/**
 * @name config/secure-config
 * @description Secure JSON configuration system with approval workflow and audit trail
 * @module config/secure-config
 */
/**
 * Secure JSON Configuration System
 *
 * Features:
 * - Dynamic config reload without restart
 * - Approval workflow for sensitive changes
 * - Complete audit trail (on-chain + off-chain)
 * - Zod runtime validation
 * - Git-friendly JSON format
 *
 * Security Model:
 * - Config changes are signed and timestamped
 * - Sensitive changes require approval (time-lock or multi-sig)
 * - All changes logged to audit trail
 * - Config hash can be submitted to SAP Oracle (optional)
 */
import { z } from 'zod';
/**
 * Core configuration schema
 */
export declare const coreConfigSchema: z.ZodObject<{
    mode: z.ZodDefault<z.ZodEnum<["readonly", "local-dev-keypair", "external-signer", "delegated-session", "hosted-api"]>>;
    rpcUrl: z.ZodDefault<z.ZodString>;
    rpcUrlDevnet: z.ZodOptional<z.ZodString>;
    rpcUrlTestnet: z.ZodOptional<z.ZodString>;
    programId: z.ZodDefault<z.ZodString>;
    commitment: z.ZodDefault<z.ZodEnum<["processed", "confirmed", "finalized"]>>;
    agentPubkey: z.ZodOptional<z.ZodString>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    walletPath: z.ZodOptional<z.ZodString>;
    walletEncrypted: z.ZodDefault<z.ZodBoolean>;
    walletPassphraseEnv: z.ZodOptional<z.ZodString>;
    externalSignerUrl: z.ZodOptional<z.ZodString>;
    externalSignerTimeoutMs: z.ZodDefault<z.ZodNumber>;
    enableHttp: z.ZodDefault<z.ZodBoolean>;
    httpPort: z.ZodDefault<z.ZodNumber>;
    httpHost: z.ZodDefault<z.ZodString>;
    httpCorsOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    maxTxValueSol: z.ZodDefault<z.ZodNumber>;
    requireApprovalAboveSol: z.ZodDefault<z.ZodNumber>;
    dailyLimitSol: z.ZodDefault<z.ZodNumber>;
    allowedTools: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodArray<z.ZodString, "many">]>>;
    logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error"]>>;
    logFormat: z.ZodDefault<z.ZodEnum<["json", "pretty"]>>;
    logFile: z.ZodOptional<z.ZodString>;
    enableMetrics: z.ZodDefault<z.ZodBoolean>;
    metricsPort: z.ZodDefault<z.ZodNumber>;
    enableCache: z.ZodDefault<z.ZodBoolean>;
    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
    enableRateLimit: z.ZodDefault<z.ZodBoolean>;
    rateLimitPerMinute: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    mode: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api";
    programId: string;
    rpcUrl: string;
    commitment: "confirmed" | "processed" | "finalized";
    maxRetries: number;
    retryDelayMs: number;
    walletEncrypted: boolean;
    externalSignerTimeoutMs: number;
    enableHttp: boolean;
    httpPort: number;
    httpHost: string;
    maxTxValueSol: number;
    requireApprovalAboveSol: number;
    dailyLimitSol: number;
    allowedTools: string[] | "all";
    logLevel: "info" | "debug" | "warn" | "error";
    logFormat: "json" | "pretty";
    enableMetrics: boolean;
    metricsPort: number;
    enableCache: boolean;
    cacheTtlSeconds: number;
    enableRateLimit: boolean;
    rateLimitPerMinute: number;
    rpcUrlDevnet?: string | undefined;
    rpcUrlTestnet?: string | undefined;
    agentPubkey?: string | undefined;
    walletPath?: string | undefined;
    walletPassphraseEnv?: string | undefined;
    externalSignerUrl?: string | undefined;
    httpCorsOrigins?: string[] | undefined;
    logFile?: string | undefined;
}, {
    mode?: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api" | undefined;
    programId?: string | undefined;
    rpcUrl?: string | undefined;
    rpcUrlDevnet?: string | undefined;
    rpcUrlTestnet?: string | undefined;
    commitment?: "confirmed" | "processed" | "finalized" | undefined;
    agentPubkey?: string | undefined;
    maxRetries?: number | undefined;
    retryDelayMs?: number | undefined;
    walletPath?: string | undefined;
    walletEncrypted?: boolean | undefined;
    walletPassphraseEnv?: string | undefined;
    externalSignerUrl?: string | undefined;
    externalSignerTimeoutMs?: number | undefined;
    enableHttp?: boolean | undefined;
    httpPort?: number | undefined;
    httpHost?: string | undefined;
    httpCorsOrigins?: string[] | undefined;
    maxTxValueSol?: number | undefined;
    requireApprovalAboveSol?: number | undefined;
    dailyLimitSol?: number | undefined;
    allowedTools?: string[] | "all" | undefined;
    logLevel?: "info" | "debug" | "warn" | "error" | undefined;
    logFormat?: "json" | "pretty" | undefined;
    logFile?: string | undefined;
    enableMetrics?: boolean | undefined;
    metricsPort?: number | undefined;
    enableCache?: boolean | undefined;
    cacheTtlSeconds?: number | undefined;
    enableRateLimit?: boolean | undefined;
    rateLimitPerMinute?: number | undefined;
}>;
/**
 * Type alias for core config values used by the SAP MCP runtime.
 */
export type CoreConfig = z.infer<typeof coreConfigSchema>;
/**
 * Security settings for config changes
 */
export declare const securityConfigSchema: z.ZodObject<{
    requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    approvalTimeout: z.ZodDefault<z.ZodNumber>;
    maxChangesPerDay: z.ZodDefault<z.ZodNumber>;
    requireMultiSig: z.ZodDefault<z.ZodBoolean>;
    multiSigThreshold: z.ZodOptional<z.ZodNumber>;
    multiSigApprovers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    requireApprovalFor: string[];
    approvalTimeout: number;
    maxChangesPerDay: number;
    requireMultiSig: boolean;
    multiSigThreshold?: number | undefined;
    multiSigApprovers?: string[] | undefined;
}, {
    requireApprovalFor?: string[] | undefined;
    approvalTimeout?: number | undefined;
    maxChangesPerDay?: number | undefined;
    requireMultiSig?: boolean | undefined;
    multiSigThreshold?: number | undefined;
    multiSigApprovers?: string[] | undefined;
}>;
/**
 * Type alias for security config values used by the SAP MCP runtime.
 */
export type SecurityConfig = z.infer<typeof securityConfigSchema>;
/**
 * Audit trail configuration
 */
export declare const auditConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    logPath: z.ZodOptional<z.ZodString>;
    retentionDays: z.ZodDefault<z.ZodNumber>;
    submitToOracle: z.ZodDefault<z.ZodBoolean>;
    oracleEndpoint: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    enabled: boolean;
    retentionDays: number;
    submitToOracle: boolean;
    logPath?: string | undefined;
    oracleEndpoint?: string | undefined;
}, {
    enabled?: boolean | undefined;
    logPath?: string | undefined;
    retentionDays?: number | undefined;
    submitToOracle?: boolean | undefined;
    oracleEndpoint?: string | undefined;
}>;
/**
 * Type alias for audit config values used by the SAP MCP runtime.
 */
export type AuditConfig = z.infer<typeof auditConfigSchema>;
/**
 * Shared bento config schema definition used by the SAP MCP runtime.
 */
export declare const bentoConfigSchema: z.ZodOptional<z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    apiKey: z.ZodOptional<z.ZodString>;
    agentId: z.ZodOptional<z.ZodString>;
    endpoint: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    enabled: boolean;
    apiKey?: string | undefined;
    agentId?: string | undefined;
    endpoint?: string | undefined;
}, {
    enabled?: boolean | undefined;
    apiKey?: string | undefined;
    agentId?: string | undefined;
    endpoint?: string | undefined;
}>>;
/**
 * Shared policy runtime config schema definition used by the SAP MCP runtime.
 */
export declare const policyRuntimeConfigSchema: z.ZodOptional<z.ZodObject<{
    mode: z.ZodDefault<z.ZodEnum<["local-only", "bento-only", "hybrid"]>>;
    failOpen: z.ZodDefault<z.ZodBoolean>;
    logging: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    mode: "local-only" | "bento-only" | "hybrid";
    failOpen: boolean;
    logging: boolean;
}, {
    mode?: "local-only" | "bento-only" | "hybrid" | undefined;
    failOpen?: boolean | undefined;
    logging?: boolean | undefined;
}>>;
/**
 * Audit log entry
 */
export interface AuditEntry {
    timestamp: string;
    action: 'config_change' | 'config_reload' | 'approval_granted' | 'approval_denied';
    user: string;
    changes?: {
        field: string;
        oldValue: unknown;
        newValue: unknown;
    }[];
    approvalRequired: boolean;
    approvalStatus?: 'pending' | 'approved' | 'denied';
    signature?: string;
    configHash: string;
}
/**
 * Complete configuration schema with security and audit
 */
export declare const fullConfigSchema: z.ZodObject<{
    $security: z.ZodOptional<z.ZodObject<{
        requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
        approvalTimeout: z.ZodDefault<z.ZodNumber>;
        maxChangesPerDay: z.ZodDefault<z.ZodNumber>;
        requireMultiSig: z.ZodDefault<z.ZodBoolean>;
        multiSigThreshold: z.ZodOptional<z.ZodNumber>;
        multiSigApprovers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        requireApprovalFor: string[];
        approvalTimeout: number;
        maxChangesPerDay: number;
        requireMultiSig: boolean;
        multiSigThreshold?: number | undefined;
        multiSigApprovers?: string[] | undefined;
    }, {
        requireApprovalFor?: string[] | undefined;
        approvalTimeout?: number | undefined;
        maxChangesPerDay?: number | undefined;
        requireMultiSig?: boolean | undefined;
        multiSigThreshold?: number | undefined;
        multiSigApprovers?: string[] | undefined;
    }>>;
    $audit: z.ZodOptional<z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        logPath: z.ZodOptional<z.ZodString>;
        retentionDays: z.ZodDefault<z.ZodNumber>;
        submitToOracle: z.ZodDefault<z.ZodBoolean>;
        oracleEndpoint: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        enabled: boolean;
        retentionDays: number;
        submitToOracle: boolean;
        logPath?: string | undefined;
        oracleEndpoint?: string | undefined;
    }, {
        enabled?: boolean | undefined;
        logPath?: string | undefined;
        retentionDays?: number | undefined;
        submitToOracle?: boolean | undefined;
        oracleEndpoint?: string | undefined;
    }>>;
    bento: z.ZodOptional<z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        apiKey: z.ZodOptional<z.ZodString>;
        agentId: z.ZodOptional<z.ZodString>;
        endpoint: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        enabled: boolean;
        apiKey?: string | undefined;
        agentId?: string | undefined;
        endpoint?: string | undefined;
    }, {
        enabled?: boolean | undefined;
        apiKey?: string | undefined;
        agentId?: string | undefined;
        endpoint?: string | undefined;
    }>>;
    policy: z.ZodOptional<z.ZodObject<{
        mode: z.ZodDefault<z.ZodEnum<["local-only", "bento-only", "hybrid"]>>;
        failOpen: z.ZodDefault<z.ZodBoolean>;
        logging: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        mode: "local-only" | "bento-only" | "hybrid";
        failOpen: boolean;
        logging: boolean;
    }, {
        mode?: "local-only" | "bento-only" | "hybrid" | undefined;
        failOpen?: boolean | undefined;
        logging?: boolean | undefined;
    }>>;
    $meta: z.ZodOptional<z.ZodObject<{
        version: z.ZodString;
        createdAt: z.ZodString;
        updatedAt: z.ZodString;
        lastHash: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        version: string;
        createdAt: string;
        updatedAt: string;
        lastHash: string;
    }, {
        version: string;
        createdAt: string;
        updatedAt: string;
        lastHash: string;
    }>>;
    mode: z.ZodDefault<z.ZodEnum<["readonly", "local-dev-keypair", "external-signer", "delegated-session", "hosted-api"]>>;
    rpcUrl: z.ZodDefault<z.ZodString>;
    rpcUrlDevnet: z.ZodOptional<z.ZodString>;
    rpcUrlTestnet: z.ZodOptional<z.ZodString>;
    programId: z.ZodDefault<z.ZodString>;
    commitment: z.ZodDefault<z.ZodEnum<["processed", "confirmed", "finalized"]>>;
    agentPubkey: z.ZodOptional<z.ZodString>;
    maxRetries: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
    walletPath: z.ZodOptional<z.ZodString>;
    walletEncrypted: z.ZodDefault<z.ZodBoolean>;
    walletPassphraseEnv: z.ZodOptional<z.ZodString>;
    externalSignerUrl: z.ZodOptional<z.ZodString>;
    externalSignerTimeoutMs: z.ZodDefault<z.ZodNumber>;
    enableHttp: z.ZodDefault<z.ZodBoolean>;
    httpPort: z.ZodDefault<z.ZodNumber>;
    httpHost: z.ZodDefault<z.ZodString>;
    httpCorsOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    maxTxValueSol: z.ZodDefault<z.ZodNumber>;
    requireApprovalAboveSol: z.ZodDefault<z.ZodNumber>;
    dailyLimitSol: z.ZodDefault<z.ZodNumber>;
    allowedTools: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodArray<z.ZodString, "many">]>>;
    logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error"]>>;
    logFormat: z.ZodDefault<z.ZodEnum<["json", "pretty"]>>;
    logFile: z.ZodOptional<z.ZodString>;
    enableMetrics: z.ZodDefault<z.ZodBoolean>;
    metricsPort: z.ZodDefault<z.ZodNumber>;
    enableCache: z.ZodDefault<z.ZodBoolean>;
    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
    enableRateLimit: z.ZodDefault<z.ZodBoolean>;
    rateLimitPerMinute: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    mode: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api";
    programId: string;
    rpcUrl: string;
    commitment: "confirmed" | "processed" | "finalized";
    maxRetries: number;
    retryDelayMs: number;
    walletEncrypted: boolean;
    externalSignerTimeoutMs: number;
    enableHttp: boolean;
    httpPort: number;
    httpHost: string;
    maxTxValueSol: number;
    requireApprovalAboveSol: number;
    dailyLimitSol: number;
    allowedTools: string[] | "all";
    logLevel: "info" | "debug" | "warn" | "error";
    logFormat: "json" | "pretty";
    enableMetrics: boolean;
    metricsPort: number;
    enableCache: boolean;
    cacheTtlSeconds: number;
    enableRateLimit: boolean;
    rateLimitPerMinute: number;
    rpcUrlDevnet?: string | undefined;
    rpcUrlTestnet?: string | undefined;
    agentPubkey?: string | undefined;
    walletPath?: string | undefined;
    walletPassphraseEnv?: string | undefined;
    externalSignerUrl?: string | undefined;
    httpCorsOrigins?: string[] | undefined;
    logFile?: string | undefined;
    $security?: {
        requireApprovalFor: string[];
        approvalTimeout: number;
        maxChangesPerDay: number;
        requireMultiSig: boolean;
        multiSigThreshold?: number | undefined;
        multiSigApprovers?: string[] | undefined;
    } | undefined;
    $audit?: {
        enabled: boolean;
        retentionDays: number;
        submitToOracle: boolean;
        logPath?: string | undefined;
        oracleEndpoint?: string | undefined;
    } | undefined;
    bento?: {
        enabled: boolean;
        apiKey?: string | undefined;
        agentId?: string | undefined;
        endpoint?: string | undefined;
    } | undefined;
    policy?: {
        mode: "local-only" | "bento-only" | "hybrid";
        failOpen: boolean;
        logging: boolean;
    } | undefined;
    $meta?: {
        version: string;
        createdAt: string;
        updatedAt: string;
        lastHash: string;
    } | undefined;
}, {
    mode?: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api" | undefined;
    programId?: string | undefined;
    rpcUrl?: string | undefined;
    rpcUrlDevnet?: string | undefined;
    rpcUrlTestnet?: string | undefined;
    commitment?: "confirmed" | "processed" | "finalized" | undefined;
    agentPubkey?: string | undefined;
    maxRetries?: number | undefined;
    retryDelayMs?: number | undefined;
    walletPath?: string | undefined;
    walletEncrypted?: boolean | undefined;
    walletPassphraseEnv?: string | undefined;
    externalSignerUrl?: string | undefined;
    externalSignerTimeoutMs?: number | undefined;
    enableHttp?: boolean | undefined;
    httpPort?: number | undefined;
    httpHost?: string | undefined;
    httpCorsOrigins?: string[] | undefined;
    maxTxValueSol?: number | undefined;
    requireApprovalAboveSol?: number | undefined;
    dailyLimitSol?: number | undefined;
    allowedTools?: string[] | "all" | undefined;
    logLevel?: "info" | "debug" | "warn" | "error" | undefined;
    logFormat?: "json" | "pretty" | undefined;
    logFile?: string | undefined;
    enableMetrics?: boolean | undefined;
    metricsPort?: number | undefined;
    enableCache?: boolean | undefined;
    cacheTtlSeconds?: number | undefined;
    enableRateLimit?: boolean | undefined;
    rateLimitPerMinute?: number | undefined;
    $security?: {
        requireApprovalFor?: string[] | undefined;
        approvalTimeout?: number | undefined;
        maxChangesPerDay?: number | undefined;
        requireMultiSig?: boolean | undefined;
        multiSigThreshold?: number | undefined;
        multiSigApprovers?: string[] | undefined;
    } | undefined;
    $audit?: {
        enabled?: boolean | undefined;
        logPath?: string | undefined;
        retentionDays?: number | undefined;
        submitToOracle?: boolean | undefined;
        oracleEndpoint?: string | undefined;
    } | undefined;
    bento?: {
        enabled?: boolean | undefined;
        apiKey?: string | undefined;
        agentId?: string | undefined;
        endpoint?: string | undefined;
    } | undefined;
    policy?: {
        mode?: "local-only" | "bento-only" | "hybrid" | undefined;
        failOpen?: boolean | undefined;
        logging?: boolean | undefined;
    } | undefined;
    $meta?: {
        version: string;
        createdAt: string;
        updatedAt: string;
        lastHash: string;
    } | undefined;
}>;
/**
 * Type alias for full config values used by the SAP MCP runtime.
 */
export type FullConfig = z.infer<typeof fullConfigSchema>;
declare const pendingChangeSchema: z.ZodObject<{
    id: z.ZodString;
    field: z.ZodString;
    oldValue: z.ZodUnknown;
    newValue: z.ZodUnknown;
    requestedAt: z.ZodString;
    requestedBy: z.ZodString;
    status: z.ZodEnum<["pending", "approved", "denied"]>;
    expiresAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    field: string;
    status: "pending" | "approved" | "denied";
    expiresAt: string;
    id: string;
    requestedAt: string;
    requestedBy: string;
    oldValue?: unknown;
    newValue?: unknown;
}, {
    field: string;
    status: "pending" | "approved" | "denied";
    expiresAt: string;
    id: string;
    requestedAt: string;
    requestedBy: string;
    oldValue?: unknown;
    newValue?: unknown;
}>;
/**
 * Contract describing pending change data used by the SAP MCP runtime.
 */
export type PendingChange = z.infer<typeof pendingChangeSchema>;
/**
 * Runtime service that implements secure config manager behavior.
 */
export declare class SecureConfigManager {
    private configPath;
    private auditPath;
    private pendingPath;
    private currentConfig;
    private pendingChanges;
    constructor(configDir?: string);
    /**
     * Get default config directory
     */
    private getDefaultConfigDir;
    /**
     * Load configuration from file
     */
    load(): FullConfig;
    /**
     * Create default configuration
     */
    private createDefaultConfig;
    /**
     * Save configuration to file
     */
    save(config: FullConfig): void;
    /**
     * Update configuration with approval workflow
     */
    update(changes: Partial<FullConfig>, user?: string): Promise<UpdateResult>;
    /**
     * Approve a pending change
     */
    approve(changeId: string, approver?: string): boolean;
    /**
     * Deny a pending change
     */
    deny(changeId: string, approver?: string): boolean;
    /**
     * Get pending changes
     */
    getPendingChanges(): PendingChange[];
    /**
     * Get audit log
     */
    getAuditLog(limit?: number): AuditEntry[];
    /**
     * Get current config hash
     */
    getConfigHash(): string;
    /**
     * Hash configuration (for audit/oracle)
     */
    private hashConfig;
    /**
     * Generate unique change ID
     */
    private generateChangeId;
    /**
     * Loads pending changes from disk so CLI approval commands work across process boundaries.
     */
    private loadPendingChanges;
    /**
     * Persists pending changes atomically for separate CLI invocations.
     */
    private savePendingChanges;
    /**
     * Removes expired pending changes before they are shown or approved.
     */
    private pruneExpiredPendingChanges;
    /**
     * Compares simple JSON-compatible config values before creating a change request.
     */
    private areValuesEqual;
    /**
     * Log audit entry
     */
    private logAuditEntry;
}
/**
 * Contract describing update result data used by the SAP MCP runtime.
 */
export interface UpdateResult {
    applied: string[];
    pending: string[];
    pendingChanges: PendingChange[];
}
/**
 * Executes the get config manager operation.
 */
export declare function getConfigManager(configDir?: string): SecureConfigManager;
export {};
//# sourceMappingURL=secure-config.d.ts.map