@mitre/hdf-converters 2.13.0 → 3.0.1

package/dist/shared/typescript/converterutil.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Shared utilities for TypeScript HDF converters.
+ *
+ * Provides common patterns used across all converter implementations:
+ * - Input checksum computation
+ * - Re-exports of shared constants and utilities
+ */
+import type { Checksum, Component, EvaluatedBaseline, Integrity, Statistics } from '@mitre/hdf-schema';
+/**
+ * Compute a SHA-256 checksum of raw converter input.
+ *
+ * Wraps the common 3-line pattern used in every converter into a single call.
+ * The returned Checksum is suitable for the EvaluatedBaseline.resultsChecksum field.
+ *
+ * @param input - Raw input string (JSON, XML, etc.)
+ * @returns Checksum with algorithm set to SHA-256
+ */
+export declare function inputChecksum(input: string): Promise<Checksum>;
+/**
+ * Compute an Integrity object (for root-level document integrity) from raw input.
+ *
+ * Returns an Integrity with algorithm and checksum fields, suitable for
+ * HdfBaseline.integrity, HdfSystem.integrity, HdfPlan.integrity, etc.
+ *
+ * @param input - Raw input string (JSON, XML, etc.)
+ * @returns Integrity object with SHA-256 algorithm and checksum
+ */
+export declare function inputIntegrity(input: string): Promise<Integrity>;
+/**
+ * Build a tags object with NIST controls and optional CCI mappings.
+ *
+ * If cci is empty, the "cci" key is omitted from the result.
+ * Additional key-value pairs can be passed via extras.
+ *
+ * @param nist - NIST 800-53 control identifiers
+ * @param cci - CCI identifiers (omitted if empty)
+ * @param extras - Additional tag key-value pairs
+ * @returns Tags object for HDF requirement
+ */
+export declare function buildNistCciTags(nist: string[], cci: string[], extras?: Record<string, unknown>): Record<string, unknown>;
+/** Maximum number of items processed from any single input array. */
+export declare const DEFAULT_MAX_ITEMS = 100000;
+/**
+ * Limit an array to at most maxItems elements.
+ *
+ * Returns the (possibly truncated) array and a flag indicating whether
+ * truncation occurred. When truncated, callers should log a warning.
+ *
+ * @param items - Array to limit
+ * @param maxItems - Maximum items (defaults to DEFAULT_MAX_ITEMS)
+ * @returns Object with limited items array and truncated flag
+ */
+export declare function limitArray<T>(items: T[], maxItems?: number): {
+    items: T[];
+    truncated: boolean;
+};
+export { stripHtml as stripHTML } from '@mitre/hdf-utilities';
+/**
+ * Limit an array and log a warning if truncated.
+ *
+ * Wraps {@link limitArray} with a console.warn call when items are truncated.
+ *
+ * @param items - Array to limit
+ * @param label - Item type label for warning message (e.g., "vulnerability")
+ * @param maxItems - Maximum items (defaults to DEFAULT_MAX_ITEMS)
+ * @returns Limited array (original if within limit)
+ */
+export declare function limitArrayWithWarning<T>(items: T[], label: string, maxItems?: number): T[];
+/**
+ * Map CWE identifiers to NIST 800-53 controls.
+ *
+ * Looks up each CWE ID, deduplicates, sorts, and falls back to the provided
+ * default when no CWE has a mapping. CWE IDs may optionally have a "CWE-"
+ * prefix (e.g., "CWE-79" or "79").
+ *
+ * @param cweIDs - CWE identifiers (e.g., ["CWE-79", "89"])
+ * @param fallback - Default NIST controls when no mapping is found
+ * @returns Sorted, deduplicated NIST control identifiers
+ */
+export declare function mapCWEToNIST(cweIDs: string[], fallback: string[]): string[];
+/**
+ * Extract all numeric CWE IDs from text.
+ * Returns deduplicated sorted array of numeric ID strings (e.g., ["79", "89"]).
+ *
+ * @param text - Text potentially containing CWE identifiers
+ * @returns Sorted, deduplicated numeric CWE ID strings
+ */
+export declare function extractCWEIDs(text: string): string[];
+/** Default maximum input size for converters (50MB) */
+export declare const DEFAULT_MAX_INPUT_SIZE: number;
+/**
+ * Validates that input string doesn't exceed maximum allowed size.
+ *
+ * Note: string.length gives char count, not bytes. For multi-byte chars this
+ * underestimates. This is acceptable as a coarse safety check — exact byte
+ * counting would require TextEncoder.
+ *
+ * @param input - Raw input string to validate
+ * @param converterName - Name of the converter (used in error message)
+ * @param maxSize - Maximum allowed character count (defaults to DEFAULT_MAX_INPUT_SIZE)
+ * @throws Error if input exceeds maxSize
+ */
+export declare function validateInputSize(input: string, converterName: string, maxSize?: number): void;
+/**
+ * Normalise a value that may be a single item, an array, undefined, or null
+ * into a guaranteed array.
+ *
+ * XML-to-JSON parsers often produce a single object when there is one child
+ * element and an array when there are multiple. This helper smooths that out.
+ *
+ * @param value - A single item, an array of items, undefined, or null
+ * @returns An array (empty if the input was nullish)
+ */
+export declare function ensureArray<T>(value: T | T[] | undefined | null): T[];
+export { DEFAULT_STATIC_ANALYSIS_NIST_TAGS } from '@mitre/hdf-mappings';
+/**
+ * Default NIST 800-53 fallback for tools that identify outdated packages or
+ * flaws requiring patching (SI-2: Flaw Remediation, RA-5: Vulnerability
+ * Monitoring and Scanning).
+ *
+ * Mirrors Go shared.DefaultRemediationNIST.
+ */
+export declare const DEFAULT_REMEDIATION_NIST_TAGS: string[];
+/**
+ * Options for building an HDF Results document.
+ * Mirrors the Go shared.HDFResultsOptions struct.
+ */
+export interface HdfResultsOptions {
+    /** Name of the converter that produced this HDF file (e.g., 'grype-to-hdf') */
+    generatorName: string;
+    /** Version of the converter */
+    converterVersion: string;
+    /** Name of the source security tool (e.g., 'Grype', 'Nessus') */
+    toolName?: string;
+    /** Version of the source tool */
+    toolVersion?: string;
+    /** Output format of the source tool (e.g., 'SARIF', 'XCCDF') */
+    toolFormat?: string;
+    /** Evaluated baselines with findings */
+    baselines: EvaluatedBaseline[];
+    /** Components that were assessed */
+    components?: Component[];
+    /** When the assessment was executed */
+    timestamp?: Date;
+    /** Assessment statistics */
+    statistics?: Statistics;
+}
+/**
+ * Build an HDF Results document from options.
+ *
+ * Eliminates the repeated boilerplate of constructing generator, tool,
+ * and assembling the top-level HdfResults in every converter. Mirrors
+ * the Go shared.BuildHDFResults() function.
+ *
+ * @returns JSON string of the HDF Results document (pretty-printed)
+ */
+export declare function buildHdfResults(opts: HdfResultsOptions): string;
+//# sourceMappingURL=converterutil.d.ts.map

package/dist/shared/typescript/converterutil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converterutil.d.ts","sourceRoot":"","sources":["../../../shared/typescript/converterutil.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAc,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAInH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAKpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAGtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAEzC;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,KAAK,EAAE,CAAC,EAAE,EACV,QAAQ,SAAoB,GAC3B;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAKpC;AAKD,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EACV,KAAK,EAAE,MAAM,EACb,QAAQ,SAAoB,GAC3B,CAAC,EAAE,CAOL;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,EAAE,CAaV;AAKD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMpD;AAED,uDAAuD;AACvD,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,OAAO,SAAyB,GAC/B,IAAI,CAMN;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,CAAC,EAAE,CAGrE;AAGD,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,UAAmB,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,oCAAoC;IACpC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,uCAAuC;IACvC,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAqB/D"}

package/dist/shared/typescript/converterutil.js

@@ -0,0 +1,220 @@
+/**
+ * Shared utilities for TypeScript HDF converters.
+ *
+ * Provides common patterns used across all converter implementations:
+ * - Input checksum computation
+ * - Re-exports of shared constants and utilities
+ */
+import { sha256 } from '@mitre/hdf-utilities';
+import { HashAlgorithm } from '@mitre/hdf-schema';
+import { getCweNistControl } from '@mitre/hdf-mappings';
+/**
+ * Compute a SHA-256 checksum of raw converter input.
+ *
+ * Wraps the common 3-line pattern used in every converter into a single call.
+ * The returned Checksum is suitable for the EvaluatedBaseline.resultsChecksum field.
+ *
+ * @param input - Raw input string (JSON, XML, etc.)
+ * @returns Checksum with algorithm set to SHA-256
+ */
+export async function inputChecksum(input) {
+    return {
+        algorithm: HashAlgorithm.Sha256,
+        value: await sha256(input),
+    };
+}
+/**
+ * Compute an Integrity object (for root-level document integrity) from raw input.
+ *
+ * Returns an Integrity with algorithm and checksum fields, suitable for
+ * HdfBaseline.integrity, HdfSystem.integrity, HdfPlan.integrity, etc.
+ *
+ * @param input - Raw input string (JSON, XML, etc.)
+ * @returns Integrity object with SHA-256 algorithm and checksum
+ */
+export async function inputIntegrity(input) {
+    const checksum = await inputChecksum(input);
+    return { algorithm: checksum.algorithm, checksum: checksum.value };
+}
+/**
+ * Build a tags object with NIST controls and optional CCI mappings.
+ *
+ * If cci is empty, the "cci" key is omitted from the result.
+ * Additional key-value pairs can be passed via extras.
+ *
+ * @param nist - NIST 800-53 control identifiers
+ * @param cci - CCI identifiers (omitted if empty)
+ * @param extras - Additional tag key-value pairs
+ * @returns Tags object for HDF requirement
+ */
+export function buildNistCciTags(nist, cci, extras) {
+    const tags = { nist };
+    if (cci.length > 0) {
+        tags.cci = cci;
+    }
+    if (extras) {
+        Object.assign(tags, extras);
+    }
+    return tags;
+}
+/** Maximum number of items processed from any single input array. */
+export const DEFAULT_MAX_ITEMS = 100000;
+/**
+ * Limit an array to at most maxItems elements.
+ *
+ * Returns the (possibly truncated) array and a flag indicating whether
+ * truncation occurred. When truncated, callers should log a warning.
+ *
+ * @param items - Array to limit
+ * @param maxItems - Maximum items (defaults to DEFAULT_MAX_ITEMS)
+ * @returns Object with limited items array and truncated flag
+ */
+export function limitArray(items, maxItems = DEFAULT_MAX_ITEMS) {
+    if (items.length <= maxItems) {
+        return { items, truncated: false };
+    }
+    return { items: items.slice(0, maxItems), truncated: true };
+}
+// Re-export stripHTML from @mitre/hdf-utilities (canonical location).
+// Named stripHTML (uppercase H) for backwards compatibility with existing
+// converter imports; hdf-utilities exports stripHtml (lowercase h).
+export { stripHtml as stripHTML } from '@mitre/hdf-utilities';
+/**
+ * Limit an array and log a warning if truncated.
+ *
+ * Wraps {@link limitArray} with a console.warn call when items are truncated.
+ *
+ * @param items - Array to limit
+ * @param label - Item type label for warning message (e.g., "vulnerability")
+ * @param maxItems - Maximum items (defaults to DEFAULT_MAX_ITEMS)
+ * @returns Limited array (original if within limit)
+ */
+export function limitArrayWithWarning(items, label, maxItems = DEFAULT_MAX_ITEMS) {
+    const { items: limited, truncated } = limitArray(items, maxItems);
+    if (truncated) {
+        // eslint-disable-next-line no-console -- Intentional warning for truncated input
+        console.warn(`WARNING: Input truncated at ${limited.length} ${label} items (original: ${items.length})`);
+    }
+    return limited;
+}
+/**
+ * Map CWE identifiers to NIST 800-53 controls.
+ *
+ * Looks up each CWE ID, deduplicates, sorts, and falls back to the provided
+ * default when no CWE has a mapping. CWE IDs may optionally have a "CWE-"
+ * prefix (e.g., "CWE-79" or "79").
+ *
+ * @param cweIDs - CWE identifiers (e.g., ["CWE-79", "89"])
+ * @param fallback - Default NIST controls when no mapping is found
+ * @returns Sorted, deduplicated NIST control identifiers
+ */
+export function mapCWEToNIST(cweIDs, fallback) {
+    const controls = new Set();
+    for (const id of cweIDs) {
+        const numericStr = id.replace(/^CWE-/i, '');
+        const numericId = parseInt(numericStr, 10);
+        if (!isNaN(numericId)) {
+            const nistControl = getCweNistControl(numericId);
+            if (nistControl) {
+                controls.add(nistControl);
+            }
+        }
+    }
+    return controls.size > 0 ? [...controls].sort() : fallback;
+}
+/** Matches CWE identifiers like "CWE-79", "CWE 89", "cwe22". */
+const CWE_PATTERN = /CWE[- ]?(\d+)/gi;
+/**
+ * Extract all numeric CWE IDs from text.
+ * Returns deduplicated sorted array of numeric ID strings (e.g., ["79", "89"]).
+ *
+ * @param text - Text potentially containing CWE identifiers
+ * @returns Sorted, deduplicated numeric CWE ID strings
+ */
+export function extractCWEIDs(text) {
+    const matches = [...text.matchAll(CWE_PATTERN)];
+    if (matches.length === 0)
+        return [];
+    const ids = [...new Set(matches.map(m => m[1]))];
+    ids.sort();
+    return ids;
+}
+/** Default maximum input size for converters (50MB) */
+export const DEFAULT_MAX_INPUT_SIZE = 50 * 1024 * 1024;
+/**
+ * Validates that input string doesn't exceed maximum allowed size.
+ *
+ * Note: string.length gives char count, not bytes. For multi-byte chars this
+ * underestimates. This is acceptable as a coarse safety check — exact byte
+ * counting would require TextEncoder.
+ *
+ * @param input - Raw input string to validate
+ * @param converterName - Name of the converter (used in error message)
+ * @param maxSize - Maximum allowed character count (defaults to DEFAULT_MAX_INPUT_SIZE)
+ * @throws Error if input exceeds maxSize
+ */
+export function validateInputSize(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZE) {
+    if (input.length > maxSize) {
+        throw new Error(`${converterName}: input exceeds maximum allowed size of ${maxSize} characters`);
+    }
+}
+/**
+ * Normalise a value that may be a single item, an array, undefined, or null
+ * into a guaranteed array.
+ *
+ * XML-to-JSON parsers often produce a single object when there is one child
+ * element and an array when there are multiple. This helper smooths that out.
+ *
+ * @param value - A single item, an array of items, undefined, or null
+ * @returns An array (empty if the input was nullish)
+ */
+export function ensureArray(value) {
+    if (value === undefined || value === null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+// Re-export shared constants for converter convenience
+export { DEFAULT_STATIC_ANALYSIS_NIST_TAGS } from '@mitre/hdf-mappings';
+/**
+ * Default NIST 800-53 fallback for tools that identify outdated packages or
+ * flaws requiring patching (SI-2: Flaw Remediation, RA-5: Vulnerability
+ * Monitoring and Scanning).
+ *
+ * Mirrors Go shared.DefaultRemediationNIST.
+ */
+export const DEFAULT_REMEDIATION_NIST_TAGS = ['SI-2', 'RA-5'];
+/**
+ * Build an HDF Results document from options.
+ *
+ * Eliminates the repeated boilerplate of constructing generator, tool,
+ * and assembling the top-level HdfResults in every converter. Mirrors
+ * the Go shared.BuildHDFResults() function.
+ *
+ * @returns JSON string of the HDF Results document (pretty-printed)
+ */
+export function buildHdfResults(opts) {
+    const hdf = {
+        baselines: opts.baselines,
+        generator: {
+            name: opts.generatorName,
+            version: opts.converterVersion,
+        },
+    };
+    if (opts.toolName || opts.toolVersion || opts.toolFormat) {
+        hdf.tool = {};
+        if (opts.toolName)
+            hdf.tool.name = opts.toolName;
+        if (opts.toolVersion)
+            hdf.tool.version = opts.toolVersion;
+        if (opts.toolFormat)
+            hdf.tool.format = opts.toolFormat;
+    }
+    if (opts.components)
+        hdf.components = opts.components;
+    if (opts.timestamp)
+        hdf.timestamp = opts.timestamp;
+    if (opts.statistics)
+        hdf.statistics = opts.statistics;
+    return JSON.stringify(hdf, null, 2);
+}
+//# sourceMappingURL=converterutil.js.map

package/dist/shared/typescript/converterutil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converterutil.js","sourceRoot":"","sources":["../../../shared/typescript/converterutil.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,MAAM;QAC/B,KAAK,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAc,EACd,GAAa,EACb,MAAgC;IAEhC,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAO,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,KAAU,EACV,QAAQ,GAAG,iBAAiB;IAE5B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,sEAAsE;AACtE,0EAA0E;AAC1E,oEAAoE;AACpE,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAU,EACV,KAAa,EACb,QAAQ,GAAG,iBAAiB;IAE5B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,iFAAiF;QACjF,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,CAAC,MAAM,IAAI,KAAK,qBAAqB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAgB,EAChB,QAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED,gEAAgE;AAChE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,aAAqB,EACrB,OAAO,GAAG,sBAAsB;IAEhC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,2CAA2C,OAAO,aAAa,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAI,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,uDAAuD;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AA2B9D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,MAAM,GAAG,GAAe;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,OAAO,EAAE,IAAI,CAAC,gBAAgB;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QAC1D,IAAI,IAAI,CAAC,UAAU;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACnD,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEtD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/shared/typescript/fingerprint.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Converter auto-detection dispatcher.
+ *
+ * Walks registered fingerprints and returns the highest-confidence match.
+ * Lightweight — no converter imports, safe for any bundle.
+ */
+import { type ConverterFingerprint, type InputFamily } from './registry.js';
+export interface DetectionResult {
+    fingerprint: ConverterFingerprint;
+    confidence: number;
+    /** Detected format version (e.g. "2.1.0" for SARIF). Empty when not available. */
+    version: string;
+}
+export declare function detectConverter(input: string): DetectionResult | undefined;
+export declare function detectConverterAll(input: string): DetectionResult[];
+export declare function detectFamily(input: string): InputFamily | undefined;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/shared/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../shared/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAyB,KAAK,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAEnG,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAS1E;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAkCnE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAUnE"}

package/dist/shared/typescript/fingerprint.js

@@ -0,0 +1,85 @@
+/**
+ * Converter auto-detection dispatcher.
+ *
+ * Walks registered fingerprints and returns the highest-confidence match.
+ * Lightweight — no converter imports, safe for any bundle.
+ */
+import { getIngestFingerprints } from './registry.js';
+/** Minimum confidence to accept an auto-detection result. */
+const MIN_CONFIDENCE = 0.8;
+export function detectConverter(input) {
+    const results = detectConverterAll(input);
+    if (results.length === 0)
+        return undefined;
+    const best = results[0];
+    // Refuse to guess if confidence is too low
+    if (best.confidence < MIN_CONFIDENCE)
+        return undefined;
+    // Refuse to guess if there's an ambiguous tie at the top
+    if (results.length > 1 && results[1].confidence === best.confidence)
+        return undefined;
+    return best;
+}
+/** Maximum input size for fingerprint detection (100 MB). */
+const MAX_DETECT_SIZE = 100 * 1024 * 1024;
+/** Maximum characters scanned for XML/text root element detection. */
+const MAX_XML_PREAMBLE = 8 * 1024;
+export function detectConverterAll(input) {
+    if (!input || input.length > MAX_DETECT_SIZE)
+        return [];
+    const family = detectFamily(input);
+    if (!family)
+        return [];
+    // For XML/text, only pass the preamble to fingerprints
+    const effectiveInput = (family !== 'json' && input.length > MAX_XML_PREAMBLE)
+        ? input.slice(0, MAX_XML_PREAMBLE)
+        : input;
+    const parsed = family === 'json' ? tryParseJSON(input) : effectiveInput;
+    if (parsed === undefined)
+        return [];
+    const results = [];
+    for (const fp of getIngestFingerprints()) {
+        if (fp.inputFamily !== family)
+            continue;
+        const confidence = fp.fingerprint(parsed);
+        if (confidence > 0) {
+            let version = '';
+            if (fp.detectVersion) {
+                try {
+                    version = fp.detectVersion(parsed);
+                }
+                catch {
+                    version = '';
+                }
+            }
+            results.push({ fingerprint: fp, confidence, version });
+        }
+    }
+    // Stable sort: by confidence desc, then by ID asc for deterministic tiebreaking
+    results.sort((a, b) => b.confidence - a.confidence || a.fingerprint.id.localeCompare(b.fingerprint.id));
+    return results;
+}
+export function detectFamily(input) {
+    if (!input)
+        return undefined;
+    // Strip UTF-8 BOM (U+FEFF) — common on Windows-generated files
+    const stripped = input.replace(/^\uFEFF/, '');
+    const trimmed = stripped.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.startsWith('{') || trimmed.startsWith('['))
+        return 'json';
+    if (trimmed.startsWith('<'))
+        return 'xml';
+    // CSV intentionally excluded — too many false positives (see design doc D1)
+    return 'text';
+}
+function tryParseJSON(input) {
+    try {
+        return JSON.parse(input);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/shared/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../shared/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,qBAAqB,EAA+C,MAAM,eAAe,CAAC;AASnG,6DAA6D;AAC7D,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACzB,2CAA2C;IAC3C,IAAI,IAAI,CAAC,UAAU,GAAG,cAAc;QAAE,OAAO,SAAS,CAAC;IACvD,yDAAyD;IACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AAElC,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,EAAE,CAAC;IAExD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,uDAAuD;IACvD,MAAM,cAAc,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC;QAC3E,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC;IAEV,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,WAAW,KAAK,MAAM;YAAE,SAAS;QACxC,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACtE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,4EAA4E;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/shared/typescript/fptest.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shared fingerprint test runner.
+ *
+ * Each converter defines a FingerprintSpec and calls runFingerprintTests
+ * to get standard metadata, positive detection, and negative rejection tests.
+ */
+import { type ConverterFingerprint } from './registry.js';
+export interface DetectionCase {
+    /** Test name */
+    name: string;
+    /** JSON string input for detection */
+    input: string;
+    /** Expected confidence (0 for negative cases) */
+    confidence: number;
+}
+export interface FingerprintSpec {
+    /** Fingerprint ID, e.g. 'gosec-to-hdf' */
+    id: string;
+    /** Human-readable label, e.g. 'GoSec' */
+    label: string;
+    /** Expected direction */
+    direction: 'ingest' | 'export';
+    /** Expected input family */
+    inputFamily: 'json' | 'xml' | 'csv' | 'text';
+    /** Expected output type */
+    outputType: string;
+    /** The fingerprint object (for direct function tests) */
+    fingerprint: ConverterFingerprint;
+    /** Function that registers the fingerprint */
+    register: () => void;
+    /** Inputs that should match with the given confidence */
+    positive: DetectionCase[];
+    /** Inputs that should not match */
+    negative: DetectionCase[];
+}
+/**
+ * Run a standard suite of fingerprint tests from a spec.
+ */
+export declare function runFingerprintTests(spec: FingerprintSpec): void;
+//# sourceMappingURL=fptest.d.ts.map

package/dist/shared/typescript/fptest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fptest.d.ts","sourceRoot":"","sources":["../../../shared/typescript/fptest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1F,MAAM,WAAW,aAAa;IAC5B,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC/B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,WAAW,EAAE,oBAAoB,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,yDAAyD;IACzD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA+D/D"}

package/dist/shared/typescript/fptest.js

@@ -0,0 +1,70 @@
+/**
+ * Shared fingerprint test runner.
+ *
+ * Each converter defines a FingerprintSpec and calls runFingerprintTests
+ * to get standard metadata, positive detection, and negative rejection tests.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { _resetRegistry, getFingerprint } from './registry.js';
+import { detectConverter, detectConverterAll } from './fingerprint.js';
+/**
+ * Run a standard suite of fingerprint tests from a spec.
+ */
+export function runFingerprintTests(spec) {
+    describe(`${spec.id} fingerprint`, () => {
+        beforeEach(() => {
+            _resetRegistry();
+            spec.register();
+        });
+        it('is registered with correct metadata', () => {
+            const fp = getFingerprint(spec.id);
+            expect(fp).toBeDefined();
+            expect(fp.label).toBe(spec.label);
+            expect(fp.direction).toBe(spec.direction);
+            expect(fp.inputFamily).toBe(spec.inputFamily);
+            expect(fp.outputType).toBe(spec.outputType);
+        });
+        it('exports fingerprint as data (no convert function)', () => {
+            expect(spec.fingerprint.id).toBe(spec.id);
+            expect(spec.fingerprint).not.toHaveProperty('convert');
+        });
+        for (const tc of spec.positive) {
+            it(tc.name, () => {
+                if (tc.confidence >= 0.8) {
+                    const result = detectConverter(tc.input);
+                    expect(result).toBeDefined();
+                    expect(result.fingerprint.id).toBe(spec.id);
+                    expect(result.confidence).toBe(tc.confidence);
+                }
+                else {
+                    const results = detectConverterAll(tc.input);
+                    const match = results.find(r => r.fingerprint.id === spec.id);
+                    expect(match).toBeDefined();
+                    expect(match.confidence).toBe(tc.confidence);
+                }
+            });
+        }
+        for (const tc of spec.negative) {
+            it(tc.name, () => {
+                const result = detectConverter(tc.input);
+                if (result) {
+                    expect(result.fingerprint.id).not.toBe(spec.id);
+                }
+            });
+        }
+        it('returns 0 for empty object', () => {
+            expect(detectConverter('{}')).toBeUndefined();
+        });
+        it('returns 0 for null input', () => {
+            expect(spec.fingerprint.fingerprint(null)).toBe(0);
+        });
+        it('returns 0 for non-object input', () => {
+            expect(spec.fingerprint.fingerprint('string')).toBe(0);
+        });
+        it('register is idempotent', () => {
+            spec.register();
+            expect(getFingerprint(spec.id)).toBeDefined();
+        });
+    });
+}
+//# sourceMappingURL=fptest.js.map

package/dist/shared/typescript/fptest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fptest.js","sourceRoot":"","sources":["../../../shared/typescript/fptest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAgCvE;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,QAAQ,CAAC,GAAG,IAAI,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE;QACtC,UAAU,CAAC,GAAG,EAAE;YACd,cAAc,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,CAAC,EAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,EAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,EAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,CAAC,EAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE;gBACf,IAAI,EAAE,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC7B,MAAM,CAAC,MAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7C,MAAM,CAAC,MAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC5B,MAAM,CAAC,KAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE;gBACf,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/typescript/hdf-version.d.ts

@@ -0,0 +1,20 @@
+/**
+ * HDF version transform router.
+ *
+ * Converts between HDF schema versions (v1 ↔ v2) using a registry of
+ * transform functions. Adding new versions means registering new pairs —
+ * the router logic does not change.
+ */
+export type HDFVersionTransform = (input: string) => string;
+/**
+ * Transform HDF data between schema versions.
+ * Returns the input unchanged when fromVersion === toVersion.
+ * Throws for unknown version pairs.
+ */
+export declare function transformHDF(input: string, fromVersion: string, toVersion: string): string;
+/**
+ * Detect HDF version from structural markers.
+ * Returns "1" or "2", or throws if unrecognizable.
+ */
+export declare function detectHDFVersion(input: string): string;
+//# sourceMappingURL=hdf-version.d.ts.map

package/dist/shared/typescript/hdf-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hdf-version.d.ts","sourceRoot":"","sources":["../../../shared/typescript/hdf-version.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAQ5D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAU1F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOtD"}