{
  "_note": "Maps entitlement product taxonomy (Product BU / Family / Midfamily / Subfamily substrings, case-insensitive regex) to capability ids. Matching runs LOCALLY in scripts/import_entitlements.py — no LLM. Families that match nothing are logged to output/state/entitlement_unmapped.json; extend this map from that log.",
  "patterns": [
    {"match": "VSAN",                          "capability": "cap_vmw_vsan"},
    {"match": "VSPHERE|VVS|VVEP|ESXI",         "capability": "cap_vmw_vsphere"},
    {"match": "\\bVCF\\b|CLOUD FOUNDATION",     "capability": "cap_vmw_vcf"},
    {"match": "NSX|VDEFEND",                   "capability": "cap_vmw_nsx"},
    {"match": "\\bAVI\\b|LOAD BALANC",          "capability": "cap_vmw_avi"},
    {"match": "ARIA|VREALIZE|VCF OPS|OPERATIONS MGMT", "capability": "cap_vmw_aria"},
    {"match": "TANZU|KUBERNETES",              "capability": "cap_vmw_tanzu"},
    {"match": "WORKSPACE ONE|WS1|AIRWATCH",    "capability": "cap_vmw_workspaceone"},
    {"match": "HORIZON",                       "capability": "cap_vmw_horizon"},
    {"match": "SITE RECOVERY|LIVE RECOVERY|SRM|RANSOMWARE", "capability": "cap_vmw_live_recovery"},
    {"match": "\\bHCX\\b",                      "capability": "cap_vmw_hcx"},
    {"match": "PRIVATE AI",                    "capability": "cap_vmw_private_ai"},

    {"match": "ENDEVOR",                       "capability": "cap_mf_endevor"},
    {"match": "BRIGHTSIDE|ZOWE",               "capability": "cap_mf_brightside"},
    {"match": "\\bIDMS\\b",                     "capability": "cap_mf_idms"},
    {"match": "DATACOM",                       "capability": "cap_mf_datacom"},
    {"match": "DB2",                           "capability": "cap_mf_db2tools"},
    {"match": "TOP SECRET|ACF2|ACF-2",         "capability": "cap_mf_security"},
    {"match": "COMPLIANCE EVENT|DATA CONTENT DISCOVERY|CLEANUP", "capability": "cap_mf_compliance"},
    {"match": "OPS/MVS|OPSMVS",                "capability": "cap_mf_automation"},
    {"match": "SYSVIEW",                       "capability": "cap_mf_sysview"},
    {"match": "MAINFRAME OPERATIONAL INTELLIGENCE|\\bMOI\\b", "capability": "cap_mf_aiops"},
    {"match": "CA 7|CA7|CA-7",                 "capability": "cap_mf_workload_automation"},
    {"match": "NETMASTER",                     "capability": "cap_mf_network"},
    {"match": "VANTAGE|DISK BACKUP",           "capability": "cap_mf_storage"},

    {"match": "RALLY|AGILE CENTRAL",           "capability": "cap_es_rally"},
    {"match": "CLARITY|PPM",                   "capability": "cap_es_clarity"},
    {"match": "VALUEOPS|CONNECTALL",           "capability": "cap_es_valueops_insights"},
    {"match": "\\bAPM\\b|APP.*PERFORMANCE|INTROSCOPE|WILY", "capability": "cap_es_dx_apm"},
    {"match": "DX OPERATIONAL|DX AIOPS|DX O2", "capability": "cap_es_dx_aiops"},
    {"match": "NETOPS|SPECTRUM|PERFORMANCE MGMT.*NET", "capability": "cap_es_dx_netops"},
    {"match": "APPNETA",                       "capability": "cap_es_appneta"},
    {"match": "AUTOMIC|AUTOSYS|WORKLOAD AUTOMATION", "capability": "cap_es_automation"},
    {"match": "LAYER ?7|API MANAGEMENT|API GATEWAY", "capability": "cap_es_layer7"},

    {"match": "SITEMINDER|ACCESS MANAGEMENT|\\bSSO\\b", "capability": "cap_iam_siteminder"},
    {"match": "\\bVIP\\b.*AUTH|SYMANTEC VIP",  "capability": "cap_iam_vip"},
    {"match": "\\bPAM\\b|PRIVILEGED",           "capability": "cap_iam_pam"},
    {"match": "IDENTITY (GOVERNANCE|SUITE|MANAGER)|\\bIGA\\b", "capability": "cap_iam_iga"},
    {"match": "DIRECTORY",                     "capability": "cap_iam_directory"},
    {"match": "ADVANCED AUTH|AUTH HUB",        "capability": "cap_iam_advauth"}
  ]
}