/**
 * OpenClawAdapter -- Orchestrator adapter for OpenClaw (Peter Steinberger, MIT).
 *
 * OpenClaw is a messaging-platform-first agent runner with 247k GitHub stars.
 * Architecture: persistent memory, multi-model support, primary delivery via
 * Telegram, WhatsApp, Slack, Discord, and Signal.
 *
 * License: MIT -- no IPR encumbrance. Pure community-inbound adapter.
 *
 * ARCHITECTURAL NOTE (honest limitation):
 *   OpenClaw is designed for personal / SMB use cases. Our adapter governs any
 *   OpenClaw deployment that opts in by wrapping OpenClaw's action + memory layer
 *   with our three-layer enforcement. The adapter does NOT turn OpenClaw into a
 *   multi-tenant compliance runtime -- that is architecturally incompatible with
 *   OpenClaw's single-user-first design. Regulated enterprise deployments should
 *   use this adapter AND a hardened runtime configuration.
 *
 *   DEFERRED-OPENCLAW-ENTERPRISE-HARDENING: For HIPAA-regulated OpenClaw
 *   deployments, a dedicated hardening guide is required (isolation, PHI
 *   minimisation, BAA confirmation with each messaging platform, persistent
 *   memory encryption at rest). Route to Vera for legal review before any
 *   production HIPAA deployment.
 *
 * Hook surface:
 *
 *   const adapter = new OpenClawAdapter(cfg);
 *   adapter.initialize(orchCfg);
 *
 *   // At agent session start:
 *   await adapter.agentStart(agentId, userId, platform, contextSnapshot);
 *
 *   // Before every action:
 *   await adapter.actionCall(agentId, actionName, args, platform);
 *
 *   // After every action result:
 *   await adapter.actionResult(agentId, actionName, result);
 *
 *   // Before writing to persistent memory:
 *   await adapter.memoryWrite(agentId, key, value, sessionId);
 *
 *   // Before reading from persistent memory:
 *   await adapter.memoryRead(agentId, key, sessionId);
 *
 *   // Before sending an outbound message to a messaging platform:
 *   await adapter.outboundMessage(agentId, platform, recipientId, content);
 *
 *   // Before an LLM call:
 *   await adapter.llmCall(agentId, model, messages);
 *
 *   // When the session ends:
 *   await adapter.agentEnd(agentId, outcome);
 *
 * Messaging platform surface:
 *   Every outbound message to Telegram / WhatsApp / Slack / Discord / Signal
 *   is an egress event. The nine-guard stack applies. Unsanctioned workspaces
 *   are blocked.
 *
 * Memory governance:
 *   OpenClaw's persistent memory across sessions means every memory write is
 *   an ingress event that must be classified. Every memory read is a potential
 *   PHI/PII leak surface. Cross-session memory reads pseudonymise protected
 *   identifiers when regulated packs are bound.
 *
 * Multi-model governance:
 *   Provider-compliance fires per-call, same pattern as other adapters.
 *
 * Pentest gate:
 *   PT-ADAPT-OPENCLAW-1: memory write containing PHI fails closed under HIPAA binding.
 *   PT-ADAPT-OPENCLAW-2: outbound message to unsanctioned Telegram / Slack workspace blocked.
 *   PT-ADAPT-OPENCLAW-3: cross-session memory retrieval pseudonymises protected identifiers.
 *
 * Spec: P3-SUB-ADAPT-07
 * @connexum/ai-governance
 */
import { BaseOrchestratorAdapter } from './base';
import { OrchestratorCapabilities, WorkflowContext, WorkflowDecision, WorkflowStepContext, WorkflowStepDecision, WorkflowResult, RoleEdgeContext, RoleEdgeDecision, OrchestratorError } from './index';
import { OpenClawUnboundDataError } from '../errors/index';
import type { TaskContext, TaskDecision, PlanContext, PlanDecision, DelegationContext, DelegationDecision } from './orchestrator-adapter';
/**
 * Thrown when an OpenClaw agent acts without a pack binding.
 * Re-exports canonical UnboundDataError as OpenClawUnboundDataError so
 * a single `instanceof UnboundDataError` at the server boundary matches
 * all adapter origins. (C2 fix, 2026-04-24)
 */
export { OpenClawUnboundDataError };
/**
 * Thrown when a memory write contains PHI and HIPAA binding is active.
 * Memory writes are an ingress event -- fail closed.
 */
export declare class OpenClawMemoryPhiError extends Error {
    readonly agentId: string;
    readonly key: string;
    constructor(agentId: string, key: string);
}
/**
 * Thrown when an outbound message is destined for an unsanctioned messaging
 * platform workspace (workspace not in the sanctionedWorkspaces allowlist).
 */
export declare class OpenClawUnsanctionedWorkspaceError extends Error {
    readonly agentId: string;
    readonly platform: OpenClawPlatform;
    readonly workspaceId: string;
    constructor(agentId: string, platform: OpenClawPlatform, workspaceId: string);
}
/** Messaging platforms supported by OpenClaw. */
export type OpenClawPlatform = 'Telegram' | 'WhatsApp' | 'Slack' | 'Discord' | 'Signal' | 'Email' | 'SMS' | 'UNKNOWN';
/** Context snapshot at agent session start. */
export interface OpenClawContextSnapshot {
    /** ISO-8601 timestamp at spawn */
    spawnedAt: string;
    /** Pack binding array -- MUST be non-empty */
    packBinding: string[];
    /** LLM model identifier */
    model: string;
    /** Whether this agent has persistent memory (cross-session) */
    hasPersistentMemory: boolean;
    /** Messaging platforms this agent is authorised to use */
    authorisedPlatforms: OpenClawPlatform[];
    /** Provider identifier (e.g. 'openai', 'anthropic', 'bedrock') */
    providerId?: string;
    /** Arbitrary session metadata */
    metadata?: Record<string, unknown>;
}
/** Arguments to an OpenClaw action call. */
export interface OpenClawActionArgs {
    [key: string]: unknown;
}
/** Result of an OpenClaw action call. */
export interface OpenClawActionResult {
    success: boolean;
    output?: unknown;
    error?: string;
    durationMs?: number;
}
/** An outbound message payload. */
export interface OpenClawOutboundMessage {
    /** Platform recipient identifier (e.g. Telegram chat_id, Slack channel, Discord channel) */
    recipientId: string;
    /**
     * Workspace / server identifier for platforms that have workspace-level
     * containment (Slack, Discord). For Telegram and WhatsApp this is the
     * same as recipientId or a channel prefix.
     */
    workspaceId?: string;
    /** Message text content */
    content: string;
    /** Optional attachments (file names only, no content in audit events) */
    attachmentNames?: string[];
}
/** A message in an LLM conversation turn. */
export interface OpenClawLlmMessage {
    role: 'user' | 'assistant' | 'system';
    content: string;
}
/** Memory entry shape. */
export interface OpenClawMemoryEntry {
    /** Memory key */
    key: string;
    /** Memory value (string or serialisable object) */
    value: string | Record<string, unknown>;
    /**
     * Session that wrote this entry.
     * For cross-session memory, this is the originating session.
     */
    sourceSessionId?: string;
    /** ISO-8601 write timestamp */
    writtenAt?: string;
}
/** Terminal outcome at agent session end. */
export interface OpenClawAgentOutcome {
    success: boolean;
    summary?: string;
    durationMs?: number;
    error?: string;
    totalActionCalls?: number;
    totalMemoryWrites?: number;
    totalOutboundMessages?: number;
}
export interface OpenClawAdapterConfig {
    /**
     * Agent IDs registered under governance.
     * Empty array denies all agents (fail closed).
     */
    registeredAgents: string[];
    /**
     * LLM model identifiers approved for use.
     */
    approvedModels: string[];
    /**
     * Action names that require reviewer approval before execution.
     */
    sensitiveActions: string[];
    /**
     * Action argument keys to scan for PHI / exfiltration patterns.
     */
    sensitiveArgKeys: string[];
    /**
     * Sanctioned messaging workspace IDs per platform.
     * Maps platform name -> set of allowed workspace IDs.
     * An empty set for a platform means ALL workspaces are blocked on that platform.
     *
     * Example:
     *   {
     *     Slack: new Set(['T01234ABCD', 'T56789EFGH']),
     *     Discord: new Set(['987654321012345678']),
     *     Telegram: new Set(),   // Telegram entirely blocked
     *   }
     */
    sanctionedWorkspaces: Map<OpenClawPlatform, Set<string>>;
    /**
     * When true (default), memory writes containing PHI are blocked under HIPAA.
     */
    blockPhiMemoryWrite?: boolean;
    /**
     * When true (default), cross-session memory reads pseudonymise protected
     * identifiers under regulated pack bindings (GDPR, HIPAA, FCRA).
     */
    pseudonymiseCrossSessionReads?: boolean;
    /**
     * HMAC key used for pseudonymisation.
     * If not provided, a session-scoped random key is used (non-persistent pseudonyms).
     * For persistent cross-session pseudonymisation, provide a stable key.
     *
     * DEFERRED-OPENCLAW-ENTERPRISE-HARDENING: Stable key must be managed via
     * KeyManager (src/security/key-management.ts) in production HIPAA deployments.
     */
    pseudonymisationKey?: string;
    /**
     * When true (default), enforce pack-binding at every hook surface.
     */
    enforcePackBinding?: boolean;
    /**
     * Maximum action calls per session before automatic suspension.
     */
    maxActionCallsPerSession?: number;
}
export declare class OpenClawAdapter extends BaseOrchestratorAdapter {
    readonly adapterId = "openclaw";
    readonly orchestratorId = "openclaw";
    private openClawConfig;
    /** Active agent sessions: agentId -> contextSnapshot */
    private activeSessions;
    /** Per-session action call counters */
    private actionCallCounters;
    /** Per-session memory write counters */
    private memoryWriteCounters;
    /** Per-session outbound message counters */
    private outboundMessageCounters;
    /** Pseudonymisation key (session-scoped random if not provided in config) */
    private readonly pseudoKey;
    constructor(config: OpenClawAdapterConfig);
    /**
     * Called when an OpenClaw agent session starts.
     *   1. Agent registration check
     *   2. Pack-binding resolver
     *   3. Provider / model compliance check
     *   4. Platform authorisation check
     */
    agentStart(agentId: string, userId: string, platform: OpenClawPlatform, contextSnapshot: OpenClawContextSnapshot): Promise<WorkflowDecision>;
    /**
     * Called before OpenClaw writes a value to its persistent memory store.
     * Every memory write is an ingress event that must be classified.
     *
     * Under HIPAA binding:
     *   - PHI in memory values is blocked (fail closed)
     *   - Memory write is audited with phi-detection flag
     *
     * Throws OpenClawMemoryPhiError when PHI is detected under HIPAA + blockPhiMemoryWrite=true.
     */
    memoryWrite(agentId: string, key: string, value: string | Record<string, unknown>, sessionId?: string): Promise<{
        auditId: string;
    }>;
    /**
     * Called before OpenClaw reads from its persistent memory store.
     * Cross-session reads are a potential PHI/PII leak surface.
     *
     * When regulated packs are bound (GDPR, HIPAA, FCRA):
     *   - Protected identifiers in memory keys are pseudonymised before surfacing
     *     in audit events (PT-ADAPT-OPENCLAW-3).
     *
     * Returns the (potentially pseudonymised) key that was read.
     */
    memoryRead(agentId: string, key: string, sessionId?: string): Promise<{
        auditId: string;
        pseudonymisedKey: string | null;
    }>;
    /**
     * Called before OpenClaw sends a message to a messaging platform.
     * Every outbound message is an egress event -- the nine-guard stack applies.
     *
     *   1. Active-session check
     *   2. Platform in authorised platforms list
     *   3. Workspace in sanctioned workspace allowlist (PT-ADAPT-OPENCLAW-2)
     *   4. PHI scan on message content
     *
     * Throws OpenClawUnsanctionedWorkspaceError for unsanctioned workspaces.
     */
    outboundMessage(agentId: string, platform: OpenClawPlatform, message: OpenClawOutboundMessage): Promise<TaskDecision>;
    /**
     * Called before every OpenClaw action.
     *   1. Active-session check
     *   2. Pack-binding check
     *   3. Runaway counter
     *   4. Sensitive-action REQUIRE_APPROVAL routing
     *   5. Exfiltration scan on sensitive argument keys
     */
    actionCall(agentId: string, actionName: string, args: OpenClawActionArgs, platform?: OpenClawPlatform): Promise<TaskDecision>;
    actionResult(agentId: string, actionName: string, result: OpenClawActionResult): Promise<void>;
    llmCall(agentId: string, model: string, messages: OpenClawLlmMessage[]): Promise<TaskDecision>;
    agentEnd(agentId: string, outcome: OpenClawAgentOutcome): Promise<void>;
    private hasHipaaBinding;
    private hasRegulatedBinding;
    private containsPhiPattern;
    startWorkflow(ctx: WorkflowContext): Promise<WorkflowDecision>;
    stepWorkflow(ctx: WorkflowStepContext): Promise<WorkflowStepDecision>;
    completeWorkflow(ctx: WorkflowContext, result: WorkflowResult): Promise<void>;
    preTask(task: TaskContext): Promise<TaskDecision>;
    postTask(task: TaskContext, result: Record<string, unknown>): Promise<void>;
    prePlan(plan: PlanContext): Promise<PlanDecision>;
    postPlan(plan: PlanContext, result: Record<string, unknown>): Promise<void>;
    preDelegation(d: DelegationContext): Promise<DelegationDecision>;
    postDelegation(d: DelegationContext, result: Record<string, unknown>): Promise<void>;
    invokeRoleEdge(edge: RoleEdgeContext): Promise<RoleEdgeDecision>;
    translateError(raw: unknown): OrchestratorError;
    getOrchestratorCapabilities(): OrchestratorCapabilities;
}
//# sourceMappingURL=openclaw.d.ts.map