@qulib/core 0.8.2 → 0.9.0

package/dist/examples/notquality-dogfood/fixture.js

@@ -0,0 +1,174 @@
+/**
+ * notquality DOGFOOD — real delivery signals fixture.
+ *
+ * P5 — qulib ingests notquality's own delivery signals → Release Confidence.
+ *
+ * PROVENANCE (all signals gathered 2026-06-04 via `gh` CLI against TapeshN/notquality):
+ *
+ *   E2E run:  gh run view 26931370208 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: E2E (playwright job, job ID 79451559555)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~6m4s)
+ *             conclusion: success
+ *             test files: 29 spec files on origin/main (git ls-tree -r origin/main)
+ *             test cases: 194 total test() calls across 29 spec files
+ *             fixme/skip: 26 test.fixme / test.skip markers
+ *             active (non-fixme): 194 - 26 = 168 runnable tests
+ *             all passed (CI conclusion: success)
+ *
+ *   CI run:   gh run view 26931370215 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: CI (validate job, job ID 79451559554)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~1m13s)
+ *             conclusion: success
+ *             steps: typecheck, lint, validate:bugs, prisma generate, build — all green
+ *
+ *   PR:       gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ *             title: "Run prisma migrate deploy before build on Vercel"
+ *             branch: notquality-app/prod-migrate
+ *             number: 52
+ *             url: https://github.com/TapeshN/notquality/pull/52
+ *             reviewDecision: "" (no review assigned — open PR, no blocking change requests)
+ *             mergeable: MERGEABLE
+ *             status checks: CI validate → SUCCESS, E2E playwright → SUCCESS, Vercel → SUCCESS
+ *
+ *   Repo inventory (gh ls-tree -r origin/main, 2026-06-04):
+ *             29 spec files, 77 source .ts/.tsx files (excl. e2e), 19 route pages
+ *             playwright.config.ts present (.github/workflows/e2e.yml present)
+ *             CI: .github/workflows/ci.yml present (typecheck + lint + validate:bugs + build)
+ *             auth: dual auth (iron-session playground + NextAuth platform)
+ *             test-id hygiene: data-testid used in app/ + e2e/ (29 spec files use getByTestId)
+ *             challenges: 1 seeded (legacy-bug-hunt-1); 16-card static list page (P5 truth-fix target)
+ *
+ * COLLECTION TIMESTAMP: 2026-06-04T09:00:00.000Z
+ *
+ * This fixture is intentionally FROZEN at this point in time. When real delivery
+ * signals are updated, create a NEW fixture version (fixture-v2.ts, etc.) and
+ * update the integration tests to use the latest. Never silently mutate this file —
+ * the provenance citation is load-bearing for the eval/audit trail.
+ */
+export const FIXTURE_COLLECTION_TS = '2026-06-04T09:00:00.000Z';
+/**
+ * Real CI run data from notquality E2E workflow (run #26931370208).
+ * Source: gh run view 26931370208 -R TapeshN/notquality
+ */
+export const NOTQUALITY_E2E_RUN = {
+    /** ISO-8601 timestamp of run completion. */
+    completedAt: '2026-06-04T04:46:20.000Z',
+    /** CI build step succeeded (typecheck, lint, validate:bugs, prisma generate, build). */
+    buildPassed: true,
+    /**
+     * 168 runnable tests (194 total test() calls − 26 test.fixme/test.skip markers).
+     * All 168 passed in this run. Source: spec-file grep + run conclusion=success.
+     */
+    testsPassed: 168,
+    testsFailed: 0,
+    testsErrored: 0,
+    /**
+     * 26 tests marked test.fixme or test.skip across 16 spec files.
+     * These are known quarantined defects (color-contrast a11y, label regression,
+     * EVT-001, duplicate challenge-title) — intentional, not infra failures.
+     */
+    testsFlaky: 0,
+    runUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370208',
+    workflowName: 'E2E (playwright)',
+};
+/**
+ * Real CI validate-job data from notquality CI workflow (run #26931370215).
+ * Source: gh run view 26931370215 -R TapeshN/notquality
+ */
+export const NOTQUALITY_CI_RUN = {
+    completedAt: '2026-06-04T04:46:20.000Z',
+    buildPassed: true,
+    testsPassed: 0, // CI job runs lint/typecheck/validate:bugs — no Jest/Vitest unit tests yet
+    testsFailed: 0,
+    testsErrored: 0,
+    runUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370215',
+    workflowName: 'CI (validate)',
+};
+/**
+ * Real PR #52 metadata from notquality.
+ * Source: gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ */
+export const NOTQUALITY_PR_52 = {
+    number: 52,
+    url: 'https://github.com/TapeshN/notquality/pull/52',
+    reviewDecision: null, // no review assigned — open PR, no blocking changes_requested
+    mergeable: 'MERGEABLE',
+    statusCheckRollup: [
+        {
+            state: 'SUCCESS',
+            name: 'validate',
+            targetUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370215/job/79451559554',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'playwright',
+            targetUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370208/job/79451559555',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'Vercel',
+            targetUrl: 'https://vercel.com/tapeshnagarwal-7364s-projects/notquality-app/5mSLRhKKEdwvnqMoTY4XWxSePFYB',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'Vercel Preview Comments',
+            targetUrl: 'https://vercel.com/github',
+        },
+    ],
+    noPr: false,
+};
+/**
+ * Repo-level automation maturity facts (from static scan of origin/main, 2026-06-04).
+ * These facts drive the test-automation EvidenceItem used when qulib_score_automation
+ * is held (no live local scan in this fixture — see HELD note below).
+ *
+ * HELD: The live qulib_score_automation(repoPath) call requires the notquality
+ * repo to be available at an absolute path on the build machine and needs the full
+ * qulib CLI. The integration test uses these pre-scored facts instead of a live scan.
+ * The live scan is operator-gated (run `qulib score-automation <path>` locally).
+ */
+export const NOTQUALITY_AUTOMATION_MATURITY = {
+    /**
+     * Estimated overall automation maturity score (0–100).
+     * Basis: Playwright present (framework-adoption ✓), 29 spec files covering 19 routes
+     * (test-coverage-breadth ~72%), e2e.yml + ci.yml present (ci-integration ✓),
+     * auth-test-coverage present (iron-session + NextAuth both tested ✓),
+     * data-testid used in spec files (test-id-hygiene present but not perfect — duplicate
+     * challenge-title test-id is a known defect, P5 truth-fix target), no component/unit
+     * tests yet (component-test-ratio = 0). Estimated L3 (60–79 range).
+     * Conservative estimate: 65/100.
+     */
+    overallScore: 65,
+    level: 3,
+    label: 'L3 — building maturity',
+    /**
+     * Key facts cited (no live scan was run; these are statically-derived):
+     * - framework: Playwright (playwright.config.ts present on origin/main)
+     * - specFiles: 29 (git ls-tree origin/main | grep "e2e/" | grep "spec.ts")
+     * - routePages: 19 (git ls-tree origin/main | grep "app/" | grep "page.tsx")
+     * - ciWorkflows: 2 (.github/workflows/ci.yml + e2e.yml)
+     * - authTests: yes (e2e/specs/auth/ — 3 spec files, 18 test() calls)
+     * - testIdHygiene: partial (data-testid used; duplicate challenge-title known defect)
+     * - componentTests: 0 (no vitest/jest unit tests in repo)
+     */
+    topRecommendations: [
+        'Add vitest/jest unit tests for lib/ (scoring, API helpers) to raise component-test-ratio.',
+        'Fix duplicate data-testid="challenge-title" (breadcrumb vs h1) for unambiguous E2E selectors.',
+        'Add dedicated challenges list + attempt E2E specs once fake list page is replaced with DB truth.',
+    ],
+    computedAt: FIXTURE_COLLECTION_TS,
+    repoPath: 'TapeshN/notquality@5732ed5a (origin/main, 2026-06-04)',
+};
+/**
+ * Repository context for the ConfidenceSubject.
+ * ref: the commit SHA + branch context; tenantId: 'notquality' (multi-tenant from day one).
+ */
+export const NOTQUALITY_SUBJECT = {
+    kind: 'release',
+    ref: 'TapeshN/notquality@5732ed5a (notquality-app/prod-migrate)',
+    tenantId: 'notquality',
+};

package/dist/examples/notquality-dogfood/run.d.ts

@@ -0,0 +1,34 @@
+/**
+ * notquality DOGFOOD — runnable example.
+ *
+ * P5: qulib scoring a real app we own. This is the confidence-layer thesis
+ * proven on a live delivery pipeline: qulib ingests notquality's CI results,
+ * PR metadata, and automation maturity, then emits a real Release Confidence
+ * score + verdict.
+ *
+ * Run with:
+ *   npx tsx packages/core/src/examples/notquality-dogfood/run.ts
+ *
+ * What it does:
+ *   1. Loads DATED real-sample fixture (provenance: gh CLI, 2026-06-04).
+ *   2. Maps CI run → ciResultsToEvidence (EvidenceItem, source='ci-results').
+ *   3. Maps PR metadata → prMetadataToEvidence (EvidenceItem, source='deploy-metadata').
+ *   4. Builds a test-automation EvidenceItem from the pre-scored maturity facts.
+ *   5. Calls computeReleaseConfidence → fused score + verdict.
+ *   6. Prints a structured JSON report to stdout.
+ *
+ * HELD signals (operator-gated, not run here):
+ *   - qulib_score_automation live scan (requires local notquality checkout + qulib CLI).
+ *     Instead this example uses the statically-derived NOTQUALITY_AUTOMATION_MATURITY
+ *     from the fixture (documented, conservative, clearly labelled as pre-scored).
+ *   - analyze_app deployed crawl (external HTTP + optional LLM cost).
+ *     The live-app-quality and accessibility EvidenceItems are omitted here; the
+ *     pipeline runs correctly with a subset of evidence (partial-evidence honesty).
+ *
+ * Output format: NDJSON line appended to stdout (one JSON object per run).
+ * The rubricVersion field versions the roll-up formula so it can evolve without
+ * silently changing meaning (P5 stopgap formula; retires when qulib's own aggregator
+ * ships in P3/P4 roadmap).
+ */
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/examples/notquality-dogfood/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/examples/notquality-dogfood/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/examples/notquality-dogfood/run.js

@@ -0,0 +1,139 @@
+/**
+ * notquality DOGFOOD — runnable example.
+ *
+ * P5: qulib scoring a real app we own. This is the confidence-layer thesis
+ * proven on a live delivery pipeline: qulib ingests notquality's CI results,
+ * PR metadata, and automation maturity, then emits a real Release Confidence
+ * score + verdict.
+ *
+ * Run with:
+ *   npx tsx packages/core/src/examples/notquality-dogfood/run.ts
+ *
+ * What it does:
+ *   1. Loads DATED real-sample fixture (provenance: gh CLI, 2026-06-04).
+ *   2. Maps CI run → ciResultsToEvidence (EvidenceItem, source='ci-results').
+ *   3. Maps PR metadata → prMetadataToEvidence (EvidenceItem, source='deploy-metadata').
+ *   4. Builds a test-automation EvidenceItem from the pre-scored maturity facts.
+ *   5. Calls computeReleaseConfidence → fused score + verdict.
+ *   6. Prints a structured JSON report to stdout.
+ *
+ * HELD signals (operator-gated, not run here):
+ *   - qulib_score_automation live scan (requires local notquality checkout + qulib CLI).
+ *     Instead this example uses the statically-derived NOTQUALITY_AUTOMATION_MATURITY
+ *     from the fixture (documented, conservative, clearly labelled as pre-scored).
+ *   - analyze_app deployed crawl (external HTTP + optional LLM cost).
+ *     The live-app-quality and accessibility EvidenceItems are omitted here; the
+ *     pipeline runs correctly with a subset of evidence (partial-evidence honesty).
+ *
+ * Output format: NDJSON line appended to stdout (one JSON object per run).
+ * The rubricVersion field versions the roll-up formula so it can evolve without
+ * silently changing meaning (P5 stopgap formula; retires when qulib's own aggregator
+ * ships in P3/P4 roadmap).
+ */
+import { ciResultsToEvidence } from '../../adapters/ci-results-adapter.js';
+import { prMetadataToEvidence } from '../../adapters/pr-metadata-adapter.js';
+import { computeReleaseConfidence } from '../../tools/scoring/confidence.js';
+import { FIXTURE_COLLECTION_TS, NOTQUALITY_E2E_RUN, NOTQUALITY_PR_52, NOTQUALITY_AUTOMATION_MATURITY, NOTQUALITY_SUBJECT, } from './fixture.js';
+// ---------------------------------------------------------------------------
+// Build the evidence bundle from real notquality delivery signals
+// ---------------------------------------------------------------------------
+/**
+ * E2E CI run → ci-results evidence item.
+ * Source: run #26931370208, E2E workflow, 2026-06-04.
+ */
+const e2eEvidence = ciResultsToEvidence(NOTQUALITY_E2E_RUN, FIXTURE_COLLECTION_TS);
+/**
+ * PR #52 metadata → deploy-metadata evidence item.
+ * Source: gh pr view 52 -R TapeshN/notquality, 2026-06-04.
+ */
+const prEvidence = prMetadataToEvidence({
+    ...NOTQUALITY_PR_52,
+    statusCheckRollup: NOTQUALITY_PR_52.statusCheckRollup.map((c) => ({ ...c })),
+}, FIXTURE_COLLECTION_TS);
+/**
+ * Automation maturity → test-automation evidence item.
+ * Source: static scan of origin/main, 2026-06-04.
+ * NOTE: This is a pre-scored estimate. Live qulib_score_automation(repoPath)
+ * is the authoritative signal; this is the operator-held substitute.
+ */
+const automationEvidence = {
+    source: 'test-automation',
+    score: NOTQUALITY_AUTOMATION_MATURITY.overallScore,
+    weight: 0.22,
+    applicability: 'applicable',
+    blocking: false,
+    evidence: [
+        `Automation maturity: ${NOTQUALITY_AUTOMATION_MATURITY.label} (score ${NOTQUALITY_AUTOMATION_MATURITY.overallScore})`,
+        `Source: static scan of ${NOTQUALITY_AUTOMATION_MATURITY.repoPath}`,
+        '29 E2E spec files, 168 runnable tests (26 fixme/skip quarantined), Playwright + CI wired.',
+        'No vitest/jest unit tests yet (component-test-ratio = 0).',
+    ],
+    recommendations: NOTQUALITY_AUTOMATION_MATURITY.topRecommendations.slice(),
+    reason: undefined,
+    collectedAt: FIXTURE_COLLECTION_TS,
+    collector: {
+        tool: 'qulib_score_automation.pre-scored',
+        inputRef: NOTQUALITY_AUTOMATION_MATURITY.repoPath,
+    },
+};
+// ---------------------------------------------------------------------------
+// Assemble ConfidenceInput and compute the score
+// ---------------------------------------------------------------------------
+const input = {
+    subject: NOTQUALITY_SUBJECT,
+    evidence: [e2eEvidence, prEvidence, automationEvidence],
+    policy: {
+        passThreshold: 80,
+        failThreshold: 30,
+        maxListLength: 5,
+        requiredSources: [],
+        // Default weights apply; explicit ci-results weight already on the EvidenceItem.
+    },
+};
+const result = computeReleaseConfidence(input);
+// ---------------------------------------------------------------------------
+// Emit the structured report
+// ---------------------------------------------------------------------------
+const report = {
+    rubricVersion: 'p5-dogfood-v1',
+    collectionTimestamp: FIXTURE_COLLECTION_TS,
+    tenantId: NOTQUALITY_SUBJECT.tenantId,
+    subject: NOTQUALITY_SUBJECT.ref,
+    sources: {
+        e2eRun: NOTQUALITY_E2E_RUN.runUrl,
+        ciRun: 'https://github.com/TapeshN/notquality/actions/runs/26931370215',
+        pr: NOTQUALITY_PR_52.url,
+        automationMaturity: `pre-scored from ${NOTQUALITY_AUTOMATION_MATURITY.repoPath}`,
+    },
+    heldSignals: [
+        'qulib_score_automation live scan (operator-gated: requires local notquality checkout)',
+        'analyze_app deployed crawl (operator-gated: external HTTP + optional LLM cost)',
+    ],
+    confidence: {
+        score: result.confidenceScore,
+        verdict: result.verdict,
+        level: result.level,
+        label: result.label,
+    },
+    contributions: result.contributions.map((c) => ({
+        source: c.source,
+        score: c.score,
+        effectiveWeight: c.effectiveWeight,
+        applicability: c.applicability,
+    })),
+    topRisks: result.topRisks,
+    recommendations: result.recommendedNextChecks,
+    honestyNotes: result.honestyNotes,
+    scoreFormula: result.scoreFormula,
+};
+// eslint-disable-next-line no-console
+console.log(JSON.stringify(report, null, 2));
+// Print a human-readable summary line on stderr for quick reading in CI.
+const verdictEmoji = {
+    ship: 'SHIP',
+    caution: 'CAUTION',
+    hold: 'HOLD',
+    block: 'BLOCK',
+};
+const v = verdictEmoji[result.verdict] ?? result.verdict.toUpperCase();
+process.stderr.write(`[notquality dogfood] confidence=${result.confidenceScore ?? 'null'} verdict=${v} (${result.label})\n`);

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { analyzeApp } from './analyze.js';
+export { slugifyUrl, defaultBaselineRoot, saveBaseline, loadBaseline, listBaselines, deleteBaseline, compareBaselines, } from './baseline/baseline.js';
+export type { BaselineGap, BaselineSnapshot, BaselineDeltaItem, BaselineDelta, } from './baseline/baseline.schema.js';
 export { toAgentSummary } from './agent-summary.js';
 export type { AgentSummary, AgentSummaryPolicy, AgentGate, CoverageStatus, AgentSummaryCostSummary, } from './agent-summary.js';
 export { detectAuth, validateStorageState, evaluateStorageStateValidity, preflightStorageStateFile, waitForReturnToOrigin, } from './tools/auth/detect.js';
@@ -13,6 +15,7 @@ export { computeApiCoverage } from './tools/scoring/api-coverage.js';
 export type { ApiCoverageResult, ApiEndpointCoverage } from './tools/scoring/api-coverage.js';
 export { scaffoldTests } from './scaffold-tests.js';
 export type { ScaffoldOptions, ScaffoldResult, ProjectConfig } from './scaffold-tests.js';
+export { expandRecipes, buildAuthScenarios, buildA11yScenarios, buildNavScenarios, buildSeedScenarios } from './recipes/index.js';
 export { createProvider } from './llm/provider-registry.js';
 export { resolveMaxOutputTokensPerLlmCall } from './schemas/config.schema.js';
 export { resolveScanStateBaseDir, resolveReportDir } from './harness/state-manager.js';
@@ -23,5 +26,15 @@ export { NoopTelemetrySink } from './telemetry/telemetry.interface.js';
 export { redactUrlForTelemetry } from './telemetry/emit.js';
 export type { LlmCallResult, LlmProvider } from './llm/provider.interface.js';
 export type { CallLlmConfigSlice } from './llm/provider.js';
-export type { HarnessConfig, AuthConfig, RouteInventory, GapAnalysis, RepoAnalysis, DetectedAuth, AuthExploration, AuthPath, AuthPathRequirements, CostIntelligence, LlmUsageRecord, RepeatedAiPattern, DeterministicMaturity, PublicSurface, AutomationMaturity, AutomationMaturityDimension, FrameworkDetectionResult, DetectedFrameworkPrimary, } from './schemas/index.js';
+export type { HarnessConfig, AuthConfig, RouteInventory, GapAnalysis, RepoAnalysis, DetectedAuth, AuthExploration, AuthPath, AuthPathRequirements, CostIntelligence, LlmUsageRecord, RepeatedAiPattern, DeterministicMaturity, PublicSurface, AutomationMaturity, AutomationMaturityDimension, FrameworkDetectionResult, DetectedFrameworkPrimary, RecipeId, RecipeConfig, } from './schemas/index.js';
+export { RecipeIdSchema } from './schemas/index.js';
+export { computeReleaseConfidence } from './tools/scoring/confidence.js';
+export { ciResultsToEvidence } from './adapters/ci-results-adapter.js';
+export type { CiRunInput } from './adapters/ci-results-adapter.js';
+export { prMetadataToEvidence } from './adapters/pr-metadata-adapter.js';
+export type { PrMetadataInput, StatusCheck, ReviewDecision, MergeableState } from './adapters/pr-metadata-adapter.js';
+export { buildConfidenceInputFromQulib } from './tools/scoring/confidence-from-qulib.js';
+export { diffConfidence, deriveInbox, buildReplay, toAuditEntry } from './tools/scoring/confidence-views.js';
+export type { EvidenceSourceKind, EvidenceItem, ConfidenceSubject, ConfidenceInput, ConfidencePolicy, ConfidenceVerdict, ConfidenceContribution, ReleaseConfidence, DeliveryTrafficPoint, InboxItem, InboxItemKind, ReplayStep, ReplayTrace, AuditEntry, } from './schemas/index.js';
+export { EvidenceSourceKindSchema, EvidenceItemSchema, ConfidenceSubjectSchema, ConfidenceInputSchema, ConfidencePolicySchema, ConfidenceVerdictSchema, ReleaseConfidenceSchema, } from './schemas/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,QAAQ,EACR,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAC7G,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export { analyzeApp } from './analyze.js';
+export { slugifyUrl, defaultBaselineRoot, saveBaseline, loadBaseline, listBaselines, deleteBaseline, compareBaselines, } from './baseline/baseline.js';
 export { toAgentSummary } from './agent-summary.js';
 export { detectAuth, validateStorageState, evaluateStorageStateValidity, preflightStorageStateFile, waitForReturnToOrigin, } from './tools/auth/detect.js';
 export { exploreAuth } from './tools/auth/explore.js';
@@ -8,8 +9,18 @@ export { discoverApiSurface, discoverApiSurfaceWithRepo } from './tools/repo/api
 export { computeAutomationMaturity } from './tools/scoring/automation-maturity.js';
 export { computeApiCoverage } from './tools/scoring/api-coverage.js';
 export { scaffoldTests } from './scaffold-tests.js';
+export { expandRecipes, buildAuthScenarios, buildA11yScenarios, buildNavScenarios, buildSeedScenarios } from './recipes/index.js';
 export { createProvider } from './llm/provider-registry.js';
 export { resolveMaxOutputTokensPerLlmCall } from './schemas/config.schema.js';
 export { resolveScanStateBaseDir, resolveReportDir } from './harness/state-manager.js';
 export { NoopTelemetrySink } from './telemetry/telemetry.interface.js';
 export { redactUrlForTelemetry } from './telemetry/emit.js';
+export { RecipeIdSchema } from './schemas/index.js';
+// P3 — Confidence Layer exports
+export { computeReleaseConfidence } from './tools/scoring/confidence.js';
+// P4 — Evidence adapters (CI results + PR metadata)
+export { ciResultsToEvidence } from './adapters/ci-results-adapter.js';
+export { prMetadataToEvidence } from './adapters/pr-metadata-adapter.js';
+export { buildConfidenceInputFromQulib } from './tools/scoring/confidence-from-qulib.js';
+export { diffConfidence, deriveInbox, buildReplay, toAuditEntry } from './tools/scoring/confidence-views.js';
+export { EvidenceSourceKindSchema, EvidenceItemSchema, ConfidenceSubjectSchema, ConfidenceInputSchema, ConfidencePolicySchema, ConfidenceVerdictSchema, ReleaseConfidenceSchema, } from './schemas/index.js';

package/dist/recipes/a11y.d.ts

@@ -0,0 +1,36 @@
+/**
+ * a11y recipe — accessibility assertion patterns.
+ *
+ * Lifted from the PROVEN NQ-2 Playwright a11y suite and qulib's own axe-core
+ * integration in src/phases/accessibility.ts. Real patterns re-derived from
+ * first principles.
+ *
+ * NQ-2 Playwright a11y reference patterns:
+ *   - import AxeBuilder from '@axe-core/playwright'
+ *   - const results = await new AxeBuilder({ page }).analyze()
+ *   - expect(violations.filter(v => v.impact === 'serious' || v.impact === 'critical')).toHaveLength(0)
+ *   - await expect(page.locator('main')).toBeVisible()
+ *   - await expect(page.locator('h1')).toBeVisible()
+ *   - expect(await page.title()).not.toBe('')
+ *
+ * For Cypress (no axe-core adapter in the scaffold toolchain), we use:
+ *   - Structural presence checks (h1, main, nav, [role=...])
+ *   - Sufficient-contrast guards via role/aria-label checks
+ *   - Focus-visible checks via keyboard nav simulation
+ */
+import type { NeutralScenario } from '../schemas/gap-analysis.schema.js';
+import type { RecipeConfig } from '../schemas/recipe.schema.js';
+/**
+ * Generate NeutralScenarios for the a11y recipe.
+ *
+ * Returns 3 scenarios:
+ *   1. Page-level a11y — heading structure + landmark regions (all frameworks)
+ *   2. Interactive a11y — focus order / aria roles for primary CTA (smoke)
+ *   3. Image/text a11y — alt text presence + non-empty page title
+ *
+ * The Playwright adapter will render axe-core assertions for scenarios tagged
+ * 'a11y-axe'. The Cypress adapter renders structural/aria assertions (axe-core
+ * Cypress integration is out-of-scope for the scaffold toolchain today).
+ */
+export declare function buildA11yScenarios(config?: RecipeConfig): NeutralScenario[];
+//# sourceMappingURL=a11y.d.ts.map

package/dist/recipes/a11y.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a11y.d.ts","sourceRoot":"","sources":["../../src/recipes/a11y.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,YAAiB,GAAG,eAAe,EAAE,CA6G/E"}

package/dist/recipes/a11y.js

@@ -0,0 +1,118 @@
+/**
+ * Generate NeutralScenarios for the a11y recipe.
+ *
+ * Returns 3 scenarios:
+ *   1. Page-level a11y — heading structure + landmark regions (all frameworks)
+ *   2. Interactive a11y — focus order / aria roles for primary CTA (smoke)
+ *   3. Image/text a11y — alt text presence + non-empty page title
+ *
+ * The Playwright adapter will render axe-core assertions for scenarios tagged
+ * 'a11y-axe'. The Cypress adapter renders structural/aria assertions (axe-core
+ * Cypress integration is out-of-scope for the scaffold toolchain today).
+ */
+export function buildA11yScenarios(config = {}) {
+    const impact = config.a11yImpact ?? 'serious';
+    return [
+        {
+            id: 'recipe-a11y-heading-structure',
+            title: 'Page has proper heading structure and landmark regions',
+            description: 'The root page has an H1 heading and at least one landmark region (main/nav/header/footer), providing a navigable document outline for screen-reader users',
+            targetPath: '/',
+            steps: [
+                { action: 'navigate', target: '/', description: 'Open the root page' },
+                {
+                    action: 'assert-visible',
+                    target: 'h1',
+                    description: 'Page has an H1 heading (document outline)',
+                },
+                {
+                    action: 'assert-visible',
+                    target: 'main',
+                    description: 'Page has a main landmark region',
+                },
+                {
+                    action: 'assert-count',
+                    target: 'nav',
+                    value: '1',
+                    description: 'At least one navigation landmark exists',
+                },
+            ],
+            tags: ['a11y', 'smoke', 'recipe-a11y', `a11y-impact-${impact}`],
+            recommendations: [
+                {
+                    adapter: 'playwright',
+                    reason: 'Landmark + heading assertions with Playwright locator — real NQ-2 pattern',
+                    confidence: 'high',
+                },
+                {
+                    adapter: 'cypress-e2e',
+                    reason: 'Structural a11y assertions — cy.get on semantic elements',
+                    confidence: 'high',
+                },
+            ],
+            sourceGapIds: ['recipe-a11y'],
+        },
+        {
+            id: 'recipe-a11y-interactive-aria',
+            title: 'Primary interactive elements have accessible names',
+            description: 'Buttons and links visible on the page carry accessible names (aria-label or text content), ensuring assistive technologies can identify the action',
+            targetPath: '/',
+            steps: [
+                { action: 'navigate', target: '/', description: 'Open the root page' },
+                {
+                    action: 'assert-count',
+                    target: 'button, a[href]',
+                    value: '1',
+                    description: 'At least one interactive element is present',
+                },
+                {
+                    action: 'assert-visible',
+                    target: 'button, [role=button]',
+                    description: 'An accessible interactive element is visible on the page',
+                },
+            ],
+            tags: ['a11y', 'aria', 'recipe-a11y'],
+            recommendations: [
+                {
+                    adapter: 'playwright',
+                    reason: 'aria-label presence check — Playwright locator + toBeVisible',
+                    confidence: 'medium',
+                },
+                {
+                    adapter: 'cypress-e2e',
+                    reason: 'Aria attribute presence — cy.get selector chain',
+                    confidence: 'medium',
+                },
+            ],
+            sourceGapIds: ['recipe-a11y'],
+        },
+        {
+            id: 'recipe-a11y-page-title',
+            title: 'Page has a non-empty, descriptive document title',
+            description: 'The <title> element is non-empty — required for bookmarks, browser tabs, and screen-reader orientation',
+            targetPath: '/',
+            steps: [
+                { action: 'navigate', target: '/', description: 'Open the root page' },
+                {
+                    action: 'assert-text',
+                    target: 'title',
+                    description: 'Document title element is non-empty',
+                },
+            ],
+            tags: ['a11y', 'seo', 'recipe-a11y'],
+            recommendations: [
+                {
+                    adapter: 'playwright',
+                    reason: 'page.title() !== "" — lightweight page-level a11y gate',
+                    confidence: 'high',
+                },
+                {
+                    adapter: 'cypress-e2e',
+                    reason: 'cy.title().should("not.be.empty") — smoke a11y gate',
+                    confidence: 'high',
+                },
+            ],
+            sourceGapIds: ['recipe-a11y'],
+        },
+    ];
+}

package/dist/recipes/auth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * auth recipe — login / logout / protected-route patterns.
+ *
+ * Lifted from the PROVEN NQ-2 Playwright specs and CaseLoom Cypress specs.
+ * These are REAL selector patterns and assertion patterns used in those test
+ * suites, re-derived from first principles (not copy-pasted).
+ *
+ * NQ-2 Playwright reference patterns:
+ *   - page.goto('/login')
+ *   - page.locator('[data-testid=login-email]').fill(email)
+ *   - page.locator('[data-testid=login-password]').fill(password)
+ *   - page.locator('[data-testid=login-submit]').click()
+ *   - expect(page.locator('[data-testid=dashboard-root]')).toBeVisible()
+ *   - expect(page.locator('[data-testid=login-error]')).toContainText('Invalid')
+ *
+ * CaseLoom Cypress reference patterns:
+ *   - cy.visit('/login')
+ *   - cy.get('[data-testid=login-email]').type(email)
+ *   - cy.get('[data-testid=login-password]').type(password)
+ *   - cy.get('[data-testid=login-submit]').click()
+ *   - cy.get('[data-testid=dashboard-root]').should('be.visible')
+ *   - cy.get('[data-testid=login-error]').should('contain.text', 'Invalid')
+ */
+import type { NeutralScenario } from '../schemas/gap-analysis.schema.js';
+import type { RecipeConfig } from '../schemas/recipe.schema.js';
+/**
+ * Generate NeutralScenarios for the auth recipe.
+ *
+ * Returns 3 scenarios:
+ *   1. Happy-path login → lands on dashboard (smoke gate)
+ *   2. Invalid-credentials → inline error message shown (negative gate)
+ *   3. Protected route redirects unauthenticated users to login (security gate)
+ *
+ * All selectors come from the proven NQ-2/CaseLoom patterns and are overridable
+ * via RecipeConfig, so the recipe works for any form-login app.
+ */
+export declare function buildAuthScenarios(config?: RecipeConfig): NeutralScenario[];
+//# sourceMappingURL=auth.d.ts.map

package/dist/recipes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/recipes/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAWhE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,YAAiB,GAAG,eAAe,EAAE,CA0I/E"}