dartmind 17.0.0

package/dist/security/PIIPatterns.js

@@ -0,0 +1,217 @@
+/**
+ * FlutterAI V16 - PII Detection Patterns
+ * Issue 1.3: Email, phone, SSN, credit card, IP address patterns
+ *
+ * Separate from secrets - different handling (mask vs block)
+ *
+ * @module security/PIIPatterns
+ * @version 16.0.0
+ */
+// ============================================================================
+// Patterns
+// ============================================================================
+export const PII_PATTERNS = {
+    // Email (RFC 5322 simplified)
+    email: {
+        regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+        type: 'email',
+        confidence: 0.9,
+    },
+    // Phone numbers (US formats)
+    phone_us: {
+        regex: /(?:\+1[-.\s]?)?\(?[2-9]\d{2}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g,
+        type: 'phone',
+        confidence: 0.85,
+    },
+    // Phone numbers (international)
+    phone_intl: {
+        regex: /\+(?:[0-9][-.\s]?){6,14}[0-9]/g,
+        type: 'phone',
+        confidence: 0.8,
+    },
+    // SSN (US Social Security Number)
+    ssn: {
+        regex: /\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/g,
+        type: 'ssn',
+        confidence: 0.85,
+    },
+    // Credit Cards - Visa
+    credit_card_visa: {
+        regex: /\b4[0-9]{12}(?:[0-9]{3})?\b/g,
+        type: 'credit_card',
+        confidence: 0.9,
+    },
+    // Credit Cards - Mastercard
+    credit_card_mc: {
+        regex: /\b5[1-5][0-9]{14}\b/g,
+        type: 'credit_card',
+        confidence: 0.9,
+    },
+    // Credit Cards - Amex
+    credit_card_amex: {
+        regex: /\b3[47][0-9]{13}\b/g,
+        type: 'credit_card',
+        confidence: 0.9,
+    },
+    // Credit Cards - Discover
+    credit_card_discover: {
+        regex: /\b6(?:011|5[0-9]{2})[0-9]{12}\b/g,
+        type: 'credit_card',
+        confidence: 0.9,
+    },
+    // IPv4 Addresses
+    ipv4: {
+        regex: /\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/g,
+        type: 'ip_address',
+        confidence: 0.8,
+    },
+    // IPv6 Addresses (simplified)
+    ipv6: {
+        regex: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
+        type: 'ip_address',
+        confidence: 0.85,
+    },
+};
+// ============================================================================
+// PIIDetector Class
+// ============================================================================
+export class PIIDetector {
+    patterns;
+    tokenCounter = 0;
+    constructor(customPatterns) {
+        this.patterns = new Map(Object.entries({
+            ...PII_PATTERNS,
+            ...customPatterns,
+        }));
+    }
+    /**
+     * Detect all PII in input string
+     */
+    detect(input) {
+        const matches = [];
+        for (const [patternName, { regex, type, confidence }] of this.patterns) {
+            // Reset regex state for global patterns
+            regex.lastIndex = 0;
+            let match;
+            while ((match = regex.exec(input)) !== null) {
+                // Calculate adjusted confidence for credit cards using Luhn
+                let adjustedConfidence = confidence;
+                if (type === 'credit_card' && this.luhnCheck(match[0])) {
+                    adjustedConfidence = Math.min(0.98, confidence + 0.08);
+                }
+                matches.push({
+                    type,
+                    value: match[0],
+                    start: match.index,
+                    end: match.index + match[0].length,
+                    confidence: adjustedConfidence,
+                    patternName,
+                });
+            }
+        }
+        // Sort by position and remove overlaps
+        return this.deduplicateMatches(matches);
+    }
+    /**
+     * Mask PII in input string with tokens
+     */
+    mask(input, tokenPrefix = 'PII') {
+        const matches = this.detect(input);
+        const tokenMap = new Map();
+        if (matches.length === 0) {
+            return { masked: input, tokenMap, matchCount: 0 };
+        }
+        let masked = input;
+        let offset = 0;
+        // Sort by position
+        matches.sort((a, b) => a.start - b.start);
+        for (const match of matches) {
+            const token = `[${tokenPrefix}_${match.type.toUpperCase()}_${this.generateTokenId()}]`;
+            tokenMap.set(token, match.value);
+            const adjustedStart = match.start + offset;
+            const adjustedEnd = match.end + offset;
+            masked = masked.slice(0, adjustedStart) + token + masked.slice(adjustedEnd);
+            offset += token.length - match.value.length;
+        }
+        return { masked, tokenMap, matchCount: matches.length };
+    }
+    /**
+     * Restore original values from masked string
+     */
+    unmask(masked, tokenMap) {
+        let result = masked;
+        for (const [token, original] of tokenMap) {
+            result = result.replace(token, original);
+        }
+        return result;
+    }
+    /**
+     * Get count of PII items by type
+     */
+    countByType(input) {
+        const matches = this.detect(input);
+        const counts = new Map();
+        for (const match of matches) {
+            counts.set(match.type, (counts.get(match.type) || 0) + 1);
+        }
+        return counts;
+    }
+    /**
+     * Luhn algorithm for credit card validation
+     */
+    luhnCheck(num) {
+        const digits = num.replace(/\D/g, '');
+        if (digits.length < 13 || digits.length > 19)
+            return false;
+        let sum = 0;
+        let isEven = false;
+        for (let i = digits.length - 1; i >= 0; i--) {
+            let digit = parseInt(digits[i], 10);
+            if (isEven) {
+                digit *= 2;
+                if (digit > 9)
+                    digit -= 9;
+            }
+            sum += digit;
+            isEven = !isEven;
+        }
+        return sum % 10 === 0;
+    }
+    /**
+     * Remove overlapping matches (prefer higher confidence)
+     */
+    deduplicateMatches(matches) {
+        if (matches.length <= 1)
+            return matches;
+        // Sort by position, then by confidence (descending)
+        matches.sort((a, b) => {
+            if (a.start !== b.start)
+                return a.start - b.start;
+            return b.confidence - a.confidence;
+        });
+        const result = [];
+        let lastEnd = -1;
+        for (const match of matches) {
+            if (match.start >= lastEnd) {
+                result.push(match);
+                lastEnd = match.end;
+            }
+        }
+        return result;
+    }
+    /**
+     * Generate unique token ID
+     */
+    generateTokenId() {
+        this.tokenCounter++;
+        return `${this.tokenCounter.toString(36).padStart(4, '0')}`;
+    }
+    /**
+     * Reset token counter (for testing)
+     */
+    resetTokenCounter() {
+        this.tokenCounter = 0;
+    }
+}
+export default PIIDetector;
+//# sourceMappingURL=PIIPatterns.js.map

package/dist/security/PIIPatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PIIPatterns.js","sourceRoot":"","sources":["../../src/security/PIIPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAyE;IAChG,8BAA8B;IAC9B,KAAK,EAAE;QACL,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,GAAG;KAChB;IAED,6BAA6B;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,0DAA0D;QACjE,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,IAAI;KACjB;IAED,gCAAgC;IAChC,UAAU,EAAE;QACV,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,GAAG;KAChB;IAED,kCAAkC;IAClC,GAAG,EAAE;QACH,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,IAAI;KACjB;IAED,sBAAsB;IACtB,gBAAgB,EAAE;QAChB,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,GAAG;KAChB;IAED,4BAA4B;IAC5B,cAAc,EAAE;QACd,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,GAAG;KAChB;IAED,sBAAsB;IACtB,gBAAgB,EAAE;QAChB,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,GAAG;KAChB;IAED,0BAA0B;IAC1B,oBAAoB,EAAE;QACpB,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,GAAG;KAChB;IAED,iBAAiB;IACjB,IAAI,EAAE;QACJ,KAAK,EAAE,gGAAgG;QACvG,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,GAAG;KAChB;IAED,8BAA8B;IAC9B,IAAI,EAAE;QACJ,KAAK,EAAE,+CAA+C;QACtD,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAEF,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,WAAW;IACd,QAAQ,CAAoE;IAC5E,YAAY,GAAG,CAAC,CAAC;IAEzB,YAAY,cAAqF;QAC/F,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CACrB,MAAM,CAAC,OAAO,CAAC;YACb,GAAG,YAAY;YACf,GAAG,cAAc;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,OAAO,GAAe,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvE,wCAAwC;YACxC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAEpB,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,4DAA4D;gBAC5D,IAAI,kBAAkB,GAAG,UAAU,CAAC;gBACpC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;gBACzD,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBACf,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,UAAU,EAAE,kBAAkB;oBAC9B,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,KAAa,EAAE,WAAW,GAAG,KAAK;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,mBAAmB;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC;YACvF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAEjC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC;YAEvC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAc,EAAE,QAA6B;QAClD,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAE3D,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,CAAC;oBAAE,KAAK,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,GAAG,CAAC,MAAM,CAAC;QACnB,CAAC;QAED,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,OAAmB;QAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QAExC,oDAAoD;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAClD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;QAEjB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;IACxB,CAAC;CACF;AAED,eAAe,WAAW,CAAC"}

package/dist/security/PrivilegedContext.d.ts

@@ -0,0 +1,169 @@
+/**
+ * FlutterAI V16 - PrivilegedContext
+ * Issue 32.3: Injection Shield - Context Minimization
+ *
+ * Privileged LLM architecture: Planner sees symbolic placeholders,
+ * not raw untrusted data. Late-binding at execution time.
+ *
+ * Architecture:
+ * - PLANNER level: Sees {{USER_INPUT_1}}, {{CODE_2}}, etc.
+ * - EXECUTOR level: Sees actual data (late-bound)
+ *
+ * @module security/PrivilegedContext
+ * @version 16.0.0
+ */
+import { EventEmitter } from 'events';
+export type PrivilegeLevel = 'PLANNER' | 'EXECUTOR';
+export type DataType = 'user_input' | 'code' | 'file_content' | 'api_response' | 'secret' | 'config';
+export interface ContextSlot {
+    placeholder: string;
+    dataType: DataType;
+    actualData: string;
+    metadata?: Record<string, unknown>;
+    addedAt: Date;
+    accessCount: number;
+}
+export interface AuditEntry {
+    action: 'slot_added' | 'slot_accessed' | 'context_elevated' | 'context_rendered' | 'context_forked';
+    slotId?: string;
+    level: PrivilegeLevel;
+    timestamp: Date;
+    reason?: string;
+}
+export interface SlotSummary {
+    slotId: string;
+    dataType: DataType;
+    dataHash: string;
+    dataLength: number;
+    accessCount: number;
+}
+export interface PrivilegedContextConfig {
+    /** Maximum number of slots allowed */
+    maxSlots?: number;
+    /** Enable audit logging */
+    enableAudit?: boolean;
+    /** Slot ID prefix */
+    slotPrefix?: string;
+}
+export declare class PrivilegedContext extends EventEmitter {
+    private level;
+    private slots;
+    private auditLog;
+    private slotCounter;
+    private config;
+    constructor(level?: PrivilegeLevel, config?: PrivilegedContextConfig);
+    /**
+     * Add a data slot with symbolic placeholder
+     * Returns the placeholder ID that can be safely shown to PLANNER
+     */
+    addSlot(data: string, dataType: DataType, metadata?: Record<string, unknown>): string;
+    /**
+     * Get slot value - respects privilege level
+     * PLANNER sees placeholder, EXECUTOR sees actual data
+     */
+    getSlot(slotId: string): string | undefined;
+    /**
+     * Check if a slot exists
+     */
+    hasSlot(slotId: string): boolean;
+    /**
+     * Get all slot IDs
+     */
+    getSlotIds(): string[];
+    /**
+     * Render template - PLANNER gets placeholders, EXECUTOR gets data
+     */
+    render(template: string): string;
+    /**
+     * Convert raw input to symbolic representation (for PLANNER)
+     */
+    symbolize(input: string, dataType?: DataType): {
+        symbolic: string;
+        slotId: string;
+    };
+    /**
+     * Symbolize multiple inputs at once
+     */
+    symbolizeAll(inputs: Array<{
+        data: string;
+        type: DataType;
+        metadata?: Record<string, unknown>;
+    }>): Map<string, string>;
+    /**
+     * Elevate context to EXECUTOR level (requires audit reason)
+     */
+    elevate(reason: string): PrivilegedContext;
+    /**
+     * Create child context with same slots but independent audit
+     */
+    fork(level?: PrivilegeLevel): PrivilegedContext;
+    /**
+     * Get slot summary (safe for logging - no actual data)
+     */
+    getSlotSummary(): SlotSummary[];
+    /**
+     * Get audit log
+     */
+    getAuditLog(): AuditEntry[];
+    /**
+     * Get current privilege level
+     */
+    getLevel(): PrivilegeLevel;
+    /**
+     * Check if context has any sensitive slots
+     */
+    hasSensitiveData(): boolean;
+    /**
+     * Get count of slots by type
+     */
+    getSlotCounts(): Map<DataType, number>;
+    /**
+     * Clear all slots (use with caution)
+     */
+    clear(): void;
+    /**
+     * Serialize context for persistence (EXECUTOR data encrypted)
+     */
+    serialize(): string;
+    private audit;
+    private hashData;
+    private escapeRegex;
+}
+export declare class ContextFactory {
+    /**
+     * Create a PLANNER context for LLM reasoning
+     */
+    static forPlanning(config?: PrivilegedContextConfig): PrivilegedContext;
+    /**
+     * Create an EXECUTOR context for code execution
+     */
+    static forExecution(config?: PrivilegedContextConfig): PrivilegedContext;
+    /**
+     * Process user input safely:
+     * 1. Symbolize the input
+     * 2. Return PLANNER-safe context
+     */
+    static processUserInput(input: string, config?: PrivilegedContextConfig): {
+        context: PrivilegedContext;
+        symbolic: string;
+        slotId: string;
+    };
+    /**
+     * Process code safely
+     */
+    static processCode(code: string, config?: PrivilegedContextConfig): {
+        context: PrivilegedContext;
+        symbolic: string;
+        slotId: string;
+    };
+    /**
+     * Process file content safely
+     */
+    static processFileContent(content: string, filePath: string, config?: PrivilegedContextConfig): {
+        context: PrivilegedContext;
+        symbolic: string;
+        slotId: string;
+    };
+}
+export default PrivilegedContext;
+//# sourceMappingURL=PrivilegedContext.d.ts.map

package/dist/security/PrivilegedContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrivilegedContext.d.ts","sourceRoot":"","sources":["../../src/security/PrivilegedContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAMtC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpD,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErG,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,GAAG,eAAe,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qBAAqB;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,qBAAa,iBAAkB,SAAQ,YAAY;IACjD,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,KAAK,GAAE,cAA0B,EAAE,MAAM,GAAE,uBAA4B;IAUnF;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAuBrF;;;OAGG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAe3C;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE;IAItB;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAsBhC;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,QAAuB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAKjG;;OAEG;IACH,YAAY,CACV,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GAClF,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAStB;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAgB1C;;OAEG;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,iBAAiB;IAW/C;;OAEG;IACH,cAAc,IAAI,WAAW,EAAE;IAU/B;;OAEG;IACH,WAAW,IAAI,UAAU,EAAE;IAI3B;;OAEG;IACH,QAAQ,IAAI,cAAc;IAI1B;;OAEG;IACH,gBAAgB,IAAI,OAAO;IAM3B;;OAEG;IACH,aAAa,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IAQtC;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,SAAS,IAAI,MAAM;IAcnB,OAAO,CAAC,KAAK;IAYb,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,WAAW;CAGpB;AAMD,qBAAa,cAAc;IACzB;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB;IAIvE;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB;IAIxE;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG;QACxE,OAAO,EAAE,iBAAiB,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB;IAMD;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG;QAClE,OAAO,EAAE,iBAAiB,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB;IAMD;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG;QAC9F,OAAO,EAAE,iBAAiB,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB;CAKF;AAMD,eAAe,iBAAiB,CAAC"}

package/dist/security/PrivilegedContext.js

@@ -0,0 +1,284 @@
+/**
+ * FlutterAI V16 - PrivilegedContext
+ * Issue 32.3: Injection Shield - Context Minimization
+ *
+ * Privileged LLM architecture: Planner sees symbolic placeholders,
+ * not raw untrusted data. Late-binding at execution time.
+ *
+ * Architecture:
+ * - PLANNER level: Sees {{USER_INPUT_1}}, {{CODE_2}}, etc.
+ * - EXECUTOR level: Sees actual data (late-bound)
+ *
+ * @module security/PrivilegedContext
+ * @version 16.0.0
+ */
+import { createHash } from 'crypto';
+import { EventEmitter } from 'events';
+// ============================================================================
+// PrivilegedContext Class
+// ============================================================================
+export class PrivilegedContext extends EventEmitter {
+    level;
+    slots = new Map();
+    auditLog = [];
+    slotCounter = 0;
+    config;
+    constructor(level = 'PLANNER', config = {}) {
+        super();
+        this.level = level;
+        this.config = {
+            maxSlots: config.maxSlots ?? 100,
+            enableAudit: config.enableAudit ?? true,
+            slotPrefix: config.slotPrefix ?? '',
+        };
+    }
+    /**
+     * Add a data slot with symbolic placeholder
+     * Returns the placeholder ID that can be safely shown to PLANNER
+     */
+    addSlot(data, dataType, metadata) {
+        if (this.slots.size >= this.config.maxSlots) {
+            throw new Error(`Maximum slot limit (${this.config.maxSlots}) reached`);
+        }
+        const prefix = this.config.slotPrefix ? `${this.config.slotPrefix}_` : '';
+        const slotId = `{{${prefix}${dataType.toUpperCase()}_${++this.slotCounter}}}`;
+        this.slots.set(slotId, {
+            placeholder: slotId,
+            dataType,
+            actualData: data,
+            metadata,
+            addedAt: new Date(),
+            accessCount: 0,
+        });
+        this.audit('slot_added', slotId);
+        this.emit('slot:added', { slotId, dataType });
+        return slotId;
+    }
+    /**
+     * Get slot value - respects privilege level
+     * PLANNER sees placeholder, EXECUTOR sees actual data
+     */
+    getSlot(slotId) {
+        const slot = this.slots.get(slotId);
+        if (!slot)
+            return undefined;
+        slot.accessCount++;
+        this.audit('slot_accessed', slotId);
+        // PLANNER only sees placeholder, EXECUTOR sees actual data
+        if (this.level === 'PLANNER') {
+            return slotId; // Return placeholder
+        }
+        else {
+            return slot.actualData; // Return actual data
+        }
+    }
+    /**
+     * Check if a slot exists
+     */
+    hasSlot(slotId) {
+        return this.slots.has(slotId);
+    }
+    /**
+     * Get all slot IDs
+     */
+    getSlotIds() {
+        return Array.from(this.slots.keys());
+    }
+    /**
+     * Render template - PLANNER gets placeholders, EXECUTOR gets data
+     */
+    render(template) {
+        this.audit('context_rendered');
+        if (this.level === 'PLANNER') {
+            // For PLANNER: Replace actual data with placeholders
+            let result = template;
+            for (const [slotId, slot] of this.slots) {
+                // Escape special regex characters in actual data
+                const escaped = this.escapeRegex(slot.actualData);
+                result = result.replace(new RegExp(escaped, 'g'), slotId);
+            }
+            return result;
+        }
+        else {
+            // For EXECUTOR: Replace placeholders with actual data
+            let result = template;
+            for (const [slotId, slot] of this.slots) {
+                result = result.replace(new RegExp(this.escapeRegex(slotId), 'g'), slot.actualData);
+            }
+            return result;
+        }
+    }
+    /**
+     * Convert raw input to symbolic representation (for PLANNER)
+     */
+    symbolize(input, dataType = 'user_input') {
+        const slotId = this.addSlot(input, dataType);
+        return { symbolic: slotId, slotId };
+    }
+    /**
+     * Symbolize multiple inputs at once
+     */
+    symbolizeAll(inputs) {
+        const result = new Map();
+        for (const input of inputs) {
+            const slotId = this.addSlot(input.data, input.type, input.metadata);
+            result.set(input.data, slotId);
+        }
+        return result;
+    }
+    /**
+     * Elevate context to EXECUTOR level (requires audit reason)
+     */
+    elevate(reason) {
+        if (this.level === 'EXECUTOR') {
+            return this; // Already elevated
+        }
+        const elevated = new PrivilegedContext('EXECUTOR', this.config);
+        elevated.slots = new Map(this.slots);
+        elevated.auditLog = [...this.auditLog];
+        elevated.slotCounter = this.slotCounter;
+        elevated.audit('context_elevated', undefined, reason);
+        elevated.emit('context:elevated', { reason });
+        return elevated;
+    }
+    /**
+     * Create child context with same slots but independent audit
+     */
+    fork(level) {
+        const forked = new PrivilegedContext(level ?? this.level, this.config);
+        forked.slots = new Map(this.slots);
+        forked.slotCounter = this.slotCounter;
+        this.audit('context_forked');
+        forked.emit('context:forked', { parentLevel: this.level });
+        return forked;
+    }
+    /**
+     * Get slot summary (safe for logging - no actual data)
+     */
+    getSlotSummary() {
+        return Array.from(this.slots.entries()).map(([slotId, slot]) => ({
+            slotId,
+            dataType: slot.dataType,
+            dataHash: this.hashData(slot.actualData),
+            dataLength: slot.actualData.length,
+            accessCount: slot.accessCount,
+        }));
+    }
+    /**
+     * Get audit log
+     */
+    getAuditLog() {
+        return [...this.auditLog];
+    }
+    /**
+     * Get current privilege level
+     */
+    getLevel() {
+        return this.level;
+    }
+    /**
+     * Check if context has any sensitive slots
+     */
+    hasSensitiveData() {
+        return Array.from(this.slots.values()).some((slot) => slot.dataType === 'secret' || slot.dataType === 'api_response');
+    }
+    /**
+     * Get count of slots by type
+     */
+    getSlotCounts() {
+        const counts = new Map();
+        for (const slot of this.slots.values()) {
+            counts.set(slot.dataType, (counts.get(slot.dataType) || 0) + 1);
+        }
+        return counts;
+    }
+    /**
+     * Clear all slots (use with caution)
+     */
+    clear() {
+        this.slots.clear();
+        this.slotCounter = 0;
+        this.emit('context:cleared');
+    }
+    /**
+     * Serialize context for persistence (EXECUTOR data encrypted)
+     */
+    serialize() {
+        return JSON.stringify({
+            level: this.level,
+            slots: Array.from(this.slots.entries()).map(([id, slot]) => ({
+                id,
+                type: slot.dataType,
+                hash: this.hashData(slot.actualData),
+                length: slot.actualData.length,
+                // Don't serialize actual data for safety
+            })),
+            slotCounter: this.slotCounter,
+        });
+    }
+    audit(action, slotId, reason) {
+        if (!this.config.enableAudit)
+            return;
+        this.auditLog.push({
+            action,
+            slotId,
+            level: this.level,
+            timestamp: new Date(),
+            reason,
+        });
+    }
+    hashData(data) {
+        return createHash('sha256').update(data).digest('hex').substring(0, 16);
+    }
+    escapeRegex(str) {
+        return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+}
+// ============================================================================
+// Context Factory
+// ============================================================================
+export class ContextFactory {
+    /**
+     * Create a PLANNER context for LLM reasoning
+     */
+    static forPlanning(config) {
+        return new PrivilegedContext('PLANNER', config);
+    }
+    /**
+     * Create an EXECUTOR context for code execution
+     */
+    static forExecution(config) {
+        return new PrivilegedContext('EXECUTOR', config);
+    }
+    /**
+     * Process user input safely:
+     * 1. Symbolize the input
+     * 2. Return PLANNER-safe context
+     */
+    static processUserInput(input, config) {
+        const context = new PrivilegedContext('PLANNER', config);
+        const { symbolic, slotId } = context.symbolize(input, 'user_input');
+        return { context, symbolic, slotId };
+    }
+    /**
+     * Process code safely
+     */
+    static processCode(code, config) {
+        const context = new PrivilegedContext('PLANNER', config);
+        const { symbolic, slotId } = context.symbolize(code, 'code');
+        return { context, symbolic, slotId };
+    }
+    /**
+     * Process file content safely
+     */
+    static processFileContent(content, filePath, config) {
+        const context = new PrivilegedContext('PLANNER', config);
+        const slotId = context.addSlot(content, 'file_content', { filePath });
+        return { context, symbolic: slotId, slotId };
+    }
+}
+// ============================================================================
+// Exports
+// ============================================================================
+export default PrivilegedContext;
+//# sourceMappingURL=PrivilegedContext.js.map