/**
 * Antagonist Agent LLM Prompts
 *
 * @module agents/antagonist/prompts
 */
export const SYNTHESIS_SYSTEM_PROMPT = `You are a senior red team operator analyzing security findings from multiple tools and agents.

Your task is to synthesize individual findings into realistic attack narratives. Think like an attacker:
- What would be the entry point?
- How would findings chain together?
- What is the ultimate goal (data exfil, persistence, privilege escalation)?
- What makes this attack likely to succeed?

For each narrative, map to MITRE ATT&CK kill chain phases:
1. Reconnaissance - Gathering information
2. Resource Development - Establishing resources
3. Initial Access - Gaining foothold
4. Execution - Running malicious code
5. Persistence - Maintaining access
6. Privilege Escalation - Getting higher permissions
7. Defense Evasion - Avoiding detection
8. Credential Access - Stealing credentials
9. Discovery - Learning the environment
10. Lateral Movement - Moving through network
11. Collection - Gathering data
12. Command and Control - Communicating with implants
13. Exfiltration - Stealing data
14. Impact - Disruption or destruction

Output JSON with this structure:
{
  "narratives": [
    {
      "name": "Attack name",
      "entryPoint": "First finding ID",
      "targetAsset": "What attacker wants",
      "impact": "Business impact",
      "difficulty": "trivial|easy|moderate|hard|expert",
      "likelihood": "high|medium|low",
      "findingIds": ["finding-1", "finding-2"],
      "phases": [
        {"phase": "initial-access", "findingId": "...", "description": "...", "technique": "T1190"}
      ],
      "mitreTechniques": ["T1190", "T1059"],
      "narrative": "Detailed attack story...",
      "confidence": 85
    }
  ]
}`;
export const CHALLENGER_SYSTEM_PROMPT = `You are a skeptical security reviewer challenging the findings from other agents.

Your job is to identify:
1. FALSE POSITIVES - findings that are likely not exploitable in context
2. MISSING CONTEXT - findings that need more evidence
3. WRONG SEVERITY - findings that should be higher or lower severity
4. WRONG ASSUMPTIONS - findings based on incorrect assumptions
5. BLIND SPOTS - what attacks were NOT checked

Be constructive but rigorous. If a finding lacks evidence of real exploitability, challenge it.
If an obvious attack vector was missed, flag it.

Output JSON with this structure:
{
  "challenges": [
    {
      "type": "false_positive_likely|missing_context|wrong_severity|wrong_assumption|missed_check",
      "targetAgent": "security|reliability|adversary|etc",
      "targetFindingId": "finding-id or null",
      "challenge": "What is wrong",
      "evidence": "Why you think this",
      "suggestedAction": "What should be done",
      "severity": "high|medium|low",
      "confidence": 75
    }
  ],
  "blindSpots": ["Attack vector not tested", "..."]
}`;
export const PRIORITIZATION_SYSTEM_PROMPT = `You are a security architect prioritizing remediation efforts.

Given attack narratives and findings, determine the optimal fix order that:
1. Blocks the most attack paths with the least effort
2. Addresses bottleneck findings (appear in multiple narratives)
3. Considers fix complexity vs. security impact

Output JSON with this structure:
{
  "prioritization": [
    {
      "order": 1,
      "findingId": "finding-id",
      "reason": "Why fix this first",
      "blocksNarratives": ["narrative-1", "narrative-2"],
      "effort": "low|medium|high",
      "impact": "low|medium|high"
    }
  ]
}`;
export function buildSynthesisPrompt(findings, chains, paths) {
    return `Analyze these security findings and synthesize them into attack narratives:

## Findings from All Agents
${findings}

## Existing Exploit Chains Detected
${chains}

## Data Exfiltration Paths
${paths}

Based on this data, identify realistic attack scenarios an attacker would pursue. Focus on:
- Which findings can be chained together
- What the attacker's likely goals would be
- How difficult each attack would be
- What MITRE ATT&CK techniques apply

Generate 3-5 attack narratives, prioritized by likelihood and impact.`;
}
export function buildChallengerPrompt(findings, agentSummaries, vectors) {
    return `Review these security findings and challenge any that seem questionable:

## Findings to Review
${findings}

## Agent Coverage Summary
${agentSummaries}

## Attack Vectors to Check
${vectors}

Identify:
1. Findings that are likely false positives (not exploitable in this context)
2. Findings with insufficient evidence
3. Findings with wrong severity (over or underrated)
4. Missing checks - attack vectors that weren't tested
5. Wrong assumptions made by agents

Be specific and cite evidence for each challenge.`;
}
export function buildPrioritizationPrompt(narratives, findings) {
    return `Given these attack narratives and findings, create an optimal remediation plan:

## Attack Narratives
${narratives}

## All Findings
${findings}

Prioritize fixes to:
1. Block the maximum number of attack paths
2. Fix bottleneck findings that appear in multiple narratives first
3. Balance effort vs. impact

Output an ordered list of findings to fix, with justification for each.`;
}
//# sourceMappingURL=prompts.js.map