@riddledc/riddle-proof 0.7.45 → 0.7.47

package/README.md

@@ -224,11 +224,15 @@ success pair across multiple viewports. Repeated sequences also record
 `sequence_cycle: true` after the first cycle.
 
 Set `capture_request_body: true` to include compact request-body evidence on
-mock hits. Add `request_body_contains` or `request_body_patterns` when the
-request body is part of the contract, such as proving that a save request
-references the build ID returned by a prior mocked build response. Body
-assertions use the full request body for matching and store only length plus a
-compact sample in the proof evidence.
+mock hits. Add `request_body_contains` / `request_body_patterns` or
+`request_body_not_contains` / `request_body_not_patterns` when the request body
+is part of the contract, such as proving that a save request references the
+current build ID returned by a prior mocked build response and not a stale one.
+Body assertions use the full request body for matching and store only length
+plus a compact sample in the proof evidence. For sequenced mocks, the same
+request-body fields may also be placed on individual `responses[]` entries when
+each step has a different request contract, such as a fail-then-success retry
+where the second request must carry newer state.
 
 `target.setup_actions` is optional. Use it when the meaningful proof surface
 appears only after a picker, tab, login stub, storage seed, form fill,

package/dist/{chunk-IJGMTTVP.js → chunk-NJDY7HYE.js}

@@ -253,15 +253,7 @@ function normalizeNetworkMock(input, index) {
   const payload = normalizeNetworkMockResponsePayload(input, `target.network_mocks[${index}]`);
   const responsesInput = input.responses ?? input.sequence;
   const responses = normalizeNetworkMockResponses(responsesInput, index, payload);
-  const requestBodyContains = normalizeStringList(
-    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
-    `target.network_mocks[${index}].request_body_contains`
-  );
-  const requestBodyPatterns = normalizeStringList(
-    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
-    `target.network_mocks[${index}].request_body_patterns`
-  );
-  validateRegexPatterns(requestBodyPatterns, `target.network_mocks[${index}].request_body_patterns`);
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, `target.network_mocks[${index}]`);
   const requiredHitCount = numberValue(
     input.required_hit_count ?? input.requiredHitCount ?? input.required_hits ?? input.requiredHits ?? input.min_hits ?? input.minHits
   );
@@ -277,9 +269,38 @@ function normalizeNetworkMock(input, index) {
     repeat_responses: input.repeat_responses === true || input.repeatResponses === true || input.cycle_responses === true || input.cycleResponses === true,
     required_hit_count: requiredHitCount,
     required: input.required === false ? false : true,
-    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length),
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
+  };
+}
+function normalizeNetworkMockRequestBodyConstraints(input, label) {
+  const requestBodyContains = normalizeStringList(
+    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
+    `${label}.request_body_contains`
+  );
+  const requestBodyPatterns = normalizeStringList(
+    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
+    `${label}.request_body_patterns`
+  );
+  validateRegexPatterns(requestBodyPatterns, `${label}.request_body_patterns`);
+  const requestBodyNotContains = normalizeStringList(
+    input.request_body_not_contains ?? input.requestBodyNotContains ?? input.request_body_absent ?? input.requestBodyAbsent ?? input.body_not_contains ?? input.bodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `${label}.request_body_not_contains`
+  );
+  const requestBodyNotPatterns = normalizeStringList(
+    input.request_body_not_patterns ?? input.requestBodyNotPatterns ?? input.request_body_forbidden_patterns ?? input.requestBodyForbiddenPatterns ?? input.body_not_patterns ?? input.bodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `${label}.request_body_not_patterns`
+  );
+  validateRegexPatterns(requestBodyNotPatterns, `${label}.request_body_not_patterns`);
+  return {
+    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length) || Boolean(requestBodyNotContains?.length) || Boolean(requestBodyNotPatterns?.length),
     request_body_contains: requestBodyContains,
-    request_body_patterns: requestBodyPatterns
+    request_body_patterns: requestBodyPatterns,
+    request_body_not_contains: requestBodyNotContains,
+    request_body_not_patterns: requestBodyNotPatterns
   };
 }
 function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
@@ -289,20 +310,33 @@ function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
   }
   const body = stringValue(input.body) ?? stringValue(input.body_text) ?? stringValue(input.bodyText) ?? defaults.body;
   const hasJsonBody = Object.prototype.hasOwnProperty.call(input, "body_json") || Object.prototype.hasOwnProperty.call(input, "bodyJson") || Object.prototype.hasOwnProperty.call(input, "json");
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, label);
   return {
     label: stringValue(input.label) || stringValue(input.name) || defaults.label,
     status,
     content_type: stringValue(input.content_type) || stringValue(input.contentType) || defaults.content_type,
     headers: stringRecord(input.headers) || defaults.headers,
     body,
-    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json
+    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json,
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
   };
 }
 function normalizeNetworkMockResponses(value, mockIndex, defaults) {
   if (value === void 0) return void 0;
   if (!Array.isArray(value)) throw new Error(`target.network_mocks[${mockIndex}].responses must be an array.`);
   if (!value.length) throw new Error(`target.network_mocks[${mockIndex}].responses must not be empty.`);
-  const responseDefaults = { ...defaults, label: void 0 };
+  const responseDefaults = {
+    label: void 0,
+    status: defaults.status,
+    content_type: defaults.content_type,
+    headers: defaults.headers,
+    body: defaults.body,
+    body_json: defaults.body_json
+  };
   return value.map((response, responseIndex) => {
     if (!isRecord(response)) {
       throw new Error(`target.network_mocks[${mockIndex}].responses[${responseIndex}] must be an object.`);
@@ -1045,6 +1079,9 @@ function assessNetworkMocksFromEvidence(profile, evidence) {
     if (event.request_body_matches === false) {
       failed.push({
         label: event.label ?? null,
+        response_label: event.response_label ?? null,
+        hit_index: event.hit_index ?? null,
+        response_index: event.response_index ?? null,
         url: event.url ?? null,
         method: event.method ?? null,
         reason: "request_body_mismatch",
@@ -1428,6 +1465,9 @@ function assessProfile(profile, evidence) {
       if (event && event.request_body_matches === false) {
         failed.push({
           label: event.label || null,
+          response_label: event.response_label || null,
+          hit_index: event.hit_index ?? null,
+          response_index: event.response_index ?? null,
           url: event.url || null,
           method: event.method || null,
           reason: "request_body_mismatch",
@@ -1892,18 +1932,21 @@ function compactNetworkMockRequestBody(value) {
 function networkMockStringList(value) {
   return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
 }
-function networkMockShouldCaptureRequestBody(mock) {
-  return mock && (
-    mock.capture_request_body === true
-    || networkMockStringList(mock.request_body_contains).length > 0
-    || networkMockStringList(mock.request_body_patterns).length > 0
-  );
+function networkMockShouldCaptureRequestBody(...sources) {
+  return sources.some((source) => source && (
+    source.capture_request_body === true
+    || networkMockStringList(source.request_body_contains).length > 0
+    || networkMockStringList(source.request_body_patterns).length > 0
+    || networkMockStringList(source.request_body_not_contains).length > 0
+    || networkMockStringList(source.request_body_not_patterns).length > 0
+  ));
 }
-function networkMockRequestBodyFailures(body, mock) {
+function networkMockRequestBodyFailuresForSource(body, source) {
   const failures = [];
+  if (!source) return failures;
   const rawBody = String(body || "");
   const compactBody = compactNetworkMockRequestBody(rawBody);
-  for (const expected of networkMockStringList(mock.request_body_contains)) {
+  for (const expected of networkMockStringList(source.request_body_contains)) {
     if (!rawBody.includes(expected) && !compactBody.includes(expected)) {
       failures.push({
         type: "request_body_missing_text",
@@ -1911,7 +1954,7 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
-  for (const pattern of networkMockStringList(mock.request_body_patterns)) {
+  for (const pattern of networkMockStringList(source.request_body_patterns)) {
     try {
       const regex = new RegExp(pattern);
       if (!regex.test(rawBody) && !regex.test(compactBody)) {
@@ -1928,8 +1971,36 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
+  for (const forbidden of networkMockStringList(source.request_body_not_contains)) {
+    if (rawBody.includes(forbidden) || compactBody.includes(forbidden)) {
+      failures.push({
+        type: "request_body_forbidden_text",
+        text: String(forbidden).slice(0, 200),
+      });
+    }
+  }
+  for (const pattern of networkMockStringList(source.request_body_not_patterns)) {
+    try {
+      const regex = new RegExp(pattern);
+      if (regex.test(rawBody) || regex.test(compactBody)) {
+        failures.push({
+          type: "request_body_forbidden_pattern_matched",
+          pattern: String(pattern).slice(0, 200),
+        });
+      }
+    } catch (error) {
+      failures.push({
+        type: "request_body_invalid_pattern",
+        pattern: String(pattern).slice(0, 200),
+        error: String(error && error.message ? error.message : error).slice(0, 500),
+      });
+    }
+  }
   return failures;
 }
+function networkMockRequestBodyFailures(body, ...sources) {
+  return sources.flatMap((source) => networkMockRequestBodyFailuresForSource(body, source));
+}
 async function setupLocatorVisible(locator, index) {
   return await locator.nth(index).isVisible({ timeout: 1000 }).catch(() => false);
 }
@@ -1958,9 +2029,10 @@ async function registerNetworkMocks(mocks) {
           body = JSON.stringify(response.body_json);
           contentType = response.content_type || headers["content-type"] || headers["Content-Type"] || "application/json";
         }
-        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock);
+        const responseBodyContract = responseIndex === null ? null : response;
+        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock, responseBodyContract);
         const requestBody = shouldCaptureRequestBody && request.postData ? request.postData() || "" : "";
-        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock) : [];
+        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock, responseBodyContract) : [];
         const status = response.status || mock.status || 200;
         const event = {
           ok: true,

package/dist/cli.cjs

@@ -7126,15 +7126,7 @@ function normalizeNetworkMock(input, index) {
   const payload = normalizeNetworkMockResponsePayload(input, `target.network_mocks[${index}]`);
   const responsesInput = input.responses ?? input.sequence;
   const responses = normalizeNetworkMockResponses(responsesInput, index, payload);
-  const requestBodyContains = normalizeStringList(
-    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
-    `target.network_mocks[${index}].request_body_contains`
-  );
-  const requestBodyPatterns = normalizeStringList(
-    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
-    `target.network_mocks[${index}].request_body_patterns`
-  );
-  validateRegexPatterns(requestBodyPatterns, `target.network_mocks[${index}].request_body_patterns`);
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, `target.network_mocks[${index}]`);
   const requiredHitCount = numberValue(
     input.required_hit_count ?? input.requiredHitCount ?? input.required_hits ?? input.requiredHits ?? input.min_hits ?? input.minHits
   );
@@ -7150,9 +7142,38 @@ function normalizeNetworkMock(input, index) {
     repeat_responses: input.repeat_responses === true || input.repeatResponses === true || input.cycle_responses === true || input.cycleResponses === true,
     required_hit_count: requiredHitCount,
     required: input.required === false ? false : true,
-    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length),
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
+  };
+}
+function normalizeNetworkMockRequestBodyConstraints(input, label) {
+  const requestBodyContains = normalizeStringList(
+    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
+    `${label}.request_body_contains`
+  );
+  const requestBodyPatterns = normalizeStringList(
+    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
+    `${label}.request_body_patterns`
+  );
+  validateRegexPatterns(requestBodyPatterns, `${label}.request_body_patterns`);
+  const requestBodyNotContains = normalizeStringList(
+    input.request_body_not_contains ?? input.requestBodyNotContains ?? input.request_body_absent ?? input.requestBodyAbsent ?? input.body_not_contains ?? input.bodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `${label}.request_body_not_contains`
+  );
+  const requestBodyNotPatterns = normalizeStringList(
+    input.request_body_not_patterns ?? input.requestBodyNotPatterns ?? input.request_body_forbidden_patterns ?? input.requestBodyForbiddenPatterns ?? input.body_not_patterns ?? input.bodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `${label}.request_body_not_patterns`
+  );
+  validateRegexPatterns(requestBodyNotPatterns, `${label}.request_body_not_patterns`);
+  return {
+    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length) || Boolean(requestBodyNotContains?.length) || Boolean(requestBodyNotPatterns?.length),
     request_body_contains: requestBodyContains,
-    request_body_patterns: requestBodyPatterns
+    request_body_patterns: requestBodyPatterns,
+    request_body_not_contains: requestBodyNotContains,
+    request_body_not_patterns: requestBodyNotPatterns
   };
 }
 function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
@@ -7162,20 +7183,33 @@ function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
   }
   const body = stringValue2(input.body) ?? stringValue2(input.body_text) ?? stringValue2(input.bodyText) ?? defaults.body;
   const hasJsonBody = Object.prototype.hasOwnProperty.call(input, "body_json") || Object.prototype.hasOwnProperty.call(input, "bodyJson") || Object.prototype.hasOwnProperty.call(input, "json");
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, label);
   return {
     label: stringValue2(input.label) || stringValue2(input.name) || defaults.label,
     status,
     content_type: stringValue2(input.content_type) || stringValue2(input.contentType) || defaults.content_type,
     headers: stringRecord(input.headers) || defaults.headers,
     body,
-    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json
+    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json,
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
   };
 }
 function normalizeNetworkMockResponses(value, mockIndex, defaults) {
   if (value === void 0) return void 0;
   if (!Array.isArray(value)) throw new Error(`target.network_mocks[${mockIndex}].responses must be an array.`);
   if (!value.length) throw new Error(`target.network_mocks[${mockIndex}].responses must not be empty.`);
-  const responseDefaults = { ...defaults, label: void 0 };
+  const responseDefaults = {
+    label: void 0,
+    status: defaults.status,
+    content_type: defaults.content_type,
+    headers: defaults.headers,
+    body: defaults.body,
+    body_json: defaults.body_json
+  };
   return value.map((response, responseIndex) => {
     if (!isRecord(response)) {
       throw new Error(`target.network_mocks[${mockIndex}].responses[${responseIndex}] must be an object.`);
@@ -7918,6 +7952,9 @@ function assessNetworkMocksFromEvidence(profile, evidence) {
     if (event.request_body_matches === false) {
       failed.push({
         label: event.label ?? null,
+        response_label: event.response_label ?? null,
+        hit_index: event.hit_index ?? null,
+        response_index: event.response_index ?? null,
         url: event.url ?? null,
         method: event.method ?? null,
         reason: "request_body_mismatch",
@@ -8285,6 +8322,9 @@ function assessProfile(profile, evidence) {
       if (event && event.request_body_matches === false) {
         failed.push({
           label: event.label || null,
+          response_label: event.response_label || null,
+          hit_index: event.hit_index ?? null,
+          response_index: event.response_index ?? null,
           url: event.url || null,
           method: event.method || null,
           reason: "request_body_mismatch",
@@ -8749,18 +8789,21 @@ function compactNetworkMockRequestBody(value) {
 function networkMockStringList(value) {
   return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
 }
-function networkMockShouldCaptureRequestBody(mock) {
-  return mock && (
-    mock.capture_request_body === true
-    || networkMockStringList(mock.request_body_contains).length > 0
-    || networkMockStringList(mock.request_body_patterns).length > 0
-  );
+function networkMockShouldCaptureRequestBody(...sources) {
+  return sources.some((source) => source && (
+    source.capture_request_body === true
+    || networkMockStringList(source.request_body_contains).length > 0
+    || networkMockStringList(source.request_body_patterns).length > 0
+    || networkMockStringList(source.request_body_not_contains).length > 0
+    || networkMockStringList(source.request_body_not_patterns).length > 0
+  ));
 }
-function networkMockRequestBodyFailures(body, mock) {
+function networkMockRequestBodyFailuresForSource(body, source) {
   const failures = [];
+  if (!source) return failures;
   const rawBody = String(body || "");
   const compactBody = compactNetworkMockRequestBody(rawBody);
-  for (const expected of networkMockStringList(mock.request_body_contains)) {
+  for (const expected of networkMockStringList(source.request_body_contains)) {
     if (!rawBody.includes(expected) && !compactBody.includes(expected)) {
       failures.push({
         type: "request_body_missing_text",
@@ -8768,7 +8811,7 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
-  for (const pattern of networkMockStringList(mock.request_body_patterns)) {
+  for (const pattern of networkMockStringList(source.request_body_patterns)) {
     try {
       const regex = new RegExp(pattern);
       if (!regex.test(rawBody) && !regex.test(compactBody)) {
@@ -8785,8 +8828,36 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
+  for (const forbidden of networkMockStringList(source.request_body_not_contains)) {
+    if (rawBody.includes(forbidden) || compactBody.includes(forbidden)) {
+      failures.push({
+        type: "request_body_forbidden_text",
+        text: String(forbidden).slice(0, 200),
+      });
+    }
+  }
+  for (const pattern of networkMockStringList(source.request_body_not_patterns)) {
+    try {
+      const regex = new RegExp(pattern);
+      if (regex.test(rawBody) || regex.test(compactBody)) {
+        failures.push({
+          type: "request_body_forbidden_pattern_matched",
+          pattern: String(pattern).slice(0, 200),
+        });
+      }
+    } catch (error) {
+      failures.push({
+        type: "request_body_invalid_pattern",
+        pattern: String(pattern).slice(0, 200),
+        error: String(error && error.message ? error.message : error).slice(0, 500),
+      });
+    }
+  }
   return failures;
 }
+function networkMockRequestBodyFailures(body, ...sources) {
+  return sources.flatMap((source) => networkMockRequestBodyFailuresForSource(body, source));
+}
 async function setupLocatorVisible(locator, index) {
   return await locator.nth(index).isVisible({ timeout: 1000 }).catch(() => false);
 }
@@ -8815,9 +8886,10 @@ async function registerNetworkMocks(mocks) {
           body = JSON.stringify(response.body_json);
           contentType = response.content_type || headers["content-type"] || headers["Content-Type"] || "application/json";
         }
-        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock);
+        const responseBodyContract = responseIndex === null ? null : response;
+        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock, responseBodyContract);
         const requestBody = shouldCaptureRequestBody && request.postData ? request.postData() || "" : "";
-        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock) : [];
+        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock, responseBodyContract) : [];
         const status = response.status || mock.status || 200;
         const event = {
           ok: true,

package/dist/cli.js

@@ -10,7 +10,7 @@ import {
   profileStatusExitCode,
   resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec
-} from "./chunk-IJGMTTVP.js";
+} from "./chunk-NJDY7HYE.js";
 import {
   createRiddleApiClient,
   parseRiddleViewport

package/dist/index.cjs

@@ -8967,15 +8967,7 @@ function normalizeNetworkMock(input, index) {
   const payload = normalizeNetworkMockResponsePayload(input, `target.network_mocks[${index}]`);
   const responsesInput = input.responses ?? input.sequence;
   const responses = normalizeNetworkMockResponses(responsesInput, index, payload);
-  const requestBodyContains = normalizeStringList(
-    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
-    `target.network_mocks[${index}].request_body_contains`
-  );
-  const requestBodyPatterns = normalizeStringList(
-    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
-    `target.network_mocks[${index}].request_body_patterns`
-  );
-  validateRegexPatterns(requestBodyPatterns, `target.network_mocks[${index}].request_body_patterns`);
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, `target.network_mocks[${index}]`);
   const requiredHitCount = numberValue3(
     input.required_hit_count ?? input.requiredHitCount ?? input.required_hits ?? input.requiredHits ?? input.min_hits ?? input.minHits
   );
@@ -8991,9 +8983,38 @@ function normalizeNetworkMock(input, index) {
     repeat_responses: input.repeat_responses === true || input.repeatResponses === true || input.cycle_responses === true || input.cycleResponses === true,
     required_hit_count: requiredHitCount,
     required: input.required === false ? false : true,
-    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length),
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
+  };
+}
+function normalizeNetworkMockRequestBodyConstraints(input, label) {
+  const requestBodyContains = normalizeStringList(
+    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
+    `${label}.request_body_contains`
+  );
+  const requestBodyPatterns = normalizeStringList(
+    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
+    `${label}.request_body_patterns`
+  );
+  validateRegexPatterns(requestBodyPatterns, `${label}.request_body_patterns`);
+  const requestBodyNotContains = normalizeStringList(
+    input.request_body_not_contains ?? input.requestBodyNotContains ?? input.request_body_absent ?? input.requestBodyAbsent ?? input.body_not_contains ?? input.bodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `${label}.request_body_not_contains`
+  );
+  const requestBodyNotPatterns = normalizeStringList(
+    input.request_body_not_patterns ?? input.requestBodyNotPatterns ?? input.request_body_forbidden_patterns ?? input.requestBodyForbiddenPatterns ?? input.body_not_patterns ?? input.bodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `${label}.request_body_not_patterns`
+  );
+  validateRegexPatterns(requestBodyNotPatterns, `${label}.request_body_not_patterns`);
+  return {
+    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length) || Boolean(requestBodyNotContains?.length) || Boolean(requestBodyNotPatterns?.length),
     request_body_contains: requestBodyContains,
-    request_body_patterns: requestBodyPatterns
+    request_body_patterns: requestBodyPatterns,
+    request_body_not_contains: requestBodyNotContains,
+    request_body_not_patterns: requestBodyNotPatterns
   };
 }
 function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
@@ -9003,20 +9024,33 @@ function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
   }
   const body = stringValue5(input.body) ?? stringValue5(input.body_text) ?? stringValue5(input.bodyText) ?? defaults.body;
   const hasJsonBody = Object.prototype.hasOwnProperty.call(input, "body_json") || Object.prototype.hasOwnProperty.call(input, "bodyJson") || Object.prototype.hasOwnProperty.call(input, "json");
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, label);
   return {
     label: stringValue5(input.label) || stringValue5(input.name) || defaults.label,
     status,
     content_type: stringValue5(input.content_type) || stringValue5(input.contentType) || defaults.content_type,
     headers: stringRecord(input.headers) || defaults.headers,
     body,
-    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json
+    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json,
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
   };
 }
 function normalizeNetworkMockResponses(value, mockIndex, defaults) {
   if (value === void 0) return void 0;
   if (!Array.isArray(value)) throw new Error(`target.network_mocks[${mockIndex}].responses must be an array.`);
   if (!value.length) throw new Error(`target.network_mocks[${mockIndex}].responses must not be empty.`);
-  const responseDefaults = { ...defaults, label: void 0 };
+  const responseDefaults = {
+    label: void 0,
+    status: defaults.status,
+    content_type: defaults.content_type,
+    headers: defaults.headers,
+    body: defaults.body,
+    body_json: defaults.body_json
+  };
   return value.map((response, responseIndex) => {
     if (!isRecord2(response)) {
       throw new Error(`target.network_mocks[${mockIndex}].responses[${responseIndex}] must be an object.`);
@@ -9759,6 +9793,9 @@ function assessNetworkMocksFromEvidence(profile, evidence) {
     if (event.request_body_matches === false) {
       failed.push({
         label: event.label ?? null,
+        response_label: event.response_label ?? null,
+        hit_index: event.hit_index ?? null,
+        response_index: event.response_index ?? null,
         url: event.url ?? null,
         method: event.method ?? null,
         reason: "request_body_mismatch",
@@ -10142,6 +10179,9 @@ function assessProfile(profile, evidence) {
       if (event && event.request_body_matches === false) {
         failed.push({
           label: event.label || null,
+          response_label: event.response_label || null,
+          hit_index: event.hit_index ?? null,
+          response_index: event.response_index ?? null,
           url: event.url || null,
           method: event.method || null,
           reason: "request_body_mismatch",
@@ -10606,18 +10646,21 @@ function compactNetworkMockRequestBody(value) {
 function networkMockStringList(value) {
   return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
 }
-function networkMockShouldCaptureRequestBody(mock) {
-  return mock && (
-    mock.capture_request_body === true
-    || networkMockStringList(mock.request_body_contains).length > 0
-    || networkMockStringList(mock.request_body_patterns).length > 0
-  );
+function networkMockShouldCaptureRequestBody(...sources) {
+  return sources.some((source) => source && (
+    source.capture_request_body === true
+    || networkMockStringList(source.request_body_contains).length > 0
+    || networkMockStringList(source.request_body_patterns).length > 0
+    || networkMockStringList(source.request_body_not_contains).length > 0
+    || networkMockStringList(source.request_body_not_patterns).length > 0
+  ));
 }
-function networkMockRequestBodyFailures(body, mock) {
+function networkMockRequestBodyFailuresForSource(body, source) {
   const failures = [];
+  if (!source) return failures;
   const rawBody = String(body || "");
   const compactBody = compactNetworkMockRequestBody(rawBody);
-  for (const expected of networkMockStringList(mock.request_body_contains)) {
+  for (const expected of networkMockStringList(source.request_body_contains)) {
     if (!rawBody.includes(expected) && !compactBody.includes(expected)) {
       failures.push({
         type: "request_body_missing_text",
@@ -10625,7 +10668,7 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
-  for (const pattern of networkMockStringList(mock.request_body_patterns)) {
+  for (const pattern of networkMockStringList(source.request_body_patterns)) {
     try {
       const regex = new RegExp(pattern);
       if (!regex.test(rawBody) && !regex.test(compactBody)) {
@@ -10642,8 +10685,36 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
+  for (const forbidden of networkMockStringList(source.request_body_not_contains)) {
+    if (rawBody.includes(forbidden) || compactBody.includes(forbidden)) {
+      failures.push({
+        type: "request_body_forbidden_text",
+        text: String(forbidden).slice(0, 200),
+      });
+    }
+  }
+  for (const pattern of networkMockStringList(source.request_body_not_patterns)) {
+    try {
+      const regex = new RegExp(pattern);
+      if (regex.test(rawBody) || regex.test(compactBody)) {
+        failures.push({
+          type: "request_body_forbidden_pattern_matched",
+          pattern: String(pattern).slice(0, 200),
+        });
+      }
+    } catch (error) {
+      failures.push({
+        type: "request_body_invalid_pattern",
+        pattern: String(pattern).slice(0, 200),
+        error: String(error && error.message ? error.message : error).slice(0, 500),
+      });
+    }
+  }
   return failures;
 }
+function networkMockRequestBodyFailures(body, ...sources) {
+  return sources.flatMap((source) => networkMockRequestBodyFailuresForSource(body, source));
+}
 async function setupLocatorVisible(locator, index) {
   return await locator.nth(index).isVisible({ timeout: 1000 }).catch(() => false);
 }
@@ -10672,9 +10743,10 @@ async function registerNetworkMocks(mocks) {
           body = JSON.stringify(response.body_json);
           contentType = response.content_type || headers["content-type"] || headers["Content-Type"] || "application/json";
         }
-        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock);
+        const responseBodyContract = responseIndex === null ? null : response;
+        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock, responseBodyContract);
         const requestBody = shouldCaptureRequestBody && request.postData ? request.postData() || "" : "";
-        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock) : [];
+        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock, responseBodyContract) : [];
         const status = response.status || mock.status || 200;
         const event = {
           ok: true,

package/dist/index.js

@@ -58,7 +58,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-IJGMTTVP.js";
+} from "./chunk-NJDY7HYE.js";
 import {
   DEFAULT_RIDDLE_API_BASE_URL,
   DEFAULT_RIDDLE_API_KEY_FILE,

package/dist/profile.cjs

@@ -296,15 +296,7 @@ function normalizeNetworkMock(input, index) {
   const payload = normalizeNetworkMockResponsePayload(input, `target.network_mocks[${index}]`);
   const responsesInput = input.responses ?? input.sequence;
   const responses = normalizeNetworkMockResponses(responsesInput, index, payload);
-  const requestBodyContains = normalizeStringList(
-    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
-    `target.network_mocks[${index}].request_body_contains`
-  );
-  const requestBodyPatterns = normalizeStringList(
-    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
-    `target.network_mocks[${index}].request_body_patterns`
-  );
-  validateRegexPatterns(requestBodyPatterns, `target.network_mocks[${index}].request_body_patterns`);
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, `target.network_mocks[${index}]`);
   const requiredHitCount = numberValue(
     input.required_hit_count ?? input.requiredHitCount ?? input.required_hits ?? input.requiredHits ?? input.min_hits ?? input.minHits
   );
@@ -320,9 +312,38 @@ function normalizeNetworkMock(input, index) {
     repeat_responses: input.repeat_responses === true || input.repeatResponses === true || input.cycle_responses === true || input.cycleResponses === true,
     required_hit_count: requiredHitCount,
     required: input.required === false ? false : true,
-    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length),
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
+  };
+}
+function normalizeNetworkMockRequestBodyConstraints(input, label) {
+  const requestBodyContains = normalizeStringList(
+    input.request_body_contains ?? input.requestBodyContains ?? input.body_contains ?? input.bodyContains,
+    `${label}.request_body_contains`
+  );
+  const requestBodyPatterns = normalizeStringList(
+    input.request_body_patterns ?? input.requestBodyPatterns ?? input.body_patterns ?? input.bodyPatterns,
+    `${label}.request_body_patterns`
+  );
+  validateRegexPatterns(requestBodyPatterns, `${label}.request_body_patterns`);
+  const requestBodyNotContains = normalizeStringList(
+    input.request_body_not_contains ?? input.requestBodyNotContains ?? input.request_body_absent ?? input.requestBodyAbsent ?? input.body_not_contains ?? input.bodyNotContains ?? input.body_absent ?? input.bodyAbsent,
+    `${label}.request_body_not_contains`
+  );
+  const requestBodyNotPatterns = normalizeStringList(
+    input.request_body_not_patterns ?? input.requestBodyNotPatterns ?? input.request_body_forbidden_patterns ?? input.requestBodyForbiddenPatterns ?? input.body_not_patterns ?? input.bodyNotPatterns ?? input.body_forbidden_patterns ?? input.bodyForbiddenPatterns,
+    `${label}.request_body_not_patterns`
+  );
+  validateRegexPatterns(requestBodyNotPatterns, `${label}.request_body_not_patterns`);
+  return {
+    capture_request_body: input.capture_request_body === true || input.captureRequestBody === true || Boolean(requestBodyContains?.length) || Boolean(requestBodyPatterns?.length) || Boolean(requestBodyNotContains?.length) || Boolean(requestBodyNotPatterns?.length),
     request_body_contains: requestBodyContains,
-    request_body_patterns: requestBodyPatterns
+    request_body_patterns: requestBodyPatterns,
+    request_body_not_contains: requestBodyNotContains,
+    request_body_not_patterns: requestBodyNotPatterns
   };
 }
 function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
@@ -332,20 +353,33 @@ function normalizeNetworkMockResponsePayload(input, label, defaults = {}) {
   }
   const body = stringValue(input.body) ?? stringValue(input.body_text) ?? stringValue(input.bodyText) ?? defaults.body;
   const hasJsonBody = Object.prototype.hasOwnProperty.call(input, "body_json") || Object.prototype.hasOwnProperty.call(input, "bodyJson") || Object.prototype.hasOwnProperty.call(input, "json");
+  const requestBody = normalizeNetworkMockRequestBodyConstraints(input, label);
   return {
     label: stringValue(input.label) || stringValue(input.name) || defaults.label,
     status,
     content_type: stringValue(input.content_type) || stringValue(input.contentType) || defaults.content_type,
     headers: stringRecord(input.headers) || defaults.headers,
     body,
-    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json
+    body_json: hasJsonBody ? toJsonValue(input.body_json ?? input.bodyJson ?? input.json) : defaults.body_json,
+    capture_request_body: requestBody.capture_request_body,
+    request_body_contains: requestBody.request_body_contains,
+    request_body_patterns: requestBody.request_body_patterns,
+    request_body_not_contains: requestBody.request_body_not_contains,
+    request_body_not_patterns: requestBody.request_body_not_patterns
   };
 }
 function normalizeNetworkMockResponses(value, mockIndex, defaults) {
   if (value === void 0) return void 0;
   if (!Array.isArray(value)) throw new Error(`target.network_mocks[${mockIndex}].responses must be an array.`);
   if (!value.length) throw new Error(`target.network_mocks[${mockIndex}].responses must not be empty.`);
-  const responseDefaults = { ...defaults, label: void 0 };
+  const responseDefaults = {
+    label: void 0,
+    status: defaults.status,
+    content_type: defaults.content_type,
+    headers: defaults.headers,
+    body: defaults.body,
+    body_json: defaults.body_json
+  };
   return value.map((response, responseIndex) => {
     if (!isRecord(response)) {
       throw new Error(`target.network_mocks[${mockIndex}].responses[${responseIndex}] must be an object.`);
@@ -1088,6 +1122,9 @@ function assessNetworkMocksFromEvidence(profile, evidence) {
     if (event.request_body_matches === false) {
       failed.push({
         label: event.label ?? null,
+        response_label: event.response_label ?? null,
+        hit_index: event.hit_index ?? null,
+        response_index: event.response_index ?? null,
         url: event.url ?? null,
         method: event.method ?? null,
         reason: "request_body_mismatch",
@@ -1471,6 +1508,9 @@ function assessProfile(profile, evidence) {
       if (event && event.request_body_matches === false) {
         failed.push({
           label: event.label || null,
+          response_label: event.response_label || null,
+          hit_index: event.hit_index ?? null,
+          response_index: event.response_index ?? null,
           url: event.url || null,
           method: event.method || null,
           reason: "request_body_mismatch",
@@ -1935,18 +1975,21 @@ function compactNetworkMockRequestBody(value) {
 function networkMockStringList(value) {
   return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
 }
-function networkMockShouldCaptureRequestBody(mock) {
-  return mock && (
-    mock.capture_request_body === true
-    || networkMockStringList(mock.request_body_contains).length > 0
-    || networkMockStringList(mock.request_body_patterns).length > 0
-  );
+function networkMockShouldCaptureRequestBody(...sources) {
+  return sources.some((source) => source && (
+    source.capture_request_body === true
+    || networkMockStringList(source.request_body_contains).length > 0
+    || networkMockStringList(source.request_body_patterns).length > 0
+    || networkMockStringList(source.request_body_not_contains).length > 0
+    || networkMockStringList(source.request_body_not_patterns).length > 0
+  ));
 }
-function networkMockRequestBodyFailures(body, mock) {
+function networkMockRequestBodyFailuresForSource(body, source) {
   const failures = [];
+  if (!source) return failures;
   const rawBody = String(body || "");
   const compactBody = compactNetworkMockRequestBody(rawBody);
-  for (const expected of networkMockStringList(mock.request_body_contains)) {
+  for (const expected of networkMockStringList(source.request_body_contains)) {
     if (!rawBody.includes(expected) && !compactBody.includes(expected)) {
       failures.push({
         type: "request_body_missing_text",
@@ -1954,7 +1997,7 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
-  for (const pattern of networkMockStringList(mock.request_body_patterns)) {
+  for (const pattern of networkMockStringList(source.request_body_patterns)) {
     try {
       const regex = new RegExp(pattern);
       if (!regex.test(rawBody) && !regex.test(compactBody)) {
@@ -1971,8 +2014,36 @@ function networkMockRequestBodyFailures(body, mock) {
       });
     }
   }
+  for (const forbidden of networkMockStringList(source.request_body_not_contains)) {
+    if (rawBody.includes(forbidden) || compactBody.includes(forbidden)) {
+      failures.push({
+        type: "request_body_forbidden_text",
+        text: String(forbidden).slice(0, 200),
+      });
+    }
+  }
+  for (const pattern of networkMockStringList(source.request_body_not_patterns)) {
+    try {
+      const regex = new RegExp(pattern);
+      if (regex.test(rawBody) || regex.test(compactBody)) {
+        failures.push({
+          type: "request_body_forbidden_pattern_matched",
+          pattern: String(pattern).slice(0, 200),
+        });
+      }
+    } catch (error) {
+      failures.push({
+        type: "request_body_invalid_pattern",
+        pattern: String(pattern).slice(0, 200),
+        error: String(error && error.message ? error.message : error).slice(0, 500),
+      });
+    }
+  }
   return failures;
 }
+function networkMockRequestBodyFailures(body, ...sources) {
+  return sources.flatMap((source) => networkMockRequestBodyFailuresForSource(body, source));
+}
 async function setupLocatorVisible(locator, index) {
   return await locator.nth(index).isVisible({ timeout: 1000 }).catch(() => false);
 }
@@ -2001,9 +2072,10 @@ async function registerNetworkMocks(mocks) {
           body = JSON.stringify(response.body_json);
           contentType = response.content_type || headers["content-type"] || headers["Content-Type"] || "application/json";
         }
-        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock);
+        const responseBodyContract = responseIndex === null ? null : response;
+        const shouldCaptureRequestBody = networkMockShouldCaptureRequestBody(mock, responseBodyContract);
         const requestBody = shouldCaptureRequestBody && request.postData ? request.postData() || "" : "";
-        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock) : [];
+        const requestBodyFailures = shouldCaptureRequestBody ? networkMockRequestBodyFailures(requestBody, mock, responseBodyContract) : [];
         const status = response.status || mock.status || 200;
         const event = {
           ok: true,

package/dist/profile.d.cts

@@ -41,6 +41,11 @@ interface RiddleProofProfileNetworkMockResponse {
     headers?: Record<string, string>;
     body?: string;
     body_json?: JsonValue;
+    capture_request_body?: boolean;
+    request_body_contains?: string[];
+    request_body_patterns?: string[];
+    request_body_not_contains?: string[];
+    request_body_not_patterns?: string[];
 }
 interface RiddleProofProfileNetworkMock extends RiddleProofProfileNetworkMockResponse {
     label: string;
@@ -53,6 +58,8 @@ interface RiddleProofProfileNetworkMock extends RiddleProofProfileNetworkMockRes
     capture_request_body?: boolean;
     request_body_contains?: string[];
     request_body_patterns?: string[];
+    request_body_not_contains?: string[];
+    request_body_not_patterns?: string[];
 }
 interface RiddleProofProfileRouteInventoryRoute {
     name?: string;

package/dist/profile.d.ts

@@ -41,6 +41,11 @@ interface RiddleProofProfileNetworkMockResponse {
     headers?: Record<string, string>;
     body?: string;
     body_json?: JsonValue;
+    capture_request_body?: boolean;
+    request_body_contains?: string[];
+    request_body_patterns?: string[];
+    request_body_not_contains?: string[];
+    request_body_not_patterns?: string[];
 }
 interface RiddleProofProfileNetworkMock extends RiddleProofProfileNetworkMockResponse {
     label: string;
@@ -53,6 +58,8 @@ interface RiddleProofProfileNetworkMock extends RiddleProofProfileNetworkMockRes
     capture_request_body?: boolean;
     request_body_contains?: string[];
     request_body_patterns?: string[];
+    request_body_not_contains?: string[];
+    request_body_not_patterns?: string[];
 }
 interface RiddleProofProfileRouteInventoryRoute {
     name?: string;

package/dist/profile.js

@@ -19,7 +19,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-IJGMTTVP.js";
+} from "./chunk-NJDY7HYE.js";
 export {
   RIDDLE_PROOF_PROFILE_CHECK_TYPES,
   RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION,

package/dist/proof-run-engine.d.cts

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     summary: string;

package/dist/proof-run-engine.d.ts

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "setup" | "recon" | "author" | "implement" | "verify" | "ship" | "run";
     state_path: string;
     stage: any;
     summary: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.7.45",
+  "version": "0.7.47",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",