/**
 * ZedAIAdapter -- Zed AI assistant governance adapter.
 *
 * Zed (https://zed.dev) is a high-performance, Rust-native code editor built
 * for collaboration. Its built-in AI assistant ("Zed AI") ships three
 * deployment modes:
 *
 *   zed-cloud      -- Anthropic-backed default; requests route through
 *                     Zed's cloud infrastructure (zed.dev servers).
 *   zed-byok       -- Bring your own key; the user configures a provider
 *                     (Anthropic, OpenAI, etc.) via Zed settings; requests
 *                     route directly from the local machine to that provider.
 *   zed-local-only -- Local Ollama / LM Studio integration; the model runs
 *                     on-device; no data leaves the machine. This adapter
 *                     enforces strict local-only isolation: any surface that
 *                     flags network egress is DENIED unconditionally when
 *                     localOnlyEnforcement is true (the default in this mode).
 *
 * Hook surfaces (9):
 *
 *   wrapInlineCompletion(prompt)
 *     Zed Predict / Zeta model auto-complete suggestion.
 *     In zed-local-only + localOnlyEnforcement: denied unless context
 *     provider flag indicates local model.
 *
 *   wrapChat(prompt)
 *     Assistant panel chat prompt.
 *     In zed-local-only + localOnlyEnforcement: denied on network-egress flag.
 *
 *   wrapAssistantThread(prompt, threadId)
 *     Threaded conversation context (multi-turn assistant panel).
 *     In zed-local-only + localOnlyEnforcement: denied on network-egress flag.
 *
 *   wrapSlashCommand(command, args)
 *     Slash commands: /explain, /refactor, /test, /diagnose, /migrate, etc.
 *     Denied if command not in slashCommandAllowList (when that list is set).
 *
 *   wrapInlineTransform(selection, instruction)
 *     cmd-Enter inline transform of selected code.
 *
 *   wrapTerminalAssist(command)
 *     Zed integrated terminal AI (assistant: terminal config).
 *     Requires allowTerminalAssist: true.
 *     When allowedTerminalPrefixes is set, the command must match at least
 *     one prefix.
 *
 *   wrapFileContext(filePath, content)
 *     Zed adds a file to the assistant context.
 *     File content is scanned for secrets before inclusion.
 *     Denied with zed-file-context-secret-detected on finding.
 *
 *   wrapMultiBufferEdit(bufferPaths, instruction)
 *     Zed multi-buffer editor -- simultaneous edits across files.
 *     Buffer count > multiBufferEditCap denied.
 *
 *   wrapVoiceInput(transcribedText)
 *     Voice mode input. Denied unless allowVoiceInput: true.
 *
 * Deployment mode enforcement (the differentiator):
 *
 *   zed-local-only with localOnlyEnforcement: true (default):
 *     All surfaces that can trigger network egress are denied unless the
 *     request carries localProvider: true in its ideMetadata. The
 *     enforcement logic is multi-layered:
 *       1. The mode guard runs first on every wrap call.
 *       2. Opt-in flags (allowTerminalAssist, allowVoiceInput) cannot
 *          override the local-only mode guard -- those are checked after
 *          the network-egress gate fails. PT-ADAPT-ZED-4 validates this.
 *       3. Setting localOnlyEnforcement: false in zed-local-only mode is
 *          rejected at construction (ambiguous privacy contract).
 *
 * Strict-mode enforcement:
 *   wrapTerminalAssist: allowTerminalAssist must be true + prefix match.
 *   wrapVoiceInput: allowVoiceInput must be true.
 *   wrapMultiBufferEdit: buffers.length > multiBufferEditCap denied.
 *   wrapSlashCommand: command must be in slashCommandAllowList if set.
 *   wrapFileContext: secret scan always applied; denied on finding.
 *   wrapInlineCompletion, wrapChat, wrapAssistantThread:
 *     in zed-local-only mode, denied if network egress flagged.
 *
 * Secret scanning:
 *   File content scanned for: AWS access keys, GitHub PATs, Anthropic API
 *   keys, OpenAI API keys, private key headers, generic SECRET/PASSWORD/
 *   API_KEY env vars, database URLs with embedded credentials, Bearer tokens.
 *   Secrets are NEVER echoed in audit entries (sanitized before emission).
 *
 * Pen-tests:
 *   PT-ADAPT-ZED-1: empty packBinding[] denied at every wrap call
 *   PT-ADAPT-ZED-2: API keys / Zed auth tokens never appear in audit entries
 *   PT-ADAPT-ZED-3: malformed config throws at construction (invalid mode,
 *                   negative cap, localOnlyEnforcement:false with zed-local-only)
 *   PT-ADAPT-ZED-4: local-only mode + network-egress feature ALWAYS denied
 *                   (even with explicit opt-in flags trying to override)
 *   PT-ADAPT-ZED-5: file context with .env content denied with
 *                   zed-file-context-secret-detected
 *
 * Spec: P3-SUB-IDE-11
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity } from './index';
/**
 * Zed AI deployment modes.
 *
 *   zed-cloud      -- Anthropic-backed default; routes through zed.dev cloud.
 *   zed-byok       -- Bring your own key; user configures provider in settings.
 *   zed-local-only -- On-device Ollama / LM Studio; no network egress permitted.
 */
export type ZedDeploymentMode = 'zed-cloud' | 'zed-byok' | 'zed-local-only';
export declare const ZED_VALID_DEPLOYMENT_MODES: readonly ZedDeploymentMode[];
export interface ZedAIAdapterConfig extends IdeAdapterConfig {
    /**
     * Zed AI deployment mode.
     * Default: 'zed-cloud'
     */
    deploymentMode?: ZedDeploymentMode;
    /**
     * Enforce local-only isolation in zed-local-only mode.
     * When true (default in zed-local-only), any surface that can trigger
     * network egress is denied unless the request carries localProvider:true
     * in ideMetadata.
     *
     * Setting localOnlyEnforcement: false in zed-local-only mode is rejected
     * at construction (PT-ADAPT-ZED-3): the combination creates an ambiguous
     * privacy contract where users believe data stays on-device but the adapter
     * does not enforce it.
     *
     * Default: true (in zed-local-only mode), ignored in other modes.
     */
    localOnlyEnforcement?: boolean;
    /**
     * Allow Zed integrated terminal AI (assistant: terminal config).
     * Default: false.
     * In zed-local-only mode, terminal assist is always gated by the
     * local-only enforcement check first.
     */
    allowTerminalAssist?: boolean;
    /**
     * When allowTerminalAssist is true, restrict terminal commands to those
     * starting with at least one of these prefixes.
     * When empty (default), all commands are permitted (subject to other gates).
     */
    allowedTerminalPrefixes?: string[];
    /**
     * Allow Zed voice mode input.
     * Default: false.
     * In zed-local-only mode, voice input is always gated by the
     * local-only enforcement check first.
     */
    allowVoiceInput?: boolean;
    /**
     * Maximum number of buffers that may be modified in a single
     * multi-buffer edit operation.
     * Default: 15.
     */
    multiBufferEditCap?: number;
    /**
     * When set, restricts slash commands to only those in this list.
     * Example: ['explain', 'refactor', 'test']
     * When not set (undefined/empty), all slash commands are permitted.
     */
    slashCommandAllowList?: string[];
}
export declare class ZedAIAdapter extends BaseIdeAdapter {
    readonly adapterId = "zed-ai";
    readonly ideId = "zed-ai";
    private deploymentMode;
    private localOnlyEnforcement;
    private allowTerminalAssist;
    private allowedTerminalPrefixes;
    private allowVoiceInput;
    private multiBufferEditCap;
    private slashCommandAllowList;
    initialize(config: ZedAIAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    getIdeCapabilities(): IdeAdapterCapabilities;
    interceptToolInvocation(ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    wrapInlineCompletion(ctx: ToolInvocationContext, prompt: string): Promise<ToolInvocationDecision>;
    wrapChat(ctx: ToolInvocationContext, prompt: string): Promise<ToolInvocationDecision>;
    wrapAssistantThread(ctx: ToolInvocationContext, prompt: string, threadId: string): Promise<ToolInvocationDecision>;
    wrapSlashCommand(ctx: ToolInvocationContext, command: string, args: string): Promise<ToolInvocationDecision>;
    wrapInlineTransform(ctx: ToolInvocationContext, selection: string, instruction: string): Promise<ToolInvocationDecision>;
    wrapTerminalAssist(ctx: ToolInvocationContext, command: string): Promise<ToolInvocationDecision>;
    wrapFileContext(ctx: ToolInvocationContext, filePath: string, content: string): Promise<ToolInvocationDecision>;
    wrapMultiBufferEdit(ctx: ToolInvocationContext, bufferPaths: string[], instruction: string): Promise<ToolInvocationDecision>;
    wrapVoiceInput(ctx: ToolInvocationContext, transcribedText: string): Promise<ToolInvocationDecision>;
    private checkPackBinding;
    /**
     * Local-only enforcement gate.
     *
     * In zed-local-only mode with localOnlyEnforcement: true (default), all
     * surfaces that can route requests to a network provider are denied unless
     * the request carries ideMetadata.localProvider: true.
     *
     * This is the primary differentiator of the Zed local-only mode: it is
     * a default-deny posture. The caller must explicitly signal "I am using
     * a local provider" to pass. Any feature that does not carry this signal
     * is treated as potentially routing to a network provider and denied.
     *
     * PT-ADAPT-ZED-4: opt-in flags (allowTerminalAssist, allowVoiceInput)
     * cannot override this gate. The local-only enforcement check happens
     * BEFORE the opt-in check in every wrap method.
     *
     * Returns a DENY decision if enforcement applies, or null to continue.
     */
    private checkLocalOnlyEnforcement;
}
//# sourceMappingURL=zed-ai.d.ts.map