/**
 * CopilotWorkspaceIdeAdapter -- GitHub Copilot Workspace IDE adapter.
 *
 * Copilot Workspace (Technical Preview as of 2026-04-22) does not expose
 * runtime per-tool hooks. AI governance fires exclusively at the PR
 * boundary: a GitHub App intercepts PRs authored by
 * `copilot-workspace[bot]`, runs diff evaluation against the active
 * compliance pack plus a secret scanner, and posts a check-run result.
 *
 * Architecture:
 *   - Runtime methods (interceptToolInvocation, recordToolResult,
 *     routeToolToReviewer) throw IdeUnsupportedError with an explicit
 *     message directing callers to evaluatePrDiff() instead. This is
 *     AC 9 -- explicit deferral, not silent skip.
 *   - PrBoundaryEnforcer is fully implemented:
 *       evaluatePrDiff(ctx)     -- diff evaluation + secret scan
 *       postCheckRun(ctx, dec)  -- emits canonical events + stubs
 *                                  the GitHub Checks API call shape
 *   - User identity resolved from ctx.webhookPayload.sender.login.
 *     Missing sender -> neutral check-run (AC 12, fail-closed).
 *   - Bot-author gate: only acts on PRs by `copilot-workspace[bot]`.
 *     Other authors produce a DEBUG no-op.
 *
 * DEFERRED-COPILOT-WS-GITHUB-APP: The real GitHub App delivery (App
 * private key, installation token flow, actual POST to the GitHub
 * Checks API) is stubbed at the _postCheckRunToGitHub() method
 * boundary. Wire the real implementation when the GitHub App is
 * provisioned. Add a KANBAN task to track.
 *
 * TESTED_API_VERSION = '2024-11-01' (GitHub Checks API version,
 * spec-aligned). Verify at implementation of the real GitHub App
 * delivery against the current GitHub REST API version.
 *
 * Spec: P3-IDE-01 AC 9-12, Section 2.4
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity, type PrBoundaryEnforcer, type PrDiffContext, type PrCheckDecision } from './index';
/**
 * GitHub Checks API version this adapter is aligned with.
 * Used in the check-run stub payload (Accept header).
 *
 * DEFERRED-COPILOT-WS-GITHUB-APP: Verify against the GitHub REST API
 * version at time of real GitHub App provisioning.
 */
export declare const COPILOT_WORKSPACE_TESTED_API_VERSION = "2024-11-01";
export interface GitHubPrWebhookSender {
    login: string;
    type?: string;
}
export interface GitHubPrWebhookOrganization {
    login: string;
}
/**
 * Minimal GitHub PR webhook payload shape.
 * The full payload is far larger; we type only the fields we consume.
 */
export interface CopilotWorkspacePrWebhookPayload {
    action?: string;
    pull_request?: {
        number?: number;
        html_url?: string;
        head?: {
            sha?: string;
        };
        user?: {
            login?: string;
            type?: string;
        };
    };
    sender?: GitHubPrWebhookSender;
    organization?: GitHubPrWebhookOrganization;
    repository?: {
        full_name?: string;
    };
}
export interface CopilotWorkspaceAdapterConfig extends IdeAdapterConfig {
    /** GitHub App installation ID (required for real check-run delivery) */
    githubAppInstallationId?: number;
    /**
     * License-violation patterns to scan for in diffs.
     * Matches against added lines (lines starting with '+').
     */
    licenseViolationPatterns?: RegExp[];
}
export interface GitHubCheckRunPayload {
    name: string;
    head_sha: string;
    status: 'completed';
    conclusion: 'success' | 'failure' | 'neutral';
    output: {
        title: string;
        summary: string;
        annotations?: Array<{
            path: string;
            start_line: number;
            end_line: number;
            annotation_level: 'failure' | 'warning' | 'notice';
            message: string;
        }>;
    };
    /** GitHub API version header value for the real delivery */
    _apiVersion: string;
    /** Installation ID for GitHub App authentication (real delivery) */
    _installationId?: number;
}
export declare class CopilotWorkspaceIdeAdapter extends BaseIdeAdapter implements PrBoundaryEnforcer {
    readonly adapterId = "copilot-workspace";
    readonly ideId = "copilot-workspace";
    private copilotConfig;
    initialize(config: IdeAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    interceptToolInvocation(_ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    recordToolResult(_ctx: ToolInvocationContext, _result: import('./index').ToolResult): Promise<void>;
    routeToolToReviewer(_tool: string, _ctx: ToolInvocationContext, _tier: import('./index').ReviewerTier): Promise<import('./index').ReviewerRoutingResult>;
    /**
     * Evaluate a PR diff against the active compliance pack, run the secret
     * scanner, and run license-violation pattern matching.
     *
     * User identity is resolved from ctx.webhookPayload.sender.login.
     * If missing, returns neutral (AC 12 -- fail-closed, not silent-approve).
     *
     * Bot-author gate: if the PR author is not copilot-workspace[bot], returns
     * a neutral decision with a DEBUG audit event. This adapter only governs
     * Copilot Workspace PRs.
     *
     * @param ctx - PR diff context including the unified diff and webhook payload
     */
    evaluatePrDiff(ctx: PrDiffContext & {
        webhookPayload?: CopilotWorkspacePrWebhookPayload;
    }): Promise<PrCheckDecision>;
    /**
     * Emit canonical audit events for the check-run decision and produce the
     * stubbed GitHub Checks API payload.
     *
     * The actual HTTP call to POST /repos/{owner}/{repo}/check-runs is stubbed
     * at _postCheckRunToGitHub(). Wire the real GitHub App delivery there.
     *
     * DEFERRED-COPILOT-WS-GITHUB-APP: Implement _postCheckRunToGitHub() with
     * real GitHub App private key + installation token flow.
     */
    postCheckRun(ctx: PrDiffContext & {
        webhookPayload?: CopilotWorkspacePrWebhookPayload;
    }, decision: PrCheckDecision): Promise<void>;
    getIdeCapabilities(): IdeAdapterCapabilities;
    /**
     * Build the shape of the payload that would be POSTed to
     * POST /repos/{owner}/{repo}/check-runs
     *
     * This is the stub boundary for DEFERRED-COPILOT-WS-GITHUB-APP.
     * The payload shape matches the GitHub Checks API 2024-11-01 contract.
     */
    private _buildCheckRunPayload;
    /**
     * Stub for the real GitHub Checks API call.
     *
     * DEFERRED-COPILOT-WS-GITHUB-APP: Replace this stub with the real
     * GitHub App installation token flow and POST to
     * /repos/{owner}/{repo}/check-runs
     *
     * Returns the payload shape that would be sent. Callers can inspect
     * this in tests to verify correctness without making live API calls.
     */
    protected _postCheckRunToGitHub(payload: GitHubCheckRunPayload): Promise<GitHubCheckRunPayload>;
}
//# sourceMappingURL=copilot-workspace.d.ts.map