@mitre/hdf-converters 3.3.0 → 3.3.1

package/dist/index.js

@@ -1,8 +1,8 @@
-import { n as detectConverter, t as registerAllFingerprints } from "./register-all-C3lYICDC.js";
+import { n as detectConverter, t as registerAllFingerprints } from "./register-all-DxZN6IJ4.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, cvssScoreToSeverity, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, sha256, stripHtml as stripHTML } from "@mitre/hdf-utilities";
+import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact } from "@mitre/hdf-schema";
-import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getCCINistMappings, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, nistToCci } from "@mitre/hdf-mappings";
+import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -249,7 +249,21 @@ function buildHdfResults(opts) {
 	if (opts.components) hdf.components = opts.components;
 	if (opts.timestamp) hdf.timestamp = opts.timestamp;
 	if (opts.statistics) hdf.statistics = opts.statistics;
-	return JSON.stringify(hdf, null, 2);
+	return serializeHdf(hdf);
+}
+const ISO_UTC_WITH_FRACTION = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z$/;
+function hdfTimestampReplacer(_key, value) {
+	if (typeof value === "string" && ISO_UTC_WITH_FRACTION.test(value)) return trimUtcFraction(value);
+	return value;
+}
+/**
+* Serialize an HDF document to pretty-printed JSON, normalizing Date-derived
+* timestamps to canonical trimmed-UTC RFC3339 (byte-identical to the Go
+* converters). Use this instead of a bare `JSON.stringify` for any HDF output
+* so the fractional-second trim is applied consistently.
+*/
+function serializeHdf(doc, space = 2) {
+	return JSON.stringify(doc, hdfTimestampReplacer, space);
 }
 /**
 * Captures a NIST 800-53 control identifier and its base sub-control number,
@@ -413,14 +427,13 @@ function buildNoFindingsRequirement(id, codeDesc, startTime) {
 * - Results: snake_case → camelCase for all fields
 * - Overlay flattening: merge overlay/wrapper baselines so every requirement has results
 */
-/** Valid severity values per HDF v2.0 schema. */
-const VALID_SEVERITIES = new Set([
+/** Valid severity values per HDF v2.0 schema (matches the Go converter). */
+const VALID_SEVERITIES = /* @__PURE__ */ new Set([
 	"critical",
 	"high",
 	"medium",
 	"low",
-	"informational",
-	"none"
+	"informational"
 ]);
 /**
 * Convert tags.severity string to a valid severity value.
@@ -432,17 +445,6 @@ function tagSeverityToSeverity(tagSeverity) {
 	return VALID_SEVERITIES.has(normalized) ? normalized : null;
 }
 /**
-* Derive severity from numeric impact score.
-* Follows InSpec conventions: 0.9+ critical, 0.7+ high, 0.5+ medium, >0 low, 0 none.
-*/
-function impactToSeverity$2(impact) {
-	if (impact >= .9) return "critical";
-	if (impact >= .7) return "high";
-	if (impact >= .5) return "medium";
-	if (impact > 0) return "low";
-	return "none";
-}
-/**
 * Normalize status values from v1.0 to v2.0 format.
 * Converts snake_case to camelCase.
 */
@@ -491,32 +493,22 @@ function computeEffectiveStatus(impact, results) {
 * Convert v1.0 result to v2.0 result.
 * Transforms snake_case field names to camelCase.
 */
+const LEGACY_ZERO_TIME = "0001-01-01T00:00:00Z";
+function legacyStartTime(s) {
+	if (s === void 0) return LEGACY_ZERO_TIME;
+	const d = parseTimestamp(s);
+	return d ? formatTimestamp(d) : LEGACY_ZERO_TIME;
+}
 function convertResult(v1Result) {
 	const v2Result = { status: normalizeStatus$1(v1Result.status) };
-	if (v1Result.code_desc !== void 0) v2Result.codeDesc = v1Result.code_desc;
+	v2Result.codeDesc = v1Result.code_desc ?? "";
 	if (v1Result.run_time !== void 0) v2Result.runTime = v1Result.run_time;
-	if (v1Result.start_time !== void 0) v2Result.startTime = v1Result.start_time;
+	v2Result.startTime = legacyStartTime(v1Result.start_time);
 	if (v1Result.message !== void 0) v2Result.message = v1Result.message;
 	if (v1Result.exception !== void 0) v2Result.exception = v1Result.exception;
 	if (v1Result.backtrace !== void 0) v2Result.backtrace = v1Result.backtrace;
-	if (v1Result.resource_class !== void 0) v2Result.resourceClass = v1Result.resource_class;
-	if (v1Result.resource_params !== void 0) v2Result.resourceParams = v1Result.resource_params;
+	if (v1Result.resource_class !== void 0) v2Result.resource = v1Result.resource_class;
 	if (v1Result.resource_id !== void 0) v2Result.resourceId = v1Result.resource_id;
-	if (v1Result.skip_message !== void 0) v2Result.skipMessage = v1Result.skip_message;
-	const knownFields = new Set([
-		"status",
-		"code_desc",
-		"run_time",
-		"start_time",
-		"message",
-		"exception",
-		"backtrace",
-		"resource_class",
-		"resource_params",
-		"resource_id",
-		"skip_message"
-	]);
-	for (const [key, value] of Object.entries(v1Result)) if (!knownFields.has(key) && !(key in v2Result)) v2Result[key] = value;
 	return v2Result;
 }
 /**
@@ -529,37 +521,19 @@ function convertControl(v1Control) {
 		impact: v1Control.impact
 	};
 	if (v1Control.title !== void 0) v2Req.title = v1Control.title;
-	if (v1Control.desc !== void 0) v2Req.desc = v1Control.desc;
 	if (v1Control.descriptions !== void 0) v2Req.descriptions = v1Control.descriptions;
-	if (v1Control.refs !== void 0) v2Req.refs = v1Control.refs;
 	if (v1Control.tags !== void 0) v2Req.tags = v1Control.tags;
 	if (v1Control.code !== void 0) v2Req.code = v1Control.code;
 	if (v1Control.source_location !== void 0) v2Req.sourceLocation = v1Control.source_location;
-	if (v1Control.waiver_data !== void 0) v2Req.waiverData = v1Control.waiver_data;
 	if (v1Control.status !== void 0) v2Req.effectiveStatus = normalizeStatus$1(v1Control.status);
 	if (v1Control.results && Array.isArray(v1Control.results)) v2Req.results = v1Control.results.map(convertResult);
 	if (!v2Req.effectiveStatus) v2Req.effectiveStatus = computeEffectiveStatus(v1Control.impact, v2Req.results ?? []);
-	v2Req.severity = tagSeverityToSeverity(v1Control.tags?.severity) ?? impactToSeverity$2(v1Control.impact);
+	v2Req.severity = tagSeverityToSeverity(v1Control.tags?.severity) ?? impactToSeverity(v1Control.impact);
 	const rawNist = v1Control.tags?.nist;
 	if (Array.isArray(rawNist)) {
 		const controlType = deriveControlTypeFromTags(rawNist.filter((v) => typeof v === "string"));
 		if (controlType !== void 0) v2Req.controlType = controlType;
 	}
-	const knownFields = new Set([
-		"id",
-		"title",
-		"desc",
-		"descriptions",
-		"impact",
-		"refs",
-		"tags",
-		"code",
-		"source_location",
-		"waiver_data",
-		"results",
-		"status"
-	]);
-	for (const [key, value] of Object.entries(v1Control)) if (!knownFields.has(key) && !(key in v2Req)) v2Req[key] = value;
 	return v2Req;
 }
 /**
@@ -572,7 +546,7 @@ function convertGroup(v1Group) {
 		requirements: v1Group.controls
 	};
 	if (v1Group.title !== void 0) v2Group.title = v1Group.title;
-	const knownFields = new Set([
+	const knownFields = /* @__PURE__ */ new Set([
 		"id",
 		"title",
 		"controls"
@@ -598,7 +572,7 @@ function convertDependency(v1Dep) {
 	if (v1Dep.compliance !== void 0) v2Dep.compliance = v1Dep.compliance;
 	if (v1Dep.status !== void 0) v2Dep.status = v1Dep.status;
 	if (v1Dep.skip_message !== void 0) v2Dep.skipMessage = v1Dep.skip_message;
-	const knownFields = new Set([
+	const knownFields = /* @__PURE__ */ new Set([
 		"name",
 		"url",
 		"path",
@@ -627,9 +601,9 @@ function convertProfile(v1Profile) {
 	if (v1Profile.summary !== void 0) v2Baseline.summary = v1Profile.summary;
 	if (v1Profile.license !== void 0) v2Baseline.license = v1Profile.license;
 	if (v1Profile.copyright !== void 0) v2Baseline.copyright = v1Profile.copyright;
-	if (v1Profile.copyright_email !== void 0) v2Baseline.copyright_email = v1Profile.copyright_email;
-	if (v1Profile.supports !== void 0) v2Baseline.supports = v1Profile.supports;
-	if (v1Profile.attributes !== void 0) v2Baseline.inputs = v1Profile.attributes;
+	if (v1Profile.copyright_email !== void 0) v2Baseline.copyrightEmail = v1Profile.copyright_email;
+	if (v1Profile.supports?.length) v2Baseline.supports = v1Profile.supports;
+	if (v1Profile.attributes?.length) v2Baseline.inputs = v1Profile.attributes;
 	if (v1Profile.status !== void 0) v2Baseline.status = v1Profile.status;
 	if (v1Profile.sha256) v2Baseline.integrity = {
 		algorithm: "sha256",
@@ -638,30 +612,9 @@ function convertProfile(v1Profile) {
 	if (v1Profile.parent_profile !== void 0) v2Baseline.parentBaseline = v1Profile.parent_profile;
 	if (v1Profile.status_message !== void 0) v2Baseline.statusMessage = v1Profile.status_message;
 	if (v1Profile.skip_message !== void 0) v2Baseline.skipMessage = v1Profile.skip_message;
-	if (v1Profile.groups && Array.isArray(v1Profile.groups)) v2Baseline.groups = v1Profile.groups.map(convertGroup);
+	if (v1Profile.groups?.length) v2Baseline.groups = v1Profile.groups.map(convertGroup);
 	if (v1Profile.controls && Array.isArray(v1Profile.controls)) v2Baseline.requirements = v1Profile.controls.map(convertControl);
-	if (v1Profile.depends && Array.isArray(v1Profile.depends)) v2Baseline.depends = v1Profile.depends.map(convertDependency);
-	const knownFields = new Set([
-		"name",
-		"version",
-		"title",
-		"maintainer",
-		"summary",
-		"license",
-		"copyright",
-		"copyright_email",
-		"supports",
-		"attributes",
-		"groups",
-		"controls",
-		"sha256",
-		"depends",
-		"parent_profile",
-		"status",
-		"status_message",
-		"skip_message"
-	]);
-	for (const [key, value] of Object.entries(v1Profile)) if (!knownFields.has(key) && !(key in v2Baseline)) v2Baseline[key] = value;
+	if (v1Profile.depends?.length) v2Baseline.depends = v1Profile.depends.map(convertDependency);
 	return v2Baseline;
 }
 /**
@@ -694,17 +647,21 @@ function convertV1ToV2(v1Data) {
 		baselines: (v1Data.profiles || []).map(convertProfile),
 		statistics: v1Data.statistics || {}
 	};
-	if (v1Data.platform) v2.components = [{
-		type: "host",
-		id: v1Data.platform.target_id || v1Data.platform.name,
-		name: v1Data.platform.name,
-		...v1Data.platform.release && { release: v1Data.platform.release },
-		labels: {}
-	}];
+	if (v1Data.platform) {
+		const component = {
+			type: "host",
+			name: v1Data.platform.name
+		};
+		if (v1Data.platform.target_id) {
+			component.osName = v1Data.platform.name;
+			if (v1Data.platform.release !== void 0) component.osVersion = v1Data.platform.release;
+		}
+		v2.components = [component];
+	}
 	if (v1Data.generator) v2.generator = v1Data.generator;
 	v2.tool = { name: "Heimdall Data Format v1" };
 	if (v1Data.timestamp) v2.timestamp = v1Data.timestamp;
-	const knownV1Fields = new Set([
+	const knownV1Fields = /* @__PURE__ */ new Set([
 		"version",
 		"platform",
 		"profiles",
@@ -1069,8 +1026,9 @@ async function convertJunitToHdf(input) {
 	if (!input || !input.trim()) throw new Error("Empty input");
 	validateInputSize(input, "junit");
 	const { suites, name } = parseJUnitXML(input);
-	const requirements = buildRequirements(suites);
-	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("junit-no-findings", `JUnit scanned ${noFindingsTarget(name, suites)} and reported zero findings.`, /* @__PURE__ */ new Date()));
+	const scanTime = resolveScanTime(suites);
+	const requirements = buildRequirements(suites, scanTime);
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("junit-no-findings", `JUnit scanned ${noFindingsTarget(name, suites)} and reported zero findings.`, scanTime));
 	return buildHdfResults({
 		generatorName: "junit-to-hdf",
 		converterVersion: CONVERTER_VERSION$2,
@@ -1081,9 +1039,16 @@ async function convertJunitToHdf(input) {
 			type: TargetType.Application,
 			name
 		}],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
+function resolveScanTime(suites) {
+	for (const suite of suites) if (suite.timestamp) {
+		const parsed = parseTimestamp(suite.timestamp);
+		if (parsed) return parsed;
+	}
+	return /* @__PURE__ */ new Date();
+}
 function parseJUnitXML(input) {
 	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2);
 	if (parsed.testsuites) return {
@@ -1100,7 +1065,7 @@ function parseJUnitXML(input) {
 	}
 	throw new Error("Input is not a JUnit XML document: expected <testsuites> or <testsuite> root element");
 }
-function buildRequirements(suites) {
+function buildRequirements(suites, scanTime) {
 	const { items: limitedSuites, truncated: truncatedSuites } = limitArray(suites);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncatedSuites) console.warn(`WARNING: Input truncated at ${limitedSuites.length} test suite items (original: ${suites.length})`);
@@ -1110,19 +1075,21 @@ function buildRequirements(suites) {
 		const { items: limitedTestCases, truncated: truncatedTC } = limitArray(testcases);
 		/* v8 ignore next -- truncation only triggers with >100K items */
 		if (truncatedTC) console.warn(`WARNING: Input truncated at ${limitedTestCases.length} test case items (original: ${testcases.length})`);
-		for (const tc of limitedTestCases) requirements.push(testCaseToRequirement(tc, suite.timestamp));
+		for (const tc of limitedTestCases) requirements.push(testCaseToRequirement(tc, scanTime));
 	}
 	return requirements;
 }
-function testCaseToRequirement(tc, suiteTimestamp) {
+function testCaseToRequirement(tc, scanTime) {
 	const id = buildID(tc);
 	const { status, message } = resolveStatus(tc);
-	const resultOptions = { codeDesc: buildCodeDesc$9(tc) };
+	const resultOptions = {
+		codeDesc: buildCodeDesc$9(tc),
+		startTime: scanTime
+	};
 	if (tc.time) {
 		const parsed = parseFloat(tc.time);
 		if (!isNaN(parsed)) resultOptions.runTime = parsed;
 	}
-	if (suiteTimestamp) resultOptions.startTime = suiteTimestamp;
 	const result = createResult(status, message ?? "", resultOptions);
 	const descriptions = [{
 		label: "default",
@@ -1227,6 +1194,13 @@ const STATUS_MAP = {
 * @param input - Raw XML string (XCCDF Benchmark with TestResult, or ARF asset-report-collection)
 * @returns Stringified HDF Results JSON
 */
+function parseStartTime(raw) {
+	if (raw) {
+		const t = parseTimestamp(raw);
+		if (t) return t;
+	}
+	return /* @__PURE__ */ new Date();
+}
 async function convertXccdfResultsToHdf(input) {
 	if (!input || !input.trim()) throw new Error("Empty input");
 	validateInputSize(input, "xccdf-results");
@@ -1245,20 +1219,21 @@ async function convertBenchmarkResultsToHdf(benchmark, rawInput) {
 	const { items: limitedRuleResults, truncated: truncatedRR } = limitArray(ruleResults);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncatedRR) console.warn(`WARNING: Input truncated at ${limitedRuleResults.length} rule-result items (original: ${ruleResults.length})`);
-	const requirements = limitedRuleResults.map((rr) => ruleResultToRequirement(rr, ruleIndex));
+	const scanTime = parseStartTime(testResult["start-time"]);
+	const requirements = limitedRuleResults.map((rr) => ruleResultToRequirement(rr, ruleIndex, scanTime));
 	if (requirements.length === 0) {
 		const target = xccdfTargetName(testResult, benchmark);
-		requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
+		requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, scanTime));
 	}
 	const resultsChecksum = await inputChecksum(rawInput);
 	const baseline = createMinimalBaseline(extractText(benchmark.title) || "XCCDF Benchmark", requirements, { resultsChecksum });
 	const components = buildTargets(testResult);
-	const timestamp = testResult["start-time"] ? new Date(testResult["start-time"]) : /* @__PURE__ */ new Date();
+	const timestamp = scanTime;
 	let durationSeconds;
 	if (testResult["start-time"] && testResult["end-time"]) {
-		const start = new Date(testResult["start-time"]).getTime();
-		const end = new Date(testResult["end-time"]).getTime();
-		if (!isNaN(start) && !isNaN(end) && end >= start) durationSeconds = (end - start) / 1e3;
+		const start = parseTimestamp(testResult["start-time"])?.getTime();
+		const end = parseTimestamp(testResult["end-time"])?.getTime();
+		if (start !== void 0 && end !== void 0 && end >= start) durationSeconds = (end - start) / 1e3;
 	}
 	const hdf = {
 		baselines: [baseline],
@@ -1274,7 +1249,7 @@ async function convertBenchmarkResultsToHdf(benchmark, rawInput) {
 		timestamp
 	};
 	if (durationSeconds !== void 0) hdf.statistics = { duration: durationSeconds };
-	return JSON.stringify(hdf, null, 2);
+	return serializeHdf(hdf);
 }
 async function convertArfCollection(arc, rawInput) {
 	const resultsChecksum = await inputChecksum(rawInput);
@@ -1291,20 +1266,24 @@ async function convertArfCollection(arc, rawInput) {
 	for (const report of arc.reports?.report ?? []) {
 		const testResult = report.content?.TestResult;
 		if (!testResult?.id) continue;
-		if (testResult["start-time"] && !firstTimestamp) firstTimestamp = new Date(testResult["start-time"]);
+		if (testResult["start-time"] && !firstTimestamp) {
+			const t = parseTimestamp(testResult["start-time"]);
+			if (t) firstTimestamp = t;
+		}
 		if (testResult["start-time"] && testResult["end-time"]) {
-			const start = new Date(testResult["start-time"]).getTime();
-			const end = new Date(testResult["end-time"]).getTime();
-			if (!isNaN(start) && !isNaN(end) && end >= start) totalDuration += (end - start) / 1e3;
+			const start = parseTimestamp(testResult["start-time"])?.getTime();
+			const end = parseTimestamp(testResult["end-time"])?.getTime();
+			if (start !== void 0 && end !== void 0 && end >= start) totalDuration += (end - start) / 1e3;
 		}
+		const scanTime = parseStartTime(testResult["start-time"]);
 		const ruleResults = testResult["rule-result"] ?? [];
 		const { items: limitedARFRuleResults, truncated: truncatedARFRR } = limitArray(ruleResults);
 		/* v8 ignore next -- truncation only triggers with >100K items */
 		if (truncatedARFRR) console.warn(`WARNING: Input truncated at ${limitedARFRuleResults.length} rule-result items (original: ${ruleResults.length})`);
-		const requirements = limitedARFRuleResults.map((rr) => ruleResultToRequirement(rr, ruleIndex));
+		const requirements = limitedARFRuleResults.map((rr) => ruleResultToRequirement(rr, ruleIndex, scanTime));
 		if (requirements.length === 0) {
 			const target = xccdfTargetName(testResult, benchmark);
-			requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
+			requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, scanTime));
 		}
 		let baselineName = "";
 		if (benchmark) baselineName = extractText(benchmark.title) || "";
@@ -1337,7 +1316,7 @@ async function convertArfCollection(arc, rawInput) {
 		timestamp: firstTimestamp ?? /* @__PURE__ */ new Date()
 	};
 	if (totalDuration > 0) hdf.statistics = { duration: totalDuration };
-	return JSON.stringify(hdf, null, 2);
+	return serializeHdf(hdf);
 }
 /**
 * Find the XCCDF Benchmark embedded in an ARF data-stream-collection.
@@ -1393,7 +1372,7 @@ function buildRuleIndex(benchmark) {
 /**
 * Convert a single <rule-result> into an EvaluatedRequirement.
 */
-function ruleResultToRequirement(rr, ruleIndex) {
+function ruleResultToRequirement(rr, ruleIndex, scanTime) {
 	const ruleId = rr.idref ?? "";
 	const ruleDef = ruleIndex.get(ruleId);
 	const id = extractVersion$1(ruleDef?.version) || ruleId;
@@ -1411,7 +1390,16 @@ function ruleResultToRequirement(rr, ruleIndex) {
 		label: "fix",
 		data: fixtext
 	});
-	const result = createResult(STATUS_MAP[(rr.result ?? "").toLowerCase()] ?? ResultStatus.NotReviewed, "", { codeDesc: `XCCDF rule ${id}` });
+	if (descriptions.length === 0) descriptions.push({
+		label: "default",
+		data: ""
+	});
+	const status = STATUS_MAP[(rr.result ?? "").toLowerCase()] ?? ResultStatus.NotReviewed;
+	const perRuleTime = rr.time ? parseTimestamp(rr.time) : null;
+	const result = createResult(status, "", {
+		codeDesc: `XCCDF rule ${id}`,
+		startTime: perRuleTime ?? scanTime
+	});
 	const tags = {};
 	let nistTags = [];
 	const cciIds = extractCCIs(rr.ident ?? ruleDef?.ident ?? []);
@@ -1589,7 +1577,7 @@ const VULN_ATTR_ORDER = [
 	"Class",
 	"STIG_UUID"
 ];
-const CORE_VULN_ATTR = new Set([
+const CORE_VULN_ATTR = /* @__PURE__ */ new Set([
 	"Vuln_Num",
 	"Severity",
 	"Group_Title",
@@ -1625,7 +1613,9 @@ function parseCkl(input) {
 			webDBSite: str(a["WEB_DB_SITE"]),
 			webDBInstance: str(a["WEB_DB_INSTANCE"])
 		},
-		stigs: istigs.map((is) => {
+		stigs: istigs.map((is, i) => {
+			const vulns = is.VULN ?? [];
+			if (vulns.length === 0) throw new Error(`parse ckl: <iSTIG> block ${i + 1} contains no <VULN> rules`);
 			const si = is.STIG_INFO?.SI_DATA ?? [];
 			const siVal = (name) => str(si.find((d) => d.SID_NAME === name)?.SID_DATA);
 			return {
@@ -1635,7 +1625,7 @@ function parseCkl(input) {
 				releaseInfo: siVal("releaseinfo"),
 				uuid: siVal("uuid"),
 				classification: siVal("classification"),
-				vulns: (is.VULN ?? []).map(cklVulnToModel)
+				vulns: vulns.map(cklVulnToModel)
 			};
 		})
 	};
@@ -1645,7 +1635,7 @@ function cklVulnToModel(v) {
 	const attr = (name) => str(data.find((sd) => sd.VULN_ATTRIBUTE === name)?.ATTRIBUTE_DATA);
 	const ccis = [];
 	const extra = {};
-	const promoted = new Set([
+	const promoted = /* @__PURE__ */ new Set([
 		"CCI_REF",
 		"Vuln_Num",
 		"Severity",
@@ -1794,16 +1784,20 @@ function parseCklb(input) {
 		techArea: nz(t.technology_area),
 		classification: nz(t.classification)
 	};
-	const stigs = doc.stigs.map((s) => ({
-		stigID: nz(s.stig_id),
-		title: nz(s.stig_name) || nz(s.display_name),
-		displayName: nz(s.display_name),
-		version: nz(s.version),
-		releaseInfo: nz(s.release_info),
-		uuid: nz(s.uuid),
-		referenceIdentifier: nz(s.reference_identifier),
-		vulns: (s.rules ?? []).map(cklbRuleToModel)
-	}));
+	const stigs = doc.stigs.map((s, i) => {
+		const rules = s.rules ?? [];
+		if (rules.length === 0) throw new Error(`parse cklb: stigs[${i}] contains no rules[]`);
+		return {
+			stigID: nz(s.stig_id),
+			title: nz(s.stig_name) || nz(s.display_name),
+			displayName: nz(s.display_name),
+			version: nz(s.version),
+			releaseInfo: nz(s.release_info),
+			uuid: nz(s.uuid),
+			referenceIdentifier: nz(s.reference_identifier),
+			vulns: rules.map(cklbRuleToModel)
+		};
+	});
 	return {
 		format: "cklb",
 		cklbVersion: nz(doc.cklb_version),
@@ -1906,8 +1900,9 @@ const CONVERTER_VERSION = "1.0.0";
 * Original-format metadata is stashed in extensions/tags for round-trip.
 */
 function checklistToHdf(cl, resultsChecksum, generatorName) {
+	const scanTime = /* @__PURE__ */ new Date();
 	const hdf = {
-		baselines: cl.stigs.map((s) => stigToBaseline(s, resultsChecksum)),
+		baselines: cl.stigs.map((s) => stigToBaseline(s, resultsChecksum, scanTime)),
 		generator: {
 			name: generatorName,
 			version: CONVERTER_VERSION
@@ -1916,7 +1911,7 @@ function checklistToHdf(cl, resultsChecksum, generatorName) {
 			name: "DISA STIG Viewer",
 			format: cl.format === "cklb" ? "CKLB" : "CKL"
 		},
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	};
 	const component = assetToComponent(cl.asset);
 	if (component) hdf.components = [component];
@@ -1924,15 +1919,15 @@ function checklistToHdf(cl, resultsChecksum, generatorName) {
 	if (Object.keys(ext).length > 0) hdf.extensions = ext;
 	return hdf;
 }
-function stigToBaseline(s, resultsChecksum) {
-	const baseline = createMinimalBaseline("STIG Checklist Scan", s.vulns.map(vulnToRequirement), { resultsChecksum });
+function stigToBaseline(s, resultsChecksum, scanTime) {
+	const baseline = createMinimalBaseline("STIG Checklist Scan", s.vulns.map((v) => vulnToRequirement(v, scanTime)), { resultsChecksum });
 	if (s.title) baseline.title = s.title;
 	if (s.version) baseline.version = s.version;
 	const ext = baselineExtensions(s);
 	if (Object.keys(ext).length > 0) baseline.extensions = ext;
 	return baseline;
 }
-function vulnToRequirement(v) {
+function vulnToRequirement(v, scanTime) {
 	const severity = (v.severity ?? "").toLowerCase();
 	const impact = severity ? severityToImpact(severity) : .5;
 	const descriptions = [{
@@ -1948,7 +1943,10 @@ function vulnToRequirement(v) {
 		data: stripHTML(v.fixText)
 	});
 	const message = [v.findingDetails, v.comments].map((s) => (s ?? "").trim()).filter(Boolean).join("\n\n");
-	const result = createResult(statusToHdf(v.status), message, { codeDesc: `STIG rule ${v.ruleVer ?? ""}` });
+	const result = createResult(statusToHdf(v.status), message, {
+		codeDesc: `STIG rule ${v.ruleVer ?? ""}`,
+		startTime: scanTime
+	});
 	const tags = {};
 	let nistTags = [];
 	if (v.ccis.length > 0) {
@@ -2238,7 +2236,7 @@ function synthesizePurl(ecosystem, name, version) {
 	if (ecosystem === Ecosystem.Generic) return void 0;
 	return `pkg:${ecosystem}/${name}@${version}`;
 }
-function buildRequirement$16(vulnID, vulns, packageManager) {
+function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const rep = vulns[0];
 	const cweIDs = rep.identifiers.CWE ?? [];
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
@@ -2253,7 +2251,10 @@ function buildRequirement$16(vulnID, vulns, packageManager) {
 		label: "default",
 		data: rep.description
 	}];
-	const results = vulns.map((vuln) => createResult(ResultStatus.Failed, void 0, { codeDesc: formatDependencyPath(vuln.from) }));
+	const results = vulns.map((vuln) => createResult(ResultStatus.Failed, void 0, {
+		codeDesc: formatDependencyPath(vuln.from),
+		startTime: scanTime
+	}));
 	const req = createRequirement(vulnID, rep.title, descriptions, severityToImpact(rep.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -2276,7 +2277,7 @@ function buildRequirement$16(vulnID, vulns, packageManager) {
 /**
 * Converts a single Snyk project report to an HDF baseline.
 */
-function convertSingleProject(report, resultsChecksum) {
+function convertSingleProject(report, resultsChecksum, scanTime) {
 	const { items: limitedVulns, truncated: truncatedVulns } = limitArray(report.vulnerabilities);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncatedVulns) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${report.vulnerabilities.length})`);
@@ -2287,10 +2288,10 @@ function convertSingleProject(report, resultsChecksum) {
 		else groups.set(vuln.id, [vuln]);
 	}
 	const requirements = [];
-	for (const [vulnID, vulns] of groups) requirements.push(buildRequirement$16(vulnID, vulns, report.packageManager));
+	for (const [vulnID, vulns] of groups) requirements.push(buildRequirement$16(vulnID, vulns, scanTime, report.packageManager));
 	if (requirements.length === 0) {
 		const target = report.projectName ?? report.path ?? "project";
-		requirements.push(buildNoFindingsRequirement("snyk-no-findings", `Snyk scanned ${target} and reported zero vulnerable components.`, /* @__PURE__ */ new Date()));
+		requirements.push(buildNoFindingsRequirement("snyk-no-findings", `Snyk scanned ${target} and reported zero vulnerable components.`, scanTime));
 	}
 	return createMinimalBaseline("Snyk Scan", requirements, {
 		resultsChecksum,
@@ -2314,6 +2315,7 @@ async function convertSnykToHdf(input) {
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
 	const resultsChecksum = await inputChecksum(input);
+	const scanTime = /* @__PURE__ */ new Date();
 	const parsed = parseJSON(input);
 	if (!parsed || typeof parsed !== "object") throw new Error("snyk: invalid JSON");
 	let baselines;
@@ -2322,10 +2324,10 @@ async function convertSnykToHdf(input) {
 		const { items: limitedProjects, truncated: truncatedProjects } = limitArray(parsed);
 		/* v8 ignore next -- truncation only triggers with >100K items */
 		if (truncatedProjects) console.warn(`WARNING: Input truncated at ${limitedProjects.length} project items (original: ${parsed.length})`);
-		baselines = limitedProjects.map((report) => convertSingleProject(report, resultsChecksum));
+		baselines = limitedProjects.map((report) => convertSingleProject(report, resultsChecksum, scanTime));
 		targetName = limitedProjects[0]?.projectName ?? limitedProjects[0]?.path ?? "";
 	} else {
-		baselines = [convertSingleProject(parsed, resultsChecksum)];
+		baselines = [convertSingleProject(parsed, resultsChecksum, scanTime)];
 		targetName = parsed.projectName ?? parsed.path ?? "";
 	}
 	return buildHdfResults({
@@ -2338,12 +2340,12 @@ async function convertSnykToHdf(input) {
 			name: targetName,
 			type: TargetType.Application
 		}],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
 //#region converters/grype-to-hdf/typescript/converter.ts
-const IMPACT_MAPPING$8 = new Map([
+const IMPACT_MAPPING$8 = /* @__PURE__ */ new Map([
 	["critical", .9],
 	["high", .7],
 	["medium", .5],
@@ -2581,7 +2583,7 @@ async function convertGrypeToHdf(input) {
 			type: TargetType.Artifact,
 			name: targetName
 		}],
-		timestamp: grypeData.descriptor?.timestamp ? new Date(grypeData.descriptor.timestamp) : /* @__PURE__ */ new Date()
+		timestamp: (grypeData.descriptor?.timestamp ? parseTimestamp(grypeData.descriptor.timestamp) : null) ?? /* @__PURE__ */ new Date()
 	});
 }
 //#endregion
@@ -2664,8 +2666,8 @@ function calculateTiming(hosts) {
 	const lastHost = hosts[hosts.length - 1];
 	const startTimeStr = getHostPropertyValue(firstHost, "HOST_START");
 	const endTimeStr = getHostPropertyValue(lastHost, "HOST_END") || getHostPropertyValue(lastHost, "HOST_START");
-	const startTime = startTimeStr ? new Date(startTimeStr) : /* @__PURE__ */ new Date();
-	const endTime = endTimeStr ? new Date(endTimeStr) : startTime;
+	const startTime = startTimeStr ? parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
+	const endTime = endTimeStr ? parseTimestamp(endTimeStr) ?? startTime : startTime;
 	return {
 		startTime,
 		endTime,
@@ -2689,7 +2691,7 @@ function convertReportHostToBaseline(host, policyName, version, resultsChecksum)
 	if (requirements.length === 0) {
 		const target = host.name || getHostPropertyValue(host, "host-ip") || "host";
 		const startTimeStr = getHostPropertyValue(host, "HOST_START");
-		const startTime = startTimeStr ? new Date(startTimeStr) : /* @__PURE__ */ new Date();
+		const startTime = startTimeStr ? parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
 		requirements = [buildNoFindingsRequirement("nessus-no-findings", `Nessus scanned ${target} and reported zero findings.`, startTime)];
 	}
 	return createMinimalBaseline(`Nessus ${policyName}`, requirements, {
@@ -2856,8 +2858,8 @@ function buildEpss(item, host) {
 function epssDate(host) {
 	const hs = getHostPropertyValue(host, "HOST_START");
 	if (hs) {
-		const d = new Date(hs);
-		if (!Number.isNaN(d.getTime())) return d.toISOString().slice(0, 10);
+		const d = parseTimestamp(hs);
+		if (d) return d.toISOString().slice(0, 10);
 	}
 }
 function buildDescriptions(item, isCompliance) {
@@ -2928,7 +2930,7 @@ function buildResult$1(item, host, isCompliance) {
 	const codeDesc = getCodeDesc(item);
 	const message = item.plugin_output || item["compliance-actual-value"];
 	const startTimeStr = getHostPropertyValue(host, "HOST_START");
-	const startTime = startTimeStr ? new Date(startTimeStr) : /* @__PURE__ */ new Date();
+	const startTime = startTimeStr ? parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
 	return {
 		status,
 		codeDesc,
@@ -3163,7 +3165,7 @@ function createResultFromIssue(issue, componentMap) {
 	const codeDesc = `${component?.path || component?.longName || issue.component}${issue.line ? ` LINE : ${issue.line}` : ""}`;
 	return createResult(status, issue.message, {
 		codeDesc,
-		startTime: new Date(issue.creationDate)
+		startTime: parseTimestamp(issue.creationDate) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	});
 }
 function extractSourceLocation(issue, componentMap) {
@@ -3200,6 +3202,28 @@ function buildNistTags$3(sourceIdentifier, ruleName) {
 	if (byName) return [byName];
 	return [];
 }
+/**
+* Flag rules whose NIST mappings exist at a revision other than the one
+* currently selected — they emit no NIST tags here even though a mapping
+* exists elsewhere, a likely sign of a wrong revision selection. Rules
+* unmapped at every revision are not flagged. Throws in strict mode; otherwise
+* logs a single aggregated warning.
+*/
+function checkRevisionAlignment(rules) {
+	const rev = getCurrentNistRevision();
+	const seen = /* @__PURE__ */ new Set();
+	const lines = [];
+	for (const rule of rules) {
+		const covered = awsConfigMappedRevisions(rule.Source.SourceIdentifier, rule.ConfigRuleName);
+		if (covered.length === 0 || covered.includes(rev) || seen.has(rule.ConfigRuleName)) continue;
+		seen.add(rule.ConfigRuleName);
+		lines.push(`  - ${rule.ConfigRuleName} (mapped at Rev ${covered.join(", ")})`);
+	}
+	if (lines.length === 0) return;
+	const detail = `${lines.length} AWS Config rule(s) have NIST 800-53 mappings at a different revision than the requested Rev ${rev}; their NIST tags were omitted:\n${lines.join("\n")}`;
+	if (isNistStrict()) throw new Error(`aws-config: ${detail}\nre-run with a matching revision, or disable strict mode to convert with the gaps`);
+	console.warn(`WARNING: ${detail}`);
+}
 function buildCheckText(rule) {
 	const parts = [`ARN: ${rule.ConfigRuleArn || "N/A"}`, `Source Identifier: ${rule.Source.SourceIdentifier || "N/A"}`];
 	if (rule.InputParameters && rule.InputParameters !== "{}") {
@@ -3220,7 +3244,7 @@ function buildResult(r) {
 	const status = mapComplianceStatus(r.ComplianceType);
 	const codeDesc = buildCodeDesc$7(q);
 	const message = buildResultMessage(codeDesc, r.Annotation, status);
-	const startTime = r.ConfigRuleInvokedTime ? new Date(r.ConfigRuleInvokedTime) : void 0;
+	const startTime = (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	return createResult(status, message ?? codeDesc, {
 		codeDesc,
 		...startTime ? { startTime } : {}
@@ -3280,6 +3304,7 @@ async function convertAwsConfigToHdf(input) {
 	const { items: limitedRules, truncated: truncatedRules } = limitArray(data.ConfigRules);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncatedRules) console.warn(`WARNING: Input truncated at ${limitedRules.length} ConfigRule items (original: ${data.ConfigRules.length})`);
+	checkRevisionAlignment(limitedRules);
 	const baseline = {
 		...createMinimalBaseline("AWS Config", limitedRules.map(buildRequirement$15), { resultsChecksum }),
 		title: "AWS Config Compliance Results",
@@ -3329,17 +3354,20 @@ function getImpact$8(severity) {
 /**
 * Converts a single CheckovCheck to an HDF RequirementResult.
 */
-function checkToResult(check) {
+function checkToResult(check, scanTime) {
 	const status = mapStatus$2(check.check_result.result);
 	const codeDesc = `Resource: ${check.resource}\nFile: ${check.file_path} (lines ${JSON.stringify(check.file_line_range)})`;
 	let message;
 	if (status === ResultStatus.NotReviewed && check.check_result.suppress_comment) message = check.check_result.suppress_comment;
-	return createResult(status, message ?? "", { codeDesc });
+	return createResult(status, message ?? "", {
+		codeDesc,
+		startTime: scanTime
+	});
 }
 /**
 * Converts a group of checks sharing a check_id into one EvaluatedRequirement.
 */
-function buildRequirement$14(checkId, checks) {
+function buildRequirement$14(checkId, checks, scanTime) {
 	const rep = checks[0];
 	const impact = getImpact$8(rep.severity);
 	const tags = { nist: [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS] };
@@ -3351,7 +3379,7 @@ function buildRequirement$14(checkId, checks) {
 		label: "check",
 		data: rep.guideline
 	});
-	const results = checks.map(checkToResult);
+	const results = checks.map((check) => checkToResult(check, scanTime));
 	const req = createRequirement(checkId, rep.check_name, descriptions, impact, results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags([...DEFAULT_STATIC_ANALYSIS_NIST_TAGS]);
@@ -3382,6 +3410,7 @@ async function convertCheckovToHdf(input) {
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
 	const resultsChecksum = await inputChecksum(input);
+	const scanTime = /* @__PURE__ */ new Date();
 	const reports = parseInput(input);
 	const allChecks = [];
 	const checkTypes = [];
@@ -3403,11 +3432,11 @@ async function convertCheckovToHdf(input) {
 		else groups.set(check.check_id, [check]);
 	}
 	const requirements = [];
-	for (const [checkId, checks] of groups) requirements.push(buildRequirement$14(checkId, checks));
+	for (const [checkId, checks] of groups) requirements.push(buildRequirement$14(checkId, checks, scanTime));
 	const format = checkTypes.join(", ");
 	if (requirements.length === 0) {
 		const target = format || "input";
-		requirements.push(buildNoFindingsRequirement("checkov-no-findings", `Checkov scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
+		requirements.push(buildNoFindingsRequirement("checkov-no-findings", `Checkov scanned ${target} and reported zero findings.`, scanTime));
 	}
 	const baseline = createMinimalBaseline("Checkov Scan", requirements, { resultsChecksum });
 	return buildHdfResults({
@@ -3417,7 +3446,7 @@ async function convertCheckovToHdf(input) {
 		toolVersion: version,
 		toolFormat: format,
 		baselines: [baseline],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -3448,19 +3477,22 @@ function formatSkipMessage(suppressions) {
 /**
 * Converts a single GosecIssue to an HDF RequirementResult.
 */
-function issueToResult(issue) {
+function issueToResult(issue, scanTime) {
 	const suppressed = isSuppressed(issue);
 	const status = suppressed ? ResultStatus.NotReviewed : ResultStatus.Failed;
 	let message;
 	if (suppressed) message = formatSkipMessage(issue.suppressions) ?? "No justification provided";
 	else message = `${issue.confidence} confidence of rule violation at:\n${issue.code}`;
 	const codeDesc = `Rule ${issue.rule_id} violation detected at:\nFile: ${issue.file}\nLine: ${issue.line}\nColumn: ${issue.column}`;
-	return createResult(status, message, { codeDesc });
+	return createResult(status, message, {
+		codeDesc,
+		startTime: scanTime
+	});
 }
 /**
 * Converts a group of issues sharing a rule_id into one EvaluatedRequirement.
 */
-function buildRequirement$13(ruleId, issues) {
+function buildRequirement$13(ruleId, issues, scanTime) {
 	const rep = issues[0];
 	const impact = IMPACT_MAPPING$6[rep.severity.toUpperCase()] ?? .5;
 	const nist = mapCWEToNIST([rep.cwe.id], DEFAULT_REMEDIATION_NIST_TAGS$1);
@@ -3471,7 +3503,7 @@ function buildRequirement$13(ruleId, issues) {
 			url: rep.cwe.url
 		}
 	};
-	const results = issues.map(issueToResult);
+	const results = issues.map((issue) => issueToResult(issue, scanTime));
 	const descriptions = [{
 		label: "default",
 		data: rep.details
@@ -3511,9 +3543,10 @@ async function convertGosecToHdf(input) {
 		if (existing) existing.push(issue);
 		else groups.set(issue.rule_id, [issue]);
 	}
+	const scanTime = /* @__PURE__ */ new Date();
 	const requirements = [];
-	for (const [ruleId, issues] of groups) requirements.push(buildRequirement$13(ruleId, issues));
-	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("gosec-no-findings", "gosec scanned Go codebase and reported zero findings.", /* @__PURE__ */ new Date()));
+	for (const [ruleId, issues] of groups) requirements.push(buildRequirement$13(ruleId, issues, scanTime));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("gosec-no-findings", "gosec scanned Go codebase and reported zero findings.", scanTime));
 	const baseline = createMinimalBaseline("gosec Scan", requirements, { resultsChecksum });
 	return buildHdfResults({
 		generatorName: "gosec-to-hdf",
@@ -3521,7 +3554,7 @@ async function convertGosecToHdf(input) {
 		toolName: "gosec",
 		toolVersion: report.GosecVersion || void 0,
 		baselines: [baseline],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -3661,6 +3694,15 @@ function selectSite(sites) {
 	}
 	return best;
 }
+const ZAP_RFC1123_LIKE = /^[A-Za-z]{3}, \d{1,2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2}$/;
+function parseZapTimestamp(s) {
+	const trimmed = s.trim();
+	if (ZAP_RFC1123_LIKE.test(trimmed)) {
+		const d = /* @__PURE__ */ new Date(`${trimmed} GMT`);
+		if (!isNaN(d.getTime())) return d;
+	}
+	return parseTimestamp(s) ?? void 0;
+}
 async function convertZapToHdf(input) {
 	validateInputSize(input, "zap");
 	registerAllFingerprints();
@@ -3762,12 +3804,15 @@ async function convertZapToHdf(input) {
 		},
 		tool
 	};
-	if (zapData["@generated"]) hdf.timestamp = new Date(zapData["@generated"]);
-	return JSON.stringify(hdf, null, 2);
+	if (zapData["@generated"]) {
+		const ts = parseZapTimestamp(zapData["@generated"]);
+		if (ts) hdf.timestamp = ts;
+	}
+	return serializeHdf(hdf);
 }
 //#endregion
 //#region converters/cyclonedx-to-hdf/typescript/converter.ts
-const CVSS_METHODS = new Set([
+const CVSS_METHODS = /* @__PURE__ */ new Set([
 	"CVSSv2",
 	"CVSSv3",
 	"CVSSv31",
@@ -3832,6 +3877,8 @@ async function convertCyclonedxToHdf(input) {
 	if ((!bom.components || bom.components.length === 0) && (!bom.vulnerabilities || bom.vulnerabilities.length === 0)) throw new Error("cyclonedx: input has neither components nor vulnerabilities");
 	if (!bom.vulnerabilities || bom.vulnerabilities.length === 0) throw new Error("cyclonedx: this file is an SBOM inventory with no vulnerabilities; to import SBOM data into a system document, use:\n  hdf system create --from <sbom-file> --component-name <name>");
 	const resultsChecksum = await inputChecksum(input);
+	const parsedTimestamp = bom.metadata?.timestamp ? parseTimestamp(bom.metadata.timestamp) ?? void 0 : void 0;
+	const scanTime = parsedTimestamp && !isNaN(parsedTimestamp.getTime()) ? parsedTimestamp : /* @__PURE__ */ new Date();
 	const allComponents = flattenComponents(bom.components ?? []);
 	const componentLookup = /* @__PURE__ */ new Map();
 	for (const comp of allComponents) if (comp["bom-ref"]) componentLookup.set(comp["bom-ref"], comp);
@@ -3870,7 +3917,13 @@ async function convertCyclonedxToHdf(input) {
 			data: fixParts.join("\n\n")
 		});
 		const affects = vuln.affects ?? [];
-		const results = affects.length > 0 ? affects.map((affect) => createResult(ResultStatus.Failed, void 0, { codeDesc: formatCodeDesc$4(componentLookup, affect.ref) })) : [createResult(ResultStatus.Failed, void 0, { codeDesc: `Vulnerability ${vuln.id}` })];
+		const results = affects.length > 0 ? affects.map((affect) => createResult(ResultStatus.Failed, void 0, {
+			codeDesc: formatCodeDesc$4(componentLookup, affect.ref),
+			startTime: scanTime
+		})) : [createResult(ResultStatus.Failed, void 0, {
+			codeDesc: `Vulnerability ${vuln.id}`,
+			startTime: scanTime
+		})];
 		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
 		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
 		const controlType = deriveControlTypeFromTags(nist);
@@ -3889,7 +3942,7 @@ async function convertCyclonedxToHdf(input) {
 			name: targetName,
 			type: TargetType.Application
 		}],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -4060,7 +4113,7 @@ async function convertSplunkToHdf(input) {
 				const descriptions = convertDescriptions(control.descriptions);
 				const results = Array.isArray(control.results) ? control.results.map((result) => createResult(mapStatus$1(result.status), result.message, {
 					codeDesc: result.code_desc,
-					startTime: new Date(result.start_time),
+					startTime: parseTimestamp(result.start_time) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
 					runTime: result.run_time,
 					exception: result.exception,
 					backtrace: result.backtrace
@@ -4083,7 +4136,7 @@ async function convertSplunkToHdf(input) {
 			allBaselines.push(createMinimalBaseline(profile.name, requirements, baselineOptions));
 		}
 	}
-	const hdf = {
+	return serializeHdf({
 		baselines: allBaselines,
 		components: [{
 			name: targetName,
@@ -4095,8 +4148,7 @@ async function convertSplunkToHdf(input) {
 			name: "splunk-to-hdf",
 			version: "1.0.0"
 		}
-	};
-	return JSON.stringify(hdf, null, 2);
+	});
 }
 //#endregion
 //#region converters/hdf-to-xml/typescript/converter.ts
@@ -4306,7 +4358,7 @@ async function convertGitlabToHdf(input) {
 		const result = {
 			status: ResultStatus.Failed,
 			codeDesc: buildCodeDesc$4(scanType, vuln.location),
-			startTime: startTime ? new Date(startTime) : /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
+			startTime: startTime ? parseTimestamp(startTime) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z") : /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 		};
 		const impact = gitlabSeverityToImpact(vuln.severity ?? "Unknown");
 		const req = {
@@ -4324,7 +4376,7 @@ async function convertGitlabToHdf(input) {
 	}
 	const label = scanTypeLabel(scanType);
 	if (requirements.length === 0) {
-		const ts = startTime ? new Date(startTime) : /* @__PURE__ */ new Date();
+		const ts = startTime ? parseTimestamp(startTime) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
 		requirements.push(buildNoFindingsRequirement("gitlab-no-findings", `GitLab ${label} scan via ${scannerName} reported zero findings.`, ts));
 	}
 	const baseline = createMinimalBaseline("GitLab Security Scan", requirements, {
@@ -4352,8 +4404,11 @@ async function convertGitlabToHdf(input) {
 		},
 		tool
 	};
-	if (report.scan?.end_time) hdf.timestamp = new Date(report.scan.end_time);
-	return JSON.stringify(hdf, null, 2);
+	if (report.scan?.end_time) {
+		const endTime = parseTimestamp(report.scan.end_time);
+		if (endTime) hdf.timestamp = endTime;
+	}
+	return serializeHdf(hdf);
 }
 //#endregion
 //#region converters/trufflehog-to-hdf/typescript/converter.ts
@@ -4420,8 +4475,8 @@ function buildCodeDesc$3(f) {
 */
 function getTimestamp(f) {
 	if (f.SourceMetadata?.Data?.Git?.timestamp) {
-		const ts = new Date(f.SourceMetadata.Data.Git.timestamp);
-		if (!isNaN(ts.getTime())) return ts;
+		const ts = parseTimestamp(f.SourceMetadata.Data.Git.timestamp);
+		if (ts) return ts;
 	}
 	return /* @__PURE__ */ new Date();
 }
@@ -4512,7 +4567,7 @@ async function convertTrufflehogToHdf(input) {
 		name: repoURL,
 		type: TargetType.Repository
 	}];
-	return JSON.stringify(hdf, null, 2);
+	return serializeHdf(hdf);
 }
 //#endregion
 //#region converters/burpsuite-to-hdf/typescript/converter.ts
@@ -4594,8 +4649,8 @@ async function convertBurpsuiteToHdf(input) {
 		},
 		tool
 	};
-	if (exportTime) hdf.timestamp = new Date(exportTime);
-	return JSON.stringify(hdf, null, 2);
+	if (exportTime) hdf.timestamp = parseTimestamp(exportTime) ?? void 0;
+	return serializeHdf(hdf);
 }
 function buildRequirement$11(issueType, issues) {
 	const rep = issues[0];
@@ -4702,15 +4757,31 @@ function formatSummary(f) {
 		`IP Address, Port, Instance : ${f["IP Address, Port, Instance"] ?? ""}`
 	].join("\n");
 }
+const MONTH_ABBR = {
+	Jan: "01",
+	Feb: "02",
+	Mar: "03",
+	Apr: "04",
+	May: "05",
+	Jun: "06",
+	Jul: "07",
+	Aug: "08",
+	Sep: "09",
+	Oct: "10",
+	Nov: "11",
+	Dec: "12"
+};
 /**
-* Parses DBProtect date format "Feb 18 2021 15:57"
+* Parses DBProtect date formats ("Feb 18 2021 15:57" or "2021-02-18 15:55").
+* Month-name values are normalized to ISO so parseTimestamp interprets them as
+* UTC, matching the Go peer and keeping output host-timezone-independent.
 */
 function parseDate(dateStr) {
 	const trimmed = dateStr.trim();
-	if (!trimmed) return /* @__PURE__ */ new Date();
-	const parsed = new Date(trimmed);
-	if (!isNaN(parsed.getTime())) return parsed;
-	return /* @__PURE__ */ new Date();
+	const ZERO = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
+	if (!trimmed) return ZERO;
+	const month = /^([A-Z][a-z]{2}) (\d{1,2}) (\d{4}) (\d{2}:\d{2})$/.exec(trimmed);
+	return parseTimestamp(month ? `${month[3]}-${MONTH_ABBR[month[1]] ?? "00"}-${month[2].padStart(2, "0")} ${month[4]}` : trimmed) ?? ZERO;
 }
 /**
 * Builds a single EvaluatedRequirement from a group of findings sharing a Check ID.
@@ -4989,7 +5060,7 @@ function buildRequirement$9(vuln, packageTypes, distro) {
 		label: "default",
 		data: vuln.description
 	}];
-	const startTime = vuln.discoveredDate ? new Date(vuln.discoveredDate) : void 0;
+	const startTime = (vuln.discoveredDate ? parseTimestamp(vuln.discoveredDate) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const results = [createResult(ResultStatus.Failed, void 0, {
 		codeDesc: formatCodeDesc$2(vuln),
 		startTime
@@ -5121,7 +5192,7 @@ function buildRequirement$8(finding, timestamp) {
 	const codeDesc = finding.vulnerability.recommendation ?? "No recommendation available";
 	const results = [createResult(ResultStatus.Failed, void 0, {
 		codeDesc,
-		startTime: timestamp ? new Date(timestamp) : void 0
+		startTime: (timestamp ? parseTimestamp(timestamp) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	})];
 	const req = createRequirement(finding.matrix, getTitle$1(finding), descriptions, getImpact$5(finding.vulnerability.severity), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -5242,7 +5313,7 @@ function formatCodeDesc$1(entry) {
 /**
 * Builds a single EvaluatedRequirement from a group of entries sharing an ID.
 */
-function buildRequirement$7(entryID, entries) {
+function buildRequirement$7(entryID, entries, scanTime) {
 	const rep = entries[0];
 	const cweIDs = extractCWEs$1(rep);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
@@ -5255,7 +5326,10 @@ function buildRequirement$7(entryID, entries) {
 		label: "default",
 		data: formatDescription(rep)
 	}];
-	const results = entries.map((entry) => createResult(ResultStatus.Failed, void 0, { codeDesc: formatCodeDesc$1(entry) }));
+	const results = entries.map((entry) => createResult(ResultStatus.Failed, void 0, {
+		codeDesc: formatCodeDesc$1(entry),
+		startTime: scanTime
+	}));
 	const req = createRequirement(entryID, rep.summary, descriptions, severityToImpact(rep.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -5315,6 +5389,7 @@ async function convertJfrogXrayToHdf(input) {
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseJSON(input);
 	if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.data)) throw new Error("jfrog-xray: invalid JSON structure");
+	const scanTime = /* @__PURE__ */ new Date();
 	const { items: limitedEntries, truncated } = limitArray(parsed.data);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedEntries.length} entries (original: ${parsed.data.length})`);
@@ -5331,8 +5406,8 @@ async function convertJfrogXrayToHdf(input) {
 		else groups.set(id, [entry]);
 	}
 	const requirements = [];
-	for (const [entryID, entries] of groups) requirements.push(buildRequirement$7(entryID, entries));
-	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("jfrog-xray-no-findings", "JFrog Xray scanned the target artifact and reported zero vulnerable components.", /* @__PURE__ */ new Date()));
+	for (const [entryID, entries] of groups) requirements.push(buildRequirement$7(entryID, entries, scanTime));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("jfrog-xray-no-findings", "JFrog Xray scanned the target artifact and reported zero vulnerable components.", scanTime));
 	return buildHdfResults({
 		generatorName: "jfrog-xray-to-hdf",
 		converterVersion: "1.0.0",
@@ -5343,7 +5418,7 @@ async function convertJfrogXrayToHdf(input) {
 			name: "JFrog Xray Scan",
 			type: TargetType.Application
 		}],
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -5387,7 +5462,7 @@ function vulnMessage(vuln) {
 /**
 * Builds a single EvaluatedRequirement from a NeuVector vulnerability.
 */
-function buildRequirement$6(vuln) {
+function buildRequirement$6(vuln, scanTime) {
 	const cweIDs = extractCWEs(vuln.description);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_REMEDIATION_NIST_TAGS);
 	const tags = {
@@ -5399,7 +5474,10 @@ function buildRequirement$6(vuln) {
 		label: "default",
 		data: vuln.description
 	}];
-	const results = [createResult(ResultStatus.Failed, vulnMessage(vuln), { codeDesc: "" })];
+	const results = [createResult(ResultStatus.Failed, vulnMessage(vuln), {
+		codeDesc: "",
+		startTime: scanTime
+	})];
 	const req = createRequirement(vulnID(vuln), vulnTitle(vuln), descriptions, getImpact$4(vuln), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -5450,17 +5528,17 @@ async function convertNeuvectorToHdf(input) {
 	const { items: limitedVulns, truncated } = limitArray(scan.report.vulnerabilities ?? []);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${scan.report.vulnerabilities.length})`);
+	const scanTime = /* @__PURE__ */ new Date();
 	const seen = /* @__PURE__ */ new Set();
 	const requirements = [];
 	for (const vuln of limitedVulns) {
 		const id = vulnID(vuln);
 		if (seen.has(id)) continue;
 		seen.add(id);
-		requirements.push(buildRequirement$6(vuln));
+		requirements.push(buildRequirement$6(vuln, scanTime));
 	}
-	const now = /* @__PURE__ */ new Date();
 	const target = targetNameFromReport(scan.report);
-	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("neuvector-no-findings", `NeuVector scanned ${target} and reported zero vulnerable components.`, now));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("neuvector-no-findings", `NeuVector scanned ${target} and reported zero vulnerable components.`, scanTime));
 	return buildHdfResults({
 		generatorName: "neuvector-to-hdf",
 		converterVersion: "1.0.0",
@@ -5478,7 +5556,7 @@ async function convertNeuvectorToHdf(input) {
 				registry: scan.report.registry
 			}
 		}],
-		timestamp: now
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -5553,7 +5631,7 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 	const results = limitedVulns.map((vuln) => ({
 		status: ResultStatus.Failed,
 		codeDesc: buildCodeDesc$2(vuln, snippetMap),
-		startTime: new Date(startTimeStr)
+		startTime: parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date()
 	}));
 	const req = {
 		id: desc.classID ?? "unknown",
@@ -5619,8 +5697,8 @@ async function convertFortifyToHdf(input) {
 			format: "FVDL"
 		}
 	};
-	if (createdDate) hdfResult.timestamp = new Date(startTimeStr);
-	return JSON.stringify(hdfResult, null, 2);
+	if (createdDate) hdfResult.timestamp = parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date();
+	return serializeHdf(hdfResult);
 }
 //#endregion
 //#region converters/prisma-to-hdf/typescript/converter.ts
@@ -5704,7 +5782,7 @@ function makeTitle(rec) {
 /**
 * Builds a single EvaluatedRequirement from a Prisma record.
 */
-function buildRequirement$4(rec) {
+function buildRequirement$4(rec, scanTime) {
 	const id = makeRequirementID(rec);
 	const title = makeTitle(rec);
 	const codeDesc = makeCodeDesc(rec);
@@ -5718,7 +5796,10 @@ function buildRequirement$4(rec) {
 		label: "default",
 		data: rec.Description
 	}];
-	const results = [createResult(ResultStatus.Failed, message, { codeDesc })];
+	const results = [createResult(ResultStatus.Failed, message, {
+		codeDesc,
+		startTime: scanTime
+	})];
 	const req = createRequirement(id, title, descriptions, getImpact$3(rec.Severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -5781,8 +5862,8 @@ function groupByHostname(records) {
 /**
 * Builds an HDF baseline from all records for a single host.
 */
-function buildBaseline(hostname, records, resultsChecksum) {
-	return createMinimalBaseline("Prisma Cloud Scan", limitArrayWithWarning(records, "finding").map((rec) => buildRequirement$4(rec)), {
+function buildBaseline(hostname, records, resultsChecksum, scanTime) {
+	return createMinimalBaseline("Prisma Cloud Scan", limitArrayWithWarning(records, "finding").map((rec) => buildRequirement$4(rec, scanTime)), {
 		resultsChecksum,
 		title: `Prisma Cloud Scan (${hostname})`
 	});
@@ -5801,16 +5882,17 @@ async function convertPrismaToHdf(input) {
 	for (const col of REQUIRED_COLUMNS) if (!headers.includes(col)) throw new Error(`prisma: missing required CSV column "${col}"`);
 	const records = parseCsv(input);
 	const resultsChecksum = await inputChecksum(input);
+	const scanTime = /* @__PURE__ */ new Date();
 	const baselines = [];
 	const components = [];
-	if (records.length === 0) baselines.push(createMinimalBaseline("Prisma Cloud Scan", [buildNoFindingsRequirement("prisma-no-findings", "Prisma Cloud scanned the workload and reported zero vulnerable components.", /* @__PURE__ */ new Date())], {
+	if (records.length === 0) baselines.push(createMinimalBaseline("Prisma Cloud Scan", [buildNoFindingsRequirement("prisma-no-findings", "Prisma Cloud scanned the workload and reported zero vulnerable components.", scanTime)], {
 		resultsChecksum,
 		title: "Prisma Cloud Scan"
 	}));
 	else {
 		const hostGroups = groupByHostname(records);
 		for (const [hostname, hostRecords] of hostGroups) {
-			baselines.push(buildBaseline(hostname, hostRecords, resultsChecksum));
+			baselines.push(buildBaseline(hostname, hostRecords, resultsChecksum, scanTime));
 			components.push({
 				name: hostname,
 				type: TargetType.Host
@@ -5824,7 +5906,7 @@ async function convertPrismaToHdf(input) {
 		toolFormat: "CSV",
 		baselines,
 		components,
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -5840,6 +5922,15 @@ const IMPACT_MAPPING$3 = {
 function getImpact$2(severity) {
 	return IMPACT_MAPPING$3[severity.toLowerCase()] ?? .5;
 }
+const NETSPARKER_US_DATETIME = /^\d{2}\/\d{2}\/\d{4} \d{1,2}:\d{2} (AM|PM)$/;
+function parseNetsparkerTimestamp(s) {
+	const trimmed = s.trim();
+	if (NETSPARKER_US_DATETIME.test(trimmed)) {
+		const d = /* @__PURE__ */ new Date(`${trimmed} GMT`);
+		if (!isNaN(d.getTime())) return d;
+	}
+	return parseTimestamp(s);
+}
 function formatCodeDesc(request) {
 	const parts = [];
 	parts.push(`http-request : ${request?.content ?? ""}`);
@@ -5921,7 +6012,7 @@ function buildRequirement$3(vuln, initiated) {
 	});
 	const codeDesc = formatCodeDesc(vuln["http-request"]);
 	const message = formatMessage$1(vuln["http-response"]);
-	const startTime = initiated ? new Date(initiated) : /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
+	const startTime = (initiated ? parseNetsparkerTimestamp(initiated) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const results = [{
 		status: ResultStatus.Failed,
 		codeDesc,
@@ -5967,8 +6058,7 @@ async function convertNetsparkerToHdf(input) {
 	const targetName = target.url ?? "Unknown";
 	const requirements = limitedVulns.map((vuln) => buildRequirement$3(vuln, initiated));
 	if (requirements.length === 0) {
-		const initiatedDate = initiated ? new Date(initiated) : /* @__PURE__ */ new Date();
-		const startTime = isNaN(initiatedDate.getTime()) ? /* @__PURE__ */ new Date() : initiatedDate;
+		const startTime = (initiated ? parseNetsparkerTimestamp(initiated) : null) ?? /* @__PURE__ */ new Date();
 		requirements.push(buildNoFindingsRequirement("netsparker-no-findings", `${toolName} scanned ${targetName} and reported zero findings.`, startTime));
 	}
 	return buildHdfResults({
@@ -6075,7 +6165,7 @@ function buildRequirement$2(ruleID, finding, startTime) {
 	});
 	const resultObj = createResult(getStatus$1(finding.checked_items, finding.flagged_items), getMessage(finding.checked_items, finding.flagged_items, finding.items), {
 		codeDesc: finding.description,
-		startTime: startTime ? new Date(startTime) : void 0
+		startTime: (startTime ? parseTimestamp(startTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	});
 	const req = createRequirement(ruleID, finding.description, descriptions, getImpact$1(finding.level), [resultObj], { tags });
 	const controlType = deriveControlTypeFromTags(nist);
@@ -6120,7 +6210,7 @@ async function convertScoutsuiteToHdf(input) {
 				provider: report.provider_code ?? report.provider_name
 			}
 		}],
-		timestamp: report.last_run.time ? new Date(report.last_run.time) : /* @__PURE__ */ new Date()
+		timestamp: report.last_run.time ? parseTimestamp(report.last_run.time) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date()
 	});
 }
 //#endregion
@@ -6217,7 +6307,7 @@ function buildRequirementFromResult(result, filename) {
 	}];
 	const scannerName = result.response.service_name;
 	const startTimeStr = result.response.milestones?.service_started ?? "";
-	const startTime = startTimeStr ? new Date(startTimeStr) : /* @__PURE__ */ new Date();
+	const startTime = (startTimeStr ? parseTimestamp(startTimeStr) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const score = result.result.score;
 	const status = determineStatus(score);
 	let results;
@@ -6305,7 +6395,7 @@ async function convertConveyorToHdf(input) {
 /** Attribute prefix used by fast-xml-parser — all XML attributes are accessed via `@_name`. */
 const A = "@_";
 /** Veracode severity level (0-5) to HDF impact mapping. */
-const IMPACT_MAPPING$2 = new Map([
+const IMPACT_MAPPING$2 = /* @__PURE__ */ new Map([
 	["5", .9],
 	["4", .7],
 	["3", .5],
@@ -6327,9 +6417,7 @@ function decodeXmlEntities(s) {
 /** Parse Veracode timestamp format ("2021-12-29 22:16:36 UTC") to Date. */
 function parseVeracodeTimestamp(ts) {
 	if (!ts) return void 0;
-	const decoded = decodeXmlEntities(ts);
-	const d = new Date(decoded.replace(" UTC", "Z").replace(" ", "T"));
-	return isNaN(d.getTime()) ? void 0 : d;
+	return parseTimestamp(decodeXmlEntities(ts).replace(" UTC", "Z").replace(" ", "T")) ?? void 0;
 }
 /** Format description paragraphs into text. */
 function formatDesc(desc) {
@@ -6647,7 +6735,7 @@ function buildRequirement$1(cs, profiles, createdDateTime) {
 		});
 	}
 	const codeDesc = cs.implementationStatus || "No implementation status provided";
-	const startTime = createdDateTime ? new Date(createdDateTime) : void 0;
+	const startTime = (createdDateTime ? parseTimestamp(createdDateTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const req = createRequirement(id, title, descriptions, impact, [createResult(status, void 0, {
 		codeDesc,
 		...startTime ? { startTime } : {}
@@ -6829,7 +6917,7 @@ function extractSubscriptionID(resourcePath) {
 /**
 * Converts a group of assessments sharing an assessment ID into one EvaluatedRequirement.
 */
-function buildRequirement(assessmentID, assessments) {
+function buildRequirement(assessmentID, assessments, scanTime) {
 	const rep = assessments[0];
 	const meta = rep.properties.metadata;
 	const impact = IMPACT_MAPPING$1[meta.severity.toLowerCase()] ?? .5;
@@ -6850,7 +6938,7 @@ function buildRequirement(assessmentID, assessments) {
 		label: "fix",
 		data: meta.remediationDescription
 	});
-	const results = assessments.map(buildResultFromAssessment);
+	const results = assessments.map((a) => buildResultFromAssessment(a, scanTime));
 	const req = createRequirement(assessmentID, rep.properties.displayName, descriptions, impact, results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	return req;
@@ -6858,10 +6946,13 @@ function buildRequirement(assessmentID, assessments) {
 /**
 * Converts a single assessment into an HDF RequirementResult.
 */
-function buildResultFromAssessment(a) {
+function buildResultFromAssessment(a, scanTime) {
 	const status = mapStatus(a.properties.status.code);
 	const codeDesc = `Resource: ${a.properties.resourceDetails.id}`;
-	return createResult(status, a.properties.status.description || a.properties.status.cause || void 0, { codeDesc });
+	return createResult(status, a.properties.status.description || a.properties.status.cause || void 0, {
+		codeDesc,
+		startTime: scanTime
+	});
 }
 /**
 * Converts Microsoft Defender for Cloud assessment output to HDF format.
@@ -6871,6 +6962,7 @@ function buildResultFromAssessment(a) {
 */
 async function convertMsftDefenderCloudToHdf(input) {
 	validateInputSize(input, "msft-defender-cloud");
+	const scanTime = /* @__PURE__ */ new Date();
 	const resultsChecksum = await inputChecksum(input);
 	const raw = parseJSON(input);
 	if (!raw || typeof raw !== "object") throw new Error("Invalid Defender for Cloud structure: not a valid JSON object");
@@ -6885,11 +6977,11 @@ async function convertMsftDefenderCloudToHdf(input) {
 		else groups.set(a.name, [a]);
 	}
 	const requirements = [];
-	for (const [assessmentID, assessments] of groups) requirements.push(buildRequirement(assessmentID, assessments));
+	for (const [assessmentID, assessments] of groups) requirements.push(buildRequirement(assessmentID, assessments, scanTime));
 	const subscriptionID = limitedAssessments.length > 0 ? extractSubscriptionID(limitedAssessments[0].id) : "";
 	if (requirements.length === 0) {
 		const targetName = subscriptionID || "Unknown";
-		requirements.push(buildNoFindingsRequirement("msft-defender-cloud-no-findings", `Microsoft Defender for Cloud scanned ${targetName} and reported zero findings.`, /* @__PURE__ */ new Date()));
+		requirements.push(buildNoFindingsRequirement("msft-defender-cloud-no-findings", `Microsoft Defender for Cloud scanned ${targetName} and reported zero findings.`, scanTime));
 	}
 	const baseline = createMinimalBaseline("Microsoft Defender for Cloud Assessments", requirements, { resultsChecksum });
 	const components = [];
@@ -6910,7 +7002,7 @@ async function convertMsftDefenderCloudToHdf(input) {
 		toolFormat: "JSON",
 		baselines: [baseline],
 		components,
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -7007,13 +7099,26 @@ function buildTags$1(alert) {
 	return tags;
 }
 /**
+* Resolves a clean per-finding source timestamp, falling back to the conversion time.
+*/
+function resolveStartTime(alert, scanTime) {
+	const first = alert.firstActivityDateTime ? parseTimestamp(alert.firstActivityDateTime) : null;
+	if (first) return first;
+	const created = alert.createdDateTime ? parseTimestamp(alert.createdDateTime) : null;
+	if (created) return created;
+	return scanTime;
+}
+/**
 * Converts a single MDE alert to an HDF EvaluatedRequirement.
 */
-function alertToRequirement(alert) {
+function alertToRequirement(alert, scanTime) {
 	const impact = severityToImpact$1(alert.severity);
 	const status = statusToResultStatus(alert.status, alert.classification);
 	const codeDesc = formatEvidence(alert.evidence ?? []);
-	const results = [createResult(status, formatMessage(alert), { codeDesc })];
+	const results = [createResult(status, formatMessage(alert), {
+		codeDesc,
+		startTime: resolveStartTime(alert, scanTime)
+	})];
 	const descriptions = [{
 		label: "default",
 		data: alert.description
@@ -7043,10 +7148,11 @@ async function convertMsftDefenderEndpointToHdf(input) {
 	const response = parseJSON(input);
 	if (!response || typeof response !== "object") throw new Error("Invalid Microsoft Defender for Endpoint structure: not a valid JSON object");
 	if (!Array.isArray(response.value)) throw new Error("Invalid Microsoft Defender for Endpoint structure: missing or invalid value array");
+	const scanTime = /* @__PURE__ */ new Date();
 	const { items: limitedAlerts, truncated } = limitArray(response.value);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedAlerts.length} alert items (original: ${response.value.length})`);
-	const requirements = limitedAlerts.map(alertToRequirement);
+	const requirements = limitedAlerts.map((alert) => alertToRequirement(alert, scanTime));
 	const seenTargets = /* @__PURE__ */ new Set();
 	const components = [];
 	for (const alert of limitedAlerts) {
@@ -7056,14 +7162,14 @@ async function convertMsftDefenderEndpointToHdf(input) {
 			components.push(target);
 		}
 	}
-	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("msft-defender-endpoint-no-findings", "Microsoft Defender for Endpoint scanned the tenant and reported zero findings.", /* @__PURE__ */ new Date()));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("msft-defender-endpoint-no-findings", "Microsoft Defender for Endpoint scanned the tenant and reported zero findings.", scanTime));
 	return buildHdfResults({
 		generatorName: "msft-defender-endpoint-to-hdf",
 		converterVersion: "1.0.0",
 		toolName: "Microsoft Defender for Endpoint",
 		baselines: [createMinimalBaseline("Microsoft Defender for Endpoint Scan", requirements, { resultsChecksum })],
 		components,
-		timestamp: /* @__PURE__ */ new Date()
+		timestamp: scanTime
 	});
 }
 //#endregion
@@ -7097,7 +7203,7 @@ function wrap(value) {
 	return { "#text": value };
 }
 /** Map HDF impact (0.0-1.0) to XCCDF severity string. */
-function impactToSeverity$1(impact) {
+function impactToSeverity$2(impact) {
 	if (impact >= .7) return "high";
 	if (impact >= .4) return "medium";
 	if (impact >= .1) return "low";
@@ -7151,7 +7257,7 @@ function buildRuleObj(req) {
 	const ruleId = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
 	const rule = {
 		[`${ATTR}id`]: ruleId,
-		[`${ATTR}severity`]: impactToSeverity$1(req.impact),
+		[`${ATTR}severity`]: impactToSeverity$2(req.impact),
 		[`${ATTR}selected`]: "true",
 		title: wrap(req.title ?? req.id)
 	};
@@ -7341,7 +7447,7 @@ function nistTagToControlId(tag) {
 * Converts a 0.0-1.0 impact value to an OSCAL severity string.
 * This is the reverse of extractRiskSeverity.
 */
-function impactToSeverity(impact) {
+function impactToSeverity$1(impact) {
 	if (impact >= .9) return "critical";
 	if (impact >= .7) return "high";
 	if (impact >= .4) return "moderate";
@@ -7496,7 +7602,7 @@ function requirementToFindingSet(req, timestamp) {
 	let risk;
 	if (req.impact > 0) {
 		const riskUUID = crypto.randomUUID();
-		const severity = impactToSeverity(req.impact);
+		const severity = impactToSeverity$1(req.impact);
 		risk = {
 			uuid: riskUUID,
 			title: `Risk for ${req.id}`,
@@ -8614,7 +8720,7 @@ function buildVulnerability(group) {
 				v.flags.push({
 					label: String(o.justification),
 					product_ids: pids,
-					date: new Date(o.appliedAt).toISOString().replace(/\.\d+Z$/, "Z")
+					date: formatTimestampSeconds(new Date(o.appliedAt))
 				});
 			}
 			emitted = true;
@@ -8678,7 +8784,7 @@ function buildVulnerability(group) {
 	return v;
 }
 function buildDocument(amendments, converterVersion) {
-	const now = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
+	const now = formatTimestampSeconds(/* @__PURE__ */ new Date());
 	const publisherName = amendments.appliedBy?.identifier || "HDF Amendments Export";
 	const trackingId = amendments.amendmentId || "HDF-VEX-EXPORT";
 	const docVersion = amendments.version || "1";
@@ -8758,7 +8864,7 @@ async function convertHdfToOpenVex(input, converterVersion) {
 		"@id": await buildDocumentID(input, amendments),
 		author,
 		role,
-		timestamp: (earliest ?? /* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z"),
+		timestamp: formatTimestampSeconds(earliest ?? /* @__PURE__ */ new Date()),
 		version: 1,
 		statements
 	};
@@ -8775,7 +8881,7 @@ function overrideToStatement(o) {
 			"@id": `https://nvd.nist.gov/vuln/detail/${o.requirementId}`
 		},
 		status: String(canonical),
-		timestamp: new Date(o.appliedAt).toISOString().replace(/\.\d+Z$/, "Z"),
+		timestamp: formatTimestampSeconds(new Date(o.appliedAt)),
 		products: productsFor(o)
 	};
 	if (canonical === VexStatus.NotAffected) {
@@ -8942,7 +9048,7 @@ function allMilestonesCompleted(o) {
 }
 function buildMetadata(a, docTime, converterVersion) {
 	const metadata = {
-		timestamp: docTime.toISOString().replace(/\.\d+Z$/, "Z"),
+		timestamp: formatTimestampSeconds(docTime),
 		tools: [{
 			vendor: "mitre",
 			name: "hdf-to-cyclonedx-vex",
@@ -9655,7 +9761,7 @@ async function convertOscalPoamToHdf(input) {
 	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
 	const systemRef = poam["import-ssp"]?.href || void 0;
 	const appliedBy = extractAppliedBy(poam.metadata);
-	const amendments = {
+	return serializeHdf({
 		name: toKebabCase(poam.metadata.title, "oscal-poam"),
 		overrides,
 		integrity,
@@ -9666,8 +9772,7 @@ async function convertOscalPoamToHdf(input) {
 			name: "oscal-poam-to-hdf",
 			version: "1.0.0"
 		}
-	};
-	return JSON.stringify(amendments, null, 2);
+	});
 }
 function buildRiskMap$1(risks) {
 	const m = /* @__PURE__ */ new Map();
@@ -9740,8 +9845,8 @@ function poamItemAppliedBy(poam) {
 }
 function poamItemAppliedAt(poam) {
 	if (poam.metadata["last-modified"]) {
-		const t = new Date(poam.metadata["last-modified"]);
-		if (!isNaN(t.getTime())) return t;
+		const t = parseTimestamp(String(poam.metadata["last-modified"]));
+		if (t) return t;
 	}
 	return /* @__PURE__ */ new Date();
 }
@@ -9799,18 +9904,23 @@ async function convertOscalSarToHdf(input) {
 	if (!doc["assessment-results"]) throw new Error("oscal-assessment-results: input is not an assessment-results document (root key is not 'assessment-results')");
 	const sar = doc["assessment-results"];
 	const meta = extractMetadata(sar.metadata);
+	const scanTime = /* @__PURE__ */ new Date();
 	const baselines = [];
 	for (const result of sar.results) {
-		const baseline = await resultToEvaluatedBaseline(result, sar, input);
+		if (!result.findings || result.findings.length === 0) {
+			console.warn(`WARNING: Skipping assessment result "${result.title || result.uuid}": no findings (empty result set)`);
+			continue;
+		}
+		const baseline = await resultToEvaluatedBaseline(result, sar, input, scanTime);
 		baselines.push(baseline);
 	}
 	const planRef = sar["import-ap"]?.href || void 0;
 	let timestamp;
 	if (meta.lastModified) {
-		const t = new Date(meta.lastModified);
-		if (!isNaN(t.getTime())) timestamp = t;
+		const t = parseTimestamp(meta.lastModified);
+		if (t) timestamp = t;
 	}
-	return JSON.stringify({
+	return serializeHdf({
 		baselines,
 		generator: {
 			name: "oscal-assessment-results-to-hdf",
@@ -9822,9 +9932,9 @@ async function convertOscalSarToHdf(input) {
 		},
 		timestamp: timestamp ?? /* @__PURE__ */ new Date(),
 		planRef
-	}, null, 2);
+	});
 }
-async function resultToEvaluatedBaseline(result, sar, rawInput) {
+async function resultToEvaluatedBaseline(result, sar, rawInput, scanTime) {
 	const checksum = await inputChecksum(rawInput);
 	const obsMap = buildObservationMap(result.observations ?? []);
 	const riskMap = buildRiskMap(result.risks ?? []);
@@ -9841,7 +9951,7 @@ async function resultToEvaluatedBaseline(result, sar, rawInput) {
 	}
 	const requirements = [];
 	for (const controlId of controlOrder) {
-		const req = findingsToEvaluatedRequirement(controlId, controlMap.get(controlId), obsMap, riskMap, result);
+		const req = findingsToEvaluatedRequirement(controlId, controlMap.get(controlId), obsMap, riskMap, result, scanTime);
 		requirements.push(req);
 	}
 	const baseline = createMinimalBaseline(sarBaselineName(result, sar), requirements, {
@@ -9853,26 +9963,26 @@ async function resultToEvaluatedBaseline(result, sar, rawInput) {
 	if (result.description) baseline.description = result.description;
 	return baseline;
 }
-function findingsToEvaluatedRequirement(controlId, findings, obsMap, riskMap, result) {
+function findingsToEvaluatedRequirement(controlId, findings, obsMap, riskMap, result, scanTime) {
 	const nistTag = controlIdToNistTag(controlId);
 	const title = findings[0].title || nistTag;
 	const impact = sarFindingsImpact(findings, riskMap);
 	const descriptions = sarBuildDescriptions(findings, obsMap);
 	const results = [];
-	for (const f of findings) results.push(findingToRequirementResult(f, obsMap, riskMap, result));
+	for (const f of findings) results.push(findingToRequirementResult(f, obsMap, riskMap, result, scanTime));
 	const req = createRequirement(nistTag, title, descriptions, impact, results, { tags: { nist: [nistTag] } });
 	const controlType = deriveControlTypeFromTags([nistTag]);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
 }
-function findingToRequirementResult(f, obsMap, riskMap, result) {
+function findingToRequirementResult(f, obsMap, riskMap, result, scanTime) {
 	const status = mapFindingStatus(f);
 	const codeDesc = buildCodeDesc(f, obsMap);
 	const message = buildRiskMessage(f, riskMap);
 	const startTime = parseResultStartTime(result);
 	return createResult(status, message || void 0, {
 		codeDesc,
-		startTime: startTime.getTime() > 0 ? startTime : void 0
+		startTime: startTime.getTime() > 0 ? startTime : scanTime
 	});
 }
 function extractControlIdFromFinding(f) {
@@ -9967,8 +10077,8 @@ function buildRiskMap(risks) {
 }
 function parseResultStartTime(result) {
 	if (result.start) {
-		const t = new Date(result.start);
-		if (!isNaN(t.getTime())) return t;
+		const t = parseTimestamp(String(result.start));
+		if (t) return t;
 	}
 	return /* @__PURE__ */ new Date(0);
 }