@riddledc/riddle-proof 0.8.80 → 0.8.82

package/dist/index.js

@@ -11,6 +11,13 @@ import {
 import {
   runRiddleProof
 } from "./chunk-YH7ADFY4.js";
+import {
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  composeRiddleProofSemanticCertificates,
+  createRiddleProofSemanticCertificate,
+  parseRiddleProofSemanticCertificate,
+  riddleProofSemanticScopesEqual
+} from "./chunk-ZZ6UNKJQ.js";
 import {
   RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION,
   RIDDLE_PROOF_PLAYABILITY_VERSION,
@@ -63,11 +70,11 @@ import {
   buildRiddleProofHandoffPrCommentMarkdown,
   buildRiddleProofPrCommentMarkdown,
   summarizeRiddleProofPrComment
-} from "./chunk-6T6ZAK77.js";
+} from "./chunk-7OAETQU3.js";
 import {
   RIDDLE_PROOF_PROFILE_SUGGESTIONS_VERSION,
   suggestRiddleProofProfileChecks
-} from "./chunk-A4EF4M3B.js";
+} from "./chunk-FW7CKARF.js";
 import {
   RIDDLE_PROOF_CHANGE_CONTRACT_VERSION,
   RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION,
@@ -82,7 +89,7 @@ import {
   parseRiddleProofHandoffReceipt,
   riddleProofChangeReceiptHtml,
   riddleProofChangeReceiptMarkdown
-} from "./chunk-IL7MLYB5.js";
+} from "./chunk-LR4UYJDY.js";
 import {
   RIDDLE_PREVIEW_RECEIPT_VERSION,
   RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
@@ -122,7 +129,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-ZNVYJFR7.js";
+} from "./chunk-2K3DIK7A.js";
 import {
   createCodexExecAgentAdapter,
   createCodexExecJsonRunner,
@@ -238,6 +245,7 @@ export {
   RIDDLE_PROOF_PR_COMMENT_MARKER,
   RIDDLE_PROOF_RUN_CARD_VERSION,
   RIDDLE_PROOF_RUN_STATE_VERSION,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION,
   RIDDLE_PROOF_VISUAL_SESSION_VERSION,
   RIDDLE_UNSUBMITTED_WAKE_HINT,
@@ -279,6 +287,7 @@ export {
   compactBasicGameplayText,
   compactRecord,
   compareVisualProofSessionFingerprint,
+  composeRiddleProofSemanticCertificates,
   createBasicGameplayCatchRecords,
   createBasicGameplayCatchSummary,
   createCaptureDiagnostic,
@@ -296,6 +305,7 @@ export {
   createRiddleProofProfileEnvironmentBlockedResult,
   createRiddleProofProfileInsufficientResult,
   createRiddleProofRunCard,
+  createRiddleProofSemanticCertificate,
   createRunResult,
   createRunState,
   createRunStatusSnapshot,
@@ -325,6 +335,7 @@ export {
   parseRiddleProofChangeReceipt,
   parseRiddleProofHandoffReceipt,
   parseRiddleProofObservationReceipt,
+  parseRiddleProofSemanticCertificate,
   parseRiddleViewport,
   parseVisualProofSession,
   pollRiddleJob,
@@ -348,6 +359,7 @@ export {
   riddleProofPublicStateAllowsClaim,
   riddleProofPublicStateAllowsMergeRecommendation,
   riddleProofPublicStateMergeRecommendation,
+  riddleProofSemanticScopesEqual,
   riddleRequestJson,
   runCodexExecAgentDoctor,
   runCodexExecAgentDoctor as runLocalAgentDoctor,

package/dist/pr-comment.js

@@ -3,10 +3,10 @@ import {
   buildRiddleProofHandoffPrCommentMarkdown,
   buildRiddleProofPrCommentMarkdown,
   summarizeRiddleProofPrComment
-} from "./chunk-6T6ZAK77.js";
-import "./chunk-IL7MLYB5.js";
+} from "./chunk-7OAETQU3.js";
+import "./chunk-LR4UYJDY.js";
 import "./chunk-MEVVL4TI.js";
-import "./chunk-ZNVYJFR7.js";
+import "./chunk-2K3DIK7A.js";
 import "./chunk-ZAR7BWMN.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/profile/index.cjs

@@ -1200,10 +1200,14 @@ function normalizeViewport(input, index) {
   if (!width || !height || width < 100 || height < 100) {
     throw new Error(`target.viewports[${index}] requires numeric width and height >= 100.`);
   }
+  const hasTouch = booleanValue(valueFromOwn(input, "hasTouch", "has_touch"));
+  const isMobile = booleanValue(valueFromOwn(input, "isMobile", "is_mobile"));
   return {
     name: normalizeName(input.name || input.label, `viewport-${index + 1}`),
     width: Math.round(width),
-    height: Math.round(height)
+    height: Math.round(height),
+    ...hasTouch === void 0 ? {} : { hasTouch },
+    ...isMobile === void 0 ? {} : { isMobile }
   };
 }
 function normalizeViewports(value) {

package/dist/profile/index.js

@@ -30,7 +30,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "../chunk-ZNVYJFR7.js";
+} from "../chunk-2K3DIK7A.js";
 import "../chunk-MLKGABMK.js";
 export {
   RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS,

package/dist/profile-suggestions.js

@@ -1,8 +1,8 @@
 import {
   RIDDLE_PROOF_PROFILE_SUGGESTIONS_VERSION,
   suggestRiddleProofProfileChecks
-} from "./chunk-A4EF4M3B.js";
-import "./chunk-ZNVYJFR7.js";
+} from "./chunk-FW7CKARF.js";
+import "./chunk-2K3DIK7A.js";
 import "./chunk-MLKGABMK.js";
 export {
   RIDDLE_PROOF_PROFILE_SUGGESTIONS_VERSION,

package/dist/profile.cjs

@@ -1198,10 +1198,14 @@ function normalizeViewport(input, index) {
   if (!width || !height || width < 100 || height < 100) {
     throw new Error(`target.viewports[${index}] requires numeric width and height >= 100.`);
   }
+  const hasTouch = booleanValue(valueFromOwn(input, "hasTouch", "has_touch"));
+  const isMobile = booleanValue(valueFromOwn(input, "isMobile", "is_mobile"));
   return {
     name: normalizeName(input.name || input.label, `viewport-${index + 1}`),
     width: Math.round(width),
-    height: Math.round(height)
+    height: Math.round(height),
+    ...hasTouch === void 0 ? {} : { hasTouch },
+    ...isMobile === void 0 ? {} : { isMobile }
   };
 }
 function normalizeViewports(value) {

package/dist/profile.d.cts

@@ -137,6 +137,8 @@ interface RiddleProofProfileViewport {
     name: string;
     width: number;
     height: number;
+    hasTouch?: boolean;
+    isMobile?: boolean;
 }
 interface RiddleProofProfileSetupAction {
     type: RiddleProofProfileSetupActionType;

package/dist/profile.d.ts

@@ -137,6 +137,8 @@ interface RiddleProofProfileViewport {
     name: string;
     width: number;
     height: number;
+    hasTouch?: boolean;
+    isMobile?: boolean;
 }
 interface RiddleProofProfileSetupAction {
     type: RiddleProofProfileSetupActionType;

package/dist/profile.js

@@ -30,7 +30,7 @@ import {
   resolveRiddleProofProfileTimeoutSec,
   slugifyRiddleProofProfileName,
   summarizeRiddleProofProfileResult
-} from "./chunk-ZNVYJFR7.js";
+} from "./chunk-2K3DIK7A.js";
 import "./chunk-MLKGABMK.js";
 export {
   RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS,

package/dist/semantic-certificate.cjs

@@ -0,0 +1,497 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/semantic-certificate.ts
+var semantic_certificate_exports = {};
+__export(semantic_certificate_exports, {
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION: () => RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  composeRiddleProofSemanticCertificates: () => composeRiddleProofSemanticCertificates,
+  createRiddleProofSemanticCertificate: () => createRiddleProofSemanticCertificate,
+  parseRiddleProofSemanticCertificate: () => parseRiddleProofSemanticCertificate,
+  riddleProofSemanticScopesEqual: () => riddleProofSemanticScopesEqual
+});
+module.exports = __toCommonJS(semantic_certificate_exports);
+var import_node_crypto = require("crypto");
+var RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION = "riddle-proof.semantic-certificate.v0";
+var SCOPE_FIELDS = [
+  "repository",
+  "revision",
+  "environment",
+  "target",
+  "proof_attempt"
+];
+var AUTHORITY_FIELDS = [
+  "authority",
+  "status",
+  "verdict",
+  "ready_to_ship",
+  "merge_ready",
+  "sync_allowed",
+  "ship_authorized",
+  "shipping_authorized",
+  "shipping_disabled",
+  "merge_recommended",
+  "merge_recommendation",
+  "shipping_authorization"
+];
+var CERTIFICATE_FIELDS = /* @__PURE__ */ new Set([
+  "version",
+  "certificate_id",
+  "scope",
+  "claim",
+  "evidence",
+  "derivation",
+  "issued_at"
+]);
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function assertOnlyKeys(record, allowed, context) {
+  const allowedSet = new Set(allowed);
+  for (const key of Object.keys(record)) {
+    if (!allowedSet.has(key)) {
+      throw new Error(`${context} contains unsupported field ${key}.`);
+    }
+  }
+}
+function requiredString(record, key, context) {
+  const value = record[key];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`${context}.${key} must be a non-empty string.`);
+  }
+  return value.trim();
+}
+function optionalString(record, key, context) {
+  if (record[key] === void 0) return void 0;
+  return requiredString(record, key, context);
+}
+function isJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return true;
+  }
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) {
+    if (ancestors.has(value)) return false;
+    ancestors.add(value);
+    const valid2 = value.every((entry) => isJsonValue(entry, ancestors));
+    ancestors.delete(value);
+    return valid2;
+  }
+  if (!isRecord(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return false;
+  if (ancestors.has(value)) return false;
+  ancestors.add(value);
+  const valid = Object.values(value).every((entry) => isJsonValue(entry, ancestors));
+  ancestors.delete(value);
+  return valid;
+}
+function parseJsonObject(value, context) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value) || !isJsonValue(value)) {
+    throw new Error(`${context} must be a JSON object.`);
+  }
+  const cloned = JSON.parse(JSON.stringify(value));
+  if (!isRecord(cloned) || !isJsonValue(cloned)) {
+    throw new Error(`${context} must remain a JSON object when serialized.`);
+  }
+  return cloned;
+}
+function parseIssuedAt(value, context) {
+  if (typeof value !== "string" || !value.trim() || !Number.isFinite(Date.parse(value))) {
+    throw new Error(`${context} must be a valid timestamp.`);
+  }
+  return value.trim();
+}
+function parseScope(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(value, SCOPE_FIELDS, context);
+  return {
+    repository: requiredString(value, "repository", context),
+    revision: requiredString(value, "revision", context),
+    environment: requiredString(value, "environment", context),
+    target: requiredString(value, "target", context),
+    proof_attempt: requiredString(value, "proof_attempt", context)
+  };
+}
+function parseClaimRef(value, context, allowedExtras = []) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(value, ["claim_id", "claim_version", "parameters", ...allowedExtras], context);
+  const parameters = parseJsonObject(value.parameters, `${context}.parameters`);
+  return {
+    claim_id: requiredString(value, "claim_id", context),
+    claim_version: requiredString(value, "claim_version", context),
+    ...parameters ? { parameters } : {}
+  };
+}
+function parseClaim(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  return {
+    ...parseClaimRef(value, context, ["label"]),
+    label: requiredString(value, "label", context)
+  };
+}
+function parseEvidenceRef(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(
+    value,
+    ["receipt_id", "artifact_digest", "role", "artifact_url", "artifact_path"],
+    context
+  );
+  const artifactDigest = requiredString(value, "artifact_digest", context).toLowerCase();
+  if (!/^sha256:[0-9a-f]{64}$/u.test(artifactDigest)) {
+    throw new Error(`${context}.artifact_digest must be a full sha256 digest.`);
+  }
+  const artifactUrl = optionalString(value, "artifact_url", context);
+  const artifactPath = optionalString(value, "artifact_path", context);
+  return {
+    receipt_id: requiredString(value, "receipt_id", context),
+    artifact_digest: artifactDigest,
+    role: requiredString(value, "role", context),
+    ...artifactUrl ? { artifact_url: artifactUrl } : {},
+    ...artifactPath ? { artifact_path: artifactPath } : {}
+  };
+}
+function parseEvidenceBundle(value, context) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error(`${context} must contain at least one evidence reference.`);
+  }
+  return value.map((entry, index) => parseEvidenceRef(entry, `${context}[${index}]`));
+}
+function parseContractRef(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  return {
+    contract_id: requiredString(value, "contract_id", context),
+    contract_version: requiredString(value, "contract_version", context),
+    label: requiredString(value, "label", context)
+  };
+}
+function parseContract(value, context, allowRuntimePredicate = false) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(
+    value,
+    ["contract_id", "contract_version", "label", "claim", ...allowRuntimePredicate ? ["accepts"] : []],
+    context
+  );
+  if (allowRuntimePredicate && typeof value.accepts !== "function") {
+    throw new Error(`${context}.accepts must be a function.`);
+  }
+  return {
+    ...parseContractRef(value, context),
+    claim: parseClaim(value.claim, `${context}.claim`)
+  };
+}
+function parseRule(value, context, allowFullPremises = false) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(value, ["rule_id", "rule_version", "label", "premises", "conclusion"], context);
+  if (!Array.isArray(value.premises) || value.premises.length === 0) {
+    throw new Error(`${context}.premises must contain at least one claim reference.`);
+  }
+  return {
+    rule_id: requiredString(value, "rule_id", context),
+    rule_version: requiredString(value, "rule_version", context),
+    label: requiredString(value, "label", context),
+    premises: value.premises.map((premise, index) => parseClaimRef(
+      premise,
+      `${context}.premises[${index}]`,
+      allowFullPremises ? ["label"] : []
+    )),
+    conclusion: parseClaim(value.conclusion, `${context}.conclusion`)
+  };
+}
+function parsePremise(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  assertOnlyKeys(
+    value,
+    ["certificate_id", "derivation_kind", "assurance", "scope", "claim", "evidence"],
+    context
+  );
+  const derivationKind = requiredString(value, "derivation_kind", context);
+  const assurance = requiredString(value, "assurance", context);
+  const validAssurance = derivationKind === "contract" && assurance === "runtime_contract_accepted" || derivationKind === "composition" && assurance === "declared_runtime_rule";
+  if (!validAssurance) {
+    throw new Error(`${context} must preserve a valid derivation_kind and assurance pair.`);
+  }
+  return {
+    certificate_id: requiredString(value, "certificate_id", context),
+    derivation_kind: derivationKind,
+    assurance,
+    scope: parseScope(value.scope, `${context}.scope`),
+    claim: parseClaim(value.claim, `${context}.claim`),
+    evidence: parseEvidenceBundle(value.evidence, `${context}.evidence`)
+  };
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (isRecord(value)) {
+    return `{${Object.keys(value).filter((key) => value[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+  }
+  const encoded = JSON.stringify(value);
+  if (encoded === void 0) throw new Error("Semantic certificate contains a non-JSON value.");
+  return encoded;
+}
+function sameClaimRef(left, right) {
+  return left.claim_id === right.claim_id && left.claim_version === right.claim_version && stableJson(left.parameters || {}) === stableJson(right.parameters || {});
+}
+function sameEvidence(left, right) {
+  return stableJson(left) === stableJson(right);
+}
+function certificateId(body) {
+  const digest = (0, import_node_crypto.createHash)("sha256").update(stableJson(body)).digest("hex");
+  return `rpsc_${digest}`;
+}
+function withCertificateId(body) {
+  return { ...body, certificate_id: certificateId(body) };
+}
+function parseDerivation(value, context) {
+  if (!isRecord(value)) throw new Error(`${context} must be an object.`);
+  const kind = requiredString(value, "kind", context);
+  if (kind === "contract") {
+    assertOnlyKeys(value, ["kind", "assurance", "contract"], context);
+    if (value.assurance !== "runtime_contract_accepted") {
+      throw new Error(`${context}.assurance must be runtime_contract_accepted.`);
+    }
+    return {
+      kind,
+      assurance: "runtime_contract_accepted",
+      contract: parseContract(value.contract, `${context}.contract`)
+    };
+  }
+  if (kind === "composition") {
+    assertOnlyKeys(value, ["kind", "assurance", "rule", "premises"], context);
+    if (value.assurance !== "declared_runtime_rule") {
+      throw new Error(`${context}.assurance must be declared_runtime_rule.`);
+    }
+    if (!Array.isArray(value.premises) || value.premises.length === 0) {
+      throw new Error(`${context}.premises must contain at least one certificate premise.`);
+    }
+    return {
+      kind,
+      assurance: "declared_runtime_rule",
+      rule: parseRule(value.rule, `${context}.rule`),
+      premises: value.premises.map((premise, index) => parsePremise(premise, `${context}.premises[${index}]`))
+    };
+  }
+  throw new Error(`${context}.kind must be contract or composition.`);
+}
+function riddleProofSemanticScopesEqual(left, right) {
+  return SCOPE_FIELDS.every((field) => left[field] === right[field]);
+}
+function createRiddleProofSemanticCertificate(input) {
+  if (!isRecord(input)) throw new Error("Semantic certificate input must be an object.");
+  assertOnlyKeys(
+    input,
+    ["scope", "evidence", "observation", "contract", "issued_at"],
+    "semantic certificate input"
+  );
+  const scope = parseScope(input.scope, "semantic certificate scope");
+  const evidence = parseEvidenceBundle(input.evidence, "semantic certificate evidence");
+  const contract = parseContract(input.contract, "semantic certificate contract", true);
+  const contractRef = {
+    contract_id: contract.contract_id,
+    contract_version: contract.contract_version,
+    label: contract.label
+  };
+  const claim = contract.claim;
+  let accepted;
+  try {
+    accepted = input.contract.accepts({ ...scope }, input.observation) === true;
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "contract_error",
+        contract: contractRef,
+        message: `Semantic contract evaluation failed: ${error instanceof Error ? error.message : String(error)}.`
+      }
+    };
+  }
+  if (!accepted) {
+    return {
+      ok: false,
+      error: {
+        code: "contract_rejected",
+        contract: contractRef,
+        message: "Semantic contract rejected the supplied observation at this scope."
+      }
+    };
+  }
+  const body = {
+    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+    scope,
+    claim,
+    evidence,
+    derivation: { kind: "contract", assurance: "runtime_contract_accepted", contract },
+    issued_at: parseIssuedAt(input.issued_at || (/* @__PURE__ */ new Date()).toISOString(), "semantic certificate issued_at")
+  };
+  return { ok: true, certificate: withCertificateId(body) };
+}
+function parseRiddleProofSemanticCertificate(value) {
+  if (!isRecord(value)) throw new Error("Semantic certificate must be an object.");
+  if (value.version !== RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION) {
+    throw new Error(`Unsupported Semantic certificate version ${String(value.version || "missing")}.`);
+  }
+  for (const field of AUTHORITY_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(value, field)) {
+      throw new Error(`Semantic certificate must not contain authority field ${field}.`);
+    }
+  }
+  for (const field of Object.keys(value)) {
+    if (!CERTIFICATE_FIELDS.has(field)) {
+      throw new Error(`Semantic certificate contains unsupported field ${field}.`);
+    }
+  }
+  const scope = parseScope(value.scope, "semantic certificate scope");
+  const claim = parseClaim(value.claim, "semantic certificate claim");
+  const evidence = parseEvidenceBundle(value.evidence, "semantic certificate evidence");
+  const derivation = parseDerivation(value.derivation, "semantic certificate derivation");
+  if (derivation.kind === "contract" && !sameClaimRef(claim, derivation.contract.claim)) {
+    throw new Error("Semantic contract-derived claim must match its contract claim.");
+  }
+  if (derivation.kind === "composition") {
+    if (derivation.premises.length !== derivation.rule.premises.length) {
+      throw new Error("Semantic composition premises must match the rule premise count.");
+    }
+    derivation.premises.forEach((premise, index) => {
+      if (!riddleProofSemanticScopesEqual(scope, premise.scope)) {
+        throw new Error(`Semantic composition premise ${index} must have the certificate scope.`);
+      }
+      if (!sameClaimRef(premise.claim, derivation.rule.premises[index])) {
+        throw new Error(`Semantic composition premise ${index} must match its rule claim.`);
+      }
+    });
+    if (!sameClaimRef(claim, derivation.rule.conclusion)) {
+      throw new Error("Semantic composition claim must match its rule conclusion.");
+    }
+    const expectedEvidence = derivation.premises.flatMap((premise) => premise.evidence);
+    if (!sameEvidence(evidence, expectedEvidence)) {
+      throw new Error("Semantic composition evidence must be the ordered concatenation of premise evidence.");
+    }
+  }
+  const body = {
+    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+    scope,
+    claim,
+    evidence,
+    derivation,
+    issued_at: parseIssuedAt(value.issued_at, "semantic certificate issued_at")
+  };
+  const observedId = requiredString(value, "certificate_id", "semantic certificate");
+  const expectedId = certificateId(body);
+  if (observedId !== expectedId) {
+    throw new Error("Semantic certificate_id must match its content.");
+  }
+  return { ...body, certificate_id: observedId };
+}
+function firstScopeMismatch(expected, observed) {
+  for (const field of SCOPE_FIELDS) {
+    if (expected[field] !== observed[field]) {
+      return { field, expected: expected[field], observed: observed[field] };
+    }
+  }
+  return void 0;
+}
+function premiseFromCertificate(certificate) {
+  return {
+    certificate_id: certificate.certificate_id,
+    derivation_kind: certificate.derivation.kind,
+    assurance: certificate.derivation.assurance,
+    scope: { ...certificate.scope },
+    claim: parseClaim(certificate.claim, "semantic composition premise claim"),
+    evidence: certificate.evidence.map((entry) => ({ ...entry }))
+  };
+}
+function composeRiddleProofSemanticCertificates(input) {
+  if (!isRecord(input)) throw new Error("Semantic composition input must be an object.");
+  assertOnlyKeys(
+    input,
+    ["rule", "certificates", "issued_at"],
+    "semantic composition input"
+  );
+  const rule = parseRule(input.rule, "semantic composition rule", true);
+  if (!Array.isArray(input.certificates) || input.certificates.length === 0) {
+    throw new Error("Semantic composition requires at least one certificate.");
+  }
+  const certificates = input.certificates.map((certificate) => parseRiddleProofSemanticCertificate(certificate));
+  if (certificates.length !== rule.premises.length) {
+    return {
+      ok: false,
+      error: {
+        code: "premise_count_mismatch",
+        expected: rule.premises.length,
+        observed: certificates.length,
+        message: `Semantic rule expected ${rule.premises.length} certificate(s), received ${certificates.length}.`
+      }
+    };
+  }
+  const expectedScope = certificates[0].scope;
+  for (let index = 1; index < certificates.length; index += 1) {
+    const mismatch = firstScopeMismatch(expectedScope, certificates[index].scope);
+    if (mismatch) {
+      return {
+        ok: false,
+        error: {
+          code: "scope_mismatch",
+          input_index: index,
+          ...mismatch,
+          message: `Semantic certificate ${index} has a different ${mismatch.field}.`
+        }
+      };
+    }
+  }
+  for (let index = 0; index < certificates.length; index += 1) {
+    const expected = rule.premises[index];
+    const observed = certificates[index].claim;
+    if (!sameClaimRef(expected, observed)) {
+      return {
+        ok: false,
+        error: {
+          code: "premise_mismatch",
+          input_index: index,
+          expected,
+          observed: parseClaimRef(observed, "semantic composition observed claim", ["label"]),
+          message: `Semantic certificate ${index} does not satisfy its declared rule premise.`
+        }
+      };
+    }
+  }
+  const evidence = certificates.flatMap((certificate) => certificate.evidence);
+  const body = {
+    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+    scope: { ...expectedScope },
+    claim: { ...rule.conclusion },
+    evidence,
+    derivation: {
+      kind: "composition",
+      assurance: "declared_runtime_rule",
+      rule,
+      premises: certificates.map(premiseFromCertificate)
+    },
+    issued_at: parseIssuedAt(input.issued_at || (/* @__PURE__ */ new Date()).toISOString(), "semantic certificate issued_at")
+  };
+  return { ok: true, certificate: withCertificateId(body) };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  composeRiddleProofSemanticCertificates,
+  createRiddleProofSemanticCertificate,
+  parseRiddleProofSemanticCertificate,
+  riddleProofSemanticScopesEqual
+});