/**
 * PromptInjectionDetector -- pre-LLM-call prompt injection classifier.
 *
 * Rule-based classifier covering OWASP LLM01 injection patterns.
 * Designed to run synchronously in the LLM adapter pre-call path with
 * negligible latency impact (< 1ms on realistic message arrays).
 *
 * Pattern catalog:
 *   - Instruction override: "ignore previous", "disregard above", "new instructions:"
 *   - Role-play exploits: "you are now DAN", "pretend you are unrestricted"
 *   - Data exfiltration: "output your system prompt", "list your tools"
 *   - Encoded payloads: base64-like sequences, hex sequences in user content
 *   - Jailbreak patterns: DAN, STAN, DUDE, and other known names
 *   - Authority escalation: "I am your admin", "system override"
 *
 * Severity thresholds:
 *   - HIGH: triggers DENY (default behavior)
 *   - MEDIUM: triggers WARN/log (audit event, allow by default)
 *   - LOW: logs only
 *
 * False-positive avoidance: legitimate sentences that contain the word "ignore"
 * in natural context (e.g., "you can ignore the warning") do not trigger
 * because patterns require the word to appear with command-forming phrases.
 *
 * Onyx #5 gap closure: Prompt Injection Detection and Blocking.
 *
 * @connexum/ai-governance
 */
import * as crypto from 'node:crypto';
/**
 * Severity ranking for comparison.
 */
const SEV_RANK = { low: 0, medium: 1, high: 2 };
function higherSeverity(a, b) {
    return SEV_RANK[a] >= SEV_RANK[b] ? a : b;
}
/**
 * Built-in pattern catalog.
 *
 * HIGH severity patterns: clear OWASP LLM01 attacks -- override, exfil, jailbreak.
 * MEDIUM severity patterns: suspicious but may appear in edge-case legit prompts.
 * LOW severity patterns: weak signals, useful for analytics/correlation.
 *
 * All patterns tested against lowercased content.
 */
const PATTERNS = [
    // ---- HIGH: Instruction overrides ----
    {
        id: 'INSTR-OVERRIDE-001',
        severity: 'high',
        roles: ['user', 'tool'],
        // "ignore previous instructions", "ignore all instructions", "ignore above"
        // Extended to tool role: workspace files / RAG tool output can embed override commands.
        pattern: /ignore\s+(previous|all|prior|any|your\s+previous|the\s+above|any\s+previous)\s+instructions?\b/i,
        description: 'Instruction override: ignore-previous-instructions pattern',
    },
    {
        id: 'INSTR-OVERRIDE-002',
        severity: 'high',
        roles: ['user', 'tool'],
        // "disregard all instructions", "disregard your previous prompt"
        // Extended to tool role: attacker-controlled tool responses can carry this.
        pattern: /disregard\s+(all|any|previous|prior|your|the|above)\s+(instructions?|prompt|rules?|guidelines?|directives?)\b/i,
        description: 'Instruction override: disregard-instructions pattern',
    },
    {
        id: 'INSTR-OVERRIDE-003',
        severity: 'high',
        roles: ['user', 'tool'],
        // "forget all previous instructions", "forget your system prompt", "forget everything above"
        // Extended to tool role: false-instruction substitution via file read or RAG.
        pattern: /forget\s+(?:all\s+)?(?:previous\s+|prior\s+|your\s+|the\s+|any\s+)?(instructions?|prompt|rules?|context|everything)\b/i,
        description: 'Instruction override: forget-instructions pattern',
    },
    {
        id: 'INSTR-OVERRIDE-004',
        severity: 'high',
        roles: ['user', 'tool'],
        // "new instructions:", "new system prompt:", "updated instructions:"
        // Extended to tool role: jailbreak framing embedded in workspace content or config files.
        pattern: /(?:new|updated|override|replacement)\s+(?:instructions?|system\s+prompt|rules?|directives?)\s*:/i,
        description: 'Instruction override: replacement-instructions pattern',
    },
    {
        id: 'INSTR-OVERRIDE-005',
        severity: 'high',
        roles: ['user', 'tool'],
        // "do not follow your instructions", "stop following your guidelines"
        // Extended to tool role: "act as [unrestricted model]" class embedded in tool-read content.
        pattern: /(?:do\s+not|don['']t|stop)\s+(?:follow|obey|adhere\s+to)\s+(?:your|the|any|previous)\s+(?:instructions?|guidelines?|rules?|prompt)/i,
        description: 'Instruction override: stop-following-instructions pattern',
    },
    // ---- HIGH: Role-play exploits (jailbreak personas) ----
    {
        id: 'ROLEPLAY-001',
        severity: 'high',
        roles: ['user'],
        // DAN, STAN, DUDE, KEVIN, AIM, JAILBREAK -- known persona names
        pattern: /\b(?:you\s+are\s+now\s+in\s+)?(?:DAN|STAN|DUDE|KEVIN|AIM|JAILBREAK|BFDI|UCAR|AntiGPT|FreeGPT|Dev(?:Mode)?)\s*(?:mode|enabled|activated|prompt|personality)?\b/i,
        description: 'Jailbreak persona: known jailbreak identifier',
    },
    {
        id: 'ROLEPLAY-002',
        severity: 'high',
        roles: ['user'],
        // "pretend you are an unrestricted AI", "act as an unrestricted model"
        pattern: /(?:pretend|act|behave|imagine)\s+(?:you\s+are|as\s+if\s+you\s+are|that\s+you\s+are)\s+(?:an?\s+)?(?:unrestricted|uncensored|unfiltered|jailbroken|freed|unshackled)\s+(?:ai|model|assistant|chatbot|llm)/i,
        description: 'Role-play exploit: unrestricted-AI persona',
    },
    {
        id: 'ROLEPLAY-003',
        severity: 'high',
        roles: ['user'],
        // "you have no restrictions", "you have no limitations", "you are free from restrictions"
        pattern: /you\s+(?:have\s+no|are\s+free\s+from|have\s+been\s+freed\s+from)\s+(?:restrictions?|limitations?|guidelines?|rules?|filters?|safety)\b/i,
        description: 'Role-play exploit: no-restrictions persona',
    },
    {
        id: 'ROLEPLAY-004',
        severity: 'high',
        roles: ['user'],
        // "developer mode enabled", "developer mode on", "[developer mode]"
        pattern: /\[?developer\s+mode\s*(?:enabled|on|activated|unlocked)?\]?/i,
        description: 'Jailbreak: developer mode activation attempt',
    },
    // ---- HIGH: Data exfiltration ----
    {
        id: 'EXFIL-001',
        severity: 'high',
        roles: ['user', 'tool'],
        // "output your system prompt", "print your system prompt", "show me your system prompt"
        // Extended to tool role: if embedded in a tool output, the agent may execute the exfiltration.
        pattern: /(?:output|print|show|display|reveal|tell\s+me|share|dump)\s+(?:me\s+)?(?:your|the)\s+(?:system\s+prompt|initial\s+instructions?|base\s+prompt|hidden\s+prompt|original\s+prompt)/i,
        description: 'Data exfiltration: system-prompt extraction attempt',
    },
    {
        id: 'EXFIL-002',
        severity: 'high',
        roles: ['user', 'tool'],
        // "list your tools", "list all your capabilities", "what tools do you have"
        // Extended to tool role: tool-embedded instruction to leak capability list.
        // Narrow pattern to avoid false-positives on innocent questions.
        pattern: /(?:list\s+(?:all\s+)?(?:your|the)|enumerate\s+(?:your|all))\s+(?:tools?|capabilities|functions?|available\s+functions?|api\s+(?:calls?|endpoints?))\b/i,
        description: 'Data exfiltration: tool/capability enumeration',
    },
    {
        id: 'EXFIL-003',
        severity: 'high',
        roles: ['user', 'tool'],
        // "repeat everything above", "repeat all text above this line"
        // Extended to tool role: append-[secret]-to-reply class embedded in tool content.
        pattern: /repeat\s+(?:everything|all\s+(?:the\s+)?text?|the\s+(?:content|instructions?|prompt))\s+(?:above|before|prior)/i,
        description: 'Data exfiltration: repeat-above-context pattern',
    },
    // ---- HIGH: Authority escalation ----
    {
        id: 'AUTH-ESC-001',
        severity: 'high',
        roles: ['user', 'tool'],
        // "I am your administrator", "I am your developer", "I am an Anthropic employee"
        // Extended to tool role: embedded in a tool-read file, this fakes elevated authority.
        pattern: /i\s+am\s+(?:your\s+)?(?:administrator|admin|developer|creator|owner|supervisor|controller|anthropic|openai)/i,
        description: 'Authority escalation: false admin identity claim',
    },
    {
        id: 'AUTH-ESC-002',
        severity: 'high',
        roles: ['user', 'tool'],
        // "system override", "security override", "admin override"
        // Extended to tool role: attackers embed in config files read by the agent.
        pattern: /(?:system|security|admin(?:istrator)?|emergency)\s+override\b/i,
        description: 'Authority escalation: override command pattern',
    },
    {
        id: 'AUTH-ESC-003',
        severity: 'high',
        roles: ['user', 'tool'],
        // "you must comply", "you are required to", "comply immediately"
        // Extended to tool role: false update framing ("your new instructions are...") via tool content.
        pattern: /(?:you\s+must\s+comply|you\s+are\s+required\s+to\s+(?:ignore|bypass|override)|comply\s+immediately)\b/i,
        description: 'Authority escalation: forced-compliance pattern',
    },
    // ---- MEDIUM: Encoded payload detection ----
    {
        id: 'ENCODED-001',
        severity: 'medium',
        roles: ['user'],
        // Base64-like sequences > 30 chars in user content (common exfil/injection vector)
        // Matches a continuous run of base64 alphabet chars with possible = padding
        pattern: /[A-Za-z0-9+/]{30,}={0,2}(?:\s|$)/,
        description: 'Encoded payload: base64-like sequence in user message',
    },
    {
        id: 'ENCODED-002',
        severity: 'medium',
        roles: ['user'],
        // Hex sequences > 20 chars in user content (0x prefix or raw hex run)
        pattern: /(?:0x)?[0-9a-f]{20,}\b/i,
        description: 'Encoded payload: long hex sequence in user message',
    },
    // ---- MEDIUM: Prompt leakage / indirect injection signals ----
    {
        id: 'INDIRECT-001',
        severity: 'medium',
        roles: ['user'],
        // "according to your training", "your training data says" -- indirect manipulation
        pattern: /(?:according\s+to|based\s+on)\s+your\s+(?:training|training\s+data|programming)\b/i,
        description: 'Indirect injection: training-data reference manipulation',
    },
    {
        id: 'INDIRECT-002',
        severity: 'medium',
        roles: ['user'],
        // "translate the above to English and execute it"
        pattern: /translate\s+(?:the\s+above|this|the\s+following)\s+(?:to\s+\w+\s+)?and\s+(?:execute|run|apply|follow|implement)\b/i,
        description: 'Indirect injection: translate-and-execute pattern',
    },
    {
        id: 'INDIRECT-003',
        severity: 'medium',
        roles: ['user'],
        // "your true instructions are:", "your real purpose is:"
        pattern: /your\s+(?:true|real|actual|hidden|secret)\s+(?:instructions?|purpose|goal|objective|directive)\s+(?:is|are)\s*:/i,
        description: 'Indirect injection: hidden-purpose revelation pattern',
    },
    {
        id: 'INDIRECT-004',
        severity: 'medium',
        roles: ['user'],
        // "from now on you will" -- prompt hijacking framing
        pattern: /from\s+now\s+on\s+(?:you\s+will|you\s+must|you\s+shall)\b/i,
        description: 'Indirect injection: behavioral-reprogramming framing',
    },
    // ---- Agent-trap patterns (Google DeepMind AI Agent Traps research) ----
    // Reference: web-interaction-security.md Rule 4
    // Each pattern corresponds to a documented trap category observed in adversarial pages
    // specifically constructed to manipulate AI agents.
    {
        id: 'AGENT-TRAP-001',
        severity: 'high',
        roles: ['user', 'tool'],
        // Matches salutations or direct address to an AI entity: "Dear AI agent,",
        // "Hello assistant:", "Attention LLM", "@AI", "Hey bot,"
        // Case-insensitive. Three clauses:
        //   1. Word-boundary salutation + AI noun: \b(?:dear|hello|...) \s+ <noun>
        //   2. @-mention: @\s*(?:ai|assistant|agent|bot|...) -- no \b needed, @ is not a word char
        //   3. AI noun used as addressee with colon: "AI:", "assistant:", "agent:"
        //
        // Extended to tool role (BUNDLE-B1): the LinkedIn workspace-file attack class
        // specifically uses this salutation embedded in a workspace file read via ReadFile.
        // AGENT-TRAP-001 is the PRIMARY GAP — this is the exact pattern described in the
        // Google DeepMind AI Agent Traps research for the LinkedIn attack vector.
        // AGENT-TRAP-006 (ALL-CAPS) remains user-only due to false-positive risk with
        // tool outputs containing JSON keys, log labels, and code constants.
        pattern: /\b(?:dear|hello|attention|hey|hi)\s+(?:ai|artificial\s+intelligence|llm|language\s+model|assistant|agent|bot|chatbot)\b|@\s*(?:ai|artificial\s+intelligence|llm|language\s+model|assistant|agent|bot|chatbot)\b|(?:^|\b)(?:ai|artificial\s+intelligence|llm|assistant|agent|bot)\s*[:,]/i,
        description: 'Agent trap: direct address to AI/agent/assistant/bot/LLM (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-002',
        severity: 'high',
        roles: ['user', 'tool'],
        // Complements AUTH-ESC-001 (which covers "I am your admin/developer/owner/supervisor").
        // This pattern catches the alternative framing "this is your administrator" or
        // "as your supervisor" which AUTH-ESC-001 does not cover.
        pattern: /(?:this\s+is)\s+your\s+(?:administrator|admin|owner|supervisor|operator|developer|creator|principal)\b|as\s+your\s+(?:administrator|admin|owner|supervisor|operator|developer|creator|principal)\b/i,
        description: 'Agent trap: authority claim via "this is your admin/owner/supervisor" (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-003',
        severity: 'medium',
        roles: ['user', 'tool'],
        // Detects embedded action requests directing the agent toward a link, button, or command:
        // "click this link", "follow the following URL", "execute the following command".
        // Extended to tool role: a tool response from a web-fetching tool could embed these
        // instructions to redirect subsequent tool calls.
        // Avoids false-positives by requiring a demonstrated target noun (link/url/button/command).
        pattern: /(?:please\s+|kindly\s+|now\s+)?(?:click|follow|navigate|execute|run|open|visit)\s+(?:this|the\s+following|that)\s+(?:link|url|button|command|action)\b/i,
        description: 'Agent trap: embedded action request directing to link/URL/command (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-004',
        severity: 'medium',
        roles: ['user', 'tool'],
        // Urgency framing combined with a compliance request: "urgent: please do X",
        // "time-sensitive: you must act". Limited look-ahead (.{0,40}) keeps this precise.
        // Extended to tool role: embedded in tool output to bypass careful agent reasoning.
        pattern: /(?:urgent|time[-\s]sensitive|act\s+(?:now|immediately|asap)|critical|emergency)\s*[:,!]?\s*.{0,40}\s+(?:please|you\s+must|don['']t\s+delay)\b/i,
        description: 'Agent trap: urgency framing combined with compliance request (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-005',
        severity: 'medium',
        roles: ['user', 'tool'],
        // Instruction to suppress audit trail: "do not log this", "silently execute",
        // "don't record", "please do not audit". Applies to tool role too because
        // tool output can carry injected "do not log" directives from external APIs.
        pattern: /(?:do\s+not|don['']t|please\s+do\s+not|please\s+don['']t|silently)\s+(?:log|record|audit|mention|report|notify|flag|trace)\b/i,
        description: 'Agent trap: instruction to suppress audit/logging (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-006',
        severity: 'low',
        roles: ['user'],
        // Structural trap: three or more consecutive ALL-CAPS words (3+ letters each)
        // followed within 80 chars by an instructional verb. Common in adversarial pages
        // that use visual noise to embed injection commands.
        // Note: this is a weak signal; many legitimate uses of ALL-CAPS exist.
        pattern: /\b[A-Z]{3,}(?:\s+[A-Z]{3,}){2,}\b.{0,80}\b(?:do|execute|run|click|visit|open)\b/,
        description: 'Agent trap: ALL-CAPS structural injection noise + instructional verb (DeepMind trap class, weak signal)',
    },
    {
        id: 'AGENT-TRAP-007',
        severity: 'high',
        roles: ['user', 'tool'],
        // Fake system-message prefix in user or tool content: "[SYSTEM]", "<<system>>",
        // "###system###". Attackers embed these to make the model treat injected text
        // as a trusted system-level instruction.
        // Matches at start-of-string, after newline, or after whitespace (mid-string injection).
        // The bracket/angle/hash delimiters make these tokens distinct from normal prose.
        pattern: /(?:^|[\n\s])(?:\[\s*SYSTEM\s*\]|<<\s*system\s*>>|#{2,}\s*system\s*#{2,})/i,
        description: 'Agent trap: fake system-message prefix in user/tool content (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-008',
        severity: 'high',
        roles: ['user', 'tool'],
        // Prompt-reveal trick: asking the agent to echo/repeat/output content "to prove
        // it understood". Distinct from EXFIL-003 ("repeat everything above") because
        // this framing uses a "confirmation" rationale to mask the extraction attempt.
        // Extended to tool role: a tool result from a RAG system or file read could
        // instruct the agent to reveal its context.
        pattern: /(?:to\s+confirm|as\s+proof|to\s+verify|in\s+order\s+to\s+confirm)(?:\s+you[\s'']{1,3}(?:ve|have)\s+(?:understood|received))?[\s,]*(?:repeat|output|send|provide|share|echo)\b/i,
        description: 'Agent trap: prompt-reveal via "to confirm you understood, repeat/output" (DeepMind trap class)',
    },
    {
        id: 'AGENT-TRAP-009',
        severity: 'low',
        roles: ['user', 'tool'],
        // Directs the agent to obey instructions embedded in external or current content:
        // "follow the instructions on this page", "do what this article says".
        // Extended to tool role: canonical embedded-instruction vector when a tool reads
        // attacker-controlled content ("follow the instructions in this document").
        // Weak signal because legitimate sentences can use similar phrasing; kept LOW
        // and separated from INSTR-OVERRIDE-005 which covers direct "stop following your rules".
        pattern: /(?:follow|obey|do\s+what)\s+(?:the\s+)?(?:instructions?|directives?|requests?)\s+(?:on|from|in)\s+(?:this|the)\s+(?:page|article|content|message|email|document)\b/i,
        description: 'Agent trap: directive to follow instructions embedded in external content (DeepMind trap class, weak signal)',
    },
    // AGENT-TRAP-010 (translate-and-execute, multi-language) is NOT added:
    // INDIRECT-002 already covers: /translate\s+(?:the\s+above|this|the\s+following)\s+(?:to\s+\w+\s+)?and\s+(?:execute|run|apply|follow|implement)/i
    // Adding a duplicate would create redundant noise without new coverage.
    // ---- LOW: Weak signals (useful for risk scoring) ----
    {
        id: 'WEAK-001',
        severity: 'low',
        roles: ['user'],
        // Excessive urgency language in user messages
        pattern: /(?:immediately|urgent(?:ly)?|right\s+now)\s+(?:ignore|bypass|override|forget|disregard)/i,
        description: 'Weak signal: urgency + override language combination',
    },
    {
        id: 'WEAK-002',
        severity: 'low',
        roles: ['user'],
        // "hidden text follows", "the following text is hidden" -- CSS injection signal
        pattern: /(?:hidden|invisible|white\s+text|display\s*:\s*none|font-size\s*:\s*0)\b/i,
        description: 'Weak signal: CSS hidden-text injection indicator',
    },
    {
        id: 'WEAK-003',
        severity: 'low',
        roles: ['user', 'assistant'],
        // URL in a context that looks like "visit this URL and follow instructions"
        pattern: /(?:visit|go\s+to|navigate\s+to|fetch|open)\s+(?:https?:\/\/\S+)\s+and\s+(?:follow|execute|run|implement)\b/i,
        description: 'Weak signal: visit-URL-and-execute pattern',
    },
];
// ---------------------------------------------------------------------------
// PromptInjectionDetector
// ---------------------------------------------------------------------------
export class PromptInjectionDetector {
    config;
    constructor(config) {
        this.config = {
            detectionThreshold: config?.detectionThreshold ?? 'low',
        };
    }
    /**
     * Analyse an array of LLM messages for injection patterns.
     *
     * Returns a detection result. When `detected=true` and severity is HIGH,
     * callers should return a synthetic DENY and emit an audit event.
     *
     * Designed for the pre-call path: synchronous, no I/O, < 1ms on typical inputs.
     */
    detectInjection(messages) {
        const matchedPatternIds = [];
        let highestSeverity = 'low';
        let anyMatch = false;
        const thresholdRank = SEV_RANK[this.config.detectionThreshold];
        for (const message of messages) {
            const roleLower = (message.role ?? '').toLowerCase();
            const content = message.content ?? '';
            for (const pat of PATTERNS) {
                // Role filter: if the pattern restricts roles, skip non-matching roles
                if (pat.roles.length > 0 && !pat.roles.includes(roleLower)) {
                    continue;
                }
                // Test pattern
                if (pat.pattern.test(content)) {
                    if (SEV_RANK[pat.severity] >= thresholdRank) {
                        anyMatch = true;
                        if (!matchedPatternIds.includes(pat.id)) {
                            matchedPatternIds.push(pat.id);
                        }
                        highestSeverity = higherSeverity(highestSeverity, pat.severity);
                    }
                }
            }
        }
        const confidence = matchedPatternIds.length > 0
            ? Math.min(1, matchedPatternIds.length / 3) // 3+ patterns = full confidence
            : 0;
        return {
            detected: anyMatch,
            patterns: matchedPatternIds,
            severity: anyMatch ? highestSeverity : 'low',
            confidence,
        };
    }
    /**
     * Produce a privacy-respecting redacted snippet of the offending content.
     * Never logs the full content to prevent exfil of sensitive system prompts.
     *
     * Returns up to 120 characters with the matching segment highlighted and
     * the rest masked with asterisks.
     */
    redactedSnippet(content, patternId) {
        const pat = PATTERNS.find(p => p.id === patternId);
        if (!pat)
            return '[redacted]';
        const match = pat.pattern.exec(content);
        if (!match)
            return '[redacted]';
        const start = Math.max(0, match.index - 20);
        const end = Math.min(content.length, match.index + match[0].length + 20);
        const snippet = content.slice(start, end);
        // Mask everything outside the matched segment within the snippet
        const prefix = start > 0 ? '...' : '';
        const suffix = end < content.length ? '...' : '';
        return `${prefix}${snippet}${suffix}`.slice(0, 120);
    }
}
// ---------------------------------------------------------------------------
// Singleton for adapter hot-path use
// ---------------------------------------------------------------------------
let _defaultDetector = null;
/** Return (or create) the process-scoped default detector instance. */
export function getDefaultDetector(config) {
    if (!_defaultDetector) {
        _defaultDetector = new PromptInjectionDetector(config);
    }
    return _defaultDetector;
}
// ---------------------------------------------------------------------------
// Audit event builder
// ---------------------------------------------------------------------------
/**
 * Build a signed audit event payload for a detected injection.
 * Includes a redacted snippet and a hash of the raw content for integrity.
 * Never includes the full message content.
 */
export function buildInjectionAuditEvent(messages, result, agentId, tenantId) {
    // Hash the raw content for integrity (without logging it)
    const contentForHash = messages.map(m => `${m.role}:${m.content}`).join('\n');
    const contentHash = crypto.createHash('sha256').update(contentForHash, 'utf-8').digest('hex');
    return {
        eventType: 'prompt-injection:detected',
        agentId,
        tenantId,
        severity: result.severity,
        matchedPatterns: result.patterns,
        confidence: result.confidence,
        contentHash,
        // Redacted snippet from the first message whose content actually matches
        // the triggered pattern. BUNDLE-B1 (2026-05-26) extended detection to
        // `tool` role messages; previously this scanned only the `user` role
        // which produced hollow `[no match]` snippets for tool-injection events.
        redactedSnippet: result.patterns.length > 0
            ? new PromptInjectionDetector().redactedSnippet(messages.find(m => (m.role === 'user' || m.role === 'tool') && m.content)?.content ?? '', result.patterns[0])
            : '[no match]',
        detectedAt: new Date().toISOString(),
    };
}
//# sourceMappingURL=prompt-injection-detector.js.map