"use strict";
/**
 * Prompt Module System
 *
 * Provides category-aware prompt assembly for AI validation.
 * Only includes relevant prompt sections based on the categories in each batch,
 * reducing token usage by ~40-60% while maintaining identical behavior.
 *
 * Modules are assembled in fixed order to maximize Anthropic prefix cache hits.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.OWASP_CLASSIC_MODULE = exports.AI_PATTERNS_MODULE = exports.SECRETS_CRYPTO_MODULE = exports.XSS_PROMPT_MODULE = exports.AUTH_ACCESS_MODULE = exports.COMMON_PROMPT = exports.INTENTIONALLY_UNMAPPED = exports.CATEGORY_TO_MODULE = void 0;
exports.assembleValidationPrompt = assembleValidationPrompt;
exports.getFullValidationPrompt = getFullValidationPrompt;
const common_1 = require("./common");
const auth_access_1 = require("./auth-access");
const xss_prompt_1 = require("./xss-prompt");
const secrets_crypto_1 = require("./secrets-crypto");
const ai_patterns_1 = require("./ai-patterns");
const owasp_classic_1 = require("./owasp-classic");
// ============================================================================
// Module Definitions (fixed order for prefix cache hits)
// ============================================================================
const MODULES = [
    {
        name: 'auth_access',
        content: auth_access_1.AUTH_ACCESS_MODULE,
        categories: new Set(['missing_auth', 'security_bypass']),
    },
    {
        name: 'xss_prompt',
        content: xss_prompt_1.XSS_PROMPT_MODULE,
        categories: new Set(['xss', 'ai_prompt_injection']),
    },
    {
        name: 'secrets_crypto',
        content: secrets_crypto_1.SECRETS_CRYPTO_MODULE,
        categories: new Set([
            'hardcoded_secret',
            'high_entropy_string',
            'sensitive_variable',
            'weak_crypto',
        ]),
    },
    {
        name: 'ai_patterns',
        content: ai_patterns_1.AI_PATTERNS_MODULE,
        categories: new Set([
            'ai_pattern',
            'ai_prompt_injection',
            'ai_unsafe_execution',
            'ai_overpermissive_tool',
            'suspicious_package',
            'ai_rag_exfiltration',
            'ai_endpoint_unprotected',
            'ai_schema_mismatch',
            'ai_package_hallucination',
            'ai_rag_corpus_poisoning',
            'ai_rag_pii_leakage',
            'ai_mcp_tool_poisoning',
            'ai_mcp_credential_issue',
            'ai_mcp_confused_deputy',
            'ai_mcp_description_injection',
            'ai_mcp_server_shadowing',
            'ai_mcp_config_secrets',
            'ai_mcp_config_permissions',
            'ai_rag_query_injection',
            'ai_rag_embedding_poisoning',
            'ai_rag_chunk_injection',
            'ai_package_typosquat',
            'ai_package_malicious',
            'ai_unsafe_model_load',
            'ai_unverified_model',
            'ai_unsafe_finetuning',
            'ai_excessive_agency',
        ]),
    },
    {
        name: 'owasp_classic',
        content: owasp_classic_1.OWASP_CLASSIC_MODULE,
        categories: new Set([
            'missing_security_headers',
            'ssrf',
            'log_injection',
            'xxe',
        ]),
    },
];
// ============================================================================
// Category-to-Module Mapping
// ============================================================================
/**
 * Maps each VulnerabilityCategory to the module(s) it requires.
 * Categories not in this map get COMMON only (intentionally unmapped).
 */
exports.CATEGORY_TO_MODULE = (() => {
    const map = new Map();
    for (const mod of MODULES) {
        for (const cat of mod.categories) {
            const existing = map.get(cat) || [];
            existing.push(mod.name);
            map.set(cat, existing);
        }
    }
    return map;
})();
/**
 * Categories that are intentionally unmapped to any specific module.
 * They get the COMMON prompt only (which includes condensed heuristic reminders).
 * If a new category is added to VulnerabilityCategory but not here or in CATEGORY_TO_MODULE,
 * the category completeness test will fail.
 */
exports.INTENTIONALLY_UNMAPPED = new Set([
    'dangerous_function',
    'sql_injection',
    'command_injection',
    'insecure_config',
    'cors_misconfiguration',
    'root_container',
    'dangerous_file',
    'sensitive_url',
    'data_exposure',
]);
// ============================================================================
// Assembler Functions
// ============================================================================
/**
 * Assemble a validation prompt containing only the modules relevant to
 * the given set of vulnerability categories.
 *
 * Always starts with COMMON, then adds modules in fixed order:
 * auth_access -> xss_prompt -> secrets_crypto -> ai_patterns -> owasp_classic
 *
 * Deterministic ordering ensures Anthropic prefix cache hits across batches.
 *
 * @param categories - The vulnerability categories present in the current batch
 * @returns The assembled prompt string
 */
function assembleValidationPrompt(categories) {
    // Determine which modules are needed
    const neededModules = new Set();
    for (const cat of categories) {
        const modules = exports.CATEGORY_TO_MODULE.get(cat);
        if (modules) {
            for (const mod of modules) {
                neededModules.add(mod);
            }
        }
        // Unmapped categories just get COMMON (no additional module)
    }
    // Build prompt: COMMON first, then modules in fixed order
    const parts = [common_1.COMMON_PROMPT];
    for (const mod of MODULES) {
        if (neededModules.has(mod.name)) {
            parts.push(mod.content);
        }
    }
    return parts.join('\n');
}
/**
 * Get the full validation prompt with all modules included.
 * Equivalent to the old monolithic HIGH_CONTEXT_VALIDATION_PROMPT.
 * Used for legacy compatibility and the completeness test.
 */
function getFullValidationPrompt() {
    const parts = [common_1.COMMON_PROMPT];
    for (const mod of MODULES) {
        parts.push(mod.content);
    }
    return parts.join('\n');
}
// Re-export module constants for direct access in tests
var common_2 = require("./common");
Object.defineProperty(exports, "COMMON_PROMPT", { enumerable: true, get: function () { return common_2.COMMON_PROMPT; } });
var auth_access_2 = require("./auth-access");
Object.defineProperty(exports, "AUTH_ACCESS_MODULE", { enumerable: true, get: function () { return auth_access_2.AUTH_ACCESS_MODULE; } });
var xss_prompt_2 = require("./xss-prompt");
Object.defineProperty(exports, "XSS_PROMPT_MODULE", { enumerable: true, get: function () { return xss_prompt_2.XSS_PROMPT_MODULE; } });
var secrets_crypto_2 = require("./secrets-crypto");
Object.defineProperty(exports, "SECRETS_CRYPTO_MODULE", { enumerable: true, get: function () { return secrets_crypto_2.SECRETS_CRYPTO_MODULE; } });
var ai_patterns_2 = require("./ai-patterns");
Object.defineProperty(exports, "AI_PATTERNS_MODULE", { enumerable: true, get: function () { return ai_patterns_2.AI_PATTERNS_MODULE; } });
var owasp_classic_2 = require("./owasp-classic");
Object.defineProperty(exports, "OWASP_CLASSIC_MODULE", { enumerable: true, get: function () { return owasp_classic_2.OWASP_CLASSIC_MODULE; } });
//# sourceMappingURL=index.js.map