anchi-kit 1.2.1 → 1.2.2

package/.antigravity/compliance/audit-standard.yaml

@@ -0,0 +1,70 @@
+# ============================================
+# Audit Logging Standard
+# ============================================
+# Format standard for security & compliance logs
+
+# ============================================
+# Standard JSON Structure
+# ============================================
+log_format:
+  timestamp: "ISO-8601 (UTC)"
+  level: "INFO | WARN | ERROR | FATAL"
+  service: "Service Name"
+
+  # Context (Who/Where)
+  context:
+    user_id: "Hash/UUID (Never plain PII)"
+    ip_address: "Masked (e.g., 192.168.x.x)"
+    request_id: "UUID"
+    session_id: "UUID"
+
+  # Action (What)
+  diff:
+    action: "CREATE | UPDATE | DELETE | READ"
+    resource: "Table/File Name"
+    target_id: "Resource ID"
+    changes: "JSON diff (Redacted)"
+
+  # Metadata
+  meta:
+    latency_ms: 123
+    status_code: 200
+    risk_score: 0-100
+
+# ============================================
+# Required Events to Log
+# ============================================
+mandatory_events:
+  security:
+    - "Login success/failure"
+    - "Password reset"
+    - "2FA configuration"
+    - "API Key generation"
+
+  data:
+    - "Bulk export"
+    - "Bulk delete"
+    - "Schema change"
+    - "Permission elevation"
+
+  system:
+    - "Deployment"
+    - "Config change"
+    - "Server restart"
+
+# ============================================
+# Anchi-Kit Implementation
+# ============================================
+# Config cho auditLogger.js
+
+implementation:
+  output: "JSON"
+  pii_redaction: "Strict"
+  destination:
+    - "Console (Dev)"
+    - "File (.ai-audit/audit.log)"
+    - "Remote (Datadog/Splunk) - Configurable"
+
+  integrity_check:
+    enabled: true
+    hashing: "SHA-256 chain per log entry"

package/.antigravity/compliance/data-retention.yaml

@@ -0,0 +1,55 @@
+# ============================================
+# Data Retention Policy
+# ============================================
+# Guidelines for data lifecycle management
+
+policies:
+  # 🔴 Application Logs
+  app_logs:
+    retention_period: "30 days"
+    action_after: "Delete"
+    storage: "Encrypted S3 / CloudWatch"
+    pii_handling: "Redacted at source"
+
+  # 🟠 Audit Logs (Security)
+  audit_logs:
+    retention_period: "1 year"
+    action_after: "Archive to Cold Storage"
+    requirement: "Immutable"
+    content: ["Login attempts", "Permission changes", "Data exports"]
+
+  # 🟡 User Activity Data
+  user_activity:
+    retention_period: "2 years"
+    action_after: "Anonymize"
+    purpose: "Analytics & Improvement"
+
+  # 🟢 Backups
+  database_backups:
+    daily: "7 days"
+    weekly: "4 weeks"
+    monthly: "12 months"
+    encryption: "Required (AES-256)"
+
+# ============================================
+# AI Automation Checks
+# ============================================
+automation:
+  # Check if Cleanup Cron Jobs exist
+  cron_checks:
+    - pattern: "log cleanup"
+    - pattern: "delete old records"
+    - pattern: "archive data"
+
+  # Check Database Schema for timestamps
+  schema_checks:
+    required_fields:
+      - created_at
+      - updated_at
+      - deleted_at (for soft deletes)
+      - data_retention_date (optional)
+
+  # Warning triggers
+  warnings:
+    - condition: "Table grows > 10GB without archiving strategy"
+    - condition: "Logs stored > 90 days in hot storage"

package/.antigravity/compliance/gdpr-checklist.yaml

@@ -0,0 +1,73 @@
+# ============================================
+# GDPR Checklist & Procedures
+# ============================================
+# AI guidance for handling personal data
+
+# ============================================
+# 1. Data Collection
+# ============================================
+data_collection:
+  rules:
+    - rule: "Minimize data collection"
+      check: "Is this data absolutely necessary for the feature?"
+      action: "Warn if collecting unrestricted PII"
+
+    - rule: "Explicit Consent"
+      check: "Is there a consent form/checkbox for this data?"
+      action: "Check for UI elements receiving this data"
+
+  pii_categories:
+    - name: "Direct Identifiers"
+      fields: [email, phone, ssn, passport, device_id]
+      risk: "HIGH"
+      requirement: "Encryption + Strict Access"
+
+    - name: "Indirect Identifiers"
+      fields: [dob, gender, zip_code, ip_address]
+      risk: "MEDIUM"
+      requirement: "Anonymization where possible"
+
+# ============================================
+# 2. Right to be Forgotten (Deletion)
+# ============================================
+deletion_procedures:
+  requirements:
+    - "Must delete from Primary Database"
+    - "Must delete from Backups (or invalidate)"
+    - "Must delete from Logs (or redact)"
+    - "Must notify 3rd party processors (Stripe, Analytics)"
+
+  ai_check:
+    - command: "delete_user"
+    - verify: "Cascading deletes implemented?"
+    - verify: "Soft delete vs Hard delete policy?"
+
+# ============================================
+# 3. Data Portability (Export)
+# ============================================
+export_procedures:
+  requirements:
+    - "Format must be machine-readable (JSON/CSV)"
+    - "Must include all user-provided data"
+    - "Must NOT include internal system metadata (hashes, internal scores)"
+
+# ============================================
+# 4. Data Processing Agreement (DPA)
+# ============================================
+third_party_checks:
+  checklist:
+    - "Is DPA signed with vendor?"
+    - "Is vendor GDPR compliant?"
+    - "Is data crossing EU borders?"
+
+# ============================================
+# AI Enforcement
+# ============================================
+ai_enforcement:
+  on_schema_change:
+    - "Check if new PII fields added"
+    - "Suggest encryption for PII"
+
+  on_api_create:
+    - "Check if PII returned in response"
+    - "Suggest strict CORS & Auth"

package/.antigravity/data-classification.yaml

@@ -0,0 +1,138 @@
+# ============================================
+# Data Classification - Internal Security
+# ============================================
+# Định nghĩa mức độ nhạy cảm của dữ liệu
+# AI sẽ tự động nhận diện và áp dụng quy tắc phù hợp
+
+classification_levels:
+  # 🔴 CONFIDENTIAL - Tuyệt mật
+  confidential:
+    description: "Dữ liệu tuyệt mật, không được chia sẻ ra ngoài"
+    patterns:
+      - "**/secrets/**"
+      - "**/credentials/**"
+      - "**/.env"
+      - "**/.env.*"
+      - "!**/.env.example"
+      - "**/private-keys/**"
+      - "**/certificates/**"
+      - "**/prisma/migrations/**"
+      - "**/database/seeds/**"
+    
+    rules:
+      no_export: true           # Không export nội dung đầy đủ
+      no_paste_external: true   # Không paste ra AI bên ngoài
+      no_screenshot: true       # Cảnh báo khi xuất hiện trong terminal
+      redact_in_logs: true      # Tự động mask trong logs
+      require_approval: true    # Yêu cầu xác nhận trước khi thao tác
+
+  # 🟠 INTERNAL - Nội bộ
+  internal:
+    description: "Dữ liệu nội bộ, chỉ chia sẻ trong team"
+    patterns:
+      - "src/domain/**"
+      - "src/core/**"
+      - "src/services/**"
+      - "**/internal/**"
+      - "**/private/**"
+      - "docs/internal/**"
+      - "docs/architecture/**"
+      - "**/api/internal/**"
+    
+    rules:
+      warn_before_share: true   # Cảnh báo trước khi share
+      summarize_only: true      # Chỉ tóm tắt, không quote đầy đủ
+      no_full_export: true      # Không export toàn bộ file
+
+  # 🟡 RESTRICTED - Hạn chế
+  restricted:
+    description: "Dữ liệu hạn chế, cần cẩn thận khi chia sẻ"
+    patterns:
+      - "src/**"
+      - "lib/**"
+      - "packages/**"
+      - "apps/**"
+      - "config/**"
+    
+    rules:
+      check_before_export: true # Kiểm tra trước khi export
+
+  # 🟢 PUBLIC - Công khai
+  public:
+    description: "Dữ liệu có thể chia sẻ công khai"
+    patterns:
+      - "README.md"
+      - "CHANGELOG.md"
+      - "LICENSE"
+      - "docs/public/**"
+      - "examples/**"
+      - ".github/workflows/**"
+    
+    rules:
+      allow_share: true
+
+# ============================================
+# Sensitive Content Patterns
+# ============================================
+# AI tự động redact các patterns này
+
+sensitive_patterns:
+  # API Keys & Tokens
+  api_keys:
+    - "sk-[a-zA-Z0-9]{20,}"           # OpenAI
+    - "AIza[a-zA-Z0-9_-]{35}"          # Google
+    - "ghp_[a-zA-Z0-9]{36}"            # GitHub PAT
+    - "sk-ant-[a-zA-Z0-9_-]+"          # Anthropic
+    - "xox[baprs]-[a-zA-Z0-9-]+"       # Slack
+    - "AKIA[A-Z0-9]{16}"               # AWS
+  
+  # URLs & Endpoints
+  internal_urls:
+    - "*://localhost:*"
+    - "*://127.0.0.1:*"
+    - "*://*.internal.*"
+    - "*://*.local:*"
+    - "*://staging.*"
+    - "*://dev.*"
+  
+  # Credentials
+  credentials:
+    - "password\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "secret\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "api[_-]?key\\s*[=:]\\s*['\"][^'\"]+['\"]"
+
+# ============================================
+# Redaction Rules
+# ============================================
+# Khi xuất logs/docs/demo, tự động thay thế
+
+redaction:
+  enabled: true
+  replacement: "[REDACTED]"
+  
+  auto_redact:
+    - api_keys
+    - internal_urls
+    - credentials
+    - email_addresses
+    - ip_addresses
+    - jwt_tokens
+
+# ============================================
+# Warning Triggers
+# ============================================
+# Khi nào AI cần cảnh báo người dùng
+
+warnings:
+  # Trigger khi tạo file trong các thư mục này
+  on_file_create:
+    - "/docs/**"
+    - "/demo/**"
+    - "/examples/**"
+    - "/public/**"
+    message: "⚠️ Đang tạo file có thể public. Kiểm tra không chứa thông tin nhạy cảm."
+  
+  # Trigger khi export/copy code
+  on_code_export:
+    from_classified: ["confidential", "internal"]
+    message: "⚠️ Code này thuộc phân loại nội bộ. Xác nhận trước khi chia sẻ."

package/.antigravity/deploy-guard.yaml

@@ -0,0 +1,135 @@
+# ============================================
+# Deploy Guard - Silent Protection
+# ============================================
+# AI tự động kiểm tra và cảnh báo khi deploy
+
+# ============================================
+# Allowed Deploy Targets
+# ============================================
+allowed_platforms:
+  # Chỉ cho phép deploy qua org/team accounts
+  vercel:
+    type: "org_only"
+    # org_name sẽ được config khi setup
+
+  aws:
+    type: "org_only"
+    # account_id sẽ được config khi setup
+
+  railway:
+    type: "team_only"
+
+  render:
+    type: "team_only"
+
+  fly_io:
+    type: "org_only"
+
+# ============================================
+# Blocked Actions
+# ============================================
+blocked:
+  # Ngăn chặn deploy qua account cá nhân
+  personal_accounts: true
+
+  # Ngăn chặn tunnel localhost ra internet
+  localhost_tunnels:
+    - ngrok
+    - localtunnel
+    - cloudflare_tunnel
+    - expose
+
+  # Ngăn chặn public share localhost
+  public_share:
+    - "*share*my*localhost*"
+    - "*expose*local*"
+
+# ============================================
+# Environment Guards
+# ============================================
+env_guards:
+  # Cảnh báo khi dùng staging config cho production
+  staging_production_mismatch:
+    enabled: true
+    check:
+      - "NODE_ENV mismatch"
+      - "DATABASE_URL contains staging/dev"
+      - "API endpoints contain staging"
+
+  # Kiểm tra .env không bị build vào frontend
+  env_in_frontend:
+    enabled: true
+    patterns:
+      - "NEXT_PUBLIC_* should not contain secrets"
+      - "VITE_* should not contain secrets"
+      - "REACT_APP_* should not contain secrets"
+
+  # Cảnh báo hardcoded secrets trong build
+  hardcoded_secrets:
+    enabled: true
+    scan_before_deploy: true
+
+# ============================================
+# Deploy Checklist (AI tự động verify)
+# ============================================
+pre_deploy_checks:
+  - name: "No secrets in code"
+    command: "scan_secrets"
+    block_on_fail: true
+
+  - name: "Environment variables set"
+    check: "required_env_vars"
+    block_on_fail: true
+
+  - name: "Not using localhost URLs"
+    pattern: "localhost|127.0.0.1"
+    exclude: "*.test.*|*.spec.*"
+    block_on_fail: false
+    warn: true
+
+  - name: "Database not pointing to local"
+    check: "DATABASE_URL != localhost"
+    block_on_fail: true
+
+# ============================================
+# Logging Redaction
+# ============================================
+log_redaction:
+  enabled: true
+
+  # Tự động redact trong console.log, logger.*
+  auto_redact_patterns:
+    - token
+    - secret
+    - password
+    - api_key
+    - authorization
+    - bearer
+
+  # Redact URLs nội bộ
+  redact_internal_urls: true
+
+  # Redact stack traces nhạy cảm
+  redact_stacktraces:
+    hide_paths: true
+    hide_line_numbers: false
+
+# ============================================
+# Demo/Docs Guard
+# ============================================
+demo_guard:
+  enabled: true
+
+  # Khi tạo docs/demo, kiểm tra không chứa
+  forbidden_content:
+    - real_api_keys
+    - real_database_urls
+    - internal_endpoints
+    - customer_data
+    - schema_with_real_data
+
+  # Suggest mock data thay thế
+  suggest_mocks: true
+
+  # Auto-redact khi phát hiện
+  auto_redact: true

package/.cursor/compliance/audit-standard.yaml

@@ -0,0 +1,70 @@
+# ============================================
+# Audit Logging Standard
+# ============================================
+# Format standard for security & compliance logs
+
+# ============================================
+# Standard JSON Structure
+# ============================================
+log_format:
+  timestamp: "ISO-8601 (UTC)"
+  level: "INFO | WARN | ERROR | FATAL"
+  service: "Service Name"
+
+  # Context (Who/Where)
+  context:
+    user_id: "Hash/UUID (Never plain PII)"
+    ip_address: "Masked (e.g., 192.168.x.x)"
+    request_id: "UUID"
+    session_id: "UUID"
+
+  # Action (What)
+  diff:
+    action: "CREATE | UPDATE | DELETE | READ"
+    resource: "Table/File Name"
+    target_id: "Resource ID"
+    changes: "JSON diff (Redacted)"
+
+  # Metadata
+  meta:
+    latency_ms: 123
+    status_code: 200
+    risk_score: 0-100
+
+# ============================================
+# Required Events to Log
+# ============================================
+mandatory_events:
+  security:
+    - "Login success/failure"
+    - "Password reset"
+    - "2FA configuration"
+    - "API Key generation"
+
+  data:
+    - "Bulk export"
+    - "Bulk delete"
+    - "Schema change"
+    - "Permission elevation"
+
+  system:
+    - "Deployment"
+    - "Config change"
+    - "Server restart"
+
+# ============================================
+# Anchi-Kit Implementation
+# ============================================
+# Config cho auditLogger.js
+
+implementation:
+  output: "JSON"
+  pii_redaction: "Strict"
+  destination:
+    - "Console (Dev)"
+    - "File (.ai-audit/audit.log)"
+    - "Remote (Datadog/Splunk) - Configurable"
+
+  integrity_check:
+    enabled: true
+    hashing: "SHA-256 chain per log entry"

package/.cursor/compliance/data-retention.yaml

@@ -0,0 +1,55 @@
+# ============================================
+# Data Retention Policy
+# ============================================
+# Guidelines for data lifecycle management
+
+policies:
+  # 🔴 Application Logs
+  app_logs:
+    retention_period: "30 days"
+    action_after: "Delete"
+    storage: "Encrypted S3 / CloudWatch"
+    pii_handling: "Redacted at source"
+
+  # 🟠 Audit Logs (Security)
+  audit_logs:
+    retention_period: "1 year"
+    action_after: "Archive to Cold Storage"
+    requirement: "Immutable"
+    content: ["Login attempts", "Permission changes", "Data exports"]
+
+  # 🟡 User Activity Data
+  user_activity:
+    retention_period: "2 years"
+    action_after: "Anonymize"
+    purpose: "Analytics & Improvement"
+
+  # 🟢 Backups
+  database_backups:
+    daily: "7 days"
+    weekly: "4 weeks"
+    monthly: "12 months"
+    encryption: "Required (AES-256)"
+
+# ============================================
+# AI Automation Checks
+# ============================================
+automation:
+  # Check if Cleanup Cron Jobs exist
+  cron_checks:
+    - pattern: "log cleanup"
+    - pattern: "delete old records"
+    - pattern: "archive data"
+
+  # Check Database Schema for timestamps
+  schema_checks:
+    required_fields:
+      - created_at
+      - updated_at
+      - deleted_at (for soft deletes)
+      - data_retention_date (optional)
+
+  # Warning triggers
+  warnings:
+    - condition: "Table grows > 10GB without archiving strategy"
+    - condition: "Logs stored > 90 days in hot storage"

package/.cursor/compliance/gdpr-checklist.yaml

@@ -0,0 +1,73 @@
+# ============================================
+# GDPR Checklist & Procedures
+# ============================================
+# AI guidance for handling personal data
+
+# ============================================
+# 1. Data Collection
+# ============================================
+data_collection:
+  rules:
+    - rule: "Minimize data collection"
+      check: "Is this data absolutely necessary for the feature?"
+      action: "Warn if collecting unrestricted PII"
+
+    - rule: "Explicit Consent"
+      check: "Is there a consent form/checkbox for this data?"
+      action: "Check for UI elements receiving this data"
+
+  pii_categories:
+    - name: "Direct Identifiers"
+      fields: [email, phone, ssn, passport, device_id]
+      risk: "HIGH"
+      requirement: "Encryption + Strict Access"
+
+    - name: "Indirect Identifiers"
+      fields: [dob, gender, zip_code, ip_address]
+      risk: "MEDIUM"
+      requirement: "Anonymization where possible"
+
+# ============================================
+# 2. Right to be Forgotten (Deletion)
+# ============================================
+deletion_procedures:
+  requirements:
+    - "Must delete from Primary Database"
+    - "Must delete from Backups (or invalidate)"
+    - "Must delete from Logs (or redact)"
+    - "Must notify 3rd party processors (Stripe, Analytics)"
+
+  ai_check:
+    - command: "delete_user"
+    - verify: "Cascading deletes implemented?"
+    - verify: "Soft delete vs Hard delete policy?"
+
+# ============================================
+# 3. Data Portability (Export)
+# ============================================
+export_procedures:
+  requirements:
+    - "Format must be machine-readable (JSON/CSV)"
+    - "Must include all user-provided data"
+    - "Must NOT include internal system metadata (hashes, internal scores)"
+
+# ============================================
+# 4. Data Processing Agreement (DPA)
+# ============================================
+third_party_checks:
+  checklist:
+    - "Is DPA signed with vendor?"
+    - "Is vendor GDPR compliant?"
+    - "Is data crossing EU borders?"
+
+# ============================================
+# AI Enforcement
+# ============================================
+ai_enforcement:
+  on_schema_change:
+    - "Check if new PII fields added"
+    - "Suggest encryption for PII"
+
+  on_api_create:
+    - "Check if PII returned in response"
+    - "Suggest strict CORS & Auth"