plogme 1.0.6 → 2.0.1

package/lib/Utils/integrity.js

@@ -1,296 +0,0 @@
-/**
- * Package integrity & attribution guard.
- *
- * Verifies at runtime that this copy is the genuine, un-rebranded
- * `plogme` distribution and that the attribution-required license is
- * intact. If the package identity has been renamed/stripped
- * (the usual result of AI-assisted rebranding), premium features are
- * disabled with a loud warning so the stolen copy visibly degrades
- * instead of quietly becoming a "free rebrand".
- *
- * A remote attestation layer sits on top: on socket connect the client
- * phones home to bailey.crysnovax.link with its package identity and a
- * machine fingerprint. The worker answers "genuine", "revoked", or
- * "rebranded"; "revoked" / "rebranded" disable premium features and can
- * be issued remotely by the operator at any time.
- *
- * DEVELOPER ESCAPE HATCH (so the maintainer never locks themself out):
- *   Set CRYSNOVAX_TRUST_MODE=1 in the environment to bypass the local
- *   integrity checks entirely. Use this when you are actively editing
- *   the package (e.g. with an AI assistant) and a check trips on a
- *   legitimate edit. Rebranders can set it too — but at that point they
- *   are deliberately tampering, which the license already prohibits.
- *
- * Anti-evasion notes:
- *  - The expected identity is stored ENCODED and only decoded at runtime,
- *    so naive find-and-replace / "remove every mention of crysnovax"
- *    rewrites miss it.
- *  - This module is imported from several unrelated entry points
- *    (socket factory, base socket, message composer, message sender), so
- *    removing one hook leaves the others active.
- *  - The checks never throw and never break legitimate installs: a
- *    manifest that cannot be read — or a worker that cannot be reached —
- *    is treated as genuine rather than risking false-positive degradation.
- */
-import { readFileSync } from 'fs';
-import { createHash } from 'node:crypto';
-import os from 'node:os';
-import { createRequire } from 'node:module';
-import { DONATE_URL, LIBRARY_NAME } from '../Defaults/index.js';
-
-const nodeRequire = createRequire(import.meta.url);
-const decode = b64 => Buffer.from(b64, 'base64').toString('utf8');
-
-// ─── Encoded brand identity (decoded below at runtime) ──────────────────────
-const EXPECTED = {
-    // plogme
-    name: 'cGxvZ21l',
-    // plogme
-    author: 'cGxvZ21l',
-    // https://web.crysnovax.link
-    site: 'aHR0cHM6Ly93ZWIuY3J5c25vdmF4Lmxpbms=',
-    // SEE LICENSE IN LICENSE
-    licenseId: 'U0VFIExJQ0VOU0UgSU4gTElDRU5TRQ==',
-    // crysnovax/bailey
-    libraryName: 'Y3J5c25vdmF4L2JhaWxleQ==',
-    // Crysnovax Source License v1.0 (canary phrase inside LICENSE)
-    licenseCanary: 'Q3J5c25vdmF4IFNvdXJjZSBMaWNlbnNlIHYxLjA=',
-    // https://bailey.crysnovax.link/api/v1/verify
-    verifyUrl: 'aHR0cHM6Ly9iYWlsZXkuY3J5c25vdmF4LmxpbmsvYXBpL3YxL3ZlcmlmeQ=='
-};
-
-/** Public brand string used for messages (decoded once). */
-export const getBrandName = () => decode(EXPECTED.name);
-
-/** Developer escape hatch — set to '1' while actively editing the package. */
-export const isTrustMode = () => process.env.CRYSNOVAX_TRUST_MODE === '1';
-
-let cachedReport = null;
-
-/**
- * Returns { genuine, reasons, warnings } for this copy. Memoized per process.
- * - CRYSNOVAX_TRUST_MODE=1                      → genuine (developer mode)
- * - manifest readable + all checks pass         → genuine: true
- * - manifest readable + identity mismatch       → genuine: false (reasons)
- * - cosmetic drift (URL/canary touched)         → genuine: true (warnings only)
- * - manifest unreadable (unusual packaging)     → genuine: true (no false positives)
- */
-export const getIntegrityReport = () => {
-    if (cachedReport) {
-        return cachedReport;
-    }
-    if (isTrustMode()) {
-        cachedReport = {
-            genuine: true,
-            reasons: ['trust mode'],
-            warnings: ['CRYSNOVAX_TRUST_MODE=1 is set — integrity checks bypassed (developer mode)']
-        };
-        return cachedReport;
-    }
-    const reasons = [];
-    const warnings = [];
-    let manifest = null;
-    try {
-        // lib/Utils/integrity.js → ../../package.json = package root manifest
-        manifest = nodeRequire('../../package.json');
-    }
-    catch {
-        // manifest not resolvable — never degrade on packaging oddities alone
-    }
-    if (manifest) {
-        const author = typeof manifest.author === 'string'
-            ? manifest.author
-            : manifest.author?.name;
-        // Hard identity checks — these are what define a rebrand.
-        if (manifest.name !== decode(EXPECTED.name)) {
-            reasons.push(`package renamed to "${manifest.name}"`);
-        }
-        if (author !== decode(EXPECTED.author)) {
-            reasons.push('author attribution removed');
-        }
-        if (manifest.license !== decode(EXPECTED.licenseId)) {
-            reasons.push(`license swapped to "${manifest.license}"`);
-        }
-    }
-    // LICENSE file must exist and carry the license identifier canary
-    try {
-        const licenseText = readFileSync(new URL('../../LICENSE', import.meta.url), 'utf8');
-        if (!licenseText.includes(decode(EXPECTED.licenseCanary))) {
-            // Missing canary = likely edited LICENSE; still licensable, so warn
-            warnings.push('license file was edited (canary phrase missing)');
-        }
-    }
-    catch {
-        reasons.push('license file missing');
-    }
-    // Brand constants — cosmetic drift warns but never disables features,
-    // so maintainers editing defaults with an AI don't lock themselves out.
-    if (DONATE_URL !== decode(EXPECTED.site)) {
-        warnings.push('attribution URL changed');
-    }
-    if (LIBRARY_NAME !== decode(EXPECTED.libraryName)) {
-        warnings.push('library identity constant changed');
-    }
-    cachedReport = {
-        genuine: reasons.length === 0,
-        reasons,
-        warnings
-    };
-    return cachedReport;
-};
-
-let rebrandWarned = false;
-let warningsShown = false;
-
-/**
- * Logs a loud, one-time warning when this copy fails the integrity check.
- * Also surfaces cosmetic warnings once (genuine but drifted) so the
- * maintainer knows a check was soft-tripped. Returns the report.
- */
-export const warnIfRebranded = (logger) => {
-    const report = getIntegrityReport();
-    if (!report.warnings.length && !rebrandWarned) {
-        return report;
-    }
-    const log = (level, message) => {
-        if (logger && typeof logger[level] === 'function') {
-            logger[level]({ reasons: report.reasons, warnings: report.warnings }, message);
-        }
-        else {
-            console.warn('\n' + message + '\n');
-        }
-    };
-    if (report.warnings.length && !warningsShown) {
-        warningsShown = true;
-        log('warn',
-            `⚙ ${getBrandName()} integrity: ${report.warnings.join('; ')}. ` +
-            `Features stay enabled; if this was an accidental edit, set CRYSNOVAX_TRUST_MODE=1 while developing.`);
-    }
-    if (!report.genuine && !rebrandWarned) {
-        rebrandWarned = true;
-        log('warn',
-            `✖ UNAUTHORIZED REBRANDED COPY DETECTED — this is not an official ` +
-            `${getBrandName()} distribution (${report.reasons.join('; ')}). ` +
-            `Rebranding or removing attribution violates the ${decode(EXPECTED.licenseCanary)}. ` +
-            `Premium features are disabled on this copy. Install the genuine package: ` +
-            `https://www.npmjs.com/package/${getBrandName()}`);
-    }
-    return report;
-};
-
-// ─── Remote attestation (bailey.crysnovax.link) ─────────────────────────────
-
-let fingerprint = null;
-const getFingerprint = () => {
-    if (fingerprint) {
-        return fingerprint;
-    }
-    const cpu = os.cpus?.()?.[0]?.model || 'unknown-cpu';
-    const raw = [
-        os.hostname(),
-        os.platform(),
-        os.arch(),
-        cpu,
-        process.version
-    ].join('|');
-    fingerprint = createHash('sha256').update(raw).digest('hex').slice(0, 32);
-    return fingerprint;
-};
-
-let remoteRevoked = false;
-let remoteChecked = false;
-let remoteError = false;
-let remoteWarned = false;
-
-/** Current remote state: 'genuine' | 'revoked' | 'unknown'. */
-export const getRemoteStatus = () => {
-    if (!remoteChecked || remoteError) {
-        return 'unknown';
-    }
-    return remoteRevoked ? 'revoked' : 'genuine';
-};
-
-/**
- * Phones home once per process. NEVER throws and FAILS OPEN: any network
- * error, timeout, or malformed reply leaves premium features enabled —
- * only an explicit revoked/rebranded verdict disables them.
- */
-export const refreshRemoteStatus = async (logger) => {
-    if (remoteChecked) {
-        return getRemoteStatus();
-    }
-    remoteChecked = true;
-    try {
-        let pkg = null;
-        let version = '';
-        try {
-            pkg = nodeRequire('../../package.json');
-            version = pkg?.version || '';
-        }
-        catch {
-            // manifest unreadable — still send what we know
-        }
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), 4000);
-        try {
-            const res = await fetch(decode(EXPECTED.verifyUrl), {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    package: pkg?.name || '',
-                    version,
-                    fingerprint: getFingerprint()
-                }),
-                signal: controller.signal
-            });
-            if (!res.ok) {
-                remoteError = true;
-                return 'unknown';
-            }
-            const body = await res.json();
-            if (body?.status === 'revoked' || body?.status === 'rebranded') {
-                remoteRevoked = true;
-                if (!remoteWarned) {
-                    remoteWarned = true;
-                    const message = `✖ THIS INSTALL HAS BEEN REVOKED (${body.status}) — premium features are disabled.`;
-                    if (logger && typeof logger.warn === 'function') {
-                        logger.warn({ status: body.status }, message);
-                    }
-                    else {
-                        console.warn('\n' + message + '\n');
-                    }
-                }
-            }
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    catch {
-        // fail open — network error/timeout never bricks a genuine install
-        remoteError = true;
-    }
-    return getRemoteStatus();
-};
-
-/**
- * Gate for premium features: returns true only on a genuine copy that has
- * not been remotely revoked. On a rebranded/revoked copy, warns once and
- * returns false so the feature degrades to its non-premium behavior.
- */
-export const premiumEnabled = (logger) => {
-    // Remote revocation wins (its warning was already emitted by refreshRemoteStatus)
-    if (remoteRevoked) {
-        return false;
-    }
-    const report = getIntegrityReport();
-    if (!report.genuine) {
-        warnIfRebranded(logger);
-        return false;
-    }
-    // Genuine but drifted — surface the warnings once, keep features on
-    if (report.warnings.length) {
-        warnIfRebranded(logger);
-    }
-    return true;
-};