@riddledc/riddle-proof 0.8.82 → 0.8.83

package/README.md

@@ -93,6 +93,7 @@ produces no certificate:
 import {
   createRiddleProofSemanticCertificate,
   composeRiddleProofSemanticCertificates,
+  matchRiddleProofSemanticCertificate,
 } from "@riddledc/riddle-proof/semantic-certificate";
 
 const quiet = createRiddleProofSemanticCertificate({
@@ -131,6 +132,36 @@ const behavior = composeRiddleProofSemanticCertificates({
 });
 ```
 
+A later agent can consume one exact certificate without reopening its receipt
+files. The expected content ID must arrive through the consumer's trusted
+handoff or configuration; copying it from the same untrusted certificate would
+not add trust:
+
+```ts
+const match = matchRiddleProofSemanticCertificate({
+  certificate: JSON.parse(serializedCertificate),
+  expected_certificate_id: trustedHandoffCertificateId,
+  expected_scope: scope,
+  expected_claim: observedWaveCollisionBehaviorClaim,
+  expected_assurance: "declared_runtime_rule",
+});
+
+if (!match.ok) throw new Error(match.error.message);
+// match.certificate is the exact scoped certificate this consumer requested.
+```
+
+Matching first reparses the envelope and its content ID, then compares the
+trusted expected ID, all five scope fields, claim ID/version/parameters, and
+top-level assurance. It does no filesystem or network I/O, and a successful
+match does not authenticate the issuer or the referenced evidence.
+
+This is an exact root-certificate handoff, not independent proof-tree
+reconstruction. A composite certificate retains compact immediate-premise
+snapshots, not the full transitive certificate bodies. A consumer that does not
+already trust the expected root ID needs a complete certificate closure plus a
+contract/rule identity policy before it can independently inspect the whole
+derivation.
+
 Composition requires the declared premise claims and exact scope equality. It
 copies compact premise snapshots into the derivation and sets the higher
 certificate's evidence to the ordered concatenation of premise evidence. The

package/dist/{chunk-ZZ6UNKJQ.js → chunk-DB5ZHRUP.js}

@@ -34,6 +34,17 @@ var CERTIFICATE_FIELDS = /* @__PURE__ */ new Set([
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+function safeErrorMessage(error) {
+  try {
+    if (error instanceof Error) return String(error.message);
+  } catch {
+  }
+  try {
+    return String(error);
+  } catch {
+    return "unprintable thrown value";
+  }
+}
 function assertOnlyKeys(record, allowed, context) {
   const allowedSet = new Set(allowed);
   for (const key of Object.keys(record)) {
@@ -371,6 +382,110 @@ function parseRiddleProofSemanticCertificate(value) {
   }
   return { ...body, certificate_id: observedId };
 }
+function matchRiddleProofSemanticCertificate(input) {
+  if (!isRecord(input)) throw new Error("Semantic certificate match input must be an object.");
+  assertOnlyKeys(
+    input,
+    [
+      "certificate",
+      "expected_certificate_id",
+      "expected_scope",
+      "expected_claim",
+      "expected_assurance"
+    ],
+    "semantic certificate match input"
+  );
+  const expectedCertificateId = requiredString(
+    input,
+    "expected_certificate_id",
+    "semantic certificate match input"
+  );
+  if (!/^rpsc_[0-9a-f]{64}$/u.test(expectedCertificateId)) {
+    throw new Error(
+      "Semantic certificate match input.expected_certificate_id must be a full rpsc content ID."
+    );
+  }
+  const expectedScope = parseScope(
+    input.expected_scope,
+    "semantic certificate match expected_scope"
+  );
+  const expectedClaim = parseClaimRef(
+    input.expected_claim,
+    "semantic certificate match expected_claim",
+    ["label"]
+  );
+  const expectedAssurance = requiredString(
+    input,
+    "expected_assurance",
+    "semantic certificate match input"
+  );
+  if (expectedAssurance !== "runtime_contract_accepted" && expectedAssurance !== "declared_runtime_rule") {
+    throw new Error(
+      "Semantic certificate match input.expected_assurance must be runtime_contract_accepted or declared_runtime_rule."
+    );
+  }
+  let certificate;
+  try {
+    certificate = parseRiddleProofSemanticCertificate(input.certificate);
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "invalid_certificate",
+        message: `Semantic certificate did not parse: ${safeErrorMessage(error)}`
+      }
+    };
+  }
+  if (certificate.certificate_id !== expectedCertificateId) {
+    return {
+      ok: false,
+      error: {
+        code: "certificate_id_mismatch",
+        expected: expectedCertificateId,
+        observed: certificate.certificate_id,
+        message: "Semantic certificate does not match the trusted expected content ID."
+      }
+    };
+  }
+  const scopeMismatch = firstScopeMismatch(expectedScope, certificate.scope);
+  if (scopeMismatch) {
+    return {
+      ok: false,
+      error: {
+        code: "scope_mismatch",
+        ...scopeMismatch,
+        message: `Semantic certificate has a different ${scopeMismatch.field} than the consumer expected.`
+      }
+    };
+  }
+  if (!sameClaimRef(expectedClaim, certificate.claim)) {
+    return {
+      ok: false,
+      error: {
+        code: "claim_mismatch",
+        expected: expectedClaim,
+        observed: parseClaimRef(
+          certificate.claim,
+          "semantic certificate match observed claim",
+          ["label"]
+        ),
+        message: "Semantic certificate does not state the claim the consumer expected."
+      }
+    };
+  }
+  if (certificate.derivation.assurance !== expectedAssurance) {
+    return {
+      ok: false,
+      error: {
+        code: "assurance_mismatch",
+        expected: expectedAssurance,
+        observed: certificate.derivation.assurance,
+        message: "Semantic certificate does not have the assurance the consumer expected."
+      }
+    };
+  }
+  return { ok: true, certificate };
+}
 function firstScopeMismatch(expected, observed) {
   for (const field of SCOPE_FIELDS) {
     if (expected[field] !== observed[field]) {
@@ -465,5 +580,6 @@ export {
   riddleProofSemanticScopesEqual,
   createRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate,
   composeRiddleProofSemanticCertificates
 };

package/dist/index.cjs

@@ -3520,6 +3520,7 @@ __export(index_exports, {
   isSuccessfulStatus: () => isSuccessfulStatus,
   isTerminalRiddleJobStatus: () => isTerminalRiddleJobStatus,
   isTerminalStatus: () => isTerminalStatus,
+  matchRiddleProofSemanticCertificate: () => matchRiddleProofSemanticCertificate,
   migrateRiddleProofChangeReceipt: () => migrateRiddleProofChangeReceipt,
   nonEmptyString: () => nonEmptyString,
   normalizeCheckpointResponse: () => normalizeCheckpointResponse,
@@ -20607,6 +20608,17 @@ var CERTIFICATE_FIELDS = /* @__PURE__ */ new Set([
 function isRecord4(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+function safeErrorMessage(error) {
+  try {
+    if (error instanceof Error) return String(error.message);
+  } catch {
+  }
+  try {
+    return String(error);
+  } catch {
+    return "unprintable thrown value";
+  }
+}
 function assertOnlyKeys(record, allowed, context) {
   const allowedSet = new Set(allowed);
   for (const key of Object.keys(record)) {
@@ -20944,6 +20956,110 @@ function parseRiddleProofSemanticCertificate(value) {
   }
   return { ...body, certificate_id: observedId };
 }
+function matchRiddleProofSemanticCertificate(input) {
+  if (!isRecord4(input)) throw new Error("Semantic certificate match input must be an object.");
+  assertOnlyKeys(
+    input,
+    [
+      "certificate",
+      "expected_certificate_id",
+      "expected_scope",
+      "expected_claim",
+      "expected_assurance"
+    ],
+    "semantic certificate match input"
+  );
+  const expectedCertificateId = requiredString2(
+    input,
+    "expected_certificate_id",
+    "semantic certificate match input"
+  );
+  if (!/^rpsc_[0-9a-f]{64}$/u.test(expectedCertificateId)) {
+    throw new Error(
+      "Semantic certificate match input.expected_certificate_id must be a full rpsc content ID."
+    );
+  }
+  const expectedScope = parseScope(
+    input.expected_scope,
+    "semantic certificate match expected_scope"
+  );
+  const expectedClaim = parseClaimRef(
+    input.expected_claim,
+    "semantic certificate match expected_claim",
+    ["label"]
+  );
+  const expectedAssurance = requiredString2(
+    input,
+    "expected_assurance",
+    "semantic certificate match input"
+  );
+  if (expectedAssurance !== "runtime_contract_accepted" && expectedAssurance !== "declared_runtime_rule") {
+    throw new Error(
+      "Semantic certificate match input.expected_assurance must be runtime_contract_accepted or declared_runtime_rule."
+    );
+  }
+  let certificate;
+  try {
+    certificate = parseRiddleProofSemanticCertificate(input.certificate);
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "invalid_certificate",
+        message: `Semantic certificate did not parse: ${safeErrorMessage(error)}`
+      }
+    };
+  }
+  if (certificate.certificate_id !== expectedCertificateId) {
+    return {
+      ok: false,
+      error: {
+        code: "certificate_id_mismatch",
+        expected: expectedCertificateId,
+        observed: certificate.certificate_id,
+        message: "Semantic certificate does not match the trusted expected content ID."
+      }
+    };
+  }
+  const scopeMismatch = firstScopeMismatch(expectedScope, certificate.scope);
+  if (scopeMismatch) {
+    return {
+      ok: false,
+      error: {
+        code: "scope_mismatch",
+        ...scopeMismatch,
+        message: `Semantic certificate has a different ${scopeMismatch.field} than the consumer expected.`
+      }
+    };
+  }
+  if (!sameClaimRef(expectedClaim, certificate.claim)) {
+    return {
+      ok: false,
+      error: {
+        code: "claim_mismatch",
+        expected: expectedClaim,
+        observed: parseClaimRef(
+          certificate.claim,
+          "semantic certificate match observed claim",
+          ["label"]
+        ),
+        message: "Semantic certificate does not state the claim the consumer expected."
+      }
+    };
+  }
+  if (certificate.derivation.assurance !== expectedAssurance) {
+    return {
+      ok: false,
+      error: {
+        code: "assurance_mismatch",
+        expected: expectedAssurance,
+        observed: certificate.derivation.assurance,
+        message: "Semantic certificate does not have the assurance the consumer expected."
+      }
+    };
+  }
+  return { ok: true, certificate };
+}
 function firstScopeMismatch(expected, observed) {
   for (const field of SCOPE_FIELDS) {
     if (expected[field] !== observed[field]) {
@@ -23161,6 +23277,7 @@ function buildRiddleProofPrCommentMarkdown(input) {
   isSuccessfulStatus,
   isTerminalRiddleJobStatus,
   isTerminalStatus,
+  matchRiddleProofSemanticCertificate,
   migrateRiddleProofChangeReceipt,
   nonEmptyString,
   normalizeCheckpointResponse,

package/dist/index.d.cts

@@ -14,7 +14,7 @@ export { AssessBasicGameplayOptions, AttachBasicGameplayArtifactOptions, BASIC_G
 export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS, RIDDLE_PROOF_ORDERED_TRACE_OPERATORS, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofOrderedTraceAssessment, RiddleProofOrderedTraceEvent, RiddleProofOrderedTraceOperator, RiddleProofOrderedTracePredicate, RiddleProofOrderedTraceWitness, RiddleProofProfile, RiddleProofProfileArtifactCompleteness, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileHttpStatusBodyJsonAssertion, RiddleProofProfileHttpStatusBodyJsonAssertionResult, RiddleProofProfileHttpStatusPreflightCheckResult, RiddleProofProfileHttpStatusPreflightFetch, RiddleProofProfileHttpStatusPreflightFetchResponse, RiddleProofProfileHttpStatusPreflightOptions, RiddleProofProfileHttpStatusPreflightResult, RiddleProofProfileJsonValueType, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileReturnSummaryField, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileRunnerArtifactPreflight, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, applyRiddleProofProfileArtifactCompleteness, assessRiddleProofOrderedTrace, assessRiddleProofOrderedTraceSetupResults, assessRiddleProofProfileArtifactCompleteness, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, preflightRiddleProofProfileRunnerArtifacts, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.cjs';
 export { RIDDLE_PROOF_PROFILE_SUGGESTIONS_VERSION, RiddleProofProfileChangedTextInput, RiddleProofProfileSuggestion, RiddleProofProfileSuggestionInput, RiddleProofProfileSuggestionsResult, suggestRiddleProofProfileChecks } from './profile-suggestions.cjs';
 export { CreateRiddleProofObservationReceiptInput, RIDDLE_PREVIEW_RECEIPT_VERSION, RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION, RiddlePreviewReceipt, RiddleProofComparisonRole, RiddleProofExecutionPhase, RiddleProofExecutionTelemetry, RiddleProofObservationArtifact, RiddleProofObservationArtifactRole, RiddleProofObservationExecutor, RiddleProofObservationExecutorKind, RiddleProofObservationPublication, RiddleProofObservationReceipt, RiddleProofObservationTarget, RiddleProofSourceIdentity, createRiddleProofObservationReceipt, parseRiddlePreviewReceipt, parseRiddleProofObservationReceipt } from './receipts.cjs';
-export { ComposeRiddleProofSemanticCertificatesInput, CreateRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, RiddleProofSemanticCertificate, RiddleProofSemanticCertificationResult, RiddleProofSemanticClaim, RiddleProofSemanticClaimRef, RiddleProofSemanticCompositionDerivation, RiddleProofSemanticCompositionError, RiddleProofSemanticCompositionResult, RiddleProofSemanticContract, RiddleProofSemanticContractDerivation, RiddleProofSemanticContractError, RiddleProofSemanticContractRef, RiddleProofSemanticContractRejected, RiddleProofSemanticDerivation, RiddleProofSemanticEvidenceBundle, RiddleProofSemanticEvidenceRef, RiddleProofSemanticPremise, RiddleProofSemanticPremiseCountMismatch, RiddleProofSemanticPremiseMismatch, RiddleProofSemanticRule, RiddleProofSemanticRuntimeContract, RiddleProofSemanticScope, RiddleProofSemanticScopeField, RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual } from './semantic-certificate.cjs';
+export { ComposeRiddleProofSemanticCertificatesInput, CreateRiddleProofSemanticCertificateInput, MatchRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, RiddleProofSemanticAssurance, RiddleProofSemanticCertificate, RiddleProofSemanticCertificateAssuranceMismatch, RiddleProofSemanticCertificateClaimMismatch, RiddleProofSemanticCertificateIdMismatch, RiddleProofSemanticCertificateInvalid, RiddleProofSemanticCertificateMatchError, RiddleProofSemanticCertificateMatchResult, RiddleProofSemanticCertificateMatchScopeMismatch, RiddleProofSemanticCertificationResult, RiddleProofSemanticClaim, RiddleProofSemanticClaimExpectation, RiddleProofSemanticClaimRef, RiddleProofSemanticCompositionDerivation, RiddleProofSemanticCompositionError, RiddleProofSemanticCompositionResult, RiddleProofSemanticContract, RiddleProofSemanticContractDerivation, RiddleProofSemanticContractError, RiddleProofSemanticContractRef, RiddleProofSemanticContractRejected, RiddleProofSemanticDerivation, RiddleProofSemanticEvidenceBundle, RiddleProofSemanticEvidenceRef, RiddleProofSemanticPremise, RiddleProofSemanticPremiseCountMismatch, RiddleProofSemanticPremiseMismatch, RiddleProofSemanticRule, RiddleProofSemanticRuntimeContract, RiddleProofSemanticScope, RiddleProofSemanticScopeField, RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, matchRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual } from './semantic-certificate.cjs';
 export { AssessRiddleProofChangeInput, CreateRiddleProofChangeReceiptInput, RIDDLE_PROOF_CHANGE_CONTRACT_VERSION, RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION, RIDDLE_PROOF_CHANGE_RECEIPT_VERSION, RIDDLE_PROOF_CHANGE_RESULT_VERSION, RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION, RiddleProofChangeContract, RiddleProofChangeDelta, RiddleProofChangeDeltaResult, RiddleProofChangeDeltaStatus, RiddleProofChangeGroupContract, RiddleProofChangeGroupResult, RiddleProofChangeProfileCheckStatus, RiddleProofChangeReceipt, RiddleProofChangeReceiptArtifact, RiddleProofChangeReceiptArtifactKind, RiddleProofChangeReceiptCheckCounts, RiddleProofChangeReceiptDelta, RiddleProofChangeReceiptSide, RiddleProofChangeReceiptVerdict, RiddleProofChangeRecommendation, RiddleProofChangeResult, RiddleProofChangeSide, RiddleProofChangeSourceBindingContract, RiddleProofChangeSourceBindingRequirement, RiddleProofChangeSourceBindingResult, RiddleProofChangeSourceBindingStatus, RiddleProofChangeStatus, RiddleProofCheckStatusTransitionDelta, RiddleProofHandoffReceipt, RiddleProofLegacyChangeReceipt, RiddleProofProfileStatusTransitionDelta, RiddleProofShippingAuthorization, assessRiddleProofChange, createRiddleProofChangeReceipt, createRiddleProofHandoffReceipt, migrateRiddleProofChangeReceipt, parseRiddleProofChangeReceipt, parseRiddleProofHandoffReceipt, riddleProofChangeReceiptHtml, riddleProofChangeReceiptMarkdown } from './change-proof.cjs';
 export { DEFAULT_RIDDLE_API_BASE_URL, DEFAULT_RIDDLE_API_KEY_FILE, RIDDLE_UNSUBMITTED_WAKE_HINT, RiddleApiError, RiddleApiKeySource, RiddleBalanceResult, RiddleClientConfig, RiddleFetch, RiddlePollJobOptions, RiddlePollJobResult, RiddlePollProgressSnapshot, RiddlePollSummary, RiddlePreviewDeployOptions, RiddlePreviewDeployProgressSnapshot, RiddlePreviewDeployResult, RiddlePreviewDeployStage, RiddlePreviewFramework, RiddleRunScriptInput, RiddleServerPreviewInput, RiddleServerPreviewResult, collectRiddlePreviewDeployWarnings, createRiddleApiClient, deployRiddlePreview, deployRiddleStaticPreview, detectRiddlePreviewSource, getRiddleBalance, isTerminalRiddleJobStatus, parseRiddleViewport, pollRiddleJob, resolveRiddleApiKey, resolveRiddleApiKeySource, riddleRequestJson, runRiddleScript, runRiddleServerPreview } from './riddle-client.cjs';
 export { RIDDLE_PROOF_PR_COMMENT_MARKER, RiddleProofPrCommentArtifact, RiddleProofPrCommentArtifactKind, RiddleProofPrCommentCheckpointSummary, RiddleProofPrCommentInput, RiddleProofPrCommentPageSummary, RiddleProofPrCommentSummary, buildRiddleProofHandoffPrCommentMarkdown, buildRiddleProofPrCommentMarkdown, summarizeRiddleProofPrComment } from './pr-comment.cjs';

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { AssessBasicGameplayOptions, AttachBasicGameplayArtifactOptions, BASIC_G
 export { NormalizeRiddleProofProfileOptions, RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS, RIDDLE_PROOF_ORDERED_TRACE_OPERATORS, RIDDLE_PROOF_PROFILE_CHECK_TYPES, RIDDLE_PROOF_PROFILE_EVIDENCE_VERSION, RIDDLE_PROOF_PROFILE_NETWORK_ABORT_ERROR_CODES, RIDDLE_PROOF_PROFILE_RESULT_VERSION, RIDDLE_PROOF_PROFILE_SETUP_ACTION_TYPES, RIDDLE_PROOF_PROFILE_STATUSES, RIDDLE_PROOF_PROFILE_VERSION, RiddleProofArtifactBodyAssertionInput, RiddleProofArtifactBodyAssertionResult, RiddleProofOrderedTraceAssessment, RiddleProofOrderedTraceEvent, RiddleProofOrderedTraceOperator, RiddleProofOrderedTracePredicate, RiddleProofOrderedTraceWitness, RiddleProofProfile, RiddleProofProfileArtifactCompleteness, RiddleProofProfileArtifactRef, RiddleProofProfileBaselinePolicy, RiddleProofProfileBoundsOffender, RiddleProofProfileCheck, RiddleProofProfileCheckResult, RiddleProofProfileCheckType, RiddleProofProfileEvidence, RiddleProofProfileFailureAction, RiddleProofProfileHttpStatusBodyJsonAssertion, RiddleProofProfileHttpStatusBodyJsonAssertionResult, RiddleProofProfileHttpStatusPreflightCheckResult, RiddleProofProfileHttpStatusPreflightFetch, RiddleProofProfileHttpStatusPreflightFetchResponse, RiddleProofProfileHttpStatusPreflightOptions, RiddleProofProfileHttpStatusPreflightResult, RiddleProofProfileJsonValueType, RiddleProofProfileNetworkAbortErrorCode, RiddleProofProfileNetworkMock, RiddleProofProfileNetworkMockResponse, RiddleProofProfileResult, RiddleProofProfileReturnSummaryField, RiddleProofProfileRouteEvidence, RiddleProofProfileRouteInventoryRoute, RiddleProofProfileRunner, RiddleProofProfileRunnerArtifactPreflight, RiddleProofProfileSetupAction, RiddleProofProfileSetupActionType, RiddleProofProfileStatus, RiddleProofProfileTarget, RiddleProofProfileViewport, RiddleProofProfileViewportEvidence, applyRiddleProofProfileArtifactCompleteness, assessRiddleProofOrderedTrace, assessRiddleProofOrderedTraceSetupResults, assessRiddleProofProfileArtifactCompleteness, assessRiddleProofProfileEvidence, buildRiddleProofProfileScript, collectRiddleProfileArtifactRefs, collectRiddleProofProfileWarnings, createRiddleProofProfileConfigurationError, createRiddleProofProfileEnvironmentBlockedResult, createRiddleProofProfileInsufficientResult, deriveRiddleProofArtifactBodyAssertions, extractRiddleProofProfileResult, normalizeRiddleProofProfile, preflightRiddleProofProfileHttpStatusChecks, preflightRiddleProofProfileRunnerArtifacts, profileStatusExitCode, resolveRiddleProofProfileRouteUrl, resolveRiddleProofProfileTargetUrl, resolveRiddleProofProfileTimeoutSec, slugifyRiddleProofProfileName, summarizeRiddleProofProfileResult } from './profile.js';
 export { RIDDLE_PROOF_PROFILE_SUGGESTIONS_VERSION, RiddleProofProfileChangedTextInput, RiddleProofProfileSuggestion, RiddleProofProfileSuggestionInput, RiddleProofProfileSuggestionsResult, suggestRiddleProofProfileChecks } from './profile-suggestions.js';
 export { CreateRiddleProofObservationReceiptInput, RIDDLE_PREVIEW_RECEIPT_VERSION, RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION, RiddlePreviewReceipt, RiddleProofComparisonRole, RiddleProofExecutionPhase, RiddleProofExecutionTelemetry, RiddleProofObservationArtifact, RiddleProofObservationArtifactRole, RiddleProofObservationExecutor, RiddleProofObservationExecutorKind, RiddleProofObservationPublication, RiddleProofObservationReceipt, RiddleProofObservationTarget, RiddleProofSourceIdentity, createRiddleProofObservationReceipt, parseRiddlePreviewReceipt, parseRiddleProofObservationReceipt } from './receipts.js';
-export { ComposeRiddleProofSemanticCertificatesInput, CreateRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, RiddleProofSemanticCertificate, RiddleProofSemanticCertificationResult, RiddleProofSemanticClaim, RiddleProofSemanticClaimRef, RiddleProofSemanticCompositionDerivation, RiddleProofSemanticCompositionError, RiddleProofSemanticCompositionResult, RiddleProofSemanticContract, RiddleProofSemanticContractDerivation, RiddleProofSemanticContractError, RiddleProofSemanticContractRef, RiddleProofSemanticContractRejected, RiddleProofSemanticDerivation, RiddleProofSemanticEvidenceBundle, RiddleProofSemanticEvidenceRef, RiddleProofSemanticPremise, RiddleProofSemanticPremiseCountMismatch, RiddleProofSemanticPremiseMismatch, RiddleProofSemanticRule, RiddleProofSemanticRuntimeContract, RiddleProofSemanticScope, RiddleProofSemanticScopeField, RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual } from './semantic-certificate.js';
+export { ComposeRiddleProofSemanticCertificatesInput, CreateRiddleProofSemanticCertificateInput, MatchRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, RiddleProofSemanticAssurance, RiddleProofSemanticCertificate, RiddleProofSemanticCertificateAssuranceMismatch, RiddleProofSemanticCertificateClaimMismatch, RiddleProofSemanticCertificateIdMismatch, RiddleProofSemanticCertificateInvalid, RiddleProofSemanticCertificateMatchError, RiddleProofSemanticCertificateMatchResult, RiddleProofSemanticCertificateMatchScopeMismatch, RiddleProofSemanticCertificationResult, RiddleProofSemanticClaim, RiddleProofSemanticClaimExpectation, RiddleProofSemanticClaimRef, RiddleProofSemanticCompositionDerivation, RiddleProofSemanticCompositionError, RiddleProofSemanticCompositionResult, RiddleProofSemanticContract, RiddleProofSemanticContractDerivation, RiddleProofSemanticContractError, RiddleProofSemanticContractRef, RiddleProofSemanticContractRejected, RiddleProofSemanticDerivation, RiddleProofSemanticEvidenceBundle, RiddleProofSemanticEvidenceRef, RiddleProofSemanticPremise, RiddleProofSemanticPremiseCountMismatch, RiddleProofSemanticPremiseMismatch, RiddleProofSemanticRule, RiddleProofSemanticRuntimeContract, RiddleProofSemanticScope, RiddleProofSemanticScopeField, RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, matchRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual } from './semantic-certificate.js';
 export { AssessRiddleProofChangeInput, CreateRiddleProofChangeReceiptInput, RIDDLE_PROOF_CHANGE_CONTRACT_VERSION, RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION, RIDDLE_PROOF_CHANGE_RECEIPT_VERSION, RIDDLE_PROOF_CHANGE_RESULT_VERSION, RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION, RiddleProofChangeContract, RiddleProofChangeDelta, RiddleProofChangeDeltaResult, RiddleProofChangeDeltaStatus, RiddleProofChangeGroupContract, RiddleProofChangeGroupResult, RiddleProofChangeProfileCheckStatus, RiddleProofChangeReceipt, RiddleProofChangeReceiptArtifact, RiddleProofChangeReceiptArtifactKind, RiddleProofChangeReceiptCheckCounts, RiddleProofChangeReceiptDelta, RiddleProofChangeReceiptSide, RiddleProofChangeReceiptVerdict, RiddleProofChangeRecommendation, RiddleProofChangeResult, RiddleProofChangeSide, RiddleProofChangeSourceBindingContract, RiddleProofChangeSourceBindingRequirement, RiddleProofChangeSourceBindingResult, RiddleProofChangeSourceBindingStatus, RiddleProofChangeStatus, RiddleProofCheckStatusTransitionDelta, RiddleProofHandoffReceipt, RiddleProofLegacyChangeReceipt, RiddleProofProfileStatusTransitionDelta, RiddleProofShippingAuthorization, assessRiddleProofChange, createRiddleProofChangeReceipt, createRiddleProofHandoffReceipt, migrateRiddleProofChangeReceipt, parseRiddleProofChangeReceipt, parseRiddleProofHandoffReceipt, riddleProofChangeReceiptHtml, riddleProofChangeReceiptMarkdown } from './change-proof.js';
 export { DEFAULT_RIDDLE_API_BASE_URL, DEFAULT_RIDDLE_API_KEY_FILE, RIDDLE_UNSUBMITTED_WAKE_HINT, RiddleApiError, RiddleApiKeySource, RiddleBalanceResult, RiddleClientConfig, RiddleFetch, RiddlePollJobOptions, RiddlePollJobResult, RiddlePollProgressSnapshot, RiddlePollSummary, RiddlePreviewDeployOptions, RiddlePreviewDeployProgressSnapshot, RiddlePreviewDeployResult, RiddlePreviewDeployStage, RiddlePreviewFramework, RiddleRunScriptInput, RiddleServerPreviewInput, RiddleServerPreviewResult, collectRiddlePreviewDeployWarnings, createRiddleApiClient, deployRiddlePreview, deployRiddleStaticPreview, detectRiddlePreviewSource, getRiddleBalance, isTerminalRiddleJobStatus, parseRiddleViewport, pollRiddleJob, resolveRiddleApiKey, resolveRiddleApiKeySource, riddleRequestJson, runRiddleScript, runRiddleServerPreview } from './riddle-client.js';
 export { RIDDLE_PROOF_PR_COMMENT_MARKER, RiddleProofPrCommentArtifact, RiddleProofPrCommentArtifactKind, RiddleProofPrCommentCheckpointSummary, RiddleProofPrCommentInput, RiddleProofPrCommentPageSummary, RiddleProofPrCommentSummary, buildRiddleProofHandoffPrCommentMarkdown, buildRiddleProofPrCommentMarkdown, summarizeRiddleProofPrComment } from './pr-comment.js';

package/dist/index.js

@@ -15,9 +15,10 @@ import {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   composeRiddleProofSemanticCertificates,
   createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate,
   riddleProofSemanticScopesEqual
-} from "./chunk-ZZ6UNKJQ.js";
+} from "./chunk-DB5ZHRUP.js";
 import {
   RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION,
   RIDDLE_PROOF_PLAYABILITY_VERSION,
@@ -323,6 +324,7 @@ export {
   isSuccessfulStatus,
   isTerminalRiddleJobStatus,
   isTerminalStatus,
+  matchRiddleProofSemanticCertificate,
   migrateRiddleProofChangeReceipt,
   nonEmptyString,
   normalizeCheckpointResponse,

package/dist/semantic-certificate.cjs

@@ -23,6 +23,7 @@ __export(semantic_certificate_exports, {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION: () => RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   composeRiddleProofSemanticCertificates: () => composeRiddleProofSemanticCertificates,
   createRiddleProofSemanticCertificate: () => createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate: () => matchRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate: () => parseRiddleProofSemanticCertificate,
   riddleProofSemanticScopesEqual: () => riddleProofSemanticScopesEqual
 });
@@ -62,6 +63,17 @@ var CERTIFICATE_FIELDS = /* @__PURE__ */ new Set([
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+function safeErrorMessage(error) {
+  try {
+    if (error instanceof Error) return String(error.message);
+  } catch {
+  }
+  try {
+    return String(error);
+  } catch {
+    return "unprintable thrown value";
+  }
+}
 function assertOnlyKeys(record, allowed, context) {
   const allowedSet = new Set(allowed);
   for (const key of Object.keys(record)) {
@@ -399,6 +411,110 @@ function parseRiddleProofSemanticCertificate(value) {
   }
   return { ...body, certificate_id: observedId };
 }
+function matchRiddleProofSemanticCertificate(input) {
+  if (!isRecord(input)) throw new Error("Semantic certificate match input must be an object.");
+  assertOnlyKeys(
+    input,
+    [
+      "certificate",
+      "expected_certificate_id",
+      "expected_scope",
+      "expected_claim",
+      "expected_assurance"
+    ],
+    "semantic certificate match input"
+  );
+  const expectedCertificateId = requiredString(
+    input,
+    "expected_certificate_id",
+    "semantic certificate match input"
+  );
+  if (!/^rpsc_[0-9a-f]{64}$/u.test(expectedCertificateId)) {
+    throw new Error(
+      "Semantic certificate match input.expected_certificate_id must be a full rpsc content ID."
+    );
+  }
+  const expectedScope = parseScope(
+    input.expected_scope,
+    "semantic certificate match expected_scope"
+  );
+  const expectedClaim = parseClaimRef(
+    input.expected_claim,
+    "semantic certificate match expected_claim",
+    ["label"]
+  );
+  const expectedAssurance = requiredString(
+    input,
+    "expected_assurance",
+    "semantic certificate match input"
+  );
+  if (expectedAssurance !== "runtime_contract_accepted" && expectedAssurance !== "declared_runtime_rule") {
+    throw new Error(
+      "Semantic certificate match input.expected_assurance must be runtime_contract_accepted or declared_runtime_rule."
+    );
+  }
+  let certificate;
+  try {
+    certificate = parseRiddleProofSemanticCertificate(input.certificate);
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        code: "invalid_certificate",
+        message: `Semantic certificate did not parse: ${safeErrorMessage(error)}`
+      }
+    };
+  }
+  if (certificate.certificate_id !== expectedCertificateId) {
+    return {
+      ok: false,
+      error: {
+        code: "certificate_id_mismatch",
+        expected: expectedCertificateId,
+        observed: certificate.certificate_id,
+        message: "Semantic certificate does not match the trusted expected content ID."
+      }
+    };
+  }
+  const scopeMismatch = firstScopeMismatch(expectedScope, certificate.scope);
+  if (scopeMismatch) {
+    return {
+      ok: false,
+      error: {
+        code: "scope_mismatch",
+        ...scopeMismatch,
+        message: `Semantic certificate has a different ${scopeMismatch.field} than the consumer expected.`
+      }
+    };
+  }
+  if (!sameClaimRef(expectedClaim, certificate.claim)) {
+    return {
+      ok: false,
+      error: {
+        code: "claim_mismatch",
+        expected: expectedClaim,
+        observed: parseClaimRef(
+          certificate.claim,
+          "semantic certificate match observed claim",
+          ["label"]
+        ),
+        message: "Semantic certificate does not state the claim the consumer expected."
+      }
+    };
+  }
+  if (certificate.derivation.assurance !== expectedAssurance) {
+    return {
+      ok: false,
+      error: {
+        code: "assurance_mismatch",
+        expected: expectedAssurance,
+        observed: certificate.derivation.assurance,
+        message: "Semantic certificate does not have the assurance the consumer expected."
+      }
+    };
+  }
+  return { ok: true, certificate };
+}
 function firstScopeMismatch(expected, observed) {
   for (const field of SCOPE_FIELDS) {
     if (expected[field] !== observed[field]) {
@@ -492,6 +608,7 @@ function composeRiddleProofSemanticCertificates(input) {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   composeRiddleProofSemanticCertificates,
   createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate,
   riddleProofSemanticScopesEqual
 });

package/dist/semantic-certificate.d.cts

@@ -17,6 +17,9 @@ interface RiddleProofSemanticClaimRef {
 interface RiddleProofSemanticClaim extends RiddleProofSemanticClaimRef {
     label: string;
 }
+interface RiddleProofSemanticClaimExpectation extends RiddleProofSemanticClaimRef {
+    label?: string;
+}
 interface RiddleProofSemanticEvidenceRef {
     receipt_id: string;
     artifact_digest: string;
@@ -46,10 +49,11 @@ interface RiddleProofSemanticRule {
     premises: [RiddleProofSemanticClaimRef, ...RiddleProofSemanticClaimRef[]];
     conclusion: RiddleProofSemanticClaim;
 }
+type RiddleProofSemanticAssurance = "runtime_contract_accepted" | "declared_runtime_rule";
 interface RiddleProofSemanticPremise {
     certificate_id: string;
     derivation_kind: RiddleProofSemanticDerivation["kind"];
-    assurance: RiddleProofSemanticDerivation["assurance"];
+    assurance: RiddleProofSemanticAssurance;
     scope: RiddleProofSemanticScope;
     claim: RiddleProofSemanticClaim;
     evidence: RiddleProofSemanticEvidenceBundle;
@@ -134,9 +138,54 @@ type RiddleProofSemanticCompositionResult = {
     ok: false;
     error: RiddleProofSemanticCompositionError;
 };
+interface MatchRiddleProofSemanticCertificateInput {
+    certificate: unknown;
+    expected_certificate_id: string;
+    expected_scope: RiddleProofSemanticScope;
+    expected_claim: RiddleProofSemanticClaimExpectation;
+    expected_assurance: RiddleProofSemanticAssurance;
+}
+interface RiddleProofSemanticCertificateInvalid {
+    code: "invalid_certificate";
+    message: string;
+}
+interface RiddleProofSemanticCertificateIdMismatch {
+    code: "certificate_id_mismatch";
+    expected: string;
+    observed: string;
+    message: string;
+}
+interface RiddleProofSemanticCertificateMatchScopeMismatch {
+    code: "scope_mismatch";
+    field: RiddleProofSemanticScopeField;
+    expected: string;
+    observed: string;
+    message: string;
+}
+interface RiddleProofSemanticCertificateClaimMismatch {
+    code: "claim_mismatch";
+    expected: RiddleProofSemanticClaimRef;
+    observed: RiddleProofSemanticClaimRef;
+    message: string;
+}
+interface RiddleProofSemanticCertificateAssuranceMismatch {
+    code: "assurance_mismatch";
+    expected: RiddleProofSemanticAssurance;
+    observed: RiddleProofSemanticAssurance;
+    message: string;
+}
+type RiddleProofSemanticCertificateMatchError = RiddleProofSemanticCertificateInvalid | RiddleProofSemanticCertificateIdMismatch | RiddleProofSemanticCertificateMatchScopeMismatch | RiddleProofSemanticCertificateClaimMismatch | RiddleProofSemanticCertificateAssuranceMismatch;
+type RiddleProofSemanticCertificateMatchResult = {
+    ok: true;
+    certificate: RiddleProofSemanticCertificate;
+} | {
+    ok: false;
+    error: RiddleProofSemanticCertificateMatchError;
+};
 declare function riddleProofSemanticScopesEqual(left: RiddleProofSemanticScope, right: RiddleProofSemanticScope): boolean;
 declare function createRiddleProofSemanticCertificate<Observation>(input: CreateRiddleProofSemanticCertificateInput<Observation>): RiddleProofSemanticCertificationResult;
 declare function parseRiddleProofSemanticCertificate(value: unknown): RiddleProofSemanticCertificate;
+declare function matchRiddleProofSemanticCertificate(input: MatchRiddleProofSemanticCertificateInput): RiddleProofSemanticCertificateMatchResult;
 declare function composeRiddleProofSemanticCertificates(input: ComposeRiddleProofSemanticCertificatesInput): RiddleProofSemanticCompositionResult;
 
-export { type ComposeRiddleProofSemanticCertificatesInput, type CreateRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, type RiddleProofSemanticCertificate, type RiddleProofSemanticCertificationResult, type RiddleProofSemanticClaim, type RiddleProofSemanticClaimRef, type RiddleProofSemanticCompositionDerivation, type RiddleProofSemanticCompositionError, type RiddleProofSemanticCompositionResult, type RiddleProofSemanticContract, type RiddleProofSemanticContractDerivation, type RiddleProofSemanticContractError, type RiddleProofSemanticContractRef, type RiddleProofSemanticContractRejected, type RiddleProofSemanticDerivation, type RiddleProofSemanticEvidenceBundle, type RiddleProofSemanticEvidenceRef, type RiddleProofSemanticPremise, type RiddleProofSemanticPremiseCountMismatch, type RiddleProofSemanticPremiseMismatch, type RiddleProofSemanticRule, type RiddleProofSemanticRuntimeContract, type RiddleProofSemanticScope, type RiddleProofSemanticScopeField, type RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual };
+export { type ComposeRiddleProofSemanticCertificatesInput, type CreateRiddleProofSemanticCertificateInput, type MatchRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, type RiddleProofSemanticAssurance, type RiddleProofSemanticCertificate, type RiddleProofSemanticCertificateAssuranceMismatch, type RiddleProofSemanticCertificateClaimMismatch, type RiddleProofSemanticCertificateIdMismatch, type RiddleProofSemanticCertificateInvalid, type RiddleProofSemanticCertificateMatchError, type RiddleProofSemanticCertificateMatchResult, type RiddleProofSemanticCertificateMatchScopeMismatch, type RiddleProofSemanticCertificationResult, type RiddleProofSemanticClaim, type RiddleProofSemanticClaimExpectation, type RiddleProofSemanticClaimRef, type RiddleProofSemanticCompositionDerivation, type RiddleProofSemanticCompositionError, type RiddleProofSemanticCompositionResult, type RiddleProofSemanticContract, type RiddleProofSemanticContractDerivation, type RiddleProofSemanticContractError, type RiddleProofSemanticContractRef, type RiddleProofSemanticContractRejected, type RiddleProofSemanticDerivation, type RiddleProofSemanticEvidenceBundle, type RiddleProofSemanticEvidenceRef, type RiddleProofSemanticPremise, type RiddleProofSemanticPremiseCountMismatch, type RiddleProofSemanticPremiseMismatch, type RiddleProofSemanticRule, type RiddleProofSemanticRuntimeContract, type RiddleProofSemanticScope, type RiddleProofSemanticScopeField, type RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, matchRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual };

package/dist/semantic-certificate.d.ts

@@ -17,6 +17,9 @@ interface RiddleProofSemanticClaimRef {
 interface RiddleProofSemanticClaim extends RiddleProofSemanticClaimRef {
     label: string;
 }
+interface RiddleProofSemanticClaimExpectation extends RiddleProofSemanticClaimRef {
+    label?: string;
+}
 interface RiddleProofSemanticEvidenceRef {
     receipt_id: string;
     artifact_digest: string;
@@ -46,10 +49,11 @@ interface RiddleProofSemanticRule {
     premises: [RiddleProofSemanticClaimRef, ...RiddleProofSemanticClaimRef[]];
     conclusion: RiddleProofSemanticClaim;
 }
+type RiddleProofSemanticAssurance = "runtime_contract_accepted" | "declared_runtime_rule";
 interface RiddleProofSemanticPremise {
     certificate_id: string;
     derivation_kind: RiddleProofSemanticDerivation["kind"];
-    assurance: RiddleProofSemanticDerivation["assurance"];
+    assurance: RiddleProofSemanticAssurance;
     scope: RiddleProofSemanticScope;
     claim: RiddleProofSemanticClaim;
     evidence: RiddleProofSemanticEvidenceBundle;
@@ -134,9 +138,54 @@ type RiddleProofSemanticCompositionResult = {
     ok: false;
     error: RiddleProofSemanticCompositionError;
 };
+interface MatchRiddleProofSemanticCertificateInput {
+    certificate: unknown;
+    expected_certificate_id: string;
+    expected_scope: RiddleProofSemanticScope;
+    expected_claim: RiddleProofSemanticClaimExpectation;
+    expected_assurance: RiddleProofSemanticAssurance;
+}
+interface RiddleProofSemanticCertificateInvalid {
+    code: "invalid_certificate";
+    message: string;
+}
+interface RiddleProofSemanticCertificateIdMismatch {
+    code: "certificate_id_mismatch";
+    expected: string;
+    observed: string;
+    message: string;
+}
+interface RiddleProofSemanticCertificateMatchScopeMismatch {
+    code: "scope_mismatch";
+    field: RiddleProofSemanticScopeField;
+    expected: string;
+    observed: string;
+    message: string;
+}
+interface RiddleProofSemanticCertificateClaimMismatch {
+    code: "claim_mismatch";
+    expected: RiddleProofSemanticClaimRef;
+    observed: RiddleProofSemanticClaimRef;
+    message: string;
+}
+interface RiddleProofSemanticCertificateAssuranceMismatch {
+    code: "assurance_mismatch";
+    expected: RiddleProofSemanticAssurance;
+    observed: RiddleProofSemanticAssurance;
+    message: string;
+}
+type RiddleProofSemanticCertificateMatchError = RiddleProofSemanticCertificateInvalid | RiddleProofSemanticCertificateIdMismatch | RiddleProofSemanticCertificateMatchScopeMismatch | RiddleProofSemanticCertificateClaimMismatch | RiddleProofSemanticCertificateAssuranceMismatch;
+type RiddleProofSemanticCertificateMatchResult = {
+    ok: true;
+    certificate: RiddleProofSemanticCertificate;
+} | {
+    ok: false;
+    error: RiddleProofSemanticCertificateMatchError;
+};
 declare function riddleProofSemanticScopesEqual(left: RiddleProofSemanticScope, right: RiddleProofSemanticScope): boolean;
 declare function createRiddleProofSemanticCertificate<Observation>(input: CreateRiddleProofSemanticCertificateInput<Observation>): RiddleProofSemanticCertificationResult;
 declare function parseRiddleProofSemanticCertificate(value: unknown): RiddleProofSemanticCertificate;
+declare function matchRiddleProofSemanticCertificate(input: MatchRiddleProofSemanticCertificateInput): RiddleProofSemanticCertificateMatchResult;
 declare function composeRiddleProofSemanticCertificates(input: ComposeRiddleProofSemanticCertificatesInput): RiddleProofSemanticCompositionResult;
 
-export { type ComposeRiddleProofSemanticCertificatesInput, type CreateRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, type RiddleProofSemanticCertificate, type RiddleProofSemanticCertificationResult, type RiddleProofSemanticClaim, type RiddleProofSemanticClaimRef, type RiddleProofSemanticCompositionDerivation, type RiddleProofSemanticCompositionError, type RiddleProofSemanticCompositionResult, type RiddleProofSemanticContract, type RiddleProofSemanticContractDerivation, type RiddleProofSemanticContractError, type RiddleProofSemanticContractRef, type RiddleProofSemanticContractRejected, type RiddleProofSemanticDerivation, type RiddleProofSemanticEvidenceBundle, type RiddleProofSemanticEvidenceRef, type RiddleProofSemanticPremise, type RiddleProofSemanticPremiseCountMismatch, type RiddleProofSemanticPremiseMismatch, type RiddleProofSemanticRule, type RiddleProofSemanticRuntimeContract, type RiddleProofSemanticScope, type RiddleProofSemanticScopeField, type RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual };
+export { type ComposeRiddleProofSemanticCertificatesInput, type CreateRiddleProofSemanticCertificateInput, type MatchRiddleProofSemanticCertificateInput, RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION, type RiddleProofSemanticAssurance, type RiddleProofSemanticCertificate, type RiddleProofSemanticCertificateAssuranceMismatch, type RiddleProofSemanticCertificateClaimMismatch, type RiddleProofSemanticCertificateIdMismatch, type RiddleProofSemanticCertificateInvalid, type RiddleProofSemanticCertificateMatchError, type RiddleProofSemanticCertificateMatchResult, type RiddleProofSemanticCertificateMatchScopeMismatch, type RiddleProofSemanticCertificationResult, type RiddleProofSemanticClaim, type RiddleProofSemanticClaimExpectation, type RiddleProofSemanticClaimRef, type RiddleProofSemanticCompositionDerivation, type RiddleProofSemanticCompositionError, type RiddleProofSemanticCompositionResult, type RiddleProofSemanticContract, type RiddleProofSemanticContractDerivation, type RiddleProofSemanticContractError, type RiddleProofSemanticContractRef, type RiddleProofSemanticContractRejected, type RiddleProofSemanticDerivation, type RiddleProofSemanticEvidenceBundle, type RiddleProofSemanticEvidenceRef, type RiddleProofSemanticPremise, type RiddleProofSemanticPremiseCountMismatch, type RiddleProofSemanticPremiseMismatch, type RiddleProofSemanticRule, type RiddleProofSemanticRuntimeContract, type RiddleProofSemanticScope, type RiddleProofSemanticScopeField, type RiddleProofSemanticScopeMismatch, composeRiddleProofSemanticCertificates, createRiddleProofSemanticCertificate, matchRiddleProofSemanticCertificate, parseRiddleProofSemanticCertificate, riddleProofSemanticScopesEqual };

package/dist/semantic-certificate.js

@@ -2,14 +2,16 @@ import {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   composeRiddleProofSemanticCertificates,
   createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate,
   riddleProofSemanticScopesEqual
-} from "./chunk-ZZ6UNKJQ.js";
+} from "./chunk-DB5ZHRUP.js";
 import "./chunk-MLKGABMK.js";
 export {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
   composeRiddleProofSemanticCertificates,
   createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate,
   parseRiddleProofSemanticCertificate,
   riddleProofSemanticScopesEqual
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.8.82",
+  "version": "0.8.83",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",