dartmind 17.0.0

package/dist/security/GhostProtocol.js

@@ -0,0 +1,881 @@
+/**
+ * FlutterAI Supreme Vision v8.0
+ * Ghost Protocol - Security Pre-Classification Engine
+ *
+ * Advanced security system that:
+ * - Prevents prompt injection attacks
+ * - Classifies code safety levels
+ * - Enforces enterprise compliance
+ * - Monitors for malicious patterns
+ * - Sanitizes user inputs
+ */
+import { EventEmitter } from 'events';
+import * as crypto from 'crypto';
+// =============================================================================
+// TYPES & INTERFACES
+// =============================================================================
+export var ThreatLevel;
+(function (ThreatLevel) {
+    ThreatLevel["SAFE"] = "safe";
+    ThreatLevel["LOW"] = "low";
+    ThreatLevel["MEDIUM"] = "medium";
+    ThreatLevel["HIGH"] = "high";
+    ThreatLevel["CRITICAL"] = "critical";
+})(ThreatLevel || (ThreatLevel = {}));
+export var ThreatCategory;
+(function (ThreatCategory) {
+    ThreatCategory["PROMPT_INJECTION"] = "prompt_injection";
+    ThreatCategory["CODE_INJECTION"] = "code_injection";
+    ThreatCategory["PATH_TRAVERSAL"] = "path_traversal";
+    ThreatCategory["COMMAND_INJECTION"] = "command_injection";
+    ThreatCategory["SQL_INJECTION"] = "sql_injection";
+    ThreatCategory["XSS"] = "xss";
+    ThreatCategory["SENSITIVE_DATA"] = "sensitive_data";
+    ThreatCategory["MALICIOUS_IMPORT"] = "malicious_import";
+    ThreatCategory["UNSAFE_REFLECTION"] = "unsafe_reflection";
+    ThreatCategory["INSECURE_CRYPTO"] = "insecure_crypto";
+    ThreatCategory["HARDCODED_SECRET"] = "hardcoded_secret";
+    ThreatCategory["UNSAFE_HTTP"] = "unsafe_http";
+    ThreatCategory["EVAL_USAGE"] = "eval_usage";
+    ThreatCategory["SHELL_COMMAND"] = "shell_command";
+    ThreatCategory["FILE_SYSTEM_ACCESS"] = "file_system_access";
+    ThreatCategory["NETWORK_ACCESS"] = "network_access";
+    ThreatCategory["COMPLIANCE_VIOLATION"] = "compliance_violation";
+})(ThreatCategory || (ThreatCategory = {}));
+// =============================================================================
+// DEFAULT THREAT PATTERNS
+// =============================================================================
+const PROMPT_INJECTION_PATTERNS = [
+    {
+        id: 'pi-001',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /ignore\s+(all\s+)?previous\s+(instructions?|prompts?|commands?)/i,
+        description: 'Attempt to override system instructions',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Remove instruction override attempts',
+        examples: ['Ignore all previous instructions', 'Ignore previous prompts']
+    },
+    {
+        id: 'pi-002',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /you\s+are\s+now\s+(a\s+)?new\s+(ai|assistant|system)/i,
+        description: 'Attempt to redefine AI identity',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Block identity redefinition attempts'
+    },
+    {
+        id: 'pi-003',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /system\s*:\s*|<\|system\|>|<system>/i,
+        description: 'Fake system message injection',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Remove fake system markers'
+    },
+    {
+        id: 'pi-004',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /\[\s*INST\s*\]|\[\/\s*INST\s*\]/i,
+        description: 'Instruction tag injection (Llama-style)',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Remove instruction tags'
+    },
+    {
+        id: 'pi-005',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /forget\s+(everything|all|what)\s+(you\s+)?(know|learned)/i,
+        description: 'Attempt to reset AI context',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Block context reset attempts'
+    },
+    {
+        id: 'pi-006',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /pretend\s+(you\s+are|to\s+be|you're)\s+(?!a\s+flutter)/i,
+        description: 'Role impersonation attempt',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Block unauthorized role changes'
+    },
+    {
+        id: 'pi-007',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /act\s+as\s+(if\s+)?(you\s+)?(are|were)\s+(a\s+)?(hacker|malicious|evil)/i,
+        description: 'Malicious role-play attempt',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Block malicious role requests'
+    },
+    {
+        id: 'pi-008',
+        category: ThreatCategory.PROMPT_INJECTION,
+        pattern: /reveal\s+(your|the)\s+(system\s+)?(prompt|instructions|rules)/i,
+        description: 'Attempt to extract system prompt',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Block system prompt extraction'
+    }
+];
+const CODE_INJECTION_PATTERNS = [
+    {
+        id: 'ci-001',
+        category: ThreatCategory.CODE_INJECTION,
+        pattern: /Process\.run\s*\(\s*['"`][^'"`]*\$\{/,
+        description: 'Shell injection via string interpolation',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Use parameterized commands'
+    },
+    {
+        id: 'ci-002',
+        category: ThreatCategory.CODE_INJECTION,
+        pattern: /dart:mirrors/,
+        description: 'Reflection usage (can bypass security)',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Avoid dart:mirrors in production'
+    },
+    {
+        id: 'ci-003',
+        category: ThreatCategory.EVAL_USAGE,
+        pattern: /Function\s*\(\s*['"`].*['"`]\s*\)\s*\(\)/,
+        description: 'Dynamic function creation (eval-like)',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Remove dynamic function creation'
+    },
+    {
+        id: 'ci-004',
+        category: ThreatCategory.SHELL_COMMAND,
+        pattern: /Process\.(run|start|runSync)\s*\(\s*['"`](bash|sh|cmd|powershell)/i,
+        description: 'Direct shell execution',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Use safe process APIs'
+    }
+];
+const PATH_TRAVERSAL_PATTERNS = [
+    {
+        id: 'pt-001',
+        category: ThreatCategory.PATH_TRAVERSAL,
+        pattern: /\.\.[\/\\]/,
+        description: 'Path traversal attempt',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Normalize and validate paths'
+    },
+    {
+        id: 'pt-002',
+        category: ThreatCategory.PATH_TRAVERSAL,
+        pattern: /File\s*\(\s*['"`]\s*[\/\\]/,
+        description: 'Absolute path file access',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Use relative paths with sandboxing'
+    }
+];
+const SENSITIVE_DATA_PATTERNS = [
+    {
+        id: 'sd-001',
+        category: ThreatCategory.HARDCODED_SECRET,
+        pattern: /['"`](sk-[a-zA-Z0-9]{32,}|api[_-]?key[_-]?[a-zA-Z0-9]{16,})['"`]/i,
+        description: 'Hardcoded API key detected',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Use environment variables or secure storage'
+    },
+    {
+        id: 'sd-002',
+        category: ThreatCategory.HARDCODED_SECRET,
+        pattern: /['"`](ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})['"`]/,
+        description: 'GitHub token detected',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Remove token and rotate immediately'
+    },
+    {
+        id: 'sd-003',
+        category: ThreatCategory.HARDCODED_SECRET,
+        pattern: /password\s*[=:]\s*['"`][^'"`]{4,}['"`]/i,
+        description: 'Hardcoded password detected',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Use secure credential storage'
+    },
+    {
+        id: 'sd-004',
+        category: ThreatCategory.HARDCODED_SECRET,
+        pattern: /['"`]-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/,
+        description: 'Private key in code',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Store keys in secure key management'
+    },
+    {
+        id: 'sd-005',
+        category: ThreatCategory.SENSITIVE_DATA,
+        pattern: /\b\d{3}[-.\s]?\d{2}[-.\s]?\d{4}\b/,
+        description: 'Potential SSN pattern',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Mask or encrypt sensitive data'
+    },
+    {
+        id: 'sd-006',
+        category: ThreatCategory.SENSITIVE_DATA,
+        pattern: /\b\d{4}[-.\s]?\d{4}[-.\s]?\d{4}[-.\s]?\d{4}\b/,
+        description: 'Credit card number pattern',
+        severity: ThreatLevel.CRITICAL,
+        mitigation: 'Use payment tokenization'
+    }
+];
+const UNSAFE_NETWORK_PATTERNS = [
+    {
+        id: 'un-001',
+        category: ThreatCategory.UNSAFE_HTTP,
+        pattern: /http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/,
+        description: 'Insecure HTTP connection',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Use HTTPS for external connections'
+    },
+    {
+        id: 'un-002',
+        category: ThreatCategory.INSECURE_CRYPTO,
+        pattern: /md5\s*\(|sha1\s*\(/i,
+        description: 'Weak cryptographic hash',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Use SHA-256 or stronger'
+    },
+    {
+        id: 'un-003',
+        category: ThreatCategory.INSECURE_CRYPTO,
+        pattern: /allowInsecure\s*:\s*true|badCertificateCallback/i,
+        description: 'SSL/TLS verification disabled',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Enable certificate validation'
+    }
+];
+const MALICIOUS_IMPORT_PATTERNS = [
+    {
+        id: 'mi-001',
+        category: ThreatCategory.MALICIOUS_IMPORT,
+        pattern: /import\s+['"]package:(flutter_jailbreak|root_checker|frida)/i,
+        description: 'Security bypass package',
+        severity: ThreatLevel.HIGH,
+        mitigation: 'Remove security bypass packages'
+    },
+    {
+        id: 'mi-002',
+        category: ThreatCategory.MALICIOUS_IMPORT,
+        pattern: /import\s+['"]dart:ffi['"];?\s*\/\/\s*(unsafe|dangerous)/i,
+        description: 'Unsafe FFI usage flagged',
+        severity: ThreatLevel.MEDIUM,
+        mitigation: 'Review FFI code for safety'
+    }
+];
+// =============================================================================
+// GHOST PROTOCOL CLASS
+// =============================================================================
+export class GhostProtocol extends EventEmitter {
+    config;
+    patterns;
+    scanHistory;
+    whitelistedHashes;
+    threatLog;
+    constructor(config = {}) {
+        super();
+        this.config = {
+            enabled: true,
+            strictMode: false,
+            autoSanitize: true,
+            logThreats: true,
+            policy: {
+                allowedDomains: [],
+                blockedDomains: [],
+                allowedPackages: [],
+                blockedPackages: [],
+                maxInputLength: 100000,
+                allowUnsafeHttp: false,
+                allowEval: false,
+                allowShellCommands: false,
+                allowFileSystemAccess: true,
+                enforceCompliance: [],
+                customPatterns: []
+            },
+            whitelistedHashes: [],
+            ...config
+        };
+        this.patterns = this.initializePatterns();
+        this.scanHistory = new Map();
+        this.whitelistedHashes = new Set(this.config.whitelistedHashes);
+        this.threatLog = [];
+    }
+    // ===========================================================================
+    // INITIALIZATION
+    // ===========================================================================
+    initializePatterns() {
+        const patterns = [
+            ...PROMPT_INJECTION_PATTERNS,
+            ...CODE_INJECTION_PATTERNS,
+            ...PATH_TRAVERSAL_PATTERNS,
+            ...SENSITIVE_DATA_PATTERNS,
+            ...UNSAFE_NETWORK_PATTERNS,
+            ...MALICIOUS_IMPORT_PATTERNS,
+            ...(this.config.policy?.customPatterns || [])
+        ];
+        // Filter based on policy
+        return patterns.filter(p => {
+            if (this.config.policy?.allowUnsafeHttp && p.category === ThreatCategory.UNSAFE_HTTP) {
+                return false;
+            }
+            if (this.config.policy?.allowEval && p.category === ThreatCategory.EVAL_USAGE) {
+                return false;
+            }
+            if (this.config.policy?.allowShellCommands && p.category === ThreatCategory.SHELL_COMMAND) {
+                return false;
+            }
+            return true;
+        });
+    }
+    // ===========================================================================
+    // MAIN SCANNING METHODS
+    // ===========================================================================
+    /**
+     * Scan a prompt for injection attempts
+     */
+    async scanPrompt(prompt) {
+        return this.scan(prompt, 'prompt');
+    }
+    /**
+     * Scan code for security vulnerabilities
+     */
+    async scanCode(code) {
+        return this.scan(code, 'code');
+    }
+    /**
+     * Scan a configuration file
+     */
+    async scanConfig(config) {
+        return this.scan(config, 'config');
+    }
+    /**
+     * Main scanning engine
+     */
+    async scan(input, inputType) {
+        const startTime = Date.now();
+        const scanId = this.generateScanId();
+        if (!this.config.enabled) {
+            return this.createSafeResult(scanId, input, inputType, startTime);
+        }
+        // Check input length
+        if (input.length > (this.config.policy?.maxInputLength || 100000)) {
+            const threat = this.createOverflowThreat(input);
+            return this.createResult(scanId, input, inputType, [threat], startTime);
+        }
+        // Check whitelist
+        const inputHash = this.hashInput(input);
+        if (this.whitelistedHashes.has(inputHash)) {
+            return this.createSafeResult(scanId, input, inputType, startTime);
+        }
+        // Scan for threats
+        const threats = [];
+        const lines = input.split('\n');
+        for (const pattern of this.patterns) {
+            // Skip patterns not relevant to input type
+            if (inputType === 'prompt' && !this.isPromptPattern(pattern))
+                continue;
+            if (inputType === 'code' && this.isPromptOnlyPattern(pattern))
+                continue;
+            for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+                const line = lines[lineNum];
+                const matches = line.matchAll(new RegExp(pattern.pattern, 'gi'));
+                for (const match of matches) {
+                    threats.push(this.createThreat(pattern, match, lineNum, line));
+                }
+            }
+        }
+        // Run additional checks
+        const additionalThreats = await this.runAdditionalChecks(input, inputType);
+        threats.push(...additionalThreats);
+        // Create result
+        const result = this.createResult(scanId, input, inputType, threats, startTime);
+        // Log if enabled
+        if (this.config.logThreats && threats.length > 0) {
+            this.threatLog.push(...threats);
+            this.emit('threatsDetected', { scanId, threats });
+        }
+        // Cache result
+        this.scanHistory.set(scanId, result);
+        return result;
+    }
+    // ===========================================================================
+    // ADDITIONAL SECURITY CHECKS
+    // ===========================================================================
+    async runAdditionalChecks(input, inputType) {
+        const threats = [];
+        // Check for blocked domains
+        if (this.config.policy?.blockedDomains?.length) {
+            for (const domain of this.config.policy.blockedDomains) {
+                const domainPattern = new RegExp(`https?:\/\/([a-z0-9-]+\.)*${this.escapeRegex(domain)}`, 'gi');
+                if (domainPattern.test(input)) {
+                    threats.push({
+                        id: this.generateThreatId(),
+                        pattern: {
+                            id: 'blocked-domain',
+                            category: ThreatCategory.NETWORK_ACCESS,
+                            pattern: domainPattern,
+                            description: `Blocked domain: ${domain}`,
+                            severity: ThreatLevel.HIGH,
+                            mitigation: 'Remove references to blocked domain'
+                        },
+                        match: domain,
+                        location: { line: 0, column: 0, context: '' },
+                        timestamp: new Date(),
+                        fingerprint: this.hashInput(`blocked-domain:${domain}`)
+                    });
+                }
+            }
+        }
+        // Check for blocked packages
+        if (inputType === 'code' && this.config.policy?.blockedPackages?.length) {
+            for (const pkg of this.config.policy.blockedPackages) {
+                const pkgPattern = new RegExp(`import\\s+['"]package:${this.escapeRegex(pkg)}`, 'gi');
+                if (pkgPattern.test(input)) {
+                    threats.push({
+                        id: this.generateThreatId(),
+                        pattern: {
+                            id: 'blocked-package',
+                            category: ThreatCategory.MALICIOUS_IMPORT,
+                            pattern: pkgPattern,
+                            description: `Blocked package: ${pkg}`,
+                            severity: ThreatLevel.HIGH,
+                            mitigation: 'Remove blocked package import'
+                        },
+                        match: pkg,
+                        location: { line: 0, column: 0, context: '' },
+                        timestamp: new Date(),
+                        fingerprint: this.hashInput(`blocked-package:${pkg}`)
+                    });
+                }
+            }
+        }
+        // Entropy analysis for potential encoded payloads
+        const highEntropySegments = this.findHighEntropySegments(input);
+        for (const segment of highEntropySegments) {
+            threats.push({
+                id: this.generateThreatId(),
+                pattern: {
+                    id: 'high-entropy',
+                    category: ThreatCategory.CODE_INJECTION,
+                    pattern: /.*/,
+                    description: 'High entropy segment (possible obfuscation)',
+                    severity: ThreatLevel.MEDIUM,
+                    mitigation: 'Review high-entropy content for obfuscated code'
+                },
+                match: segment.content.substring(0, 50) + '...',
+                location: { line: segment.line, column: 0, context: segment.content },
+                timestamp: new Date(),
+                fingerprint: this.hashInput(`entropy:${segment.content}`)
+            });
+        }
+        return threats;
+    }
+    // ===========================================================================
+    // SANITIZATION
+    // ===========================================================================
+    /**
+     * Sanitize input by removing detected threats
+     */
+    async sanitize(input, inputType) {
+        if (!this.config.autoSanitize) {
+            return input;
+        }
+        let sanitized = input;
+        for (const pattern of this.patterns) {
+            if (inputType === 'prompt' && !this.isPromptPattern(pattern))
+                continue;
+            if (inputType === 'code' && this.isPromptOnlyPattern(pattern))
+                continue;
+            sanitized = sanitized.replace(new RegExp(pattern.pattern, 'gi'), this.getSanitizationReplacement(pattern));
+        }
+        // Additional sanitization
+        sanitized = this.sanitizeSpecialCharacters(sanitized, inputType);
+        this.emit('sanitized', {
+            original: input,
+            sanitized,
+            inputType
+        });
+        return sanitized;
+    }
+    getSanitizationReplacement(pattern) {
+        switch (pattern.category) {
+            case ThreatCategory.PROMPT_INJECTION:
+                return '[REMOVED]';
+            case ThreatCategory.HARDCODED_SECRET:
+                return '[SECRET_REDACTED]';
+            case ThreatCategory.SENSITIVE_DATA:
+                return '[DATA_REDACTED]';
+            case ThreatCategory.UNSAFE_HTTP:
+                return 'https://[SECURE_URL]';
+            default:
+                return '';
+        }
+    }
+    sanitizeSpecialCharacters(input, inputType) {
+        if (inputType === 'prompt') {
+            // Remove potential control characters
+            return input
+                .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
+                .replace(/\u200B|\u200C|\u200D|\uFEFF/g, ''); // Zero-width characters
+        }
+        return input;
+    }
+    // ===========================================================================
+    // COMPLIANCE CHECKING
+    // ===========================================================================
+    /**
+     * Check code for compliance with standards
+     */
+    checkCompliance(code) {
+        const violations = [];
+        const standards = this.config.policy?.enforceCompliance || [];
+        // GDPR Checks
+        if (standards.includes('gdpr')) {
+            violations.push(...this.checkGDPR(code));
+        }
+        // HIPAA Checks
+        if (standards.includes('hipaa')) {
+            violations.push(...this.checkHIPAA(code));
+        }
+        // PCI DSS Checks
+        if (standards.includes('pci')) {
+            violations.push(...this.checkPCI(code));
+        }
+        // SOC 2 Checks
+        if (standards.includes('soc')) {
+            violations.push(...this.checkSOC(code));
+        }
+        return {
+            gdprCompliant: !violations.some(v => v.standard === 'gdpr'),
+            hipaaCompliant: !violations.some(v => v.standard === 'hipaa'),
+            pciCompliant: !violations.some(v => v.standard === 'pci'),
+            socCompliant: !violations.some(v => v.standard === 'soc'),
+            violations
+        };
+    }
+    checkGDPR(code) {
+        const violations = [];
+        // Check for PII logging
+        if (/print\(.*email|print\(.*password|log\(.*user/i.test(code)) {
+            violations.push({
+                standard: 'gdpr',
+                rule: 'Article 32 - Security of Processing',
+                description: 'PII may be logged without encryption',
+                severity: ThreatLevel.HIGH
+            });
+        }
+        // Check for data retention
+        if (/SharedPreferences.*email|Hive.*personal/i.test(code)) {
+            violations.push({
+                standard: 'gdpr',
+                rule: 'Article 17 - Right to Erasure',
+                description: 'Personal data stored without clear deletion mechanism',
+                severity: ThreatLevel.MEDIUM
+            });
+        }
+        return violations;
+    }
+    checkHIPAA(code) {
+        const violations = [];
+        // Check for PHI in logs
+        if (/print\(.*patient|log\(.*medical|debug\(.*health/i.test(code)) {
+            violations.push({
+                standard: 'hipaa',
+                rule: '164.312(b) - Audit Controls',
+                description: 'PHI may be exposed in application logs',
+                severity: ThreatLevel.CRITICAL
+            });
+        }
+        // Check for unencrypted transmission
+        if (/http:\/\/.*patient|http:\/\/.*medical/i.test(code)) {
+            violations.push({
+                standard: 'hipaa',
+                rule: '164.312(e)(1) - Transmission Security',
+                description: 'PHI transmitted over unencrypted connection',
+                severity: ThreatLevel.CRITICAL
+            });
+        }
+        return violations;
+    }
+    checkPCI(code) {
+        const violations = [];
+        // Check for card data storage
+        if (/SharedPreferences.*card|Hive.*credit|store.*cvv/i.test(code)) {
+            violations.push({
+                standard: 'pci',
+                rule: 'Requirement 3.2 - Protect Stored Cardholder Data',
+                description: 'Card data may be stored insecurely',
+                severity: ThreatLevel.CRITICAL
+            });
+        }
+        // Check for card logging
+        if (/print\(.*card|log\(.*credit|debug\(.*payment/i.test(code)) {
+            violations.push({
+                standard: 'pci',
+                rule: 'Requirement 3.4 - Render PAN Unreadable',
+                description: 'Card data may be logged in plaintext',
+                severity: ThreatLevel.CRITICAL
+            });
+        }
+        return violations;
+    }
+    checkSOC(code) {
+        const violations = [];
+        // Check for access controls
+        if (/admin.*password.*=|hardcoded.*auth/i.test(code)) {
+            violations.push({
+                standard: 'soc',
+                rule: 'CC6.1 - Logical and Physical Access Controls',
+                description: 'Hardcoded credentials detected',
+                severity: ThreatLevel.HIGH
+            });
+        }
+        return violations;
+    }
+    // ===========================================================================
+    // RESULT CREATION HELPERS
+    // ===========================================================================
+    createResult(scanId, input, inputType, threats, startTime) {
+        const threatLevel = this.calculateThreatLevel(threats);
+        const compliance = this.checkCompliance(input);
+        return {
+            id: scanId,
+            input: input.substring(0, 1000) + (input.length > 1000 ? '...' : ''),
+            inputType,
+            threats,
+            threatLevel,
+            safe: threats.length === 0 && threatLevel === ThreatLevel.SAFE,
+            sanitized: this.config.autoSanitize
+                ? undefined // Would be populated separately
+                : undefined,
+            scanDuration: Date.now() - startTime,
+            timestamp: new Date(),
+            compliance
+        };
+    }
+    createSafeResult(scanId, input, inputType, startTime) {
+        return {
+            id: scanId,
+            input: input.substring(0, 1000) + (input.length > 1000 ? '...' : ''),
+            inputType,
+            threats: [],
+            threatLevel: ThreatLevel.SAFE,
+            safe: true,
+            scanDuration: Date.now() - startTime,
+            timestamp: new Date(),
+            compliance: {
+                gdprCompliant: true,
+                hipaaCompliant: true,
+                pciCompliant: true,
+                socCompliant: true,
+                violations: []
+            }
+        };
+    }
+    createThreat(pattern, match, lineNum, lineContent) {
+        return {
+            id: this.generateThreatId(),
+            pattern,
+            match: match[0],
+            location: {
+                line: lineNum + 1,
+                column: match.index || 0,
+                context: lineContent.trim()
+            },
+            timestamp: new Date(),
+            fingerprint: this.hashInput(`${pattern.id}:${match[0]}:${lineNum}`)
+        };
+    }
+    createOverflowThreat(input) {
+        return {
+            id: this.generateThreatId(),
+            pattern: {
+                id: 'overflow-001',
+                category: ThreatCategory.CODE_INJECTION,
+                pattern: /.*/,
+                description: 'Input exceeds maximum allowed length',
+                severity: ThreatLevel.HIGH,
+                mitigation: 'Reduce input size'
+            },
+            match: `Input length: ${input.length}`,
+            location: { line: 0, column: 0, context: '' },
+            timestamp: new Date(),
+            fingerprint: this.hashInput(`overflow:${input.length}`)
+        };
+    }
+    calculateThreatLevel(threats) {
+        if (threats.length === 0)
+            return ThreatLevel.SAFE;
+        const severities = threats.map(t => t.pattern.severity);
+        if (severities.includes(ThreatLevel.CRITICAL))
+            return ThreatLevel.CRITICAL;
+        if (severities.includes(ThreatLevel.HIGH))
+            return ThreatLevel.HIGH;
+        if (severities.includes(ThreatLevel.MEDIUM))
+            return ThreatLevel.MEDIUM;
+        if (severities.includes(ThreatLevel.LOW))
+            return ThreatLevel.LOW;
+        return ThreatLevel.SAFE;
+    }
+    // ===========================================================================
+    // UTILITY METHODS
+    // ===========================================================================
+    generateScanId() {
+        return `scan_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+    }
+    generateThreatId() {
+        return `threat_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+    }
+    hashInput(input) {
+        return crypto.createHash('sha256').update(input).digest('hex');
+    }
+    escapeRegex(str) {
+        return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+    isPromptPattern(pattern) {
+        return pattern.category === ThreatCategory.PROMPT_INJECTION ||
+            pattern.category === ThreatCategory.CODE_INJECTION;
+    }
+    isPromptOnlyPattern(pattern) {
+        return pattern.category === ThreatCategory.PROMPT_INJECTION;
+    }
+    findHighEntropySegments(input) {
+        const segments = [];
+        const lines = input.split('\n');
+        const threshold = 4.5; // Shannon entropy threshold
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (line.length < 20)
+                continue;
+            // Check for base64-like patterns
+            const base64Pattern = /[A-Za-z0-9+/=]{40,}/g;
+            const matches = line.match(base64Pattern);
+            if (matches) {
+                for (const match of matches) {
+                    const entropy = this.calculateEntropy(match);
+                    if (entropy > threshold) {
+                        segments.push({ content: match, line: i + 1, entropy });
+                    }
+                }
+            }
+        }
+        return segments;
+    }
+    calculateEntropy(str) {
+        const freq = {};
+        for (const char of str) {
+            freq[char] = (freq[char] || 0) + 1;
+        }
+        let entropy = 0;
+        const len = str.length;
+        for (const char in freq) {
+            const p = freq[char] / len;
+            entropy -= p * Math.log2(p);
+        }
+        return entropy;
+    }
+    // ===========================================================================
+    // PUBLIC API
+    // ===========================================================================
+    /**
+     * Add a custom threat pattern
+     */
+    addPattern(pattern) {
+        this.patterns.push(pattern);
+        this.emit('patternAdded', pattern);
+    }
+    /**
+     * Remove a threat pattern by ID
+     */
+    removePattern(patternId) {
+        const index = this.patterns.findIndex(p => p.id === patternId);
+        if (index >= 0) {
+            const removed = this.patterns.splice(index, 1);
+            this.emit('patternRemoved', removed[0]);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Whitelist a specific input hash
+     */
+    whitelist(input) {
+        const hash = this.hashInput(input);
+        this.whitelistedHashes.add(hash);
+        this.emit('whitelisted', { hash });
+    }
+    /**
+     * Check if an input is whitelisted
+     */
+    isWhitelisted(input) {
+        return this.whitelistedHashes.has(this.hashInput(input));
+    }
+    /**
+     * Get scan history
+     */
+    getHistory() {
+        return Array.from(this.scanHistory.values());
+    }
+    /**
+     * Get threat log
+     */
+    getThreatLog() {
+        return [...this.threatLog];
+    }
+    /**
+     * Clear threat log
+     */
+    clearThreatLog() {
+        this.threatLog = [];
+        this.emit('threatLogCleared');
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Update configuration
+     */
+    updateConfig(config) {
+        this.config = { ...this.config, ...config };
+        if (config.policy) {
+            this.config.policy = { ...this.config.policy, ...config.policy };
+        }
+        this.patterns = this.initializePatterns();
+        this.emit('configUpdated', this.config);
+    }
+    /**
+     * Enable Ghost Protocol
+     */
+    enable() {
+        this.config.enabled = true;
+        this.emit('enabled');
+    }
+    /**
+     * Disable Ghost Protocol
+     */
+    disable() {
+        this.config.enabled = false;
+        this.emit('disabled');
+    }
+    /**
+     * Get statistics
+     */
+    getStats() {
+        const stats = {
+            totalScans: this.scanHistory.size,
+            threatsDetected: this.threatLog.length,
+            threatsByCategory: {},
+            threatsBySeverity: {}
+        };
+        for (const threat of this.threatLog) {
+            stats.threatsByCategory[threat.pattern.category] =
+                (stats.threatsByCategory[threat.pattern.category] || 0) + 1;
+            stats.threatsBySeverity[threat.pattern.severity] =
+                (stats.threatsBySeverity[threat.pattern.severity] || 0) + 1;
+        }
+        return stats;
+    }
+}
+// =============================================================================
+// EXPORTS
+// =============================================================================
+export default GhostProtocol;
+//# sourceMappingURL=GhostProtocol.js.map