@riddledc/riddle-proof 0.7.94 → 0.7.96

package/README.md

@@ -479,6 +479,8 @@ artifact links should fail the profile:
   "expected_count": 88,
   "same_origin_only": true,
   "require_nonzero_bytes": true,
+  "min_bytes": 32,
+  "allowed_content_types": ["image/*", "application/json"],
   "max_links": 150
 }
 ```
@@ -486,9 +488,12 @@ artifact links should fail the profile:
 The check defaults to `a[href]`, deduplicates URLs, probes up to 100 selected
 URLs, and treats HTTP `2xx` / `3xx` responses as healthy. Use
 `allowed_statuses` or `expected_status` when a narrower status contract is
-intentional, `min_count` for lower-bound audits, and `max_links` when the
-selected set is intentionally larger than 100. `artifact_link_status` is an
-alias with the same behavior for profiles that want artifact-specific wording.
+intentional, `min_count` for lower-bound audits, `min_bytes` when a one-byte
+range response is too weak, `allowed_content_types` for MIME checks, and
+`max_links` when the selected set is intentionally larger than 100.
+`allowed_content_types` accepts exact types and family wildcards such as
+`image/*`. `artifact_link_status` is an alias with the same behavior for
+profiles that want artifact-specific wording.
 
 Use the `route_inventory` check for source-page route coverage audits where a
 navigation surface must expose a known set of routes and each route must load

package/dist/{chunk-FQ4QBY2N.js → chunk-G3UY3SHZ.js}

@@ -785,6 +785,12 @@ function normalizeCheck(input, index) {
     `checks[${index}] allowed_statuses`
   ) : void 0;
   const maxLinks = isLinkStatusCheck ? normalizePositiveInteger(input.max_links ?? input.maxLinks ?? input.limit, `checks[${index}] max_links`, 500) : void 0;
+  const minBytes = isLinkStatusCheck ? normalizePositiveInteger(input.min_bytes ?? input.minBytes ?? input.min_response_bytes ?? input.minResponseBytes, `checks[${index}] min_bytes`) : void 0;
+  const expectedContentType = isLinkStatusCheck ? stringValue(input.expected_content_type) || stringValue(input.expectedContentType) || stringValue(input.content_type) || stringValue(input.contentType) : void 0;
+  const allowedContentTypes = isLinkStatusCheck ? normalizeStringList(
+    input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
+    `checks[${index}] allowed_content_types`
+  ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -826,6 +832,8 @@ function normalizeCheck(input, index) {
     same_origin_only: isLinkStatusCheck ? input.same_origin_only === true || input.sameOriginOnly === true : void 0,
     dedupe: isLinkStatusCheck ? input.dedupe === false ? false : true : void 0,
     require_nonzero_bytes: isLinkStatusCheck ? input.require_nonzero_bytes === true || input.requireNonzeroBytes === true : void 0,
+    min_bytes: minBytes,
+    allowed_content_types: allowedContentTypes,
     allow_get_fallback: isLinkStatusCheck ? input.allow_get_fallback === false || input.allowGetFallback === false ? false : true : void 0,
     max_overflow_px: numberValue(input.max_overflow_px),
     timeout_ms: numberValue(input.timeout_ms) ?? numberValue(input.timeoutMs),
@@ -932,15 +940,40 @@ function linkStatusIsAllowed(status, check) {
   const allowed = linkStatusAllowedStatuses(check);
   return allowed?.length ? allowed.includes(status) : status >= 200 && status < 400;
 }
+function linkStatusObservedBytes(result) {
+  const bytes = numberValue(result.bytes);
+  const contentLength = numberValue(result.content_length);
+  return Math.max(bytes ?? 0, contentLength ?? 0) || void 0;
+}
+function normalizeLinkStatusContentType(value) {
+  const normalized = value?.split(";")[0]?.trim().toLowerCase();
+  return normalized || void 0;
+}
+function linkStatusContentTypeOk(result, check) {
+  const expected = check.allowed_content_types;
+  if (!expected?.length) return true;
+  const actual = normalizeLinkStatusContentType(stringValue(result.content_type));
+  if (!actual) return false;
+  return expected.some((contentType) => {
+    const normalized = normalizeLinkStatusContentType(contentType);
+    if (!normalized) return false;
+    if (normalized.endsWith("/*")) return actual.startsWith(normalized.slice(0, -1));
+    return actual === normalized;
+  });
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue(result.status);
   if (!linkStatusIsAllowed(status, check)) return false;
   if (stringValue(result.error)) return false;
   if (result.ok === false) return false;
+  if (!linkStatusContentTypeOk(result, check)) return false;
   if (check.require_nonzero_bytes) {
-    const bytes = numberValue(result.bytes);
-    const contentLength = numberValue(result.content_length);
-    return bytes !== void 0 && bytes > 0 || contentLength !== void 0 && contentLength > 0;
+    const observedBytes = linkStatusObservedBytes(result);
+    if (observedBytes === void 0 || observedBytes <= 0) return false;
+  }
+  if (check.min_bytes !== void 0) {
+    const observedBytes = linkStatusObservedBytes(result);
+    if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
   return true;
 }
@@ -962,6 +995,10 @@ function summarizeLinkStatusEvidence(viewport, check) {
   }
   const results = Array.isArray(linkEvidence.results) ? linkEvidence.results.filter(isRecord) : [];
   const totalCount = numberValue(linkEvidence.total_count) ?? results.length;
+  const resultCount = numberValue(linkEvidence.result_count) ?? totalCount;
+  const storedResultCount = numberValue(linkEvidence.stored_result_count) ?? results.length;
+  const omittedResultCount = numberValue(linkEvidence.omitted_result_count) ?? Math.max(0, resultCount - storedResultCount);
+  const omittedSuccessCount = numberValue(linkEvidence.omitted_success_count) ?? 0;
   const okCount = results.filter((result) => linkStatusResultOk(result, check)).length;
   const failures = results.filter((result) => !linkStatusResultOk(result, check)).map((result) => ({
     code: "link_status_failed",
@@ -969,7 +1006,10 @@ function summarizeLinkStatusEvidence(viewport, check) {
     status: numberValue(result.status) ?? null,
     method: stringValue(result.method) ?? null,
     error: stringValue(result.error) ?? null,
-    bytes: numberValue(result.bytes) ?? numberValue(result.content_length) ?? null
+    content_type: stringValue(result.content_type) ?? null,
+    bytes: linkStatusObservedBytes(result) ?? null,
+    min_bytes: check.min_bytes ?? null,
+    allowed_content_types: check.allowed_content_types ?? null
   }));
   if (stringValue(linkEvidence.error)) {
     failures.push({ code: "link_status_capture_failed", error: stringValue(linkEvidence.error) ?? "" });
@@ -1006,6 +1046,13 @@ function summarizeLinkStatusEvidence(viewport, check) {
     failed_count: failures.length,
     truncated: linkEvidence.truncated === true,
     max_links: numberValue(linkEvidence.max_links) ?? check.max_links ?? 100,
+    result_count: resultCount,
+    stored_result_count: storedResultCount,
+    omitted_result_count: omittedResultCount,
+    omitted_success_count: omittedSuccessCount,
+    results_compacted: linkEvidence.results_compacted === true || omittedResultCount > 0,
+    min_bytes: check.min_bytes ?? null,
+    allowed_content_types: check.allowed_content_types ?? null,
     status_counts: statusCounts,
     failures: failures.slice(0, 20)
   };
@@ -1534,6 +1581,8 @@ function assessCheckFromEvidence(check, evidence) {
         min_count: check.min_count ?? null,
         allowed_statuses: linkStatusAllowedStatuses(check) || ["2xx", "3xx"],
         require_nonzero_bytes: check.require_nonzero_bytes === true,
+        min_bytes: check.min_bytes ?? null,
+        allowed_content_types: check.allowed_content_types ?? null,
         viewports: summaries.map((summary) => toJsonValue(summary)),
         failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue(summary.viewport) ?? null, failure })) : [])
       },
@@ -2137,15 +2186,41 @@ function linkStatusIsAllowed(status, check) {
   const allowed = linkStatusAllowedStatuses(check);
   return Array.isArray(allowed) && allowed.length ? allowed.includes(status) : status >= 200 && status < 400;
 }
+function linkStatusObservedBytes(result) {
+  const bytes = typeof result.bytes === "number" && Number.isFinite(result.bytes) ? result.bytes : undefined;
+  const contentLength = typeof result.content_length === "number" && Number.isFinite(result.content_length) ? result.content_length : undefined;
+  const observed = Math.max(bytes || 0, contentLength || 0);
+  return observed > 0 ? observed : undefined;
+}
+function normalizeLinkStatusContentType(value) {
+  if (typeof value !== "string") return undefined;
+  const normalized = (value.split(";")[0] || "").trim().toLowerCase();
+  return normalized || undefined;
+}
+function linkStatusContentTypeOk(result, check) {
+  if (!Array.isArray(check.allowed_content_types) || !check.allowed_content_types.length) return true;
+  const actual = normalizeLinkStatusContentType(result.content_type);
+  if (!actual) return false;
+  return check.allowed_content_types.some((contentType) => {
+    const normalized = normalizeLinkStatusContentType(contentType);
+    if (!normalized) return false;
+    if (normalized.endsWith("/*")) return actual.startsWith(normalized.slice(0, -1));
+    return actual === normalized;
+  });
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
   if (!linkStatusIsAllowed(result.status, check)) return false;
   if (typeof result.error === "string" && result.error.trim()) return false;
   if (result.ok === false) return false;
+  if (!linkStatusContentTypeOk(result, check)) return false;
   if (check.require_nonzero_bytes === true) {
-    const bytes = typeof result.bytes === "number" && Number.isFinite(result.bytes) ? result.bytes : undefined;
-    const contentLength = typeof result.content_length === "number" && Number.isFinite(result.content_length) ? result.content_length : undefined;
-    return (bytes !== undefined && bytes > 0) || (contentLength !== undefined && contentLength > 0);
+    const observedBytes = linkStatusObservedBytes(result);
+    if (observedBytes === undefined || observedBytes <= 0) return false;
+  }
+  if (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) {
+    const observedBytes = linkStatusObservedBytes(result);
+    if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
   return true;
 }
@@ -2164,6 +2239,10 @@ function summarizeLinkStatusEvidence(viewport, check) {
   }
   const results = Array.isArray(linkEvidence.results) ? linkEvidence.results.filter((result) => result && typeof result === "object" && !Array.isArray(result)) : [];
   const totalCount = typeof linkEvidence.total_count === "number" && Number.isFinite(linkEvidence.total_count) ? linkEvidence.total_count : results.length;
+  const resultCount = typeof linkEvidence.result_count === "number" && Number.isFinite(linkEvidence.result_count) ? linkEvidence.result_count : totalCount;
+  const storedResultCount = typeof linkEvidence.stored_result_count === "number" && Number.isFinite(linkEvidence.stored_result_count) ? linkEvidence.stored_result_count : results.length;
+  const omittedResultCount = typeof linkEvidence.omitted_result_count === "number" && Number.isFinite(linkEvidence.omitted_result_count) ? linkEvidence.omitted_result_count : Math.max(0, resultCount - storedResultCount);
+  const omittedSuccessCount = typeof linkEvidence.omitted_success_count === "number" && Number.isFinite(linkEvidence.omitted_success_count) ? linkEvidence.omitted_success_count : 0;
   const okCount = results.filter((result) => linkStatusResultOk(result, check)).length;
   const failures = results
     .filter((result) => !linkStatusResultOk(result, check))
@@ -2173,11 +2252,10 @@ function summarizeLinkStatusEvidence(viewport, check) {
       status: typeof result.status === "number" && Number.isFinite(result.status) ? result.status : null,
       method: typeof result.method === "string" ? result.method : null,
       error: typeof result.error === "string" ? result.error : null,
-      bytes: typeof result.bytes === "number" && Number.isFinite(result.bytes)
-        ? result.bytes
-        : typeof result.content_length === "number" && Number.isFinite(result.content_length)
-          ? result.content_length
-          : null,
+      content_type: typeof result.content_type === "string" ? result.content_type : null,
+      bytes: linkStatusObservedBytes(result) ?? null,
+      min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+      allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
     }));
   if (typeof linkEvidence.error === "string" && linkEvidence.error.trim()) {
     failures.push({ code: "link_status_capture_failed", error: linkEvidence.error });
@@ -2212,6 +2290,13 @@ function summarizeLinkStatusEvidence(viewport, check) {
     failed_count: failures.length,
     truncated: linkEvidence.truncated === true,
     max_links: typeof linkEvidence.max_links === "number" ? linkEvidence.max_links : check.max_links || 100,
+    result_count: resultCount,
+    stored_result_count: storedResultCount,
+    omitted_result_count: omittedResultCount,
+    omitted_success_count: omittedSuccessCount,
+    results_compacted: linkEvidence.results_compacted === true || omittedResultCount > 0,
+    min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+    allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
     status_counts: linkEvidence.status_counts && typeof linkEvidence.status_counts === "object" && !Array.isArray(linkEvidence.status_counts) ? linkEvidence.status_counts : {},
     failures: failures.slice(0, 20),
   };
@@ -2908,6 +2993,8 @@ function assessProfile(profile, evidence) {
           min_count: check.min_count ?? null,
           allowed_statuses: linkStatusAllowedStatuses(check) || ["2xx", "3xx"],
           require_nonzero_bytes: check.require_nonzero_bytes === true,
+          min_bytes: check.min_bytes ?? null,
+          allowed_content_types: check.allowed_content_types ?? null,
           viewports: summaries,
           failures: failed.flatMap((summary) => Array.isArray(summary.failures)
             ? summary.failures.map((failure) => ({ viewport: summary.viewport || null, failure }))
@@ -4055,6 +4142,28 @@ function linkProbeAllowed(status, check) {
       : null;
   return allowed ? allowed.includes(status) : status >= 200 && status < 400;
 }
+function linkProbeObservedBytes(result) {
+  const bytes = typeof result.bytes === "number" && Number.isFinite(result.bytes) ? result.bytes : undefined;
+  const contentLength = typeof result.content_length === "number" && Number.isFinite(result.content_length) ? result.content_length : undefined;
+  const observed = Math.max(bytes || 0, contentLength || 0);
+  return observed > 0 ? observed : undefined;
+}
+function normalizeLinkProbeContentType(value) {
+  if (typeof value !== "string") return undefined;
+  const normalized = (value.split(";")[0] || "").trim().toLowerCase();
+  return normalized || undefined;
+}
+function linkProbeContentTypeAllowed(result, check) {
+  if (!Array.isArray(check.allowed_content_types) || !check.allowed_content_types.length) return true;
+  const actual = normalizeLinkProbeContentType(result.content_type);
+  if (!actual) return false;
+  return check.allowed_content_types.some((contentType) => {
+    const normalized = normalizeLinkProbeContentType(contentType);
+    if (!normalized) return false;
+    if (normalized.endsWith("/*")) return actual.startsWith(normalized.slice(0, -1));
+    return actual === normalized;
+  });
+}
 function linkProbeResponseFields(response, method) {
   const contentLengthHeader = response.headers && typeof response.headers.get === "function" ? response.headers.get("content-length") : null;
   const contentLength = contentLengthHeader && /^\d+$/.test(contentLengthHeader) ? Number(contentLengthHeader) : null;
@@ -4069,6 +4178,7 @@ function linkProbeResponseFields(response, method) {
 }
 async function probeLinkStatus(candidate, check) {
   const requireNonzeroBytes = check.require_nonzero_bytes === true;
+  const minBytes = typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? Math.max(1, Math.floor(check.min_bytes)) : null;
   const allowGetFallback = check.allow_get_fallback !== false;
   const result = {
     url: candidate.url,
@@ -4086,7 +4196,7 @@ async function probeLinkStatus(candidate, check) {
   };
   const applyResponse = async (response, method, readBytes) => {
     Object.assign(result, linkProbeResponseFields(response, method));
-    if (readBytes || requireNonzeroBytes) {
+    if (readBytes) {
       try {
         const buffer = await response.arrayBuffer();
         result.bytes = buffer.byteLength;
@@ -4095,7 +4205,9 @@ async function probeLinkStatus(candidate, check) {
       }
     }
     result.ok = linkProbeAllowed(result.status, check)
-      && (!requireNonzeroBytes || (typeof result.bytes === "number" ? result.bytes > 0 : typeof result.content_length === "number" && result.content_length > 0))
+      && linkProbeContentTypeAllowed(result, check)
+      && (!requireNonzeroBytes || ((linkProbeObservedBytes(result) || 0) > 0))
+      && (minBytes === null || ((linkProbeObservedBytes(result) || 0) >= minBytes))
       && !result.error;
   };
   try {
@@ -4112,9 +4224,9 @@ async function probeLinkStatus(candidate, check) {
       method: "GET",
       redirect: "follow",
       cache: "no-store",
-      headers: { Range: "bytes=0-0" },
+      headers: { Range: "bytes=0-" + String((minBytes || 1) - 1) },
     });
-    await applyResponse(response, "GET", requireNonzeroBytes);
+    await applyResponse(response, "GET", requireNonzeroBytes || minBytes !== null);
     return result;
   } catch (error) {
     result.error = String(error && error.message ? error.message : error).slice(0, 500);
@@ -4122,6 +4234,30 @@ async function probeLinkStatus(candidate, check) {
     return result;
   }
 }
+function compactLinkProbeResults(results) {
+  const allResults = Array.isArray(results) ? results : [];
+  if (allResults.length <= 20) {
+    return {
+      result_count: allResults.length,
+      stored_result_count: allResults.length,
+      omitted_result_count: 0,
+      omitted_success_count: 0,
+      results_compacted: false,
+      results: allResults,
+    };
+  }
+  const successResults = allResults.filter((result) => result && result.ok);
+  const sampledSuccesses = new Set(successResults.slice(0, 5));
+  const storedResults = allResults.filter((result) => result && (!result.ok || sampledSuccesses.has(result)));
+  return {
+    result_count: allResults.length,
+    stored_result_count: storedResults.length,
+    omitted_result_count: allResults.length - storedResults.length,
+    omitted_success_count: Math.max(0, successResults.length - sampledSuccesses.size),
+    results_compacted: storedResults.length < allResults.length,
+    results: storedResults,
+  };
+}
 async function collectLinkStatus(check) {
   const selector = linkStatusSelector(check);
   const candidateResult = await collectLinkCandidates(selector);
@@ -4168,13 +4304,17 @@ async function collectLinkStatus(check) {
     status: result.status,
     method: result.method,
     error: result.error,
-    bytes: result.bytes == null ? result.content_length : result.bytes,
+    content_type: result.content_type,
+    bytes: linkProbeObservedBytes(result) || null,
+    min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+    allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
   }));
   const statusCounts = {};
   for (const result of results) {
     const key = result.status == null ? "error" : String(result.status);
     statusCounts[key] = (statusCounts[key] || 0) + 1;
   }
+  const compactedResults = compactLinkProbeResults(results);
   return {
     version: "riddle-proof.link-status.v1",
     selector,
@@ -4182,6 +4322,8 @@ async function collectLinkStatus(check) {
     same_origin_only: linkProbeSameOriginOnly(check),
     dedupe: linkProbeDedupe(check),
     require_nonzero_bytes: check.require_nonzero_bytes === true,
+    min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+    allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
     allowed_statuses: Array.isArray(check.allowed_statuses) && check.allowed_statuses.length
       ? check.allowed_statuses
       : typeof check.expected_status === "number"
@@ -4194,7 +4336,7 @@ async function collectLinkStatus(check) {
     failed_count: failures.length,
     status_counts: statusCounts,
     failures: failures.slice(0, 20),
-    results,
+    ...compactedResults,
   };
 }
 async function frameEvidence(selector) {