@vorionsys/security 1.0.0

package/dist/compliance/fedramp/boundary.d.ts

@@ -0,0 +1,932 @@
+/**
+ * FedRAMP System Boundary Documentation
+ *
+ * Manages system boundary documentation including:
+ * - Component inventory
+ * - Data flow diagrams (metadata)
+ * - Network diagrams (metadata)
+ * - Interconnections tracking
+ * - External services documentation
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * Component types within the boundary
+ */
+export declare const COMPONENT_TYPES: readonly ["server", "database", "load-balancer", "firewall", "storage", "container", "serverless", "api-gateway", "message-queue", "cache", "monitoring", "logging", "identity-provider", "dns", "cdn", "waf", "vpn", "hsm", "secrets-manager", "workstation", "mobile-device", "network-device", "other"];
+export type ComponentType = (typeof COMPONENT_TYPES)[number];
+/**
+ * Component status
+ */
+export declare const COMPONENT_STATUSES: readonly ["production", "development", "staging", "decommissioned", "planned"];
+export type ComponentStatus = (typeof COMPONENT_STATUSES)[number];
+/**
+ * Data classification levels
+ */
+export declare const DATA_CLASSIFICATIONS: readonly ["public", "internal", "confidential", "restricted", "cui", "pii", "phi"];
+export type DataClassification = (typeof DATA_CLASSIFICATIONS)[number];
+/**
+ * Connection type
+ */
+export declare const CONNECTION_TYPES: readonly ["https", "tls", "ssh", "vpn", "direct-connect", "ipsec", "mtls", "api", "database", "internal"];
+export type ConnectionType = (typeof CONNECTION_TYPES)[number];
+/**
+ * Interconnection type
+ */
+export declare const INTERCONNECTION_TYPES: readonly ["federal-agency", "commercial-csp", "third-party-service", "partner-organization", "customer-system"];
+export type InterconnectionType = (typeof INTERCONNECTION_TYPES)[number];
+/**
+ * External service type
+ */
+export declare const EXTERNAL_SERVICE_TYPES: readonly ["saas", "paas", "iaas", "api-service", "identity-provider", "payment-processor", "email-service", "monitoring-service", "cdn", "dns", "security-service", "other"];
+export type ExternalServiceType = (typeof EXTERNAL_SERVICE_TYPES)[number];
+/**
+ * System component within the authorization boundary
+ */
+export interface SystemComponent {
+    /** Unique identifier */
+    id: string;
+    /** Component name */
+    name: string;
+    /** Component type */
+    type: ComponentType;
+    /** Description */
+    description: string;
+    /** Status */
+    status: ComponentStatus;
+    /** Is this within the authorization boundary */
+    withinBoundary: boolean;
+    /** IP addresses */
+    ipAddresses?: string[];
+    /** Hostname/FQDN */
+    hostname?: string;
+    /** Operating system */
+    operatingSystem?: string;
+    /** Software/version running on component */
+    software?: Array<{
+        name: string;
+        version: string;
+        vendor: string;
+        patchLevel?: string;
+    }>;
+    /** Physical location / data center */
+    location: string;
+    /** Cloud provider if applicable */
+    cloudProvider?: string;
+    /** Cloud region if applicable */
+    cloudRegion?: string;
+    /** Availability zone */
+    availabilityZone?: string;
+    /** Owner/team responsible */
+    owner: string;
+    /** Data classifications handled */
+    dataClassifications: DataClassification[];
+    /** Security controls applied */
+    securityControls: string[];
+    /** Last scan date */
+    lastScanDate?: Date;
+    /** Asset tag/identifier */
+    assetTag?: string;
+    /** Serial number */
+    serialNumber?: string;
+    /** Purchase date */
+    purchaseDate?: Date;
+    /** End of life date */
+    endOfLifeDate?: Date;
+    /** Is virtual/containerized */
+    isVirtual: boolean;
+    /** Parent component ID if virtualized */
+    parentComponentId?: string;
+    /** Tags for categorization */
+    tags: string[];
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+export declare const systemComponentSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodEnum<["server", "database", "load-balancer", "firewall", "storage", "container", "serverless", "api-gateway", "message-queue", "cache", "monitoring", "logging", "identity-provider", "dns", "cdn", "waf", "vpn", "hsm", "secrets-manager", "workstation", "mobile-device", "network-device", "other"]>;
+    description: z.ZodString;
+    status: z.ZodEnum<["production", "development", "staging", "decommissioned", "planned"]>;
+    withinBoundary: z.ZodBoolean;
+    ipAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    hostname: z.ZodOptional<z.ZodString>;
+    operatingSystem: z.ZodOptional<z.ZodString>;
+    software: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        vendor: z.ZodString;
+        patchLevel: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        version?: string;
+        vendor?: string;
+        patchLevel?: string;
+    }, {
+        name?: string;
+        version?: string;
+        vendor?: string;
+        patchLevel?: string;
+    }>, "many">>;
+    location: z.ZodString;
+    cloudProvider: z.ZodOptional<z.ZodString>;
+    cloudRegion: z.ZodOptional<z.ZodString>;
+    availabilityZone: z.ZodOptional<z.ZodString>;
+    owner: z.ZodString;
+    dataClassifications: z.ZodArray<z.ZodEnum<["public", "internal", "confidential", "restricted", "cui", "pii", "phi"]>, "many">;
+    securityControls: z.ZodArray<z.ZodString, "many">;
+    lastScanDate: z.ZodOptional<z.ZodDate>;
+    assetTag: z.ZodOptional<z.ZodString>;
+    serialNumber: z.ZodOptional<z.ZodString>;
+    purchaseDate: z.ZodOptional<z.ZodDate>;
+    endOfLifeDate: z.ZodOptional<z.ZodDate>;
+    isVirtual: z.ZodBoolean;
+    parentComponentId: z.ZodOptional<z.ZodString>;
+    tags: z.ZodArray<z.ZodString, "many">;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "server" | "database" | "storage" | "other" | "hsm" | "vpn" | "dns" | "monitoring" | "container" | "firewall" | "waf" | "cdn" | "api-gateway" | "cache" | "load-balancer" | "serverless" | "message-queue" | "logging" | "identity-provider" | "secrets-manager" | "workstation" | "mobile-device" | "network-device";
+    status?: "production" | "development" | "staging" | "planned" | "decommissioned";
+    name?: string;
+    location?: string;
+    tags?: string[];
+    description?: string;
+    metadata?: Record<string, unknown>;
+    owner?: string;
+    hostname?: string;
+    serialNumber?: string;
+    software?: {
+        name?: string;
+        version?: string;
+        vendor?: string;
+        patchLevel?: string;
+    }[];
+    securityControls?: string[];
+    withinBoundary?: boolean;
+    ipAddresses?: string[];
+    operatingSystem?: string;
+    cloudProvider?: string;
+    cloudRegion?: string;
+    availabilityZone?: string;
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    lastScanDate?: Date;
+    assetTag?: string;
+    purchaseDate?: Date;
+    endOfLifeDate?: Date;
+    isVirtual?: boolean;
+    parentComponentId?: string;
+}, {
+    id?: string;
+    type?: "server" | "database" | "storage" | "other" | "hsm" | "vpn" | "dns" | "monitoring" | "container" | "firewall" | "waf" | "cdn" | "api-gateway" | "cache" | "load-balancer" | "serverless" | "message-queue" | "logging" | "identity-provider" | "secrets-manager" | "workstation" | "mobile-device" | "network-device";
+    status?: "production" | "development" | "staging" | "planned" | "decommissioned";
+    name?: string;
+    location?: string;
+    tags?: string[];
+    description?: string;
+    metadata?: Record<string, unknown>;
+    owner?: string;
+    hostname?: string;
+    serialNumber?: string;
+    software?: {
+        name?: string;
+        version?: string;
+        vendor?: string;
+        patchLevel?: string;
+    }[];
+    securityControls?: string[];
+    withinBoundary?: boolean;
+    ipAddresses?: string[];
+    operatingSystem?: string;
+    cloudProvider?: string;
+    cloudRegion?: string;
+    availabilityZone?: string;
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    lastScanDate?: Date;
+    assetTag?: string;
+    purchaseDate?: Date;
+    endOfLifeDate?: Date;
+    isVirtual?: boolean;
+    parentComponentId?: string;
+}>;
+/**
+ * Data flow within the system
+ */
+export interface DataFlow {
+    /** Unique identifier */
+    id: string;
+    /** Flow name */
+    name: string;
+    /** Description */
+    description: string;
+    /** Source component ID */
+    sourceComponentId: string;
+    /** Destination component ID */
+    destinationComponentId: string;
+    /** Data types in this flow */
+    dataTypes: string[];
+    /** Data classifications */
+    dataClassifications: DataClassification[];
+    /** Connection type */
+    connectionType: ConnectionType;
+    /** Protocol */
+    protocol: string;
+    /** Port(s) used */
+    ports: number[];
+    /** Is encrypted */
+    isEncrypted: boolean;
+    /** Encryption method */
+    encryptionMethod?: string;
+    /** Flow direction */
+    direction: 'unidirectional' | 'bidirectional';
+    /** Is this flow required for operation */
+    isRequired: boolean;
+    /** Associated controls */
+    associatedControls: string[];
+    /** Diagram reference */
+    diagramReference?: string;
+}
+export declare const dataFlowSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    sourceComponentId: z.ZodString;
+    destinationComponentId: z.ZodString;
+    dataTypes: z.ZodArray<z.ZodString, "many">;
+    dataClassifications: z.ZodArray<z.ZodEnum<["public", "internal", "confidential", "restricted", "cui", "pii", "phi"]>, "many">;
+    connectionType: z.ZodEnum<["https", "tls", "ssh", "vpn", "direct-connect", "ipsec", "mtls", "api", "database", "internal"]>;
+    protocol: z.ZodString;
+    ports: z.ZodArray<z.ZodNumber, "many">;
+    isEncrypted: z.ZodBoolean;
+    encryptionMethod: z.ZodOptional<z.ZodString>;
+    direction: z.ZodEnum<["unidirectional", "bidirectional"]>;
+    isRequired: z.ZodBoolean;
+    associatedControls: z.ZodArray<z.ZodString, "many">;
+    diagramReference: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    name?: string;
+    description?: string;
+    protocol?: string;
+    dataTypes?: string[];
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    sourceComponentId?: string;
+    destinationComponentId?: string;
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    ports?: number[];
+    isEncrypted?: boolean;
+    encryptionMethod?: string;
+    direction?: "unidirectional" | "bidirectional";
+    isRequired?: boolean;
+    associatedControls?: string[];
+    diagramReference?: string;
+}, {
+    id?: string;
+    name?: string;
+    description?: string;
+    protocol?: string;
+    dataTypes?: string[];
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    sourceComponentId?: string;
+    destinationComponentId?: string;
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    ports?: number[];
+    isEncrypted?: boolean;
+    encryptionMethod?: string;
+    direction?: "unidirectional" | "bidirectional";
+    isRequired?: boolean;
+    associatedControls?: string[];
+    diagramReference?: string;
+}>;
+/**
+ * Network zone
+ */
+export interface NetworkZone {
+    /** Unique identifier */
+    id: string;
+    /** Zone name */
+    name: string;
+    /** Description */
+    description: string;
+    /** CIDR ranges */
+    cidrRanges: string[];
+    /** Security level */
+    securityLevel: 'dmz' | 'internal' | 'restricted' | 'management';
+    /** Component IDs in this zone */
+    componentIds: string[];
+    /** Allowed inbound connections */
+    allowedInbound: Array<{
+        fromZone: string;
+        ports: number[];
+        protocol: string;
+    }>;
+    /** Allowed outbound connections */
+    allowedOutbound: Array<{
+        toZone: string;
+        ports: number[];
+        protocol: string;
+    }>;
+    /** Firewall rules reference */
+    firewallRulesRef?: string;
+}
+export declare const networkZoneSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    cidrRanges: z.ZodArray<z.ZodString, "many">;
+    securityLevel: z.ZodEnum<["dmz", "internal", "restricted", "management"]>;
+    componentIds: z.ZodArray<z.ZodString, "many">;
+    allowedInbound: z.ZodArray<z.ZodObject<{
+        fromZone: z.ZodString;
+        ports: z.ZodArray<z.ZodNumber, "many">;
+        protocol: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        protocol?: string;
+        ports?: number[];
+        fromZone?: string;
+    }, {
+        protocol?: string;
+        ports?: number[];
+        fromZone?: string;
+    }>, "many">;
+    allowedOutbound: z.ZodArray<z.ZodObject<{
+        toZone: z.ZodString;
+        ports: z.ZodArray<z.ZodNumber, "many">;
+        protocol: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        protocol?: string;
+        ports?: number[];
+        toZone?: string;
+    }, {
+        protocol?: string;
+        ports?: number[];
+        toZone?: string;
+    }>, "many">;
+    firewallRulesRef: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    name?: string;
+    description?: string;
+    securityLevel?: "internal" | "restricted" | "management" | "dmz";
+    cidrRanges?: string[];
+    componentIds?: string[];
+    allowedInbound?: {
+        protocol?: string;
+        ports?: number[];
+        fromZone?: string;
+    }[];
+    allowedOutbound?: {
+        protocol?: string;
+        ports?: number[];
+        toZone?: string;
+    }[];
+    firewallRulesRef?: string;
+}, {
+    id?: string;
+    name?: string;
+    description?: string;
+    securityLevel?: "internal" | "restricted" | "management" | "dmz";
+    cidrRanges?: string[];
+    componentIds?: string[];
+    allowedInbound?: {
+        protocol?: string;
+        ports?: number[];
+        fromZone?: string;
+    }[];
+    allowedOutbound?: {
+        protocol?: string;
+        ports?: number[];
+        toZone?: string;
+    }[];
+    firewallRulesRef?: string;
+}>;
+/**
+ * System interconnection (ISA/MOU)
+ */
+export interface SystemInterconnection {
+    /** Unique identifier */
+    id: string;
+    /** Interconnection name */
+    name: string;
+    /** Description */
+    description: string;
+    /** Type of interconnection */
+    type: InterconnectionType;
+    /** Remote system name */
+    remoteSystemName: string;
+    /** Remote organization */
+    remoteOrganization: string;
+    /** Remote POC */
+    remotePoc: {
+        name: string;
+        email: string;
+        phone?: string;
+    };
+    /** Local POC */
+    localPoc: {
+        name: string;
+        email: string;
+        phone?: string;
+    };
+    /** Connection type */
+    connectionType: ConnectionType;
+    /** Data shared */
+    dataShared: DataClassification[];
+    /** Direction of data flow */
+    direction: 'inbound' | 'outbound' | 'bidirectional';
+    /** Security requirements */
+    securityRequirements: string[];
+    /** ISA/MOU document reference */
+    agreementDocRef?: string;
+    /** Agreement effective date */
+    agreementEffectiveDate?: Date;
+    /** Agreement expiration date */
+    agreementExpirationDate?: Date;
+    /** Status */
+    status: 'proposed' | 'pending-approval' | 'active' | 'suspended' | 'terminated';
+    /** Associated controls */
+    associatedControls: string[];
+    /** Authorization to connect (ATC) reference */
+    atcReference?: string;
+    /** Last review date */
+    lastReviewDate?: Date;
+    /** Review frequency */
+    reviewFrequency: 'annual' | 'biannual' | 'quarterly';
+}
+export declare const systemInterconnectionSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    type: z.ZodEnum<["federal-agency", "commercial-csp", "third-party-service", "partner-organization", "customer-system"]>;
+    remoteSystemName: z.ZodString;
+    remoteOrganization: z.ZodString;
+    remotePoc: z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodString;
+        phone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        email?: string;
+        phone?: string;
+    }, {
+        name?: string;
+        email?: string;
+        phone?: string;
+    }>;
+    localPoc: z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodString;
+        phone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        email?: string;
+        phone?: string;
+    }, {
+        name?: string;
+        email?: string;
+        phone?: string;
+    }>;
+    connectionType: z.ZodEnum<["https", "tls", "ssh", "vpn", "direct-connect", "ipsec", "mtls", "api", "database", "internal"]>;
+    dataShared: z.ZodArray<z.ZodEnum<["public", "internal", "confidential", "restricted", "cui", "pii", "phi"]>, "many">;
+    direction: z.ZodEnum<["inbound", "outbound", "bidirectional"]>;
+    securityRequirements: z.ZodArray<z.ZodString, "many">;
+    agreementDocRef: z.ZodOptional<z.ZodString>;
+    agreementEffectiveDate: z.ZodOptional<z.ZodDate>;
+    agreementExpirationDate: z.ZodOptional<z.ZodDate>;
+    status: z.ZodEnum<["proposed", "pending-approval", "active", "suspended", "terminated"]>;
+    associatedControls: z.ZodArray<z.ZodString, "many">;
+    atcReference: z.ZodOptional<z.ZodString>;
+    lastReviewDate: z.ZodOptional<z.ZodDate>;
+    reviewFrequency: z.ZodEnum<["annual", "biannual", "quarterly"]>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "federal-agency" | "commercial-csp" | "third-party-service" | "partner-organization" | "customer-system";
+    status?: "active" | "suspended" | "pending-approval" | "terminated" | "proposed";
+    name?: string;
+    description?: string;
+    securityRequirements?: string[];
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    direction?: "bidirectional" | "inbound" | "outbound";
+    associatedControls?: string[];
+    remoteSystemName?: string;
+    remoteOrganization?: string;
+    remotePoc?: {
+        name?: string;
+        email?: string;
+        phone?: string;
+    };
+    localPoc?: {
+        name?: string;
+        email?: string;
+        phone?: string;
+    };
+    dataShared?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    agreementDocRef?: string;
+    agreementEffectiveDate?: Date;
+    agreementExpirationDate?: Date;
+    atcReference?: string;
+    lastReviewDate?: Date;
+    reviewFrequency?: "quarterly" | "annual" | "biannual";
+}, {
+    id?: string;
+    type?: "federal-agency" | "commercial-csp" | "third-party-service" | "partner-organization" | "customer-system";
+    status?: "active" | "suspended" | "pending-approval" | "terminated" | "proposed";
+    name?: string;
+    description?: string;
+    securityRequirements?: string[];
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    direction?: "bidirectional" | "inbound" | "outbound";
+    associatedControls?: string[];
+    remoteSystemName?: string;
+    remoteOrganization?: string;
+    remotePoc?: {
+        name?: string;
+        email?: string;
+        phone?: string;
+    };
+    localPoc?: {
+        name?: string;
+        email?: string;
+        phone?: string;
+    };
+    dataShared?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    agreementDocRef?: string;
+    agreementEffectiveDate?: Date;
+    agreementExpirationDate?: Date;
+    atcReference?: string;
+    lastReviewDate?: Date;
+    reviewFrequency?: "quarterly" | "annual" | "biannual";
+}>;
+/**
+ * External service dependency
+ */
+export interface ExternalService {
+    /** Unique identifier */
+    id: string;
+    /** Service name */
+    name: string;
+    /** Service type */
+    type: ExternalServiceType;
+    /** Provider name */
+    provider: string;
+    /** Description */
+    description: string;
+    /** Purpose */
+    purpose: string;
+    /** Data classifications shared/processed */
+    dataClassifications: DataClassification[];
+    /** Is FedRAMP authorized */
+    isFedRAMPAuthorized: boolean;
+    /** FedRAMP package ID if authorized */
+    fedrampPackageId?: string;
+    /** FedRAMP authorization level */
+    fedrampLevel?: 'low' | 'moderate' | 'high' | 'li-saas';
+    /** Authorization date */
+    authorizationDate?: Date;
+    /** Contract reference */
+    contractReference?: string;
+    /** Connection type */
+    connectionType: ConnectionType;
+    /** API endpoints */
+    apiEndpoints?: string[];
+    /** Status */
+    status: 'active' | 'pending' | 'deprecated' | 'terminated';
+    /** Responsible party */
+    responsibleParty: string;
+    /** Security review date */
+    securityReviewDate?: Date;
+    /** Risk assessment reference */
+    riskAssessmentRef?: string;
+    /** Associated controls */
+    associatedControls: string[];
+    /** SLA reference */
+    slaReference?: string;
+    /** Data processing agreement */
+    dpaReference?: string;
+}
+export declare const externalServiceSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodEnum<["saas", "paas", "iaas", "api-service", "identity-provider", "payment-processor", "email-service", "monitoring-service", "cdn", "dns", "security-service", "other"]>;
+    provider: z.ZodString;
+    description: z.ZodString;
+    purpose: z.ZodString;
+    dataClassifications: z.ZodArray<z.ZodEnum<["public", "internal", "confidential", "restricted", "cui", "pii", "phi"]>, "many">;
+    isFedRAMPAuthorized: z.ZodBoolean;
+    fedrampPackageId: z.ZodOptional<z.ZodString>;
+    fedrampLevel: z.ZodOptional<z.ZodEnum<["low", "moderate", "high", "li-saas"]>>;
+    authorizationDate: z.ZodOptional<z.ZodDate>;
+    contractReference: z.ZodOptional<z.ZodString>;
+    connectionType: z.ZodEnum<["https", "tls", "ssh", "vpn", "direct-connect", "ipsec", "mtls", "api", "database", "internal"]>;
+    apiEndpoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    status: z.ZodEnum<["active", "pending", "deprecated", "terminated"]>;
+    responsibleParty: z.ZodString;
+    securityReviewDate: z.ZodOptional<z.ZodDate>;
+    riskAssessmentRef: z.ZodOptional<z.ZodString>;
+    associatedControls: z.ZodArray<z.ZodString, "many">;
+    slaReference: z.ZodOptional<z.ZodString>;
+    dpaReference: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "other" | "dns" | "cdn" | "security-service" | "identity-provider" | "saas" | "paas" | "iaas" | "api-service" | "payment-processor" | "email-service" | "monitoring-service";
+    status?: "pending" | "deprecated" | "active" | "terminated";
+    name?: string;
+    description?: string;
+    provider?: string;
+    purpose?: string;
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    associatedControls?: string[];
+    isFedRAMPAuthorized?: boolean;
+    fedrampPackageId?: string;
+    fedrampLevel?: "low" | "high" | "moderate" | "li-saas";
+    authorizationDate?: Date;
+    contractReference?: string;
+    apiEndpoints?: string[];
+    responsibleParty?: string;
+    securityReviewDate?: Date;
+    riskAssessmentRef?: string;
+    slaReference?: string;
+    dpaReference?: string;
+}, {
+    id?: string;
+    type?: "other" | "dns" | "cdn" | "security-service" | "identity-provider" | "saas" | "paas" | "iaas" | "api-service" | "payment-processor" | "email-service" | "monitoring-service";
+    status?: "pending" | "deprecated" | "active" | "terminated";
+    name?: string;
+    description?: string;
+    provider?: string;
+    purpose?: string;
+    dataClassifications?: ("internal" | "public" | "confidential" | "restricted" | "pii" | "phi" | "cui")[];
+    connectionType?: "internal" | "https" | "api" | "database" | "tls" | "vpn" | "ssh" | "direct-connect" | "ipsec" | "mtls";
+    associatedControls?: string[];
+    isFedRAMPAuthorized?: boolean;
+    fedrampPackageId?: string;
+    fedrampLevel?: "low" | "high" | "moderate" | "li-saas";
+    authorizationDate?: Date;
+    contractReference?: string;
+    apiEndpoints?: string[];
+    responsibleParty?: string;
+    securityReviewDate?: Date;
+    riskAssessmentRef?: string;
+    slaReference?: string;
+    dpaReference?: string;
+}>;
+/**
+ * Diagram metadata
+ */
+export interface DiagramMetadata {
+    /** Unique identifier */
+    id: string;
+    /** Diagram name */
+    name: string;
+    /** Diagram type */
+    type: 'network' | 'data-flow' | 'system-architecture' | 'boundary' | 'deployment';
+    /** Description */
+    description: string;
+    /** Version */
+    version: string;
+    /** Last updated */
+    lastUpdated: Date;
+    /** Author */
+    author: string;
+    /** File reference */
+    fileReference: string;
+    /** File format */
+    fileFormat: 'pdf' | 'png' | 'visio' | 'drawio' | 'lucidchart';
+    /** Components depicted */
+    componentsDepicted: string[];
+    /** Data flows depicted */
+    dataFlowsDepicted?: string[];
+    /** Review status */
+    reviewStatus: 'draft' | 'reviewed' | 'approved';
+    /** Reviewed by */
+    reviewedBy?: string;
+    /** Review date */
+    reviewDate?: Date;
+}
+export declare const diagramMetadataSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodEnum<["network", "data-flow", "system-architecture", "boundary", "deployment"]>;
+    description: z.ZodString;
+    version: z.ZodString;
+    lastUpdated: z.ZodDate;
+    author: z.ZodString;
+    fileReference: z.ZodString;
+    fileFormat: z.ZodEnum<["pdf", "png", "visio", "drawio", "lucidchart"]>;
+    componentsDepicted: z.ZodArray<z.ZodString, "many">;
+    dataFlowsDepicted: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    reviewStatus: z.ZodEnum<["draft", "reviewed", "approved"]>;
+    reviewedBy: z.ZodOptional<z.ZodString>;
+    reviewDate: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "network" | "data-flow" | "system-architecture" | "boundary" | "deployment";
+    name?: string;
+    version?: string;
+    description?: string;
+    reviewedBy?: string;
+    lastUpdated?: Date;
+    author?: string;
+    fileReference?: string;
+    reviewDate?: Date;
+    fileFormat?: "pdf" | "png" | "visio" | "drawio" | "lucidchart";
+    componentsDepicted?: string[];
+    dataFlowsDepicted?: string[];
+    reviewStatus?: "approved" | "draft" | "reviewed";
+}, {
+    id?: string;
+    type?: "network" | "data-flow" | "system-architecture" | "boundary" | "deployment";
+    name?: string;
+    version?: string;
+    description?: string;
+    reviewedBy?: string;
+    lastUpdated?: Date;
+    author?: string;
+    fileReference?: string;
+    reviewDate?: Date;
+    fileFormat?: "pdf" | "png" | "visio" | "drawio" | "lucidchart";
+    componentsDepicted?: string[];
+    dataFlowsDepicted?: string[];
+    reviewStatus?: "approved" | "draft" | "reviewed";
+}>;
+/**
+ * Boundary configuration
+ */
+export interface BoundaryConfig {
+    /** System name */
+    systemName: string;
+    /** Organization name */
+    organizationName: string;
+    /** Boundary description */
+    boundaryDescription: string;
+    /** Authorization level */
+    authorizationLevel: 'low' | 'moderate' | 'high';
+    /** Primary data center */
+    primaryDataCenter: string;
+    /** Disaster recovery site */
+    drSite?: string;
+}
+/**
+ * System Boundary Management Service
+ */
+export declare class BoundaryService {
+    private config;
+    private components;
+    private dataFlows;
+    private networkZones;
+    private interconnections;
+    private externalServices;
+    private diagrams;
+    constructor(config: BoundaryConfig);
+    /**
+     * Add a system component
+     */
+    addComponent(component: Omit<SystemComponent, 'id'>): SystemComponent;
+    /**
+     * Update a component
+     */
+    updateComponent(id: string, updates: Partial<SystemComponent>): SystemComponent;
+    /**
+     * Remove a component
+     */
+    removeComponent(id: string): void;
+    /**
+     * Get component by ID
+     */
+    getComponent(id: string): SystemComponent | undefined;
+    /**
+     * Get all components
+     */
+    getAllComponents(filter?: {
+        type?: ComponentType;
+        status?: ComponentStatus;
+        withinBoundary?: boolean;
+        dataClassification?: DataClassification;
+    }): SystemComponent[];
+    /**
+     * Get components within authorization boundary
+     */
+    getBoundaryComponents(): SystemComponent[];
+    /**
+     * Add a data flow
+     */
+    addDataFlow(flow: Omit<DataFlow, 'id'>): DataFlow;
+    /**
+     * Get all data flows
+     */
+    getAllDataFlows(filter?: {
+        sourceComponentId?: string;
+        destinationComponentId?: string;
+        dataClassification?: DataClassification;
+    }): DataFlow[];
+    /**
+     * Get data flows for a component
+     */
+    getComponentDataFlows(componentId: string): DataFlow[];
+    /**
+     * Add a network zone
+     */
+    addNetworkZone(zone: Omit<NetworkZone, 'id'>): NetworkZone;
+    /**
+     * Get all network zones
+     */
+    getAllNetworkZones(): NetworkZone[];
+    /**
+     * Add component to zone
+     */
+    addComponentToZone(zoneId: string, componentId: string): void;
+    /**
+     * Add a system interconnection
+     */
+    addInterconnection(interconnection: Omit<SystemInterconnection, 'id'>): SystemInterconnection;
+    /**
+     * Update interconnection status
+     */
+    updateInterconnectionStatus(id: string, status: SystemInterconnection['status']): SystemInterconnection;
+    /**
+     * Get all interconnections
+     */
+    getAllInterconnections(filter?: {
+        type?: InterconnectionType;
+        status?: SystemInterconnection['status'];
+    }): SystemInterconnection[];
+    /**
+     * Get interconnections needing review
+     */
+    getInterconnectionsNeedingReview(): SystemInterconnection[];
+    /**
+     * Get expiring agreements
+     */
+    getExpiringAgreements(daysThreshold?: number): SystemInterconnection[];
+    /**
+     * Add an external service
+     */
+    addExternalService(service: Omit<ExternalService, 'id'>): ExternalService;
+    /**
+     * Get all external services
+     */
+    getAllExternalServices(filter?: {
+        type?: ExternalServiceType;
+        status?: ExternalService['status'];
+        isFedRAMPAuthorized?: boolean;
+    }): ExternalService[];
+    /**
+     * Get non-FedRAMP authorized services (requires risk assessment)
+     */
+    getNonFedRAMPServices(): ExternalService[];
+    /**
+     * Add diagram metadata
+     */
+    addDiagram(diagram: Omit<DiagramMetadata, 'id'>): DiagramMetadata;
+    /**
+     * Get all diagrams
+     */
+    getAllDiagrams(filter?: {
+        type?: DiagramMetadata['type'];
+        reviewStatus?: DiagramMetadata['reviewStatus'];
+    }): DiagramMetadata[];
+    /**
+     * Generate boundary inventory summary
+     */
+    generateInventorySummary(): BoundaryInventorySummary;
+    /**
+     * Export boundary documentation for SSP
+     */
+    exportForSSP(): SSPBoundaryDocumentation;
+}
+export interface BoundaryInventorySummary {
+    generatedDate: Date;
+    systemName: string;
+    authorizationLevel: 'low' | 'moderate' | 'high';
+    totalComponents: number;
+    boundaryComponents: number;
+    componentsByType: Record<string, number>;
+    componentsByStatus: Record<string, number>;
+    dataFlowCount: number;
+    networkZoneCount: number;
+    activeInterconnections: number;
+    activeExternalServices: number;
+    nonFedRAMPServices: number;
+    dataClassificationsHandled: DataClassification[];
+    diagramsApproved: number;
+    interconnectionsNeedingReview: number;
+    expiringAgreements: number;
+}
+export interface SSPBoundaryDocumentation {
+    systemDescription: {
+        systemName: string;
+        organizationName: string;
+        boundaryDescription: string;
+        authorizationLevel: 'low' | 'moderate' | 'high';
+    };
+    componentInventory: SystemComponent[];
+    dataFlows: DataFlow[];
+    networkZones: NetworkZone[];
+    interconnections: SystemInterconnection[];
+    externalServices: ExternalService[];
+    diagrams: DiagramMetadata[];
+}
+export default BoundaryService;
+//# sourceMappingURL=boundary.d.ts.map