@riddledc/riddle-proof 0.7.98 → 0.7.100

package/dist/{chunk-OMTWNL4B.js → chunk-TRNLSX3U.js}

@@ -803,6 +803,19 @@ function normalizeCheck(input, index) {
     input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
     `checks[${index}] allowed_content_types`
   ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
+  const bodyContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_contains ?? input.bodyContains ?? input.expected_body_contains ?? input.expectedBodyContains ?? input.response_body_contains ?? input.responseBodyContains ?? input.body_includes ?? input.bodyIncludes,
+    `checks[${index}] body_contains`
+  ) : void 0;
+  const bodyNotContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_contains ?? input.bodyNotContains ?? input.expected_body_not_contains ?? input.expectedBodyNotContains ?? input.response_body_not_contains ?? input.responseBodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `checks[${index}] body_not_contains`
+  ) : void 0;
+  const bodyNotPatterns = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_patterns ?? input.bodyNotPatterns ?? input.expected_body_not_patterns ?? input.expectedBodyNotPatterns ?? input.response_body_not_patterns ?? input.responseBodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `checks[${index}] body_not_patterns`
+  ) : void 0;
+  if (bodyNotPatterns?.length) validateRegexPatterns(bodyNotPatterns, `checks[${index}] body_not_patterns`);
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -825,6 +838,9 @@ function normalizeCheck(input, index) {
     headers: isHttpStatusCheck ? stringRecord(input.headers) : void 0,
     body: isHttpStatusCheck ? stringValue(input.body) : void 0,
     body_json: isHttpStatusCheck && hasBodyJson ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : void 0,
+    body_contains: bodyContains,
+    body_not_contains: bodyNotContains,
+    body_not_patterns: bodyNotPatterns,
     expected_texts: expectedTexts,
     link_selector: stringValue(input.link_selector) || stringValue(input.linkSelector),
     source_selector: stringValue(input.source_selector) || stringValue(input.sourceSelector),
@@ -996,6 +1012,24 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = check.body_contains?.filter(Boolean) ?? [];
+  if (!expected.length) return [];
+  const observed = isRecord(result.body_contains) ? result.body_contains : {};
+  return expected.filter((text) => observed[text] !== true);
+}
+function httpStatusBodyNotContainsFailures(result, check) {
+  const forbidden = check.body_not_contains?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_contains) ? result.body_not_contains : {};
+  return forbidden.filter((text) => observed[text] !== false);
+}
+function httpStatusBodyNotPatternFailures(result, check) {
+  const forbidden = check.body_not_patterns?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_patterns) ? result.body_not_patterns : {};
+  return forbidden.filter((pattern) => observed[pattern] !== false);
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue(result.status);
   if (!httpStatusIsAllowed(status, check)) return false;
@@ -1010,6 +1044,9 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
 function httpStatusEvidenceForCheck(viewport, check) {
@@ -1031,6 +1068,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(statusEvidence, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -1042,7 +1082,14 @@ function summarizeHttpStatusEvidence(viewport, check) {
       bytes: linkStatusObservedBytes(statusEvidence) ?? null,
       allowed_statuses: httpStatusAllowedStatuses(check) ?? ["2xx", "3xx"],
       min_bytes: check.min_bytes ?? null,
-      allowed_content_types: check.allowed_content_types ?? null
+      allowed_content_types: check.allowed_content_types ?? null,
+      body_contains: check.body_contains ?? null,
+      body_contains_missing: bodyContainsMissing,
+      body_not_contains: check.body_not_contains ?? null,
+      body_not_contains_found: bodyNotContainsFound,
+      body_not_patterns: check.body_not_patterns ?? null,
+      body_not_patterns_found: bodyNotPatternsFound,
+      body_sample: stringValue(statusEvidence.body_sample) ?? null
     });
   }
   return {
@@ -1057,6 +1104,13 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: stringValue(statusEvidence.content_type) ?? null,
     content_length: numberValue(statusEvidence.content_length) ?? null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: isRecord(statusEvidence.body_contains) ? toJsonValue(statusEvidence.body_contains) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(statusEvidence.body_not_contains) ? toJsonValue(statusEvidence.body_not_contains) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(statusEvidence.body_not_patterns) ? toJsonValue(statusEvidence.body_not_patterns) : null,
+    body_not_patterns_found: bodyNotPatternsFound,
+    body_sample: stringValue(statusEvidence.body_sample) ?? null,
     failures
   };
 }
@@ -1666,6 +1720,9 @@ function assessCheckFromEvidence(check, evidence) {
         require_nonzero_bytes: check.require_nonzero_bytes === true,
         min_bytes: check.min_bytes ?? null,
         allowed_content_types: check.allowed_content_types ?? null,
+        body_contains: check.body_contains ?? [],
+        body_not_contains: check.body_not_contains ?? [],
+        body_not_patterns: check.body_not_patterns ?? [],
         viewports: summaries.map((summary) => toJsonValue(summary)),
         failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue(summary.viewport) ?? null, failure })) : [])
       },
@@ -2334,6 +2391,14 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  if (!expected.length) return [];
+  const observed = result && typeof result.body_contains === "object" && !Array.isArray(result.body_contains)
+    ? result.body_contains
+    : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
   if (!httpStatusIsAllowed(result.status, check)) return false;
@@ -2348,6 +2413,7 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
 function summarizeHttpStatusEvidence(viewport, check) {
@@ -2365,6 +2431,7 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -2377,6 +2444,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
       allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
       min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
       allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+      body_contains: Array.isArray(check.body_contains) ? check.body_contains : null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     });
   }
   return {
@@ -2391,6 +2461,11 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
     content_length: typeof statusEvidence.content_length === "number" && Number.isFinite(statusEvidence.content_length) ? statusEvidence.content_length : null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: statusEvidence.body_contains && typeof statusEvidence.body_contains === "object" && !Array.isArray(statusEvidence.body_contains)
+      ? statusEvidence.body_contains
+      : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     failures,
   };
 }
@@ -4384,6 +4459,9 @@ async function collectHttpStatus(check) {
   } else if (typeof check.body === "string") {
     body = check.body;
   }
+  const bodyContains = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  const bodyNotContains = Array.isArray(check.body_not_contains) ? check.body_not_contains.filter(Boolean) : [];
+  const bodyNotPatterns = Array.isArray(check.body_not_patterns) ? check.body_not_patterns.filter(Boolean) : [];
   const options = {
     method,
     redirect: "follow",
@@ -4409,11 +4487,18 @@ async function collectHttpStatus(check) {
     Object.assign(result, linkProbeResponseFields(response, method));
     result.url = url;
     result.status_text = response.statusText || "";
-    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes));
+    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || bodyContains.length > 0 || bodyNotContains.length > 0 || bodyNotPatterns.length > 0;
     if (shouldReadBody) {
       try {
         const buffer = await response.arrayBuffer();
         result.bytes = buffer.byteLength;
+        if (bodyContains.length || bodyNotContains.length || bodyNotPatterns.length) {
+          const text = new TextDecoder().decode(buffer);
+          result.body_sample = text.slice(0, 1000);
+          if (bodyContains.length) result.body_contains = Object.fromEntries(bodyContains.map((expected) => [expected, text.includes(expected)]));
+          if (bodyNotContains.length) result.body_not_contains = Object.fromEntries(bodyNotContains.map((forbidden) => [forbidden, text.includes(forbidden)]));
+          if (bodyNotPatterns.length) result.body_not_patterns = Object.fromEntries(bodyNotPatterns.map((pattern) => [pattern, new RegExp(pattern).test(text)]));
+        }
       } catch (error) {
         result.error = String(error && error.message ? error.message : error).slice(0, 500);
       }
@@ -4422,6 +4507,9 @@ async function collectHttpStatus(check) {
       && linkProbeContentTypeAllowed(result, check)
       && (check.require_nonzero_bytes !== true || ((linkProbeObservedBytes(result) || 0) > 0))
       && (!(typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || ((linkProbeObservedBytes(result) || 0) >= check.min_bytes))
+      && (!bodyContains.length || bodyContains.every((expected) => result.body_contains && result.body_contains[expected] === true))
+      && (!bodyNotContains.length || bodyNotContains.every((forbidden) => result.body_not_contains && result.body_not_contains[forbidden] === false))
+      && (!bodyNotPatterns.length || bodyNotPatterns.every((pattern) => result.body_not_patterns && result.body_not_patterns[pattern] === false))
       && !result.error;
     return result;
   } catch (error) {

package/dist/cli.cjs

@@ -7696,6 +7696,19 @@ function normalizeCheck(input, index) {
     input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
     `checks[${index}] allowed_content_types`
   ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
+  const bodyContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_contains ?? input.bodyContains ?? input.expected_body_contains ?? input.expectedBodyContains ?? input.response_body_contains ?? input.responseBodyContains ?? input.body_includes ?? input.bodyIncludes,
+    `checks[${index}] body_contains`
+  ) : void 0;
+  const bodyNotContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_contains ?? input.bodyNotContains ?? input.expected_body_not_contains ?? input.expectedBodyNotContains ?? input.response_body_not_contains ?? input.responseBodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `checks[${index}] body_not_contains`
+  ) : void 0;
+  const bodyNotPatterns = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_patterns ?? input.bodyNotPatterns ?? input.expected_body_not_patterns ?? input.expectedBodyNotPatterns ?? input.response_body_not_patterns ?? input.responseBodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `checks[${index}] body_not_patterns`
+  ) : void 0;
+  if (bodyNotPatterns?.length) validateRegexPatterns(bodyNotPatterns, `checks[${index}] body_not_patterns`);
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -7718,6 +7731,9 @@ function normalizeCheck(input, index) {
     headers: isHttpStatusCheck ? stringRecord(input.headers) : void 0,
     body: isHttpStatusCheck ? stringValue2(input.body) : void 0,
     body_json: isHttpStatusCheck && hasBodyJson ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : void 0,
+    body_contains: bodyContains,
+    body_not_contains: bodyNotContains,
+    body_not_patterns: bodyNotPatterns,
     expected_texts: expectedTexts,
     link_selector: stringValue2(input.link_selector) || stringValue2(input.linkSelector),
     source_selector: stringValue2(input.source_selector) || stringValue2(input.sourceSelector),
@@ -7889,6 +7905,24 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = check.body_contains?.filter(Boolean) ?? [];
+  if (!expected.length) return [];
+  const observed = isRecord(result.body_contains) ? result.body_contains : {};
+  return expected.filter((text) => observed[text] !== true);
+}
+function httpStatusBodyNotContainsFailures(result, check) {
+  const forbidden = check.body_not_contains?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_contains) ? result.body_not_contains : {};
+  return forbidden.filter((text) => observed[text] !== false);
+}
+function httpStatusBodyNotPatternFailures(result, check) {
+  const forbidden = check.body_not_patterns?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_patterns) ? result.body_not_patterns : {};
+  return forbidden.filter((pattern) => observed[pattern] !== false);
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue(result.status);
   if (!httpStatusIsAllowed(status, check)) return false;
@@ -7903,6 +7937,9 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
 function httpStatusEvidenceForCheck(viewport, check) {
@@ -7924,6 +7961,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(statusEvidence, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -7935,7 +7975,14 @@ function summarizeHttpStatusEvidence(viewport, check) {
       bytes: linkStatusObservedBytes(statusEvidence) ?? null,
       allowed_statuses: httpStatusAllowedStatuses(check) ?? ["2xx", "3xx"],
       min_bytes: check.min_bytes ?? null,
-      allowed_content_types: check.allowed_content_types ?? null
+      allowed_content_types: check.allowed_content_types ?? null,
+      body_contains: check.body_contains ?? null,
+      body_contains_missing: bodyContainsMissing,
+      body_not_contains: check.body_not_contains ?? null,
+      body_not_contains_found: bodyNotContainsFound,
+      body_not_patterns: check.body_not_patterns ?? null,
+      body_not_patterns_found: bodyNotPatternsFound,
+      body_sample: stringValue2(statusEvidence.body_sample) ?? null
     });
   }
   return {
@@ -7950,6 +7997,13 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: stringValue2(statusEvidence.content_type) ?? null,
     content_length: numberValue(statusEvidence.content_length) ?? null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: isRecord(statusEvidence.body_contains) ? toJsonValue(statusEvidence.body_contains) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(statusEvidence.body_not_contains) ? toJsonValue(statusEvidence.body_not_contains) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(statusEvidence.body_not_patterns) ? toJsonValue(statusEvidence.body_not_patterns) : null,
+    body_not_patterns_found: bodyNotPatternsFound,
+    body_sample: stringValue2(statusEvidence.body_sample) ?? null,
     failures
   };
 }
@@ -8559,6 +8613,9 @@ function assessCheckFromEvidence(check, evidence) {
         require_nonzero_bytes: check.require_nonzero_bytes === true,
         min_bytes: check.min_bytes ?? null,
         allowed_content_types: check.allowed_content_types ?? null,
+        body_contains: check.body_contains ?? [],
+        body_not_contains: check.body_not_contains ?? [],
+        body_not_patterns: check.body_not_patterns ?? [],
         viewports: summaries.map((summary) => toJsonValue(summary)),
         failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue2(summary.viewport) ?? null, failure })) : [])
       },
@@ -9211,6 +9268,14 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  if (!expected.length) return [];
+  const observed = result && typeof result.body_contains === "object" && !Array.isArray(result.body_contains)
+    ? result.body_contains
+    : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
   if (!httpStatusIsAllowed(result.status, check)) return false;
@@ -9225,6 +9290,7 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
 function summarizeHttpStatusEvidence(viewport, check) {
@@ -9242,6 +9308,7 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -9254,6 +9321,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
       allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
       min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
       allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+      body_contains: Array.isArray(check.body_contains) ? check.body_contains : null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     });
   }
   return {
@@ -9268,6 +9338,11 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
     content_length: typeof statusEvidence.content_length === "number" && Number.isFinite(statusEvidence.content_length) ? statusEvidence.content_length : null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: statusEvidence.body_contains && typeof statusEvidence.body_contains === "object" && !Array.isArray(statusEvidence.body_contains)
+      ? statusEvidence.body_contains
+      : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     failures,
   };
 }
@@ -11261,6 +11336,9 @@ async function collectHttpStatus(check) {
   } else if (typeof check.body === "string") {
     body = check.body;
   }
+  const bodyContains = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  const bodyNotContains = Array.isArray(check.body_not_contains) ? check.body_not_contains.filter(Boolean) : [];
+  const bodyNotPatterns = Array.isArray(check.body_not_patterns) ? check.body_not_patterns.filter(Boolean) : [];
   const options = {
     method,
     redirect: "follow",
@@ -11286,11 +11364,18 @@ async function collectHttpStatus(check) {
     Object.assign(result, linkProbeResponseFields(response, method));
     result.url = url;
     result.status_text = response.statusText || "";
-    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes));
+    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || bodyContains.length > 0 || bodyNotContains.length > 0 || bodyNotPatterns.length > 0;
     if (shouldReadBody) {
       try {
         const buffer = await response.arrayBuffer();
         result.bytes = buffer.byteLength;
+        if (bodyContains.length || bodyNotContains.length || bodyNotPatterns.length) {
+          const text = new TextDecoder().decode(buffer);
+          result.body_sample = text.slice(0, 1000);
+          if (bodyContains.length) result.body_contains = Object.fromEntries(bodyContains.map((expected) => [expected, text.includes(expected)]));
+          if (bodyNotContains.length) result.body_not_contains = Object.fromEntries(bodyNotContains.map((forbidden) => [forbidden, text.includes(forbidden)]));
+          if (bodyNotPatterns.length) result.body_not_patterns = Object.fromEntries(bodyNotPatterns.map((pattern) => [pattern, new RegExp(pattern).test(text)]));
+        }
       } catch (error) {
         result.error = String(error && error.message ? error.message : error).slice(0, 500);
       }
@@ -11299,6 +11384,9 @@ async function collectHttpStatus(check) {
       && linkProbeContentTypeAllowed(result, check)
       && (check.require_nonzero_bytes !== true || ((linkProbeObservedBytes(result) || 0) > 0))
       && (!(typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || ((linkProbeObservedBytes(result) || 0) >= check.min_bytes))
+      && (!bodyContains.length || bodyContains.every((expected) => result.body_contains && result.body_contains[expected] === true))
+      && (!bodyNotContains.length || bodyNotContains.every((forbidden) => result.body_not_contains && result.body_not_contains[forbidden] === false))
+      && (!bodyNotPatterns.length || bodyNotPatterns.every((pattern) => result.body_not_patterns && result.body_not_patterns[pattern] === false))
       && !result.error;
     return result;
   } catch (error) {

package/dist/cli.js

@@ -10,7 +10,7 @@ import {
   profileStatusExitCode,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec
-} from "./chunk-OMTWNL4B.js";
+} from "./chunk-TRNLSX3U.js";
 import {
   createRiddleApiClient,
   parseRiddleViewport

package/dist/index.cjs

@@ -9532,6 +9532,19 @@ function normalizeCheck(input, index) {
     input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
     `checks[${index}] allowed_content_types`
   ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
+  const bodyContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_contains ?? input.bodyContains ?? input.expected_body_contains ?? input.expectedBodyContains ?? input.response_body_contains ?? input.responseBodyContains ?? input.body_includes ?? input.bodyIncludes,
+    `checks[${index}] body_contains`
+  ) : void 0;
+  const bodyNotContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_contains ?? input.bodyNotContains ?? input.expected_body_not_contains ?? input.expectedBodyNotContains ?? input.response_body_not_contains ?? input.responseBodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `checks[${index}] body_not_contains`
+  ) : void 0;
+  const bodyNotPatterns = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_patterns ?? input.bodyNotPatterns ?? input.expected_body_not_patterns ?? input.expectedBodyNotPatterns ?? input.response_body_not_patterns ?? input.responseBodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `checks[${index}] body_not_patterns`
+  ) : void 0;
+  if (bodyNotPatterns?.length) validateRegexPatterns(bodyNotPatterns, `checks[${index}] body_not_patterns`);
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -9554,6 +9567,9 @@ function normalizeCheck(input, index) {
     headers: isHttpStatusCheck ? stringRecord(input.headers) : void 0,
     body: isHttpStatusCheck ? stringValue5(input.body) : void 0,
     body_json: isHttpStatusCheck && hasBodyJson ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : void 0,
+    body_contains: bodyContains,
+    body_not_contains: bodyNotContains,
+    body_not_patterns: bodyNotPatterns,
     expected_texts: expectedTexts,
     link_selector: stringValue5(input.link_selector) || stringValue5(input.linkSelector),
     source_selector: stringValue5(input.source_selector) || stringValue5(input.sourceSelector),
@@ -9725,6 +9741,24 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = check.body_contains?.filter(Boolean) ?? [];
+  if (!expected.length) return [];
+  const observed = isRecord2(result.body_contains) ? result.body_contains : {};
+  return expected.filter((text) => observed[text] !== true);
+}
+function httpStatusBodyNotContainsFailures(result, check) {
+  const forbidden = check.body_not_contains?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord2(result.body_not_contains) ? result.body_not_contains : {};
+  return forbidden.filter((text) => observed[text] !== false);
+}
+function httpStatusBodyNotPatternFailures(result, check) {
+  const forbidden = check.body_not_patterns?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord2(result.body_not_patterns) ? result.body_not_patterns : {};
+  return forbidden.filter((pattern) => observed[pattern] !== false);
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue3(result.status);
   if (!httpStatusIsAllowed(status, check)) return false;
@@ -9739,6 +9773,9 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
 function httpStatusEvidenceForCheck(viewport, check) {
@@ -9760,6 +9797,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(statusEvidence, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -9771,7 +9811,14 @@ function summarizeHttpStatusEvidence(viewport, check) {
       bytes: linkStatusObservedBytes(statusEvidence) ?? null,
       allowed_statuses: httpStatusAllowedStatuses(check) ?? ["2xx", "3xx"],
       min_bytes: check.min_bytes ?? null,
-      allowed_content_types: check.allowed_content_types ?? null
+      allowed_content_types: check.allowed_content_types ?? null,
+      body_contains: check.body_contains ?? null,
+      body_contains_missing: bodyContainsMissing,
+      body_not_contains: check.body_not_contains ?? null,
+      body_not_contains_found: bodyNotContainsFound,
+      body_not_patterns: check.body_not_patterns ?? null,
+      body_not_patterns_found: bodyNotPatternsFound,
+      body_sample: stringValue5(statusEvidence.body_sample) ?? null
     });
   }
   return {
@@ -9786,6 +9833,13 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: stringValue5(statusEvidence.content_type) ?? null,
     content_length: numberValue3(statusEvidence.content_length) ?? null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: isRecord2(statusEvidence.body_contains) ? toJsonValue(statusEvidence.body_contains) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord2(statusEvidence.body_not_contains) ? toJsonValue(statusEvidence.body_not_contains) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord2(statusEvidence.body_not_patterns) ? toJsonValue(statusEvidence.body_not_patterns) : null,
+    body_not_patterns_found: bodyNotPatternsFound,
+    body_sample: stringValue5(statusEvidence.body_sample) ?? null,
     failures
   };
 }
@@ -10395,6 +10449,9 @@ function assessCheckFromEvidence(check, evidence) {
         require_nonzero_bytes: check.require_nonzero_bytes === true,
         min_bytes: check.min_bytes ?? null,
         allowed_content_types: check.allowed_content_types ?? null,
+        body_contains: check.body_contains ?? [],
+        body_not_contains: check.body_not_contains ?? [],
+        body_not_patterns: check.body_not_patterns ?? [],
         viewports: summaries.map((summary) => toJsonValue(summary)),
         failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue5(summary.viewport) ?? null, failure })) : [])
       },
@@ -11063,6 +11120,14 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  if (!expected.length) return [];
+  const observed = result && typeof result.body_contains === "object" && !Array.isArray(result.body_contains)
+    ? result.body_contains
+    : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
   if (!httpStatusIsAllowed(result.status, check)) return false;
@@ -11077,6 +11142,7 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
 function summarizeHttpStatusEvidence(viewport, check) {
@@ -11094,6 +11160,7 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -11106,6 +11173,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
       allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
       min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
       allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+      body_contains: Array.isArray(check.body_contains) ? check.body_contains : null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     });
   }
   return {
@@ -11120,6 +11190,11 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
     content_length: typeof statusEvidence.content_length === "number" && Number.isFinite(statusEvidence.content_length) ? statusEvidence.content_length : null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: statusEvidence.body_contains && typeof statusEvidence.body_contains === "object" && !Array.isArray(statusEvidence.body_contains)
+      ? statusEvidence.body_contains
+      : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     failures,
   };
 }
@@ -13113,6 +13188,9 @@ async function collectHttpStatus(check) {
   } else if (typeof check.body === "string") {
     body = check.body;
   }
+  const bodyContains = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  const bodyNotContains = Array.isArray(check.body_not_contains) ? check.body_not_contains.filter(Boolean) : [];
+  const bodyNotPatterns = Array.isArray(check.body_not_patterns) ? check.body_not_patterns.filter(Boolean) : [];
   const options = {
     method,
     redirect: "follow",
@@ -13138,11 +13216,18 @@ async function collectHttpStatus(check) {
     Object.assign(result, linkProbeResponseFields(response, method));
     result.url = url;
     result.status_text = response.statusText || "";
-    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes));
+    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || bodyContains.length > 0 || bodyNotContains.length > 0 || bodyNotPatterns.length > 0;
     if (shouldReadBody) {
       try {
         const buffer = await response.arrayBuffer();
         result.bytes = buffer.byteLength;
+        if (bodyContains.length || bodyNotContains.length || bodyNotPatterns.length) {
+          const text = new TextDecoder().decode(buffer);
+          result.body_sample = text.slice(0, 1000);
+          if (bodyContains.length) result.body_contains = Object.fromEntries(bodyContains.map((expected) => [expected, text.includes(expected)]));
+          if (bodyNotContains.length) result.body_not_contains = Object.fromEntries(bodyNotContains.map((forbidden) => [forbidden, text.includes(forbidden)]));
+          if (bodyNotPatterns.length) result.body_not_patterns = Object.fromEntries(bodyNotPatterns.map((pattern) => [pattern, new RegExp(pattern).test(text)]));
+        }
       } catch (error) {
         result.error = String(error && error.message ? error.message : error).slice(0, 500);
       }
@@ -13151,6 +13236,9 @@ async function collectHttpStatus(check) {
       && linkProbeContentTypeAllowed(result, check)
       && (check.require_nonzero_bytes !== true || ((linkProbeObservedBytes(result) || 0) > 0))
       && (!(typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || ((linkProbeObservedBytes(result) || 0) >= check.min_bytes))
+      && (!bodyContains.length || bodyContains.every((expected) => result.body_contains && result.body_contains[expected] === true))
+      && (!bodyNotContains.length || bodyNotContains.every((forbidden) => result.body_not_contains && result.body_not_contains[forbidden] === false))
+      && (!bodyNotPatterns.length || bodyNotPatterns.every((pattern) => result.body_not_patterns && result.body_not_patterns[pattern] === false))
       && !result.error;
     return result;
   } catch (error) {

package/dist/index.js

@@ -58,7 +58,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-OMTWNL4B.js";
+} from "./chunk-TRNLSX3U.js";
 import {
   DEFAULT_RIDDLE_API_BASE_URL,
   DEFAULT_RIDDLE_API_KEY_FILE,

package/dist/profile.cjs

@@ -846,6 +846,19 @@ function normalizeCheck(input, index) {
     input.allowed_content_types ?? input.allowedContentTypes ?? input.expected_content_types ?? input.expectedContentTypes,
     `checks[${index}] allowed_content_types`
   ) ?? (expectedContentType ? [expectedContentType] : void 0) : void 0;
+  const bodyContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_contains ?? input.bodyContains ?? input.expected_body_contains ?? input.expectedBodyContains ?? input.response_body_contains ?? input.responseBodyContains ?? input.body_includes ?? input.bodyIncludes,
+    `checks[${index}] body_contains`
+  ) : void 0;
+  const bodyNotContains = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_contains ?? input.bodyNotContains ?? input.expected_body_not_contains ?? input.expectedBodyNotContains ?? input.response_body_not_contains ?? input.responseBodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `checks[${index}] body_not_contains`
+  ) : void 0;
+  const bodyNotPatterns = isHttpStatusCheck ? normalizeStringList(
+    input.body_not_patterns ?? input.bodyNotPatterns ?? input.expected_body_not_patterns ?? input.expectedBodyNotPatterns ?? input.response_body_not_patterns ?? input.responseBodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `checks[${index}] body_not_patterns`
+  ) : void 0;
+  if (bodyNotPatterns?.length) validateRegexPatterns(bodyNotPatterns, `checks[${index}] body_not_patterns`);
   if (isLinkStatusCheck) {
     if (minCount !== void 0 && (!Number.isInteger(minCount) || minCount < 0)) {
       throw new Error(`checks[${index}] ${type} min_count must be a non-negative integer.`);
@@ -868,6 +881,9 @@ function normalizeCheck(input, index) {
     headers: isHttpStatusCheck ? stringRecord(input.headers) : void 0,
     body: isHttpStatusCheck ? stringValue(input.body) : void 0,
     body_json: isHttpStatusCheck && hasBodyJson ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : void 0,
+    body_contains: bodyContains,
+    body_not_contains: bodyNotContains,
+    body_not_patterns: bodyNotPatterns,
     expected_texts: expectedTexts,
     link_selector: stringValue(input.link_selector) || stringValue(input.linkSelector),
     source_selector: stringValue(input.source_selector) || stringValue(input.sourceSelector),
@@ -1039,6 +1055,24 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = check.body_contains?.filter(Boolean) ?? [];
+  if (!expected.length) return [];
+  const observed = isRecord(result.body_contains) ? result.body_contains : {};
+  return expected.filter((text) => observed[text] !== true);
+}
+function httpStatusBodyNotContainsFailures(result, check) {
+  const forbidden = check.body_not_contains?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_contains) ? result.body_not_contains : {};
+  return forbidden.filter((text) => observed[text] !== false);
+}
+function httpStatusBodyNotPatternFailures(result, check) {
+  const forbidden = check.body_not_patterns?.filter(Boolean) ?? [];
+  if (!forbidden.length) return [];
+  const observed = isRecord(result.body_not_patterns) ? result.body_not_patterns : {};
+  return forbidden.filter((pattern) => observed[pattern] !== false);
+}
 function linkStatusResultOk(result, check) {
   const status = numberValue(result.status);
   if (!httpStatusIsAllowed(status, check)) return false;
@@ -1053,6 +1087,9 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === void 0 || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotContainsFailures(result, check).length) return false;
+  if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
 function httpStatusEvidenceForCheck(viewport, check) {
@@ -1074,6 +1111,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(statusEvidence, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -1085,7 +1125,14 @@ function summarizeHttpStatusEvidence(viewport, check) {
       bytes: linkStatusObservedBytes(statusEvidence) ?? null,
       allowed_statuses: httpStatusAllowedStatuses(check) ?? ["2xx", "3xx"],
       min_bytes: check.min_bytes ?? null,
-      allowed_content_types: check.allowed_content_types ?? null
+      allowed_content_types: check.allowed_content_types ?? null,
+      body_contains: check.body_contains ?? null,
+      body_contains_missing: bodyContainsMissing,
+      body_not_contains: check.body_not_contains ?? null,
+      body_not_contains_found: bodyNotContainsFound,
+      body_not_patterns: check.body_not_patterns ?? null,
+      body_not_patterns_found: bodyNotPatternsFound,
+      body_sample: stringValue(statusEvidence.body_sample) ?? null
     });
   }
   return {
@@ -1100,6 +1147,13 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: stringValue(statusEvidence.content_type) ?? null,
     content_length: numberValue(statusEvidence.content_length) ?? null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: isRecord(statusEvidence.body_contains) ? toJsonValue(statusEvidence.body_contains) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(statusEvidence.body_not_contains) ? toJsonValue(statusEvidence.body_not_contains) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(statusEvidence.body_not_patterns) ? toJsonValue(statusEvidence.body_not_patterns) : null,
+    body_not_patterns_found: bodyNotPatternsFound,
+    body_sample: stringValue(statusEvidence.body_sample) ?? null,
     failures
   };
 }
@@ -1709,6 +1763,9 @@ function assessCheckFromEvidence(check, evidence) {
         require_nonzero_bytes: check.require_nonzero_bytes === true,
         min_bytes: check.min_bytes ?? null,
         allowed_content_types: check.allowed_content_types ?? null,
+        body_contains: check.body_contains ?? [],
+        body_not_contains: check.body_not_contains ?? [],
+        body_not_patterns: check.body_not_patterns ?? [],
         viewports: summaries.map((summary) => toJsonValue(summary)),
         failures: failed.flatMap((summary) => Array.isArray(summary.failures) ? summary.failures.map((failure) => toJsonValue({ viewport: stringValue(summary.viewport) ?? null, failure })) : [])
       },
@@ -2377,6 +2434,14 @@ function linkStatusContentTypeOk(result, check) {
     return actual === normalized;
   });
 }
+function httpStatusBodyContainsFailures(result, check) {
+  const expected = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  if (!expected.length) return [];
+  const observed = result && typeof result.body_contains === "object" && !Array.isArray(result.body_contains)
+    ? result.body_contains
+    : {};
+  return expected.filter((text) => observed[text] !== true);
+}
 function linkStatusResultOk(result, check) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return false;
   if (!httpStatusIsAllowed(result.status, check)) return false;
@@ -2391,6 +2456,7 @@ function linkStatusResultOk(result, check) {
     const observedBytes = linkStatusObservedBytes(result);
     if (observedBytes === undefined || observedBytes < check.min_bytes) return false;
   }
+  if (httpStatusBodyContainsFailures(result, check).length) return false;
   return true;
 }
 function summarizeHttpStatusEvidence(viewport, check) {
@@ -2408,6 +2474,7 @@ function summarizeHttpStatusEvidence(viewport, check) {
     };
   }
   const failures = [];
+  const bodyContainsMissing = httpStatusBodyContainsFailures(statusEvidence, check);
   if (!linkStatusResultOk(statusEvidence, check)) {
     failures.push({
       code: "http_status_failed",
@@ -2420,6 +2487,9 @@ function summarizeHttpStatusEvidence(viewport, check) {
       allowed_statuses: httpStatusAllowedStatuses(check) || ["2xx", "3xx"],
       min_bytes: typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes) ? check.min_bytes : null,
       allowed_content_types: Array.isArray(check.allowed_content_types) ? check.allowed_content_types : null,
+      body_contains: Array.isArray(check.body_contains) ? check.body_contains : null,
+      body_contains_missing: bodyContainsMissing,
+      body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     });
   }
   return {
@@ -2434,6 +2504,11 @@ function summarizeHttpStatusEvidence(viewport, check) {
     content_type: typeof statusEvidence.content_type === "string" ? statusEvidence.content_type : null,
     content_length: typeof statusEvidence.content_length === "number" && Number.isFinite(statusEvidence.content_length) ? statusEvidence.content_length : null,
     bytes: linkStatusObservedBytes(statusEvidence) ?? null,
+    body_contains: statusEvidence.body_contains && typeof statusEvidence.body_contains === "object" && !Array.isArray(statusEvidence.body_contains)
+      ? statusEvidence.body_contains
+      : null,
+    body_contains_missing: bodyContainsMissing,
+    body_sample: typeof statusEvidence.body_sample === "string" ? statusEvidence.body_sample : null,
     failures,
   };
 }
@@ -4427,6 +4502,9 @@ async function collectHttpStatus(check) {
   } else if (typeof check.body === "string") {
     body = check.body;
   }
+  const bodyContains = Array.isArray(check.body_contains) ? check.body_contains.filter(Boolean) : [];
+  const bodyNotContains = Array.isArray(check.body_not_contains) ? check.body_not_contains.filter(Boolean) : [];
+  const bodyNotPatterns = Array.isArray(check.body_not_patterns) ? check.body_not_patterns.filter(Boolean) : [];
   const options = {
     method,
     redirect: "follow",
@@ -4452,11 +4530,18 @@ async function collectHttpStatus(check) {
     Object.assign(result, linkProbeResponseFields(response, method));
     result.url = url;
     result.status_text = response.statusText || "";
-    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes));
+    const shouldReadBody = check.require_nonzero_bytes === true || (typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || bodyContains.length > 0 || bodyNotContains.length > 0 || bodyNotPatterns.length > 0;
     if (shouldReadBody) {
       try {
         const buffer = await response.arrayBuffer();
         result.bytes = buffer.byteLength;
+        if (bodyContains.length || bodyNotContains.length || bodyNotPatterns.length) {
+          const text = new TextDecoder().decode(buffer);
+          result.body_sample = text.slice(0, 1000);
+          if (bodyContains.length) result.body_contains = Object.fromEntries(bodyContains.map((expected) => [expected, text.includes(expected)]));
+          if (bodyNotContains.length) result.body_not_contains = Object.fromEntries(bodyNotContains.map((forbidden) => [forbidden, text.includes(forbidden)]));
+          if (bodyNotPatterns.length) result.body_not_patterns = Object.fromEntries(bodyNotPatterns.map((pattern) => [pattern, new RegExp(pattern).test(text)]));
+        }
       } catch (error) {
         result.error = String(error && error.message ? error.message : error).slice(0, 500);
       }
@@ -4465,6 +4550,9 @@ async function collectHttpStatus(check) {
       && linkProbeContentTypeAllowed(result, check)
       && (check.require_nonzero_bytes !== true || ((linkProbeObservedBytes(result) || 0) > 0))
       && (!(typeof check.min_bytes === "number" && Number.isFinite(check.min_bytes)) || ((linkProbeObservedBytes(result) || 0) >= check.min_bytes))
+      && (!bodyContains.length || bodyContains.every((expected) => result.body_contains && result.body_contains[expected] === true))
+      && (!bodyNotContains.length || bodyNotContains.every((forbidden) => result.body_not_contains && result.body_not_contains[forbidden] === false))
+      && (!bodyNotPatterns.length || bodyNotPatterns.every((pattern) => result.body_not_patterns && result.body_not_patterns[pattern] === false))
       && !result.error;
     return result;
   } catch (error) {

package/dist/profile.d.cts

@@ -119,6 +119,9 @@ interface RiddleProofProfileCheck {
     headers?: Record<string, string>;
     body?: string;
     body_json?: JsonValue;
+    body_contains?: string[];
+    body_not_contains?: string[];
+    body_not_patterns?: string[];
     expected_texts?: string[];
     link_selector?: string;
     source_selector?: string;

package/dist/profile.d.ts

@@ -119,6 +119,9 @@ interface RiddleProofProfileCheck {
     headers?: Record<string, string>;
     body?: string;
     body_json?: JsonValue;
+    body_contains?: string[];
+    body_not_contains?: string[];
+    body_not_patterns?: string[];
     expected_texts?: string[];
     link_selector?: string;
     source_selector?: string;

package/dist/profile.js

@@ -19,7 +19,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-OMTWNL4B.js";
+} from "./chunk-TRNLSX3U.js";
 export {
   RIDDLE_PROOF_PROFILE_CHECK_TYPES,
   RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.7.98",
+  "version": "0.7.100",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",