@fentz26/envcp 1.1.0 → 1.2.0-exp.1

package/dist/types.d.ts

@@ -17,6 +17,146 @@ export declare const RateLimitConfigSchema: z.ZodObject<{
 export type RateLimitConfig = z.infer<typeof RateLimitConfigSchema>;
 export declare const VaultModeSchema: z.ZodEnum<["project", "global"]>;
 export type VaultMode = z.infer<typeof VaultModeSchema>;
+export declare const AuditFieldsSchema: z.ZodDefault<z.ZodObject<{
+    session_id: z.ZodDefault<z.ZodBoolean>;
+    client_id: z.ZodDefault<z.ZodBoolean>;
+    client_type: z.ZodDefault<z.ZodBoolean>;
+    ip: z.ZodDefault<z.ZodBoolean>;
+    user_agent: z.ZodDefault<z.ZodBoolean>;
+    purpose: z.ZodDefault<z.ZodBoolean>;
+    duration_ms: z.ZodDefault<z.ZodBoolean>;
+    variable: z.ZodDefault<z.ZodBoolean>;
+    message: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    message: boolean;
+    session_id: boolean;
+    client_id: boolean;
+    client_type: boolean;
+    ip: boolean;
+    user_agent: boolean;
+    purpose: boolean;
+    duration_ms: boolean;
+    variable: boolean;
+}, {
+    message?: boolean | undefined;
+    session_id?: boolean | undefined;
+    client_id?: boolean | undefined;
+    client_type?: boolean | undefined;
+    ip?: boolean | undefined;
+    user_agent?: boolean | undefined;
+    purpose?: boolean | undefined;
+    duration_ms?: boolean | undefined;
+    variable?: boolean | undefined;
+}>>;
+export declare const AuditConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    retain_days: z.ZodDefault<z.ZodNumber>;
+    fields: z.ZodDefault<z.ZodObject<{
+        session_id: z.ZodDefault<z.ZodBoolean>;
+        client_id: z.ZodDefault<z.ZodBoolean>;
+        client_type: z.ZodDefault<z.ZodBoolean>;
+        ip: z.ZodDefault<z.ZodBoolean>;
+        user_agent: z.ZodDefault<z.ZodBoolean>;
+        purpose: z.ZodDefault<z.ZodBoolean>;
+        duration_ms: z.ZodDefault<z.ZodBoolean>;
+        variable: z.ZodDefault<z.ZodBoolean>;
+        message: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        message: boolean;
+        session_id: boolean;
+        client_id: boolean;
+        client_type: boolean;
+        ip: boolean;
+        user_agent: boolean;
+        purpose: boolean;
+        duration_ms: boolean;
+        variable: boolean;
+    }, {
+        message?: boolean | undefined;
+        session_id?: boolean | undefined;
+        client_id?: boolean | undefined;
+        client_type?: boolean | undefined;
+        ip?: boolean | undefined;
+        user_agent?: boolean | undefined;
+        purpose?: boolean | undefined;
+        duration_ms?: boolean | undefined;
+        variable?: boolean | undefined;
+    }>>;
+    hmac: z.ZodDefault<z.ZodBoolean>;
+    hmac_key_path: z.ZodDefault<z.ZodString>;
+    hmac_chain: z.ZodDefault<z.ZodBoolean>;
+    protection: z.ZodDefault<z.ZodEnum<["none", "append_only", "immutable", "remote"]>>;
+    remote_ship: z.ZodOptional<z.ZodObject<{
+        type: z.ZodOptional<z.ZodEnum<["syslog", "http", "file"]>>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        api_key: z.ZodOptional<z.ZodString>;
+        batch_size: z.ZodDefault<z.ZodNumber>;
+        retry_count: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        batch_size: number;
+        retry_count: number;
+        type?: "syslog" | "http" | "file" | undefined;
+        endpoint?: string | undefined;
+        api_key?: string | undefined;
+    }, {
+        type?: "syslog" | "http" | "file" | undefined;
+        endpoint?: string | undefined;
+        api_key?: string | undefined;
+        batch_size?: number | undefined;
+        retry_count?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    retain_days: number;
+    fields: {
+        message: boolean;
+        session_id: boolean;
+        client_id: boolean;
+        client_type: boolean;
+        ip: boolean;
+        user_agent: boolean;
+        purpose: boolean;
+        duration_ms: boolean;
+        variable: boolean;
+    };
+    hmac: boolean;
+    hmac_key_path: string;
+    hmac_chain: boolean;
+    protection: "none" | "append_only" | "immutable" | "remote";
+    remote_ship?: {
+        batch_size: number;
+        retry_count: number;
+        type?: "syslog" | "http" | "file" | undefined;
+        endpoint?: string | undefined;
+        api_key?: string | undefined;
+    } | undefined;
+}, {
+    enabled?: boolean | undefined;
+    retain_days?: number | undefined;
+    fields?: {
+        message?: boolean | undefined;
+        session_id?: boolean | undefined;
+        client_id?: boolean | undefined;
+        client_type?: boolean | undefined;
+        ip?: boolean | undefined;
+        user_agent?: boolean | undefined;
+        purpose?: boolean | undefined;
+        duration_ms?: boolean | undefined;
+        variable?: boolean | undefined;
+    } | undefined;
+    hmac?: boolean | undefined;
+    hmac_key_path?: string | undefined;
+    hmac_chain?: boolean | undefined;
+    protection?: "none" | "append_only" | "immutable" | "remote" | undefined;
+    remote_ship?: {
+        type?: "syslog" | "http" | "file" | undefined;
+        endpoint?: string | undefined;
+        api_key?: string | undefined;
+        batch_size?: number | undefined;
+        retry_count?: number | undefined;
+    } | undefined;
+}>>;
+export type AuditConfig = z.infer<typeof AuditConfigSchema>;
 export declare const EnvCPConfigSchema: z.ZodObject<{
     version: z.ZodDefault<z.ZodString>;
     project: z.ZodOptional<z.ZodString>;
@@ -56,6 +196,26 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         blacklist_patterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         require_variable_password: z.ZodDefault<z.ZodBoolean>;
+        command_blacklist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        run_safety: z.ZodDefault<z.ZodObject<{
+            disallow_root_delete: z.ZodDefault<z.ZodBoolean>;
+            disallow_path_manipulation: z.ZodDefault<z.ZodBoolean>;
+            require_command_whitelist: z.ZodDefault<z.ZodBoolean>;
+            scrub_output: z.ZodDefault<z.ZodBoolean>;
+            redact_patterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            disallow_root_delete: boolean;
+            disallow_path_manipulation: boolean;
+            require_command_whitelist: boolean;
+            scrub_output: boolean;
+            redact_patterns: string[];
+        }, {
+            disallow_root_delete?: boolean | undefined;
+            disallow_path_manipulation?: boolean | undefined;
+            require_command_whitelist?: boolean | undefined;
+            scrub_output?: boolean | undefined;
+            redact_patterns?: string[] | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         allow_ai_read: boolean;
         allow_ai_write: boolean;
@@ -69,6 +229,14 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         audit_log: boolean;
         blacklist_patterns: string[];
         require_variable_password: boolean;
+        command_blacklist: string[];
+        run_safety: {
+            disallow_root_delete: boolean;
+            disallow_path_manipulation: boolean;
+            require_command_whitelist: boolean;
+            scrub_output: boolean;
+            redact_patterns: string[];
+        };
         allowed_commands?: string[] | undefined;
         allowed_patterns?: string[] | undefined;
         denied_patterns?: string[] | undefined;
@@ -88,6 +256,14 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         denied_patterns?: string[] | undefined;
         blacklist_patterns?: string[] | undefined;
         require_variable_password?: boolean | undefined;
+        command_blacklist?: string[] | undefined;
+        run_safety?: {
+            disallow_root_delete?: boolean | undefined;
+            disallow_path_manipulation?: boolean | undefined;
+            require_command_whitelist?: boolean | undefined;
+            scrub_output?: boolean | undefined;
+            redact_patterns?: string[] | undefined;
+        } | undefined;
     }>>;
     sync: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -116,16 +292,22 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         timeout_minutes: z.ZodDefault<z.ZodNumber>;
         max_extensions: z.ZodDefault<z.ZodNumber>;
         path: z.ZodDefault<z.ZodString>;
+        lockout_threshold: z.ZodDefault<z.ZodNumber>;
+        lockout_base_seconds: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         path: string;
         enabled: boolean;
         timeout_minutes: number;
         max_extensions: number;
+        lockout_threshold: number;
+        lockout_base_seconds: number;
     }, {
         path?: string | undefined;
         enabled?: boolean | undefined;
         timeout_minutes?: number | undefined;
         max_extensions?: number | undefined;
+        lockout_threshold?: number | undefined;
+        lockout_base_seconds?: number | undefined;
     }>>;
     encryption: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -144,15 +326,104 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         enabled?: boolean | undefined;
         service?: string | undefined;
     }>>;
+    hsm: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        type: z.ZodDefault<z.ZodEnum<["yubikey", "gpg", "pkcs11"]>>;
+        serial: z.ZodOptional<z.ZodString>;
+        require_touch: z.ZodDefault<z.ZodBoolean>;
+        key_id: z.ZodOptional<z.ZodString>;
+        pkcs11_lib: z.ZodOptional<z.ZodString>;
+        slot: z.ZodOptional<z.ZodNumber>;
+        protected_key_path: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "yubikey" | "gpg" | "pkcs11";
+        enabled: boolean;
+        require_touch: boolean;
+        protected_key_path: string;
+        serial?: string | undefined;
+        key_id?: string | undefined;
+        pkcs11_lib?: string | undefined;
+        slot?: number | undefined;
+    }, {
+        type?: "yubikey" | "gpg" | "pkcs11" | undefined;
+        enabled?: boolean | undefined;
+        serial?: string | undefined;
+        require_touch?: boolean | undefined;
+        key_id?: string | undefined;
+        pkcs11_lib?: string | undefined;
+        slot?: number | undefined;
+        protected_key_path?: string | undefined;
+    }>>;
+    auth: z.ZodDefault<z.ZodObject<{
+        method: z.ZodDefault<z.ZodEnum<["password", "keychain", "hsm", "multi"]>>;
+        multi_factors: z.ZodDefault<z.ZodArray<z.ZodEnum<["password", "keychain", "hsm"]>, "many">>;
+        fallback: z.ZodDefault<z.ZodEnum<["recovery_key", "password", "none"]>>;
+    }, "strip", z.ZodTypeAny, {
+        method: "keychain" | "hsm" | "password" | "multi";
+        multi_factors: ("keychain" | "hsm" | "password")[];
+        fallback: "none" | "password" | "recovery_key";
+    }, {
+        method?: "keychain" | "hsm" | "password" | "multi" | undefined;
+        multi_factors?: ("keychain" | "hsm" | "password")[] | undefined;
+        fallback?: "none" | "password" | "recovery_key" | undefined;
+    }>>;
     security: z.ZodDefault<z.ZodObject<{
         mode: z.ZodDefault<z.ZodEnum<["hard-lock", "recoverable"]>>;
         recovery_file: z.ZodDefault<z.ZodString>;
+        brute_force_protection: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            max_attempts: z.ZodDefault<z.ZodNumber>;
+            lockout_duration: z.ZodDefault<z.ZodNumber>;
+            progressive_delay: z.ZodDefault<z.ZodBoolean>;
+            max_delay: z.ZodDefault<z.ZodNumber>;
+            permanent_lockout_threshold: z.ZodDefault<z.ZodNumber>;
+            permanent_lockout_action: z.ZodDefault<z.ZodEnum<["require_recovery_key", "require_admin", "permanent_lock"]>>;
+            notifications: z.ZodDefault<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            max_attempts: number;
+            lockout_duration: number;
+            progressive_delay: boolean;
+            max_delay: number;
+            permanent_lockout_threshold: number;
+            permanent_lockout_action: "require_recovery_key" | "require_admin" | "permanent_lock";
+            notifications: {};
+        }, {
+            enabled?: boolean | undefined;
+            max_attempts?: number | undefined;
+            lockout_duration?: number | undefined;
+            progressive_delay?: boolean | undefined;
+            max_delay?: number | undefined;
+            permanent_lockout_threshold?: number | undefined;
+            permanent_lockout_action?: "require_recovery_key" | "require_admin" | "permanent_lock" | undefined;
+            notifications?: {} | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         mode: "hard-lock" | "recoverable";
         recovery_file: string;
+        brute_force_protection: {
+            enabled: boolean;
+            max_attempts: number;
+            lockout_duration: number;
+            progressive_delay: boolean;
+            max_delay: number;
+            permanent_lockout_threshold: number;
+            permanent_lockout_action: "require_recovery_key" | "require_admin" | "permanent_lock";
+            notifications: {};
+        };
     }, {
         mode?: "hard-lock" | "recoverable" | undefined;
         recovery_file?: string | undefined;
+        brute_force_protection?: {
+            enabled?: boolean | undefined;
+            max_attempts?: number | undefined;
+            lockout_duration?: number | undefined;
+            progressive_delay?: boolean | undefined;
+            max_delay?: number | undefined;
+            permanent_lockout_threshold?: number | undefined;
+            permanent_lockout_action?: "require_recovery_key" | "require_admin" | "permanent_lock" | undefined;
+            notifications?: {} | undefined;
+        } | undefined;
     }>>;
     password: z.ZodDefault<z.ZodObject<{
         min_length: z.ZodDefault<z.ZodNumber>;
@@ -198,6 +469,114 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         accessed?: string | undefined;
         sync_to_env?: boolean | undefined;
     }>>>;
+    audit: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        retain_days: z.ZodDefault<z.ZodNumber>;
+        fields: z.ZodDefault<z.ZodObject<{
+            session_id: z.ZodDefault<z.ZodBoolean>;
+            client_id: z.ZodDefault<z.ZodBoolean>;
+            client_type: z.ZodDefault<z.ZodBoolean>;
+            ip: z.ZodDefault<z.ZodBoolean>;
+            user_agent: z.ZodDefault<z.ZodBoolean>;
+            purpose: z.ZodDefault<z.ZodBoolean>;
+            duration_ms: z.ZodDefault<z.ZodBoolean>;
+            variable: z.ZodDefault<z.ZodBoolean>;
+            message: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            message: boolean;
+            session_id: boolean;
+            client_id: boolean;
+            client_type: boolean;
+            ip: boolean;
+            user_agent: boolean;
+            purpose: boolean;
+            duration_ms: boolean;
+            variable: boolean;
+        }, {
+            message?: boolean | undefined;
+            session_id?: boolean | undefined;
+            client_id?: boolean | undefined;
+            client_type?: boolean | undefined;
+            ip?: boolean | undefined;
+            user_agent?: boolean | undefined;
+            purpose?: boolean | undefined;
+            duration_ms?: boolean | undefined;
+            variable?: boolean | undefined;
+        }>>;
+        hmac: z.ZodDefault<z.ZodBoolean>;
+        hmac_key_path: z.ZodDefault<z.ZodString>;
+        hmac_chain: z.ZodDefault<z.ZodBoolean>;
+        protection: z.ZodDefault<z.ZodEnum<["none", "append_only", "immutable", "remote"]>>;
+        remote_ship: z.ZodOptional<z.ZodObject<{
+            type: z.ZodOptional<z.ZodEnum<["syslog", "http", "file"]>>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            api_key: z.ZodOptional<z.ZodString>;
+            batch_size: z.ZodDefault<z.ZodNumber>;
+            retry_count: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            batch_size: number;
+            retry_count: number;
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+        }, {
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+            batch_size?: number | undefined;
+            retry_count?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        retain_days: number;
+        fields: {
+            message: boolean;
+            session_id: boolean;
+            client_id: boolean;
+            client_type: boolean;
+            ip: boolean;
+            user_agent: boolean;
+            purpose: boolean;
+            duration_ms: boolean;
+            variable: boolean;
+        };
+        hmac: boolean;
+        hmac_key_path: string;
+        hmac_chain: boolean;
+        protection: "none" | "append_only" | "immutable" | "remote";
+        remote_ship?: {
+            batch_size: number;
+            retry_count: number;
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+        } | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        retain_days?: number | undefined;
+        fields?: {
+            message?: boolean | undefined;
+            session_id?: boolean | undefined;
+            client_id?: boolean | undefined;
+            client_type?: boolean | undefined;
+            ip?: boolean | undefined;
+            user_agent?: boolean | undefined;
+            purpose?: boolean | undefined;
+            duration_ms?: boolean | undefined;
+            variable?: boolean | undefined;
+        } | undefined;
+        hmac?: boolean | undefined;
+        hmac_key_path?: string | undefined;
+        hmac_chain?: boolean | undefined;
+        protection?: "none" | "append_only" | "immutable" | "remote" | undefined;
+        remote_ship?: {
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+            batch_size?: number | undefined;
+            retry_count?: number | undefined;
+        } | undefined;
+    }>>;
     server: z.ZodOptional<z.ZodObject<{
         mode: z.ZodOptional<z.ZodEnum<["mcp", "rest", "openai", "gemini", "all", "auto"]>>;
         port: z.ZodOptional<z.ZodNumber>;
@@ -219,11 +598,11 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
             whitelist?: string[] | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        api_key?: string | undefined;
         mode?: "mcp" | "rest" | "openai" | "gemini" | "all" | "auto" | undefined;
         port?: number | undefined;
         host?: string | undefined;
         cors?: boolean | undefined;
-        api_key?: string | undefined;
         auto_detect?: boolean | undefined;
         rate_limit?: {
             enabled: boolean;
@@ -231,11 +610,11 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
             whitelist: string[];
         } | undefined;
     }, {
+        api_key?: string | undefined;
         mode?: "mcp" | "rest" | "openai" | "gemini" | "all" | "auto" | undefined;
         port?: number | undefined;
         host?: string | undefined;
         cors?: boolean | undefined;
-        api_key?: string | undefined;
         auto_detect?: boolean | undefined;
         rate_limit?: {
             enabled?: boolean | undefined;
@@ -266,6 +645,14 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         audit_log: boolean;
         blacklist_patterns: string[];
         require_variable_password: boolean;
+        command_blacklist: string[];
+        run_safety: {
+            disallow_root_delete: boolean;
+            disallow_path_manipulation: boolean;
+            require_command_whitelist: boolean;
+            scrub_output: boolean;
+            redact_patterns: string[];
+        };
         allowed_commands?: string[] | undefined;
         allowed_patterns?: string[] | undefined;
         denied_patterns?: string[] | undefined;
@@ -283,6 +670,8 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         enabled: boolean;
         timeout_minutes: number;
         max_extensions: number;
+        lockout_threshold: number;
+        lockout_base_seconds: number;
     };
     encryption: {
         enabled: boolean;
@@ -291,9 +680,15 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         enabled: boolean;
         service: string;
     };
-    security: {
-        mode: "hard-lock" | "recoverable";
-        recovery_file: string;
+    hsm: {
+        type: "yubikey" | "gpg" | "pkcs11";
+        enabled: boolean;
+        require_touch: boolean;
+        protected_key_path: string;
+        serial?: string | undefined;
+        key_id?: string | undefined;
+        pkcs11_lib?: string | undefined;
+        slot?: number | undefined;
     };
     password: {
         min_length: number;
@@ -301,6 +696,51 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         allow_numeric_only: boolean;
         allow_single_char: boolean;
     };
+    auth: {
+        method: "keychain" | "hsm" | "password" | "multi";
+        multi_factors: ("keychain" | "hsm" | "password")[];
+        fallback: "none" | "password" | "recovery_key";
+    };
+    security: {
+        mode: "hard-lock" | "recoverable";
+        recovery_file: string;
+        brute_force_protection: {
+            enabled: boolean;
+            max_attempts: number;
+            lockout_duration: number;
+            progressive_delay: boolean;
+            max_delay: number;
+            permanent_lockout_threshold: number;
+            permanent_lockout_action: "require_recovery_key" | "require_admin" | "permanent_lock";
+            notifications: {};
+        };
+    };
+    audit: {
+        enabled: boolean;
+        retain_days: number;
+        fields: {
+            message: boolean;
+            session_id: boolean;
+            client_id: boolean;
+            client_type: boolean;
+            ip: boolean;
+            user_agent: boolean;
+            purpose: boolean;
+            duration_ms: boolean;
+            variable: boolean;
+        };
+        hmac: boolean;
+        hmac_key_path: string;
+        hmac_chain: boolean;
+        protection: "none" | "append_only" | "immutable" | "remote";
+        remote_ship?: {
+            batch_size: number;
+            retry_count: number;
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+        } | undefined;
+    };
     project?: string | undefined;
     variables?: Record<string, {
         value: string;
@@ -313,11 +753,11 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         accessed?: string | undefined;
     }> | undefined;
     server?: {
+        api_key?: string | undefined;
         mode?: "mcp" | "rest" | "openai" | "gemini" | "all" | "auto" | undefined;
         port?: number | undefined;
         host?: string | undefined;
         cors?: boolean | undefined;
-        api_key?: string | undefined;
         auto_detect?: boolean | undefined;
         rate_limit?: {
             enabled: boolean;
@@ -352,6 +792,14 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         denied_patterns?: string[] | undefined;
         blacklist_patterns?: string[] | undefined;
         require_variable_password?: boolean | undefined;
+        command_blacklist?: string[] | undefined;
+        run_safety?: {
+            disallow_root_delete?: boolean | undefined;
+            disallow_path_manipulation?: boolean | undefined;
+            require_command_whitelist?: boolean | undefined;
+            scrub_output?: boolean | undefined;
+            redact_patterns?: string[] | undefined;
+        } | undefined;
     } | undefined;
     sync?: {
         enabled?: boolean | undefined;
@@ -366,6 +814,8 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         enabled?: boolean | undefined;
         timeout_minutes?: number | undefined;
         max_extensions?: number | undefined;
+        lockout_threshold?: number | undefined;
+        lockout_base_seconds?: number | undefined;
     } | undefined;
     encryption?: {
         enabled?: boolean | undefined;
@@ -374,9 +824,15 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         enabled?: boolean | undefined;
         service?: string | undefined;
     } | undefined;
-    security?: {
-        mode?: "hard-lock" | "recoverable" | undefined;
-        recovery_file?: string | undefined;
+    hsm?: {
+        type?: "yubikey" | "gpg" | "pkcs11" | undefined;
+        enabled?: boolean | undefined;
+        serial?: string | undefined;
+        require_touch?: boolean | undefined;
+        key_id?: string | undefined;
+        pkcs11_lib?: string | undefined;
+        slot?: number | undefined;
+        protected_key_path?: string | undefined;
     } | undefined;
     password?: {
         min_length?: number | undefined;
@@ -384,6 +840,25 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         allow_numeric_only?: boolean | undefined;
         allow_single_char?: boolean | undefined;
     } | undefined;
+    auth?: {
+        method?: "keychain" | "hsm" | "password" | "multi" | undefined;
+        multi_factors?: ("keychain" | "hsm" | "password")[] | undefined;
+        fallback?: "none" | "password" | "recovery_key" | undefined;
+    } | undefined;
+    security?: {
+        mode?: "hard-lock" | "recoverable" | undefined;
+        recovery_file?: string | undefined;
+        brute_force_protection?: {
+            enabled?: boolean | undefined;
+            max_attempts?: number | undefined;
+            lockout_duration?: number | undefined;
+            progressive_delay?: boolean | undefined;
+            max_delay?: number | undefined;
+            permanent_lockout_threshold?: number | undefined;
+            permanent_lockout_action?: "require_recovery_key" | "require_admin" | "permanent_lock" | undefined;
+            notifications?: {} | undefined;
+        } | undefined;
+    } | undefined;
     variables?: Record<string, {
         value: string;
         encrypted?: boolean | undefined;
@@ -394,12 +869,38 @@ export declare const EnvCPConfigSchema: z.ZodObject<{
         accessed?: string | undefined;
         sync_to_env?: boolean | undefined;
     }> | undefined;
+    audit?: {
+        enabled?: boolean | undefined;
+        retain_days?: number | undefined;
+        fields?: {
+            message?: boolean | undefined;
+            session_id?: boolean | undefined;
+            client_id?: boolean | undefined;
+            client_type?: boolean | undefined;
+            ip?: boolean | undefined;
+            user_agent?: boolean | undefined;
+            purpose?: boolean | undefined;
+            duration_ms?: boolean | undefined;
+            variable?: boolean | undefined;
+        } | undefined;
+        hmac?: boolean | undefined;
+        hmac_key_path?: string | undefined;
+        hmac_chain?: boolean | undefined;
+        protection?: "none" | "append_only" | "immutable" | "remote" | undefined;
+        remote_ship?: {
+            type?: "syslog" | "http" | "file" | undefined;
+            endpoint?: string | undefined;
+            api_key?: string | undefined;
+            batch_size?: number | undefined;
+            retry_count?: number | undefined;
+        } | undefined;
+    } | undefined;
     server?: {
+        api_key?: string | undefined;
         mode?: "mcp" | "rest" | "openai" | "gemini" | "all" | "auto" | undefined;
         port?: number | undefined;
         host?: string | undefined;
         cors?: boolean | undefined;
-        api_key?: string | undefined;
         auto_detect?: boolean | undefined;
         rate_limit?: {
             enabled?: boolean | undefined;
@@ -452,25 +953,55 @@ export declare const VariableSchema: z.ZodObject<{
 export type Variable = z.infer<typeof VariableSchema>;
 export declare const OperationLogSchema: z.ZodObject<{
     timestamp: z.ZodString;
-    operation: z.ZodEnum<["add", "get", "update", "delete", "list", "sync", "export", "unlock", "lock", "check_access"]>;
+    operation: z.ZodEnum<["add", "get", "update", "delete", "list", "sync", "export", "unlock", "lock", "check_access", "run", "auth_failure", "permanent_lockout", "lockout_triggered"]>;
     variable: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<["cli", "mcp", "api"]>;
     success: z.ZodBoolean;
     message: z.ZodOptional<z.ZodString>;
+    session_id: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_type: z.ZodOptional<z.ZodString>;
+    ip: z.ZodOptional<z.ZodString>;
+    user_agent: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    duration_ms: z.ZodOptional<z.ZodNumber>;
+    hmac: z.ZodOptional<z.ZodString>;
+    prev_hmac: z.ZodOptional<z.ZodString>;
+    chain_index: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     timestamp: string;
-    operation: "sync" | "add" | "get" | "update" | "delete" | "list" | "export" | "unlock" | "lock" | "check_access";
+    operation: "sync" | "add" | "get" | "update" | "delete" | "list" | "export" | "unlock" | "lock" | "check_access" | "run" | "auth_failure" | "permanent_lockout" | "lockout_triggered";
     source: "mcp" | "cli" | "api";
     success: boolean;
     message?: string | undefined;
+    session_id?: string | undefined;
+    client_id?: string | undefined;
+    client_type?: string | undefined;
+    ip?: string | undefined;
+    user_agent?: string | undefined;
+    purpose?: string | undefined;
+    duration_ms?: number | undefined;
     variable?: string | undefined;
+    hmac?: string | undefined;
+    prev_hmac?: string | undefined;
+    chain_index?: number | undefined;
 }, {
     timestamp: string;
-    operation: "sync" | "add" | "get" | "update" | "delete" | "list" | "export" | "unlock" | "lock" | "check_access";
+    operation: "sync" | "add" | "get" | "update" | "delete" | "list" | "export" | "unlock" | "lock" | "check_access" | "run" | "auth_failure" | "permanent_lockout" | "lockout_triggered";
     source: "mcp" | "cli" | "api";
     success: boolean;
     message?: string | undefined;
+    session_id?: string | undefined;
+    client_id?: string | undefined;
+    client_type?: string | undefined;
+    ip?: string | undefined;
+    user_agent?: string | undefined;
+    purpose?: string | undefined;
+    duration_ms?: number | undefined;
     variable?: string | undefined;
+    hmac?: string | undefined;
+    prev_hmac?: string | undefined;
+    chain_index?: number | undefined;
 }>;
 export type OperationLog = z.infer<typeof OperationLogSchema>;
 export declare const SessionSchema: z.ZodObject<{
@@ -526,11 +1057,11 @@ export declare const ServerConfigSchema: z.ZodObject<{
         whitelist: string[];
     } | undefined;
 }, {
+    api_key?: string | undefined;
     mode?: "mcp" | "rest" | "openai" | "gemini" | "all" | "auto" | undefined;
     port?: number | undefined;
     host?: string | undefined;
     cors?: boolean | undefined;
-    api_key?: string | undefined;
     auto_detect?: boolean | undefined;
     rate_limit?: {
         enabled?: boolean | undefined;