# PaloQA — Full Technical Reference & Architecture Documentation

> Generated for LLMs, AI Agents, and Technical Documentation Crawlers.
> Version: 0.0.10 | Target: Google Chrome (Manifest V3) & Web Cloud Hub
> Website: https://paloqa.palosite.com
> Chrome Web Store: https://chromewebstore.google.com/detail/paloqa/ejpnfcikckeeaephllmaokcikapffoec

---

## 1. System Overview & Philosophy

PaloQA solves the fundamental brittleness and privacy concerns of traditional software testing tools (e.g. Cypress, Playwright, Selenium, Percy, Applitools).

Traditional cloud testing tools require:
1. Writing hundreds of lines of brittle DOM selector code.
2. Uploading confidential company DOMs, session cookies, and internal test databases to third-party cloud test farms.
3. Expensive monthly subscriptions ($200-$500+/mo) for visual snapshot diffs.

PaloQA replaces this with a **Local-First, AI-Augmented Chrome Extension Studio** combined with a lightweight collaborative Web Cloud Hub.

---

## 2. Core Architecture Components

### A. Local-First Engine (Chrome DevTools Protocol - CDP v128+)
- Connects directly to Chromium via the `chrome.debugger` API.
- Captures full-page DOM layouts, dynamic CSS animations (including GSAP ScrollTrigger and canvas elements) with sub-millisecond precision.
- Emulates device viewports (Desktop 1920x1080, Tablet 768x1024, Mobile 375x667).
- Stores all test runs, screenshots, and network logs inside browser **IndexedDB**, guaranteeing zero data leakage.

### B. AI Test Flow Planner
- Translates natural language goals (e.g. "Simulate a user adding an item to cart and checking out with a coupon code") into executable step-by-step action arrays.
- Fully model-agnostic (BYOK - Bring Your Own Key):
  - Google Gemini 1.5 Flash / 2.0 Flash / Pro
  - Anthropic Claude 3.5 Sonnet / Haiku
  - NVIDIA NIM (Meta Llama 3.3 70B, DeepSeek R1, Nemotron)
  - Custom OpenAI-compatible endpoints

### C. Visual UI Regression Auditor
- Crawls interconnected internal pages up to Depth 10 (1,000 pages on Pro/Team tiers, 20 pages on Free).
- Compares baseline vs current DOM screenshots using pixel-by-pixel canvas diffing.
- Supports customizable CSS ignore-selectors (e.g. dynamic timestamps, avatars, rotating banners) to eliminate false positives.

### D. API Schema & Drift Auditor
- Monitors all XHR/Fetch network traffic during browser runs.
- Validates live JSON responses against OpenAPI 3.0, Swagger 2.0, or Postman Collections (v2.1).
- Uses AJV (Another JSON Schema Validator) in strict mode to instantly catch breaking API contract changes, missing required fields, and type mutations.

### E. Smart cURL Data Injector
- Parses raw cURL commands and automatically detects JSON/form payloads.
- Injects dynamic variables:
  - {{$randomUUID}}, {{$timestamp}}, {{$randomEmail}}, {{$randomName}}, {{$randomInt}}
- Supports batch iterations (up to 1,000 requests) with live response code distributions and latency graphs.

### F. 1-Click Code Exporter
- Converts any recorded or AI-planned browser flow into:
  - **Playwright TypeScript** (@playwright/test)
  - **Cypress TypeScript** (cypress)
- Emits clean, production-grade test code with resilient selector strategies (data-testid, aria-label, role, text).

---

## 3. Subscription Tiers & Quotas

| Feature | Free Open-Core | Developer Pro ($5/mo) | Team Cloud ($20/mo) |
| :--- | :---: | :---: | :---: |
| Price (Annual Billing) | $0 | $4 / mo ($48/yr) | $16 / mo ($192/yr) |
| Price (Monthly) | $0 | $5 / mo | $20 / mo |
| Local Recording Steps | 500 steps/flow | Unlimited | Unlimited |
| Visual & API Crawl Depth | 20 pages (Depth 3) | 1,000 pages (Depth 10) | 1,000 pages (Depth 10) |
| Contract Audit (OpenAPI/Postman) | No | Yes (Unlimited) | Yes (Unlimited) |
| Batch Data Injections | 20 per batch | 100 per batch | 1,000 per batch |
| Playwright & Cypress TS Export | Locked | 1-Click Export | 1-Click Export |
| Cloud Test Flows Storage | 5 flows (7-day) | Unlimited (90-day) | Permanent (Never deleted) |
| Shareable Web Reports | JSON/Excel | Verified Web Links | Team Workspace + Priority |

---

## 4. Security, Compliance & Privacy

- **GDPR & CCPA Compliant**: User data stored locally by default. Cloud features use encrypted Supabase PostgreSQL with strict Row Level Security (RLS).
- **No Third-Party Tracking**: Zero telemetry or analytics injection on captured test sessions.
- **Enterprise Isolation**: Billing and plan state verified cryptographically via Supabase Service Role and Stripe Webhooks.

---

## 5. Contact & Official Resources

- Website: https://paloqa.palosite.com
- Support: hello@palosite.com
- Extension Store: https://chromewebstore.google.com/detail/paloqa/ejpnfcikckeeaephllmaokcikapffoec
- Privacy Policy: https://paloqa.palosite.com/privacy.html
- Terms of Service: https://paloqa.palosite.com/terms.html