import { z } from 'zod';
import type { VulnerabilitySeverity } from './continuous-monitoring.js';
/**
 * POA&M weakness status
 */
export declare const POAM_STATUSES: readonly ["open", "ongoing", "completed", "closed", "risk-accepted", "false-positive", "delayed"];
export type POAMStatus = (typeof POAM_STATUSES)[number];
/**
 * Weakness source
 */
export declare const WEAKNESS_SOURCES: readonly ["vulnerability-scan", "penetration-test", "security-assessment", "audit-finding", "incident", "self-identified", "configuration-scan", "continuous-monitoring"];
export type WeaknessSource = (typeof WEAKNESS_SOURCES)[number];
/**
 * Risk level for POA&M items
 */
export declare const RISK_LEVELS: readonly ["very-high", "high", "moderate", "low", "very-low"];
export type PoamRiskLevel = (typeof RISK_LEVELS)[number];
/**
 * Deviation request type
 */
export declare const DEVIATION_TYPES: readonly ["operational-requirement", "false-positive", "risk-acceptance", "compensating-control", "vendor-dependency"];
export type DeviationType = (typeof DEVIATION_TYPES)[number];
/**
 * Deviation request status
 */
export declare const DEVIATION_STATUSES: readonly ["draft", "submitted", "under-review", "approved", "denied", "expired"];
export type DeviationStatus = (typeof DEVIATION_STATUSES)[number];
/**
 * POA&M milestone
 */
export interface POAMMilestone {
    /** Unique ID */
    id: string;
    /** Milestone number */
    number: number;
    /** Description of the milestone */
    description: string;
    /** Target completion date */
    targetDate: Date;
    /** Actual completion date */
    completedDate?: Date;
    /** Status */
    status: 'pending' | 'in-progress' | 'completed' | 'missed';
    /** Responsible party */
    responsibleParty: string;
    /** Notes */
    notes?: string;
    /** Percent complete */
    percentComplete: number;
}
export declare const milestoneSchema: z.ZodObject<{
    id: z.ZodString;
    number: z.ZodNumber;
    description: z.ZodString;
    targetDate: z.ZodDate;
    completedDate: z.ZodOptional<z.ZodDate>;
    status: z.ZodEnum<["pending", "in-progress", "completed", "missed"]>;
    responsibleParty: z.ZodString;
    notes: z.ZodOptional<z.ZodString>;
    percentComplete: z.ZodNumber;
}, "strip", z.ZodTypeAny, {
    number?: number;
    id?: string;
    status?: "pending" | "completed" | "in-progress" | "missed";
    description?: string;
    notes?: string;
    completedDate?: Date;
    responsibleParty?: string;
    targetDate?: Date;
    percentComplete?: number;
}, {
    number?: number;
    id?: string;
    status?: "pending" | "completed" | "in-progress" | "missed";
    description?: string;
    notes?: string;
    completedDate?: Date;
    responsibleParty?: string;
    targetDate?: Date;
    percentComplete?: number;
}>;
/**
 * POA&M item (weakness)
 */
export interface POAMItem {
    /** Unique POA&M ID (e.g., POAM-2024-001) */
    id: string;
    /** POA&M item number for reporting */
    itemNumber: number;
    /** Source of the weakness */
    source: WeaknessSource;
    /** Source identifier (e.g., scan ID, audit finding ID) */
    sourceId?: string;
    /** Weakness title */
    title: string;
    /** Detailed description */
    description: string;
    /** Associated control IDs */
    controlIds: string[];
    /** Risk level */
    riskLevel: PoamRiskLevel;
    /** Original severity from source */
    originalSeverity?: VulnerabilitySeverity;
    /** Adjusted severity after analysis */
    adjustedSeverity?: VulnerabilitySeverity;
    /** Severity adjustment justification */
    severityAdjustmentJustification?: string;
    /** Status */
    status: POAMStatus;
    /** Detection date */
    detectedDate: Date;
    /** Scheduled completion date */
    scheduledCompletionDate: Date;
    /** Actual completion date */
    actualCompletionDate?: Date;
    /** Point of contact */
    poc: string;
    /** POC email */
    pocEmail: string;
    /** Resources required */
    resourcesRequired: string;
    /** Estimated cost */
    estimatedCost?: number;
    /** Remediation plan */
    remediationPlan: string;
    /** Milestones */
    milestones: POAMMilestone[];
    /** Risk statement */
    riskStatement: string;
    /** Business impact */
    businessImpact: string;
    /** Comments/updates history */
    comments: POAMComment[];
    /** Deviation request ID if applicable */
    deviationRequestId?: string;
    /** Related vulnerability IDs */
    relatedVulnerabilityIds: string[];
    /** Evidence of completion */
    completionEvidence?: string[];
    /** Last status update */
    lastUpdated: Date;
    /** Vendor dependency */
    vendorDependency?: {
        vendor: string;
        expectedFixDate?: Date;
        ticketNumber?: string;
    };
    /** Days overdue (negative if not yet due) */
    daysOverdue: number;
    /** Is this a recurring/persistent weakness */
    isRecurring: boolean;
    /** Previous POA&M IDs if recurring */
    previousPOAMIds?: string[];
}
export declare const poamItemSchema: z.ZodObject<{
    id: z.ZodString;
    itemNumber: z.ZodNumber;
    source: z.ZodEnum<["vulnerability-scan", "penetration-test", "security-assessment", "audit-finding", "incident", "self-identified", "configuration-scan", "continuous-monitoring"]>;
    sourceId: z.ZodOptional<z.ZodString>;
    title: z.ZodString;
    description: z.ZodString;
    controlIds: z.ZodArray<z.ZodString, "many">;
    riskLevel: z.ZodEnum<["very-high", "high", "moderate", "low", "very-low"]>;
    originalSeverity: z.ZodOptional<z.ZodEnum<["critical", "high", "moderate", "low"]>>;
    adjustedSeverity: z.ZodOptional<z.ZodEnum<["critical", "high", "moderate", "low"]>>;
    severityAdjustmentJustification: z.ZodOptional<z.ZodString>;
    status: z.ZodEnum<["open", "ongoing", "completed", "closed", "risk-accepted", "false-positive", "delayed"]>;
    detectedDate: z.ZodDate;
    scheduledCompletionDate: z.ZodDate;
    actualCompletionDate: z.ZodOptional<z.ZodDate>;
    poc: z.ZodString;
    pocEmail: z.ZodString;
    resourcesRequired: z.ZodString;
    estimatedCost: z.ZodOptional<z.ZodNumber>;
    remediationPlan: z.ZodString;
    milestones: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        number: z.ZodNumber;
        description: z.ZodString;
        targetDate: z.ZodDate;
        completedDate: z.ZodOptional<z.ZodDate>;
        status: z.ZodEnum<["pending", "in-progress", "completed", "missed"]>;
        responsibleParty: z.ZodString;
        notes: z.ZodOptional<z.ZodString>;
        percentComplete: z.ZodNumber;
    }, "strip", z.ZodTypeAny, {
        number?: number;
        id?: string;
        status?: "pending" | "completed" | "in-progress" | "missed";
        description?: string;
        notes?: string;
        completedDate?: Date;
        responsibleParty?: string;
        targetDate?: Date;
        percentComplete?: number;
    }, {
        number?: number;
        id?: string;
        status?: "pending" | "completed" | "in-progress" | "missed";
        description?: string;
        notes?: string;
        completedDate?: Date;
        responsibleParty?: string;
        targetDate?: Date;
        percentComplete?: number;
    }>, "many">;
    riskStatement: z.ZodString;
    businessImpact: z.ZodString;
    comments: z.ZodArray<z.ZodAny, "many">;
    deviationRequestId: z.ZodOptional<z.ZodString>;
    relatedVulnerabilityIds: z.ZodArray<z.ZodString, "many">;
    completionEvidence: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    lastUpdated: z.ZodDate;
    vendorDependency: z.ZodOptional<z.ZodObject<{
        vendor: z.ZodString;
        expectedFixDate: z.ZodOptional<z.ZodDate>;
        ticketNumber: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        vendor?: string;
        expectedFixDate?: Date;
        ticketNumber?: string;
    }, {
        vendor?: string;
        expectedFixDate?: Date;
        ticketNumber?: string;
    }>>;
    daysOverdue: z.ZodNumber;
    isRecurring: z.ZodBoolean;
    previousPOAMIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    status?: "completed" | "closed" | "open" | "delayed" | "risk-accepted" | "false-positive" | "ongoing";
    title?: string;
    description?: string;
    source?: "incident" | "penetration-test" | "vulnerability-scan" | "security-assessment" | "audit-finding" | "self-identified" | "configuration-scan" | "continuous-monitoring";
    riskLevel?: "low" | "high" | "moderate" | "very-high" | "very-low";
    lastUpdated?: Date;
    comments?: any[];
    sourceId?: string;
    remediationPlan?: string;
    controlIds?: string[];
    deviationRequestId?: string;
    daysOverdue?: number;
    itemNumber?: number;
    originalSeverity?: "low" | "high" | "critical" | "moderate";
    adjustedSeverity?: "low" | "high" | "critical" | "moderate";
    severityAdjustmentJustification?: string;
    detectedDate?: Date;
    scheduledCompletionDate?: Date;
    actualCompletionDate?: Date;
    poc?: string;
    pocEmail?: string;
    resourcesRequired?: string;
    estimatedCost?: number;
    milestones?: {
        number?: number;
        id?: string;
        status?: "pending" | "completed" | "in-progress" | "missed";
        description?: string;
        notes?: string;
        completedDate?: Date;
        responsibleParty?: string;
        targetDate?: Date;
        percentComplete?: number;
    }[];
    riskStatement?: string;
    businessImpact?: string;
    relatedVulnerabilityIds?: string[];
    completionEvidence?: string[];
    vendorDependency?: {
        vendor?: string;
        expectedFixDate?: Date;
        ticketNumber?: string;
    };
    isRecurring?: boolean;
    previousPOAMIds?: string[];
}, {
    id?: string;
    status?: "completed" | "closed" | "open" | "delayed" | "risk-accepted" | "false-positive" | "ongoing";
    title?: string;
    description?: string;
    source?: "incident" | "penetration-test" | "vulnerability-scan" | "security-assessment" | "audit-finding" | "self-identified" | "configuration-scan" | "continuous-monitoring";
    riskLevel?: "low" | "high" | "moderate" | "very-high" | "very-low";
    lastUpdated?: Date;
    comments?: any[];
    sourceId?: string;
    remediationPlan?: string;
    controlIds?: string[];
    deviationRequestId?: string;
    daysOverdue?: number;
    itemNumber?: number;
    originalSeverity?: "low" | "high" | "critical" | "moderate";
    adjustedSeverity?: "low" | "high" | "critical" | "moderate";
    severityAdjustmentJustification?: string;
    detectedDate?: Date;
    scheduledCompletionDate?: Date;
    actualCompletionDate?: Date;
    poc?: string;
    pocEmail?: string;
    resourcesRequired?: string;
    estimatedCost?: number;
    milestones?: {
        number?: number;
        id?: string;
        status?: "pending" | "completed" | "in-progress" | "missed";
        description?: string;
        notes?: string;
        completedDate?: Date;
        responsibleParty?: string;
        targetDate?: Date;
        percentComplete?: number;
    }[];
    riskStatement?: string;
    businessImpact?: string;
    relatedVulnerabilityIds?: string[];
    completionEvidence?: string[];
    vendorDependency?: {
        vendor?: string;
        expectedFixDate?: Date;
        ticketNumber?: string;
    };
    isRecurring?: boolean;
    previousPOAMIds?: string[];
}>;
/**
 * POA&M comment/update
 */
export interface POAMComment {
    /** Comment ID */
    id: string;
    /** Author */
    author: string;
    /** Comment date */
    date: Date;
    /** Comment text */
    text: string;
    /** Status at time of comment */
    statusAtTime: POAMStatus;
}
/**
 * Deviation request
 */
export interface DeviationRequest {
    /** Unique ID */
    id: string;
    /** Associated POA&M ID */
    poamId: string;
    /** Deviation type */
    type: DeviationType;
    /** Request status */
    status: DeviationStatus;
    /** Title */
    title: string;
    /** Justification */
    justification: string;
    /** Risk analysis */
    riskAnalysis: string;
    /** Compensating controls (if applicable) */
    compensatingControls?: string;
    /** Business impact if not approved */
    businessImpact: string;
    /** Requested duration (days) */
    requestedDuration?: number;
    /** Expiration date for approved deviations */
    expirationDate?: Date;
    /** Submitted by */
    submittedBy: string;
    /** Submitted date */
    submittedDate: Date;
    /** Reviewed by (AO) */
    reviewedBy?: string;
    /** Review date */
    reviewDate?: Date;
    /** Review comments */
    reviewComments?: string;
    /** Attachments */
    attachments: string[];
}
export declare const deviationRequestSchema: z.ZodObject<{
    id: z.ZodString;
    poamId: z.ZodString;
    type: z.ZodEnum<["operational-requirement", "false-positive", "risk-acceptance", "compensating-control", "vendor-dependency"]>;
    status: z.ZodEnum<["draft", "submitted", "under-review", "approved", "denied", "expired"]>;
    title: z.ZodString;
    justification: z.ZodString;
    riskAnalysis: z.ZodString;
    compensatingControls: z.ZodOptional<z.ZodString>;
    businessImpact: z.ZodString;
    requestedDuration: z.ZodOptional<z.ZodNumber>;
    expirationDate: z.ZodOptional<z.ZodDate>;
    submittedBy: z.ZodString;
    submittedDate: z.ZodDate;
    reviewedBy: z.ZodOptional<z.ZodString>;
    reviewDate: z.ZodOptional<z.ZodDate>;
    reviewComments: z.ZodOptional<z.ZodString>;
    attachments: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    id?: string;
    type?: "compensating-control" | "false-positive" | "operational-requirement" | "risk-acceptance" | "vendor-dependency";
    status?: "approved" | "denied" | "draft" | "expired" | "submitted" | "under-review";
    title?: string;
    attachments?: string[];
    reviewedBy?: string;
    justification?: string;
    expirationDate?: Date;
    poamId?: string;
    reviewDate?: Date;
    businessImpact?: string;
    riskAnalysis?: string;
    compensatingControls?: string;
    requestedDuration?: number;
    submittedBy?: string;
    submittedDate?: Date;
    reviewComments?: string;
}, {
    id?: string;
    type?: "compensating-control" | "false-positive" | "operational-requirement" | "risk-acceptance" | "vendor-dependency";
    status?: "approved" | "denied" | "draft" | "expired" | "submitted" | "under-review";
    title?: string;
    attachments?: string[];
    reviewedBy?: string;
    justification?: string;
    expirationDate?: Date;
    poamId?: string;
    reviewDate?: Date;
    businessImpact?: string;
    riskAnalysis?: string;
    compensatingControls?: string;
    requestedDuration?: number;
    submittedBy?: string;
    submittedDate?: Date;
    reviewComments?: string;
}>;
/**
 * POA&M configuration
 */
export interface POAMConfig {
    /** Organization name */
    organizationName: string;
    /** System name */
    systemName: string;
    /** ISSO name and email */
    isso: {
        name: string;
        email: string;
    };
    /** System Owner */
    systemOwner: {
        name: string;
        email: string;
    };
    /** Authorizing Official */
    authorizingOfficial: {
        name: string;
        email: string;
    };
    /** POA&M ID prefix */
    idPrefix: string;
    /** Auto-calculate days overdue */
    autoCalculateOverdue: boolean;
    /** Alert threshold for upcoming deadlines (days) */
    upcomingDeadlineThreshold: number;
}
/**
 * POA&M Management Service
 */
export declare class POAMService {
    private config;
    private items;
    private deviations;
    private itemCounter;
    constructor(config: POAMConfig);
    /**
     * Create a new POA&M item
     */
    createItem(item: Omit<POAMItem, 'id' | 'itemNumber' | 'comments' | 'lastUpdated' | 'daysOverdue'>): POAMItem;
    /**
     * Update a POA&M item
     */
    updateItem(id: string, updates: Partial<POAMItem>): POAMItem;
    /**
     * Add a comment to a POA&M item
     */
    addComment(poamId: string, author: string, text: string): POAMComment;
    /**
     * Add a milestone to a POA&M item
     */
    addMilestone(poamId: string, milestone: Omit<POAMMilestone, 'id' | 'number'>): POAMMilestone;
    /**
     * Update a milestone
     */
    updateMilestone(poamId: string, milestoneId: string, updates: Partial<POAMMilestone>): POAMMilestone;
    /**
     * Complete a milestone
     */
    completeMilestone(poamId: string, milestoneId: string): POAMMilestone;
    /**
     * Close a POA&M item
     */
    closeItem(poamId: string, completionEvidence: string[]): POAMItem;
    /**
     * Get a POA&M item by ID
     */
    getItem(id: string): POAMItem | undefined;
    /**
     * Get all POA&M items
     */
    getAllItems(filter?: {
        status?: POAMStatus;
        riskLevel?: PoamRiskLevel;
        controlId?: string;
        overdue?: boolean;
        source?: WeaknessSource;
    }): POAMItem[];
    /**
     * Get open POA&M items
     */
    getOpenItems(): POAMItem[];
    /**
     * Get overdue POA&M items
     */
    getOverdueItems(): POAMItem[];
    /**
     * Calculate days overdue (negative if not yet due)
     */
    private calculateDaysOverdue;
    /**
     * Update days overdue for all items
     */
    refreshOverdueCalculations(): void;
    /**
     * Create a deviation request
     */
    createDeviationRequest(request: Omit<DeviationRequest, 'id' | 'status' | 'submittedDate'>): DeviationRequest;
    /**
     * Submit a deviation request
     */
    submitDeviationRequest(id: string): DeviationRequest;
    /**
     * Review a deviation request
     */
    reviewDeviationRequest(id: string, decision: 'approved' | 'denied', reviewedBy: string, comments: string, expirationDate?: Date): DeviationRequest;
    /**
     * Get deviation request by ID
     */
    getDeviationRequest(id: string): DeviationRequest | undefined;
    /**
     * Get all deviation requests
     */
    getAllDeviationRequests(filter?: {
        status?: DeviationStatus;
        type?: DeviationType;
    }): DeviationRequest[];
    /**
     * Check for expiring deviations
     */
    getExpiringDeviations(daysThreshold?: number): DeviationRequest[];
    /**
     * Generate POA&M summary statistics
     */
    getSummaryStatistics(): POAMSummaryStatistics;
    /**
     * Generate FedRAMP-format POA&M report
     */
    generatePOAMReport(): POAMReport;
    private formatMilestoneChanges;
    /**
     * Create POA&M item from vulnerability finding
     */
    createFromVulnerability(vulnId: string, title: string, description: string, severity: VulnerabilitySeverity, controlIds: string[], deadline: Date, poc: {
        name: string;
        email: string;
    }, remediationPlan: string): POAMItem;
    private severityToRiskLevel;
}
export interface POAMSummaryStatistics {
    totalOpen: number;
    totalOverdue: number;
    byRiskLevel: Record<PoamRiskLevel, number>;
    byStatus: Record<POAMStatus, number>;
    bySource: Record<WeaknessSource, number>;
    averageDaysOpen: number;
    closureRate: number;
    deviationsPending: number;
    deviationsExpiringSoon: number;
}
export interface POAMReport {
    header: {
        systemName: string;
        organizationName: string;
        generatedDate: Date;
        isso: {
            name: string;
            email: string;
        };
        systemOwner: {
            name: string;
            email: string;
        };
        authorizingOfficial: {
            name: string;
            email: string;
        };
    };
    summary: POAMSummaryStatistics;
    items: Array<{
        itemNumber: number;
        id: string;
        weakness: string;
        pointOfContact: string;
        resourcesRequired: string;
        scheduledCompletionDate: Date;
        milestoneChanges: string;
        sourceIdentifyingWeakness: WeaknessSource;
        status: POAMStatus;
        comments: string;
        riskLevel: PoamRiskLevel;
        controlIds: string[];
        deviationRequest?: DeviationRequest;
    }>;
}
export default POAMService;
//# sourceMappingURL=poam.d.ts.map