aiox-core 5.0.3 → 5.0.5

package/pro/license/license-crypto.js

@@ -1,303 +0,0 @@
-/**
- * License Crypto Module
- *
- * Provides cryptographic utilities for license cache encryption:
- * - Machine ID generation (deterministic fingerprint)
- * - PBKDF2 key derivation
- * - AES-256-GCM encryption/decryption
- * - HMAC-SHA256 integrity verification
- *
- * @module pro/license/license-crypto
- * @see ADR-PRO-003 - Feature Gating & Licensing
- * @see Story PRO-6 - License Key & Feature Gating System
- */
-
-'use strict';
-
-const crypto = require('crypto');
-const os = require('os');
-
-/**
- * Configuration constants for cryptographic operations.
- * These values follow security best practices per ADR-PRO-003.
- */
-const CONFIG = {
-  // PBKDF2 settings
-  PBKDF2_ITERATIONS: 100000, // Minimum per ADR-PRO-003
-  PBKDF2_KEY_LENGTH: 32, // 256 bits for AES-256
-  PBKDF2_DIGEST: 'sha256',
-
-  // AES-256-GCM settings
-  AES_ALGORITHM: 'aes-256-gcm',
-  AES_IV_LENGTH: 12, // 96 bits recommended for GCM
-  AES_TAG_LENGTH: 16, // 128 bits auth tag
-
-  // HMAC settings
-  HMAC_ALGORITHM: 'sha256',
-
-  // Salt settings
-  SALT_LENGTH: 16, // 128 bits
-};
-
-/**
- * Generate a deterministic machine identifier.
- *
- * Combines hostname + CPU model + first MAC address to create
- * a unique but reproducible identifier for this machine.
- *
- * @returns {string} SHA-256 hash of machine fingerprint components
- */
-function generateMachineId() {
-  const components = [];
-
-  // Hostname
-  const hostname = os.hostname();
-  components.push(hostname);
-
-  // CPU model (first CPU)
-  const cpus = os.cpus();
-  if (cpus.length > 0) {
-    components.push(cpus[0].model);
-  }
-
-  // First non-internal MAC address
-  const networkInterfaces = os.networkInterfaces();
-  for (const [, interfaces] of Object.entries(networkInterfaces)) {
-    for (const iface of interfaces) {
-      if (!iface.internal && iface.mac && iface.mac !== '00:00:00:00:00:00') {
-        components.push(iface.mac);
-        break;
-      }
-    }
-    // Only use first valid MAC
-    if (components.length > 2) {
-      break;
-    }
-  }
-
-  // Create deterministic hash
-  const fingerprint = components.join('|');
-  return crypto.createHash('sha256').update(fingerprint).digest('hex');
-}
-
-/**
- * Generate a cryptographically secure random salt.
- *
- * @param {number} [length=16] - Salt length in bytes
- * @returns {Buffer} Random salt buffer
- */
-function generateSalt(length = CONFIG.SALT_LENGTH) {
-  return crypto.randomBytes(length);
-}
-
-/**
- * Derive an encryption key from machine ID using PBKDF2.
- *
- * Uses 100,000 iterations minimum per ADR-PRO-003 security requirements.
- *
- * @param {string} machineId - Machine identifier from generateMachineId()
- * @param {Buffer|string} salt - Random salt (Buffer or hex string)
- * @returns {Buffer} 256-bit derived key
- */
-function deriveCacheKey(machineId, salt) {
-  const saltBuffer = Buffer.isBuffer(salt) ? salt : Buffer.from(salt, 'hex');
-
-  return crypto.pbkdf2Sync(
-    machineId,
-    saltBuffer,
-    CONFIG.PBKDF2_ITERATIONS,
-    CONFIG.PBKDF2_KEY_LENGTH,
-    CONFIG.PBKDF2_DIGEST,
-  );
-}
-
-/**
- * Encrypt data using AES-256-GCM.
- *
- * Returns an object containing the encrypted ciphertext, initialization vector,
- * and authentication tag for integrity verification.
- *
- * @param {string|object} data - Data to encrypt (objects are JSON stringified)
- * @param {Buffer|string} key - 256-bit encryption key (Buffer or hex string)
- * @returns {{ ciphertext: string, iv: string, tag: string }} Encrypted data components (hex encoded)
- * @throws {Error} If encryption fails
- */
-function encrypt(data, key) {
-  const keyBuffer = Buffer.isBuffer(key) ? key : Buffer.from(key, 'hex');
-
-  if (keyBuffer.length !== 32) {
-    throw new Error('Encryption key must be 256 bits (32 bytes)');
-  }
-
-  // Generate random IV
-  const iv = crypto.randomBytes(CONFIG.AES_IV_LENGTH);
-
-  // Stringify objects
-  const plaintext = typeof data === 'object' ? JSON.stringify(data) : String(data);
-
-  // Create cipher and encrypt
-  const cipher = crypto.createCipheriv(CONFIG.AES_ALGORITHM, keyBuffer, iv, {
-    authTagLength: CONFIG.AES_TAG_LENGTH,
-  });
-
-  let ciphertext = cipher.update(plaintext, 'utf8', 'hex');
-  ciphertext += cipher.final('hex');
-
-  // Get auth tag
-  const tag = cipher.getAuthTag();
-
-  return {
-    ciphertext,
-    iv: iv.toString('hex'),
-    tag: tag.toString('hex'),
-  };
-}
-
-/**
- * Decrypt data using AES-256-GCM.
- *
- * Verifies the authentication tag to ensure data integrity.
- *
- * @param {{ ciphertext: string, iv: string, tag: string }} encryptedData - Encrypted data object
- * @param {Buffer|string} key - 256-bit encryption key (Buffer or hex string)
- * @param {boolean} [parseJson=true] - Whether to parse result as JSON
- * @returns {string|object} Decrypted data
- * @throws {Error} If decryption fails or authentication fails
- */
-function decrypt(encryptedData, key, parseJson = true) {
-  const { ciphertext, iv, tag } = encryptedData;
-
-  const keyBuffer = Buffer.isBuffer(key) ? key : Buffer.from(key, 'hex');
-
-  if (keyBuffer.length !== 32) {
-    throw new Error('Decryption key must be 256 bits (32 bytes)');
-  }
-
-  const ivBuffer = Buffer.from(iv, 'hex');
-  const tagBuffer = Buffer.from(tag, 'hex');
-
-  // Create decipher
-  const decipher = crypto.createDecipheriv(CONFIG.AES_ALGORITHM, keyBuffer, ivBuffer, {
-    authTagLength: CONFIG.AES_TAG_LENGTH,
-  });
-
-  decipher.setAuthTag(tagBuffer);
-
-  let plaintext = decipher.update(ciphertext, 'hex', 'utf8');
-  plaintext += decipher.final('utf8');
-
-  // Optionally parse as JSON
-  if (parseJson) {
-    try {
-      return JSON.parse(plaintext);
-    } catch {
-      // Return as string if not valid JSON
-      return plaintext;
-    }
-  }
-
-  return plaintext;
-}
-
-/**
- * Compute HMAC-SHA256 for data integrity verification.
- *
- * @param {string|Buffer} data - Data to compute HMAC for
- * @param {Buffer|string} key - HMAC key (Buffer or hex string)
- * @returns {string} HMAC as hex string
- */
-function computeHMAC(data, key) {
-  const keyBuffer = Buffer.isBuffer(key) ? key : Buffer.from(key, 'hex');
-  const dataString = Buffer.isBuffer(data) ? data.toString('utf8') : String(data);
-
-  return crypto.createHmac(CONFIG.HMAC_ALGORITHM, keyBuffer).update(dataString).digest('hex');
-}
-
-/**
- * Verify HMAC matches expected value.
- *
- * Uses timing-safe comparison to prevent timing attacks.
- *
- * @param {string|Buffer} data - Data to verify
- * @param {Buffer|string} key - HMAC key
- * @param {string} expectedHmac - Expected HMAC value (hex string)
- * @returns {boolean} true if HMAC matches
- */
-function verifyHMAC(data, key, expectedHmac) {
-  const computedHmac = computeHMAC(data, key);
-
-  // Use timing-safe comparison
-  const computedBuffer = Buffer.from(computedHmac, 'hex');
-  const expectedBuffer = Buffer.from(expectedHmac, 'hex');
-
-  if (computedBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-
-  return crypto.timingSafeEqual(computedBuffer, expectedBuffer);
-}
-
-/**
- * Mask a license key for display.
- *
- * Shows only first and last 4 characters: PRO-XXXX-****-****-XXXX
- * CRITICAL: Always use this function when logging or displaying keys.
- *
- * @param {string} key - Full license key
- * @returns {string} Masked key for display
- */
-function maskKey(key) {
-  if (!key || typeof key !== 'string') {
-    return '****-****-****-****';
-  }
-
-  // Handle PRO-XXXX-XXXX-XXXX-XXXX format
-  const parts = key.split('-');
-  if (parts.length !== 5 || parts[0] !== 'PRO') {
-    // Non-standard format, mask all but first/last 4
-    if (key.length <= 8) {
-      return '****';
-    }
-    return `${key.slice(0, 4)}-****-****-${key.slice(-4)}`;
-  }
-
-  // Standard format: PRO-XXXX-XXXX-XXXX-XXXX
-  return `${parts[0]}-${parts[1]}-****-****-${parts[4]}`;
-}
-
-/**
- * Validate license key format.
- *
- * Expected format: PRO-XXXX-XXXX-XXXX-XXXX
- * Where X is alphanumeric (A-Z0-9)
- *
- * @param {string} key - License key to validate
- * @returns {boolean} true if format is valid
- */
-function validateKeyFormat(key) {
-  if (!key || typeof key !== 'string') {
-    return false;
-  }
-
-  // Format: PRO-XXXX-XXXX-XXXX-XXXX (uppercase alphanumeric)
-  const pattern = /^PRO-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$/;
-  return pattern.test(key);
-}
-
-module.exports = {
-  // Core functions per ADR-PRO-003
-  generateMachineId,
-  deriveCacheKey,
-  encrypt,
-  decrypt,
-  computeHMAC,
-
-  // Additional utilities
-  generateSalt,
-  verifyHMAC,
-  maskKey,
-  validateKeyFormat,
-
-  // Exported for testing
-  _CONFIG: CONFIG,
-};

package/pro/package.json

@@ -1,39 +0,0 @@
-{
-  "name": "@aiox-fullstack/pro",
-  "version": "0.2.0",
-  "description": "AIOX Pro: Premium features for Synkra AIOX",
-  "private": false,
-  "dependencies": {
-    "yaml": "^2.8.2"
-  },
-  "peerDependencies": {
-    "aiox-core": ">=4.0.0"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "files": [
-    "squads/index.js",
-    "squads/README.md",
-    "squads/squad-creator-pro/",
-    "squads/design/",
-    "memory/",
-    "metrics/",
-    "integrations/",
-    "license/",
-    "feature-registry.yaml",
-    "pro-config.yaml",
-    "LICENSE",
-    "README.md"
-  ],
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/SynkraAI/aios-pro.git"
-  },
-  "author": "SynkraAI",
-  "license": "SEE LICENSE IN LICENSE"
-}

package/pro/pro-config.yaml

@@ -1,63 +0,0 @@
-# AIOS Pro Extension Configuration
-# This file is loaded by aios-core's config-resolver when pro/ submodule is present.
-# Reference: ADR-PRO-002 (Configuration Hierarchy)
-#
-# Merge behavior: Deep merge into project config at the "pro" namespace.
-# Priority: After L2 (project-config), before L3 (app-config).
-
-# Pro extension enabled flag
-# Set to false to disable all pro features without removing the submodule
-pro:
-  enabled: true
-  version: "0.1.0"
-
-# Premium Squads Configuration
-# Defines available premium squad templates and marketplace settings
-squads:
-  # Enable premium squad templates
-  premium_templates: true
-  # Marketplace integration (requires pro.integrations for full functionality)
-  marketplace:
-    enabled: false
-    # registry_url: "https://marketplace.synkra.ai/squads"
-
-# Persistent Memory Configuration
-# Cross-session context and memory analytics
-memory:
-  # Enable persistent memory store
-  persistent: false
-  # Storage backend (local | cloud)
-  backend: local
-  # Cross-session context sharing
-  cross_session: false
-  # Memory analytics and optimization
-  analytics: false
-
-# Usage Metrics Configuration
-# Dashboards, team analytics, and cost tracking
-metrics:
-  # Enable usage dashboards
-  dashboards: false
-  # Team-level analytics
-  team_analytics: false
-  # AI provider cost tracking
-  cost_tracking: false
-
-# Enterprise Integrations Configuration
-# Adapters for project management and collaboration tools
-integrations:
-  # Each integration can be enabled independently
-  gitlab:
-    enabled: false
-    # url: "https://gitlab.example.com"
-  bitbucket:
-    enabled: false
-  jira:
-    enabled: false
-    # url: "https://jira.example.com"
-  azure_devops:
-    enabled: false
-  clickup:
-    enabled: false
-  google_drive:
-    enabled: false

package/pro/squads/README.md

@@ -1,24 +0,0 @@
-# Premium Squads
-
-Pre-built agent squads installed during `npx aiox-core install` after Pro license activation.
-
-## Available Squads
-
-| Squad | Agents | Description |
-|-------|--------|-------------|
-| **squad-creator-pro** | 3 | Meta-squad for creating AI agent squads based on real elite minds |
-| **design** | 8 | Design System squad — tokens, components, accessibility, DesignOps |
-
-## How It Works
-
-1. User runs `npx aiox-core install` and activates Pro license
-2. `@aiox-fullstack/pro` npm package is installed
-3. Scaffolder copies all squads from this directory into the user's project `squads/`
-4. Agent commands are auto-installed into active IDEs (Claude Code, Codex, Gemini, Cursor)
-
-## Adding New Squads
-
-1. Develop in `pro/private-squads/` (not published)
-2. When ready, move to `pro/squads/`
-3. Add to `package.json` `files` array
-4. Bump version and publish

package/pro/squads/design/HEADLINE.md

@@ -1,3 +0,0 @@
-# DESIGN — HEADLINE v3 (Copy Squad)
-
-Eu vou criar um design system unificado para todos os seus produtos em 30 dias — sem contratar 4 designers e sem cada tela ter uma cara diferente.

package/pro/squads/design/README.md

@@ -1,109 +0,0 @@
-# Design System Squad
-
-**Version:** 4.2.0  
-**Command:** `/DS`  
-**Type:** Specialist Squad
-
-## Overview
-
-The Design System Squad is focused only on:
-
-- token architecture and governance
-- component system design and composition
-- accessibility governance (WCAG)
-- design system operations and adoption
-- registry and AI-readable metadata
-
-Domain work like brand, logo, thumbnails, photo, and editing was moved to dedicated squads:
-
-- `squads/brand`
-- `squads/content-visual`
-
-## Agents
-
-| Agent | Command | Specialty |
-|---|---|---|
-| Design Chief | `@design-chief` | Orchestration and routing |
-| Brad Frost | `@brad-frost` | Atomic design, components, tokens |
-| Dan Mall | `@dan-mall` | Stakeholder buy-in and DS adoption |
-| Dave Malouf | `@dave-malouf` | DesignOps and operating model |
-| Nano Banana | `@nano-banana-generator` | Visual utility support |
-| Atlas | `@ds-token-architect` | Figma-to-tokens/component specs |
-| Foundations Lead | `@ds-foundations-lead` | Orchestrates F1/F2/F3 foundations pipeline |
-| Storybook Expert | `@storybook-expert` | Story architecture, interaction tests, visual regression |
-
-## Routing
-
-Use Design Chief as entrypoint:
-
-- `"auditar design system"` -> `@brad-frost`
-- `"escalar operacao de design"` -> `@dave-malouf`
-- `"preciso vender DS internamente"` -> `@dan-mall`
-- `"metadata/registry para AI"` -> `@brad-frost`
-- `"preciso de logo/brand"` -> handoff to `/Brand`
-- `"thumbnail/foto/video"` -> handoff to `/ContentVisual`
-
-## Core Tasks
-
-- `ds-*`: architecture, audit, tokenization, migration, registry, metadata, MCP
-- `agentic-*`: machine-readability audit and AI-ready setup
-- `token-*`: W3C DTCG extraction and token modes governance
-- `motion-*`: motion quality and visual regression baselines
-- `fluent-*`: Fluent 2 audit/build compatibility tracks
-- `ds-govern`, `ds-designops`: governance model and DesignOps operating playbook
-- `figma-pipeline`: Figma MCP integration and design-to-code mapping
-- `f1-*`, `f2-*`, `f3-*`: foundations pipeline with blocking QA gates
-- `a11y-*`: accessibility audits and governance
-- `atomic-refactor-*`: decomposition and execution
-- `designops-*`: maturity, scaling, process and tooling
-- `design-triage`, `design-review-orchestration`: orchestration gates
-
-## Workflows
-
-- `workflows/audit-only.yaml`
-- `workflows/brownfield-complete.yaml`
-- `workflows/greenfield-new.yaml`
-- `workflows/self-healing-workflow.yaml`
-- `workflows/agentic-readiness.yaml`
-- `workflows/dtcg-tokens-governance.yaml`
-- `workflows/motion-quality.yaml`
-- `workflows/foundations-pipeline.yaml`
-- `workflows/critical-eye.yaml`
-
-## Modelo de Governance
-
-### Princípio: Governance cria, Execution usa
-
-O squad segue a regra fundamental de separação entre **governance** e **execution**:
-
-- **Governance** define tokens, regras, templates, checklists e protocolos. Esses artefatos são criados e mantidos pelos agentes do squad dentro de `squads/design/`.
-- **Execution** consome esses artefatos sem modificá-los. Agentes de desenvolvimento, CI/CD e IDEs leem as definições e aplicam as regras durante a implementação.
-
-O protocolo completo está documentado em `squads/design/protocols/ai-first-governance.md`.
-
-### Tier System
-
-Definido em `squads/design/config.yaml`:
-
-| Tier | Papel |
-|------|-------|
-| **tier_0_foundation** | Agentes de entrada para operações e estratégia de adoção |
-| **tier_1_masters** | Masters de execução com práticas especialistas |
-| **tier_2_specialists** | Especialistas profundos para implementação de DS |
-| **orchestrator** | Design Chief — roteia requisições para o agente adequado |
-
-### Hierarquia de Fontes Canônicas
-
-Ordem de precedência para resolução de conflitos:
-
-1. `workspace/` — fonte de verdade global (system, ui, domains)
-2. `squads/design/` — governança e conhecimento local do squad
-3. `docs/` — evidência de suporte, nunca fonte final de verdade
-
-Quando dois artefatos conflitam, prevalece a fonte de maior precedência. Conflitos devem ser registrados conforme o protocolo de governance.
-
-## Notes
-
-- Source hierarchy: `workspace/` -> `squads/design/` -> `docs/`
-- This squad is DS-only by design.
-- Cross-domain requests are routed to specialized squads instead of being executed here.