@riddledc/riddle-proof 0.7.97 → 0.7.99

package/dist/profile.cjs

@@ -72,6 +72,7 @@ var RIDDLE_PROOF_PROFILE_CHECK_TYPES = [
   "frame_no_horizontal_overflow",
   "text_visible",
   "text_absent",
+  "http_status",
   "link_status",
   "artifact_link_status",
   "route_inventory",
@@ -821,19 +822,34 @@ function normalizeCheck(input, index) {
   if (type === "route_inventory" && !expectedRoutes?.length) {
     throw new Error(`checks[${index}] route_inventory requires expected_routes.`);
   }
+  const isHttpStatusCheck = type === "http_status";
   const isLinkStatusCheck = type === "link_status" || type === "artifact_link_status";
-  const expectedStatus = isLinkStatusCheck ? normalizeHttpStatus(input.expected_status ?? input.expectedStatus ?? input.status, `checks[${index}] expected_status`) : void 0;
-  const allowedStatuses = isLinkStatusCheck ? normalizeHttpStatuses(
+  const isStatusCheck = isHttpStatusCheck || isLinkStatusCheck;
+  const requestUrl = stringFromOwn(input, "url", "endpoint_url", "endpointUrl", "endpoint", "request_url", "requestUrl", "path");
+  if (isHttpStatusCheck && !requestUrl) {
+    throw new Error(`checks[${index}] http_status requires url.`);
+  }
+  const method = stringFromOwn(input, "method", "http_method", "httpMethod")?.toUpperCase();
+  if (isHttpStatusCheck && method && !/^[A-Z]+$/.test(method)) {
+    throw new Error(`checks[${index}] http_status method must contain only letters.`);
+  }
+  const hasBodyJson = hasOwn(input, "body_json") || hasOwn(input, "bodyJson") || hasOwn(input, "json");
+  const expectedStatus = isStatusCheck ? normalizeHttpStatus(input.expected_status ?? input.expectedStatus ?? input.status, `checks[${index}] expected_status`) : void 0;
+  const allowedStatuses = isStatusCheck ? normalizeHttpStatuses(
     input.allowed_statuses ?? input.allowedStatuses ?? input.expected_statuses ?? input.expectedStatuses,
     `checks[${index}] allowed_statuses`
   ) : void 0;
   const maxLinks = isLinkStatusCheck ? normalizePositiveInteger(input.max_links ?? input.maxLinks ?? input.limit, `checks[${index}] max_links`, 500) : void 0;
-  const minBytes = isLinkStatusCheck ? normalizePositiveInteger(input.min_bytes ?? input.minBytes ?? input.min_response_bytes ?? input.minResponseBytes, `checks[${index}] min_bytes`) : void 0;
-  const expectedContentType = isLinkStatusCheck ? stringValue(input.expected_content_type) || stringValue(input.expectedContentType) || stringValue(input.content_type) || stringValue(input.contentType) : void 0;
-  const allowedContentTypes = isLinkStatusCheck ? normalizeStringList(
+  const minBytes = isStatusCheck ? normalizePositiveInteger(input.min_bytes ?? input.minBytes ?? input.min_response_bytes ?? input.minResponseBytes, `checks[${index}] min_bytes`) : void 0;
+  const expectedContentType = isStatusCheck ? stringValue(input.expected_content_type) || stringValue(input.expectedContentType) || stringValue(input.content_type) || stringValue(input.contentType) : void 0;
+  const allowedContentTypes = isStatusCheck ? normalizeStringList(
     input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
     `checks[${index}] allowed_content_types`
   ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
+  const bodyContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_contains ?? input.bodyContains ?? input.expected_body_contains ?? input.expectedBodyContains ?? input.response_body_contains ?? input.responseBodyContains ?? input.body_includes ?? input.bodyIncludes,
+    `checks[${index}] body_contains`
+  ) : void 0;
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -851,6 +867,12 @@ function normalizeCheck(input, index) {
     expected_url: expectedUrl,
     expected_routes: expectedRoutes,
     selector: stringValue(input.selector),
+    url: isHttpStatusCheck ? requestUrl : void 0,
+    method: isHttpStatusCheck ? method || "GET" : void 0,
+    headers: isHttpStatusCheck ? stringRecord(input.headers) : void 0,
+    body: isHttpStatusCheck ? stringValue(input.body) : void 0,
+    body_json: isHttpStatusCheck && hasBodyJson ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : void 0,
+    body_contains: bodyContains,
     expected_texts: expectedTexts,
     link_selector: stringValue(input.link_selector) || stringValue(input.linkSelector),
     source_selector: stringValue(input.source_selector) || stringValue(input.sourceSelector),
@@ -874,7 +896,7 @@ function normalizeCheck(input, index) {
     max_links: maxLinks,
     same_origin_only: isLinkStatusCheck ? input.same_origin_only === true || input.sameOriginOnly === true : void 0,
     dedupe: isLinkStatusCheck ? input.dedupe === false ? false : true : void 0,
-    require_nonzero_bytes: isLinkStatusCheck ? input.require_nonzero_bytes === true || input.requireNonzeroBytes === true : void 0,
+    require_nonzero_bytes: isStatusCheck ? input.require_nonzero_bytes === true || input.requireNonzeroBytes === true : void 0,
     min_bytes: minBytes,
     allowed_content_types: allowedContentTypes,
     allow_get_fallback: isLinkStatusCheck ? input.allow_get_fallback === false || input.allowGetFallback === false ? false : true : void 0,
@@ -973,14 +995,32 @@ function selectorKey(check) {
 function linkStatusSelector(check) {
   return check.selector || check.link_selector || "a[href]";
 }
-function linkStatusAllowedStatuses(check) {
+function httpStatusRequestUrl(check, baseUrl) {
+  const rawUrl = check.url || "";
+  if (!rawUrl) return "";
+  try {
+    return baseUrl ? new URL(rawUrl, baseUrl).href : new URL(rawUrl).href;
+  } catch {
+    return rawUrl;
+  }
+}
+function httpStatusMethod(check) {
+  return (check.method || "GET").toUpperCase();
+}
+function httpStatusKey(check, baseUrl) {
+  return `${httpStatusMethod(check)} ${httpStatusRequestUrl(check, baseUrl)}`;
+}
+function httpStatusAllowedStatuses(check) {
   if (check.allowed_statuses?.length) return check.allowed_statuses;
   if (check.expected_status !== void 0) return [check.expected_status];
   return void 0;
 }
-function linkStatusIsAllowed(status, check) {
+function linkStatusAllowedStatuses(check) {
+  return httpStatusAllowedStatuses(check);
+}
+function httpStatusIsAllowed(status, check) {
   if (status === void 0) return false;
-  const allowed = linkStatusAllowedStatuses(check);
+  const allowed = httpStatusAllowedStatuses(check);
   return allowed?.length ? allowed.includes(status) : status >= 200 && status < 400;
 }
 function linkStatusObservedBytes(result) {
@@ -1004,9 +1044,15 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = check.body_contains?.filter(Boolean) ?? [];
+  if (!expected.length) return [];
+  const observed = isRecord(result.body_contains) ? result.body_contains : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue(result.status);
-  if (!linkStatusIsAllowed(status, check)) return false;
+  if (!httpStatusIsAllowed(status, check)) return false;
   if (stringValue(result.error)) return false;
   if (result.ok === false) return false;
   if (!linkStatusContentTypeOk(result, check)) return false;
@@ -1018,8 +1064,64 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
+function httpStatusEvidenceForCheck(viewport, check) {
+  const evidence = viewport.http_statuses?.[httpStatusKey(check, viewport.url)];
+  return isRecord(evidence) ? evidence : void 0;
+}
+function summarizeHttpStatusEvidence(viewport, check) {
+  const key = httpStatusKey(check, viewport.url);
+  const statusEvidence = httpStatusEvidenceForCheck(viewport, check);
+  if (!statusEvidence) {
+    return {
+      viewport: viewport.name,
+      key,
+      url: httpStatusRequestUrl(check, viewport.url),
+      method: httpStatusMethod(check),
+      ok: false,
+      status: null,
+      failures: [{ code: "http_status_evidence_missing" }]
+    };
+  }
+  const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  if (!linkStatusResultOk(statusEvidence, check)) {
+    failures.push({
+      code: "http_status_failed",
+      url: stringValue(statusEvidence.url) ?? httpStatusRequestUrl(check, viewport.url),
+      status: numberValue(statusEvidence.status) ?? null,
+      method: stringValue(statusEvidence.method) ?? httpStatusMethod(check),
+      error: stringValue(statusEvidence.error) ?? null,
+      content_type: stringValue(statusEvidence.content_type) ?? null,
+      bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+      allowed_statuses: httpStatusAllowedStatuses(check) ?? ["2xx", "3xx"],
+      min_bytes: check.min_bytes ?? null,
+      allowed_content_types: check.allowed_content_types ?? null,
+      body_contains: check.body_contains ?? null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: stringValue(statusEvidence.body_sample) ?? null
+    });
+  }
+  return {
+    viewport: viewport.name,
+    key,
+    url: stringValue(statusEvidence.url) ?? httpStatusRequestUrl(check, viewport.url),
+    method: stringValue(statusEvidence.method) ?? httpStatusMethod(check),
+    status: numberValue(statusEvidence.status) ?? null,
+    status_text: stringValue(statusEvidence.status_text) ?? null,
+    ok: failures.length === 0,
+    error: stringValue(statusEvidence.error) ?? null,
+    content_type: stringValue(statusEvidence.content_type) ?? null,
+    content_length: numberValue(statusEvidence.content_length) ?? null,
+    bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: isRecord(statusEvidence.body_contains) ? toJsonValue(statusEvidence.body_contains) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: stringValue(statusEvidence.body_sample) ?? null,
+    failures
+  };
+}
 function linkStatusEvidenceForCheck(viewport, check) {
   const evidence = viewport.link_statuses?.[linkStatusSelector(check)];
   return isRecord(evidence) ? evidence : void 0;
@@ -1610,6 +1712,29 @@ function assessCheckFromEvidence(check, evidence) {
       message: failed ? `Text assertion failed in ${failed} viewport(s).` : void 0
     };
   }
+  if (check.type === "http_status") {
+    const url = httpStatusRequestUrl(check, evidence.target_url);
+    const method = httpStatusMethod(check);
+    const summaries = viewports.map((viewport) => summarizeHttpStatusEvidence(viewport, check));
+    const failed = summaries.filter((summary) => Array.isArray(summary.failures) && summary.failures.length > 0);
+    return {
+      type: check.type,
+      label: checkLabel(check),
+      status: failed.length ? "failed" : "passed",
+      evidence: {
+        url,
+        method,
+        allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
+        require_nonzero_bytes: check.require_nonzero_bytes === true,
+        min_bytes: check.min_bytes ?? null,
+        allowed_content_types: check.allowed_content_types ?? null,
+        body_contains: check.body_contains ?? [],
+        viewports: summaries.map((summary) => toJsonValue(summary)),
+        failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue(summary.viewport) ?? null, failure })) : [])
+      },
+      message: failed.length ? `HTTP status failed in ${failed.length} viewport(s).` : void 0
+    };
+  }
   if (check.type === "link_status" || check.type === "artifact_link_status") {
     const selector = linkStatusSelector(check);
     const summaries = viewports.map((viewport) => summarizeLinkStatusEvidence(viewport, check));
@@ -2219,16 +2344,37 @@ function textOrderMatch(texts, expectedTexts) {
 function linkStatusSelector(check) {
   return check.selector || check.link_selector || "a[href]";
 }
-function linkStatusAllowedStatuses(check) {
+function httpStatusRequestUrl(check, baseUrl) {
+  const rawUrl = check.url || "";
+  if (!rawUrl) return "";
+  try {
+    return baseUrl ? new URL(rawUrl, baseUrl).href : new URL(rawUrl).href;
+  } catch {
+    return rawUrl;
+  }
+}
+function httpStatusMethod(check) {
+  return String(check.method || "GET").toUpperCase();
+}
+function httpStatusKey(check, baseUrl) {
+  return httpStatusMethod(check) + " " + httpStatusRequestUrl(check, baseUrl);
+}
+function httpStatusAllowedStatuses(check) {
   if (Array.isArray(check.allowed_statuses) && check.allowed_statuses.length) return check.allowed_statuses;
   if (typeof check.expected_status === "number" && Number.isFinite(check.expected_status)) return [check.expected_status];
   return undefined;
 }
-function linkStatusIsAllowed(status, check) {
+function linkStatusAllowedStatuses(check) {
+  return httpStatusAllowedStatuses(check);
+}
+function httpStatusIsAllowed(status, check) {
   if (typeof status !== "number" || !Number.isFinite(status)) return false;
-  const allowed = linkStatusAllowedStatuses(check);
+  const allowed = httpStatusAllowedStatuses(check);
   return Array.isArray(allowed) && allowed.length ? allowed.includes(status) : status >= 200 && status < 400;
 }
+function linkStatusIsAllowed(status, check) {
+  return httpStatusIsAllowed(status, check);
+}
 function linkStatusObservedBytes(result) {
   const bytes = typeof result.bytes === "number" && Number.isFinite(result.bytes) ? result.bytes : undefined;
   const contentLength = typeof result.content_length === "number" && Number.isFinite(result.content_length) ? result.content_length : undefined;
@@ -2251,9 +2397,17 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  if (!expected.length) return [];
+  const observed = result && typeof result.body_contains === "object" && !Array.isArray(result.body_contains)
+    ? result.body_contains
+    : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
-  if (!linkStatusIsAllowed(result.status, check)) return false;
+  if (!httpStatusIsAllowed(result.status, check)) return false;
   if (typeof result.error === "string" && result.error.trim()) return false;
   if (result.ok === false) return false;
   if (!linkStatusContentTypeOk(result, check)) return false;
@@ -2265,8 +2419,62 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
+function summarizeHttpStatusEvidence(viewport, check) {
+  const key = httpStatusKey(check, viewport && viewport.url);
+  const statusEvidence = viewport && viewport.http_statuses && viewport.http_statuses[key];
+  if (!statusEvidence || typeof statusEvidence !== "object" || Array.isArray(statusEvidence)) {
+    return {
+      viewport: viewport && viewport.name,
+      key,
+      url: httpStatusRequestUrl(check, viewport && viewport.url),
+      method: httpStatusMethod(check),
+      ok: false,
+      status: null,
+      failures: [{ code: "http_status_evidence_missing" }],
+    };
+  }
+  const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  if (!linkStatusResultOk(statusEvidence, check)) {
+    failures.push({
+      code: "http_status_failed",
+      url: typeof statusEvidence.url === "string" ? statusEvidence.url : httpStatusRequestUrl(check, viewport && viewport.url),
+      status: typeof statusEvidence.status === "number" && Number.isFinite(statusEvidence.status) ? statusEvidence.status : null,
+      method: typeof statusEvidence.method === "string" ? statusEvidence.method : httpStatusMethod(check),
+      error: typeof statusEvidence.error === "string" ? statusEvidence.error : null,
+      content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
+      bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+      allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
+      min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+      allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+      body_contains: Array.isArray(check.body_contains) ? check.body_contains : null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
+    });
+  }
+  return {
+    viewport: viewport && viewport.name,
+    key,
+    url: typeof statusEvidence.url === "string" ? statusEvidence.url : httpStatusRequestUrl(check, viewport && viewport.url),
+    method: typeof statusEvidence.method === "string" ? statusEvidence.method : httpStatusMethod(check),
+    status: typeof statusEvidence.status === "number" && Number.isFinite(statusEvidence.status) ? statusEvidence.status : null,
+    status_text: typeof statusEvidence.status_text === "string" ? statusEvidence.status_text : null,
+    ok: failures.length === 0,
+    error: typeof statusEvidence.error === "string" ? statusEvidence.error : null,
+    content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
+    content_length: typeof statusEvidence.content_length === "number" && Number.isFinite(statusEvidence.content_length) ? statusEvidence.content_length : null,
+    bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: statusEvidence.body_contains && typeof statusEvidence.body_contains === "object" && !Array.isArray(statusEvidence.body_contains)
+      ? statusEvidence.body_contains
+      : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
+    failures,
+  };
+}
 function summarizeLinkStatusEvidence(viewport, check) {
   const selector = linkStatusSelector(check);
   const linkEvidence = viewport && viewport.link_statuses && viewport.link_statuses[selector];
@@ -3022,6 +3230,31 @@ function assessProfile(profile, evidence) {
       });
       continue;
     }
+    if (check.type === "http_status") {
+      const url = httpStatusRequestUrl(check, evidence.target_url);
+      const method = httpStatusMethod(check);
+      const summaries = checkViewports.map((viewport) => summarizeHttpStatusEvidence(viewport, check));
+      const failed = summaries.filter((summary) => Array.isArray(summary.failures) && summary.failures.length > 0);
+      checks.push({
+        type: check.type,
+        label: check.label || check.type,
+        status: failed.length ? "failed" : "passed",
+        evidence: {
+          url,
+          method,
+          allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
+          require_nonzero_bytes: check.require_nonzero_bytes === true,
+          min_bytes: check.min_bytes ?? null,
+          allowed_content_types: check.allowed_content_types ?? null,
+          viewports: summaries,
+          failures: failed.flatMap((summary) => Array.isArray(summary.failures)
+            ? summary.failures.map((failure) => ({ viewport: summary.viewport || null, failure }))
+            : []),
+        },
+        message: failed.length ? "HTTP status failed in " + failed.length + " viewport(s)." : undefined,
+      });
+      continue;
+    }
     if (check.type === "link_status" || check.type === "artifact_link_status") {
       const selector = linkStatusSelector(check);
       const summaries = checkViewports.map((viewport) => summarizeLinkStatusEvidence(viewport, check));
@@ -4219,6 +4452,72 @@ function linkProbeResponseFields(response, method) {
     content_length: contentLength,
   };
 }
+async function collectHttpStatus(check) {
+  const url = httpStatusRequestUrl(check, page.url() || targetUrl);
+  const method = httpStatusMethod(check);
+  const headers = check.headers && typeof check.headers === "object" && !Array.isArray(check.headers)
+    ? Object.fromEntries(Object.entries(check.headers).map(([key, value]) => [key, String(value)]).filter(([key]) => key.trim()))
+    : {};
+  let body;
+  if (check.body_json !== undefined) {
+    body = JSON.stringify(check.body_json);
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) headers["content-type"] = "application/json";
+  } else if (typeof check.body === "string") {
+    body = check.body;
+  }
+  const bodyContains = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  const options = {
+    method,
+    redirect: "follow",
+    cache: "no-store",
+    headers,
+  };
+  if (body !== undefined && method !== "GET" && method !== "HEAD") options.body = body;
+  const result = {
+    version: "riddle-proof.http-status.v1",
+    url,
+    method,
+    status: null,
+    ok: false,
+    error: null,
+    request_body_bytes: typeof body === "string" ? body.length : 0,
+    allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
+    require_nonzero_bytes: check.require_nonzero_bytes === true,
+    min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
+    allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+  };
+  try {
+    const response = await fetch(url, options);
+    Object.assign(result, linkProbeResponseFields(response, method));
+    result.url = url;
+    result.status_text = response.statusText || "";
+    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || bodyContains.length > 0;
+    if (shouldReadBody) {
+      try {
+        const buffer = await response.arrayBuffer();
+        result.bytes = buffer.byteLength;
+        if (bodyContains.length) {
+          const text = new TextDecoder().decode(buffer);
+          result.body_sample = text.slice(0, 1000);
+          result.body_contains = Object.fromEntries(bodyContains.map((expected) => [expected, text.includes(expected)]));
+        }
+      } catch (error) {
+        result.error = String(error && error.message ? error.message : error).slice(0, 500);
+      }
+    }
+    result.ok = linkProbeAllowed(result.status, check)
+      && linkProbeContentTypeAllowed(result, check)
+      && (check.require_nonzero_bytes !== true || ((linkProbeObservedBytes(result) || 0) > 0))
+      && (!(typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || ((linkProbeObservedBytes(result) || 0) >= check.min_bytes))
+      && (!bodyContains.length || bodyContains.every((expected) => result.body_contains && result.body_contains[expected] === true))
+      && !result.error;
+    return result;
+  } catch (error) {
+    result.error = String(error && error.message ? error.message : error).slice(0, 500);
+    result.ok = false;
+    return result;
+  }
+}
 async function probeLinkStatus(candidate, check) {
   const requireNonzeroBytes = check.require_nonzero_bytes === true;
   const minBytes = typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? Math.max(1, Math.floor(check.min_bytes)) : null;
@@ -4911,6 +5210,7 @@ async function captureViewport(viewport) {
   const frames = {};
   const text_sequences = {};
   const text_matches = {};
+  const http_statuses = {};
   const link_statuses = {};
   for (const check of profile.checks || []) {
     if (!profileCheckAppliesToViewport(check, viewport)) continue;
@@ -4937,6 +5237,10 @@ async function captureViewport(viewport) {
       selectors[check.selector] = selectors[check.selector] || await selectorStats(check.selector);
       frames[check.selector] = frames[check.selector] || await frameEvidence(check.selector);
     }
+    if (check.type === "http_status") {
+      const key = httpStatusKey(check, page.url() || targetUrl);
+      http_statuses[key] = http_statuses[key] || await collectHttpStatus(check);
+    }
     if (check.type === "link_status" || check.type === "artifact_link_status") {
       const selector = linkStatusSelector(check);
       link_statuses[selector] = link_statuses[selector] || await collectLinkStatus(check);
@@ -5004,6 +5308,7 @@ async function captureViewport(viewport) {
     frames,
     text_sequences,
     text_matches,
+    http_statuses,
     link_statuses,
     route_inventory: routeInventory,
     setup_action_results: setupActionResults,
@@ -5053,6 +5358,19 @@ function buildProfileEvidence(currentViewports) {
             ),
           })),
         })),
+      http_status: currentViewports
+        .filter((viewport) => viewport.http_statuses && Object.keys(viewport.http_statuses).length)
+        .map((viewport) => ({
+          viewport: viewport.name,
+          requests: Object.entries(viewport.http_statuses || {}).map(([key, statusSet]) => ({
+            key,
+            url: statusSet && statusSet.url,
+            method: statusSet && statusSet.method,
+            status: statusSet && statusSet.status,
+            ok: statusSet && statusSet.ok === true,
+            error: statusSet && statusSet.error,
+          })),
+        })),
       link_status: currentViewports
         .filter((viewport) => viewport.link_statuses && Object.keys(viewport.link_statuses).length)
         .map((viewport) => ({

package/dist/profile.d.cts

@@ -4,7 +4,7 @@ declare const RIDDLE_PROOF_PROFILE_VERSION: "riddle-proof.profile.v1";
 declare const RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION: "riddle-proof.profile-evidence.v1";
 declare const RIDDLE_PROOF_PROFILE_RESULT_VERSION: "riddle-proof.profile-result.v1";
 declare const RIDDLE_PROOF_PROFILE_STATUSES: readonly ["passed", "product_regression", "proof_insufficient", "environment_blocked", "configuration_error", "needs_human_review"];
-declare const RIDDLE_PROOF_PROFILE_CHECK_TYPES: readonly ["route_loaded", "url_search_param_equals", "url_search_param_absent", "selector_visible", "selector_absent", "selector_count_at_least", "selector_count_equals", "selector_count_equal", "selector_count_eq", "selector_text_visible", "selector_text_absent", "selector_text_order", "frame_text_visible", "frame_url_equals", "frame_url_matches", "frame_no_horizontal_overflow", "text_visible", "text_absent", "link_status", "artifact_link_status", "route_inventory", "no_horizontal_overflow", "no_mobile_horizontal_overflow", "no_fatal_console_errors"];
+declare const RIDDLE_PROOF_PROFILE_CHECK_TYPES: readonly ["route_loaded", "url_search_param_equals", "url_search_param_absent", "selector_visible", "selector_absent", "selector_count_at_least", "selector_count_equals", "selector_count_equal", "selector_count_eq", "selector_text_visible", "selector_text_absent", "selector_text_order", "frame_text_visible", "frame_url_equals", "frame_url_matches", "frame_no_horizontal_overflow", "text_visible", "text_absent", "http_status", "link_status", "artifact_link_status", "route_inventory", "no_horizontal_overflow", "no_mobile_horizontal_overflow", "no_fatal_console_errors"];
 declare const RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES: readonly ["click", "drag", "press", "fill", "set_input_value", "assert_text_visible", "assert_text_absent", "assert_selector_count", "assert_window_value", "assert_window_number", "local_storage", "session_storage", "clear_storage", "clear_console", "dialog_response", "screenshot", "wait", "wait_for_selector", "wait_for_text", "window_call"];
 type RiddleProofProfileStatus = typeof RIDDLE_PROOF_PROFILE_STATUSES[number];
 type RiddleProofProfileCheckType = typeof RIDDLE_PROOF_PROFILE_CHECK_TYPES[number];
@@ -114,6 +114,12 @@ interface RiddleProofProfileCheck {
     expected_url?: string;
     expected_routes?: RiddleProofProfileRouteInventoryRoute[];
     selector?: string;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    body_json?: JsonValue;
+    body_contains?: string[];
     expected_texts?: string[];
     link_selector?: string;
     source_selector?: string;
@@ -205,6 +211,7 @@ interface RiddleProofProfileViewportEvidence {
     frames?: Record<string, Record<string, JsonValue>>;
     text_sequences?: Record<string, Record<string, JsonValue>>;
     text_matches?: Record<string, boolean>;
+    http_statuses?: Record<string, Record<string, JsonValue>>;
     link_statuses?: Record<string, Record<string, JsonValue>>;
     route_inventory?: Record<string, JsonValue>;
     setup_action_results?: Array<Record<string, JsonValue>>;

package/dist/profile.d.ts

@@ -4,7 +4,7 @@ declare const RIDDLE_PROOF_PROFILE_VERSION: "riddle-proof.profile.v1";
 declare const RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION: "riddle-proof.profile-evidence.v1";
 declare const RIDDLE_PROOF_PROFILE_RESULT_VERSION: "riddle-proof.profile-result.v1";
 declare const RIDDLE_PROOF_PROFILE_STATUSES: readonly ["passed", "product_regression", "proof_insufficient", "environment_blocked", "configuration_error", "needs_human_review"];
-declare const RIDDLE_PROOF_PROFILE_CHECK_TYPES: readonly ["route_loaded", "url_search_param_equals", "url_search_param_absent", "selector_visible", "selector_absent", "selector_count_at_least", "selector_count_equals", "selector_count_equal", "selector_count_eq", "selector_text_visible", "selector_text_absent", "selector_text_order", "frame_text_visible", "frame_url_equals", "frame_url_matches", "frame_no_horizontal_overflow", "text_visible", "text_absent", "link_status", "artifact_link_status", "route_inventory", "no_horizontal_overflow", "no_mobile_horizontal_overflow", "no_fatal_console_errors"];
+declare const RIDDLE_PROOF_PROFILE_CHECK_TYPES: readonly ["route_loaded", "url_search_param_equals", "url_search_param_absent", "selector_visible", "selector_absent", "selector_count_at_least", "selector_count_equals", "selector_count_equal", "selector_count_eq", "selector_text_visible", "selector_text_absent", "selector_text_order", "frame_text_visible", "frame_url_equals", "frame_url_matches", "frame_no_horizontal_overflow", "text_visible", "text_absent", "http_status", "link_status", "artifact_link_status", "route_inventory", "no_horizontal_overflow", "no_mobile_horizontal_overflow", "no_fatal_console_errors"];
 declare const RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES: readonly ["click", "drag", "press", "fill", "set_input_value", "assert_text_visible", "assert_text_absent", "assert_selector_count", "assert_window_value", "assert_window_number", "local_storage", "session_storage", "clear_storage", "clear_console", "dialog_response", "screenshot", "wait", "wait_for_selector", "wait_for_text", "window_call"];
 type RiddleProofProfileStatus = typeof RIDDLE_PROOF_PROFILE_STATUSES[number];
 type RiddleProofProfileCheckType = typeof RIDDLE_PROOF_PROFILE_CHECK_TYPES[number];
@@ -114,6 +114,12 @@ interface RiddleProofProfileCheck {
     expected_url?: string;
     expected_routes?: RiddleProofProfileRouteInventoryRoute[];
     selector?: string;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    body_json?: JsonValue;
+    body_contains?: string[];
     expected_texts?: string[];
     link_selector?: string;
     source_selector?: string;
@@ -205,6 +211,7 @@ interface RiddleProofProfileViewportEvidence {
     frames?: Record<string, Record<string, JsonValue>>;
     text_sequences?: Record<string, Record<string, JsonValue>>;
     text_matches?: Record<string, boolean>;
+    http_statuses?: Record<string, Record<string, JsonValue>>;
     link_statuses?: Record<string, Record<string, JsonValue>>;
     route_inventory?: Record<string, JsonValue>;
     setup_action_results?: Array<Record<string, JsonValue>>;

package/dist/profile.js

@@ -19,7 +19,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-G3UY3SHZ.js";
+} from "./chunk-W5PBTTMJ.js";
 export {
   RIDDLE_PROOF_PROFILE_CHECK_TYPES,
   RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.7.97",
+  "version": "0.7.99",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",