qa360 1.0.4 → 1.1.0

package/dist/core/vault/index.js

@@ -0,0 +1,631 @@
+/**
+ * QA360 Evidence Vault Engine
+ * SQLite WAL-based storage with idempotence and CAS integration
+ */
+import sqlite3pkg from 'sqlite3';
+const { Database } = sqlite3pkg;
+import { existsSync, mkdirSync } from 'fs';
+import { join, resolve } from 'path';
+import { randomUUID } from 'crypto';
+import { createHash } from 'crypto';
+import { ContentAddressableStorage } from './cas.js';
+import { SecurityRedactor } from '../security/redactor.js';
+export class EvidenceVault {
+    db;
+    cas;
+    redactor;
+    dbPath;
+    baseDir;
+    constructor(config) {
+        this.baseDir = resolve(config.baseDir);
+        this.dbPath = join(this.baseDir, 'vault.db');
+        this.cas = new ContentAddressableStorage(join(this.baseDir, 'runs'));
+        this.redactor = SecurityRedactor.forReports();
+        this.ensureDirectories();
+        this.initializeDatabase(config);
+    }
+    /**
+     * Open vault connection and initialize schema
+     */
+    static async open(baseDir, config) {
+        const fullConfig = {
+            baseDir,
+            enableWAL: true,
+            maxConnections: 10,
+            retentionDays: 90,
+            ...config
+        };
+        const vault = new EvidenceVault(fullConfig);
+        await vault.initializeSchema();
+        return vault;
+    }
+    /**
+     * Begin a new run with idempotence support
+     */
+    async beginRun(options) {
+        // Check for existing run with same run_key
+        if (options.run_key) {
+            const existing = await this.getRunByKey(options.run_key);
+            if (existing) {
+                console.log(`[VAULT] RUN_IDEMPOTENT_REUSED: ${existing.id} (key: ${options.run_key})`);
+                return { runId: existing.id, isReused: true };
+            }
+        }
+        const runId = randomUUID();
+        const now = Date.now();
+        const run = {
+            id: runId,
+            run_key: options.run_key,
+            started_at: now,
+            pack_hash: options.pack_hash,
+            pack_path: options.pack_path,
+            status: 'running',
+            weights_json: options.weights ? JSON.stringify(options.weights) : undefined,
+            pinned: 0,
+            created_at: now,
+            updated_at: now
+        };
+        await this.insertRun(run);
+        console.log(`[VAULT] RUN_STARTED: ${runId} (key: ${options.run_key || 'none'})`);
+        return { runId, isReused: false };
+    }
+    /**
+     * Finish a run with final status and signature
+     */
+    async finishRun(runId, options) {
+        const now = Date.now();
+        const updates = {
+            ended_at: now,
+            status: options.status,
+            trust_score: options.trust_score,
+            signature_hex: options.signature,
+            updated_at: now
+        };
+        if (options.weights) {
+            updates.weights_json = JSON.stringify(options.weights);
+        }
+        if (options.proof_pdf_sha) {
+            const artifact = await this.getArtifact(options.proof_pdf_sha);
+            if (artifact) {
+                updates.proof_pdf_path = artifact.cas_path;
+                await this.attachArtifact(runId, { sha256: options.proof_pdf_sha, label: 'proof_pdf' });
+            }
+        }
+        await this.updateRun(runId, updates);
+        console.log(`[VAULT] RUN_FINISHED: ${runId} (status: ${options.status}, trust: ${options.trust_score})`);
+    }
+    /**
+     * Record gate execution result
+     */
+    async recordGate(runId, gate) {
+        const gateRecord = {
+            run_id: runId,
+            created_at: Date.now(),
+            ...gate
+        };
+        const gateId = await this.insertGate(gateRecord);
+        console.log(`[VAULT] GATE_RECORDED: ${runId}/${gate.name} (status: ${gate.status}, duration: ${gate.duration_ms}ms)`);
+        return gateId;
+    }
+    /**
+     * Record security/quality finding
+     */
+    async recordFinding(runId, finding) {
+        // Redact sensitive information
+        const redactedFinding = {
+            run_id: runId,
+            created_at: Date.now(),
+            ...finding,
+            message: this.redactor.redact(finding.message),
+            raw_output: finding.raw_output ? this.redactor.redact(finding.raw_output) : undefined,
+            fingerprint: finding.fingerprint || this.generateFindingFingerprint(finding)
+        };
+        const findingId = await this.insertFinding(redactedFinding);
+        console.log(`[VAULT] FINDING_RECORDED: ${runId}/${finding.gate} (severity: ${finding.severity}, rule: ${finding.rule})`);
+        return findingId;
+    }
+    /**
+     * Store artifact in CAS and link to run
+     */
+    async storeArtifact(runId, content, mimeType, label, originalName) {
+        const casArtifact = await this.cas.saveArtifact(content, mimeType, originalName);
+        // Store artifact metadata
+        const artifact = {
+            sha256: casArtifact.sha256,
+            mime_type: mimeType,
+            size_bytes: casArtifact.size,
+            cas_path: casArtifact.path,
+            original_name: originalName,
+            created_at: Date.now(),
+            last_accessed: Date.now()
+        };
+        await this.insertArtifact(artifact);
+        await this.attachArtifact(runId, { sha256: casArtifact.sha256, label });
+        console.log(`[VAULT] ARTIFACT_STORED: ${runId}/${label} (sha256: ${casArtifact.sha256.substring(0, 8)}..., size: ${casArtifact.size})`);
+        return casArtifact;
+    }
+    /**
+     * Attach existing artifact to run
+     */
+    async attachArtifact(runId, link) {
+        const linkRecord = {
+            run_id: runId,
+            sha256: link.sha256,
+            label: link.label,
+            created_at: Date.now()
+        };
+        await this.insertRunArtifact(linkRecord);
+    }
+    /**
+     * Get run by ID
+     */
+    async getRun(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM runs WHERE id = ?', [runId], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Get run by run_key
+     */
+    async getRunByKey(runKey) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM runs WHERE run_key = ?', [runKey], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * List runs with filters
+     */
+    async listRuns(filters) {
+        let query = 'SELECT * FROM runs WHERE 1=1';
+        const params = [];
+        if (filters?.status?.length) {
+            query += ` AND status IN (${filters.status.map(() => '?').join(',')})`;
+            params.push(...filters.status);
+        }
+        if (filters?.since) {
+            query += ' AND started_at >= ?';
+            params.push(filters.since.getTime());
+        }
+        if (filters?.until) {
+            query += ' AND started_at <= ?';
+            params.push(filters.until.getTime());
+        }
+        if (filters?.pack_hash) {
+            query += ' AND pack_hash = ?';
+            params.push(filters.pack_hash);
+        }
+        query += ' ORDER BY started_at DESC';
+        if (filters?.limit) {
+            query += ' LIMIT ?';
+            params.push(filters.limit);
+            if (filters?.offset) {
+                query += ' OFFSET ?';
+                params.push(filters.offset);
+            }
+        }
+        return new Promise((resolve, reject) => {
+            this.db.all(query, params, (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get gates for a run
+     */
+    async getGates(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.all('SELECT * FROM gates WHERE run_id = ? ORDER BY created_at', [runId], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get findings for a run
+     */
+    async getFindings(runId, gate) {
+        let query = 'SELECT * FROM findings WHERE run_id = ?';
+        const params = [runId];
+        if (gate) {
+            query += ' AND gate = ?';
+            params.push(gate);
+        }
+        query += ' ORDER BY severity DESC, created_at';
+        return new Promise((resolve, reject) => {
+            this.db.all(query, params, (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get artifacts for a run
+     */
+    async getRunArtifacts(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.all(`
+        SELECT a.*, ra.label 
+        FROM artifacts a
+        JOIN run_artifacts ra ON a.sha256 = ra.sha256
+        WHERE ra.run_id = ?
+        ORDER BY ra.created_at
+      `, [runId], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get artifact by SHA256
+     */
+    async getArtifact(sha256) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM artifacts WHERE sha256 = ?', [sha256], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Pin/unpin run to protect from GC
+     */
+    async pinRun(runId, pinned = true) {
+        await this.updateRun(runId, { pinned: pinned ? 1 : 0 });
+        console.log(`[VAULT] RUN_${pinned ? 'PINNED' : 'UNPINNED'}: ${runId}`);
+    }
+    /**
+     * Calculate pack hash for idempotence
+     */
+    static calculatePackHash(packContent) {
+        // Normalize pack content (remove comments, sort keys, etc.)
+        const normalized = packContent
+            .split('\n')
+            .filter(line => !line.trim().startsWith('#'))
+            .join('\n')
+            .trim();
+        return createHash('sha256').update(normalized).digest('hex');
+    }
+    /**
+     * Get vault statistics
+     */
+    async getStats() {
+        const queries = [
+            'SELECT COUNT(*) as count FROM runs',
+            'SELECT COUNT(*) as count FROM gates',
+            'SELECT COUNT(*) as count FROM findings',
+            'SELECT COUNT(*) as count FROM artifacts',
+            'SELECT MIN(started_at) as oldest, MAX(started_at) as newest FROM runs'
+        ];
+        const results = await Promise.all(queries.map(query => new Promise((resolve, reject) => {
+            this.db.get(query, (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row);
+            });
+        })));
+        const casStats = await this.cas.getStats();
+        return {
+            totalRuns: results[0].count,
+            totalGates: results[1].count,
+            totalFindings: results[2].count,
+            totalArtifacts: results[3].count,
+            vaultSizeBytes: casStats.totalBytes,
+            oldestRun: results[4].oldest ? new Date(results[4].oldest) : undefined,
+            newestRun: results[4].newest ? new Date(results[4].newest) : undefined
+        };
+    }
+    // Private helper methods
+    async insertRun(run) {
+        const fields = Object.keys(run).join(', ');
+        const placeholders = Object.keys(run).map(() => '?').join(', ');
+        const values = Object.values(run);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO runs (${fields}) VALUES (${placeholders})`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async updateRun(runId, updates) {
+        const fields = Object.keys(updates).map(key => `${key} = ?`).join(', ');
+        const values = [...Object.values(updates), runId];
+        return new Promise((resolve, reject) => {
+            this.db.run(`UPDATE runs SET ${fields} WHERE id = ?`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertGate(gate) {
+        const fields = Object.keys(gate).join(', ');
+        const placeholders = Object.keys(gate).map(() => '?').join(', ');
+        const values = Object.values(gate);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO gates (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async insertFinding(finding) {
+        const fields = Object.keys(finding).join(', ');
+        const placeholders = Object.keys(finding).map(() => '?').join(', ');
+        const values = Object.values(finding);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO findings (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async insertArtifact(artifact) {
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT OR IGNORE INTO artifacts (sha256, mime_type, size_bytes, cas_path, original_name, created_at, last_accessed) 
+         VALUES (?, ?, ?, ?, ?, ?, ?)`, [
+                artifact.sha256,
+                artifact.mime_type,
+                artifact.size_bytes,
+                artifact.cas_path,
+                artifact.original_name,
+                artifact.created_at,
+                artifact.last_accessed
+            ], (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertRunArtifact(link) {
+        return new Promise((resolve, reject) => {
+            this.db.run('INSERT OR IGNORE INTO run_artifacts (run_id, sha256, label, created_at) VALUES (?, ?, ?, ?)', [link.run_id, link.sha256, link.label, link.created_at], (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    generateFindingFingerprint(finding) {
+        const content = `${finding.gate}:${finding.rule}:${finding.location || ''}:${finding.message}`;
+        return createHash('sha256').update(content).digest('hex').substring(0, 16);
+    }
+    /**
+     * Initialize database connection
+     */
+    initializeDatabase(config) {
+        this.db = new Database(this.dbPath);
+        if (config.enableWAL) {
+            this.db.exec('PRAGMA journal_mode = WAL');
+            this.db.exec('PRAGMA synchronous = NORMAL');
+        }
+        this.db.exec('PRAGMA foreign_keys = ON');
+        this.db.exec('PRAGMA cache_size = 10000');
+        this.db.exec('PRAGMA temp_store = MEMORY');
+    }
+    /**
+     * Initialize database schema
+     */
+    async initializeSchema() {
+        const schema = `
+-- QA360 Evidence Vault Schema
+-- SQLite WAL mode for concurrent access and performance
+
+-- Runs table: core execution records
+CREATE TABLE IF NOT EXISTS runs (
+    id TEXT PRIMARY KEY,
+    run_key TEXT UNIQUE,
+    started_at INTEGER NOT NULL,
+    ended_at INTEGER,
+    pack_hash TEXT NOT NULL,
+    pack_path TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'running',
+    trust_score INTEGER,
+    weights_json TEXT,
+    sign_alg TEXT DEFAULT 'ed25519',
+    signature_hex TEXT,
+    proof_pdf_path TEXT,
+    pinned INTEGER DEFAULT 0,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Gates table: individual test gate results
+CREATE TABLE IF NOT EXISTS gates (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    status TEXT NOT NULL,
+    duration_ms INTEGER,
+    metrics_json TEXT,
+    budgets_json TEXT,
+    started_at INTEGER,
+    ended_at INTEGER,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Findings table: security and quality findings
+CREATE TABLE IF NOT EXISTS findings (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    gate TEXT NOT NULL,
+    severity TEXT NOT NULL,
+    rule TEXT NOT NULL,
+    location TEXT,
+    message TEXT,
+    raw_output TEXT,
+    fingerprint TEXT,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Artifacts table: Content-Addressable Storage metadata
+CREATE TABLE IF NOT EXISTS artifacts (
+    sha256 TEXT PRIMARY KEY,
+    mime_type TEXT NOT NULL,
+    size_bytes INTEGER NOT NULL,
+    cas_path TEXT NOT NULL,
+    original_name TEXT,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    last_accessed INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Run artifacts table: N-N relationship between runs and artifacts
+CREATE TABLE IF NOT EXISTS run_artifacts (
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    sha256 TEXT NOT NULL REFERENCES artifacts(sha256) ON DELETE CASCADE,
+    label TEXT NOT NULL,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    PRIMARY KEY (run_id, sha256, label)
+);
+
+-- Vault metadata table: schema version and configuration
+CREATE TABLE IF NOT EXISTS vault_metadata (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS idx_runs_started_at ON runs(started_at DESC);
+CREATE INDEX IF NOT EXISTS idx_runs_run_key ON runs(run_key) WHERE run_key IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+CREATE INDEX IF NOT EXISTS idx_runs_pack_hash ON runs(pack_hash);
+CREATE INDEX IF NOT EXISTS idx_runs_pinned ON runs(pinned) WHERE pinned = 1;
+
+CREATE INDEX IF NOT EXISTS idx_gates_run_id ON gates(run_id);
+CREATE INDEX IF NOT EXISTS idx_gates_run_name ON gates(run_id, name);
+CREATE INDEX IF NOT EXISTS idx_gates_status ON gates(status);
+CREATE INDEX IF NOT EXISTS idx_gates_name ON gates(name);
+
+CREATE INDEX IF NOT EXISTS idx_findings_run_id ON findings(run_id);
+CREATE INDEX IF NOT EXISTS idx_findings_run_gate ON findings(run_id, gate);
+CREATE INDEX IF NOT EXISTS idx_findings_severity ON findings(severity);
+CREATE INDEX IF NOT EXISTS idx_findings_rule ON findings(rule);
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
+
+CREATE INDEX IF NOT EXISTS idx_artifacts_mime_type ON artifacts(mime_type);
+CREATE INDEX IF NOT EXISTS idx_artifacts_size ON artifacts(size_bytes);
+CREATE INDEX IF NOT EXISTS idx_artifacts_created_at ON artifacts(created_at);
+CREATE INDEX IF NOT EXISTS idx_artifacts_last_accessed ON artifacts(last_accessed);
+
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_run_id ON run_artifacts(run_id);
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_sha256 ON run_artifacts(sha256);
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_label ON run_artifacts(label);
+
+-- Insert initial metadata
+INSERT OR IGNORE INTO vault_metadata (key, value) VALUES 
+    ('schema_version', '1.0.0'),
+    ('created_at', strftime('%s', 'now') * 1000),
+    ('vault_format', 'qa360-evidence-vault-v1');
+
+-- Triggers for updated_at timestamps
+CREATE TRIGGER IF NOT EXISTS trigger_runs_updated_at 
+    AFTER UPDATE ON runs
+    BEGIN
+        UPDATE runs SET updated_at = strftime('%s', 'now') * 1000 WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER IF NOT EXISTS trigger_artifacts_last_accessed
+    AFTER UPDATE ON artifacts
+    BEGIN
+        UPDATE artifacts SET last_accessed = strftime('%s', 'now') * 1000 WHERE sha256 = NEW.sha256;
+    END;
+
+-- Views for common queries
+CREATE VIEW IF NOT EXISTS v_recent_runs AS
+SELECT 
+    r.id,
+    r.run_key,
+    r.started_at,
+    r.ended_at,
+    r.status,
+    r.trust_score,
+    r.pack_path,
+    COUNT(g.id) as gate_count,
+    COUNT(CASE WHEN g.status = 'passed' THEN 1 END) as gates_passed,
+    COUNT(CASE WHEN g.status = 'failed' THEN 1 END) as gates_failed,
+    COUNT(f.id) as finding_count,
+    COUNT(CASE WHEN f.severity IN ('high', 'critical') THEN 1 END) as critical_findings
+FROM runs r
+LEFT JOIN gates g ON r.id = g.run_id
+LEFT JOIN findings f ON r.id = f.run_id
+GROUP BY r.id
+ORDER BY r.started_at DESC;
+
+CREATE VIEW IF NOT EXISTS v_gate_trends AS
+SELECT 
+    g.name,
+    g.status,
+    r.started_at,
+    r.trust_score,
+    g.duration_ms,
+    g.metrics_json
+FROM gates g
+JOIN runs r ON g.run_id = r.id
+WHERE r.status IN ('passed', 'failed')
+ORDER BY r.started_at DESC;
+`;
+        return new Promise((resolve, reject) => {
+            this.db.exec(schema, (err) => {
+                if (err) {
+                    reject(new Error(`Failed to initialize schema: ${err.message}`));
+                }
+                else {
+                    resolve();
+                }
+            });
+        });
+    }
+    /**
+     * Ensure required directories exist
+     */
+    ensureDirectories() {
+        if (!existsSync(this.baseDir)) {
+            mkdirSync(this.baseDir, { recursive: true });
+        }
+    }
+    /**
+     * Close database connection
+     */
+    async close() {
+        return new Promise((resolve, reject) => {
+            this.db.close((err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qa360",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
   "type": "module",
   "main": "dist/index.js",
@@ -18,21 +18,27 @@
   "scripts": {
     "build": "tsc --project tsconfig.json",
     "build:pkg": "tsc",
+    "build:bundle": "bash scripts/bundle-for-npm.sh",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "dev": "tsx watch src/index.ts",
-    "clean": "rimraf dist",
-    "prepublishOnly": "npm run build",
-    "publish:dry": "npm publish --dry-run",
-    "publish:real": "npm publish --access public --provenance"
+    "clean": "rimraf dist src/core",
+    "prepublishOnly": "npm run build:bundle",
+    "publish:dry": "npm run build:bundle && npm publish --dry-run",
+    "publish:real": "npm run build:bundle && npm publish --access public --provenance"
   },
   "dependencies": {
+    "ajv": "^8.17.1",
+    "ajv-draft-04": "^1.0.0",
+    "ajv-formats": "^2.1.1",
     "chalk": "^4.1.2",
     "commander": "^11.0.0",
     "inquirer": "^8.2.7",
+    "js-yaml": "^4.1.0",
     "ora": "^5.4.1",
-    "qa360-core": "^1.0.0"
+    "sqlite3": "^5.1.6",
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.9",