@riddledc/riddle-proof 0.7.122 → 0.7.123

package/README.md

@@ -216,6 +216,23 @@ required snippets make the command exit non-zero. This keeps Good Catch and
 audit-profile promotions tied to real artifacts instead of hand-authored token
 guesses.
 
+Before spending a hosted browser run on a public-promotion profile, preflight
+the profile-level `http_status` checks directly:
+
+```sh
+riddle-proof-loop profile-http-status-preflight \
+  --profile .riddle-proof/profiles/good-catch-promotion.json \
+  --url https://preview.riddledc.com/s/ps_12345678/ \
+  --format summary
+```
+
+The preflight resolves the profile's `http_status` URLs against the same base
+URL that `run-profile` would use, then verifies status, content type, byte
+requirements, `body_contains`, `body_not_contains`, and `body_not_patterns`.
+It exits non-zero if any body assertion is missing or any forbidden body text is
+present, which catches raw/escaped proof-artifact mistakes before a full
+viewport matrix run.
+
 The package includes generic starter profiles:
 
 - `examples/profiles/page-content-basic.json` for route/content/layout smoke profiles.

package/dist/{chunk-TBEVHMU3.js → chunk-JVZWSI55.js}

@@ -1221,6 +1221,134 @@ function linkStatusResultOk(result, check) {
   if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
+function responseHeader(response, name) {
+  const getter = response.headers?.get;
+  if (typeof getter !== "function") return null;
+  return getter.call(response.headers, name);
+}
+function responseContentLength(response) {
+  const value = responseHeader(response, "content-length");
+  return value && /^\d+$/.test(value) ? Number(value) : null;
+}
+async function responseBodyText(response) {
+  if (typeof response.arrayBuffer === "function") {
+    const buffer = await response.arrayBuffer();
+    return {
+      text: new TextDecoder().decode(buffer),
+      bytes: buffer.byteLength
+    };
+  }
+  if (typeof response.text === "function") {
+    const text = await response.text();
+    return {
+      text,
+      bytes: new TextEncoder().encode(text).byteLength
+    };
+  }
+  return { text: "", bytes: null };
+}
+function httpStatusRequestBody(check) {
+  const headers = isRecord(check.headers) ? Object.fromEntries(Object.entries(check.headers).map(([key, value]) => [key, String(value)]).filter(([key]) => key.trim())) : {};
+  if (check.body_json !== void 0) {
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+      headers["content-type"] = "application/json";
+    }
+    return { headers, body: JSON.stringify(check.body_json) };
+  }
+  if (typeof check.body === "string") {
+    return { headers, body: check.body };
+  }
+  return { headers };
+}
+async function preflightHttpStatusCheck(check, index, targetUrl, fetchImpl) {
+  const url = httpStatusRequestUrl(check, targetUrl);
+  const method = httpStatusMethod(check);
+  const request = httpStatusRequestBody(check);
+  const init = {
+    method,
+    redirect: "follow",
+    cache: "no-store",
+    headers: request.headers
+  };
+  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
+    init.body = request.body;
+  }
+  const result = {
+    status: null,
+    content_type: null,
+    content_length: null,
+    bytes: null
+  };
+  let error = null;
+  let statusText = "";
+  try {
+    const response = await fetchImpl(url, init);
+    result.status = typeof response.status === "number" && Number.isFinite(response.status) ? response.status : null;
+    statusText = typeof response.statusText === "string" ? response.statusText : "";
+    result.content_type = responseHeader(response, "content-type");
+    result.content_length = responseContentLength(response);
+    const shouldReadBody = check.require_nonzero_bytes === true || typeof check.min_bytes === "number" || Boolean(check.body_contains?.length) || Boolean(check.body_not_contains?.length) || Boolean(check.body_not_patterns?.length);
+    if (shouldReadBody && method !== "HEAD") {
+      const body = await responseBodyText(response);
+      result.bytes = body.bytes;
+      if (check.body_contains?.length) {
+        result.body_contains = Object.fromEntries(check.body_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_contains?.length) {
+        result.body_not_contains = Object.fromEntries(check.body_not_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_patterns?.length) {
+        result.body_not_patterns = Object.fromEntries(check.body_not_patterns.filter(Boolean).map((pattern) => [pattern, new RegExp(pattern).test(body.text)]));
+      }
+    }
+  } catch (caught) {
+    error = String(caught instanceof Error ? caught.message : caught).slice(0, 500);
+    result.error = error;
+  }
+  const bodyContainsMissing = httpStatusBodyContainsFailures(result, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(result, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(result, check);
+  const ok = !error && linkStatusResultOk(result, check);
+  return {
+    index,
+    label: checkLabel(check) || `checks[${index}]`,
+    url,
+    method,
+    ok,
+    status: numberValue(result.status) ?? null,
+    status_text: statusText,
+    error,
+    content_type: stringValue(result.content_type) ?? null,
+    content_length: numberValue(result.content_length) ?? null,
+    bytes: numberValue(result.bytes) ?? null,
+    body_contains: isRecord(result.body_contains) ? Object.fromEntries(Object.entries(result.body_contains).map(([key, value]) => [key, value === true])) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(result.body_not_contains) ? Object.fromEntries(Object.entries(result.body_not_contains).map(([key, value]) => [key, value === true])) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(result.body_not_patterns) ? Object.fromEntries(Object.entries(result.body_not_patterns).map(([key, value]) => [key, value === true])) : null,
+    body_not_patterns_found: bodyNotPatternsFound
+  };
+}
+async function preflightRiddleProofProfileHttpStatusChecks(profile, options = {}) {
+  const targetUrl = options.target_url || resolveRiddleProofProfileTargetUrl(profile);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error("profile http_status preflight requires fetch support or options.fetchImpl.");
+  }
+  const httpStatusChecks = profile.checks.map((check, index) => ({ check, index })).filter((item) => item.check.type === "http_status");
+  const checks = await Promise.all(httpStatusChecks.map((item) => preflightHttpStatusCheck(item.check, item.index, targetUrl, fetchImpl)));
+  const failed = checks.filter((check) => !check.ok).length;
+  return {
+    version: "riddle-proof.profile-http-status-preflight.v1",
+    ok: failed === 0,
+    profile_name: profile.name,
+    target_url: targetUrl,
+    checked: checks.length,
+    failed,
+    checks,
+    summary: failed === 0 ? `${profile.name} http_status preflight passed ${checks.length} check(s).` : `${profile.name} http_status preflight failed ${failed} of ${checks.length} check(s).`
+  };
+}
 function httpStatusEvidenceForCheck(viewport, check) {
   const evidence = viewport.http_statuses?.[httpStatusKey(check, viewport.url)];
   return isRecord(evidence) ? evidence : void 0;
@@ -5920,6 +6048,7 @@ export {
   normalizeRiddleProofProfile,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec,
+  preflightRiddleProofProfileHttpStatusChecks,
   resolveRiddleProofProfileRouteUrl,
   assessRiddleProofProfileEvidence,
   summarizeRiddleProofProfileResult,

package/dist/cli.cjs

@@ -8158,6 +8158,134 @@ function linkStatusResultOk(result, check) {
   if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
+function responseHeader(response, name) {
+  const getter = response.headers?.get;
+  if (typeof getter !== "function") return null;
+  return getter.call(response.headers, name);
+}
+function responseContentLength(response) {
+  const value = responseHeader(response, "content-length");
+  return value && /^\d+$/.test(value) ? Number(value) : null;
+}
+async function responseBodyText(response) {
+  if (typeof response.arrayBuffer === "function") {
+    const buffer = await response.arrayBuffer();
+    return {
+      text: new TextDecoder().decode(buffer),
+      bytes: buffer.byteLength
+    };
+  }
+  if (typeof response.text === "function") {
+    const text = await response.text();
+    return {
+      text,
+      bytes: new TextEncoder().encode(text).byteLength
+    };
+  }
+  return { text: "", bytes: null };
+}
+function httpStatusRequestBody(check) {
+  const headers = isRecord(check.headers) ? Object.fromEntries(Object.entries(check.headers).map(([key, value]) => [key, String(value)]).filter(([key]) => key.trim())) : {};
+  if (check.body_json !== void 0) {
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+      headers["content-type"] = "application/json";
+    }
+    return { headers, body: JSON.stringify(check.body_json) };
+  }
+  if (typeof check.body === "string") {
+    return { headers, body: check.body };
+  }
+  return { headers };
+}
+async function preflightHttpStatusCheck(check, index, targetUrl, fetchImpl) {
+  const url = httpStatusRequestUrl(check, targetUrl);
+  const method = httpStatusMethod(check);
+  const request = httpStatusRequestBody(check);
+  const init = {
+    method,
+    redirect: "follow",
+    cache: "no-store",
+    headers: request.headers
+  };
+  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
+    init.body = request.body;
+  }
+  const result = {
+    status: null,
+    content_type: null,
+    content_length: null,
+    bytes: null
+  };
+  let error = null;
+  let statusText = "";
+  try {
+    const response = await fetchImpl(url, init);
+    result.status = typeof response.status === "number" && Number.isFinite(response.status) ? response.status : null;
+    statusText = typeof response.statusText === "string" ? response.statusText : "";
+    result.content_type = responseHeader(response, "content-type");
+    result.content_length = responseContentLength(response);
+    const shouldReadBody = check.require_nonzero_bytes === true || typeof check.min_bytes === "number" || Boolean(check.body_contains?.length) || Boolean(check.body_not_contains?.length) || Boolean(check.body_not_patterns?.length);
+    if (shouldReadBody && method !== "HEAD") {
+      const body = await responseBodyText(response);
+      result.bytes = body.bytes;
+      if (check.body_contains?.length) {
+        result.body_contains = Object.fromEntries(check.body_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_contains?.length) {
+        result.body_not_contains = Object.fromEntries(check.body_not_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_patterns?.length) {
+        result.body_not_patterns = Object.fromEntries(check.body_not_patterns.filter(Boolean).map((pattern) => [pattern, new RegExp(pattern).test(body.text)]));
+      }
+    }
+  } catch (caught) {
+    error = String(caught instanceof Error ? caught.message : caught).slice(0, 500);
+    result.error = error;
+  }
+  const bodyContainsMissing = httpStatusBodyContainsFailures(result, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(result, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(result, check);
+  const ok = !error && linkStatusResultOk(result, check);
+  return {
+    index,
+    label: checkLabel(check) || `checks[${index}]`,
+    url,
+    method,
+    ok,
+    status: numberValue(result.status) ?? null,
+    status_text: statusText,
+    error,
+    content_type: stringValue2(result.content_type) ?? null,
+    content_length: numberValue(result.content_length) ?? null,
+    bytes: numberValue(result.bytes) ?? null,
+    body_contains: isRecord(result.body_contains) ? Object.fromEntries(Object.entries(result.body_contains).map(([key, value]) => [key, value === true])) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(result.body_not_contains) ? Object.fromEntries(Object.entries(result.body_not_contains).map(([key, value]) => [key, value === true])) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(result.body_not_patterns) ? Object.fromEntries(Object.entries(result.body_not_patterns).map(([key, value]) => [key, value === true])) : null,
+    body_not_patterns_found: bodyNotPatternsFound
+  };
+}
+async function preflightRiddleProofProfileHttpStatusChecks(profile, options = {}) {
+  const targetUrl = options.target_url || resolveRiddleProofProfileTargetUrl(profile);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error("profile http_status preflight requires fetch support or options.fetchImpl.");
+  }
+  const httpStatusChecks = profile.checks.map((check, index) => ({ check, index })).filter((item) => item.check.type === "http_status");
+  const checks = await Promise.all(httpStatusChecks.map((item) => preflightHttpStatusCheck(item.check, item.index, targetUrl, fetchImpl)));
+  const failed = checks.filter((check) => !check.ok).length;
+  return {
+    version: "riddle-proof.profile-http-status-preflight.v1",
+    ok: failed === 0,
+    profile_name: profile.name,
+    target_url: targetUrl,
+    checked: checks.length,
+    failed,
+    checks,
+    summary: failed === 0 ? `${profile.name} http_status preflight passed ${checks.length} check(s).` : `${profile.name} http_status preflight failed ${failed} of ${checks.length} check(s).`
+  };
+}
 function httpStatusEvidenceForCheck(viewport, check) {
   const evidence = viewport.http_statuses?.[httpStatusKey(check, viewport.url)];
   return isRecord(evidence) ? evidence : void 0;
@@ -12838,6 +12966,7 @@ function usage() {
     "  riddle-proof-loop status --state-path <path>",
     "  riddle-proof-loop run-profile --profile <file|json|-> --url <base-url> [--runner riddle] [--strict true|false; default false] [--poll-attempts n] [--output <dir>|--output-dir <dir>] [--quiet]",
     "  riddle-proof-loop profile-body-assertions --artifact <file|url|-> --candidates-json <file|json|-> [--required-json <file|json|->] [--format json|body-contains]",
+    "  riddle-proof-loop profile-http-status-preflight --profile <file|json|-> --url <base-url> [--format json|summary]",
     "  riddle-proof-loop riddle-preview-deploy <build-dir> <label> [--framework spa|static]",
     "  riddle-proof-loop riddle-server-preview <directory> --script-file <file> [--path /route] [--wait-for-selector selector]",
     "  riddle-proof-loop riddle-run-script --url <url> --script-file <file> [--viewport 1280x720] [--strict true|false]",
@@ -13118,6 +13247,27 @@ function normalizeProfileForCli(options) {
     viewports: parseProfileViewports(optionString(options, "viewports") || optionString(options, "viewport"))
   });
 }
+function profileHttpStatusPreflightSummary(result) {
+  const lines = [
+    result.summary,
+    `Profile: ${result.profile_name}`,
+    `Target: ${result.target_url}`,
+    `Checked: ${result.checked}`,
+    `Failed: ${result.failed}`
+  ];
+  for (const check of result.checks) {
+    lines.push(`- ${check.ok ? "passed" : "failed"}: ${check.method} ${check.url}`);
+    if (!check.ok) {
+      if (check.status !== null) lines.push(`  status: ${check.status}`);
+      if (check.error) lines.push(`  error: ${check.error}`);
+      if (check.body_contains_missing.length) lines.push(`  missing body_contains: ${check.body_contains_missing.join(", ")}`);
+      if (check.body_not_contains_found.length) lines.push(`  found body_not_contains: ${check.body_not_contains_found.join(", ")}`);
+      if (check.body_not_patterns_found.length) lines.push(`  found body_not_patterns: ${check.body_not_patterns_found.join(", ")}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
 function profileResultMarkdown(result) {
   const lines = [
     `# Riddle Proof Profile: ${result.profile_name}`,
@@ -13691,6 +13841,21 @@ async function main() {
     process.exitCode = profileStatusExitCode(profile, result.status);
     return;
   }
+  if (command === "profile-http-status-preflight") {
+    const profile = normalizeProfileForCli(options);
+    const result = await preflightRiddleProofProfileHttpStatusChecks(profile);
+    const format = optionString(options, "format") || "json";
+    if (format === "summary") {
+      process.stdout.write(profileHttpStatusPreflightSummary(result));
+    } else if (format === "json") {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    } else {
+      throw new Error("--format must be json or summary.");
+    }
+    process.exitCode = result.ok ? 0 : 1;
+    return;
+  }
   if (command === "profile-body-assertions") {
     const artifactText = await readTextValue(optionString(options, "artifact") ?? optionString(options, "input"), "--artifact");
     const candidates = readOptionalJsonStringArray(optionString(options, "candidatesJson") ?? optionString(options, "candidateJson"), "--candidates-json") ?? [];

package/dist/cli.js

@@ -8,10 +8,11 @@ import {
   deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult,
   normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec
-} from "./chunk-TBEVHMU3.js";
+} from "./chunk-JVZWSI55.js";
 import {
   createRiddleApiClient,
   parseRiddleViewport
@@ -47,6 +48,7 @@ function usage() {
     "  riddle-proof-loop status --state-path <path>",
     "  riddle-proof-loop run-profile --profile <file|json|-> --url <base-url> [--runner riddle] [--strict true|false; default false] [--poll-attempts n] [--output <dir>|--output-dir <dir>] [--quiet]",
     "  riddle-proof-loop profile-body-assertions --artifact <file|url|-> --candidates-json <file|json|-> [--required-json <file|json|->] [--format json|body-contains]",
+    "  riddle-proof-loop profile-http-status-preflight --profile <file|json|-> --url <base-url> [--format json|summary]",
     "  riddle-proof-loop riddle-preview-deploy <build-dir> <label> [--framework spa|static]",
     "  riddle-proof-loop riddle-server-preview <directory> --script-file <file> [--path /route] [--wait-for-selector selector]",
     "  riddle-proof-loop riddle-run-script --url <url> --script-file <file> [--viewport 1280x720] [--strict true|false]",
@@ -327,6 +329,27 @@ function normalizeProfileForCli(options) {
     viewports: parseProfileViewports(optionString(options, "viewports") || optionString(options, "viewport"))
   });
 }
+function profileHttpStatusPreflightSummary(result) {
+  const lines = [
+    result.summary,
+    `Profile: ${result.profile_name}`,
+    `Target: ${result.target_url}`,
+    `Checked: ${result.checked}`,
+    `Failed: ${result.failed}`
+  ];
+  for (const check of result.checks) {
+    lines.push(`- ${check.ok ? "passed" : "failed"}: ${check.method} ${check.url}`);
+    if (!check.ok) {
+      if (check.status !== null) lines.push(`  status: ${check.status}`);
+      if (check.error) lines.push(`  error: ${check.error}`);
+      if (check.body_contains_missing.length) lines.push(`  missing body_contains: ${check.body_contains_missing.join(", ")}`);
+      if (check.body_not_contains_found.length) lines.push(`  found body_not_contains: ${check.body_not_contains_found.join(", ")}`);
+      if (check.body_not_patterns_found.length) lines.push(`  found body_not_patterns: ${check.body_not_patterns_found.join(", ")}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
 function profileResultMarkdown(result) {
   const lines = [
     `# Riddle Proof Profile: ${result.profile_name}`,
@@ -900,6 +923,21 @@ async function main() {
     process.exitCode = profileStatusExitCode(profile, result.status);
     return;
   }
+  if (command === "profile-http-status-preflight") {
+    const profile = normalizeProfileForCli(options);
+    const result = await preflightRiddleProofProfileHttpStatusChecks(profile);
+    const format = optionString(options, "format") || "json";
+    if (format === "summary") {
+      process.stdout.write(profileHttpStatusPreflightSummary(result));
+    } else if (format === "json") {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    } else {
+      throw new Error("--format must be json or summary.");
+    }
+    process.exitCode = result.ok ? 0 : 1;
+    return;
+  }
   if (command === "profile-body-assertions") {
     const artifactText = await readTextValue(optionString(options, "artifact") ?? optionString(options, "input"), "--artifact");
     const candidates = readOptionalJsonStringArray(optionString(options, "candidatesJson") ?? optionString(options, "candidateJson"), "--candidates-json") ?? [];

package/dist/index.cjs

@@ -2991,6 +2991,7 @@ __export(index_exports, {
   parseRiddleViewport: () => parseRiddleViewport,
   parseVisualProofSession: () => parseVisualProofSession,
   pollRiddleJob: () => pollRiddleJob,
+  preflightRiddleProofProfileHttpStatusChecks: () => preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode: () => profileStatusExitCode,
   proofContractFromAuthorCheckpointResponse: () => proofContractFromAuthorCheckpointResponse,
   readRiddleProofRunStatus: () => readRiddleProofRunStatus,
@@ -9953,6 +9954,134 @@ function linkStatusResultOk(result, check) {
   if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
+function responseHeader(response, name) {
+  const getter = response.headers?.get;
+  if (typeof getter !== "function") return null;
+  return getter.call(response.headers, name);
+}
+function responseContentLength(response) {
+  const value = responseHeader(response, "content-length");
+  return value && /^\d+$/.test(value) ? Number(value) : null;
+}
+async function responseBodyText(response) {
+  if (typeof response.arrayBuffer === "function") {
+    const buffer = await response.arrayBuffer();
+    return {
+      text: new TextDecoder().decode(buffer),
+      bytes: buffer.byteLength
+    };
+  }
+  if (typeof response.text === "function") {
+    const text = await response.text();
+    return {
+      text,
+      bytes: new TextEncoder().encode(text).byteLength
+    };
+  }
+  return { text: "", bytes: null };
+}
+function httpStatusRequestBody(check) {
+  const headers = isRecord2(check.headers) ? Object.fromEntries(Object.entries(check.headers).map(([key, value]) => [key, String(value)]).filter(([key]) => key.trim())) : {};
+  if (check.body_json !== void 0) {
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+      headers["content-type"] = "application/json";
+    }
+    return { headers, body: JSON.stringify(check.body_json) };
+  }
+  if (typeof check.body === "string") {
+    return { headers, body: check.body };
+  }
+  return { headers };
+}
+async function preflightHttpStatusCheck(check, index, targetUrl, fetchImpl) {
+  const url = httpStatusRequestUrl(check, targetUrl);
+  const method = httpStatusMethod(check);
+  const request = httpStatusRequestBody(check);
+  const init = {
+    method,
+    redirect: "follow",
+    cache: "no-store",
+    headers: request.headers
+  };
+  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
+    init.body = request.body;
+  }
+  const result = {
+    status: null,
+    content_type: null,
+    content_length: null,
+    bytes: null
+  };
+  let error = null;
+  let statusText = "";
+  try {
+    const response = await fetchImpl(url, init);
+    result.status = typeof response.status === "number" && Number.isFinite(response.status) ? response.status : null;
+    statusText = typeof response.statusText === "string" ? response.statusText : "";
+    result.content_type = responseHeader(response, "content-type");
+    result.content_length = responseContentLength(response);
+    const shouldReadBody = check.require_nonzero_bytes === true || typeof check.min_bytes === "number" || Boolean(check.body_contains?.length) || Boolean(check.body_not_contains?.length) || Boolean(check.body_not_patterns?.length);
+    if (shouldReadBody && method !== "HEAD") {
+      const body = await responseBodyText(response);
+      result.bytes = body.bytes;
+      if (check.body_contains?.length) {
+        result.body_contains = Object.fromEntries(check.body_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_contains?.length) {
+        result.body_not_contains = Object.fromEntries(check.body_not_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_patterns?.length) {
+        result.body_not_patterns = Object.fromEntries(check.body_not_patterns.filter(Boolean).map((pattern) => [pattern, new RegExp(pattern).test(body.text)]));
+      }
+    }
+  } catch (caught) {
+    error = String(caught instanceof Error ? caught.message : caught).slice(0, 500);
+    result.error = error;
+  }
+  const bodyContainsMissing = httpStatusBodyContainsFailures(result, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(result, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(result, check);
+  const ok = !error && linkStatusResultOk(result, check);
+  return {
+    index,
+    label: checkLabel(check) || `checks[${index}]`,
+    url,
+    method,
+    ok,
+    status: numberValue3(result.status) ?? null,
+    status_text: statusText,
+    error,
+    content_type: stringValue5(result.content_type) ?? null,
+    content_length: numberValue3(result.content_length) ?? null,
+    bytes: numberValue3(result.bytes) ?? null,
+    body_contains: isRecord2(result.body_contains) ? Object.fromEntries(Object.entries(result.body_contains).map(([key, value]) => [key, value === true])) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord2(result.body_not_contains) ? Object.fromEntries(Object.entries(result.body_not_contains).map(([key, value]) => [key, value === true])) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord2(result.body_not_patterns) ? Object.fromEntries(Object.entries(result.body_not_patterns).map(([key, value]) => [key, value === true])) : null,
+    body_not_patterns_found: bodyNotPatternsFound
+  };
+}
+async function preflightRiddleProofProfileHttpStatusChecks(profile, options = {}) {
+  const targetUrl = options.target_url || resolveRiddleProofProfileTargetUrl(profile);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error("profile http_status preflight requires fetch support or options.fetchImpl.");
+  }
+  const httpStatusChecks = profile.checks.map((check, index) => ({ check, index })).filter((item) => item.check.type === "http_status");
+  const checks = await Promise.all(httpStatusChecks.map((item) => preflightHttpStatusCheck(item.check, item.index, targetUrl, fetchImpl)));
+  const failed = checks.filter((check) => !check.ok).length;
+  return {
+    version: "riddle-proof.profile-http-status-preflight.v1",
+    ok: failed === 0,
+    profile_name: profile.name,
+    target_url: targetUrl,
+    checked: checks.length,
+    failed,
+    checks,
+    summary: failed === 0 ? `${profile.name} http_status preflight passed ${checks.length} check(s).` : `${profile.name} http_status preflight failed ${failed} of ${checks.length} check(s).`
+  };
+}
 function httpStatusEvidenceForCheck(viewport, check) {
   const evidence = viewport.http_statuses?.[httpStatusKey(check, viewport.url)];
   return isRecord2(evidence) ? evidence : void 0;
@@ -15108,6 +15237,7 @@ function createRiddleApiClient(config = {}) {
   parseRiddleViewport,
   parseVisualProofSession,
   pollRiddleJob,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   proofContractFromAuthorCheckpointResponse,
   readRiddleProofRunStatus,

package/dist/index.d.cts

@@ -10,5 +10,5 @@ export { CreateCaptureDiagnosticInput, DEFAULT_DIAGNOSTIC_ARRAY_LIMIT, DEFAULT_D
 export { BuildVisualProofSessionInput, RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION, RIDDLE_PROOF_VISUAL_SESSION_VERSION, VisualProofSessionMismatch, buildVisualProofSession, compareVisualProofSessionFingerprint, parseVisualProofSession, visualSessionFingerprint, visualSessionFingerprintBasis } from './proof-session.cjs';
 export { AssessPlayabilityOptions, RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION, RIDDLE_PROOF_PLAYABILITY_VERSION, RiddleProofPlayabilityAssessment, RiddleProofPlayabilityEvidence, assessPlayabilityEvidence, extractPlayabilityEvidence, isRiddleProofPlayabilityMode } from './playability.cjs';
 export { AssessBasicGameplayOptions, AttachBasicGameplayArtifactOptions, BASIC_GAMEPLAY_ACTION_TYPES, BASIC_GAMEPLAY_PROGRESS_CHECK_TYPES, BasicGameplayActionResult, BasicGameplayActionType, BasicGameplayArtifactResolution, BasicGameplayAssessmentSummary, BasicGameplayBoundsOffender, BasicGameplayCanvasState, BasicGameplayCatchRecord, BasicGameplayChangeSummary, BasicGameplayFailureCode, BasicGameplayFixReference, BasicGameplayMetric, BasicGameplayMobileEvidence, BasicGameplayProgressCheckType, BasicGameplayProgressionCheck, BasicGameplayProofArtifact, BasicGameplayResponsiveViewportEvidence, BasicGameplayRouteReference, BasicGameplaySnapshot, BasicGameplaySuiteFailure, BasicGameplayWarningCode, CreateBasicGameplayCatchSummaryInput, RIDDLE_PROOF_BASIC_GAMEPLAY_ASSESSMENT_VERSION, RIDDLE_PROOF_BASIC_GAMEPLAY_CATCH_VERSION, RIDDLE_PROOF_BASIC_GAMEPLAY_VERSION, RiddleProofBasicGameplayAssessment, RiddleProofBasicGameplayCatchSummary, RiddleProofBasicGameplayEvidence, RiddleProofBasicGameplayRouteAssessment, RiddleProofBasicGameplayRouteEvidence, assessBasicGameplayEvidence, assessBasicGameplayProgressionCheck, assessBasicGameplayProgressionChecks, assessBasicGameplayRoute, attachBasicGameplayArtifactScreenshotHashes, augmentBasicGameplayAssessmentWithProgressionChecks, compactBasicGameplayText, createBasicGameplayCatchRecords, createBasicGameplayCatchSummary, extractBasicGameplayEvidence, resolveBasicGameplayProgressionCheckWithArtifactScreenshots, sanitizeBasicGameplayJsonString } from './basic-gameplay.cjs';
-export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofProfile, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.cjs';
+export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofProfile, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileHttpStatusPreflightCheckResult, RiddleProofProfileHttpStatusPreflightFetch, RiddleProofProfileHttpStatusPreflightFetchResponse, RiddleProofProfileHttpStatusPreflightOptions, RiddleProofProfileHttpStatusPreflightResult, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.cjs';
 export { DEFAULT_RIDDLE_API_BASE_URL, DEFAULT_RIDDLE_API_KEY_FILE, RiddleApiError, RiddleClientConfig, RiddleFetch, RiddlePollJobOptions, RiddlePollJobResult, RiddlePollProgressSnapshot, RiddlePollSummary, RiddlePreviewDeployResult, RiddlePreviewFramework, RiddleRunScriptInput, RiddleServerPreviewInput, RiddleServerPreviewResult, createRiddleApiClient, deployRiddlePreview, deployRiddleStaticPreview, isTerminalRiddleJobStatus, parseRiddleViewport, pollRiddleJob, resolveRiddleApiKey, riddleRequestJson, runRiddleScript, runRiddleServerPreview } from './riddle-client.cjs';

package/dist/index.d.ts

@@ -10,5 +10,5 @@ export { CreateCaptureDiagnosticInput, DEFAULT_DIAGNOSTIC_ARRAY_LIMIT, DEFAULT_D
 export { BuildVisualProofSessionInput, RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION, RIDDLE_PROOF_VISUAL_SESSION_VERSION, VisualProofSessionMismatch, buildVisualProofSession, compareVisualProofSessionFingerprint, parseVisualProofSession, visualSessionFingerprint, visualSessionFingerprintBasis } from './proof-session.js';
 export { AssessPlayabilityOptions, RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION, RIDDLE_PROOF_PLAYABILITY_VERSION, RiddleProofPlayabilityAssessment, RiddleProofPlayabilityEvidence, assessPlayabilityEvidence, extractPlayabilityEvidence, isRiddleProofPlayabilityMode } from './playability.js';
 export { AssessBasicGameplayOptions, AttachBasicGameplayArtifactOptions, BASIC_GAMEPLAY_ACTION_TYPES, BASIC_GAMEPLAY_PROGRESS_CHECK_TYPES, BasicGameplayActionResult, BasicGameplayActionType, BasicGameplayArtifactResolution, BasicGameplayAssessmentSummary, BasicGameplayBoundsOffender, BasicGameplayCanvasState, BasicGameplayCatchRecord, BasicGameplayChangeSummary, BasicGameplayFailureCode, BasicGameplayFixReference, BasicGameplayMetric, BasicGameplayMobileEvidence, BasicGameplayProgressCheckType, BasicGameplayProgressionCheck, BasicGameplayProofArtifact, BasicGameplayResponsiveViewportEvidence, BasicGameplayRouteReference, BasicGameplaySnapshot, BasicGameplaySuiteFailure, BasicGameplayWarningCode, CreateBasicGameplayCatchSummaryInput, RIDDLE_PROOF_BASIC_GAMEPLAY_ASSESSMENT_VERSION, RIDDLE_PROOF_BASIC_GAMEPLAY_CATCH_VERSION, RIDDLE_PROOF_BASIC_GAMEPLAY_VERSION, RiddleProofBasicGameplayAssessment, RiddleProofBasicGameplayCatchSummary, RiddleProofBasicGameplayEvidence, RiddleProofBasicGameplayRouteAssessment, RiddleProofBasicGameplayRouteEvidence, assessBasicGameplayEvidence, assessBasicGameplayProgressionCheck, assessBasicGameplayProgressionChecks, assessBasicGameplayRoute, attachBasicGameplayArtifactScreenshotHashes, augmentBasicGameplayAssessmentWithProgressionChecks, compactBasicGameplayText, createBasicGameplayCatchRecords, createBasicGameplayCatchSummary, extractBasicGameplayEvidence, resolveBasicGameplayProgressionCheckWithArtifactScreenshots, sanitizeBasicGameplayJsonString } from './basic-gameplay.js';
-export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofProfile, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.js';
+export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofProfile, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileHttpStatusPreflightCheckResult, RiddleProofProfileHttpStatusPreflightFetch, RiddleProofProfileHttpStatusPreflightFetchResponse, RiddleProofProfileHttpStatusPreflightOptions, RiddleProofProfileHttpStatusPreflightResult, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.js';
 export { DEFAULT_RIDDLE_API_BASE_URL, DEFAULT_RIDDLE_API_KEY_FILE, RiddleApiError, RiddleClientConfig, RiddleFetch, RiddlePollJobOptions, RiddlePollJobResult, RiddlePollProgressSnapshot, RiddlePollSummary, RiddlePreviewDeployResult, RiddlePreviewFramework, RiddleRunScriptInput, RiddleServerPreviewInput, RiddleServerPreviewResult, createRiddleApiClient, deployRiddlePreview, deployRiddleStaticPreview, isTerminalRiddleJobStatus, parseRiddleViewport, pollRiddleJob, resolveRiddleApiKey, riddleRequestJson, runRiddleScript, runRiddleServerPreview } from './riddle-client.js';

package/dist/index.js

@@ -55,13 +55,14 @@ import {
   deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult,
   normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-TBEVHMU3.js";
+} from "./chunk-JVZWSI55.js";
 import {
   DEFAULT_RIDDLE_API_BASE_URL,
   DEFAULT_RIDDLE_API_KEY_FILE,
@@ -234,6 +235,7 @@ export {
   parseRiddleViewport,
   parseVisualProofSession,
   pollRiddleJob,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   proofContractFromAuthorCheckpointResponse,
   readRiddleProofRunStatus,

package/dist/profile.cjs

@@ -37,6 +37,7 @@ __export(profile_exports, {
   deriveRiddleProofArtifactBodyAssertions: () => deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult: () => extractRiddleProofProfileResult,
   normalizeRiddleProofProfile: () => normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks: () => preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode: () => profileStatusExitCode,
   resolveRiddleProofProfileRouteUrl: () => resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl: () => resolveRiddleProofProfileTargetUrl,
@@ -1267,6 +1268,134 @@ function linkStatusResultOk(result, check) {
   if (httpStatusBodyNotPatternFailures(result, check).length) return false;
   return true;
 }
+function responseHeader(response, name) {
+  const getter = response.headers?.get;
+  if (typeof getter !== "function") return null;
+  return getter.call(response.headers, name);
+}
+function responseContentLength(response) {
+  const value = responseHeader(response, "content-length");
+  return value && /^\d+$/.test(value) ? Number(value) : null;
+}
+async function responseBodyText(response) {
+  if (typeof response.arrayBuffer === "function") {
+    const buffer = await response.arrayBuffer();
+    return {
+      text: new TextDecoder().decode(buffer),
+      bytes: buffer.byteLength
+    };
+  }
+  if (typeof response.text === "function") {
+    const text = await response.text();
+    return {
+      text,
+      bytes: new TextEncoder().encode(text).byteLength
+    };
+  }
+  return { text: "", bytes: null };
+}
+function httpStatusRequestBody(check) {
+  const headers = isRecord(check.headers) ? Object.fromEntries(Object.entries(check.headers).map(([key, value]) => [key, String(value)]).filter(([key]) => key.trim())) : {};
+  if (check.body_json !== void 0) {
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+      headers["content-type"] = "application/json";
+    }
+    return { headers, body: JSON.stringify(check.body_json) };
+  }
+  if (typeof check.body === "string") {
+    return { headers, body: check.body };
+  }
+  return { headers };
+}
+async function preflightHttpStatusCheck(check, index, targetUrl, fetchImpl) {
+  const url = httpStatusRequestUrl(check, targetUrl);
+  const method = httpStatusMethod(check);
+  const request = httpStatusRequestBody(check);
+  const init = {
+    method,
+    redirect: "follow",
+    cache: "no-store",
+    headers: request.headers
+  };
+  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
+    init.body = request.body;
+  }
+  const result = {
+    status: null,
+    content_type: null,
+    content_length: null,
+    bytes: null
+  };
+  let error = null;
+  let statusText = "";
+  try {
+    const response = await fetchImpl(url, init);
+    result.status = typeof response.status === "number" && Number.isFinite(response.status) ? response.status : null;
+    statusText = typeof response.statusText === "string" ? response.statusText : "";
+    result.content_type = responseHeader(response, "content-type");
+    result.content_length = responseContentLength(response);
+    const shouldReadBody = check.require_nonzero_bytes === true || typeof check.min_bytes === "number" || Boolean(check.body_contains?.length) || Boolean(check.body_not_contains?.length) || Boolean(check.body_not_patterns?.length);
+    if (shouldReadBody && method !== "HEAD") {
+      const body = await responseBodyText(response);
+      result.bytes = body.bytes;
+      if (check.body_contains?.length) {
+        result.body_contains = Object.fromEntries(check.body_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_contains?.length) {
+        result.body_not_contains = Object.fromEntries(check.body_not_contains.filter(Boolean).map((snippet) => [snippet, body.text.includes(snippet)]));
+      }
+      if (check.body_not_patterns?.length) {
+        result.body_not_patterns = Object.fromEntries(check.body_not_patterns.filter(Boolean).map((pattern) => [pattern, new RegExp(pattern).test(body.text)]));
+      }
+    }
+  } catch (caught) {
+    error = String(caught instanceof Error ? caught.message : caught).slice(0, 500);
+    result.error = error;
+  }
+  const bodyContainsMissing = httpStatusBodyContainsFailures(result, check);
+  const bodyNotContainsFound = httpStatusBodyNotContainsFailures(result, check);
+  const bodyNotPatternsFound = httpStatusBodyNotPatternFailures(result, check);
+  const ok = !error && linkStatusResultOk(result, check);
+  return {
+    index,
+    label: checkLabel(check) || `checks[${index}]`,
+    url,
+    method,
+    ok,
+    status: numberValue(result.status) ?? null,
+    status_text: statusText,
+    error,
+    content_type: stringValue(result.content_type) ?? null,
+    content_length: numberValue(result.content_length) ?? null,
+    bytes: numberValue(result.bytes) ?? null,
+    body_contains: isRecord(result.body_contains) ? Object.fromEntries(Object.entries(result.body_contains).map(([key, value]) => [key, value === true])) : null,
+    body_contains_missing: bodyContainsMissing,
+    body_not_contains: isRecord(result.body_not_contains) ? Object.fromEntries(Object.entries(result.body_not_contains).map(([key, value]) => [key, value === true])) : null,
+    body_not_contains_found: bodyNotContainsFound,
+    body_not_patterns: isRecord(result.body_not_patterns) ? Object.fromEntries(Object.entries(result.body_not_patterns).map(([key, value]) => [key, value === true])) : null,
+    body_not_patterns_found: bodyNotPatternsFound
+  };
+}
+async function preflightRiddleProofProfileHttpStatusChecks(profile, options = {}) {
+  const targetUrl = options.target_url || resolveRiddleProofProfileTargetUrl(profile);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error("profile http_status preflight requires fetch support or options.fetchImpl.");
+  }
+  const httpStatusChecks = profile.checks.map((check, index) => ({ check, index })).filter((item) => item.check.type === "http_status");
+  const checks = await Promise.all(httpStatusChecks.map((item) => preflightHttpStatusCheck(item.check, item.index, targetUrl, fetchImpl)));
+  const failed = checks.filter((check) => !check.ok).length;
+  return {
+    version: "riddle-proof.profile-http-status-preflight.v1",
+    ok: failed === 0,
+    profile_name: profile.name,
+    target_url: targetUrl,
+    checked: checks.length,
+    failed,
+    checks,
+    summary: failed === 0 ? `${profile.name} http_status preflight passed ${checks.length} check(s).` : `${profile.name} http_status preflight failed ${failed} of ${checks.length} check(s).`
+  };
+}
 function httpStatusEvidenceForCheck(viewport, check) {
   const evidence = viewport.http_statuses?.[httpStatusKey(check, viewport.url)];
   return isRecord(evidence) ? evidence : void 0;
@@ -5970,6 +6099,7 @@ function extractRiddleProofProfileResult(input) {
   deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult,
   normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl,

package/dist/profile.d.cts

@@ -28,6 +28,49 @@ interface RiddleProofArtifactBodyAssertionResult {
     missing_required: string[];
     warnings: string[];
 }
+interface RiddleProofProfileHttpStatusPreflightFetchResponse {
+    status?: number;
+    statusText?: string;
+    headers?: {
+        get?: (name: string) => string | null;
+    };
+    arrayBuffer?: () => Promise<ArrayBuffer>;
+    text?: () => Promise<string>;
+}
+type RiddleProofProfileHttpStatusPreflightFetch = (url: string, init?: Record<string, unknown>) => Promise<RiddleProofProfileHttpStatusPreflightFetchResponse>;
+interface RiddleProofProfileHttpStatusPreflightOptions {
+    fetchImpl?: RiddleProofProfileHttpStatusPreflightFetch;
+    target_url?: string;
+}
+interface RiddleProofProfileHttpStatusPreflightCheckResult {
+    index: number;
+    label: string;
+    url: string;
+    method: string;
+    ok: boolean;
+    status: number | null;
+    status_text: string;
+    error: string | null;
+    content_type: string | null;
+    content_length: number | null;
+    bytes: number | null;
+    body_contains: Record<string, boolean> | null;
+    body_contains_missing: string[];
+    body_not_contains: Record<string, boolean> | null;
+    body_not_contains_found: string[];
+    body_not_patterns: Record<string, boolean> | null;
+    body_not_patterns_found: string[];
+}
+interface RiddleProofProfileHttpStatusPreflightResult {
+    version: "riddle-proof.profile-http-status-preflight.v1";
+    ok: boolean;
+    profile_name: string;
+    target_url: string;
+    checked: number;
+    failed: number;
+    checks: RiddleProofProfileHttpStatusPreflightCheckResult[];
+    summary: string;
+}
 declare function deriveRiddleProofArtifactBodyAssertions(input: RiddleProofArtifactBodyAssertionInput): RiddleProofArtifactBodyAssertionResult;
 interface RiddleProofProfileViewport {
     name: string;
@@ -313,6 +356,7 @@ declare function collectRiddleProofProfileWarnings(profile: RiddleProofProfile):
 declare function normalizeRiddleProofProfile(input: unknown, options?: NormalizeRiddleProofProfileOptions): RiddleProofProfile;
 declare function resolveRiddleProofProfileTargetUrl(profile: RiddleProofProfile): string;
 declare function resolveRiddleProofProfileTimeoutSec(profile: RiddleProofProfile, requestedTimeoutSec?: number): number | undefined;
+declare function preflightRiddleProofProfileHttpStatusChecks(profile: RiddleProofProfile, options?: RiddleProofProfileHttpStatusPreflightOptions): Promise<RiddleProofProfileHttpStatusPreflightResult>;
 declare function resolveRiddleProofProfileRouteUrl(targetUrl: string, route: string): string;
 declare function assessRiddleProofProfileEvidence(profile: RiddleProofProfile, evidence: RiddleProofProfileEvidence | undefined, options?: {
     runner?: RiddleProofProfileRunner;
@@ -345,4 +389,4 @@ declare function buildRiddleProofProfileScript(profile: RiddleProofProfile): str
 declare function collectRiddleProfileArtifactRefs(input: unknown): RiddleProofProfileArtifactRef[];
 declare function extractRiddleProofProfileResult(input: unknown): RiddleProofProfileResult | undefined;
 
-export { type NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, type RiddleProofArtifactBodyAssertionInput, type RiddleProofArtifactBodyAssertionResult, type RiddleProofProfile, type RiddleProofProfileArtifactRef, type RiddleProofProfileBaselinePolicy, type RiddleProofProfileBoundsOffender, type RiddleProofProfileCheck, type RiddleProofProfileCheckResult, type RiddleProofProfileCheckType, type RiddleProofProfileEvidence, type RiddleProofProfileFailureAction, type RiddleProofProfileNetworkAbortErrorCode, type RiddleProofProfileNetworkMock, type RiddleProofProfileNetworkMockResponse, type RiddleProofProfileResult, type RiddleProofProfileRouteEvidence, type RiddleProofProfileRouteInventoryRoute, type RiddleProofProfileRunner, type RiddleProofProfileSetupAction, type RiddleProofProfileSetupActionType, type RiddleProofProfileStatus, type RiddleProofProfileTarget, type RiddleProofProfileViewport, type RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult };
+export { type NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, type RiddleProofArtifactBodyAssertionInput, type RiddleProofArtifactBodyAssertionResult, type RiddleProofProfile, type RiddleProofProfileArtifactRef, type RiddleProofProfileBaselinePolicy, type RiddleProofProfileBoundsOffender, type RiddleProofProfileCheck, type RiddleProofProfileCheckResult, type RiddleProofProfileCheckType, type RiddleProofProfileEvidence, type RiddleProofProfileFailureAction, type RiddleProofProfileHttpStatusPreflightCheckResult, type RiddleProofProfileHttpStatusPreflightFetch, type RiddleProofProfileHttpStatusPreflightFetchResponse, type RiddleProofProfileHttpStatusPreflightOptions, type RiddleProofProfileHttpStatusPreflightResult, type RiddleProofProfileNetworkAbortErrorCode, type RiddleProofProfileNetworkMock, type RiddleProofProfileNetworkMockResponse, type RiddleProofProfileResult, type RiddleProofProfileRouteEvidence, type RiddleProofProfileRouteInventoryRoute, type RiddleProofProfileRunner, type RiddleProofProfileSetupAction, type RiddleProofProfileSetupActionType, type RiddleProofProfileStatus, type RiddleProofProfileTarget, type RiddleProofProfileViewport, type RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult };

package/dist/profile.d.ts

@@ -28,6 +28,49 @@ interface RiddleProofArtifactBodyAssertionResult {
     missing_required: string[];
     warnings: string[];
 }
+interface RiddleProofProfileHttpStatusPreflightFetchResponse {
+    status?: number;
+    statusText?: string;
+    headers?: {
+        get?: (name: string) => string | null;
+    };
+    arrayBuffer?: () => Promise<ArrayBuffer>;
+    text?: () => Promise<string>;
+}
+type RiddleProofProfileHttpStatusPreflightFetch = (url: string, init?: Record<string, unknown>) => Promise<RiddleProofProfileHttpStatusPreflightFetchResponse>;
+interface RiddleProofProfileHttpStatusPreflightOptions {
+    fetchImpl?: RiddleProofProfileHttpStatusPreflightFetch;
+    target_url?: string;
+}
+interface RiddleProofProfileHttpStatusPreflightCheckResult {
+    index: number;
+    label: string;
+    url: string;
+    method: string;
+    ok: boolean;
+    status: number | null;
+    status_text: string;
+    error: string | null;
+    content_type: string | null;
+    content_length: number | null;
+    bytes: number | null;
+    body_contains: Record<string, boolean> | null;
+    body_contains_missing: string[];
+    body_not_contains: Record<string, boolean> | null;
+    body_not_contains_found: string[];
+    body_not_patterns: Record<string, boolean> | null;
+    body_not_patterns_found: string[];
+}
+interface RiddleProofProfileHttpStatusPreflightResult {
+    version: "riddle-proof.profile-http-status-preflight.v1";
+    ok: boolean;
+    profile_name: string;
+    target_url: string;
+    checked: number;
+    failed: number;
+    checks: RiddleProofProfileHttpStatusPreflightCheckResult[];
+    summary: string;
+}
 declare function deriveRiddleProofArtifactBodyAssertions(input: RiddleProofArtifactBodyAssertionInput): RiddleProofArtifactBodyAssertionResult;
 interface RiddleProofProfileViewport {
     name: string;
@@ -313,6 +356,7 @@ declare function collectRiddleProofProfileWarnings(profile: RiddleProofProfile):
 declare function normalizeRiddleProofProfile(input: unknown, options?: NormalizeRiddleProofProfileOptions): RiddleProofProfile;
 declare function resolveRiddleProofProfileTargetUrl(profile: RiddleProofProfile): string;
 declare function resolveRiddleProofProfileTimeoutSec(profile: RiddleProofProfile, requestedTimeoutSec?: number): number | undefined;
+declare function preflightRiddleProofProfileHttpStatusChecks(profile: RiddleProofProfile, options?: RiddleProofProfileHttpStatusPreflightOptions): Promise<RiddleProofProfileHttpStatusPreflightResult>;
 declare function resolveRiddleProofProfileRouteUrl(targetUrl: string, route: string): string;
 declare function assessRiddleProofProfileEvidence(profile: RiddleProofProfile, evidence: RiddleProofProfileEvidence | undefined, options?: {
     runner?: RiddleProofProfileRunner;
@@ -345,4 +389,4 @@ declare function buildRiddleProofProfileScript(profile: RiddleProofProfile): str
 declare function collectRiddleProfileArtifactRefs(input: unknown): RiddleProofProfileArtifactRef[];
 declare function extractRiddleProofProfileResult(input: unknown): RiddleProofProfileResult | undefined;
 
-export { type NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, type RiddleProofArtifactBodyAssertionInput, type RiddleProofArtifactBodyAssertionResult, type RiddleProofProfile, type RiddleProofProfileArtifactRef, type RiddleProofProfileBaselinePolicy, type RiddleProofProfileBoundsOffender, type RiddleProofProfileCheck, type RiddleProofProfileCheckResult, type RiddleProofProfileCheckType, type RiddleProofProfileEvidence, type RiddleProofProfileFailureAction, type RiddleProofProfileNetworkAbortErrorCode, type RiddleProofProfileNetworkMock, type RiddleProofProfileNetworkMockResponse, type RiddleProofProfileResult, type RiddleProofProfileRouteEvidence, type RiddleProofProfileRouteInventoryRoute, type RiddleProofProfileRunner, type RiddleProofProfileSetupAction, type RiddleProofProfileSetupActionType, type RiddleProofProfileStatus, type RiddleProofProfileTarget, type RiddleProofProfileViewport, type RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult };
+export { type NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, type RiddleProofArtifactBodyAssertionInput, type RiddleProofArtifactBodyAssertionResult, type RiddleProofProfile, type RiddleProofProfileArtifactRef, type RiddleProofProfileBaselinePolicy, type RiddleProofProfileBoundsOffender, type RiddleProofProfileCheck, type RiddleProofProfileCheckResult, type RiddleProofProfileCheckType, type RiddleProofProfileEvidence, type RiddleProofProfileFailureAction, type RiddleProofProfileHttpStatusPreflightCheckResult, type RiddleProofProfileHttpStatusPreflightFetch, type RiddleProofProfileHttpStatusPreflightFetchResponse, type RiddleProofProfileHttpStatusPreflightOptions, type RiddleProofProfileHttpStatusPreflightResult, type RiddleProofProfileNetworkAbortErrorCode, type RiddleProofProfileNetworkMock, type RiddleProofProfileNetworkMockResponse, type RiddleProofProfileResult, type RiddleProofProfileRouteEvidence, type RiddleProofProfileRouteInventoryRoute, type RiddleProofProfileRunner, type RiddleProofProfileSetupAction, type RiddleProofProfileSetupActionType, type RiddleProofProfileStatus, type RiddleProofProfileTarget, type RiddleProofProfileViewport, type RiddleProofProfileViewportEvidence, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult };

package/dist/profile.js

@@ -16,13 +16,14 @@ import {
   deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult,
   normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-TBEVHMU3.js";
+} from "./chunk-JVZWSI55.js";
 export {
   RIDDLE_PROOF_PROFILE_CHECK_TYPES,
   RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION,
@@ -41,6 +42,7 @@ export {
   deriveRiddleProofArtifactBodyAssertions,
   extractRiddleProofProfileResult,
   normalizeRiddleProofProfile,
+  preflightRiddleProofProfileHttpStatusChecks,
   profileStatusExitCode,
   resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl,

package/dist/proof-run-engine.d.cts

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;

package/dist/proof-run-engine.d.ts

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.7.122",
+  "version": "0.7.123",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",