/**
 * CopilotStudioAdapter -- Microsoft Copilot Studio IDE adapter.
 *
 * Microsoft Copilot Studio is a low-code agent builder inside Microsoft's
 * Power Platform ecosystem. It is DISTINCT from GitHub Copilot (autocomplete)
 * and M365 Copilot (productivity assistant). Copilot Studio lets business
 * analysts, IT admins, and citizen developers build organization-specific
 * copilots and agents using natural-language descriptions, topic graphs,
 * Power Automate flows, custom connectors, MCP servers, and knowledge sources.
 *
 * Target users: non-developers with elevated organizational trust. A Copilot
 * Studio agent can be published to Microsoft Teams, M365 Copilot, the public
 * web, or custom channels -- giving it organizational-grade reach from a
 * low-code interface. The governance challenges are distinct from developer IDE
 * adapters:
 *   - Agents are described in natural language; purpose must be recorded.
 *   - Knowledge sources span corporate SharePoint, Dataverse, and the public
 *     web; data residency depends on the source type.
 *   - Connectors can egress to public internet; in government / sovereign mode
 *     this creates a data-residency violation.
 *   - Publishing to "public web" channel from government / sovereign tenants is
 *     an unconditional compliance violation.
 *   - Governance Center policy changes are admin-only; citizen developers must
 *     not trigger them.
 *
 * Deployment modes (three, matching Microsoft's actual cloud segmentation):
 *   copilot-studio-cloud       -- standard commercial cloud (default)
 *   copilot-studio-government  -- GCC / GCC-High / DoD; strict data residency;
 *                                 public-web channel and public-website knowledge
 *                                 sources denied unconditionally; connectors
 *                                 restricted to Microsoft-internal allow-list.
 *   copilot-studio-sovereign   -- regulated-industry sovereign cloud; all
 *                                 government restrictions PLUS Governance Center
 *                                 policy changes require admin approval.
 *
 * Hook surfaces (8 distinct governable surfaces):
 *
 *   agentBuildRequested(agentDescription, agentOwner)
 *     Describes an agent in natural language; Studio generates skill/topic graph.
 *     REQUIRES non-empty agentDescription (governance must identify purpose).
 *     REQUIRES non-empty agentOwner (tenant identity).
 *     Reason codes: copilot-studio-agent-description-required,
 *                   copilot-studio-agent-owner-required.
 *
 *   topicCreationRequested(topicName, topicDescription)
 *     Adds a new conversational topic to an agent.
 *     Audited; no specific deny conditions beyond packBinding.
 *
 *   actionDefinitionRequested(actionName, actionBody)
 *     Defines a tool/action the agent can call (Power Automate flow, custom
 *     connector, MCP server, etc.).
 *     In copilot-studio-government: scan action body for embedded URLs; any URL
 *     host outside allowedConnectorPrefixes is denied.
 *     Reason code: copilot-studio-action-egress-not-permitted.
 *
 *   connectorAddRequested(connectorId, connectorType)
 *     Wires up a Microsoft / third-party connector (Dataverse, SharePoint,
 *     Outlook, custom HTTP).
 *     In copilot-studio-government: connectors NOT in allowedConnectorPrefixes
 *     (default Microsoft-only) are denied. Connectors implying public-internet
 *     egress are denied unless explicitly allowlisted.
 *     Reason code: copilot-studio-connector-not-permitted-government.
 *
 *   knowledgeSourceAddRequested(sourceType, sourceUri)
 *     Adds a knowledge source (SharePoint, public website, uploaded files,
 *     Dataverse table).
 *     In copilot-studio-government: 'public-website' source is denied
 *     unconditionally.
 *     If allowedKnowledgeSources is configured: only listed source types allowed.
 *     Reason codes: copilot-studio-knowledge-source-public-website-not-permitted-government,
 *                   copilot-studio-knowledge-source-not-permitted.
 *
 *   publishRequested(channel, version)
 *     Publishes the agent to a channel (Teams, M365 Copilot, public web, custom).
 *     In copilot-studio-government: 'public-web' denied unconditionally.
 *     In copilot-studio-sovereign: 'public-web' denied + admin approval required
 *     for any publish.
 *     If allowedChannels configured: only listed channels allowed.
 *     Reason codes: copilot-studio-public-channel-not-permitted-government,
 *                   copilot-studio-channel-not-permitted,
 *                   copilot-studio-publish-requires-governance-approval.
 *
 *   governanceCenterPolicyRequested(policyName, policyBody)
 *     Admin tier: defines or updates governance policy for the tenant.
 *     REQUIRES requireGovernanceCenterApproval: true in config AND admin role
 *     in context. Non-admin denied unconditionally.
 *     Reason codes: copilot-studio-admin-only,
 *                   copilot-studio-governance-center-approval-required.
 *
 *   chatTestRequested(promptText)
 *     Test conversation in the design canvas.
 *     Scanned for secrets. Audited.
 *
 * Government / sovereign safeguards (the differentiators):
 *   - publishRequested: government/sovereign mode blocks 'public-web' channel.
 *   - connectorAddRequested: government mode blocks non-Microsoft connectors
 *     unless allowlisted.
 *   - knowledgeSourceAddRequested: government/sovereign mode blocks
 *     'public-website' source.
 *   - actionDefinitionRequested: government mode blocks action bodies referencing
 *     URLs outside allowedConnectorPrefixes.
 *   - governanceCenterPolicyRequested: sovereign mode requires admin approval.
 *
 * Pen-tests:
 *   PT-ADAPT-COPILOTSTUDIO-1: empty packBinding[] denied at every wrap call
 *   PT-ADAPT-COPILOTSTUDIO-2: tenant secrets / connection strings never appear
 *                              in audit entries
 *   PT-ADAPT-COPILOTSTUDIO-3: malformed config throws at construction (invalid
 *                              mode, conflicting tenantTier vs deployment mode)
 *   PT-ADAPT-COPILOTSTUDIO-4: government mode publish to public-web ALWAYS denied
 *                              with copilot-studio-public-channel-not-permitted-government
 *   PT-ADAPT-COPILOTSTUDIO-5: sovereign mode without admin approval ALWAYS denied
 *                              for governance-center policy changes
 *   PT-ADAPT-COPILOTSTUDIO-6: action definition egress URL outside allowlist in
 *                              government mode denied with
 *                              copilot-studio-action-egress-not-permitted
 *
 * Spec: P3-SUB-IDE-09
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity } from './index';
/**
 * Copilot Studio deployment modes.
 *
 *   copilot-studio-cloud       -- standard commercial Microsoft cloud (default)
 *   copilot-studio-government  -- GCC / GCC-High / DoD; strict data residency;
 *                                 public-internet egress controls enforced.
 *   copilot-studio-sovereign   -- regulated-industry sovereign cloud; all
 *                                 government restrictions plus admin-approval
 *                                 gate on Governance Center policy changes.
 */
export type CopilotStudioDeploymentMode = 'copilot-studio-cloud' | 'copilot-studio-government' | 'copilot-studio-sovereign';
export declare const COPILOT_STUDIO_VALID_DEPLOYMENT_MODES: readonly CopilotStudioDeploymentMode[];
/**
 * Tenant tiers and the deployment modes they are compatible with.
 *
 * commercial  -- copilot-studio-cloud
 * government  -- copilot-studio-government
 * gcc         -- copilot-studio-government
 * gcc-high    -- copilot-studio-government
 * dod         -- copilot-studio-government
 * sovereign   -- copilot-studio-sovereign
 */
export type CopilotStudioTenantTier = 'commercial' | 'government' | 'gcc' | 'gcc-high' | 'dod' | 'sovereign';
export declare const COPILOT_STUDIO_GOVERNMENT_TENANT_TIERS: readonly CopilotStudioTenantTier[];
export declare const COPILOT_STUDIO_VALID_TENANT_TIERS: readonly CopilotStudioTenantTier[];
/**
 * Channels available for agent publish. Governance mode affects which are permitted.
 *   teams        -- Microsoft Teams (permitted in all modes)
 *   m365-copilot -- M365 Copilot extension (permitted in all modes)
 *   public-web   -- Public website embed (BLOCKED in government / sovereign)
 *   custom       -- Custom channel via Direct Line / channel adapter
 */
export type CopilotStudioChannel = 'teams' | 'm365-copilot' | 'public-web' | 'custom';
export type CopilotStudioKnowledgeSourceType = 'sharepoint' | 'dataverse' | 'public-website' | 'uploaded-file';
/**
 * Default connector allow-list for government / sovereign mode.
 * Only connectors whose IDs begin with these prefixes are permitted.
 * All others require explicit configuration in allowedConnectorPrefixes.
 */
export declare const COPILOT_STUDIO_GOVERNMENT_DEFAULT_CONNECTOR_PREFIXES: readonly string[];
export interface CopilotStudioAdapterConfig extends IdeAdapterConfig {
    /**
     * Copilot Studio deployment mode. Required. No default.
     * Determines data-residency posture, channel permissions, and connector
     * allow-list defaults.
     */
    deploymentMode: CopilotStudioDeploymentMode;
    /**
     * Tenant tier. Optional. Must be compatible with deploymentMode.
     *   commercial -- only valid with copilot-studio-cloud
     *   government / gcc / gcc-high / dod -- only valid with copilot-studio-government
     *   sovereign  -- only valid with copilot-studio-sovereign
     *
     * Invariant: tenantTier must be compatible with deploymentMode. Throws at
     * construction if they conflict (e.g. gcc + copilot-studio-cloud).
     */
    tenantTier?: CopilotStudioTenantTier;
    /**
     * Data residency region identifier. Advisory; recorded in audit entries.
     * Examples: 'us-gov', 'eu-de', 'au-east'.
     */
    dataResidencyRegion?: string;
    /**
     * Channels the agent is permitted to publish to.
     * Defaults: cloud: all four; government/sovereign: ['teams', 'm365-copilot', 'custom'].
     * 'public-web' is ALWAYS excluded in government/sovereign regardless of this list.
     */
    allowedChannels?: CopilotStudioChannel[];
    /**
     * Connector id prefixes that are permitted in this environment.
     * Government/sovereign default: COPILOT_STUDIO_GOVERNMENT_DEFAULT_CONNECTOR_PREFIXES.
     * Cloud: no restriction (all connectors permitted).
     * Any prefix explicitly listed here overrides the default.
     */
    allowedConnectorPrefixes?: string[];
    /**
     * Knowledge source types that are permitted in this environment.
     * Government/sovereign default: ['sharepoint', 'dataverse', 'uploaded-file'].
     * 'public-website' is ALWAYS excluded in government/sovereign.
     * Cloud: no restriction (all source types permitted by default).
     */
    allowedKnowledgeSources?: CopilotStudioKnowledgeSourceType[];
    /**
     * When true, Governance Center policy operations require admin role in context
     * AND explicit approval from this flag. Default: false.
     * In sovereign mode, this is effectively forced true for all policy operations.
     */
    requireGovernanceCenterApproval?: boolean;
}
export interface CopilotStudioAgentBuildContext {
    /** Natural language description of the agent purpose. REQUIRED. */
    agentDescription: string;
    /** Tenant identity / owner of this agent. REQUIRED. */
    agentOwner: string;
    sessionId?: string;
}
export interface CopilotStudioTopicCreationContext {
    /** Name of the new conversational topic. */
    topicName: string;
    /** Optional description of the topic intent. */
    topicDescription?: string;
    sessionId?: string;
}
export interface CopilotStudioActionDefinitionContext {
    /** Name of the action / tool being defined. */
    actionName: string;
    /** Action body / configuration string (Power Automate JSON, connector spec, etc.). */
    actionBody?: string;
    sessionId?: string;
}
export interface CopilotStudioConnectorAddContext {
    /** Connector ID (e.g. 'shared_sharepointonline', 'shared_twitter'). */
    connectorId: string;
    /** Optional human-readable connector type label. */
    connectorType?: string;
    sessionId?: string;
}
export interface CopilotStudioKnowledgeSourceAddContext {
    /** Source type: sharepoint | dataverse | public-website | uploaded-file. */
    sourceType: CopilotStudioKnowledgeSourceType;
    /** Source URI or identifier. ADVISORY -- not used for gate logic. */
    sourceUri?: string;
    sessionId?: string;
}
export interface CopilotStudioPublishContext {
    /** Target channel for the publish operation. */
    channel: CopilotStudioChannel;
    /** Version label (advisory). */
    version?: string;
    sessionId?: string;
}
export interface CopilotStudioGovernancePolicyContext {
    /** Name of the governance policy being defined or updated. */
    policyName: string;
    /** Policy body / configuration. */
    policyBody?: string;
    /**
     * Role of the user performing this operation.
     * Must be 'admin' for governance-center policy operations to be permitted.
     */
    userRole?: string;
    sessionId?: string;
}
export interface CopilotStudioChatTestContext {
    /** Prompt text being tested in the design canvas. */
    promptText: string;
    sessionId?: string;
}
export declare class CopilotStudioAdapter extends BaseIdeAdapter {
    readonly adapterId = "copilot-studio";
    readonly ideId = "copilot-studio";
    private copilotConfig;
    initialize(config: IdeAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    interceptToolInvocation(ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    private _gateAgentBuildRequest;
    private _gateTopicCreationRequest;
    private _gateActionDefinitionRequest;
    private _gateConnectorAddRequest;
    private _gateKnowledgeSourceAddRequest;
    private _gatePublishRequest;
    private _gateGovernanceCenterPolicyRequest;
    private _gateChatTestRequest;
    wrapAgentBuild(ctx: CopilotStudioAgentBuildContext): Promise<ToolInvocationDecision>;
    wrapTopicCreation(ctx: CopilotStudioTopicCreationContext): Promise<ToolInvocationDecision>;
    wrapActionDefinition(ctx: CopilotStudioActionDefinitionContext): Promise<ToolInvocationDecision>;
    wrapConnectorAdd(ctx: CopilotStudioConnectorAddContext): Promise<ToolInvocationDecision>;
    wrapKnowledgeSourceAdd(ctx: CopilotStudioKnowledgeSourceAddContext): Promise<ToolInvocationDecision>;
    wrapPublish(ctx: CopilotStudioPublishContext): Promise<ToolInvocationDecision>;
    wrapGovernanceCenterPolicy(ctx: CopilotStudioGovernancePolicyContext): Promise<ToolInvocationDecision>;
    wrapChatTest(ctx: CopilotStudioChatTestContext): Promise<ToolInvocationDecision>;
    getIdeCapabilities(): IdeAdapterCapabilities;
    translateError(raw: unknown): import('./index').IdeAdapterError;
    getDeploymentMode(): CopilotStudioDeploymentMode;
    getTenantTier(): CopilotStudioTenantTier | undefined;
    getDataResidencyRegion(): string | undefined;
    isGovernmentMode(): boolean;
    isSovereignMode(): boolean;
    requiresGovernanceCenterApproval(): boolean;
    /**
     * Resolve the effective connector prefix allow-list.
     * Government/sovereign: use configured list or default Microsoft-only list.
     * Cloud: empty list (no connector restriction).
     */
    private _effectiveConnectorPrefixes;
}
//# sourceMappingURL=copilot-studio.d.ts.map