/**
 * BedrockAgentCoreAdapter -- Orchestrator adapter for AWS Bedrock AgentCore.
 *
 * Hook surface: Bedrock AgentCore is AWS's agent orchestration layer. Agents
 * invoke foundation models through Bedrock (InvokeAgent API). This adapter
 * intercepts at the caller layer (before InvokeAgent fires) and at the
 * response layer:
 *
 *   const adapter = new BedrockAgentCoreAdapter(cfg);
 *   adapter.initialize(orchCfg);
 *
 *   // Before every InvokeAgent call (agentStart equivalent):
 *   await adapter.agentStart(agentId, sessionId, contextSnapshot);
 *
 *   // Before every action group (tool equivalent) invocation:
 *   await adapter.toolCall(agentId, actionGroup, actionSpec, args);
 *
 *   // After every action group result returns:
 *   await adapter.toolResult(agentId, actionGroup, result);
 *
 *   // Before every underlying Bedrock model call:
 *   await adapter.llmCall(agentId, modelId, messages, tools);
 *
 *   // After the model response arrives:
 *   await adapter.llmResult(agentId, modelId, response);
 *
 *   // When the agent run terminates:
 *   await adapter.agentEnd(agentId, outcome);
 *
 * AgentCore-specific surfaces:
 *   - InvokeAgent API: pre-call governance (agentStart) + response governance (agentEnd)
 *   - Action groups: AgentCore's tool concept; maps to toolCall/toolResult hooks
 *   - Knowledge Base retrieval: separate ingress data class, tagged KNOWLEDGE_BASE in audit
 *   - HIPAA BAA region enforcement: Bedrock has BAA coverage in specific AWS regions;
 *     this adapter verifies region compliance before any HIPAA-bound invocation proceeds
 *
 * HIPAA BAA coverage:
 *   AWS Bedrock is covered by the AWS HIPAA BAA in specific regions. Any region
 *   not on the BAA-covered list triggers BedrockBaaRegionError when a HIPAA pack
 *   is bound. Reuses provider compliance metadata from src/llm-adapters/bedrock.ts
 *   (providerId: 'amazon', baa: true).
 *
 * Provider compliance:
 *   Bedrock agents call foundation models through Bedrock. The adapter checks that
 *   the resolved modelId is on the approved model list. Models are identified by
 *   Bedrock model IDs (e.g. 'anthropic.claude-3-5-sonnet-20241022-v2:0').
 *
 * No live AWS Bedrock SDK installed. All framework surfaces are shims.
 * No AWS SDK dependency; matching the pattern from src/llm-adapters/bedrock.ts.
 * DEFERRED-BEDROCK-AGENTCORE-V1: Verify exact InvokeAgent hook surface against
 * AWS SDK for JavaScript v3 @aws-sdk/client-bedrock-agent-runtime at implementation.
 *
 * Spec: P3-SUB-ADAPT-03
 * @connexum/ai-governance
 */
import { BaseOrchestratorAdapter } from './base';
import { OrchestratorCapabilities, WorkflowContext, WorkflowDecision, WorkflowStepContext, WorkflowStepDecision, WorkflowResult, RoleEdgeContext, RoleEdgeDecision, OrchestratorError } from './index';
import { BedrockUnboundDataError } from '../errors/index';
import type { TaskContext, TaskDecision, PlanContext, PlanDecision, DelegationContext, DelegationDecision } from './orchestrator-adapter';
/** Thrown when an AgentCore invocation targets a region without HIPAA BAA coverage. */
export declare class BedrockBaaRegionError extends Error {
    readonly agentId: string;
    readonly region: string;
    constructor(agentId: string, region: string);
}
/**
 * Thrown when an AgentCore agent attempts to act without a pack binding.
 * Re-exports canonical UnboundDataError as BedrockUnboundDataError so
 * a single `instanceof UnboundDataError` at the server boundary matches
 * all adapter origins. (C2 fix, 2026-04-24)
 */
export { BedrockUnboundDataError };
/** Thrown when a Knowledge Base retrieval contains PHI under a HIPAA binding. */
export declare class BedrockKbPhiError extends Error {
    readonly agentId: string;
    readonly knowledgeBaseId: string;
    constructor(agentId: string, knowledgeBaseId: string);
}
/**
 * AWS regions where Bedrock (and thus AgentCore) is covered under the AWS HIPAA BAA.
 * Any region not in this set triggers BedrockBaaRegionError under a HIPAA binding.
 */
export declare const BEDROCK_BAA_REGIONS: ReadonlySet<string>;
/**
 * Ingress data class tags for AgentCore-specific data sources.
 * Used in canonical audit event payloads to classify data origin.
 */
export type AgentCoreDataClass = 'ACTION_GROUP' | 'KNOWLEDGE_BASE' | 'INLINE_AGENT' | 'MEMORY' | 'PROMPT_OVERRIDE';
/** Context snapshot passed when an AgentCore agent run starts (pre-InvokeAgent). */
export interface AgentCoreContextSnapshot {
    /** ISO-8601 timestamp at agent invocation */
    invokedAt: string;
    /** Pack binding array -- MUST be non-empty for the invocation to proceed */
    packBinding: string[];
    /** Bedrock agent ID (from AWS console) */
    bedrockAgentId: string;
    /** Bedrock agent alias ID */
    agentAliasId: string;
    /** AWS region for this invocation (required for BAA region check) */
    region: string;
    /** Foundation model ID this agent is configured to use */
    modelId: string;
    /** Arbitrary agent metadata */
    metadata?: Record<string, unknown>;
}
/**
 * AgentCore action group specification.
 * Action groups are AgentCore's concept of tools. They map to toolCall hooks.
 * Each action group can have multiple API operations (actions).
 */
export interface AgentCoreActionSpec {
    /** Action group name */
    actionGroupName: string;
    /** Operation name within the action group */
    operationName: string;
    /** Whether this action group accesses a Bedrock Knowledge Base */
    isKnowledgeBase?: boolean;
    /** Knowledge Base ID if isKnowledgeBase is true */
    knowledgeBaseId?: string;
}
/** Arguments to a single AgentCore action group invocation. */
export interface AgentCoreActionArgs {
    [key: string]: unknown;
}
/** Result returned by an AgentCore action group invocation. */
export interface AgentCoreActionResult {
    /** Whether the action completed without error */
    success: boolean;
    /** Structured output (sanitised -- no raw PHI) */
    output?: unknown;
    /** HTTP status code from the Lambda backing the action group */
    statusCode?: number;
    /** Error message if success is false */
    error?: string;
    /** Duration in milliseconds */
    durationMs?: number;
}
/** Knowledge Base retrieval result. Distinct from action group results. */
export interface AgentCoreKbResult {
    /** Knowledge Base ID */
    knowledgeBaseId: string;
    /** Retrieved text passages */
    retrievedPassages: Array<{
        text: string;
        sourceUri?: string;
        score?: number;
    }>;
    /** Whether any passage may contain PHI (flagged by classifier) */
    hasPotentialPhi?: boolean;
}
/** A single message in an AgentCore conversation. */
export interface AgentCoreMessage {
    role: 'user' | 'assistant' | 'tool';
    content: string | Array<{
        type: string;
        text?: string;
        [key: string]: unknown;
    }>;
}
/** The raw Bedrock model response after a foundation model call. */
export interface AgentCoreLlmResponse {
    /** Model ID that produced this response */
    modelId: string;
    /** Stop reason */
    stopReason?: string;
    /** Token usage */
    usage?: {
        inputTokens?: number;
        outputTokens?: number;
    };
    /** Response content */
    output?: Array<{
        type: string;
        text?: string;
        [key: string]: unknown;
    }>;
}
/** Terminal outcome when an AgentCore agent run ends. */
export interface AgentCoreOutcome {
    /** Whether the run completed successfully */
    success: boolean;
    /** Brief outcome description (no secrets) */
    summary?: string;
    /** Duration in milliseconds */
    durationMs?: number;
    /** Error if success is false */
    error?: string;
}
export interface BedrockAgentCoreAdapterConfig {
    /**
     * Bedrock agent IDs permitted to invoke under governance.
     * Empty array denies all invocations (fail closed).
     */
    registeredAgents: string[];
    /**
     * Action group names that require reviewer approval before execution.
     * Maps to sensitive-tool approval routing (REQUIRE_APPROVAL).
     */
    sensitiveActionGroups: string[];
    /**
     * Foundation model IDs that are approved for use via AgentCore.
     * Any model not in this list triggers an approval block.
     * Bedrock model IDs use 'provider.model-name:version' format.
     * Example: ['anthropic.claude-3-5-sonnet-20241022-v2:0', 'amazon.titan-text-express-v1']
     */
    approvedModelIds: string[];
    /**
     * Action argument keys to scan for PHI / exfiltration patterns.
     */
    sensitiveArgKeys: string[];
    /**
     * If true (default), enforce HIPAA BAA region check when a HIPAA pack is bound.
     */
    enforceHipaaBaaRegion?: boolean;
    /**
     * If true (default), enforce that packBinding is non-empty at agentStart.
     */
    enforcePackBinding?: boolean;
    /**
     * Maximum action group calls per run before automatic suspension.
     */
    maxActionCallsPerRun?: number;
}
export declare class BedrockAgentCoreAdapter extends BaseOrchestratorAdapter {
    readonly adapterId = "bedrock-agentcore";
    readonly orchestratorId = "bedrock-agentcore";
    private agentCoreConfig;
    /** Per-agent action call counters for runaway detection. */
    private actionCallCounters;
    /** Active agents: agentId -> contextSnapshot */
    private activeAgents;
    constructor(config: BedrockAgentCoreAdapterConfig);
    /**
     * Called before every InvokeAgent API call. Runs:
     *   1. Agent registration check (fail-closed on unregistered agents)
     *   2. Pack-binding resolver (BedrockUnboundDataError if binding is empty)
     *   3. HIPAA BAA region check (BedrockBaaRegionError if region not covered)
     *   4. Approved model check for the agent's configured modelId
     *
     * Throws BedrockBaaRegionError, BedrockUnboundDataError, or OrchestratorError
     * if denied. Returns WorkflowDecision.ALLOW on success.
     *
     * SessionId travels through every audit event for traceability.
     */
    agentStart(agentId: string, sessionId: string, contextSnapshot: AgentCoreContextSnapshot): Promise<WorkflowDecision>;
    /**
     * Called before every AgentCore action group invocation (the toolCall equivalent).
     *   1. Active-agent check
     *   2. Pack-binding presence
     *   3. Runaway-agent counter
     *   4. Knowledge Base retrieval classification as KNOWLEDGE_BASE ingress data
     *   5. Sensitive action group REQUIRE_APPROVAL routing
     *   6. PHI classifier scan on action arguments (G5 / G7 egress guards)
     *
     * AgentCore distinguishes action groups (Lambda-backed tools) from Knowledge Base
     * retrievals. Both map to this hook surface. Knowledge Base calls are tagged
     * with data class KNOWLEDGE_BASE in the audit event.
     */
    toolCall(agentId: string, actionSpec: AgentCoreActionSpec, args: AgentCoreActionArgs): Promise<TaskDecision>;
    /**
     * Called after every AgentCore action group or Knowledge Base result returns.
     * For Knowledge Base retrievals, applies PHI classifier to retrieved passages.
     * Emits audit event with data class tag for compliance queries.
     */
    toolResult(agentId: string, actionSpec: AgentCoreActionSpec, result: AgentCoreActionResult): Promise<void>;
    /**
     * Called specifically for Knowledge Base retrieval operations.
     * KB retrievals are a separate ingress data class from action groups.
     * This hook classifies each retrieved passage for PHI/PII at emit time.
     *
     * PHI found in KB passages emits a BedrockKbPhiError audit event.
     * It does NOT throw (retrieval is post-hoc) but surfaces to compliance review.
     */
    knowledgeBaseRetrieval(agentId: string, kbResult: AgentCoreKbResult): Promise<void>;
    /**
     * Called before every Bedrock foundation model call.
     *   1. Active-agent check
     *   2. Pack-binding presence
     *   3. Approved model ID check
     */
    llmCall(agentId: string, modelId: string, messages: AgentCoreMessage[], tools: AgentCoreActionSpec[]): Promise<TaskDecision>;
    /**
     * Called after the Bedrock model response arrives.
     * Scans response content for PHI/PAN exfiltration patterns.
     */
    llmResult(agentId: string, modelId: string, response: AgentCoreLlmResponse): Promise<void>;
    /**
     * Called when a Bedrock AgentCore run terminates (success or failure).
     * Seals the terminal audit event and cleans up tracking state.
     */
    agentEnd(agentId: string, sessionId: string, outcome: AgentCoreOutcome): Promise<void>;
    /**
     * Scan action arguments for potential exfiltration patterns.
     */
    private scanArgsForExfiltration;
    /**
     * Heuristic PHI / PAN pattern check.
     * Mirrors the DataClassifier patterns at a lightweight level.
     */
    private containsPhiPattern;
    startWorkflow(ctx: WorkflowContext): Promise<WorkflowDecision>;
    stepWorkflow(ctx: WorkflowStepContext): Promise<WorkflowStepDecision>;
    completeWorkflow(ctx: WorkflowContext, result: WorkflowResult): Promise<void>;
    preTask(task: TaskContext): Promise<TaskDecision>;
    postTask(task: TaskContext, result: Record<string, unknown>): Promise<void>;
    prePlan(plan: PlanContext): Promise<PlanDecision>;
    postPlan(plan: PlanContext, result: Record<string, unknown>): Promise<void>;
    preDelegation(d: DelegationContext): Promise<DelegationDecision>;
    postDelegation(d: DelegationContext, result: Record<string, unknown>): Promise<void>;
    invokeRoleEdge(edge: RoleEdgeContext): Promise<RoleEdgeDecision>;
    translateError(raw: unknown): OrchestratorError;
    getOrchestratorCapabilities(): OrchestratorCapabilities;
}
//# sourceMappingURL=bedrock-agentcore.d.ts.map