@veraxhq/verax 0.2.0 → 0.3.0

package/README.md

@@ -1,5 +1,7 @@
 # 🛡️ VERAX
 
+> **SOURCE CODE REQUIRED** — VERAX requires local access to source code. It is not a public website scanner. See [docs/README.md](docs/README.md) for the canonical product contract.
+
 A forensic observation engine for real user outcomes
 
 VERAX observes and reports gaps between what your code explicitly promises and what users can actually observe.
@@ -229,27 +231,21 @@ MEDIUM (60–79) — likely discrepancy with some ambiguity
 
 LOW (<60) — weak or partial evidence; interpret cautiously
 
-🧭 When VERAX is a good fit
-
-SaaS signup and pricing flows
-
-React and Next.js projects
-
-CI pipelines that need UX reality checks
-
-Teams that value evidence over assumptions
-
-🚫 When VERAX is NOT a good fit
-
-Internal admin dashboards
-
-Authentication-heavy systems
+🧭 Supported use cases
 
-Apps built around highly dynamic routing
+- React, Next.js, or static HTML projects where you can provide local source code
+- CI pipelines that can mount the repository so VERAX can analyze it
+- Developer workstations that need evidence-backed silent failure detection
+- Teams that value deterministic evidence over heuristics or AI guesses
+- Demo projects in this repo (see [demos/](demos/))
 
-Unsupported frameworks
+🚫 Not supported
 
-Teams expecting a full QA replacement
+- URL-only scans without source code (fails fast with guidance)
+- Production monitoring or hosted/public scanning
+- Highly dynamic routing without static promises to analyze
+- Closed-source third-party targets where code is unavailable
+- Using VERAX as a drop-in QA replacement
 
 🧪 Project status
 

package/bin/verax.js

@@ -2,10 +2,17 @@
 
 /**
  * VERAX CLI Shim
+ * PHASE 21.6.1: Verified entry point
  * Delegates to src/cli/entry.js
+ * 
+ * This file MUST be the only entry point for the verax CLI.
+ * package.json "bin" field points to this file.
  */
 
 import('../src/cli/entry.js').catch((error) => {
   console.error(`Failed to load CLI: ${error.message}`);
+  if (error.stack) {
+    console.error(error.stack);
+  }
   process.exit(2);
 });

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@veraxhq/verax",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "VERAX - Silent failure detection for websites",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "verax": "./bin/verax.js"
+    "verax": "bin/verax.js"
   },
   "files": [
     "bin/",
@@ -14,8 +14,11 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test",
-    "test:pack": "node scripts/test-pack.js"
+    "test": "node scripts/test-runner-wrapper.js",
+    "test:pack": "node scripts/test-pack.js",
+    "verify-release": "node scripts/verify-release.js",
+    "lint": "eslint . --max-warnings 0",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
     "glob": "^10.3.10",
@@ -30,6 +33,13 @@
   "devDependencies": {
     "@babel/parser": "^7.28.5",
     "@babel/traverse": "^7.28.5",
-    "@veraxhq/verax": "file:veraxhq-verax-0.2.0.tgz"
+    "@reduxjs/toolkit": "^2.11.2",
+    "@veraxhq/verax": "file:veraxhq-verax-0.3.0.tgz",
+    "eslint": "^8.57.0",
+    "next": "^16.1.1",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
+    "react-redux": "^9.2.0",
+    "react-router-dom": "^7.12.0"
   }
 }

package/src/cli/commands/baseline.js

@@ -0,0 +1,104 @@
+/**
+ * PHASE 21.11 — Baseline Command
+ * 
+ * `verax baseline` - Shows baseline hash and drift status
+ */
+
+import { resolve } from 'path';
+import { loadBaselineSnapshot, buildBaselineSnapshot } from '../../verax/core/baseline/baseline.snapshot.js';
+import { compareBaselines, isBaselineFrozen } from '../../verax/core/baseline/baseline.enforcer.js';
+
+/**
+ * Baseline command
+ * 
+ * @param {string} projectDir - Project directory
+ * @param {Object} options - Command options
+ */
+export async function baselineCommand(projectDir, options = {}) {
+  const { json = false } = options;
+  
+  const frozen = loadBaselineSnapshot(projectDir);
+  const current = buildBaselineSnapshot(projectDir);
+  
+  if (!frozen) {
+    if (json) {
+      console.log(JSON.stringify({
+        status: 'NO_BASELINE',
+        message: 'No baseline snapshot found (pre-GA)',
+        current: {
+          hash: current.baselineHash,
+          version: current.veraxVersion,
+          commit: current.gitCommit
+        }
+      }, null, 2));
+    } else {
+      console.log('\n=== Baseline Status ===\n');
+      console.log('Status: NO_BASELINE (pre-GA)');
+      console.log(`Current baseline hash: ${current.baselineHash}`);
+      console.log(`Version: ${current.veraxVersion}`);
+      console.log(`Commit: ${current.gitCommit}`);
+      console.log(`Dirty: ${current.gitDirty ? 'YES' : 'NO'}`);
+      console.log('\nNote: Baseline will be frozen when GA-READY is achieved.\n');
+    }
+    return;
+  }
+  
+  const comparison = compareBaselines(current, frozen);
+  const frozenStatus = frozen.frozen ? 'FROZEN' : 'NOT_FROZEN';
+  
+  if (json) {
+    console.log(JSON.stringify({
+      status: frozenStatus,
+      frozen: frozen.frozen,
+      drifted: comparison.drifted,
+      message: comparison.message,
+      frozenBaseline: {
+        hash: frozen.baselineHash,
+        version: frozen.veraxVersion,
+        commit: frozen.gitCommit,
+        timestamp: frozen.timestamp
+      },
+      currentBaseline: {
+        hash: current.baselineHash,
+        version: current.veraxVersion,
+        commit: current.gitCommit
+      },
+      differences: comparison.differences
+    }, null, 2));
+  } else {
+    console.log('\n=== Baseline Status ===\n');
+    console.log(`Status: ${frozenStatus}`);
+    console.log(`Frozen: ${frozen.frozen ? 'YES' : 'NO'}`);
+    console.log(`Drifted: ${comparison.drifted ? 'YES' : 'NO'}`);
+    console.log(`\nMessage: ${comparison.message}`);
+    
+    console.log('\nFrozen Baseline:');
+    console.log(`  Hash: ${frozen.baselineHash}`);
+    console.log(`  Version: ${frozen.veraxVersion}`);
+    console.log(`  Commit: ${frozen.gitCommit}`);
+    console.log(`  Timestamp: ${frozen.timestamp}`);
+    
+    console.log('\nCurrent Baseline:');
+    console.log(`  Hash: ${current.baselineHash}`);
+    console.log(`  Version: ${current.veraxVersion}`);
+    console.log(`  Commit: ${current.gitCommit}`);
+    console.log(`  Dirty: ${current.gitDirty ? 'YES' : 'NO'}`);
+    
+    if (comparison.drifted) {
+      console.log('\n⚠️  BASELINE DRIFT DETECTED:');
+      for (const diff of comparison.differences) {
+        console.log(`  - ${diff.message}`);
+        if (diff.component) {
+          console.log(`    Component: ${diff.component}`);
+        }
+      }
+      console.log('\n⚠️  Changes to core contracts/policies after GA require:');
+      console.log('    1. MAJOR version bump');
+      console.log('    2. Baseline regeneration');
+      console.log('    3. GA re-evaluation\n');
+    } else {
+      console.log('\n✓ Baseline integrity maintained\n');
+    }
+  }
+}
+