"""Canonical TIER_CONFIG dict — single source of truth for tier enforcement.

Mirrors backend/shared/tier_config.py. Both CLI and backend import
the same canonical structure.
"""

from __future__ import annotations

VALID_TIERS: tuple[str, ...] = (
    "community",
    "pro",
    "team",
    "agency",
    "enterprise",
    "enterprise_unlimited",
)

ALL_FRAMEWORKS: frozenset[str] = frozenset(
    [
        "soc2",
        "cis_gcp",
        "cis_azure",
        "cis_aws",
        "hipaa",
        "iso27001",
        "pci_dss",
        "gdpr",
        "nist_800_53",
        "nist_csf_2",
        "ccpa",
        "nis2",
        "dora",
        "bsi_c5",
        "ens",
        "irap",
        "k_isms_p",
        "mtcs",
        "ospar",
        "phipa",
        "ismap",
        "lgpd",
        "popia",
        "csa_ccm",
        "hitrust",
        "sox_it",
        "fedramp",
        "cmmc",
        "cjis",
        "fisma",
        "nerc_cip",
        "tx_ramp",
        "stateramp",
        "glba",
        "ferpa",
        "itar",
        "nca_ecc",
        "nca_dcc",
        "nca_tcc",
        "nca_cscc",
        "nca_osmacc",
        "nca_cgiot",
        "nca_otcc",
        "nca_telework",
        "sama_csf",
        "uae_ia",
        "nca_ccc",
        "desc_csp",
        "cbb_cloud",
        "cbk_corf",
        "nia_qatar",
        "citra_kuwait",
        "mtcit_oman",
    ]
)

FREE_FRAMEWORKS: frozenset[str] = frozenset(
    [
        "soc2",
        "cis_gcp",
        "cis_azure",
        "cis_aws",
    ]
)

ME_FRAMEWORKS: frozenset[str] = frozenset(
    [
        "nca_ecc",
        "nca_dcc",
        "nca_tcc",
        "nca_cscc",
        "nca_osmacc",
        "nca_cgiot",
        "nca_otcc",
        "nca_telework",
        "sama_csf",
        "uae_ia",
        "nca_ccc",
        "desc_csp",
        "cbb_cloud",
        "cbk_corf",
        "nia_qatar",
        "citra_kuwait",
        "mtcit_oman",
    ]
)

TIER_CONFIG: dict[str, dict[str, object]] = {
    "community": {
        "price_annual": 0,
        "project_limit": 1,
        "batch_limit": None,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": [
            "soc2",
            "cis_gcp",
            "cis_azure",
            "cis_aws",
        ],
        "scan_sources": ["local_state"],
        "features": [],
        "retention_months": None,
        "dormancy_days": None,
    },
    "pro": {
        "price_annual": 599,
        "project_limit": 1,
        "batch_limit": 10,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": [
            "soc2",
            "cis_gcp",
            "cis_azure",
            "cis_aws",
            "hipaa",
            "iso27001",
            "pci_dss",
            "gdpr",
            "nist_800_53",
            "nist_csf_2",
            "ccpa",
        ],
        "scan_sources": [
            "local_state",
            "gcs",
            "s3",
            "azure_blob",
            "tfc",
        ],
        "features": [
            "html_report",
            "github_action",
            "checkov_custom",
            "multi_state_remediate",
            "batch_scan_assess",
            "pr_remediation",
            "ai_explain",
        ],
        "retention_months": None,
        "dormancy_days": None,
    },
    "team": {
        "price_annual": 1999,
        "project_limit": 1,
        "batch_limit": 10,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": [
            "soc2",
            "cis_gcp",
            "cis_azure",
            "cis_aws",
            "hipaa",
            "iso27001",
            "pci_dss",
            "gdpr",
            "nist_800_53",
            "nist_csf_2",
            "ccpa",
            "nis2",
            "dora",
            "bsi_c5",
            "ens",
            "irap",
            "k_isms_p",
            "mtcs",
            "ospar",
            "phipa",
            "ismap",
            "lgpd",
            "popia",
            "csa_ccm",
        ],
        "scan_sources": [
            "local_state",
            "gcs",
            "s3",
            "azure_blob",
            "tfc",
            "cloud_api",
        ],
        "features": [
            "html_report",
            "github_action",
            "checkov_custom",
            "hosted_dashboard",
            "drift_alerts",
            "drift_event_driven",
            "opa_rego",
            "validation_api",
            "evidence_export_native",
            "iam_analysis",
            "cross_validation",
            "cost_impact",
            "sso_saml",
            "team_members",
            "audit_log",
            "webhooks",
            "data_residency",
            "shared_scan_links",
            "signed_attestations",
            "multi_state_remediate",
            "batch_scan_assess",
            "pr_remediation",
            "ai_explain",
        ],
        "retention_months": 6,
        "dormancy_days": None,
        "member_limit": 10,
        "available_regions": ["us", "eu"],
    },
    "agency": {
        "price_annual": 4999,
        "project_limit": 5,
        "batch_limit": 10,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": [
            "soc2",
            "cis_gcp",
            "cis_azure",
            "cis_aws",
            "hipaa",
            "iso27001",
            "pci_dss",
            "gdpr",
            "nist_800_53",
            "nist_csf_2",
            "ccpa",
            "nis2",
            "dora",
            "bsi_c5",
            "ens",
            "irap",
            "k_isms_p",
            "mtcs",
            "ospar",
            "phipa",
            "ismap",
            "lgpd",
            "popia",
            "csa_ccm",
            "hitrust",
            "sox_it",
            "fedramp",
            "cmmc",
            "cjis",
            "fisma",
            "nerc_cip",
            "tx_ramp",
            "stateramp",
            "glba",
            "ferpa",
            "itar",
        ],
        "scan_sources": [
            "local_state",
            "gcs",
            "s3",
            "azure_blob",
            "tfc",
            "cloud_api",
        ],
        "features": [
            "html_report",
            "github_action",
            "checkov_custom",
            "hosted_dashboard",
            "drift_alerts",
            "drift_event_driven",
            "opa_rego",
            "validation_api",
            "branded_pdf",
            "multi_project_dashboard",
            "evidence_export_native",
            "evidence_export_grc",
            "evidence_export_batch",
            "batch_scan",
            "iam_analysis",
            "cross_validation",
            "cost_impact",
            "sso_saml",
            "team_members",
            "audit_log",
            "webhooks",
            "data_residency",
            "shared_scan_links",
            "signed_attestations",
            "multi_state_remediate",
            "batch_scan_assess",
            "batch_remediate",
            "pr_remediation",
            "ai_explain",
        ],
        "retention_months": 12,
        "dormancy_days": 90,
        "member_limit": 25,
        "available_regions": ["us", "eu"],
        "overage_brackets": [
            {"min": 6, "max": 10, "per_engagement_month": 99},
            {"min": 11, "max": 20, "per_engagement_month": 79},
            {"min": 21, "max": None, "per_engagement_month": 59},
        ],
    },
    "enterprise": {
        "price_annual": 24999,
        "project_limit": 5,
        "batch_limit": 10,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": ["all"],
        "scan_sources": [
            "local_state",
            "gcs",
            "s3",
            "azure_blob",
            "tfc",
            "cloud_api",
        ],
        "features": [
            "html_report",
            "github_action",
            "checkov_custom",
            "hosted_dashboard",
            "drift_alerts",
            "drift_event_driven",
            "opa_rego",
            "validation_api",
            "branded_pdf",
            "multi_project_dashboard",
            "evidence_export_native",
            "evidence_export_grc",
            "evidence_export_batch",
            "batch_scan",
            "iam_analysis",
            "cross_validation",
            "cost_impact",
            "sso_saml",
            "enforce_sso",
            "scim_provisioning",
            "air_gap",
            "data_residency",
            "team_members",
            "audit_log",
            "webhooks",
            "ip_allowlist",
            "shared_scan_links",
            "signed_attestations",
            "annual_fw_revision_email",
            "multi_state_remediate",
            "batch_scan_assess",
            "batch_remediate",
            "pr_remediation",
            "ai_explain",
        ],
        "retention_months": 24,
        "dormancy_days": 90,
        "member_limit": 50,
        "available_regions": ["us", "eu", "me"],
        "overage_brackets": [
            {"min": 6, "max": 10, "per_engagement_month": 4999},
            {"min": 11, "max": 20, "per_engagement_month": 3999},
            {"min": 21, "max": None, "per_engagement_month": 2999},
        ],
    },
    "enterprise_unlimited": {
        "price_annual": 99999,
        "project_limit": None,
        "batch_limit": 10,
        "discover_limit": 50,
        "assess_frameworks": ["all"],
        "remediate_frameworks": ["all"],
        "scan_sources": [
            "local_state",
            "gcs",
            "s3",
            "azure_blob",
            "tfc",
            "cloud_api",
        ],
        "features": [
            "html_report",
            "github_action",
            "checkov_custom",
            "hosted_dashboard",
            "drift_alerts",
            "drift_event_driven",
            "opa_rego",
            "validation_api",
            "branded_pdf",
            "multi_project_dashboard",
            "evidence_export_native",
            "evidence_export_grc",
            "evidence_export_batch",
            "batch_scan",
            "iam_analysis",
            "cross_validation",
            "cost_impact",
            "sso_saml",
            "enforce_sso",
            "scim_provisioning",
            "air_gap",
            "data_residency",
            "team_members",
            "audit_log",
            "webhooks",
            "ip_allowlist",
            "shared_scan_links",
            "signed_attestations",
            "annual_fw_revision_email",
            "custom_sub_framework",
            "dedicated_slack_support",
            "multi_state_remediate",
            "batch_scan_assess",
            "batch_remediate",
            "pr_remediation",
            "ai_explain",
        ],
        "retention_months": None,
        "dormancy_days": None,
        "member_limit": None,
        "available_regions": ["us", "eu", "me"],
    },
}


def get_tier_config(tier: str) -> dict[str, object]:
    """Lookup tier config. Raises KeyError on invalid tier."""
    return TIER_CONFIG[tier]
