"use strict";
/**
 * AXIS-B1 — Capability composition conflict classifier tests
 *
 * Step 5 RED→GREEN:
 *   RED  — run before capability-composition-conflicts.ts exists → import fails
 *   GREEN — run after implementation → all 12 mandatory conflict assertions pass
 *
 * Each test case maps directly to the adjudication table in the dispatch brief
 * (kai-2026-05-26-owasp-build-plan-briefs.md, AXIS-B1 section).
 *
 * @connexum/ai-governance  AXIS-B1
 */
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
const node_test_1 = require("node:test");
const assert = __importStar(require("node:assert/strict"));
const capability_composition_conflicts_js_1 = require("../capability-composition-conflicts.js");
// Convenience aliases.
const FAIL = capability_composition_conflicts_js_1.COMPOSITION_RESULT.FAIL;
const REQUIRES_HITL = capability_composition_conflicts_js_1.COMPOSITION_RESULT.REQUIRES_HITL;
const OK = capability_composition_conflicts_js_1.COMPOSITION_RESULT.OK;
// ---------------------------------------------------------------------------
// 12 mandatory conflict table entries (from dispatch brief AXIS-B1)
// ---------------------------------------------------------------------------
(0, node_test_1.describe)('capability-composition-conflicts — fail-list', () => {
    (0, node_test_1.it)('web-scraping + decision-making → FAIL (attacker-controlled data drives autonomous decisions)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['web-scraping', 'decision-making']), FAIL);
    });
    (0, node_test_1.it)('web-scraping + file-write → FAIL (exfil vector: web content written to disk)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['web-scraping', 'file-write']), FAIL);
    });
    (0, node_test_1.it)('web-scraping + external-api-call → FAIL (exfil vector: web content routed to external API)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['web-scraping', 'external-api-call']), FAIL);
    });
    (0, node_test_1.it)('file-write + email-send → FAIL (mass data exfiltration: files emailed externally)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['file-write', 'email-send']), FAIL);
    });
    (0, node_test_1.it)('read-phi + external-api-call-outside-proxy → FAIL (PHI exfiltration outside approved proxy)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-phi', 'external-api-call-outside-proxy']), FAIL);
    });
    (0, node_test_1.it)('read-pii + external-api-call-outside-proxy → FAIL (PII exfiltration outside approved proxy)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-pii', 'external-api-call-outside-proxy']), FAIL);
    });
    (0, node_test_1.it)('execute-shell + commit-code → FAIL (supply-chain injection: shell-injected code committed to repo)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['execute-shell', 'commit-code']), FAIL);
    });
    (0, node_test_1.it)('read-secrets + web-scraping → FAIL (attacker-controlled data reaches secrets context)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-secrets', 'web-scraping']), FAIL);
    });
    (0, node_test_1.it)('read-secrets + external-api-call → FAIL (secrets exfiltrated to external endpoint)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-secrets', 'external-api-call']), FAIL);
    });
    (0, node_test_1.it)('read-secrets + file-write → FAIL (secrets written to potentially accessible file)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-secrets', 'file-write']), FAIL);
    });
    (0, node_test_1.it)('read-secrets + email-send → FAIL (secrets emailed — any external destination)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-secrets', 'email-send']), FAIL);
    });
    (0, node_test_1.it)('read-financial-records + decision-making → REQUIRES_HITL (financial records driving autonomous decisions)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-financial-records', 'decision-making']), REQUIRES_HITL);
    });
});
// ---------------------------------------------------------------------------
// read-secrets wildcard — any external destination
// ---------------------------------------------------------------------------
(0, node_test_1.describe)('capability-composition-conflicts — read-secrets wildcard', () => {
    (0, node_test_1.it)('read-secrets + commit-code → FAIL (wildcard: any external destination)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-secrets', 'commit-code']), FAIL);
    });
});
// ---------------------------------------------------------------------------
// Order independence — pairs are unordered
// ---------------------------------------------------------------------------
(0, node_test_1.describe)('capability-composition-conflicts — order independence', () => {
    (0, node_test_1.it)('decision-making + web-scraping (reversed) → FAIL', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['decision-making', 'web-scraping']), FAIL);
    });
    (0, node_test_1.it)('commit-code + execute-shell (reversed) → FAIL', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['commit-code', 'execute-shell']), FAIL);
    });
    (0, node_test_1.it)('email-send + file-write (reversed) → FAIL', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['email-send', 'file-write']), FAIL);
    });
});
// ---------------------------------------------------------------------------
// Non-conflicting combinations → OK
// ---------------------------------------------------------------------------
(0, node_test_1.describe)('capability-composition-conflicts — non-conflicting pairs', () => {
    (0, node_test_1.it)('read-public-data + decision-making → OK', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['read-public-data', 'decision-making']), OK);
    });
    (0, node_test_1.it)('file-read + decision-making → OK (read does not conflict with decision-making alone)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['file-read', 'decision-making']), OK);
    });
    (0, node_test_1.it)('empty capability list → OK', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)([]), OK);
    });
    (0, node_test_1.it)('single capability → OK (no pair to conflict)', () => {
        assert.equal((0, capability_composition_conflicts_js_1.classifyCapabilityComposition)(['web-scraping']), OK);
    });
});
// ---------------------------------------------------------------------------
// FourAxisScore and InteractionAxisScore type-level smoke test
// ---------------------------------------------------------------------------
// FourAxisScore type-export verification was previously asserted here via a
// cross-package dynamic import. Removed 2026-05-26 because the static path
// pulled the entire packages/governance-server tree into the root tsc rootDir
// program and broke the production Railway build (TS6059 cascade — every
// transitive import landed outside rootDir '/app/src').
//
// The type exists and is exercised by the governance-server package's own
// build (tsc -p packages/governance-server/tsconfig.json) which fails at
// compile time if FourAxisScore or InteractionAxisScore is missing. That is
// the correct verification surface for cross-package types.
//# sourceMappingURL=capability-composition-conflicts.test.js.map