/**
 * GitHubCopilotIdeAdapter -- GitHub Copilot classic adapter.
 *
 * Governs GitHub Copilot classic: the autocomplete + Copilot Chat surface
 * inside VS Code, JetBrains IDEs, Vim, and Visual Studio. Distinct from
 * Copilot Workspace, which is the agentic PR-level surface (see
 * src/ide-adapters/copilot-workspace.ts).
 *
 * Hook surfaces:
 *   completionRequested(file, cursor, context) -- pre-completion gate.
 *     Classifier checks for secret patterns, PHI, and trade-secret markers
 *     in the surrounding code context BEFORE the request leaves the IDE.
 *   completionReceived(completion, context) -- post-completion ingress.
 *     Scans the returned completion for secret material. GitHub Copilot has
 *     historically leaked API keys from training data.
 *   chatRequested(prompt, context) -- pre-chat gate. Same classifier pass on
 *     the prompt body and attached files.
 *   chatReceived(response) -- post-chat ingress classification.
 *   suggestionAccepted(suggestion, targetFile) -- audit event on acceptance,
 *     links the accepted code to its originating completion.
 *   suggestionRejected(suggestion, reason) -- optional audit event.
 *
 * Copilot-specific considerations:
 *   - Copilot Content Exclusion is Microsoft's own policy layer. This
 *     adapter surfaces it as a pack-level binding configuration flag --
 *     it is a complement, not a replacement.
 *   - Enterprise deployment flavour (Business vs Enterprise) is read from
 *     config at initialize time and applied to provider-compliance decisions.
 *   - Public-code filter mode is surfaced as an auditable config flag.
 *   - Editor-specific shims (VS Code, JetBrains, Vim, Visual Studio) are
 *     DEFERRED: DEFERRED-COPILOT-EDITOR-SHIMS. This adapter is editor-
 *     agnostic and receives normalised events from a thin shim per editor.
 *
 * Spec: P3-SUB-IDE-02
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity, type ReviewerTier } from './index';
export type CopilotEnterpriseFlavour = 'individual' | 'business' | 'enterprise';
/**
 * Data-retention commitment per Copilot flavour.
 *
 * Copilot Individual: prompts and completions may be used for model training
 *   unless telemetry opt-out is active. Not suitable for any regulated data.
 * Copilot Business: prompt retention is disabled by default.
 * Copilot Enterprise: prompt retention off, content exclusions configurable,
 *   and enterprise-level data-handling commitments apply.
 *
 * Reference: https://docs.github.com/en/copilot/github-copilot-enterprise
 */
export declare const COPILOT_DATA_RETENTION: Record<CopilotEnterpriseFlavour, string>;
/**
 * Flavours that carry a Microsoft / GitHub data-processing agreement
 * suitable for HIPAA use (with explicit Business Associate Agreement in place).
 *
 * Individual flavour NEVER qualifies because GitHub has no BAA for it.
 */
export declare const COPILOT_BAA_ELIGIBLE_FLAVOURS: CopilotEnterpriseFlavour[];
/**
 * Whether the tenant has the public-code filter enabled.
 * When enabled, GitHub filters completions that duplicate public code that
 * is not under a permissive licence. Adapter surfaces this as an auditable
 * configuration flag, not as an enforcement mechanism we replace.
 */
export type CopilotPublicCodeFilter = 'enabled' | 'disabled' | 'unknown';
export interface GitHubCopilotAdapterConfig extends IdeAdapterConfig {
    /** Copilot deployment flavour (default: 'business' -- safe default for enterprise) */
    copilotFlavour?: CopilotEnterpriseFlavour;
    /** Whether the tenant has the public-code filter mode enabled (default: 'unknown') */
    publicCodeFilter?: CopilotPublicCodeFilter;
    /**
     * Content Exclusion paths configured in the GitHub org.
     * Our adapter reads this list to classify requests involving excluded paths
     * as a pack-level binding violation. This DOES NOT replace the GitHub
     * Content Exclusion setting -- it surfaces it as an auditable policy flag.
     */
    contentExclusionPaths?: string[];
    /** Reviewer tier for HIPAA-binding violations (default: T2_LEAD) */
    hipaaReviewerTier?: ReviewerTier;
}
export interface CopilotCompletionContext {
    filePath: string;
    language?: string;
    /** Lines of code surrounding the cursor (the window Copilot uses) */
    surroundingContext?: string;
    cursorOffset?: number;
    sessionId?: string;
}
export interface CopilotCompletionEvent {
    completionText: string;
    context: CopilotCompletionContext;
    completionId?: string;
    sessionId?: string;
}
export interface CopilotChatEvent {
    promptText: string;
    attachedFilePaths?: string[];
    sessionId?: string;
    threadId?: string;
}
export interface CopilotChatResponseEvent {
    responseText: string;
    sessionId?: string;
    threadId?: string;
}
export interface CopilotSuggestionEvent {
    suggestionText: string;
    targetFilePath: string;
    completionId?: string;
    sessionId?: string;
}
export declare class GitHubCopilotIdeAdapter extends BaseIdeAdapter {
    readonly adapterId = "github-copilot";
    readonly ideId = "github-copilot";
    private copilotConfig;
    initialize(config: IdeAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    interceptToolInvocation(ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    private _gateCompletionRequest;
    private _scanCompletionResponse;
    private _gateChatRequest;
    private _scanChatResponse;
    private _auditSuggestionAccepted;
    private _auditSuggestionRejected;
    getIdeCapabilities(): IdeAdapterCapabilities;
    translateError(raw: unknown): import('./index').IdeAdapterError;
    /**
     * Scan text for known secret patterns. Returns the pattern name on first
     * match, or null if no match. One match is enough to act.
     */
    private _scanTextForSecrets;
    /**
     * Scan text for PHI proximity indicators. Returns the pattern source on
     * first match, or null.
     */
    private _scanTextForPhiIndicators;
    /**
     * Check whether the given file path matches any Content Exclusion path
     * configured in the pack binding. Returns the matching exclusion path, or
     * null.
     *
     * NOTE: This supplements the GitHub Content Exclusion setting -- it does
     * not replace it. The customer must also configure Content Exclusion in
     * their GitHub org settings for it to take effect at the GitHub network level.
     */
    private _checkContentExclusion;
    /**
     * True if the pack binding includes HIPAA.
     */
    private _isHipaaBinding;
    /**
     * Check that the Copilot flavour is BAA-eligible when a HIPAA binding is
     * active. Returns a DENY decision if the flavour is non-BAA-eligible,
     * or null if no issue is found.
     *
     * PT-ADAPT-GHCOPILOT-3: Copilot Enterprise tenant with non-BAA
     * data-retention setting is blocked under HIPAA binding.
     */
    private _checkFlavourCompliance;
    /** Expose the resolved Copilot flavour for diagnostics / tests. */
    getCopilotFlavour(): CopilotEnterpriseFlavour;
    /** Expose the public-code filter setting for diagnostics / tests. */
    getPublicCodeFilter(): CopilotPublicCodeFilter;
}
//# sourceMappingURL=github-copilot.d.ts.map