/**
 * Capability Catalog — single source of truth mapping every governance capability
 * to exactly one pricing tier.
 *
 * Tiers:
 *   base         — universal, every tenant, no upsell needed
 *   company_pack — auto-generated from OWASP scan, customers publish freely
 *   vertical     — licensed add-on tied to a specific vertical pack
 *
 * ZERO duplicate-owner entries. Each capability appears exactly once.
 * If a capability is used by multiple shipped packs today, it is assigned
 * to the owning vertical pack deliberately.
 *
 * Initial scope covers the 9 Tier 8.7 packs that have shipped definitively
 * (HIPAA #1041, SOC 2 #1045, GDPR #1046, PCI DSS #1047, EU AI Act #1060,
 * ISO 27001 #1061, NIST AI RMF #1062, ISO 42001 #1063, DORA #1064).
 *
 * Unmapped capabilities (the remaining ~137 packs in the catalogue) are listed
 * as TODO placeholders with tier: { kind: 'base' }. The validator allows them
 * (graceful degrade, logged as warning). They will be classified in PR-C.
 *
 * @connexum/ai-governance  feat/capability-licensing-pr-a-publish-validator
 */
import type { CapabilityClassId } from './capability-classes.js';
import { type VerticalGroup } from '../packs/vertical-group-catalog.js';
export type CapabilityTier = {
    kind: 'base';
} | {
    kind: 'company_pack';
} | {
    kind: 'vertical';
    packId: string;
};
export interface CapabilityCatalogEntry {
    capability: string;
    tier: CapabilityTier;
    description: string;
    /** Display name of the owning pack, for upsell error messages. */
    owningPackName?: string;
}
export declare const CAPABILITY_CATALOG: ReadonlyArray<CapabilityCatalogEntry>;
/**
 * Look up a capability by its ID. Returns undefined for capabilities not yet
 * catalogued (the validator treats those as base tier — allow with warning).
 */
export declare function lookupCapability(cap: string): CapabilityCatalogEntry | undefined;
/**
 * Returns the list of pack IDs that are bundled (licensed at no extra cost)
 * when the customer holds a license for `parentPackId` in the context of `group`.
 *
 * Convention: capability-catalog uses snake_case pack IDs (e.g. 'iso_27001', 'gdpr').
 *
 * Rules:
 *   - 'iso_27001' is always bundled (universal baseline).
 *   - 'gdpr' is bundled when the group's jurisdiction covers the EU or an EU member state.
 *
 * The parentPackId itself is excluded from the result to prevent self-listing.
 *
 * **Licensing-layer only.** Customer who licenses this group gets these packs
 * licensed too (free, capability-bundling). Per-agent BINDING + per-rule
 * VERIFICATION remain explicit customer actions in the wizard.
 */
export declare function bundledPackIds(parentPackId: string, group?: VerticalGroup): string[];
/**
 * Check whether a capability requires a vertical pack license that the org does
 * not currently hold.
 *
 * Returns false if the capability is base or company_pack tier, or if the org
 * holds the required pack license, or if the capability's owning pack is bundled
 * via `group` (ISO 27001 universal baseline; GDPR for EU/Global groups).
 *
 * Returns { packId, packName } if the capability is vertical-gated and the org
 * is NOT licensed for the owning pack (and it is not bundled via group).
 *
 * @param cap            - capability ID being checked
 * @param licensedPacks  - pack IDs the org has explicitly licensed
 * @param group          - optional purchased group (enables bundle-licensing check)
 */
export declare function isUnlicensed(cap: string, licensedPacks: string[], group?: VerticalGroup): false | {
    packId: string;
    packName?: string;
};
export type { CapabilityClassId };
//# sourceMappingURL=capability-catalog.d.ts.map