fraud-sim 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] — Cleaner customer-only output, end-to-end walkthrough — 2026-10-16
+
+### Added
+
+- **End-to-end walkthrough** (`test/e2e/walkthrough.e2e.js`). Starts both
+  practice engines as real HTTP servers and drives the real CLI and library
+  against them in six acts: a contained botnet, a defeated adaptive attacker, a
+  smarter attacker finding the hardened engine's gap, customers getting
+  through, the full suite gated on block rate and false positives, and an
+  unreachable target exiting 3. `npm run demo` paces it for a screen recording
+  and opens the HTML report; `npm run test:e2e` runs it flat out and is part of
+  CI. Every act asserts what it shows.
+
+### Fixed
+
+- The terminal report no longer prints an empty attack table and a
+  "TOTAL 0 events" line for a run that contained only legitimate traffic.
+
 ## [0.5.0] — False positives, markets, a harder target — 2026-10-16
 
 The first npm release since 0.2.0. Versions 0.3.0 and 0.4.0 below were tagged

package/README.md

@@ -155,6 +155,24 @@ you have.
 Graduating to the real thing is a one-line change — swap the `baseUrl`. Full
 walk-through in **[docs/TESTING.md](docs/TESTING.md)**.
 
+### Watch the whole thing in 90 seconds
+
+From a clone of the repository, `npm run demo` starts both practice engines
+and walks through six acts in the terminal, paced to be followed:
+
+1. A credential-stuffing botnet is contained.
+2. An adaptive attacker that rotates IP, device and browser is defeated.
+3. A smarter attacker replays a device that was only challenged, and gets in.
+4. Ordinary customers get through the hardened engine.
+5. The full suite, gated like CI: an 85% block rate passes, and customers
+   blocked fail the run.
+6. An unreachable target exits 3 — fix the environment, not the rules.
+
+It finishes by opening the HTML report. Each act asserts what it shows, and CI
+runs the same walkthrough flat out (`npm run test:e2e`), so the demo cannot
+drift from what the tool does. `DEMO_PACE=<ms>` sets the pause per beat;
+`DEMO_LLM=anthropic` with `ANTHROPIC_API_KEY` puts a real model behind act 3.
+
 ---
 
 ## The command line

package/bin/fraud-sim.js

@@ -24,7 +24,7 @@ import { run, runSuite, listScenarios, resolveLocale, localeIds } from '../src/i
 import { httpAdapter } from '../src/adapters/http.js';
 import { generateReport, summarise } from '../src/reporting/index.js';
 
-const VERSION = '0.5.0';
+const VERSION = '0.5.1';
 
 const FORMAT_BY_EXT = {
   '.html': 'html',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraud-sim",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Realistic synthetic attack traffic for testing fintech fraud detection systems",
   "type": "module",
   "main": "src/index.js",
@@ -46,6 +46,9 @@
     "test": "cd test/unit && node --test",
     "test:integration": "cd test/integration && node --test",
     "test:all": "cd test && node --test",
+    "test:e2e": "node --test test/e2e/walkthrough.e2e.js",
+    "demo": "node --test-reporter=spec test/e2e/walkthrough.e2e.js",
+    "demo:npm": "node --test-reporter=spec test/e2e/walkthrough.e2e.js --from-npm",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "example:basic": "node examples/basic-credential-stuffing/index.js",

package/src/reporting/index.js

@@ -119,28 +119,33 @@ function renderText(result, options = {}) {
   const width = Math.max(20, ...all.map((r) => String(r.scenarioId).length));
 
   const lines = [];
-  lines.push('');
-  lines.push(
-    `  ${pad('SCENARIO', width)}  ${rpad('EVENTS', 6)}  ${rpad('BLOCK', 6)}  ${rpad('CHALL', 6)}  ${rpad('ALLOW', 6)}  ${rpad('RATE', 7)}  OUTCOME`
-  );
-  lines.push(`  ${'-'.repeat(width + 48)}`);
 
-  for (const r of reports) {
-    const o = outcomeFor(r);
+  // A run of customer traffic alone has no attack half; an empty table and a
+  // "TOTAL 0 events" line would read as a run that measured nothing.
+  if (reports.length) {
+    lines.push('');
     lines.push(
-      `  ${pad(r.scenarioId, width)}  ${rpad(r.attempts, 6)}  ${rpad(r.blocked, 6)}  ` +
-        `${rpad(r.stepUp, 6)}  ${rpad(r.allowed, 6)}  ${rpad((r.blockRate * 100).toFixed(1) + '%', 7)}  ${o.label}`
+      `  ${pad('SCENARIO', width)}  ${rpad('EVENTS', 6)}  ${rpad('BLOCK', 6)}  ${rpad('CHALL', 6)}  ${rpad('ALLOW', 6)}  ${rpad('RATE', 7)}  OUTCOME`
     );
-  }
+    lines.push(`  ${'-'.repeat(width + 48)}`);
 
-  lines.push('');
-  lines.push(
-    `  TOTAL  ${totals.attempts} events · ${totals.scoredAttempts} scored · ` +
-      `${(totals.blockRate * 100).toFixed(1)}% blocked · ${totals.errors} errors`
-  );
+    for (const r of reports) {
+      const o = outcomeFor(r);
+      lines.push(
+        `  ${pad(r.scenarioId, width)}  ${rpad(r.attempts, 6)}  ${rpad(r.blocked, 6)}  ` +
+          `${rpad(r.stepUp, 6)}  ${rpad(r.allowed, 6)}  ${rpad((r.blockRate * 100).toFixed(1) + '%', 7)}  ${o.label}`
+      );
+    }
 
-  if (totals.estimatedLossMinor > 0) {
-    lines.push(`  LOSS   ${formatMoney(totals.estimatedLossMinor, options)} extracted`);
+    lines.push('');
+    lines.push(
+      `  TOTAL  ${totals.attempts} events · ${totals.scoredAttempts} scored · ` +
+        `${(totals.blockRate * 100).toFixed(1)}% blocked · ${totals.errors} errors`
+    );
+
+    if (totals.estimatedLossMinor > 0) {
+      lines.push(`  LOSS   ${formatMoney(totals.estimatedLossMinor, options)} extracted`);
+    }
   }
 
   // The other half of the measurement, in its own table: here a block is the