@mitre/hdf-converters 2.13.0 → 3.0.1

package/dist/converters/gosec-to-hdf/typescript/converter.js

@@ -0,0 +1,126 @@
+import { parseJSON } from '@mitre/hdf-utilities';
+import { detectConverter } from '../../../shared/typescript/fingerprint.js';
+import { registerAllFingerprints } from '../../../shared/typescript/register-all.js';
+import { convertSarifToHdf } from '../../sarif-to-hdf/typescript/converter.js';
+import { inputChecksum, limitArray, validateInputSize, mapCWEToNIST, DEFAULT_REMEDIATION_NIST_TAGS, buildHdfResults } from '../../../shared/typescript/converterutil.js';
+import { ResultStatus, createMinimalBaseline, createRequirement, createResult, } from '@mitre/hdf-schema';
+/**
+ * Severity to HDF impact mapping for gosec.
+ */
+const IMPACT_MAPPING = {
+    HIGH: 0.7,
+    MEDIUM: 0.5,
+    LOW: 0.3,
+};
+/**
+ * Returns true if the issue is suppressed (via nosec flag or suppressions list).
+ */
+function isSuppressed(issue) {
+    return issue.nosec || issue.suppressions !== null;
+}
+/**
+ * Builds a skip message from a suppressions list.
+ * Returns undefined when suppressions is null (issue not suppressed via list).
+ */
+function formatSkipMessage(suppressions) {
+    if (suppressions === null) {
+        return undefined;
+    }
+    if (suppressions.length === 0) {
+        return 'No justification provided';
+    }
+    return suppressions
+        .map(s => `${s.justification || 'No justification provided'} (${s.kind})`)
+        .join('\n');
+}
+/**
+ * Converts a single GosecIssue to an HDF RequirementResult.
+ */
+function issueToResult(issue) {
+    const suppressed = isSuppressed(issue);
+    const status = suppressed ? ResultStatus.NotReviewed : ResultStatus.Failed;
+    let message;
+    if (suppressed) {
+        const skipMsg = formatSkipMessage(issue.suppressions);
+        message = skipMsg ?? 'No justification provided';
+    }
+    else {
+        message = `${issue.confidence} confidence of rule violation at:\n${issue.code}`;
+    }
+    const codeDesc = `Rule ${issue.rule_id} violation detected at:\nFile: ${issue.file}\nLine: ${issue.line}\nColumn: ${issue.column}`;
+    return createResult(status, message, { codeDesc });
+}
+/**
+ * Converts a group of issues sharing a rule_id into one EvaluatedRequirement.
+ */
+function buildRequirement(ruleId, issues) {
+    const rep = issues[0];
+    const impact = IMPACT_MAPPING[rep.severity.toUpperCase()] ?? 0.5;
+    const nist = mapCWEToNIST([rep.cwe.id], DEFAULT_REMEDIATION_NIST_TAGS);
+    const tags = {
+        nist,
+        cwe: { id: rep.cwe.id, url: rep.cwe.url },
+    };
+    const results = issues.map(issueToResult);
+    const descriptions = [
+        { label: 'default', data: rep.details },
+        { label: 'check', data: `CWE-${rep.cwe.id}: ${rep.cwe.url}` },
+    ];
+    return createRequirement(ruleId, rep.details, descriptions, impact, results, { tags });
+}
+/**
+ * Converts gosec output to HDF format.
+ * Accepts both native gosec JSON and SARIF format — SARIF input is detected
+ * automatically and delegated to the shared SARIF converter.
+ *
+ * @param input - gosec JSON or SARIF string
+ * @returns HDF JSON string
+ */
+export async function convertGosecToHdf(input) {
+    validateInputSize(input, 'gosec');
+    // Detect format: if SARIF, delegate to the shared SARIF converter
+    registerAllFingerprints();
+    const detected = detectConverter(input);
+    if (detected && detected.fingerprint.id === 'sarif-to-hdf') {
+        return convertSarifToHdf(input);
+    }
+    const resultsChecksum = await inputChecksum(input);
+    const report = parseJSON(input);
+    if (!report || typeof report !== 'object') {
+        throw new Error('Invalid gosec structure: not a valid JSON object');
+    }
+    if (!Array.isArray(report.Issues)) {
+        throw new Error('Invalid gosec structure: missing or invalid Issues field');
+    }
+    // Group issues by rule_id, preserving insertion order.
+    const { items: limitedIssues, truncated: truncatedIssues } = limitArray(report.Issues);
+    /* v8 ignore next -- truncation only triggers with >100K items */
+    if (truncatedIssues) {
+        // eslint-disable-next-line no-console
+        console.warn(`WARNING: Input truncated at ${limitedIssues.length} issue items (original: ${report.Issues.length})`);
+    }
+    const groups = new Map();
+    for (const issue of limitedIssues) {
+        const existing = groups.get(issue.rule_id);
+        if (existing) {
+            existing.push(issue);
+        }
+        else {
+            groups.set(issue.rule_id, [issue]);
+        }
+    }
+    const requirements = [];
+    for (const [ruleId, issues] of groups) {
+        requirements.push(buildRequirement(ruleId, issues));
+    }
+    const baseline = createMinimalBaseline('gosec Scan', requirements, { resultsChecksum });
+    return buildHdfResults({
+        generatorName: 'gosec-to-hdf',
+        converterVersion: '1.0.0',
+        toolName: 'gosec',
+        toolVersion: report.GosecVersion || undefined,
+        baselines: [baseline],
+        timestamp: new Date(),
+    });
+}
+//# sourceMappingURL=converter.js.map

package/dist/converters/gosec-to-hdf/typescript/converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.js","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAOzK,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AA4C3B;;GAEG;AACH,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACT,CAAC;AAGF;;GAEG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,YAAuC;IAChE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,OAAO,YAAY;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,IAAI,2BAA2B,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;IAE3E,IAAI,OAAe,CAAC;IACpB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,GAAG,OAAO,IAAI,2BAA2B,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,sCAAsC,KAAK,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,OAAO,kCAAkC,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnI,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC;IACjE,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAEvE,MAAM,IAAI,GAA4B;QACpC,IAAI;QACJ,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;KAC1C,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,YAAY,GAAkB;QAClC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE;QACvC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE;KAC9D,CAAC;IAEF,OAAO,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,kEAAkE;IAClE,uBAAuB,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAa,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,SAAS,CAAc,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,uDAAuD;IACvD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvF,iEAAiE;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,aAAa,CAAC,MAAM,2BAA2B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAsB,qBAAqB,CACvD,YAAY,EACZ,YAAY,EACZ,EAAE,eAAe,EAAE,CACC,CAAC;IAEvB,OAAO,eAAe,CAAC;QACrB,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,OAAO;QACzB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;QAC7C,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC"}

package/dist/converters/gosec-to-hdf/typescript/fingerprint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GoSec format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with GosecVersion + Issues[] (1.0) or Issues[] + Stats (0.6).
+ */
+import { type ConverterFingerprint } from '../../../shared/typescript/registry.js';
+export declare const gosecFingerprint: ConverterFingerprint;
+export declare function register(): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/converters/gosec-to-hdf/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAExH,eAAO,MAAM,gBAAgB,EAAE,oBAe9B,CAAC;AAEF,wBAAgB,QAAQ,IAAI,IAAI,CAG/B"}

package/dist/converters/gosec-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,32 @@
+/**
+ * GoSec format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with GosecVersion + Issues[] (1.0) or Issues[] + Stats (0.6).
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+export const gosecFingerprint = {
+    id: 'gosec-to-hdf',
+    label: 'GoSec',
+    direction: 'ingest',
+    inputFamily: 'json',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'object' || input === null)
+            return 0;
+        const obj = input;
+        // Strong signal: GosecVersion present with Issues array
+        if (typeof obj.GosecVersion === 'string' && Array.isArray(obj.Issues))
+            return 1.0;
+        // Medium signal: Issues array with Stats object (gosec shape without version)
+        if (Array.isArray(obj.Issues) && typeof obj.Stats === 'object' && obj.Stats !== null)
+            return 0.6;
+        return 0;
+    },
+};
+export function register() {
+    if (getFingerprint('gosec-to-hdf'))
+        return;
+    registerFingerprint(gosecFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/gosec-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AAExH,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,wDAAwD;QACxD,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAClF,8EAA8E;QAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QACjG,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,cAAc,CAAC;QAAE,OAAO;IAC3C,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AACxC,CAAC"}

package/dist/converters/gosec-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertGosecToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/gosec-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/gosec-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertGosecToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/gosec-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/grype-to-hdf/typescript/converter.d.ts

@@ -0,0 +1,2 @@
+export declare function convertGrypeToHdf(input: string): Promise<string>;
+//# sourceMappingURL=converter.d.ts.map

package/dist/converters/grype-to-hdf/typescript/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAsTA,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DtE"}

package/dist/converters/grype-to-hdf/typescript/converter.js

@@ -0,0 +1,222 @@
+import { Copyright, createMinimalBaseline, ResultStatus, } from '@mitre/hdf-schema';
+import { nistToCci, DEFAULT_STATIC_ANALYSIS_NIST_TAGS } from '@mitre/hdf-mappings';
+import { parseJSON } from '@mitre/hdf-utilities';
+import { inputChecksum, buildNistCciTags, limitArray, validateInputSize, buildHdfResults } from '../../../shared/typescript/converterutil.js';
+// Severity to impact mapping
+const IMPACT_MAPPING = new Map([
+    ['critical', 0.9],
+    ['high', 0.7],
+    ['medium', 0.5],
+    ['low', 0.3],
+    ['negligible', 0.0],
+    ['unknown', 0.5],
+]);
+function getImpact(severity) {
+    if (!severity) {
+        return 0.5; // default for unknown
+    }
+    return IMPACT_MAPPING.get(severity.toLowerCase()) ?? 0.5;
+}
+function isNegligibleOrUnknown(severity) {
+    if (!severity) {
+        return true;
+    }
+    const lower = severity.toLowerCase();
+    return lower === 'negligible' || lower === 'unknown';
+}
+function getDescription(vuln, relatedVulns) {
+    // Use primary vulnerability description if available
+    if (vuln.description) {
+        return vuln.description;
+    }
+    // Fall back to related vulnerability with matching ID
+    if (relatedVulns) {
+        for (const related of relatedVulns) {
+            if (related.id === vuln.id && related.description) {
+                return related.description;
+            }
+        }
+    }
+    return `Vulnerability ${vuln.id}`;
+}
+function getFixInfo(fix) {
+    if (!fix || !fix.state) {
+        return 'vulnerability is not known to be fixed in any versions';
+    }
+    if (fix.state === 'fixed' && fix.versions && fix.versions.length > 0) {
+        return `vulnerability is ${fix.state} for versions ${fix.versions.join(', ')}`;
+    }
+    return `vulnerability is ${fix.state}`;
+}
+function getCVSSInfo(vuln, relatedVulns) {
+    const cvssData = {};
+    // Collect CVSS from primary vulnerability
+    if (vuln.cvss && vuln.cvss.length > 0) {
+        cvssData.primary = vuln.cvss;
+    }
+    // Collect CVSS from related vulnerabilities
+    if (relatedVulns && relatedVulns.length > 0) {
+        cvssData.related = relatedVulns
+            .filter(r => r.cvss && r.cvss.length > 0)
+            .map(r => ({
+            id: r.id,
+            dataSource: r.dataSource,
+            cvss: r.cvss,
+        }));
+    }
+    return JSON.stringify(cvssData);
+}
+function getReferences(vuln, relatedVulns) {
+    const refs = new Set();
+    // Add URLs from primary vulnerability
+    if (vuln.urls) {
+        for (const url of vuln.urls) {
+            refs.add(url);
+        }
+    }
+    // Add URLs from related vulnerabilities
+    if (relatedVulns) {
+        for (const related of relatedVulns) {
+            if (related.urls) {
+                for (const url of related.urls) {
+                    refs.add(url);
+                }
+            }
+        }
+    }
+    return Array.from(refs);
+}
+function buildCodeDesc(match) {
+    const parts = [];
+    // Package info
+    parts.push(`Package: ${match.artifact.name}@${match.artifact.version}`);
+    // Package type if available
+    if (match.artifact.type) {
+        parts.push(`Type: ${match.artifact.type}`);
+    }
+    // Location if available
+    if (match.artifact.locations && match.artifact.locations.length > 0) {
+        const location = match.artifact.locations[0];
+        if (location.path) {
+            parts.push(`Location: ${location.path}`);
+        }
+    }
+    // Match type if available
+    if (match.matchDetails && match.matchDetails.length > 0) {
+        const matchType = match.matchDetails[0].type;
+        if (matchType) {
+            parts.push(`Match Type: ${matchType}`);
+        }
+    }
+    return parts.join(' | ');
+}
+function convertMatchToRequirement(match, isIgnored) {
+    const vuln = match.vulnerability;
+    const cveId = vuln.id;
+    const severity = vuln.severity;
+    const impact = getImpact(severity);
+    const description = getDescription(vuln, match.relatedVulnerabilities);
+    const fixInfo = getFixInfo(vuln.fix);
+    const cvssInfo = getCVSSInfo(vuln, match.relatedVulnerabilities);
+    const refs = getReferences(vuln, match.relatedVulnerabilities);
+    // Determine status
+    let status;
+    if (isIgnored) {
+        status = ResultStatus.NotReviewed; // Ignored by configured rules
+    }
+    else if (isNegligibleOrUnknown(severity)) {
+        status = ResultStatus.NotApplicable;
+    }
+    else {
+        status = ResultStatus.Failed;
+    }
+    // Build result message
+    const messageParts = [];
+    if (isIgnored) {
+        messageParts.push('This vulnerability was ignored by configured rules.');
+    }
+    if (isNegligibleOrUnknown(severity) && !isIgnored) {
+        messageParts.push('Manual review required because a Grype rating severity is set to `negligible` or `unknown`.');
+    }
+    messageParts.push(`Severity: ${severity || 'unknown'}`);
+    messageParts.push(fixInfo);
+    const message = messageParts.join(' ');
+    // Build execution result
+    const result = {
+        status,
+        codeDesc: buildCodeDesc(match),
+        message,
+        startTime: new Date('0001-01-01T00:00:00Z'), // Go zero time format
+    };
+    // Get CCI mappings for NIST controls using curated mapping table
+    const cciTags = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
+    // Build tags object - only include cci if not empty
+    const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, cciTags);
+    // Build requirement
+    const requirement = {
+        id: isIgnored ? `Grype-Ignored-Match/${cveId}` : `Grype/${cveId}`,
+        impact,
+        results: [result],
+        tags,
+        descriptions: [
+            { label: 'default', data: description },
+            { label: 'fix', data: fixInfo },
+            { label: 'check', data: cvssInfo },
+        ],
+        refs: refs.length > 0 ? refs.map(url => ({ url })) : undefined,
+    };
+    return requirement;
+}
+export async function convertGrypeToHdf(input) {
+    validateInputSize(input, 'grype');
+    // Calculate checksum of input data
+    const resultsChecksum = await inputChecksum(input);
+    // Parse Grype JSON
+    const grypeData = parseJSON(input);
+    // Build requirements from matches
+    const requirements = [];
+    // Process regular matches
+    if (grypeData.matches && grypeData.matches.length > 0) {
+        const { items: limitedMatches, truncated: truncatedMatches } = limitArray(grypeData.matches);
+        /* v8 ignore next -- truncation only triggers with >100K items */
+        if (truncatedMatches) {
+            // eslint-disable-next-line no-console
+            console.warn(`WARNING: Input truncated at ${limitedMatches.length} match items (original: ${grypeData.matches.length})`);
+        }
+        for (const match of limitedMatches) {
+            requirements.push(convertMatchToRequirement(match, false));
+        }
+    }
+    // Process ignored matches
+    if (grypeData.ignoredMatches && grypeData.ignoredMatches.length > 0) {
+        const { items: limitedIgnored, truncated: truncatedIgnored } = limitArray(grypeData.ignoredMatches);
+        /* v8 ignore next -- truncation only triggers with >100K items */
+        if (truncatedIgnored) {
+            // eslint-disable-next-line no-console
+            console.warn(`WARNING: Input truncated at ${limitedIgnored.length} ignoredMatch items (original: ${grypeData.ignoredMatches.length})`);
+        }
+        for (const match of limitedIgnored) {
+            requirements.push(convertMatchToRequirement(match, true));
+        }
+    }
+    // Build baseline name from source
+    const targetName = grypeData.source?.target?.userInput || 'Grype Scan';
+    // Create baseline
+    const baseline = createMinimalBaseline(targetName, requirements, {
+        resultsChecksum,
+    });
+    // Build HDF results
+    return buildHdfResults({
+        generatorName: grypeData.descriptor?.name || 'grype',
+        converterVersion: grypeData.descriptor?.version || 'unknown',
+        toolName: 'Grype',
+        toolVersion: grypeData.descriptor?.version,
+        baselines: [baseline],
+        components: [{
+                type: Copyright.Artifact,
+                name: targetName,
+            }],
+        timestamp: grypeData.descriptor?.timestamp ? new Date(grypeData.descriptor.timestamp) : new Date(),
+    });
+}
+//# sourceMappingURL=converter.js.map

package/dist/converters/grype-to-hdf/typescript/converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.js","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EACT,qBAAqB,EAIrB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAC,SAAS,EAAE,iCAAiC,EAAC,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAC,MAAM,6CAA6C,CAAC;AAsG5I,6BAA6B;AAC7B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,UAAU,EAAE,GAAG,CAAC;IACjB,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,YAAY,EAAE,GAAG,CAAC;IACnB,CAAC,SAAS,EAAE,GAAG,CAAC;CACjB,CAAC,CAAC;AAGH,SAAS,SAAS,CAAC,QAAiB;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,CAAC,sBAAsB;IACpC,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAiB;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB,EAAE,YAA0C;IAC1F,qDAAqD;IACrD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,sDAAsD;IACtD,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO,OAAO,CAAC,WAAW,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,GAAc;IAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,wDAAwD,CAAC;IAClE,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,oBAAoB,GAAG,CAAC,KAAK,iBAAiB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,OAAO,oBAAoB,GAAG,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,YAA0C;IACvF,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,0CAA0C;IAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,4CAA4C;IAC5C,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,OAAO,GAAG,YAAY;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACT,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB,EAAE,YAA0C;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,eAAe;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,4BAA4B;IAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QAC9C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAiB,EAAE,SAAkB;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAE/D,mBAAmB;IACnB,IAAI,MAAoB,CAAC;IACzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,8BAA8B;IACnE,CAAC;SAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,uBAAuB;IACvB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,YAAY,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClD,YAAY,CAAC,IAAI,CACf,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,aAAa,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEvC,yBAAyB;IACzB,MAAM,MAAM,GAAsB;QAChC,MAAM;QACN,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC;QAC9B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,sBAAsB;KACpE,CAAC;IAEF,iEAAiE;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAE7D,oDAAoD;IACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;IAE1E,oBAAoB;IACpB,MAAM,WAAW,GAAyB;QACxC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE;QACjE,MAAM;QACN,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,IAAI;QACJ,YAAY,EAAE;YACZ,EAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAC;YACrC,EAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAC;YAC7B,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAC;SACjC;QACD,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,mCAAmC;IACnC,MAAM,eAAe,GAAa,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7D,mBAAmB;IACnB,MAAM,SAAS,GAAG,SAAS,CAAc,KAAK,CAAC,CAAC;IAEhD,kCAAkC;IAClC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,0BAA0B;IAC1B,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7F,iEAAiE;QACjE,IAAI,gBAAgB,EAAE,CAAC;YACrB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,cAAc,CAAC,MAAM,2BAA2B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACpG,iEAAiE;QACjE,IAAI,gBAAgB,EAAE,CAAC;YACrB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,cAAc,CAAC,MAAM,kCAAkC,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACzI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,YAAY,CAAC;IAEvE,kBAAkB;IAClB,MAAM,QAAQ,GAAsB,qBAAqB,CAAC,UAAU,EAAE,YAAY,EAAE;QAClF,eAAe;KAChB,CAAsB,CAAC;IAExB,oBAAoB;IACpB,OAAO,eAAe,CAAC;QACrB,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,IAAI,OAAO;QACpD,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,IAAI,SAAS;QAC5D,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO;QAC1C,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,UAAU,EAAE,CAAC;gBACX,IAAI,EAAE,SAAS,CAAC,QAAQ;gBACxB,IAAI,EAAE,UAAU;aACjB,CAAC;QACF,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;KACnG,CAAC,CAAC;AACL,CAAC"}

package/dist/converters/grype-to-hdf/typescript/fingerprint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Grype format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with matches[] + source (1.0) or descriptor.name === 'grype' (0.8).
+ */
+import { type ConverterFingerprint } from '../../../shared/typescript/registry.js';
+export declare const grypeFingerprint: ConverterFingerprint;
+export declare function register(): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/converters/grype-to-hdf/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAExH,eAAO,MAAM,gBAAgB,EAAE,oBAoB9B,CAAC;AAEF,wBAAgB,QAAQ,IAAI,IAAI,CAG/B"}

package/dist/converters/grype-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,38 @@
+/**
+ * Grype format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with matches[] + source (1.0) or descriptor.name === 'grype' (0.8).
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+export const grypeFingerprint = {
+    id: 'grype-to-hdf',
+    label: 'Grype',
+    direction: 'ingest',
+    inputFamily: 'json',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'object' || input === null)
+            return 0;
+        const obj = input;
+        // Strong signal: matches array with source object (standard Grype output)
+        if (Array.isArray(obj.matches) && typeof obj.source === 'object' && obj.source !== null)
+            return 1.0;
+        // Medium signal: descriptor.name === 'grype'
+        if (typeof obj.descriptor === 'object' && obj.descriptor !== null) {
+            const desc = obj.descriptor;
+            if (desc.name === 'grype')
+                return 0.8;
+        }
+        // Weak signal: matches array alone (could be other tools)
+        if (Array.isArray(obj.matches))
+            return 0.4;
+        return 0;
+    },
+};
+export function register() {
+    if (getFingerprint('grype-to-hdf'))
+        return;
+    registerFingerprint(grypeFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/grype-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AAExH,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QACpG,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAqC,CAAC;YACvD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,GAAG,CAAC;QACxC,CAAC;QACD,0DAA0D;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,cAAc,CAAC;QAAE,OAAO;IAC3C,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AACxC,CAAC"}

package/dist/converters/grype-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertGrypeToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/grype-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/grype-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertGrypeToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/grype-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/grype-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/hdf-to-csv/typescript/converter.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Convert HDF JSON to CSV format
+ * @param input HDF JSON string
+ * @returns CSV string with sanitized output
+ */
+export declare function convertHdfToCsv(input: string): string;
+//# sourceMappingURL=converter.d.ts.map

package/dist/converters/hdf-to-csv/typescript/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../converters/hdf-to-csv/typescript/converter.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmCrD"}

package/dist/converters/hdf-to-csv/typescript/converter.js

@@ -0,0 +1,108 @@
+import { parseJSON } from '@mitre/hdf-utilities';
+import { buildCsv } from '@mitre/hdf-utilities';
+import { validateInputSize } from '../../../shared/typescript/converterutil.js';
+/**
+ * Convert HDF JSON to CSV format
+ * @param input HDF JSON string
+ * @returns CSV string with sanitized output
+ */
+export function convertHdfToCsv(input) {
+    validateInputSize(input, 'hdf-to-csv');
+    const hdf = parseJSON(input);
+    if (!hdf || typeof hdf !== 'object' || !('baselines' in hdf)) {
+        throw new Error('Invalid HDF structure: missing baselines field');
+    }
+    if (!Array.isArray(hdf.baselines)) {
+        throw new Error('Invalid HDF structure: baselines must be an array');
+    }
+    const rows = [];
+    // Get components array (may be empty or undefined)
+    const components = hdf.components || [];
+    // If no components, create a single default target entry
+    const targetList = components.length > 0
+        ? components.map((t) => ({ name: t.name, type: t.type }))
+        : [{ name: '', type: '' }];
+    // Iterate through each baseline
+    for (const baseline of hdf.baselines) {
+        // Iterate through each requirement in the baseline
+        for (const requirement of baseline.requirements) {
+            // Create a row for each target
+            for (const target of targetList) {
+                rows.push(createRow(baseline, requirement, target));
+            }
+        }
+    }
+    // Convert to CSV with sanitization enabled
+    return buildCsv(rows, { sanitize: true });
+}
+/**
+ * Create a CSV row from baseline, requirement, and target data
+ */
+function createRow(baseline, requirement, target) {
+    // Get default description (required to be present per schema)
+    const defaultDesc = requirement.descriptions.find((d) => d.label === 'default');
+    const description = defaultDesc?.data || '';
+    // Get severity from tags or derive from impact
+    const severity = getSeverity(requirement);
+    // Get status from first result (results is required, minItems: 1 per schema)
+    const firstResult = requirement.results[0];
+    const status = firstResult?.status || '';
+    const message = firstResult?.message || '';
+    // Extract NIST and CCI controls from tags
+    const nistControls = extractArrayFromTags(requirement.tags, 'nist');
+    const cciControls = extractArrayFromTags(requirement.tags, 'cci');
+    return {
+        'Baseline ID': baseline.name,
+        'Baseline Version': baseline.version || '',
+        'Baseline Title': baseline.title || '',
+        'Target ID': target.name,
+        'Target Type': target.type,
+        'Requirement ID': requirement.id,
+        'Requirement Title': requirement.title || '',
+        'Description': description,
+        'Severity': severity,
+        'Impact': requirement.impact,
+        'Status': String(status),
+        'NIST Controls': nistControls,
+        'CCI Controls': cciControls,
+        'Result Message': message
+    };
+}
+/**
+ * Get severity from requirement tags or derive from impact
+ */
+function getSeverity(requirement) {
+    // Check if severity is explicitly provided in tags
+    if (requirement.tags && typeof requirement.tags === 'object') {
+        if ('severity' in requirement.tags) {
+            const sev = requirement.tags.severity;
+            if (typeof sev === 'string') {
+                return sev;
+            }
+            if (Array.isArray(sev) && sev.length > 0) {
+                return String(sev[0]);
+            }
+        }
+    }
+    // Derive from impact if not provided
+    const impact = requirement.impact;
+    if (impact >= 0.7)
+        return 'high';
+    if (impact >= 0.4)
+        return 'medium';
+    return 'low';
+}
+/**
+ * Extract array values from tags object and join with semicolons
+ */
+function extractArrayFromTags(tags, key) {
+    if (!tags || typeof tags !== 'object') {
+        return '';
+    }
+    const value = tags[key];
+    if (Array.isArray(value)) {
+        return value.map(v => String(v)).join('; ');
+    }
+    return '';
+}
+//# sourceMappingURL=converter.js.map