qa360 2.2.20 → 2.3.1

package/package.json

@@ -1,66 +1,41 @@
 {
   "name": "qa360",
-  "version": "2.2.20",
-  "description": "Transform software testing into verifiable, signed, and traceable proofs",
+  "version": "2.3.1",
+  "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
   "type": "module",
-  "packageManager": "pnpm@9.12.2",
-  "engines": {
-    "node": ">=18.20.0"
-  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "bin": {
-    "qa360": "./cli/bin/qa360.js"
+    "qa360": "bin/qa360.js"
   },
   "files": [
-    "cli/dist",
-    "cli/bin",
-    "cli/README.md",
-    "core/schemas",
-    "core/dist/schemas",
-    "core/README.md",
+    "dist",
+    "bin",
     "README.md",
-    "CHANGELOG.md",
-    "CONTRIBUTING.md",
     "LICENSE",
-    "QUICK_START.md",
-    "package.json"
+    "examples"
   ],
   "scripts": {
-    "build": "tsc --build tsconfig.build.json",
+    "build": "tsc --project tsconfig.bundle.json",
     "build:pkg": "tsc",
-    "docs": "typedoc --skipErrorChecking",
-    "docs:serve": "typedoc --skipErrorChecking --serve",
-    "test": "pnpm -r run test",
-    "test:core": "cd core && pnpm test",
-    "test:cli": "cd cli && pnpm test",
-    "test:e2e": "vitest run --config e2e/vitest.config.ts",
-    "test:examples": "node scripts/validate-examples.mjs",
-    "test:all": "npm run type-check && npm run test && npm run test:examples",
-    "lint": "eslint . --ext .ts,.js",
-    "lint:fix": "eslint . --ext .ts,.js --fix",
-    "type-check": "tsc --build tsconfig.build.json --force",
-    "dev": "tsx watch cli/src/index.ts",
-    "clean": "rm -rf dist/ */dist/ **/dist/",
-    "clean:all": "pnpm clean && find . -name '.tmp-test-*' -type d -exec rm -rf {} + 2>/dev/null; find . -name '.qa360' -type d -exec rm -rf {} + 2>/dev/null; find . -name '*.tsbuildinfo' -delete 2>/dev/null; echo 'All artifacts cleaned'",
-    "version:sync": "node scripts/sync-version.mjs",
-    "prepare": "husky install",
-    "install:mcp": "bash scripts/install-mcp.sh"
-  },
-  "workspaces": [
-    "cli",
-    "core",
-    "packages/*"
-  ],
-  "pnpm": {
-    "overrides": {
-      "ajv": "^8.17.1"
-    }
+    "build:bundle": "bash scripts/bundle-for-npm.sh",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "dev": "tsx watch src/index.ts",
+    "clean": "rimraf dist src/core",
+    "prepack": "node scripts/validate-package.js",
+    "prepublishOnly": "npm run build:bundle && sed -i.bak 's/\"qa360-core\": \"workspace:\\*\",//g' package.json && rm -f package.json.bak",
+    "postpublish": "git checkout package.json 2>/dev/null || true",
+    "publish:dry": "npm run build:bundle && sed -i.bak 's/\"qa360-core\": \"workspace:\\*\",//g' package.json && npm publish --dry-run; git checkout package.json",
+    "publish:real": "npm run build:bundle && npm publish --access public --provenance"
   },
   "dependencies": {
     "@playwright/test": "^1.49.0",
     "adm-zip": "^0.5.16",
     "ajv": "^8.17.1",
     "ajv-draft-04": "^1.0.0",
-    "ajv-formats": "^3.0.1",
+    "ajv-formats": "^2.1.1",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.5",
     "commander": "^11.0.0",
@@ -69,43 +44,34 @@
     "js-yaml": "^4.1.0",
     "ollama": "^0.5.1",
     "ora": "^5.4.1",
+    "pngjs": "^7.0.0",
     "playwright": "^1.57.0",
+    
     "sqlite3": "^5.1.6",
-    "table": "^6.9.0",
-    "tweetnacl": "^1.0.3",
-    "qa360-core": "^2.2.6"
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
-    "@playwright/test": "^1.56.1",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.0.0",
-    "@typescript-eslint/eslint-plugin": "^6.0.0",
-    "@typescript-eslint/parser": "^6.0.0",
+    "@types/adm-zip": "^0.5.7",
+    "@types/inquirer": "^9.0.9",
+    "@types/pngjs": "^6.0.5",
     "@vitest/coverage-v8": "1.6.0",
-    "eslint": "^8.0.0",
-    "husky": "^8.0.0",
     "tsx": "^4.0.0",
-    "typedoc": "^0.28.15",
-    "typescript": "^5.0.0",
     "vitest": "1.6.0"
   },
   "keywords": [
-    "qa",
+    "qa360",
+    "cli",
     "testing",
-    "proof",
-    "verification",
-    "ci-cd",
-    "quality-assurance",
-    "local-first",
-    "portable"
+    "proof"
   ],
   "author": "QA360 Core Team",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/xyqotech/qa360.git"
+    "url": "https://github.com/xyqotech/qa360.git",
+    "directory": "cli"
   },
-  "homepage": "https://qa360.dev",
+  "homepage": "https://github.com/xyqotech/qa360",
   "bugs": {
     "url": "https://github.com/xyqotech/qa360/issues"
   }

package/CHANGELOG.md

@@ -1,262 +0,0 @@
-# Changelog
-
-All notable changes to QA360 will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
----
-
-## ⚠️ BROKEN VERSIONS - DO NOT USE
-
-| Version | Status | Issue | Fixed In |
-|---------|--------|-------|----------|
-| **2.2.4** | 🔴 BROKEN | Published without CI check (CI was failing) | 2.2.6 |
-| **2.2.5** | 🔴 BROKEN | Published without bundle script - missing `cli/dist/core/` | 2.2.6 |
-
-**Use version 2.2.6 or later instead.**
-
----
-
-## [2.2.6] - 2025-01-18
-
-### Fixed
-- **Critical bundle fix**: Re-ran bundle script correctly before publication
-  - `cli/dist/core/` now contains the bundled core engine
-  - Imports correctly use `../core/index.js` instead of `qa360-core`
-  - Package installation now works correctly
-- **Recovery**: This version fixes the broken 2.2.4 and 2.2.5 releases
-
-### Added
-- **npm Publication Workflow section** in README with mandatory checklist
-- Documented fatal mistakes from 2.2.4 and 2.2.5 to prevent recurrence
-
----
-
-## Versioning Convention
-
-QA360 uses **Node.js-style versioning** (Major.Minor.Patch).
-
-Example: `v1.4.8` (similar to Node.js `v18.20.5`)
-
-- **Major** (X.0.0): Breaking changes, major rewrites
-- **Minor** (1.X.0): New features, backward compatible
-- **Patch** (1.4.X): Bug fixes, minor improvements
-
-Always reference versions with the **`v`** prefix.
-
-## [1.4.8] - 2026-01-01
-
-### Added
-- **Phase 8 Complete**: TUI & Dashboard for real-time test visualization
-- **E2E Test Suite**: 27 automated end-to-end tests covering all major CLI commands
-  - Tests for: init, preflight, run, verify, doctor, secrets, history
-  - Multi-gate scenarios, error handling, performance tests
-  - AI features with Ollama (skipped if not available)
-- **Beta Testing Plan**: Comprehensive user testing program documentation
-  - 10 test scenarios including AI integration (Ollama, OpenAI, Anthropic)
-  - Success metrics and feedback templates
-- **monitor command**: Run tests with terminal UI visualization
-- **dashboard command**: Run tests with web dashboard (Server-Sent Events)
-
-### Changed
-- Updated documentation with Phase 8 completion status
-- README now references Beta Testing Plan
-- All CI green on Node 18, 20, 22
-
-## [1.4.4] - 2025-12-30
-
-### Fixed
-- **Critical dependency fix**: Moved `adm-zip` from devDependencies to dependencies
-  - Resolves runtime error: "Cannot find package 'adm-zip'"
-  - Affects `qa360 history` command functionality
-  - No other changes - pure dependency fix for v1.4.3
-
-### Technical
-- Package now includes all required runtime dependencies
-- All smoke tests passing
-
-## [1.4.3] - 2025-12-29
-
-### Security
-- **Removed sourcemap files from npm package**: Eliminated 46 `.d.ts.map` files that exposed internal code structure
-- **Package size reduction**: 135.3 kB → 123.6 kB (-8.6%)
-- **File count reduction**: 151 → 105 files (-30%)
-- **Added automatic validation**: `prepack` hook prevents accidental publication of sensitive files
-- **Anti-clone protection**: Added official package notice in README with provenance signatures
-
-### Changed
-- Disabled `declarationMap` in all TypeScript configurations
-- Added `validate-package.js` script to enforce packaging rules
-- Updated CLI README with official package attribution
-
-### Technical
-- Zero runtime impact (all smoke tests passing)
-- Reduced attack surface for code inspection
-- Automated safeguards against future regressions
-- Fixes both v1.4.1 and v1.4.2 (identical sourcemap exposure)
-
-## [1.4.1] - 2025-12-29
-
-### Improved
-- **Phase 7 (Proof) Test Coverage**: 76.42% → 95.41% (+19%)
-  - verifier.ts: 45% → 93.68% (+48.68%)
-  - signer.ts: 70.64% → 97.26% (+26.62%)
-  - bundle.ts: 87.93% → 91.37% (+3.44%)
-  - Added verifier-advanced.test.ts with 26 comprehensive tests
-  - Enhanced signer and bundle test suites
-
-- **Phase3Runner Test Coverage**: 0% → 85.81% (+85.81%)
-  - Replaced placeholder tests with real integration tests
-  - Added E2E tests for complete run workflow
-  - Real integration tests with httpbin.org for api_smoke gate
-  - Mocked tests for ui, a11y, perf, sast, dast gates
-  - Tests for initialization, summary calculation, weighted trust score
-  - 25 comprehensive tests covering core orchestration logic
-
-### Changed
-- Test suite expanded to 593 tests (all passing)
-- Total Phase 7 (proof) tests: 106
-- Enhanced code reliability and maintainability
-
-### Technical
-- All CI checks passing (Node 18, 20, 22)
-- Playwright browsers installed in CI for integration tests
-- No breaking changes or dependency updates
-- Focus on internal quality improvements
-
-## [1.4.0] - 2025-12-29
-
-### Added
-- **ZIP Bundle Export**: Export complete proof bundles with `qa360 history export <run-id> --bundle proof.zip`
-  - Includes proof.json, report.pdf, run metadata, all artifacts, and verification instructions
-  - Portable archive for sharing with stakeholders or archival
-- **Garbage Collection**: Clean up old runs with `qa360 history gc`
-  - Configurable retention policy (default: keep last 10 runs)
-  - Smart artifact reference tracking prevents orphaning
-  - Dry-run mode for safe preview
-  - Respects pinned runs (never deletes)
-- Comprehensive test coverage for export/gc features (14 new integration tests)
-- Detailed documentation and workflow examples in `docs/examples/history-export-gc.md`
-
-### Changed
-- Enhanced `history` command documentation in README
-- Test suite expanded to 282 tests (all passing)
-
-### Technical
-- Package size: 134.6 KB tarball, 616.3 KB unpacked
-- Dependencies: Added adm-zip for ZIP archive creation
-- 151 files in npm package
-- All CI checks passing (Node 18, 20, 22)
-
-## [1.0.1] - 2025-12-26
-
-### Added
-- Connected `qa360 run` command to Phase3Runner
-- Connected `qa360 verify` command to Ed25519 verifier
-- Added `verifyPhase3Proof()` function for proof verification
-- Jest mock for Playwright to fix Node 18 ESM issues
-- Documentation for ZAP DAST adapter (real implementation)
-
-### Fixed
-- ESM/Jest compatibility with inline SQL schema
-- Workspace dependency resolution for qa360-core
-- Playwright dynamic import errors in Jest
-- Lazy loading for test adapters to prevent Jest worker crashes
-
-### Changed
-- Updated test count badge (291 → 412 tests)
-- Documentation reflects actual project state
-- ZAP DAST documented as real implementation (not mock)
-- Phase status updated: Phases 1-6 marked as complete
-- Adapter count corrected (6 → 7 adapters)
-
-### Technical
-- 412 tests passing across 32 test suites
-- CI green on Node 18, 20, 22
-- Trust Score calculation with Ed25519 signatures
-- Phase3Runner orchestration complete
-
-## [1.0.0] - 2024-12-25
-
-### 🎉 First Stable Release
-
-QA360 transforms software testing into cryptographically signed, verifiable proofs.
-
-### Added
-
-#### Core Features
-- **Proof System**: Ed25519 cryptographic signatures for test results
-- **Evidence Vault**: SQLite-based storage with content-addressable system (CAS)
-- **Secrets Management**: AES-256-GCM encrypted secrets storage
-- **Security Redactor**: PII masking for logs and outputs
-
-#### CLI Commands
-- `qa360 doctor` - System health check with auto-fix capabilities
-- `qa360 verify` - Cryptographic proof verification
-- `qa360 run` - Test pack execution (in development)
-- `qa360 serve` - Local observability server
-- `qa360 report` - Report generation (HTML, JSON, PDF, Markdown)
-- `qa360 secrets` - Encrypted secrets management
-
-#### Adapters (OOTB)
-- Playwright API adapter - REST/GraphQL smoke tests
-- Playwright UI adapter - UI testing with accessibility (axe-core)
-- K6 adapter - Performance/load testing
-- Semgrep adapter - SAST security scanning
-- Gitleaks adapter - Secret detection
-- ZAP adapter - DAST security scanning
-- OSV adapter - Dependency vulnerability scanning
-
-#### MCP Integration
-- Model Context Protocol server with 23 tools
--  integration
-- Zero-friction CLI for AI assistants
-
-### Infrastructure
-- Monorepo structure with pnpm workspaces
-- TypeScript 5+ with strict mode
-- Jest testing framework (291 tests, ~55% coverage)
-- GitHub Actions CI (Node 18, 20, 22)
-- Cross-platform support (Windows, macOS, Linux)
-
-### Security
-- Ed25519 digital signatures (tweetnacl)
-- SHA-256 content hashing
-- AES-256-GCM secret encryption
-- JSON Schema validation (AJV 2020-12)
-
-## [0.9.0] - 2024-12-23
-
-### Added
-- Initial beta release
-- Core proof generation engine
-- Basic CLI commands (doctor, verify)
-- Evidence vault implementation
-- Secrets management system
-
-### Changed
-- Monorepo consolidation
-- MCP package unification (2 → 1)
-- Workspace cleanup
-
----
-
-## Migration Guide
-
-### From 0.9.x to 1.0.0
-
-No breaking changes. Simply update:
-
-```bash
-npm update @qa360/cli@1.0.0
-```
-
----
-
-## Links
-
-- **Documentation**: https://qa360.ai
-- **Repository**: https://github.com/xyqotech/qa360
-- **Issues**: https://github.com/xyqotech/qa360/issues
-- **NPM**: https://www.npmjs.com/package/@qa360/cli

package/CONTRIBUTING.md

@@ -1,273 +0,0 @@
-# Contributing to QA360
-
-## 🚀 IMPORTANT - AI INTEGRATION IN PROGRESS
-
-**Status**: Phases 1-3 terminées | Phase 4 en préparation
-
-QA360 est en cours de **transformation AI-native** avec Ollama (100% gratuit, local).
-
-**Progression**: Voir [`docs/OLLAMA_REFACTORING_ROADMAP.md`](./docs/OLLAMA_REFACTORING_ROADMAP.md)
-
----
-
-## Mission Statement
-
-QA360 transforms software testing into **verifiable, signed, and traceable proofs**.
-
-Our goal: Make quality **executable, measurable, and legally provable** while remaining **simple, portable, and sovereign**.
-
-## 🔄 Architecture Pivot (2025)
-
-### Bilan des Phases Terminées
-
-| Phase | Composant | Tests | Statut |
-|-------|-----------|-------|--------|
-| **Phase 1** | Ollama Provider | 96 | ✅ Terminé |
-| **Phase 2** | Auth Module (9 providers) | 92 | ✅ Terminé |
-| **Phase 3** | Pack Validation | 210 | ✅ Terminé |
-
-**Total Phases 1-3**: 398 tests ajoutés
-
-### Ce qui a changé
-
-| Aspect | Avant | Après |
-|--------|-------|-------|
-| **AI Provider** | Non | OllamaProvider (retry, timeout) |
-| **Test Discovery** | Manuel (pack.yml) | TestDiscoverer (auto-détection) |
-| **Authentification** | Secrets chiffrés simples | 9 providers (JWT, OAuth2, TOTP, Cloud, UI Login) |
-| **Pack Format** | Simple (array-based) | Complet (object-based + auth profiles) |
-| **Validation** | PackValidator basic | PackValidator (36 codes d'erreur) |
-
-### Ce qui est PRÉSERVÉ (Le cœur de QA360)
-
-✅ **Proof System** - Signatures Ed25519, vérification, canonicalisation
-✅ **Evidence Vault** - SQLite + CAS, stockage immuable
-✅ **Pack System** - Configuration déclarative
-✅ **Security Redactor** - Protection des secrets
-✅ **Adapters** - Playwright, k6, Semgrep, ZAP, Gitleaks, OSV
-
-### Prochaines Phases
-
-| Phase | Sujet | Statut |
-|-------|-------|--------|
-| **Phase 4** | AI Test Generation | ⏳ À faire |
-| **Phase 5** | Integration & Polish | ⏳ À faire |
-
----
-
-## Development Principles
-
-### 📌 Versioning System
-
-**IMPORTANT**: QA360 uses **Node.js-style versioning** (Major.Minor.Patch).
-
-Example: `v1.4.5` (similar to Node.js `v18.20.5`)
-
-- **Major** (X.0.0): Breaking changes, major rewrites
-- **Minor** (1.X.0): New features, backward compatible
-- **Patch** (1.4.X): Bug fixes, minor improvements
-
-Always reference versions with the **`v`** prefix in documentation and commits.
-
-### 🎯 Core Values
-- **Simplicity**: One command, one file, one proof
-- **Auditability**: Every action is traceable and verifiable
-- **Elegance**: Clean code that speaks for itself
-- **Portability**: Works everywhere, depends on nothing external
-- **AI-Native**: Utilise Ollama pour une génération intelligente
-- **Auth-Complete**: Gère tous les scénarios d'authentification
-
-### 🏗️ Architecture Guidelines
-- **Local-first**: Ollama runs locally, no cloud dependency for AI
-- **BYOCI**: Bring Your Own CI/CD integration
-- **Monorepo**: All components in one repository
-- **TypeScript**: Type safety and developer experience
-- **AI-Enhanced**: Generation de code via Ollama (DeepSeek Coder)
-
----
-
-## Development Workflow
-
-### Branch Strategy (SIMPLIFIED)
-
-```
-main        ← Production releases (STABLE)
-  ↑
-develop     ← Development branch (WORK HERE)
-```
-
-**IMPORTANT - Workflow simplifié**:
-1. Travailler **directement sur `develop`**
-2. Committer et pousser sur `develop`
-3. Vérifier que la **CI est verte** sur `develop`
-4. Merger `develop` vers `main` **uniquement quand tout est vert**
-5. Vérifier que la **CI est aussi verte** sur `main`
-6. **Supprimer toutes les autres branches** (pas de `feature/*`, pas de confusion)
-
-### Workflow complet
-
-```bash
-# 1. S'assurer d'être sur develop
-git checkout develop
-git pull origin develop
-
-# 2. Travailler sur develop
-# ... faire les modifications ...
-
-# 3. Committer
-git add .
-git commit -m "fix(scope): description"
-
-# 4. Pusher
-git push origin develop
-
-# 5. Attendre que la CI soit verte sur develop
-
-# 6. Merger vers main
-git checkout main
-git pull origin main
-git merge develop
-git push origin main
-
-# 7. Vérifier que la CI est verte sur main
-
-# 8. Nettoyer les branches locales (supprimer feature/*)
-git branch | grep -E 'feature/' | xargs git branch -D 2>/dev/null || true
-```
-
-### ⚠️ Règles strictes
-
-**OBLIGATOIRE**:
-- ✅ Travailler sur `develop` uniquement
-- ✅ CI verte sur `develop` avant merge vers `main`
-- ✅ CI verte sur `main` après merge
-- ✅ Supprimer les branches `feature/*` locales et distantes
-
-**INTERDIT**:
-- ❌ Créer des branches `feature/*`
-- ❌ Travailler directement sur `main`
-- ❌ Merge vers `main` si la CI n'est pas verte
-- ❌ Laisser des branches orphelines
-
-### Commit Convention
-
-Nous utilisons [Conventional Commits](https://www.conventionalcommits.org/):
-
-```
-feat(ai): add Ollama provider with DeepSeek Coder support
-feat(auth): implement JWT manager with auto-refresh
-feat(cli): add generate command for AI test generation
-fix(core): resolve signature verification edge case
-refactor(adapters): inject auth manager into playwright adapter
-docs(auth): add authentication guide
-test(vault): add evidence storage integration tests
-chore(deps): add ollama dependency
-```
-
-### ⛔ Publication NPM - DÉACTIVÉ
-
-**ATTENTION**: Les publications NPM sont temporairement désactivées pendant la refactorisation.
-
-Le workflow `.github/workflows/release.yml` est désactivé via `if: false`.
-
-**Ne PAS**:
-- ❌ Créer de tag `v*` sur `main`
-- ❌ Publier sur npm
-- ❌ Incrémenter la version dans `package.json`
-
-**Oui, continuez à**:
-- ✅ Travailler sur `develop`
-- ✅ Committer et pousser régulièrement
-- ✅ Faire des commits conventionnels
-
----
-
-## Phase-by-Phase Development
-
-**Phase actuelle**: **Phase 3 terminée, Phase 4 en préparation**
-
-| Phase | Status | Description | Tests |
-|-------|--------|-------------|-------|
-| **Phase 1** | ✅ Terminé | Ollama Provider, TestDiscoverer, PackConfig | 96 |
-| **Phase 2** | ✅ Terminé | Auth Module (9 providers) | 92 |
-| **Phase 3** | ✅ Terminé | Pack Validation, Migration, Loader | 210 |
-| **Phase 4** | ⏳ À faire | AI Test Generation | - |
-| **Phase 5** | ⏳ À faire | Integration & Polish | - |
-
-**Tests Globaux**: 1859 passing (CLI: 358, Core: 1455, MCP: 46)
-
----
-
-## Code Standards
-
-### TypeScript Configuration
-- Strict mode enabled
-- No `any` types allowed
-- Comprehensive error handling
-
-### Testing Requirements
-- Unit tests for all core functions
-- Integration tests for CLI commands
-- End-to-end tests for complete workflows
-
-### Documentation Standards
-- Every module has a README.md
-- Usage examples for all public APIs
-- Error messages are pedagogical and guiding
-
----
-
-## Getting Started
-
-### Prerequisites
-
-**Obligatoire**:
-- Node.js 18+
-- TypeScript 5+
-- pnpm 9+
-
-**Optionnel mais recommandé pour le développement**:
-- Ollama (pour IA locale) - `brew install ollama`
-- DeepSeek Coder model - `ollama pull deepseek-coder`
-
-### Setup
-```bash
-git clone <repository>
-cd QA360
-pnpm install
-pnpm run build
-pnpm test
-```
-
-### Ollama Setup (pour développement IA)
-```bash
-# Installer Ollama
-brew install ollama  # macOS
-# Ou https://ollama.com pour d'autres OS
-
-# Démarrer Ollama
-ollama serve
-
-# Télécharger le modèle de code
-ollama pull deepseek-coder
-
-# Vérifier
-ollama list
-```
-
----
-
-## Running Tests
-
-```bash
-pnpm test           # Tous les tests
-pnpm test:core      # Tests core uniquement
-pnpm test:cli       # Tests CLI uniquement
-pnpm lint           # Code quality
-pnpm type-check     # TypeScript validation
-pnpm test:all       # Tout (lint + type-check + test)
-```
-
----
-
-## Code Standards