@riddledc/riddle-proof 0.8.84 → 0.8.85

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
@@ -1797,9 +1798,9 @@ function cleanupMergedProofRun(state, repoDir, params, prState) {
   const baseBranch = stringValue2(prState.base_branch) || stringValue2(state?.base_branch) || "main";
   let fetchedBase = params.fetch_base === false;
   if (params.fetch_base !== false && baseBranch) {
-    const fetch2 = commandResult("git", ["fetch", "origin", baseBranch], repoDir, 12e4);
-    cleanup.fetch = fetch2.ok ? { ok: true, base_branch: baseBranch } : { ok: false, base_branch: baseBranch, error: fetch2.stderr.slice(0, 300) };
-    if (fetch2.ok) {
+    const fetch = commandResult("git", ["fetch", "origin", baseBranch], repoDir, 12e4);
+    cleanup.fetch = fetch.ok ? { ok: true, base_branch: baseBranch } : { ok: false, base_branch: baseBranch, error: fetch.stderr.slice(0, 300) };
+    if (fetch.ok) {
       fetchedBase = true;
       state.base_synced_at = (/* @__PURE__ */ new Date()).toISOString();
       state.base_branch = baseBranch;
@@ -3412,9 +3413,10 @@ __export(index_exports, {
   DEFAULT_DIAGNOSTIC_ARRAY_LIMIT: () => DEFAULT_DIAGNOSTIC_ARRAY_LIMIT,
   DEFAULT_DIAGNOSTIC_HISTORY_LIMIT: () => DEFAULT_DIAGNOSTIC_HISTORY_LIMIT,
   DEFAULT_DIAGNOSTIC_STRING_LIMIT: () => DEFAULT_DIAGNOSTIC_STRING_LIMIT,
-  DEFAULT_RIDDLE_API_BASE_URL: () => DEFAULT_RIDDLE_API_BASE_URL,
-  DEFAULT_RIDDLE_API_KEY_FILE: () => DEFAULT_RIDDLE_API_KEY_FILE,
-  RIDDLE_PREVIEW_RECEIPT_VERSION: () => RIDDLE_PREVIEW_RECEIPT_VERSION,
+  DEFAULT_RIDDLE_API_BASE_URL: () => import_client.DEFAULT_RIDDLE_API_BASE_URL,
+  DEFAULT_RIDDLE_API_KEY_FILE: () => import_client.DEFAULT_RIDDLE_API_KEY_FILE,
+  RIDDLE_BALANCE_ENDPOINT_PATH: () => import_client.RIDDLE_BALANCE_ENDPOINT_PATH,
+  RIDDLE_PREVIEW_RECEIPT_VERSION: () => import_receipts.RIDDLE_PREVIEW_RECEIPT_VERSION,
   RIDDLE_PROOF_BASIC_GAMEPLAY_ASSESSMENT_VERSION: () => RIDDLE_PROOF_BASIC_GAMEPLAY_ASSESSMENT_VERSION,
   RIDDLE_PROOF_BASIC_GAMEPLAY_CATCH_VERSION: () => RIDDLE_PROOF_BASIC_GAMEPLAY_CATCH_VERSION,
   RIDDLE_PROOF_BASIC_GAMEPLAY_VERSION: () => RIDDLE_PROOF_BASIC_GAMEPLAY_VERSION,
@@ -3423,11 +3425,42 @@ __export(index_exports, {
   RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION: () => RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION,
   RIDDLE_PROOF_CHANGE_RECEIPT_VERSION: () => RIDDLE_PROOF_CHANGE_RECEIPT_VERSION,
   RIDDLE_PROOF_CHANGE_RESULT_VERSION: () => RIDDLE_PROOF_CHANGE_RESULT_VERSION,
+  RIDDLE_PROOF_CHECKED_MEANING_ASSURANCE: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_ASSURANCE,
+  RIDDLE_PROOF_CHECKED_MEANING_CLOSURE_VERSION: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_CLOSURE_VERSION,
+  RIDDLE_PROOF_CHECKED_MEANING_MATERIALIZED_RULE_DIGEST_DOMAIN: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MATERIALIZED_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_AGE_MS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_AGE_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_CONSUMPTION_WINDOW_MS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_CONSUMPTION_WINDOW_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_DEFINITION_BYTES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PARAMETERS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_PARAMETERS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PREMISES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_PREMISES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_RULES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_RULES,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_DIGEST_DOMAIN: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_ENGINE: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_RULE_ENGINE,
   RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION: () => RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
   RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION: () => RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACTS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACTS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_OBSERVATION_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_OBSERVATION_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TIME_WINDOW_MS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TIME_WINDOW_MS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TOTAL_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_STATEMENT_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_STATEMENT_VERSION,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_DEFINITION_DIGEST_DOMAIN: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_DEFINITION_DIGEST_DOMAIN,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_CONTRACT_ENGINE: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_CONTRACT_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_VERIFIER_ENGINE: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_VERIFIER_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_ASSERTIONS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_ASSERTIONS,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_DEFINITION_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_SEGMENTS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_SEGMENTS,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_CONFIG_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_CONFIG_BYTES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_REGISTRY_ENTRIES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_REGISTRY_ENTRIES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_TRUSTED_KEY_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_TRUSTED_KEY_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CERTIFICATE_CLOSURE_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_METADATA_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_METADATA_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_TOTAL_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_VERIFICATION_RECEIPT_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_VERIFICATION_RECEIPT_VERSION,
   RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION: () => RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION,
   RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS: () => RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS,
-  RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION: () => RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
+  RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION: () => import_receipts.RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
   RIDDLE_PROOF_ORDERED_TRACE_OPERATORS: () => RIDDLE_PROOF_ORDERED_TRACE_OPERATORS,
   RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION: () => RIDDLE_PROOF_PLAYABILITY_ASSESSMENT_VERSION,
   RIDDLE_PROOF_PLAYABILITY_VERSION: () => RIDDLE_PROOF_PLAYABILITY_VERSION,
@@ -3442,13 +3475,15 @@ __export(index_exports, {
   RIDDLE_PROOF_PR_COMMENT_MARKER: () => RIDDLE_PROOF_PR_COMMENT_MARKER,
   RIDDLE_PROOF_RUN_CARD_VERSION: () => RIDDLE_PROOF_RUN_CARD_VERSION,
   RIDDLE_PROOF_RUN_STATE_VERSION: () => RIDDLE_PROOF_RUN_STATE_VERSION,
-  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES: () => RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES,
-  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION: () => RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
-  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION: () => RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_BUNDLE_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_SIGNED_CAPTURE_BUNDLE_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_SIGNATURE_DOMAIN: () => import_grounded_evidence.RIDDLE_PROOF_SIGNED_CAPTURE_SIGNATURE_DOMAIN,
   RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION: () => RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION,
   RIDDLE_PROOF_VISUAL_SESSION_VERSION: () => RIDDLE_PROOF_VISUAL_SESSION_VERSION,
-  RIDDLE_UNSUBMITTED_WAKE_HINT: () => RIDDLE_UNSUBMITTED_WAKE_HINT,
-  RiddleApiError: () => RiddleApiError,
+  RIDDLE_UNSUBMITTED_WAKE_HINT: () => import_client.RIDDLE_UNSUBMITTED_WAKE_HINT,
+  RiddleApiError: () => import_client.RiddleApiError,
   appendCaptureDiagnostic: () => appendCaptureDiagnostic,
   appendRunEvent: () => appendRunEvent,
   appendStageHeartbeat: () => appendStageHeartbeat,
@@ -3462,6 +3497,7 @@ __export(index_exports, {
   assessBasicGameplayRoute: () => assessBasicGameplayRoute,
   assessPlayabilityEvidence: () => assessPlayabilityEvidence,
   assessRiddleProofChange: () => assessRiddleProofChange,
+  assessRiddleProofCheckedMeaningClosure: () => import_checked_meaning.assessRiddleProofCheckedMeaningClosure,
   assessRiddleProofOrderedTrace: () => assessRiddleProofOrderedTrace,
   assessRiddleProofOrderedTraceSetupResults: () => assessRiddleProofOrderedTraceSetupResults,
   assessRiddleProofProfileArtifactCompleteness: () => assessRiddleProofProfileArtifactCompleteness,
@@ -3480,14 +3516,16 @@ __export(index_exports, {
   checkpointPacketIdentity: () => checkpointPacketIdentity,
   checkpointResponseIdentity: () => checkpointResponseIdentity,
   checkpointSummaryFromState: () => checkpointSummaryFromState,
-  collectRiddlePreviewDeployWarnings: () => collectRiddlePreviewDeployWarnings,
+  collectRiddlePreviewDeployWarnings: () => import_client.collectRiddlePreviewDeployWarnings,
   collectRiddleProfileArtifactRefs: () => collectRiddleProfileArtifactRefs,
   collectRiddleProofProfileWarnings: () => collectRiddleProofProfileWarnings,
   compactBasicGameplayText: () => compactBasicGameplayText,
   compactRecord: () => compactRecord,
   compareVisualProofSessionFingerprint: () => compareVisualProofSessionFingerprint,
-  composeRiddleProofSemanticCertificateClosures: () => composeRiddleProofSemanticCertificateClosures,
-  composeRiddleProofSemanticCertificates: () => composeRiddleProofSemanticCertificates,
+  composeRiddleProofCheckedMeaningClosures: () => import_checked_meaning.composeRiddleProofCheckedMeaningClosures,
+  composeRiddleProofGroundedSemanticCertificateClosures: () => import_grounded_evidence.composeRiddleProofGroundedSemanticCertificateClosures,
+  composeRiddleProofSemanticCertificateClosures: () => import_semantic_certificate.composeRiddleProofSemanticCertificateClosures,
+  composeRiddleProofSemanticCertificates: () => import_semantic_certificate.composeRiddleProofSemanticCertificates,
   createBasicGameplayCatchRecords: () => createBasicGameplayCatchRecords,
   createBasicGameplayCatchSummary: () => createBasicGameplayCatchSummary,
   createCaptureDiagnostic: () => createCaptureDiagnostic,
@@ -3497,35 +3535,45 @@ __export(index_exports, {
   createDisabledRiddleProofAgentAdapter: () => createDisabledRiddleProofAgentAdapter,
   createLocalAgentAdapter: () => createCodexExecAgentAdapter,
   createLocalAgentJsonRunner: () => createCodexExecJsonRunner,
-  createRiddleApiClient: () => createRiddleApiClient,
+  createRiddleApiClient: () => import_client.createRiddleApiClient,
   createRiddleProofChangeReceipt: () => createRiddleProofChangeReceipt,
+  createRiddleProofCheckedMeaningAtomicClosure: () => import_checked_meaning.createRiddleProofCheckedMeaningAtomicClosure,
+  createRiddleProofCheckedMeaningRule: () => import_checked_meaning.createRiddleProofCheckedMeaningRule,
+  createRiddleProofGroundedDeclarativeJsonContract: () => import_grounded_evidence.createRiddleProofGroundedDeclarativeJsonContract,
+  createRiddleProofGroundedDeclarativeJsonVerifier: () => import_grounded_evidence.createRiddleProofGroundedDeclarativeJsonVerifier,
+  createRiddleProofGroundedSemanticAtomicCertificateClosure: () => import_grounded_evidence.createRiddleProofGroundedSemanticAtomicCertificateClosure,
+  createRiddleProofGroundedSemanticCertificate: () => import_grounded_evidence.createRiddleProofGroundedSemanticCertificate,
   createRiddleProofHandoffReceipt: () => createRiddleProofHandoffReceipt,
-  createRiddleProofObservationReceipt: () => createRiddleProofObservationReceipt,
+  createRiddleProofObservationReceipt: () => import_receipts.createRiddleProofObservationReceipt,
   createRiddleProofProfileConfigurationError: () => createRiddleProofProfileConfigurationError,
   createRiddleProofProfileEnvironmentBlockedResult: () => createRiddleProofProfileEnvironmentBlockedResult,
   createRiddleProofProfileInsufficientResult: () => createRiddleProofProfileInsufficientResult,
   createRiddleProofRunCard: () => createRiddleProofRunCard,
-  createRiddleProofSemanticAtomicCertificateClosure: () => createRiddleProofSemanticAtomicCertificateClosure,
-  createRiddleProofSemanticCertificate: () => createRiddleProofSemanticCertificate,
+  createRiddleProofSemanticAtomicCertificateClosure: () => import_semantic_certificate.createRiddleProofSemanticAtomicCertificateClosure,
+  createRiddleProofSemanticCertificate: () => import_semantic_certificate.createRiddleProofSemanticCertificate,
+  createRiddleProofSignedCaptureBundle: () => import_grounded_evidence.createRiddleProofSignedCaptureBundle,
   createRunResult: () => createRunResult,
   createRunState: () => createRunState,
   createRunStatusSnapshot: () => createRunStatusSnapshot,
-  deployRiddlePreview: () => deployRiddlePreview,
-  deployRiddleStaticPreview: () => deployRiddleStaticPreview,
+  deployRiddlePreview: () => import_client.deployRiddlePreview,
+  deployRiddleStaticPreview: () => import_client.deployRiddleStaticPreview,
   deriveRiddleProofArtifactBodyAssertions: () => deriveRiddleProofArtifactBodyAssertions,
-  detectRiddlePreviewSource: () => detectRiddlePreviewSource,
+  detectRiddlePreviewSource: () => import_client.detectRiddlePreviewSource,
   extractBasicGameplayEvidence: () => extractBasicGameplayEvidence,
   extractPlayabilityEvidence: () => extractPlayabilityEvidence,
   extractRiddleProofProfileResult: () => extractRiddleProofProfileResult,
-  getRiddleBalance: () => getRiddleBalance,
+  getRiddleBalance: () => import_client.getRiddleBalance,
+  getRiddleJobArtifacts: () => import_client.getRiddleJobArtifacts,
   isDuplicateCheckpointResponse: () => isDuplicateCheckpointResponse,
   isProtectedFinalStatus: () => isProtectedFinalStatus,
   isRiddleProofPlayabilityMode: () => isRiddleProofPlayabilityMode,
   isSuccessfulStatus: () => isSuccessfulStatus,
-  isTerminalRiddleJobStatus: () => isTerminalRiddleJobStatus,
+  isTerminalRiddleJobStatus: () => import_client.isTerminalRiddleJobStatus,
   isTerminalStatus: () => isTerminalStatus,
-  matchRiddleProofSemanticCertificate: () => matchRiddleProofSemanticCertificate,
-  matchRiddleProofSemanticCertificateClosure: () => matchRiddleProofSemanticCertificateClosure,
+  matchRiddleProofCheckedMeaningClosure: () => import_checked_meaning.matchRiddleProofCheckedMeaningClosure,
+  matchRiddleProofGroundedSemanticCertificateClosure: () => import_grounded_evidence.matchRiddleProofGroundedSemanticCertificateClosure,
+  matchRiddleProofSemanticCertificate: () => import_semantic_certificate.matchRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificateClosure: () => import_semantic_certificate.matchRiddleProofSemanticCertificateClosure,
   migrateRiddleProofChangeReceipt: () => migrateRiddleProofChangeReceipt,
   nonEmptyString: () => nonEmptyString,
   normalizeCheckpointResponse: () => normalizeCheckpointResponse,
@@ -3534,14 +3582,14 @@ __export(index_exports, {
   normalizeRiddleProofProfile: () => normalizeRiddleProofProfile,
   normalizeRunParams: () => normalizeRunParams,
   normalizeTerminalMetadata: () => normalizeTerminalMetadata,
-  parseRiddlePreviewReceipt: () => parseRiddlePreviewReceipt,
+  parseRiddlePreviewReceipt: () => import_receipts.parseRiddlePreviewReceipt,
   parseRiddleProofChangeReceipt: () => parseRiddleProofChangeReceipt,
   parseRiddleProofHandoffReceipt: () => parseRiddleProofHandoffReceipt,
-  parseRiddleProofObservationReceipt: () => parseRiddleProofObservationReceipt,
-  parseRiddleProofSemanticCertificate: () => parseRiddleProofSemanticCertificate,
-  parseRiddleViewport: () => parseRiddleViewport,
+  parseRiddleProofObservationReceipt: () => import_receipts.parseRiddleProofObservationReceipt,
+  parseRiddleProofSemanticCertificate: () => import_semantic_certificate.parseRiddleProofSemanticCertificate,
+  parseRiddleViewport: () => import_client.parseRiddleViewport,
   parseVisualProofSession: () => parseVisualProofSession,
-  pollRiddleJob: () => pollRiddleJob,
+  pollRiddleJob: () => import_client.pollRiddleJob,
   preflightRiddleProofProfileHttpStatusChecks: () => preflightRiddleProofProfileHttpStatusChecks,
   preflightRiddleProofProfileRunnerArtifacts: () => preflightRiddleProofProfileRunnerArtifacts,
   profileStatusExitCode: () => profileStatusExitCode,
@@ -3551,9 +3599,11 @@ __export(index_exports, {
   readRiddleProofRunStatus: () => readRiddleProofRunStatus,
   recordValue: () => recordValue,
   redactForProofDiagnostics: () => redactForProofDiagnostics,
+  replayRiddleProofCheckedMeaningClosure: () => import_checked_meaning.replayRiddleProofCheckedMeaningClosure,
+  replayRiddleProofGroundedSemanticCertificate: () => import_grounded_evidence.replayRiddleProofGroundedSemanticCertificate,
   resolveBasicGameplayProgressionCheckWithArtifactScreenshots: () => resolveBasicGameplayProgressionCheckWithArtifactScreenshots,
-  resolveRiddleApiKey: () => resolveRiddleApiKey,
-  resolveRiddleApiKeySource: () => resolveRiddleApiKeySource,
+  resolveRiddleApiKey: () => import_client.resolveRiddleApiKey,
+  resolveRiddleApiKeySource: () => import_client.resolveRiddleApiKeySource,
   resolveRiddleProofProfileRouteUrl: () => resolveRiddleProofProfileRouteUrl,
   resolveRiddleProofProfileTargetUrl: () => resolveRiddleProofProfileTargetUrl,
   resolveRiddleProofProfileTimeoutSec: () => resolveRiddleProofProfileTimeoutSec,
@@ -3562,14 +3612,14 @@ __export(index_exports, {
   riddleProofPublicStateAllowsClaim: () => riddleProofPublicStateAllowsClaim,
   riddleProofPublicStateAllowsMergeRecommendation: () => riddleProofPublicStateAllowsMergeRecommendation,
   riddleProofPublicStateMergeRecommendation: () => riddleProofPublicStateMergeRecommendation,
-  riddleProofSemanticScopesEqual: () => riddleProofSemanticScopesEqual,
-  riddleRequestJson: () => riddleRequestJson,
+  riddleProofSemanticScopesEqual: () => import_semantic_certificate.riddleProofSemanticScopesEqual,
+  riddleRequestJson: () => import_client.riddleRequestJson,
   runCodexExecAgentDoctor: () => runCodexExecAgentDoctor,
   runLocalAgentDoctor: () => runCodexExecAgentDoctor,
   runRiddleProof: () => runRiddleProof,
   runRiddleProofEngineHarness: () => runRiddleProofEngineHarness,
-  runRiddleScript: () => runRiddleScript,
-  runRiddleServerPreview: () => runRiddleServerPreview,
+  runRiddleScript: () => import_client.runRiddleScript,
+  runRiddleServerPreview: () => import_client.runRiddleServerPreview,
   sanitizeBasicGameplayJsonString: () => sanitizeBasicGameplayJsonString,
   setRunStatus: () => setRunStatus,
   shipControlStateFor: () => shipControlStateFor,
@@ -3583,7 +3633,10 @@ __export(index_exports, {
   summarizeRiddleProofProfileResult: () => summarizeRiddleProofProfileResult,
   summarizeRiddleProofPublicConsumerSurface: () => summarizeRiddleProofPublicConsumerSurface,
   summarizeRiddleProofPublicState: () => summarizeRiddleProofPublicState,
-  validateRiddleProofSemanticCertificateClosure: () => validateRiddleProofSemanticCertificateClosure,
+  validateRiddleProofCheckedMeaningClosure: () => import_checked_meaning.validateRiddleProofCheckedMeaningClosure,
+  validateRiddleProofGroundedSemanticCertificateClosure: () => import_grounded_evidence.validateRiddleProofGroundedSemanticCertificateClosure,
+  validateRiddleProofSemanticCertificateClosure: () => import_semantic_certificate.validateRiddleProofSemanticCertificateClosure,
+  verifyRiddleProofSignedCaptureBundle: () => import_grounded_evidence.verifyRiddleProofSignedCaptureBundle,
   visualSessionFingerprint: () => visualSessionFingerprint,
   visualSessionFingerprintBasis: () => visualSessionFingerprintBasis
 });
@@ -10522,8 +10575,8 @@ function jsonContains(observed, expected) {
   }
   return false;
 }
-function parseJsonPathSegments(path6) {
-  let input = path6.trim();
+function parseJsonPathSegments(path5) {
+  let input = path5.trim();
   if (!input) throw new Error("path is empty");
   if (input === "$") return [];
   if (input.startsWith("$.")) input = input.slice(2);
@@ -10563,10 +10616,10 @@ function parseJsonPathSegments(path6) {
   pushToken();
   return segments;
 }
-function resolveJsonPath(root, path6) {
+function resolveJsonPath(root, path5) {
   let segments;
   try {
-    segments = parseJsonPathSegments(path6);
+    segments = parseJsonPathSegments(path5);
   } catch (error) {
     return { exists: false, error: String(error instanceof Error ? error.message : error) };
   }
@@ -10600,7 +10653,7 @@ function assessRiddleProofOrderedTrace(trace, events) {
     missing_paths: missingPaths,
     reason
   });
-  const parsePath = (path6) => {
+  const parsePath = (path5) => {
     const segments = [];
     let token = "";
     const pushToken = () => {
@@ -10608,8 +10661,8 @@ function assessRiddleProofOrderedTrace(trace, events) {
       if (value) segments.push(value);
       token = "";
     };
-    for (let index = 0; index < path6.length; index += 1) {
-      const char = path6[index];
+    for (let index = 0; index < path5.length; index += 1) {
+      const char = path5[index];
       if (char === ".") {
         pushToken();
         continue;
@@ -10619,9 +10672,9 @@ function assessRiddleProofOrderedTrace(trace, events) {
         continue;
       }
       pushToken();
-      const closeIndex = path6.indexOf("]", index + 1);
+      const closeIndex = path5.indexOf("]", index + 1);
       if (closeIndex === -1) throw new Error(`unterminated bracket at ${index}`);
-      const bracket = path6.slice(index + 1, closeIndex).trim();
+      const bracket = path5.slice(index + 1, closeIndex).trim();
       if (!bracket) throw new Error(`empty bracket at ${index}`);
       if (/^\d+$/.test(bracket)) {
         segments.push(Number(bracket));
@@ -10633,10 +10686,10 @@ function assessRiddleProofOrderedTrace(trace, events) {
     pushToken();
     return segments;
   };
-  const resolve = (root, path6) => {
+  const resolve = (root, path5) => {
     let segments;
     try {
-      segments = parsePath(path6);
+      segments = parsePath(path5);
     } catch {
       return { exists: false };
     }
@@ -10932,15 +10985,15 @@ function profileSetupReturnSummaryFields(result) {
   const fields = [];
   for (const item of input) {
     if (typeof item === "string") {
-      const path7 = item.trim();
-      if (path7) fields.push({ path: path7 });
+      const path6 = item.trim();
+      if (path6) fields.push({ path: path6 });
       continue;
     }
     if (!isRecord2(item)) continue;
-    const path6 = stringValue6(item.path) ?? stringValue6(item.key) ?? stringValue6(item.json_path) ?? stringValue6(item.jsonPath);
-    if (!path6) continue;
+    const path5 = stringValue6(item.path) ?? stringValue6(item.key) ?? stringValue6(item.json_path) ?? stringValue6(item.jsonPath);
+    if (!path5) continue;
     const label = stringValue6(item.label) ?? stringValue6(item.name) ?? stringValue6(item.title);
-    fields.push(label ? { path: path6, label } : { path: path6 });
+    fields.push(label ? { path: path5, label } : { path: path5 });
   }
   return fields;
 }
@@ -11398,17 +11451,17 @@ function normalizeReturnSummaryFields(input, index) {
   }
   return fieldsInput.map((field, fieldIndex) => {
     if (typeof field === "string") {
-      const path7 = field.trim();
-      if (!path7) throw new Error(`target.setup_actions[${index}].return_summary_fields[${fieldIndex}] requires path.`);
-      return { path: path7 };
+      const path6 = field.trim();
+      if (!path6) throw new Error(`target.setup_actions[${index}].return_summary_fields[${fieldIndex}] requires path.`);
+      return { path: path6 };
     }
     if (!isRecord2(field)) {
       throw new Error(`target.setup_actions[${index}].return_summary_fields[${fieldIndex}] must be a string path or object.`);
     }
-    const path6 = stringFromOwn(field, "path", "key", "json_path", "jsonPath");
-    if (!path6) throw new Error(`target.setup_actions[${index}].return_summary_fields[${fieldIndex}] requires path.`);
+    const path5 = stringFromOwn(field, "path", "key", "json_path", "jsonPath");
+    if (!path5) throw new Error(`target.setup_actions[${index}].return_summary_fields[${fieldIndex}] requires path.`);
     const label = stringFromOwn(field, "label", "name", "title");
-    return label ? { path: path6, label } : { path: path6 };
+    return label ? { path: path5, label } : { path: path5 };
   });
 }
 function normalizeSetupActionRepeat(input, index) {
@@ -11623,8 +11676,8 @@ function normalizeSetupAction(input, index) {
   if ((type === "local_storage" || type === "session_storage") && value === void 0 && !hasJsonValue) {
     throw new Error(`target.setup_actions[${index}] ${type} requires value.`);
   }
-  const path6 = stringFromOwn(input, "path", "function_path", "functionPath", "window_path", "windowPath", "state_path", "statePath");
-  if ((type === "window_call" || type === "window_call_until" || type === "assert_window_value" || type === "assert_window_number") && !path6) {
+  const path5 = stringFromOwn(input, "path", "function_path", "functionPath", "window_path", "windowPath", "state_path", "statePath");
+  if ((type === "window_call" || type === "window_call_until" || type === "assert_window_value" || type === "assert_window_number") && !path5) {
     throw new Error(`target.setup_actions[${index}] ${type} requires path.`);
   }
   const script = stringFromOwn(input, "script", "code", "source", "body");
@@ -11722,7 +11775,7 @@ function normalizeSetupAction(input, index) {
     restore: deterministicRestore || void 0,
     label: stringFromOwn(input, "label", "name", "screenshot_label", "screenshotLabel"),
     script,
-    path: path6,
+    path: path5,
     args,
     expect_return: hasExpectedReturn ? toJsonValue(valueFromOwn(input, "expect_return", "expectReturn", "expected_return", "expectedReturn")) : void 0,
     store_return_to: storeReturnTo,
@@ -12048,10 +12101,10 @@ function collectRiddleProofProfileEnvironmentBlockedWarnings(profile, blocker) {
   return warnings;
 }
 function normalizeRouteInventoryPath(value, label) {
-  const path6 = stringValue6(value);
-  if (!path6) throw new Error(`${label} requires path.`);
-  if (!path6.startsWith("/")) throw new Error(`${label}.path must start with /.`);
-  return normalizeRoutePath2(path6);
+  const path5 = stringValue6(value);
+  if (!path5) throw new Error(`${label} requires path.`);
+  if (!path5.startsWith("/")) throw new Error(`${label}.path must start with /.`);
+  return normalizeRoutePath2(path5);
 }
 function normalizeRouteInventoryRoute(input, index) {
   if (typeof input === "string") return { path: normalizeRouteInventoryPath(input, `checks route_inventory expected_routes[${index}]`) };
@@ -12130,16 +12183,16 @@ function normalizeHttpStatusBodyJsonAssertions(value, label) {
   return value.map((item, index) => {
     const itemLabel = `${label}[${index}]`;
     if (typeof item === "string") {
-      const path7 = stringValue6(item);
-      if (!path7) throw new Error(`${itemLabel} path must not be empty.`);
-      return { path: path7, exists: true };
+      const path6 = stringValue6(item);
+      if (!path6) throw new Error(`${itemLabel} path must not be empty.`);
+      return { path: path6, exists: true };
     }
     if (!isRecord2(item)) throw new Error(`${itemLabel} must be an object or JSON path string.`);
-    const path6 = stringFromOwn(item, "path", "json_path", "jsonPath", "key");
-    if (!path6) throw new Error(`${itemLabel}.path is required.`);
+    const path5 = stringFromOwn(item, "path", "json_path", "jsonPath", "key");
+    if (!path5) throw new Error(`${itemLabel}.path is required.`);
     const assertion = {
       label: stringValue6(item.label),
-      path: path6
+      path: path5
     };
     const exists = booleanValue2(valueFromOwn(item, "exists", "present"));
     if (exists !== void 0) assertion.exists = exists;
@@ -12189,8 +12242,8 @@ function normalizeOrderedTraceEvents(value, label) {
     const predicates = predicatesInput.map((predicateInput, predicateIndex) => {
       const predicateLabel = `${eventLabel}.predicates[${predicateIndex}]`;
       if (!isRecord2(predicateInput)) throw new Error(`${predicateLabel} must be an object.`);
-      const path6 = stringFromOwn(predicateInput, "path", "field", "key");
-      if (!path6) throw new Error(`${predicateLabel}.path is required.`);
+      const path5 = stringFromOwn(predicateInput, "path", "field", "key");
+      if (!path5) throw new Error(`${predicateLabel}.path is required.`);
       const op = stringFromOwn(predicateInput, "op", "operator");
       if (!op || !RIDDLE_PROOF_ORDERED_TRACE_OPERATORS.includes(op)) {
         throw new Error(`${predicateLabel}.op must be one of ${RIDDLE_PROOF_ORDERED_TRACE_OPERATORS.join(", ")}.`);
@@ -12208,7 +12261,7 @@ function normalizeOrderedTraceEvents(value, label) {
         }
       }
       return {
-        path: path6,
+        path: path5,
         op,
         value: requiresValue ? toJsonValue(value2) : void 0
       };
@@ -12976,7 +13029,7 @@ function summarizeRouteInventory(viewport, inventory) {
   const sourceCandidateCount = numberValue4(inventory.source_candidate_count);
   const sourceCandidateUniqueLinkCount = numberValue4(inventory.source_candidate_unique_link_count);
   const sourceLinkScope = stringValue6(inventory.source_link_scope);
-  const duplicateSourceLinks = Array.isArray(inventory.duplicate_source_link_paths) ? inventory.duplicate_source_link_paths.map((path6) => String(path6)) : [];
+  const duplicateSourceLinks = Array.isArray(inventory.duplicate_source_link_paths) ? inventory.duplicate_source_link_paths.map((path5) => String(path5)) : [];
   const duplicateSourceLinkCount = numberValue4(inventory.duplicate_source_link_count) ?? (sourceLinkCount !== null && sourceUniqueLinkCount !== null ? Math.max(0, sourceLinkCount - sourceUniqueLinkCount) : null);
   const failures = Array.isArray(inventory.failures) ? inventory.failures : [];
   return {
@@ -12997,14 +13050,14 @@ function routeInventoryExpectedRouteSummaries(value, fallback) {
   const rawRoutes = Array.isArray(value) ? value : Array.isArray(fallback) ? fallback : [];
   return rawRoutes.map((route) => {
     if (typeof route === "string") {
-      const path7 = route.trim();
-      return path7 ? { path: path7 } : void 0;
+      const path6 = route.trim();
+      return path6 ? { path: path6 } : void 0;
     }
     if (!isRecord2(route)) return void 0;
-    const path6 = stringValue6(route.path);
-    if (!path6) return void 0;
+    const path5 = stringValue6(route.path);
+    if (!path5) return void 0;
     const name = stringValue6(route.name);
-    return name ? { name, path: path6 } : { path: path6 };
+    return name ? { name, path: path5 } : { path: path5 };
   }).filter((route) => Boolean(route));
 }
 function matchText(sample, check) {
@@ -13141,8 +13194,8 @@ function expectedFailedNetworkMockConsoleEventSummary(event, evidence) {
     text: isRecord2(event) && typeof event.text === "string" ? event.text.slice(0, 300) : sample.slice(0, 300)
   };
 }
-function normalizeRoutePath2(path6) {
-  const value = path6 || "/";
+function normalizeRoutePath2(path5) {
+  const value = path5 || "/";
   if (value === "/") return "/";
   return value.replace(/\/+$/, "") || "/";
 }
@@ -13708,7 +13761,7 @@ function assessCheckFromEvidence(check, evidence) {
     const sourceCandidateCount = numberValue4(first?.source_candidate_count);
     const sourceCandidateUniqueLinkCount = numberValue4(first?.source_candidate_unique_link_count);
     const sourceLinkScope = stringValue6(first?.source_link_scope);
-    const duplicateSourceLinks = Array.isArray(first?.duplicate_source_link_paths) ? first.duplicate_source_link_paths.map((path6) => String(path6)) : [];
+    const duplicateSourceLinks = Array.isArray(first?.duplicate_source_link_paths) ? first.duplicate_source_link_paths.map((path5) => String(path5)) : [];
     const duplicateSourceLinkCount = numberValue4(first?.duplicate_source_link_count) ?? (sourceLinkCount !== null && sourceUniqueLinkCount !== null ? Math.max(0, sourceLinkCount - sourceUniqueLinkCount) : null);
     const expectedRoutes = routeInventoryExpectedRouteSummaries(first?.expected_routes, check.expected_routes);
     return {
@@ -20072,16 +20125,16 @@ function collectRiddleProfileArtifactRefs(input) {
   function add(item, source) {
     if (!isRecord2(item)) return;
     const url = stringValue6(item.url);
-    const path6 = stringValue6(item.path);
-    const rawName = stringValue6(item.name) || stringValue6(item.filename) || artifactNameFromPath(url || path6) || "";
+    const path5 = stringValue6(item.path);
+    const rawName = stringValue6(item.name) || stringValue6(item.filename) || artifactNameFromPath(url || path5) || "";
     const name = normalizeRiddleProfileArtifactName(rawName);
-    if (!name && !url && !path6) return;
-    const key = profileArtifactDedupeKey(name, url || path6 || "");
+    if (!name && !url && !path5) return;
+    const key = profileArtifactDedupeKey(name, url || path5 || "");
     const priority = profileArtifactPriority(rawName, name);
     const ref = {
       name,
       url,
-      path: path6,
+      path: path5,
       kind: stringValue6(item.kind) || stringValue6(item.type),
       content_type: stringValue6(item.content_type) || stringValue6(item.contentType),
       source
@@ -20328,1327 +20381,111 @@ function suggestRiddleProofProfileChecks(input) {
 }
 
 // src/receipts.ts
-var RIDDLE_PREVIEW_RECEIPT_VERSION = "riddle.preview-receipt.v1";
-var RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION = "riddle-proof.observation-receipt.v1";
-function isRecord3(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function requiredString(record, key, context) {
-  const value = record[key];
-  if (typeof value !== "string" || !value.trim()) {
-    throw new Error(`${context}.${key} must be a non-empty string.`);
-  }
-  return value.trim();
-}
-function normalizedSourceIdentity(value) {
-  if (!isRecord3(value)) return {};
-  return {
-    git_revision: typeof value.git_revision === "string" && value.git_revision.trim() ? value.git_revision.trim() : void 0,
-    repository: typeof value.repository === "string" && value.repository.trim() ? value.repository.trim() : void 0,
-    dirty: typeof value.dirty === "boolean" ? value.dirty : void 0,
-    label: typeof value.label === "string" && value.label.trim() ? value.label.trim() : void 0
-  };
-}
-function parseRiddlePreviewReceipt(value) {
-  if (!isRecord3(value)) throw new Error("Preview receipt must be an object.");
-  if (value.version !== RIDDLE_PREVIEW_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Preview receipt version ${String(value.version || "missing")}.`);
-  }
-  if (!isRecord3(value.source)) throw new Error("Preview receipt source must be an object.");
-  const expiresAt = requiredString(value, "expires_at", "preview receipt");
-  const publishedAt = requiredString(value, "published_at", "preview receipt");
-  const contentDigest = requiredString(value, "content_digest", "preview receipt");
-  if (!contentDigest.startsWith("sha256:") || contentDigest.length <= "sha256:".length) {
-    throw new Error("preview receipt.content_digest must be a sha256 digest.");
-  }
-  if (!Number.isFinite(Date.parse(expiresAt)) || !Number.isFinite(Date.parse(publishedAt))) {
-    throw new Error("Preview receipt timestamps must be valid ISO date strings.");
-  }
-  return {
-    version: RIDDLE_PREVIEW_RECEIPT_VERSION,
-    preview_id: requiredString(value, "preview_id", "preview receipt"),
-    url: requiredString(value, "url", "preview receipt"),
-    expires_at: expiresAt,
-    content_digest: contentDigest,
-    source: normalizedSourceIdentity(value.source),
-    published_at: publishedAt
-  };
-}
-function comparableArtifactName(value) {
-  return (value || "").split(/[/?#]/).pop()?.toLowerCase().replace(/\.(png|jpe?g|gif|webp|avif|svg)$/u, "").replace(/[^a-z0-9_-]+/gu, "-").replace(/^-+|-+$/g, "") || "";
-}
-function artifactMatchesLabel(artifact, label) {
-  const expected = comparableArtifactName(label);
-  if (!expected) return false;
-  return [artifact.name, artifact.url, artifact.path].map(comparableArtifactName).some((name) => name === expected || name.endsWith(`-${expected}`));
-}
-function artifactLooksLikeScreenshot(ref) {
-  const text = [ref.name, ref.url, ref.path, ref.kind, ref.content_type].filter(Boolean).join(" ").toLowerCase();
-  return /screenshot|\bimage\b/.test(text) || /\.(png|jpe?g|gif|webp|avif|svg)(\?|#|$)/.test(text);
-}
-function finalScreenshotLabels(result) {
-  const explicit = result.artifacts.canonical_screenshots || [];
-  if (explicit.length) return explicit;
-  const fromEvidence = (result.evidence?.viewports || []).map((viewport) => viewport.screenshot_label).filter((label) => typeof label === "string" && Boolean(label.trim()));
-  if (fromEvidence.length) return fromEvidence;
-  return (result.artifacts.screenshots || []).slice(0, 1);
-}
-function setupScreenshotLabels(result) {
-  const explicit = result.artifacts.setup_screenshots || [];
-  if (explicit.length) return explicit;
-  return (result.evidence?.viewports || []).flatMap(
-    (viewport) => (viewport.setup_action_results || []).filter((action) => action.action === "screenshot" && action.ok !== false && typeof action.screenshot_label === "string").map((action) => String(action.screenshot_label))
-  );
-}
-function observationArtifactFromRef(ref, canonicalLabels, setupLabels) {
-  const base = {
-    name: ref.name,
-    role: ref.role || "artifact",
-    url: ref.url,
-    path: ref.path,
-    kind: ref.kind,
-    content_type: ref.content_type,
-    source: ref.source
-  };
-  if (!artifactLooksLikeScreenshot(ref)) return base;
-  if (canonicalLabels.some((label) => artifactMatchesLabel(base, label))) {
-    return { ...base, role: "canonical_screenshot" };
-  }
-  if (setupLabels.some((label) => artifactMatchesLabel(base, label))) {
-    return { ...base, role: "setup_screenshot" };
-  }
-  return { ...base, role: "diagnostic" };
-}
-function profileObservationArtifacts(result) {
-  const canonicalLabels = finalScreenshotLabels(result);
-  const setupLabels = setupScreenshotLabels(result);
-  const artifacts = [];
-  const seen = /* @__PURE__ */ new Set();
-  const add = (artifact) => {
-    const key = artifact.url || artifact.path || `${artifact.role}:${artifact.name}`;
-    if (!artifact.name || seen.has(key)) return;
-    seen.add(key);
-    artifacts.push(artifact);
-  };
-  for (const ref of result.artifacts.riddle_artifacts || []) {
-    add(observationArtifactFromRef(ref, canonicalLabels, setupLabels));
-  }
-  for (const label of canonicalLabels) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "canonical_screenshot", kind: "image" });
-    }
-  }
-  for (const label of setupLabels) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "setup_screenshot", kind: "image" });
-    }
-  }
-  for (const label of result.artifacts.screenshots || []) {
-    if (!artifacts.some((artifact) => artifactMatchesLabel(artifact, label))) {
-      add({ name: label, path: label, role: "diagnostic", kind: "image" });
-    }
-  }
-  return artifacts;
-}
-function mergeObservationArtifacts(profileArtifacts, suppliedArtifacts) {
-  const artifacts = [...profileArtifacts];
-  for (const supplied of suppliedArtifacts) {
-    const suppliedNames = [supplied.name, supplied.url, supplied.path].map(comparableArtifactName).filter(Boolean);
-    const existingIndex = artifacts.findIndex((artifact) => {
-      if (supplied.url && artifact.url === supplied.url) return true;
-      if (supplied.path && artifact.path === supplied.path) return true;
-      return [artifact.name, artifact.url, artifact.path].map(comparableArtifactName).some((name) => name && suppliedNames.includes(name));
-    });
-    if (existingIndex < 0) {
-      artifacts.push(supplied);
-      continue;
-    }
-    const existing = artifacts[existingIndex];
-    const role = supplied.role === "canonical_screenshot" || supplied.role === "setup_screenshot" ? supplied.role : existing.role === "canonical_screenshot" || existing.role === "setup_screenshot" ? existing.role : supplied.role === "artifact" ? existing.role : supplied.role;
-    artifacts[existingIndex] = {
-      ...existing,
-      ...supplied,
-      role
-    };
-  }
-  return artifacts;
-}
-function defaultObservationId(role, capturedAt) {
-  return `obs_${role}_${capturedAt.replace(/[^0-9]/g, "").slice(0, 17) || "unknown"}`;
-}
-function profileCheckCounts(result) {
-  const counts = { total: result.checks.length, passed: 0, failed: 0, skipped: 0, needs_human_review: 0 };
-  for (const check of result.checks) {
-    if (check.status === "passed") counts.passed += 1;
-    if (check.status === "failed") counts.failed += 1;
-    if (check.status === "skipped") counts.skipped += 1;
-    if (check.status === "needs_human_review") counts.needs_human_review += 1;
-  }
-  return counts;
-}
-function createRiddleProofObservationReceipt(input) {
-  const capturedAt = input.captured_at || input.profile_result?.captured_at || (/* @__PURE__ */ new Date()).toISOString();
-  const profileArtifacts = input.profile_result ? profileObservationArtifacts(input.profile_result) : [];
-  const requestedCanonical = input.canonical_screenshot ? { ...input.canonical_screenshot, role: "canonical_screenshot" } : void 0;
-  const artifacts = mergeObservationArtifacts(
-    profileArtifacts,
-    [...input.artifacts || [], ...requestedCanonical ? [requestedCanonical] : []]
-  );
-  const canonicalScreenshot = requestedCanonical ? artifacts.find((artifact) => artifact.role === "canonical_screenshot" && artifactMatchesLabel(artifact, requestedCanonical.name)) || requestedCanonical : artifacts.find((artifact) => artifact.role === "canonical_screenshot");
-  const target = input.target.kind === "preview" && input.target.preview ? { ...input.target, preview: parseRiddlePreviewReceipt(input.target.preview) } : input.target;
-  return {
-    version: RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
-    observation_id: input.observation_id || defaultObservationId(input.comparison_role, capturedAt),
-    comparison_role: input.comparison_role,
-    executor: input.executor,
-    target,
-    source: normalizedSourceIdentity(input.source || input.target.preview?.source),
-    captured_at: capturedAt,
-    artifacts,
-    canonical_screenshot: canonicalScreenshot,
-    profile_summary: input.profile_result ? {
-      profile_name: input.profile_result.profile_name,
-      status: input.profile_result.status,
-      summary: input.profile_result.summary,
-      route: input.profile_result.route,
-      checks: profileCheckCounts(input.profile_result)
-    } : void 0,
-    proof: input.profile_result ? {
-      profile_name: input.profile_result.profile_name,
-      result: input.profile_result
-    } : void 0,
-    publication: input.publication,
-    execution: input.execution,
-    metadata: input.metadata
-  };
-}
-function parseRiddleProofObservationReceipt(value) {
-  if (!isRecord3(value)) throw new Error("Observation receipt must be an object.");
-  if (value.version !== RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Observation receipt version ${String(value.version || "missing")}.`);
-  }
-  if (!isRecord3(value.executor)) throw new Error("Observation receipt executor must be an object.");
-  if (!isRecord3(value.target)) throw new Error("Observation receipt target must be an object.");
-  if (!isRecord3(value.source)) throw new Error("Observation receipt source must be an object.");
-  requiredString(value, "observation_id", "observation receipt");
-  requiredString(value, "captured_at", "observation receipt");
-  const executorKind = requiredString(value.executor, "kind", "observation receipt executor");
-  if (!"local_playwright,riddle_hosted,browser_api,other".split(",").includes(executorKind)) {
-    throw new Error(`Unsupported observation executor kind ${executorKind}.`);
-  }
-  if (value.executor.runner !== void 0) {
-    requiredString(value.executor, "runner", "observation receipt executor");
-  }
-  const role = requiredString(value, "comparison_role", "observation receipt");
-  if (!["before", "after", "standalone"].includes(role)) {
-    throw new Error(`Unsupported observation comparison role ${role}.`);
-  }
-  const targetKind = requiredString(value.target, "kind", "observation receipt target");
-  if (targetKind !== "url" && targetKind !== "preview") {
-    throw new Error(`Unsupported observation target kind ${targetKind}.`);
-  }
-  requiredString(value.target, "url", "observation receipt target");
-  if (targetKind === "preview") {
-    if (value.target.preview === void 0) {
-      throw new Error("Preview Observation target must include its Preview receipt.");
-    }
-    parseRiddlePreviewReceipt(value.target.preview);
-  }
-  if (!Array.isArray(value.artifacts)) throw new Error("Observation receipt artifacts must be an array.");
-  const artifactRoles = /* @__PURE__ */ new Set(["canonical_screenshot", "setup_screenshot", "data", "diagnostic", "artifact"]);
-  const artifacts = value.artifacts.map((artifact, index) => {
-    if (!isRecord3(artifact)) throw new Error(`Observation receipt artifact ${index} must be an object.`);
-    requiredString(artifact, "name", `observation receipt artifact ${index}`);
-    const artifactRole = requiredString(artifact, "role", `observation receipt artifact ${index}`);
-    if (!artifactRoles.has(artifactRole)) {
-      throw new Error(`Unsupported observation artifact role ${artifactRole}.`);
-    }
-    return artifact;
-  });
-  if (value.canonical_screenshot !== void 0) {
-    if (!isRecord3(value.canonical_screenshot) || value.canonical_screenshot.role !== "canonical_screenshot") {
-      throw new Error("Observation canonical_screenshot must have the canonical_screenshot role.");
-    }
-    const canonical = value.canonical_screenshot;
-    const included = artifacts.some((artifact) => artifact.role === "canonical_screenshot" && artifact.name === canonical.name && artifact.url === canonical.url && artifact.path === canonical.path);
-    if (!included) {
-      throw new Error("Observation canonical_screenshot must reference an artifact in the receipt.");
-    }
-  }
-  return value;
-}
-
-// src/semantic-certificate.ts
-var import_node_crypto5 = require("crypto");
-var RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION = "riddle-proof.semantic-certificate.v0";
-var RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION = "riddle-proof.semantic-certificate-closure.v0";
-var RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES = 4096;
-var SCOPE_FIELDS = [
-  "repository",
-  "revision",
-  "environment",
-  "target",
-  "proof_attempt"
-];
-var AUTHORITY_FIELDS = [
-  "authority",
-  "status",
-  "verdict",
-  "ready_to_ship",
-  "merge_ready",
-  "sync_allowed",
-  "ship_authorized",
-  "shipping_authorized",
-  "shipping_disabled",
-  "merge_recommended",
-  "merge_recommendation",
-  "shipping_authorization"
-];
-var CERTIFICATE_FIELDS = /* @__PURE__ */ new Set([
-  "version",
-  "certificate_id",
-  "scope",
-  "claim",
-  "evidence",
-  "derivation",
-  "issued_at"
-]);
-function isRecord4(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function safeErrorMessage(error) {
-  try {
-    if (error instanceof Error) return String(error.message);
-  } catch {
-  }
-  try {
-    return String(error);
-  } catch {
-    return "unprintable thrown value";
-  }
-}
-function assertOnlyKeys(record, allowed, context) {
-  const allowedSet = new Set(allowed);
-  for (const key of Reflect.ownKeys(record)) {
-    if (typeof key !== "string") {
-      throw new Error(`${context} contains an unsupported symbol field.`);
-    }
-    if (!allowedSet.has(key)) {
-      throw new Error(`${context} contains unsupported field ${key}.`);
-    }
-    const descriptor = Object.getOwnPropertyDescriptor(record, key);
-    if (!descriptor || descriptor.enumerable !== true || descriptor.get !== void 0 || descriptor.set !== void 0) {
-      throw new Error(`${context}.${key} must be an enumerable data field.`);
-    }
-  }
-}
-function readDenseDataArray(value, context, maximumLength) {
-  if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
-    throw new Error(`${context} must be a plain array.`);
-  }
-  const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
-  if (!lengthDescriptor || typeof lengthDescriptor.value !== "number" || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0) {
-    throw new Error(`${context}.length must be an own data field.`);
-  }
-  const length = lengthDescriptor.value;
-  if (maximumLength !== void 0 && length > maximumLength) {
-    throw new Error(`${context} exceeds ${maximumLength} entries.`);
-  }
-  const indexedElements = [];
-  let elementCount = 0;
-  for (const key of Reflect.ownKeys(value)) {
-    if (key === "length") continue;
-    if (typeof key !== "string") {
-      throw new Error(`${context} contains an unsupported symbol field.`);
-    }
-    const index = Number(key);
-    if (!Number.isInteger(index) || index < 0 || index >= length || index >= 2 ** 32 - 1 || String(index) !== key) {
-      throw new Error(`${context} contains unsupported array field ${key}.`);
-    }
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    if (!descriptor || descriptor.enumerable !== true || descriptor.get !== void 0 || descriptor.set !== void 0) {
-      throw new Error(`${context}[${key}] must be an enumerable data field.`);
-    }
-    indexedElements.push([index, descriptor.value]);
-    elementCount += 1;
-  }
-  if (elementCount !== length) {
-    throw new Error(`${context} must not contain sparse or inherited entries.`);
-  }
-  indexedElements.sort(([left], [right]) => left - right);
-  return indexedElements.map(([, entry]) => entry);
-}
-function requiredField(record, key, context) {
-  const descriptor = Object.getOwnPropertyDescriptor(record, key);
-  if (!descriptor) {
-    throw new Error(`${context}.${key} is required.`);
-  }
-  if (descriptor.enumerable !== true || descriptor.get !== void 0 || descriptor.set !== void 0) {
-    throw new Error(`${context}.${key} must be an enumerable data field.`);
-  }
-  return descriptor.value;
-}
-function optionalField(record, key) {
-  const descriptor = Object.getOwnPropertyDescriptor(record, key);
-  if (!descriptor) return void 0;
-  if (descriptor.enumerable !== true || descriptor.get !== void 0 || descriptor.set !== void 0) {
-    throw new Error(`${key} must be an enumerable data field.`);
-  }
-  return descriptor.value;
-}
-function requiredString2(record, key, context) {
-  const value = requiredField(record, key, context);
-  if (typeof value !== "string" || !value.trim()) {
-    throw new Error(`${context}.${key} must be a non-empty string.`);
-  }
-  return value.trim();
-}
-function optionalString(record, key, context) {
-  if (optionalField(record, key) === void 0) return void 0;
-  return requiredString2(record, key, context);
-}
-function cloneJsonValue(value, context, ancestors = /* @__PURE__ */ new Set()) {
-  if (value === null || typeof value === "string" || typeof value === "boolean") {
-    return value;
-  }
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error(`${context} must contain only finite numbers.`);
-    return value;
-  }
-  if (Array.isArray(value)) {
-    const elements = readDenseDataArray(value, context);
-    if (ancestors.has(value)) throw new Error(`${context} must not be cyclic.`);
-    ancestors.add(value);
-    const cloned2 = elements.map((entry, index) => cloneJsonValue(entry, `${context}[${index}]`, ancestors));
-    ancestors.delete(value);
-    return cloned2;
-  }
-  if (!isRecord4(value)) throw new Error(`${context} must contain only JSON values.`);
-  if (ancestors.has(value)) throw new Error(`${context} must not be cyclic.`);
-  ancestors.add(value);
-  const cloned = {};
-  for (const key of Reflect.ownKeys(value)) {
-    if (typeof key !== "string") {
-      throw new Error(`${context} contains an unsupported symbol field.`);
-    }
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    if (!descriptor || descriptor.enumerable !== true || descriptor.get !== void 0 || descriptor.set !== void 0) {
-      throw new Error(`${context}.${key} must be an enumerable data field.`);
-    }
-    Object.defineProperty(cloned, key, {
-      value: cloneJsonValue(descriptor.value, `${context}.${key}`, ancestors),
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  }
-  ancestors.delete(value);
-  return cloned;
-}
-function parseJsonObject2(value, context) {
-  if (value === void 0) return void 0;
-  if (!isRecord4(value)) {
-    throw new Error(`${context} must be a JSON object.`);
-  }
-  const cloned = cloneJsonValue(value, context);
-  if (!isRecord4(cloned)) {
-    throw new Error(`${context} must remain a JSON object when serialized.`);
-  }
-  return cloned;
-}
-function parseIssuedAt(value, context) {
-  if (typeof value !== "string" || !value.trim() || !Number.isFinite(Date.parse(value))) {
-    throw new Error(`${context} must be a valid timestamp.`);
-  }
-  return value.trim();
-}
-function parseScope(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(value, SCOPE_FIELDS, context);
-  return {
-    repository: requiredString2(value, "repository", context),
-    revision: requiredString2(value, "revision", context),
-    environment: requiredString2(value, "environment", context),
-    target: requiredString2(value, "target", context),
-    proof_attempt: requiredString2(value, "proof_attempt", context)
-  };
-}
-function parseClaimRef(value, context, allowedExtras = []) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(value, ["claim_id", "claim_version", "parameters", ...allowedExtras], context);
-  const parameters = parseJsonObject2(optionalField(value, "parameters"), `${context}.parameters`);
-  return {
-    claim_id: requiredString2(value, "claim_id", context),
-    claim_version: requiredString2(value, "claim_version", context),
-    ...parameters ? { parameters } : {}
-  };
-}
-function parseClaim(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  return {
-    ...parseClaimRef(value, context, ["label"]),
-    label: requiredString2(value, "label", context)
-  };
-}
-function parseEvidenceRef(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(
-    value,
-    ["receipt_id", "artifact_digest", "role", "artifact_url", "artifact_path"],
-    context
-  );
-  const artifactDigest = requiredString2(value, "artifact_digest", context).toLowerCase();
-  if (!/^sha256:[0-9a-f]{64}$/u.test(artifactDigest)) {
-    throw new Error(`${context}.artifact_digest must be a full sha256 digest.`);
-  }
-  const artifactUrl = optionalString(value, "artifact_url", context);
-  const artifactPath = optionalString(value, "artifact_path", context);
-  return {
-    receipt_id: requiredString2(value, "receipt_id", context),
-    artifact_digest: artifactDigest,
-    role: requiredString2(value, "role", context),
-    ...artifactUrl ? { artifact_url: artifactUrl } : {},
-    ...artifactPath ? { artifact_path: artifactPath } : {}
-  };
-}
-function parseEvidenceBundle(value, context) {
-  const entries = readDenseDataArray(value, context);
-  if (entries.length === 0) {
-    throw new Error(`${context} must contain at least one evidence reference.`);
-  }
-  return entries.map((entry, index) => parseEvidenceRef(entry, `${context}[${index}]`));
-}
-function parseContractRef(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  return {
-    contract_id: requiredString2(value, "contract_id", context),
-    contract_version: requiredString2(value, "contract_version", context),
-    label: requiredString2(value, "label", context)
-  };
-}
-function parseContract(value, context, allowRuntimePredicate = false) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(
-    value,
-    ["contract_id", "contract_version", "label", "claim", ...allowRuntimePredicate ? ["accepts"] : []],
-    context
-  );
-  if (allowRuntimePredicate && typeof requiredField(value, "accepts", context) !== "function") {
-    throw new Error(`${context}.accepts must be a function.`);
-  }
-  return {
-    ...parseContractRef(value, context),
-    claim: parseClaim(requiredField(value, "claim", context), `${context}.claim`)
-  };
-}
-function parseRule(value, context, allowFullPremises = false) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(value, ["rule_id", "rule_version", "label", "premises", "conclusion"], context);
-  const premises = requiredField(value, "premises", context);
-  const premiseValues = readDenseDataArray(premises, `${context}.premises`);
-  if (premiseValues.length === 0) {
-    throw new Error(`${context}.premises must contain at least one claim reference.`);
-  }
-  return {
-    rule_id: requiredString2(value, "rule_id", context),
-    rule_version: requiredString2(value, "rule_version", context),
-    label: requiredString2(value, "label", context),
-    premises: premiseValues.map((premise, index) => parseClaimRef(
-      premise,
-      `${context}.premises[${index}]`,
-      allowFullPremises ? ["label"] : []
-    )),
-    conclusion: parseClaim(requiredField(value, "conclusion", context), `${context}.conclusion`)
-  };
-}
-function parsePremise(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  assertOnlyKeys(
-    value,
-    ["certificate_id", "derivation_kind", "assurance", "scope", "claim", "evidence"],
-    context
-  );
-  const derivationKind = requiredString2(value, "derivation_kind", context);
-  const assurance = requiredString2(value, "assurance", context);
-  const validAssurance = derivationKind === "contract" && assurance === "runtime_contract_accepted" || derivationKind === "composition" && assurance === "declared_runtime_rule";
-  if (!validAssurance) {
-    throw new Error(`${context} must preserve a valid derivation_kind and assurance pair.`);
-  }
-  return {
-    certificate_id: requiredString2(value, "certificate_id", context),
-    derivation_kind: derivationKind,
-    assurance,
-    scope: parseScope(requiredField(value, "scope", context), `${context}.scope`),
-    claim: parseClaim(requiredField(value, "claim", context), `${context}.claim`),
-    evidence: parseEvidenceBundle(requiredField(value, "evidence", context), `${context}.evidence`)
-  };
-}
-function stableJson3(value) {
-  if (Array.isArray(value)) return `[${value.map(stableJson3).join(",")}]`;
-  if (isRecord4(value)) {
-    return `{${Object.keys(value).filter((key) => value[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${stableJson3(value[key])}`).join(",")}}`;
-  }
-  const encoded = JSON.stringify(value);
-  if (encoded === void 0) throw new Error("Semantic certificate contains a non-JSON value.");
-  return encoded;
-}
-function sameClaimRef(left, right) {
-  return left.claim_id === right.claim_id && left.claim_version === right.claim_version && stableJson3(left.parameters || {}) === stableJson3(right.parameters || {});
-}
-function sameEvidence(left, right) {
-  return stableJson3(left) === stableJson3(right);
-}
-function certificateId(body) {
-  const digest = (0, import_node_crypto5.createHash)("sha256").update(stableJson3(body)).digest("hex");
-  return `rpsc_${digest}`;
-}
-function withCertificateId(body) {
-  return { ...body, certificate_id: certificateId(body) };
-}
-function parseDerivation(value, context) {
-  if (!isRecord4(value)) throw new Error(`${context} must be an object.`);
-  const kind = requiredString2(value, "kind", context);
-  if (kind === "contract") {
-    assertOnlyKeys(value, ["kind", "assurance", "contract"], context);
-    if (requiredField(value, "assurance", context) !== "runtime_contract_accepted") {
-      throw new Error(`${context}.assurance must be runtime_contract_accepted.`);
-    }
-    return {
-      kind,
-      assurance: "runtime_contract_accepted",
-      contract: parseContract(requiredField(value, "contract", context), `${context}.contract`)
-    };
-  }
-  if (kind === "composition") {
-    assertOnlyKeys(value, ["kind", "assurance", "rule", "premises"], context);
-    if (requiredField(value, "assurance", context) !== "declared_runtime_rule") {
-      throw new Error(`${context}.assurance must be declared_runtime_rule.`);
-    }
-    const premises = requiredField(value, "premises", context);
-    const premiseValues = readDenseDataArray(premises, `${context}.premises`);
-    if (premiseValues.length === 0) {
-      throw new Error(`${context}.premises must contain at least one certificate premise.`);
-    }
-    return {
-      kind,
-      assurance: "declared_runtime_rule",
-      rule: parseRule(requiredField(value, "rule", context), `${context}.rule`),
-      premises: premiseValues.map((premise, index) => parsePremise(premise, `${context}.premises[${index}]`))
-    };
-  }
-  throw new Error(`${context}.kind must be contract or composition.`);
-}
-function riddleProofSemanticScopesEqual(left, right) {
-  return SCOPE_FIELDS.every((field) => left[field] === right[field]);
-}
-function createRiddleProofSemanticCertificate(input) {
-  if (!isRecord4(input)) throw new Error("Semantic certificate input must be an object.");
-  assertOnlyKeys(
-    input,
-    ["scope", "evidence", "observation", "contract", "issued_at"],
-    "semantic certificate input"
-  );
-  const scope = parseScope(requiredField(input, "scope", "semantic certificate input"), "semantic certificate scope");
-  const evidence = parseEvidenceBundle(
-    requiredField(input, "evidence", "semantic certificate input"),
-    "semantic certificate evidence"
-  );
-  const runtimeContract = requiredField(
-    input,
-    "contract",
-    "semantic certificate input"
-  );
-  const contract = parseContract(runtimeContract, "semantic certificate contract", true);
-  const accepts = requiredField(
-    runtimeContract,
-    "accepts",
-    "semantic certificate contract"
-  );
-  if (typeof accepts !== "function") {
-    throw new Error("semantic certificate contract.accepts must be a function.");
-  }
-  const contractRef = {
-    contract_id: contract.contract_id,
-    contract_version: contract.contract_version,
-    label: contract.label
-  };
-  const claim = contract.claim;
-  let accepted;
-  try {
-    accepted = accepts(
-      { ...scope },
-      requiredField(input, "observation", "semantic certificate input")
-    ) === true;
-  } catch (error) {
-    return {
-      ok: false,
-      error: {
-        code: "contract_error",
-        contract: contractRef,
-        message: `Semantic contract evaluation failed: ${safeErrorMessage(error)}.`
-      }
-    };
-  }
-  if (!accepted) {
-    return {
-      ok: false,
-      error: {
-        code: "contract_rejected",
-        contract: contractRef,
-        message: "Semantic contract rejected the supplied observation at this scope."
-      }
-    };
-  }
-  const body = {
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
-    scope,
-    claim,
-    evidence,
-    derivation: { kind: "contract", assurance: "runtime_contract_accepted", contract },
-    issued_at: parseIssuedAt(
-      optionalField(input, "issued_at") || (/* @__PURE__ */ new Date()).toISOString(),
-      "semantic certificate issued_at"
-    )
-  };
-  return { ok: true, certificate: withCertificateId(body) };
-}
-function parseRiddleProofSemanticCertificate(value) {
-  if (!isRecord4(value)) throw new Error("Semantic certificate must be an object.");
-  const version = optionalField(value, "version");
-  if (version !== RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION) {
-    throw new Error(`Unsupported Semantic certificate version ${String(version || "missing")}.`);
-  }
-  for (const field of AUTHORITY_FIELDS) {
-    if (Object.prototype.hasOwnProperty.call(value, field)) {
-      throw new Error(`Semantic certificate must not contain authority field ${field}.`);
-    }
-  }
-  assertOnlyKeys(value, [...CERTIFICATE_FIELDS], "Semantic certificate");
-  const scope = parseScope(requiredField(value, "scope", "semantic certificate"), "semantic certificate scope");
-  const claim = parseClaim(requiredField(value, "claim", "semantic certificate"), "semantic certificate claim");
-  const evidence = parseEvidenceBundle(
-    requiredField(value, "evidence", "semantic certificate"),
-    "semantic certificate evidence"
-  );
-  const derivation = parseDerivation(
-    requiredField(value, "derivation", "semantic certificate"),
-    "semantic certificate derivation"
-  );
-  if (derivation.kind === "contract" && !sameClaimRef(claim, derivation.contract.claim)) {
-    throw new Error("Semantic contract-derived claim must match its contract claim.");
-  }
-  if (derivation.kind === "composition") {
-    if (derivation.premises.length !== derivation.rule.premises.length) {
-      throw new Error("Semantic composition premises must match the rule premise count.");
-    }
-    derivation.premises.forEach((premise, index) => {
-      if (!riddleProofSemanticScopesEqual(scope, premise.scope)) {
-        throw new Error(`Semantic composition premise ${index} must have the certificate scope.`);
-      }
-      if (!sameClaimRef(premise.claim, derivation.rule.premises[index])) {
-        throw new Error(`Semantic composition premise ${index} must match its rule claim.`);
-      }
-    });
-    if (!sameClaimRef(claim, derivation.rule.conclusion)) {
-      throw new Error("Semantic composition claim must match its rule conclusion.");
-    }
-    const expectedEvidence = derivation.premises.flatMap((premise) => premise.evidence);
-    if (!sameEvidence(evidence, expectedEvidence)) {
-      throw new Error("Semantic composition evidence must be the ordered concatenation of premise evidence.");
-    }
-  }
-  const body = {
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
-    scope,
-    claim,
-    evidence,
-    derivation,
-    issued_at: parseIssuedAt(
-      requiredField(value, "issued_at", "semantic certificate"),
-      "semantic certificate issued_at"
-    )
-  };
-  const observedId = requiredString2(value, "certificate_id", "semantic certificate");
-  const expectedId = certificateId(body);
-  if (observedId !== expectedId) {
-    throw new Error("Semantic certificate_id must match its content.");
-  }
-  return { ...body, certificate_id: observedId };
-}
-function matchRiddleProofSemanticCertificate(input) {
-  if (!isRecord4(input)) throw new Error("Semantic certificate match input must be a plain object.");
-  assertOnlyKeys(
-    input,
-    [
-      "certificate",
-      "expected_certificate_id",
-      "expected_scope",
-      "expected_claim",
-      "expected_assurance"
-    ],
-    "semantic certificate match input"
-  );
-  const expectedCertificateId = requiredString2(
-    input,
-    "expected_certificate_id",
-    "semantic certificate match input"
-  );
-  if (!/^rpsc_[0-9a-f]{64}$/u.test(expectedCertificateId)) {
-    throw new Error(
-      "Semantic certificate match input.expected_certificate_id must be a full rpsc content ID."
-    );
-  }
-  const expectedScope = parseScope(
-    requiredField(input, "expected_scope", "semantic certificate match input"),
-    "semantic certificate match expected_scope"
-  );
-  const expectedClaim = parseClaimRef(
-    requiredField(input, "expected_claim", "semantic certificate match input"),
-    "semantic certificate match expected_claim",
-    ["label"]
-  );
-  const expectedAssurance = requiredString2(
-    input,
-    "expected_assurance",
-    "semantic certificate match input"
-  );
-  if (expectedAssurance !== "runtime_contract_accepted" && expectedAssurance !== "declared_runtime_rule") {
-    throw new Error(
-      "Semantic certificate match input.expected_assurance must be runtime_contract_accepted or declared_runtime_rule."
-    );
-  }
-  let certificate;
-  try {
-    certificate = parseRiddleProofSemanticCertificate(
-      requiredField(input, "certificate", "semantic certificate match input")
-    );
-  } catch (error) {
-    return {
-      ok: false,
-      error: {
-        code: "invalid_certificate",
-        message: `Semantic certificate did not parse: ${safeErrorMessage(error)}`
-      }
-    };
-  }
-  if (certificate.certificate_id !== expectedCertificateId) {
-    return {
-      ok: false,
-      error: {
-        code: "certificate_id_mismatch",
-        expected: expectedCertificateId,
-        observed: certificate.certificate_id,
-        message: "Semantic certificate does not match the trusted expected content ID."
-      }
-    };
-  }
-  const scopeMismatch = firstScopeMismatch(expectedScope, certificate.scope);
-  if (scopeMismatch) {
-    return {
-      ok: false,
-      error: {
-        code: "scope_mismatch",
-        ...scopeMismatch,
-        message: `Semantic certificate has a different ${scopeMismatch.field} than the consumer expected.`
-      }
-    };
-  }
-  if (!sameClaimRef(expectedClaim, certificate.claim)) {
-    return {
-      ok: false,
-      error: {
-        code: "claim_mismatch",
-        expected: expectedClaim,
-        observed: parseClaimRef(
-          certificate.claim,
-          "semantic certificate match observed claim",
-          ["label"]
-        ),
-        message: "Semantic certificate does not state the claim the consumer expected."
-      }
-    };
-  }
-  if (certificate.derivation.assurance !== expectedAssurance) {
-    return {
-      ok: false,
-      error: {
-        code: "assurance_mismatch",
-        expected: expectedAssurance,
-        observed: certificate.derivation.assurance,
-        message: "Semantic certificate does not have the assurance the consumer expected."
-      }
-    };
-  }
-  return { ok: true, certificate };
-}
-function firstScopeMismatch(expected, observed) {
-  for (const field of SCOPE_FIELDS) {
-    if (expected[field] !== observed[field]) {
-      return { field, expected: expected[field], observed: observed[field] };
-    }
-  }
-  return void 0;
-}
-function premiseFromCertificate(certificate) {
-  return {
-    certificate_id: certificate.certificate_id,
-    derivation_kind: certificate.derivation.kind,
-    assurance: certificate.derivation.assurance,
-    scope: { ...certificate.scope },
-    claim: parseClaim(certificate.claim, "semantic composition premise claim"),
-    evidence: certificate.evidence.map((entry) => ({ ...entry }))
-  };
-}
-function composeRiddleProofSemanticCertificates(input) {
-  if (!isRecord4(input)) throw new Error("Semantic composition input must be an object.");
-  assertOnlyKeys(
-    input,
-    ["rule", "certificates", "issued_at"],
-    "semantic composition input"
-  );
-  const rule = parseRule(
-    requiredField(input, "rule", "semantic composition input"),
-    "semantic composition rule",
-    true
-  );
-  const inputCertificates = requiredField(input, "certificates", "semantic composition input");
-  const certificateValues = readDenseDataArray(
-    inputCertificates,
-    "semantic composition input.certificates"
-  );
-  if (certificateValues.length === 0) {
-    throw new Error("Semantic composition requires at least one certificate.");
-  }
-  const certificates = certificateValues.map((certificate) => parseRiddleProofSemanticCertificate(certificate));
-  if (certificates.length !== rule.premises.length) {
-    return {
-      ok: false,
-      error: {
-        code: "premise_count_mismatch",
-        expected: rule.premises.length,
-        observed: certificates.length,
-        message: `Semantic rule expected ${rule.premises.length} certificate(s), received ${certificates.length}.`
-      }
-    };
-  }
-  const expectedScope = certificates[0].scope;
-  for (let index = 1; index < certificates.length; index += 1) {
-    const mismatch = firstScopeMismatch(expectedScope, certificates[index].scope);
-    if (mismatch) {
-      return {
-        ok: false,
-        error: {
-          code: "scope_mismatch",
-          input_index: index,
-          ...mismatch,
-          message: `Semantic certificate ${index} has a different ${mismatch.field}.`
-        }
-      };
-    }
-  }
-  for (let index = 0; index < certificates.length; index += 1) {
-    const expected = rule.premises[index];
-    const observed = certificates[index].claim;
-    if (!sameClaimRef(expected, observed)) {
-      return {
-        ok: false,
-        error: {
-          code: "premise_mismatch",
-          input_index: index,
-          expected,
-          observed: parseClaimRef(observed, "semantic composition observed claim", ["label"]),
-          message: `Semantic certificate ${index} does not satisfy its declared rule premise.`
-        }
-      };
-    }
-  }
-  const evidence = certificates.flatMap((certificate) => certificate.evidence);
-  const body = {
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
-    scope: { ...expectedScope },
-    claim: { ...rule.conclusion },
-    evidence,
-    derivation: {
-      kind: "composition",
-      assurance: "declared_runtime_rule",
-      rule,
-      premises: certificates.map(premiseFromCertificate)
-    },
-    issued_at: parseIssuedAt(
-      optionalField(input, "issued_at") || (/* @__PURE__ */ new Date()).toISOString(),
-      "semantic certificate issued_at"
-    )
-  };
-  return { ok: true, certificate: withCertificateId(body) };
-}
-function invalidClosure(message) {
-  return { ok: false, error: { code: "invalid_closure", message } };
-}
-function firstPremiseSnapshotMismatch(snapshot, certificate) {
-  const observed = premiseFromCertificate(certificate);
-  if (snapshot.derivation_kind !== observed.derivation_kind) return "derivation_kind";
-  if (snapshot.assurance !== observed.assurance) return "assurance";
-  if (stableJson3(snapshot.scope) !== stableJson3(observed.scope)) return "scope";
-  if (stableJson3(snapshot.claim) !== stableJson3(observed.claim)) return "claim";
-  if (stableJson3(snapshot.evidence) !== stableJson3(observed.evidence)) return "evidence";
-  return void 0;
-}
-function validateSemanticCertificateClosureInternal(value) {
-  if (!isRecord4(value)) {
-    return invalidClosure("Semantic certificate closure must be a plain object.");
-  }
-  assertOnlyKeys(
-    value,
-    ["version", "root_certificate_id", "certificates"],
-    "Semantic certificate closure"
-  );
-  if (requiredField(value, "version", "Semantic certificate closure") !== RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION) {
-    return invalidClosure("Unsupported Semantic certificate closure version.");
-  }
-  const rootCertificateId = requiredString2(
-    value,
-    "root_certificate_id",
-    "Semantic certificate closure"
-  );
-  if (!/^rpsc_[0-9a-f]{64}$/u.test(rootCertificateId)) {
-    return invalidClosure(
-      "Semantic certificate closure.root_certificate_id must be a full rpsc content ID."
-    );
-  }
-  const inputCertificates = requiredField(
-    value,
-    "certificates",
-    "Semantic certificate closure"
-  );
-  const certificateValues = readDenseDataArray(
-    inputCertificates,
-    "Semantic certificate closure.certificates",
-    RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES
-  );
-  if (certificateValues.length === 0) {
-    return invalidClosure("Semantic certificate closure must contain at least one certificate.");
-  }
-  const certificates = [];
-  for (let index = 0; index < certificateValues.length; index += 1) {
-    try {
-      certificates.push(parseRiddleProofSemanticCertificate(certificateValues[index]));
-    } catch (error) {
-      return {
-        ok: false,
-        error: {
-          code: "invalid_closure_certificate",
-          input_index: index,
-          message: `Semantic certificate closure certificate ${index} did not parse: ${safeErrorMessage(error)}`
-        }
-      };
-    }
-  }
-  const certificatesById = /* @__PURE__ */ new Map();
-  const firstIndexById = /* @__PURE__ */ new Map();
-  for (let index = 0; index < certificates.length; index += 1) {
-    const certificate = certificates[index];
-    const firstIndex = firstIndexById.get(certificate.certificate_id);
-    if (firstIndex !== void 0) {
-      return {
-        ok: false,
-        error: {
-          code: "duplicate_certificate_id",
-          certificate_id: certificate.certificate_id,
-          first_index: firstIndex,
-          duplicate_index: index,
-          message: `Semantic certificate closure repeats certificate ${certificate.certificate_id}.`
-        }
-      };
-    }
-    firstIndexById.set(certificate.certificate_id, index);
-    certificatesById.set(certificate.certificate_id, certificate);
-  }
-  const rootCertificate = certificatesById.get(rootCertificateId);
-  if (!rootCertificate) {
-    return {
-      ok: false,
-      error: {
-        code: "root_certificate_missing",
-        root_certificate_id: rootCertificateId,
-        message: "Semantic certificate closure does not contain its declared root certificate."
-      }
-    };
-  }
-  const states = /* @__PURE__ */ new Map();
-  const stack = [{ certificate: rootCertificate, next_premise_index: 0 }];
-  const dependencyFirst = [];
-  states.set(rootCertificateId, "visiting");
-  while (stack.length > 0) {
-    const frame = stack[stack.length - 1];
-    const premises = frame.certificate.derivation.kind === "composition" ? frame.certificate.derivation.premises : [];
-    if (frame.next_premise_index < premises.length) {
-      const premiseIndex = frame.next_premise_index;
-      frame.next_premise_index += 1;
-      const snapshot = premises[premiseIndex];
-      const child = certificatesById.get(snapshot.certificate_id);
-      if (!child) {
-        return {
-          ok: false,
-          error: {
-            code: "dangling_premise",
-            parent_certificate_id: frame.certificate.certificate_id,
-            premise_index: premiseIndex,
-            premise_certificate_id: snapshot.certificate_id,
-            message: `Semantic certificate ${frame.certificate.certificate_id} premise ${premiseIndex} has no full certificate body.`
-          }
-        };
-      }
-      const mismatch = firstPremiseSnapshotMismatch(snapshot, child);
-      if (mismatch) {
-        return {
-          ok: false,
-          error: {
-            code: "premise_snapshot_mismatch",
-            parent_certificate_id: frame.certificate.certificate_id,
-            premise_index: premiseIndex,
-            premise_certificate_id: snapshot.certificate_id,
-            field: mismatch,
-            message: `Semantic certificate ${frame.certificate.certificate_id} premise ${premiseIndex} has a different ${mismatch} than its full certificate body.`
-          }
-        };
-      }
-      const childState = states.get(child.certificate_id);
-      if (childState === "visiting") {
-        const cycleStart = stack.findIndex(
-          (candidate) => candidate.certificate.certificate_id === child.certificate_id
-        );
-        const certificateIds = stack.slice(Math.max(0, cycleStart)).map((candidate) => candidate.certificate.certificate_id);
-        certificateIds.push(child.certificate_id);
-        return {
-          ok: false,
-          error: {
-            code: "certificate_cycle",
-            certificate_ids: certificateIds,
-            message: "Semantic certificate closure contains a certificate cycle."
-          }
-        };
-      }
-      if (childState !== "visited") {
-        states.set(child.certificate_id, "visiting");
-        stack.push({ certificate: child, next_premise_index: 0 });
-      }
-      continue;
-    }
-    stack.pop();
-    states.set(frame.certificate.certificate_id, "visited");
-    dependencyFirst.push(frame.certificate);
-  }
-  if (dependencyFirst.length !== certificates.length) {
-    const reachable = new Set(dependencyFirst.map((certificate) => certificate.certificate_id));
-    const unreachable = certificates.filter((certificate) => !reachable.has(certificate.certificate_id)).map((certificate) => certificate.certificate_id).sort();
-    return {
-      ok: false,
-      error: {
-        code: "unreachable_certificates",
-        certificate_ids: unreachable,
-        message: "Semantic certificate closure contains certificates unreachable from its root."
-      }
-    };
-  }
-  const closure = {
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
-    root_certificate_id: rootCertificateId,
-    certificates: dependencyFirst
-  };
-  return { ok: true, closure, root_certificate: rootCertificate };
-}
-function validateRiddleProofSemanticCertificateClosure(value) {
-  try {
-    return validateSemanticCertificateClosureInternal(value);
-  } catch (error) {
-    return invalidClosure(
-      `Semantic certificate closure did not parse: ${safeErrorMessage(error)}`
-    );
-  }
-}
-function createRiddleProofSemanticAtomicCertificateClosure(input) {
-  if (!isRecord4(input)) throw new Error("Semantic certificate closure input must be a plain object.");
-  assertOnlyKeys(input, ["certificate"], "Semantic certificate closure input");
-  const certificate = requiredField(input, "certificate", "Semantic certificate closure input");
-  let parsedCertificate;
-  try {
-    parsedCertificate = parseRiddleProofSemanticCertificate(certificate);
-  } catch (error) {
-    return {
-      ok: false,
-      error: {
-        code: "invalid_closure_certificate",
-        input_index: 0,
-        message: `Semantic certificate closure certificate 0 did not parse: ${safeErrorMessage(error)}`
-      }
-    };
-  }
-  if (parsedCertificate.derivation.kind !== "contract") {
-    return invalidClosure(
-      "An atomic Semantic certificate closure requires a contract-derived certificate."
-    );
-  }
-  return validateRiddleProofSemanticCertificateClosure({
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
-    root_certificate_id: parsedCertificate.certificate_id,
-    certificates: [certificate]
-  });
-}
-function composeRiddleProofSemanticCertificateClosures(input) {
-  if (!isRecord4(input)) throw new Error("Semantic closure composition input must be a plain object.");
-  assertOnlyKeys(
-    input,
-    ["rule", "closures", "issued_at"],
-    "Semantic closure composition input"
-  );
-  const inputClosures = requiredField(
-    input,
-    "closures",
-    "Semantic closure composition input"
-  );
-  const closureValues = readDenseDataArray(
-    inputClosures,
-    "Semantic closure composition input.closures"
-  );
-  if (closureValues.length === 0) {
-    throw new Error("Semantic closure composition requires at least one closure.");
-  }
-  const validatedClosures = [];
-  for (let index = 0; index < closureValues.length; index += 1) {
-    const result = validateRiddleProofSemanticCertificateClosure(closureValues[index]);
-    if (!result.ok) {
-      return {
-        ok: false,
-        error: {
-          code: "input_closure_invalid",
-          input_index: index,
-          cause: result.error,
-          message: `Semantic input closure ${index} is invalid: ${result.error.message}`
-        }
-      };
-    }
-    validatedClosures.push(result);
-  }
-  const roots = validatedClosures.map((result) => {
-    if (!result.ok) throw new Error("Validated Semantic closure unexpectedly became invalid.");
-    return result.root_certificate;
-  });
-  const composition = composeRiddleProofSemanticCertificates({
-    rule: requiredField(input, "rule", "Semantic closure composition input"),
-    certificates: roots,
-    issued_at: optionalField(input, "issued_at")
-  });
-  if (!composition.ok) return composition;
-  const merged = [];
-  const byId = /* @__PURE__ */ new Map();
-  for (const result of validatedClosures) {
-    if (!result.ok) continue;
-    for (const certificate of result.closure.certificates) {
-      const existing = byId.get(certificate.certificate_id);
-      if (existing) {
-        if (stableJson3(existing) !== stableJson3(certificate)) {
-          return {
-            ok: false,
-            error: {
-              code: "certificate_id_collision",
-              certificate_id: certificate.certificate_id,
-              message: `Semantic closures contain unequal bodies for ${certificate.certificate_id}.`
-            }
-          };
-        }
-        continue;
-      }
-      byId.set(certificate.certificate_id, certificate);
-      merged.push(certificate);
-    }
-  }
-  if (byId.has(composition.certificate.certificate_id)) {
-    return {
-      ok: false,
-      error: {
-        code: "certificate_id_collision",
-        certificate_id: composition.certificate.certificate_id,
-        message: "Semantic composition produced a root ID already present in its premise closures."
-      }
-    };
-  }
-  merged.push(composition.certificate);
-  const validation = validateRiddleProofSemanticCertificateClosure({
-    version: RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
-    root_certificate_id: composition.certificate.certificate_id,
-    certificates: merged
-  });
-  if (!validation.ok) {
-    return {
-      ok: false,
-      error: {
-        code: "closure_construction_failed",
-        cause: validation.error,
-        message: `Semantic closure construction failed: ${validation.error.message}`
-      }
-    };
-  }
-  return {
-    ok: true,
-    certificate: composition.certificate,
-    closure: validation.closure
-  };
-}
-function matchRiddleProofSemanticCertificateClosure(input) {
-  if (!isRecord4(input)) throw new Error("Semantic certificate closure match input must be a plain object.");
-  assertOnlyKeys(
-    input,
-    [
-      "closure",
-      "expected_root_certificate_id",
-      "expected_scope",
-      "expected_claim",
-      "expected_assurance"
-    ],
-    "Semantic certificate closure match input"
-  );
-  const validation = validateRiddleProofSemanticCertificateClosure(
-    requiredField(input, "closure", "Semantic certificate closure match input")
-  );
-  if (!validation.ok) return validation;
-  const expectedRootCertificateId = requiredString2(
-    input,
-    "expected_root_certificate_id",
-    "Semantic certificate closure match input"
-  );
-  if (!/^rpsc_[0-9a-f]{64}$/u.test(expectedRootCertificateId)) {
-    throw new Error(
-      "Semantic certificate closure match input.expected_root_certificate_id must be a full rpsc content ID."
-    );
-  }
-  const rootMatch = matchRiddleProofSemanticCertificate({
-    certificate: validation.root_certificate,
-    expected_certificate_id: expectedRootCertificateId,
-    expected_scope: requiredField(
-      input,
-      "expected_scope",
-      "Semantic certificate closure match input"
-    ),
-    expected_claim: requiredField(
-      input,
-      "expected_claim",
-      "Semantic certificate closure match input"
-    ),
-    expected_assurance: requiredField(
-      input,
-      "expected_assurance",
-      "Semantic certificate closure match input"
-    )
-  });
-  if (!rootMatch.ok) return rootMatch;
-  return {
-    ok: true,
-    closure: validation.closure,
-    root_certificate: rootMatch.certificate
-  };
-}
+var receipts_exports = {};
+__export(receipts_exports, {
+  RIDDLE_PREVIEW_RECEIPT_VERSION: () => import_receipts.RIDDLE_PREVIEW_RECEIPT_VERSION,
+  RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION: () => import_receipts.RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
+  createRiddleProofObservationReceipt: () => import_receipts.createRiddleProofObservationReceipt,
+  parseRiddlePreviewReceipt: () => import_receipts.parseRiddlePreviewReceipt,
+  parseRiddleProofObservationReceipt: () => import_receipts.parseRiddleProofObservationReceipt
+});
+__reExport(receipts_exports, require("@riddledc/riddle-proof-core/receipts"));
+var import_receipts = require("@riddledc/riddle-proof-core/receipts");
+
+// src/index.ts
+__reExport(index_exports, receipts_exports, module.exports);
+
+// src/semantic-certificate.ts
+var semantic_certificate_exports = {};
+__export(semantic_certificate_exports, {
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
+  RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION: () => import_semantic_certificate.RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  composeRiddleProofSemanticCertificateClosures: () => import_semantic_certificate.composeRiddleProofSemanticCertificateClosures,
+  composeRiddleProofSemanticCertificates: () => import_semantic_certificate.composeRiddleProofSemanticCertificates,
+  createRiddleProofSemanticAtomicCertificateClosure: () => import_semantic_certificate.createRiddleProofSemanticAtomicCertificateClosure,
+  createRiddleProofSemanticCertificate: () => import_semantic_certificate.createRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificate: () => import_semantic_certificate.matchRiddleProofSemanticCertificate,
+  matchRiddleProofSemanticCertificateClosure: () => import_semantic_certificate.matchRiddleProofSemanticCertificateClosure,
+  parseRiddleProofSemanticCertificate: () => import_semantic_certificate.parseRiddleProofSemanticCertificate,
+  riddleProofSemanticScopesEqual: () => import_semantic_certificate.riddleProofSemanticScopesEqual,
+  validateRiddleProofSemanticCertificateClosure: () => import_semantic_certificate.validateRiddleProofSemanticCertificateClosure
+});
+__reExport(semantic_certificate_exports, require("@riddledc/riddle-proof-core/semantic-certificate"));
+var import_semantic_certificate = require("@riddledc/riddle-proof-core/semantic-certificate");
+
+// src/index.ts
+__reExport(index_exports, semantic_certificate_exports, module.exports);
+
+// src/grounded-evidence.ts
+var grounded_evidence_exports = {};
+__export(grounded_evidence_exports, {
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACTS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACTS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_OBSERVATION_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_OBSERVATION_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TIME_WINDOW_MS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TIME_WINDOW_MS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TOTAL_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_STATEMENT_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_CAPTURE_STATEMENT_VERSION,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_DEFINITION_DIGEST_DOMAIN: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_DEFINITION_DIGEST_DOMAIN,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_CONTRACT_ENGINE: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_CONTRACT_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_VERIFIER_ENGINE: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_VERIFIER_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_ASSERTIONS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_ASSERTIONS,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_DEFINITION_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_SEGMENTS: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_SEGMENTS,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_CONFIG_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_CONFIG_BYTES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_REGISTRY_ENTRIES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_REGISTRY_ENTRIES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_TRUSTED_KEY_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_TRUSTED_KEY_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CERTIFICATE_CLOSURE_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_METADATA_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_METADATA_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_TOTAL_ARTIFACT_BYTES: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_VERIFICATION_RECEIPT_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_GROUNDED_VERIFICATION_RECEIPT_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_BUNDLE_VERSION: () => import_grounded_evidence.RIDDLE_PROOF_SIGNED_CAPTURE_BUNDLE_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_SIGNATURE_DOMAIN: () => import_grounded_evidence.RIDDLE_PROOF_SIGNED_CAPTURE_SIGNATURE_DOMAIN,
+  composeRiddleProofGroundedSemanticCertificateClosures: () => import_grounded_evidence.composeRiddleProofGroundedSemanticCertificateClosures,
+  createRiddleProofGroundedDeclarativeJsonContract: () => import_grounded_evidence.createRiddleProofGroundedDeclarativeJsonContract,
+  createRiddleProofGroundedDeclarativeJsonVerifier: () => import_grounded_evidence.createRiddleProofGroundedDeclarativeJsonVerifier,
+  createRiddleProofGroundedSemanticAtomicCertificateClosure: () => import_grounded_evidence.createRiddleProofGroundedSemanticAtomicCertificateClosure,
+  createRiddleProofGroundedSemanticCertificate: () => import_grounded_evidence.createRiddleProofGroundedSemanticCertificate,
+  createRiddleProofSignedCaptureBundle: () => import_grounded_evidence.createRiddleProofSignedCaptureBundle,
+  matchRiddleProofGroundedSemanticCertificateClosure: () => import_grounded_evidence.matchRiddleProofGroundedSemanticCertificateClosure,
+  replayRiddleProofGroundedSemanticCertificate: () => import_grounded_evidence.replayRiddleProofGroundedSemanticCertificate,
+  validateRiddleProofGroundedSemanticCertificateClosure: () => import_grounded_evidence.validateRiddleProofGroundedSemanticCertificateClosure,
+  verifyRiddleProofSignedCaptureBundle: () => import_grounded_evidence.verifyRiddleProofSignedCaptureBundle
+});
+__reExport(grounded_evidence_exports, require("@riddledc/riddle-proof-core/grounded-evidence"));
+var import_grounded_evidence = require("@riddledc/riddle-proof-core/grounded-evidence");
+
+// src/index.ts
+__reExport(index_exports, grounded_evidence_exports, module.exports);
+
+// src/checked-meaning.ts
+var checked_meaning_exports = {};
+__export(checked_meaning_exports, {
+  RIDDLE_PROOF_CHECKED_MEANING_ASSURANCE: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_ASSURANCE,
+  RIDDLE_PROOF_CHECKED_MEANING_CLOSURE_VERSION: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_CLOSURE_VERSION,
+  RIDDLE_PROOF_CHECKED_MEANING_MATERIALIZED_RULE_DIGEST_DOMAIN: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MATERIALIZED_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_AGE_MS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_AGE_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_CONSUMPTION_WINDOW_MS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_CONSUMPTION_WINDOW_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_DEFINITION_BYTES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PARAMETERS: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_PARAMETERS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PREMISES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_PREMISES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_RULES: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_MAX_RULES,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_DIGEST_DOMAIN: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_ENGINE: () => import_checked_meaning.RIDDLE_PROOF_CHECKED_MEANING_RULE_ENGINE,
+  assessRiddleProofCheckedMeaningClosure: () => import_checked_meaning.assessRiddleProofCheckedMeaningClosure,
+  composeRiddleProofCheckedMeaningClosures: () => import_checked_meaning.composeRiddleProofCheckedMeaningClosures,
+  createRiddleProofCheckedMeaningAtomicClosure: () => import_checked_meaning.createRiddleProofCheckedMeaningAtomicClosure,
+  createRiddleProofCheckedMeaningRule: () => import_checked_meaning.createRiddleProofCheckedMeaningRule,
+  matchRiddleProofCheckedMeaningClosure: () => import_checked_meaning.matchRiddleProofCheckedMeaningClosure,
+  replayRiddleProofCheckedMeaningClosure: () => import_checked_meaning.replayRiddleProofCheckedMeaningClosure,
+  validateRiddleProofCheckedMeaningClosure: () => import_checked_meaning.validateRiddleProofCheckedMeaningClosure
+});
+__reExport(checked_meaning_exports, require("@riddledc/riddle-proof-core/checked-meaning"));
+var import_checked_meaning = require("@riddledc/riddle-proof-core/checked-meaning");
+
+// src/index.ts
+__reExport(index_exports, checked_meaning_exports, module.exports);
 
 // src/change-proof.ts
 var RIDDLE_PROOF_CHANGE_CONTRACT_VERSION = "riddle-proof.change-contract.v1";
@@ -21992,7 +20829,7 @@ function changeReceiptVerdict(status) {
   if (status === "proof_insufficient") return "proof_insufficient";
   return "not_mergeable";
 }
-function profileCheckCounts2(result) {
+function profileCheckCounts(result) {
   const counts = {
     total: result.checks.length,
     passed: 0,
@@ -22065,7 +20902,7 @@ function observationExecutor(result) {
 function observationForReceiptSide(side, result, source, sourceIdentity) {
   if (!result) throw new Error(`${side}_result or ${side}_observation is required.`);
   if (!source) throw new Error(`${side}_source or ${side}_observation is required.`);
-  return createRiddleProofObservationReceipt({
+  return (0, import_receipts.createRiddleProofObservationReceipt)({
     comparison_role: side,
     executor: observationExecutor(result),
     target: { kind: "url", url: source },
@@ -22076,8 +20913,8 @@ function observationForReceiptSide(side, result, source, sourceIdentity) {
   });
 }
 function createRiddleProofChangeReceipt(input) {
-  const before = input.before_observation ? parseRiddleProofObservationReceipt(input.before_observation) : observationForReceiptSide("before", input.before_result, input.before_source, input.before_source_identity);
-  const after = input.after_observation ? parseRiddleProofObservationReceipt(input.after_observation) : observationForReceiptSide("after", input.after_result, input.after_source, input.after_source_identity);
+  const before = input.before_observation ? (0, import_receipts.parseRiddleProofObservationReceipt)(input.before_observation) : observationForReceiptSide("before", input.before_result, input.before_source, input.before_source_identity);
+  const after = input.after_observation ? (0, import_receipts.parseRiddleProofObservationReceipt)(input.after_observation) : observationForReceiptSide("after", input.after_result, input.after_source, input.after_source_identity);
   const verdict = changeReceiptVerdict(input.result.status);
   const shippingAuthorization = input.shipping_authorization || noShippingAuthorization();
   assertShippingAuthorizationConsistent(shippingAuthorization, "Change receipt");
@@ -22107,7 +20944,7 @@ function createRiddleProofChangeReceipt(input) {
     metadata: input.result.metadata
   };
 }
-function isRecord5(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function migratedObservationFromLegacySide(side, legacy) {
@@ -22184,7 +21021,7 @@ function migrateRiddleProofChangeReceipt(legacy) {
   };
 }
 function parseRiddleProofChangeReceipt(value) {
-  if (!isRecord5(value)) throw new Error("Change receipt must be an object.");
+  if (!isRecord3(value)) throw new Error("Change receipt must be an object.");
   if (value.version === RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION) {
     return migrateRiddleProofChangeReceipt(value);
   }
@@ -22195,8 +21032,8 @@ function parseRiddleProofChangeReceipt(value) {
   if (!RIDDLE_PROOF_PROFILE_STATUSES.includes(receipt.status)) {
     throw new Error(`Unsupported Change receipt status ${String(receipt.status || "missing")}.`);
   }
-  parseRiddleProofObservationReceipt(receipt.before);
-  parseRiddleProofObservationReceipt(receipt.after);
+  (0, import_receipts.parseRiddleProofObservationReceipt)(receipt.before);
+  (0, import_receipts.parseRiddleProofObservationReceipt)(receipt.after);
   if (receipt.before.comparison_role !== "before" || receipt.after.comparison_role !== "after") {
     throw new Error("Change receipt observations must preserve their before and after comparison roles.");
   }
@@ -22228,8 +21065,8 @@ function createRiddleProofHandoffReceipt(changeReceipt, options = {}) {
   };
 }
 function parseRiddleProofHandoffReceipt(value) {
-  if (!isRecord5(value) || value.version !== RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION) {
-    throw new Error(`Unsupported Handoff receipt version ${String(isRecord5(value) ? value.version || "missing" : "missing")}.`);
+  if (!isRecord3(value) || value.version !== RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION) {
+    throw new Error(`Unsupported Handoff receipt version ${String(isRecord3(value) ? value.version || "missing" : "missing")}.`);
   }
   const receipt = value;
   if (!Number.isFinite(Date.parse(receipt.created_at))) {
@@ -22284,7 +21121,7 @@ function receiptSideView(side, observation) {
     summary: summary?.summary || observation.proof?.result.summary || "No profile summary recorded.",
     route: summary?.route,
     captured_at: observation.captured_at,
-    checks: summary?.checks || (observation.proof ? profileCheckCounts2(observation.proof.result) : {
+    checks: summary?.checks || (observation.proof ? profileCheckCounts(observation.proof.result) : {
       total: 0,
       passed: 0,
       failed: 0,
@@ -22514,624 +21351,7 @@ function riddleProofChangeReceiptHtml(receipt) {
 }
 
 // src/riddle-client.ts
-var import_node_child_process4 = require("child_process");
-var import_node_fs5 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path5 = __toESM(require("path"), 1);
-var DEFAULT_RIDDLE_API_BASE_URL = "https://api.riddledc.com";
-var DEFAULT_RIDDLE_API_KEY_FILE = "/tmp/riddle-api-key";
-var RIDDLE_UNSUBMITTED_WAKE_HINT = "hosted worker may still be waking or waiting for a lease";
-var RiddleApiError = class extends Error {
-  constructor(pathname, status, body) {
-    super(`Riddle API ${pathname} failed HTTP ${status}: ${body}`);
-    this.name = "RiddleApiError";
-    this.status = status;
-    this.body = body;
-    this.path = pathname;
-  }
-};
-var PREVIEW_PUBLISH_RECOVERY_STATUSES = /* @__PURE__ */ new Set([408, 429, 500, 502, 503, 504]);
-var PREVIEW_PUBLISH_RECOVERY_ATTEMPTS = 30;
-var PREVIEW_PUBLISH_RECOVERY_INTERVAL_MS = 2e3;
-function normalizeBaseUrl(value) {
-  return (value || DEFAULT_RIDDLE_API_BASE_URL).replace(/\/$/, "");
-}
-function fetchFor(config = {}) {
-  return config.fetchImpl || fetch;
-}
-function resolveRiddleApiKeyWithSource(config = {}) {
-  if (config.apiKey?.trim()) return { apiKey: config.apiKey.trim(), source: "option" };
-  if (process.env.RIDDLE_API_KEY?.trim()) return { apiKey: process.env.RIDDLE_API_KEY.trim(), source: "env" };
-  const keyFile = config.apiKeyFile || process.env.RIDDLE_API_KEY_FILE || DEFAULT_RIDDLE_API_KEY_FILE;
-  if ((0, import_node_fs5.existsSync)(keyFile)) {
-    const key = (0, import_node_fs5.readFileSync)(keyFile, "utf8").trim();
-    if (key) return { apiKey: key, source: "file", file: keyFile };
-  }
-  throw new Error(`Riddle API key missing. Set RIDDLE_API_KEY or write ${DEFAULT_RIDDLE_API_KEY_FILE}.`);
-}
-function resolveRiddleApiKeySource(config = {}) {
-  const { apiKey: _apiKey, ...source } = resolveRiddleApiKeyWithSource(config);
-  return source;
-}
-function resolveRiddleApiKey(config = {}) {
-  return resolveRiddleApiKeyWithSource(config).apiKey;
-}
-async function riddleRequestJson(config, pathname, init = {}) {
-  const response = await fetchFor(config)(`${normalizeBaseUrl(config.apiBaseUrl)}${pathname}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${resolveRiddleApiKey(config)}`,
-      "Content-Type": "application/json",
-      ...init.headers || {}
-    }
-  });
-  const text = await response.text();
-  let json = null;
-  try {
-    json = JSON.parse(text);
-  } catch {
-  }
-  if (!response.ok) throw new RiddleApiError(pathname, response.status, text);
-  return json ?? text;
-}
-async function getRiddleBalance(config = {}) {
-  return riddleRequestJson(config, "/v1/balance", { method: "GET" });
-}
-function previewDeployResultFromRecord(input) {
-  const { record, id, label, framework, expiresAt, publishRecovered, publishError } = input;
-  const receipt = record.receipt && typeof record.receipt === "object" ? parseRiddlePreviewReceipt(record.receipt) : void 0;
-  return {
-    ok: true,
-    id: String(record.id || record.preview_id || id),
-    label,
-    framework,
-    preview_url: String(record.preview_url || ""),
-    file_count: typeof record.file_count === "number" ? record.file_count : void 0,
-    total_bytes: typeof record.total_bytes === "number" ? record.total_bytes : void 0,
-    expires_at: receipt?.expires_at || expiresAt,
-    receipt,
-    publish_recovered: publishRecovered || void 0,
-    publish_error: publishError,
-    warnings: input.warnings?.length ? input.warnings : void 0,
-    raw: record
-  };
-}
-function gitOutput(directory, args) {
-  try {
-    return (0, import_node_child_process4.execFileSync)("git", ["-C", directory, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function detectRiddlePreviewSource(directory) {
-  const gitRevision = gitOutput(directory, ["rev-parse", "HEAD"]);
-  if (!gitRevision) return {};
-  const repository = gitOutput(directory, ["config", "--get", "remote.origin.url"]);
-  const status = gitOutput(directory, ["status", "--porcelain", "--untracked-files=normal"]);
-  return {
-    git_revision: gitRevision,
-    repository: repository || void 0,
-    dirty: Boolean(status)
-  };
-}
-function canRecoverPreviewPublish(error) {
-  return error instanceof RiddleApiError && PREVIEW_PUBLISH_RECOVERY_STATUSES.has(error.status);
-}
-function summarizePreviewDirectory(directory) {
-  const stack = [directory];
-  let fileCount = 0;
-  let totalBytes = 0;
-  while (stack.length) {
-    const current = stack.pop();
-    for (const entry of (0, import_node_fs5.readdirSync)(current, { withFileTypes: true })) {
-      const fullPath = import_node_path5.default.join(current, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      const stat = (0, import_node_fs5.statSync)(fullPath);
-      fileCount += 1;
-      totalBytes += stat.size;
-    }
-  }
-  return { file_count: fileCount, total_bytes: totalBytes };
-}
-function previewProgressEmitter(config, base) {
-  return async (snapshot) => {
-    if (!config.onPreviewProgress) return;
-    await config.onPreviewProgress({
-      label: base.label,
-      framework: base.framework,
-      directory: base.directory,
-      elapsed_ms: Math.max(0, Date.now() - base.startedAt),
-      warnings: base.warnings?.length ? base.warnings : void 0,
-      ...snapshot
-    });
-  };
-}
-async function waitForPublishedPreview(config, input) {
-  await input.emitProgress?.({
-    stage: "publish_recovering",
-    id: input.id,
-    file_count: input.localSummary?.file_count,
-    total_bytes: input.localSummary?.total_bytes,
-    publish_error: input.publishError.message,
-    message: `publish returned ${input.publishError.status}; polling preview status`
-  });
-  for (let attempt = 1; attempt <= PREVIEW_PUBLISH_RECOVERY_ATTEMPTS; attempt += 1) {
-    const status = await riddleRequestJson(config, `/v1/preview/${input.id}`);
-    await input.emitProgress?.({
-      stage: "checking_status",
-      id: input.id,
-      attempt,
-      attempts: PREVIEW_PUBLISH_RECOVERY_ATTEMPTS,
-      status: typeof status.status === "string" ? status.status : null,
-      preview_url: typeof status.preview_url === "string" ? status.preview_url : void 0,
-      file_count: typeof status.file_count === "number" ? status.file_count : input.localSummary?.file_count,
-      total_bytes: typeof status.total_bytes === "number" ? status.total_bytes : input.localSummary?.total_bytes
-    });
-    if (String(status.status || "") === "ready" && String(status.preview_url || "").trim()) {
-      await input.emitProgress?.({
-        stage: "ready",
-        id: input.id,
-        preview_url: String(status.preview_url),
-        file_count: typeof status.file_count === "number" ? status.file_count : input.localSummary?.file_count,
-        total_bytes: typeof status.total_bytes === "number" ? status.total_bytes : input.localSummary?.total_bytes
-      });
-      return previewDeployResultFromRecord({
-        record: status,
-        id: input.id,
-        label: input.label,
-        framework: input.framework,
-        expiresAt: input.expiresAt,
-        publishRecovered: true,
-        publishError: input.publishError.message,
-        warnings: input.warnings
-      });
-    }
-    if (attempt < PREVIEW_PUBLISH_RECOVERY_ATTEMPTS) {
-      await new Promise((resolve) => setTimeout(resolve, PREVIEW_PUBLISH_RECOVERY_INTERVAL_MS));
-    }
-  }
-  throw input.publishError;
-}
-async function deployRiddlePreview(config, directory, label, framework = "static", options = {}) {
-  if (!directory?.trim()) throw new Error("directory is required");
-  if (!label?.trim()) throw new Error("label is required");
-  if (framework !== "spa" && framework !== "static") throw new Error("framework must be spa or static");
-  const startedAt = Date.now();
-  const warnings = collectRiddlePreviewDeployWarnings(directory, framework);
-  const source = options.source || detectRiddlePreviewSource(directory);
-  const emitProgress = previewProgressEmitter(config, { label, framework, directory, startedAt, warnings });
-  await emitProgress({ stage: "validating", message: "checking preview input directory" });
-  const localSummary = summarizePreviewDirectory(directory);
-  await emitProgress({
-    stage: "creating",
-    file_count: localSummary.file_count,
-    total_bytes: localSummary.total_bytes,
-    message: "creating preview upload target"
-  });
-  const created = await riddleRequestJson(config, "/v1/preview", {
-    method: "POST",
-    body: JSON.stringify({ framework, label, source })
-  });
-  const id = String(created.id || "");
-  const uploadUrl = String(created.upload_url || "");
-  if (!id || !uploadUrl) throw new Error("Riddle preview create response was missing id or upload_url.");
-  await emitProgress({
-    stage: "created",
-    id,
-    file_count: localSummary.file_count,
-    total_bytes: localSummary.total_bytes,
-    message: "preview upload target created"
-  });
-  const scratch = (0, import_node_fs5.mkdtempSync)(import_node_path5.default.join((0, import_node_os2.tmpdir)(), "riddle-preview-upload-"));
-  const tarball = import_node_path5.default.join(scratch, `${id}.tar.gz`);
-  let tarballBytes = 0;
-  try {
-    await emitProgress({
-      stage: "archiving",
-      id,
-      file_count: localSummary.file_count,
-      total_bytes: localSummary.total_bytes,
-      message: "creating preview archive"
-    });
-    (0, import_node_child_process4.execFileSync)("tar", ["czf", tarball, "-C", directory, "."], { stdio: "pipe" });
-    tarballBytes = (0, import_node_fs5.statSync)(tarball).size;
-    await emitProgress({
-      stage: "archived",
-      id,
-      file_count: localSummary.file_count,
-      total_bytes: localSummary.total_bytes,
-      tarball_bytes: tarballBytes,
-      message: "preview archive created"
-    });
-    await emitProgress({
-      stage: "uploading",
-      id,
-      file_count: localSummary.file_count,
-      total_bytes: localSummary.total_bytes,
-      tarball_bytes: tarballBytes,
-      message: "uploading preview archive"
-    });
-    const upload = await fetchFor(config)(uploadUrl, {
-      method: "PUT",
-      headers: { "Content-Type": "application/gzip" },
-      body: (0, import_node_fs5.readFileSync)(tarball)
-    });
-    if (!upload.ok) {
-      throw new RiddleApiError(uploadUrl, upload.status, await upload.text());
-    }
-    await emitProgress({
-      stage: "uploaded",
-      id,
-      file_count: localSummary.file_count,
-      total_bytes: localSummary.total_bytes,
-      tarball_bytes: tarballBytes,
-      message: "preview archive uploaded"
-    });
-  } finally {
-    (0, import_node_fs5.rmSync)(scratch, { recursive: true, force: true });
-  }
-  const expiresAt = typeof created.expires_at === "string" ? created.expires_at : void 0;
-  try {
-    await emitProgress({
-      stage: "publishing",
-      id,
-      file_count: localSummary.file_count,
-      total_bytes: localSummary.total_bytes,
-      tarball_bytes: tarballBytes || void 0,
-      message: "publishing preview"
-    });
-    const published = await riddleRequestJson(config, `/v1/preview/${id}/publish`, {
-      method: "POST"
-    });
-    await emitProgress({
-      stage: "ready",
-      id,
-      preview_url: String(published.preview_url || ""),
-      file_count: typeof published.file_count === "number" ? published.file_count : localSummary.file_count,
-      total_bytes: typeof published.total_bytes === "number" ? published.total_bytes : localSummary.total_bytes
-    });
-    return previewDeployResultFromRecord({ record: published, id, label, framework, expiresAt, warnings });
-  } catch (error) {
-    if (!canRecoverPreviewPublish(error)) throw error;
-    return waitForPublishedPreview(config, {
-      id,
-      label,
-      framework,
-      expiresAt,
-      publishError: error,
-      warnings,
-      localSummary,
-      emitProgress
-    });
-  }
-}
-function latestMatchingMtimeMs(directory, predicate) {
-  let latest = 0;
-  const stack = [directory];
-  let visited = 0;
-  while (stack.length) {
-    const current = stack.pop();
-    for (const entry of (0, import_node_fs5.readdirSync)(current, { withFileTypes: true })) {
-      const fullPath = import_node_path5.default.join(current, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile() || !predicate(fullPath)) continue;
-      const stat = (0, import_node_fs5.statSync)(fullPath);
-      latest = Math.max(latest, stat.mtimeMs);
-      visited += 1;
-      if (visited >= 1e4) return latest;
-    }
-  }
-  return latest;
-}
-function collectRiddlePreviewDeployWarnings(directory, framework = "static") {
-  try {
-    if (framework !== "static") return [];
-    const resolvedDirectory = import_node_path5.default.resolve(directory);
-    if (import_node_path5.default.basename(resolvedDirectory) !== "out") return [];
-    const repoRoot = import_node_path5.default.dirname(resolvedDirectory);
-    const nextAppDir = import_node_path5.default.join(repoRoot, ".next", "server", "app");
-    if (!(0, import_node_fs5.existsSync)(nextAppDir)) return [];
-    const nextRenderedMtimeMs = latestMatchingMtimeMs(nextAppDir, (filePath) => /\.(?:html|rsc)$/i.test(filePath));
-    if (!nextRenderedMtimeMs) return [];
-    const outRenderedMtimeMs = (0, import_node_fs5.existsSync)(resolvedDirectory) ? latestMatchingMtimeMs(resolvedDirectory, (filePath) => /\.(?:html|txt|rsc)$/i.test(filePath)) : 0;
-    if (!outRenderedMtimeMs) {
-      return [
-        "Riddle Preview static deploy target is an out/ directory with newer Next render output in .next/server/app, but no rendered HTML/RSC files were found in out/. Run the project static bundle/export step before deploying."
-      ];
-    }
-    if (nextRenderedMtimeMs > outRenderedMtimeMs + 1e3) {
-      return [
-        "Riddle Preview static deploy target out/ appears older than the Next render output in .next/server/app. Run the project static bundle/export step, such as npm run build:static-deploy or next export, before deploying to avoid a stale Preview."
-      ];
-    }
-    return [];
-  } catch {
-    return [];
-  }
-}
-async function deployRiddleStaticPreview(config, directory, label, options = {}) {
-  return deployRiddlePreview(config, directory, label, "static", options);
-}
-function createTarball(directory, label, exclude = []) {
-  const scratch = (0, import_node_fs5.mkdtempSync)(import_node_path5.default.join((0, import_node_os2.tmpdir)(), "riddle-upload-"));
-  const tarball = import_node_path5.default.join(scratch, `${label}.tar.gz`);
-  const excludeArgs = exclude.flatMap((item) => ["--exclude", item]);
-  try {
-    (0, import_node_child_process4.execFileSync)("tar", ["czf", tarball, ...excludeArgs, "-C", directory, "."], { stdio: "pipe" });
-    return { scratch, tarball };
-  } catch (error) {
-    (0, import_node_fs5.rmSync)(scratch, { recursive: true, force: true });
-    throw error;
-  }
-}
-function parseRiddleViewport(value) {
-  if (!value) return void 0;
-  const match = /^(\d+)x(\d+)$/.exec(value.trim());
-  if (!match) throw new Error("viewport must look like 1280x720");
-  return { width: Number(match[1]), height: Number(match[2]) };
-}
-function scriptErrorFrom(job) {
-  const nested = job?.proof_of_execution && typeof job.proof_of_execution === "object" && !Array.isArray(job.proof_of_execution) ? job.proof_of_execution : null;
-  return typeof job?.script_error === "string" && job.script_error.trim() ? job.script_error : typeof nested?.script_error === "string" && nested.script_error.trim() ? nested.script_error : null;
-}
-async function runRiddleServerPreview(config, input) {
-  if (!input.directory?.trim()) throw new Error("directory is required");
-  if (!input.script?.trim()) throw new Error("script is required");
-  const port = input.port || 3e3;
-  const routePath = input.path || "/";
-  const timeoutSec = input.timeoutSec || 180;
-  const created = await riddleRequestJson(config, "/v1/server-preview", {
-    method: "POST",
-    body: JSON.stringify({
-      image: input.image || "node:22-slim",
-      command: input.command || "node scripts/riddleSpaPreviewServer.mjs build 3000",
-      port,
-      path: routePath,
-      readiness_path: input.readinessPath || routePath,
-      readiness_timeout: input.readinessTimeoutSec || 90,
-      wait_until: input.waitUntil || "domcontentloaded",
-      wait_for_selector: input.waitForSelector || "body",
-      navigation_timeout: input.navigationTimeoutSec || 60,
-      viewport: input.viewport,
-      timeout: timeoutSec,
-      script: input.script
-    })
-  });
-  const jobId = String(created.job_id || "");
-  const uploadUrl = String(created.upload_url || "");
-  if (!jobId || !uploadUrl) {
-    throw new Error(`Riddle server preview create response was missing job_id or upload_url.`);
-  }
-  const { scratch, tarball } = createTarball(input.directory, jobId, [
-    ".git",
-    "node_modules",
-    "test-results",
-    ...input.exclude || []
-  ]);
-  try {
-    const upload = await fetchFor(config)(uploadUrl, {
-      method: "PUT",
-      headers: { "Content-Type": "application/gzip" },
-      body: (0, import_node_fs5.readFileSync)(tarball)
-    });
-    if (!upload.ok) throw new RiddleApiError(uploadUrl, upload.status, await upload.text());
-  } finally {
-    (0, import_node_fs5.rmSync)(scratch, { recursive: true, force: true });
-  }
-  await riddleRequestJson(config, `/v1/server-preview/${jobId}/start`, {
-    method: "POST"
-  });
-  let job = null;
-  const attempts = input.pollAttempts || Math.ceil((timeoutSec + 90) / 2);
-  const intervalMs = input.pollIntervalMs || 2e3;
-  for (let index = 0; index < attempts; index += 1) {
-    job = await riddleRequestJson(config, `/v1/server-preview/${jobId}`);
-    if (isTerminalRiddleJobStatus(job.status)) break;
-    if (index + 1 < attempts) await new Promise((resolve) => setTimeout(resolve, intervalMs));
-  }
-  const status = job?.status ? String(job.status) : null;
-  const scriptError = scriptErrorFrom(job);
-  return {
-    ok: (status === "completed" || status === "complete") && !scriptError,
-    job_id: jobId,
-    status,
-    terminal: isTerminalRiddleJobStatus(status),
-    script_error: scriptError,
-    job
-  };
-}
-async function runRiddleScript(config, input) {
-  if (!input.url?.trim()) throw new Error("url is required");
-  if (!input.script?.trim()) throw new Error("script is required");
-  const payload = {
-    url: input.url,
-    script: input.script,
-    sync: input.sync ?? false,
-    timeout_sec: input.timeoutSec || 120
-  };
-  if (input.viewport) payload.viewport = input.viewport;
-  if (input.include) payload.include = input.include;
-  if (typeof input.strict === "boolean") payload.strict = input.strict;
-  if (input.options) payload.options = input.options;
-  return riddleRequestJson(config, "/v1/run", {
-    method: "POST",
-    body: JSON.stringify(payload)
-  });
-}
-function isTerminalRiddleJobStatus(status) {
-  return ["completed", "complete", "completed_error", "completed_timeout", "failed"].includes(String(status || ""));
-}
-function stringField(record, key) {
-  const value = record?.[key];
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function parseTimestampMs(value) {
-  if (!value) return null;
-  const parsed = Date.parse(value);
-  return Number.isFinite(parsed) ? parsed : null;
-}
-function buildPollSnapshot(jobId, job, input) {
-  const status = job?.status ? String(job.status) : null;
-  const phase = job?.phase ? String(job.phase) : null;
-  const terminal = isTerminalRiddleJobStatus(status);
-  const createdAt = stringField(job, "created_at");
-  const submittedAt = stringField(job, "submitted_at");
-  const completedAt = stringField(job, "completed_at");
-  const createdMs = parseTimestampMs(createdAt);
-  const submittedMs = parseTimestampMs(submittedAt);
-  const rawExecution = job?.execution && typeof job.execution === "object" && !Array.isArray(job.execution) ? job.execution : null;
-  const enqueuedAt = rawExecution ? stringField(rawExecution, "enqueued_at") : null;
-  const enqueuedMs = parseTimestampMs(enqueuedAt);
-  const queueStartedMs = enqueuedMs ?? createdMs;
-  const claimedAt = rawExecution ? stringField(rawExecution, "claimed_at") : null;
-  const claimedMs = parseTimestampMs(claimedAt);
-  let queueElapsedMs = null;
-  if (queueStartedMs !== null && claimedMs !== null) {
-    queueElapsedMs = Math.max(0, claimedMs - queueStartedMs);
-  } else if (queueStartedMs !== null && submittedMs !== null) {
-    queueElapsedMs = Math.max(0, submittedMs - queueStartedMs);
-  } else if (queueStartedMs !== null && !submittedAt && !terminal) {
-    queueElapsedMs = Math.max(0, input.observedAt - queueStartedMs);
-  }
-  return {
-    job_id: jobId,
-    status,
-    phase,
-    terminal,
-    attempt: input.attempt,
-    attempts: input.attempts,
-    elapsed_ms: Math.max(0, input.observedAt - input.startedAt),
-    created_at: createdAt,
-    submitted_at: submittedAt,
-    completed_at: completedAt,
-    queue_elapsed_ms: queueElapsedMs,
-    pre_submission_elapsed_ms: Math.max(0, Math.floor(input.preSubmissionElapsedMs ?? 0)),
-    running_without_submission: Boolean(status && !terminal && !submittedAt),
-    active_execution: Boolean(status === "running" && phase && phase !== "queued"),
-    execution: rawExecution ? rawExecution : void 0
-  };
-}
-function pollMessage(snapshot, timedOut) {
-  if (!timedOut) return void 0;
-  const submitted = snapshot.submitted_at || "not submitted";
-  const wakeHint = snapshot.running_without_submission && !snapshot.created_at && !snapshot.submitted_at ? ` ${RIDDLE_UNSUBMITTED_WAKE_HINT}.` : "";
-  const queue = snapshot.queue_elapsed_ms !== null ? ` queue_elapsed_ms=${snapshot.queue_elapsed_ms}` : "";
-  const preSubmit = snapshot.pre_submission_elapsed_ms > 0 ? ` pre_submission_elapsed_ms=${snapshot.pre_submission_elapsed_ms}` : "";
-  return `Riddle job ${snapshot.job_id} did not reach a terminal status after ${snapshot.attempt} poll attempts; status=${snapshot.status || "unknown"} phase=${snapshot.phase || "unknown"} submitted_at=${submitted}.${wakeHint}${queue}${preSubmit}`;
-}
-async function pollRiddleJob(config, jobId, options = {}) {
-  if (!jobId?.trim()) throw new Error("jobId is required");
-  const attempts = Math.max(1, Math.floor(options.attempts ?? (options.wait ? 300 : 1)));
-  const intervalMs = Math.max(0, Math.floor(options.intervalMs ?? 2e3));
-  const progressEveryMs = Math.max(0, Math.floor(options.progressEveryMs ?? 1e4));
-  const unsubmittedTimeoutMs = Math.max(0, Math.floor(options.unsubmittedTimeoutMs ?? 0));
-  const startedAt = Date.now();
-  let job = null;
-  let lastSnapshot = null;
-  let lastProgressAt = 0;
-  let lastProgressKey = "";
-  let preSubmissionElapsedMs = 0;
-  let unsubmittedTimedOut = false;
-  for (let index = 0; index < attempts; index += 1) {
-    job = await riddleRequestJson(config, `/v1/jobs/${jobId}`);
-    const observedAt = Date.now();
-    const nextSnapshot = buildPollSnapshot(jobId, job, {
-      attempt: index + 1,
-      attempts,
-      startedAt,
-      observedAt,
-      preSubmissionElapsedMs
-    });
-    if (nextSnapshot.running_without_submission) {
-      preSubmissionElapsedMs = Math.max(preSubmissionElapsedMs, nextSnapshot.elapsed_ms);
-    }
-    lastSnapshot = {
-      ...nextSnapshot,
-      pre_submission_elapsed_ms: preSubmissionElapsedMs
-    };
-    const progressKey = [
-      lastSnapshot.status || "unknown",
-      lastSnapshot.phase || "unknown",
-      lastSnapshot.terminal ? "terminal" : "nonterminal",
-      lastSnapshot.submitted_at ? "submitted" : "unsubmitted"
-    ].join(":");
-    if (options.onProgress) {
-      const shouldReport = index === 0 || lastSnapshot.terminal || progressKey !== lastProgressKey || observedAt - lastProgressAt >= progressEveryMs;
-      if (shouldReport) {
-        lastProgressAt = observedAt;
-        lastProgressKey = progressKey;
-        await options.onProgress(lastSnapshot);
-      }
-    }
-    unsubmittedTimedOut = Boolean(
-      options.wait && unsubmittedTimeoutMs > 0 && lastSnapshot.running_without_submission && !lastSnapshot.created_at && !lastSnapshot.submitted_at && preSubmissionElapsedMs >= unsubmittedTimeoutMs
-    );
-    if (lastSnapshot.terminal) break;
-    if (unsubmittedTimedOut) break;
-    if (index + 1 < attempts) {
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
-    }
-  }
-  const status = job?.status ? String(job.status) : null;
-  const fallbackObservedAt = Date.now();
-  const snapshot = lastSnapshot || buildPollSnapshot(jobId, job, {
-    attempt: 0,
-    attempts,
-    startedAt,
-    observedAt: fallbackObservedAt
-  });
-  if (!isTerminalRiddleJobStatus(status)) {
-    const timedOut = Boolean(options.wait);
-    return {
-      ok: !timedOut,
-      job_id: jobId,
-      status,
-      terminal: false,
-      job,
-      poll: {
-        ...snapshot,
-        timed_out: timedOut,
-        interval_ms: intervalMs,
-        unsubmitted_timeout: unsubmittedTimedOut || void 0,
-        unsubmitted_timeout_ms: unsubmittedTimedOut ? unsubmittedTimeoutMs : void 0,
-        message: pollMessage(snapshot, timedOut)
-      }
-    };
-  }
-  const artifacts = await riddleRequestJson(config, `/v1/jobs/${jobId}/artifacts`);
-  return {
-    ok: status === "completed" || status === "complete",
-    job_id: jobId,
-    status,
-    terminal: true,
-    job,
-    artifacts,
-    poll: {
-      ...snapshot,
-      timed_out: false,
-      interval_ms: intervalMs
-    }
-  };
-}
-function createRiddleApiClient(config = {}) {
-  return {
-    apiKeySource: () => resolveRiddleApiKeySource(config),
-    requestJson: (pathname, init) => riddleRequestJson(config, pathname, init),
-    getBalance: () => getRiddleBalance(config),
-    deployPreview: (directory, label, framework = "static", options) => deployRiddlePreview(config, directory, label, framework, options),
-    deployStaticPreview: (directory, label, options) => deployRiddleStaticPreview(config, directory, label, options),
-    runScript: (input) => runRiddleScript(config, input),
-    runServerPreview: (input) => runRiddleServerPreview(config, input),
-    pollJob: (jobId, options) => pollRiddleJob(config, jobId, options)
-  };
-}
+var import_client = require("@riddledc/riddle-proof-riddle-client/client");
 
 // src/pr-comment.ts
 var RIDDLE_PROOF_PR_COMMENT_MARKER = "<!-- riddle-proof:pr-comment:v1 -->";
@@ -23262,7 +21482,7 @@ function pageSummaries(result) {
   }
   return pages;
 }
-function profileCheckCounts3(result) {
+function profileCheckCounts2(result) {
   const checks = asArray(result.checks);
   if (checks.length) {
     let passed2 = 0;
@@ -23401,7 +21621,7 @@ function summarizeRiddleProofPrComment(input) {
   const resultDetails = asRecord2(result.details);
   const resultRaw = asRecord2(result.raw);
   const rawDetails = asRecord2(resultRaw.details);
-  const profileChecks = profileResult ? profileCheckCounts3(result) : void 0;
+  const profileChecks = profileResult ? profileCheckCounts2(result) : void 0;
   const changeChecks = changeResult ? changeReceiptCheckCounts(result) : void 0;
   const artifacts = mergeArtifacts(
     collectArtifacts(runResponse),
@@ -23672,6 +21892,7 @@ function buildRiddleProofPrCommentMarkdown(input) {
   DEFAULT_DIAGNOSTIC_STRING_LIMIT,
   DEFAULT_RIDDLE_API_BASE_URL,
   DEFAULT_RIDDLE_API_KEY_FILE,
+  RIDDLE_BALANCE_ENDPOINT_PATH,
   RIDDLE_PREVIEW_RECEIPT_VERSION,
   RIDDLE_PROOF_BASIC_GAMEPLAY_ASSESSMENT_VERSION,
   RIDDLE_PROOF_BASIC_GAMEPLAY_CATCH_VERSION,
@@ -23681,8 +21902,39 @@ function buildRiddleProofPrCommentMarkdown(input) {
   RIDDLE_PROOF_CHANGE_RECEIPT_V1_VERSION,
   RIDDLE_PROOF_CHANGE_RECEIPT_VERSION,
   RIDDLE_PROOF_CHANGE_RESULT_VERSION,
+  RIDDLE_PROOF_CHECKED_MEANING_ASSURANCE,
+  RIDDLE_PROOF_CHECKED_MEANING_CLOSURE_VERSION,
+  RIDDLE_PROOF_CHECKED_MEANING_MATERIALIZED_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_AGE_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_CONSUMPTION_WINDOW_MS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PARAMETERS,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_PREMISES,
+  RIDDLE_PROOF_CHECKED_MEANING_MAX_RULES,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_DIGEST_DOMAIN,
+  RIDDLE_PROOF_CHECKED_MEANING_RULE_ENGINE,
   RIDDLE_PROOF_CHECKPOINT_PACKET_VERSION,
   RIDDLE_PROOF_CHECKPOINT_RESPONSE_VERSION,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACTS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_OBSERVATION_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TIME_WINDOW_MS,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_CAPTURE_STATEMENT_VERSION,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_DEFINITION_DIGEST_DOMAIN,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_CONTRACT_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_JSON_VERIFIER_ENGINE,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_ASSERTIONS,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_DEFINITION_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_BYTES,
+  RIDDLE_PROOF_GROUNDED_DECLARATIVE_MAX_POINTER_SEGMENTS,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_CONFIG_BYTES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_REGISTRY_ENTRIES,
+  RIDDLE_PROOF_GROUNDED_REPLAY_MAX_AGGREGATE_TRUSTED_KEY_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_METADATA_BYTES,
+  RIDDLE_PROOF_GROUNDED_SEMANTIC_CLOSURE_MAX_TOTAL_ARTIFACT_BYTES,
+  RIDDLE_PROOF_GROUNDED_VERIFICATION_RECEIPT_VERSION,
   RIDDLE_PROOF_HANDOFF_RECEIPT_VERSION,
   RIDDLE_PROOF_HOSTED_PROFILE_ARTIFACTS,
   RIDDLE_PROOF_OBSERVATION_RECEIPT_VERSION,
@@ -23703,6 +21955,8 @@ function buildRiddleProofPrCommentMarkdown(input) {
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_MAX_CERTIFICATES,
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_CLOSURE_VERSION,
   RIDDLE_PROOF_SEMANTIC_CERTIFICATE_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_BUNDLE_VERSION,
+  RIDDLE_PROOF_SIGNED_CAPTURE_SIGNATURE_DOMAIN,
   RIDDLE_PROOF_VISUAL_SESSION_FINGERPRINT_VERSION,
   RIDDLE_PROOF_VISUAL_SESSION_VERSION,
   RIDDLE_UNSUBMITTED_WAKE_HINT,
@@ -23720,6 +21974,7 @@ function buildRiddleProofPrCommentMarkdown(input) {
   assessBasicGameplayRoute,
   assessPlayabilityEvidence,
   assessRiddleProofChange,
+  assessRiddleProofCheckedMeaningClosure,
   assessRiddleProofOrderedTrace,
   assessRiddleProofOrderedTraceSetupResults,
   assessRiddleProofProfileArtifactCompleteness,
@@ -23744,6 +21999,8 @@ function buildRiddleProofPrCommentMarkdown(input) {
   compactBasicGameplayText,
   compactRecord,
   compareVisualProofSessionFingerprint,
+  composeRiddleProofCheckedMeaningClosures,
+  composeRiddleProofGroundedSemanticCertificateClosures,
   composeRiddleProofSemanticCertificateClosures,
   composeRiddleProofSemanticCertificates,
   createBasicGameplayCatchRecords,
@@ -23757,6 +22014,12 @@ function buildRiddleProofPrCommentMarkdown(input) {
   createLocalAgentJsonRunner,
   createRiddleApiClient,
   createRiddleProofChangeReceipt,
+  createRiddleProofCheckedMeaningAtomicClosure,
+  createRiddleProofCheckedMeaningRule,
+  createRiddleProofGroundedDeclarativeJsonContract,
+  createRiddleProofGroundedDeclarativeJsonVerifier,
+  createRiddleProofGroundedSemanticAtomicCertificateClosure,
+  createRiddleProofGroundedSemanticCertificate,
   createRiddleProofHandoffReceipt,
   createRiddleProofObservationReceipt,
   createRiddleProofProfileConfigurationError,
@@ -23765,6 +22028,7 @@ function buildRiddleProofPrCommentMarkdown(input) {
   createRiddleProofRunCard,
   createRiddleProofSemanticAtomicCertificateClosure,
   createRiddleProofSemanticCertificate,
+  createRiddleProofSignedCaptureBundle,
   createRunResult,
   createRunState,
   createRunStatusSnapshot,
@@ -23776,12 +22040,15 @@ function buildRiddleProofPrCommentMarkdown(input) {
   extractPlayabilityEvidence,
   extractRiddleProofProfileResult,
   getRiddleBalance,
+  getRiddleJobArtifacts,
   isDuplicateCheckpointResponse,
   isProtectedFinalStatus,
   isRiddleProofPlayabilityMode,
   isSuccessfulStatus,
   isTerminalRiddleJobStatus,
   isTerminalStatus,
+  matchRiddleProofCheckedMeaningClosure,
+  matchRiddleProofGroundedSemanticCertificateClosure,
   matchRiddleProofSemanticCertificate,
   matchRiddleProofSemanticCertificateClosure,
   migrateRiddleProofChangeReceipt,
@@ -23809,6 +22076,8 @@ function buildRiddleProofPrCommentMarkdown(input) {
   readRiddleProofRunStatus,
   recordValue,
   redactForProofDiagnostics,
+  replayRiddleProofCheckedMeaningClosure,
+  replayRiddleProofGroundedSemanticCertificate,
   resolveBasicGameplayProgressionCheckWithArtifactScreenshots,
   resolveRiddleApiKey,
   resolveRiddleApiKeySource,
@@ -23841,7 +22110,10 @@ function buildRiddleProofPrCommentMarkdown(input) {
   summarizeRiddleProofProfileResult,
   summarizeRiddleProofPublicConsumerSurface,
   summarizeRiddleProofPublicState,
+  validateRiddleProofCheckedMeaningClosure,
+  validateRiddleProofGroundedSemanticCertificateClosure,
   validateRiddleProofSemanticCertificateClosure,
+  verifyRiddleProofSignedCaptureBundle,
   visualSessionFingerprint,
   visualSessionFingerprintBasis
 });