@riddledc/riddle-proof 0.8.84 → 0.8.85

package/README.md

@@ -203,6 +203,199 @@ truth. Contract/rule IDs remain declared data, so consumers that care which
 models were used should apply their own allowlist or authenticated issuer
 policy in addition to anchoring the expected root ID.
 
+### Experimental Grounded Evidence
+
+The grounded-evidence layer extends Semantic certificates with a replayable
+path back to the exact captured bytes:
+
+1. `createRiddleProofSignedCaptureBundle` canonicalizes an artifact manifest,
+   binds it to a complete Semantic scope, a 32-byte challenge nonce, capture
+   time, collector, sensor, and verifier identity, and signs the protected
+   header plus statement with Ed25519.
+2. `verifyRiddleProofSignedCaptureBundle` independently checks the policy,
+   freshness window, trusted public-key fingerprint, signature, manifest, and
+   every inline artifact's length and SHA-256 digest. The callback registry path
+   runs a verifier twice on fresh byte copies and accepts only one identical
+   canonical JSON observation; the callback-free declarative path runs the
+   package's fixed, data-only JSON interpreter.
+3. `createRiddleProofGroundedSemanticCertificate` applies the registered
+   contract to that verifier-derived observation. It emits a content-addressed
+   grounded receipt and a contract-derived Semantic certificate whose evidence
+   begins with that exact receipt and then names every captured artifact.
+4. Atomic grounded closures can be composed. Validation or matching structurally
+   validates the complete Semantic closure, requires exactly one grounding for
+   every contract leaf and none for composition nodes, then replays every leaf
+   against independently supplied signer, verifier, contract, nonce, scope, and
+   time policy. Shared leaves are deduplicated, and a composition certificate
+   cannot predate any direct premise.
+
+The public surface is available from both the package root and
+`@riddledc/riddle-proof/grounded-evidence`. This example issues one grounded
+leaf, wraps it as a closure, and replays the complete handoff. The omitted
+values (`scope`, key material, artifacts, and identity objects) come from the
+collector and trust setup. In particular, policy and replay expectations must
+be independently configured rather than copied out of an untrusted bundle:
+
+```ts
+import {
+  type RiddleProofGroundedCaptureVerificationPolicy,
+  type RiddleProofGroundedReplayConfiguration,
+  createRiddleProofGroundedDeclarativeJsonContract,
+  createRiddleProofGroundedDeclarativeJsonVerifier,
+  createRiddleProofGroundedSemanticAtomicCertificateClosure,
+  createRiddleProofGroundedSemanticCertificate,
+  createRiddleProofSignedCaptureBundle,
+  matchRiddleProofGroundedSemanticCertificateClosure,
+} from "@riddledc/riddle-proof/grounded-evidence";
+
+const declarativeVerifier = createRiddleProofGroundedDeclarativeJsonVerifier({
+  verifier_id: "riddle-proof.profile-evidence-json",
+  verifier_version: "1",
+  program: {
+    artifact: {
+      artifact_id: "profile-evidence.json",
+      role: "profile_evidence",
+      media_type: "application/json",
+    },
+    pointer: "", // RFC 6901: select the parsed document root
+  },
+});
+if (!declarativeVerifier.ok) throw new Error(declarativeVerifier.error.message);
+
+const declarativeContract = createRiddleProofGroundedDeclarativeJsonContract({
+  contract_id: "riddle-proof.profile-passed",
+  contract_version: "1",
+  label: "The captured profile passed",
+  claim: passedProfileClaim,
+  program: {
+    all: [
+      { op: "type_is", source: "observation", pointer: "", type: "object" },
+      { op: "equals", source: "observation", pointer: "/status", value: "passed" },
+      { op: "equals", source: "scope", pointer: "/revision", value: scope.revision },
+    ],
+  },
+});
+if (!declarativeContract.ok) throw new Error(declarativeContract.error.message);
+
+const createdBundle = createRiddleProofSignedCaptureBundle({
+  scope,
+  nonce, // canonical base64url encoding of an independently issued 32-byte value
+  captured_at: "2026-07-19T14:30:00.000Z",
+  collector,
+  sensor,
+  verifier: declarativeVerifier.verifier_ref,
+  artifacts,
+  signing_key: {
+    key_id: "local-playwright-key",
+    private_key_pkcs8_base64: privateKeyPkcs8Base64,
+  },
+});
+if (!createdBundle.ok) throw new Error(createdBundle.error.message);
+
+const policy: RiddleProofGroundedCaptureVerificationPolicy = {
+  expected_scope: scope,
+  expected_nonce: nonce,
+  expected_collector: collector,
+  expected_sensor: sensor,
+  expected_verifier: declarativeVerifier.verifier_ref,
+  expected_signer: {
+    key_id: "local-playwright-key",
+    public_key_spki_sha256: trustedPublicKeySpkiSha256,
+  },
+  verification_time: "2026-07-19T14:30:01.000Z",
+  max_capture_age_ms: 60_000,
+  max_future_skew_ms: 1_000,
+  required_artifact_roles: ["profile_evidence"],
+};
+
+const configuration: RiddleProofGroundedReplayConfiguration = {
+  policy,
+  trusted_signers: [{
+    key_id: "local-playwright-key",
+    public_key_spki_base64: trustedPublicKeySpkiBase64,
+  }],
+  verifier_registry: [declarativeVerifier.registration],
+  contract_registry: [declarativeContract.registration],
+  expected_contract: declarativeContract.contract_ref,
+};
+
+const issued = createRiddleProofGroundedSemanticCertificate({
+  bundle: createdBundle.bundle,
+  ...configuration,
+  // Grounded leaf chronology is the independent verification time, not caller drift.
+  issued_at: policy.verification_time,
+});
+if (!issued.ok) throw new Error(issued.error.message);
+
+const atomic = createRiddleProofGroundedSemanticAtomicCertificateClosure({
+  certificate: issued.certificate,
+  grounding: issued.grounding,
+  configuration,
+});
+if (!atomic.ok) throw new Error(atomic.error.message);
+
+const checked = matchRiddleProofGroundedSemanticCertificateClosure({
+  grounded_closure: JSON.parse(JSON.stringify(atomic.grounded_closure)),
+  replay_contexts: [{
+    certificate_id: issued.certificate.certificate_id,
+    ...configuration,
+  }],
+  expected_root_certificate_id: trustedHandoffCertificateId,
+  expected_scope: scope,
+  expected_claim: passedProfileClaim,
+  expected_assurance: "runtime_contract_accepted",
+});
+if (!checked.ok) throw new Error(checked.error.message);
+```
+
+Use `composeRiddleProofGroundedSemanticCertificateClosures` for higher claims.
+It takes a normal Semantic `rule`, one grounded closure per premise,
+`replay_contexts` for every distinct leaf, and an `issued_at` no earlier than
+the latest input root. `validateRiddleProofGroundedSemanticCertificateClosure`
+performs the same full leaf replay without applying trusted root expectations;
+`matchRiddleProofGroundedSemanticCertificateClosure` adds those expectations.
+
+The declarative builders above are the narrower primary path. They canonicalize
+the data-only program, domain-separate and SHA-256 hash the complete definition,
+set `trust_basis.kind` to `builtin_declarative_json`, and return a registration
+with no callback. During every issuance and replay, Riddle Proof recomputes that
+digest and uses only its fixed v0 interpreter. The verifier selects one exact
+`application/json` artifact by ID, role, and media type, parses strict UTF-8 JSON,
+and projects an RFC 6901 JSON Pointer. The contract supports a bounded `all`
+list of `exists`, exact `equals`, and `type_is` assertions over the observation
+or the five-field scope.
+
+The custom callback trust boundary remains deliberately visible. A verifier or
+contract reference with `trust_basis: { kind: "external_registry" }` means an
+independent registry selected that callback and vouches for its
+`implementation_digest`. Riddle Proof does not derive callback identity from
+`Function#toString` or prove that arbitrary JavaScript bytes correspond to the
+declared digest. Registry callbacks are invoked from snapshots without a
+receiver and with cloned inputs, but the registry remains part of the trusted
+computing base.
+
+Parsing is fail-closed for extra/hidden/accessor fields, sparse structural
+arrays, noncanonical base64, noncanonical timestamps, and noncanonical DER.
+The exported limits bound a capture to 64 artifacts, 16 MiB per artifact,
+64 MiB total decoded artifact bytes, and a 1 MiB canonical observation. A
+grounded closure additionally has 256 MiB aggregate replay-work and 64 MiB
+canonical metadata limits, plus aggregate replay-configuration, registry, and
+trusted-key limits. Declarative definitions are limited to 64 KiB, 64 contract
+assertions, and bounded JSON Pointer sizes and depth. These limits are
+denial-of-service boundaries; they do not make the evidence empirically true.
+
+The remaining outside-world boundary is also explicit. The signature proves
+that the trusted key signed this exact capture statement, and replay proves that
+the registered verifier and contract deterministically produce this exact leaf
+from the included bytes. It does not prove that the key was well kept, the
+collector's clock or nonce source was honest, the browser rendered the claimed
+URL faithfully, the sensor was well calibrated, or the included screenshot
+matches photons a human would have seen. The Playwright runner reduces that gap
+by signing the exact files it persisted and recording browser provenance, but
+its signer, browser process, machine, and capture policy still require trust.
+Lean proves the framework invariants that connect these stages; it does not
+turn those empirical assumptions into theorems.
+
 Persist a deploy result and its immutable receipt for later Change Proof input:
 
 ```sh

package/capabilities.json

@@ -0,0 +1,17 @@
+{
+  "version": "riddle-proof.package-capabilities.v1",
+  "package": "@riddledc/riddle-proof",
+  "capabilities": {
+    "network": true,
+    "filesystem": true,
+    "browser": true,
+    "subprocess": true,
+    "hosted_riddle": true,
+    "cryptography": true,
+    "ambient_clock": true
+  },
+  "notes": [
+    "This pre-1.0 package is the compatibility facade and intentionally exposes the union of core, local engine, and hosted-client capabilities.",
+    "Security-sensitive local consumers should install @riddledc/riddle-proof-core and a specific adapter instead."
+  ]
+}

package/dist/advanced/engine-harness.js

@@ -2,10 +2,10 @@ import {
   createDisabledRiddleProofAgentAdapter,
   readRiddleProofRunStatus,
   runRiddleProofEngineHarness
-} from "../chunk-WLUMLHII.js";
+} from "../chunk-BID7CKMM.js";
+import "../chunk-EKZXU6MU.js";
 import "../chunk-CGJX7LJO.js";
 import "../chunk-UTCL7FEZ.js";
-import "../chunk-EKZXU6MU.js";
 import "../chunk-DYE3URAQ.js";
 import "../chunk-NKHZASNQ.js";
 import "../chunk-ZAR7BWMN.js";

package/dist/advanced/index.js

@@ -3,15 +3,15 @@ import {
 } from "../chunk-VYJD6XYF.js";
 import {
   runner_exports
-} from "../chunk-YH7ADFY4.js";
+} from "../chunk-IVSP24XI.js";
 import {
   engine_harness_exports
-} from "../chunk-WLUMLHII.js";
-import "../chunk-CGJX7LJO.js";
-import "../chunk-UTCL7FEZ.js";
+} from "../chunk-BID7CKMM.js";
 import {
   proof_run_core_exports
 } from "../chunk-EKZXU6MU.js";
+import "../chunk-CGJX7LJO.js";
+import "../chunk-UTCL7FEZ.js";
 import "../chunk-DYE3URAQ.js";
 import "../chunk-NKHZASNQ.js";
 import "../chunk-ZAR7BWMN.js";

package/dist/advanced/runner.js

@@ -1,9 +1,9 @@
 import {
   runRiddleProof
-} from "../chunk-YH7ADFY4.js";
+} from "../chunk-IVSP24XI.js";
+import "../chunk-EKZXU6MU.js";
 import "../chunk-CGJX7LJO.js";
 import "../chunk-UTCL7FEZ.js";
-import "../chunk-EKZXU6MU.js";
 import "../chunk-DYE3URAQ.js";
 import "../chunk-NKHZASNQ.js";
 import "../chunk-ZAR7BWMN.js";

package/dist/change-proof.cjs

@@ -15,6 +15,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/change-proof.ts
@@ -47,255 +48,16 @@ var RIDDLE_PROOF_PROFILE_STATUSES = [
 ];
 
 // src/receipts.ts
-var RIDDLE_PREVIEW_RECEIPT_VERSION = "riddle.preview-receipt.v1";
-var RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION = "riddle-proof.observation-receipt.v1";
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function requiredString(record, key, context) {
-  const value = record[key];
-  if (typeof value !== "string" || !value.trim()) {
-    throw new Error(`${context}.${key} must be a non-empty string.`);
-  }
-  return value.trim();
-}
-function normalizedSourceIdentity(value) {
-  if (!isRecord(value)) return {};
-  return {
-    git_revision: typeof value.git_revision === "string" && value.git_revision.trim() ? value.git_revision.trim() : void 0,
-    repository: typeof value.repository === "string" && value.repository.trim() ? value.repository.trim() : void 0,
-    dirty: typeof value.dirty === "boolean" ? value.dirty : void 0,
-    label: typeof value.label === "string" && value.label.trim() ? value.label.trim() : void 0
-  };
-}
-function parseRiddlePreviewReceipt(value) {
-  if (!isRecord(value)) throw new Error("Preview receipt must be an object.");
-  if (value.version !== RIDDLE_PREVIEW_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Preview receipt version ${String(value.version || "missing")}.`);
-  }
-  if (!isRecord(value.source)) throw new Error("Preview receipt source must be an object.");
-  const expiresAt = requiredString(value, "expires_at", "preview receipt");
-  const publishedAt = requiredString(value, "published_at", "preview receipt");
-  const contentDigest = requiredString(value, "content_digest", "preview receipt");
-  if (!contentDigest.startsWith("sha256:") || contentDigest.length <= "sha256:".length) {
-    throw new Error("preview receipt.content_digest must be a sha256 digest.");
-  }
-  if (!Number.isFinite(Date.parse(expiresAt)) || !Number.isFinite(Date.parse(publishedAt))) {
-    throw new Error("Preview receipt timestamps must be valid ISO date strings.");
-  }
-  return {
-    version: RIDDLE_PREVIEW_RECEIPT_VERSION,
-    preview_id: requiredString(value, "preview_id", "preview receipt"),
-    url: requiredString(value, "url", "preview receipt"),
-    expires_at: expiresAt,
-    content_digest: contentDigest,
-    source: normalizedSourceIdentity(value.source),
-    published_at: publishedAt
-  };
-}
-function comparableArtifactName(value) {
-  return (value || "").split(/[/?#]/).pop()?.toLowerCase().replace(/\.(png|jpe?g|gif|webp|avif|svg)$/u, "").replace(/[^a-z0-9_-]+/gu, "-").replace(/^-+|-+$/g, "") || "";
-}
-function artifactMatchesLabel(artifact, label) {
-  const expected = comparableArtifactName(label);
-  if (!expected) return false;
-  return [artifact.name, artifact.url, artifact.path].map(comparableArtifactName).some((name) => name === expected || name.endsWith(`-${expected}`));
-}
-function artifactLooksLikeScreenshot(ref) {
-  const text = [ref.name, ref.url, ref.path, ref.kind, ref.content_type].filter(Boolean).join(" ").toLowerCase();
-  return /screenshot|\bimage\b/.test(text) || /\.(png|jpe?g|gif|webp|avif|svg)(\?|#|$)/.test(text);
-}
-function finalScreenshotLabels(result) {
-  const explicit = result.artifacts.canonical_screenshots || [];
-  if (explicit.length) return explicit;
-  const fromEvidence = (result.evidence?.viewports || []).map((viewport) => viewport.screenshot_label).filter((label) => typeof label === "string" && Boolean(label.trim()));
-  if (fromEvidence.length) return fromEvidence;
-  return (result.artifacts.screenshots || []).slice(0, 1);
-}
-function setupScreenshotLabels(result) {
-  const explicit = result.artifacts.setup_screenshots || [];
-  if (explicit.length) return explicit;
-  return (result.evidence?.viewports || []).flatMap(
-    (viewport) => (viewport.setup_action_results || []).filter((action) => action.action === "screenshot" && action.ok !== false && typeof action.screenshot_label === "string").map((action) => String(action.screenshot_label))
-  );
-}
-function observationArtifactFromRef(ref, canonicalLabels, setupLabels) {
-  const base = {
-    name: ref.name,
-    role: ref.role || "artifact",
-    url: ref.url,
-    path: ref.path,
-    kind: ref.kind,
-    content_type: ref.content_type,
-    source: ref.source
-  };
-  if (!artifactLooksLikeScreenshot(ref)) return base;
-  if (canonicalLabels.some((label) => artifactMatchesLabel(base, label))) {
-    return { ...base, role: "canonical_screenshot" };
-  }
-  if (setupLabels.some((label) => artifactMatchesLabel(base, label))) {
-    return { ...base, role: "setup_screenshot" };
-  }
-  return { ...base, role: "diagnostic" };
-}
-function profileObservationArtifacts(result) {
-  const canonicalLabels = finalScreenshotLabels(result);
-  const setupLabels = setupScreenshotLabels(result);
-  const artifacts = [];
-  const seen = /* @__PURE__ */ new Set();
-  const add = (artifact) => {
-    const key = artifact.url || artifact.path || `${artifact.role}:${artifact.name}`;
-    if (!artifact.name || seen.has(key)) return;
-    seen.add(key);
-    artifacts.push(artifact);
-  };
-  for (const ref of result.artifacts.riddle_artifacts || []) {
-    add(observationArtifactFromRef(ref, canonicalLabels, setupLabels));
-  }
-  for (const label of canonicalLabels) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "canonical_screenshot", kind: "image" });
-    }
-  }
-  for (const label of setupLabels) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "setup_screenshot", kind: "image" });
-    }
-  }
-  for (const label of result.artifacts.screenshots || []) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "diagnostic", kind: "image" });
-    }
-  }
-  return artifacts;
-}
-function mergeObservationArtifacts(profileArtifacts, suppliedArtifacts) {
-  const artifacts = [...profileArtifacts];
-  for (const supplied of suppliedArtifacts) {
-    const suppliedNames = [supplied.name, supplied.url, supplied.path].map(comparableArtifactName).filter(Boolean);
-    const existingIndex = artifacts.findIndex((artifact) => {
-      if (supplied.url && artifact.url === supplied.url) return true;
-      if (supplied.path && artifact.path === supplied.path) return true;
-      return [artifact.name, artifact.url, artifact.path].map(comparableArtifactName).some((name) => name && suppliedNames.includes(name));
-    });
-    if (existingIndex < 0) {
-      artifacts.push(supplied);
-      continue;
-    }
-    const existing = artifacts[existingIndex];
-    const role = supplied.role === "canonical_screenshot" || supplied.role === "setup_screenshot" ? supplied.role : existing.role === "canonical_screenshot" || existing.role === "setup_screenshot" ? existing.role : supplied.role === "artifact" ? existing.role : supplied.role;
-    artifacts[existingIndex] = {
-      ...existing,
-      ...supplied,
-      role
-    };
-  }
-  return artifacts;
-}
-function defaultObservationId(role, capturedAt) {
-  return `obs_${role}_${capturedAt.replace(/[^0-9]/g, "").slice(0, 17) || "unknown"}`;
-}
-function profileCheckCounts(result) {
-  const counts = { total: result.checks.length, passed: 0, failed: 0, skipped: 0, needs_human_review: 0 };
-  for (const check of result.checks) {
-    if (check.status === "passed") counts.passed += 1;
-    if (check.status === "failed") counts.failed += 1;
-    if (check.status === "skipped") counts.skipped += 1;
-    if (check.status === "needs_human_review") counts.needs_human_review += 1;
-  }
-  return counts;
-}
-function createRiddleProofObservationReceipt(input) {
-  const capturedAt = input.captured_at || input.profile_result?.captured_at || (/* @__PURE__ */ new Date()).toISOString();
-  const profileArtifacts = input.profile_result ? profileObservationArtifacts(input.profile_result) : [];
-  const requestedCanonical = input.canonical_screenshot ? { ...input.canonical_screenshot, role: "canonical_screenshot" } : void 0;
-  const artifacts = mergeObservationArtifacts(
-    profileArtifacts,
-    [...input.artifacts || [], ...requestedCanonical ? [requestedCanonical] : []]
-  );
-  const canonicalScreenshot = requestedCanonical ? artifacts.find((artifact) => artifact.role === "canonical_screenshot" && artifactMatchesLabel(artifact, requestedCanonical.name)) || requestedCanonical : artifacts.find((artifact) => artifact.role === "canonical_screenshot");
-  const target = input.target.kind === "preview" && input.target.preview ? { ...input.target, preview: parseRiddlePreviewReceipt(input.target.preview) } : input.target;
-  return {
-    version: RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
-    observation_id: input.observation_id || defaultObservationId(input.comparison_role, capturedAt),
-    comparison_role: input.comparison_role,
-    executor: input.executor,
-    target,
-    source: normalizedSourceIdentity(input.source || input.target.preview?.source),
-    captured_at: capturedAt,
-    artifacts,
-    canonical_screenshot: canonicalScreenshot,
-    profile_summary: input.profile_result ? {
-      profile_name: input.profile_result.profile_name,
-      status: input.profile_result.status,
-      summary: input.profile_result.summary,
-      route: input.profile_result.route,
-      checks: profileCheckCounts(input.profile_result)
-    } : void 0,
-    proof: input.profile_result ? {
-      profile_name: input.profile_result.profile_name,
-      result: input.profile_result
-    } : void 0,
-    publication: input.publication,
-    execution: input.execution,
-    metadata: input.metadata
-  };
-}
-function parseRiddleProofObservationReceipt(value) {
-  if (!isRecord(value)) throw new Error("Observation receipt must be an object.");
-  if (value.version !== RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Observation receipt version ${String(value.version || "missing")}.`);
-  }
-  if (!isRecord(value.executor)) throw new Error("Observation receipt executor must be an object.");
-  if (!isRecord(value.target)) throw new Error("Observation receipt target must be an object.");
-  if (!isRecord(value.source)) throw new Error("Observation receipt source must be an object.");
-  requiredString(value, "observation_id", "observation receipt");
-  requiredString(value, "captured_at", "observation receipt");
-  const executorKind = requiredString(value.executor, "kind", "observation receipt executor");
-  if (!"local_playwright,riddle_hosted,browser_api,other".split(",").includes(executorKind)) {
-    throw new Error(`Unsupported observation executor kind ${executorKind}.`);
-  }
-  if (value.executor.runner !== void 0) {
-    requiredString(value.executor, "runner", "observation receipt executor");
-  }
-  const role = requiredString(value, "comparison_role", "observation receipt");
-  if (!["before", "after", "standalone"].includes(role)) {
-    throw new Error(`Unsupported observation comparison role ${role}.`);
-  }
-  const targetKind = requiredString(value.target, "kind", "observation receipt target");
-  if (targetKind !== "url" && targetKind !== "preview") {
-    throw new Error(`Unsupported observation target kind ${targetKind}.`);
-  }
-  requiredString(value.target, "url", "observation receipt target");
-  if (targetKind === "preview") {
-    if (value.target.preview === void 0) {
-      throw new Error("Preview Observation target must include its Preview receipt.");
-    }
-    parseRiddlePreviewReceipt(value.target.preview);
-  }
-  if (!Array.isArray(value.artifacts)) throw new Error("Observation receipt artifacts must be an array.");
-  const artifactRoles = /* @__PURE__ */ new Set(["canonical_screenshot", "setup_screenshot", "data", "diagnostic", "artifact"]);
-  const artifacts = value.artifacts.map((artifact, index) => {
-    if (!isRecord(artifact)) throw new Error(`Observation receipt artifact ${index} must be an object.`);
-    requiredString(artifact, "name", `observation receipt artifact ${index}`);
-    const artifactRole = requiredString(artifact, "role", `observation receipt artifact ${index}`);
-    if (!artifactRoles.has(artifactRole)) {
-      throw new Error(`Unsupported observation artifact role ${artifactRole}.`);
-    }
-    return artifact;
-  });
-  if (value.canonical_screenshot !== void 0) {
-    if (!isRecord(value.canonical_screenshot) || value.canonical_screenshot.role !== "canonical_screenshot") {
-      throw new Error("Observation canonical_screenshot must have the canonical_screenshot role.");
-    }
-    const canonical = value.canonical_screenshot;
-    const included = artifacts.some((artifact) => artifact.role === "canonical_screenshot" && artifact.name === canonical.name && artifact.url === canonical.url && artifact.path === canonical.path);
-    if (!included) {
-      throw new Error("Observation canonical_screenshot must reference an artifact in the receipt.");
-    }
-  }
-  return value;
-}
+var receipts_exports = {};
+__export(receipts_exports, {
+  RIDDLE_PREVIEW_RECEIPT_VERSION: () => import_receipts.RIDDLE_PREVIEW_RECEIPT_VERSION,
+  RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION: () => import_receipts.RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
+  createRiddleProofObservationReceipt: () => import_receipts.createRiddleProofObservationReceipt,
+  parseRiddlePreviewReceipt: () => import_receipts.parseRiddlePreviewReceipt,
+  parseRiddleProofObservationReceipt: () => import_receipts.parseRiddleProofObservationReceipt
+});
+__reExport(receipts_exports, require("@riddledc/riddle-proof-core/receipts"));
+var import_receipts = require("@riddledc/riddle-proof-core/receipts");
 
 // src/change-proof.ts
 var RIDDLE_PROOF_CHANGE_CONTRACT_VERSION = "riddle-proof.change-contract.v1";
@@ -639,7 +401,7 @@ function changeReceiptVerdict(status) {
   if (status === "proof_insufficient") return "proof_insufficient";
   return "not_mergeable";
 }
-function profileCheckCounts2(result) {
+function profileCheckCounts(result) {
   const counts = {
     total: result.checks.length,
     passed: 0,
@@ -712,7 +474,7 @@ function observationExecutor(result) {
 function observationForReceiptSide(side, result, source, sourceIdentity) {
   if (!result) throw new Error(`${side}_result or ${side}_observation is required.`);
   if (!source) throw new Error(`${side}_source or ${side}_observation is required.`);
-  return createRiddleProofObservationReceipt({
+  return (0, import_receipts.createRiddleProofObservationReceipt)({
     comparison_role: side,
     executor: observationExecutor(result),
     target: { kind: "url", url: source },
@@ -723,8 +485,8 @@ function observationForReceiptSide(side, result, source, sourceIdentity) {
   });
 }
 function createRiddleProofChangeReceipt(input) {
-  const before = input.before_observation ? parseRiddleProofObservationReceipt(input.before_observation) : observationForReceiptSide("before", input.before_result, input.before_source, input.before_source_identity);
-  const after = input.after_observation ? parseRiddleProofObservationReceipt(input.after_observation) : observationForReceiptSide("after", input.after_result, input.after_source, input.after_source_identity);
+  const before = input.before_observation ? (0, import_receipts.parseRiddleProofObservationReceipt)(input.before_observation) : observationForReceiptSide("before", input.before_result, input.before_source, input.before_source_identity);
+  const after = input.after_observation ? (0, import_receipts.parseRiddleProofObservationReceipt)(input.after_observation) : observationForReceiptSide("after", input.after_result, input.after_source, input.after_source_identity);
   const verdict = changeReceiptVerdict(input.result.status);
   const shippingAuthorization = input.shipping_authorization || noShippingAuthorization();
   assertShippingAuthorizationConsistent(shippingAuthorization, "Change receipt");
@@ -754,7 +516,7 @@ function createRiddleProofChangeReceipt(input) {
     metadata: input.result.metadata
   };
 }
-function isRecord2(value) {
+function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function migratedObservationFromLegacySide(side, legacy) {
@@ -831,7 +593,7 @@ function migrateRiddleProofChangeReceipt(legacy) {
   };
 }
 function parseRiddleProofChangeReceipt(value) {
-  if (!isRecord2(value)) throw new Error("Change receipt must be an object.");
+  if (!isRecord(value)) throw new Error("Change receipt must be an object.");
   if (value.version === RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION) {
     return migrateRiddleProofChangeReceipt(value);
   }
@@ -842,8 +604,8 @@ function parseRiddleProofChangeReceipt(value) {
   if (!RIDDLE_PROOF_PROFILE_STATUSES.includes(receipt.status)) {
     throw new Error(`Unsupported Change receipt status ${String(receipt.status || "missing")}.`);
   }
-  parseRiddleProofObservationReceipt(receipt.before);
-  parseRiddleProofObservationReceipt(receipt.after);
+  (0, import_receipts.parseRiddleProofObservationReceipt)(receipt.before);
+  (0, import_receipts.parseRiddleProofObservationReceipt)(receipt.after);
   if (receipt.before.comparison_role !== "before" || receipt.after.comparison_role !== "after") {
     throw new Error("Change receipt observations must preserve their before and after comparison roles.");
   }
@@ -875,8 +637,8 @@ function createRiddleProofHandoffReceipt(changeReceipt, options = {}) {
   };
 }
 function parseRiddleProofHandoffReceipt(value) {
-  if (!isRecord2(value) || value.version !== RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Handoff receipt version ${String(isRecord2(value) ? value.version || "missing" : "missing")}.`);
+  if (!isRecord(value) || value.version !== RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION) {
+    throw new Error(`Unsupported Handoff receipt version ${String(isRecord(value) ? value.version || "missing" : "missing")}.`);
   }
   const receipt = value;
   if (!Number.isFinite(Date.parse(receipt.created_at))) {
@@ -931,7 +693,7 @@ function receiptSideView(side, observation) {
     summary: summary?.summary || observation.proof?.result.summary || "No profile summary recorded.",
     route: summary?.route,
     captured_at: observation.captured_at,
-    checks: summary?.checks || (observation.proof ? profileCheckCounts2(observation.proof.result) : {
+    checks: summary?.checks || (observation.proof ? profileCheckCounts(observation.proof.result) : {
       total: 0,
       passed: 0,
       failed: 0,

package/dist/change-proof.d.cts

@@ -1,5 +1,5 @@
 import { RiddleProofProfileResult, RiddleProofProfileStatus, RiddleProofProfileCheckResult } from './profile.cjs';
-import { RiddleProofObservationReceipt, RiddleProofSourceIdentity, RiddleProofObservationArtifact } from './receipts.cjs';
+import { RiddleProofObservationReceipt, RiddleProofSourceIdentity, RiddleProofObservationArtifact } from '@riddledc/riddle-proof-core/receipts';
 import { JsonValue } from './types.cjs';
 import './public-state.cjs';
 

package/dist/change-proof.d.ts

@@ -1,5 +1,5 @@
 import { RiddleProofProfileResult, RiddleProofProfileStatus, RiddleProofProfileCheckResult } from './profile.js';
-import { RiddleProofObservationReceipt, RiddleProofSourceIdentity, RiddleProofObservationArtifact } from './receipts.js';
+import { RiddleProofObservationReceipt, RiddleProofSourceIdentity, RiddleProofObservationArtifact } from '@riddledc/riddle-proof-core/receipts';
 import { JsonValue } from './types.js';
 import './public-state.js';
 

package/dist/change-proof.js

@@ -12,8 +12,8 @@ import {
   parseRiddleProofHandoffReceipt,
   riddleProofChangeReceiptHtml,
   riddleProofChangeReceiptMarkdown
-} from "./chunk-LR4UYJDY.js";
-import "./chunk-MEVVL4TI.js";
+} from "./chunk-O2AO726C.js";
+import "./chunk-OHDNCXRM.js";
 import "./chunk-2K3DIK7A.js";
 import "./chunk-MLKGABMK.js";
 export {