anchi-kit 1.2.0 → 1.2.2

package/.antigravity/compliance/audit-standard.yaml

@@ -0,0 +1,70 @@
+# ============================================
+# Audit Logging Standard
+# ============================================
+# Format standard for security & compliance logs
+
+# ============================================
+# Standard JSON Structure
+# ============================================
+log_format:
+  timestamp: "ISO-8601 (UTC)"
+  level: "INFO | WARN | ERROR | FATAL"
+  service: "Service Name"
+
+  # Context (Who/Where)
+  context:
+    user_id: "Hash/UUID (Never plain PII)"
+    ip_address: "Masked (e.g., 192.168.x.x)"
+    request_id: "UUID"
+    session_id: "UUID"
+
+  # Action (What)
+  diff:
+    action: "CREATE | UPDATE | DELETE | READ"
+    resource: "Table/File Name"
+    target_id: "Resource ID"
+    changes: "JSON diff (Redacted)"
+
+  # Metadata
+  meta:
+    latency_ms: 123
+    status_code: 200
+    risk_score: 0-100
+
+# ============================================
+# Required Events to Log
+# ============================================
+mandatory_events:
+  security:
+    - "Login success/failure"
+    - "Password reset"
+    - "2FA configuration"
+    - "API Key generation"
+
+  data:
+    - "Bulk export"
+    - "Bulk delete"
+    - "Schema change"
+    - "Permission elevation"
+
+  system:
+    - "Deployment"
+    - "Config change"
+    - "Server restart"
+
+# ============================================
+# Anchi-Kit Implementation
+# ============================================
+# Config cho auditLogger.js
+
+implementation:
+  output: "JSON"
+  pii_redaction: "Strict"
+  destination:
+    - "Console (Dev)"
+    - "File (.ai-audit/audit.log)"
+    - "Remote (Datadog/Splunk) - Configurable"
+
+  integrity_check:
+    enabled: true
+    hashing: "SHA-256 chain per log entry"

package/.antigravity/compliance/data-retention.yaml

@@ -0,0 +1,55 @@
+# ============================================
+# Data Retention Policy
+# ============================================
+# Guidelines for data lifecycle management
+
+policies:
+  # 🔴 Application Logs
+  app_logs:
+    retention_period: "30 days"
+    action_after: "Delete"
+    storage: "Encrypted S3 / CloudWatch"
+    pii_handling: "Redacted at source"
+
+  # 🟠 Audit Logs (Security)
+  audit_logs:
+    retention_period: "1 year"
+    action_after: "Archive to Cold Storage"
+    requirement: "Immutable"
+    content: ["Login attempts", "Permission changes", "Data exports"]
+
+  # 🟡 User Activity Data
+  user_activity:
+    retention_period: "2 years"
+    action_after: "Anonymize"
+    purpose: "Analytics & Improvement"
+
+  # 🟢 Backups
+  database_backups:
+    daily: "7 days"
+    weekly: "4 weeks"
+    monthly: "12 months"
+    encryption: "Required (AES-256)"
+
+# ============================================
+# AI Automation Checks
+# ============================================
+automation:
+  # Check if Cleanup Cron Jobs exist
+  cron_checks:
+    - pattern: "log cleanup"
+    - pattern: "delete old records"
+    - pattern: "archive data"
+
+  # Check Database Schema for timestamps
+  schema_checks:
+    required_fields:
+      - created_at
+      - updated_at
+      - deleted_at (for soft deletes)
+      - data_retention_date (optional)
+
+  # Warning triggers
+  warnings:
+    - condition: "Table grows > 10GB without archiving strategy"
+    - condition: "Logs stored > 90 days in hot storage"

package/.antigravity/compliance/gdpr-checklist.yaml

@@ -0,0 +1,73 @@
+# ============================================
+# GDPR Checklist & Procedures
+# ============================================
+# AI guidance for handling personal data
+
+# ============================================
+# 1. Data Collection
+# ============================================
+data_collection:
+  rules:
+    - rule: "Minimize data collection"
+      check: "Is this data absolutely necessary for the feature?"
+      action: "Warn if collecting unrestricted PII"
+
+    - rule: "Explicit Consent"
+      check: "Is there a consent form/checkbox for this data?"
+      action: "Check for UI elements receiving this data"
+
+  pii_categories:
+    - name: "Direct Identifiers"
+      fields: [email, phone, ssn, passport, device_id]
+      risk: "HIGH"
+      requirement: "Encryption + Strict Access"
+
+    - name: "Indirect Identifiers"
+      fields: [dob, gender, zip_code, ip_address]
+      risk: "MEDIUM"
+      requirement: "Anonymization where possible"
+
+# ============================================
+# 2. Right to be Forgotten (Deletion)
+# ============================================
+deletion_procedures:
+  requirements:
+    - "Must delete from Primary Database"
+    - "Must delete from Backups (or invalidate)"
+    - "Must delete from Logs (or redact)"
+    - "Must notify 3rd party processors (Stripe, Analytics)"
+
+  ai_check:
+    - command: "delete_user"
+    - verify: "Cascading deletes implemented?"
+    - verify: "Soft delete vs Hard delete policy?"
+
+# ============================================
+# 3. Data Portability (Export)
+# ============================================
+export_procedures:
+  requirements:
+    - "Format must be machine-readable (JSON/CSV)"
+    - "Must include all user-provided data"
+    - "Must NOT include internal system metadata (hashes, internal scores)"
+
+# ============================================
+# 4. Data Processing Agreement (DPA)
+# ============================================
+third_party_checks:
+  checklist:
+    - "Is DPA signed with vendor?"
+    - "Is vendor GDPR compliant?"
+    - "Is data crossing EU borders?"
+
+# ============================================
+# AI Enforcement
+# ============================================
+ai_enforcement:
+  on_schema_change:
+    - "Check if new PII fields added"
+    - "Suggest encryption for PII"
+
+  on_api_create:
+    - "Check if PII returned in response"
+    - "Suggest strict CORS & Auth"

package/.antigravity/data-classification.yaml

@@ -0,0 +1,138 @@
+# ============================================
+# Data Classification - Internal Security
+# ============================================
+# Định nghĩa mức độ nhạy cảm của dữ liệu
+# AI sẽ tự động nhận diện và áp dụng quy tắc phù hợp
+
+classification_levels:
+  # 🔴 CONFIDENTIAL - Tuyệt mật
+  confidential:
+    description: "Dữ liệu tuyệt mật, không được chia sẻ ra ngoài"
+    patterns:
+      - "**/secrets/**"
+      - "**/credentials/**"
+      - "**/.env"
+      - "**/.env.*"
+      - "!**/.env.example"
+      - "**/private-keys/**"
+      - "**/certificates/**"
+      - "**/prisma/migrations/**"
+      - "**/database/seeds/**"
+    
+    rules:
+      no_export: true           # Không export nội dung đầy đủ
+      no_paste_external: true   # Không paste ra AI bên ngoài
+      no_screenshot: true       # Cảnh báo khi xuất hiện trong terminal
+      redact_in_logs: true      # Tự động mask trong logs
+      require_approval: true    # Yêu cầu xác nhận trước khi thao tác
+
+  # 🟠 INTERNAL - Nội bộ
+  internal:
+    description: "Dữ liệu nội bộ, chỉ chia sẻ trong team"
+    patterns:
+      - "src/domain/**"
+      - "src/core/**"
+      - "src/services/**"
+      - "**/internal/**"
+      - "**/private/**"
+      - "docs/internal/**"
+      - "docs/architecture/**"
+      - "**/api/internal/**"
+    
+    rules:
+      warn_before_share: true   # Cảnh báo trước khi share
+      summarize_only: true      # Chỉ tóm tắt, không quote đầy đủ
+      no_full_export: true      # Không export toàn bộ file
+
+  # 🟡 RESTRICTED - Hạn chế
+  restricted:
+    description: "Dữ liệu hạn chế, cần cẩn thận khi chia sẻ"
+    patterns:
+      - "src/**"
+      - "lib/**"
+      - "packages/**"
+      - "apps/**"
+      - "config/**"
+    
+    rules:
+      check_before_export: true # Kiểm tra trước khi export
+
+  # 🟢 PUBLIC - Công khai
+  public:
+    description: "Dữ liệu có thể chia sẻ công khai"
+    patterns:
+      - "README.md"
+      - "CHANGELOG.md"
+      - "LICENSE"
+      - "docs/public/**"
+      - "examples/**"
+      - ".github/workflows/**"
+    
+    rules:
+      allow_share: true
+
+# ============================================
+# Sensitive Content Patterns
+# ============================================
+# AI tự động redact các patterns này
+
+sensitive_patterns:
+  # API Keys & Tokens
+  api_keys:
+    - "sk-[a-zA-Z0-9]{20,}"           # OpenAI
+    - "AIza[a-zA-Z0-9_-]{35}"          # Google
+    - "ghp_[a-zA-Z0-9]{36}"            # GitHub PAT
+    - "sk-ant-[a-zA-Z0-9_-]+"          # Anthropic
+    - "xox[baprs]-[a-zA-Z0-9-]+"       # Slack
+    - "AKIA[A-Z0-9]{16}"               # AWS
+  
+  # URLs & Endpoints
+  internal_urls:
+    - "*://localhost:*"
+    - "*://127.0.0.1:*"
+    - "*://*.internal.*"
+    - "*://*.local:*"
+    - "*://staging.*"
+    - "*://dev.*"
+  
+  # Credentials
+  credentials:
+    - "password\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "secret\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "api[_-]?key\\s*[=:]\\s*['\"][^'\"]+['\"]"
+
+# ============================================
+# Redaction Rules
+# ============================================
+# Khi xuất logs/docs/demo, tự động thay thế
+
+redaction:
+  enabled: true
+  replacement: "[REDACTED]"
+  
+  auto_redact:
+    - api_keys
+    - internal_urls
+    - credentials
+    - email_addresses
+    - ip_addresses
+    - jwt_tokens
+
+# ============================================
+# Warning Triggers
+# ============================================
+# Khi nào AI cần cảnh báo người dùng
+
+warnings:
+  # Trigger khi tạo file trong các thư mục này
+  on_file_create:
+    - "/docs/**"
+    - "/demo/**"
+    - "/examples/**"
+    - "/public/**"
+    message: "⚠️ Đang tạo file có thể public. Kiểm tra không chứa thông tin nhạy cảm."
+  
+  # Trigger khi export/copy code
+  on_code_export:
+    from_classified: ["confidential", "internal"]
+    message: "⚠️ Code này thuộc phân loại nội bộ. Xác nhận trước khi chia sẻ."

package/.antigravity/deploy-guard.yaml

@@ -0,0 +1,135 @@
+# ============================================
+# Deploy Guard - Silent Protection
+# ============================================
+# AI tự động kiểm tra và cảnh báo khi deploy
+
+# ============================================
+# Allowed Deploy Targets
+# ============================================
+allowed_platforms:
+  # Chỉ cho phép deploy qua org/team accounts
+  vercel:
+    type: "org_only"
+    # org_name sẽ được config khi setup
+
+  aws:
+    type: "org_only"
+    # account_id sẽ được config khi setup
+
+  railway:
+    type: "team_only"
+
+  render:
+    type: "team_only"
+
+  fly_io:
+    type: "org_only"
+
+# ============================================
+# Blocked Actions
+# ============================================
+blocked:
+  # Ngăn chặn deploy qua account cá nhân
+  personal_accounts: true
+
+  # Ngăn chặn tunnel localhost ra internet
+  localhost_tunnels:
+    - ngrok
+    - localtunnel
+    - cloudflare_tunnel
+    - expose
+
+  # Ngăn chặn public share localhost
+  public_share:
+    - "*share*my*localhost*"
+    - "*expose*local*"
+
+# ============================================
+# Environment Guards
+# ============================================
+env_guards:
+  # Cảnh báo khi dùng staging config cho production
+  staging_production_mismatch:
+    enabled: true
+    check:
+      - "NODE_ENV mismatch"
+      - "DATABASE_URL contains staging/dev"
+      - "API endpoints contain staging"
+
+  # Kiểm tra .env không bị build vào frontend
+  env_in_frontend:
+    enabled: true
+    patterns:
+      - "NEXT_PUBLIC_* should not contain secrets"
+      - "VITE_* should not contain secrets"
+      - "REACT_APP_* should not contain secrets"
+
+  # Cảnh báo hardcoded secrets trong build
+  hardcoded_secrets:
+    enabled: true
+    scan_before_deploy: true
+
+# ============================================
+# Deploy Checklist (AI tự động verify)
+# ============================================
+pre_deploy_checks:
+  - name: "No secrets in code"
+    command: "scan_secrets"
+    block_on_fail: true
+
+  - name: "Environment variables set"
+    check: "required_env_vars"
+    block_on_fail: true
+
+  - name: "Not using localhost URLs"
+    pattern: "localhost|127.0.0.1"
+    exclude: "*.test.*|*.spec.*"
+    block_on_fail: false
+    warn: true
+
+  - name: "Database not pointing to local"
+    check: "DATABASE_URL != localhost"
+    block_on_fail: true
+
+# ============================================
+# Logging Redaction
+# ============================================
+log_redaction:
+  enabled: true
+
+  # Tự động redact trong console.log, logger.*
+  auto_redact_patterns:
+    - token
+    - secret
+    - password
+    - api_key
+    - authorization
+    - bearer
+
+  # Redact URLs nội bộ
+  redact_internal_urls: true
+
+  # Redact stack traces nhạy cảm
+  redact_stacktraces:
+    hide_paths: true
+    hide_line_numbers: false
+
+# ============================================
+# Demo/Docs Guard
+# ============================================
+demo_guard:
+  enabled: true
+
+  # Khi tạo docs/demo, kiểm tra không chứa
+  forbidden_content:
+    - real_api_keys
+    - real_database_urls
+    - internal_endpoints
+    - customer_data
+    - schema_with_real_data
+
+  # Suggest mock data thay thế
+  suggest_mocks: true
+
+  # Auto-redact khi phát hiện
+  auto_redact: true

package/.antigravity/skills/article-extractor/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: article-extractor
+description: Extract full article text and metadata from web pages, converting HTML to clean markdown with citations and readability optimization.
+---
+
+# Article Extractor
+
+Extract clean article content from web pages to markdown.
+
+## When to Use
+
+- Research documentation
+- Content aggregation
+- Knowledge base creation
+- Citation collection
+- Offline reading
+
+## Extraction
+
+```bash
+# Input: URL
+https://example.com/article
+
+# Output: Clean markdown
+# Article Title
+
+*By Author Name - Published Date*
+
+Article content in clean markdown format...
+
+## Citations
+- Source: https://example.com/article
+- Author: Name
+- Date: 2025-12-27
+```
+
+## Features
+
+- Remove ads, navigation, footers
+- Extract main content
+- Preserve formatting
+- Generate metadata
+- Create citations
+
+## Example
+
+```javascript
+const article = await extractArticle(url);
+// Returns: {title, author, date, content, metadata}
+```
+
+See scripts for implementation examples.

package/.antigravity/skills/artifacts-builder/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: artifacts-builder
+description: Create elaborate multi-component HTML artifacts using React, Tailwind CSS, and shadcn/ui. Modern frontend stack for rapid UI prototyping with professional components.
+---
+
+# Artifacts Builder
+
+Multi-component HTML artifacts with React, Tailwind, and shadcn/ui.
+
+## When to Use
+
+- Building interactive UIs
+- Prototyping dashboards
+- Creating component libraries
+- Modern web applications
+- Quick mockups
+
+## Tech Stack
+
+**React** - Component architecture  
+**Tailwind CSS** - Utility-first styling  
+**shadcn/ui** - Pre-built components
+
+## Component Types
+
+```tsx
+// Button component
+import { Button } from "@/components/ui/button";
+
+export function Demo() {
+  return <Button variant="outline">Click me</Button>;
+}
+
+// Card with content
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+
+export function InfoCard() {
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Title</CardTitle>
+      </CardHeader>
+      <CardContent>Content here</CardContent>
+    </Card>
+  );
+}
+```
+
+## shadcn/ui Components
+
+- Buttons, Cards, Dialogs
+- Forms, Inputs, Select
+- Tables, Tabs, Tooltips
+- And 40+ more...
+
+## Best Practices
+
+1. **Component composition** - Build from small pieces
+2. **Responsive design** - Mobile-first approach
+3. **Accessibility** - ARIA labels, keyboard nav
+4. **Performance** - Code splitting, lazy loading
+
+See [references/react-patterns.md](references/react-patterns.md), [references/t ailwind-utilities.md](references/tailwind-utilities.md), [references/shadcn-components.md](references/shadcn-components.md).

package/.antigravity/skills/aws-deployment/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: aws-deployment
+description: AWS infrastructure deployment using CDK (Cloud Development Kit), serverless patterns, Lambda functions, API Gateway, DynamoDB, and cost optimization strategies. Includes security best practices and CI/CD integration.
+---
+
+# AWS Deployment
+
+Production-ready AWS infrastructure using CDK and serverless patterns.
+
+## When to Use
+
+- Deploying to AWS cloud
+- Building serverless applications
+- Infrastructure as Code
+- Auto-scaling requirements
+- Cost-conscious deployments
+
+## CDK Infrastructure
+
+```typescript
+import * as cdk from "aws-cdk-lib";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as apigateway from "aws-cdk-lib/aws-apigateway";
+
+export class ApiStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string) {
+    super(scope, id);
+
+    // Lambda function
+    const handler = new lambda.Function(this, "Handler", {
+      runtime: lambda.Runtime.NODEJS_18_X,
+      code: lambda.Code.fromAsset("lambda"),
+      handler: "index.handler",
+    });
+
+    // API Gateway
+    new apigateway.LambdaRestApi(this, "Api", {
+      handler: handler,
+    });
+  }
+}
+```
+
+## Serverless Patterns
+
+### API + Lambda + DynamoDB
+
+- RESTful API via API Gateway
+- Business logic in Lambda
+- Data storage in DynamoDB
+- Auto-scaling built-in
+
+### Event-Driven Architecture
+
+- S3 triggers Lambda
+- SQS queues for async processing
+- EventBridge for event routing
+
+## Cost Optimization
+
+1. **Use appropriate sizes** - Right-size Lambda memory
+2. **Reserved capacity** - For predictable workloads
+3. **S3 lifecycle policies** - Archive old data
+4. **CloudWatch monitoring** - Track costs
+5. **Serverless First** - Pay per use
+
+## Security Best Practices
+
+- IAM least privilege
+- VPC for sensitive resources
+- Secrets in AWS Secrets Manager
+- Enable CloudTrail logging
+- Use WAF for API protection
+
+## Deployment
+
+```bash
+# CDK commands
+cdk synth      # Generate CloudFormation
+cdk deploy     # Deploy to AWS
+cdk diff       # Show changes
+cdk destroy    # Remove stack
+```
+
+See [references/cdk-best-practices.md](references/cdk-best-practices.md), [references/serverless-patterns.md](references/serverless-patterns.md), and [references/cost-optimization.md](references/cost-optimization.md).