/**
 * GoogleAdkAdapter -- Orchestrator adapter for the Google Agent Development Kit (ADK).
 *
 * Hook surface: Google ADK exposes agent lifecycle events that this adapter
 * intercepts at the TypeScript governance layer. Customers wire the adapter by
 * calling the six lifecycle methods at the corresponding points in their ADK
 * integration:
 *
 *   const adapter = new GoogleAdkAdapter(cfg);
 *   adapter.initialize(orchCfg);
 *
 *   // At agent spawn:
 *   await adapter.agentStart(sessionId, userId, contextSnapshot);
 *
 *   // Before every tool invocation:
 *   await adapter.toolCall(sessionId, toolName, toolSpec, args);
 *
 *   // After every tool result returns:
 *   await adapter.toolResult(sessionId, toolName, result);
 *
 *   // Before the agent sends a message to Gemini via Vertex AI:
 *   await adapter.llmCall(sessionId, model, messages, tools);
 *
 *   // After the Gemini response arrives:
 *   await adapter.llmResult(sessionId, model, response);
 *
 *   // When the agent terminates:
 *   await adapter.agentEnd(sessionId, outcome);
 *
 * ADK runtime contexts:
 *   Google ADK agents run on Vertex AI Agent Engine, Cloud Run, GKE, and
 *   Bedrock AgentCore (cross-cloud). Our adapter is the TypeScript governance
 *   layer that consumes ADK-native event payloads regardless of runtime.
 *
 * Provider compliance:
 *   ADK agents call Gemini via Vertex AI. The Google provider compliance
 *   entry (providerId: 'google', baaPath: 'vertex-ai-only') is reused here.
 *   BAA coverage is only valid when Vertex AI is the invocation path; direct
 *   Gemini API calls (AI Studio) do NOT carry a BAA. The adapter enforces
 *   this distinction via the vertexAiRequired flag.
 *
 * Session context:
 *   ADK carries conversation state via session_id and user_id. Both values
 *   are surfaced in every canonical audit event to maintain traceability.
 *
 * Tool normalization:
 *   ADK tool specs use a different format from LangGraph (function declarations
 *   vs JSON schema tool definitions). The adapter normalises both to the
 *   canonical tool-spec shape before emitting audit events.
 *
 * No live Google ADK Python SDK installed. All framework surfaces are shims.
 * TypeScript governance layer only. DEFERRED-ADK-V1-API marker: verify the
 * exact ADK hook surface when the Python SDK stabilises (beta as of 2026-04-23).
 *
 * Spec: P3-SUB-ADAPT-02
 * @connexum/ai-governance
 */
import { BaseOrchestratorAdapter } from './base';
import { OrchestratorCapabilities, WorkflowContext, WorkflowDecision, WorkflowStepContext, WorkflowStepDecision, WorkflowResult, RoleEdgeContext, RoleEdgeDecision, OrchestratorError } from './index';
import { AdkUnboundDataError } from '../errors/index';
import type { TaskContext, TaskDecision, PlanContext, PlanDecision, DelegationContext, DelegationDecision } from './orchestrator-adapter';
/**
 * Thrown when an ADK agent attempts to act without a pack binding.
 * Re-exports canonical UnboundDataError as AdkUnboundDataError so
 * a single `instanceof UnboundDataError` at the server boundary matches
 * all adapter origins. (C2 fix, 2026-04-24)
 */
export { AdkUnboundDataError };
/** Thrown when a Vertex AI region is used that is NOT on the HIPAA BAA-covered list. */
export declare class AdkBaaRegionError extends Error {
    readonly sessionId: string;
    readonly region: string;
    constructor(sessionId: string, region: string);
}
/** Thrown when the subscription gate blocks an ADK agent. */
export declare class AdkSubscriptionGateError extends Error {
    readonly sessionId: string;
    constructor(sessionId: string, reason: string);
}
/**
 * Vertex AI regions with documented HIPAA BAA coverage.
 * Any region not in this set triggers AdkBaaRegionError under a HIPAA binding.
 */
export declare const VERTEX_AI_BAA_REGIONS: ReadonlySet<string>;
/** Context snapshot passed when an ADK agent session starts. */
export interface AdkContextSnapshot {
    /** ISO-8601 timestamp at spawn */
    spawnedAt: string;
    /** Pack binding array -- MUST be non-empty for the session to proceed */
    packBinding: string[];
    /** Gemini model identifier (e.g. 'gemini-1.5-pro', 'gemini-2.0-flash') */
    model: string;
    /** Vertex AI region for this session (required for BAA region check) */
    vertexRegion: string;
    /** Whether this session uses Vertex AI (true) or direct AI Studio (false) */
    isVertexAiPath: boolean;
    /** Arbitrary ADK session metadata */
    metadata?: Record<string, unknown>;
    /** Optional parent session ID (for multi-agent ADK graphs) */
    parentSessionId?: string;
}
/**
 * ADK tool specification.
 * ADK uses Google-style FunctionDeclaration format rather than JSON Schema.
 * The adapter normalises this to the canonical tool-spec shape.
 */
export interface AdkToolSpec {
    /** Tool name */
    name: string;
    /** Human-readable description */
    description?: string;
    /**
     * ADK FunctionDeclaration parameters block.
     * Format: { type: 'object', properties: { ... }, required: [...] }
     */
    parameters?: Record<string, unknown>;
}
/** Arguments to a single ADK tool invocation (key-value pairs). */
export interface AdkToolCallArgs {
    [key: string]: unknown;
}
/** Result returned by an ADK tool invocation. */
export interface AdkToolResult {
    /** Whether the tool completed without error */
    success: boolean;
    /** Structured output (sanitised -- no raw PHI) */
    output?: unknown;
    /** Error message if success is false */
    error?: string;
    /** Duration in milliseconds */
    durationMs?: number;
}
/** A single message in an ADK conversation turn. */
export interface AdkMessage {
    role: 'user' | 'model' | 'function';
    content: string | Array<{
        type: string;
        text?: string;
        [key: string]: unknown;
    }>;
}
/** The raw Gemini/Vertex AI response object returned after an LLM call. */
export interface AdkLlmResponse {
    /** Model identifier that produced this response */
    model: string;
    /** Finish reason from Gemini */
    finishReason?: string;
    /** Token usage statistics */
    usageMetadata?: {
        promptTokenCount?: number;
        candidatesTokenCount?: number;
    };
    /** Response content parts */
    candidates?: Array<{
        content?: {
            parts?: Array<{
                text?: string;
                [key: string]: unknown;
            }>;
        };
        finishReason?: string;
    }>;
}
/** Terminal outcome when an ADK session ends. */
export interface AdkAgentOutcome {
    /** Whether the session completed successfully */
    success: boolean;
    /** Brief outcome description (no secrets) */
    summary?: string;
    /** Duration in milliseconds */
    durationMs?: number;
    /** Error if success is false */
    error?: string;
}
export interface GoogleAdkAdapterConfig {
    /**
     * Session IDs (or a registered-session allowlist) permitted under governance.
     * In production, this maps to an allowlist of known project + session prefixes.
     * Empty array denies all sessions (fail closed).
     */
    registeredSessions: string[];
    /**
     * Tool names that require reviewer approval before execution.
     * Maps to sensitive-tool approval routing (REQUIRE_APPROVAL).
     */
    sensitiveTools: string[];
    /**
     * Gemini model identifiers that are approved for use.
     * Any model not in this list triggers a provider compliance block.
     * Example: ['gemini-1.5-pro', 'gemini-2.0-flash', 'gemini-1.0-pro']
     */
    approvedModels: string[];
    /**
     * Tool argument keys to scan for PHI / exfiltration patterns.
     */
    sensitiveArgKeys: string[];
    /**
     * When true (default), enforce Vertex AI path for all LLM calls under
     * a HIPAA binding. Direct AI Studio calls are blocked.
     */
    enforceVertexAiPath?: boolean;
    /**
     * If true, the adapter enforces that packBinding is non-empty at agentStart.
     * Default: true (fail-closed per pack-binding primacy rule).
     */
    enforcePackBinding?: boolean;
    /**
     * Maximum tool calls per session before automatic suspension.
     */
    maxToolCallsPerSession?: number;
}
export declare class GoogleAdkAdapter extends BaseOrchestratorAdapter {
    readonly adapterId = "google-adk";
    readonly orchestratorId = "google-adk";
    private adkConfig;
    /** Per-session tool call counters for runaway detection. */
    private toolCallCounters;
    /** Active sessions: sessionId -> contextSnapshot */
    private activeSessions;
    constructor(config: GoogleAdkAdapterConfig);
    /**
     * Called when an ADK agent session starts. Runs:
     *   1. Session registration check (fail-closed on unregistered sessions)
     *   2. Subscription gate proxy (non-empty registeredSessions)
     *   3. Pack-binding resolver (AdkUnboundDataError if binding is empty)
     *   4. Vertex AI path enforcement (blocks AI Studio calls under HIPAA)
     *   5. BAA region check (AdkBaaRegionError if region not BAA-covered under HIPAA)
     *   6. Provider compliance check for Gemini model
     *
     * Throws AdkSubscriptionGateError, AdkUnboundDataError, AdkBaaRegionError, or
     * OrchestratorError if denied. Returns WorkflowDecision.ALLOW on success.
     *
     * Session context: session_id and user_id are surfaced in every audit event
     * per ADK's session tracking model.
     */
    agentStart(sessionId: string, userId: string, contextSnapshot: AdkContextSnapshot): Promise<WorkflowDecision>;
    /**
     * Called before every ADK tool invocation.
     *   1. Active-session check
     *   2. Pack-binding presence
     *   3. Runaway-session counter
     *   4. Sensitive-tool REQUIRE_APPROVAL routing
     *   5. Exfiltration scan on sensitive argument keys
     *   6. ADK tool-spec normalization (FunctionDeclaration -> canonical)
     *
     * Session_id and user_id travel through every audit event.
     */
    toolCall(sessionId: string, toolName: string, toolSpec: AdkToolSpec, args: AdkToolCallArgs): Promise<TaskDecision>;
    /**
     * Called after every ADK tool result is returned.
     * Emits a post-tool audit event and performs an output classifier re-check.
     * Session_id travels through the event for traceability.
     */
    toolResult(sessionId: string, toolName: string, result: AdkToolResult): Promise<void>;
    /**
     * Called before the ADK agent sends messages to Gemini via Vertex AI.
     *   1. Active-session check
     *   2. Pack-binding presence
     *   3. Provider-compliance check (approved Gemini model list)
     *   4. Vertex AI path re-verification (HIPAA binding)
     *
     * Session_id travels through the audit event.
     */
    llmCall(sessionId: string, model: string, messages: AdkMessage[], tools: AdkToolSpec[]): Promise<TaskDecision>;
    /**
     * Called after the Gemini response arrives.
     * Runs output-exfiltration scanner on response content.
     * Session_id travels through the audit event.
     */
    llmResult(sessionId: string, model: string, response: AdkLlmResponse): Promise<void>;
    /**
     * Called when an ADK session terminates (success or failure).
     * Seals the terminal audit event and cleans up tracking state.
     * Session_id and user_id travel through the event.
     */
    agentEnd(sessionId: string, outcome: AdkAgentOutcome): Promise<void>;
    /**
     * Normalize an ADK FunctionDeclaration tool spec to a canonical shape.
     * ADK uses Google's function_declarations format; we flatten to name + description
     * for audit event payloads.
     */
    private normalizeToolSpec;
    /**
     * Scan tool call arguments for potential exfiltration patterns.
     * Returns the first sensitive key found, or null if clean.
     */
    private scanArgsForExfiltration;
    /**
     * Heuristic PHI / PAN pattern check.
     * Mirrors the DataClassifier patterns at a lightweight level.
     */
    private containsPhiPattern;
    startWorkflow(ctx: WorkflowContext): Promise<WorkflowDecision>;
    stepWorkflow(ctx: WorkflowStepContext): Promise<WorkflowStepDecision>;
    completeWorkflow(ctx: WorkflowContext, result: WorkflowResult): Promise<void>;
    preTask(task: TaskContext): Promise<TaskDecision>;
    postTask(task: TaskContext, result: Record<string, unknown>): Promise<void>;
    prePlan(plan: PlanContext): Promise<PlanDecision>;
    postPlan(plan: PlanContext, result: Record<string, unknown>): Promise<void>;
    preDelegation(d: DelegationContext): Promise<DelegationDecision>;
    postDelegation(d: DelegationContext, result: Record<string, unknown>): Promise<void>;
    invokeRoleEdge(edge: RoleEdgeContext): Promise<RoleEdgeDecision>;
    translateError(raw: unknown): OrchestratorError;
    getOrchestratorCapabilities(): OrchestratorCapabilities;
}
//# sourceMappingURL=google-adk.d.ts.map