@veraxhq/verax 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (191) hide show
  1. package/README.md +28 -20
  2. package/bin/verax.js +11 -18
  3. package/package.json +28 -7
  4. package/src/cli/commands/baseline.js +1 -2
  5. package/src/cli/commands/default.js +72 -81
  6. package/src/cli/commands/doctor.js +29 -0
  7. package/src/cli/commands/ga.js +3 -0
  8. package/src/cli/commands/gates.js +1 -1
  9. package/src/cli/commands/inspect.js +6 -133
  10. package/src/cli/commands/release-check.js +2 -0
  11. package/src/cli/commands/run.js +74 -246
  12. package/src/cli/commands/security-check.js +2 -1
  13. package/src/cli/commands/truth.js +0 -1
  14. package/src/cli/entry.js +82 -309
  15. package/src/cli/util/angular-component-extractor.js +2 -2
  16. package/src/cli/util/angular-navigation-detector.js +2 -2
  17. package/src/cli/util/ast-interactive-detector.js +4 -6
  18. package/src/cli/util/ast-network-detector.js +3 -3
  19. package/src/cli/util/ast-promise-extractor.js +581 -0
  20. package/src/cli/util/ast-usestate-detector.js +3 -3
  21. package/src/cli/util/atomic-write.js +12 -1
  22. package/src/cli/util/console-reporter.js +72 -0
  23. package/src/cli/util/detection-engine.js +105 -41
  24. package/src/cli/util/determinism-runner.js +2 -1
  25. package/src/cli/util/determinism-writer.js +1 -1
  26. package/src/cli/util/digest-engine.js +359 -0
  27. package/src/cli/util/dom-diff.js +226 -0
  28. package/src/cli/util/env-url.js +0 -4
  29. package/src/cli/util/evidence-engine.js +287 -0
  30. package/src/cli/util/expectation-extractor.js +217 -367
  31. package/src/cli/util/findings-writer.js +19 -126
  32. package/src/cli/util/framework-detector.js +572 -0
  33. package/src/cli/util/idgen.js +1 -1
  34. package/src/cli/util/interaction-planner.js +529 -0
  35. package/src/cli/util/learn-writer.js +2 -2
  36. package/src/cli/util/ledger-writer.js +110 -0
  37. package/src/cli/util/monorepo-resolver.js +162 -0
  38. package/src/cli/util/observation-engine.js +127 -278
  39. package/src/cli/util/observe-writer.js +2 -2
  40. package/src/cli/util/paths.js +12 -3
  41. package/src/cli/util/project-discovery.js +284 -3
  42. package/src/cli/util/project-writer.js +2 -2
  43. package/src/cli/util/run-id.js +23 -27
  44. package/src/cli/util/run-result.js +778 -0
  45. package/src/cli/util/selector-resolver.js +235 -0
  46. package/src/cli/util/summary-writer.js +2 -1
  47. package/src/cli/util/svelte-navigation-detector.js +3 -3
  48. package/src/cli/util/svelte-sfc-extractor.js +0 -1
  49. package/src/cli/util/svelte-state-detector.js +1 -2
  50. package/src/cli/util/trust-activation-integration.js +496 -0
  51. package/src/cli/util/trust-activation-wrapper.js +85 -0
  52. package/src/cli/util/trust-integration-hooks.js +164 -0
  53. package/src/cli/util/types.js +153 -0
  54. package/src/cli/util/url-validation.js +40 -0
  55. package/src/cli/util/vue-navigation-detector.js +4 -3
  56. package/src/cli/util/vue-sfc-extractor.js +1 -2
  57. package/src/cli/util/vue-state-detector.js +1 -1
  58. package/src/types/fs-augment.d.ts +23 -0
  59. package/src/types/global.d.ts +137 -0
  60. package/src/types/internal-types.d.ts +35 -0
  61. package/src/verax/cli/finding-explainer.js +3 -56
  62. package/src/verax/cli/init.js +4 -18
  63. package/src/verax/core/action-classifier.js +4 -3
  64. package/src/verax/core/artifacts/registry.js +0 -15
  65. package/src/verax/core/artifacts/verifier.js +18 -8
  66. package/src/verax/core/baseline/baseline.snapshot.js +2 -0
  67. package/src/verax/core/capabilities/gates.js +7 -1
  68. package/src/verax/core/confidence/confidence-compute.js +14 -7
  69. package/src/verax/core/confidence/confidence.loader.js +1 -0
  70. package/src/verax/core/confidence-engine-refactor.js +8 -3
  71. package/src/verax/core/confidence-engine.js +162 -23
  72. package/src/verax/core/contracts/types.js +1 -0
  73. package/src/verax/core/contracts/validators.js +79 -4
  74. package/src/verax/core/decision-snapshot.js +3 -30
  75. package/src/verax/core/decisions/decision.trace.js +2 -0
  76. package/src/verax/core/determinism/contract-writer.js +2 -2
  77. package/src/verax/core/determinism/contract.js +1 -1
  78. package/src/verax/core/determinism/diff.js +42 -1
  79. package/src/verax/core/determinism/engine.js +7 -6
  80. package/src/verax/core/determinism/finding-identity.js +3 -2
  81. package/src/verax/core/determinism/normalize.js +32 -4
  82. package/src/verax/core/determinism/report-writer.js +1 -0
  83. package/src/verax/core/determinism/run-fingerprint.js +7 -2
  84. package/src/verax/core/dynamic-route-intelligence.js +8 -7
  85. package/src/verax/core/evidence/evidence-capture-service.js +1 -0
  86. package/src/verax/core/evidence/evidence-intent-ledger.js +2 -1
  87. package/src/verax/core/evidence-builder.js +2 -2
  88. package/src/verax/core/execution-mode-context.js +1 -1
  89. package/src/verax/core/execution-mode-detector.js +5 -3
  90. package/src/verax/core/failures/exit-codes.js +39 -37
  91. package/src/verax/core/failures/failure-summary.js +1 -1
  92. package/src/verax/core/failures/failure.factory.js +3 -3
  93. package/src/verax/core/failures/failure.ledger.js +3 -2
  94. package/src/verax/core/ga/ga.artifact.js +1 -1
  95. package/src/verax/core/ga/ga.contract.js +3 -2
  96. package/src/verax/core/ga/ga.enforcer.js +1 -0
  97. package/src/verax/core/guardrails/policy.loader.js +1 -0
  98. package/src/verax/core/guardrails/truth-reconciliation.js +1 -1
  99. package/src/verax/core/guardrails-engine.js +2 -2
  100. package/src/verax/core/incremental-store.js +1 -0
  101. package/src/verax/core/integrity/budget.js +138 -0
  102. package/src/verax/core/integrity/determinism.js +342 -0
  103. package/src/verax/core/integrity/integrity.js +208 -0
  104. package/src/verax/core/integrity/poisoning.js +108 -0
  105. package/src/verax/core/integrity/transaction.js +140 -0
  106. package/src/verax/core/observe/run-timeline.js +2 -0
  107. package/src/verax/core/perf/perf.report.js +2 -0
  108. package/src/verax/core/pipeline-tracker.js +5 -0
  109. package/src/verax/core/release/provenance.builder.js +73 -214
  110. package/src/verax/core/release/release.enforcer.js +14 -9
  111. package/src/verax/core/release/reproducibility.check.js +1 -0
  112. package/src/verax/core/release/sbom.builder.js +32 -23
  113. package/src/verax/core/replay-validator.js +2 -0
  114. package/src/verax/core/replay.js +4 -0
  115. package/src/verax/core/report/cross-index.js +6 -3
  116. package/src/verax/core/report/human-summary.js +141 -1
  117. package/src/verax/core/route-intelligence.js +4 -3
  118. package/src/verax/core/run-id.js +6 -3
  119. package/src/verax/core/run-manifest.js +4 -3
  120. package/src/verax/core/security/secrets.scan.js +10 -7
  121. package/src/verax/core/security/security.enforcer.js +4 -0
  122. package/src/verax/core/security/supplychain.policy.js +9 -1
  123. package/src/verax/core/security/vuln.scan.js +2 -2
  124. package/src/verax/core/truth/truth.certificate.js +3 -1
  125. package/src/verax/core/ui-feedback-intelligence.js +12 -46
  126. package/src/verax/detect/conditional-ui-silent-failure.js +84 -0
  127. package/src/verax/detect/confidence-engine.js +100 -660
  128. package/src/verax/detect/confidence-helper.js +1 -0
  129. package/src/verax/detect/detection-engine.js +1 -18
  130. package/src/verax/detect/dynamic-route-findings.js +17 -14
  131. package/src/verax/detect/expectation-chain-detector.js +1 -1
  132. package/src/verax/detect/expectation-model.js +3 -5
  133. package/src/verax/detect/failure-cause-inference.js +293 -0
  134. package/src/verax/detect/findings-writer.js +126 -166
  135. package/src/verax/detect/flow-detector.js +2 -2
  136. package/src/verax/detect/form-silent-failure.js +98 -0
  137. package/src/verax/detect/index.js +51 -234
  138. package/src/verax/detect/invariants-enforcer.js +147 -0
  139. package/src/verax/detect/journey-stall-detector.js +4 -4
  140. package/src/verax/detect/navigation-silent-failure.js +82 -0
  141. package/src/verax/detect/problem-aggregator.js +361 -0
  142. package/src/verax/detect/route-findings.js +7 -6
  143. package/src/verax/detect/summary-writer.js +477 -0
  144. package/src/verax/detect/test-failure-cause-inference.js +314 -0
  145. package/src/verax/detect/ui-feedback-findings.js +18 -18
  146. package/src/verax/detect/verdict-engine.js +3 -57
  147. package/src/verax/detect/view-switch-correlator.js +2 -2
  148. package/src/verax/flow/flow-engine.js +2 -1
  149. package/src/verax/flow/flow-spec.js +0 -6
  150. package/src/verax/index.js +48 -412
  151. package/src/verax/intel/ts-program.js +1 -0
  152. package/src/verax/intel/vue-navigation-extractor.js +3 -0
  153. package/src/verax/learn/action-contract-extractor.js +67 -682
  154. package/src/verax/learn/ast-contract-extractor.js +1 -1
  155. package/src/verax/learn/flow-extractor.js +1 -0
  156. package/src/verax/learn/project-detector.js +5 -0
  157. package/src/verax/learn/react-router-extractor.js +2 -0
  158. package/src/verax/learn/route-validator.js +1 -4
  159. package/src/verax/learn/source-instrumenter.js +1 -0
  160. package/src/verax/learn/state-extractor.js +2 -1
  161. package/src/verax/learn/static-extractor.js +1 -0
  162. package/src/verax/observe/coverage-gaps.js +132 -0
  163. package/src/verax/observe/expectation-handler.js +126 -0
  164. package/src/verax/observe/incremental-skip.js +46 -0
  165. package/src/verax/observe/index.js +735 -84
  166. package/src/verax/observe/interaction-executor.js +192 -0
  167. package/src/verax/observe/interaction-runner.js +782 -530
  168. package/src/verax/observe/network-firewall.js +86 -0
  169. package/src/verax/observe/observation-builder.js +169 -0
  170. package/src/verax/observe/observe-context.js +1 -1
  171. package/src/verax/observe/observe-helpers.js +2 -1
  172. package/src/verax/observe/observe-runner.js +28 -24
  173. package/src/verax/observe/observers/budget-observer.js +3 -3
  174. package/src/verax/observe/observers/console-observer.js +4 -4
  175. package/src/verax/observe/observers/coverage-observer.js +4 -4
  176. package/src/verax/observe/observers/interaction-observer.js +3 -3
  177. package/src/verax/observe/observers/navigation-observer.js +4 -4
  178. package/src/verax/observe/observers/network-observer.js +4 -4
  179. package/src/verax/observe/observers/safety-observer.js +1 -1
  180. package/src/verax/observe/observers/ui-feedback-observer.js +4 -4
  181. package/src/verax/observe/page-traversal.js +138 -0
  182. package/src/verax/observe/snapshot-ops.js +94 -0
  183. package/src/verax/observe/ui-signal-sensor.js +2 -148
  184. package/src/verax/scan-summary-writer.js +10 -42
  185. package/src/verax/shared/artifact-manager.js +30 -13
  186. package/src/verax/shared/caching.js +1 -0
  187. package/src/verax/shared/expectation-tracker.js +1 -0
  188. package/src/verax/shared/zip-artifacts.js +6 -0
  189. package/src/verax/core/confidence-engine.js.backup +0 -471
  190. package/src/verax/shared/config-loader.js +0 -169
  191. /package/src/verax/shared/{expectation-proof.js → expectation-validation.js} +0 -0
@@ -0,0 +1,192 @@
1
+ /**
2
+ * INTERACTION EXECUTION ENGINE
3
+ *
4
+ * Handles execution of interactions on pages, evidence capture, and tracing.
5
+ */
6
+
7
+ import { runInteraction } from './interaction-runner.js';
8
+ import { deriveObservedExpectation, shouldAttemptRepeatObservedExpectation, evaluateObservedExpectation } from './observed-expectation.js';
9
+ import { isExternalUrl } from './domain-boundary.js';
10
+
11
+ /**
12
+ * Execute a single interaction and capture results
13
+ *
14
+ * @param {Object} page - Playwright page
15
+ * @param {Object} interaction - Interaction to execute
16
+ * @param {number} timestamp - Execution timestamp
17
+ * @param {number} interactionIndex - Index in execution sequence
18
+ * @param {string} screenshotsDir - Directory for screenshots
19
+ * @param {string} baseOrigin - Base origin for URL checking
20
+ * @param {number} startTime - Scan start time
21
+ * @param {Object} routeBudget - Route-specific budget
22
+ * @param {Object} expectationResults - Results from proven expectations
23
+ * @param {Object} silenceTracker - Silence tracker
24
+ * @returns {Promise<{trace: Object, totalExecuted: number, navigatedToNewPage: boolean, newPageUrl: string|null}>}
25
+ */
26
+ export async function executeInteraction(
27
+ page,
28
+ interaction,
29
+ timestamp,
30
+ interactionIndex,
31
+ screenshotsDir,
32
+ baseOrigin,
33
+ startTime,
34
+ routeBudget,
35
+ expectationResults,
36
+ silenceTracker
37
+ ) {
38
+ const beforeUrl = page.url();
39
+
40
+ const trace = await runInteraction(
41
+ page,
42
+ interaction,
43
+ timestamp,
44
+ interactionIndex,
45
+ screenshotsDir,
46
+ baseOrigin,
47
+ startTime,
48
+ routeBudget,
49
+ null,
50
+ silenceTracker
51
+ );
52
+
53
+ let totalExecuted = 1;
54
+
55
+ if (trace) {
56
+ // Check if this matched a proven expectation
57
+ const matchingExpectation = expectationResults?.results?.find(
58
+ r => r.trace?.interaction?.selector === trace.interaction.selector
59
+ );
60
+
61
+ if (matchingExpectation) {
62
+ trace.expectationDriven = true;
63
+ trace.expectationId = matchingExpectation.expectationId;
64
+ trace.expectationOutcome = matchingExpectation.outcome;
65
+ } else {
66
+ // Derive observed expectation from trace
67
+ const observedExpectation = deriveObservedExpectation(interaction, trace, baseOrigin);
68
+ if (observedExpectation) {
69
+ trace.observedExpectation = observedExpectation;
70
+ trace.resultType = 'OBSERVED_EXPECTATION';
71
+
72
+ // Attempt repeat if eligible and budget allows
73
+ const repeatEligible = shouldAttemptRepeatObservedExpectation(observedExpectation, trace);
74
+ const budgetAllowsRepeat = repeatEligible &&
75
+ (Date.now() - startTime) < routeBudget.maxScanDurationMs;
76
+
77
+ if (budgetAllowsRepeat) {
78
+ const repeatIndex = interactionIndex + 1;
79
+ const repeatResult = await repeatObservedInteraction(
80
+ page,
81
+ interaction,
82
+ observedExpectation,
83
+ timestamp,
84
+ repeatIndex,
85
+ screenshotsDir,
86
+ baseOrigin,
87
+ startTime,
88
+ routeBudget
89
+ );
90
+
91
+ if (repeatResult) {
92
+ const repeatEvaluation = repeatResult.repeatEvaluation;
93
+ trace.observedExpectation.repeatAttempted = true;
94
+ trace.observedExpectation.repeated = repeatEvaluation.outcome === 'VERIFIED';
95
+ trace.observedExpectation.repeatOutcome = repeatEvaluation.outcome;
96
+ trace.observedExpectation.repeatReason = repeatEvaluation.reason;
97
+
98
+ if (repeatEvaluation.outcome === 'OBSERVED_BREAK') {
99
+ trace.observedExpectation.outcome = 'OBSERVED_BREAK';
100
+ trace.observedExpectation.reason = 'inconsistent_on_repeat';
101
+ trace.observedExpectation.confidenceLevel = 'LOW';
102
+ } else if (trace.observedExpectation.repeated && trace.observedExpectation.outcome === 'VERIFIED') {
103
+ trace.observedExpectation.confidenceLevel = 'MEDIUM';
104
+ }
105
+
106
+ totalExecuted = 2;
107
+ }
108
+ }
109
+ } else {
110
+ trace.unprovenResult = true;
111
+ trace.resultType = 'UNPROVEN_RESULT';
112
+ }
113
+ }
114
+ }
115
+
116
+ // Check for same-origin navigation
117
+ let navigatedToNewPage = false;
118
+ let newPageUrl = null;
119
+
120
+ if (trace) {
121
+ const afterUrl = trace.after?.url || page.url();
122
+ const navigatedSameOrigin = afterUrl && afterUrl !== beforeUrl && !isExternalUrl(afterUrl, baseOrigin);
123
+ if (navigatedSameOrigin && interaction.type === 'link') {
124
+ navigatedToNewPage = true;
125
+ newPageUrl = afterUrl;
126
+ }
127
+ }
128
+
129
+ return {
130
+ trace,
131
+ totalExecuted,
132
+ navigatedToNewPage,
133
+ newPageUrl
134
+ };
135
+ }
136
+
137
+ /**
138
+ * Repeat an observed interaction to verify consistency
139
+ */
140
+ async function repeatObservedInteraction(
141
+ page,
142
+ interaction,
143
+ observedExpectation,
144
+ timestamp,
145
+ interactionIndex,
146
+ screenshotsDir,
147
+ baseOrigin,
148
+ startTime,
149
+ scanBudget
150
+ ) {
151
+ const selector = observedExpectation.evidence?.selector || interaction.selector;
152
+ if (!selector) return null;
153
+
154
+ const locator = page.locator(selector).first();
155
+ const count = await locator.count();
156
+ if (count === 0) {
157
+ return null;
158
+ }
159
+
160
+ const repeatInteraction = {
161
+ ...interaction,
162
+ element: locator
163
+ };
164
+
165
+ const repeatTrace = await runInteraction(
166
+ page,
167
+ repeatInteraction,
168
+ timestamp,
169
+ interactionIndex,
170
+ screenshotsDir,
171
+ baseOrigin,
172
+ startTime,
173
+ scanBudget,
174
+ null,
175
+ null // No silence tracker for repeat executions
176
+ );
177
+
178
+ if (!repeatTrace) {
179
+ return null;
180
+ }
181
+
182
+ repeatTrace.repeatExecution = true;
183
+ repeatTrace.repeatOfObservedExpectationId = observedExpectation.id;
184
+ repeatTrace.resultType = 'OBSERVED_EXPECTATION_REPEAT';
185
+
186
+ const repeatEvaluation = evaluateObservedExpectation(observedExpectation, repeatTrace);
187
+
188
+ return {
189
+ repeatTrace,
190
+ repeatEvaluation
191
+ };
192
+ }