/**
 * DORA ICT Major Incident Report Template
 *
 * Satisfies DORA Article 19 -- Classification and Reporting of ICT-Related
 * Incidents. Financial entities subject to DORA must submit initial, interim,
 * and final reports to competent authorities within prescribed deadlines.
 *
 * The 4-hour initial classification deadline from incident detection is
 * embedded as a structural constraint in the timeline section.
 *
 * Regulatory references:
 *   Regulation (EU) 2022/2554 (DORA), Article 17 -- ICT-related incident management
 *   Regulation (EU) 2022/2554 (DORA), Article 18 -- Classification of ICT incidents
 *   Regulation (EU) 2022/2554 (DORA), Article 19 -- Reporting of major ICT incidents
 *   Commission Delegated Regulation (EU) 2024/1772 -- RTS on classification
 *   Commission Implementing Regulation (EU) 2024/2956 -- ITS on reporting templates
 *   EBA/ESMA/EIOPA Joint Guidelines on ICT Incident Reporting
 *
 * Classification thresholds (Art. 18 + RTS 2024/1772):
 *   - Clients or counterparts affected (number or percentage)
 *   - Geographical spread (cross-border impact)
 *   - Data loss (confidentiality, integrity, availability)
 *   - Duration and service unavailability
 *   - Economic impact (direct costs threshold set by regulator)
 *   - Reputational impact
 *   - Criticality of services affected
 *
 * Required audit event types:
 *   security:incident:major -- classified major ICT incident
 *   approval:escalated -- incident escalated for management/board review
 *   retention:deleted -- any data deletion during/after incident
 *
 * Spec: P4-AIR-02 item 5
 *
 * @connexum/ai-governance
 */
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is insufficient, write
"Evidence not available in audit chain; financial entity must supplement with
operational records per DORA Art. 19(3)." Never invent event IDs.
`.trim();
/** DORA 4-hour classification deadline notice embedded in section prompts. */
const DEADLINE_NOTICE = `
IMPORTANT DORA DEADLINE: Under DORA Art. 19 and RTS 2024/1772, the initial
notification to the competent authority must be submitted within 4 hours of
classifying the incident as major, and no later than 24 hours after detection.
Identify the detection timestamp from the audit chain and calculate whether
the 4-hour window has been met.
`.trim();
export const DORA_ICT_MAJOR_INCIDENT_TEMPLATE = {
    templateId: 'tpl-dora-ict-major-incident-v1',
    name: 'DORA Art. 19 Major ICT Incident Report',
    framework: 'dora',
    requiredAuditEventTypes: [
        'security:incident:major',
        'approval:escalated',
        'retention:deleted',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'dora-incident-classification',
            title: '1. Incident Classification (DORA Art. 18 + RTS 2024/1772)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Incident Classification section for a DORA Major ICT
Incident Report under Article 18 of Regulation (EU) 2022/2554 and Commission
Delegated Regulation (EU) 2024/1772.

An ICT incident qualifies as "major" if it meets materiality thresholds in at
least one of the seven classification criteria: (a) clients affected, (b)
geographical spread, (c) data losses, (d) duration and service unavailability,
(e) economic impact, (f) reputational impact, (g) criticality of services.

${DEADLINE_NOTICE}

Using ONLY the audit-chain events provided, describe:
1. The incident trigger: the security:incident:major event, its timestamp, and
   the AI governance signals that led to its classification.
2. Assessment against each DORA classification criterion -- for each criterion,
   state whether the threshold was met, not met, or indeterminate based on
   available chain evidence.
3. The classification decision: who made it, when, and which criteria were met.
4. Calculate the time from first detection (earliest relevant chain event) to
   formal classification. Flag if this exceeds 24 hours.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs. Use the DORA Art. 19 reporting template structure.
`.trim(),
        },
        {
            id: 'dora-timeline-and-deadlines',
            title: '2. Incident Timeline and Reporting Deadlines (DORA Art. 19)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Timeline and Deadlines section for a DORA Major ICT
Incident Report under Article 19 of Regulation (EU) 2022/2554.

DORA Art. 19 reporting obligations:
  - Initial notification: within 4 hours of major classification, ≤24h from detection
  - Intermediate report: within 72 hours of initial notification
  - Final report: within 1 month of intermediate report (or resolution, whichever first)

${DEADLINE_NOTICE}

Using ONLY the audit-chain events provided, construct a precise timeline:
1. T0 -- Incident detection timestamp (earliest alert or anomaly event in chain).
2. T1 -- Incident classification as "major" (security:incident:major event).
3. T2 -- Escalation to management/board (approval:escalated event).
4. T3 -- Initial notification to competent authority (if evidenced in chain).
5. Derived deadlines: T1+4h (initial notification due), T3+72h (intermediate
   report due), T3+30d (final report due).
6. Compliance assessment: were each deadline met, at risk, or breached?

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs. Include a structured timeline table if evidence permits.
`.trim(),
        },
        {
            id: 'dora-impact-assessment',
            title: '3. Impact Assessment and Affected Services',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Impact Assessment section for a DORA Major ICT Incident
Report. DORA requires quantification of impact across clients, services, and
economic dimensions.

Using ONLY the audit-chain events provided, describe:
1. Affected AI agents and services: which agents were suspended or experienced
   governance failures during the incident window.
2. Client/counterpart exposure: evidence in the chain of external-facing service
   disruption.
3. Data integrity impact: retention:deleted events during the incident that may
   indicate data loss or unauthorised deletion.
4. Service availability: duration of unavailability as evidenced by enforcement
   events (circuit breakers, suspensions) and their resolution timestamps.
5. Economic impact: if the chain contains cost-tracking events relevant to the
   incident, summarise them.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'dora-containment-response',
            title: '4. Containment and Response Actions',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Containment and Response section for a DORA Major ICT
Incident Report under DORA Art. 17 (ICT-related incident management).

DORA Art. 17 requires financial entities to have incident management processes
that include: detection, management and notification, classification, response,
recovery, post-incident review, and communication.

Using ONLY the audit-chain events provided, describe:
1. Automated containment actions taken by the governance runtime (circuit
   breakers, agent suspensions, access revocations) -- cite each event.
2. Human response: escalation events, approval decisions during containment.
3. Recovery actions and their outcomes.
4. Communication events: internal escalation, board/management notification.
5. Outstanding remediation items not yet resolved at report time.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'dora-root-cause-and-prevention',
            title: '5. Root Cause Analysis and Recurrence Prevention',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Root Cause and Prevention section for a DORA Major ICT
Incident Report. DORA Art. 17(1)(e) requires post-incident review and
identification of root causes.

Using ONLY the audit-chain events provided, describe:
1. Root cause of the incident as evidenced by audit-chain patterns.
2. Contributing factors: policy gaps, misconfigured AI agents, or external attack
   vectors indicated by the event sequence.
3. Lessons learned from the incident timeline and response.
4. Corrective controls implemented or planned to prevent recurrence.
5. Evidence that the corrective controls have been or will be subject to human
   approval before activation.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'dora-supervisory-disclosure',
            title: '6. Supervisory Disclosure and Regulatory Communication',
            citationRequirement: 'optional',
            promptTemplate: `
You are drafting the Supervisory Disclosure section for a DORA Major ICT
Incident Report. DORA Art. 19(5) requires financial entities to notify clients
and counterparts when the incident has or is likely to have an adverse impact on
their financial interests.

Describe:
1. Whether client/counterpart notification was required based on the impact
   assessment.
2. The competent authority to which notification must be submitted (determined
   by the financial entity's home member state).
3. Status of regulatory submissions: submitted, pending, or planned.
4. Communication plan for affected clients/counterparts.

If the audit chain does not contain supervisory disclosure events, state that
this section must be completed with external records. The chain provides the
technical evidence basis; the regulatory submission itself is outside the
governance platform's scope.
`.trim(),
        },
    ],
};
//# sourceMappingURL=dora-ict-major-incident.js.map