@mitre/hdf-converters 2.13.0 → 3.0.1

package/dist/converters/xccdf-results-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,33 @@
+/**
+ * XCCDF/ARF format fingerprint.
+ *
+ * Detects XCCDF and ARF XML files by checking for:
+ * - <Benchmark> root element (XCCDF)
+ * - <asset-report-collection> root element (ARF)
+ * Handles namespace prefixes (e.g., <xccdf:Benchmark>).
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+import { extractXmlRootElement } from '../../../shared/typescript/xml-utils.js';
+export const xccdfFingerprint = {
+    id: 'xccdf-results-to-hdf',
+    label: 'XCCDF/ARF',
+    direction: 'ingest',
+    inputFamily: 'xml',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'string')
+            return 0;
+        const root = extractXmlRootElement(input);
+        if (!root)
+            return 0;
+        if (root === 'Benchmark' || root === 'asset-report-collection')
+            return 1.0;
+        return 0;
+    },
+};
+export function register() {
+    if (getFingerprint('xccdf-results-to-hdf'))
+        return;
+    registerFingerprint(xccdfFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/xccdf-results-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/xccdf-results-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AACxH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,yBAAyB;YAAE,OAAO,GAAG,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,sBAAsB,CAAC;QAAE,OAAO;IACnD,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AACxC,CAAC"}

package/dist/converters/xccdf-results-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertXccdfResultsToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/xccdf-results-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/xccdf-results-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/xccdf-results-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertXccdfResultsToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/xccdf-results-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/xccdf-results-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/zap-to-hdf/typescript/converter.d.ts

@@ -0,0 +1,2 @@
+export declare function convertZapToHdf(input: string): Promise<string>;
+//# sourceMappingURL=converter.d.ts.map

package/dist/converters/zap-to-hdf/typescript/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAqJA,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgLpE"}

package/dist/converters/zap-to-hdf/typescript/converter.js

@@ -0,0 +1,237 @@
+import { createMinimalBaseline, Copyright, ResultStatus, } from '@mitre/hdf-schema';
+import { getCweNistControl, nistToCci, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, } from '@mitre/hdf-mappings';
+import { parseJSON } from '@mitre/hdf-utilities';
+import { detectConverter } from '../../../shared/typescript/fingerprint.js';
+import { registerAllFingerprints } from '../../../shared/typescript/register-all.js';
+import { convertSarifToHdf } from '../../sarif-to-hdf/typescript/converter.js';
+import { inputChecksum, buildNistCciTags, limitArray, stripHTML, validateInputSize } from '../../../shared/typescript/converterutil.js';
+// --- Risk code to impact ---
+function riskCodeToImpact(riskCode) {
+    switch (riskCode) {
+        case '0':
+        case '1':
+            return 0.3;
+        case '2':
+            return 0.5;
+        case '3':
+            return 0.7;
+        default:
+            return 0.5;
+    }
+}
+// --- NIST tag building ---
+function buildNistTags(cweid) {
+    if (cweid && cweid !== '0') {
+        const cweNum = parseInt(cweid, 10);
+        if (!isNaN(cweNum)) {
+            const control = getCweNistControl(cweNum);
+            if (control) {
+                return [control];
+            }
+        }
+    }
+    return [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+}
+// --- Instance to code desc ---
+function buildCodeDesc(instance) {
+    const parts = [];
+    if (instance.uri) {
+        parts.push(`URI: ${instance.uri}`);
+    }
+    if (instance.method) {
+        parts.push(`Method: ${instance.method}`);
+    }
+    if (instance.param) {
+        parts.push(`Param: ${instance.param}`);
+    }
+    if (instance.evidence) {
+        parts.push(`Evidence: ${instance.evidence}`);
+    }
+    return parts.join(' | ');
+}
+// --- Build check description ---
+function buildCheckDescription(alert) {
+    const parts = [];
+    if (alert.solution) {
+        const stripped = stripHTML(alert.solution);
+        if (stripped) {
+            parts.push(stripped);
+        }
+    }
+    if (alert.otherinfo) {
+        const stripped = stripHTML(alert.otherinfo);
+        if (stripped) {
+            parts.push(stripped);
+        }
+    }
+    return parts.join('\n');
+}
+// --- Select site with most alerts ---
+function selectSite(sites) {
+    if (sites.length === 0)
+        return undefined;
+    let best = sites[0];
+    for (let i = 1; i < sites.length; i++) {
+        const site = sites[i];
+        if ((site.alerts?.length ?? 0) > (best.alerts?.length ?? 0)) {
+            best = site;
+        }
+    }
+    return best;
+}
+// --- Main converter ---
+export async function convertZapToHdf(input) {
+    validateInputSize(input, 'zap');
+    // SARIF routing — delegate to the shared SARIF converter
+    registerAllFingerprints();
+    const detected = detectConverter(input);
+    if (detected && detected.fingerprint.id === 'sarif-to-hdf') {
+        return convertSarifToHdf(input);
+    }
+    const resultsChecksum = await inputChecksum(input);
+    const zapData = parseJSON(input);
+    // Validate basic structure
+    if (!zapData.site || !Array.isArray(zapData.site)) {
+        // Empty report — produce empty HDF
+        const baseline = createMinimalBaseline('OWASP ZAP Scan', [], {
+            resultsChecksum,
+            title: 'OWASP ZAP Scan',
+            summary: '',
+        });
+        const hdf = {
+            baselines: [baseline],
+            generator: { name: 'zap-to-hdf', version: 'unknown' },
+            tool: { name: 'OWASP ZAP', format: 'JSON' },
+        };
+        return JSON.stringify(hdf, null, 2);
+    }
+    // Select site with most alerts
+    const site = selectSite(zapData.site);
+    if (!site) {
+        // Empty site array — produce empty HDF
+        const baseline = createMinimalBaseline('OWASP ZAP Scan', [], {
+            resultsChecksum,
+            title: 'OWASP ZAP Scan',
+            summary: `ZAP Version ${zapData['@version'] ?? 'unknown'}`,
+        });
+        const hdf = {
+            baselines: [baseline],
+            generator: { name: 'zap-to-hdf', version: 'unknown' },
+            tool: { name: 'OWASP ZAP', format: 'JSON' },
+        };
+        if (zapData['@generated']) {
+            hdf.timestamp = new Date(zapData['@generated']);
+        }
+        return JSON.stringify(hdf, null, 2);
+    }
+    const alerts = site.alerts ?? [];
+    // Deduplicate by pluginid — append .1, .2 for duplicates
+    const pluginIdCount = new Map();
+    const { items: limitedAlerts, truncated } = limitArray(alerts);
+    /* v8 ignore next -- truncation only triggers with >100K items */
+    if (truncated) {
+        // eslint-disable-next-line no-console
+        console.warn(`WARNING: Input truncated at ${limitedAlerts.length} alert items (original: ${alerts.length})`);
+    }
+    const requirements = [];
+    for (const alert of limitedAlerts) {
+        // Deduplicate pluginid
+        const count = pluginIdCount.get(alert.pluginid) ?? 0;
+        pluginIdCount.set(alert.pluginid, count + 1);
+        const reqId = count === 0 ? alert.pluginid : `${alert.pluginid}.${count}`;
+        // Build NIST tags
+        const nistTags = buildNistTags(alert.cweid ?? '');
+        const cciTags = nistToCci(nistTags);
+        // Build extra tags
+        const extras = {};
+        if (alert.cweid) {
+            extras.cweid = alert.cweid;
+        }
+        if (alert.wascid) {
+            extras.wascid = alert.wascid;
+        }
+        if (alert.riskdesc) {
+            extras.riskdesc = alert.riskdesc;
+        }
+        if (alert.confidence) {
+            extras.confidence = alert.confidence;
+        }
+        const tags = buildNistCciTags(nistTags, cciTags, Object.keys(extras).length > 0 ? extras : undefined);
+        // Build results from instances
+        const results = [];
+        if (alert.instances && alert.instances.length > 0) {
+            const { items: limitedInstances, truncated: instTruncated } = limitArray(alert.instances);
+            if (instTruncated) {
+                // eslint-disable-next-line no-console
+                console.warn(`WARNING: Instances truncated at ${limitedInstances.length} for alert ${alert.pluginid}`);
+            }
+            for (const instance of limitedInstances) {
+                const result = {
+                    status: ResultStatus.Failed,
+                    codeDesc: buildCodeDesc(instance),
+                    startTime: new Date('0001-01-01T00:00:00Z'),
+                };
+                if (instance.attack) {
+                    result.message = instance.attack;
+                }
+                results.push(result);
+            }
+        }
+        // Build descriptions
+        const descriptions = [];
+        if (alert.desc) {
+            descriptions.push({ label: 'default', data: stripHTML(alert.desc) });
+        }
+        const checkDesc = buildCheckDescription(alert);
+        if (checkDesc) {
+            descriptions.push({ label: 'check', data: checkDesc });
+        }
+        const impact = riskCodeToImpact(alert.riskcode ?? '');
+        const req = {
+            id: reqId,
+            title: alert.name,
+            impact,
+            results,
+            tags,
+            descriptions,
+        };
+        requirements.push(req);
+    }
+    const targetName = site['@host'] ?? 'Unknown Host';
+    const siteName = site['@name'] ?? targetName;
+    const baselineName = `OWASP ZAP Scan of ${siteName}`;
+    const baseline = createMinimalBaseline('OWASP ZAP Scan', requirements, {
+        resultsChecksum,
+        title: baselineName,
+        summary: `ZAP Version ${zapData['@version'] ?? 'unknown'}`,
+    });
+    const tool = {
+        name: 'OWASP ZAP',
+        format: 'JSON',
+    };
+    if (zapData['@version']) {
+        tool.version = zapData['@version'];
+    }
+    // Build components — ZAP is a DAST tool scanning web applications
+    const components = [];
+    if (site['@name']) {
+        components.push({ name: targetName, type: Copyright.Application, url: site['@name'] });
+    }
+    else if (targetName !== 'Unknown Host') {
+        components.push({ name: targetName, type: Copyright.Application });
+    }
+    const hdf = {
+        baselines: [baseline],
+        components,
+        generator: {
+            name: 'zap-to-hdf',
+            version: 'unknown',
+        },
+        tool,
+    };
+    if (zapData['@generated']) {
+        hdf.timestamp = new Date(zapData['@generated']);
+    }
+    return JSON.stringify(hdf, null, 2);
+}
+//# sourceMappingURL=converter.js.map

package/dist/converters/zap-to-hdf/typescript/converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.js","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,EACrB,SAAS,EAMT,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,eAAe,EAAC,MAAM,2CAA2C,CAAC;AAC1E,OAAO,EAAC,uBAAuB,EAAC,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAC,iBAAiB,EAAC,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAC,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAC,MAAM,6CAA6C,CAAC;AA4CtI,8BAA8B;AAE9B,SAAS,gBAAgB,CAAC,QAAgB;IACxC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,GAAG,CAAC;QACb,KAAK,GAAG;YACN,OAAO,GAAG,CAAC;QACb,KAAK,GAAG;YACN,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,4BAA4B;AAE5B,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,iCAAiC,CAAC,CAAC;AAChD,CAAC;AAED,gCAAgC;AAEhC,SAAS,aAAa,CAAC,QAAqB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,kCAAkC;AAElC,SAAS,qBAAqB,CAAC,KAAe;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,uCAAuC;AAEvC,SAAS,UAAU,CAAC,KAAgB;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,yDAAyD;IACzD,uBAAuB,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAa,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,SAAS,CAAY,KAAK,CAAC,CAAC;IAE5C,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,mCAAmC;QACnC,MAAM,QAAQ,GAAsB,qBAAqB,CAAC,gBAAgB,EAAE,EAAE,EAAE;YAC9E,eAAe;YACf,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,EAAE;SACZ,CAAsB,CAAC;QAExB,MAAM,GAAG,GAAe;YACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,SAAS,EAAE,EAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAC;YACnD,IAAI,EAAE,EAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAC;SAC1C,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,uCAAuC;QACvC,MAAM,QAAQ,GAAsB,qBAAqB,CAAC,gBAAgB,EAAE,EAAE,EAAE;YAC9E,eAAe;YACf,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE;SAC3D,CAAsB,CAAC;QAExB,MAAM,GAAG,GAAe;YACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,SAAS,EAAE,EAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAC;YACnD,IAAI,EAAE,EAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAC;SAC1C,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAEjC,yDAAyD;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,EAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,iEAAiE;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,CAAC,MAAM,2BAA2B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,uBAAuB;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC;QAE1E,kBAAkB;QAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEpC,mBAAmB;QACnB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAEtG,+BAA+B;QAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,EAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAC,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxF,IAAI,aAAa,EAAE,CAAC;gBAClB,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,mCAAmC,gBAAgB,CAAC,MAAM,cAAc,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAsB;oBAChC,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;oBACjC,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;iBAC5C,CAAC;gBACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACnC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,YAAY,GAAyC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAyB;YAChC,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,YAAY;SACb,CAAC;QAEF,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC;IAC7C,MAAM,YAAY,GAAG,qBAAqB,QAAQ,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,qBAAqB,CAAC,gBAAgB,EAAE,YAAY,EAAE;QACxF,eAAe;QACf,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE;KAC3D,CAAsB,CAAC;IAExB,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,kEAAkE;IAClE,MAAM,UAAU,GAA0F,EAAE,CAAC;IAC7G,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAC,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QACzC,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAe;QACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,UAAU;QACV,SAAS,EAAE;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,SAAS;SACnB;QACD,IAAI;KACL,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/converters/zap-to-hdf/typescript/fingerprint.d.ts

@@ -0,0 +1,11 @@
+/**
+ * OWASP ZAP format fingerprint.
+ *
+ * Detects ZAP JSON output by checking for a site array with alerts.
+ * ZAP outputs JSON (not XML), containing @generated/@version and site[] fields.
+ * Note: ZAP can also output SARIF — the SARIF fingerprint handles that case.
+ */
+import { type ConverterFingerprint } from '../../../shared/typescript/registry.js';
+export declare const zapFingerprint: ConverterFingerprint;
+export declare function register(): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/converters/zap-to-hdf/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAExH,eAAO,MAAM,cAAc,EAAE,oBAiB5B,CAAC;AAEF,wBAAgB,QAAQ,IAAI,IAAI,CAG/B"}

package/dist/converters/zap-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,34 @@
+/**
+ * OWASP ZAP format fingerprint.
+ *
+ * Detects ZAP JSON output by checking for a site array with alerts.
+ * ZAP outputs JSON (not XML), containing @generated/@version and site[] fields.
+ * Note: ZAP can also output SARIF — the SARIF fingerprint handles that case.
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+export const zapFingerprint = {
+    id: 'zap-to-hdf',
+    label: 'OWASP ZAP',
+    direction: 'ingest',
+    inputFamily: 'json',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'object' || input === null)
+            return 0;
+        const obj = input;
+        // ZAP JSON has a "site" array and optionally "@generated", "@version"
+        if (Array.isArray(obj.site)) {
+            // Higher confidence if @version or @generated present (standard ZAP fields)
+            if (typeof obj['@version'] === 'string' || typeof obj['@generated'] === 'string')
+                return 0.95;
+            return 0.85;
+        }
+        return 0;
+    },
+};
+export function register() {
+    if (getFingerprint('zap-to-hdf'))
+        return;
+    registerFingerprint(zapFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/zap-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AAExH,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,sEAAsE;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,4EAA4E;YAC5E,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,YAAY,CAAC;QAAE,OAAO;IACzC,mBAAmB,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC"}

package/dist/converters/zap-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertZapToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/zap-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/zap-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertZapToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/zap-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/zap-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/package.json

@@ -0,0 +1,71 @@
+{
+    "name": "@mitre/hdf-converters",
+    "version": "3.0.1",
+    "description": "Converters for transforming security tool outputs and HDF formats",
+    "publishConfig": {
+        "access": "public"
+    },
+    "type": "module",
+    "main": "./dist/src/index.js",
+    "types": "./dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "import": "./dist/src/index.js",
+            "types": "./dist/src/index.d.ts"
+        },
+        "./detect": {
+            "import": "./dist/src/detect.js",
+            "types": "./dist/src/detect.d.ts"
+        },
+        "./registry": {
+            "import": "./dist/shared/typescript/registry.js",
+            "types": "./dist/shared/typescript/registry.d.ts"
+        },
+        "./package.json": "./package.json"
+    },
+    "sideEffects": false,
+    "files": [
+        "dist"
+    ],
+    "scripts": {
+        "build": "pnpm clean && tsc",
+        "clean": "rimraf dist",
+        "test": "pnpm run test:ts && pnpm run test:go",
+        "test:ts": "vitest run",
+        "test:go": "go test ./...",
+        "test:watch": "vitest",
+        "test:coverage": "vitest run --coverage",
+        "test:differential": "vitest run converters/**/differential.test.ts",
+        "test:parity": "pnpm test:differential && pnpm test:go && node shared/typescript/compare-all.js",
+        "type-check": "tsc --noEmit",
+        "lint": "eslint src converters shared",
+        "lint:fix": "eslint src converters shared --fix",
+        "lint:go": "golangci-lint run ./...",
+        "lint:go:fix": "golangci-lint run --fix ./..."
+    },
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/mitre/hdf-libs.git",
+        "directory": "hdf-converters"
+    },
+    "author": "MITRE Corporation",
+    "license": "Apache-2.0",
+    "dependencies": {
+        "@mitre/hdf-parsers": "workspace:*",
+        "@mitre/hdf-schema": "workspace:*",
+        "@mitre/hdf-utilities": "workspace:*",
+        "@mitre/hdf-mappings": "workspace:*"
+    },
+    "devDependencies": {},
+    "engines": {
+        "node": ">=20.0.0"
+    },
+    "keywords": [
+        "hdf",
+        "heimdall",
+        "converters",
+        "security",
+        "compliance",
+        "inspec"
+    ]
+}

package/dist/shared/typescript/compare.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env tsx
+/**
+ * Deep JSON comparison utility for differential testing.
+ *
+ * Compares two JSON files and reports differences.
+ * Exit code 0 = identical, 1 = different, 2 = error
+ */
+interface CompareOptions {
+    ignoreFields?: string[];
+    ignoreArrayOrder?: boolean;
+}
+declare function compareJSON(file1: string, file2: string, options?: CompareOptions): boolean;
+export { compareJSON, type CompareOptions };
+//# sourceMappingURL=compare.d.ts.map

package/dist/shared/typescript/compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.d.ts","sourceRoot":"","sources":["../../../shared/typescript/compare.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAOH,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAOD,iBAAS,WAAW,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CA4BT;AA+DD,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC"}

package/dist/shared/typescript/compare.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env tsx
+/**
+ * Deep JSON comparison utility for differential testing.
+ *
+ * Compares two JSON files and reports differences.
+ * Exit code 0 = identical, 1 = different, 2 = error
+ */
+/* eslint-disable no-console -- CLI tool requires console output */
+import { readFileSync } from 'fs';
+import { deepStrictEqual } from 'assert';
+function compareJSON(file1, file2, options = {}) {
+    try {
+        const data1 = JSON.parse(readFileSync(file1, 'utf-8'));
+        const data2 = JSON.parse(readFileSync(file2, 'utf-8'));
+        // Normalize if needed
+        const normalized1 = normalizeData(data1, options);
+        const normalized2 = normalizeData(data2, options);
+        // Deep comparison
+        deepStrictEqual(normalized1, normalized2);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AssertionError') {
+            console.error('Files differ:');
+            console.error(`   Left:  ${file1}`);
+            console.error(`   Right: ${file2}`);
+            console.error();
+            console.error('Difference:', error.message);
+            // Show detailed diff
+            showDetailedDiff(error);
+            return false;
+        }
+        throw error;
+    }
+}
+function normalizeData(data, options) {
+    if (typeof data !== 'object' || data === null) {
+        return data;
+    }
+    if (Array.isArray(data)) {
+        const normalized = data.map(item => normalizeData(item, options));
+        return options.ignoreArrayOrder ? normalized.sort() : normalized;
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        // Skip ignored fields
+        if (options.ignoreFields?.includes(key)) {
+            continue;
+        }
+        result[key] = normalizeData(value, options);
+    }
+    return result;
+}
+function showDetailedDiff(error) {
+    if (error.actual && error.expected) {
+        console.error('\nExpected:');
+        console.error(JSON.stringify(error.expected, null, 2).split('\n').slice(0, 20).join('\n'));
+        console.error('\nActual:');
+        console.error(JSON.stringify(error.actual, null, 2).split('\n').slice(0, 20).join('\n'));
+    }
+}
+// CLI Usage
+if (import.meta.url === (await import('url')).pathToFileURL(process.argv[1] ?? '').href) {
+    const [, , file1, file2, ...optionArgs] = process.argv;
+    if (!file1 || !file2) {
+        console.error('Usage: compare.ts <file1> <file2> [--ignore-fields=field1,field2]');
+        process.exit(2);
+    }
+    const options = {};
+    for (const arg of optionArgs) {
+        if (arg.startsWith('--ignore-fields=')) {
+            options.ignoreFields = arg.split('=')[1]?.split(',');
+        }
+    }
+    try {
+        const identical = compareJSON(file1, file2, options);
+        if (identical) {
+            console.log('Files are identical');
+            process.exit(0);
+        }
+        else {
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        console.error('Error comparing files:', error);
+        process.exit(2);
+    }
+}
+export { compareJSON };
+//# sourceMappingURL=compare.js.map

package/dist/shared/typescript/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../shared/typescript/compare.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAYzC,SAAS,WAAW,CAClB,KAAa,EACb,KAAa,EACb,UAA0B,EAAE;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAEhE,sBAAsB;QACtB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAElD,kBAAkB;QAClB,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5C,qBAAqB;YACrB,gBAAgB,CAAC,KAA2B,CAAC,CAAC;YAE9C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,OAAuB;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC3E,sBAAsB;QACtB,IAAI,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,YAAY;AACZ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,MAAM,CAAC,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAuB,CAAC"}

package/dist/shared/typescript/converter-contract.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared converter contract tests.
+ *
+ * Tests the universal contract that every converter must satisfy:
+ * empty input fails, invalid input fails, minimal fixture converts.
+ * Call alongside converter-specific tests.
+ */
+export interface ConverterContractSpec {
+    /** Converter directory name, e.g. 'gosec-to-hdf' */
+    converterName: string;
+    /** The convert function (may be sync or async) */
+    convertFn: (input: string) => string | Promise<string>;
+    /** Path relative to fixtures/input/, e.g. 'minimal.json' */
+    minimalFixture: string;
+}
+/**
+ * Run universal converter contract tests.
+ */
+export declare function runConverterContractTests(spec: ConverterContractSpec): void;
+//# sourceMappingURL=converter-contract.d.ts.map

package/dist/shared/typescript/converter-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter-contract.d.ts","sourceRoot":"","sources":["../../../shared/typescript/converter-contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAmB3E"}

package/dist/shared/typescript/converter-contract.js

@@ -0,0 +1,35 @@
+/**
+ * Shared converter contract tests.
+ *
+ * Tests the universal contract that every converter must satisfy:
+ * empty input fails, invalid input fails, minimal fixture converts.
+ * Call alongside converter-specific tests.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const convertersDir = join(__dirname, '..', '..', 'converters');
+/**
+ * Run universal converter contract tests.
+ */
+export function runConverterContractTests(spec) {
+    describe(`${spec.converterName} contract`, () => {
+        it('rejects empty input', async () => {
+            await expect(Promise.resolve(spec.convertFn(''))).rejects.toThrow();
+        });
+        it('rejects invalid input', async () => {
+            await expect(Promise.resolve(spec.convertFn('not valid json'))).rejects.toThrow();
+        });
+        it('converts minimal fixture without error', async () => {
+            const fixturePath = join(convertersDir, spec.converterName, 'fixtures', 'input', spec.minimalFixture);
+            const input = readFileSync(fixturePath, 'utf-8');
+            const output = await Promise.resolve(spec.convertFn(input));
+            expect(output).toBeTruthy();
+            // Should produce valid JSON
+            expect(() => JSON.parse(output)).not.toThrow();
+        });
+    });
+}
+//# sourceMappingURL=converter-contract.js.map

package/dist/shared/typescript/converter-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter-contract.js","sourceRoot":"","sources":["../../../shared/typescript/converter-contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAWhE;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA2B;IACnE,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE,GAAG,EAAE;QAC9C,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACtG,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;YAC5B,4BAA4B;YAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}