@mitre/hdf-converters 2.13.0 → 3.0.1

package/dist/converters/oscal-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,57 @@
+/**
+ * OSCAL document type fingerprints.
+ *
+ * Registers 7 separate ConverterFingerprint entries, one for each OSCAL
+ * document type. Each checks for its specific top-level JSON key.
+ *
+ * No converter imports — data only, safe for client bundles.
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+const OSCAL_SPECS = [
+    { key: 'system-security-plan', id: 'oscal-ssp-to-hdf', label: 'OSCAL SSP', outputType: 'raw' },
+    { key: 'assessment-plan', id: 'oscal-sap-to-hdf', label: 'OSCAL SAP', outputType: 'plan' },
+    { key: 'assessment-results', id: 'oscal-sar-to-hdf', label: 'OSCAL SAR', outputType: 'results' },
+    { key: 'plan-of-action-and-milestones', id: 'oscal-poam-to-hdf', label: 'OSCAL POA&M', outputType: 'amendments' },
+    { key: 'profile', id: 'oscal-profile-to-hdf', label: 'OSCAL Profile', outputType: 'baseline' },
+    { key: 'catalog', id: 'oscal-catalog-to-hdf', label: 'OSCAL Catalog', outputType: 'baseline' },
+    { key: 'component-definition', id: 'oscal-component-to-hdf', label: 'OSCAL Component', outputType: 'baseline' },
+];
+function oscalDetectVersion(rootKey, input) {
+    if (typeof input !== 'object' || input === null)
+        return '';
+    const obj = input;
+    const root = obj[rootKey];
+    if (!root || typeof root !== 'object')
+        return '';
+    const meta = root.metadata;
+    if (!meta || typeof meta !== 'object')
+        return '';
+    return typeof meta['oscal-version'] === 'string' ? meta['oscal-version'] : '';
+}
+function buildFingerprint(spec) {
+    return {
+        id: spec.id,
+        label: spec.label,
+        direction: 'ingest',
+        inputFamily: 'json',
+        outputType: spec.outputType,
+        fingerprint: (input) => {
+            if (typeof input !== 'object' || input === null || Array.isArray(input))
+                return 0;
+            const obj = input;
+            if (spec.key in obj)
+                return 1.0;
+            return 0;
+        },
+        detectVersion: (input) => oscalDetectVersion(spec.key, input),
+    };
+}
+export const oscalFingerprints = OSCAL_SPECS.map(buildFingerprint);
+export function register() {
+    for (const fp of oscalFingerprints) {
+        if (getFingerprint(fp.id))
+            continue;
+        registerFingerprint(fp);
+    }
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/oscal-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/oscal-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA8C,MAAM,wCAAwC,CAAC;AASzI,MAAM,WAAW,GAA2B;IAC1C,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9F,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;IAC1F,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE;IAChG,EAAE,GAAG,EAAE,+BAA+B,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE;IACjH,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE;IAC9F,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE;IAC9F,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE;CAChH,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAc;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAwC,CAAC;IACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,QAA+C,CAAC;IAClE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,OAAO,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA0B;IAClD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YAChC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,aAAa,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAA2B,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE3F,MAAM,UAAU,QAAQ;IACtB,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/converters/oscal-to-hdf/typescript/index.d.ts

@@ -0,0 +1,9 @@
+export { detectOscalDocumentType } from './detect.js';
+export { convertOscalCatalogToHdf } from './converter-catalog.js';
+export { convertOscalProfileToHdf } from './converter-profile.js';
+export { convertOscalComponentToHdf } from './converter-component.js';
+export { convertOscalSspToHdf } from './converter-ssp.js';
+export { convertOscalSapToHdf } from './converter-sap.js';
+export { convertOscalPoamToHdf } from './converter-poam.js';
+export { convertOscalSarToHdf } from './converter-sar.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/oscal-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/oscal-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/converters/oscal-to-hdf/typescript/index.js

@@ -0,0 +1,9 @@
+export { detectOscalDocumentType } from './detect.js';
+export { convertOscalCatalogToHdf } from './converter-catalog.js';
+export { convertOscalProfileToHdf } from './converter-profile.js';
+export { convertOscalComponentToHdf } from './converter-component.js';
+export { convertOscalSspToHdf } from './converter-ssp.js';
+export { convertOscalSapToHdf } from './converter-sap.js';
+export { convertOscalPoamToHdf } from './converter-poam.js';
+export { convertOscalSarToHdf } from './converter-sar.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/oscal-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/oscal-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/converters/oscal-to-hdf/typescript/shared.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Shared helper functions for OSCAL-to-HDF converters.
+ *
+ * Mirrors the Go helpers in converters/oscal-to-hdf/go/shared.go.
+ */
+import type { Property, Part, Characterization, DocumentMetadata, Oscal } from './types.js';
+/**
+ * Converts an OSCAL control ID to NIST 800-53 notation.
+ * "ac-1" -> "AC-1", "ac-2.3" -> "AC-2 (3)"
+ */
+export declare function controlIdToNistTag(id: string): string;
+/**
+ * Converts a list of OSCAL control IDs to NIST tags, deduplicating.
+ */
+export declare function controlIdsToNistTags(ids: string[]): string[];
+/**
+ * Extracts the base control ID from a SAR objective ID.
+ * "ac-1.a.1_obj.1" -> "ac-1"
+ */
+export declare function extractControlIdFromObjectiveId(objectiveId: string): string;
+/**
+ * Maps OSCAL finding/risk status strings to HDF-compatible status strings.
+ * "satisfied"/"closed" -> "passed", "not-satisfied"/"open" -> "failed"
+ */
+export declare function oscalStatusToHdf(state: string): string | undefined;
+/**
+ * Finds the first property with the given name and returns its value.
+ * If ns is non-empty, the property must also match that namespace.
+ */
+export declare function extractPropValue(props: Property[] | undefined, name: string, ns?: string): string | undefined;
+/**
+ * Returns all property values matching the given name.
+ */
+export declare function extractAllPropValues(props: Property[] | undefined, name: string, ns?: string): string[];
+/**
+ * Recursively concatenates prose from a Part tree, joining with newlines.
+ */
+export declare function flattenParts(parts: Part[] | undefined): string;
+/**
+ * Like flattenParts but only includes top-level parts matching the given name.
+ * Nested parts are included regardless of their name.
+ */
+export declare function flattenPartsByName(parts: Part[] | undefined, name: string): string;
+/**
+ * Extracts impact/severity from risk characterization facets.
+ * Returns a normalized 0.0-1.0 impact value. Falls back to defaultImpact.
+ */
+export declare function extractRiskSeverity(characterizations: Characterization[] | undefined, defaultImpact: number): number;
+/** Holds extracted metadata common to all OSCAL documents. */
+export interface MetadataInfo {
+    title: string;
+    version: string;
+    oscalVersion: string;
+    lastModified: string;
+}
+/** Pulls common fields from OSCAL metadata. */
+export declare function extractMetadata(m: DocumentMetadata): MetadataInfo;
+/**
+ * Converts NIST 800-53 notation back to OSCAL control ID.
+ * "AC-1" -> "ac-1", "AC-2 (3)" -> "ac-2.3", "SI-7 (1)" -> "si-7.1"
+ */
+export declare function nistTagToControlId(tag: string): string;
+/**
+ * Converts a 0.0-1.0 impact value to an OSCAL severity string.
+ * This is the reverse of extractRiskSeverity.
+ */
+export declare function impactToSeverity(impact: number): string;
+/**
+ * Maps an HDF status string to an OSCAL risk status string.
+ * "passed"/"notApplicable" -> "closed", everything else -> "open".
+ */
+export declare function hdfStatusToOscalRiskStatus(status: string): string;
+/** OSCAL specification version used in reverse converter output documents. */
+export declare const OSCAL_VERSION = "1.1.2";
+/**
+ * Parses an OSCAL document from JSON input, validates the document type.
+ * Throws if input is empty, invalid JSON, or not the expected type.
+ */
+export declare function parseOscalDocument<T extends keyof Oscal>(input: string, expectedKey: T, converterName: string): NonNullable<Oscal[T]>;
+/**
+ * Converts a title to kebab-case, truncated to 80 characters.
+ * Shared utility used by multiple converters for deriving names.
+ */
+export declare function toKebabCase(title: string, fallback: string): string;
+//# sourceMappingURL=shared.d.ts.map

package/dist/converters/oscal-to-hdf/typescript/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../converters/oscal-to-hdf/typescript/shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAK5F;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAW5D;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWlE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,QAAQ,EAAE,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,EACZ,EAAE,CAAC,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAQpB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,EAAE,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,EACZ,EAAE,CAAC,EAAE,MAAM,GACV,MAAM,EAAE,CASV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,GAAG,MAAM,CAK9D;AAaD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,EACzB,IAAI,EAAE,MAAM,GACX,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,SAAS,EACjD,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,CAAC,EAAE,gBAAgB,GAAG,YAAY,CAOjE;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,8EAA8E;AAC9E,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,KAAK,EACtD,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,CAAC,EACd,aAAa,EAAE,MAAM,GACpB,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAkBvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAanE"}

package/dist/converters/oscal-to-hdf/typescript/shared.js

@@ -0,0 +1,251 @@
+/**
+ * Shared helper functions for OSCAL-to-HDF converters.
+ *
+ * Mirrors the Go helpers in converters/oscal-to-hdf/go/shared.go.
+ */
+const controlEnhancementRe = /^([a-z]{2}-\d+)\.(\d+)$/;
+const objectiveIDRe = /^([a-z]{2}-\d+(?:\.\d+)?)/;
+/**
+ * Converts an OSCAL control ID to NIST 800-53 notation.
+ * "ac-1" -> "AC-1", "ac-2.3" -> "AC-2 (3)"
+ */
+export function controlIdToNistTag(id) {
+    const m = controlEnhancementRe.exec(id);
+    if (m) {
+        return `${m[1].toUpperCase()} (${m[2]})`;
+    }
+    return id.toUpperCase();
+}
+/**
+ * Converts a list of OSCAL control IDs to NIST tags, deduplicating.
+ */
+export function controlIdsToNistTags(ids) {
+    const tags = [];
+    const seen = new Set();
+    for (const id of ids) {
+        const tag = controlIdToNistTag(id);
+        if (!seen.has(tag)) {
+            seen.add(tag);
+            tags.push(tag);
+        }
+    }
+    return tags;
+}
+/**
+ * Extracts the base control ID from a SAR objective ID.
+ * "ac-1.a.1_obj.1" -> "ac-1"
+ */
+export function extractControlIdFromObjectiveId(objectiveId) {
+    const m = objectiveIDRe.exec(objectiveId);
+    if (m) {
+        return m[1];
+    }
+    return objectiveId;
+}
+/**
+ * Maps OSCAL finding/risk status strings to HDF-compatible status strings.
+ * "satisfied"/"closed" -> "passed", "not-satisfied"/"open" -> "failed"
+ */
+export function oscalStatusToHdf(state) {
+    switch (state.toLowerCase().trim()) {
+        case 'satisfied':
+        case 'closed':
+            return 'passed';
+        case 'not-satisfied':
+        case 'open':
+            return 'failed';
+        default:
+            return undefined;
+    }
+}
+/**
+ * Finds the first property with the given name and returns its value.
+ * If ns is non-empty, the property must also match that namespace.
+ */
+export function extractPropValue(props, name, ns) {
+    if (!props)
+        return undefined;
+    for (const p of props) {
+        if (p.name === name && (!ns || p.ns === ns)) {
+            return p.value;
+        }
+    }
+    return undefined;
+}
+/**
+ * Returns all property values matching the given name.
+ */
+export function extractAllPropValues(props, name, ns) {
+    if (!props)
+        return [];
+    const values = [];
+    for (const p of props) {
+        if (p.name === name && (!ns || p.ns === ns)) {
+            values.push(p.value);
+        }
+    }
+    return values;
+}
+/**
+ * Recursively concatenates prose from a Part tree, joining with newlines.
+ */
+export function flattenParts(parts) {
+    if (!parts)
+        return '';
+    const pieces = [];
+    flattenPartsRecursive(parts, pieces);
+    return pieces.join('\n').trim();
+}
+function flattenPartsRecursive(parts, pieces) {
+    for (const p of parts) {
+        if (p.prose) {
+            pieces.push(p.prose);
+        }
+        if (p.parts && p.parts.length > 0) {
+            flattenPartsRecursive(p.parts, pieces);
+        }
+    }
+}
+/**
+ * Like flattenParts but only includes top-level parts matching the given name.
+ * Nested parts are included regardless of their name.
+ */
+export function flattenPartsByName(parts, name) {
+    if (!parts)
+        return '';
+    const pieces = [];
+    for (const p of parts) {
+        if (p.name === name) {
+            if (p.prose) {
+                pieces.push(p.prose);
+            }
+            if (p.parts && p.parts.length > 0) {
+                flattenPartsRecursive(p.parts, pieces);
+            }
+        }
+    }
+    return pieces.join('\n').trim();
+}
+/**
+ * Extracts impact/severity from risk characterization facets.
+ * Returns a normalized 0.0-1.0 impact value. Falls back to defaultImpact.
+ */
+export function extractRiskSeverity(characterizations, defaultImpact) {
+    if (!characterizations)
+        return defaultImpact;
+    for (const c of characterizations) {
+        if (!c.facets)
+            continue;
+        for (const f of c.facets) {
+            if (f.name === 'impact' || f.name === 'risk' || f.name === 'likelihood') {
+                switch (f.value.toLowerCase()) {
+                    case 'critical':
+                        return 0.9;
+                    case 'high':
+                        return 0.7;
+                    case 'moderate':
+                    case 'medium':
+                        return 0.5;
+                    case 'low':
+                        return 0.3;
+                    case 'info':
+                    case 'informational':
+                    case 'none':
+                        return 0.0;
+                }
+            }
+        }
+    }
+    return defaultImpact;
+}
+/** Pulls common fields from OSCAL metadata. */
+export function extractMetadata(m) {
+    return {
+        title: m.title,
+        version: m.version,
+        oscalVersion: m['oscal-version'],
+        lastModified: String(m['last-modified']),
+    };
+}
+/** Matches NIST 800-53 tags with enhancements like "AC-2 (3)". */
+const nistEnhancementReverseRe = /^([A-Z]{2}-\d+)\s*\((\d+)\)$/;
+/**
+ * Converts NIST 800-53 notation back to OSCAL control ID.
+ * "AC-1" -> "ac-1", "AC-2 (3)" -> "ac-2.3", "SI-7 (1)" -> "si-7.1"
+ */
+export function nistTagToControlId(tag) {
+    tag = tag.trim();
+    const m = nistEnhancementReverseRe.exec(tag);
+    if (m) {
+        return `${m[1].toLowerCase()}.${m[2]}`;
+    }
+    return tag.toLowerCase();
+}
+/**
+ * Converts a 0.0-1.0 impact value to an OSCAL severity string.
+ * This is the reverse of extractRiskSeverity.
+ */
+export function impactToSeverity(impact) {
+    if (impact >= 0.9)
+        return 'critical';
+    if (impact >= 0.7)
+        return 'high';
+    if (impact >= 0.4)
+        return 'moderate';
+    if (impact >= 0.1)
+        return 'low';
+    return 'info';
+}
+/**
+ * Maps an HDF status string to an OSCAL risk status string.
+ * "passed"/"notApplicable" -> "closed", everything else -> "open".
+ */
+export function hdfStatusToOscalRiskStatus(status) {
+    if (status === 'passed' || status === 'notApplicable') {
+        return 'closed';
+    }
+    return 'open';
+}
+/** OSCAL specification version used in reverse converter output documents. */
+export const OSCAL_VERSION = '1.1.2';
+/**
+ * Parses an OSCAL document from JSON input, validates the document type.
+ * Throws if input is empty, invalid JSON, or not the expected type.
+ */
+export function parseOscalDocument(input, expectedKey, converterName) {
+    if (!input || input.trim().length === 0) {
+        throw new Error(`${converterName}: empty input`);
+    }
+    let doc;
+    try {
+        doc = JSON.parse(input);
+    }
+    catch {
+        throw new Error(`${converterName}: failed to parse JSON`);
+    }
+    const value = doc[expectedKey];
+    if (!value) {
+        throw new Error(`${converterName}: expected ${String(expectedKey)} document`);
+    }
+    return value;
+}
+/**
+ * Converts a title to kebab-case, truncated to 80 characters.
+ * Shared utility used by multiple converters for deriving names.
+ */
+export function toKebabCase(title, fallback) {
+    if (!title)
+        return fallback;
+    let name = title.toLowerCase();
+    name = name.replace(/[^a-z0-9]/g, '-');
+    // Collapse consecutive dashes
+    while (name.includes('--')) {
+        name = name.replace(/--/g, '-');
+    }
+    name = name.replace(/^-+|-+$/g, '');
+    if (name.length > 80) {
+        name = name.slice(0, 80);
+    }
+    return name;
+}
+//# sourceMappingURL=shared.js.map

package/dist/converters/oscal-to-hdf/typescript/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../../converters/oscal-to-hdf/typescript/shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAa;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,WAAmB;IACjE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;IACf,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,eAAe,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA6B,EAC7B,IAAY,EACZ,EAAW;IAEX,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA6B,EAC7B,IAAY,EACZ,EAAW;IAEX,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,MAAgB;IAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,qBAAqB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAyB,EACzB,IAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,qBAAqB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,iBAAiD,EACjD,aAAqB;IAErB,IAAI,CAAC,iBAAiB;QAAE,OAAO,aAAa,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACxE,QAAQ,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9B,KAAK,UAAU;wBACb,OAAO,GAAG,CAAC;oBACb,KAAK,MAAM;wBACT,OAAO,GAAG,CAAC;oBACb,KAAK,UAAU,CAAC;oBAChB,KAAK,QAAQ;wBACX,OAAO,GAAG,CAAC;oBACb,KAAK,KAAK;wBACR,OAAO,GAAG,CAAC;oBACb,KAAK,MAAM,CAAC;oBACZ,KAAK,eAAe,CAAC;oBACrB,KAAK,MAAM;wBACT,OAAO,GAAG,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAUD,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,CAAmB;IACjD,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACjB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,WAAc,EACd,aAAqB;IAErB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,eAAe,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAU,CAAC;IACf,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAU,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,cAAc,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,KAA8B,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACvC,8BAA8B;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}