/**
 * capability-catalog-bundle-licensing.test.ts
 *
 * Tests for bundledPackIds() and the extended isUnlicensed() in capability-catalog.ts.
 *
 * Thomas Layer 0 directive 2026-05-22 01:00 (clarification):
 *   License-layer bundling — ISO 27001 + GDPR are licensed at the org level
 *   when the customer buys a group pack. isUnlicensed() must accept these
 *   capabilities without raising an "unlicensed" rejection, even if the packs
 *   are not in the explicit licensedPacks[] list.
 *
 * Test IDs:
 *   CB-1   bundledPackIds('hipaa', usGroup) → ['iso_27001']
 *   CB-2   bundledPackIds('eu-mdr', euGroup) → ['iso_27001', 'gdpr']
 *   CB-3   bundledPackIds excludes parentPackId itself from the result
 *   CB-4   isUnlicensed: HIPAA capability is not unlicensed when hipaa is licensed
 *   CB-5   isUnlicensed: ISO 27001 capability NOT unlicensed for US group (bundled)
 *   CB-6   isUnlicensed: GDPR capability IS unlicensed for US group (not bundled)
 *   CB-7   isUnlicensed: GDPR capability NOT unlicensed for EU group (bundled)
 *   CB-8   isUnlicensed: base capabilities are never unlicensed (no group needed)
 *   CB-9   isUnlicensed: unknown capability returns false (graceful degrade)
 *   CB-10  bundledPackIds: without group, only iso_27001 is returned (no gdpr)
 *
 * Step 5 RED→GREEN:
 *   RED  (before): bundledPackIds did not exist; isUnlicensed did not accept group arg.
 *   GREEN (after): all CB tests pass.
 */
import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { bundledPackIds, isUnlicensed } from '../capability-catalog.js';
// ---------------------------------------------------------------------------
// Minimal VerticalGroup fixtures (no DB access needed)
// ---------------------------------------------------------------------------
function makePack(id, jurisdiction) {
    return {
        id,
        name: id,
        shortName: id,
        description: '',
        jurisdiction,
        vertical: 'Healthcare',
        priority: 'P1',
        status: 'ACTIVE',
        frameworkCategory: 'sector-specific',
        keyRequirements: [],
        aiRelevance: '',
        crossIndustry: false,
        pricing: { tier: '6000', monthlyUsd: 500, annualUsd: 5100 },
    };
}
const US_HEALTHCARE_GROUP = {
    groupKey: 'healthcare-us',
    vertical: 'Healthcare',
    jurisdiction: 'US',
    displayName: 'US Healthcare',
    description: '',
    packs: [makePack('hipaa', 'US'), makePack('hitech', 'US')],
    priceAnnualUsd: 4000,
    includedBaselinePacks: ['iso27001'],
};
const EU_HEALTHCARE_GROUP = {
    groupKey: 'healthcare-eu',
    vertical: 'Healthcare',
    jurisdiction: 'EU',
    displayName: 'EU Healthcare',
    description: '',
    packs: [makePack('eu-mdr', 'EU'), makePack('eu_ai_act', 'EU')],
    priceAnnualUsd: 4000,
    includedBaselinePacks: ['iso27001', 'gdpr'],
};
// ---------------------------------------------------------------------------
// CB-1: bundledPackIds for US group
// ---------------------------------------------------------------------------
describe('CB-1: bundledPackIds for US group', () => {
    it('returns ["iso_27001"] for hipaa + US group', () => {
        assert.deepEqual(bundledPackIds('hipaa', US_HEALTHCARE_GROUP), ['iso_27001']);
    });
    it('returns ["iso_27001"] for hitech + US group', () => {
        assert.deepEqual(bundledPackIds('hitech', US_HEALTHCARE_GROUP), ['iso_27001']);
    });
});
// ---------------------------------------------------------------------------
// CB-2: bundledPackIds for EU group
// ---------------------------------------------------------------------------
describe('CB-2: bundledPackIds for EU group', () => {
    it('returns ["iso_27001", "gdpr"] for eu-mdr + EU group', () => {
        assert.deepEqual(bundledPackIds('eu-mdr', EU_HEALTHCARE_GROUP), ['iso_27001', 'gdpr']);
    });
    it('returns ["iso_27001", "gdpr"] for eu_ai_act + EU group', () => {
        assert.deepEqual(bundledPackIds('eu_ai_act', EU_HEALTHCARE_GROUP), ['iso_27001', 'gdpr']);
    });
});
// ---------------------------------------------------------------------------
// CB-3: bundledPackIds excludes the parentPackId
// ---------------------------------------------------------------------------
describe('CB-3: bundledPackIds excludes parentPackId', () => {
    it('excludes iso_27001 when parentPackId is iso_27001', () => {
        const result = bundledPackIds('iso_27001', US_HEALTHCARE_GROUP);
        assert.equal(result.includes('iso_27001'), false);
    });
    it('excludes gdpr when parentPackId is gdpr in EU group', () => {
        const result = bundledPackIds('gdpr', EU_HEALTHCARE_GROUP);
        assert.equal(result.includes('gdpr'), false);
        assert.equal(result.includes('iso_27001'), true);
    });
});
// ---------------------------------------------------------------------------
// CB-4: isUnlicensed — HIPAA capability passes when hipaa is licensed
// ---------------------------------------------------------------------------
describe('CB-4: isUnlicensed — HIPAA capability is not unlicensed', () => {
    it('phi_redaction is licensed when hipaa is in licensedPacks', () => {
        assert.equal(isUnlicensed('phi_redaction', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
    it('minimum_necessary_rule is licensed when hipaa is in licensedPacks', () => {
        assert.equal(isUnlicensed('minimum_necessary_rule', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
});
// ---------------------------------------------------------------------------
// CB-5: isUnlicensed — ISO 27001 capability NOT unlicensed for US group (bundled)
// ---------------------------------------------------------------------------
describe('CB-5: isUnlicensed — ISO 27001 bundled for US group', () => {
    it('isms_policy_gate is NOT unlicensed for US group with hipaa licensed (iso_27001 bundled)', () => {
        assert.equal(isUnlicensed('isms_policy_gate', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
    it('access_control_policy is NOT unlicensed for US group (iso_27001 bundled)', () => {
        assert.equal(isUnlicensed('access_control_policy', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
    it('cryptography_policy is NOT unlicensed for US group (iso_27001 bundled)', () => {
        assert.equal(isUnlicensed('cryptography_policy', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
});
// ---------------------------------------------------------------------------
// CB-6: isUnlicensed — GDPR capability IS unlicensed for US group
// ---------------------------------------------------------------------------
describe('CB-6: isUnlicensed — GDPR capability unlicensed for US group', () => {
    it('data_subject_request IS unlicensed for US group (gdpr not bundled)', () => {
        const result = isUnlicensed('data_subject_request', ['hipaa'], US_HEALTHCARE_GROUP);
        assert.notEqual(result, false);
        assert.equal(typeof result, 'object');
        assert.equal(result.packId, 'gdpr');
    });
    it('right_to_erasure IS unlicensed for US group', () => {
        const result = isUnlicensed('right_to_erasure', ['hipaa'], US_HEALTHCARE_GROUP);
        assert.notEqual(result, false);
        assert.equal(result.packId, 'gdpr');
    });
});
// ---------------------------------------------------------------------------
// CB-7: isUnlicensed — GDPR capability NOT unlicensed for EU group (bundled)
// ---------------------------------------------------------------------------
describe('CB-7: isUnlicensed — GDPR capability bundled for EU group', () => {
    it('data_subject_request is NOT unlicensed for EU group (gdpr bundled)', () => {
        assert.equal(isUnlicensed('data_subject_request', ['hipaa'], EU_HEALTHCARE_GROUP), false);
    });
    it('right_to_erasure is NOT unlicensed for EU group', () => {
        assert.equal(isUnlicensed('right_to_erasure', ['hipaa'], EU_HEALTHCARE_GROUP), false);
    });
    it('consent_management is NOT unlicensed for EU group', () => {
        assert.equal(isUnlicensed('consent_management', ['hipaa'], EU_HEALTHCARE_GROUP), false);
    });
});
// ---------------------------------------------------------------------------
// CB-8: isUnlicensed — base capabilities always return false
// ---------------------------------------------------------------------------
describe('CB-8: isUnlicensed — base capabilities never unlicensed', () => {
    it('tool_use_logging (base) is never unlicensed without group', () => {
        assert.equal(isUnlicensed('tool_use_logging', [], undefined), false);
    });
    it('tool_use_logging (base) is never unlicensed with US group', () => {
        assert.equal(isUnlicensed('tool_use_logging', [], US_HEALTHCARE_GROUP), false);
    });
    it('audit_chain_integrity (base) is never unlicensed', () => {
        assert.equal(isUnlicensed('audit_chain_integrity', [], undefined), false);
    });
    it('circuit_breaker (base) is never unlicensed', () => {
        assert.equal(isUnlicensed('circuit_breaker', [], undefined), false);
    });
});
// ---------------------------------------------------------------------------
// CB-9: isUnlicensed — unknown capability returns false (graceful degrade)
// ---------------------------------------------------------------------------
describe('CB-9: isUnlicensed — unknown capability gracefully degrades', () => {
    it('returns false for an unknown capability with no group', () => {
        assert.equal(isUnlicensed('capability_not_in_catalog_xyz', [], undefined), false);
    });
    it('returns false for an unknown capability with a group', () => {
        assert.equal(isUnlicensed('capability_not_in_catalog_xyz', ['hipaa'], US_HEALTHCARE_GROUP), false);
    });
});
// ---------------------------------------------------------------------------
// CB-10: bundledPackIds — without group, only iso_27001 is returned
// ---------------------------------------------------------------------------
describe('CB-10: bundledPackIds without group', () => {
    it('returns ["iso_27001"] when no group is provided', () => {
        assert.deepEqual(bundledPackIds('hipaa', undefined), ['iso_27001']);
    });
    it('does NOT return gdpr when no group is provided', () => {
        assert.equal(bundledPackIds('hipaa', undefined).includes('gdpr'), false);
    });
    it('returns empty array when parentPackId is iso_27001 and no group', () => {
        assert.deepEqual(bundledPackIds('iso_27001', undefined), []);
    });
});
//# sourceMappingURL=capability-catalog-bundle-licensing.test.js.map