@aperant/framework 0.8.0 → 0.8.4

package/dist/cli/verify-proof/audit.mjs

@@ -0,0 +1,53 @@
+/**
+ * audit.mjs — append-only JSONL audit log for driver invocations.
+ *
+ * ID-05: one file per day at .aperant/events/{YYYY-MM-DD}.jsonl.
+ * One line per driver invocation:
+ *   {ts, driver_id, version, manifest_sha256, trust_tier, sandbox_profile,
+ *    decision: "allow|deny|requires_approval",
+ *    result: "success|fail|skip"}
+ *
+ * Append-only — no rewrites. Each appendDriverEvent() opens the file in
+ * 'a' mode and writes a single line; concurrent agents may interleave
+ * lines but no line is ever overwritten.
+ */
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+/**
+ * Compute today's events filename relative to projectDir.
+ * @param {string} projectDir
+ * @param {Date} [now]
+ * @returns {string}
+ */
+export function dailyEventsPath(projectDir, now = new Date()) {
+    const yyyy = now.getUTCFullYear();
+    const mm = String(now.getUTCMonth() + 1).padStart(2, '0');
+    const dd = String(now.getUTCDate()).padStart(2, '0');
+    return join(resolve(projectDir), '.aperant/events', `${yyyy}-${mm}-${dd}.jsonl`);
+}
+/**
+ * Append a driver-invocation audit line.
+ *
+ * @param {string} projectDir
+ * @param {Object} entry
+ * @param {string} entry.driver_id
+ * @param {string} entry.version
+ * @param {string} entry.manifest_sha256
+ * @param {string} entry.trust_tier
+ * @param {string} entry.sandbox_profile
+ * @param {'allow' | 'deny' | 'requires_approval'} entry.decision
+ * @param {'success' | 'fail' | 'skip'} entry.result
+ * @param {string} [entry.verb] — IDL verb invoked (optional metadata)
+ * @param {string} [entry.reason] — decision-rationale string (optional)
+ */
+export function appendDriverEvent(projectDir, entry) {
+    const path = dailyEventsPath(projectDir);
+    mkdirSync(dirname(path), { recursive: true });
+    const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        kind: 'driver_invocation',
+        ...entry,
+    });
+    appendFileSync(path, line + '\n', 'utf-8');
+}
+//# sourceMappingURL=audit.mjs.map

package/dist/cli/verify-proof/audit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.mjs","sourceRoot":"","sources":["../../../src/cli/verify-proof/audit.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,CAAA;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAU,EAAE,KAAK;IAClD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACxC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,mBAAmB;QACzB,GAAG,KAAK;KACR,CAAC,CAAA;IACF,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3C,CAAC"}

package/dist/cli/verify-proof/exec.d.mts

@@ -0,0 +1,20 @@
+/**
+ * Execute a manifest's local_command transport via execFile (no shell).
+ * Throws if the transport is not the structured variant.
+ *
+ * @param {{transport: unknown}} manifest
+ * @param {string[]} [extraArgs] — appended to manifest.transport.local_command.args.
+ * @param {{cwd?: string, env?: Record<string,string>, timeout?: number}} [options]
+ * @returns {Promise<{stdout: string, stderr: string}>}
+ */
+export function execLocalCommand(manifest: {
+    transport: unknown;
+}, extraArgs?: string[], options?: {
+    cwd?: string;
+    env?: Record<string, string>;
+    timeout?: number;
+}): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+//# sourceMappingURL=exec.d.mts.map

package/dist/cli/verify-proof/exec.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.mts","sourceRoot":"","sources":["../../../src/cli/verify-proof/exec.mjs"],"names":[],"mappings":"AA2CA;;;;;;;;GAQG;AACH,2CALW;IAAC,SAAS,EAAE,OAAO,CAAA;CAAC,cACpB,MAAM,EAAE,YACR;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAC,GAC3D,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,CAAC,CAuBrD"}

package/dist/cli/verify-proof/exec.mjs

@@ -0,0 +1,74 @@
+/**
+ * exec.mjs — execFile-only execution layer for local_command transports.
+ *
+ * ID-03 security invariant: drivers with `transport: { local_command }`
+ * MUST be invoked through execFile (NO shell, NO pipes, NO redirects).
+ *
+ * This module exposes ONE function — execLocalCommand — which:
+ *   1. Asserts the transport is { local_command: { binary, args[] } }
+ *      (the manifest validator already structurally enforces this; this
+ *      is defense-in-depth at runtime).
+ *   2. Rejects any args entry that is not a plain string.
+ *   3. Invokes node:child_process.execFile (NOT child_process.exec, NOT
+ *      spawn with shell:true).
+ *
+ * Grep guard (TD-05): the test verify-proof-local-command-security.test.ts
+ * statically asserts that exec.mjs imports execFile from
+ * 'node:child_process' and never references child_process.exec / spawn
+ * with shell:true.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+/**
+ * Type-check that a transport is the structured local_command variant.
+ * @param {unknown} transport
+ * @returns {transport is {local_command: {binary: string, args: string[]}}}
+ */
+function isStructuredLocalCommand(transport) {
+    if (transport === null || typeof transport !== 'object' || Array.isArray(transport))
+        return false;
+    const obj = /** @type {Record<string, unknown>} */ (transport);
+    if (obj.local_command === null || typeof obj.local_command !== 'object')
+        return false;
+    const lc = /** @type {Record<string, unknown>} */ (obj.local_command);
+    if (typeof lc.binary !== 'string')
+        return false;
+    if (!Array.isArray(lc.args))
+        return false;
+    for (const a of lc.args) {
+        if (typeof a !== 'string')
+            return false;
+    }
+    return true;
+}
+/**
+ * Execute a manifest's local_command transport via execFile (no shell).
+ * Throws if the transport is not the structured variant.
+ *
+ * @param {{transport: unknown}} manifest
+ * @param {string[]} [extraArgs] — appended to manifest.transport.local_command.args.
+ * @param {{cwd?: string, env?: Record<string,string>, timeout?: number}} [options]
+ * @returns {Promise<{stdout: string, stderr: string}>}
+ */
+export async function execLocalCommand(manifest, extraArgs = [], options = {}) {
+    const transport = manifest.transport;
+    if (!isStructuredLocalCommand(transport)) {
+        throw new Error(`execLocalCommand: transport is not a structured local_command — refusing to invoke. Got: ${JSON.stringify(transport)}`);
+    }
+    const { binary, args } = transport.local_command;
+    for (const arg of extraArgs) {
+        if (typeof arg !== 'string') {
+            throw new Error(`execLocalCommand: extraArgs must be strings, got ${typeof arg}`);
+        }
+    }
+    return execFileAsync(binary, [...args, ...extraArgs], {
+        cwd: options.cwd,
+        env: options.env,
+        timeout: options.timeout,
+        // Explicit — never pass shell:true. execFile defaults to no shell, but
+        // we surface the invariant in code for grep-guard purposes.
+        shell: false,
+    });
+}
+//# sourceMappingURL=exec.mjs.map

package/dist/cli/verify-proof/exec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.mjs","sourceRoot":"","sources":["../../../src/cli/verify-proof/exec.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,SAAS;IAC1C,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACjG,MAAM,GAAG,GAAG,sCAAsC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,EAAE,GAAG,sCAAsC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACrE,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAQ,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IAC5E,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IACpC,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACd,4FAA4F,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACvH,CAAA;IACF,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAA;IAChD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,OAAO,GAAG,EAAE,CAAC,CAAA;QAClF,CAAC;IACF,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE;QACrD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,uEAAuE;QACvE,4DAA4D;QAC5D,KAAK,EAAE,KAAK;KACZ,CAAC,CAAA;AACH,CAAC"}

package/dist/cli/verify-proof/idl/index.d.mts

@@ -0,0 +1,2 @@
+export { ASSERTION_VERBS, ASYNC_VERBS, EVIDENCE_VERBS, IDL_VERB_ARGS, IDL_VERB_NAMES, INTERACTION_VERBS, isVerbResult, LIFECYCLE_VERBS, validateVerbArgs } from "@aperant/driver-sdk";
+//# sourceMappingURL=index.d.mts.map

package/dist/cli/verify-proof/idl/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../../src/cli/verify-proof/idl/index.mjs"],"names":[],"mappings":""}

package/dist/cli/verify-proof/idl/index.mjs

@@ -0,0 +1,14 @@
+/**
+ * idl/index.mjs — framework-side re-export of the IDL v1 runtime registry.
+ *
+ * The SINGLE SOURCE OF TRUTH lives in `@aperant/driver-sdk` (idl.ts) — see
+ * ID-04 in spec.md. This file just re-exports those runtime values so
+ * framework-internal callers (bundled drivers, resolver, driver-doctor,
+ * conformance kit) can import from the existing relative path without
+ * paying the cost of refactoring every callsite.
+ *
+ * If you add a verb, edit packages/framework-driver-sdk/src/idl.ts. This
+ * file requires no maintenance.
+ */
+export { ASSERTION_VERBS, ASYNC_VERBS, EVIDENCE_VERBS, IDL_VERB_ARGS, IDL_VERB_NAMES, INTERACTION_VERBS, isVerbResult, LIFECYCLE_VERBS, validateVerbArgs, } from '@aperant/driver-sdk';
+//# sourceMappingURL=index.mjs.map

package/dist/cli/verify-proof/idl/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../../src/cli/verify-proof/idl/index.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,gBAAgB,GAChB,MAAM,qBAAqB,CAAA"}

package/dist/cli/verify-proof/idl/types.d.ts

@@ -0,0 +1,9 @@
+/**
+ * idl/types.ts — re-export the SDK's IDL types for framework-internal use.
+ *
+ * Single source of truth lives in `@aperant/driver-sdk/idl.ts`. Framework
+ * code imports from here so future moves (e.g. an internal-only IDL
+ * extension) only touch this re-export, not every call site.
+ */
+export type { AssertNetworkArgs, AssertOutputArgs, AssertTextArgs, AssertVisibleArgs, AwaitSignalArgs, CaptureLogsArgs, ClickArgs, DomDumpArgs, DragDropArgs, DriverModule, DumpStateArgs, ExecuteJsArgs, Handle, IdlVerbName, KeyArgs, LaunchArgs, NavigateArgs, RecordVideoArgs, ScreenshotArgs, SelectArgs, SwipeArgs, SwitchContextArgs, Target, TargetKind, TeardownArgs, TriggerArgs, TypeArgs, UploadFileArgs, VerbResult, WaitForEventArgs, WaitForIdleArgs, } from '@aperant/driver-sdk';
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/verify-proof/idl/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cli/verify-proof/idl/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,MAAM,EACN,WAAW,EACX,OAAO,EACP,UAAU,EACV,YAAY,EACZ,eAAe,EACf,cAAc,EACd,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,eAAe,GACf,MAAM,qBAAqB,CAAA"}

package/dist/cli/verify-proof/idl/types.js

@@ -0,0 +1,9 @@
+/**
+ * idl/types.ts — re-export the SDK's IDL types for framework-internal use.
+ *
+ * Single source of truth lives in `@aperant/driver-sdk/idl.ts`. Framework
+ * code imports from here so future moves (e.g. an internal-only IDL
+ * extension) only touch this re-export, not every call site.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cli/verify-proof/idl/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/verify-proof/idl/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/cli/verify-proof/manifest-validator.d.mts

@@ -0,0 +1,19 @@
+/** Read the bundled manifest-schema.json. */
+export function loadManifestSchema(): any;
+/**
+ * Validate a manifest object against the bundled schema.
+ *
+ * @param {unknown} manifest — usually JSON.parse(manifest.json contents).
+ * @param {object} [schema] — override the bundled schema (used by tests).
+ * @returns {{valid: true} | {valid: false, errors: Array<{path: string, message: string}>}}
+ */
+export function validateManifest(manifest: unknown, schema?: object): {
+    valid: true;
+} | {
+    valid: false;
+    errors: Array<{
+        path: string;
+        message: string;
+    }>;
+};
+//# sourceMappingURL=manifest-validator.d.mts.map

package/dist/cli/verify-proof/manifest-validator.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validator.d.mts","sourceRoot":"","sources":["../../../src/cli/verify-proof/manifest-validator.mjs"],"names":[],"mappings":"AA2BA,6CAA6C;AAC7C,0CAKC;AAED;;;;;;GAMG;AACH,2CAJW,OAAO,WACP,MAAM,GACJ;IAAC,KAAK,EAAE,IAAI,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAQ1F"}

package/dist/cli/verify-proof/manifest-validator.mjs

@@ -0,0 +1,182 @@
+/**
+ * manifest-validator.mjs — hand-rolled JSON-Schema subset validator.
+ *
+ * Validates driver manifests against manifest-schema.json. Implements
+ * exactly the JSON-Schema keywords we need:
+ *
+ *   type / required / properties / items / enum / const / pattern / oneOf
+ *
+ * Returns { valid: true } or { valid: false, errors: [{ path, message }] }
+ * where `path` is a JSON-pointer (`/transport/local_command/binary`).
+ *
+ * No external deps — keeps the validator installable as `dist/` with the
+ * framework package and avoids dragging ajv (or any v5+ JSON-Schema
+ * validator) into the runtime surface for ~80 lines of validator code per
+ * AC15. We don't need allOf / anyOf / definitions — manifest-schema.json
+ * is intentionally a thin contract.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/** Lazy-loaded JSON-Schema (read once on first call). */
+let cachedSchema = null;
+/** Read the bundled manifest-schema.json. */
+export function loadManifestSchema() {
+    if (cachedSchema !== null)
+        return cachedSchema;
+    const schemaPath = join(__dirname, 'manifest-schema.json');
+    cachedSchema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
+    return cachedSchema;
+}
+/**
+ * Validate a manifest object against the bundled schema.
+ *
+ * @param {unknown} manifest — usually JSON.parse(manifest.json contents).
+ * @param {object} [schema] — override the bundled schema (used by tests).
+ * @returns {{valid: true} | {valid: false, errors: Array<{path: string, message: string}>}}
+ */
+export function validateManifest(manifest, schema) {
+    const root = schema ?? loadManifestSchema();
+    const errors = [];
+    validateNode(manifest, root, '', errors);
+    if (errors.length === 0)
+        return { valid: true };
+    return { valid: false, errors };
+}
+/** Type check — JSON-Schema's union of "string", "number", "object", "array", "boolean", "null". */
+function checkType(value, type) {
+    if (type === 'string')
+        return typeof value === 'string';
+    if (type === 'number')
+        return typeof value === 'number' && !Number.isNaN(value);
+    if (type === 'integer')
+        return typeof value === 'number' && Number.isInteger(value);
+    if (type === 'boolean')
+        return typeof value === 'boolean';
+    if (type === 'null')
+        return value === null;
+    if (type === 'array')
+        return Array.isArray(value);
+    if (type === 'object') {
+        return value !== null && typeof value === 'object' && !Array.isArray(value);
+    }
+    return false;
+}
+/**
+ * Human-readable name for the actual shape of a value. Distinguishes
+ * `null`, `array`, and plain `object` — JS `typeof` reports all three as
+ * `'object'`, which makes error messages like "expected type object, got
+ * object" misleading.
+ *
+ * @param {unknown} value
+ * @returns {string}
+ */
+function describeType(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value;
+}
+/**
+ * Recursive validator. `errors` is mutated.
+ *
+ * @param {unknown} value
+ * @param {object} schema
+ * @param {string} path — JSON-pointer
+ * @param {Array<{path: string, message: string}>} errors
+ */
+function validateNode(value, schema, path, errors) {
+    // const
+    if ('const' in schema) {
+        if (value !== schema.const) {
+            errors.push({
+                path: path || '/',
+                message: `expected const ${JSON.stringify(schema.const)}, got ${JSON.stringify(value)}`,
+            });
+            return;
+        }
+    }
+    // type
+    if (schema.type !== undefined) {
+        const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+        if (!types.some((t) => checkType(value, t))) {
+            errors.push({
+                path: path || '/',
+                message: `expected type ${types.join('|')}, got ${describeType(value)}`,
+            });
+            return;
+        }
+    }
+    // enum
+    if (Array.isArray(schema.enum)) {
+        if (!schema.enum.includes(value)) {
+            errors.push({
+                path: path || '/',
+                message: `value ${JSON.stringify(value)} not in enum [${schema.enum.join(', ')}]`,
+            });
+            return;
+        }
+    }
+    // pattern
+    if (typeof schema.pattern === 'string' && typeof value === 'string') {
+        const re = new RegExp(schema.pattern);
+        if (!re.test(value)) {
+            errors.push({
+                path: path || '/',
+                message: `value ${JSON.stringify(value)} does not match pattern ${schema.pattern}`,
+            });
+            return;
+        }
+    }
+    // oneOf
+    if (Array.isArray(schema.oneOf)) {
+        let matchCount = 0;
+        const branchErrors = [];
+        for (let i = 0; i < schema.oneOf.length; i++) {
+            const sub = schema.oneOf[i];
+            const subErrors = [];
+            validateNode(value, sub, path, subErrors);
+            if (subErrors.length === 0)
+                matchCount++;
+            else
+                branchErrors.push({ branch: i, errors: subErrors });
+        }
+        if (matchCount !== 1) {
+            errors.push({
+                path: path || '/',
+                message: matchCount === 0
+                    ? `oneOf: value matched no branch (${branchErrors.length} branches tried)`
+                    : `oneOf: value matched ${matchCount} branches (must match exactly 1)`,
+            });
+            return;
+        }
+    }
+    // object validation
+    if (checkType(value, 'object')) {
+        const obj = /** @type {Record<string, unknown>} */ (value);
+        if (Array.isArray(schema.required)) {
+            for (const key of schema.required) {
+                if (!(key in obj)) {
+                    errors.push({ path: `${path}/${key}`, message: `required property "${key}" missing` });
+                }
+            }
+        }
+        if (schema.properties && typeof schema.properties === 'object') {
+            for (const [key, subSchema] of Object.entries(schema.properties)) {
+                if (key in obj) {
+                    validateNode(obj[key], /** @type {object} */ (subSchema), `${path}/${key}`, errors);
+                }
+            }
+        }
+    }
+    // array validation
+    if (checkType(value, 'array') && schema.items) {
+        const arr = /** @type {unknown[]} */ (value);
+        for (let i = 0; i < arr.length; i++) {
+            validateNode(arr[i], schema.items, `${path}/${i}`, errors);
+        }
+    }
+}
+//# sourceMappingURL=manifest-validator.mjs.map

package/dist/cli/verify-proof/manifest-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validator.mjs","sourceRoot":"","sources":["../../../src/cli/verify-proof/manifest-validator.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD,yDAAyD;AACzD,IAAI,YAAY,GAAG,IAAI,CAAA;AAEvB,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB;IACjC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAA;IAC1D,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,YAAY,CAAA;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAQ,EAAE,MAAM;IAChD,MAAM,IAAI,GAAG,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3C,MAAM,MAAM,GAAG,EAAE,CAAA;IACjB,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC;AAED,oGAAoG;AACpG,SAAS,SAAS,CAAC,KAAK,EAAE,IAAI;IAC7B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAA;IACvD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACnF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,KAAK,SAAS,CAAA;IACzD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,KAAK,IAAI,CAAA;IAC1C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,KAAK;IAC1B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IACxC,OAAO,OAAO,KAAK,CAAA;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAChD,QAAQ;IACR,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,IAAI,GAAG;gBACjB,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;aACvF,CAAC,CAAA;YACF,OAAM;QACP,CAAC;IACF,CAAC;IAED,OAAO;IACP,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,IAAI,GAAG;gBACjB,OAAO,EAAE,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE;aACvE,CAAC,CAAA;YACF,OAAM;QACP,CAAC;IACF,CAAC;IAED,OAAO;IACP,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,IAAI,GAAG;gBACjB,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACjF,CAAC,CAAA;YACF,OAAM;QACP,CAAC;IACF,CAAC;IAED,UAAU;IACV,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,IAAI,GAAG;gBACjB,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,OAAO,EAAE;aAClF,CAAC,CAAA;YACF,OAAM;QACP,CAAC;IACF,CAAC;IAED,QAAQ;IACR,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,MAAM,YAAY,GAAG,EAAE,CAAA;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC3B,MAAM,SAAS,GAAG,EAAE,CAAA;YACpB,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,UAAU,EAAE,CAAA;;gBACnC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,IAAI,GAAG;gBACjB,OAAO,EACN,UAAU,KAAK,CAAC;oBACf,CAAC,CAAC,mCAAmC,YAAY,CAAC,MAAM,kBAAkB;oBAC1E,CAAC,CAAC,wBAAwB,UAAU,kCAAkC;aACxE,CAAC,CAAA;YACF,OAAM;QACP,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,sCAAsC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,GAAG,WAAW,EAAE,CAAC,CAAA;gBACvF,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClE,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;gBACpF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,mBAAmB;IACnB,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAA;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3D,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/cli/verify-proof/resolver.d.mts

@@ -0,0 +1,43 @@
+/**
+ * Score a single driver against the project's runtime + required capabilities.
+ *
+ * @param {DriverManifest & {locality?: 'bundled'|'user'|'registry'}} manifest
+ * @param {RuntimeCapabilities} runtime
+ * @param {string[]} required
+ * @returns {{score: number[], reason?: string}}
+ */
+export function scoreDriver(manifest: DriverManifest & {
+    locality?: "bundled" | "user" | "registry";
+}, runtime: RuntimeCapabilities, required: string[]): {
+    score: number[];
+    reason?: string;
+};
+/**
+ * Resolve the best driver for a given (runtime, drivers, override, required)
+ * tuple.
+ *
+ * @param {Object} opts
+ * @param {DriverManifest[]} opts.drivers — manifests of every discovered driver.
+ * @param {RuntimeCapabilities} opts.runtime — project's runtime capabilities.
+ * @param {string[]} opts.required_capabilities — IDL verbs the test needs.
+ * @param {string[]} [opts.required_stability] — accepted stability values; default ['ga'].
+ * @param {string[]} [opts.override] — config.json:verification.runtimes[]: explicit driverId precedence.
+ * @returns {{selected: DriverManifest, fallback_attempts: Array<{driver_id: string, reason: string}>}}
+ * @throws {UnsatisfiedRequiredCapabilityError} when no driver satisfies a REQUIRED capability.
+ */
+export function resolveDriver(opts: {
+    drivers: DriverManifest[];
+    runtime: RuntimeCapabilities;
+    required_capabilities: string[];
+    required_stability?: string[] | undefined;
+    override?: string[] | undefined;
+}): {
+    selected: DriverManifest;
+    fallback_attempts: Array<{
+        driver_id: string;
+        reason: string;
+    }>;
+};
+export type DriverManifest = import("@aperant/driver-sdk").DriverManifest;
+export type RuntimeCapabilities = import("./runtime-detect.mjs").RuntimeCapabilities;
+//# sourceMappingURL=resolver.d.mts.map

package/dist/cli/verify-proof/resolver.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.mts","sourceRoot":"","sources":["../../../src/cli/verify-proof/resolver.mjs"],"names":[],"mappings":"AA8BA;;;;;;;GAOG;AACH,sCALW,cAAc,GAAG;IAAC,QAAQ,CAAC,EAAE,SAAS,GAAC,MAAM,GAAC,UAAU,CAAA;CAAC,WACzD,mBAAmB,YACnB,MAAM,EAAE,GACN;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,CAU9C;AA0CD;;;;;;;;;;;;GAYG;AACH,oCARG;IAA+B,OAAO,EAA9B,cAAc,EAAE;IACU,OAAO,EAAjC,mBAAmB;IACJ,qBAAqB,EAApC,MAAM,EAAE;IACQ,kBAAkB;IAClB,QAAQ;CAChC,GAAU;IAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;CAAC,CAgErG;6BA3IY,OAAO,qBAAqB,EAAE,cAAc;kCAC5C,OAAO,sBAAsB,EAAE,mBAAmB"}

package/dist/cli/verify-proof/resolver.mjs

@@ -0,0 +1,160 @@
+/**
+ * resolver.mjs — driver selection + fallback chain.
+ *
+ * Given a project's runtime capabilities, the discovered drivers, and the
+ * test's required IDL capabilities, return the best driver — or throw
+ * UnsatisfiedRequiredCapabilityError if no driver in the chain satisfies
+ * a REQUIRED capability (ID-02 fail-closed).
+ *
+ * Scoring (ID-02, ordered high → low):
+ *   1. capability_coverage — how many required capabilities the driver has
+ *   2. compatibility — does the runtime match the manifest.targets?
+ *   3. stability — ga > beta > experimental
+ *   4. priority — higher wins (manifest.priority)
+ *   5. locality — bundled (packages/framework/drivers/) > user-installed
+ *      (.aperant/drivers/) > registry (.aperant/registry-cache/)
+ *
+ * Ties are broken by the next dimension; if every dimension is equal the
+ * driver with the lexicographically smaller driverId wins (deterministic).
+ */
+import { UnsatisfiedRequiredCapabilityError } from '@aperant/driver-sdk';
+/**
+ * @typedef {import('@aperant/driver-sdk').DriverManifest} DriverManifest
+ * @typedef {import('./runtime-detect.mjs').RuntimeCapabilities} RuntimeCapabilities
+ */
+const STABILITY_RANK = { ga: 3, beta: 2, experimental: 1 };
+const LOCALITY_RANK = { bundled: 3, user: 2, registry: 1 };
+/**
+ * Score a single driver against the project's runtime + required capabilities.
+ *
+ * @param {DriverManifest & {locality?: 'bundled'|'user'|'registry'}} manifest
+ * @param {RuntimeCapabilities} runtime
+ * @param {string[]} required
+ * @returns {{score: number[], reason?: string}}
+ */
+export function scoreDriver(manifest, runtime, required) {
+    const caps = new Set(manifest.capabilities ?? []);
+    const coverage = required.filter((c) => caps.has(c)).length;
+    const compatibility = matchesRuntime(manifest, runtime) ? 1 : 0;
+    const stability = STABILITY_RANK[manifest.stability] ?? 0;
+    const priority = manifest.priority ?? 0;
+    const locality = LOCALITY_RANK[manifest.locality ?? 'bundled'] ?? 0;
+    return { score: [coverage, compatibility, stability, priority, locality] };
+}
+/**
+ * Whether a manifest's targets[] mentions a runtime the project has.
+ *
+ * @param {DriverManifest} manifest
+ * @param {RuntimeCapabilities} runtime
+ * @returns {boolean}
+ */
+function matchesRuntime(manifest, runtime) {
+    const targets = manifest.targets ?? [];
+    for (const t of targets) {
+        // Strip any version range suffix (e.g. "electron@>=25" → "electron").
+        const stripped = String(t).split('@')[0].toLowerCase();
+        if (stripped === 'electron' && runtime.is_electron)
+            return true;
+        if (stripped === 'tauri' && runtime.is_tauri)
+            return true;
+        if ((stripped === 'browser' || stripped === 'web') && runtime.is_web_frontend)
+            return true;
+        if (stripped === 'next' && runtime.is_nextjs)
+            return true;
+        if (stripped === 'nuxt' && runtime.is_nuxt)
+            return true;
+        if (stripped === 'expo' && runtime.is_expo)
+            return true;
+        if (stripped === 'react-native' && runtime.is_react_native)
+            return true;
+        if (stripped === 'node' && runtime.has_node)
+            return true;
+        if (stripped === 'cli' && runtime.has_node)
+            return true;
+        if (stripped === 'api' && runtime.has_node)
+            return true;
+        if (stripped === 'fake')
+            return true; // fixture-only — always matches
+    }
+    return false;
+}
+/**
+ * Compare two driver-score tuples lexicographically.
+ * @param {number[]} a
+ * @param {number[]} b
+ * @returns {number}
+ */
+function compareScores(a, b) {
+    for (let i = 0; i < Math.min(a.length, b.length); i++) {
+        if (a[i] !== b[i])
+            return b[i] - a[i]; // higher wins
+    }
+    return 0;
+}
+/**
+ * Resolve the best driver for a given (runtime, drivers, override, required)
+ * tuple.
+ *
+ * @param {Object} opts
+ * @param {DriverManifest[]} opts.drivers — manifests of every discovered driver.
+ * @param {RuntimeCapabilities} opts.runtime — project's runtime capabilities.
+ * @param {string[]} opts.required_capabilities — IDL verbs the test needs.
+ * @param {string[]} [opts.required_stability] — accepted stability values; default ['ga'].
+ * @param {string[]} [opts.override] — config.json:verification.runtimes[]: explicit driverId precedence.
+ * @returns {{selected: DriverManifest, fallback_attempts: Array<{driver_id: string, reason: string}>}}
+ * @throws {UnsatisfiedRequiredCapabilityError} when no driver satisfies a REQUIRED capability.
+ */
+export function resolveDriver(opts) {
+    const drivers = opts.drivers ?? [];
+    const runtime = opts.runtime;
+    const required = opts.required_capabilities ?? [];
+    const stabilityFilter = new Set(opts.required_stability ?? ['ga']);
+    const override = opts.override ?? [];
+    const fallback = [];
+    // Apply override precedence first (config-listed driverIds come first).
+    const overrideOrdered = [];
+    const overrideSet = new Set(override);
+    for (const id of override) {
+        const d = drivers.find((m) => m.driverId === id);
+        if (d)
+            overrideOrdered.push(d);
+    }
+    const remaining = drivers.filter((m) => !overrideSet.has(m.driverId));
+    const ordered = [...overrideOrdered, ...remaining];
+    // Filter by stability; rejected drivers go into fallback_attempts.
+    const stableOnly = [];
+    for (const d of ordered) {
+        if (!stabilityFilter.has(d.stability)) {
+            fallback.push({
+                driver_id: d.driverId,
+                reason: `stability ${d.stability} not in allowed set [${[...stabilityFilter].join(', ')}]`,
+            });
+            continue;
+        }
+        stableOnly.push(d);
+    }
+    // Score every survivor against required capabilities.
+    const scored = stableOnly.map((m) => ({ manifest: m, ...scoreDriver(m, runtime, required) }));
+    // Sort highest-first, tie-break on driverId for determinism.
+    scored.sort((a, b) => {
+        const cmp = compareScores(a.score, b.score);
+        if (cmp !== 0)
+            return cmp;
+        return a.manifest.driverId.localeCompare(b.manifest.driverId);
+    });
+    // Pick the top scorer that covers EVERY required capability. Others go into fallback.
+    for (const candidate of scored) {
+        const caps = new Set(candidate.manifest.capabilities ?? []);
+        const missing = required.filter((c) => !caps.has(c));
+        if (missing.length === 0) {
+            return { selected: candidate.manifest, fallback_attempts: fallback };
+        }
+        fallback.push({
+            driver_id: candidate.manifest.driverId,
+            reason: `missing required capabilities: ${missing.join(', ')}`,
+        });
+    }
+    // Exhausted the chain — fail closed (ID-02).
+    throw new UnsatisfiedRequiredCapabilityError(`No driver in the chain satisfies every required capability: [${required.join(', ')}]`, required[0], fallback);
+}
+//# sourceMappingURL=resolver.mjs.map