qa360 2.1.7 → 2.2.1

package/check-branches.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+cd /Users/bassiroudiop/QA360
+
+echo "=== COMPARAISON BRANCHES main vs develop ==="
+echo ""
+
+# Fetch pour être sûr d'avoir les dernières infos
+git fetch origin --quiet
+
+echo "📊 COMMITS SUR develop NON PRÉSENTS SUR main:"
+echo "================================================"
+git log origin/main..origin/develop --oneline | head -50
+
+echo ""
+echo "📈 STATISTIQUES:"
+echo "================"
+AHEAD=$(git rev-list --count origin/main..origin/develop)
+BEHIND=$(git rev-list --count origin/develop..origin/main)
+echo "develop est $AHEAD commits EN AVANCE sur main"
+echo "develop est $BEHIND commits EN RETARD sur main"
+
+echo ""
+echo "📅 DERNIER COMMIT SUR main:"
+git log origin/main -1 --format="%h - %s (%cr)"
+
+echo ""
+echo "📅 DERNIER COMMIT SUR develop:"
+git log origin/develop -1 --format="%h - %s (%cr)"
+
+echo ""
+echo "📁 FICHIERS DIFFÉRENTS (résumé):"
+git diff --stat origin/main..origin/develop | tail -5

package/cli/.qa360/keys/ed25519.key

@@ -0,0 +1 @@
+5E6oDirXySnYKtpHfgbbSGVBkJFScbfHVGKj1Q2b+aA5sjC7CbON2uJma27146i5Y+OgBRUCyzKSZVLPpBrU2Q==

package/cli/.qa360/keys/ed25519.pub

@@ -0,0 +1 @@
+ObIwuwmzjdriZmtu9eOouWPjoAUVAssykmVSz6Qa1Nk=

package/cli/CHANGELOG.md

@@ -0,0 +1,84 @@
+# Changelog
+
+All notable changes to QA360 Proof CLI will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.1.0] - 2025-10-26
+
+### Added
+- **AJV 2020-12 Support**: Full JSON Schema Draft 2020-12 validation (RFC-compliant)
+- **CI Matrix**: 9-job validation matrix (3 OS × 3 Node versions)
+- **Comprehensive Tests**: 11 unit tests + 3 smoke tests
+- **Cross-platform Build**: Automated build script with OS detection
+- **Dependency Lock**: Frozen AJV versions (anti-regression)
+- **CI Badges**: Status badges in README
+
+### Changed
+- **Schema Validation**: Migrated from draft-07 to draft-2020-12
+- **Build System**: Idempotent cross-platform build script
+- **prepublishOnly**: Added doctor --strict validation before publish
+
+### Fixed
+- **ESM Imports**: Fixed AJV 2020 import for Node.js ESM compatibility
+- **Schema Path**: Corrected import paths in test files
+
+### Security
+- **Provenance**: Added npm provenance for supply chain security
+- **Dependency Freeze**: Locked ajv@8.17.1, ajv-formats@2.1.1, ajv-draft-04@1.0.0
+
+## [1.1.0-rc] - 2025-10-25
+
+### Added
+- **Initial Release Candidate**: First public release
+- **Commands**: `doctor`, `verify`
+- **Flags**: `--json`, `--strict`, `--verbose`
+- **Documentation**: Complete guides and examples
+
+### Features
+- 🔒 **Local-first**: 100% offline, no network dependencies
+- 🔐 **Cryptographic trust**: Ed25519 signatures, SHA-256 hashing
+- 🌍 **Cross-OS**: Windows, macOS, Linux validated
+- ⚡ **Zero friction**: Auto-generates keys
+- 
+
+## [Unreleased]
+
+### Planned
+- RFC 3161 TSA timestamp support (Phase 6)
+- W3C DID / Sigstore identity (Phase 6)
+- Revocation mechanism (Phase 6)
+- Compliance metadata (Phase 6)
+
+---
+
+## Version History
+
+- **1.1.0** (2025-10-26): Stable release with AJV 2020-12 + CI lockdown
+- **1.1.0-rc** (2025-10-25): Release candidate
+- **0.9.0-core** (2025-10-24): Internal development version
+
+---
+
+## Quick Validation
+
+```bash
+# Install
+npm i -g @qa360/cli@1.1.0
+
+# Verify version
+qa360 --version
+
+# System check
+qa360 doctor --strict
+
+# Verify proof
+qa360 verify examples/proofs/httpbin-proof.json --json
+```
+
+**Expected**: All commands succeed, proof validates correctly.
+
+---
+
+For detailed changes, see [GitHub Releases](https://github.com/qa360/qa360/releases).

package/cli/LICENSE

@@ -0,0 +1,24 @@
+Business Source License 1.1
+
+Licensor: XyqoTech
+Licensed Work: QA360 Cloud Preview
+Change Date: 2027-10-01
+Change License: MIT
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.
+
+If your use of the Licensed Work does not comply with the requirements currently in effect as described in this License, you must purchase a commercial license from the Licensor, its affiliated entities, or authorized resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of the Licensed Work, are subject to this License. This License applies separately for each version of the Licensed Work and the Change Date may vary for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of the Licensed Work. If you receive the Licensed Work in original or modified form from a third party, the terms and conditions set forth in this License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically terminate your rights under this License for the current and all other versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor or its affiliates (provided that you may use a trademark or logo of Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/cli/README.md

@@ -0,0 +1,222 @@
+# qa360
+
+**QA360 Proof CLI** - Quality as Cryptographic Proof
+
+[![Version](https://img.shields.io/npm/v/qa360.svg)](https://www.npmjs.com/package/qa360)
+[![License](https://img.shields.io/npm/l/qa360.svg)](https://github.com/xyqotech/qa360/blob/main/LICENSE)
+[![Tests](https://img.shields.io/badge/tests-282%20passing-success)](https://github.com/xyqotech/qa360)
+[![Coverage](https://img.shields.io/badge/coverage-55%25-brightgreen)](https://github.com/xyqotech/qa360)
+
+> **Official package** published by [xyqotech](https://github.com/xyqotech) with npm provenance signatures
+
+## Installation
+
+### Option 1: Global installation (recommended for regular use)
+
+```bash
+# macOS: use sudo if you get EACCES permission errors
+sudo npm install -g qa360
+
+# Or configure npm prefix (one-time setup)
+mkdir -p ~/.npm-global
+npm config set prefix '~/.npm-global'
+echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.zshrc
+source ~/.zshrc
+npm install -g qa360
+```
+
+### Option 2: Direct usage with npx (no installation needed)
+
+```bash
+# Run directly without installing
+npx qa360@latest run test.yml
+npx qa360@latest verify proof.json
+npx qa360@latest doctor
+```
+
+**Note**: On first run, Playwright browsers will be automatically downloaded (~100MB). This happens only once.
+
+## Quick Start
+
+### 1. Generate a test pack
+
+```bash
+# Option 1: Interactive mode (recommended for first-time users)
+qa360 init
+
+# Option 2: Use a template directly
+qa360 init --template api-basic --yes
+
+# Option 3: Copy an example
+qa360 examples copy api-basic
+qa360 examples list              # See all available examples
+```
+
+### 2. Run tests
+
+```bash
+qa360 run
+```
+
+### 3. Verify proof
+
+```bash
+qa360 verify .qa360/runs/
+```
+
+## Usage
+
+```bash
+# Generate test pack (interactive)
+qa360 init
+
+# Generate with template
+qa360 init --template api-basic
+qa360 init --template fullstack
+qa360 init --template security
+qa360 init --template complete
+
+# Examples commands
+qa360 examples list              # List all examples
+qa360 examples copy api-basic    # Copy example to qa360.yml
+qa360 examples show fullstack    # Preview example content
+
+# System health check
+qa360 doctor
+
+# Run test pack
+qa360 run                    # Auto-detects qa360.yml
+qa360 run custom-pack.yml    # Use specific file
+
+# Verify proof bundle
+qa360 verify .qa360/runs/
+qa360 verify proof.json
+
+# View run history
+qa360 history list
+qa360 history show <run-id>
+
+# Export proof bundle
+qa360 history export <run-id> --bundle proof-bundle.zip
+
+# Clean up old runs (garbage collection)
+qa360 history gc                    # Default: keep last 10 runs
+qa360 history gc --keep-last 20     # Keep last 20 runs
+qa360 history gc --dry-run          # Preview what would be deleted
+
+# Pin/unpin runs (pinned runs are never deleted by gc)
+qa360 history pin <run-id>
+qa360 history unpin <run-id>
+
+# With JSON output (CI-friendly)
+qa360 doctor --json
+qa360 verify proof.json --json
+qa360 history list --json
+```
+
+## Available Templates
+
+| Template | Description | Gates |
+|----------|-------------|-------|
+| **api-basic** | Simple API smoke tests | api_smoke |
+| **ui-basic** | Basic UI/E2E tests | ui |
+| **fullstack** | API + UI + Performance | api_smoke, ui, perf |
+| **security** | Security testing suite | sast, dast, secrets, deps |
+| **accessibility** | Accessibility testing | ui, a11y |
+| **complete** | All quality gates | All (8 gates) |
+
+## Example Files
+
+Pre-made examples are included in the package:
+
+```bash
+# List examples
+ls examples/
+
+# Copy an example
+cp examples/api-basic.yml qa360.yml
+
+# Run example directly
+qa360 run examples/api-basic.yml
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `init` | Generate test pack interactively |
+| `examples` | Manage example templates (list, copy, show) |
+| `run` | Execute test pack |
+| `verify` | Verify cryptographic proof bundles |
+| `doctor` | Check system health, auto-fix issues |
+| `history` | View run history and results |
+| `report` | Generate reports |
+| `secrets` | Manage encrypted secrets |
+| `pack` | Pack validation and linting |
+
+### History Commands
+
+The `history` command provides comprehensive management of test run history stored in the Evidence Vault:
+
+| Subcommand | Description | Example |
+|------------|-------------|---------|
+| `list` | List recent test runs | `qa360 history list --limit 20` |
+| `show <run-id>` | Show detailed run information | `qa360 history show abc123` |
+| `diff <id1> <id2>` | Compare two test runs | `qa360 history diff abc123 def456` |
+| `trend` | Show trust score trends | `qa360 history trend --window 30` |
+| `export <run-id>` | Export run as ZIP bundle | `qa360 history export abc123 --bundle proof.zip` |
+| `gc` | Garbage collect old runs | `qa360 history gc --keep-last 10` |
+| `pin <run-id>` | Pin run (protect from gc) | `qa360 history pin abc123` |
+| `unpin <run-id>` | Unpin run | `qa360 history unpin abc123` |
+
+#### Export Bundle Contents
+
+When exporting a run with `qa360 history export <run-id> --bundle proof.zip`, the ZIP contains:
+
+- `proof.json` - Cryptographically signed proof document
+- `report.pdf` - Human-readable PDF report (if generated)
+- `run.json` - Complete run details (gates, findings, artifacts)
+- `artifacts/` - All test artifacts (screenshots, logs, etc.)
+- `VERIFICATION.json` - Verification instructions and metadata
+
+#### Garbage Collection
+
+The `gc` command removes old test runs and orphaned artifacts to free disk space:
+
+```bash
+# Preview what would be deleted (dry-run)
+qa360 history gc --dry-run
+
+# Keep last 20 runs, delete older ones
+qa360 history gc --keep-last 20
+
+# Default behavior (keeps last 10 unpinned runs)
+qa360 history gc
+```
+
+**Important**: Pinned runs are NEVER deleted by garbage collection. Use `qa360 history pin <run-id>` to protect important runs.
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | Verification failed |
+| 2 | File not found |
+| 3 | Invalid schema |
+| 4 | Missing key |
+| 5 | Internal error |
+
+## Requirements
+
+- Node.js >= 18.0.0
+- npm or pnpm
+
+## Documentation
+
+- [Quick Start](https://github.com/xyqotech/qa360/blob/main/docs/quickstart-5min.md)
+- [Full Documentation](https://github.com/xyqotech/qa360/blob/main/docs/README.md)
+
+## License
+
+MIT

package/cli/examples/README.md

@@ -0,0 +1,160 @@
+# QA360 Examples
+
+This directory contains example pack files for different testing scenarios.
+
+## Quick Start
+
+Copy an example to your project:
+
+```bash
+# Copy API basic example
+cp examples/api-basic.yml qa360.yml
+
+# Edit and customize
+vim qa360.yml
+
+# Run tests
+qa360 run
+```
+
+## Available Examples
+
+### 1. **api-basic.yml** - API Smoke Tests
+Simple REST/GraphQL health checks.
+
+**Gates**: `api_smoke`
+
+**Use case**: Verify API endpoints are responding correctly
+
+```bash
+qa360 run examples/api-basic.yml
+```
+
+---
+
+### 2. **ui-basic.yml** - UI/E2E Tests
+Basic browser automation tests.
+
+**Gates**: `ui`
+
+**Use case**: Test web pages load correctly
+
+```bash
+qa360 run examples/ui-basic.yml
+```
+
+---
+
+### 2b. **ui-advanced.yml** - UI Tests with Playwright++
+Advanced UI testing with artifacts, video, screenshots, and HTML reports.
+
+**Gates**: `ui`
+
+**Features**:
+- Automatic screenshots on failure
+- Video recording
+- Trace capture for debugging
+- Interactive HTML report generation
+- Configurable bail on failures
+
+**Use case**: Full-featured UI testing with rich artifacts
+
+```bash
+qa360 run examples/ui-advanced.yml
+```
+
+---
+
+### 2c. **crawler.yml** - Web Crawler
+Auto-generate tests by crawling a web application.
+
+**Gates**: `ui`
+
+**Features**:
+- Automatic discovery of pages and forms
+- Generate test packs from existing sites
+- Smart selector generation
+
+**Use case**: Quick start with existing applications
+
+```bash
+qa360 run examples/crawler.yml
+```
+
+---
+
+### 3. **fullstack.yml** - Full Stack Tests
+API + UI + Performance testing.
+
+**Gates**: `api_smoke`, `ui`, `perf`
+
+**Use case**: Complete application testing with Docker Compose integration
+
+```bash
+qa360 run examples/fullstack.yml
+```
+
+---
+
+### 4. **security.yml** - Security Suite
+Comprehensive security scanning.
+
+**Gates**: `sast`, `dast`, `secrets`, `deps`
+
+**Use case**: Security audit with vulnerability scanning
+
+```bash
+qa360 run examples/security.yml
+```
+
+---
+
+### 5. **accessibility.yml** - Accessibility Tests
+WCAG compliance testing.
+
+**Gates**: `ui`, `a11y`
+
+**Use case**: Ensure website meets accessibility standards
+
+```bash
+qa360 run examples/accessibility.yml
+```
+
+---
+
+### 6. **complete.yml** - Complete Test Suite
+All quality gates enabled.
+
+**Gates**: All (8 gates)
+
+**Use case**: Comprehensive quality assurance for production-ready applications
+
+```bash
+qa360 run examples/complete.yml
+```
+
+---
+
+## Interactive Generator
+
+Generate a custom pack with:
+
+```bash
+qa360 init
+```
+
+This will walk you through creating a pack file tailored to your needs.
+
+## Customization
+
+All examples use placeholder URLs. Replace with your actual endpoints:
+
+- `https://api.example.com` → Your API URL
+- `https://example.com` → Your web application URL
+- `http://localhost:3000` → Your local dev server
+
+## Learn More
+
+- [Pack Schema Documentation](https://github.com/xyqotech/qa360/blob/main/docs/pack-schema.md)
+- [Quality Gates Reference](https://github.com/xyqotech/qa360/blob/main/docs/gates.md)
+- [Full Documentation](https://github.com/xyqotech/qa360/blob/main/docs/README.md)

package/cli/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "qa360",
+  "version": "2.2.1",
+  "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "qa360": "bin/qa360.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE",
+    "examples"
+  ],
+  "scripts": {
+    "build": "tsc --project tsconfig.bundle.json",
+    "build:pkg": "tsc",
+    "build:bundle": "bash scripts/bundle-for-npm.sh",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "dev": "tsx watch src/index.ts",
+    "clean": "rimraf dist src/core",
+    "prepack": "node scripts/validate-package.js",
+    "prepublishOnly": "npm run build:bundle && sed -i.bak 's/\"qa360-core\": \"workspace:\\*\",//g' package.json && rm -f package.json.bak",
+    "postpublish": "git checkout package.json 2>/dev/null || true",
+    "publish:dry": "npm run build:bundle && sed -i.bak 's/\"qa360-core\": \"workspace:\\*\",//g' package.json && npm publish --dry-run; git checkout package.json",
+    "publish:real": "npm run build:bundle && npm publish --access public --provenance"
+  },
+  "dependencies": {
+    "@playwright/test": "^1.49.0",
+    "adm-zip": "^0.5.16",
+    "ajv": "^8.17.1",
+    "ajv-draft-04": "^1.0.0",
+    "ajv-formats": "^2.1.1",
+    "chalk": "^4.1.2",
+    "cli-table3": "^0.6.5",
+    "commander": "^11.0.0",
+    "glob": "^10.4.5",
+    "inquirer": "^8.2.7",
+    "js-yaml": "^4.1.0",
+    "ollama": "^0.5.1",
+    "ora": "^5.4.1",
+    "playwright": "^1.57.0",
+    "qa360-core": "workspace:*",
+    "sqlite3": "^5.1.6",
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@types/adm-zip": "^0.5.7",
+    "@types/inquirer": "^9.0.9",
+    "@vitest/coverage-v8": "1.6.0",
+    "tsx": "^4.0.0",
+    "vitest": "1.6.0"
+  },
+  "keywords": [
+    "qa360",
+    "cli",
+    "testing",
+    "proof"
+  ],
+  "author": "QA360 Core Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/xyqotech/qa360.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/xyqotech/qa360",
+  "bugs": {
+    "url": "https://github.com/xyqotech/qa360/issues"
+  }
+}

package/cli/scripts/bundle-for-npm.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+set -e
+
+echo "🔧 Bundling QA360 for npm publication..."
+
+# Clean previous builds
+echo "🧹 Cleaning previous builds..."
+rm -rf dist/
+rm -rf src/core/
+
+# Copy core source to cli
+echo "📦 Copying core source code..."
+mkdir -p src/core
+cp -r ../core/src/* src/core/
+cp -r ../core/schemas src/core/
+
+# Update imports in CLI to use local core
+echo "🔄 Updating imports..."
+find src/commands -type f -name "*.ts" -exec sed -i.bak "s|from 'qa360-core'|from '../core/index.js'|g" {} \;
+find src/commands -type f -name "*.ts" -exec sed -i.bak "s|import('qa360-core')|import('../core/index.js')|g" {} \;
+find src/commands -type f -name "*.ts.bak" -exec rm {} \;
+# Also update utils/config.ts
+find src/utils -type f -name "*.ts" -exec sed -i.bak "s|from 'qa360-core'|from '../core/index.js'|g" {} \;
+find src/utils -type f -name "*.ts.bak" -exec rm {} \;
+# Also update src/index.ts if it has qa360-core imports
+sed -i.bak "s|from 'qa360-core'|from './core/index.js'|g" src/index.ts 2>/dev/null || true
+rm -f src/index.ts.bak
+
+# Build TypeScript with bundle config
+echo "🔨 Building TypeScript..."
+npx tsc --project tsconfig.bundle.json
+
+# Copy schemas to dist (TypeScript doesn't copy JSON files)
+echo "📄 Copying schemas to dist..."
+mkdir -p dist/core/schemas
+mkdir -p dist/schemas
+cp -r ../core/schemas/* dist/core/schemas/
+cp -r ../core/schemas/* dist/schemas/
+
+# Clean up temporary source files (but keep dist/)
+echo "🧹 Cleaning temporary files..."
+rm -rf src/core/
+
+# Restore original files (for development) - only restore files that weren't fixed for encoding
+echo "Restoring original files..."
+git checkout src/commands/doctor.ts src/commands/pack.ts src/commands/report.ts src/commands/run.ts src/commands/secrets.ts src/commands/serve.ts src/utils/config.ts 2>/dev/null || true
+# Do NOT restore files that were fixed for encoding issues or have other fixes:
+# - history.ts (pin fix), ask.ts, ai.ts, explain.ts, generate.ts, coverage.ts, flakiness.ts, init.ts, monitor.ts, ollama.ts, regression.ts, repair.ts, retry.ts, slo.ts, verify.ts
+# - index.ts (pack commands re-enabled), tsconfig.json (pack.ts removed from exclude)
+
+echo "✅ Bundle complete! dist/ contains bundled code ready for npm publish"