@mitre/hdf-converters 3.3.1 → 3.4.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { n as detectConverter, t as registerAllFingerprints } from "./register-all-DxZN6IJ4.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
-import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact } from "@mitre/hdf-schema";
+import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
+import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
 /**
@@ -153,6 +153,34 @@ function validateInputSize(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZ
 	if (input.length > maxSize) throw new Error(`${converterName}: input exceeds maximum allowed size of ${maxSize} characters`);
 }
 /**
+* Parse an HDF document. The single ingest point for every HDF-consuming
+* converter: real HDF carries zone-less timestamps (InSpec emits startTime with
+* no offset), so the raw JSON is normalized to canonical trimmed-UTC RFC3339
+* before parsing — otherwise the non-canonical value is laundered into the
+* converter's output (and Go, whose schema types decode date-time into
+* time.Time, rejects the document outright).
+*/
+function parseHdf(input) {
+	return parseJSON(normalizeHdfTimestamps(input));
+}
+/**
+* Read a timestamp field off a parsed HDF document.
+*
+* The generated schema types these as `Date` (startTime, appliedAt, ...), but
+* JSON.parse does not revive Dates, so at runtime they are strings. Reaching for
+* `new Date(value)` to bridge that gap reads a zone-less timestamp as host-local,
+* where Go reads it as UTC — so the same document converts differently depending
+* on the machine. parseTimestamp reads it as UTC, matching Go.
+*
+* Returns null when the field is absent or unparseable; callers decide the
+* fallback, since a missing time is not the same as the epoch.
+*/
+function hdfTime(value) {
+	if (value instanceof Date) return value;
+	if (value === void 0 || value === null || value === "") return null;
+	return parseTimestamp(String(value));
+}
+/**
 * Normalise a value that may be a single item, an array, undefined, or null
 * into a guaranteed array.
 *
@@ -505,6 +533,7 @@ function convertResult(v1Result) {
 	if (v1Result.run_time !== void 0) v2Result.runTime = v1Result.run_time;
 	v2Result.startTime = legacyStartTime(v1Result.start_time);
 	if (v1Result.message !== void 0) v2Result.message = v1Result.message;
+	else if (v1Result.skip_message !== void 0) v2Result.message = v1Result.skip_message;
 	if (v1Result.exception !== void 0) v2Result.exception = v1Result.exception;
 	if (v1Result.backtrace !== void 0) v2Result.backtrace = v1Result.backtrace;
 	if (v1Result.resource_class !== void 0) v2Result.resource = v1Result.resource_class;
@@ -512,6 +541,59 @@ function convertResult(v1Result) {
 	return v2Result;
 }
 /**
+* Convert a v1 ref value (a string or an array of objects) to the v2
+* Reference.ref union value. Returns undefined when there is no content (e.g.
+* an empty array), so callers can drop empty references — matching the Go
+* converter's toRef.
+*/
+function toRefValue(raw) {
+	if (typeof raw === "string") return raw === "" ? void 0 : raw;
+	if (Array.isArray(raw)) {
+		const maps = raw.filter((e) => !!e && typeof e === "object" && !Array.isArray(e));
+		return maps.length === 0 ? void 0 : maps;
+	}
+}
+/**
+* Convert a single v1 refs[] element (a bare string or an object with
+* ref/url/uri) to a v2 Reference object. Returns null when the element carries
+* no usable content. Key order (ref, url, uri) matches the Go Reference struct.
+*/
+function convertRef(raw) {
+	if (typeof raw === "string") return raw === "" ? null : { ref: raw };
+	if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+		const m = raw;
+		const out = {};
+		let has = false;
+		const refVal = toRefValue(m.ref);
+		if (refVal !== void 0) {
+			out.ref = refVal;
+			has = true;
+		}
+		if (typeof m.url === "string" && m.url !== "") {
+			out.url = m.url;
+			has = true;
+		}
+		if (typeof m.uri === "string" && m.uri !== "") {
+			out.uri = m.uri;
+			has = true;
+		}
+		return has ? out : null;
+	}
+	return null;
+}
+/**
+* Map v1 control-level refs to v2 requirement refs, dropping empty/contentless
+* entries. Returns undefined when nothing maps.
+*/
+function convertRefs(refs) {
+	const out = [];
+	for (const raw of refs) {
+		const ref = convertRef(raw);
+		if (ref) out.push(ref);
+	}
+	return out.length ? out : void 0;
+}
+/**
 * Convert v1.0 control to v2.0 requirement.
 * Transforms field names and structure.
 */
@@ -524,6 +606,10 @@ function convertControl(v1Control) {
 	if (v1Control.descriptions !== void 0) v2Req.descriptions = v1Control.descriptions;
 	if (v1Control.tags !== void 0) v2Req.tags = v1Control.tags;
 	if (v1Control.code !== void 0) v2Req.code = v1Control.code;
+	if (Array.isArray(v1Control.refs)) {
+		const refs = convertRefs(v1Control.refs);
+		if (refs) v2Req.refs = refs;
+	}
 	if (v1Control.source_location !== void 0) v2Req.sourceLocation = v1Control.source_location;
 	if (v1Control.status !== void 0) v2Req.effectiveStatus = normalizeStatus$1(v1Control.status);
 	if (v1Control.results && Array.isArray(v1Control.results)) v2Req.results = v1Control.results.map(convertResult);
@@ -590,6 +676,26 @@ function convertDependency(v1Dep) {
 	return v2Dep;
 }
 /**
+* Map v1 profile `supports` entries (InSpec hyphenated keys) to v2
+* SupportedPlatform objects. Entries that map no recognized key are dropped.
+* Key order (platform, platformFamily, platformName, release) matches the Go
+* SupportedPlatform struct. Returns undefined when nothing maps.
+*/
+function convertSupports(supports) {
+	const out = [];
+	for (const raw of supports) {
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+		const s = raw;
+		const sp = {};
+		if (typeof s.platform === "string" && s.platform !== "") sp.platform = s.platform;
+		if (typeof s["platform-family"] === "string" && s["platform-family"] !== "") sp.platformFamily = s["platform-family"];
+		if (typeof s["platform-name"] === "string" && s["platform-name"] !== "") sp.platformName = s["platform-name"];
+		if (typeof s.release === "string" && s.release !== "") sp.release = s.release;
+		if (Object.keys(sp).length > 0) out.push(sp);
+	}
+	return out.length ? out : void 0;
+}
+/**
 * Convert v1.0 profile to v2.0 baseline.
 * Transforms field names and nested structures.
 */
@@ -602,7 +708,10 @@ function convertProfile(v1Profile) {
 	if (v1Profile.license !== void 0) v2Baseline.license = v1Profile.license;
 	if (v1Profile.copyright !== void 0) v2Baseline.copyright = v1Profile.copyright;
 	if (v1Profile.copyright_email !== void 0) v2Baseline.copyrightEmail = v1Profile.copyright_email;
-	if (v1Profile.supports?.length) v2Baseline.supports = v1Profile.supports;
+	if (v1Profile.supports?.length) {
+		const supports = convertSupports(v1Profile.supports);
+		if (supports) v2Baseline.supports = supports;
+	}
 	if (v1Profile.attributes?.length) v2Baseline.inputs = v1Profile.attributes;
 	if (v1Profile.status !== void 0) v2Baseline.status = v1Profile.status;
 	if (v1Profile.sha256) v2Baseline.integrity = {
@@ -652,7 +761,7 @@ function convertV1ToV2(v1Data) {
 			type: "host",
 			name: v1Data.platform.name
 		};
-		if (v1Data.platform.target_id) {
+		if (v1Data.platform.target_id || v1Data.platform.release !== void 0) {
 			component.osName = v1Data.platform.name;
 			if (v1Data.platform.release !== void 0) component.osVersion = v1Data.platform.release;
 		}
@@ -695,7 +804,7 @@ const IMPACT_MAPPING$9 = {
 	warning: .5,
 	note: .3
 };
-async function convertSarifToHdf(input) {
+async function convertSarifToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "sarif");
 	const resultsChecksum = await inputChecksum(input);
 	const sarif = parseJSON(input);
@@ -708,12 +817,11 @@ async function convertSarifToHdf(input) {
 	const timestamp = /* @__PURE__ */ new Date();
 	return buildHdfResults({
 		generatorName: "sarif-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: firstDriver?.name,
 		toolVersion: firstDriver?.version,
 		toolFormat: "SARIF",
 		baselines: limitedRuns.map((run) => convertRun(run, sarif.version, resultsChecksum, timestamp)),
-		components: [],
 		timestamp
 	});
 }
@@ -837,9 +945,9 @@ function convertSarifResultToHDFResults(result) {
 		const locationlessResult = {
 			status,
 			codeDesc: "No source location",
-			startTime: /* @__PURE__ */ new Date(),
-			backtrace
+			startTime: /* @__PURE__ */ new Date()
 		};
+		if (backtrace.length > 0) locationlessResult.backtrace = backtrace;
 		if (suppressionJustification) locationlessResult.message = `Suppressed: ${suppressionJustification}`;
 		results.push(locationlessResult);
 	}
@@ -891,28 +999,17 @@ function extractCweFromRule(rule) {
 		if (cweIds.length > 0) return cweIds;
 	}
 	if (rule.properties?.tags && Array.isArray(rule.properties.tags)) {
-		const cweTagPattern = /^CWE-\d+$/;
 		const cweIds = [];
-		for (const tag of rule.properties.tags) if (typeof tag === "string" && cweTagPattern.test(tag)) cweIds.push(tag);
+		for (const tag of rule.properties.tags) {
+			if (typeof tag !== "string") continue;
+			cweIds.push(...extractCWEIDs(tag).map((id) => `CWE-${id}`));
+		}
 		if (cweIds.length > 0) return cweIds;
 	}
 	return [];
 }
 function extractCweIds(text) {
-	const matches = text.match(/\(([^)]+)\)/g);
-	if (!matches) return [];
-	const cweIds = [];
-	for (const match of matches) {
-		const content = match.slice(1, -1);
-		if (content.includes("CWE-")) {
-			const parts = content.split(/,\s*|!\//);
-			for (const part of parts) {
-				const trimmed = part.trim();
-				if (trimmed.startsWith("CWE-")) cweIds.push(trimmed);
-			}
-		}
-	}
-	return cweIds;
+	return extractCWEIDs(text).map((id) => `CWE-${id}`);
 }
 function mapKindToStatus(kind) {
 	switch (kind) {
@@ -1008,21 +1105,31 @@ function createHDFResult(location, status, backtrace, suppressionMessage) {
 	const snippet = location.physicalLocation?.region?.snippet?.text;
 	let codeDesc = `URL : ${uri} LINE : ${line} COLUMN : ${column}`;
 	if (snippet) codeDesc = `${codeDesc}\n${snippet}`;
-	return createResult(status, suppressionMessage ? `Suppressed: ${suppressionMessage}` : "", {
+	const result = createResult(status, void 0, {
 		codeDesc,
-		startTime: /* @__PURE__ */ new Date(),
-		backtrace
+		startTime: /* @__PURE__ */ new Date()
 	});
+	delete result.message;
+	if (suppressionMessage) result.message = `Suppressed: ${suppressionMessage}`;
+	if (backtrace.length > 0) result.backtrace = backtrace;
+	return result;
 }
 //#endregion
 //#region converters/junit-to-hdf/typescript/converter.ts
 const DEFAULT_NIST = ["SA-11"];
-const CONVERTER_VERSION$2 = "1.0.0";
+/**
+* The shared XML parser runs with `processEntities: false` (XXE defense), so
+* character references reach us undecoded. Surefire escapes quotes and angle
+* brackets in failure messages, so decode them here.
+*/
+function decodeXmlEntities$5(s) {
+	return s.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCodePoint(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(parseInt(dec, 10))).replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
 const ARRAY_TAGS$2 = ["testsuite", "testcase"];
 /**
 * Converts JUnit XML test results to HDF format.
 */
-async function convertJunitToHdf(input) {
+async function convertJunitToHdf(input, converterVersion = "1.0.0") {
 	if (!input || !input.trim()) throw new Error("Empty input");
 	validateInputSize(input, "junit");
 	const { suites, name } = parseJUnitXML(input);
@@ -1031,7 +1138,7 @@ async function convertJunitToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("junit-no-findings", `JUnit scanned ${noFindingsTarget(name, suites)} and reported zero findings.`, scanTime));
 	return buildHdfResults({
 		generatorName: "junit-to-hdf",
-		converterVersion: CONVERTER_VERSION$2,
+		converterVersion,
 		toolName: "JUnit XML",
 		toolFormat: "XML",
 		baselines: [createMinimalBaseline(name, requirements, { resultsChecksum: await inputChecksum(input) })],
@@ -1053,14 +1160,15 @@ function parseJUnitXML(input) {
 	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2);
 	if (parsed.testsuites) return {
 		suites: parsed.testsuites.testsuite ?? [],
-		name: parsed.testsuites.name || "JUnit Test Results"
+		name: parsed.testsuites.name ? decodeXmlEntities$5(parsed.testsuites.name) : "JUnit Test Results"
 	};
 	if (parsed.testsuite) {
 		const suite = parsed.testsuite;
 		const suites = Array.isArray(suite) ? suite : [suite];
+		const suiteName = suites[0]?.name;
 		return {
 			suites,
-			name: suites[0]?.name || "JUnit Test Results"
+			name: suiteName ? decodeXmlEntities$5(suiteName) : "JUnit Test Results"
 		};
 	}
 	throw new Error("Input is not a JUnit XML document: expected <testsuites> or <testsuite> root element");
@@ -1082,28 +1190,29 @@ function buildRequirements(suites, scanTime) {
 function testCaseToRequirement(tc, scanTime) {
 	const id = buildID(tc);
 	const { status, message } = resolveStatus(tc);
-	const resultOptions = {
+	const result = {
+		status,
 		codeDesc: buildCodeDesc$9(tc),
 		startTime: scanTime
 	};
+	if (message !== void 0) result.message = message;
 	if (tc.time) {
 		const parsed = parseFloat(tc.time);
-		if (!isNaN(parsed)) resultOptions.runTime = parsed;
+		if (!isNaN(parsed)) result.runTime = parsed;
 	}
-	const result = createResult(status, message ?? "", resultOptions);
-	const descriptions = [{
+	const name = decodeXmlEntities$5(tc.name);
+	const req = createRequirement(id, name, [{
 		label: "default",
-		data: `JUnit test: ${tc.name} in ${tc.classname || "unknown"}`
-	}];
-	const req = createRequirement(id, tc.name, descriptions, .5, [result], { tags: { nist: DEFAULT_NIST } });
+		data: `JUnit test: ${name} in ${tc.classname ? decodeXmlEntities$5(tc.classname) : "unknown"}`
+	}], .5, [result], { tags: { nist: DEFAULT_NIST } });
 	const controlType = deriveControlTypeFromTags(DEFAULT_NIST);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	return req;
 }
 function buildID(tc) {
-	if (tc.classname) return `${tc.classname}.${tc.name}`;
-	return tc.name;
+	if (tc.classname) return `${decodeXmlEntities$5(tc.classname)}.${decodeXmlEntities$5(tc.name)}`;
+	return decodeXmlEntities$5(tc.name);
 }
 function resolveStatus(tc) {
 	if (tc.failure) {
@@ -1124,7 +1233,7 @@ function resolveStatus(tc) {
 		const skipped = typeof tc.skipped === "object" ? tc.skipped : null;
 		if (skipped?.message) return {
 			status: ResultStatus.NotReviewed,
-			message: `Skipped: ${skipped.message}`
+			message: `Skipped: ${decodeXmlEntities$5(skipped.message)}`
 		};
 		return {
 			status: ResultStatus.NotReviewed,
@@ -1135,24 +1244,40 @@ function resolveStatus(tc) {
 }
 function buildFailureMessage(message, typeName, body) {
 	let result = "";
-	if (typeName) result = `${typeName}: `;
-	result += message;
-	if (body) result += "\n" + body;
+	if (typeName) result = `${decodeXmlEntities$5(typeName)}: `;
+	result += decodeXmlEntities$5(message);
+	if (body) result += "\n" + decodeXmlEntities$5(body);
 	return result;
 }
 function buildCodeDesc$9(tc) {
-	if (tc.classname) return `${tc.classname} :: ${tc.name}`;
-	return tc.name;
+	if (tc.classname) return `${decodeXmlEntities$5(tc.classname)} :: ${decodeXmlEntities$5(tc.name)}`;
+	return decodeXmlEntities$5(tc.name);
 }
 function noFindingsTarget(baselineName, suites) {
 	if (baselineName && baselineName !== "JUnit Test Results") return baselineName;
-	for (const s of suites) if (s.name) return s.name;
+	for (const s of suites) if (s.name) return decodeXmlEntities$5(s.name);
 	return "JUnit test suite";
 }
 //#endregion
 //#region converters/xccdf-results-to-hdf/typescript/converter.ts
-const CONVERTER_VERSION$1 = "1.0.0";
-const CCI_SYSTEM = "http://cyber.mil/cci";
+/**
+* Walk the Group tree depth-first, collecting every rule at any depth. Rules may
+* sit directly on a Group that also has nested Groups.
+*/
+function flattenGroups(groups) {
+	const out = [];
+	for (const group of groups) {
+		for (const rule of group.Rule ?? []) {
+			if (!rule.id) continue;
+			out.push({
+				rule,
+				group
+			});
+		}
+		out.push(...flattenGroups(group.Group ?? []));
+	}
+	return out;
+}
 /** Tags that must always be parsed as arrays even if only one element exists. */
 const ARRAY_TAGS$1 = [
 	"Group",
@@ -1201,18 +1326,18 @@ function parseStartTime(raw) {
 	}
 	return /* @__PURE__ */ new Date();
 }
-async function convertXccdfResultsToHdf(input) {
+async function convertXccdfResultsToHdf(input, converterVersion = "1.0.0") {
 	if (!input || !input.trim()) throw new Error("Empty input");
 	validateInputSize(input, "xccdf-results");
-	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$1);
+	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$1, { trimValues: false });
 	const arfParsed = parsed;
-	if (arfParsed["asset-report-collection"]) return convertArfCollection(arfParsed["asset-report-collection"], input);
+	if (arfParsed["asset-report-collection"]) return convertArfCollection(arfParsed["asset-report-collection"], input, converterVersion);
 	const benchmark = parsed.Benchmark;
 	if (!benchmark) throw new Error("Input is not an XCCDF document: expected <Benchmark> root element");
 	if (!benchmark.TestResult) throw new Error("Input has no TestResult elements — this is a benchmark. Use 'xccdf-benchmark' or 'xccdf' instead");
-	return convertBenchmarkResultsToHdf(benchmark, input);
+	return convertBenchmarkResultsToHdf(benchmark, input, converterVersion);
 }
-async function convertBenchmarkResultsToHdf(benchmark, rawInput) {
+async function convertBenchmarkResultsToHdf(benchmark, rawInput, converterVersion) {
 	const testResult = benchmark.TestResult;
 	const ruleIndex = buildRuleIndex(benchmark);
 	const ruleResults = testResult["rule-result"] ?? [];
@@ -1226,32 +1351,35 @@ async function convertBenchmarkResultsToHdf(benchmark, rawInput) {
 		requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, scanTime));
 	}
 	const resultsChecksum = await inputChecksum(rawInput);
-	const baseline = createMinimalBaseline(extractText(benchmark.title) || "XCCDF Benchmark", requirements, { resultsChecksum });
-	const components = buildTargets(testResult);
-	const timestamp = scanTime;
-	let durationSeconds;
-	if (testResult["start-time"] && testResult["end-time"]) {
-		const start = parseTimestamp(testResult["start-time"])?.getTime();
-		const end = parseTimestamp(testResult["end-time"])?.getTime();
-		if (start !== void 0 && end !== void 0 && end >= start) durationSeconds = (end - start) / 1e3;
-	}
-	const hdf = {
+	const baselineName = extractText(benchmark.title) || benchmark.id || "";
+	const baseline = createMinimalBaseline(baselineName, requirements, { resultsChecksum });
+	baseline.title = baselineName;
+	baseline.version = extractVersion$1(benchmark.version);
+	baseline.status = "loaded";
+	baseline.summary = stripHTML(extractText(benchmark.description));
+	return serializeHdf({
 		baselines: [baseline],
 		generator: {
 			name: "xccdf-results-to-hdf",
-			version: CONVERTER_VERSION$1
+			version: converterVersion
 		},
 		tool: {
-			name: "XCCDF Results",
-			format: "XML"
+			name: "XCCDF",
+			format: "XCCDF"
 		},
-		components,
-		timestamp
-	};
-	if (durationSeconds !== void 0) hdf.statistics = { duration: durationSeconds };
-	return serializeHdf(hdf);
+		components: buildTargets(testResult),
+		timestamp: scanTime,
+		statistics: { duration: calculateDuration(testResult) }
+	});
 }
-async function convertArfCollection(arc, rawInput) {
+/** Seconds between the TestResult start-time and end-time; 0 when unavailable. */
+function calculateDuration(testResult) {
+	const start = testResult["start-time"] ? parseTimestamp(testResult["start-time"])?.getTime() : void 0;
+	const end = testResult["end-time"] ? parseTimestamp(testResult["end-time"])?.getTime() : void 0;
+	if (start === void 0 || end === void 0 || end < start) return 0;
+	return (end - start) / 1e3;
+}
+async function convertArfCollection(arc, rawInput, converterVersion) {
 	const resultsChecksum = await inputChecksum(rawInput);
 	const benchmark = findBenchmarkInArf(arc);
 	const ruleIndex = benchmark ? buildRuleIndex(benchmark) : /* @__PURE__ */ new Map();
@@ -1266,16 +1394,9 @@ async function convertArfCollection(arc, rawInput) {
 	for (const report of arc.reports?.report ?? []) {
 		const testResult = report.content?.TestResult;
 		if (!testResult?.id) continue;
-		if (testResult["start-time"] && !firstTimestamp) {
-			const t = parseTimestamp(testResult["start-time"]);
-			if (t) firstTimestamp = t;
-		}
-		if (testResult["start-time"] && testResult["end-time"]) {
-			const start = parseTimestamp(testResult["start-time"])?.getTime();
-			const end = parseTimestamp(testResult["end-time"])?.getTime();
-			if (start !== void 0 && end !== void 0 && end >= start) totalDuration += (end - start) / 1e3;
-		}
 		const scanTime = parseStartTime(testResult["start-time"]);
+		if (!firstTimestamp) firstTimestamp = scanTime;
+		totalDuration += calculateDuration(testResult);
 		const ruleResults = testResult["rule-result"] ?? [];
 		const { items: limitedARFRuleResults, truncated: truncatedARFRR } = limitArray(ruleResults);
 		/* v8 ignore next -- truncation only triggers with >100K items */
@@ -1286,9 +1407,15 @@ async function convertArfCollection(arc, rawInput) {
 			requirements.push(buildNoFindingsRequirement("xccdf-results-no-findings", `XCCDF scanned ${target} and reported zero findings.`, scanTime));
 		}
 		let baselineName = "";
-		if (benchmark) baselineName = extractText(benchmark.title) || "";
-		if (!baselineName) baselineName = extractText(testResult.title) || testResult.id || "ARF Report";
+		if (benchmark) baselineName = extractText(benchmark.title) || benchmark.id || "";
+		if (!baselineName) baselineName = extractText(testResult.title) || testResult.id || "";
 		const baseline = createMinimalBaseline(baselineName, requirements, { resultsChecksum });
+		baseline.title = baselineName;
+		baseline.status = "loaded";
+		if (benchmark) {
+			baseline.version = extractVersion$1(benchmark.version);
+			baseline.summary = stripHTML(extractText(benchmark.description));
+		}
 		baselines.push(baseline);
 		const reportTargets = buildTargets(testResult);
 		const target = reportTargets[0];
@@ -1302,21 +1429,20 @@ async function convertArfCollection(arc, rawInput) {
 		components.push(...reportTargets);
 	}
 	if (baselines.length === 0) throw new Error("ARF document contains no XCCDF TestResult reports");
-	const hdf = {
+	return serializeHdf({
 		baselines,
 		generator: {
 			name: "xccdf-results-to-hdf",
-			version: CONVERTER_VERSION$1
+			version: converterVersion
 		},
 		tool: {
 			name: "ARF",
 			format: "ARF"
 		},
 		components,
-		timestamp: firstTimestamp ?? /* @__PURE__ */ new Date()
-	};
-	if (totalDuration > 0) hdf.statistics = { duration: totalDuration };
-	return serializeHdf(hdf);
+		timestamp: firstTimestamp ?? /* @__PURE__ */ new Date(),
+		statistics: { duration: totalDuration }
+	});
 }
 /**
 * Find the XCCDF Benchmark embedded in an ARF data-stream-collection.
@@ -1362,11 +1488,7 @@ function buildRuleIndex(benchmark) {
 	const index = /* @__PURE__ */ new Map();
 	const topRules = benchmark.Rule ?? [];
 	for (const rule of topRules) if (rule.id) index.set(rule.id, rule);
-	const groups = benchmark.Group ?? [];
-	for (const group of groups) {
-		const rules = group.Rule ?? [];
-		for (const rule of rules) if (rule.id) index.set(rule.id, rule);
-	}
+	for (const { rule } of flattenGroups(benchmark.Group ?? [])) index.set(rule.id, rule);
 	return index;
 }
 /**
@@ -1375,39 +1497,29 @@ function buildRuleIndex(benchmark) {
 function ruleResultToRequirement(rr, ruleIndex, scanTime) {
 	const ruleId = rr.idref ?? "";
 	const ruleDef = ruleIndex.get(ruleId);
-	const id = extractVersion$1(ruleDef?.version) || ruleId;
-	const title = extractText(ruleDef?.title) || id;
-	const severity = rr.severity ?? ruleDef?.severity ?? "";
-	const impact = severity ? severityToImpact(severity) : .5;
-	const descriptions = [];
-	const rawDesc = extractText(ruleDef?.description);
-	if (rawDesc) descriptions.push({
+	const id = ruleDef?.id ? extractRuleID(ruleDef.id) : ruleId;
+	const title = extractText(ruleDef?.title) || ruleId;
+	const severity = (rr.severity || ruleDef?.severity || "").toLowerCase();
+	const impact = severity ? severityToImpact$1(severity) : .5;
+	const descriptions = [{
 		label: "default",
-		data: extractVulnDiscussion(rawDesc)
-	});
+		data: stripHTML(extractVulnDiscussion(extractText(ruleDef?.description)))
+	}];
 	const fixtext = extractFixtext(ruleDef?.fixtext);
 	if (fixtext) descriptions.push({
 		label: "fix",
-		data: fixtext
+		data: stripHTML(fixtext)
 	});
-	if (descriptions.length === 0) descriptions.push({
-		label: "default",
-		data: ""
-	});
-	const status = STATUS_MAP[(rr.result ?? "").toLowerCase()] ?? ResultStatus.NotReviewed;
+	const xccdfResult = (rr.result ?? "").trim().toLowerCase();
+	const status = STATUS_MAP[xccdfResult] ?? ResultStatus.Error;
 	const perRuleTime = rr.time ? parseTimestamp(rr.time) : null;
-	const result = createResult(status, "", {
-		codeDesc: `XCCDF rule ${id}`,
+	const result = {
+		status,
+		codeDesc: `XCCDF rule ${ruleId}`,
 		startTime: perRuleTime ?? scanTime
-	});
-	const tags = {};
-	let nistTags = [];
-	const cciIds = extractCCIs(rr.ident ?? ruleDef?.ident ?? []);
-	if (cciIds.length > 0) {
-		tags["cci"] = cciIds;
-		nistTags = [...new Set(cciIds.flatMap((cci) => getCCINistMappings(cci) ?? []))];
-		if (nistTags.length > 0) tags["nist"] = nistTags;
-	}
+	};
+	const tags = buildCciNistTags(extractCCIs([...rr.ident ?? [], ...ruleDef?.ident ?? []]));
+	const nistTags = tags["nist"];
 	const req = createRequirement(id, title, descriptions, impact, [result], { tags });
 	const controlType = deriveControlTypeFromTags(nistTags);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -1438,19 +1550,29 @@ function buildTargets(testResult) {
 	const addresses = testResult["target-address"] ?? [];
 	const target = {
 		name: targetName,
-		type: TargetType.Host,
-		labels: {}
+		type: TargetType.Host
 	};
 	if (addresses.length > 0) target.ipAddress = addresses[0];
 	return [target];
 }
-/**
-* Extract plain text from a field that may be a string or {#text: string}.
-*/
+const NAMED_ENTITIES$4 = {
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'",
+	amp: "&"
+};
+function decodeXmlEntities$4(s) {
+	return s.replace(/&(?:#(\d+)|#[xX]([0-9a-fA-F]+)|(lt|gt|quot|apos|amp));/g, (match, dec, hex, name) => {
+		if (dec !== void 0) return String.fromCodePoint(Number.parseInt(dec, 10));
+		if (hex !== void 0) return String.fromCodePoint(Number.parseInt(hex, 16));
+		return name !== void 0 ? NAMED_ENTITIES$4[name] ?? match : match;
+	});
+}
 function extractText(field) {
 	if (field === void 0 || field === null) return "";
-	if (typeof field === "string") return field;
-	return field["#text"] ?? "";
+	if (typeof field === "string") return decodeXmlEntities$4(field);
+	return decodeXmlEntities$4(field["#text"] ?? "");
 }
 /**
 * Extract version string from a version field.
@@ -1465,8 +1587,8 @@ function extractVersion$1(field) {
 */
 function extractFixtext(field) {
 	if (field === void 0 || field === null) return "";
-	if (typeof field === "string") return field;
-	return field["#text"] ?? "";
+	if (typeof field === "string") return decodeXmlEntities$4(field);
+	return decodeXmlEntities$4(field["#text"] ?? "");
 }
 /**
 * Extract the VulnDiscussion text from an XCCDF description that contains
@@ -1475,16 +1597,38 @@ function extractFixtext(field) {
 */
 function extractVulnDiscussion(description) {
 	const match = description.match(/<VulnDiscussion>([\s\S]*?)<\/VulnDiscussion>/);
-	if (match) return match[1].trim();
-	const entityMatch = description.match(/&lt;VulnDiscussion&gt;([\s\S]*?)&lt;\/VulnDiscussion&gt;/);
-	if (entityMatch) return entityMatch[1].trim();
-	return description;
+	return match ? match[1] : description;
 }
 /**
-* Extract CCI identifiers from ident elements (system="http://cyber.mil/cci").
+* Extract CCI identifiers from ident elements, deduplicated in first-seen order.
 */
 function extractCCIs(idents) {
-	return idents.filter((i) => i.system === CCI_SYSTEM).map((i) => i["#text"] ?? "").filter((v) => v.length > 0);
+	const ccis = idents.filter((i) => (i.system ?? "").toLowerCase().includes("cci")).map((i) => i["#text"] ?? "").filter((v) => v.length > 0);
+	return [...new Set(ccis)];
+}
+/**
+* Build the cci/nist tag pair. `nist` is always present (empty when there are no
+* CCIs) and sorted, matching Go's cci.CCIToNIST.
+*/
+function buildCciNistTags(cciIds) {
+	if (cciIds.length === 0) return { nist: [] };
+	return {
+		cci: cciIds,
+		nist: [...new Set(cciIds.flatMap((c) => getCCINistMappings(c) ?? []))].sort()
+	};
+}
+/**
+* Extract the vulnerability ID from an XCCDF Rule ID:
+* "SV-254238r991589_rule" and "xccdf_mil.disa.stig_rule_SV-204393r603261_rule"
+* both yield "SV-254238"/"SV-204393". Non-SV IDs pass through unchanged.
+*/
+function extractRuleID(ruleID) {
+	const svIdx = ruleID.toUpperCase().indexOf("SV-");
+	if (svIdx < 0) return ruleID;
+	const digits = ruleID.slice(svIdx + 3);
+	const revIdx = digits.indexOf("r");
+	if (revIdx > 0) return `SV-${digits.slice(0, revIdx)}`;
+	return `SV-${digits}`;
 }
 //#endregion
 //#region shared/typescript/checklist/status.ts
@@ -1672,6 +1816,8 @@ function cklVulnToModel(v) {
 		status: parseStatus(v.STATUS),
 		findingDetails: str(v.FINDING_DETAILS),
 		comments: str(v.COMMENTS),
+		severityOverride: str(v.SEVERITY_OVERRIDE),
+		severityJustification: str(v.SEVERITY_JUSTIFICATION),
 		extra
 	};
 }
@@ -1760,7 +1906,9 @@ function modelVulnToCkl(v) {
 		STIG_DATA: stigData,
 		STATUS: statusToCkl(v.status),
 		FINDING_DETAILS: v.findingDetails ?? "",
-		COMMENTS: v.comments ?? ""
+		COMMENTS: v.comments ?? "",
+		SEVERITY_OVERRIDE: v.severityOverride ?? "",
+		SEVERITY_JUSTIFICATION: v.severityJustification ?? ""
 	};
 }
 //#endregion
@@ -1929,7 +2077,7 @@ function stigToBaseline(s, resultsChecksum, scanTime) {
 }
 function vulnToRequirement(v, scanTime) {
 	const severity = (v.severity ?? "").toLowerCase();
-	const impact = severity ? severityToImpact(severity) : .5;
+	const impact = severity ? severityToImpact$1(severity) : .5;
 	const descriptions = [{
 		label: "default",
 		data: stripHTML(v.vulnDiscuss ?? "")
@@ -1942,7 +2090,7 @@ function vulnToRequirement(v, scanTime) {
 		label: "fix",
 		data: stripHTML(v.fixText)
 	});
-	const message = [v.findingDetails, v.comments].map((s) => (s ?? "").trim()).filter(Boolean).join("\n\n");
+	const message = (v.findingDetails ?? "").trim();
 	const result = createResult(statusToHdf(v.status), message, {
 		codeDesc: `STIG rule ${v.ruleVer ?? ""}`,
 		startTime: scanTime
@@ -1954,12 +2102,13 @@ function vulnToRequirement(v, scanTime) {
 		nistTags = [...new Set(v.ccis.flatMap((c) => getCCINistMappings(c) ?? []))].sort();
 		tags["nist"] = nistTags;
 	} else tags["nist"] = [];
-	setIf(tags, "rid", v.ruleID);
-	setIf(tags, "stig_id", v.ruleVer);
-	setIf(tags, "gtitle", v.groupTitle);
-	setIf(tags, "group_id", v.groupID);
-	setIf(tags, "weight", v.weight);
-	setIf(tags, "severity", severity);
+	setIf$1(tags, "rid", v.ruleID);
+	setIf$1(tags, "stig_id", v.ruleVer);
+	setIf$1(tags, "gtitle", v.groupTitle);
+	setIf$1(tags, "group_id", v.groupID);
+	setIf$1(tags, "weight", v.weight);
+	setIf$1(tags, "comments", v.comments);
+	setIf$1(tags, "severity", severity);
 	if (v.legacyIDs && v.legacyIDs.length) tags["legacy_ids"] = v.legacyIDs;
 	if (v.extra && Object.keys(v.extra).length > 0) tags["cklMetadata"] = { ...v.extra };
 	const req = createRequirement(v.vulnNum, v.ruleTitle ?? v.vulnNum, descriptions, impact, [result], { tags });
@@ -1974,6 +2123,7 @@ function assetToComponent(a) {
 		name: a.hostName || a.hostFQDN || a.hostIP || "",
 		type: TargetType.Host
 	};
+	if (a.hostName) c.hostname = a.hostName;
 	if (a.hostIP) c.ipAddress = a.hostIP;
 	if (a.hostFQDN) c.fqdn = a.hostFQDN;
 	if (a.hostMAC) c.macAddress = a.hostMAC;
@@ -1983,30 +2133,30 @@ function rootExtensions(cl) {
 	const ext = { checklistFormat: cl.format || "ckl" };
 	if (cl.cklbVersion) ext["cklbVersion"] = cl.cklbVersion;
 	const ax = {};
-	setIf(ax, "role", cl.asset.role);
-	setIf(ax, "assetType", cl.asset.assetType);
-	setIf(ax, "marking", cl.asset.marking);
-	setIf(ax, "targetKey", cl.asset.targetKey);
-	setIf(ax, "techArea", cl.asset.techArea);
-	setIf(ax, "targetComment", cl.asset.targetComment);
-	setIf(ax, "webDbSite", cl.asset.webDBSite);
-	setIf(ax, "webDbInstance", cl.asset.webDBInstance);
-	setIf(ax, "classification", cl.asset.classification);
+	setIf$1(ax, "role", cl.asset.role);
+	setIf$1(ax, "assetType", cl.asset.assetType);
+	setIf$1(ax, "marking", cl.asset.marking);
+	setIf$1(ax, "targetKey", cl.asset.targetKey);
+	setIf$1(ax, "techArea", cl.asset.techArea);
+	setIf$1(ax, "targetComment", cl.asset.targetComment);
+	setIf$1(ax, "webDbSite", cl.asset.webDBSite);
+	setIf$1(ax, "webDbInstance", cl.asset.webDBInstance);
+	setIf$1(ax, "classification", cl.asset.classification);
 	if (cl.asset.webOrDatabase) ax["webOrDatabase"] = true;
 	if (Object.keys(ax).length > 0) ext["assetExtras"] = ax;
 	return ext;
 }
 function baselineExtensions(s) {
 	const ext = {};
-	setIf(ext, "stigid", s.stigID);
-	setIf(ext, "uuid", s.uuid);
-	setIf(ext, "releaseInfo", s.releaseInfo);
-	setIf(ext, "displayName", s.displayName);
-	setIf(ext, "referenceIdentifier", s.referenceIdentifier);
-	setIf(ext, "classification", s.classification);
+	setIf$1(ext, "stigid", s.stigID);
+	setIf$1(ext, "uuid", s.uuid);
+	setIf$1(ext, "releaseInfo", s.releaseInfo);
+	setIf$1(ext, "displayName", s.displayName);
+	setIf$1(ext, "referenceIdentifier", s.referenceIdentifier);
+	setIf$1(ext, "classification", s.classification);
 	return ext;
 }
-function setIf(m, key, val) {
+function setIf$1(m, key, val) {
 	if (val) m[key] = val;
 }
 //#endregion
@@ -2018,7 +2168,7 @@ function setIf(m, key, val) {
 * fields are synthesized best-effort so any HDF yields a valid checklist.
 */
 function hdfToChecklist(input) {
-	const hdf = parseJSON(input);
+	const hdf = parseHdf(input);
 	if (!hdf || !Array.isArray(hdf.baselines) || hdf.baselines.length === 0) throw new Error("hdf to checklist: HDF has no baselines");
 	const ext = hdf.extensions ?? {};
 	const format = strVal(ext, "checklistFormat") || "ckl";
@@ -2036,7 +2186,8 @@ function buildAsset(hdf, ext) {
 	const asset = {};
 	const comp = hdf.components?.[0];
 	if (comp) {
-		asset.hostName = comp.name;
+		if (comp.hostname) asset.hostName = comp.hostname;
+		else if (comp.name && comp.name !== comp.fqdn && comp.name !== comp.ipAddress) asset.hostName = comp.name;
 		asset.hostIP = comp.ipAddress;
 		asset.hostFQDN = comp.fqdn;
 		asset.hostMAC = comp.macAddress;
@@ -2090,6 +2241,7 @@ function requirementToVuln(req) {
 		legacyIDs: strSlice(tags, "legacy_ids"),
 		status: statusFromHdf(req.results?.[0]?.status),
 		findingDetails: req.results?.[0]?.message,
+		comments: strVal(tags, "comments"),
 		extra: extractCklMetadata(tags)
 	};
 }
@@ -2251,11 +2403,15 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 		label: "default",
 		data: rep.description
 	}];
-	const results = vulns.map((vuln) => createResult(ResultStatus.Failed, void 0, {
-		codeDesc: formatDependencyPath(vuln.from),
-		startTime: scanTime
-	}));
-	const req = createRequirement(vulnID, rep.title, descriptions, severityToImpact(rep.severity), results, { tags });
+	const results = vulns.map((vuln) => {
+		const result = createResult(ResultStatus.Failed, void 0, {
+			codeDesc: formatDependencyPath(vuln.from),
+			startTime: scanTime
+		});
+		delete result.message;
+		return result;
+	});
+	const req = createRequirement(vulnID, rep.title, descriptions, severityToImpact$1(rep.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -2308,12 +2464,12 @@ function convertSingleProject(report, resultsChecksum, scanTime) {
 * @param input - Snyk JSON or SARIF string
 * @returns HDF JSON string
 */
-async function convertSnykToHdf(input) {
+async function convertSnykToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("snyk: empty input");
 	validateInputSize(input, "snyk");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
-	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
 	const resultsChecksum = await inputChecksum(input);
 	const scanTime = /* @__PURE__ */ new Date();
 	const parsed = parseJSON(input);
@@ -2332,7 +2488,7 @@ async function convertSnykToHdf(input) {
 	}
 	return buildHdfResults({
 		generatorName: "snyk-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Snyk",
 		toolFormat: "JSON",
 		baselines,
@@ -2377,11 +2533,12 @@ function getFixInfo(fix) {
 function getCVSSInfo(vuln, relatedVulns) {
 	const cvssData = {};
 	if (vuln.cvss && vuln.cvss.length > 0) cvssData.primary = vuln.cvss;
-	if (relatedVulns && relatedVulns.length > 0) cvssData.related = relatedVulns.filter((r) => r.cvss && r.cvss.length > 0).map((r) => ({
+	const related = (relatedVulns ?? []).filter((r) => r.cvss && r.cvss.length > 0).map((r) => ({
 		id: r.id,
 		dataSource: r.dataSource,
 		cvss: r.cvss
 	}));
+	if (related.length > 0) cvssData.related = related;
 	return JSON.stringify(cvssData);
 }
 function getReferences(vuln, relatedVulns) {
@@ -2553,7 +2710,7 @@ function convertMatchToRequirement(match, isIgnored) {
 	if (kev) requirement.kev = kev;
 	return requirement;
 }
-async function convertGrypeToHdf(input) {
+async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "grype");
 	const resultsChecksum = await inputChecksum(input);
 	const grypeData = parseJSON(input);
@@ -2574,8 +2731,8 @@ async function convertGrypeToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("grype-no-findings", `Grype scanned ${targetName} and reported zero vulnerable components.`, /* @__PURE__ */ new Date()));
 	const baseline = createMinimalBaseline(targetName, requirements, { resultsChecksum });
 	return buildHdfResults({
-		generatorName: grypeData.descriptor?.name || "grype",
-		converterVersion: grypeData.descriptor?.version || "unknown",
+		generatorName: "grype-to-hdf",
+		converterVersion,
 		toolName: "Grype",
 		toolVersion: grypeData.descriptor?.version,
 		baselines: [baseline],
@@ -2590,7 +2747,6 @@ async function convertGrypeToHdf(input) {
 //#region converters/nessus-to-hdf/typescript/converter.ts
 const CVE_SOURCE_RE = /^CVE-\d{4}-\d{4,}$/;
 const CWE_PATTERN = /CWE[- ]?(\d+)/gi;
-const converterVersion = "1.0.0";
 const IMPACT_MAPPING$7 = {
 	"4": .9,
 	"3": .7,
@@ -2607,20 +2763,47 @@ const IMPACT_MAPPING$7 = {
 function parseHtml(html) {
 	return html.replace(/<[^>]*>/g, "").trim();
 }
+const NAMED_ENTITIES$3 = {
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'",
+	amp: "&"
+};
+/**
+* Resolve XML predefined and numeric character references. The shared parser
+* runs with `processEntities: false` (XXE defense), which also leaves `&apos;`
+* and friends unresolved — so scan text would otherwise carry raw entity
+* markup into every title, description and message.
+*/
+function decodeXmlEntities$3(text) {
+	return text.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, ref) => {
+		if (ref.startsWith("#x") || ref.startsWith("#X")) return String.fromCodePoint(Number.parseInt(ref.slice(2), 16));
+		if (ref.startsWith("#")) return String.fromCodePoint(Number.parseInt(ref.slice(1), 10));
+		return NAMED_ENTITIES$3[ref] ?? match;
+	});
+}
+/** Apply decodeXmlEntities to every string in a parsed XML document. */
+function decodeEntitiesDeep(value) {
+	if (typeof value === "string") return decodeXmlEntities$3(value);
+	if (Array.isArray(value)) return value.map(decodeEntitiesDeep);
+	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) value[k] = decodeEntitiesDeep(v);
+	return value;
+}
 /**
 * Convert Nessus XML scan results to HDF format
 */
-async function convertNessusToHdf(nessusXml) {
+async function convertNessusToHdf(nessusXml, converterVersion = "1.0.0") {
 	validateInputSize(nessusXml, "nessus");
 	const resultsChecksum = await inputChecksum(nessusXml);
-	const parsed = parseXmlWithArrays(nessusXml, [
+	const parsed = decodeEntitiesDeep(parseXmlWithArrays(nessusXml, [
 		"preference",
 		"tag",
 		"ReportItem",
 		"ReportHost",
 		"cwe",
 		"cve"
-	]);
+	]));
 	const policyName = parsed.NessusClientData_v2.Policy.policyName;
 	const version = extractVersion(parsed);
 	const reportHosts = parsed.NessusClientData_v2.Report.ReportHost;
@@ -2903,7 +3086,7 @@ function buildTags$2(item, isCompliance) {
 		const cciTags = parseComplianceRef(item["compliance-reference"], "CCI");
 		tags.cci = cciTags;
 		const mappedControls = cciTags.flatMap((cci) => getCCINistMappings(cci) ?? []);
-		tags.nist = [...new Set(mappedControls)];
+		tags.nist = [...new Set(mappedControls)].sort();
 	} else {
 		const nistControls = getNessusNistControl(item["pluginFamily"], item["pluginID"]);
 		tags.nist = nistControls ? nistControls.split("|") : [];
@@ -2928,7 +3111,7 @@ function buildRefs(item) {
 function buildResult$1(item, host, isCompliance) {
 	const status = getStatus$3(item, isCompliance);
 	const codeDesc = getCodeDesc(item);
-	const message = item.plugin_output || item["compliance-actual-value"];
+	const message = isCompliance && item["compliance-actual-value"] ? item["compliance-actual-value"] : item.plugin_output;
 	const startTimeStr = getHostPropertyValue(host, "HOST_START");
 	const startTime = startTimeStr ? parseTimestamp(startTimeStr) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
 	return {
@@ -2966,6 +3149,7 @@ function convertReportHostToTarget(host) {
 		name: hostName,
 		type: TargetType.Host
 	};
+	if (hostProps["hostname"]) target.hostname = hostProps["hostname"];
 	if (isFQDN(hostName)) target.fqdn = hostName;
 	const hostIp = hostProps["host-ip"];
 	if (hostIp) target.ipAddress = hostIp;
@@ -2974,7 +3158,6 @@ function convertReportHostToTarget(host) {
 	if (hostProps["os"]) target.osVersion = hostProps["os"];
 	if (hostProps["mac-address"]) target.macAddress = hostProps["mac-address"].split("\n")[0];
 	if (hostProps["host-fqdn"]) target.fqdn = hostProps["host-fqdn"];
-	target.labels = {};
 	return target;
 }
 function isFQDN(s) {
@@ -2986,7 +3169,7 @@ function isIPAddress(s) {
 //#endregion
 //#region converters/sonarqube-to-hdf/typescript/converter.ts
 /**
-* Severity to impact mapping.
+* Deprecated legacy severity to impact mapping.
 * Canonical reference: heimdall2 sonarqube-mapper.ts IMPACT_MAPPING.
 */
 const SEVERITY_IMPACT_MAPPING = {
@@ -2996,6 +3179,58 @@ const SEVERITY_IMPACT_MAPPING = {
 	MINOR: .3,
 	INFO: 0
 };
+/** MQR software-quality severity to impact mapping. */
+const MQR_IMPACT_MAPPING = {
+	BLOCKER: 1,
+	HIGH: .7,
+	MEDIUM: .5,
+	LOW: .3,
+	INFO: 0
+};
+/** MQR severities ordered weakest to strongest. */
+const MQR_SEVERITY_RANK = {
+	INFO: 0,
+	LOW: 1,
+	MEDIUM: 2,
+	HIGH: 3,
+	BLOCKER: 4
+};
+/**
+* Which severity axis drove a requirement's severity/impact. Emitted as the
+* severitySource tag so downstream gates can pin the meaning of severity.
+*/
+const SEVERITY_SOURCE_MQR = "mqr";
+const SEVERITY_SOURCE_LEGACY = "legacy";
+/**
+* Order by code unit, matching Go's sort.Strings (byte order). Not
+* localeCompare: locale-aware collation would order keys differently than the Go
+* converter and break output parity between the two implementations.
+*/
+const byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+/**
+* Pick the authoritative severity axis for an issue. In MQR mode SonarQube
+* deprecates the top-level severity and the UI reports impacts[], so impacts[]
+* wins whenever present; pre-MQR servers fall back to the legacy field. An issue
+* is rated per software quality, so the worst rating governs — matching how the
+* SonarQube UI buckets it. The legacy→MQR relationship is per-rule, not a
+* constant offset, so the legacy value can never be relabelled after the fact.
+*/
+function selectSeverity(issue) {
+	const impacts = issue.impacts ?? [];
+	if (impacts.length > 0) {
+		const worst = impacts.reduce((a, b) => MQR_SEVERITY_RANK[b.severity] > MQR_SEVERITY_RANK[a.severity] ? b : a);
+		return {
+			severity: worst.severity,
+			source: SEVERITY_SOURCE_MQR,
+			impact: MQR_IMPACT_MAPPING[worst.severity] ?? .5
+		};
+	}
+	return {
+		severity: issue.severity,
+		source: SEVERITY_SOURCE_LEGACY,
+		impact: SEVERITY_IMPACT_MAPPING[issue.severity] ?? .5
+	};
+}
 /**
 * Default NIST tag for SonarQube findings without CWE mappings.
 * SA-11 (Developer Security Testing and Evaluation) applies to all issue types —
@@ -3008,7 +3243,7 @@ const DEFAULT_NIST_TAGS = ["SA-11"];
 * @param input - JSON string from SonarQube /api/issues/search endpoint
 * @returns HDF JSON string
 */
-async function convertSonarqubeToHdf(input) {
+async function convertSonarqubeToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "sonarqube");
 	const resultsChecksum = await inputChecksum(input);
 	const sonarData = parseJSON(input);
@@ -3027,12 +3262,13 @@ async function convertSonarqubeToHdf(input) {
 		if (!issuesByProject.has(projectKey)) issuesByProject.set(projectKey, []);
 		issuesByProject.get(projectKey).push(issue);
 	}
+	const projectKeys = Array.from(issuesByProject.keys()).sort(byCodeUnit);
 	const baselines = [];
-	for (const [projectKey, issues] of issuesByProject) {
-		const baseline = convertProjectToBaseline(projectKey, issues, componentMap, ruleMap, resultsChecksum);
+	for (const projectKey of projectKeys) {
+		const baseline = convertProjectToBaseline(projectKey, issuesByProject.get(projectKey), componentMap, ruleMap, resultsChecksum);
 		baselines.push(baseline);
 	}
-	let components = Array.from(issuesByProject.keys()).map((projectKey) => ({
+	let components = projectKeys.map((projectKey) => ({
 		type: TargetType.Application,
 		name: projectKey
 	}));
@@ -3051,8 +3287,9 @@ async function convertSonarqubeToHdf(input) {
 	}
 	return buildHdfResults({
 		generatorName: "sonarqube-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "SonarQube",
+		toolVersion: sonarData.serverVersion || void 0,
 		baselines,
 		components,
 		timestamp: /* @__PURE__ */ new Date()
@@ -3074,8 +3311,8 @@ function convertProjectToBaseline(projectKey, issues, componentMap, ruleMap, res
 		issuesByRule.get(ruleKey).push(issue);
 	}
 	const requirements = [];
-	for (const [ruleKey, ruleIssues] of issuesByRule) {
-		const requirement = convertRuleToRequirement(ruleKey, ruleIssues, componentMap, ruleMap);
+	for (const ruleKey of Array.from(issuesByRule.keys()).sort(byCodeUnit)) {
+		const requirement = convertRuleToRequirement(ruleKey, issuesByRule.get(ruleKey), componentMap, ruleMap);
 		requirements.push(requirement);
 	}
 	return createMinimalBaseline(projectKey, requirements, {
@@ -3088,7 +3325,7 @@ function convertRuleToRequirement(ruleKey, issues, componentMap, ruleMap) {
 	const title = rule?.name || ruleKey;
 	const description = extractDescription(rule);
 	const firstIssue = issues[0];
-	const impact = SEVERITY_IMPACT_MAPPING[firstIssue.severity] || .5;
+	const { severity, source: severitySource, impact } = selectSeverity(firstIssue);
 	const { cweIds, owaspTags, allTags } = extractTags(rule, issues);
 	const nistControls = mapCWEToNIST(cweIds, DEFAULT_NIST_TAGS);
 	const cciControls = nistToCci(nistControls);
@@ -3096,12 +3333,18 @@ function convertRuleToRequirement(ruleKey, issues, componentMap, ruleMap) {
 	const issueWithLocation = issues.find((i) => i.line !== void 0);
 	const sourceLocation = issueWithLocation ? extractSourceLocation(issueWithLocation, componentMap) : void 0;
 	const options = { tags: {
-		severity: firstIssue.severity.toLowerCase(),
+		severity: severity.toLowerCase(),
+		severitySource,
 		type: firstIssue.type.toLowerCase(),
 		cwe: cweIds,
 		owasp: owaspTags,
 		nist: nistControls,
 		cci: cciControls,
+		...severitySource === SEVERITY_SOURCE_MQR ? {
+			legacySeverity: firstIssue.severity.toLowerCase(),
+			impacts: firstIssue.impacts,
+			...firstIssue.cleanCodeAttribute ? { cleanCodeAttribute: firstIssue.cleanCodeAttribute } : {}
+		} : {},
 		...allTags
 	} };
 	if (sourceLocation) options.sourceLocation = sourceLocation;
@@ -3195,11 +3438,15 @@ function mapComplianceStatus(complianceType) {
 		default: return ResultStatus.NotReviewed;
 	}
 }
+/** Mapping values pack multiple controls into one pipe-delimited string. */
+function splitControls(nistId) {
+	return nistId.split("|").map((c) => c.trim()).filter(Boolean);
+}
 function buildNistTags$3(sourceIdentifier, ruleName) {
-	const byIdentifier = getAwsConfigNistControlByIdentifier(sourceIdentifier);
-	if (byIdentifier) return [byIdentifier];
+	const byIdentifier = sourceIdentifier ? getAwsConfigNistControlByIdentifier(sourceIdentifier) : void 0;
+	if (byIdentifier) return splitControls(byIdentifier);
 	const byName = getAwsConfigNistControlByName(ruleName);
-	if (byName) return [byName];
+	if (byName) return splitControls(byName);
 	return [];
 }
 /**
@@ -3239,16 +3486,27 @@ function buildResultMessage(codeDesc, annotation, status) {
 	if (status !== ResultStatus.Failed) return void 0;
 	return `(${codeDesc}): ${annotation || "Rule does not pass rule compliance"}`;
 }
+/** Elapsed seconds between rule invocation and result recording; omitted if either time is unusable. */
+function computeRunTime(invoked, recorded) {
+	const start = invoked ? parseTimestamp(invoked) : null;
+	const end = recorded ? parseTimestamp(recorded) : null;
+	if (!start || !end) return void 0;
+	return (end.getTime() - start.getTime()) / 1e3;
+}
 function buildResult(r) {
 	const q = r.EvaluationResultIdentifier.EvaluationResultQualifier;
 	const status = mapComplianceStatus(r.ComplianceType);
 	const codeDesc = buildCodeDesc$7(q);
 	const message = buildResultMessage(codeDesc, r.Annotation, status);
 	const startTime = (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
-	return createResult(status, message ?? codeDesc, {
+	const runTime = computeRunTime(r.ConfigRuleInvokedTime, r.ResultRecordedTime);
+	return {
+		status,
 		codeDesc,
-		...startTime ? { startTime } : {}
-	});
+		startTime,
+		...runTime !== void 0 ? { runTime } : {},
+		...message !== void 0 ? { message } : {}
+	};
 }
 /**
 * Synthesizes a single HDF result for a Config rule whose live evaluation
@@ -3259,10 +3517,11 @@ function buildResult(r) {
 */
 function buildNotApplicableResult(rule) {
 	const codeDesc = `AWS Config rule ${rule.ConfigRuleName} evaluated zero in-scope resources in this account/region.`;
-	return createResult(ResultStatus.NotApplicable, codeDesc, {
+	return {
+		status: ResultStatus.NotApplicable,
 		codeDesc,
 		startTime: /* @__PURE__ */ new Date()
-	});
+	};
 }
 function buildRequirement$15(rule) {
 	const nist = buildNistTags$3(rule.Source.SourceIdentifier, rule.ConfigRuleName);
@@ -3295,7 +3554,7 @@ function buildRequirement$15(rule) {
 *                with get-compliance-details-by-config-rule
 * @returns HDF JSON string
 */
-async function convertAwsConfigToHdf(input) {
+async function convertAwsConfigToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "aws-config");
 	const resultsChecksum = await inputChecksum(input);
 	const data = parseJSON(input);
@@ -3316,7 +3575,7 @@ async function convertAwsConfigToHdf(input) {
 	const region = getRegion(firstArn);
 	return buildHdfResults({
 		generatorName: "aws-config-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "AWS Config",
 		baselines: [baseline],
 		components: [{
@@ -3349,7 +3608,7 @@ function mapStatus$2(result) {
 */
 function getImpact$8(severity) {
 	if (!severity) return .5;
-	return severityToImpact(severity);
+	return severityToImpact$1(severity);
 }
 /**
 * Converts a single CheckovCheck to an HDF RequirementResult.
@@ -3359,10 +3618,12 @@ function checkToResult(check, scanTime) {
 	const codeDesc = `Resource: ${check.resource}\nFile: ${check.file_path} (lines ${JSON.stringify(check.file_line_range)})`;
 	let message;
 	if (status === ResultStatus.NotReviewed && check.check_result.suppress_comment) message = check.check_result.suppress_comment;
-	return createResult(status, message ?? "", {
+	return {
+		status,
 		codeDesc,
-		startTime: scanTime
-	});
+		startTime: scanTime,
+		...message !== void 0 ? { message } : {}
+	};
 }
 /**
 * Converts a group of checks sharing a check_id into one EvaluatedRequirement.
@@ -3404,11 +3665,11 @@ function parseInput(input) {
 * @param input - checkov JSON or SARIF string
 * @returns HDF JSON string
 */
-async function convertCheckovToHdf(input) {
+async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "checkov");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
-	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
 	const resultsChecksum = await inputChecksum(input);
 	const scanTime = /* @__PURE__ */ new Date();
 	const reports = parseInput(input);
@@ -3441,7 +3702,7 @@ async function convertCheckovToHdf(input) {
 	const baseline = createMinimalBaseline("Checkov Scan", requirements, { resultsChecksum });
 	return buildHdfResults({
 		generatorName: "checkov-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Checkov",
 		toolVersion: version,
 		toolFormat: format,
@@ -3525,11 +3786,11 @@ function buildRequirement$13(ruleId, issues, scanTime) {
 * @param input - gosec JSON or SARIF string
 * @returns HDF JSON string
 */
-async function convertGosecToHdf(input) {
+async function convertGosecToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "gosec");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
-	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
 	const resultsChecksum = await inputChecksum(input);
 	const report = parseJSON(input);
 	if (!report || typeof report !== "object") throw new Error("Invalid gosec structure: not a valid JSON object");
@@ -3550,7 +3811,7 @@ async function convertGosecToHdf(input) {
 	const baseline = createMinimalBaseline("gosec Scan", requirements, { resultsChecksum });
 	return buildHdfResults({
 		generatorName: "gosec-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "gosec",
 		toolVersion: report.GosecVersion || void 0,
 		baselines: [baseline],
@@ -3597,7 +3858,7 @@ function convertVulnToRequirement(vuln) {
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	return req;
 }
-async function convertNiktoToHdf(input) {
+async function convertNiktoToHdf(input, converterVersion = "unknown") {
 	validateInputSize(input, "nikto");
 	const resultsChecksum = await inputChecksum(input);
 	const niktoData = parseJSON(input);
@@ -3630,7 +3891,7 @@ async function convertNiktoToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("nikto-no-findings", `Nikto scanned ${targetName} and reported zero findings.`, /* @__PURE__ */ new Date()));
 	return buildHdfResults({
 		generatorName: "nikto-to-hdf",
-		converterVersion: "unknown",
+		converterVersion,
 		toolName: "Nikto",
 		toolFormat: "JSON",
 		baselines: [createMinimalBaseline(targetName, requirements, {
@@ -3703,11 +3964,11 @@ function parseZapTimestamp(s) {
 	}
 	return parseTimestamp(s) ?? void 0;
 }
-async function convertZapToHdf(input) {
+async function convertZapToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "zap");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
-	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
 	const resultsChecksum = await inputChecksum(input);
 	const zapData = parseJSON(input);
 	const site = selectSite(Array.isArray(zapData.site) ? zapData.site : []);
@@ -3800,7 +4061,7 @@ async function convertZapToHdf(input) {
 		components,
 		generator: {
 			name: "zap-to-hdf",
-			version: "unknown"
+			version: converterVersion
 		},
 		tool
 	};
@@ -3811,6 +4072,579 @@ async function convertZapToHdf(input) {
 	return serializeHdf(hdf);
 }
 //#endregion
+//#region shared/typescript/bom/model.ts
+/**
+* BOM manifest-kind discriminator. The schema allows custom 'x-'-prefixed kinds
+* beyond the reserved set, so the generated `bomType` field is a plain string;
+* the reserved values below are the parser's normalized vocabulary. Mirrors the
+* Go bom package.
+*/
+const BOMType = {
+	Sbom: "sbom",
+	AIModel: "ai-model",
+	Dataset: "dataset"
+};
+//#endregion
+//#region shared/typescript/bom/fingerprints.ts
+function record(input) {
+	return typeof input === "object" && input !== null && !Array.isArray(input) ? input : void 0;
+}
+/** CycloneDX: bomFormat === 'CycloneDX'. Returns 0..1 confidence. */
+function detectCycloneDX(input) {
+	return record(input)?.bomFormat === "CycloneDX" ? 1 : 0;
+}
+/**
+* CycloneDX ML-BOM: a CycloneDX document with at least one
+* machine-learning-model component. Strictly more specific than plain
+* CycloneDX.
+*/
+function detectCycloneDXML(input) {
+	const obj = record(input);
+	if (obj?.bomFormat !== "CycloneDX") return 0;
+	const components = obj.components;
+	if (!Array.isArray(components)) return 0;
+	return components.some((c) => record(c)?.type === "machine-learning-model") ? 1 : 0;
+}
+/** SPDX: a non-empty spdxVersion string is present. Returns 0..1 confidence. */
+function detectSPDX(input) {
+	const obj = record(input);
+	return typeof obj?.spdxVersion === "string" && obj.spdxVersion.length > 0 ? 1 : 0;
+}
+/**
+* SPDX 3.0 AI/Dataset (JSON-LD): a document with an `@context` and an `@graph`
+* array carrying at least one ai_AIPackage or dataset_DatasetPackage element.
+* Structurally disjoint from the SPDX 2.3 detector (which keys on spdxVersion),
+* so the two never conflict.
+*/
+function detectSPDX3(input) {
+	const obj = record(input);
+	if (!obj || obj["@context"] === void 0) return 0;
+	const graph = obj["@graph"];
+	if (!Array.isArray(graph)) return 0;
+	return graph.some((el) => {
+		const type = record(el)?.type;
+		return type === "ai_AIPackage" || type === "dataset_DatasetPackage";
+	}) ? 1 : 0;
+}
+/**
+* Detect the BOM format of a parsed JSON object. ML wins over plain CycloneDX
+* by precedence; returns undefined when no supported format matches.
+*/
+function detectFormat(input) {
+	const ml = detectCycloneDXML(input);
+	if (ml > 0) return {
+		format: "cyclonedx-ml",
+		confidence: ml
+	};
+	const cdx = detectCycloneDX(input);
+	if (cdx > 0) return {
+		format: "cyclonedx",
+		confidence: cdx
+	};
+	const spdx3 = detectSPDX3(input);
+	if (spdx3 > 0) return {
+		format: "spdx-3-ai",
+		confidence: spdx3
+	};
+	const spdx = detectSPDX(input);
+	if (spdx > 0) return {
+		format: "spdx",
+		confidence: spdx
+	};
+}
+//#endregion
+//#region shared/typescript/bom/cyclonedx.ts
+/**
+* CycloneDX SBOM -> normalized HDF BillOfMaterials.
+*
+* Flattens the top-level components[] into SBOM packages. Nested subcomponents
+* (metadata.component.components[]) are the tool's own assembly tree and are
+* intentionally not treated as inventory packages here.
+*/
+/** Extract license identifiers/expressions from a CycloneDX licenses[] array. */
+function extractLicenses$1(raw) {
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const entry of raw) {
+		const e = asRecord(entry);
+		if (!e) continue;
+		const license = asRecord(e.license);
+		const value = (license ? asString(license.id) ?? asString(license.name) : void 0) ?? asString(e.expression);
+		if (value) out.push(value);
+	}
+	return out;
+}
+function componentToPackage(component) {
+	const c = asRecord(component);
+	const name = c ? asString(c.name) : void 0;
+	if (!c || !name) return void 0;
+	const pkg = { name };
+	const version = asString(c.version);
+	if (version) pkg.version = version;
+	const purl = asString(c.purl);
+	if (purl) pkg.purl = purl;
+	const licenses = extractLicenses$1(c.licenses);
+	if (licenses.length > 0) pkg.licenses = licenses;
+	enrichFromPurl(pkg);
+	return pkg;
+}
+function parseCycloneDX(obj) {
+	const components = Array.isArray(obj.components) ? obj.components : [];
+	const packages = [];
+	for (const component of components) {
+		const pkg = componentToPackage(component);
+		if (pkg) packages.push(pkg);
+	}
+	const uniqueId = asString(obj.serialNumber);
+	return buildBom({
+		bomType: BOMType.Sbom,
+		format: "cyclonedx",
+		packages: limitArrayWithWarning(packages, "package"),
+		uniqueId
+	});
+}
+//#endregion
+//#region shared/typescript/bom/spdx.ts
+/**
+* SPDX SBOM -> normalized HDF BillOfMaterials.
+*
+* Maps packages[] to normalized SBOM packages. purl comes from an externalRefs
+* entry with referenceType 'purl'; licenses come from licenseConcluded /
+* licenseDeclared with NOASSERTION/NONE sentinels filtered out.
+*/
+const SPDX_LICENSE_FIELDS = ["licenseConcluded", "licenseDeclared"];
+/** First externalRefs[].referenceLocator whose referenceType is 'purl'. */
+function purlFromExternalRefs(refs) {
+	if (!Array.isArray(refs)) return void 0;
+	for (const ref of refs) {
+		const r = asRecord(ref);
+		if (r?.referenceType === "purl") {
+			const locator = asString(r.referenceLocator);
+			if (locator) return locator;
+		}
+	}
+}
+function extractLicenses(pkg) {
+	const out = [];
+	for (const field of SPDX_LICENSE_FIELDS) {
+		const license = cleanLicense(pkg[field]);
+		if (license && !out.includes(license)) out.push(license);
+	}
+	return out;
+}
+function packageToPackage(source) {
+	const p = asRecord(source);
+	const name = p ? asString(p.name) : void 0;
+	if (!p || !name) return void 0;
+	const pkg = { name };
+	const version = asString(p.versionInfo);
+	if (version) pkg.version = version;
+	const purl = purlFromExternalRefs(p.externalRefs);
+	if (purl) pkg.purl = purl;
+	const licenses = extractLicenses(p);
+	if (licenses.length > 0) pkg.licenses = licenses;
+	enrichFromPurl(pkg);
+	return pkg;
+}
+function parseSPDX(obj) {
+	const sourcePackages = Array.isArray(obj.packages) ? obj.packages : [];
+	const packages = [];
+	for (const source of sourcePackages) {
+		const pkg = packageToPackage(source);
+		if (pkg) packages.push(pkg);
+	}
+	const uniqueId = asString(obj.documentNamespace);
+	return buildBom({
+		bomType: BOMType.Sbom,
+		format: "spdx",
+		packages: limitArrayWithWarning(packages, "package"),
+		uniqueId
+	});
+}
+//#endregion
+//#region shared/typescript/bom/spdx3.ts
+/**
+* SPDX 3.0 AI/Dataset (JSON-LD) -> normalized HDF BillOfMaterials subjects.
+*
+* SPDX 3.0 is JSON-LD: a top-level { "@context", "@graph" } where "@graph" is an
+* array of typed elements. A single document is inherently MULTI-SUBJECT — it
+* can carry several ai_AIPackage and dataset_DatasetPackage elements — so this
+* parser returns one subject per AI/dataset element (unlike the single-BOM
+* parseSPDX / parseMLBOM paths). This is completely distinct from SPDX 2.3
+* (spdxVersion + packages[]), handled by parseSPDX.
+*
+* PARTIAL-FIDELITY: only fields that map cleanly onto the normalized extensions
+* are lifted; everything else (energy, autonomy, safety, bias, sensor, size, …)
+* is carried opaquely via the BOM `document` passthrough of the raw element.
+* Two conflation traps are deliberately avoided: ai_hyperparameter is training
+* knobs (-> hyperparameters, NEVER parameterCount) and dataset_datasetSize is
+* ambiguous/unlabeled (never -> recordCount).
+*/
+/** SPDX-3 relationship types that link a model to a training/eval dataset. */
+const DATASET_RELATIONSHIP_TYPES = /* @__PURE__ */ new Set(["trainedOn", "testedOn"]);
+function graphElements(obj) {
+	const graph = obj["@graph"];
+	if (!Array.isArray(graph)) return [];
+	const out = [];
+	for (const el of graph) {
+		const r = asRecord(el);
+		if (r) out.push(r);
+	}
+	return out;
+}
+/** Map SPDX DictionaryEntry[] ({key,value}) to normalized {name,value} pairs. */
+function dictionaryEntries(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	for (const entry of value) {
+		const e = asRecord(entry);
+		if (!e) continue;
+		const name = asString(e.key);
+		if (name === void 0) continue;
+		const value = e.value !== void 0 && e.value !== null ? stringifyScalar(e.value) : "";
+		out.push({
+			name,
+			value
+		});
+	}
+	return out;
+}
+/** First element of a non-empty string array, else undefined. */
+function firstString(value) {
+	if (!Array.isArray(value)) return void 0;
+	for (const item of value) {
+		const s = asString(item);
+		if (s !== void 0) return s;
+	}
+}
+/** Distinct non-empty strings of an array, joined with "; ". */
+function joinDistinct(value) {
+	if (!Array.isArray(value)) return void 0;
+	const seen = [];
+	for (const item of value) {
+		const s = asString(item);
+		if (s !== void 0 && !seen.includes(s)) seen.push(s);
+	}
+	return seen.length > 0 ? seen.join("; ") : void 0;
+}
+/**
+* Dataset references for a model: targets of trainedOn/testedOn relationships
+* whose `from` is this model. Each target is resolved to the referenced
+* dataset element's name when present in the graph, else the raw id. Distinct,
+* first-seen order.
+*/
+function datasetRefsFor(modelId, relationships, datasetNameById) {
+	const out = [];
+	for (const rel of relationships) {
+		if (asString(rel.from) !== modelId) continue;
+		if (!DATASET_RELATIONSHIP_TYPES.has(asString(rel.relationshipType) ?? "")) continue;
+		const targets = Array.isArray(rel.to) ? rel.to : [rel.to];
+		for (const target of targets) {
+			const targetId = asString(target);
+			if (targetId === void 0) continue;
+			const ref = datasetNameById.get(targetId) ?? targetId;
+			if (!out.includes(ref)) out.push(ref);
+		}
+	}
+	return out;
+}
+function buildModelExtension$1(element, relationships, datasetNameById) {
+	const model = {};
+	const hyperparameters = dictionaryEntries(element.ai_hyperparameter);
+	if (hyperparameters.length > 0) model.hyperparameters = hyperparameters;
+	const performanceMetrics = dictionaryEntries(element.ai_metric);
+	if (performanceMetrics.length > 0) model.performanceMetrics = performanceMetrics;
+	const task = firstString(element.ai_domain);
+	if (task !== void 0) model.task = task;
+	const architecture = joinDistinct(element.ai_typeOfModel);
+	if (architecture !== void 0) model.modelArchitecture = architecture;
+	const intendedUse = asString(element.ai_informationAboutApplication);
+	if (intendedUse !== void 0) model.intendedUse = intendedUse;
+	const datasetRefs = datasetRefsFor(asString(element.spdxId) ?? "", relationships, datasetNameById);
+	if (datasetRefs.length > 0) model.datasetRefs = datasetRefs;
+	return model;
+}
+function buildDatasetExtension(element) {
+	const dataset = {};
+	const modality = element.dataset_datasetType;
+	if (Array.isArray(modality)) {
+		const values = modality.map(asString).filter((s) => s !== void 0);
+		if (values.length > 0) dataset.modality = values;
+	}
+	const dataClassification = asString(element.dataset_confidentialityLevel);
+	if (dataClassification !== void 0) dataset.dataClassification = dataClassification;
+	const intendedUse = asString(element.dataset_intendedUse);
+	if (intendedUse !== void 0) dataset.intendedUse = intendedUse;
+	const provenance = asString(element.dataset_dataCollectionProcess);
+	if (provenance !== void 0) dataset.provenance = provenance;
+	return dataset;
+}
+/**
+* Parse an SPDX-3 JSON-LD document into its AI/dataset subjects. Emits one
+* aiModel subject per ai_AIPackage and one dataset subject per
+* dataset_DatasetPackage, in graph order.
+*/
+function parseSPDX3(obj) {
+	const elements = graphElements(obj);
+	const relationships = elements.filter((el) => el.type === "Relationship");
+	const datasetNameById = /* @__PURE__ */ new Map();
+	for (const el of elements) {
+		if (el.type !== "dataset_DatasetPackage") continue;
+		const id = asString(el.spdxId);
+		const name = asString(el.name);
+		if (id !== void 0 && name !== void 0) datasetNameById.set(id, name);
+	}
+	const subjects = [];
+	for (const element of elements) if (element.type === "ai_AIPackage") {
+		const model = buildModelExtension$1(element, relationships, datasetNameById);
+		subjects.push({
+			kind: "aiModel",
+			name: asString(element.name) ?? "",
+			id: asString(element.spdxId) ?? "",
+			bom: buildBom({
+				bomType: BOMType.AIModel,
+				format: "spdx-3-ai",
+				model,
+				document: element,
+				uniqueId: asString(element.spdxId)
+			})
+		});
+	} else if (element.type === "dataset_DatasetPackage") {
+		const dataset = buildDatasetExtension(element);
+		subjects.push({
+			kind: "dataset",
+			name: asString(element.name) ?? "",
+			id: asString(element.spdxId) ?? "",
+			bom: buildBom({
+				bomType: BOMType.Dataset,
+				format: "spdx-3-ai",
+				dataset,
+				document: element,
+				uniqueId: asString(element.spdxId)
+			})
+		});
+	}
+	return { subjects: limitArrayWithWarning(subjects, "subject") };
+}
+//#endregion
+//#region shared/typescript/bom/ml-bom.ts
+/**
+* CycloneDX ML-BOM -> normalized HDF ai-model BillOfMaterials.
+*
+* PARTIAL-FIDELITY: only modelCard fields that map cleanly onto the normalized
+* AI_Model_Extension are lifted (modelArchitecture, datasetRefs, intendedUse,
+* learningApproach, task, performanceMetrics, inputOutput.dataTypes).
+* parameterCount, serializationFormat, hyperparameters, and the rest of
+* inputOutput have NO native CycloneDX ML source, so they are left undefined —
+* never fabricated. The raw machine-learning-model component is carried verbatim
+* in the BOM `document` passthrough so nothing is lost, satisfying the
+* "drop-or-passthrough, never invent" rule.
+*/
+function findModelComponent(obj) {
+	const components = Array.isArray(obj.components) ? obj.components : [];
+	for (const component of components) {
+		const c = asRecord(component);
+		if (c?.type === "machine-learning-model") return c;
+	}
+}
+/**
+* References to training/evaluation datasets. Only ref-shaped entries (a bare
+* ref string, or an object with a `ref`) are lifted; inline dataset descriptors
+* without a reference are left for a future dataset-normalization pass rather
+* than being synthesized into a ref.
+*/
+function extractDatasetRefs(datasets) {
+	if (!Array.isArray(datasets)) return [];
+	const out = [];
+	for (const dataset of datasets) {
+		if (typeof dataset === "string") {
+			if (dataset.length > 0) out.push(dataset);
+			continue;
+		}
+		const ref = asString(asRecord(dataset)?.ref);
+		if (ref) out.push(ref);
+	}
+	return out;
+}
+/** Intended-use statement from modelCard.considerations.useCases, if present. */
+function extractIntendedUse(considerations) {
+	const c = asRecord(considerations);
+	if (!c || !Array.isArray(c.useCases)) return void 0;
+	const parts = c.useCases.map(asString).filter((s) => s !== void 0);
+	return parts.length > 0 ? parts.join("; ") : void 0;
+}
+/**
+* Reported evaluation metrics from modelCard.quantitativeAnalysis. Each native
+* metric's `type` becomes the normalized `name` and its `value` is carried as a
+* string (metrics are heterogeneous). An entry contributes only when it has a
+* name or value; native slice/confidenceInterval are left in the `document`.
+*/
+function extractPerformanceMetrics(quantitativeAnalysis) {
+	const qa = asRecord(quantitativeAnalysis);
+	if (!qa || !Array.isArray(qa.performanceMetrics)) return [];
+	const out = [];
+	for (const entry of qa.performanceMetrics) {
+		const e = asRecord(entry);
+		if (!e) continue;
+		const name = asString(e.type);
+		const value = e.value !== void 0 && e.value !== null ? stringifyScalar(e.value) : void 0;
+		if (name === void 0 && value === void 0) continue;
+		const metric = {};
+		if (name !== void 0) metric.name = name;
+		if (value !== void 0) metric.value = value;
+		out.push(metric);
+	}
+	return out;
+}
+/** Distinct `format` strings across modelParameters.inputs[] and outputs[]. */
+function extractIODataTypes(parameters) {
+	const out = [];
+	for (const key of ["inputs", "outputs"]) {
+		const entries = parameters[key];
+		if (!Array.isArray(entries)) continue;
+		for (const entry of entries) {
+			const format = asString(asRecord(entry)?.format);
+			if (format && !out.includes(format)) out.push(format);
+		}
+	}
+	return out;
+}
+function buildModelExtension(modelComponent) {
+	const model = {};
+	const modelCard = asRecord(modelComponent.modelCard);
+	if (!modelCard) return model;
+	const parameters = asRecord(modelCard.modelParameters);
+	if (parameters) {
+		const architecture = asString(parameters.modelArchitecture) ?? asString(parameters.architectureFamily);
+		if (architecture) model.modelArchitecture = architecture;
+		const datasetRefs = extractDatasetRefs(parameters.datasets);
+		if (datasetRefs.length > 0) model.datasetRefs = datasetRefs;
+		const learningApproach = asString(asRecord(parameters.approach)?.type);
+		if (learningApproach) model.learningApproach = learningApproach;
+		const task = asString(parameters.task);
+		if (task) model.task = task;
+		const dataTypes = extractIODataTypes(parameters);
+		if (dataTypes.length > 0) model.inputOutput = { dataTypes };
+	}
+	const performanceMetrics = extractPerformanceMetrics(modelCard.quantitativeAnalysis);
+	if (performanceMetrics.length > 0) model.performanceMetrics = performanceMetrics;
+	const intendedUse = extractIntendedUse(modelCard.considerations);
+	if (intendedUse) model.intendedUse = intendedUse;
+	return model;
+}
+function parseMLBOM(obj) {
+	const modelComponent = findModelComponent(obj);
+	const model = modelComponent ? buildModelExtension(modelComponent) : {};
+	return buildBom({
+		bomType: BOMType.AIModel,
+		format: "cyclonedx-ml",
+		model,
+		document: modelComponent,
+		uniqueId: asString(obj.serialNumber)
+	});
+}
+//#endregion
+//#region shared/typescript/bom/normalize.ts
+/**
+* Shared BOM normalization: parseBom / buildBom / detectFormat re-dispatch and
+* the cross-format helpers (object guards, license cleaning, purl handling).
+* Format-specific extraction lives in cyclonedx.ts / spdx.ts / ml-bom.ts.
+*/
+const CONVERTER = "bom-parser";
+/** SPDX sentinels that mean "no license", filtered out of normalized output. */
+const SPDX_NULL_LICENSES = /* @__PURE__ */ new Set(["noassertion", "none"]);
+/** Narrow an unknown value to a plain object (not array, not null). */
+function asRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/** Narrow an unknown value to a non-empty string. */
+function asString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/**
+* Render a heterogeneous scalar BOM value (metric value, SPDX DictionaryEntry
+* value) to a string. This is the REFERENCE the Go side matches byte-for-byte
+* (see stringifyScalar / jsNumberToString in normalize.go): JS String() gives
+* numbers their shortest round-tripping form, and Go reimplements that exact
+* formatting. Callers must guard null/undefined before calling.
+*/
+function stringifyScalar(value) {
+	return String(value);
+}
+/** Return an SPDX license string unless it is a NOASSERTION/NONE sentinel. */
+function cleanLicense(value) {
+	const s = asString(value);
+	if (!s) return void 0;
+	return SPDX_NULL_LICENSES.has(s.trim().toLowerCase()) ? void 0 : s;
+}
+/**
+* Fill a package's missing name/version from its purl when parseable. Never
+* overwrites values the source BOM already provided (e.g. an SPDX versionInfo
+* is authoritative over a purl whose @segment is a git commit).
+*/
+function enrichFromPurl(pkg) {
+	if (!pkg.purl) return;
+	const parsed = parsePurl(pkg.purl);
+	if (!parsed) return;
+	if (!pkg.version && parsed.version) pkg.version = parsed.version;
+	if (!pkg.name && parsed.name) pkg.name = parsed.name;
+}
+/**
+* Assemble a schema-valid BillOfMaterials from normalized parts, enforcing the
+* three-tier discipline: the packages/model/dataset extension is kept only when
+* it matches bomType; a mismatched extension is silently dropped (the schema
+* forbids it, so carrying it would produce invalid output).
+*/
+function buildBom(parts) {
+	const bom = {
+		bomType: parts.bomType,
+		format: parts.format
+	};
+	if (parts.ref !== void 0) bom.ref = parts.ref;
+	if (parts.document !== void 0) bom.document = parts.document;
+	if (parts.uniqueId !== void 0) bom.uniqueId = parts.uniqueId;
+	if (parts.hashes !== void 0 && parts.hashes.length > 0) bom.hashes = parts.hashes;
+	if (parts.license !== void 0) bom.license = parts.license;
+	if (parts.bomType === BOMType.Sbom && parts.packages !== void 0) bom.packages = parts.packages;
+	if (parts.bomType === BOMType.AIModel && parts.model !== void 0) bom.model = parts.model;
+	if (parts.bomType === BOMType.Dataset && parts.dataset !== void 0) bom.dataset = parts.dataset;
+	return bom;
+}
+/**
+* Detect and parse a BOM document into normalized form. Validates input size
+* FIRST (security boundary), then dispatches on the detected format. Throws on
+* oversized or undetectable input.
+*/
+function parseBom(input) {
+	validateInputSize(input, CONVERTER);
+	const obj = parseJSON(input);
+	const detected = detectFormat(obj);
+	if (!detected) throw new Error("bom-parser: could not detect a supported BOM format (expected CycloneDX or SPDX JSON)");
+	const record = asRecord(obj) ?? {};
+	switch (detected.format) {
+		case "cyclonedx-ml": return {
+			format: detected.format,
+			normalized: parseMLBOM(record)
+		};
+		case "cyclonedx": return {
+			format: detected.format,
+			normalized: parseCycloneDX(record)
+		};
+		case "spdx": return {
+			format: detected.format,
+			normalized: parseSPDX(record)
+		};
+		case "spdx-3-ai": {
+			const [first] = parseSPDX3(record).subjects;
+			if (!first) throw new Error("bom-parser: SPDX-3 document carries no AI/dataset subjects");
+			return {
+				format: detected.format,
+				normalized: first.bom
+			};
+		}
+	}
+}
+//#endregion
 //#region converters/cyclonedx-to-hdf/typescript/converter.ts
 const CVSS_METHODS = /* @__PURE__ */ new Set([
 	"CVSSv2",
@@ -3828,7 +4662,7 @@ function maxImpact(ratings) {
 	for (const rating of ratings) {
 		let impact;
 		if (rating.method && CVSS_METHODS.has(rating.method) && rating.score !== void 0 && rating.score !== null) impact = rating.score / 10;
-		else impact = severityToImpact(rating.severity ?? "medium");
+		else impact = severityToImpact$1(rating.severity ?? "medium");
 		if (impact > max) max = impact;
 	}
 	return max;
@@ -3863,19 +4697,29 @@ function flattenComponents(components) {
 	return result;
 }
 /**
+* Reports whether any (possibly nested) component is a machine-learning-model,
+* i.e. the CycloneDX document is an AI-BOM.
+*/
+function hasMLModelComponent(components) {
+	return flattenComponents(components).some((comp) => comp.type === "machine-learning-model");
+}
+/**
 * Converts CycloneDX SBOM/VEX JSON to HDF format.
 *
 * @param input - CycloneDX JSON string
 * @returns HDF JSON string
 */
-async function convertCyclonedxToHdf(input) {
+async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("cyclonedx: empty input");
 	validateInputSize(input, "cyclonedx");
 	const bom = parseJSON(input);
 	if (!bom || typeof bom !== "object") throw new Error("cyclonedx: invalid JSON");
 	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx: missing or invalid bomFormat (expected "CycloneDX", got "${bom.bomFormat ?? "undefined"}")`);
 	if ((!bom.components || bom.components.length === 0) && (!bom.vulnerabilities || bom.vulnerabilities.length === 0)) throw new Error("cyclonedx: input has neither components nor vulnerabilities");
-	if (!bom.vulnerabilities || bom.vulnerabilities.length === 0) throw new Error("cyclonedx: this file is an SBOM inventory with no vulnerabilities; to import SBOM data into a system document, use:\n  hdf system create --from <sbom-file> --component-name <name>");
+	if (!bom.vulnerabilities || bom.vulnerabilities.length === 0) {
+		if (hasMLModelComponent(bom.components ?? [])) throw new Error("cyclonedx: this file is a CycloneDX AI-BOM (machine-learning-model inventory) with no vulnerabilities; to import it into a system document, use:\n  hdf system create <file> --from cyclonedx-mlbom");
+		throw new Error("cyclonedx: this file is an SBOM inventory with no vulnerabilities; to import SBOM data into a system document, use:\n  hdf system create <sbom-file> --component-name <name>");
+	}
 	const resultsChecksum = await inputChecksum(input);
 	const parsedTimestamp = bom.metadata?.timestamp ? parseTimestamp(bom.metadata.timestamp) ?? void 0 : void 0;
 	const scanTime = parsedTimestamp && !isNaN(parsedTimestamp.getTime()) ? parsedTimestamp : /* @__PURE__ */ new Date();
@@ -3917,13 +4761,12 @@ async function convertCyclonedxToHdf(input) {
 			data: fixParts.join("\n\n")
 		});
 		const affects = vuln.affects ?? [];
-		const results = affects.length > 0 ? affects.map((affect) => createResult(ResultStatus.Failed, void 0, {
-			codeDesc: formatCodeDesc$4(componentLookup, affect.ref),
-			startTime: scanTime
-		})) : [createResult(ResultStatus.Failed, void 0, {
-			codeDesc: `Vulnerability ${vuln.id}`,
+		const toResult = (codeDesc) => ({
+			status: ResultStatus.Failed,
+			codeDesc,
 			startTime: scanTime
-		})];
+		});
+		const results = affects.length > 0 ? affects.map((affect) => toResult(formatCodeDesc$4(componentLookup, affect.ref))) : [toResult(`Vulnerability ${vuln.id}`)];
 		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
 		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
 		const controlType = deriveControlTypeFromTags(nist);
@@ -3931,16 +4774,29 @@ async function convertCyclonedxToHdf(input) {
 		requirements.push(req);
 	}
 	const baseline = createMinimalBaseline("CycloneDX Scan", requirements, { resultsChecksum });
-	const targetName = bom.metadata?.component?.name ?? "";
+	const targetComponent = {
+		name: bom.metadata?.component?.name ?? "",
+		type: TargetType.Application
+	};
+	if (bom.metadata?.component?.version) targetComponent.version = bom.metadata.component.version;
+	const parsedBom = parseBom(input);
+	const bomParts = {
+		bomType: BOMType.Sbom,
+		format: "cyclonedx",
+		uniqueId: parsedBom.normalized.uniqueId,
+		document: JSON.parse(input)
+	};
+	if (parsedBom.normalized.packages && parsedBom.normalized.packages.length > 0) bomParts.packages = parsedBom.normalized.packages;
+	const componentBom = buildBom(bomParts);
 	return buildHdfResults({
 		generatorName: "cyclonedx-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "CycloneDX",
 		toolFormat: "JSON",
 		baselines: [baseline],
 		components: [{
-			name: targetName,
-			type: TargetType.Application
+			...targetComponent,
+			boms: [componentBom]
 		}],
 		timestamp: scanTime
 	});
@@ -3954,7 +4810,7 @@ async function convertCyclonedxToHdf(input) {
 */
 function convertHdfToCsv(input) {
 	validateInputSize(input, "hdf-to-csv");
-	const hdf = parseJSON(input);
+	const hdf = parseHdf(input);
 	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
 	const rows = [];
@@ -3974,6 +4830,11 @@ function convertHdfToCsv(input) {
 */
 function createRow(baseline, requirement, target) {
 	const description = requirement.descriptions.find((d) => d.label === "default")?.data || "";
+	const check = descriptionByLabel(requirement, "check");
+	const fix = descriptionByLabel(requirement, "fix");
+	const rationale = descriptionByLabel(requirement, "rationale");
+	const code = requirement.code ?? "";
+	const references = flattenRefs(requirement.refs);
 	const severity = getSeverity(requirement);
 	const firstResult = requirement.results[0];
 	const status = firstResult?.status || "";
@@ -3989,6 +4850,11 @@ function createRow(baseline, requirement, target) {
 		"Requirement ID": requirement.id,
 		"Requirement Title": requirement.title || "",
 		"Description": description,
+		"Check": check,
+		"Fix": fix,
+		"Rationale": rationale,
+		"Code": code,
+		"References": references,
 		"Severity": severity,
 		"Impact": requirement.impact,
 		"Status": String(status),
@@ -4011,21 +4877,826 @@ function getSeverity(requirement) {
 			if (Array.isArray(sev) && sev.length > 0) return String(sev[0]);
 		}
 	}
-	const impact = requirement.impact;
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "medium";
-	return "low";
+	const impact = requirement.impact;
+	if (impact >= .7) return "high";
+	if (impact >= .4) return "medium";
+	return "low";
+}
+/**
+* Extract array values from tags object and join with semicolons
+*/
+function extractArrayFromTags(tags, key) {
+	if (!tags || typeof tags !== "object") return "";
+	const value = tags[key];
+	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
+	return "";
+}
+/**
+* Get the data of the first description matching a label. Empty when absent.
+*/
+function descriptionByLabel(requirement, label) {
+	return requirement.descriptions.find((d) => d.label === label)?.data || "";
+}
+/**
+* Flatten a requirement's refs to one string: each Reference rendered as its
+* url/uri (or a string `ref`); array-form refs are skipped. Joined with '; ' to
+* match the NIST/CCI column convention.
+*/
+function flattenRefs(refs) {
+	if (!Array.isArray(refs)) return "";
+	const out = [];
+	for (const r of refs) {
+		if (!r || typeof r !== "object") continue;
+		const o = r;
+		if (typeof o.url === "string") out.push(o.url);
+		else if (typeof o.uri === "string") out.push(o.uri);
+		else if (typeof o.ref === "string") out.push(o.ref);
+	}
+	return out.join("; ");
+}
+//#endregion
+//#region shared/typescript/exportmap.ts
+/**
+* Generic, source-tool-agnostic mapping helpers shared by the HDF export
+* converters (hdf-to-ecs, hdf-to-splunk, ...).
+*
+* The export converters deliberately operate on generically-parsed JSON rather
+* than typed HDF structs, so their output can be held byte-identical with the
+* Go implementations. This module centralizes the generic accessors, the status
+* roll-up, the requirement/document field extraction, and the canonical
+* (key-sorted, HTML-unescaped) line serialization. Target-specific event shaping
+* (ECS field names, CIM field names, envelopes) stays in each converter.
+*/
+function asMap(v) {
+	return v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+function asArr(v) {
+	return Array.isArray(v) ? v : void 0;
+}
+function getStr(m, key) {
+	const v = m?.[key];
+	return typeof v === "string" ? v : "";
+}
+function setIf(m, key, val) {
+	if (val !== "") m[key] = val;
+}
+function stringSlice(v) {
+	if (typeof v === "string") return [v];
+	if (Array.isArray(v)) return v.filter((e) => typeof e === "string");
+	return [];
+}
+/** Most-significant status across a requirement's results[] (lossless). */
+function worstOfResults(req) {
+	const results = asArr(req.results) ?? [];
+	const precedence = [
+		"failed",
+		"error",
+		"passed",
+		"notReviewed",
+		"notApplicable"
+	];
+	const present = /* @__PURE__ */ new Set();
+	for (const rRaw of results) {
+		const r = asMap(rRaw);
+		if (r) present.add(getStr(r, "status"));
+	}
+	for (const s of precedence) if (present.has(s)) return s;
+	return "notReviewed";
+}
+/**
+* Whether an HDF Result_Status is a failing verdict. Only 'failed' fails;
+* 'error' is indeterminate (not a compliance failure) and every other value is
+* non-failing. Single shared definition of "failing" for the suppression axis
+* and the per-exporter outcome maps.
+*/
+function isFailing(status) {
+	return status === "failed";
+}
+/** Resolve the status context for a requirement. */
+function statusOf(req) {
+	const raw = worstOfResults(req);
+	const effective = getStr(req, "effectiveStatus");
+	const overrides = asArr(req.statusOverrides);
+	const rollup = effective !== "" ? effective : raw;
+	return {
+		raw,
+		effective,
+		rollup,
+		overridden: overrides !== void 0 && overrides.length > 0 || "effectiveStatus" in req,
+		suppressed: isFailing(raw) && !isFailing(rollup)
+	};
+}
+function firstComponent(doc) {
+	const comps = asArr(doc.components);
+	if (!comps || comps.length === 0) return void 0;
+	return asMap(comps[0]);
+}
+function firstResultStartTime(req, fallback) {
+	const results = asArr(req.results) ?? [];
+	if (results.length > 0) {
+		const st = getStr(asMap(results[0]), "startTime");
+		if (st !== "") return st;
+	}
+	return fallback;
+}
+function defaultDescription(req) {
+	const descs = asArr(req.descriptions) ?? [];
+	for (const dRaw of descs) {
+		const d = asMap(dRaw);
+		if (d && getStr(d, "label") === "default") return getStr(d, "data");
+	}
+	return "";
+}
+function firstRefURL(req) {
+	const refs = asArr(req.refs) ?? [];
+	for (const rRaw of refs) {
+		const url = getStr(asMap(rRaw), "url");
+		if (url !== "") return url;
+	}
+	return "";
+}
+/** Deterministic event id: component | baseline | control. */
+function eventID(component, baselineName, controlID) {
+	let comp = "";
+	if (component) comp = getStr(component, "componentId") || getStr(component, "name");
+	return [
+		comp,
+		baselineName,
+		controlID
+	].join("|");
+}
+/**
+* Build the lossless hdf.* namespace shared by the export converters: promoted
+* snake_case scalars plus the full requirement sub-objects preserved verbatim.
+* `status` is the lossless results roll-up (statusOf().raw); `suppressed` is the
+* acceptance axis (statusOf().suppressed).
+*/
+function buildHDFBlock(req, baseline, status, overridden, suppressed, generator, tool, converterVersion) {
+	const hdf = {
+		status,
+		overridden,
+		suppressed,
+		exporter_version: converterVersion
+	};
+	setIf(hdf, "control_id", getStr(req, "id"));
+	setIf(hdf, "baseline", getStr(baseline, "name"));
+	if ("effectiveStatus" in req) hdf.effective_status = req.effectiveStatus;
+	if ("effectiveImpact" in req) hdf.effective_impact = req.effectiveImpact;
+	if ("impact" in req) hdf.impact = req.impact;
+	if ("severity" in req) hdf.severity = req.severity;
+	if ("disposition" in req) hdf.disposition = req.disposition;
+	const tags = asMap(req.tags);
+	if (tags?.nist !== void 0) hdf.nist = tags.nist;
+	if (tags?.cci !== void 0) hdf.cci = tags.cci;
+	for (const [src, dst] of Object.entries({
+		tags: "tags",
+		cvss: "cvss",
+		cwe: "cwe",
+		epss: "epss",
+		kev: "kev",
+		affectedPackages: "affected_packages",
+		descriptions: "descriptions",
+		results: "results",
+		statusOverrides: "status_overrides",
+		poams: "poams",
+		code: "code",
+		refs: "refs"
+	})) if (src in req) hdf[dst] = req[src];
+	if (generator) hdf.generator = generator;
+	if (tool) hdf.tool = tool;
+	return hdf;
+}
+/**
+* A numeric value that must serialize with an explicit decimal point, so a
+* whole-number renders as `10.0` rather than the integer `10`. Some consumers
+* type-check strictly (OCSF's `float_t` rejects an integer-shaped token).
+* JSON.stringify cannot emit `10.0` for a JS number, so the value is carried in
+* this wrapper (passed through canonicalize untouched) and rendered as a bare
+* numeric token by stringifyLine. Go's counterpart is encoding/json's json.Number.
+*/
+var RawNumber = class {
+	constructor(token) {
+		this.token = token;
+	}
+};
+/** Wrap a number as a RawNumber whose token always bears a decimal point. */
+function floatNumber(f) {
+	let s = String(f);
+	if (!/[.eE]/.test(s)) s += ".0";
+	return new RawNumber(s);
+}
+const RAWNUM_MARK = String.fromCharCode(1);
+const RAWNUM_RE = /"\\u0001(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\\u0001"/g;
+/**
+* Compare two strings by Unicode code point. This matches Go's `encoding/json`
+* key ordering, which is a bytewise comparison of the UTF-8 encoding \u2014 and UTF-8
+* byte order is identical to code-point order. JS's default Array.sort() instead
+* compares UTF-16 code units, which diverges for supplementary-plane (non-BMP)
+* characters: a lead surrogate (0xD800\u20130xDBFF) sorts before a BMP char in
+* [0xE000,0xFFFF] under UTF-16, but a non-BMP code point (\u22650x10000) sorts after
+* it under UTF-8. Iterating the string yields whole code points (surrogate pairs
+* combined), so this comparator is correct for the full Unicode range.
+*/
+function byCodePoint(a, b) {
+	const ai = [...a];
+	const bi = [...b];
+	const n = Math.min(ai.length, bi.length);
+	for (let i = 0; i < n; i++) {
+		const ca = ai[i]?.codePointAt(0) ?? 0;
+		const cb = bi[i]?.codePointAt(0) ?? 0;
+		if (ca !== cb) return ca - cb;
+	}
+	return ai.length - bi.length;
+}
+/**
+* Recursively sort object keys in Go's map-key order (bytewise UTF-8 / code
+* point) so the emitted JSON is byte-identical to Go's encoder.
+*/
+function canonicalize$1(v) {
+	if (v instanceof RawNumber) return v;
+	if (Array.isArray(v)) return v.map(canonicalize$1);
+	const m = asMap(v);
+	if (m) {
+		const out = {};
+		for (const k of Object.keys(m).sort(byCodePoint)) out[k] = canonicalize$1(m[k]);
+		return out;
+	}
+	return v;
+}
+/**
+* Emit compact JSON matching Go's encoder byte-for-byte. A RawNumber is rendered
+* as a bare numeric token (Go's json.Number) via an SOH-delimited placeholder
+* that is stripped back to the token afterward. Go's encoding/json escapes
+* U+2028/U+2029 (JSONP safety) while JSON.stringify emits them raw, so we escape
+* them here. Key ordering is handled upstream by canonicalize (code point order).
+*/
+function stringifyLine(v) {
+	return JSON.stringify(v, (_key, val) => val instanceof RawNumber ? RAWNUM_MARK + val.token + RAWNUM_MARK : val).replace(RAWNUM_RE, "$1").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+/**
+* Shared entry-point driver for the HDF→SIEM exporters: runs the identical
+* prologue (validate, parse, baselines extraction, doc-level context), fans out
+* one output object per requirement via `build`, and joins the canonical NDJSON
+* lines (byte-identical with the Go `Export` driver). `converterName` prefixes
+* the missing-baselines error and drives validateInputSize.
+*/
+function runExport(input, converterName, build) {
+	validateInputSize(input, converterName);
+	const doc = parseHdf(input);
+	const baselines = asArr(doc.baselines);
+	if (!baselines) throw new Error(`${converterName}: invalid HDF structure: missing baselines field`);
+	const docTimestamp = getStr(doc, "timestamp");
+	const tool = asMap(doc.tool);
+	const generator = asMap(doc.generator);
+	const component = firstComponent(doc);
+	const lines = [];
+	for (const bRaw of baselines) {
+		const baseline = asMap(bRaw);
+		if (!baseline) continue;
+		const reqs = asArr(baseline.requirements) ?? [];
+		for (const rRaw of reqs) {
+			const req = asMap(rRaw);
+			if (!req) continue;
+			lines.push(stringifyLine(canonicalize$1(build(req, baseline, docTimestamp, tool, generator, component))));
+		}
+	}
+	return lines.length === 0 ? "" : lines.join("\n") + "\n";
+}
+/**
+* The first cvss[].source that looks like a CVE id (case-insensitive "CVE-"
+* prefix), or ''. Shared by the exporters that key vulnerability identity off
+* the CVE (splunk, ocsf).
+*/
+function firstCVE(cvssList) {
+	for (const c of cvssList) {
+		const src = getStr(asMap(c), "source");
+		if (src.toUpperCase().startsWith("CVE-")) return src;
+	}
+	return "";
+}
+/**
+* Parse an HDF RFC3339 timestamp into integer epoch seconds (Splunk HEC `time`)
+* via the canonical parser, returning undefined when empty/unparseable. Integer
+* epoch keeps Go and TypeScript byte-identical.
+*/
+function epochSeconds(s) {
+	const d = parseTimestamp(s);
+	if (d === null) return void 0;
+	return Math.floor(d.getTime() / 1e3);
+}
+/**
+* Parse an HDF RFC3339 timestamp into integer epoch milliseconds (OCSF `time`)
+* via the canonical parser, returning undefined when empty/unparseable.
+*/
+function epochMillis(s) {
+	const d = parseTimestamp(s);
+	if (d === null) return void 0;
+	return d.getTime();
+}
+//#endregion
+//#region converters/hdf-to-ecs/typescript/converter.ts
+/**
+* HDF Results -> Elastic Common Schema (ECS) NDJSON exporter.
+*
+* One ECS event per Evaluated_Requirement, in the hybrid shape from ADR-0002:
+* a core-ECS-native projection plus a lossless hdf.* block, hot filter scalars
+* promoted flat. Output is plain NDJSON (LF-delimited, trailing newline), ECS
+* 9.4.0.
+*
+* Status is raw-primary: event.outcome carries the RAW verdict (a waived failure
+* is still failure), and hdf.suppressed is the separate acceptance axis. The
+* canonical "still actionable" query is
+* event.outcome:"failure" AND hdf.suppressed:false.
+*
+* Generic JSON access, the status roll-up, requirement/document field
+* extraction, and the canonical line serialization are shared with the other
+* export converters via ../../../shared/typescript/exportmap.js; only
+* ECS-specific event shaping lives here. Output is held byte-identical with the
+* Go implementation via key-sorted, HTML-unescaped compact JSON.
+*/
+const ECS_VERSION = "9.4.0";
+function convertHdfToEcs(input, converterVersion = "0.1.0") {
+	return runExport(input, "hdf-to-ecs", (req, baseline, docTimestamp, tool, generator, component) => buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion));
+}
+function buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
+	const st = statusOf(req);
+	const outcome = statusToOutcome(st.raw);
+	const controlID = getStr(req, "id");
+	const baselineName = getStr(baseline, "name");
+	const title = getStr(req, "title");
+	const cvssList = asArr(req.cvss);
+	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
+	const categories = ["configuration"];
+	if (hasCVSS) categories.push("vulnerability");
+	const event = {
+		kind: "state",
+		category: categories,
+		type: ["info"],
+		outcome,
+		id: eventID(component, baselineName, controlID),
+		dataset: "hdf.findings",
+		module: "hdf"
+	};
+	const obj = {
+		"@timestamp": firstResultStartTime(req, docTimestamp),
+		ecs: { version: ECS_VERSION },
+		event,
+		message: (title + " — " + st.raw).trim()
+	};
+	const observer = buildObserver(tool, generator);
+	if (observer) obj.observer = observer;
+	const host = buildHost(component);
+	if (host) {
+		obj.host = host;
+		const related = buildRelated(component);
+		if (related) obj.related = related;
+	}
+	obj.rule = buildRule(req, baseline, controlID, title);
+	if (hasCVSS) obj.vulnerability = buildVulnerability$1(cvssList, req, tool);
+	const threat = buildThreat(req);
+	if (threat) obj.threat = threat;
+	obj.hdf = buildHDFBlock(req, baseline, st.raw, st.overridden, st.suppressed, generator, tool, converterVersion);
+	return obj;
+}
+function buildObserver(tool, generator) {
+	let name = getStr(tool, "name");
+	let version = getStr(tool, "version");
+	if (name === "" && generator) {
+		name = getStr(generator, "name");
+		version = getStr(generator, "version");
+	}
+	if (name === "") return void 0;
+	const observer = {
+		name,
+		type: "scanner"
+	};
+	if (version !== "") observer.version = version;
+	const product = getStr(tool, "format");
+	if (product !== "") observer.product = product;
+	return observer;
+}
+function buildHost(component) {
+	if (!component) return void 0;
+	const host = {};
+	const name = getStr(component, "fqdn") || getStr(component, "name");
+	if (name !== "") host.name = name;
+	setIf(host, "id", getStr(component, "componentId"));
+	setIf(host, "ip", getStr(component, "ipAddress"));
+	setIf(host, "mac", getStr(component, "macAddress"));
+	const os = {};
+	setIf(os, "name", getStr(component, "osName"));
+	setIf(os, "version", getStr(component, "osVersion"));
+	if (Object.keys(os).length > 0) host.os = os;
+	return Object.keys(host).length === 0 ? void 0 : host;
+}
+function buildRelated(component) {
+	const related = {};
+	const name = getStr(component, "fqdn") || getStr(component, "name");
+	if (name !== "") related.hosts = [name];
+	const ip = getStr(component, "ipAddress");
+	if (ip !== "") related.ip = [ip];
+	return Object.keys(related).length === 0 ? void 0 : related;
+}
+function buildRule(req, baseline, controlID, title) {
+	const rule = { id: controlID };
+	if (title !== "") rule.name = title;
+	setIf(rule, "description", defaultDescription(req));
+	setIf(rule, "ruleset", getStr(baseline, "name"));
+	setIf(rule, "version", getStr(baseline, "version"));
+	setIf(rule, "reference", firstRefURL(req));
+	return rule;
+}
+function buildVulnerability$1(cvssList, req, tool) {
+	const first = asMap(cvssList[0]) ?? {};
+	const vuln = {};
+	const source = getStr(first, "source");
+	if (source !== "") {
+		vuln.id = source;
+		if (source.toUpperCase().startsWith("CVE-")) vuln.enumeration = "CVE";
+	} else setIf(vuln, "id", getStr(req, "id"));
+	vuln.classification = "CVSS";
+	const score = {};
+	if ("baseScore" in first) score.base = first.baseScore;
+	setIf(score, "version", getStr(first, "version"));
+	if (Object.keys(score).length > 0) vuln.score = score;
+	const severity = getStr(first, "baseSeverity") || getStr(req, "severity");
+	if (severity !== "") vuln.severity = severity;
+	const vendor = getStr(tool, "name");
+	if (vendor !== "") vuln.scanner = { vendor };
+	setIf(vuln, "description", defaultDescription(req));
+	return vuln;
+}
+function buildThreat(req) {
+	const tags = asMap(req.tags);
+	if (!tags) return void 0;
+	const techniques = [];
+	for (const key of [
+		"mitre_attack",
+		"attack",
+		"mitre_techniques"
+	]) for (const id of stringSlice(tags[key])) techniques.push({ id });
+	if (techniques.length === 0) return void 0;
+	return {
+		framework: "MITRE ATT&CK",
+		technique: techniques
+	};
+}
+function statusToOutcome(status) {
+	switch (status) {
+		case "passed": return "success";
+		case "failed": return "failure";
+		default: return "unknown";
+	}
+}
+//#endregion
+//#region converters/hdf-to-splunk/typescript/converter.ts
+/**
+* HDF Results -> Splunk HEC-envelope NDJSON, normalized to the Common
+* Information Model (CIM). See ADR-0004.
+*
+* One HEC event per Evaluated_Requirement, hybrid shape: flat CIM-named scalars
+* (signature/signature_id/cve/cvss/severity/dest/vendor_product/category) are
+* promoted to the top of the event payload; the hot query scalars among them
+* (signature/signature_id/dest/severity/cve/cvss + hdf_status + suppressed) are
+* additionally mirrored into the HEC indexed `fields` (surviving Splunk's
+* ~5000-char cutoff), plus a lossless hdf.* block.
+*
+* Status is raw-primary: hdf_status carries the RAW verdict (a waived failure is
+* still failed) and suppressed is the separate acceptance axis. The companion TA
+* (Splunk_TA_hdf) tags failed/error/CVE findings into the CIM Vulnerabilities
+* data model but excludes suppressed=true, so a waived control drops out while a
+* risk-adjusted still-failing control stays in. Canonical "still actionable"
+* query: hdf_status=failed suppressed=false.
+*
+* Generic access, the status roll-up, field extraction, the lossless hdf.*
+* block, and the canonical line serialization are shared with the other
+* exporters via exportmap; output is held byte-identical with the Go side.
+*/
+const SOURCETYPE = "hdf:results";
+const SOURCE = "hdf-exporter";
+function convertHdfToSplunk(input, converterVersion = "0.1.0") {
+	return runExport(input, "hdf-to-splunk", (req, baseline, docTimestamp, tool, generator, component) => buildHECEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion));
+}
+function buildHECEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
+	const st = statusOf(req);
+	const title = getStr(req, "title");
+	const controlID = getStr(req, "id");
+	const signature = title !== "" ? title : controlID;
+	const dest = destHost(component);
+	const sev = severity(req);
+	const [cvss, hasCVSS] = maxCVSS(req);
+	const cve = firstCVE(asArr(req.cvss) ?? []);
+	const category = firstCWE(req);
+	const vendorProduct = getStr(tool, "name");
+	const event = {
+		signature,
+		hdf_status: st.raw,
+		suppressed: st.suppressed,
+		hdf: buildHDFBlock(req, baseline, st.raw, st.overridden, st.suppressed, generator, tool, converterVersion)
+	};
+	setIf(event, "signature_id", controlID);
+	setIf(event, "dest", dest);
+	setIf(event, "severity", sev);
+	setIf(event, "cve", cve);
+	setIf(event, "category", category);
+	setIf(event, "vendor_product", vendorProduct);
+	if (hasCVSS) event.cvss = cvss;
+	const fields = {
+		signature,
+		hdf_status: st.raw,
+		suppressed: st.suppressed
+	};
+	setIf(fields, "signature_id", controlID);
+	setIf(fields, "dest", dest);
+	setIf(fields, "severity", sev);
+	setIf(fields, "cve", cve);
+	if (hasCVSS) fields.cvss = cvss;
+	const hec = {
+		source: SOURCE,
+		sourcetype: SOURCETYPE,
+		event,
+		fields
+	};
+	const t = epochSeconds(firstResultStartTime(req, docTimestamp));
+	if (t !== void 0) hec.time = t;
+	setIf(hec, "host", dest);
+	return hec;
+}
+function destHost(component) {
+	if (!component) return "";
+	return getStr(component, "fqdn") || getStr(component, "name") || getStr(component, "ipAddress");
+}
+function severity(req) {
+	if (typeof req.impact === "number") return impactToSeverity(req.impact);
+	return normalizeSeverity(getStr(req, "severity"));
+}
+function normalizeSeverity(s) {
+	switch (s) {
+		case "critical":
+		case "high":
+		case "medium":
+		case "low":
+		case "informational": return s;
+		default: return "informational";
+	}
+}
+function maxCVSS(req) {
+	const list = asArr(req.cvss) ?? [];
+	let max = 0;
+	let found = false;
+	for (const c of list) {
+		const m = asMap(c);
+		if (m && typeof m.baseScore === "number") {
+			if (!found || m.baseScore > max) max = m.baseScore;
+			found = true;
+		}
+	}
+	return [max, found];
 }
-/**
-* Extract array values from tags object and join with semicolons
-*/
-function extractArrayFromTags(tags, key) {
-	if (!tags || typeof tags !== "object") return "";
-	const value = tags[key];
-	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
+function firstCWE(req) {
+	const list = asArr(req.cwe) ?? [];
+	for (const c of list) if (typeof c === "string" && c !== "") return c;
 	return "";
 }
 //#endregion
+//#region converters/hdf-to-ocsf/typescript/converter.ts
+/**
+* HDF Results -> OCSF (Open Cybersecurity Schema Framework) Finding NDJSON.
+* See the ADR-0002 addendum (HDF -> OCSF, wvc3.5). Pinned to OCSF v1.8.0.
+*
+* One Finding per requirement: a CVE finding -> Vulnerability Finding
+* (class_uid 2002), any other -> Compliance Finding (class_uid 2003), both in
+* the Findings category (2). Status model is raw-primary: compliance.status_id
+* carries the RAW verdict (a failed control stays Fail even when waived). The
+* acceptance axis rides the base finding status_id: a raw-failing finding that
+* an override drove non-failing (waiver/falsePositive/attestation) -> 3
+* Suppressed, everything else -> 1 New; a riskAdjustment/operationalRequirement/
+* poam that leaves the finding failing stays New (actionable, only re-scored).
+* The exact override chain is preserved in unmapped.hdf_requirement (+ comment).
+* Canonical "still actionable" query: compliance.status_id=3 AND status_id=1.
+*
+* Shares the generic access / status roll-up / field extraction / canonical
+* line serialization with the other exporters via exportmap; output is held
+* byte-identical with the Go implementation.
+*/
+const OCSF_VERSION = "1.8.0";
+const CATEGORY_FINDINGS = 2;
+const CLASS_COMPLIANCE = 2003;
+const CLASS_VULNERABILITY = 2002;
+const ACTIVITY_CREATE = 1;
+const STATUS_NEW = 1;
+const STATUS_SUPPRESSED = 3;
+function convertHdfToOcsf(input, converterVersion = "0.1.0") {
+	return runExport(input, "hdf-to-ocsf", (req, baseline, docTimestamp, tool, generator, component) => buildFinding(req, baseline, docTimestamp, tool, generator, component, converterVersion));
+}
+function buildFinding(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
+	const st = statusOf(req);
+	const cvssList = asArr(req.cvss);
+	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
+	const title = getStr(req, "title");
+	const controlID = getStr(req, "id");
+	const cls = hasCVSS ? CLASS_VULNERABILITY : CLASS_COMPLIANCE;
+	const findingInfo = { uid: controlID };
+	setIf(findingInfo, "title", title);
+	setIf(findingInfo, "desc", defaultDescription(req));
+	if (hasCVSS) {
+		const tags = frameworkTags(req);
+		if (tags.length > 0) findingInfo.tags = tags;
+	}
+	const finding = {
+		category_uid: CATEGORY_FINDINGS,
+		class_uid: cls,
+		type_uid: cls * 100 + ACTIVITY_CREATE,
+		activity_id: ACTIVITY_CREATE,
+		severity_id: severityID(req),
+		status_id: st.suppressed ? STATUS_SUPPRESSED : STATUS_NEW,
+		metadata: buildMetadata$1(tool, generator, converterVersion),
+		finding_info: findingInfo,
+		unmapped: { hdf_requirement: req }
+	};
+	finding.time = epochMillis(firstResultStartTime(req, docTimestamp)) ?? 0;
+	setIf(finding, "comment", overrideComment(req));
+	const device = buildDevice(component);
+	if (device) finding.device = device;
+	if (hasCVSS) finding.vulnerabilities = buildVulnerabilities(cvssList, req);
+	else finding.compliance = buildCompliance(req, baseline, title, st.raw);
+	return finding;
+}
+function severityID(req) {
+	if (typeof req.impact === "number") return severityIDFromString(impactToSeverity(req.impact));
+	return severityIDFromString(getStr(req, "severity"));
+}
+function severityIDFromString(s) {
+	switch (s.toLowerCase()) {
+		case "critical": return 5;
+		case "high": return 4;
+		case "medium": return 3;
+		case "low": return 2;
+		case "informational":
+		case "info":
+		case "none": return 1;
+		default: return 0;
+	}
+}
+function complianceStatusID(rawStatus) {
+	switch (rawStatus) {
+		case "passed": return 1;
+		case "failed": return 3;
+		default: return 2;
+	}
+}
+function complianceStatusCaption(statusID) {
+	switch (statusID) {
+		case 1: return "Pass";
+		case 3: return "Fail";
+		default: return "Warning";
+	}
+}
+function overrideComment(req) {
+	const disposition = getStr(req, "disposition");
+	const overrides = asArr(req.statusOverrides) ?? [];
+	if (disposition === "" && overrides.length === 0) return "";
+	let reason = "";
+	if (overrides.length > 0) reason = getStr(asMap(overrides[0]), "reason");
+	if (disposition !== "" && reason !== "") return `${disposition}: ${reason}`;
+	if (disposition !== "") return disposition;
+	return reason;
+}
+function buildMetadata$1(tool, generator, converterVersion) {
+	const metadata = { version: OCSF_VERSION };
+	let name = getStr(tool, "name");
+	let version = getStr(tool, "version");
+	let vendor = getStr(tool, "format");
+	if (name === "" && generator) {
+		name = getStr(generator, "name");
+		version = getStr(generator, "version");
+	}
+	if (name === "") {
+		name = "hdf-to-ocsf";
+		version = converterVersion;
+		vendor = "";
+	}
+	const product = { name };
+	setIf(product, "version", version);
+	setIf(product, "vendor_name", vendor);
+	metadata.product = product;
+	return metadata;
+}
+function buildDevice(component) {
+	if (!component) return void 0;
+	const device = { type_id: 0 };
+	setIf(device, "name", getStr(component, "name"));
+	setIf(device, "hostname", getStr(component, "fqdn"));
+	setIf(device, "ip", getStr(component, "ipAddress"));
+	setIf(device, "uid", getStr(component, "componentId"));
+	const osName = getStr(component, "osName");
+	if (osName !== "") {
+		const os = {
+			name: osName,
+			type_id: osTypeID(osName)
+		};
+		setIf(os, "version", getStr(component, "osVersion"));
+		device.os = os;
+	}
+	return Object.keys(device).length === 1 ? void 0 : device;
+}
+const OS_LINUX = [
+	"linux",
+	"rhel",
+	"red hat",
+	"ubuntu",
+	"centos",
+	"debian",
+	"fedora",
+	"suse"
+];
+const OS_MAC = [
+	"mac",
+	"darwin",
+	"os x"
+];
+function osTypeID(osName) {
+	const n = osName.toLowerCase();
+	if (n.includes("windows")) return 100;
+	if (OS_LINUX.some((k) => n.includes(k))) return 200;
+	if (OS_MAC.some((k) => n.includes(k))) return 300;
+	return 0;
+}
+function frameworkTags(req) {
+	const tags = asMap(req.tags);
+	const out = [];
+	for (const key of ["nist", "cci"]) {
+		const vals = stringSlice(tags?.[key]);
+		if (vals.length > 0) out.push({
+			name: key,
+			values: vals
+		});
+	}
+	return out;
+}
+function buildCompliance(req, baseline, title, rawStatus) {
+	const statusID = complianceStatusID(rawStatus);
+	const compliance = {
+		status_id: statusID,
+		status: complianceStatusCaption(statusID)
+	};
+	const controlID = getStr(req, "id");
+	setIf(compliance, "control", controlID);
+	const baselineName = getStr(baseline, "name");
+	const tags = asMap(req.tags);
+	const nist = stringSlice(tags?.nist);
+	const cci = stringSlice(tags?.cci);
+	const standards = [];
+	if (baselineName !== "") standards.push(baselineName);
+	if (nist.length > 0) standards.push("NIST SP 800-53");
+	if (cci.length > 0) standards.push("CCI");
+	if (standards.length > 0) compliance.standards = standards;
+	const checks = [];
+	if (controlID !== "") {
+		const check = {
+			uid: controlID,
+			status_id: statusID
+		};
+		setIf(check, "name", title);
+		if (baselineName !== "") check.standards = [baselineName];
+		checks.push(check);
+	}
+	for (const id of nist) checks.push({
+		uid: id,
+		standards: ["NIST SP 800-53"]
+	});
+	for (const id of cci) checks.push({
+		uid: id,
+		standards: ["CCI"]
+	});
+	if (checks.length > 0) compliance.checks = checks;
+	return compliance;
+}
+function buildVulnerabilities(cvssList, req) {
+	const cve = {};
+	cve.uid = firstCVE(cvssList) || getStr(req, "id");
+	const cvssArr = [];
+	for (const c of cvssList) {
+		const m = asMap(c);
+		if (!m) continue;
+		const entry = {};
+		if (typeof m.baseScore === "number") entry.base_score = floatNumber(m.baseScore);
+		setIf(entry, "version", getStr(m, "version"));
+		setIf(entry, "vector_string", getStr(m, "baseVector"));
+		setIf(entry, "severity", getStr(m, "baseSeverity"));
+		cvssArr.push(entry);
+	}
+	if (cvssArr.length > 0) cve.cvss = cvssArr;
+	const cwes = stringSlice(req.cwe);
+	if (cwes.length > 0) cve.related_cwes = cwes.map((id) => ({ uid: id }));
+	const vuln = { cve };
+	setIf(vuln, "title", getStr(req, "title"));
+	setIf(vuln, "desc", defaultDescription(req));
+	const ref = firstRefURL(req);
+	if (ref !== "") vuln.references = [ref];
+	return [vuln];
+}
+//#endregion
 //#region converters/splunk-to-hdf/typescript/converter.ts
 /**
 * Map a Splunk result status string to the HDF ResultStatus enum.
@@ -4041,11 +5712,12 @@ function mapStatus$1(status) {
 }
 /**
 * Convert a Splunk descriptions object (`{ key: value }`) to an array of
-* HDF Description objects.
+* HDF Description objects. Labels are sorted: Go decodes the same object into
+* a map, so sorting is the only ordering both languages can agree on.
 */
 function convertDescriptions(descriptions) {
 	if (!descriptions || typeof descriptions !== "object") return [];
-	return Object.entries(descriptions).map(([label, data]) => createDescription(label, data));
+	return Object.entries(descriptions).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([label, data]) => createDescription(label, data));
 }
 /**
 * Convert Splunk profile groups (which use `controls`) to HDF
@@ -4069,7 +5741,7 @@ function convertGroups(groups) {
 * @param input - JSON string of a SplunkEvent array
 * @returns HDF Results JSON string
 */
-async function convertSplunkToHdf(input) {
+async function convertSplunkToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "splunk");
 	const resultsChecksum = await inputChecksum(input);
 	const events = parseJSON(input);
@@ -4081,9 +5753,10 @@ async function convertSplunkToHdf(input) {
 		eventsByGuid.get(guid).push(event);
 	}
 	const allBaselines = [];
-	let targetName = "unknown";
-	let targetRelease = "";
-	for (const [, guidEvents] of eventsByGuid) {
+	const components = [];
+	let statistics;
+	for (const guid of [...eventsByGuid.keys()].sort()) {
+		const guidEvents = eventsByGuid.get(guid);
 		const headers = [];
 		const profiles = [];
 		const controls = [];
@@ -4100,8 +5773,13 @@ async function convertSplunkToHdf(input) {
 		}
 		if (headers.length !== 1) throw new Error(`Expected 1 header event, got ${headers.length}`);
 		const header = headers[0];
-		targetName = header.platform.name;
-		targetRelease = header.platform.release;
+		const component = {
+			name: header.platform.name,
+			type: TargetType.Host
+		};
+		if (header.platform.release) component.osVersion = header.platform.release;
+		components.push(component);
+		statistics = convertStatistics(header.statistics);
 		const controlsByProfile = /* @__PURE__ */ new Map();
 		for (const control of controls) {
 			const sha = control.meta.profile_sha256 ?? "";
@@ -4111,16 +5789,24 @@ async function convertSplunkToHdf(input) {
 		for (const profile of profiles) {
 			const requirements = (controlsByProfile.get(profile.sha256) ?? []).map((control) => {
 				const descriptions = convertDescriptions(control.descriptions);
-				const results = Array.isArray(control.results) ? control.results.map((result) => createResult(mapStatus$1(result.status), result.message, {
-					codeDesc: result.code_desc,
-					startTime: parseTimestamp(result.start_time) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
-					runTime: result.run_time,
-					exception: result.exception,
-					backtrace: result.backtrace
-				})) : [];
+				if (descriptions.length === 0) descriptions.push(createDescription("default", control.desc ?? ""));
+				const results = Array.isArray(control.results) ? control.results.map((result) => {
+					const res = createResult(mapStatus$1(result.status), result.skip_message || result.message, {
+						codeDesc: result.code_desc,
+						startTime: parseTimestamp(result.start_time) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
+						runTime: result.run_time,
+						exception: result.exception,
+						backtrace: result.backtrace
+					});
+					if (!res.message) delete res.message;
+					if (result.resource) res.resource = result.resource;
+					return res;
+				}) : [];
 				const options = { tags: control.tags ?? {} };
 				if (control.source_location) options.sourceLocation = control.source_location;
 				const req = createRequirement(control.id, control.title, descriptions, control.impact, results, options);
+				if (!req.title) delete req.title;
+				if (control.code) req.code = control.code;
 				const nistTagsRaw = control.tags?.["nist"];
 				const controlType = deriveControlTypeFromTags(Array.isArray(nistTagsRaw) ? nistTagsRaw.filter((t) => typeof t === "string") : []);
 				if (controlType !== void 0) req.controlType = controlType;
@@ -4133,23 +5819,34 @@ async function convertSplunkToHdf(input) {
 			if (profile.version) baselineOptions.version = profile.version;
 			if (profile.summary) baselineOptions.summary = profile.summary;
 			if (groups.length > 0) baselineOptions.groups = groups;
-			allBaselines.push(createMinimalBaseline(profile.name, requirements, baselineOptions));
+			if (profile.sha256) baselineOptions.integrity = {
+				algorithm: HashAlgorithm.Sha256,
+				checksum: profile.sha256
+			};
+			const baseline = createMinimalBaseline(profile.name, requirements, baselineOptions);
+			if (profile.copyright) baseline.copyright = profile.copyright;
+			if (profile.maintainer) baseline.maintainer = profile.maintainer;
+			if (profile.license) baseline.license = profile.license;
+			allBaselines.push(baseline);
 		}
 	}
-	return serializeHdf({
+	return buildHdfResults({
+		generatorName: "splunk-to-hdf",
+		converterVersion,
+		toolName: "Splunk",
 		baselines: allBaselines,
-		components: [{
-			name: targetName,
-			type: TargetType.Host,
-			osName: targetRelease || void 0,
-			labels: {}
-		}],
-		generator: {
-			name: "splunk-to-hdf",
-			version: "1.0.0"
-		}
+		components,
+		statistics,
+		timestamp: /* @__PURE__ */ new Date()
 	});
 }
+/** Extract the assessment duration from a Splunk header's statistics blob. */
+function convertStatistics(stats) {
+	if (!stats || typeof stats !== "object") return void 0;
+	const out = {};
+	if (typeof stats["duration"] === "number") out.duration = stats["duration"];
+	return out;
+}
 //#endregion
 //#region converters/hdf-to-xml/typescript/converter.ts
 /**
@@ -4159,7 +5856,7 @@ async function convertSplunkToHdf(input) {
 */
 function convertHdfToXml(input) {
 	validateInputSize(input, "hdf-to-xml");
-	const hdf = parseJSON(input);
+	const hdf = parseHdf(input);
 	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
 	return buildXml({ HdfResults: transformHdfToXmlObject(hdf) });
@@ -4171,6 +5868,20 @@ function wrap$1(value) {
 	return { "#text": value };
 }
 /**
+* Transform a polymorphic Reference ({url} | {uri} | {ref: string}) into an
+* XML-friendly object. Array-form `ref` values are skipped.
+*/
+function transformReference(r) {
+	const out = {};
+	if (r && typeof r === "object") {
+		const o = r;
+		if (typeof o.url === "string") out.url = wrap$1(o.url);
+		else if (typeof o.uri === "string") out.uri = wrap$1(o.uri);
+		else if (typeof o.ref === "string") out.ref = wrap$1(o.ref);
+	}
+	return out;
+}
+/**
 * Transform HDF object to XML-compatible structure
 * Converts arrays to repeated singular elements
 */
@@ -4180,6 +5891,16 @@ function transformHdfToXmlObject(hdf) {
 		name: wrap$1(baseline.name),
 		...baseline.version && { version: wrap$1(baseline.version) },
 		...baseline.title && { title: wrap$1(baseline.title) },
+		...baseline.summary && { summary: wrap$1(baseline.summary) },
+		...baseline.status && { status: wrap$1(baseline.status) },
+		...baseline.resultsChecksum && { resultsChecksum: {
+			algorithm: wrap$1(baseline.resultsChecksum.algorithm),
+			value: wrap$1(baseline.resultsChecksum.value)
+		} },
+		...baseline.originalChecksum && { originalChecksum: {
+			algorithm: wrap$1(baseline.originalChecksum.algorithm),
+			value: wrap$1(baseline.originalChecksum.value)
+		} },
 		...baseline.integrity && { integrity: {
 			...baseline.integrity.algorithm && { algorithm: wrap$1(baseline.integrity.algorithm) },
 			...baseline.integrity.checksum && { checksum: wrap$1(baseline.integrity.checksum) }
@@ -4189,11 +5910,13 @@ function transformHdfToXmlObject(hdf) {
 	})) };
 	else result.baselines = {};
 	if (hdf.components && hdf.components.length > 0) result.components = { target: hdf.components.map((target) => ({
+		...target.componentId && { componentId: wrap$1(target.componentId) },
 		name: wrap$1(target.name),
 		type: wrap$1(target.type),
+		...target.hostname && { hostname: wrap$1(target.hostname) },
 		...target.fqdn && { fqdn: wrap$1(target.fqdn) },
-		...target.ipAddress && { ipAddress: wrap$1(target.ipAddress) },
-		...target.hostname && { hostname: wrap$1(target.hostname) }
+		...target.domain && { domain: wrap$1(target.domain) },
+		...target.ipAddress && { ipAddress: wrap$1(target.ipAddress) }
 	})) };
 	if (hdf.statistics) {
 		result.statistics = {};
@@ -4201,7 +5924,10 @@ function transformHdfToXmlObject(hdf) {
 		if (hdf.statistics.requirements) result.statistics.requirements = hdf.statistics.requirements;
 	}
 	if (hdf.timestamp) result.timestamp = wrap$1(typeof hdf.timestamp === "string" ? hdf.timestamp : hdf.timestamp.toISOString());
-	if (hdf.generator) result.generator = hdf.generator;
+	if (hdf.generator) result.generator = {
+		name: wrap$1(hdf.generator.name),
+		...hdf.generator.version && { version: wrap$1(hdf.generator.version) }
+	};
 	return result;
 }
 /**
@@ -4215,11 +5941,20 @@ function transformRequirement(req) {
 			label: wrap$1(d.label),
 			data: wrap$1(d.data)
 		})) } },
+		...req.code && { code: wrap$1(req.code) },
+		...req.sourceLocation && { sourceLocation: {
+			...req.sourceLocation.ref !== void 0 && { ref: wrap$1(req.sourceLocation.ref) },
+			...req.sourceLocation.line !== void 0 && { line: wrap$1(req.sourceLocation.line) }
+		} },
+		...req.controlType && { controlType: wrap$1(req.controlType) },
+		...req.verificationMethod && { verificationMethod: wrap$1(req.verificationMethod) },
+		...req.applicability && { applicability: wrap$1(req.applicability) },
+		...req.refs && req.refs.length > 0 && { refs: { ref: req.refs.map(transformReference) } },
 		impact: wrap$1(req.impact)
 	};
 	if (req.tags && Object.keys(req.tags).length > 0) {
 		const transformedTags = {};
-		for (const [key, value] of Object.entries(req.tags)) if (Array.isArray(value) && value.length > 0) transformedTags[key] = value.map((v) => wrap$1(v));
+		for (const [key, value] of Object.entries(req.tags).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) if (Array.isArray(value) && value.length > 0) transformedTags[key] = value.map((v) => wrap$1(v));
 		else if (!Array.isArray(value)) transformedTags[key] = wrap$1(value);
 		if (Object.keys(transformedTags).length > 0) result.tags = transformedTags;
 	}
@@ -4235,7 +5970,7 @@ function transformRequirement(req) {
 //#endregion
 //#region converters/gitlab-to-hdf/typescript/converter.ts
 function gitlabSeverityToImpact(severity) {
-	return severityToImpact(severity.toLowerCase());
+	return severityToImpact$1(severity.toLowerCase());
 }
 function scanTypeToTargetType(scanType) {
 	switch (scanType) {
@@ -4325,7 +6060,7 @@ function buildCodeDesc$4(scanType, location) {
 		default: return `Location: ${JSON.stringify(location)}`;
 	}
 }
-async function convertGitlabToHdf(input) {
+async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "gitlab");
 	const resultsChecksum = await inputChecksum(input);
 	const report = parseJSON(input);
@@ -4400,7 +6135,7 @@ async function convertGitlabToHdf(input) {
 		components,
 		generator: {
 			name: "gitlab-to-hdf",
-			version: "unknown"
+			version: converterVersion
 		},
 		tool
 	};
@@ -4453,6 +6188,18 @@ function groupFindings(findings) {
 	return groups;
 }
 /**
+* Order ExtraData keys the way Go's map marshalling does (lexicographic), so the
+* embedded message string is byte-identical in both languages.
+*/
+function canonicalize(value) {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+		return Object.fromEntries(entries.map(([k, v]) => [k, canonicalize(v)]));
+	}
+	return value;
+}
+/**
 * Build the Result.Message JSON from selected finding fields.
 */
 function buildMessage(f) {
@@ -4461,7 +6208,7 @@ function buildMessage(f) {
 		Redacted: f.Redacted
 	};
 	if (f.VerificationError) msg.VerificationError = f.VerificationError;
-	if (f.ExtraData && Object.keys(f.ExtraData).length > 0) msg.ExtraData = f.ExtraData;
+	if (f.ExtraData && Object.keys(f.ExtraData).length > 0) msg.ExtraData = canonicalize(f.ExtraData);
 	return JSON.stringify(msg);
 }
 /**
@@ -4534,7 +6281,7 @@ function buildRequirement$12(reqID, findings) {
 * @param input - TruffleHog JSON/NDJSON string
 * @returns HDF JSON string
 */
-async function convertTrufflehogToHdf(input) {
+async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("trufflehog: empty input");
 	validateInputSize(input, "trufflehog");
 	const findings = parseFindings(input);
@@ -4554,7 +6301,7 @@ async function convertTrufflehogToHdf(input) {
 		})],
 		generator: {
 			name: "trufflehog-to-hdf",
-			version: "1.0.0"
+			version: converterVersion
 		},
 		tool: {
 			name: "TruffleHog",
@@ -4605,7 +6352,7 @@ function formatCodeDesc$3(hostIP, hostURL, location, issueDetail, confidence) {
 * @param input - BurpSuite XML string
 * @returns HDF JSON string
 */
-async function convertBurpsuiteToHdf(input) {
+async function convertBurpsuiteToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("burpsuite: empty input");
 	validateInputSize(input, "burpsuite");
 	const resultsChecksum = await inputChecksum(input);
@@ -4645,7 +6392,7 @@ async function convertBurpsuiteToHdf(input) {
 		}],
 		generator: {
 			name: "burpsuite-to-hdf",
-			version: "1.0.0"
+			version: converterVersion
 		},
 		tool
 	};
@@ -4706,6 +6453,26 @@ const IMPACT_MAPPING$4 = {
 	low: .3,
 	informational: 0
 };
+const NAMED_ENTITIES$2 = {
+	amp: "&",
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'"
+};
+/**
+* Decodes XML character references. The shared parser runs with
+* processEntities disabled to block entity-expansion attacks, which also leaves
+* the five predefined references undecoded — Go's encoding/xml decodes them, so
+* the raw text would otherwise differ between the two converters.
+*/
+function decodeXmlEntities$2(s) {
+	return s.replace(/&(#\d+|#x[0-9a-fA-F]+|amp|lt|gt|quot|apos);/g, (match, ref) => {
+		if (ref.startsWith("#x") || ref.startsWith("#X")) return String.fromCodePoint(parseInt(ref.slice(2), 16));
+		if (ref.startsWith("#")) return String.fromCodePoint(parseInt(ref.slice(1), 10));
+		return NAMED_ENTITIES$2[ref] ?? match;
+	});
+}
 /**
 * Maps metadata column names to row values by position index.
 * Mirrors the heimdall2 compileFindings function.
@@ -4720,7 +6487,7 @@ function compileFindings(parsed) {
 		colNames.forEach((name, i) => {
 			const val = values[i];
 			if (val === null || val === void 0 || typeof val === "object") finding[name] = "";
-			else finding[name] = String(val);
+			else finding[name] = decodeXmlEntities$2(String(val));
 		});
 		return finding;
 	});
@@ -4795,10 +6562,11 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 		data: formatDesc$1(rep)
 	}];
 	const results = findings.map((f) => {
-		return createResult(hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed, void 0, {
+		return {
+			status: hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed,
 			codeDesc: f["Details"] ?? "",
 			startTime: parseDate(f["Date"] ?? "")
-		});
+		};
 	});
 	const req = createRequirement(checkID, rep["Check"] ?? "", descriptions, getImpact$6(rep["Risk DV"] ?? ""), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -4814,7 +6582,7 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 * @param input - DBProtect XML string
 * @returns HDF JSON string
 */
-async function convertDbprotectToHdf(input) {
+async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("dbprotect: empty input");
 	validateInputSize(input, "dbprotect");
 	const resultsChecksum = await inputChecksum(input);
@@ -4842,16 +6610,19 @@ async function convertDbprotectToHdf(input) {
 	const title = firstFinding["Job Name"] ?? "";
 	const summary = formatSummary(firstFinding);
 	const targetName = firstFinding["Asset"] ?? "";
+	const baseline = createMinimalBaseline("DBProtect Scan", requirements, {
+		resultsChecksum,
+		title,
+		summary
+	});
+	const policy = firstFinding["Policy"] ?? "";
+	if (policy) baseline.version = policy;
 	return buildHdfResults({
 		generatorName: "dbprotect-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "DBProtect",
 		toolFormat: "XML",
-		baselines: [createMinimalBaseline("DBProtect Scan", requirements, {
-			resultsChecksum,
-			title,
-			summary
-		})],
+		baselines: [baseline],
 		components: [{
 			name: targetName,
 			type: TargetType.Host
@@ -5040,7 +6811,7 @@ function buildPackageTypeIndex(pkgs) {
 */
 function formatCodeDesc$2(vuln) {
 	const packageName = vuln.packageName ?? "N/A";
-	const impactedVersions = vuln.impactedVersions && vuln.impactedVersions.length > 0 ? JSON.stringify(vuln.impactedVersions) : "N/A";
+	const impactedVersions = vuln.impactedVersions && vuln.impactedVersions.length > 0 ? `[${vuln.impactedVersions.join(" ")}]` : "N/A";
 	return `Package ${JSON.stringify(packageName)} should be updated to latest version above impacted versions ${impactedVersions}`;
 }
 /**
@@ -5061,10 +6832,11 @@ function buildRequirement$9(vuln, packageTypes, distro) {
 		data: vuln.description
 	}];
 	const startTime = (vuln.discoveredDate ? parseTimestamp(vuln.discoveredDate) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
-	const results = [createResult(ResultStatus.Failed, void 0, {
+	const results = [{
+		status: ResultStatus.Failed,
 		codeDesc: formatCodeDesc$2(vuln),
 		startTime
-	})];
+	}];
 	const req = createRequirement(vuln.id, vuln.id, descriptions, twistlockSeverityToImpact(vuln.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -5106,7 +6878,7 @@ function convertSingleResult(result, resultsChecksum) {
 * @param input - Twistlock JSON string
 * @returns HDF JSON string
 */
-async function convertTwistlockToHdf(input) {
+async function convertTwistlockToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("twistlock: empty input");
 	validateInputSize(input, "twistlock");
 	const resultsChecksum = await inputChecksum(input);
@@ -5117,18 +6889,19 @@ async function convertTwistlockToHdf(input) {
 	else results = [parsed];
 	if (results.length === 0) throw new Error("twistlock: no scan results found");
 	const baselines = results.map((result) => convertSingleResult(result, resultsChecksum));
-	const targetName = results[0].name ?? results[0].repository ?? "";
+	const component = {
+		name: results[0].name ?? results[0].repository ?? "",
+		type: TargetType.ContainerImage
+	};
+	const imageID = results[0].id;
+	if (imageID) component.labels = { image: imageID };
 	return buildHdfResults({
 		generatorName: "twistlock-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Twistlock",
 		toolFormat: "JSON",
 		baselines,
-		components: [{
-			name: targetName,
-			type: TargetType.ContainerImage,
-			labels: { image: results[0]?.id ?? targetName }
-		}],
+		components: [component],
 		timestamp: /* @__PURE__ */ new Date()
 	});
 }
@@ -5190,10 +6963,11 @@ function buildRequirement$8(finding, timestamp) {
 		data: finding.vulnerability.recommendation
 	});
 	const codeDesc = finding.vulnerability.recommendation ?? "No recommendation available";
-	const results = [createResult(ResultStatus.Failed, void 0, {
+	const results = [{
+		status: ResultStatus.Failed,
 		codeDesc,
 		startTime: (timestamp ? parseTimestamp(timestamp) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
-	})];
+	}];
 	const req = createRequirement(finding.matrix, getTitle$1(finding), descriptions, getImpact$5(finding.vulnerability.severity), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags(nist);
@@ -5227,7 +7001,7 @@ function buildAffectedPackageFromComponent(c) {
 * @param input - Dependency-Track FPF JSON string
 * @returns HDF JSON string
 */
-async function convertDeptrackToHdf(input) {
+async function convertDeptrackToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("deptrack: empty input");
 	validateInputSize(input, "deptrack");
 	const resultsChecksum = await inputChecksum(input);
@@ -5247,7 +7021,7 @@ async function convertDeptrackToHdf(input) {
 	const targetName = parsed.project?.name ?? parsed.project?.uuid ?? "";
 	return buildHdfResults({
 		generatorName: "deptrack-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Dependency-Track",
 		toolFormat: "JSON",
 		baselines: [baseline],
@@ -5326,11 +7100,12 @@ function buildRequirement$7(entryID, entries, scanTime) {
 		label: "default",
 		data: formatDescription(rep)
 	}];
-	const results = entries.map((entry) => createResult(ResultStatus.Failed, void 0, {
+	const results = entries.map((entry) => ({
+		status: ResultStatus.Failed,
 		codeDesc: formatCodeDesc$1(entry),
 		startTime: scanTime
 	}));
-	const req = createRequirement(entryID, rep.summary, descriptions, severityToImpact(rep.severity), results, { tags });
+	const req = createRequirement(entryID, rep.summary, descriptions, severityToImpact$1(rep.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -5383,7 +7158,7 @@ function buildAffectedPackageFromEntry(entry) {
 * @param input - JFrog Xray JSON string
 * @returns HDF JSON string
 */
-async function convertJfrogXrayToHdf(input) {
+async function convertJfrogXrayToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("jfrog-xray: empty input");
 	validateInputSize(input, "jfrog-xray");
 	const resultsChecksum = await inputChecksum(input);
@@ -5410,7 +7185,7 @@ async function convertJfrogXrayToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("jfrog-xray-no-findings", "JFrog Xray scanned the target artifact and reported zero vulnerable components.", scanTime));
 	return buildHdfResults({
 		generatorName: "jfrog-xray-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "JFrog Xray",
 		toolFormat: "JSON",
 		baselines: [createMinimalBaseline("JFrog Xray Scan", requirements, { resultsChecksum })],
@@ -5519,7 +7294,7 @@ function targetNameFromReport(report) {
 * @param input - NeuVector scan JSON string
 * @returns HDF JSON string
 */
-async function convertNeuvectorToHdf(input) {
+async function convertNeuvectorToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("neuvector: empty input");
 	validateInputSize(input, "neuvector");
 	const scan = parseJSON(input);
@@ -5541,7 +7316,7 @@ async function convertNeuvectorToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("neuvector-no-findings", `NeuVector scanned ${target} and reported zero vulnerable components.`, scanTime));
 	return buildHdfResults({
 		generatorName: "neuvector-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "NeuVector",
 		toolFormat: "JSON",
 		baselines: [createMinimalBaseline("NeuVector Scan", requirements, {
@@ -5563,6 +7338,23 @@ async function convertNeuvectorToHdf(input) {
 //#region converters/fortify-to-hdf/typescript/converter.ts
 const NIST_REFERENCE_NAME = "Standards Mapping - NIST Special Publication 800-53 Revision 4";
 const NIST_PATTERN = /[a-zA-Z]{2}-\d+/g;
+const NAMED_ENTITIES$1 = {
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'",
+	amp: "&"
+};
+function decodeXmlEntities$1(s) {
+	return s.replace(/&(?:#(\d+)|#[xX]([0-9a-fA-F]+)|(lt|gt|quot|apos|amp));/g, (match, dec, hex, name) => {
+		if (dec !== void 0) return String.fromCodePoint(Number.parseInt(dec, 10));
+		if (hex !== void 0) return String.fromCodePoint(Number.parseInt(hex, 16));
+		return name !== void 0 ? NAMED_ENTITIES$1[name] ?? match : match;
+	});
+}
+function stripFvdlMarkup(s) {
+	return stripHTML(decodeXmlEntities$1(s));
+}
 function buildSnippetMap(snippets) {
 	const map = /* @__PURE__ */ new Map();
 	for (const s of snippets) if (s.id) map.set(s.id, s);
@@ -5612,8 +7404,8 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 	if (nistTags.length === 0) nistTags = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1];
 	const cciTags = nistToCci(nistTags);
 	const tags = buildNistCciTags(nistTags, cciTags);
-	const title = stripHTML(desc.Abstract ?? "");
-	let explanationText = stripHTML(desc.Explanation ?? "");
+	const title = stripFvdlMarkup(desc.Abstract ?? "");
+	let explanationText = stripFvdlMarkup(desc.Explanation ?? "");
 	if (!explanationText) explanationText = title;
 	const descriptions = [{
 		label: "default",
@@ -5621,7 +7413,7 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 	}];
 	if (desc.Recommendations) descriptions.push({
 		label: "fix",
-		data: stripHTML(desc.Recommendations)
+		data: stripFvdlMarkup(desc.Recommendations)
 	});
 	let impact = 0;
 	if (vulns.length > 0) impact = parseFloat(vulns[0].ClassInfo?.DefaultSeverity ?? "0") / 5;
@@ -5656,7 +7448,7 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 * @param input - Fortify FVDL XML string
 * @returns HDF JSON string
 */
-async function convertFortifyToHdf(input) {
+async function convertFortifyToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("fortify: empty input");
 	validateInputSize(input, "fortify");
 	const resultsChecksum = await inputChecksum(input);
@@ -5690,7 +7482,7 @@ async function convertFortifyToHdf(input) {
 		}],
 		generator: {
 			name: "fortify-to-hdf",
-			version: "1.0.0"
+			version: converterVersion
 		},
 		tool: {
 			name: "Fortify",
@@ -5721,16 +7513,12 @@ const REQUIRED_COLUMNS = [
 * Prisma uses non-standard severity names: "important" and "moderate"
 * in addition to the standard critical/high/medium/low.
 */
+const PRISMA_SEVERITY_ALIASES = {
+	important: .9,
+	moderate: .5
+};
 function getImpact$3(severity) {
-	switch (severity.toLowerCase()) {
-		case "critical": return 1;
-		case "important": return .9;
-		case "high": return .7;
-		case "moderate":
-		case "medium": return .5;
-		case "low": return .3;
-		default: return .5;
-	}
+	return PRISMA_SEVERITY_ALIASES[severity.toLowerCase()] ?? severityToImpact(severity);
 }
 /**
 * Returns NIST tags based on whether the finding has a CVE.
@@ -5875,7 +7663,7 @@ function buildBaseline(hostname, records, resultsChecksum, scanTime) {
 * @param input - Prisma Cloud CSV string
 * @returns HDF JSON string
 */
-async function convertPrismaToHdf(input) {
+async function convertPrismaToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("prisma: empty input");
 	validateInputSize(input, "prisma");
 	const headers = (input.split(/\r?\n/, 1)[0] ?? "").split(",").map((h) => h.trim());
@@ -5901,7 +7689,7 @@ async function convertPrismaToHdf(input) {
 	}
 	return buildHdfResults({
 		generatorName: "prisma-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Prisma Cloud",
 		toolFormat: "CSV",
 		baselines,
@@ -6040,7 +7828,7 @@ function buildRequirement$3(vuln, initiated) {
 * @param input - Netsparker/Invicti XML string
 * @returns HDF JSON string
 */
-async function convertNetsparkerToHdf(input) {
+async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("netsparker: empty input");
 	validateInputSize(input, "netsparker");
 	const resultsChecksum = await inputChecksum(input);
@@ -6063,7 +7851,7 @@ async function convertNetsparkerToHdf(input) {
 	}
 	return buildHdfResults({
 		generatorName: "netsparker-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName,
 		toolFormat: "XML",
 		baselines: [createMinimalBaseline("Netsparker Scan", requirements, {
@@ -6180,7 +7968,7 @@ function buildRequirement$2(ruleID, finding, startTime) {
 * @param input - ScoutSuite JS/JSON string
 * @returns HDF JSON string
 */
-async function convertScoutsuiteToHdf(input) {
+async function convertScoutsuiteToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("scoutsuite: empty input");
 	validateInputSize(input, "scoutsuite");
 	const jsonStr = stripJSPrefix(input);
@@ -6197,7 +7985,7 @@ async function convertScoutsuiteToHdf(input) {
 	});
 	return buildHdfResults({
 		generatorName: "scoutsuite-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "ScoutSuite",
 		toolFormat: "JSON",
 		toolVersion: report.last_run.version,
@@ -6310,17 +8098,12 @@ function buildRequirementFromResult(result, filename) {
 	const startTime = (startTimeStr ? parseTimestamp(startTimeStr) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const score = result.result.score;
 	const status = determineStatus(score);
-	let results;
-	if (result.result.sections.length > 0) results = result.result.sections.map((section) => {
-		return createResult(status, void 0, {
-			codeDesc: buildCodeDesc$1(section, scannerName),
-			startTime
-		});
-	});
-	else results = [createResult(status, void 0, {
-		codeDesc: `No sections reported by ${scannerName}`,
+	const toResult = (codeDesc) => ({
+		status,
+		codeDesc,
 		startTime
-	})];
+	});
+	const results = result.result.sections.length > 0 ? result.result.sections.map((section) => toResult(buildCodeDesc$1(section, scannerName))) : [toResult(`No sections reported by ${scannerName}`)];
 	const req = createRequirement(result.sha256, filename, descriptions, scoreToImpact(score), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags([...nist]);
@@ -6345,7 +8128,7 @@ function buildScannerBaseline(scannerName, results, shaMap, resultsChecksum) {
 * @param input - Conveyor JSON string
 * @returns HDF JSON string
 */
-async function convertConveyorToHdf(input) {
+async function convertConveyorToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("conveyor: empty input");
 	validateInputSize(input, "conveyor");
 	const data = parseJSON(input);
@@ -6367,7 +8150,7 @@ async function convertConveyorToHdf(input) {
 	}));
 	return buildHdfResults({
 		generatorName: "conveyor-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Conveyor",
 		toolFormat: "JSON",
 		baselines,
@@ -6406,18 +8189,29 @@ const IMPACT_MAPPING$2 = /* @__PURE__ */ new Map([
 function veracodeSeverityToImpact(severity) {
 	return IMPACT_MAPPING$2.get(severity) ?? .1;
 }
-/** Get an attribute from a parsed XML node. */
+/** Get an attribute from a parsed XML node, entity-decoded. */
 function attr(node, name) {
-	return node[`${A}${name}`] ?? "";
-}
-/** Decode common XML/HTML character references (&#xHH; and &#NNN;). */
+	const raw = node[`${A}${name}`];
+	return raw === void 0 ? "" : decodeXmlEntities(raw);
+}
+const NAMED_ENTITIES = {
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'",
+	amp: "&"
+};
 function decodeXmlEntities(s) {
-	return s.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
+	return s.replace(/&(?:#(\d+)|#[xX]([0-9a-fA-F]+)|(lt|gt|quot|apos|amp));/g, (match, dec, hex, name) => {
+		if (dec !== void 0) return String.fromCodePoint(Number.parseInt(dec, 10));
+		if (hex !== void 0) return String.fromCodePoint(Number.parseInt(hex, 16));
+		return name !== void 0 ? NAMED_ENTITIES[name] ?? match : match;
+	});
 }
 /** Parse Veracode timestamp format ("2021-12-29 22:16:36 UTC") to Date. */
 function parseVeracodeTimestamp(ts) {
 	if (!ts) return void 0;
-	return parseTimestamp(decodeXmlEntities(ts).replace(" UTC", "Z").replace(" ", "T")) ?? void 0;
+	return parseTimestamp(ts.replace(" UTC", "Z").replace(" ", "T")) ?? void 0;
 }
 /** Format description paragraphs into text. */
 function formatDesc(desc) {
@@ -6550,12 +8344,20 @@ function buildCWERequirement(cat, impact, firstBuildDate) {
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
 	const results = cwes.flatMap((c) => {
 		const staticflaws = c.staticflaws;
-		return ensureArray(staticflaws?.flaw).map((flaw) => createResult(ResultStatus.Failed, void 0, {
+		return ensureArray(staticflaws?.flaw).map((flaw) => ({
+			status: ResultStatus.Failed,
 			codeDesc: formatFlawCodeDesc(flaw),
 			startTime
 		}));
 	});
-	const req = createRequirement(attr(cat, "categoryid"), attr(cat, "categoryname"), descriptions, impact, results, { tags });
+	const sourceRef = cwes.flatMap((c) => {
+		const staticflaws = c.staticflaws;
+		return ensureArray(staticflaws?.flaw).map((flaw) => attr(flaw, "sourcefile")).filter(Boolean);
+	}).join("\n");
+	const req = createRequirement(attr(cat, "categoryid"), attr(cat, "categoryname"), descriptions, impact, results, {
+		tags,
+		sourceLocation: sourceRef ? { ref: sourceRef } : void 0
+	});
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -6605,16 +8407,26 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	if (cweID) extras.cwe = cweID;
 	const tags = buildNistCciTags(nist, cciTags, extras);
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
-	const results = components.map((comp) => createResult(ResultStatus.Failed, void 0, {
+	const results = components.map((comp) => ({
+		status: ResultStatus.Failed,
 		codeDesc: formatSCACodeDesc(comp),
 		startTime
 	}));
 	const cveSummary = attr(vuln, "cve_summary");
 	const cveId = attr(vuln, "cve_id");
-	const req = createRequirement(cveId, cveId, [{
+	const descriptions = [{
 		label: "default",
 		data: cveSummary || ""
-	}], impact, results, { tags });
+	}];
+	const sourceRef = components.flatMap((comp) => {
+		const filePaths = comp.file_paths;
+		if (!filePaths) return [];
+		return ensureArray(filePaths.file_path).map((fp) => attr(fp, "value")).filter(Boolean);
+	}).join("\n");
+	const req = createRequirement(cveId, cveId, descriptions, impact, results, {
+		tags,
+		sourceLocation: sourceRef ? { ref: sourceRef } : void 0
+	});
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -6626,10 +8438,13 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 * @param input - Veracode DetailedReport XML string
 * @returns HDF JSON string
 */
-async function convertVeracodeToHdf(input) {
+async function convertVeracodeToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("veracode: empty input");
 	validateInputSize(input, "veracode");
-	const parsed = parseXml(input, { attributeNamePrefix: "@_" });
+	const parsed = parseXml(input, {
+		attributeNamePrefix: "@_",
+		trimValues: false
+	});
 	if ("summaryreport" in parsed) throw new Error("veracode: summary reports are not supported; use a detailed report");
 	const report = parsed.detailedreport;
 	if (!report) throw new Error("veracode: invalid XML - no <detailedreport> root element");
@@ -6658,7 +8473,7 @@ async function convertVeracodeToHdf(input) {
 	const timestamp = parseVeracodeTimestamp(firstBuildDate);
 	return buildHdfResults({
 		generatorName: "veracode-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Veracode",
 		toolFormat: "XML",
 		baselines: [baseline],
@@ -6734,12 +8549,11 @@ function buildRequirement$1(cs, profiles, createdDateTime) {
 			data: stripHTML(impacts[0])
 		});
 	}
-	const codeDesc = cs.implementationStatus || "No implementation status provided";
-	const startTime = (createdDateTime ? parseTimestamp(createdDateTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
-	const req = createRequirement(id, title, descriptions, impact, [createResult(status, void 0, {
-		codeDesc,
-		...startTime ? { startTime } : {}
-	})], { tags });
+	const req = createRequirement(id, title, descriptions, impact, [{
+		status,
+		codeDesc: cs.implementationStatus || "No implementation status provided",
+		startTime: (createdDateTime ? parseTimestamp(createdDateTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
+	}], { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -6754,7 +8568,7 @@ function buildRequirement$1(cs, profiles, createdDateTime) {
 * @param input - Combined JSON string with secureScore and profiles
 * @returns HDF JSON string
 */
-async function convertMsftSecureScoreToHdf(input) {
+async function convertMsftSecureScoreToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("msft-secure-score: empty input");
 	validateInputSize(input, "msft-secure-score");
 	const combined = parseJSON(input);
@@ -6767,7 +8581,7 @@ async function convertMsftSecureScoreToHdf(input) {
 	let tenantId = "";
 	return buildHdfResults({
 		generatorName: "msft-secure-score-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Microsoft Secure Score",
 		toolFormat: "JSON",
 		baselines: combined.secureScore.value.map((ss) => {
@@ -6775,14 +8589,17 @@ async function convertMsftSecureScoreToHdf(input) {
 			const { items: limitedControlScores, truncated } = limitArray(ss.controlScores);
 			/* v8 ignore next -- truncation only triggers with >100K items */
 			if (truncated) console.warn(`WARNING: Input truncated at ${limitedControlScores.length} controlScore items (original: ${ss.controlScores.length})`);
-			return createMinimalBaseline("Microsoft Secure Score", limitedControlScores.map((cs) => buildRequirement$1(cs, profiles, ss.createdDateTime)), {
+			const requirements = limitedControlScores.map((cs) => buildRequirement$1(cs, profiles, ss.createdDateTime));
+			const title = `Azure Secure Score report - Tenant ID: ${ss.azureTenantId} - Run ID: ${ss.id}`;
+			return createMinimalBaseline("Microsoft Secure Score", requirements, {
 				resultsChecksum,
-				title: `Azure Secure Score report - Tenant ID: ${ss.azureTenantId} - Run ID: ${ss.id}`
+				title
 			});
 		}),
 		components: [{
 			name: `Azure Tenant: ${tenantId}`,
 			type: TargetType.CloudAccount,
+			provider: "azure",
 			labels: {
 				account: tenantId,
 				provider: "azure"
@@ -6798,12 +8615,12 @@ async function convertMsftSecureScoreToHdf(input) {
 * Delegates base conversion to the generic SARIF converter and enriches
 * the output with MSDO-specific metadata.
 */
-async function convertMsftDefenderDevopsToHdf(input) {
+async function convertMsftDefenderDevopsToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "msft-defender-devops");
 	const raw = parseJSON(input);
 	if (!raw || !Array.isArray(raw.runs)) throw new Error("Invalid MSDO SARIF structure: missing or invalid runs field");
 	const { components, runEnrichments } = extractEnrichments(raw);
-	const hdfJson = await convertSarifToHdf(input);
+	const hdfJson = await convertSarifToHdf(input, converterVersion);
 	const result = JSON.parse(hdfJson);
 	synthesizeNoFindingsPlaceholders(result);
 	applyEnrichments(result, components, runEnrichments);
@@ -6821,8 +8638,7 @@ function extractEnrichments(raw) {
 			const target = {
 				name: repoNameFromURI(vcp.repositoryUri),
 				type: TargetType.Repository,
-				url: vcp.repositoryUri,
-				labels: {}
+				url: vcp.repositoryUri
 			};
 			if (vcp.branch) target.branch = vcp.branch;
 			if (vcp.revisionId) target.commit = vcp.revisionId;
@@ -6949,10 +8765,14 @@ function buildRequirement(assessmentID, assessments, scanTime) {
 function buildResultFromAssessment(a, scanTime) {
 	const status = mapStatus(a.properties.status.code);
 	const codeDesc = `Resource: ${a.properties.resourceDetails.id}`;
-	return createResult(status, a.properties.status.description || a.properties.status.cause || void 0, {
+	const message = a.properties.status.description || a.properties.status.cause || void 0;
+	const result = {
+		status,
 		codeDesc,
 		startTime: scanTime
-	});
+	};
+	if (message !== void 0) result.message = message;
+	return result;
 }
 /**
 * Converts Microsoft Defender for Cloud assessment output to HDF format.
@@ -6960,7 +8780,7 @@ function buildResultFromAssessment(a, scanTime) {
 * @param input - JSON string containing Azure Security Assessments API response
 * @returns HDF JSON string
 */
-async function convertMsftDefenderCloudToHdf(input) {
+async function convertMsftDefenderCloudToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "msft-defender-cloud");
 	const scanTime = /* @__PURE__ */ new Date();
 	const resultsChecksum = await inputChecksum(input);
@@ -6997,7 +8817,7 @@ async function convertMsftDefenderCloudToHdf(input) {
 	});
 	return buildHdfResults({
 		generatorName: "msft-defender-cloud-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Microsoft Defender for Cloud",
 		toolFormat: "JSON",
 		baselines: [baseline],
@@ -7019,7 +8839,7 @@ const IMPACT_MAPPING = {
 /**
 * Maps MDE severity to HDF impact value.
 */
-function severityToImpact$1(severity) {
+function severityToImpact$2(severity) {
 	return IMPACT_MAPPING[severity.toLowerCase()] ?? .5;
 }
 /**
@@ -7112,7 +8932,7 @@ function resolveStartTime(alert, scanTime) {
 * Converts a single MDE alert to an HDF EvaluatedRequirement.
 */
 function alertToRequirement(alert, scanTime) {
-	const impact = severityToImpact$1(alert.severity);
+	const impact = severityToImpact$2(alert.severity);
 	const status = statusToResultStatus(alert.status, alert.classification);
 	const codeDesc = formatEvidence(alert.evidence ?? []);
 	const results = [createResult(status, formatMessage(alert), {
@@ -7142,7 +8962,7 @@ function alertToRequirement(alert, scanTime) {
 * @param input - JSON string of MDE alert response
 * @returns HDF JSON string
 */
-async function convertMsftDefenderEndpointToHdf(input) {
+async function convertMsftDefenderEndpointToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "msft-defender-endpoint");
 	const resultsChecksum = await inputChecksum(input);
 	const response = parseJSON(input);
@@ -7165,7 +8985,7 @@ async function convertMsftDefenderEndpointToHdf(input) {
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("msft-defender-endpoint-no-findings", "Microsoft Defender for Endpoint scanned the tenant and reported zero findings.", scanTime));
 	return buildHdfResults({
 		generatorName: "msft-defender-endpoint-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Microsoft Defender for Endpoint",
 		baselines: [createMinimalBaseline("Microsoft Defender for Endpoint Scan", requirements, { resultsChecksum })],
 		components,
@@ -7183,7 +9003,8 @@ const BUILD_OPTIONS = {
 	ignoreAttributes: false,
 	format: true,
 	indentBy: "  ",
-	suppressEmptyNode: false
+	suppressEmptyNode: false,
+	suppressBooleanAttributes: false
 };
 /**
 * Convert HDF Results JSON to XCCDF 1.2 Benchmark XML.
@@ -7193,7 +9014,7 @@ const BUILD_OPTIONS = {
 */
 function convertHdfToXccdf(input) {
 	validateInputSize(input, "hdf-to-xccdf");
-	const hdfData = parseJSON(input);
+	const hdfData = parseHdf(input);
 	if (!hdfData || typeof hdfData !== "object" || !("baselines" in hdfData)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdfData.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
 	return `<?xml version="1.0" encoding="UTF-8"?>\n${buildXml({ Benchmark: buildBenchmarkObj(hdfData) }, BUILD_OPTIONS)}`;
@@ -7229,19 +9050,19 @@ function sanitizeXccdfId(id) {
 }
 /** Build the Benchmark XML object from HDF data. */
 function buildBenchmarkObj(hdfData) {
+	const empty = !hdfData.baselines || hdfData.baselines.length === 0;
 	const benchmark = {
 		[`${ATTR}xmlns`]: "http://checklists.nist.gov/xccdf/1.2",
+		[`${ATTR}id`]: empty ? "xccdf_hdf_benchmark_exported" : sanitizeXccdfId("xccdf_hdf_benchmark_" + hdfData.baselines[0].name),
 		[`${ATTR}resolved`]: "1",
 		status: wrap("incomplete")
 	};
-	if (!hdfData.baselines || hdfData.baselines.length === 0) {
-		benchmark[`${ATTR}id`] = "xccdf_hdf_benchmark_exported";
+	if (empty) {
 		benchmark.title = wrap("HDF Export");
 		benchmark.version = wrap("1.0");
 		return benchmark;
 	}
 	const baseline = hdfData.baselines[0];
-	benchmark[`${ATTR}id`] = sanitizeXccdfId("xccdf_hdf_benchmark_" + baseline.name);
 	benchmark.title = wrap(baseline.title ?? baseline.name);
 	benchmark.version = wrap(baseline.version ?? "1.0");
 	benchmark.Profile = {
@@ -7263,20 +9084,40 @@ function buildRuleObj(req) {
 	};
 	const description = findDescription(req.descriptions, "default");
 	if (description) rule.description = wrap(description);
+	if (Array.isArray(req.refs) && req.refs.length > 0) {
+		const refs = req.refs.map((r) => {
+			const o = r;
+			if (typeof o.url === "string") return { [`${ATTR}href`]: o.url };
+			if (typeof o.uri === "string") return { [`${ATTR}href`]: o.uri };
+			if (typeof o.ref === "string") return { "#text": o.ref };
+		}).filter((x) => x !== void 0);
+		if (refs.length > 0) rule.reference = refs;
+	}
+	const rationale = findDescription(req.descriptions, "rationale");
+	if (rationale) rule.rationale = wrap(rationale);
 	const fixtext = findDescription(req.descriptions, "fix");
 	if (fixtext) rule.fixtext = wrap(fixtext);
-	if (req.tags && Array.isArray(req.tags["cci"])) {
-		const ccis = req.tags["cci"];
-		if (ccis.length > 0) rule.ident = ccis.map((cci) => ({
-			[`${ATTR}system`]: "http://cyber.mil/cci",
-			"#text": cci
-		}));
-	}
+	const idents = [];
+	if (req.tags && Array.isArray(req.tags["cci"])) for (const cci of req.tags["cci"]) idents.push({
+		[`${ATTR}system`]: "http://cyber.mil/cci",
+		"#text": cci
+	});
+	if (req.tags && Array.isArray(req.tags["nist"])) for (const n of req.tags["nist"]) idents.push({
+		[`${ATTR}system`]: "https://csrc.nist.gov/projects/risk-management/sp800-53-controls",
+		"#text": n
+	});
+	if (idents.length > 0) rule.ident = idents;
+	const checks = [];
 	const checkContent = findDescription(req.descriptions, "check");
-	if (checkContent) rule.check = {
+	if (checkContent) checks.push({
 		[`${ATTR}system`]: "http://oval.mitre.org/XMLSchema/oval-definitions-5",
 		"check-content": wrap(checkContent)
-	};
+	});
+	if (req.code) checks.push({
+		[`${ATTR}system`]: "http://inspec.io/",
+		"check-content": wrap(req.code)
+	});
+	if (checks.length > 0) rule.check = checks;
 	return rule;
 }
 /** Build the XCCDF TestResult object. */
@@ -7496,7 +9337,7 @@ async function convertHdfToOscalSar(input) {
 	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-sar: empty input");
 	let hdfResults;
 	try {
-		hdfResults = parseJSON(input);
+		hdfResults = parseHdf(input);
 	} catch {
 		throw new Error("hdf-to-oscal-sar: failed to parse HDF JSON");
 	}
@@ -7508,8 +9349,9 @@ async function convertHdfToOscalSar(input) {
 * Constructs the full OSCAL assessment-results document from HDF results.
 */
 function buildOSCALDocument(hdfResults) {
-	let timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	if (hdfResults.timestamp) timestamp = typeof hdfResults.timestamp === "string" ? hdfResults.timestamp : hdfResults.timestamp.toISOString();
+	let timestamp = formatTimestampSeconds(/* @__PURE__ */ new Date());
+	const documentTime = hdfTime(hdfResults.timestamp);
+	if (documentTime) timestamp = formatTimestampSeconds(documentTime);
 	const metadata = {
 		title: "HDF Assessment Results Export",
 		"last-modified": timestamp,
@@ -7528,6 +9370,34 @@ function buildOSCALDocument(hdfResults) {
 		results
 	} };
 }
+/** Earliest startTime across the results, or undefined if none carry one. */
+function earliestResultTime(results) {
+	let earliest;
+	for (const result of results ?? []) {
+		const parsed = hdfTime(result.startTime);
+		if (!parsed) continue;
+		if (earliest === void 0 || parsed < earliest) earliest = parsed;
+	}
+	return earliest;
+}
+/**
+* Render an assessment time. OSCAL requires result.start and
+* observation.collected, so a fallback is needed when HDF carries no result time
+* — but it must never win over a real one.
+*/
+function formatAssessmentTime(time, fallback) {
+	return time === void 0 ? fallback : formatTimestampSeconds(time);
+}
+/** When the assessment ran: the earliest result time anywhere in the baseline. */
+function assessmentStart(baseline, fallback) {
+	let earliest;
+	for (const req of baseline.requirements) {
+		const reqEarliest = earliestResultTime(req.results);
+		if (reqEarliest === void 0) continue;
+		if (earliest === void 0 || reqEarliest < earliest) earliest = reqEarliest;
+	}
+	return formatAssessmentTime(earliest, fallback);
+}
 /**
 * Converts a single EvaluatedBaseline to an OSCAL Result.
 */
@@ -7549,7 +9419,7 @@ function baselineToResult(baseline, timestamp) {
 		uuid: crypto.randomUUID(),
 		title,
 		description,
-		start: timestamp,
+		start: assessmentStart(baseline, timestamp),
 		findings,
 		observations,
 		risks
@@ -7563,14 +9433,59 @@ function requirementToFindingSet(req, timestamp) {
 	const { state, reason } = aggregateStatus(req.results);
 	const findingDesc = extractDefaultDescription(req.descriptions);
 	const props = [];
-	if (req.tags) {
-		const nistRaw = req.tags["nist"];
-		if (Array.isArray(nistRaw)) {
-			for (const v of nistRaw) if (typeof v === "string") props.push({
-				name: "nist",
+	const pushTagValues = (key) => {
+		const raw = req.tags?.[key];
+		if (Array.isArray(raw)) {
+			for (const v of raw) if (typeof v === "string") props.push({
+				name: key,
 				value: v
 			});
 		}
+	};
+	pushTagValues("nist");
+	pushTagValues("cci");
+	if (req.code) props.push({
+		name: "code",
+		value: req.code
+	});
+	for (const label of [
+		"check",
+		"fix",
+		"rationale"
+	]) {
+		const d = req.descriptions.find((x) => x.label === label);
+		if (d) props.push({
+			name: label,
+			value: d.data
+		});
+	}
+	if (req.controlType) props.push({
+		name: "control-type",
+		value: req.controlType
+	});
+	if (req.verificationMethod) props.push({
+		name: "verification-method",
+		value: req.verificationMethod
+	});
+	if (req.applicability) props.push({
+		name: "applicability",
+		value: req.applicability
+	});
+	const links = [];
+	if (Array.isArray(req.refs)) for (const r of req.refs) {
+		const o = r;
+		if (typeof o.url === "string") links.push({
+			href: o.url,
+			rel: "reference"
+		});
+		else if (typeof o.uri === "string") links.push({
+			href: o.uri,
+			rel: "reference"
+		});
+		else if (typeof o.ref === "string") props.push({
+			name: "reference",
+			value: o.ref
+		});
 	}
 	let title = req.id;
 	if (req.title && req.title !== "") title = req.title;
@@ -7586,6 +9501,7 @@ function requirementToFindingSet(req, timestamp) {
 		title,
 		description: findingDesc || "",
 		props: props.length > 0 ? props : void 0,
+		links: links.length > 0 ? links : void 0,
 		target
 	};
 	let observation;
@@ -7595,7 +9511,7 @@ function requirementToFindingSet(req, timestamp) {
 			uuid: obsUUID,
 			description: buildObservationDescription(req.results),
 			methods: ["TEST"],
-			collected: timestamp
+			collected: formatAssessmentTime(earliestResultTime(req.results), timestamp)
 		};
 		finding["related-observations"] = [{ "observation-uuid": obsUUID }];
 	}
@@ -7725,18 +9641,24 @@ async function convertHdfToOscalPoam(input) {
 	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-poam: empty input");
 	let amendments;
 	try {
-		amendments = parseJSON(input);
+		amendments = parseHdf(input);
 	} catch {
 		throw new Error("hdf-to-oscal-poam: failed to parse JSON");
 	}
 	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendments) };
 	return JSON.stringify(doc, null, 2);
 }
+/** HDF dates arrive as strings from JSON.parse but are typed as Date. */
+function toDate(value) {
+	const d = typeof value === "string" ? parseTimestamp(value) : value;
+	if (!d || isNaN(d.getTime())) return void 0;
+	return d;
+}
 /**
 * Converts parsed HDFAmendments to an OSCAL PlanOfActionAndMilestones.
 */
 function amendmentsToPOAM(amendments) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const now = formatTimestampSeconds(/* @__PURE__ */ new Date());
 	const metadata = {
 		title: amendments.name,
 		"last-modified": now,
@@ -7787,25 +9709,45 @@ function overrideToPOAMItem(override) {
 		name: "impacted-control-id",
 		value: nistTagToControlId(override.requirementId)
 	}];
-	const remediations = [];
-	if (override.milestones) for (const ms of override.milestones) remediations.push({
-		uuid: crypto.randomUUID(),
-		lifecycle: "planned",
-		title: ms.description,
-		description: ms.description
+	if (override.type) riskProps.push({
+		name: "override-type",
+		value: String(override.type)
 	});
-	let riskLog;
-	const expiresAt = override.expiresAt;
-	if (expiresAt) {
-		const expiresDate = typeof expiresAt === "string" ? new Date(expiresAt) : expiresAt;
-		if (!isNaN(expiresDate.getTime()) && expiresDate.getTime() > 0) riskLog = { entries: [{
+	if (override.impact && typeof override.impact.value === "number") riskProps.push({
+		name: "impact-override",
+		value: String(override.impact.value)
+	});
+	const remediations = [];
+	if (override.milestones) for (const ms of override.milestones) {
+		const msProps = [];
+		if (ms.estimatedCompletion) {
+			const d = toDate(ms.estimatedCompletion);
+			if (d) msProps.push({
+				name: "estimated-completion",
+				value: formatTimestampSeconds(d)
+			});
+		}
+		if (ms.status) msProps.push({
+			name: "milestone-status",
+			value: String(ms.status)
+		});
+		remediations.push({
 			uuid: crypto.randomUUID(),
-			title: "Scheduled review",
-			description: "Amendment expiration date",
-			start: expiresDate.toISOString(),
-			"status-change": riskStatus
-		}] };
+			lifecycle: "planned",
+			title: ms.description,
+			description: ms.description,
+			props: msProps.length > 0 ? msProps : void 0
+		});
 	}
+	let riskLog;
+	const expiresDate = override.expiresAt ? toDate(override.expiresAt) : void 0;
+	if (expiresDate && expiresDate.getTime() > 0) riskLog = { entries: [{
+		uuid: crypto.randomUUID(),
+		title: "Scheduled review",
+		description: "Amendment expiration date",
+		start: formatTimestampSeconds(expiresDate),
+		"status-change": riskStatus
+	}] };
 	const risk = {
 		uuid: riskUUID,
 		title: override.requirementId,
@@ -7877,7 +9819,7 @@ function buildTags(dep) {
 	if (dep.parentDependencies.length > 0) extras.parentDependencies = dep.parentDependencies;
 	return buildNistCciTags(nist, cciTags, extras);
 }
-async function convertIonchannelToHdf(input) {
+async function convertIonchannelToHdf(input, converterVersion = "1.0.0") {
 	if (!input?.trim()) throw new Error("Empty input");
 	validateInputSize(input, "ionchannel");
 	const analysis = parseJSON(input);
@@ -7904,10 +9846,11 @@ async function convertIonchannelToHdf(input) {
 			outdated_version: dep.outdated_version,
 			dependencies: dep.dependencies
 		}, null, 2);
-		const req = createRequirement(depId, title, [createDescription("default", `Dependency ${dep.org}/${dep.name}`)], 0, [createResult(ResultStatus.NotReviewed, "Dependency inventory item", {
+		const req = createRequirement(depId, title, [createDescription("default", `Dependency ${dep.org}/${dep.name}`)], 0, [{
+			status: ResultStatus.NotReviewed,
 			codeDesc: "Dependency inventory item",
 			startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
-		})], { tags });
+		}], { tags });
 		req.code = code;
 		const controlType = deriveControlTypeFromTags(DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS);
 		if (controlType !== void 0) req.controlType = controlType;
@@ -7915,20 +9858,22 @@ async function convertIonchannelToHdf(input) {
 		return req;
 	});
 	const resultsChecksum = await inputChecksum(input);
+	const baseline = createMinimalBaseline("Ion Channel SBOM Analysis", requirements, {
+		title: `Ion Channel Analysis of ${analysis.source}`,
+		summary: analysis.summary,
+		integrity: {
+			algorithm: resultsChecksum.algorithm,
+			checksum: resultsChecksum.value
+		},
+		status: "loaded"
+	});
+	baseline.maintainer = "saf@groups.mitre.org";
 	return buildHdfResults({
 		generatorName: "ionchannel-to-hdf",
-		converterVersion: "1.0.0",
+		converterVersion,
 		toolName: "Ion Channel",
 		toolFormat: "JSON",
-		baselines: [createMinimalBaseline("Ion Channel SBOM Analysis", requirements, {
-			title: `Ion Channel Analysis of ${analysis.source}`,
-			summary: analysis.summary,
-			integrity: {
-				algorithm: resultsChecksum.algorithm,
-				checksum: resultsChecksum.value
-			},
-			status: "loaded"
-		})],
+		baselines: [baseline],
 		timestamp: /* @__PURE__ */ new Date()
 	});
 }
@@ -8141,6 +10086,40 @@ function affectedPackageToIdentifier(pkg) {
 	if (pkg.name && pkg.version) return `${pkg.name}@${pkg.version}`;
 	if (pkg.name) return pkg.name;
 }
+/** Replace the `@version` segment of a purl (between `@` and `?`/`#`), inserting one if absent. */
+function swapPurlVersion(purl, version) {
+	const at = purl.indexOf("@");
+	if (at >= 0) {
+		const rest = purl.slice(at + 1);
+		const end = rest.search(/[?#]/);
+		const tail = end >= 0 ? rest.slice(end) : "";
+		return `${purl.slice(0, at)}@${version}${tail}`;
+	}
+	const end = purl.search(/[?#]/);
+	return end >= 0 ? `${purl.slice(0, end)}@${version}${purl.slice(end)}` : `${purl}@${version}`;
+}
+/**
+* Identifier for the FIXED version of a package (purl with the version swapped
+* to fixedInVersion, or name@fixedInVersion). Undefined when there is no
+* fixedInVersion or no purl/name to anchor it (a bare cpe cannot be swapped).
+*/
+function fixedPackageIdentifier(pkg) {
+	if (!pkg.fixedInVersion) return void 0;
+	if (pkg.purl) return swapPurlVersion(pkg.purl, pkg.fixedInVersion);
+	if (pkg.name) return `${pkg.name}@${pkg.fixedInVersion}`;
+}
+/**
+* `vers` (Package URL version-range) type for a package, from its ecosystem or
+* the purl type. Returns undefined when neither is known (so callers avoid
+* emitting an invalid range).
+*/
+function versTypeFor(pkg) {
+	if (pkg.ecosystem) return String(pkg.ecosystem).toLowerCase();
+	if (pkg.purl) {
+		const m = /^pkg:([^/]+)\//.exec(pkg.purl);
+		if (m?.[1]) return m[1].toLowerCase();
+	}
+}
 /**
 * Build an HDF Evidence entry pointing at the upstream VEX document. Used by
 * importers to preserve provenance even though we lose the structured
@@ -8635,12 +10614,27 @@ function publisherIdentityOrDefault(bom) {
 * fields the shared VEX mapping considers consumer-action-bearing survive
 * round-trip; the rest collapse into the available CSAF fields.
 */
+const GO_ZERO_TIME$1 = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 const CVE_ID_PATTERN$2 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$2 = /^Products:\s*(.+)$/m;
 const DEFAULT_PRODUCT_ID$2 = "HDFPID-0001";
+/** Map an HDF Cvss block to a CSAF score entry (cvss_v2/v3/v4 by version). */
+function buildCsafScore(cvss, products) {
+	const inner = {
+		version: cvss.version,
+		...cvss.baseVector && { vectorString: cvss.baseVector },
+		...typeof cvss.baseScore === "number" && { baseScore: cvss.baseScore },
+		...cvss.baseSeverity && { baseSeverity: cvss.baseSeverity }
+	};
+	if (inner.vectorString === void 0 && inner.baseScore === void 0) return;
+	return {
+		[cvss.version.startsWith("4") ? "cvss_v4" : cvss.version.startsWith("2") ? "cvss_v2" : "cvss_v3"]: inner,
+		products
+	};
+}
 function convertHdfToCsafVex(input, converterVersion) {
 	validateInputSize(input, "hdf-to-csaf-vex");
-	const amendments = parseJSON(input);
+	const amendments = parseHdf(input);
 	const groups = groupByCVE(amendments.overrides ?? []);
 	const productSet = /* @__PURE__ */ new Map();
 	const vulnerabilities = [];
@@ -8649,6 +10643,7 @@ function convertHdfToCsafVex(input, converterVersion) {
 		if (!v) continue;
 		vulnerabilities.push(v);
 		for (const p of productIDsForGroup(group)) productSet.set(p, true);
+		for (const p of fixedProductIDsForGroup(group)) productSet.set(p, true);
 	}
 	if (vulnerabilities.length === 0) throw new Error("hdf-to-csaf-vex: no overrides with CVE-shaped requirementIds; nothing to emit");
 	const products = [...productSet.keys()].sort();
@@ -8684,6 +10679,15 @@ function productIDsForGroup(group) {
 	for (const o of group.overrides) for (const p of productIDsFor$1(o)) seen.add(p);
 	return [...seen].sort();
 }
+/** Synthesized fixed-version product ids across a group's affectedPackages. */
+function fixedProductIDsForGroup(group) {
+	const ids = [];
+	for (const o of group.overrides) for (const p of o.affectedPackages ?? []) {
+		const f = fixedPackageIdentifier(p);
+		if (f) ids.push(f);
+	}
+	return ids;
+}
 function productIDsFor$1(o) {
 	if (o.affectedPackages && o.affectedPackages.length > 0) {
 		const ids = o.affectedPackages.map((p) => affectedPackageToIdentifier(p)).filter((id) => Boolean(id));
@@ -8710,6 +10714,25 @@ function buildVulnerability(group) {
 	let emitted = false;
 	for (const o of group.overrides) {
 		const pids = productIDsFor$1(o);
+		if (o.cvss) {
+			const score = buildCsafScore(o.cvss, pids);
+			if (score) {
+				v.scores = (v.scores ?? []).concat(score);
+				emitted = true;
+			}
+		}
+		for (const p of o.affectedPackages ?? []) {
+			const fixedId = fixedPackageIdentifier(p);
+			if (!fixedId) continue;
+			status.first_fixed = (status.first_fixed ?? []).concat(fixedId);
+			status.fixed = (status.fixed ?? []).concat(fixedId);
+			v.remediations = (v.remediations ?? []).concat({
+				category: "vendor_fix",
+				details: `Fixed in ${p.fixedInVersion}`,
+				product_ids: [fixedId]
+			});
+			emitted = true;
+		}
 		let canonical = exportStatusFor(o, allMilestonesCompleted$2(o), false);
 		if (!canonical) continue;
 		if (o.type === OverrideType.Poam && canonical === VexStatus.Affected && allMilestonesCompleted$2(o)) canonical = VexStatus.Fixed;
@@ -8719,8 +10742,8 @@ function buildVulnerability(group) {
 				v.flags = v.flags ?? [];
 				v.flags.push({
 					label: String(o.justification),
-					product_ids: pids,
-					date: formatTimestampSeconds(new Date(o.appliedAt))
+					date: formatTimestampSeconds(hdfTime(o.appliedAt) ?? GO_ZERO_TIME$1),
+					product_ids: pids
 				});
 			}
 			emitted = true;
@@ -8770,9 +10793,9 @@ function buildVulnerability(group) {
 	/* c8 ignore next */
 	if (!emitted) return void 0;
 	if (status.fixed) status.fixed = [...new Set(status.fixed)];
+	if (status.first_fixed) status.first_fixed = [...new Set(status.first_fixed)];
 	if (status.known_affected) status.known_affected = [...new Set(status.known_affected)];
 	if (status.known_not_affected) status.known_not_affected = [...new Set(status.known_not_affected)];
-	v.product_status = status;
 	if (v.references) {
 		const seen = /* @__PURE__ */ new Set();
 		v.references = v.references.filter((r) => {
@@ -8781,10 +10804,30 @@ function buildVulnerability(group) {
 			return true;
 		});
 	}
-	return v;
+	return {
+		cve: v.cve,
+		...v.notes && { notes: v.notes },
+		product_status: status,
+		...v.flags && { flags: v.flags },
+		...v.threats && { threats: v.threats },
+		...v.remediations && { remediations: v.remediations },
+		...v.references && { references: v.references },
+		...v.scores && { scores: v.scores }
+	};
+}
+/** Stable document time: the earliest override appliedAt, falling back to now. */
+function earliestAppliedAt(amendments) {
+	let earliest;
+	for (const o of amendments.overrides ?? []) {
+		if (!o.appliedAt) continue;
+		const t = hdfTime(o.appliedAt);
+		if (!t) continue;
+		if (!earliest || t < earliest) earliest = t;
+	}
+	return earliest ?? /* @__PURE__ */ new Date();
 }
 function buildDocument(amendments, converterVersion) {
-	const now = formatTimestampSeconds(/* @__PURE__ */ new Date());
+	const now = formatTimestampSeconds(earliestAppliedAt(amendments));
 	const publisherName = amendments.appliedBy?.identifier || "HDF Amendments Export";
 	const trackingId = amendments.amendmentId || "HDF-VEX-EXPORT";
 	const docVersion = amendments.version || "1";
@@ -8800,7 +10843,7 @@ function buildDocument(amendments, converterVersion) {
 			category: "csaf_vex",
 			csaf_version: "2.0",
 			title,
-			notes,
+			...notes.length > 0 && { notes },
 			publisher: {
 				category: "other",
 				name: publisherName
@@ -8838,6 +10881,7 @@ function buildDocument(amendments, converterVersion) {
 * partial-fidelity by design — consumer-action-bearing fields (CVE id,
 * status, justification) survive round-trip; the rest collapse.
 */
+const GO_ZERO_TIME = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 const CVE_ID_PATTERN$1 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$1 = /^Products:\s*(.+)$/m;
 const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
@@ -8845,14 +10889,15 @@ const OPENVEX_NAMESPACE = "https://openvex.dev/docs/public/";
 const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
 async function convertHdfToOpenVex(input, converterVersion) {
 	validateInputSize(input, "hdf-to-openvex");
-	const amendments = parseJSON(input);
+	const amendments = parseHdf(input);
 	const statements = [];
 	let earliest;
 	for (const o of amendments.overrides ?? []) {
 		const s = overrideToStatement(o);
 		if (!s) continue;
 		statements.push(s);
-		const t = new Date(o.appliedAt);
+		const t = hdfTime(o.appliedAt);
+		if (!t) continue;
 		if (!earliest || t < earliest) earliest = t;
 	}
 	if (statements.length === 0) throw new Error("hdf-to-openvex: no overrides with CVE-shaped requirementIds; nothing to emit");
@@ -8875,22 +10920,24 @@ function overrideToStatement(o) {
 	let canonical = exportStatusFor(o, allMilestonesCompleted$1(o), false);
 	if (!canonical) return void 0;
 	if (o.type === OverrideType.Poam && canonical === VexStatus.Affected && allMilestonesCompleted$1(o)) canonical = VexStatus.Fixed;
-	const stmt = {
+	const notAffected = canonical === VexStatus.NotAffected;
+	const justification = notAffected && o.justification ? String(o.justification) : "";
+	const impact = notAffected ? stripProductsLine(o.reason ?? "") : "";
+	let action = "";
+	if (canonical === VexStatus.Fixed) action = firstMilestoneAction(o) || "Fix applied; consumer re-scan confirmed clean.";
+	else if (canonical === VexStatus.Affected) action = firstMilestoneAction(o) || stripProductsLine(o.reason ?? "");
+	return {
 		vulnerability: {
-			name: o.requirementId,
-			"@id": `https://nvd.nist.gov/vuln/detail/${o.requirementId}`
+			"@id": `https://nvd.nist.gov/vuln/detail/${o.requirementId}`,
+			name: o.requirementId
 		},
+		products: productsFor(o),
 		status: String(canonical),
-		timestamp: formatTimestampSeconds(new Date(o.appliedAt)),
-		products: productsFor(o)
+		...justification && { justification },
+		...impact && { impact_statement: impact },
+		...action && { action_statement: action },
+		timestamp: formatTimestampSeconds(hdfTime(o.appliedAt) ?? GO_ZERO_TIME)
 	};
-	if (canonical === VexStatus.NotAffected) {
-		if (o.justification) stmt.justification = String(o.justification);
-		const impact = stripProductsLine(o.reason ?? "");
-		if (impact) stmt.impact_statement = impact;
-	} else if (canonical === VexStatus.Fixed) stmt.action_statement = firstMilestoneAction(o) || "Fix applied; consumer re-scan confirmed clean.";
-	else if (canonical === VexStatus.Affected) stmt.action_statement = firstMilestoneAction(o) || stripProductsLine(o.reason ?? "");
-	return stmt;
 }
 function productsFor(o) {
 	if (o.affectedPackages && o.affectedPackages.length > 0) {
@@ -8919,7 +10966,8 @@ function stripProductsLine(reason) {
 }
 async function buildDocumentID(input, a) {
 	if (a.amendmentId) return `${OPENVEX_NAMESPACE}vex-${a.amendmentId}`;
-	return `${OPENVEX_NAMESPACE}vex-${await sha256(input)}`;
+	const digest = await sha256(input);
+	return `${OPENVEX_NAMESPACE}vex-${digest}`;
 }
 //#endregion
 //#region converters/hdf-to-cyclonedx-vex/typescript/converter.ts
@@ -8936,9 +10984,41 @@ const PRODUCTS_LINE = /^Products:\s*(.+)$/m;
 const RAW_JUST_LINE = /^VEX justification:\s*(.+)$/m;
 const RESPONSE_LINE = /^Response:.*$/gm;
 const DEFAULT_PRODUCT_ID = "HDFPID-0001";
-function convertHdfToCyclonedxVex(input, converterVersion) {
+/**
+* Build CycloneDX affects[].versions[] for a package with a fixedInVersion:
+* the current version is `affected`, and `>= fixedInVersion` is `unaffected`,
+* expressed as a `vers` range. Undefined when there is no vers type to key the
+* range (caller falls back to a free-text recommendation).
+*/
+function buildCdxAffectsVersions(pkg) {
+	if (!pkg?.fixedInVersion) return void 0;
+	const t = versTypeFor(pkg);
+	if (!t) return void 0;
+	const versions = [];
+	if (pkg.version) versions.push({
+		version: pkg.version,
+		status: "affected"
+	});
+	versions.push({
+		range: `vers:${t}/>=${pkg.fixedInVersion}`,
+		status: "unaffected"
+	});
+	return versions;
+}
+/** Map an HDF Cvss block to a CycloneDX rating. */
+function buildCdxRating(cvss) {
+	const rating = {};
+	if (typeof cvss.baseScore === "number") rating.score = cvss.baseScore;
+	if (cvss.baseSeverity) rating.severity = cvss.baseSeverity;
+	if (cvss.baseVector) rating.vector = cvss.baseVector;
+	const v = cvss.version;
+	rating.method = v === "4.0" ? "CVSSv4" : v === "3.1" ? "CVSSv31" : v === "3.0" ? "CVSSv3" : v === "2.0" ? "CVSSv2" : "other";
+	if (rating.score === void 0 && rating.vector === void 0) return void 0;
+	return rating;
+}
+async function convertHdfToCyclonedxVex(input, converterVersion) {
 	validateInputSize(input, "hdf-to-cyclonedx-vex");
-	const amendments = parseJSON(input);
+	const amendments = parseHdf(input);
 	const componentRegistry = /* @__PURE__ */ new Map();
 	const vulnerabilities = [];
 	let earliest;
@@ -8947,7 +11027,8 @@ function convertHdfToCyclonedxVex(input, converterVersion) {
 		const v = overrideToVulnerability(o, componentRegistry);
 		if (!v) continue;
 		vulnerabilities.push(v);
-		const t = new Date(o.appliedAt);
+		const t = hdfTime(o.appliedAt);
+		if (!t) continue;
 		if (!earliest || t < earliest) earliest = t;
 	}
 	if (vulnerabilities.length === 0) throw new Error("hdf-to-cyclonedx-vex: no overrides with CVE-shaped requirementIds; nothing to emit");
@@ -8956,7 +11037,7 @@ function convertHdfToCyclonedxVex(input, converterVersion) {
 	const bom = {
 		bomFormat: "CycloneDX",
 		specVersion: "1.4",
-		serialNumber: buildSerialNumberSync(input, amendments),
+		serialNumber: await buildSerialNumber(input, amendments),
 		version: 1,
 		metadata: buildMetadata(amendments, earliest ?? /* @__PURE__ */ new Date(), converterVersion),
 		components,
@@ -8980,23 +11061,14 @@ function overrideToVulnerability(o, componentRegistry) {
 		const cdxJust = justificationForCycloneDX(o.justification);
 		if (cdxJust) analysis.justification = cdxJust;
 	}
-	const detail = stripReasonAnnotations(o.reason ?? "");
-	if (detail) analysis.detail = detail;
 	if (canonical === VexStatus.Fixed) analysis.response = ["update"];
 	else if (canonical === VexStatus.Affected && o.type === OverrideType.Poam) analysis.response = ["workaround_available"];
-	const v = {
-		id: o.requirementId,
-		source: {
-			name: "NVD",
-			url: `https://nvd.nist.gov/vuln/detail/${o.requirementId}`
-		},
-		analysis,
-		affects: pids.map((p) => ({ ref: p }))
-	};
+	const detail = stripReasonAnnotations(o.reason ?? "");
+	if (detail) analysis.detail = detail;
+	const references = [];
 	for (const e of o.evidence ?? []) {
 		if (e.type !== "url" || !e.data) continue;
-		v.references = v.references ?? [];
-		v.references.push({
+		references.push({
 			id: o.requirementId,
 			source: {
 				name: e.description ?? "",
@@ -9004,7 +11076,26 @@ function overrideToVulnerability(o, componentRegistry) {
 			}
 		});
 	}
-	return v;
+	const rating = o.cvss ? buildCdxRating(o.cvss) : void 0;
+	const unranged = (o.affectedPackages ?? []).find((p) => p.fixedInVersion && !versTypeFor(p));
+	return {
+		id: o.requirementId,
+		source: {
+			name: "NVD",
+			url: `https://nvd.nist.gov/vuln/detail/${o.requirementId}`
+		},
+		...references.length > 0 && { references },
+		...rating && { ratings: [rating] },
+		...unranged && { recommendation: `Upgrade to ${unranged.fixedInVersion}` },
+		analysis,
+		affects: pids.map((pid) => {
+			const versions = buildCdxAffectsVersions(pkgById.get(pid));
+			return versions ? {
+				ref: pid,
+				versions
+			} : { ref: pid };
+		})
+	};
 }
 function canonicalToCycloneDXState(canonical) {
 	switch (canonical) {
@@ -9063,18 +11154,9 @@ function buildMetadata(a, docTime, converterVersion) {
 	}
 	return metadata;
 }
-function buildSerialNumberSync(input, a) {
+async function buildSerialNumber(input, a) {
 	if (a.amendmentId) return `urn:uuid:${a.amendmentId}`;
-	return `urn:uuid:${fnv1a(input)}`;
-}
-function fnv1a(s) {
-	let h = 2166136261;
-	for (let i = 0; i < s.length; i++) {
-		h ^= s.charCodeAt(i);
-		h = Math.imul(h, 16777619) >>> 0;
-	}
-	const d = h.toString(16).padStart(8, "0");
-	return (d + d + d + d).slice(0, 32);
+	return `urn:uuid:${(await sha256(input)).slice(0, 32)}`;
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/detect.ts
@@ -10086,6 +12168,6 @@ function sarBaselineName(result, sar) {
 	return toKebabCase(result.title || sar.metadata.title, "oscal-assessment-results");
 }
 //#endregion
-export { convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToXccdf, convertHdfToXml, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
+export { convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
 
 //# sourceMappingURL=index.js.map