@oobe-protocol-labs/sap-mcp-server 0.1.0

package/dist/config/secure-config.d.ts

@@ -0,0 +1,607 @@
+/**
+ * Secure JSON Configuration System
+ *
+ * Features:
+ * - Dynamic config reload without restart
+ * - Approval workflow for sensitive changes
+ * - Complete audit trail (on-chain + off-chain)
+ * - Zod runtime validation
+ * - Git-friendly JSON format
+ *
+ * Security Model:
+ * - Config changes are signed and timestamped
+ * - Sensitive changes require approval (time-lock or multi-sig)
+ * - All changes logged to audit trail
+ * - Config hash can be submitted to SAP Oracle (optional)
+ */
+import { z } from 'zod';
+/**
+ * Core configuration schema
+ */
+export declare const coreConfigSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["readonly", "local-dev-keypair", "external-signer", "delegated-session", "hosted-api"]>>;
+    rpcUrl: z.ZodDefault<z.ZodString>;
+    rpcUrlDevnet: z.ZodOptional<z.ZodString>;
+    rpcUrlTestnet: z.ZodOptional<z.ZodString>;
+    programId: z.ZodDefault<z.ZodString>;
+    commitment: z.ZodDefault<z.ZodEnum<["processed", "confirmed", "finalized"]>>;
+    agentPubkey: z.ZodOptional<z.ZodString>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    walletPath: z.ZodOptional<z.ZodString>;
+    walletEncrypted: z.ZodDefault<z.ZodBoolean>;
+    walletPassphraseEnv: z.ZodOptional<z.ZodString>;
+    externalSignerUrl: z.ZodOptional<z.ZodString>;
+    externalSignerTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    enableHttp: z.ZodDefault<z.ZodBoolean>;
+    httpPort: z.ZodDefault<z.ZodNumber>;
+    httpHost: z.ZodDefault<z.ZodString>;
+    httpCorsOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    maxTxValueSol: z.ZodDefault<z.ZodNumber>;
+    requireApprovalAboveSol: z.ZodDefault<z.ZodNumber>;
+    dailyLimitSol: z.ZodDefault<z.ZodNumber>;
+    allowedTools: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodArray<z.ZodString, "many">]>>;
+    logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+    logFormat: z.ZodDefault<z.ZodEnum<["json", "pretty"]>>;
+    logFile: z.ZodOptional<z.ZodString>;
+    enableMetrics: z.ZodDefault<z.ZodBoolean>;
+    metricsPort: z.ZodDefault<z.ZodNumber>;
+    enableCache: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    enableRateLimit: z.ZodDefault<z.ZodBoolean>;
+    rateLimitPerMinute: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    mode: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api";
+    rpcUrl: string;
+    programId: string;
+    commitment: "processed" | "confirmed" | "finalized";
+    maxRetries: number;
+    retryDelayMs: number;
+    walletEncrypted: boolean;
+    externalSignerTimeoutMs: number;
+    enableHttp: boolean;
+    httpPort: number;
+    httpHost: string;
+    maxTxValueSol: number;
+    requireApprovalAboveSol: number;
+    dailyLimitSol: number;
+    allowedTools: string[] | "all";
+    logLevel: "debug" | "info" | "warn" | "error";
+    logFormat: "json" | "pretty";
+    enableMetrics: boolean;
+    metricsPort: number;
+    enableCache: boolean;
+    cacheTtlSeconds: number;
+    enableRateLimit: boolean;
+    rateLimitPerMinute: number;
+    rpcUrlDevnet?: string | undefined;
+    rpcUrlTestnet?: string | undefined;
+    agentPubkey?: string | undefined;
+    walletPath?: string | undefined;
+    walletPassphraseEnv?: string | undefined;
+    externalSignerUrl?: string | undefined;
+    httpCorsOrigins?: string[] | undefined;
+    logFile?: string | undefined;
+}, {
+    mode?: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api" | undefined;
+    rpcUrl?: string | undefined;
+    rpcUrlDevnet?: string | undefined;
+    rpcUrlTestnet?: string | undefined;
+    programId?: string | undefined;
+    commitment?: "processed" | "confirmed" | "finalized" | undefined;
+    agentPubkey?: string | undefined;
+    maxRetries?: number | undefined;
+    retryDelayMs?: number | undefined;
+    walletPath?: string | undefined;
+    walletEncrypted?: boolean | undefined;
+    walletPassphraseEnv?: string | undefined;
+    externalSignerUrl?: string | undefined;
+    externalSignerTimeoutMs?: number | undefined;
+    enableHttp?: boolean | undefined;
+    httpPort?: number | undefined;
+    httpHost?: string | undefined;
+    httpCorsOrigins?: string[] | undefined;
+    maxTxValueSol?: number | undefined;
+    requireApprovalAboveSol?: number | undefined;
+    dailyLimitSol?: number | undefined;
+    allowedTools?: string[] | "all" | undefined;
+    logLevel?: "debug" | "info" | "warn" | "error" | undefined;
+    logFormat?: "json" | "pretty" | undefined;
+    logFile?: string | undefined;
+    enableMetrics?: boolean | undefined;
+    metricsPort?: number | undefined;
+    enableCache?: boolean | undefined;
+    cacheTtlSeconds?: number | undefined;
+    enableRateLimit?: boolean | undefined;
+    rateLimitPerMinute?: number | undefined;
+}>;
+/**
+ * Type alias for core config values used by the SAP MCP runtime.
+ */
+export type CoreConfig = z.infer<typeof coreConfigSchema>;
+/**
+ * Security settings for config changes
+ */
+export declare const securityConfigSchema: z.ZodObject<{
+    requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    approvalTimeout: z.ZodDefault<z.ZodNumber>;
+    maxChangesPerDay: z.ZodDefault<z.ZodNumber>;
+    requireMultiSig: z.ZodDefault<z.ZodBoolean>;
+    multiSigThreshold: z.ZodOptional<z.ZodNumber>;
+    multiSigApprovers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    requireApprovalFor: string[];
+    approvalTimeout: number;
+    maxChangesPerDay: number;
+    requireMultiSig: boolean;
+    multiSigThreshold?: number | undefined;
+    multiSigApprovers?: string[] | undefined;
+}, {
+    requireApprovalFor?: string[] | undefined;
+    approvalTimeout?: number | undefined;
+    maxChangesPerDay?: number | undefined;
+    requireMultiSig?: boolean | undefined;
+    multiSigThreshold?: number | undefined;
+    multiSigApprovers?: string[] | undefined;
+}>;
+/**
+ * Type alias for security config values used by the SAP MCP runtime.
+ */
+export type SecurityConfig = z.infer<typeof securityConfigSchema>;
+/**
+ * Audit trail configuration
+ */
+export declare const auditConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    logPath: z.ZodOptional<z.ZodString>;
+    retentionDays: z.ZodDefault<z.ZodNumber>;
+    submitToOracle: z.ZodDefault<z.ZodBoolean>;
+    oracleEndpoint: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    retentionDays: number;
+    submitToOracle: boolean;
+    logPath?: string | undefined;
+    oracleEndpoint?: string | undefined;
+}, {
+    enabled?: boolean | undefined;
+    logPath?: string | undefined;
+    retentionDays?: number | undefined;
+    submitToOracle?: boolean | undefined;
+    oracleEndpoint?: string | undefined;
+}>;
+/**
+ * Type alias for audit config values used by the SAP MCP runtime.
+ */
+export type AuditConfig = z.infer<typeof auditConfigSchema>;
+/**
+ * Shared bento config schema definition used by the SAP MCP runtime.
+ */
+export declare const bentoConfigSchema: z.ZodOptional<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    apiKey?: string | undefined;
+    agentId?: string | undefined;
+    endpoint?: string | undefined;
+}, {
+    enabled?: boolean | undefined;
+    apiKey?: string | undefined;
+    agentId?: string | undefined;
+    endpoint?: string | undefined;
+}>>;
+/**
+ * Shared policy runtime config schema definition used by the SAP MCP runtime.
+ */
+export declare const policyRuntimeConfigSchema: z.ZodOptional<z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["local-only", "bento-only", "hybrid"]>>;
+    failOpen: z.ZodDefault<z.ZodBoolean>;
+    logging: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    mode: "local-only" | "bento-only" | "hybrid";
+    failOpen: boolean;
+    logging: boolean;
+}, {
+    mode?: "local-only" | "bento-only" | "hybrid" | undefined;
+    failOpen?: boolean | undefined;
+    logging?: boolean | undefined;
+}>>;
+/**
+ * Audit log entry
+ */
+export interface AuditEntry {
+    timestamp: string;
+    action: 'config_change' | 'config_reload' | 'approval_granted' | 'approval_denied';
+    user: string;
+    changes?: {
+        field: string;
+        oldValue: unknown;
+        newValue: unknown;
+    }[];
+    approvalRequired: boolean;
+    approvalStatus?: 'pending' | 'approved' | 'denied';
+    signature?: string;
+    configHash: string;
+}
+/**
+ * Complete configuration schema with security and audit
+ */
+export declare const fullConfigSchema: z.ZodObject<{
+    $security: z.ZodOptional<z.ZodObject<{
+        requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        approvalTimeout: z.ZodDefault<z.ZodNumber>;
+        maxChangesPerDay: z.ZodDefault<z.ZodNumber>;
+        requireMultiSig: z.ZodDefault<z.ZodBoolean>;
+        multiSigThreshold: z.ZodOptional<z.ZodNumber>;
+        multiSigApprovers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        requireApprovalFor: string[];
+        approvalTimeout: number;
+        maxChangesPerDay: number;
+        requireMultiSig: boolean;
+        multiSigThreshold?: number | undefined;
+        multiSigApprovers?: string[] | undefined;
+    }, {
+        requireApprovalFor?: string[] | undefined;
+        approvalTimeout?: number | undefined;
+        maxChangesPerDay?: number | undefined;
+        requireMultiSig?: boolean | undefined;
+        multiSigThreshold?: number | undefined;
+        multiSigApprovers?: string[] | undefined;
+    }>>;
+    $audit: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        logPath: z.ZodOptional<z.ZodString>;
+        retentionDays: z.ZodDefault<z.ZodNumber>;
+        submitToOracle: z.ZodDefault<z.ZodBoolean>;
+        oracleEndpoint: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        retentionDays: number;
+        submitToOracle: boolean;
+        logPath?: string | undefined;
+        oracleEndpoint?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        logPath?: string | undefined;
+        retentionDays?: number | undefined;
+        submitToOracle?: boolean | undefined;
+        oracleEndpoint?: string | undefined;
+    }>>;
+    bento: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        endpoint: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        apiKey?: string | undefined;
+        agentId?: string | undefined;
+        endpoint?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        apiKey?: string | undefined;
+        agentId?: string | undefined;
+        endpoint?: string | undefined;
+    }>>;
+    policy: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<["local-only", "bento-only", "hybrid"]>>;
+        failOpen: z.ZodDefault<z.ZodBoolean>;
+        logging: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        mode: "local-only" | "bento-only" | "hybrid";
+        failOpen: boolean;
+        logging: boolean;
+    }, {
+        mode?: "local-only" | "bento-only" | "hybrid" | undefined;
+        failOpen?: boolean | undefined;
+        logging?: boolean | undefined;
+    }>>;
+    $meta: z.ZodOptional<z.ZodObject<{
+        version: z.ZodString;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        lastHash: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        createdAt: string;
+        updatedAt: string;
+        lastHash: string;
+    }, {
+        version: string;
+        createdAt: string;
+        updatedAt: string;
+        lastHash: string;
+    }>>;
+    mode: z.ZodDefault<z.ZodEnum<["readonly", "local-dev-keypair", "external-signer", "delegated-session", "hosted-api"]>>;
+    rpcUrl: z.ZodDefault<z.ZodString>;
+    rpcUrlDevnet: z.ZodOptional<z.ZodString>;
+    rpcUrlTestnet: z.ZodOptional<z.ZodString>;
+    programId: z.ZodDefault<z.ZodString>;
+    commitment: z.ZodDefault<z.ZodEnum<["processed", "confirmed", "finalized"]>>;
+    agentPubkey: z.ZodOptional<z.ZodString>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    walletPath: z.ZodOptional<z.ZodString>;
+    walletEncrypted: z.ZodDefault<z.ZodBoolean>;
+    walletPassphraseEnv: z.ZodOptional<z.ZodString>;
+    externalSignerUrl: z.ZodOptional<z.ZodString>;
+    externalSignerTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    enableHttp: z.ZodDefault<z.ZodBoolean>;
+    httpPort: z.ZodDefault<z.ZodNumber>;
+    httpHost: z.ZodDefault<z.ZodString>;
+    httpCorsOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    maxTxValueSol: z.ZodDefault<z.ZodNumber>;
+    requireApprovalAboveSol: z.ZodDefault<z.ZodNumber>;
+    dailyLimitSol: z.ZodDefault<z.ZodNumber>;
+    allowedTools: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodArray<z.ZodString, "many">]>>;
+    logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+    logFormat: z.ZodDefault<z.ZodEnum<["json", "pretty"]>>;
+    logFile: z.ZodOptional<z.ZodString>;
+    enableMetrics: z.ZodDefault<z.ZodBoolean>;
+    metricsPort: z.ZodDefault<z.ZodNumber>;
+    enableCache: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    enableRateLimit: z.ZodDefault<z.ZodBoolean>;
+    rateLimitPerMinute: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    mode: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api";
+    rpcUrl: string;
+    programId: string;
+    commitment: "processed" | "confirmed" | "finalized";
+    maxRetries: number;
+    retryDelayMs: number;
+    walletEncrypted: boolean;
+    externalSignerTimeoutMs: number;
+    enableHttp: boolean;
+    httpPort: number;
+    httpHost: string;
+    maxTxValueSol: number;
+    requireApprovalAboveSol: number;
+    dailyLimitSol: number;
+    allowedTools: string[] | "all";
+    logLevel: "debug" | "info" | "warn" | "error";
+    logFormat: "json" | "pretty";
+    enableMetrics: boolean;
+    metricsPort: number;
+    enableCache: boolean;
+    cacheTtlSeconds: number;
+    enableRateLimit: boolean;
+    rateLimitPerMinute: number;
+    rpcUrlDevnet?: string | undefined;
+    rpcUrlTestnet?: string | undefined;
+    agentPubkey?: string | undefined;
+    walletPath?: string | undefined;
+    walletPassphraseEnv?: string | undefined;
+    externalSignerUrl?: string | undefined;
+    httpCorsOrigins?: string[] | undefined;
+    logFile?: string | undefined;
+    $security?: {
+        requireApprovalFor: string[];
+        approvalTimeout: number;
+        maxChangesPerDay: number;
+        requireMultiSig: boolean;
+        multiSigThreshold?: number | undefined;
+        multiSigApprovers?: string[] | undefined;
+    } | undefined;
+    $audit?: {
+        enabled: boolean;
+        retentionDays: number;
+        submitToOracle: boolean;
+        logPath?: string | undefined;
+        oracleEndpoint?: string | undefined;
+    } | undefined;
+    bento?: {
+        enabled: boolean;
+        apiKey?: string | undefined;
+        agentId?: string | undefined;
+        endpoint?: string | undefined;
+    } | undefined;
+    policy?: {
+        mode: "local-only" | "bento-only" | "hybrid";
+        failOpen: boolean;
+        logging: boolean;
+    } | undefined;
+    $meta?: {
+        version: string;
+        createdAt: string;
+        updatedAt: string;
+        lastHash: string;
+    } | undefined;
+}, {
+    mode?: "readonly" | "local-dev-keypair" | "external-signer" | "delegated-session" | "hosted-api" | undefined;
+    rpcUrl?: string | undefined;
+    rpcUrlDevnet?: string | undefined;
+    rpcUrlTestnet?: string | undefined;
+    programId?: string | undefined;
+    commitment?: "processed" | "confirmed" | "finalized" | undefined;
+    agentPubkey?: string | undefined;
+    maxRetries?: number | undefined;
+    retryDelayMs?: number | undefined;
+    walletPath?: string | undefined;
+    walletEncrypted?: boolean | undefined;
+    walletPassphraseEnv?: string | undefined;
+    externalSignerUrl?: string | undefined;
+    externalSignerTimeoutMs?: number | undefined;
+    enableHttp?: boolean | undefined;
+    httpPort?: number | undefined;
+    httpHost?: string | undefined;
+    httpCorsOrigins?: string[] | undefined;
+    maxTxValueSol?: number | undefined;
+    requireApprovalAboveSol?: number | undefined;
+    dailyLimitSol?: number | undefined;
+    allowedTools?: string[] | "all" | undefined;
+    logLevel?: "debug" | "info" | "warn" | "error" | undefined;
+    logFormat?: "json" | "pretty" | undefined;
+    logFile?: string | undefined;
+    enableMetrics?: boolean | undefined;
+    metricsPort?: number | undefined;
+    enableCache?: boolean | undefined;
+    cacheTtlSeconds?: number | undefined;
+    enableRateLimit?: boolean | undefined;
+    rateLimitPerMinute?: number | undefined;
+    $security?: {
+        requireApprovalFor?: string[] | undefined;
+        approvalTimeout?: number | undefined;
+        maxChangesPerDay?: number | undefined;
+        requireMultiSig?: boolean | undefined;
+        multiSigThreshold?: number | undefined;
+        multiSigApprovers?: string[] | undefined;
+    } | undefined;
+    $audit?: {
+        enabled?: boolean | undefined;
+        logPath?: string | undefined;
+        retentionDays?: number | undefined;
+        submitToOracle?: boolean | undefined;
+        oracleEndpoint?: string | undefined;
+    } | undefined;
+    bento?: {
+        enabled?: boolean | undefined;
+        apiKey?: string | undefined;
+        agentId?: string | undefined;
+        endpoint?: string | undefined;
+    } | undefined;
+    policy?: {
+        mode?: "local-only" | "bento-only" | "hybrid" | undefined;
+        failOpen?: boolean | undefined;
+        logging?: boolean | undefined;
+    } | undefined;
+    $meta?: {
+        version: string;
+        createdAt: string;
+        updatedAt: string;
+        lastHash: string;
+    } | undefined;
+}>;
+/**
+ * Type alias for full config values used by the SAP MCP runtime.
+ */
+export type FullConfig = z.infer<typeof fullConfigSchema>;
+declare const pendingChangeSchema: z.ZodObject<{
+    id: z.ZodString;
+    field: z.ZodString;
+    oldValue: z.ZodUnknown;
+    newValue: z.ZodUnknown;
+    requestedAt: z.ZodString;
+    requestedBy: z.ZodString;
+    status: z.ZodEnum<["pending", "approved", "denied"]>;
+    expiresAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status: "pending" | "approved" | "denied";
+    id: string;
+    field: string;
+    requestedAt: string;
+    requestedBy: string;
+    expiresAt: string;
+    oldValue?: unknown;
+    newValue?: unknown;
+}, {
+    status: "pending" | "approved" | "denied";
+    id: string;
+    field: string;
+    requestedAt: string;
+    requestedBy: string;
+    expiresAt: string;
+    oldValue?: unknown;
+    newValue?: unknown;
+}>;
+/**
+ * Contract describing pending change data used by the SAP MCP runtime.
+ */
+export type PendingChange = z.infer<typeof pendingChangeSchema>;
+/**
+ * Runtime service that implements secure config manager behavior.
+ */
+export declare class SecureConfigManager {
+    private configPath;
+    private auditPath;
+    private pendingPath;
+    private currentConfig;
+    private pendingChanges;
+    constructor(configDir?: string);
+    /**
+     * Get default config directory
+     */
+    private getDefaultConfigDir;
+    /**
+     * Load configuration from file
+     */
+    load(): FullConfig;
+    /**
+     * Create default configuration
+     */
+    private createDefaultConfig;
+    /**
+     * Save configuration to file
+     */
+    save(config: FullConfig): void;
+    /**
+     * Update configuration with approval workflow
+     */
+    update(changes: Partial<FullConfig>, user?: string): Promise<UpdateResult>;
+    /**
+     * Approve a pending change
+     */
+    approve(changeId: string, approver?: string): boolean;
+    /**
+     * Deny a pending change
+     */
+    deny(changeId: string, approver?: string): boolean;
+    /**
+     * Get pending changes
+     */
+    getPendingChanges(): PendingChange[];
+    /**
+     * Get audit log
+     */
+    getAuditLog(limit?: number): AuditEntry[];
+    /**
+     * Get current config hash
+     */
+    getConfigHash(): string;
+    /**
+     * Hash configuration (for audit/oracle)
+     */
+    private hashConfig;
+    /**
+     * Generate unique change ID
+     */
+    private generateChangeId;
+    /**
+     * Loads pending changes from disk so CLI approval commands work across process boundaries.
+     */
+    private loadPendingChanges;
+    /**
+     * Persists pending changes atomically for separate CLI invocations.
+     */
+    private savePendingChanges;
+    /**
+     * Removes expired pending changes before they are shown or approved.
+     */
+    private pruneExpiredPendingChanges;
+    /**
+     * Compares simple JSON-compatible config values before creating a change request.
+     */
+    private areValuesEqual;
+    /**
+     * Log audit entry
+     */
+    private logAuditEntry;
+}
+/**
+ * Contract describing update result data used by the SAP MCP runtime.
+ */
+export interface UpdateResult {
+    applied: string[];
+    pending: string[];
+    pendingChanges: PendingChange[];
+}
+/**
+ * Executes the get config manager operation.
+ */
+export declare function getConfigManager(configDir?: string): SecureConfigManager;
+export {};
+//# sourceMappingURL=secure-config.d.ts.map

package/dist/config/secure-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-config.d.ts","sourceRoot":"","sources":["../../src/config/secure-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiD3B,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAqB/B,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAM5B,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;GAKjB,CAAC;AAEd;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;GAIzB,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;KACnB,EAAE,CAAC;IACJ,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB3B,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAIH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,cAAc,CAAyC;gBAEnD,SAAS,CAAC,EAAE,MAAM;IAO9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACH,IAAI,IAAI,UAAU;IA0BlB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAqC9B;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAoEhF;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAmCrD;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAyBlD;;OAEG;IACH,iBAAiB,IAAI,aAAa,EAAE;IAMpC;;OAEG;IACH,WAAW,CAAC,KAAK,GAAE,MAAY,GAAG,UAAU,EAAE;IAa9C;;OAEG;IACH,aAAa,IAAI,MAAM;IAOvB;;OAEG;IACH,OAAO,CAAC,UAAU;IAKlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAgBlC;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,aAAa;CAQtB;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAQD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAUxE"}