/**
 * Capability Catalog — single source of truth mapping every governance capability
 * to exactly one pricing tier.
 *
 * Tiers:
 *   base         — universal, every tenant, no upsell needed
 *   company_pack — auto-generated from OWASP scan, customers publish freely
 *   vertical     — licensed add-on tied to a specific vertical pack
 *
 * ZERO duplicate-owner entries. Each capability appears exactly once.
 * If a capability is used by multiple shipped packs today, it is assigned
 * to the owning vertical pack deliberately.
 *
 * Initial scope covers the 9 Tier 8.7 packs that have shipped definitively
 * (HIPAA #1041, SOC 2 #1045, GDPR #1046, PCI DSS #1047, EU AI Act #1060,
 * ISO 27001 #1061, NIST AI RMF #1062, ISO 42001 #1063, DORA #1064).
 *
 * Unmapped capabilities (the remaining ~137 packs in the catalogue) are listed
 * as TODO placeholders with tier: { kind: 'base' }. The validator allows them
 * (graceful degrade, logged as warning). They will be classified in PR-C.
 *
 * @connexum/ai-governance  feat/capability-licensing-pr-a-publish-validator
 */
import { groupBundlesGdpr } from '../packs/vertical-group-catalog.js';
// ---------------------------------------------------------------------------
// Catalog
// ---------------------------------------------------------------------------
export const CAPABILITY_CATALOG = [
    // =========================================================================
    // BASE — universal, every tenant gets these at no extra cost
    // =========================================================================
    {
        capability: 'capability:mcp',
        tier: { kind: 'base' },
        description: 'Track MCP tool calls in the audit chain',
    },
    {
        capability: 'capability:web-fetch',
        tier: { kind: 'base' },
        description: 'Log web-fetch calls to audit chain',
    },
    {
        capability: 'capability:external-db-write',
        tier: { kind: 'base' },
        description: 'Log external database write operations',
    },
    {
        capability: 'capability:shell-exec',
        tier: { kind: 'base' },
        description: 'Log shell execution calls to audit chain',
    },
    {
        capability: 'capability:filesystem-write',
        tier: { kind: 'base' },
        description: 'Log filesystem write operations to audit chain',
    },
    {
        capability: 'capability:network-egress',
        tier: { kind: 'base' },
        description: 'Log network egress calls to audit chain',
    },
    {
        capability: 'capability:secret-access',
        tier: { kind: 'base' },
        description: 'Log secret/credential access to audit chain',
    },
    {
        capability: 'tool_use_logging',
        tier: { kind: 'base' },
        description: 'Log every tool call to audit chain',
    },
    {
        capability: 'auth_required',
        tier: { kind: 'base' },
        description: 'Reject unauthenticated requests',
    },
    {
        capability: 'rate_limiting',
        tier: { kind: 'base' },
        description: 'Enforce per-agent rate limits',
    },
    {
        capability: 'owasp_llm01_prompt_injection_detect',
        tier: { kind: 'base' },
        description: 'Detect OWASP LLM-01 prompt injection patterns (base detection)',
    },
    {
        capability: 'owasp_llm02_insecure_output_detect',
        tier: { kind: 'base' },
        description: 'Detect OWASP LLM-02 insecure output patterns',
    },
    {
        capability: 'owasp_llm06_sensitive_info_detect',
        tier: { kind: 'base' },
        description: 'Detect OWASP LLM-06 sensitive information disclosure',
    },
    {
        capability: 'owasp_llm10_model_theft_detect',
        tier: { kind: 'base' },
        description: 'Detect OWASP LLM-10 model theft patterns',
    },
    {
        capability: 'audit_chain_integrity',
        tier: { kind: 'base' },
        description: 'SHA-256 tamper-evidence on the audit chain',
    },
    {
        capability: 'circuit_breaker',
        tier: { kind: 'base' },
        description: 'Circuit breaker on repeated agent failures',
    },
    {
        capability: 'anomaly_detection_basic',
        tier: { kind: 'base' },
        description: 'Basic statistical anomaly detection on tool-call patterns',
    },
    // =========================================================================
    // COMPANY_PACK — auto-generated from OWASP scan; customer-specific rules
    // =========================================================================
    {
        capability: 'input_validation',
        tier: { kind: 'company_pack' },
        description: 'Validate and sanitize agent input before processing',
    },
    {
        capability: 'prompt_injection_guard',
        tier: { kind: 'company_pack' },
        description: 'Block prompt injection attempts detected by OWASP scanner',
    },
    {
        capability: 'output_filtering',
        tier: { kind: 'company_pack' },
        description: 'Filter agent outputs through content policy before delivery',
    },
    {
        capability: 'tos_adherence',
        tier: { kind: 'company_pack' },
        description: 'Enforce terms-of-service rules specific to the organisation',
    },
    {
        capability: 'blast_radius_limit',
        tier: { kind: 'company_pack' },
        description: 'Cap the number of consequential actions per agent cycle',
    },
    {
        capability: 'info_action_separation',
        tier: { kind: 'company_pack' },
        description: 'Enforce sourced-only or strict info/action separation',
    },
    {
        capability: 'approval_gate_custom',
        tier: { kind: 'company_pack' },
        description: 'Custom human-in-the-loop approval gates per org policy',
    },
    {
        capability: 'retention_custom',
        tier: { kind: 'company_pack' },
        description: 'Custom audit-log retention schedule per org policy',
    },
    // =========================================================================
    // VERTICAL — HIPAA (packId: 'hipaa')
    // Governs PR #1041 capabilities
    // =========================================================================
    {
        capability: 'phi_redaction',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Redact PHI from agent outputs before delivery',
    },
    {
        capability: 'baa_required',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Block tool calls until a signed BAA is in place',
    },
    {
        capability: 'minimum_necessary_rule',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Limit data exposure to the HIPAA minimum-necessary standard',
    },
    {
        capability: 'phi_access_logging',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Log all access to Protected Health Information',
    },
    {
        capability: 'hipaa_encryption_at_rest',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Enforce AES-256 encryption at rest for PHI stores',
    },
    {
        capability: 'hipaa_breach_notification',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: '72-hour breach notification workflow for HIPAA incidents',
    },
    {
        capability: 'workforce_training_gate',
        tier: { kind: 'vertical', packId: 'hipaa' },
        owningPackName: 'HIPAA Security & Privacy',
        description: 'Block agent activation until workforce training is recorded',
    },
    // =========================================================================
    // VERTICAL — SOC 2 (packId: 'soc2')
    // Governs PR #1045 capabilities
    // =========================================================================
    {
        capability: 'soc2_availability_monitoring',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Continuous availability monitoring per SOC 2 CC9',
    },
    {
        capability: 'soc2_change_management',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Enforce change-management approval gates (SOC 2 CC8)',
    },
    {
        capability: 'soc2_logical_access_controls',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Role-based logical access controls (SOC 2 CC6)',
    },
    {
        capability: 'soc2_vendor_risk',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Third-party / vendor risk assessment gate (SOC 2 CC9.2)',
    },
    {
        capability: 'soc2_incident_response',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'SOC 2-aligned incident response workflow (SOC 2 CC7)',
    },
    {
        capability: 'soc2_confidentiality_controls',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Confidentiality controls for sensitive data (SOC 2 C1)',
    },
    {
        capability: 'soc2_processing_integrity',
        tier: { kind: 'vertical', packId: 'soc2' },
        owningPackName: 'SOC 2',
        description: 'Processing integrity checks on agent outputs (SOC 2 PI1)',
    },
    // =========================================================================
    // VERTICAL — GDPR (packId: 'gdpr')
    // Governs PR #1046 capabilities
    // =========================================================================
    {
        capability: 'data_subject_request',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Process GDPR data subject access requests (Art. 15)',
    },
    {
        capability: 'right_to_erasure',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Right to erasure / right to be forgotten (Art. 17)',
    },
    {
        capability: 'consent_management',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Lawful-basis consent capture and withdrawal (Art. 6 & 7)',
    },
    {
        capability: 'data_portability',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Export personal data in machine-readable format (Art. 20)',
    },
    {
        capability: 'gdpr_breach_notification',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: '72-hour supervisory authority breach notification (Art. 33)',
    },
    {
        capability: 'data_minimisation',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Enforce data minimisation principle (Art. 5.1.c)',
    },
    {
        capability: 'purpose_limitation',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Enforce purpose-limitation checks on agent data processing (Art. 5.1.b)',
    },
    {
        capability: 'dpa_record_keeping',
        tier: { kind: 'vertical', packId: 'gdpr' },
        owningPackName: 'GDPR',
        description: 'Records of processing activities for the DPA (Art. 30)',
    },
    // =========================================================================
    // VERTICAL — PCI DSS (packId: 'pci_dss')
    // Governs PR #1047 capabilities
    // =========================================================================
    {
        capability: 'cardholder_data_protection',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Protect cardholder data in agent inputs and outputs (PCI Req 3)',
    },
    {
        capability: 'pan_truncation',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Truncate / mask primary account numbers in agent outputs',
    },
    {
        capability: 'pci_network_segmentation',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Enforce network segmentation assertions for CDE access (PCI Req 1)',
    },
    {
        capability: 'pci_vulnerability_management',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Vulnerability management workflow gate (PCI Req 6)',
    },
    {
        capability: 'pci_access_control',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Restrict CDE access on a need-to-know basis (PCI Req 7)',
    },
    {
        capability: 'pci_audit_log_retention',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: '12-month audit log retention per PCI DSS Req 10.7',
    },
    {
        capability: 'pci_strong_cryptography',
        tier: { kind: 'vertical', packId: 'pci_dss' },
        owningPackName: 'PCI DSS',
        description: 'Enforce strong cryptography standards in CDE (PCI Req 4)',
    },
    // =========================================================================
    // VERTICAL — EU AI Act (packId: 'eu_ai_act')
    // Governs PR #1060 capabilities
    // =========================================================================
    {
        capability: 'high_risk_ai_classification',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Classify and gate high-risk AI system use cases (Art. 6)',
    },
    {
        capability: 'eu_ai_transparency_disclosure',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Mandatory transparency disclosure for AI interactions (Art. 50)',
    },
    {
        capability: 'human_oversight_gate',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Human oversight requirement for high-risk AI decisions (Art. 14)',
    },
    {
        capability: 'fundamental_rights_impact',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Fundamental Rights Impact Assessment gate (Art. 27)',
    },
    {
        capability: 'eu_ai_conformity_assessment',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Conformity assessment documentation for high-risk systems (Art. 43)',
    },
    {
        capability: 'eu_ai_prohibited_practices_block',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Block prohibited AI practices (subliminal manipulation, social scoring) (Art. 5)',
    },
    {
        capability: 'eu_ai_technical_documentation',
        tier: { kind: 'vertical', packId: 'eu_ai_act' },
        owningPackName: 'EU AI Act',
        description: 'Technical documentation requirements for high-risk AI (Art. 11)',
    },
    // =========================================================================
    // VERTICAL — ISO 27001 (packId: 'iso_27001')
    // Governs PR #1061 capabilities
    // =========================================================================
    {
        capability: 'isms_policy_gate',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Gate agent activation on ISMS policy acceptance (ISO 27001 A.5)',
    },
    {
        capability: 'asset_inventory_binding',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Bind agents to the information asset inventory (ISO 27001 A.8)',
    },
    {
        capability: 'access_control_policy',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Enforce access control policies per ISO 27001 A.9',
    },
    {
        capability: 'cryptography_policy',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Enforce cryptography usage policy (ISO 27001 A.10)',
    },
    {
        capability: 'supplier_security_gate',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Gate external tool calls through supplier security review (ISO 27001 A.15)',
    },
    {
        capability: 'iso27001_incident_management',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'ISO 27001-aligned incident management workflow (A.16)',
    },
    {
        capability: 'business_continuity_assertion',
        tier: { kind: 'vertical', packId: 'iso_27001' },
        owningPackName: 'ISO 27001',
        description: 'Business continuity controls assertion gate (ISO 27001 A.17)',
    },
    // =========================================================================
    // VERTICAL — NIST AI RMF (packId: 'nist_ai_rmf')
    // Governs PR #1062 capabilities
    // =========================================================================
    {
        capability: 'nist_govern_policy',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Govern function: AI risk governance policy gate (NIST AI RMF 1.0 Govern)',
    },
    {
        capability: 'nist_map_context',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Map function: categorise AI context and risks (NIST AI RMF Map)',
    },
    {
        capability: 'nist_measure_metrics',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Measure function: quantitative risk metrics collection (NIST AI RMF Measure)',
    },
    {
        capability: 'nist_manage_response',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Manage function: risk treatment and response actions (NIST AI RMF Manage)',
    },
    {
        capability: 'nist_trustworthy_ai_assertions',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Assert trustworthy AI properties (accountable, explainable, fair, secure)',
    },
    {
        capability: 'nist_bias_monitoring',
        tier: { kind: 'vertical', packId: 'nist_ai_rmf' },
        owningPackName: 'NIST AI RMF',
        description: 'Continuous bias and fairness monitoring per NIST AI RMF',
    },
    // =========================================================================
    // VERTICAL — ISO 42001 (packId: 'iso_42001')
    // Governs PR #1063 capabilities
    // =========================================================================
    {
        capability: 'aims_policy_gate',
        tier: { kind: 'vertical', packId: 'iso_42001' },
        owningPackName: 'ISO 42001',
        description: 'AI Management System policy acceptance gate (ISO 42001 Cl.5)',
    },
    {
        capability: 'ai_impact_assessment',
        tier: { kind: 'vertical', packId: 'iso_42001' },
        owningPackName: 'ISO 42001',
        description: 'AI impact assessment before deployment (ISO 42001 Cl.8)',
    },
    {
        capability: 'ai_lifecycle_controls',
        tier: { kind: 'vertical', packId: 'iso_42001' },
        owningPackName: 'ISO 42001',
        description: 'Lifecycle controls: design, test, monitor, retire (ISO 42001 Cl.8.4)',
    },
    {
        capability: 'ai_transparency_obligations',
        tier: { kind: 'vertical', packId: 'iso_42001' },
        owningPackName: 'ISO 42001',
        description: 'Transparency obligations for AI system outputs (ISO 42001 Cl.8.5)',
    },
    {
        capability: 'aims_continual_improvement',
        tier: { kind: 'vertical', packId: 'iso_42001' },
        owningPackName: 'ISO 42001',
        description: 'Continual improvement process gate (ISO 42001 Cl.10)',
    },
    // =========================================================================
    // VERTICAL — DORA (packId: 'dora')
    // Governs PR #1064 capabilities
    // =========================================================================
    {
        capability: 'dora_ict_risk_framework',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'ICT risk management framework gate (DORA Art. 5-14)',
    },
    {
        capability: 'dora_incident_classification',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'Classify and report major ICT-related incidents (DORA Art. 17-23)',
    },
    {
        capability: 'dora_resilience_testing',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'Digital operational resilience testing gate (DORA Art. 24-27)',
    },
    {
        capability: 'dora_third_party_risk',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'ICT third-party risk management gate (DORA Art. 28-44)',
    },
    {
        capability: 'dora_tiber_eu_testing',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'TIBER-EU threat-led penetration testing workflow (DORA Art. 26)',
    },
    {
        capability: 'dora_critical_ict_contracts',
        tier: { kind: 'vertical', packId: 'dora' },
        owningPackName: 'DORA',
        description: 'ICT contractual arrangements with critical providers (DORA Art. 30)',
    },
    // =========================================================================
    // TODO: remaining ~137 vertical packs — assign tier in PR-C
    // These are safe defaults (base) so the validator allows them and emits
    // a warning. They will be reclassified incrementally.
    // =========================================================================
    // TODO: assign tier in PR-C — FedRAMP
    // { capability: 'fedramp_authorization_gate', tier: { kind: 'base' }, description: '...' },
    // TODO: assign tier in PR-C — CCPA
    // { capability: 'ccpa_opt_out_processing', tier: { kind: 'base' }, description: '...' },
    // TODO: assign tier in PR-C — CMMC
    // { capability: 'cmmc_cui_protection', tier: { kind: 'base' }, description: '...' },
    // TODO: assign tier in PR-C — HITRUST
    // { capability: 'hitrust_control_inheritance', tier: { kind: 'base' }, description: '...' },
    // (add additional TODO entries here as new packs are catalogued)
];
// ---------------------------------------------------------------------------
// Lookup helpers
// ---------------------------------------------------------------------------
/**
 * Look up a capability by its ID. Returns undefined for capabilities not yet
 * catalogued (the validator treats those as base tier — allow with warning).
 */
export function lookupCapability(cap) {
    return CAPABILITY_CATALOG.find((c) => c.capability === cap);
}
/**
 * Returns the list of pack IDs that are bundled (licensed at no extra cost)
 * when the customer holds a license for `parentPackId` in the context of `group`.
 *
 * Convention: capability-catalog uses snake_case pack IDs (e.g. 'iso_27001', 'gdpr').
 *
 * Rules:
 *   - 'iso_27001' is always bundled (universal baseline).
 *   - 'gdpr' is bundled when the group's jurisdiction covers the EU or an EU member state.
 *
 * The parentPackId itself is excluded from the result to prevent self-listing.
 *
 * **Licensing-layer only.** Customer who licenses this group gets these packs
 * licensed too (free, capability-bundling). Per-agent BINDING + per-rule
 * VERIFICATION remain explicit customer actions in the wizard.
 */
export function bundledPackIds(parentPackId, group) {
    const bundled = ['iso_27001'];
    if (group && groupBundlesGdpr(group)) {
        bundled.push('gdpr');
    }
    return bundled.filter((p) => p !== parentPackId);
}
/**
 * Check whether a capability requires a vertical pack license that the org does
 * not currently hold.
 *
 * Returns false if the capability is base or company_pack tier, or if the org
 * holds the required pack license, or if the capability's owning pack is bundled
 * via `group` (ISO 27001 universal baseline; GDPR for EU/Global groups).
 *
 * Returns { packId, packName } if the capability is vertical-gated and the org
 * is NOT licensed for the owning pack (and it is not bundled via group).
 *
 * @param cap            - capability ID being checked
 * @param licensedPacks  - pack IDs the org has explicitly licensed
 * @param group          - optional purchased group (enables bundle-licensing check)
 */
export function isUnlicensed(cap, licensedPacks, group) {
    const entry = lookupCapability(cap);
    if (!entry || entry.tier.kind !== 'vertical')
        return false;
    const packId = entry.tier.packId;
    if (licensedPacks.includes(packId))
        return false;
    // Check if the owning pack is bundled via the group license (licensing-layer).
    // The parent pack for bundling is the first explicitly licensed vertical pack,
    // or an empty string when no explicit vertical packs are licensed yet.
    const primaryPackId = licensedPacks[0] ?? '';
    if (bundledPackIds(primaryPackId, group).includes(packId))
        return false;
    return { packId, packName: entry.owningPackName };
}
//# sourceMappingURL=capability-catalog.js.map