/**
 * PCI-DSS 4.0 Compliance Framework
 *
 * Implements Payment Card Industry Data Security Standard version 4.0
 * for payment card security, covering all 12 requirements.
 *
 * Requirements:
 * - Req 1: Network security controls
 * - Req 2: Secure configurations
 * - Req 3: Protect stored account data
 * - Req 4: Protect data in transit
 * - Req 5: Malware protection
 * - Req 6: Secure systems development
 * - Req 7: Restrict access
 * - Req 8: User identification
 * - Req 9: Physical access
 * - Req 10: Logging and monitoring
 * - Req 11: Security testing
 * - Req 12: Security policies
 *
 * @packageDocumentation
 */
import type { ComplianceFramework, ComplianceControl, ControlPriority, ImplementationStatus } from '../types.js';
/**
 * PCI-DSS Data Classification Categories
 */
export declare const PCI_DATA_CLASSIFICATIONS: {
    /** Cardholder Data - PAN, cardholder name, expiration date, service code */
    readonly CHD: "CHD";
    /** Sensitive Authentication Data - Full track, CVV/CVC, PIN/PIN block */
    readonly SAD: "SAD";
    /** Primary Account Number */
    readonly PAN: "PAN";
    /** Track Data (magnetic stripe) */
    readonly TRACK_DATA: "TRACK_DATA";
    /** Card Verification Value/Code */
    readonly CVV: "CVV";
    /** Personal Identification Number */
    readonly PIN: "PIN";
};
export type PCIDataClassification = (typeof PCI_DATA_CLASSIFICATIONS)[keyof typeof PCI_DATA_CLASSIFICATIONS];
/**
 * Data element with classification
 */
export interface PCIDataElement {
    type: PCIDataClassification;
    storageAllowed: boolean;
    encryptionRequired: boolean;
    maxRetentionDays: number | null;
    description: string;
}
/**
 * PCI Data Elements Reference
 */
export declare const PCI_DATA_ELEMENTS: Record<PCIDataClassification, PCIDataElement>;
/**
 * Network zone classifications for CDE segmentation
 */
export declare const NETWORK_ZONES: {
    readonly CDE: "CDE";
    readonly CONNECTED: "CONNECTED";
    readonly OUT_OF_SCOPE: "OUT_OF_SCOPE";
};
export type NetworkZone = (typeof NETWORK_ZONES)[keyof typeof NETWORK_ZONES];
/**
 * Network segment definition
 */
export interface NetworkSegment {
    id: string;
    name: string;
    zone: NetworkZone;
    description: string;
    ipRanges: string[];
    allowedInbound: string[];
    allowedOutbound: string[];
}
/**
 * Firewall rule for CDE protection
 */
export interface FirewallRule {
    id: string;
    name: string;
    sourceZone: NetworkZone;
    destinationZone: NetworkZone;
    protocol: string;
    ports: string[];
    action: 'allow' | 'deny';
    logging: boolean;
    businessJustification: string;
}
/**
 * Token representing a masked/tokenized PAN
 */
export interface PANToken {
    token: string;
    lastFour: string;
    firstSix?: string;
    tokenizedAt: Date;
    expiresAt?: Date;
}
/**
 * Cardholder Data Service for secure CHD handling
 *
 * Implements PCI-DSS requirements for:
 * - PAN masking (show only last 4)
 * - PAN tokenization
 * - Secure deletion
 * - Audit logging (never logs full PAN)
 */
export declare class CardholderDataService {
    private readonly tokenVault;
    private readonly auditLog;
    /**
     * Mask a PAN showing only the last 4 digits
     * Per PCI-DSS: Display at most first 6 and last 4 digits
     */
    maskPAN(pan: string): string;
    /**
     * Get only the last 4 digits of a PAN (safe for display/logging)
     */
    getLastFour(pan: string): string;
    /**
     * Tokenize a PAN for secure storage
     * Returns a token that can be used to reference the PAN
     */
    tokenizePAN(pan: string, userId: string): Promise<PANToken>;
    /**
     * Detokenize to retrieve masked PAN (never returns full PAN)
     */
    detokenizeForDisplay(token: string, userId: string): Promise<string>;
    /**
     * Securely delete a tokenized PAN
     * Implements cryptographic erasure
     */
    secureDelete(token: string, userId: string): Promise<boolean>;
    /**
     * Validate PAN format (Luhn check)
     */
    isValidPANFormat(pan: string): boolean;
    /**
     * Get audit log entries (for compliance reporting)
     * Never includes full PAN
     */
    getAuditLog(startDate?: Date, endDate?: Date): typeof this.auditLog;
    /**
     * Clear audit logs older than retention period
     * Per PCI-DSS: Retain logs for at least 1 year, 3 months online
     */
    purgeOldAuditLogs(retentionDays?: number): number;
    private luhnCheck;
    private generateSecureToken;
    private encryptPAN;
    private decryptPAN;
    private logAccess;
}
/**
 * Encryption requirements per PCI-DSS
 */
export interface EncryptionRequirements {
    algorithm: string;
    keyLength: number;
    mode: string;
    padding: string;
}
/**
 * PCI-DSS approved encryption configurations
 */
export declare const PCI_ENCRYPTION_REQUIREMENTS: Record<string, EncryptionRequirements>;
/**
 * Key management configuration per PCI-DSS
 */
export interface KeyManagementConfig {
    keyRotationDays: number;
    splitKnowledge: boolean;
    dualControl: boolean;
    hsmRequired: boolean;
    keyVersioning: boolean;
    keyDestructionMethod: 'cryptographic-erasure' | 'physical-destruction';
}
/**
 * Default key management configuration
 */
export declare const DEFAULT_KEY_MANAGEMENT: KeyManagementConfig;
/**
 * Access control configuration for CDE
 */
export interface CDEAccessControl {
    requireMFA: boolean;
    sessionTimeoutMinutes: number;
    maxFailedAttempts: number;
    lockoutDurationMinutes: number;
    passwordMinLength: number;
    passwordRequireComplexity: boolean;
    passwordExpirationDays: number;
    passwordHistoryCount: number;
}
/**
 * Default CDE access control settings per PCI-DSS
 */
export declare const DEFAULT_CDE_ACCESS_CONTROL: CDEAccessControl;
/**
 * Self-Assessment Questionnaire types
 */
export declare const SAQ_TYPES: {
    readonly SAQ_A: "SAQ-A";
    readonly SAQ_A_EP: "SAQ-A-EP";
    readonly SAQ_B: "SAQ-B";
    readonly SAQ_B_IP: "SAQ-B-IP";
    readonly SAQ_C: "SAQ-C";
    readonly SAQ_C_VT: "SAQ-C-VT";
    readonly SAQ_P2PE: "SAQ-P2PE";
    readonly SAQ_D_MERCHANT: "SAQ-D-Merchant";
    readonly SAQ_D_SP: "SAQ-D-SP";
};
export type SAQType = (typeof SAQ_TYPES)[keyof typeof SAQ_TYPES];
/**
 * SAQ Response
 */
export interface SAQResponse {
    questionId: string;
    requirement: string;
    response: 'yes' | 'no' | 'n/a' | 'compensating-control';
    compensatingControl?: string;
    evidence?: string[];
    notes?: string;
}
/**
 * Self-Assessment Questionnaire
 */
export interface SelfAssessmentQuestionnaire {
    type: SAQType;
    version: string;
    merchantName: string;
    assessmentDate: Date;
    responses: SAQResponse[];
    attestation: {
        signedBy: string;
        title: string;
        signedAt: Date;
    };
}
/**
 * ASV Scan Result
 */
export interface ASVScanResult {
    scanId: string;
    asvProvider: string;
    scanDate: Date;
    scanType: 'external' | 'internal';
    status: 'pass' | 'fail';
    targetIPs: string[];
    vulnerabilitiesFound: {
        critical: number;
        high: number;
        medium: number;
        low: number;
    };
    failingVulnerabilities: Array<{
        cveId?: string;
        description: string;
        severity: string;
        affectedHost: string;
        port?: number;
        remediation: string;
    }>;
    nextScanDue: Date;
}
/**
 * Penetration Test Result
 */
export interface PenetrationTestResult {
    testId: string;
    testerCompany: string;
    testDate: Date;
    testType: 'network' | 'application' | 'segmentation';
    scope: string[];
    methodology: string;
    findings: Array<{
        id: string;
        title: string;
        severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
        description: string;
        affectedAssets: string[];
        remediation: string;
        status: 'open' | 'remediated' | 'accepted';
    }>;
    executiveSummary: string;
    attestation: string;
}
/**
 * PCI-DSS required audit log fields
 */
export interface PCIAuditLogEntry {
    /** Unique event ID */
    eventId: string;
    /** Event timestamp (synchronized time source) */
    timestamp: Date;
    /** User identification */
    userId: string;
    /** Event type */
    eventType: PCIAuditEventType;
    /** Affected component/system */
    component: string;
    /** Success or failure */
    outcome: 'success' | 'failure';
    /** Origin of the event (IP, terminal, etc.) */
    origin: string;
    /** Affected resource (never full PAN) */
    resource: string;
    /** Additional context */
    details?: Record<string, unknown>;
    /** Hash for tamper detection */
    integrityHash?: string;
    /** Previous entry hash for chain verification */
    previousHash?: string;
}
/**
 * PCI-DSS audit event types
 */
export declare const PCI_AUDIT_EVENT_TYPES: {
    readonly LOGIN_SUCCESS: "LOGIN_SUCCESS";
    readonly LOGIN_FAILURE: "LOGIN_FAILURE";
    readonly LOGOUT: "LOGOUT";
    readonly MFA_SUCCESS: "MFA_SUCCESS";
    readonly MFA_FAILURE: "MFA_FAILURE";
    readonly CHD_ACCESS: "CHD_ACCESS";
    readonly CHD_CREATE: "CHD_CREATE";
    readonly CHD_MODIFY: "CHD_MODIFY";
    readonly CHD_DELETE: "CHD_DELETE";
    readonly CHD_EXPORT: "CHD_EXPORT";
    readonly ADMIN_ACTION: "ADMIN_ACTION";
    readonly CONFIG_CHANGE: "CONFIG_CHANGE";
    readonly PERMISSION_CHANGE: "PERMISSION_CHANGE";
    readonly USER_CREATE: "USER_CREATE";
    readonly USER_MODIFY: "USER_MODIFY";
    readonly USER_DELETE: "USER_DELETE";
    readonly SECURITY_ALERT: "SECURITY_ALERT";
    readonly INTRUSION_DETECTED: "INTRUSION_DETECTED";
    readonly MALWARE_DETECTED: "MALWARE_DETECTED";
    readonly AUDIT_LOG_ACCESS: "AUDIT_LOG_ACCESS";
    readonly AUDIT_LOG_CLEAR: "AUDIT_LOG_CLEAR";
};
export type PCIAuditEventType = (typeof PCI_AUDIT_EVENT_TYPES)[keyof typeof PCI_AUDIT_EVENT_TYPES];
/**
 * Audit log retention configuration
 */
export interface AuditLogRetention {
    onlineRetentionDays: number;
    archiveRetentionDays: number;
    tamperEvident: boolean;
    centralizedLogging: boolean;
    dailyReviewRequired: boolean;
}
/**
 * Default audit log retention per PCI-DSS
 */
export declare const DEFAULT_AUDIT_RETENTION: AuditLogRetention;
/**
 * Complete PCI-DSS 4.0 compliance framework
 */
export declare const pciDssFramework: ComplianceFramework;
/**
 * Get PCI-DSS controls by requirement
 */
export declare function getPciControlsByRequirement(requirement: number): ComplianceControl[];
/**
 * Get PCI-DSS control by ID
 */
export declare function getPciControlById(id: string): ComplianceControl | undefined;
/**
 * Get all PCI-DSS controls by implementation status
 */
export declare function getPciControlsByStatus(status: ImplementationStatus): ComplianceControl[];
/**
 * Get all PCI-DSS controls by priority
 */
export declare function getPciControlsByPriority(priority: ControlPriority): ComplianceControl[];
/**
 * Get all requirement families
 */
export declare function getPciRequirementFamilies(): string[];
/**
 * Calculate compliance percentage by requirement
 */
export declare function getPciComplianceByRequirement(): Map<number, number>;
/**
 * Validate SAQ responses
 */
export declare function validateSAQResponses(saq: SelfAssessmentQuestionnaire): {
    valid: boolean;
    missingResponses: string[];
    compensatingControlsWithoutJustification: string[];
};
/**
 * Check if ASV scan is current (within 90 days)
 */
export declare function isASVScanCurrent(scan: ASVScanResult): boolean;
/**
 * Check if penetration test is current (within 12 months)
 */
export declare function isPenTestCurrent(test: PenetrationTestResult): boolean;
/**
 * Create a new Cardholder Data Service instance
 */
export declare function createCardholderDataService(): CardholderDataService;
export default pciDssFramework;
//# sourceMappingURL=pci-dss.d.ts.map