/**
 * PCI DSS Annual Attestation Digest Template
 *
 * Generates a 12-month evidence digest supporting the Annual Report on
 * Compliance (ROC) or Self-Assessment Questionnaire (SAQ). This template
 * produces the AI-governance evidence layer -- not a substitute for the
 * full QSA-validated ROC, but the section documenting AI agent controls
 * within the Cardholder Data Environment (CDE).
 *
 * The 12-month window is structural and enforced at render time.
 * Approval events must be scoped to security-reviewer tier per PCI DSS
 * Requirements 6, 8, and 12 change-approval obligations.
 *
 * Regulatory references:
 *   PCI DSS v4.0.1 -- Payment Card Industry Data Security Standard
 *   PCI DSS v4.0.1 Requirement 1: Network Security Controls
 *   PCI DSS v4.0.1 Requirement 6: Secure Systems and Software (change management)
 *   PCI DSS v4.0.1 Requirement 8: Identify Users and Authenticate Access
 *   PCI DSS v4.0.1 Requirement 10: Log and Monitor All Access to System Components
 *   PCI DSS v4.0.1 Requirement 12: Support Information Security with Policies
 *   PCI SSC Guidance on AI Tools in the CDE (2024)
 *
 * Required audit event types:
 *   governance:verdict -- enforcement decisions (Req. 10 logging)
 *   approval:decided   -- change approvals (Req. 6 + 12, security-reviewer tier)
 *
 * Spec: P4-AIR-02 item 6
 *
 * @connexum/ai-governance
 */
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is insufficient, write
"Evidence not available in audit chain; entity must supplement with QSA-reviewed
documentation per PCI DSS ROC requirements." Never invent event IDs.

This report covers a 12-month review period. Flag any gaps in evidence coverage
that would prevent a QSA from forming an opinion of operating effectiveness.
`.trim();
/** Note embedded in all sections reminding analysts of the 12-month window. */
const WINDOW_NOTE = `NOTE: PCI DSS annual attestation requires a full 12-month evidence window.
Verify that the report window parameter spans the complete assessment period.`;
export const PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE = {
    templateId: 'tpl-pci-dss-annual-attestation-v1',
    name: 'PCI DSS Annual Attestation Evidence Digest',
    framework: 'pci-dss',
    requiredAuditEventTypes: [
        'governance:verdict',
        'approval:decided',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'pci-req-6-change-management',
            title: 'Requirement 6: Secure Systems and Software -- Change Management',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Requirement 6 (Change Management) section for a PCI DSS
v4.0.1 Annual Attestation Evidence Digest.

${WINDOW_NOTE}

PCI DSS Req. 6.3.2: Patches and updates are installed on system components within
one month of release. Req. 6.4.1: All security vulnerabilities are identified and
protected. Req. 6.5.1-6.5.6: Change management processes including authorisation,
testing, and documentation.

Using ONLY the audit-chain events provided, describe:
1. AI agent governance policy changes during the 12-month period -- cite each
   policy:snapshot event and the corresponding approval.
2. Evidence that changes to AI agent configurations were subject to security
   review before deployment (approval:decided events with security-reviewer tier).
3. Any emergency changes and their post-hoc approval documentation.
4. Control gaps: changes without documented security approval or testing evidence.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'pci-req-8-identity-access',
            title: 'Requirement 8: Identify Users and Authenticate Access',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Requirement 8 (Identity and Access Management) section for
a PCI DSS v4.0.1 Annual Attestation Evidence Digest.

${WINDOW_NOTE}

PCI DSS Req. 8.2.1: All user and system accounts are managed by an authentication
policy. Req. 8.3.6: Passwords/passphrases meet complexity requirements. Req. 8.6.1:
System and application accounts are managed and controlled.

For AI governance specifically, this requirement applies to:
  - AI agent identity (each agent has a unique identifier in the registry)
  - Authentication of agents before access to CDE-adjacent tools is granted
  - Access reviews for agent accounts

Using ONLY the audit-chain events provided, describe:
1. AI agent identities registered during the period (agent:registered events).
2. Evidence that agent identities are unique and authenticated before tool access.
3. Access reviews performed -- approval events reviewing agent permissions.
4. Any accounts with shared credentials or authentication control gaps.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'pci-req-10-logging-monitoring',
            title: 'Requirement 10: Log and Monitor All Access to System Components',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Requirement 10 (Logging and Monitoring) section for a PCI
DSS v4.0.1 Annual Attestation Evidence Digest.

${WINDOW_NOTE}

PCI DSS Req. 10.2.1: Audit logs capture all individual user access to cardholder
data, all actions taken by any individual with root or administrative privileges,
access to all audit trails, invalid logical access attempts, use of and changes to
identification and authentication mechanisms, initialisation, stopping, or pausing
of audit logs, and creation and deletion of system-level objects.

Req. 10.3.2: Audit log files are protected to prevent modifications.
Req. 10.4.1: Log review is automated.
Req. 10.7.1: Failures of critical security controls are detected, reported, and
responded to promptly.

Using ONLY the audit-chain events provided, describe:
1. Volume and completeness of AI governance audit events during the 12-month
   period.
2. Evidence that the tamper-evident chain prevents log modification (hash-chain
   integrity).
3. Automated monitoring: anomaly detection events, alert rates, and response times.
4. Any log failures or gaps detected and their resolution.
5. Quantify: total events logged, deny rate, escalation rate, coverage gaps.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'pci-req-12-policy-governance',
            title: 'Requirement 12: Support Information Security with Policies',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Requirement 12 (Security Policy) section for a PCI DSS
v4.0.1 Annual Attestation Evidence Digest.

${WINDOW_NOTE}

PCI DSS Req. 12.1.1: An information security policy is established, published,
maintained, and disseminated to all relevant personnel and applicable vendors.
Req. 12.3.2: Targeted risk analysis is performed for any PCI DSS requirement
that provides flexibility. Req. 12.10.1: An incident response plan exists and is
ready to be activated in the event of a system breach.

Using ONLY the audit-chain events provided, describe:
1. AI governance policies in force during the period (policy:snapshot events),
   their version history, and approval status.
2. Evidence that AI agent policies address CDE-relevant controls (access,
   logging, encryption, incident response).
3. Incident response activation: any incidents during the period where the
   response plan was invoked, citing relevant chain events.
4. Evidence that security policies were communicated to relevant AI agent
   operators and that operators acknowledged them (approval events).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'pci-overall-compliance-posture',
            title: 'Overall Compliance Posture Summary',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Overall Compliance Posture Summary for a PCI DSS v4.0.1
Annual Attestation Evidence Digest covering AI governance controls.

${WINDOW_NOTE}

Provide a concise executive summary covering:
1. The 12-month period reviewed and the AI governance platform scope within
   the Cardholder Data Environment.
2. Key metrics: total governance decisions, deny rate, approval events, and
   anomaly alerts over the period.
3. Material control gaps identified: where AI governance evidence was absent
   or insufficient to support a QSA opinion.
4. Attestation statement: based on the available audit-chain evidence, do the
   AI governance controls appear to have operated continuously and effectively
   throughout the review period? If not, identify the specific periods or
   requirements where effectiveness is not demonstrated.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs. This section will be reviewed by the QSA first.
`.trim(),
        },
    ],
};
//# sourceMappingURL=pci-dss-annual-attestation.js.map