feat(cli): gRPC/SSL/Traceroute typed result rendering + IaC constructs

examples/advanced-project-js/src/__checks__/uptime/grpc.check.js

@@ -0,0 +1,26 @@
+const { GrpcMonitor, GrpcAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// gRPC monitors check gRPC service health or invoke unary methods to validate responses.
+// They support HEALTH mode (standard gRPC health-check) and BEHAVIOR mode (custom method calls).
+// Read more: https://www.checklyhq.com/docs/grpc-monitors/
+
+new GrpcMonitor('grpc-api-health', {
+  name: 'gRPC API Health Monitor',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 2000,
+  maxResponseTime: 5000,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+      tls: true,
+    },
+    assertions: [
+      GrpcAssertionBuilder.healthCheckStatus().equals('SERVING'),
+      GrpcAssertionBuilder.responseTime().lessThan(1000),
+    ],
+  },
+})

examples/advanced-project-js/src/__checks__/uptime/ssl.check.js

@@ -0,0 +1,27 @@
+const { SslMonitor, SslAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// SSL monitors validate TLS certificates: expiry, chain trust, TLS version, and more.
+// Configure alertDaysBeforeExpiry to be notified before a certificate expires.
+// Read more: https://www.checklyhq.com/docs/ssl-monitors/
+
+new SslMonitor('example-com-ssl', {
+  name: 'example.com SSL Certificate',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 3000,
+  maxResponseTime: 10000,
+  request: {
+    hostname: 'example.com',
+    port: 443,
+    sslConfig: {
+      alertDaysBeforeExpiry: 30,
+    },
+    assertions: [
+      SslAssertionBuilder.certExpiresInDays().greaterThan(30),
+      SslAssertionBuilder.chainTrusted().equals(true),
+      SslAssertionBuilder.hostnameVerified().equals(true),
+      SslAssertionBuilder.tlsVersion().equals('TLS1.3'),
+    ],
+  },
+})

examples/advanced-project-js/src/__checks__/uptime/traceroute.check.js

@@ -0,0 +1,24 @@
+const { TracerouteMonitor, TracerouteAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// Traceroute monitors map the network path to a host and can detect routing issues,
+// excessive hops, or high packet loss along the path.
+// Read more: https://www.checklyhq.com/docs/traceroute-monitors/
+
+new TracerouteMonitor('example-com-traceroute', {
+  name: 'example.com Traceroute',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 10000,
+  maxResponseTime: 20000,
+  request: {
+    url: 'example.com',
+    protocol: 'TCP',
+    port: 443,
+    maxHops: 30,
+    assertions: [
+      TracerouteAssertionBuilder.hopCount().lessThan(20),
+      TracerouteAssertionBuilder.packetLoss().lessThan(10),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/grpc.check.ts

@@ -0,0 +1,26 @@
+import { GrpcMonitor, GrpcAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// gRPC monitors check gRPC service health or invoke unary methods to validate responses.
+// They support HEALTH mode (standard gRPC health-check) and BEHAVIOR mode (custom method calls).
+// Read more: https://www.checklyhq.com/docs/grpc-monitors/
+
+new GrpcMonitor('grpc-api-health', {
+  name: 'gRPC API Health Monitor',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 2000,
+  maxResponseTime: 5000,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+      tls: true,
+    },
+    assertions: [
+      GrpcAssertionBuilder.healthCheckStatus().equals('SERVING'),
+      GrpcAssertionBuilder.responseTime().lessThan(1000),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/ssl.check.ts

@@ -0,0 +1,27 @@
+import { SslMonitor, SslAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// SSL monitors validate TLS certificates: expiry, chain trust, TLS version, and more.
+// Configure alertDaysBeforeExpiry to be notified before a certificate expires.
+// Read more: https://www.checklyhq.com/docs/ssl-monitors/
+
+new SslMonitor('example-com-ssl', {
+  name: 'example.com SSL Certificate',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 3000,
+  maxResponseTime: 10000,
+  request: {
+    hostname: 'example.com',
+    port: 443,
+    sslConfig: {
+      alertDaysBeforeExpiry: 30,
+    },
+    assertions: [
+      SslAssertionBuilder.certExpiresInDays().greaterThan(30),
+      SslAssertionBuilder.chainTrusted().equals(true),
+      SslAssertionBuilder.hostnameVerified().equals(true),
+      SslAssertionBuilder.tlsVersion().equals('TLS1.3'),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/traceroute.check.ts

@@ -0,0 +1,24 @@
+import { TracerouteMonitor, TracerouteAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// Traceroute monitors map the network path to a host and can detect routing issues,
+// excessive hops, or high packet loss along the path.
+// Read more: https://www.checklyhq.com/docs/traceroute-monitors/
+
+new TracerouteMonitor('example-com-traceroute', {
+  name: 'example.com Traceroute',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 10000,
+  maxResponseTime: 20000,
+  request: {
+    url: 'example.com',
+    protocol: 'TCP',
+    port: 443,
+    maxHops: 30,
+    assertions: [
+      TracerouteAssertionBuilder.hopCount().lessThan(20),
+      TracerouteAssertionBuilder.packetLoss().lessThan(10),
+    ],
+  },
+})

packages/cli/e2e/__tests__/deploy.spec.ts

@@ -205,10 +205,13 @@ describe('deploy', { timeout: 45_000 }, () => {
     DnsMonitor: dns-nonexistent-all-assertion-types
     DnsMonitor: dns-welcome-a
     DnsMonitor: dns-welcome-aaaa
+    GrpcMonitor: grpc-monitor
     HeartbeatMonitor: heartbeat-monitor-1
     BrowserCheck: homepage-browser-check
     IcmpMonitor: icmp-welcome
+    SslMonitor: ssl-monitor
     TcpMonitor: tcp-monitor
+    TracerouteMonitor: traceroute-monitor
     CheckGroupV2: my-group-1
     CheckGroupV1: my-group-2-v1
     Dashboard: dashboard-1
@@ -227,11 +230,14 @@ describe('deploy', { timeout: 45_000 }, () => {
     DnsMonitor: dns-nonexistent-all-assertion-types
     DnsMonitor: dns-welcome-a
     DnsMonitor: dns-welcome-aaaa
+    GrpcMonitor: grpc-monitor
     HeartbeatMonitor: heartbeat-monitor-1
     BrowserCheck: homepage-browser-check
     IcmpMonitor: icmp-welcome
     BrowserCheck: snapshot-test.test.ts
+    SslMonitor: ssl-monitor
     TcpMonitor: tcp-monitor
+    TracerouteMonitor: traceroute-monitor
     CheckGroupV2: my-group-1
     CheckGroupV1: my-group-2-v1
     Dashboard: dashboard-1

packages/cli/e2e/__tests__/fixtures/deploy-project/grpc.check.ts

@@ -0,0 +1,13 @@
+import { GrpcMonitor } from 'checkly/constructs'
+
+new GrpcMonitor('grpc-monitor', {
+  name: 'gRPC Monitor',
+  activated: false,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+    },
+  },
+})

packages/cli/e2e/__tests__/fixtures/deploy-project/ssl.check.ts

@@ -0,0 +1,10 @@
+import { SslMonitor } from 'checkly/constructs'
+
+new SslMonitor('ssl-monitor', {
+  name: 'SSL Monitor',
+  activated: false,
+  request: {
+    hostname: 'example.com',
+    sslConfig: {},
+  },
+})

packages/cli/e2e/__tests__/fixtures/deploy-project/traceroute.check.ts

@@ -0,0 +1,9 @@
+import { TracerouteMonitor } from 'checkly/constructs'
+
+new TracerouteMonitor('traceroute-monitor', {
+  name: 'Traceroute Monitor',
+  activated: false,
+  request: {
+    url: 'example.com',
+  },
+})

packages/cli/src/ai-context/context.ts

@@ -35,6 +35,18 @@ export const REFERENCES = [
     id: 'configure-icmp-monitors',
     description: 'ICMP Monitor construct (`IcmpMonitor`) with latency and packet loss assertions',
   },
+  {
+    id: 'configure-grpc-monitors',
+    description: 'gRPC Monitor construct (`GrpcMonitor`) with status code, response message, and health-check assertions',
+  },
+  {
+    id: 'configure-ssl-monitors',
+    description: 'SSL Monitor construct (`SslMonitor`) with certificate expiry, chain trust, and TLS version assertions',
+  },
+  {
+    id: 'configure-traceroute-monitors',
+    description: 'Traceroute Monitor construct (`TracerouteMonitor`) with hop count and packet loss assertions',
+  },
   {
     id: 'configure-heartbeat-monitors',
     description: 'Heartbeat Monitor construct (`HeartbeatMonitor`)',
@@ -235,6 +247,83 @@ const playwrightChecks = new PlaywrightCheck("multi-browser-check", {
     exampleConfigPath: 'resources/icmp-monitors/example-icmp-monitor.check.ts',
     reference: 'https://www.checklyhq.com/docs/constructs/icmp-monitor/',
   },
+  GRPC_MONITOR: {
+    templateString: '<!-- EXAMPLE: GRPC_MONITOR -->',
+    exampleConfig: `import { GrpcMonitor, GrpcAssertionBuilder } from 'checkly/constructs'
+
+new GrpcMonitor('grpc-api-health', {
+  name: 'gRPC API Health',
+  activated: true,
+  locations: ['us-east-1', 'eu-west-1'],
+  degradedResponseTime: 2000,
+  maxResponseTime: 5000,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+      tls: true,
+    },
+    assertions: [
+      GrpcAssertionBuilder.healthCheckStatus().equals('SERVING'),
+      GrpcAssertionBuilder.responseTime().lessThan(1000),
+    ],
+  },
+})
+`,
+    reference: 'https://www.checklyhq.com/docs/constructs/grpc-monitor/',
+  },
+  SSL_MONITOR: {
+    templateString: '<!-- EXAMPLE: SSL_MONITOR -->',
+    exampleConfig: `import { SslMonitor, SslAssertionBuilder } from 'checkly/constructs'
+
+new SslMonitor('example-com-ssl', {
+  name: 'example.com SSL Certificate',
+  activated: true,
+  locations: ['us-east-1', 'eu-west-1'],
+  degradedResponseTime: 3000,
+  maxResponseTime: 10000,
+  request: {
+    hostname: 'example.com',
+    port: 443,
+    sslConfig: {
+      alertDaysBeforeExpiry: 30,
+    },
+    assertions: [
+      SslAssertionBuilder.certExpiresInDays().greaterThan(30),
+      SslAssertionBuilder.chainTrusted().equals(true),
+      SslAssertionBuilder.hostnameVerified().equals(true),
+      SslAssertionBuilder.tlsVersion().equals('TLS1.3'),
+    ],
+  },
+})
+`,
+    reference: 'https://www.checklyhq.com/docs/constructs/ssl-monitor/',
+  },
+  TRACEROUTE_MONITOR: {
+    templateString: '<!-- EXAMPLE: TRACEROUTE_MONITOR -->',
+    exampleConfig: `import { TracerouteMonitor, TracerouteAssertionBuilder } from 'checkly/constructs'
+
+new TracerouteMonitor('example-com-traceroute', {
+  name: 'example.com Traceroute',
+  activated: true,
+  locations: ['us-east-1', 'eu-west-1'],
+  degradedResponseTime: 10000,
+  maxResponseTime: 20000,
+  request: {
+    url: 'example.com',
+    protocol: 'TCP',
+    port: 443,
+    maxHops: 30,
+    assertions: [
+      TracerouteAssertionBuilder.hopCount().lessThan(20),
+      TracerouteAssertionBuilder.packetLoss().lessThan(10),
+    ],
+  },
+})
+`,
+    reference: 'https://www.checklyhq.com/docs/constructs/traceroute-monitor/',
+  },
   CHECK_GROUP: {
     templateString: '<!-- EXAMPLE: CHECK_GROUP -->',
     exampleConfigPath:

packages/cli/src/ai-context/references/configure-grpc-monitors.md

@@ -0,0 +1,13 @@
+# gRPC Monitor
+
+- Import the `GrpcMonitor` construct from `checkly/constructs`.
+- Reference [the docs for gRPC monitors](https://www.checklyhq.com/docs/constructs/grpc-monitor/) before generating any code.
+- When adding `assertions`, always use `GrpcAssertionBuilder` class.
+- The `request` object must include a `url` (hostname only, no scheme), `port`, and a `grpcConfig` object.
+- Use `grpcConfig.mode` to choose between `'BEHAVIOR'` (invoke a unary method) and `'HEALTH'` (standard health-check service).
+- In `BEHAVIOR` mode, set `grpcConfig.method` (e.g. `'package.Service/Method'`). Use `grpcConfig.serviceDefinition` (`'REFLECTION'` or `'PROTO_FILE'`) to resolve the service definition.
+- In `HEALTH` mode, optionally set `grpcConfig.service` to query a specific service; omit it to query overall server health.
+- Use `degradedResponseTime` and `maxResponseTime` (milliseconds) to configure response time thresholds.
+- **Plan-gated properties:** `retryStrategy`, `runParallel`, and higher frequencies are not available on all plans. Check entitlements matching `UPTIME_CHECKS_*` before using these. Omit any property whose entitlement is disabled. See `npx checkly skills manage` for details.
+
+<!-- EXAMPLE: GRPC_MONITOR -->

packages/cli/src/ai-context/references/configure-ssl-monitors.md

@@ -0,0 +1,14 @@
+# SSL Monitor
+
+- Import the `SslMonitor` construct from `checkly/constructs`.
+- Reference [the docs for SSL monitors](https://www.checklyhq.com/docs/constructs/ssl-monitor/) before generating any code.
+- When adding `assertions`, always use `SslAssertionBuilder` class.
+- The `request` object must include `hostname` (required, hostname only, no scheme) and a `sslConfig` object.
+- Use `request.port` to set the port (default: 443). Use `request.ipFamily` to choose `'IPv4'` or `'IPv6'`.
+- Use `sslConfig.alertDaysBeforeExpiry` to raise an alert before the certificate expires (default: 20 days).
+- Use top-level `degradedResponseTime` and `maxResponseTime` (on `SslMonitorProps`) to configure TLS handshake time thresholds.
+- Use `sslConfig.securityBaseline` to enforce TLS version, key size, cipher suite, and other certificate quality rules.
+- For mutual TLS, set `sslConfig.clientCertificateMode` to `'auto'` or `'explicit'`. When `'explicit'`, also set `sslConfig.sslClientCertificateId`.
+- **Plan-gated properties:** `retryStrategy`, `runParallel`, and higher frequencies are not available on all plans. Check entitlements matching `UPTIME_CHECKS_*` before using these. Omit any property whose entitlement is disabled. See `npx checkly skills manage` for details.
+
+<!-- EXAMPLE: SSL_MONITOR -->

packages/cli/src/ai-context/references/configure-traceroute-monitors.md

@@ -0,0 +1,13 @@
+# Traceroute Monitor
+
+- Import the `TracerouteMonitor` construct from `checkly/constructs`.
+- Reference [the docs for Traceroute monitors](https://www.checklyhq.com/docs/constructs/traceroute-monitor/) before generating any code.
+- When adding `assertions`, always use `TracerouteAssertionBuilder` class.
+- The `request` object must include a `url` field (hostname only, no scheme or port).
+- Use `request.protocol` to choose the probe protocol: `'TCP'` (default), `'UDP'`, `'ICMP'`, or `'SCTP'`.
+- Use `request.maxHops` (default: 30) and `request.maxUnknownHops` (default: 15) to control trace depth.
+- Use `degradedResponseTime` and `maxResponseTime` (milliseconds) to configure response time thresholds.
+- Traceroute assertions support `RESPONSE_TIME`, `HOP_COUNT`, and `PACKET_LOSS` sources.
+- **Plan-gated properties:** `retryStrategy`, `runParallel`, and higher frequencies are not available on all plans. Check entitlements matching `UPTIME_CHECKS_*` before using these. Omit any property whose entitlement is disabled. See `npx checkly skills manage` for details.
+
+<!-- EXAMPLE: TRACEROUTE_MONITOR -->

packages/cli/src/commands/deploy.ts

@@ -193,14 +193,20 @@ export default class Deploy extends AuthCommand {
     const archive = await bundler.finalize()
     bundler.updateMarker(archive.archiveFile)
 
-    this.style.actionStart('Uploading Playwright tests')
-    try {
-      const storedArchive = await archive.store()
-      bundler.updateMarker(storedArchive.key)
-      this.style.actionSuccess()
-    } catch (err) {
-      this.style.actionFailure()
-      throw err
+    // The remote code bundle is only consumed by Playwright check suites (via
+    // bundler.marker). If nothing registered files to bundle (e.g. a project of
+    // only uptime monitors), there is nothing to upload — skip the store() to
+    // avoid an unnecessary code-bundle upload.
+    if (!bundler.isEmpty) {
+      this.style.actionStart('Uploading Playwright tests')
+      try {
+        const storedArchive = await archive.store()
+        bundler.updateMarker(storedArchive.key)
+        this.style.actionSuccess()
+      } catch (err) {
+        this.style.actionFailure()
+        throw err
+      }
     }
 
     const bundledChecksByType = {