@ia-qa/qa-discovery 0.1.0

package/dist/taxonomy.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * The closed, versioned referentials F2 classifies against.
+ *
+ * Closed on purpose: a model that may invent a label produces a vocabulary that
+ * drifts between runs, and two scans of one app stop being comparable — which
+ * kills the diff this package is built around. The model picks from these lists
+ * or refuses; there is no third option.
+ *
+ * THE ADMISSION RULE, and it is what keeps these lists from bloating into
+ * uselessness:
+ *
+ *   > An intent earns its place only if it changes **what you would test**.
+ *
+ * Two labels that lead to the same test plan are one label. This mirrors the
+ * rule `@ia-qa/self-healing`'s `check` uses to refuse new checks ("it must be
+ * able to fail for a reason the diff would not already catch") — without such a
+ * rule every plausible noun becomes a category and the classification stops
+ * discriminating anything.
+ *
+ * TWO AXES, NOT ONE. The original spec asks for "what intention, what data
+ * sensitivity" — those are different questions and collapsing them makes both
+ * wrong. `admin` is not an intent, it is an access dimension: an admin page can
+ * be data entry, configuration or navigation. Sensitivity is likewise
+ * orthogonal — a login form and a payment form are both high-sensitivity and
+ * need completely different tests.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNKNOWN_INTENT = exports.SENSITIVITY_IDS = exports.INTENT_IDS = exports.SENSITIVITIES = exports.INTENTS = exports.TAXONOMY_VERSION = void 0;
+exports.isIntent = isIntent;
+exports.isSensitivity = isSensitivity;
+exports.securityToolsFor = securityToolsFor;
+exports.taxonomyForPrompt = taxonomyForPrompt;
+exports.TAXONOMY_VERSION = 'qa-discovery-taxonomy@1';
+/**
+ * What an entry point is FOR.
+ *
+ * `content` looks like the least useful entry and is one of the most: it is what
+ * lets F4 *deprioritise*. A terms page and a checkout page both being "a page"
+ * is how a test plan ends up spending its budget on the wrong half of an app.
+ */
+exports.INTENTS = [
+    {
+        id: 'authentication',
+        means: 'Establishing or ending identity: sign in, sign up, sign out, password reset, MFA.',
+        testsDifferently: 'Session lifetime, invalid credentials, lockout, redirect-after-login, and what a logged-out user can still reach.',
+    },
+    {
+        id: 'payment',
+        means: 'Moving money: checkout, card or bank details, subscription, billing.',
+        testsDifferently: 'Amounts and currency, double submission and idempotency, a declined payment, and what is left behind when it fails halfway.',
+    },
+    {
+        id: 'data-entry',
+        means: 'Creating or editing a business object — a form that is not auth, payment or settings.',
+        testsDifferently: 'Field validation and boundaries, required fields, persistence after reload, and concurrent edits.',
+    },
+    {
+        id: 'search',
+        means: 'Querying, filtering or sorting a collection.',
+        testsDifferently: 'No results, one result, special characters and injection payloads, pagination edges, and result ordering.',
+    },
+    {
+        id: 'file-transfer',
+        means: 'Uploading or downloading a file.',
+        testsDifferently: 'Type and size limits, a malicious or malformed file, an interrupted transfer — none of which a text field ever needs.',
+    },
+    {
+        id: 'communication',
+        means: 'Sending something to a person: contact form, message, invitation, notification.',
+        testsDifferently: 'It has a side effect outside the app. Delivery, header/template injection, and what a retry sends twice.',
+    },
+    {
+        id: 'configuration',
+        means: 'Changing how the app or the account behaves: settings, preferences, feature toggles.',
+        testsDifferently: 'Defaults, persistence across sessions, and blast radius — a setting that changes what other pages do.',
+    },
+    {
+        id: 'navigation',
+        means: 'Getting somewhere else: menus, dashboards, index and listing pages.',
+        testsDifferently: 'Link integrity and permission gates — whether every route it offers actually resolves, and for whom.',
+    },
+    {
+        id: 'content',
+        means: 'Reading: terms, policies, documentation, marketing copy.',
+        testsDifferently: 'Almost nothing behavioural — presence, links, accessibility. Its value is that it tells F4 what NOT to spend budget on.',
+    },
+];
+/** What an entry point HANDLES. Orthogonal to intent, and it drives risk, not test shape. */
+exports.SENSITIVITIES = [
+    { id: 'none', means: 'Nothing personal or secret — a search box, a filter, a page of docs.', raises: 'Nothing.' },
+    {
+        id: 'personal',
+        means: 'Identifies a person: name, email, phone, address, account identifier.',
+        raises: 'Exposure and retention. A leak here is a privacy incident, not just a bug.',
+    },
+    {
+        id: 'credential',
+        means: 'Grants access: password, token, API key, session material.',
+        raises: 'A leak is an intrusion. Highest priority regardless of how simple the form looks.',
+    },
+    {
+        id: 'financial',
+        means: 'Money or the means to move it: card, IBAN, amount, invoice.',
+        raises: 'Direct loss, and a compliance surface (PCI) that changes what may even be stored.',
+    },
+];
+exports.INTENT_IDS = exports.INTENTS.map((i) => i.id);
+exports.SENSITIVITY_IDS = exports.SENSITIVITIES.map((s) => s.id);
+/**
+ * The refusal. Guardrail 5 made concrete: a model asked to classify will always
+ * classify, so "I cannot tell from this evidence" has to be a value it can
+ * return, not a state it has to invent a label to escape.
+ */
+exports.UNKNOWN_INTENT = 'unknown';
+function isIntent(value) {
+    return typeof value === 'string' && (exports.INTENT_IDS.includes(value) || value === exports.UNKNOWN_INTENT);
+}
+function isSensitivity(value) {
+    return typeof value === 'string' && exports.SENSITIVITY_IDS.includes(value);
+}
+function securityToolsFor(intent, sensitivity) {
+    const out = [];
+    const add = (tool, why) => {
+        if (!out.some((t) => t.tool === tool))
+            out.push({ tool, why });
+    };
+    if (intent === 'authentication' || sensitivity === 'credential') {
+        add('cookie_security_audit', 'Session material is handled here — HttpOnly, Secure and SameSite decide whether it can be stolen.');
+        add('security_headers_check', 'An auth surface is the one worth clickjacking or framing.');
+        add('secret_scan', 'A credential surface is where a key most often ends up hard-coded.');
+    }
+    if (intent === 'payment' || sensitivity === 'financial') {
+        add('ssl_certificate_check', 'Money in transit — an expiring or weak certificate is the failure CI exists to catch early.');
+        add('security_headers_check', 'A payment page is the highest-value target for injection and framing.');
+    }
+    if (sensitivity === 'personal') {
+        add('security_headers_check', 'Personal data on the page raises the cost of an injection or a leak through a third party.');
+    }
+    return out;
+}
+/** Everything a prompt needs to state the closed vocabulary, without duplicating it. */
+function taxonomyForPrompt() {
+    const lines = [`Taxonomy ${exports.TAXONOMY_VERSION}. Choose from these ids only.`, '', 'INTENT — what the entry point is for:'];
+    for (const i of exports.INTENTS)
+        lines.push(`  ${i.id}: ${i.means}`);
+    lines.push(`  ${exports.UNKNOWN_INTENT}: the evidence does not support any of the above. Prefer this over guessing.`);
+    lines.push('', 'DATA SENSITIVITY — what it handles:');
+    for (const s of exports.SENSITIVITIES)
+        lines.push(`  ${s.id}: ${s.means}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=taxonomy.js.map

package/dist/taxonomy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.js","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAwGH,4BAEC;AAED,sCAEC;AAiBD,4CAmBC;AAGD,8CAOC;AA1JY,QAAA,gBAAgB,GAAG,yBAAyB,CAAC;AAU1D;;;;;;GAMG;AACU,QAAA,OAAO,GAAgB;IAClC;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,mFAAmF;QAC1F,gBAAgB,EAAE,mHAAmH;KACtI;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,sEAAsE;QAC7E,gBAAgB,EAAE,6HAA6H;KAChJ;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,uFAAuF;QAC9F,gBAAgB,EAAE,mGAAmG;KACtH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,8CAA8C;QACrD,gBAAgB,EAAE,2GAA2G;KAC9H;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,kCAAkC;QACzC,gBAAgB,EAAE,uHAAuH;KAC1I;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,iFAAiF;QACxF,gBAAgB,EAAE,0GAA0G;KAC7H;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,sFAAsF;QAC7F,gBAAgB,EAAE,uGAAuG;KAC1H;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,qEAAqE;QAC5E,gBAAgB,EAAE,sGAAsG;KACzH;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,0DAA0D;QACjE,gBAAgB,EAAE,yHAAyH;KAC5I;CACF,CAAC;AASF,6FAA6F;AAChF,QAAA,aAAa,GAAqB;IAC7C,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sEAAsE,EAAE,MAAM,EAAE,UAAU,EAAE;IACjH;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,uEAAuE;QAC9E,MAAM,EAAE,4EAA4E;KACrF;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,4DAA4D;QACnE,MAAM,EAAE,mFAAmF;KAC5F;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,6DAA6D;QACpE,MAAM,EAAE,mFAAmF;KAC5F;CACF,CAAC;AAEW,QAAA,UAAU,GAAG,eAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtC,QAAA,eAAe,GAAG,qBAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE9D;;;;GAIG;AACU,QAAA,cAAc,GAAG,SAAS,CAAC;AAExC,SAAgB,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,sBAAc,CAAC,CAAC;AAC/F,CAAC;AAED,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAiBD,SAAgB,gBAAgB,CAAC,MAAc,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,gBAAgB,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAChE,GAAG,CAAC,uBAAuB,EAAE,mGAAmG,CAAC,CAAC;QAClI,GAAG,CAAC,wBAAwB,EAAE,2DAA2D,CAAC,CAAC;QAC3F,GAAG,CAAC,aAAa,EAAE,oEAAoE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QACxD,GAAG,CAAC,uBAAuB,EAAE,6FAA6F,CAAC,CAAC;QAC5H,GAAG,CAAC,wBAAwB,EAAE,uEAAuE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,GAAG,CAAC,wBAAwB,EAAE,4FAA4F,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAgB,iBAAiB;IAC/B,MAAM,KAAK,GAAa,CAAC,YAAY,wBAAgB,+BAA+B,EAAE,EAAE,EAAE,uCAAuC,CAAC,CAAC;IACnI,KAAK,MAAM,CAAC,IAAI,eAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,sBAAc,8EAA8E,CAAC,CAAC;IAC9G,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,qBAAa;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@ia-qa/qa-discovery",
+  "version": "0.1.0",
+  "description": "Deterministic surface reconnaissance for an unknown web app — crawl, capture, diff. No LLM, no hosting: runs entirely on your machine, with a local MCP server for agents.",
+  "keywords": [
+    "qa",
+    "testing",
+    "test-discovery",
+    "crawler",
+    "playwright",
+    "mcp",
+    "model-context-protocol"
+  ],
+  "license": "MIT",
+  "author": "Jean-Christophe Jamet",
+  "homepage": "https://www.ia-qa.com",
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./dist/*": [
+      "./dist/*",
+      "./dist/*.js"
+    ],
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "ia-qa-discover": "dist/cli/index.js",
+    "ia-qa-discover-mcp": "dist/mcp/server.js",
+    "ia-qa-discover-ai": "dist/cli-ai/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "ROADMAP.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "start:mcp": "node dist/mcp/server.js",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@ia-qa/self-healing": "^1.7.0"
+  },
+  "peerDependencies": {
+    "playwright": ">=1.40.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "playwright": "^1.45.0",
+    "typescript": "^5.5.0"
+  }
+}