qa360 2.1.7 → 2.2.1

package/cli/src/types/scan.ts

@@ -0,0 +1,84 @@
+/**
+ * Types for DOM Element Discovery feature
+ */
+
+export type ElementType =
+  | 'buttons'
+  | 'links'
+  | 'forms'
+  | 'inputs'
+  | 'images'
+  | 'headings'
+  | 'all';
+
+export interface ScanOptions {
+  url: string;
+  output?: string;
+  include?: ElementType[];
+  exclude?: string[];
+  screenshot?: boolean;
+  autoGenerateTest?: boolean;
+  timeout?: number;
+  headless?: boolean;
+}
+
+export interface ElementPosition {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+export interface DiscoveredElement {
+  type: string;
+  selector: string;
+  text?: string;
+  attributes?: Record<string, string>;
+  position: ElementPosition;
+  visible: boolean;
+  page: string;
+}
+
+export interface ScanSummary {
+  totalElements: number;
+  buttons: number;
+  links: number;
+  forms: number;
+  inputs: number;
+  images: number;
+  headings: number;
+}
+
+export interface ScanResult {
+  scanDate: string;
+  url: string;
+  duration: number;
+  summary: ScanSummary;
+  elements: DiscoveredElement[];
+}
+
+export interface GeneratedPageConfig {
+  url: string;
+  expectedElements: string[];
+}
+
+export interface GeneratedGateConfig {
+  adapter: string;
+  enabled: boolean;
+  config: {
+    baseUrl: string;
+    pages: GeneratedPageConfig[];
+  };
+}
+
+export interface GeneratedTestConfig {
+  version: number;
+  name: string;
+  description: string;
+  gates: Record<string, GeneratedGateConfig>;
+  execution?: {
+    default_timeout: number;
+    default_retries: number;
+    on_failure: string;
+  };
+}

package/cli/src/utils/config.ts

@@ -0,0 +1,145 @@
+/**
+ * Config loader utilities for CLI commands
+ */
+
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import { PackConfigV1, type PackConfigV2 } from 'qa360-core';
+
+export async function loadPackConfig(packPath: string): Promise<PackConfigV1 | PackConfigV2> {
+  const fullPath = join(process.cwd(), packPath);
+  const content = readFileSync(fullPath, 'utf8');
+
+  // Try YAML parse
+  let config: any;
+  try {
+    // Simple YAML parser (basic implementation)
+    config = parseYaml(content);
+  } catch (error) {
+    throw new Error(`Failed to parse pack file: ${error}`);
+  }
+
+  // Validate version
+  if (config.version === 2) {
+    return config as PackConfigV2;
+  } else if (config.version === 1 || !config.version) {
+    return config as PackConfigV1;
+  }
+
+  throw new Error(`Unsupported pack version: ${config.version}`);
+}
+
+/**
+ * Simple YAML parser for pack files
+ * This is a basic implementation that handles common cases
+ */
+function parseYaml(content: string): any {
+  const lines = content.split('\n');
+  const result: any = {};
+  const stack: Array<{ obj: any; indent: number }> = [{ obj: result, indent: -1 }];
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const trimmed = line.trimRight();
+
+    // Skip empty lines and comments
+    if (!trimmed || trimmed.startsWith('#')) continue;
+
+    const indent = line.search(/\S|$/);
+
+    // Find parent in stack
+    while (stack.length > 1 && stack[stack.length - 1].indent >= indent) {
+      stack.pop();
+    }
+
+    const parent = stack[stack.length - 1].obj;
+    const colonIndex = trimmed.indexOf(':');
+
+    if (colonIndex === -1) {
+      // List item (array continuation)
+      if (Array.isArray(parent)) {
+        parent.push(parseValue(trimmed));
+      }
+      continue;
+    }
+
+    const key = trimmed.slice(0, colonIndex).trim();
+    const rest = trimmed.slice(colonIndex + 1).trim();
+
+    if (!rest || rest.startsWith('#')) {
+      // Object or empty value
+      parent[key] = null;
+    } else if (rest.startsWith('|') || rest.startsWith('>')) {
+      // Multi-line string
+      const valueLines: string[] = [];
+      for (let j = i + 1; j < lines.length; j++) {
+        const nextLine = lines[j];
+        if (nextLine.trim() && !nextLine.startsWith(' ')) break;
+        valueLines.push(nextLine.trim());
+        i = j;
+      }
+      parent[key] = valueLines.join('\n');
+    } else {
+      // Simple value
+      parent[key] = parseValue(rest);
+    }
+
+    // If next line is more indented, this key starts a nested object/array
+    if (i < lines.length - 1) {
+      const nextIndent = lines[i + 1].search(/\S|$/);
+      if (nextIndent > indent) {
+        if (Array.isArray(parent[key])) {
+          // Already an array
+        } else if (typeof parent[key] === 'object' && parent[key] !== null) {
+          // Nested object
+          stack.push({ obj: parent[key], indent });
+        } else {
+          // Start of array
+          const arr: any[] = [];
+          parent[key] = arr;
+          stack.push({ obj: arr, indent });
+        }
+      }
+    }
+  }
+
+  return result;
+}
+
+function parseValue(value: string): any {
+  value = value.trim();
+
+  // String
+  if (value.startsWith('"') || value.startsWith("'")) {
+    return value.slice(1, -1);
+  }
+
+  // Number
+  if (/^-?\d+$/.test(value)) return parseInt(value, 10);
+  if (/^-?\d+\.\d+$/.test(value)) return parseFloat(value);
+
+  // Boolean
+  if (value === 'true') return true;
+  if (value === 'false') return false;
+  if (value === 'null' || value === '~') return null;
+
+  // Array
+  if (value.startsWith('[')) {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value;
+    }
+  }
+
+  // Object
+  if (value.startsWith('{')) {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value;
+    }
+  }
+
+  return value;
+}

package/cli/tsconfig.bundle.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "composite": false,
+    "declaration": true,
+    "declarationMap": false
+  },
+  "include": ["src/**/*"],
+  "exclude": ["src/**/__tests__/**", "src/**/*.test.ts", "src/**/*.spec.ts"]
+}

package/cli/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "composite": true,
+    "declaration": true,
+    "declarationMap": false
+  },
+  "include": ["src/**/*"],
+  "exclude": [
+    "src/**/__tests__/**",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    // TODO: Re-enable these commands once their dependencies are exported from core
+    "src/commands/repair.ts",
+    // "src/commands/monitor.ts", // Now enabled with flakiness support
+    "src/commands/ollama.ts"
+  ],
+  "references": [
+    { "path": "../core" }
+  ]
+}

package/cli/vitest.config.ts

@@ -0,0 +1,59 @@
+import { defineConfig } from 'vitest/config';
+import { resolve } from 'path';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    pool: 'forks', // Use forks instead of threads to support process.chdir()
+    poolOptions: {
+      forks: {
+        singleFork: true, // Run tests in a single fork for better isolation
+      },
+    },
+    testTimeout: 15000, // Increase default timeout for slower CI environments
+    hookTimeout: 15000, // Increase hook timeout as well
+    bail: 0, // Don't stop on failures - continue to generate coverage
+    include: ['src/**/*.{test,spec}.{js,ts}', 'src/**/__tests__/**/*.{js,ts}'],
+    exclude: [
+      '**/node_modules/**',
+      '**/dist/**',
+      '**/*.d.ts',
+      // E2E tests (Playwright/Mocha) - not for vitest
+      'tests/**',
+      'tests/e2e/**',
+      '**/tests/**',
+      '.tmp-test-*/**',
+      // WIP - experimental features not yet implemented
+      'src/commands/__tests__/e2e-ui-tests.test.ts',
+      'src/commands/__tests__/flakiness.test.ts',
+      'src/commands/__tests__/ollama.test.ts',
+      'src/commands/__tests__/repair.test.ts',
+      'src/commands/__tests__/crawl.test.ts',
+    ],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html', 'lcov'],
+      include: ['src/**/*.ts'],
+      exclude: [
+        '**/*.d.ts',
+        '**/*.test.ts',
+        '**/*.spec.ts',
+        '**/__tests__/**',
+        '**/node_modules/**',
+        '**/dist/**',
+      ],
+      all: true,
+      lines: 25,
+      functions: 20,
+      branches: 20,
+      statements: 25,
+    },
+  },
+  resolve: {
+    alias: {
+      '@qa360/core': resolve(__dirname, '../core/src'),
+      'qa360-core': resolve(__dirname, '../core/dist'),
+    },
+  },
+});

package/core/LICENSE

@@ -0,0 +1,24 @@
+Business Source License 1.1
+
+Licensor: XyqoTech
+Licensed Work: QA360 Cloud Preview
+Change Date: 2027-10-01
+Change License: MIT
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.
+
+If your use of the Licensed Work does not comply with the requirements currently in effect as described in this License, you must purchase a commercial license from the Licensor, its affiliated entities, or authorized resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of the Licensed Work, are subject to this License. This License applies separately for each version of the Licensed Work and the Change Date may vary for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of the Licensed Work. If you receive the Licensed Work in original or modified form from a third party, the terms and conditions set forth in this License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically terminate your rights under this License for the current and all other versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor or its affiliates (provided that you may use a trademark or logo of Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/core/README.md

@@ -0,0 +1,64 @@
+# QA360 Core Engine
+
+The heart of QA360 - handles proof generation, cryptographic signatures, and evidence vault.
+
+## Modules
+
+### Proof System
+- **ProofGenerator** - Creates verifiable quality proofs
+- **SignatureManager** - Ed25519 cryptographic signatures
+- **TrustScoreCalculator** - Quantifies test confidence
+
+### Evidence Vault
+- **EvidenceVault** - SQLite WAL storage for test history
+- **HistoryManager** - Track changes and trends over time
+- **AuditTrail** - Immutable record of all operations
+
+### Crypto & Security
+- **KeyManager** - Secure key generation and storage
+- **EncryptionService** - AES-256-GCM for sensitive data
+- **IntegrityChecker** - Verify data hasn't been tampered
+
+## Adapters
+
+| Adapter | Description | Status |
+|---------|-------------|--------|
+| `playwright-api` | REST/GraphQL API testing | ✅ Production |
+| `playwright-ui` | UI + Accessibility testing | ✅ Production |
+| `k6-perf` | Load & performance testing | ✅ Production |
+| `semgrep-sast` | Static security analysis | ✅ Production |
+| `zap-dast` | Dynamic security scanning (Docker/local) | ✅ Production |
+| `gitleaks-secrets` | Secret detection in code | ✅ Production |
+| `osv-deps` | Dependency vulnerability scanning | ✅ Production |
+
+## Phase3Runner
+
+The orchestration engine for quality gates:
+
+```typescript
+import { Phase3Runner } from 'qa360-core';
+
+const runner = new Phase3Runner({
+  workingDir: process.cwd(),
+  pack: packConfig,
+});
+
+const result = await runner.run();
+// Result includes: gates, trustScore, proofPath, duration
+```
+
+## Architecture Principles
+
+- **Local-first**: No cloud dependencies required
+- **Cryptographically verifiable**: All proofs are signed
+- **Immutable audit trail**: Evidence cannot be altered
+- **Performance optimized**: SQLite WAL for concurrent access
+
+## Development
+
+```bash
+cd core/
+npm install
+npm run build
+npm test
+```

package/core/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "qa360-core",
+  "version": "2.2.1",
+  "description": "QA360 Core Engine - Proof generation, signatures, and evidence vault",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./proof": {
+      "types": "./dist/proof/index.d.ts",
+      "import": "./dist/proof/index.js"
+    },
+    "./pack/validator": {
+      "types": "./dist/pack/validator.d.ts",
+      "import": "./dist/pack/validator.js"
+    },
+    "./pack/migrator": {
+      "types": "./dist/pack/migrator.d.ts",
+      "import": "./dist/pack/migrator.js"
+    },
+    "./types/pack-v1": {
+      "types": "./dist/types/pack-v1.d.ts",
+      "import": "./dist/types/pack-v1.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "build:pkg": "tsc",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "test:schema": "node src/proof/__tests__/schema-validation-manual.mjs",
+    "clean": "rimraf dist"
+  },
+  "dependencies": {
+    "ajv": "^8.17.1",
+    "ajv-draft-04": "^1.0.0",
+    "ajv-formats": "^2.1.1",
+    "chalk": "^4.1.2",
+    "glob": "^10.4.5",
+    "js-yaml": "^4.1.0",
+    "ollama": "^0.5.1",
+    "sqlite3": "^5.1.6",
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.0.0",
+    "@vitest/coverage-v8": "1.6.0",
+    "msw": "1",
+    "playwright": "^1.57.0",
+    "vitest": "1.6.0"
+  },
+  "keywords": [
+    "qa360",
+    "core",
+    "proof",
+    "signature",
+    "vault"
+  ],
+  "author": "QA360 Core Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/xyqotech/qa360.git",
+    "directory": "core"
+  },
+  "homepage": "https://github.com/xyqotech/qa360",
+  "bugs": {
+    "url": "https://github.com/xyqotech/qa360/issues"
+  }
+}

package/core/src/__tests__/adapters-contract/adapters-contract.test.md

@@ -0,0 +1,156 @@
+# QA360 Adapters Contract Tests
+
+## Objectif
+Valider que chaque adaptateur respecte son contrat et retourne des codes d'erreur structurés, applique la redaction, et fournit des diagnostics.
+
+## Adaptateurs à Tester
+
+### 1. Playwright API (PA###)
+- **PA001**: Timeout
+- **PA002**: Connection reset (ECONNRESET)
+- **PA003**: Connection refused (ECONNREFUSED)
+- **Redaction**: Headers Authorization, Bearer tokens
+- **Diagnostics**: Request/response dump avec headers redactés
+
+**Scénarios**:
+- ✅ Pass: GET https://httpbin.org/get -> 200
+- ⚠️ Timeout: GET https://httpbin.org/delay/10 (timeout 2s) -> PA001
+- ❌ Reset: GET https://invalid-domain.local -> PA002/PA003
+- 🔐 Redaction: Authorization header masqué
+
+### 2. Playwright UI (PU###)
+- **PU001**: A11y budget violation
+- **PU002**: Load timeout
+- **PU003**: Selector not found
+- **Heal hints**: selector_candidates triés par confiance
+- **Golden DOM**: innerHTML ciblé + path CSS
+
+**Scénarios**:
+- ✅ Pass: Navigate + screenshot https://httpbin.org
+- ⚠️ Selector missing: Click #non-existent -> PU003 + heal hints
+- ❌ A11y budget: violations > budget -> PU001
+- 📸 Golden DOM: Export snapshot minimal
+
+### 3. k6 Performance (K6###)
+- **K6001**: Timeout
+- **K6002**: Exit code non-zero
+- **K6003**: Start failed
+- **Métriques**: P50/P90/P95/P99, error_rate, req/s
+- **Budget mapping**: perf.p95_ms, max_errors_rate
+
+**Scénarios**:
+- ✅ Pass: Load test 10s, 1 VU -> metrics OK
+- ⚠️ Budget exceeded: p95 > budget -> warn
+- ❌ Timeout: k6 run timeout -> K6001
+
+### 4. Semgrep SAST (SG###)
+- **SG001**: High findings > budget
+- **SG002**: Critical findings > budget
+- **SG003**: Scan timeout
+- **Mapping**: sast.max_high, max_critical
+- **Redaction**: Masque secrets dans findings
+
+**Scénarios**:
+- ✅ Pass: Scan ./examples -> findings within budget
+- ⚠️ High findings: findings > budget -> SG001
+- ❌ Critical findings: critical > 0 -> SG002
+
+### 5. OSV Scanner (OSV###)
+- **OSV001**: High vulnerabilities > budget
+- **OSV002**: Critical vulnerabilities > budget
+- **OSV003**: Scan failed
+- **Mapping**: deps.max_high, max_critical
+- **Severity**: HIGH, CRITICAL, MODERATE, LOW
+
+**Scénarios**:
+- ✅ Pass: Scan package.json -> vulns within budget
+- ⚠️ High vulns: high > budget -> OSV001
+- ❌ Critical vulns: critical > 0 -> OSV002
+
+### 6. Gitleaks Secrets (GL###)
+- **GL001**: Secrets detected
+- **GL002**: Scan failed
+- **GL003**: Config invalid
+- **Mapping**: secrets.max_findings
+- **Redaction**: Masque secrets détectés dans logs
+
+**Scénarios**:
+- ✅ Pass: Scan ./examples -> 0 secrets
+- ❌ Secrets found: findings > 0 -> GL001
+- 🔐 Redaction: Secrets masqués dans output
+
+### 7. ZAP DAST (ZAP###)
+- **ZAP001**: High alerts > budget
+- **ZAP002**: Critical alerts > budget
+- **ZAP003**: Scan timeout
+- **ZAP004**: Docker not available
+- **Mapping**: dast.max_high, max_critical
+- **Modes**: baseline, full, api
+
+**Scénarios**:
+- ✅ Pass: Baseline scan https://httpbin.org -> alerts within budget
+- ⚠️ High alerts: alerts > budget -> ZAP001
+- ❌ Docker missing: ZAP not available -> ZAP004 (fallback mock)
+
+## Critères de Conformité
+
+### Codes d'Erreur Structurés
+- Format: `[ADAPTER][NUMBER]` (ex: PA001, K6002)
+- Plage: 001-099 par adaptateur
+- Cohérence: Même erreur = même code
+
+### Redaction Active
+- Patterns: Bearer, Basic, password=, mysql://user:pass@
+- Application: Logs, diagnostics, error messages
+- Validation: Aucun secret en clair dans output
+
+### Trust Score Cohérent
+- Pass + findings critiques = IMPOSSIBLE
+- Warn + budget exceeded = COHÉRENT
+- Fail + error code = COHÉRENT
+
+### Diagnostics Actionnables
+- Request/response dump (API)
+- Golden DOM snapshot (UI)
+- Metrics summary (Perf)
+- Findings list (Security)
+
+## Rapport de Conformité
+
+Format: `artifacts/adapters/contract-report.json`
+
+```json
+{
+  "adapters": [
+    {
+      "name": "playwright-api",
+      "scenarios": {
+        "pass": true,
+        "timeout": true,
+        "reset": true,
+        "redaction": true
+      },
+      "codes": ["PA001", "PA002", "PA003"],
+      "conformance": 100
+    }
+  ],
+  "summary": {
+    "total": 7,
+    "conformant": 7,
+    "rate": 100
+  }
+}
+```
+
+## Exécution
+
+```bash
+# Tests unitaires
+pnpm test adapters-contract
+
+# Validation complète
+./scripts/ci/run-adapter-contracts.sh
+```
+
+## Critère GO/NO-GO
+✅ 100% des adaptateurs passent leurs scénarios contractuels (pass/warn/fail/timeout)

package/core/src/__tests__/index.test.ts

@@ -0,0 +1,31 @@
+/**
+ * QA360 Core Tests
+ */
+
+import { QA360Core, VERSION } from '../index';
+
+describe('QA360 Core', () => {
+  it('should export correct version', () => {
+    expect(VERSION).toBe('0.9.0-core');
+  });
+
+  it('should create QA360Core instance', () => {
+    const core = new QA360Core();
+    expect(core).toBeInstanceOf(QA360Core);
+  });
+
+  it('should have proof generation method', () => {
+    const core = new QA360Core();
+    expect(typeof core.generateProof).toBe('function');
+  });
+
+  it('should have proof verification method', () => {
+    const core = new QA360Core();
+    expect(typeof core.verifyProof).toBe('function');
+  });
+
+  it('should have trust score calculation method', () => {
+    const core = new QA360Core();
+    expect(typeof core.calculateTrustScore).toBe('function');
+  });
+});