/**
 * ClaudeAgentSdkAdapter -- Orchestrator adapter for the Anthropic Claude Agent SDK
 * (Claude Managed Agents / claude-code-sdk / multi-agent orchestration layer).
 *
 * Hook surface: The Claude Agent SDK exposes agent lifecycle events as explicit
 * hooks. Customers wire the adapter by calling the six lifecycle methods below at
 * the corresponding points in their SDK integration:
 *
 *   const adapter = new ClaudeAgentSdkAdapter(cfg);
 *   adapter.initialize(orchCfg);
 *
 *   // At agent spawn:
 *   await adapter.agentStart(agentId, contextSnapshot);
 *
 *   // Before every tool invocation:
 *   await adapter.toolCall(agentId, tool, args);
 *
 *   // After every tool result returns:
 *   await adapter.toolResult(agentId, tool, result);
 *
 *   // Before the agent sends a message to the LLM:
 *   await adapter.llmCall(agentId, model, messages, tools);
 *
 *   // After the LLM response arrives:
 *   await adapter.llmResult(agentId, model, response);
 *
 *   // When the agent terminates:
 *   await adapter.agentEnd(agentId, outcome);
 *
 * Why this adapter is Rank 1:
 *   My-CC is itself built on Claude Code and dogfoods the Anthropic Agent SDK
 *   internally. Shipping a first-party adapter closes the credibility gap for
 *   the "we govern our own agents" claim and provides a reference implementation
 *   for every other adapter.
 *
 * Gate sequence at agentStart (fail-closed per Thomas philosophy):
 *   1. SubscriptionGate -- verify active subscription before any agent fires
 *   2. ChainTamperDetector -- verify audit-chain integrity before allowing spawn
 *   3. Pack-binding resolver -- every agent MUST carry packBinding before acting
 *   4. Provider compliance check -- LLM provider must satisfy active pack policies
 *
 * Gate sequence at toolCall (INGRESS + VERIFICATION + G1-G9 egress guards):
 *   1. Registered-agent check (DA-MED-NEW-1 phantom-agent detection)
 *   2. Pack-binding presence (UnboundDataError if missing)
 *   3. Sensitive-tool approval routing (REQUIRE_APPROVAL for configured tools)
 *   4. Exfiltration scan on tool arguments (G5, G7 egress guards)
 *
 * Gate sequence at llmCall:
 *   1. Registered-agent check
 *   2. Provider-compliance check against resolved pack provider list
 *   3. Unapproved destination check (WEB_ACCESS_DENIED for disallowed LLM endpoints)
 *   4. Budget / token-budget gate before the call fires
 *
 * Audit chain:
 *   Every lifecycle event seals a canonical audit event to the chain via
 *   emitCanonical(). agentEnd seals the terminal event that closes the agent's
 *   run record.
 *
 * No live Claude Agent SDK installed. All framework surfaces are shims.
 * Tests use in-process fakes only.
 * DEFERRED-CLAUDE-AGENT-SDK-V1-API: Verify exact SDK hook surface at
 * implementation time (beta API in active development as of 2026-04-23).
 *
 * Spec: P3-SUB-ADAPT-01
 * @connexum/ai-governance
 */
import { BaseOrchestratorAdapter } from './base';
import { OrchestratorCapabilities, WorkflowContext, WorkflowDecision, WorkflowStepContext, WorkflowStepDecision, WorkflowResult, RoleEdgeContext, RoleEdgeDecision, OrchestratorError } from './index';
import { UnboundDataError } from '../errors/index';
import type { TaskContext, TaskDecision, PlanContext, PlanDecision, DelegationContext, DelegationDecision } from './orchestrator-adapter';
/**
 * Thrown when an agent attempts to act without a pack binding.
 * Re-exports canonical UnboundDataError from src/errors/index.ts so
 * a single `instanceof UnboundDataError` at the server boundary matches
 * all adapter origins. (C2 fix, 2026-04-24)
 */
export { UnboundDataError };
/** Thrown when an agent attempts to call an unapproved LLM destination. */
export declare class WebAccessDeniedError extends Error {
    readonly agentId: string;
    readonly destination: string;
    constructor(agentId: string, destination: string);
}
/** Thrown when a phantom agent (not registered) attempts to act. */
export declare class PhantomAgentError extends Error {
    readonly agentId: string;
    constructor(agentId: string, registeredAgents: string[]);
}
/** Thrown when the subscription gate blocks an agent from spawning. */
export declare class SubscriptionGateError extends Error {
    readonly agentId: string;
    constructor(agentId: string, reason: string);
}
/** Context snapshot passed when an agent spawns. */
export interface ClaudeAgentContextSnapshot {
    /** ISO-8601 timestamp at spawn */
    spawnedAt: string;
    /** Pack binding array -- MUST be non-empty for the spawn to proceed */
    packBinding: string[];
    /** The LLM model the agent will use for its primary calls */
    model: string;
    /** Arbitrary metadata from the agent runtime */
    metadata?: Record<string, unknown>;
    /** Optional parent agent ID (for sub-agent spawning) */
    parentAgentId?: string;
    /** Session ID carrying the parent conversation state */
    sessionId?: string;
}
/** Arguments to a single tool invocation. */
export interface ClaudeAgentToolCallArgs {
    /** Positional or named arguments */
    [key: string]: unknown;
}
/** Result returned by a tool invocation. */
export interface ClaudeAgentToolResult {
    /** Whether the tool completed without error */
    success: boolean;
    /** Structured output (sanitised -- no raw PHI) */
    output?: unknown;
    /** Error message if success is false */
    error?: string;
    /** Duration in milliseconds */
    durationMs?: number;
}
/** Messages passed to the LLM at each turn. */
export interface ClaudeAgentLlmMessage {
    role: 'user' | 'assistant' | 'system';
    content: string | Array<{
        type: string;
        text?: string;
        [key: string]: unknown;
    }>;
}
/** Tool definition passed to the LLM. */
export interface ClaudeAgentLlmTool {
    name: string;
    description: string;
    input_schema?: Record<string, unknown>;
}
/** The raw LLM response object. */
export interface ClaudeAgentLlmResponse {
    /** Model identifier that produced this response */
    model: string;
    /** Stop reason from the LLM */
    stopReason?: string;
    /** Usage stats */
    usage?: {
        inputTokens?: number;
        outputTokens?: number;
    };
    /** Content blocks */
    content?: Array<{
        type: string;
        text?: string;
        [key: string]: unknown;
    }>;
}
/** Terminal outcome when an agent run ends. */
export interface ClaudeAgentOutcome {
    /** Whether the run completed successfully */
    success: boolean;
    /** Brief outcome description (no secrets) */
    summary?: string;
    /** Duration in milliseconds */
    durationMs?: number;
    /** Error if success is false */
    error?: string;
}
export interface ClaudeAgentSdkAdapterConfig {
    /**
     * Agent IDs permitted to spawn under governance.
     * Empty array causes all agent starts to be denied (fail closed).
     * Maps to DA-MED-NEW-1 agent-registration integrity.
     */
    registeredAgents: string[];
    /**
     * Tool names that require reviewer approval before execution.
     * Maps to sensitive-tool approval routing (REQUIRE_APPROVAL).
     */
    sensitiveTools: string[];
    /**
     * LLM model identifiers that are approved for use.
     * Any model not in this list triggers WEB_ACCESS_DENIED at llmCall.
     * Example: ['claude-opus-4', 'claude-sonnet-4-6', 'claude-haiku-4-5']
     */
    approvedModels: string[];
    /**
     * Tool argument keys to scan for PHI / exfiltration patterns.
     * The adapter inspects these keys on every toolCall.
     * Example: ['query', 'body', 'content', 'message']
     */
    sensitiveArgKeys: string[];
    /**
     * Maximum tool calls per agent run before automatic suspension.
     * Prevents runaway agents from exhausting resources.
     * Undefined means no limit.
     */
    maxToolCallsPerRun?: number;
    /**
     * If true, the adapter enforces that packBinding is non-empty at agentStart.
     * Default: true (fail-closed per pack-binding primacy rule).
     */
    enforcePackBinding?: boolean;
}
export declare class ClaudeAgentSdkAdapter extends BaseOrchestratorAdapter {
    readonly adapterId = "claude-agent-sdk";
    readonly orchestratorId = "claude-agent-sdk";
    private adapterConfig;
    /** Per-agent tool call counters for runaway detection. */
    private toolCallCounters;
    /** Active agents: agentId -> contextSnapshot (for phantom checks on mid-run events) */
    private activeAgents;
    constructor(config: ClaudeAgentSdkAdapterConfig);
    /**
     * Called when an agent spawns. Runs:
     *   1. Subscription gate
     *   2. Chain tamper detector (integrity check on audit chain)
     *   3. Pack-binding resolver (UnboundDataError if binding is empty)
     *   4. Provider compliance check
     *
     * Throws SubscriptionGateError, UnboundDataError, PhantomAgentError, or
     * OrchestratorError if denied. Returns WorkflowDecision.ALLOW on success.
     */
    agentStart(agentId: string, contextSnapshot: ClaudeAgentContextSnapshot): Promise<WorkflowDecision>;
    /**
     * Called before every tool invocation.
     *   1. Registered-agent check
     *   2. Pack-binding presence
     *   3. Runaway-agent counter
     *   4. Sensitive-tool REQUIRE_APPROVAL routing
     *   5. Exfiltration scan on tool arguments (G5 / G7 guards)
     */
    toolCall(agentId: string, tool: string, args: ClaudeAgentToolCallArgs): Promise<TaskDecision>;
    /**
     * Called after every tool result is returned.
     * Emits a post-tool audit event and performs an output classifier re-check
     * to detect unexpected PHI / PAN leaking in tool results.
     */
    toolResult(agentId: string, tool: string, result: ClaudeAgentToolResult): Promise<void>;
    /**
     * Called before the agent sends a message to the LLM.
     *   1. Registered-agent check
     *   2. Pack-binding presence
     *   3. Provider-compliance check against approved model list
     *   4. Unapproved destination check (WEB_ACCESS_DENIED)
     */
    llmCall(agentId: string, model: string, messages: ClaudeAgentLlmMessage[], tools: ClaudeAgentLlmTool[]): Promise<TaskDecision>;
    /**
     * Called after the LLM response arrives.
     * Runs ingress classify + output-exfiltration scanner on response content.
     * Emits an audit event summarising the response and any classifier flags.
     */
    llmResult(agentId: string, model: string, response: ClaudeAgentLlmResponse): Promise<void>;
    /**
     * Called when an agent run terminates (success or failure).
     * Seals the terminal audit event to the chain and cleans up tracking state.
     */
    agentEnd(agentId: string, outcome: ClaudeAgentOutcome): Promise<void>;
    /**
     * Scan tool call arguments for potential exfiltration patterns.
     * Returns the first sensitive key found, or null if clean.
     *
     * This is a heuristic scan (G5 / G7 guards). Production wiring integrates
     * with DataClassifier for full PHI / PAN pattern matching.
     */
    private scanArgsForExfiltration;
    /**
     * Heuristic PHI / PAN pattern check.
     * Mirrors the DataClassifier patterns at a lightweight level for
     * pre-tool and post-LLM scanning.
     *
     * Production adapters should route through DataClassifier.scan().
     */
    private containsPhiPattern;
    startWorkflow(ctx: WorkflowContext): Promise<WorkflowDecision>;
    stepWorkflow(ctx: WorkflowStepContext): Promise<WorkflowStepDecision>;
    completeWorkflow(ctx: WorkflowContext, result: WorkflowResult): Promise<void>;
    preTask(task: TaskContext): Promise<TaskDecision>;
    postTask(task: TaskContext, result: Record<string, unknown>): Promise<void>;
    prePlan(plan: PlanContext): Promise<PlanDecision>;
    postPlan(plan: PlanContext, result: Record<string, unknown>): Promise<void>;
    preDelegation(d: DelegationContext): Promise<DelegationDecision>;
    postDelegation(d: DelegationContext, result: Record<string, unknown>): Promise<void>;
    invokeRoleEdge(edge: RoleEdgeContext): Promise<RoleEdgeDecision>;
    translateError(raw: unknown): OrchestratorError;
    getOrchestratorCapabilities(): OrchestratorCapabilities;
}
//# sourceMappingURL=claude-agent-sdk.d.ts.map