@veraxhq/verax 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -20
- package/bin/verax.js +11 -18
- package/package.json +28 -7
- package/src/cli/commands/baseline.js +1 -2
- package/src/cli/commands/default.js +72 -81
- package/src/cli/commands/doctor.js +29 -0
- package/src/cli/commands/ga.js +3 -0
- package/src/cli/commands/gates.js +1 -1
- package/src/cli/commands/inspect.js +6 -133
- package/src/cli/commands/release-check.js +2 -0
- package/src/cli/commands/run.js +74 -246
- package/src/cli/commands/security-check.js +2 -1
- package/src/cli/commands/truth.js +0 -1
- package/src/cli/entry.js +82 -309
- package/src/cli/util/angular-component-extractor.js +2 -2
- package/src/cli/util/angular-navigation-detector.js +2 -2
- package/src/cli/util/ast-interactive-detector.js +4 -6
- package/src/cli/util/ast-network-detector.js +3 -3
- package/src/cli/util/ast-promise-extractor.js +581 -0
- package/src/cli/util/ast-usestate-detector.js +3 -3
- package/src/cli/util/atomic-write.js +12 -1
- package/src/cli/util/console-reporter.js +72 -0
- package/src/cli/util/detection-engine.js +105 -41
- package/src/cli/util/determinism-runner.js +2 -1
- package/src/cli/util/determinism-writer.js +1 -1
- package/src/cli/util/digest-engine.js +359 -0
- package/src/cli/util/dom-diff.js +226 -0
- package/src/cli/util/env-url.js +0 -4
- package/src/cli/util/evidence-engine.js +287 -0
- package/src/cli/util/expectation-extractor.js +217 -367
- package/src/cli/util/findings-writer.js +19 -126
- package/src/cli/util/framework-detector.js +572 -0
- package/src/cli/util/idgen.js +1 -1
- package/src/cli/util/interaction-planner.js +529 -0
- package/src/cli/util/learn-writer.js +2 -2
- package/src/cli/util/ledger-writer.js +110 -0
- package/src/cli/util/monorepo-resolver.js +162 -0
- package/src/cli/util/observation-engine.js +127 -278
- package/src/cli/util/observe-writer.js +2 -2
- package/src/cli/util/paths.js +12 -3
- package/src/cli/util/project-discovery.js +284 -3
- package/src/cli/util/project-writer.js +2 -2
- package/src/cli/util/run-id.js +23 -27
- package/src/cli/util/run-result.js +778 -0
- package/src/cli/util/selector-resolver.js +235 -0
- package/src/cli/util/summary-writer.js +2 -1
- package/src/cli/util/svelte-navigation-detector.js +3 -3
- package/src/cli/util/svelte-sfc-extractor.js +0 -1
- package/src/cli/util/svelte-state-detector.js +1 -2
- package/src/cli/util/trust-activation-integration.js +496 -0
- package/src/cli/util/trust-activation-wrapper.js +85 -0
- package/src/cli/util/trust-integration-hooks.js +164 -0
- package/src/cli/util/types.js +153 -0
- package/src/cli/util/url-validation.js +40 -0
- package/src/cli/util/vue-navigation-detector.js +4 -3
- package/src/cli/util/vue-sfc-extractor.js +1 -2
- package/src/cli/util/vue-state-detector.js +1 -1
- package/src/types/fs-augment.d.ts +23 -0
- package/src/types/global.d.ts +137 -0
- package/src/types/internal-types.d.ts +35 -0
- package/src/verax/cli/finding-explainer.js +3 -56
- package/src/verax/cli/init.js +4 -18
- package/src/verax/core/action-classifier.js +4 -3
- package/src/verax/core/artifacts/registry.js +0 -15
- package/src/verax/core/artifacts/verifier.js +18 -8
- package/src/verax/core/baseline/baseline.snapshot.js +2 -0
- package/src/verax/core/capabilities/gates.js +7 -1
- package/src/verax/core/confidence/confidence-compute.js +14 -7
- package/src/verax/core/confidence/confidence.loader.js +1 -0
- package/src/verax/core/confidence-engine-refactor.js +8 -3
- package/src/verax/core/confidence-engine.js +162 -23
- package/src/verax/core/contracts/types.js +1 -0
- package/src/verax/core/contracts/validators.js +79 -4
- package/src/verax/core/decision-snapshot.js +3 -30
- package/src/verax/core/decisions/decision.trace.js +2 -0
- package/src/verax/core/determinism/contract-writer.js +2 -2
- package/src/verax/core/determinism/contract.js +1 -1
- package/src/verax/core/determinism/diff.js +42 -1
- package/src/verax/core/determinism/engine.js +7 -6
- package/src/verax/core/determinism/finding-identity.js +3 -2
- package/src/verax/core/determinism/normalize.js +32 -4
- package/src/verax/core/determinism/report-writer.js +1 -0
- package/src/verax/core/determinism/run-fingerprint.js +7 -2
- package/src/verax/core/dynamic-route-intelligence.js +8 -7
- package/src/verax/core/evidence/evidence-capture-service.js +1 -0
- package/src/verax/core/evidence/evidence-intent-ledger.js +2 -1
- package/src/verax/core/evidence-builder.js +2 -2
- package/src/verax/core/execution-mode-context.js +1 -1
- package/src/verax/core/execution-mode-detector.js +5 -3
- package/src/verax/core/failures/exit-codes.js +39 -37
- package/src/verax/core/failures/failure-summary.js +1 -1
- package/src/verax/core/failures/failure.factory.js +3 -3
- package/src/verax/core/failures/failure.ledger.js +3 -2
- package/src/verax/core/ga/ga.artifact.js +1 -1
- package/src/verax/core/ga/ga.contract.js +3 -2
- package/src/verax/core/ga/ga.enforcer.js +1 -0
- package/src/verax/core/guardrails/policy.loader.js +1 -0
- package/src/verax/core/guardrails/truth-reconciliation.js +1 -1
- package/src/verax/core/guardrails-engine.js +2 -2
- package/src/verax/core/incremental-store.js +1 -0
- package/src/verax/core/integrity/budget.js +138 -0
- package/src/verax/core/integrity/determinism.js +342 -0
- package/src/verax/core/integrity/integrity.js +208 -0
- package/src/verax/core/integrity/poisoning.js +108 -0
- package/src/verax/core/integrity/transaction.js +140 -0
- package/src/verax/core/observe/run-timeline.js +2 -0
- package/src/verax/core/perf/perf.report.js +2 -0
- package/src/verax/core/pipeline-tracker.js +5 -0
- package/src/verax/core/release/provenance.builder.js +73 -214
- package/src/verax/core/release/release.enforcer.js +14 -9
- package/src/verax/core/release/reproducibility.check.js +1 -0
- package/src/verax/core/release/sbom.builder.js +32 -23
- package/src/verax/core/replay-validator.js +2 -0
- package/src/verax/core/replay.js +4 -0
- package/src/verax/core/report/cross-index.js +6 -3
- package/src/verax/core/report/human-summary.js +141 -1
- package/src/verax/core/route-intelligence.js +4 -3
- package/src/verax/core/run-id.js +6 -3
- package/src/verax/core/run-manifest.js +4 -3
- package/src/verax/core/security/secrets.scan.js +10 -7
- package/src/verax/core/security/security.enforcer.js +4 -0
- package/src/verax/core/security/supplychain.policy.js +9 -1
- package/src/verax/core/security/vuln.scan.js +2 -2
- package/src/verax/core/truth/truth.certificate.js +3 -1
- package/src/verax/core/ui-feedback-intelligence.js +12 -46
- package/src/verax/detect/conditional-ui-silent-failure.js +84 -0
- package/src/verax/detect/confidence-engine.js +100 -660
- package/src/verax/detect/confidence-helper.js +1 -0
- package/src/verax/detect/detection-engine.js +1 -18
- package/src/verax/detect/dynamic-route-findings.js +17 -14
- package/src/verax/detect/expectation-chain-detector.js +1 -1
- package/src/verax/detect/expectation-model.js +3 -5
- package/src/verax/detect/failure-cause-inference.js +293 -0
- package/src/verax/detect/findings-writer.js +126 -166
- package/src/verax/detect/flow-detector.js +2 -2
- package/src/verax/detect/form-silent-failure.js +98 -0
- package/src/verax/detect/index.js +51 -234
- package/src/verax/detect/invariants-enforcer.js +147 -0
- package/src/verax/detect/journey-stall-detector.js +4 -4
- package/src/verax/detect/navigation-silent-failure.js +82 -0
- package/src/verax/detect/problem-aggregator.js +361 -0
- package/src/verax/detect/route-findings.js +7 -6
- package/src/verax/detect/summary-writer.js +477 -0
- package/src/verax/detect/test-failure-cause-inference.js +314 -0
- package/src/verax/detect/ui-feedback-findings.js +18 -18
- package/src/verax/detect/verdict-engine.js +3 -57
- package/src/verax/detect/view-switch-correlator.js +2 -2
- package/src/verax/flow/flow-engine.js +2 -1
- package/src/verax/flow/flow-spec.js +0 -6
- package/src/verax/index.js +48 -412
- package/src/verax/intel/ts-program.js +1 -0
- package/src/verax/intel/vue-navigation-extractor.js +3 -0
- package/src/verax/learn/action-contract-extractor.js +67 -682
- package/src/verax/learn/ast-contract-extractor.js +1 -1
- package/src/verax/learn/flow-extractor.js +1 -0
- package/src/verax/learn/project-detector.js +5 -0
- package/src/verax/learn/react-router-extractor.js +2 -0
- package/src/verax/learn/route-validator.js +1 -4
- package/src/verax/learn/source-instrumenter.js +1 -0
- package/src/verax/learn/state-extractor.js +2 -1
- package/src/verax/learn/static-extractor.js +1 -0
- package/src/verax/observe/coverage-gaps.js +132 -0
- package/src/verax/observe/expectation-handler.js +126 -0
- package/src/verax/observe/incremental-skip.js +46 -0
- package/src/verax/observe/index.js +735 -84
- package/src/verax/observe/interaction-executor.js +192 -0
- package/src/verax/observe/interaction-runner.js +782 -530
- package/src/verax/observe/network-firewall.js +86 -0
- package/src/verax/observe/observation-builder.js +169 -0
- package/src/verax/observe/observe-context.js +1 -1
- package/src/verax/observe/observe-helpers.js +2 -1
- package/src/verax/observe/observe-runner.js +28 -24
- package/src/verax/observe/observers/budget-observer.js +3 -3
- package/src/verax/observe/observers/console-observer.js +4 -4
- package/src/verax/observe/observers/coverage-observer.js +4 -4
- package/src/verax/observe/observers/interaction-observer.js +3 -3
- package/src/verax/observe/observers/navigation-observer.js +4 -4
- package/src/verax/observe/observers/network-observer.js +4 -4
- package/src/verax/observe/observers/safety-observer.js +1 -1
- package/src/verax/observe/observers/ui-feedback-observer.js +4 -4
- package/src/verax/observe/page-traversal.js +138 -0
- package/src/verax/observe/snapshot-ops.js +94 -0
- package/src/verax/observe/ui-signal-sensor.js +2 -148
- package/src/verax/scan-summary-writer.js +10 -42
- package/src/verax/shared/artifact-manager.js +30 -13
- package/src/verax/shared/caching.js +1 -0
- package/src/verax/shared/expectation-tracker.js +1 -0
- package/src/verax/shared/zip-artifacts.js +6 -0
- package/src/verax/core/confidence-engine.js.backup +0 -471
- package/src/verax/shared/config-loader.js +0 -169
- /package/src/verax/shared/{expectation-proof.js → expectation-validation.js} +0 -0
|
@@ -0,0 +1,192 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* INTERACTION EXECUTION ENGINE
|
|
3
|
+
*
|
|
4
|
+
* Handles execution of interactions on pages, evidence capture, and tracing.
|
|
5
|
+
*/
|
|
6
|
+
|
|
7
|
+
import { runInteraction } from './interaction-runner.js';
|
|
8
|
+
import { deriveObservedExpectation, shouldAttemptRepeatObservedExpectation, evaluateObservedExpectation } from './observed-expectation.js';
|
|
9
|
+
import { isExternalUrl } from './domain-boundary.js';
|
|
10
|
+
|
|
11
|
+
/**
|
|
12
|
+
* Execute a single interaction and capture results
|
|
13
|
+
*
|
|
14
|
+
* @param {Object} page - Playwright page
|
|
15
|
+
* @param {Object} interaction - Interaction to execute
|
|
16
|
+
* @param {number} timestamp - Execution timestamp
|
|
17
|
+
* @param {number} interactionIndex - Index in execution sequence
|
|
18
|
+
* @param {string} screenshotsDir - Directory for screenshots
|
|
19
|
+
* @param {string} baseOrigin - Base origin for URL checking
|
|
20
|
+
* @param {number} startTime - Scan start time
|
|
21
|
+
* @param {Object} routeBudget - Route-specific budget
|
|
22
|
+
* @param {Object} expectationResults - Results from proven expectations
|
|
23
|
+
* @param {Object} silenceTracker - Silence tracker
|
|
24
|
+
* @returns {Promise<{trace: Object, totalExecuted: number, navigatedToNewPage: boolean, newPageUrl: string|null}>}
|
|
25
|
+
*/
|
|
26
|
+
export async function executeInteraction(
|
|
27
|
+
page,
|
|
28
|
+
interaction,
|
|
29
|
+
timestamp,
|
|
30
|
+
interactionIndex,
|
|
31
|
+
screenshotsDir,
|
|
32
|
+
baseOrigin,
|
|
33
|
+
startTime,
|
|
34
|
+
routeBudget,
|
|
35
|
+
expectationResults,
|
|
36
|
+
silenceTracker
|
|
37
|
+
) {
|
|
38
|
+
const beforeUrl = page.url();
|
|
39
|
+
|
|
40
|
+
const trace = await runInteraction(
|
|
41
|
+
page,
|
|
42
|
+
interaction,
|
|
43
|
+
timestamp,
|
|
44
|
+
interactionIndex,
|
|
45
|
+
screenshotsDir,
|
|
46
|
+
baseOrigin,
|
|
47
|
+
startTime,
|
|
48
|
+
routeBudget,
|
|
49
|
+
null,
|
|
50
|
+
silenceTracker
|
|
51
|
+
);
|
|
52
|
+
|
|
53
|
+
let totalExecuted = 1;
|
|
54
|
+
|
|
55
|
+
if (trace) {
|
|
56
|
+
// Check if this matched a proven expectation
|
|
57
|
+
const matchingExpectation = expectationResults?.results?.find(
|
|
58
|
+
r => r.trace?.interaction?.selector === trace.interaction.selector
|
|
59
|
+
);
|
|
60
|
+
|
|
61
|
+
if (matchingExpectation) {
|
|
62
|
+
trace.expectationDriven = true;
|
|
63
|
+
trace.expectationId = matchingExpectation.expectationId;
|
|
64
|
+
trace.expectationOutcome = matchingExpectation.outcome;
|
|
65
|
+
} else {
|
|
66
|
+
// Derive observed expectation from trace
|
|
67
|
+
const observedExpectation = deriveObservedExpectation(interaction, trace, baseOrigin);
|
|
68
|
+
if (observedExpectation) {
|
|
69
|
+
trace.observedExpectation = observedExpectation;
|
|
70
|
+
trace.resultType = 'OBSERVED_EXPECTATION';
|
|
71
|
+
|
|
72
|
+
// Attempt repeat if eligible and budget allows
|
|
73
|
+
const repeatEligible = shouldAttemptRepeatObservedExpectation(observedExpectation, trace);
|
|
74
|
+
const budgetAllowsRepeat = repeatEligible &&
|
|
75
|
+
(Date.now() - startTime) < routeBudget.maxScanDurationMs;
|
|
76
|
+
|
|
77
|
+
if (budgetAllowsRepeat) {
|
|
78
|
+
const repeatIndex = interactionIndex + 1;
|
|
79
|
+
const repeatResult = await repeatObservedInteraction(
|
|
80
|
+
page,
|
|
81
|
+
interaction,
|
|
82
|
+
observedExpectation,
|
|
83
|
+
timestamp,
|
|
84
|
+
repeatIndex,
|
|
85
|
+
screenshotsDir,
|
|
86
|
+
baseOrigin,
|
|
87
|
+
startTime,
|
|
88
|
+
routeBudget
|
|
89
|
+
);
|
|
90
|
+
|
|
91
|
+
if (repeatResult) {
|
|
92
|
+
const repeatEvaluation = repeatResult.repeatEvaluation;
|
|
93
|
+
trace.observedExpectation.repeatAttempted = true;
|
|
94
|
+
trace.observedExpectation.repeated = repeatEvaluation.outcome === 'VERIFIED';
|
|
95
|
+
trace.observedExpectation.repeatOutcome = repeatEvaluation.outcome;
|
|
96
|
+
trace.observedExpectation.repeatReason = repeatEvaluation.reason;
|
|
97
|
+
|
|
98
|
+
if (repeatEvaluation.outcome === 'OBSERVED_BREAK') {
|
|
99
|
+
trace.observedExpectation.outcome = 'OBSERVED_BREAK';
|
|
100
|
+
trace.observedExpectation.reason = 'inconsistent_on_repeat';
|
|
101
|
+
trace.observedExpectation.confidenceLevel = 'LOW';
|
|
102
|
+
} else if (trace.observedExpectation.repeated && trace.observedExpectation.outcome === 'VERIFIED') {
|
|
103
|
+
trace.observedExpectation.confidenceLevel = 'MEDIUM';
|
|
104
|
+
}
|
|
105
|
+
|
|
106
|
+
totalExecuted = 2;
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
} else {
|
|
110
|
+
trace.unprovenResult = true;
|
|
111
|
+
trace.resultType = 'UNPROVEN_RESULT';
|
|
112
|
+
}
|
|
113
|
+
}
|
|
114
|
+
}
|
|
115
|
+
|
|
116
|
+
// Check for same-origin navigation
|
|
117
|
+
let navigatedToNewPage = false;
|
|
118
|
+
let newPageUrl = null;
|
|
119
|
+
|
|
120
|
+
if (trace) {
|
|
121
|
+
const afterUrl = trace.after?.url || page.url();
|
|
122
|
+
const navigatedSameOrigin = afterUrl && afterUrl !== beforeUrl && !isExternalUrl(afterUrl, baseOrigin);
|
|
123
|
+
if (navigatedSameOrigin && interaction.type === 'link') {
|
|
124
|
+
navigatedToNewPage = true;
|
|
125
|
+
newPageUrl = afterUrl;
|
|
126
|
+
}
|
|
127
|
+
}
|
|
128
|
+
|
|
129
|
+
return {
|
|
130
|
+
trace,
|
|
131
|
+
totalExecuted,
|
|
132
|
+
navigatedToNewPage,
|
|
133
|
+
newPageUrl
|
|
134
|
+
};
|
|
135
|
+
}
|
|
136
|
+
|
|
137
|
+
/**
|
|
138
|
+
* Repeat an observed interaction to verify consistency
|
|
139
|
+
*/
|
|
140
|
+
async function repeatObservedInteraction(
|
|
141
|
+
page,
|
|
142
|
+
interaction,
|
|
143
|
+
observedExpectation,
|
|
144
|
+
timestamp,
|
|
145
|
+
interactionIndex,
|
|
146
|
+
screenshotsDir,
|
|
147
|
+
baseOrigin,
|
|
148
|
+
startTime,
|
|
149
|
+
scanBudget
|
|
150
|
+
) {
|
|
151
|
+
const selector = observedExpectation.evidence?.selector || interaction.selector;
|
|
152
|
+
if (!selector) return null;
|
|
153
|
+
|
|
154
|
+
const locator = page.locator(selector).first();
|
|
155
|
+
const count = await locator.count();
|
|
156
|
+
if (count === 0) {
|
|
157
|
+
return null;
|
|
158
|
+
}
|
|
159
|
+
|
|
160
|
+
const repeatInteraction = {
|
|
161
|
+
...interaction,
|
|
162
|
+
element: locator
|
|
163
|
+
};
|
|
164
|
+
|
|
165
|
+
const repeatTrace = await runInteraction(
|
|
166
|
+
page,
|
|
167
|
+
repeatInteraction,
|
|
168
|
+
timestamp,
|
|
169
|
+
interactionIndex,
|
|
170
|
+
screenshotsDir,
|
|
171
|
+
baseOrigin,
|
|
172
|
+
startTime,
|
|
173
|
+
scanBudget,
|
|
174
|
+
null,
|
|
175
|
+
null // No silence tracker for repeat executions
|
|
176
|
+
);
|
|
177
|
+
|
|
178
|
+
if (!repeatTrace) {
|
|
179
|
+
return null;
|
|
180
|
+
}
|
|
181
|
+
|
|
182
|
+
repeatTrace.repeatExecution = true;
|
|
183
|
+
repeatTrace.repeatOfObservedExpectationId = observedExpectation.id;
|
|
184
|
+
repeatTrace.resultType = 'OBSERVED_EXPECTATION_REPEAT';
|
|
185
|
+
|
|
186
|
+
const repeatEvaluation = evaluateObservedExpectation(observedExpectation, repeatTrace);
|
|
187
|
+
|
|
188
|
+
return {
|
|
189
|
+
repeatTrace,
|
|
190
|
+
repeatEvaluation
|
|
191
|
+
};
|
|
192
|
+
}
|