import { Assertion as CoreAssertion, GeneralAssertionBuilder, NumericAssertionBuilder } from './internal/assertion.js'; import { PropertyOperators } from './internal/assertion-grammar.js'; import { certificateGrammar, connectionGrammar } from './ssl-assertion-grammar.js'; /** * Known TLS protocol versions for use as a target of the `tlsVersion` property on * the {@link SslAssertionBuilder.connection} builder. * * @example * ```typescript * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3) * ``` */ export declare const TlsVersion: { readonly TLS1_0: "TLS1.0"; readonly TLS1_1: "TLS1.1"; readonly TLS1_2: "TLS1.2"; readonly TLS1_3: "TLS1.3"; }; export type TlsVersionValue = (typeof TlsVersion)[keyof typeof TlsVersion]; /** * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`. * These are the exact values the SSL runner evaluates assertions against — use these * constants (or the string literals they represent) as a target of the * `signatureAlgorithm` property on the {@link SslAssertionBuilder.certificate} builder. * * @example * ```typescript * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA) * ``` */ export declare const SignatureAlgorithm: { readonly MD2_RSA: "MD2-RSA"; readonly MD5_RSA: "MD5-RSA"; readonly SHA1_RSA: "SHA1-RSA"; readonly SHA256_RSA: "SHA256-RSA"; readonly SHA384_RSA: "SHA384-RSA"; readonly SHA512_RSA: "SHA512-RSA"; readonly SHA256_RSAPSS: "SHA256-RSAPSS"; readonly SHA384_RSAPSS: "SHA384-RSAPSS"; readonly SHA512_RSAPSS: "SHA512-RSAPSS"; readonly DSA_SHA1: "DSA-SHA1"; readonly DSA_SHA256: "DSA-SHA256"; readonly ECDSA_SHA1: "ECDSA-SHA1"; readonly ECDSA_SHA256: "ECDSA-SHA256"; readonly ECDSA_SHA384: "ECDSA-SHA384"; readonly ECDSA_SHA512: "ECDSA-SHA512"; readonly ED25519: "Ed25519"; }; export type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm]; /** * Commonly-used IANA cipher suite names for use as a target of the `cipherSuite` * property on the {@link SslAssertionBuilder.connection} builder. Includes TLS 1.3 * suites and widely-deployed TLS 1.2 suites. * * @example * ```typescript * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384) * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) * ``` */ export declare const CipherSuite: { readonly TLS_AES_128_GCM_SHA256: "TLS_AES_128_GCM_SHA256"; readonly TLS_AES_256_GCM_SHA384: "TLS_AES_256_GCM_SHA384"; readonly TLS_CHACHA20_POLY1305_SHA256: "TLS_CHACHA20_POLY1305_SHA256"; readonly TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; readonly TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; readonly TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"; readonly TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"; readonly TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"; readonly TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"; readonly TLS_RSA_WITH_AES_128_GCM_SHA256: "TLS_RSA_WITH_AES_128_GCM_SHA256"; readonly TLS_RSA_WITH_AES_256_GCM_SHA384: "TLS_RSA_WITH_AES_256_GCM_SHA384"; readonly TLS_RSA_WITH_AES_128_CBC_SHA256: "TLS_RSA_WITH_AES_128_CBC_SHA256"; readonly TLS_RSA_WITH_AES_256_CBC_SHA256: "TLS_RSA_WITH_AES_256_CBC_SHA256"; readonly TLS_RSA_WITH_AES_128_CBC_SHA: "TLS_RSA_WITH_AES_128_CBC_SHA"; readonly TLS_RSA_WITH_AES_256_CBC_SHA: "TLS_RSA_WITH_AES_256_CBC_SHA"; }; export type CipherSuiteValue = (typeof CipherSuite)[keyof typeof CipherSuite]; type SslAssertionSource = 'CERTIFICATE' | 'CONNECTION' | 'RESPONSE_TIME' | 'JSON_RESPONSE' | 'TEXT_RESPONSE'; export type SslAssertion = CoreAssertion; /** The certificate properties an assertion can be made against. */ export type SslCertificateProperty = keyof typeof certificateGrammar; /** The connection properties an assertion can be made against. */ export type SslConnectionProperty = keyof typeof connectionGrammar; /** * Builder class for creating SSL monitor assertions. * * Assertions are property-scoped: {@link certificate} and {@link connection} take the * name of a certificate/connection property, {@link jsonResponse} takes a JSONPath and * {@link textResponse} an optional regex. The comparison operators the backend accepts * depend on the property's value type and are validated at deploy time. * * @example * ```typescript * // Certificate facts, addressed by property name * SslAssertionBuilder.certificate('daysUntilExpiry').greaterThan(30) * SslAssertionBuilder.certificate('issuerCN').contains("Let's Encrypt") * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA) * SslAssertionBuilder.certificate('selfSigned').equals(false) * * // Connection / handshake facts * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3) * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384) * SslAssertionBuilder.connection('chainTrusted').equals(true) * * // Response time, JSON and text responses * SslAssertionBuilder.responseTime().lessThan(1000) * SslAssertionBuilder.jsonResponse('$.status').equals('ok') * SslAssertionBuilder.textResponse().contains('healthy') * ``` */ export declare class SslAssertionBuilder { /** * Creates an assertion builder for a certificate property. * @param property The certificate property to assert on (e.g. `'daysUntilExpiry'`, * `'issuerCN'`, `'signatureAlgorithm'`, `'sans'`, `'selfSigned'`). */ static certificate(property: Property): PropertyOperators<'CERTIFICATE', typeof certificateGrammar[Property]>; /** * Creates an assertion builder for a connection property. * @param property The connection property to assert on (e.g. `'tlsVersion'`, * `'cipherSuite'`, `'hostnameVerified'`, `'ocspStatus'`, `'resolvedIp'`). */ static connection(property: Property): PropertyOperators<'CONNECTION', typeof connectionGrammar[Property]>; /** * Creates an assertion builder for the TLS handshake response time in milliseconds. */ static responseTime(): NumericAssertionBuilder; /** * Creates an assertion builder for a JSON response body. * @param property Optional JSONPath to a specific value (e.g. `'$.status'`). */ static jsonResponse(property?: string): GeneralAssertionBuilder; /** * Creates an assertion builder for a text response body. * @param regex Optional regex pattern (with a capture group) used to extract the value * to compare from the serialized response document. Carried in the assertion's * `property` field — the slot the backend and runner read the pattern from. */ static textResponse(regex?: string): GeneralAssertionBuilder; } export {};