/**
 * AmazonQDeveloperIdeAdapter -- Amazon Q Developer adapter.
 *
 * Amazon Q Developer (formerly CodeWhisperer) ships with every AWS Bedrock
 * shop. This adapter is the natural pair with the Bedrock AgentCore
 * orchestrator adapter (P3-SUB-ADAPT-03, src/orchestrator-adapters/
 * bedrock-agentcore.ts): the same BAA region list applies directly.
 *
 * Hook surfaces:
 *   Standard six (shared with GitHub Copilot contract):
 *   completionRequested(file, cursor, context) -- pre-completion gate.
 *   completionReceived(completion, context) -- post-completion ingress.
 *   chatRequested(prompt, context) -- pre-chat gate.
 *   chatReceived(response) -- post-chat ingress classification.
 *   suggestionAccepted(suggestion, targetFile) -- audit on acceptance.
 *   suggestionRejected(suggestion, reason) -- optional audit.
 *
 *   Amazon Q-specific surfaces:
 *   awsResourceOperationRequested(resource, operation) -- Q Developer's
 *     "agent for AWS" feature can create/modify/delete AWS resources.
 *     High-risk egress path routed through G4 Destructive Command Guard
 *     equivalent. (PT-ADAPT-AMAZONQ-3)
 *   iamPolicyGenerationRequested(role, intent) -- Q Developer writes IAM
 *     policies. Adapter runs a policy-safety classifier (wildcards, missing
 *     MFA, etc.) before return. Under PCI/HIPAA, routes to named reviewer.
 *     (PT-ADAPT-AMAZONQ-2)
 *   codeTransformRequested(project, targetVersion) -- whole-project Java
 *     modernization. Surfaces as bulk refactor subject to pack-binding
 *     rules. Audit chain needs project-level provenance.
 *
 * AWS-specific considerations:
 *   - Q Developer runs on AWS native; Bedrock BAA region list applies.
 *     (PT-ADAPT-AMAZONQ-1)
 *   - IAM policy generation output classifies as "infrastructure-change"
 *     DataClass; routes to named AWS reviewer when PCI or HIPAA is bound.
 *   - Code Transform workflows touch source code at scale; audit chain
 *     carries project-level provenance (projectName + targetVersion).
 *
 * Spec: P3-SUB-IDE-04
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity, type ReviewerTier } from './index';
export declare const AMAZON_Q_BAA_REGIONS: readonly string[];
/**
 * AWS resource operation verbs classified by risk level.
 * High-risk operations (DELETE, TERMINATE, DISASSOCIATE) route to a named
 * reviewer via the G4 Destructive Command Guard equivalent.
 */
export type AwsResourceOperation = 'CreateBucket' | 'DeleteBucket' | 'PutObject' | 'DeleteObject' | 'CreateFunction' | 'DeleteFunction' | 'CreateRole' | 'DeleteRole' | 'AttachRolePolicy' | 'DetachRolePolicy' | 'CreateSecurityGroup' | 'DeleteSecurityGroup' | 'RunInstances' | 'TerminateInstances' | 'CreateCluster' | 'DeleteCluster' | string;
export interface AmazonQDeveloperAdapterConfig extends IdeAdapterConfig {
    /**
     * AWS region where Amazon Q Developer is running.
     * Used to enforce BAA region compliance under HIPAA binding.
     * Default: 'us-east-1'
     */
    awsRegion?: string;
    /** Reviewer tier for IAM policy review. Default: T3_SECURITY */
    iamReviewerTier?: ReviewerTier;
    /** Reviewer tier for destructive AWS resource operations. Default: T3_SECURITY */
    destructiveOperationReviewerTier?: ReviewerTier;
    /** Reviewer tier for HIPAA/PHI completions. Default: T2_LEAD */
    hipaaReviewerTier?: ReviewerTier;
}
export interface AmazonQResourceOperationContext {
    resourceType: string;
    operation: AwsResourceOperation;
    resourceArn?: string;
    region?: string;
    sessionId?: string;
}
export interface AmazonQIamPolicyContext {
    roleName: string;
    intent: string;
    policyDocument?: string;
    sessionId?: string;
}
export interface AmazonQCodeTransformContext {
    projectName: string;
    targetVersion: string;
    language?: string;
    estimatedFilesCount?: number;
    sessionId?: string;
}
export declare class AmazonQDeveloperIdeAdapter extends BaseIdeAdapter {
    readonly adapterId = "amazon-q-developer";
    readonly ideId = "amazon-q-developer";
    private aqConfig;
    initialize(config: IdeAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    interceptToolInvocation(ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    private _gateCompletionRequest;
    private _scanCompletionResponse;
    private _gateChatRequest;
    private _scanChatResponse;
    private _auditSuggestionAccepted;
    private _auditSuggestionRejected;
    awsResourceOperationRequested(ctx: AmazonQResourceOperationContext): Promise<ToolInvocationDecision>;
    iamPolicyGenerationRequested(ctx: AmazonQIamPolicyContext): Promise<ToolInvocationDecision>;
    codeTransformRequested(ctx: AmazonQCodeTransformContext): Promise<ToolInvocationDecision>;
    private _gateAwsResourceOperation;
    private _gateIamPolicyGeneration;
    private _gateCodeTransform;
    getIdeCapabilities(): IdeAdapterCapabilities;
    translateError(raw: unknown): import('./index').IdeAdapterError;
    private _scanForSecrets;
    private _scanForPhiIndicators;
    private _isHipaaOrPciBinding;
    /**
     * Classify an IAM policy document string for unsafe patterns.
     * Returns array of finding names. Empty = safe.
     */
    private _classifyIamPolicy;
    /**
     * Check BAA region compliance. Returns a DENY decision if the configured
     * region is not BAA-eligible under a regulated pack binding, or null.
     * (PT-ADAPT-AMAZONQ-1)
     */
    private _checkBaaRegion;
    /** Expose the configured AWS region for diagnostics / tests. */
    getAwsRegion(): string;
}
//# sourceMappingURL=amazon-q-developer.d.ts.map