@mitre/hdf-converters 3.4.0 → 3.4.2

package/dist/index.js

@@ -1,8 +1,8 @@
-import { n as detectConverter, t as registerAllFingerprints } from "./register-all-DxZN6IJ4.js";
+import { n as detectConverter, t as registerAllFingerprints } from "./register-all-WRR-vAZf.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
 import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
-import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
+import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -696,6 +696,33 @@ function convertSupports(supports) {
 	return out.length ? out : void 0;
 }
 /**
+* Convert v1.0 attributes to v2.0 Input objects. V1 attributes are
+* {name, options: {...}}; InSpec nests value/type/required/sensitive/description
+* under `options`. Mirrors convertAttributes in the Go converter (omit fields
+* absent from options so both languages produce identical output).
+*/
+function convertAttributes(attrs) {
+	const inputs = [];
+	for (const attr of attrs) {
+		if (attr === null || typeof attr !== "object") continue;
+		const a = attr;
+		const name = typeof a.name === "string" ? a.name : "";
+		if (!name) continue;
+		const input = { name };
+		const options = a.options;
+		if (options !== null && typeof options === "object") {
+			const o = options;
+			if ("value" in o) input.value = o.value;
+			if (typeof o.description === "string") input.description = o.description;
+			if (typeof o.sensitive === "boolean") input.sensitive = o.sensitive;
+			if (typeof o.required === "boolean") input.required = o.required;
+			if (typeof o.type === "string") input.type = o.type;
+		}
+		inputs.push(input);
+	}
+	return inputs;
+}
+/**
 * Convert v1.0 profile to v2.0 baseline.
 * Transforms field names and nested structures.
 */
@@ -712,7 +739,7 @@ function convertProfile(v1Profile) {
 		const supports = convertSupports(v1Profile.supports);
 		if (supports) v2Baseline.supports = supports;
 	}
-	if (v1Profile.attributes?.length) v2Baseline.inputs = v1Profile.attributes;
+	if (v1Profile.attributes?.length) v2Baseline.inputs = convertAttributes(v1Profile.attributes);
 	if (v1Profile.status !== void 0) v2Baseline.status = v1Profile.status;
 	if (v1Profile.sha256) v2Baseline.integrity = {
 		algorithm: "sha256",
@@ -798,6 +825,352 @@ function isHDFV1(data) {
 	return typeof obj.version === "string" && Array.isArray(obj.profiles) && typeof obj.platform === "object" && obj.platform !== null;
 }
 //#endregion
+//#region converters/asff-to-hdf/typescript/converter.ts
+/**
+* AWS Security Finding Format (ASFF) to HDF converter.
+*
+* A single ASFF envelope can carry findings from many products, and Security Hub
+* findings span multiple compliance standards (CIS, AFSBP, PCI, ...). Because
+* hdf-results supports multiple baselines in one document, each product — and
+* each Security Hub standard — becomes its own baseline entry, mirroring the
+* per-file split the predecessor SAF CLI produced.
+*/
+function productOf(f) {
+	const [company, prod] = productArnParts(f.ProductArn);
+	if (prod === "securityhub") return "securityHub";
+	if (company === "prowler" && prod === "prowler") return "prowler";
+	if (company === "aquasecurity" && prod === "aquasecurity") return "trivy";
+	return "default";
+}
+/** The CVE id Trivy stashes under Resources[0].Details.Other. */
+function trivyCVE(f) {
+	return f.Resources?.[0]?.Details?.Other?.["CVE ID"] ?? "";
+}
+/** Accepts the `{ "Findings": [...] }` envelope, a bare array, a single finding, or NDJSON (Prowler). */
+function parseFindings$1(input) {
+	try {
+		const parsed = parseJSON(input);
+		if (parsed !== null && typeof parsed === "object" && "Findings" in parsed) {
+			const findings = parsed.Findings;
+			return Array.isArray(findings) ? findings : [];
+		}
+		if (Array.isArray(parsed)) return parsed;
+		if (parsed !== null && typeof parsed === "object") return [parsed];
+	} catch {}
+	const out = input.trim().split("\n").filter((l) => l.trim().length > 0).map((l) => parseJSON(l.trim())).filter((x) => x !== null && typeof x === "object" && !Array.isArray(x));
+	if (out.length > 0) return out;
+	throw new Error("invalid ASFF JSON");
+}
+/**
+* mapComplianceStatus maps ASFF Compliance.Status to an HDF result status.
+* hdf-results has no "skipped": WARNING and NOT_AVAILABLE (no clean pass/fail
+* verdict) map to notReviewed; an absent status defaults to failed.
+*/
+function mapComplianceStatus$1(status) {
+	switch (status) {
+		case "PASSED": return ResultStatus.Passed;
+		case "FAILED": return ResultStatus.Failed;
+		case "WARNING":
+		case "NOT_AVAILABLE": return ResultStatus.NotReviewed;
+		case void 0:
+		case "": return ResultStatus.Failed;
+		default: return ResultStatus.Error;
+	}
+}
+function severityLabelToImpact(label) {
+	switch ((label ?? "").toUpperCase()) {
+		case "CRITICAL": return .9;
+		case "HIGH": return .7;
+		case "MEDIUM": return .5;
+		case "LOW": return .3;
+		default: return 0;
+	}
+}
+/**
+* findingImpact derives a 0.0–1.0 impact. Suppressed findings are forced to 0.
+* Security Hub's INFORMATIONAL is up-graded to MEDIUM (Security Hub over-marks
+* findings INFORMATIONAL without context).
+*/
+function findingImpact(f) {
+	if (f.Workflow?.Status === "SUPPRESSED") return 0;
+	let label = f.Severity?.Label;
+	if (isSecurityHub(f) && (label ?? "").toUpperCase() === "INFORMATIONAL") label = "MEDIUM";
+	if (label) return severityLabelToImpact(label);
+	if (typeof f.Severity?.Normalized === "number") return f.Severity.Normalized / 100;
+	return 0;
+}
+function productArnParts(arn) {
+	if (!arn) return ["", ""];
+	const segs = (arn.split(":").pop() ?? "").split("/");
+	if (segs.length >= 3) return [segs[1], segs[2]];
+	return ["", ""];
+}
+function isSecurityHub(f) {
+	return productOf(f) === "securityHub";
+}
+const normalizeStd = (s) => s.toLowerCase().replace(/-/g, " ");
+function titleCaseWords(s) {
+	return s.split(/\s+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+/**
+* securityHubStandardName derives "CIS AWS Foundations Benchmark v1.2.0" from a
+* finding's StandardsControlArn, preferring the nicer Types[0] casing when it
+* matches the ARN's standard slug (mirrors the SAF CLI grouping key).
+*/
+function securityHubStandardName(f) {
+	const arn = f.ProductFields?.StandardsControlArn ?? "";
+	if (!arn) return "";
+	const segs = arn.split("/");
+	if (segs.length < 4) return "";
+	const slug = segs[segs.length - 4];
+	const version = segs[segs.length - 2];
+	let typesLast = "";
+	if (f.Types && f.Types.length > 0) {
+		const ts = f.Types[0].split("/");
+		typesLast = ts[ts.length - 1];
+	}
+	return `${typesLast && normalizeStd(typesLast) === normalizeStd(slug) ? typesLast.replace(/-/g, " ") : titleCaseWords(slug.replace(/-/g, " "))} v${version}`;
+}
+/** Level-1 grouping key, per product. */
+function baselineName(f) {
+	switch (productOf(f)) {
+		case "securityHub": {
+			const name = securityHubStandardName(f);
+			if (name) return name;
+			break;
+		}
+		case "prowler":
+			if (f.ProductFields?.ProviderName) return f.ProductFields.ProviderName;
+			break;
+		case "trivy": return "Aqua Security - Trivy";
+	}
+	const [company, prod] = productArnParts(f.ProductArn);
+	if (!company && !prod) return "AWS Security Finding Format";
+	return `${company} - ${prod}`;
+}
+/** Level-2 grouping key within a baseline, per product. */
+function controlId(f) {
+	switch (productOf(f)) {
+		case "securityHub":
+			if (f.ProductFields?.ControlId) return f.ProductFields.ControlId;
+			if (f.ProductFields?.RuleId) return f.ProductFields.RuleId;
+			break;
+		case "prowler": {
+			const i = (f.GeneratorId ?? "").indexOf("-");
+			if (i >= 0) return (f.GeneratorId ?? "").slice(i + 1);
+			break;
+		}
+		case "trivy": return `${f.GeneratorId ?? ""}/${trivyCVE(f) || f.Id || ""}`;
+	}
+	if (f.Compliance?.Status && f.GeneratorId) {
+		const segs = f.GeneratorId.split("/");
+		if (segs[segs.length - 1]) return segs[segs.length - 1];
+	}
+	return f.Id ?? "";
+}
+/**
+* nistTags derives NIST controls for a finding group: AWS Config rule → NIST via
+* the shared awsconfig mapping, falling back to the static analysis default
+* bundle (matching the SAF CLI) when no config rule applies.
+*/
+function nistTags(group) {
+	if (group.length > 0 && productOf(group[0]) === "trivy" && trivyCVE(group[0])) return DEFAULT_REMEDIATION_NIST_TAGS$1;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of group) for (const tag of configRuleNist(f)) if (!seen.has(tag)) {
+		seen.add(tag);
+		out.push(tag);
+	}
+	return out.length > 0 ? out : DEFAULT_STATIC_ANALYSIS_NIST_TAGS;
+}
+function configRuleNist(f) {
+	if (f.ProductFields?.["RelatedAWSResources:0/type"] !== "AWS::Config::ConfigRule") return [];
+	const name = f.ProductFields?.["RelatedAWSResources:0/name"];
+	if (!name) return [];
+	return getAwsConfigNistControlsBySubstring(name);
+}
+function remediationText(f) {
+	const parts = [];
+	const rec = f.Remediation?.Recommendation;
+	if (rec?.Text) parts.push(rec.Text);
+	if (rec?.Url) parts.push(rec.Url);
+	return parts.join("\n");
+}
+function resourceCodeDesc(f) {
+	return `Resources: [${(f.Resources ?? []).map((r) => {
+		let seg = `Type: ${r.Type ?? ""}, Id: ${r.Id ?? ""}`;
+		if (r.Partition) seg += `, Partition: ${r.Partition}`;
+		if (r.Region) seg += `, Region: ${r.Region}`;
+		return seg;
+	}).join("; ")}]`;
+}
+function statusReason(f) {
+	const lines = [];
+	for (const r of f.Compliance?.StatusReasons ?? []) {
+		if (r.ReasonCode) lines.push(`ReasonCode: ${r.ReasonCode}`);
+		if (r.Description) lines.push(`Description: ${r.Description}`);
+	}
+	return lines.join("\n");
+}
+function buildResult$2(f) {
+	const start = parseTimestamp(f.LastObservedAt ?? f.UpdatedAt ?? "") ?? /* @__PURE__ */ new Date();
+	let status = mapComplianceStatus$1(f.Compliance?.Status);
+	let codeDesc = resourceCodeDesc(f);
+	let message = statusReason(f);
+	switch (productOf(f)) {
+		case "prowler":
+			codeDesc = f.Description ?? "";
+			break;
+		case "trivy": {
+			status = ResultStatus.Failed;
+			const m = trivyMessage(f);
+			if (m) message = m;
+			break;
+		}
+	}
+	const vuln = vulnerabilitySummary(f);
+	if (vuln) message = message ? `${message}\n${vuln}` : vuln;
+	return createResult(status, message || void 0, {
+		codeDesc,
+		startTime: start
+	});
+}
+/**
+* Renders a finding's ASFF Vulnerabilities[] as a compact text block: CVE id,
+* CVSS base score, EPSS, exploit/fix availability, and affected packages.
+* Generic — applies to any producer that emits the field.
+*/
+function vulnerabilitySummary(f) {
+	return (f.Vulnerabilities ?? []).map((v) => {
+		const parts = [v.Id ?? ""];
+		const cvss = v.Cvss?.[0];
+		if (cvss && typeof cvss.BaseScore === "number") parts.push(`CVSS ${cvss.Version ?? ""} ${cvss.BaseScore.toFixed(1)}`);
+		if (typeof v.EpssScore === "number") parts.push(`EPSS ${v.EpssScore.toFixed(4)}`);
+		if (v.ExploitAvailable) parts.push(`exploit ${v.ExploitAvailable.toLowerCase()}`);
+		if (v.FixAvailable) parts.push(`fix ${v.FixAvailable.toLowerCase()}`);
+		for (const p of v.VulnerablePackages ?? []) {
+			let pkg = `${p.Name ?? ""}@${p.Version ?? ""}`;
+			if (p.FixedInVersion) pkg += ` (fixed in ${p.FixedInVersion})`;
+			parts.push(pkg);
+		}
+		return parts.join("; ");
+	}).join("\n");
+}
+function trivyMessage(f) {
+	const o = f.Resources?.[0]?.Details?.Other;
+	if (!o) return "";
+	if (o["CVE ID"]) {
+		const patched = o["Patched Package"];
+		const patchMsg = patched ? `The package has been patched since version(s): ${patched}.` : "There is no patched version of the package.";
+		return `For package ${o["PkgName"] ?? ""}, the current version that is installed is ${o["Installed Package"] ?? ""}.  ${patchMsg}`;
+	}
+	if (o["Message"]) {
+		const loc = trivyLocation(o);
+		return loc ? `${o["Message"]} (${loc})` : o["Message"];
+	}
+	if (o["Filename"]) return `Secret detected in ${o["Filename"]}.`;
+	return "";
+}
+function trivyLocation(o) {
+	const file = o["Filename"] ?? "";
+	if (!file) return "";
+	const sl = o["StartLine"];
+	if (!sl || sl === "0") return file;
+	let loc = `${file}:${sl}`;
+	const el = o["EndLine"];
+	if (el && el !== "0" && el !== sl) loc += `-${el}`;
+	return loc;
+}
+function buildRequirement$17(id, group) {
+	const primary = group[0];
+	const impact = Math.max(...group.map(findingImpact));
+	const descriptions = [{
+		label: "default",
+		data: productOf(primary) === "prowler" ? " " : primary.Description ?? primary.Title ?? ""
+	}];
+	const fix = remediationText(primary);
+	if (fix) descriptions.push({
+		label: "fix",
+		data: fix
+	});
+	const nist = nistTags(group);
+	const tags = nist.length > 0 ? buildNistCciTags(nist, nistToCci(nist)) : {};
+	const results = group.map(buildResult$2);
+	const req = createRequirement(id, primary.Title ?? "", descriptions, impact, results, { tags });
+	const controlType = deriveControlTypeFromTags(nist);
+	if (controlType !== void 0) req.controlType = controlType;
+	const refs = [];
+	if (primary.SourceUrl) refs.push({ url: primary.SourceUrl });
+	const seen = /* @__PURE__ */ new Set();
+	for (const v of primary.Vulnerabilities ?? []) for (const u of v.ReferenceUrls ?? []) if (u && !seen.has(u)) {
+		seen.add(u);
+		refs.push({ url: u });
+	}
+	if (refs.length > 0) req.refs = refs;
+	return req;
+}
+function buildBaseline$1(name, findings, resultsChecksum) {
+	const order = [];
+	const groups = /* @__PURE__ */ new Map();
+	for (const f of findings) {
+		const id = controlId(f);
+		const existing = groups.get(id);
+		if (existing) existing.push(f);
+		else {
+			order.push(id);
+			groups.set(id, [f]);
+		}
+	}
+	return createMinimalBaseline(name, order.map((id) => buildRequirement$17(id, groups.get(id))), { resultsChecksum });
+}
+/** Converts an ASFF document to HDF Results JSON. */
+async function convertAsffToHdf(input, converterVersion = "1.0.0") {
+	if (!input || input.trim().length === 0) throw new Error("asff: empty input");
+	validateInputSize(input, "asff");
+	const findings = parseFindings$1(input);
+	const resultsChecksum = await inputChecksum(input);
+	const order = [];
+	const byBaseline = /* @__PURE__ */ new Map();
+	const accounts = [];
+	const seenAccount = /* @__PURE__ */ new Set();
+	for (const f of findings) {
+		const name = baselineName(f);
+		const existing = byBaseline.get(name);
+		if (existing) existing.push(f);
+		else {
+			order.push(name);
+			byBaseline.set(name, [f]);
+		}
+		if (f.AwsAccountId && !seenAccount.has(f.AwsAccountId)) {
+			seenAccount.add(f.AwsAccountId);
+			accounts.push(f.AwsAccountId);
+		}
+	}
+	let baselines = order.map((name) => buildBaseline$1(name, byBaseline.get(name), resultsChecksum));
+	if (baselines.length === 0) baselines = [createMinimalBaseline("AWS Security Finding Format", [buildNoFindingsRequirement("asff-no-findings", "AWS Security Finding Format input contained zero findings.", /* @__PURE__ */ new Date())], { resultsChecksum })];
+	const hdf = {
+		baselines,
+		generator: {
+			name: "asff-to-hdf",
+			version: converterVersion
+		},
+		tool: {
+			name: "AWS Security Finding Format",
+			format: "JSON"
+		},
+		timestamp: /* @__PURE__ */ new Date()
+	};
+	if (accounts.length > 0) {
+		const refs = baselines.map((b) => b.name);
+		hdf.components = accounts.map((acct) => ({
+			name: acct,
+			type: TargetType.CloudAccount,
+			baselineRefs: refs
+		}));
+	}
+	return serializeHdf(hdf);
+}
+//#endregion
 //#region converters/sarif-to-hdf/typescript/converter.ts
 const IMPACT_MAPPING$9 = {
 	error: .7,
@@ -1949,6 +2322,9 @@ function parseCklb(input) {
 	return {
 		format: "cklb",
 		cklbVersion: nz(doc.cklb_version),
+		active: doc.active ?? false,
+		hasPath: doc.has_path ?? false,
+		mode: doc.mode ?? 0,
 		asset,
 		stigs
 	};
@@ -1989,8 +2365,9 @@ function serializeCklb(cl) {
 	const doc = {
 		title: cklbTitle(cl),
 		cklb_version: cl.cklbVersion || "1.0",
-		active: false,
-		has_path: false,
+		active: cl.active ?? false,
+		...cl.mode ? { mode: cl.mode } : {},
+		has_path: cl.hasPath ?? false,
 		target_data: {
 			target_type: cl.asset.assetType || "Computing",
 			host_name: cl.asset.hostName ?? "",
@@ -2132,6 +2509,9 @@ function assetToComponent(a) {
 function rootExtensions(cl) {
 	const ext = { checklistFormat: cl.format || "ckl" };
 	if (cl.cklbVersion) ext["cklbVersion"] = cl.cklbVersion;
+	if (cl.active) ext["cklbActive"] = true;
+	if (cl.hasPath) ext["cklbHasPath"] = true;
+	if (cl.mode) ext["cklbMode"] = cl.mode;
 	const ax = {};
 	setIf$1(ax, "role", cl.asset.role);
 	setIf$1(ax, "assetType", cl.asset.assetType);
@@ -2178,6 +2558,9 @@ function hdfToChecklist(input) {
 	return {
 		format,
 		cklbVersion: cklbVersion || void 0,
+		active: boolVal(ext, "cklbActive"),
+		hasPath: boolVal(ext, "cklbHasPath"),
+		mode: numVal(ext, "cklbMode"),
 		asset,
 		stigs
 	};
@@ -2279,6 +2662,13 @@ function strVal(m, key) {
 	const v = m[key];
 	return typeof v === "string" ? v : "";
 }
+function boolVal(m, key) {
+	return m[key] === true;
+}
+function numVal(m, key) {
+	const v = m[key];
+	return typeof v === "number" ? v : 0;
+}
 function strSlice(m, key) {
 	const v = m[key];
 	if (Array.isArray(v)) return v.filter((e) => typeof e === "string");
@@ -3471,6 +3861,18 @@ function checkRevisionAlignment(rules) {
 	if (isNistStrict()) throw new Error(`aws-config: ${detail}\nre-run with a matching revision, or disable strict mode to convert with the gaps`);
 	console.warn(`WARNING: ${detail}`);
 }
+function buildFixText(rule) {
+	const r = rule.Remediation;
+	if (!r || !r.TargetId) return "";
+	const trigger = r.Automatic ? "automatically on non-compliance" : "on demand";
+	const doc = r.TargetVersion ? `${r.TargetId} (version ${r.TargetVersion})` : r.TargetId;
+	return `Remediate via ${remediationTargetLabel(r.TargetType)} ${doc}, applied ${trigger}.`;
+}
+function remediationTargetLabel(targetType) {
+	if (targetType === "SSM_DOCUMENT") return "SSM Automation document";
+	if (!targetType) return "automation document";
+	return `${targetType} document`;
+}
 function buildCheckText(rule) {
 	const parts = [`ARN: ${rule.ConfigRuleArn || "N/A"}`, `Source Identifier: ${rule.Source.SourceIdentifier || "N/A"}`];
 	if (rule.InputParameters && rule.InputParameters !== "{}") {
@@ -3497,31 +3899,25 @@ function buildResult(r) {
 	const q = r.EvaluationResultIdentifier.EvaluationResultQualifier;
 	const status = mapComplianceStatus(r.ComplianceType);
 	const codeDesc = buildCodeDesc$7(q);
-	const message = buildResultMessage(codeDesc, r.Annotation, status);
-	const startTime = (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
-	const runTime = computeRunTime(r.ConfigRuleInvokedTime, r.ResultRecordedTime);
-	return {
-		status,
+	return createResult(status, buildResultMessage(codeDesc, r.Annotation, status), {
 		codeDesc,
-		startTime,
-		...runTime !== void 0 ? { runTime } : {},
-		...message !== void 0 ? { message } : {}
-	};
+		startTime: (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
+		runTime: computeRunTime(r.ConfigRuleInvokedTime, r.ResultRecordedTime)
+	});
 }
 /**
 * Synthesizes a single HDF result for a Config rule whose live evaluation
 * returned zero in-scope resources. The HDF schema requires `results` to have
 * minItems >= 1; this honestly signals to auditors that the rule's check ran
 * but had no scope in this account/region rather than vacuously claiming
-* "passed". See issue #80 bug 2.
+* "passed".
 */
 function buildNotApplicableResult(rule) {
 	const codeDesc = `AWS Config rule ${rule.ConfigRuleName} evaluated zero in-scope resources in this account/region.`;
-	return {
-		status: ResultStatus.NotApplicable,
+	return createResult(ResultStatus.NotApplicable, void 0, {
 		codeDesc,
 		startTime: /* @__PURE__ */ new Date()
-	};
+	});
 }
 function buildRequirement$15(rule) {
 	const nist = buildNistTags$3(rule.Source.SourceIdentifier, rule.ConfigRuleName);
@@ -3533,6 +3929,11 @@ function buildRequirement$15(rule) {
 		label: "check",
 		data: buildCheckText(rule)
 	}];
+	const fix = buildFixText(rule);
+	if (fix) descriptions.push({
+		label: "fix",
+		data: fix
+	});
 	const title = `${getAccountId(rule.ConfigRuleArn)} - ${rule.ConfigRuleName}`;
 	const results = rule.EvaluationResults.length > 0 ? rule.EvaluationResults.map(buildResult) : [buildNotApplicableResult(rule)];
 	const req = createRequirement(rule.ConfigRuleId, title, descriptions, .5, results, {
@@ -3618,12 +4019,10 @@ function checkToResult(check, scanTime) {
 	const codeDesc = `Resource: ${check.resource}\nFile: ${check.file_path} (lines ${JSON.stringify(check.file_line_range)})`;
 	let message;
 	if (status === ResultStatus.NotReviewed && check.check_result.suppress_comment) message = check.check_result.suppress_comment;
-	return {
-		status,
+	return createResult(status, message, {
 		codeDesc,
-		startTime: scanTime,
-		...message !== void 0 ? { message } : {}
-	};
+		startTime: scanTime
+	});
 }
 /**
 * Converts a group of checks sharing a check_id into one EvaluatedRequirement.
@@ -4645,472 +5044,202 @@ function parseBom(input) {
 	}
 }
 //#endregion
-//#region converters/cyclonedx-to-hdf/typescript/converter.ts
-const CVSS_METHODS = /* @__PURE__ */ new Set([
-	"CVSSv2",
-	"CVSSv3",
-	"CVSSv31",
-	"CVSSv4"
-]);
+//#region shared/typescript/exportmap.ts
 /**
-* Computes the maximum impact across all ratings for a vulnerability.
-* Prefers CVSS score/10 when available, falls back to severityToImpact().
+* Generic, source-tool-agnostic mapping helpers shared by the HDF export
+* converters (hdf-to-ecs, hdf-to-splunk, ...).
+*
+* The export converters deliberately operate on generically-parsed JSON rather
+* than typed HDF structs, so their output can be held byte-identical with the
+* Go implementations. This module centralizes the generic accessors, the status
+* roll-up, the requirement/document field extraction, and the canonical
+* (key-sorted, HTML-unescaped) line serialization. Target-specific event shaping
+* (ECS field names, CIM field names, envelopes) stays in each converter.
 */
-function maxImpact(ratings) {
-	if (ratings.length === 0) return .5;
-	let max = 0;
-	for (const rating of ratings) {
-		let impact;
-		if (rating.method && CVSS_METHODS.has(rating.method) && rating.score !== void 0 && rating.score !== null) impact = rating.score / 10;
-		else impact = severityToImpact$1(rating.severity ?? "medium");
-		if (impact > max) max = impact;
-	}
-	return max;
+function asMap(v) {
+	return v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
-/**
-* Formats the ratings as a human-readable tag string.
-*/
-function formatRatingsTag(ratings) {
-	return ratings.map((r) => `${r.source?.name ?? "Unknown"} - ${r.severity ?? "unrated"}`).join(", ");
+function asArr(v) {
+	return Array.isArray(v) ? v : void 0;
 }
-/**
-* Formats a component reference as a code_desc string.
-*/
-function formatCodeDesc$4(componentLookup, ref) {
-	const comp = componentLookup.get(ref);
-	if (!comp) return `Component ${ref} is vulnerable`;
-	let name = "";
-	if (comp.group) name += comp.group + "/";
-	name += comp.name;
-	if (comp.version) name += "@" + comp.version;
-	return `Component ${name} is vulnerable`;
+function getStr(m, key) {
+	const v = m?.[key];
+	return typeof v === "string" ? v : "";
 }
-/**
-* Flattens nested CycloneDX components into a single array.
-*/
-function flattenComponents(components) {
-	const result = [];
-	for (const comp of components) {
-		result.push(comp);
-		if (comp.components) result.push(...flattenComponents(comp.components));
+function setIf(m, key, val) {
+	if (val !== "") m[key] = val;
+}
+function stringSlice(v) {
+	if (typeof v === "string") return [v];
+	if (Array.isArray(v)) return v.filter((e) => typeof e === "string");
+	return [];
+}
+/** Most-significant status across a requirement's results[] (lossless). */
+function worstOfResults(req) {
+	const results = asArr(req.results) ?? [];
+	const precedence = [
+		"failed",
+		"error",
+		"passed",
+		"notReviewed",
+		"notApplicable"
+	];
+	const present = /* @__PURE__ */ new Set();
+	for (const rRaw of results) {
+		const r = asMap(rRaw);
+		if (r) present.add(getStr(r, "status"));
 	}
-	return result;
+	for (const s of precedence) if (present.has(s)) return s;
+	return "notReviewed";
 }
 /**
-* Reports whether any (possibly nested) component is a machine-learning-model,
-* i.e. the CycloneDX document is an AI-BOM.
+* Whether an HDF Result_Status is a failing verdict. Only 'failed' fails;
+* 'error' is indeterminate (not a compliance failure) and every other value is
+* non-failing. Single shared definition of "failing" for the suppression axis
+* and the per-exporter outcome maps.
 */
-function hasMLModelComponent(components) {
-	return flattenComponents(components).some((comp) => comp.type === "machine-learning-model");
+function isFailing(status) {
+	return status === "failed";
 }
-/**
-* Converts CycloneDX SBOM/VEX JSON to HDF format.
-*
-* @param input - CycloneDX JSON string
-* @returns HDF JSON string
-*/
-async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
-	if (!input || input.trim().length === 0) throw new Error("cyclonedx: empty input");
-	validateInputSize(input, "cyclonedx");
-	const bom = parseJSON(input);
-	if (!bom || typeof bom !== "object") throw new Error("cyclonedx: invalid JSON");
-	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx: missing or invalid bomFormat (expected "CycloneDX", got "${bom.bomFormat ?? "undefined"}")`);
-	if ((!bom.components || bom.components.length === 0) && (!bom.vulnerabilities || bom.vulnerabilities.length === 0)) throw new Error("cyclonedx: input has neither components nor vulnerabilities");
-	if (!bom.vulnerabilities || bom.vulnerabilities.length === 0) {
-		if (hasMLModelComponent(bom.components ?? [])) throw new Error("cyclonedx: this file is a CycloneDX AI-BOM (machine-learning-model inventory) with no vulnerabilities; to import it into a system document, use:\n  hdf system create <file> --from cyclonedx-mlbom");
-		throw new Error("cyclonedx: this file is an SBOM inventory with no vulnerabilities; to import SBOM data into a system document, use:\n  hdf system create <sbom-file> --component-name <name>");
+/** Resolve the status context for a requirement. */
+function statusOf(req) {
+	const raw = worstOfResults(req);
+	const effective = getStr(req, "effectiveStatus");
+	const overrides = asArr(req.statusOverrides);
+	const rollup = effective !== "" ? effective : raw;
+	return {
+		raw,
+		effective,
+		rollup,
+		overridden: overrides !== void 0 && overrides.length > 0 || "effectiveStatus" in req,
+		suppressed: isFailing(raw) && !isFailing(rollup)
+	};
+}
+function firstComponent(doc) {
+	const comps = asArr(doc.components);
+	if (!comps || comps.length === 0) return void 0;
+	return asMap(comps[0]);
+}
+function firstResultStartTime(req, fallback) {
+	const results = asArr(req.results) ?? [];
+	if (results.length > 0) {
+		const st = getStr(asMap(results[0]), "startTime");
+		if (st !== "") return st;
 	}
-	const resultsChecksum = await inputChecksum(input);
-	const parsedTimestamp = bom.metadata?.timestamp ? parseTimestamp(bom.metadata.timestamp) ?? void 0 : void 0;
-	const scanTime = parsedTimestamp && !isNaN(parsedTimestamp.getTime()) ? parsedTimestamp : /* @__PURE__ */ new Date();
-	const allComponents = flattenComponents(bom.components ?? []);
-	const componentLookup = /* @__PURE__ */ new Map();
-	for (const comp of allComponents) if (comp["bom-ref"]) componentLookup.set(comp["bom-ref"], comp);
-	const requirements = [];
-	const { items: limitedVulns, truncated: truncatedVulns } = limitArray(bom.vulnerabilities ?? []);
-	/* v8 ignore next -- truncation only triggers with >100K items */
-	if (truncatedVulns) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${(bom.vulnerabilities ?? []).length})`);
-	for (const vuln of limitedVulns) {
-		const ratings = vuln.ratings ?? [];
-		const impact = maxImpact(ratings);
-		const cwes = vuln.cwes ?? [];
-		const nist = mapCWEToNIST(cwes.map((c) => `${c}`), DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
-		const tags = {
-			nist,
-			cci: nistToCci(nist)
-		};
-		if (cwes.length > 0) tags["cweid"] = cwes.map((c) => `CWE-${c}`);
-		if (ratings.length > 0) tags["ratings"] = formatRatingsTag(ratings);
-		const descriptions = [];
-		const defaultParts = [];
-		if (vuln.description) defaultParts.push(`Description: ${vuln.description}`);
-		if (vuln.detail) defaultParts.push(`Detail: ${vuln.detail}`);
-		if (defaultParts.length > 0) descriptions.push({
-			label: "default",
-			data: defaultParts.join("\n\n")
-		});
-		else descriptions.push({
-			label: "default",
-			data: vuln.id
-		});
-		const fixParts = [];
-		if (vuln.recommendation) fixParts.push(vuln.recommendation);
-		if (vuln.analysis?.detail) fixParts.push(`Workaround: ${vuln.analysis.detail}`);
-		if (fixParts.length > 0) descriptions.push({
-			label: "fix",
-			data: fixParts.join("\n\n")
-		});
-		const affects = vuln.affects ?? [];
-		const toResult = (codeDesc) => ({
-			status: ResultStatus.Failed,
-			codeDesc,
-			startTime: scanTime
-		});
-		const results = affects.length > 0 ? affects.map((affect) => toResult(formatCodeDesc$4(componentLookup, affect.ref))) : [toResult(`Vulnerability ${vuln.id}`)];
-		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
-		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
-		const controlType = deriveControlTypeFromTags(nist);
-		if (controlType !== void 0) req.controlType = controlType;
-		requirements.push(req);
+	return fallback;
+}
+function defaultDescription(req) {
+	const descs = asArr(req.descriptions) ?? [];
+	for (const dRaw of descs) {
+		const d = asMap(dRaw);
+		if (d && getStr(d, "label") === "default") return getStr(d, "data");
 	}
-	const baseline = createMinimalBaseline("CycloneDX Scan", requirements, { resultsChecksum });
-	const targetComponent = {
-		name: bom.metadata?.component?.name ?? "",
-		type: TargetType.Application
-	};
-	if (bom.metadata?.component?.version) targetComponent.version = bom.metadata.component.version;
-	const parsedBom = parseBom(input);
-	const bomParts = {
-		bomType: BOMType.Sbom,
-		format: "cyclonedx",
-		uniqueId: parsedBom.normalized.uniqueId,
-		document: JSON.parse(input)
-	};
-	if (parsedBom.normalized.packages && parsedBom.normalized.packages.length > 0) bomParts.packages = parsedBom.normalized.packages;
-	const componentBom = buildBom(bomParts);
-	return buildHdfResults({
-		generatorName: "cyclonedx-to-hdf",
-		converterVersion,
-		toolName: "CycloneDX",
-		toolFormat: "JSON",
-		baselines: [baseline],
-		components: [{
-			...targetComponent,
-			boms: [componentBom]
-		}],
-		timestamp: scanTime
-	});
+	return "";
 }
-//#endregion
-//#region converters/hdf-to-csv/typescript/converter.ts
-/**
-* Convert HDF JSON to CSV format
-* @param input HDF JSON string
-* @returns CSV string with sanitized output
-*/
-function convertHdfToCsv(input) {
-	validateInputSize(input, "hdf-to-csv");
-	const hdf = parseHdf(input);
-	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
-	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
-	const rows = [];
-	const components = hdf.components || [];
-	const targetList = components.length > 0 ? components.map((t) => ({
-		name: t.name,
-		type: t.type
-	})) : [{
-		name: "",
-		type: ""
-	}];
-	for (const baseline of hdf.baselines) for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
-	return buildCsv(rows, { sanitize: true });
+function firstRefURL(req) {
+	const refs = asArr(req.refs) ?? [];
+	for (const rRaw of refs) {
+		const url = getStr(asMap(rRaw), "url");
+		if (url !== "") return url;
+	}
+	return "";
+}
+/** Deterministic event id: component | baseline | control. */
+function eventID(component, baselineName, controlID) {
+	let comp = "";
+	if (component) comp = getStr(component, "componentId") || getStr(component, "name");
+	return [
+		comp,
+		baselineName,
+		controlID
+	].join("|");
 }
 /**
-* Create a CSV row from baseline, requirement, and target data
+* Build the lossless hdf.* namespace shared by the export converters: promoted
+* snake_case scalars plus the full requirement sub-objects preserved verbatim.
+* `status` is the lossless results roll-up (statusOf().raw); `suppressed` is the
+* acceptance axis (statusOf().suppressed).
 */
-function createRow(baseline, requirement, target) {
-	const description = requirement.descriptions.find((d) => d.label === "default")?.data || "";
-	const check = descriptionByLabel(requirement, "check");
-	const fix = descriptionByLabel(requirement, "fix");
-	const rationale = descriptionByLabel(requirement, "rationale");
-	const code = requirement.code ?? "";
-	const references = flattenRefs(requirement.refs);
-	const severity = getSeverity(requirement);
-	const firstResult = requirement.results[0];
-	const status = firstResult?.status || "";
-	const message = firstResult?.message || "";
-	const nistControls = extractArrayFromTags(requirement.tags, "nist");
-	const cciControls = extractArrayFromTags(requirement.tags, "cci");
-	return {
-		"Baseline ID": baseline.name,
-		"Baseline Version": baseline.version || "",
-		"Baseline Title": baseline.title || "",
-		"Target ID": target.name,
-		"Target Type": target.type,
-		"Requirement ID": requirement.id,
-		"Requirement Title": requirement.title || "",
-		"Description": description,
-		"Check": check,
-		"Fix": fix,
-		"Rationale": rationale,
-		"Code": code,
-		"References": references,
-		"Severity": severity,
-		"Impact": requirement.impact,
-		"Status": String(status),
-		"NIST Controls": nistControls,
-		"CCI Controls": cciControls,
-		"Control Type": requirement.controlType ?? "",
-		"Verification Method": requirement.verificationMethod ?? "",
-		"Applicability": requirement.applicability ?? "",
-		"Result Message": message
+function buildHDFBlock(req, baseline, status, overridden, suppressed, generator, tool, converterVersion) {
+	const hdf = {
+		status,
+		overridden,
+		suppressed,
+		exporter_version: converterVersion
 	};
+	setIf(hdf, "control_id", getStr(req, "id"));
+	setIf(hdf, "baseline", getStr(baseline, "name"));
+	if ("effectiveStatus" in req) hdf.effective_status = req.effectiveStatus;
+	if ("effectiveImpact" in req) hdf.effective_impact = req.effectiveImpact;
+	if ("impact" in req) hdf.impact = req.impact;
+	if ("severity" in req) hdf.severity = req.severity;
+	if ("disposition" in req) hdf.disposition = req.disposition;
+	const tags = asMap(req.tags);
+	if (tags?.nist !== void 0) hdf.nist = tags.nist;
+	if (tags?.cci !== void 0) hdf.cci = tags.cci;
+	for (const [src, dst] of Object.entries({
+		tags: "tags",
+		cvss: "cvss",
+		cwe: "cwe",
+		epss: "epss",
+		kev: "kev",
+		affectedPackages: "affected_packages",
+		descriptions: "descriptions",
+		results: "results",
+		statusOverrides: "status_overrides",
+		poams: "poams",
+		code: "code",
+		refs: "refs"
+	})) if (src in req) hdf[dst] = req[src];
+	if (generator) hdf.generator = generator;
+	if (tool) hdf.tool = tool;
+	return hdf;
 }
 /**
-* Get severity from requirement tags or derive from impact
+* A numeric value that must serialize with an explicit decimal point, so a
+* whole-number renders as `10.0` rather than the integer `10`. Some consumers
+* type-check strictly (OCSF's `float_t` rejects an integer-shaped token).
+* JSON.stringify cannot emit `10.0` for a JS number, so the value is carried in
+* this wrapper (passed through canonicalize untouched) and rendered as a bare
+* numeric token by stringifyLine. Go's counterpart is encoding/json's json.Number.
 */
-function getSeverity(requirement) {
-	if (requirement.tags && typeof requirement.tags === "object") {
-		if ("severity" in requirement.tags) {
-			const sev = requirement.tags.severity;
-			if (typeof sev === "string") return sev;
-			if (Array.isArray(sev) && sev.length > 0) return String(sev[0]);
-		}
+var RawNumber = class {
+	constructor(token) {
+		this.token = token;
 	}
-	const impact = requirement.impact;
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "medium";
-	return "low";
+};
+/** Wrap a number as a RawNumber whose token always bears a decimal point. */
+function floatNumber(f) {
+	let s = String(f);
+	if (!/[.eE]/.test(s)) s += ".0";
+	return new RawNumber(s);
 }
+const RAWNUM_MARK = String.fromCharCode(1);
+const RAWNUM_RE = /"\\u0001(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\\u0001"/g;
 /**
-* Extract array values from tags object and join with semicolons
+* Compare two strings by Unicode code point. This matches Go's `encoding/json`
+* key ordering, which is a bytewise comparison of the UTF-8 encoding \u2014 and UTF-8
+* byte order is identical to code-point order. JS's default Array.sort() instead
+* compares UTF-16 code units, which diverges for supplementary-plane (non-BMP)
+* characters: a lead surrogate (0xD800\u20130xDBFF) sorts before a BMP char in
+* [0xE000,0xFFFF] under UTF-16, but a non-BMP code point (\u22650x10000) sorts after
+* it under UTF-8. Iterating the string yields whole code points (surrogate pairs
+* combined), so this comparator is correct for the full Unicode range.
 */
-function extractArrayFromTags(tags, key) {
-	if (!tags || typeof tags !== "object") return "";
-	const value = tags[key];
-	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
-	return "";
+function byCodePoint(a, b) {
+	const ai = [...a];
+	const bi = [...b];
+	const n = Math.min(ai.length, bi.length);
+	for (let i = 0; i < n; i++) {
+		const ca = ai[i]?.codePointAt(0) ?? 0;
+		const cb = bi[i]?.codePointAt(0) ?? 0;
+		if (ca !== cb) return ca - cb;
+	}
+	return ai.length - bi.length;
 }
 /**
-* Get the data of the first description matching a label. Empty when absent.
-*/
-function descriptionByLabel(requirement, label) {
-	return requirement.descriptions.find((d) => d.label === label)?.data || "";
-}
-/**
-* Flatten a requirement's refs to one string: each Reference rendered as its
-* url/uri (or a string `ref`); array-form refs are skipped. Joined with '; ' to
-* match the NIST/CCI column convention.
-*/
-function flattenRefs(refs) {
-	if (!Array.isArray(refs)) return "";
-	const out = [];
-	for (const r of refs) {
-		if (!r || typeof r !== "object") continue;
-		const o = r;
-		if (typeof o.url === "string") out.push(o.url);
-		else if (typeof o.uri === "string") out.push(o.uri);
-		else if (typeof o.ref === "string") out.push(o.ref);
-	}
-	return out.join("; ");
-}
-//#endregion
-//#region shared/typescript/exportmap.ts
-/**
-* Generic, source-tool-agnostic mapping helpers shared by the HDF export
-* converters (hdf-to-ecs, hdf-to-splunk, ...).
-*
-* The export converters deliberately operate on generically-parsed JSON rather
-* than typed HDF structs, so their output can be held byte-identical with the
-* Go implementations. This module centralizes the generic accessors, the status
-* roll-up, the requirement/document field extraction, and the canonical
-* (key-sorted, HTML-unescaped) line serialization. Target-specific event shaping
-* (ECS field names, CIM field names, envelopes) stays in each converter.
-*/
-function asMap(v) {
-	return v !== null && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-}
-function asArr(v) {
-	return Array.isArray(v) ? v : void 0;
-}
-function getStr(m, key) {
-	const v = m?.[key];
-	return typeof v === "string" ? v : "";
-}
-function setIf(m, key, val) {
-	if (val !== "") m[key] = val;
-}
-function stringSlice(v) {
-	if (typeof v === "string") return [v];
-	if (Array.isArray(v)) return v.filter((e) => typeof e === "string");
-	return [];
-}
-/** Most-significant status across a requirement's results[] (lossless). */
-function worstOfResults(req) {
-	const results = asArr(req.results) ?? [];
-	const precedence = [
-		"failed",
-		"error",
-		"passed",
-		"notReviewed",
-		"notApplicable"
-	];
-	const present = /* @__PURE__ */ new Set();
-	for (const rRaw of results) {
-		const r = asMap(rRaw);
-		if (r) present.add(getStr(r, "status"));
-	}
-	for (const s of precedence) if (present.has(s)) return s;
-	return "notReviewed";
-}
-/**
-* Whether an HDF Result_Status is a failing verdict. Only 'failed' fails;
-* 'error' is indeterminate (not a compliance failure) and every other value is
-* non-failing. Single shared definition of "failing" for the suppression axis
-* and the per-exporter outcome maps.
-*/
-function isFailing(status) {
-	return status === "failed";
-}
-/** Resolve the status context for a requirement. */
-function statusOf(req) {
-	const raw = worstOfResults(req);
-	const effective = getStr(req, "effectiveStatus");
-	const overrides = asArr(req.statusOverrides);
-	const rollup = effective !== "" ? effective : raw;
-	return {
-		raw,
-		effective,
-		rollup,
-		overridden: overrides !== void 0 && overrides.length > 0 || "effectiveStatus" in req,
-		suppressed: isFailing(raw) && !isFailing(rollup)
-	};
-}
-function firstComponent(doc) {
-	const comps = asArr(doc.components);
-	if (!comps || comps.length === 0) return void 0;
-	return asMap(comps[0]);
-}
-function firstResultStartTime(req, fallback) {
-	const results = asArr(req.results) ?? [];
-	if (results.length > 0) {
-		const st = getStr(asMap(results[0]), "startTime");
-		if (st !== "") return st;
-	}
-	return fallback;
-}
-function defaultDescription(req) {
-	const descs = asArr(req.descriptions) ?? [];
-	for (const dRaw of descs) {
-		const d = asMap(dRaw);
-		if (d && getStr(d, "label") === "default") return getStr(d, "data");
-	}
-	return "";
-}
-function firstRefURL(req) {
-	const refs = asArr(req.refs) ?? [];
-	for (const rRaw of refs) {
-		const url = getStr(asMap(rRaw), "url");
-		if (url !== "") return url;
-	}
-	return "";
-}
-/** Deterministic event id: component | baseline | control. */
-function eventID(component, baselineName, controlID) {
-	let comp = "";
-	if (component) comp = getStr(component, "componentId") || getStr(component, "name");
-	return [
-		comp,
-		baselineName,
-		controlID
-	].join("|");
-}
-/**
-* Build the lossless hdf.* namespace shared by the export converters: promoted
-* snake_case scalars plus the full requirement sub-objects preserved verbatim.
-* `status` is the lossless results roll-up (statusOf().raw); `suppressed` is the
-* acceptance axis (statusOf().suppressed).
-*/
-function buildHDFBlock(req, baseline, status, overridden, suppressed, generator, tool, converterVersion) {
-	const hdf = {
-		status,
-		overridden,
-		suppressed,
-		exporter_version: converterVersion
-	};
-	setIf(hdf, "control_id", getStr(req, "id"));
-	setIf(hdf, "baseline", getStr(baseline, "name"));
-	if ("effectiveStatus" in req) hdf.effective_status = req.effectiveStatus;
-	if ("effectiveImpact" in req) hdf.effective_impact = req.effectiveImpact;
-	if ("impact" in req) hdf.impact = req.impact;
-	if ("severity" in req) hdf.severity = req.severity;
-	if ("disposition" in req) hdf.disposition = req.disposition;
-	const tags = asMap(req.tags);
-	if (tags?.nist !== void 0) hdf.nist = tags.nist;
-	if (tags?.cci !== void 0) hdf.cci = tags.cci;
-	for (const [src, dst] of Object.entries({
-		tags: "tags",
-		cvss: "cvss",
-		cwe: "cwe",
-		epss: "epss",
-		kev: "kev",
-		affectedPackages: "affected_packages",
-		descriptions: "descriptions",
-		results: "results",
-		statusOverrides: "status_overrides",
-		poams: "poams",
-		code: "code",
-		refs: "refs"
-	})) if (src in req) hdf[dst] = req[src];
-	if (generator) hdf.generator = generator;
-	if (tool) hdf.tool = tool;
-	return hdf;
-}
-/**
-* A numeric value that must serialize with an explicit decimal point, so a
-* whole-number renders as `10.0` rather than the integer `10`. Some consumers
-* type-check strictly (OCSF's `float_t` rejects an integer-shaped token).
-* JSON.stringify cannot emit `10.0` for a JS number, so the value is carried in
-* this wrapper (passed through canonicalize untouched) and rendered as a bare
-* numeric token by stringifyLine. Go's counterpart is encoding/json's json.Number.
-*/
-var RawNumber = class {
-	constructor(token) {
-		this.token = token;
-	}
-};
-/** Wrap a number as a RawNumber whose token always bears a decimal point. */
-function floatNumber(f) {
-	let s = String(f);
-	if (!/[.eE]/.test(s)) s += ".0";
-	return new RawNumber(s);
-}
-const RAWNUM_MARK = String.fromCharCode(1);
-const RAWNUM_RE = /"\\u0001(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\\u0001"/g;
-/**
-* Compare two strings by Unicode code point. This matches Go's `encoding/json`
-* key ordering, which is a bytewise comparison of the UTF-8 encoding \u2014 and UTF-8
-* byte order is identical to code-point order. JS's default Array.sort() instead
-* compares UTF-16 code units, which diverges for supplementary-plane (non-BMP)
-* characters: a lead surrogate (0xD800\u20130xDBFF) sorts before a BMP char in
-* [0xE000,0xFFFF] under UTF-16, but a non-BMP code point (\u22650x10000) sorts after
-* it under UTF-8. Iterating the string yields whole code points (surrogate pairs
-* combined), so this comparator is correct for the full Unicode range.
-*/
-function byCodePoint(a, b) {
-	const ai = [...a];
-	const bi = [...b];
-	const n = Math.min(ai.length, bi.length);
-	for (let i = 0; i < n; i++) {
-		const ca = ai[i]?.codePointAt(0) ?? 0;
-		const cb = bi[i]?.codePointAt(0) ?? 0;
-		if (ca !== cb) return ca - cb;
-	}
-	return ai.length - bi.length;
-}
-/**
-* Recursively sort object keys in Go's map-key order (bytewise UTF-8 / code
-* point) so the emitted JSON is byte-identical to Go's encoder.
+* Recursively sort object keys in Go's map-key order (bytewise UTF-8 / code
+* point) so the emitted JSON is byte-identical to Go's encoder.
 */
 function canonicalize$1(v) {
 	if (v instanceof RawNumber) return v;
@@ -5194,38 +5323,307 @@ function epochMillis(s) {
 	return d.getTime();
 }
 //#endregion
-//#region converters/hdf-to-ecs/typescript/converter.ts
+//#region converters/cyclonedx-to-hdf/typescript/converter.ts
+const CVSS_METHODS = /* @__PURE__ */ new Set([
+	"CVSSv2",
+	"CVSSv3",
+	"CVSSv31",
+	"CVSSv4"
+]);
 /**
-* HDF Results -> Elastic Common Schema (ECS) NDJSON exporter.
-*
-* One ECS event per Evaluated_Requirement, in the hybrid shape from ADR-0002:
-* a core-ECS-native projection plus a lossless hdf.* block, hot filter scalars
-* promoted flat. Output is plain NDJSON (LF-delimited, trailing newline), ECS
-* 9.4.0.
-*
-* Status is raw-primary: event.outcome carries the RAW verdict (a waived failure
-* is still failure), and hdf.suppressed is the separate acceptance axis. The
-* canonical "still actionable" query is
-* event.outcome:"failure" AND hdf.suppressed:false.
-*
-* Generic JSON access, the status roll-up, requirement/document field
-* extraction, and the canonical line serialization are shared with the other
-* export converters via ../../../shared/typescript/exportmap.js; only
-* ECS-specific event shaping lives here. Output is held byte-identical with the
-* Go implementation via key-sorted, HTML-unescaped compact JSON.
+* Computes the maximum impact across all ratings for a vulnerability.
+* Prefers CVSS score/10 when available, falls back to severityToImpact().
 */
-const ECS_VERSION = "9.4.0";
-function convertHdfToEcs(input, converterVersion = "0.1.0") {
-	return runExport(input, "hdf-to-ecs", (req, baseline, docTimestamp, tool, generator, component) => buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion));
-}
-function buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
-	const st = statusOf(req);
-	const outcome = statusToOutcome(st.raw);
-	const controlID = getStr(req, "id");
-	const baselineName = getStr(baseline, "name");
-	const title = getStr(req, "title");
-	const cvssList = asArr(req.cvss);
-	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
+function maxImpact(ratings) {
+	if (ratings.length === 0) return .5;
+	let max = 0;
+	for (const rating of ratings) {
+		let impact;
+		if (rating.method && CVSS_METHODS.has(rating.method) && rating.score !== void 0 && rating.score !== null) impact = rating.score / 10;
+		else impact = severityToImpact$1(rating.severity ?? "medium");
+		if (impact > max) max = impact;
+	}
+	return max;
+}
+/**
+* Formats the ratings as a human-readable tag string.
+*/
+function formatRatingsTag(ratings) {
+	return ratings.map((r) => `${r.source?.name ?? "Unknown"} - ${r.severity ?? "unrated"}`).join(", ");
+}
+/**
+* Formats a component reference as a code_desc string.
+*/
+function formatCodeDesc$4(componentLookup, ref) {
+	const comp = componentLookup.get(ref);
+	if (!comp) return `Component ${ref} is vulnerable`;
+	let name = "";
+	if (comp.group) name += comp.group + "/";
+	name += comp.name;
+	if (comp.version) name += "@" + comp.version;
+	return `Component ${name} is vulnerable`;
+}
+/**
+* Flattens nested CycloneDX components into a single array.
+*/
+function flattenComponents(components) {
+	const result = [];
+	for (const comp of components) {
+		result.push(comp);
+		if (comp.components) result.push(...flattenComponents(comp.components));
+	}
+	return result;
+}
+/**
+* Reports whether any (possibly nested) component is a machine-learning-model,
+* i.e. the CycloneDX document is an AI-BOM.
+*/
+function hasMLModelComponent(components) {
+	return flattenComponents(components).some((comp) => comp.type === "machine-learning-model");
+}
+/**
+* Converts CycloneDX SBOM/VEX JSON to HDF format.
+*
+* @param input - CycloneDX JSON string
+* @returns HDF JSON string
+*/
+async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
+	if (!input || input.trim().length === 0) throw new Error("cyclonedx: empty input");
+	validateInputSize(input, "cyclonedx");
+	const bom = parseJSON(input);
+	if (!bom || typeof bom !== "object") throw new Error("cyclonedx: invalid JSON");
+	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx: missing or invalid bomFormat (expected "CycloneDX", got "${bom.bomFormat ?? "undefined"}")`);
+	if ((!bom.components || bom.components.length === 0) && (!bom.vulnerabilities || bom.vulnerabilities.length === 0)) throw new Error("cyclonedx: input has neither components nor vulnerabilities");
+	if (!bom.vulnerabilities || bom.vulnerabilities.length === 0) {
+		if (hasMLModelComponent(bom.components ?? [])) throw new Error("cyclonedx: this file is a CycloneDX AI-BOM (machine-learning-model inventory) with no vulnerabilities; to import it into a system document, use:\n  hdf system create <file> --from cyclonedx-mlbom");
+		throw new Error("cyclonedx: this file is an SBOM inventory with no vulnerabilities; to import SBOM data into a system document, use:\n  hdf system create <sbom-file> --component-name <name>");
+	}
+	const resultsChecksum = await inputChecksum(input);
+	const parsedTimestamp = bom.metadata?.timestamp ? parseTimestamp(bom.metadata.timestamp) ?? void 0 : void 0;
+	const scanTime = parsedTimestamp && !isNaN(parsedTimestamp.getTime()) ? parsedTimestamp : /* @__PURE__ */ new Date();
+	const allComponents = flattenComponents(bom.components ?? []);
+	const componentLookup = /* @__PURE__ */ new Map();
+	for (const comp of allComponents) if (comp["bom-ref"]) componentLookup.set(comp["bom-ref"], comp);
+	const requirements = [];
+	const { items: limitedVulns, truncated: truncatedVulns } = limitArray(bom.vulnerabilities ?? []);
+	/* v8 ignore next -- truncation only triggers with >100K items */
+	if (truncatedVulns) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${(bom.vulnerabilities ?? []).length})`);
+	for (const vuln of limitedVulns) {
+		const ratings = vuln.ratings ?? [];
+		const impact = maxImpact(ratings);
+		const cwes = vuln.cwes ?? [];
+		const nist = mapCWEToNIST(cwes.map((c) => `${c}`), DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
+		const tags = {
+			nist,
+			cci: nistToCci(nist)
+		};
+		if (cwes.length > 0) tags["cweid"] = cwes.map((c) => `CWE-${c}`);
+		if (ratings.length > 0) tags["ratings"] = formatRatingsTag(ratings);
+		const descriptions = [];
+		const defaultParts = [];
+		if (vuln.description) defaultParts.push(`Description: ${vuln.description}`);
+		if (vuln.detail) defaultParts.push(`Detail: ${vuln.detail}`);
+		if (defaultParts.length > 0) descriptions.push({
+			label: "default",
+			data: defaultParts.join("\n\n")
+		});
+		else descriptions.push({
+			label: "default",
+			data: vuln.id
+		});
+		const fixParts = [];
+		if (vuln.recommendation) fixParts.push(vuln.recommendation);
+		if (vuln.analysis?.detail) fixParts.push(`Workaround: ${vuln.analysis.detail}`);
+		if (fixParts.length > 0) descriptions.push({
+			label: "fix",
+			data: fixParts.join("\n\n")
+		});
+		const affects = vuln.affects ?? [];
+		const toResult = (codeDesc) => createResult(ResultStatus.Failed, void 0, {
+			codeDesc,
+			startTime: scanTime
+		});
+		const results = affects.length > 0 ? affects.map((affect) => toResult(formatCodeDesc$4(componentLookup, affect.ref))) : [toResult(`Vulnerability ${vuln.id}`)];
+		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
+		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
+		const controlType = deriveControlTypeFromTags(nist);
+		if (controlType !== void 0) req.controlType = controlType;
+		requirements.push(req);
+	}
+	const baseline = createMinimalBaseline("CycloneDX Scan", requirements, { resultsChecksum });
+	const targetComponent = {
+		name: bom.metadata?.component?.name ?? "",
+		type: TargetType.Application
+	};
+	if (bom.metadata?.component?.version) targetComponent.version = bom.metadata.component.version;
+	const parsedBom = parseBom(input);
+	const bomParts = {
+		bomType: BOMType.Sbom,
+		format: "cyclonedx",
+		uniqueId: parsedBom.normalized.uniqueId,
+		document: canonicalize$1(JSON.parse(input))
+	};
+	if (parsedBom.normalized.packages && parsedBom.normalized.packages.length > 0) bomParts.packages = parsedBom.normalized.packages;
+	const componentBom = buildBom(bomParts);
+	return buildHdfResults({
+		generatorName: "cyclonedx-to-hdf",
+		converterVersion,
+		toolName: "CycloneDX",
+		toolFormat: "JSON",
+		baselines: [baseline],
+		components: [{
+			...targetComponent,
+			boms: [componentBom]
+		}],
+		timestamp: scanTime
+	});
+}
+//#endregion
+//#region converters/hdf-to-csv/typescript/converter.ts
+/**
+* Convert HDF JSON to CSV format
+* @param input HDF JSON string
+* @returns CSV string with sanitized output
+*/
+function convertHdfToCsv(input) {
+	validateInputSize(input, "hdf-to-csv");
+	const hdf = parseHdf(input);
+	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
+	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
+	const rows = [];
+	const components = hdf.components || [];
+	const targetList = components.length > 0 ? components.map((t) => ({
+		name: t.name,
+		type: t.type
+	})) : [{
+		name: "",
+		type: ""
+	}];
+	for (const baseline of hdf.baselines) for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
+	return buildCsv(rows, { sanitize: true });
+}
+/**
+* Create a CSV row from baseline, requirement, and target data
+*/
+function createRow(baseline, requirement, target) {
+	const description = requirement.descriptions.find((d) => d.label === "default")?.data || "";
+	const check = descriptionByLabel(requirement, "check");
+	const fix = descriptionByLabel(requirement, "fix");
+	const rationale = descriptionByLabel(requirement, "rationale");
+	const code = requirement.code ?? "";
+	const references = flattenRefs(requirement.refs);
+	const severity = getSeverity(requirement);
+	const firstResult = requirement.results[0];
+	const status = firstResult?.status || "";
+	const message = firstResult?.message || "";
+	const nistControls = extractArrayFromTags(requirement.tags, "nist");
+	const cciControls = extractArrayFromTags(requirement.tags, "cci");
+	return {
+		"Baseline ID": baseline.name,
+		"Baseline Version": baseline.version || "",
+		"Baseline Title": baseline.title || "",
+		"Target ID": target.name,
+		"Target Type": target.type,
+		"Requirement ID": requirement.id,
+		"Requirement Title": requirement.title || "",
+		"Description": description,
+		"Check": check,
+		"Fix": fix,
+		"Rationale": rationale,
+		"Code": code,
+		"References": references,
+		"Severity": severity,
+		"Impact": requirement.impact,
+		"Status": String(status),
+		"NIST Controls": nistControls,
+		"CCI Controls": cciControls,
+		"Control Type": requirement.controlType ?? "",
+		"Verification Method": requirement.verificationMethod ?? "",
+		"Applicability": requirement.applicability ?? "",
+		"Result Message": message
+	};
+}
+/**
+* Get severity from requirement tags or derive from impact
+*/
+function getSeverity(requirement) {
+	if (requirement.tags && typeof requirement.tags === "object") {
+		if ("severity" in requirement.tags) {
+			const sev = requirement.tags.severity;
+			if (typeof sev === "string") return sev;
+			if (Array.isArray(sev) && sev.length > 0) return String(sev[0]);
+		}
+	}
+	const impact = requirement.impact;
+	if (impact >= .7) return "high";
+	if (impact >= .4) return "medium";
+	return "low";
+}
+/**
+* Extract array values from tags object and join with semicolons
+*/
+function extractArrayFromTags(tags, key) {
+	if (!tags || typeof tags !== "object") return "";
+	const value = tags[key];
+	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
+	return "";
+}
+/**
+* Get the data of the first description matching a label. Empty when absent.
+*/
+function descriptionByLabel(requirement, label) {
+	return requirement.descriptions.find((d) => d.label === label)?.data || "";
+}
+/**
+* Flatten a requirement's refs to one string: each Reference rendered as its
+* url/uri (or a string `ref`); array-form refs are skipped. Joined with '; ' to
+* match the NIST/CCI column convention.
+*/
+function flattenRefs(refs) {
+	if (!Array.isArray(refs)) return "";
+	const out = [];
+	for (const r of refs) {
+		if (!r || typeof r !== "object") continue;
+		const o = r;
+		if (typeof o.url === "string") out.push(o.url);
+		else if (typeof o.uri === "string") out.push(o.uri);
+		else if (typeof o.ref === "string") out.push(o.ref);
+	}
+	return out.join("; ");
+}
+//#endregion
+//#region converters/hdf-to-ecs/typescript/converter.ts
+/**
+* HDF Results -> Elastic Common Schema (ECS) NDJSON exporter.
+*
+* One ECS event per Evaluated_Requirement, in the hybrid shape from ADR-0002:
+* a core-ECS-native projection plus a lossless hdf.* block, hot filter scalars
+* promoted flat. Output is plain NDJSON (LF-delimited, trailing newline), ECS
+* 9.4.0.
+*
+* Status is raw-primary: event.outcome carries the RAW verdict (a waived failure
+* is still failure), and hdf.suppressed is the separate acceptance axis. The
+* canonical "still actionable" query is
+* event.outcome:"failure" AND hdf.suppressed:false.
+*
+* Generic JSON access, the status roll-up, requirement/document field
+* extraction, and the canonical line serialization are shared with the other
+* export converters via ../../../shared/typescript/exportmap.js; only
+* ECS-specific event shaping lives here. Output is held byte-identical with the
+* Go implementation via key-sorted, HTML-unescaped compact JSON.
+*/
+const ECS_VERSION = "9.4.0";
+function convertHdfToEcs(input, converterVersion = "0.1.0") {
+	return runExport(input, "hdf-to-ecs", (req, baseline, docTimestamp, tool, generator, component) => buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion));
+}
+function buildEvent(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
+	const st = statusOf(req);
+	const outcome = statusToOutcome(st.raw);
+	const controlID = getStr(req, "id");
+	const baselineName = getStr(baseline, "name");
+	const title = getStr(req, "title");
+	const cvssList = asArr(req.cvss);
+	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
 	const categories = ["configuration"];
 	if (hasCVSS) categories.push("vulnerability");
 	const event = {
@@ -5383,7 +5781,7 @@ function buildHECEvent(req, baseline, docTimestamp, tool, generator, component,
 	const controlID = getStr(req, "id");
 	const signature = title !== "" ? title : controlID;
 	const dest = destHost(component);
-	const sev = severity(req);
+	const sev = severity$1(req);
 	const [cvss, hasCVSS] = maxCVSS(req);
 	const cve = firstCVE(asArr(req.cvss) ?? []);
 	const category = firstCWE(req);
@@ -5426,7 +5824,7 @@ function destHost(component) {
 	if (!component) return "";
 	return getStr(component, "fqdn") || getStr(component, "name") || getStr(component, "ipAddress");
 }
-function severity(req) {
+function severity$1(req) {
 	if (typeof req.impact === "number") return impactToSeverity(req.impact);
 	return normalizeSeverity(getStr(req, "severity"));
 }
@@ -5487,9 +5885,9 @@ const ACTIVITY_CREATE = 1;
 const STATUS_NEW = 1;
 const STATUS_SUPPRESSED = 3;
 function convertHdfToOcsf(input, converterVersion = "0.1.0") {
-	return runExport(input, "hdf-to-ocsf", (req, baseline, docTimestamp, tool, generator, component) => buildFinding(req, baseline, docTimestamp, tool, generator, component, converterVersion));
+	return runExport(input, "hdf-to-ocsf", (req, baseline, docTimestamp, tool, generator, component) => buildFinding$1(req, baseline, docTimestamp, tool, generator, component, converterVersion));
 }
-function buildFinding(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
+function buildFinding$1(req, baseline, docTimestamp, tool, generator, component, converterVersion) {
 	const st = statusOf(req);
 	const cvssList = asArr(req.cvss);
 	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
@@ -5697,6 +6095,174 @@ function buildVulnerabilities(cvssList, req) {
 	return [vuln];
 }
 //#endregion
+//#region converters/hdf-to-asff/typescript/converter.ts
+/**
+* HDF Results -> AWS Security Finding Format (ASFF), the reverse of
+* asff-to-hdf. Output is the standard {"Findings": [...]} envelope that
+* BatchImportFindings accepts and asff-to-hdf reads back.
+*
+* One finding per requirement (matching hdf-to-ocsf): a requirement's results
+* roll up to one Compliance.Status via the shared statusOf. The mapping is
+* deliberately LOSSY and standard-compliant — HDF structure ASFF cannot hold is
+* dropped, NOT crammed into Types[] (heimdall2's rejected Types-string
+* encoding). Provenance rides ProductFields (ASFF's official string map).
+*
+* ProductArn / AwsAccountId / Region are ASFF-required but absent from HDF: the
+* account is recovered from a cloudAccount component when present, otherwise a
+* placeholder is emitted; the push path overrides all three. Output is held
+* byte-identical with the Go implementation via canonicalize + stringifyLine.
+*/
+const ASFF_SCHEMA_VERSION = "2018-10-08";
+const PLACEHOLDER_REGION = "us-east-1";
+const PLACEHOLDER_ACCOUNT_ID = "000000000000";
+const DEFAULT_PARTITION = "aws";
+const MAX_TITLE = 256;
+const MAX_DESCRIPTION = 1024;
+const EPOCH_SENTINEL = "1970-01-01T00:00:00Z";
+function convertHdfToAsff(input, converterVersion = "0.1.0") {
+	const name = "hdf-to-asff";
+	validateInputSize(input, name);
+	const doc = parseHdf(input);
+	const baselines = asArr(doc.baselines);
+	if (!baselines) throw new Error(`${name}: invalid HDF structure: missing baselines field`);
+	const docTimestamp = getStr(doc, "timestamp");
+	const component = firstComponent(doc);
+	const accountID = recoverAccountID(doc);
+	const productArn = `arn:aws:securityhub:${PLACEHOLDER_REGION}:${accountID}:product/${accountID}/default`;
+	const findings = [];
+	for (const bRaw of baselines) {
+		const baseline = asMap(bRaw);
+		if (!baseline) continue;
+		const baselineName = getStr(baseline, "name");
+		const reqs = asArr(baseline.requirements) ?? [];
+		for (const rRaw of reqs) {
+			const req = asMap(rRaw);
+			if (!req) continue;
+			findings.push(buildFinding(req, baselineName, docTimestamp, component, accountID, productArn, converterVersion));
+		}
+	}
+	return stringifyLine(canonicalize$1({ Findings: findings })) + "\n";
+}
+function recoverAccountID(doc) {
+	for (const cRaw of asArr(doc.components) ?? []) {
+		const c = asMap(cRaw);
+		if (!c || getStr(c, "type") !== "cloudAccount") continue;
+		const id = getStr(c, "accountId") || getStr(c, "name");
+		if (id) return id;
+	}
+	return PLACEHOLDER_ACCOUNT_ID;
+}
+function buildFinding(req, baselineName, docTimestamp, component, accountID, productArn, converterVersion) {
+	const controlID = getStr(req, "id");
+	const st = statusOf(req);
+	const title = getStr(req, "title") || controlID;
+	const desc = defaultDescription(req) || title;
+	const cvssList = asArr(req.cvss);
+	const hasCVSS = cvssList !== void 0 && cvssList.length > 0;
+	const ts = canonicalTime(firstResultStartTime(req, docTimestamp));
+	const id = findingID(accountID, baselineName, controlID);
+	const finding = {
+		SchemaVersion: ASFF_SCHEMA_VERSION,
+		Id: id,
+		ProductArn: productArn,
+		GeneratorId: controlID,
+		AwsAccountId: accountID,
+		CreatedAt: ts,
+		UpdatedAt: ts,
+		Title: truncate(title, MAX_TITLE),
+		Description: truncate(desc, MAX_DESCRIPTION),
+		Types: asffTypes(hasCVSS),
+		Severity: severity(req),
+		Resources: resources(component, id),
+		RecordState: "ACTIVE",
+		Compliance: { Status: complianceStatus(st.rollup) }
+	};
+	if (st.suppressed) finding.Workflow = { Status: "SUPPRESSED" };
+	const pf = productFields(baselineName, controlID, converterVersion);
+	if (Object.keys(pf).length > 0) finding.ProductFields = pf;
+	const rem = remediation(req);
+	if (rem) finding.Remediation = rem;
+	return finding;
+}
+function findingID(accountID, baselineName, controlID) {
+	return [
+		accountID,
+		PLACEHOLDER_REGION,
+		baselineName,
+		controlID
+	].join("/");
+}
+function asffTypes(hasCVSS) {
+	return hasCVSS ? ["Software and Configuration Checks/Vulnerabilities/CVE"] : ["Software and Configuration Checks"];
+}
+function complianceStatus(status) {
+	switch (status) {
+		case "passed": return "PASSED";
+		case "failed": return "FAILED";
+		case "notApplicable": return "NOT_AVAILABLE";
+		default: return "WARNING";
+	}
+}
+function severity(req) {
+	let label = "INFORMATIONAL";
+	let normalized = 0;
+	if (typeof req.impact === "number") {
+		label = impactToSeverity(req.impact).toUpperCase();
+		normalized = Math.trunc(req.impact * 100);
+	}
+	return {
+		Label: label,
+		Normalized: normalized
+	};
+}
+function resources(component, id) {
+	const res = {
+		Type: "Other",
+		Id: id,
+		Partition: DEFAULT_PARTITION,
+		Region: PLACEHOLDER_REGION
+	};
+	if (component) {
+		const details = {};
+		setIf(details, "Name", getStr(component, "name"));
+		setIf(details, "Type", getStr(component, "type"));
+		setIf(details, "IpAddress", getStr(component, "ipAddress"));
+		setIf(details, "OsName", getStr(component, "osName"));
+		if (Object.keys(details).length > 0) res.Details = { Other: details };
+	}
+	return [res];
+}
+function productFields(baselineName, controlID, converterVersion) {
+	const pf = {};
+	setIf(pf, "hdf/baseline", baselineName);
+	setIf(pf, "hdf/control_id", controlID);
+	setIf(pf, "hdf/exporter_version", converterVersion);
+	return pf;
+}
+function remediation(req) {
+	let fix = "";
+	for (const dRaw of asArr(req.descriptions) ?? []) {
+		const d = asMap(dRaw);
+		if (d && getStr(d, "label") === "fix") {
+			fix = getStr(d, "data");
+			break;
+		}
+	}
+	const url = firstRefURL(req);
+	if (fix === "" && url === "") return void 0;
+	const rec = {};
+	setIf(rec, "Text", truncate(fix, MAX_DESCRIPTION));
+	setIf(rec, "Url", url);
+	return { Recommendation: rec };
+}
+function canonicalTime(s) {
+	return parseTimestamp(s) ? s : EPOCH_SENTINEL;
+}
+function truncate(s, max) {
+	const r = [...s];
+	return r.length <= max ? s : r.slice(0, max).join("");
+}
+//#endregion
 //#region converters/splunk-to-hdf/typescript/converter.ts
 /**
 * Map a Splunk result status string to the HDF ResultStatus enum.
@@ -6282,9 +6848,8 @@ function buildRequirement$12(reqID, findings) {
 * @returns HDF JSON string
 */
 async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
-	if (!input || input.trim().length === 0) throw new Error("trufflehog: empty input");
 	validateInputSize(input, "trufflehog");
-	const findings = parseFindings(input);
+	const findings = !input || input.trim().length === 0 ? [] : parseFindings(input);
 	const resultsChecksum = await inputChecksum(input);
 	const limitedFindings = limitArrayWithWarning(findings, "finding");
 	const groups = groupFindings(limitedFindings);
@@ -6562,11 +7127,10 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 		data: formatDesc$1(rep)
 	}];
 	const results = findings.map((f) => {
-		return {
-			status: hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed,
+		return createResult(hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed, void 0, {
 			codeDesc: f["Details"] ?? "",
 			startTime: parseDate(f["Date"] ?? "")
-		};
+		});
 	});
 	const req = createRequirement(checkID, rep["Check"] ?? "", descriptions, getImpact$6(rep["Risk DV"] ?? ""), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -6832,11 +7396,10 @@ function buildRequirement$9(vuln, packageTypes, distro) {
 		data: vuln.description
 	}];
 	const startTime = (vuln.discoveredDate ? parseTimestamp(vuln.discoveredDate) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
-	const results = [{
-		status: ResultStatus.Failed,
+	const results = [createResult(ResultStatus.Failed, void 0, {
 		codeDesc: formatCodeDesc$2(vuln),
 		startTime
-	}];
+	})];
 	const req = createRequirement(vuln.id, vuln.id, descriptions, twistlockSeverityToImpact(vuln.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -6963,11 +7526,10 @@ function buildRequirement$8(finding, timestamp) {
 		data: finding.vulnerability.recommendation
 	});
 	const codeDesc = finding.vulnerability.recommendation ?? "No recommendation available";
-	const results = [{
-		status: ResultStatus.Failed,
+	const results = [createResult(ResultStatus.Failed, void 0, {
 		codeDesc,
 		startTime: (timestamp ? parseTimestamp(timestamp) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
-	}];
+	})];
 	const req = createRequirement(finding.matrix, getTitle$1(finding), descriptions, getImpact$5(finding.vulnerability.severity), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags(nist);
@@ -8098,8 +8660,7 @@ function buildRequirementFromResult(result, filename) {
 	const startTime = (startTimeStr ? parseTimestamp(startTimeStr) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const score = result.result.score;
 	const status = determineStatus(score);
-	const toResult = (codeDesc) => ({
-		status,
+	const toResult = (codeDesc) => createResult(status, void 0, {
 		codeDesc,
 		startTime
 	});
@@ -8344,8 +8905,7 @@ function buildCWERequirement(cat, impact, firstBuildDate) {
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
 	const results = cwes.flatMap((c) => {
 		const staticflaws = c.staticflaws;
-		return ensureArray(staticflaws?.flaw).map((flaw) => ({
-			status: ResultStatus.Failed,
+		return ensureArray(staticflaws?.flaw).map((flaw) => createResult(ResultStatus.Failed, void 0, {
 			codeDesc: formatFlawCodeDesc(flaw),
 			startTime
 		}));
@@ -8407,8 +8967,7 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	if (cweID) extras.cwe = cweID;
 	const tags = buildNistCciTags(nist, cciTags, extras);
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
-	const results = components.map((comp) => ({
-		status: ResultStatus.Failed,
+	const results = components.map((comp) => createResult(ResultStatus.Failed, void 0, {
 		codeDesc: formatSCACodeDesc(comp),
 		startTime
 	}));
@@ -9720,23 +10279,31 @@ function overrideToPOAMItem(override) {
 	const remediations = [];
 	if (override.milestones) for (const ms of override.milestones) {
 		const msProps = [];
-		if (ms.estimatedCompletion) {
-			const d = toDate(ms.estimatedCompletion);
-			if (d) msProps.push({
-				name: "estimated-completion",
-				value: formatTimestampSeconds(d)
-			});
-		}
 		if (ms.status) msProps.push({
 			name: "milestone-status",
 			value: String(ms.status)
 		});
+		let tasks;
+		const d = ms.estimatedCompletion ? toDate(ms.estimatedCompletion) : void 0;
+		if (d) {
+			const eta = formatTimestampSeconds(d);
+			tasks = [{
+				uuid: crypto.randomUUID(),
+				type: "milestone",
+				title: ms.description,
+				timing: { "within-date-range": {
+					start: eta,
+					end: eta
+				} }
+			}];
+		}
 		remediations.push({
 			uuid: crypto.randomUUID(),
 			lifecycle: "planned",
 			title: ms.description,
 			description: ms.description,
-			props: msProps.length > 0 ? msProps : void 0
+			props: msProps.length > 0 ? msProps : void 0,
+			tasks
 		});
 	}
 	let riskLog;
@@ -9748,12 +10315,14 @@ function overrideToPOAMItem(override) {
 		start: formatTimestampSeconds(expiresDate),
 		"status-change": riskStatus
 	}] };
+	const deadline = expiresDate && expiresDate.getTime() > 0 ? formatTimestampSeconds(expiresDate) : void 0;
 	const risk = {
 		uuid: riskUUID,
 		title: override.requirementId,
 		description: override.reason,
 		statement: override.reason,
 		status: riskStatus,
+		deadline,
 		props: riskProps,
 		remediations: remediations.length > 0 ? remediations : void 0,
 		"risk-log": riskLog
@@ -10152,7 +10721,7 @@ function supplierEvidence(sourceURI, description) {
 *  arrives; one year is a defensive default consistent with the
 *  no-permanent-amendment rule on Standalone_Override. */
 const DEFAULT_EXPIRY_HORIZON_MS$2 = 365 * 24 * 60 * 60 * 1e3;
-async function convertOpenVexToHdf(input, converterVersion) {
+async function convertOpenVexToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "openvex-to-hdf");
 	const doc = parseJSON(input);
 	const docTime = (doc.timestamp ? parseTimestamp(doc.timestamp) : null) ?? /* @__PURE__ */ new Date();
@@ -10244,7 +10813,7 @@ function truncateId(id) {
 * Spec: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html
 */
 const DEFAULT_EXPIRY_HORIZON_MS$1 = 365 * 24 * 60 * 60 * 1e3;
-async function convertCsafVexToHdf(input, converterVersion) {
+async function convertCsafVexToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "csaf-vex-to-hdf");
 	const doc = parseJSON(input);
 	if (doc.document?.category !== "csaf_vex") throw new Error(`csaf-vex-to-hdf: document.category is ${JSON.stringify(doc.document?.category)}; only 'csaf_vex' is supported`);
@@ -10457,7 +11026,7 @@ function overlap(ids, scope) {
 * Spec: https://cyclonedx.org/use-cases/#vulnerability-exploitability
 */
 const DEFAULT_EXPIRY_HORIZON_MS = 365 * 24 * 60 * 60 * 1e3;
-async function convertCyclonedxVexToHdf(input, converterVersion) {
+async function convertCyclonedxVexToHdf(input, converterVersion = "1.0.0") {
 	validateInputSize(input, "cyclonedx-vex-to-hdf");
 	const bom = parseJSON(input);
 	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx-vex-to-hdf: bomFormat is ${JSON.stringify(bom.bomFormat)}; only 'CycloneDX' is supported`);
@@ -11217,245 +11786,91 @@ async function catalogToBaseline(catalog, rawInput) {
 		for (const ctrl of group.controls ?? []) {
 			const req = controlToBaselineRequirement(ctrl);
 			requirements.push(req);
-			reqIDs.push(req.id);
-			for (const enh of ctrl.controls ?? []) {
-				const enhReq = controlToBaselineRequirement(enh);
-				requirements.push(enhReq);
-				reqIDs.push(enhReq.id);
-			}
-		}
-		if (reqIDs.length > 0) groups.push({
-			id: group.id ?? "",
-			title: group.title,
-			requirements: reqIDs
-		});
-	}
-	for (const ctrl of catalog.controls ?? []) {
-		const req = controlToBaselineRequirement(ctrl);
-		requirements.push(req);
-		for (const enh of ctrl.controls ?? []) {
-			const enhReq = controlToBaselineRequirement(enh);
-			requirements.push(enhReq);
-		}
-	}
-	return {
-		name: catalogBaselineName(catalog),
-		title: meta.title,
-		version: meta.version,
-		status: "loaded",
-		integrity,
-		requirements,
-		groups,
-		generator: {
-			name: "oscal-catalog-to-hdf",
-			version: "1.0.0"
-		}
-	};
-}
-/** Converts a single OSCAL Control to an HDF BaselineRequirement. */
-function controlToBaselineRequirement(ctrl) {
-	const nistTag = controlIdToNistTag(ctrl.id);
-	const descriptions = buildCatalogDescriptions(ctrl);
-	const tags = buildCatalogTags(ctrl);
-	const req = {
-		id: nistTag,
-		title: ctrl.title,
-		impact: .5,
-		descriptions,
-		tags
-	};
-	const controlType = deriveControlTypeFromTags([nistTag]);
-	if (controlType !== void 0) req.controlType = controlType;
-	if (extractPropValue(ctrl.props, "CORE") === "true") req.applicability = Applicability.Required;
-	return req;
-}
-/** Creates HDF Description entries from control parts. */
-function buildCatalogDescriptions(ctrl) {
-	const descriptions = [];
-	const statement = flattenPartsByName(ctrl.parts, "statement");
-	descriptions.push({
-		label: "default",
-		data: statement || ""
-	});
-	const guidance = flattenPartsByName(ctrl.parts, "guidance");
-	if (guidance) descriptions.push({
-		label: "rationale",
-		data: guidance
-	});
-	const check = flattenPartsByName(ctrl.parts, "assessment-objective");
-	if (check) descriptions.push({
-		label: "check",
-		data: check
-	});
-	return descriptions;
-}
-/** Builds the tags map for an OSCAL catalog control. */
-function buildCatalogTags(ctrl) {
-	const tags = {};
-	tags["nist"] = [controlIdToNistTag(ctrl.id)];
-	const label = extractPropValue(ctrl.props, "label");
-	if (label !== void 0) tags["label"] = label;
-	const sortId = extractPropValue(ctrl.props, "sort-id");
-	if (sortId !== void 0) tags["sort-id"] = sortId;
-	return tags;
-}
-/** Derives a baseline name from catalog metadata. */
-function catalogBaselineName(catalog) {
-	return toKebabCase(catalog.metadata.title, "oscal-catalog");
-}
-//#endregion
-//#region converters/oscal-to-hdf/typescript/converter-profile.ts
-/**
-* OSCAL Profile to HDF Baseline converter.
-*
-* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_profile.go.
-*
-* This implements the "simple resolver" -- it handles:
-* - A single catalog import
-* - include-controls with with-ids filtering
-* - set-parameters from modify section
-* - merge as-is (preserve catalog structure)
-*
-* It does NOT handle:
-* - Multiple imports
-* - Nested profile imports
-* - alter directives
-* - Complex merge strategies
-*/
-/**
-* Converts an OSCAL Profile against a provided catalog to HDF Baseline JSON.
-*
-* @param profileInput - Raw JSON string containing an OSCAL profile
-* @param catalogInput - Raw JSON string containing an OSCAL catalog
-* @returns HDF Baseline JSON string
-*/
-async function convertOscalProfileToHdf(profileInput, catalogInput) {
-	validateInputSize(profileInput, "oscal-profile");
-	if (!profileInput || profileInput.trim().length === 0) throw new Error("empty profile input");
-	if (!catalogInput || catalogInput.trim().length === 0) throw new Error("empty catalog input");
-	const profileDoc = parseJSON(profileInput);
-	if (!profileDoc.profile) throw new Error("oscal-profile: input is not a profile document (root key is not 'profile')");
-	const profile = profileDoc.profile;
-	const catalogDoc = parseJSON(catalogInput);
-	if (!catalogDoc.catalog) throw new Error("oscal-profile: catalog input is not a catalog document (root key is not 'catalog')");
-	const catalog = catalogDoc.catalog;
-	if (!profile.imports || profile.imports.length === 0) throw new Error("oscal-profile: profile has no imports");
-	if (profile.imports.length > 1) throw new Error(`oscal-profile: profile has ${profile.imports.length} imports -- this converter only supports single-catalog imports. Use NIST's oscal-cli to resolve complex profiles, or use a pre-resolved catalog`);
-	if (profile.modify?.alters && profile.modify.alters.length > 0) throw new Error(`oscal-profile: profile contains ${profile.modify.alters.length} alter directives -- this converter only supports parameter overrides. Use NIST's oscal-cli to resolve profiles with alter directives, or use a pre-resolved catalog`);
-	const imp = profile.imports[0];
-	const resolvedCatalog = filterCatalog(catalog, collectIncludedIDs(imp), collectExcludedIDs(imp));
-	if (profile.modify?.["set-parameters"]) applyParameterOverrides(resolvedCatalog, profile.modify["set-parameters"]);
-	resolvedCatalog.metadata = profile.metadata;
-	resolvedCatalog.uuid = profile.uuid;
-	const baseline = await catalogToBaseline(resolvedCatalog, profileInput);
-	baseline.integrity = await inputIntegrity(profileInput);
-	return JSON.stringify(baseline, null, 2);
-}
-/** Extracts all control IDs from an import's include-controls. Returns null if include all. */
-function collectIncludedIDs(imp) {
-	const includeControls = imp["include-controls"];
-	if (!includeControls || includeControls.length === 0) return null;
-	const ids = /* @__PURE__ */ new Set();
-	for (const ic of includeControls) for (const id of ic["with-ids"] ?? []) ids.add(id);
-	return ids;
-}
-/** Extracts all control IDs from an import's exclude-controls. */
-function collectExcludedIDs(imp) {
-	const excludeControls = imp["exclude-controls"];
-	if (!excludeControls || excludeControls.length === 0) return null;
-	const ids = /* @__PURE__ */ new Set();
-	for (const ec of excludeControls) for (const id of ec["with-ids"] ?? []) ids.add(id);
-	return ids;
-}
-/** Creates a new catalog containing only the controls matching filters. */
-function filterCatalog(catalog, includedIDs, excludedIDs) {
-	const includeAll = includedIDs === null;
-	const result = {
-		uuid: catalog.uuid,
-		metadata: catalog.metadata,
-		"back-matter": catalog["back-matter"],
-		groups: [],
-		controls: []
-	};
-	for (const group of catalog.groups ?? []) {
-		const filtered = filterGroupControls(group, includedIDs, excludedIDs, includeAll);
-		if (filtered.controls && filtered.controls.length > 0) result.groups.push(filtered);
+			reqIDs.push(req.id);
+			for (const enh of ctrl.controls ?? []) {
+				const enhReq = controlToBaselineRequirement(enh);
+				requirements.push(enhReq);
+				reqIDs.push(enhReq.id);
+			}
+		}
+		if (reqIDs.length > 0) groups.push({
+			id: group.id ?? "",
+			title: group.title,
+			requirements: reqIDs
+		});
 	}
-	for (const ctrl of catalog.controls ?? []) if (shouldIncludeControl(ctrl.id, includedIDs, excludedIDs, includeAll)) {
-		const filteredCtrl = filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll);
-		result.controls.push(filteredCtrl);
+	for (const ctrl of catalog.controls ?? []) {
+		const req = controlToBaselineRequirement(ctrl);
+		requirements.push(req);
+		for (const enh of ctrl.controls ?? []) {
+			const enhReq = controlToBaselineRequirement(enh);
+			requirements.push(enhReq);
+		}
 	}
-	return result;
-}
-function filterGroupControls(group, includedIDs, excludedIDs, includeAll) {
-	const filtered = {
-		id: group.id,
-		class: group.class,
-		title: group.title,
-		props: group.props,
-		parts: group.parts,
-		controls: []
+	return {
+		name: catalogBaselineName(catalog),
+		title: meta.title,
+		version: meta.version,
+		status: "loaded",
+		integrity,
+		requirements,
+		groups,
+		generator: {
+			name: "oscal-catalog-to-hdf",
+			version: "1.0.0"
+		}
 	};
-	for (const ctrl of group.controls ?? []) if (shouldIncludeControl(ctrl.id, includedIDs, excludedIDs, includeAll)) {
-		const filteredCtrl = filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll);
-		filtered.controls.push(filteredCtrl);
-	}
-	return filtered;
 }
-function filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll) {
-	const result = {
-		id: ctrl.id,
-		class: ctrl.class,
+/** Converts a single OSCAL Control to an HDF BaselineRequirement. */
+function controlToBaselineRequirement(ctrl) {
+	const nistTag = controlIdToNistTag(ctrl.id);
+	const descriptions = buildCatalogDescriptions(ctrl);
+	const tags = buildCatalogTags(ctrl);
+	const req = {
+		id: nistTag,
 		title: ctrl.title,
-		params: ctrl.params,
-		props: ctrl.props,
-		links: ctrl.links,
-		parts: ctrl.parts,
-		controls: []
+		impact: .5,
+		descriptions,
+		tags
 	};
-	for (const enh of ctrl.controls ?? []) if (shouldIncludeControl(enh.id, includedIDs, excludedIDs, includeAll)) result.controls.push(enh);
-	return result;
-}
-function shouldIncludeControl(id, includedIDs, excludedIDs, includeAll) {
-	if (excludedIDs !== null && excludedIDs.has(id)) return false;
-	if (includeAll) return true;
-	return includedIDs !== null && includedIDs.has(id);
-}
-/** Applies set-parameters from the profile's modify section to the resolved catalog. */
-function applyParameterOverrides(catalog, setParams) {
-	if (setParams.length === 0) return;
-	const overrides = /* @__PURE__ */ new Map();
-	for (const sp of setParams) if (sp["param-id"]) overrides.set(sp["param-id"], sp.values ?? []);
-	for (const group of catalog.groups ?? []) for (const ctrl of group.controls ?? []) {
-		applyParamOverridesToControl(ctrl, overrides);
-		for (const enh of ctrl.controls ?? []) applyParamOverridesToControl(enh, overrides);
-	}
-	for (const ctrl of catalog.controls ?? []) {
-		applyParamOverridesToControl(ctrl, overrides);
-		for (const enh of ctrl.controls ?? []) applyParamOverridesToControl(enh, overrides);
-	}
+	const controlType = deriveControlTypeFromTags([nistTag]);
+	if (controlType !== void 0) req.controlType = controlType;
+	if (extractPropValue(ctrl.props, "CORE") === "true") req.applicability = Applicability.Required;
+	return req;
 }
-function applyParamOverridesToControl(ctrl, overrides) {
-	if (ctrl.params) for (const param of ctrl.params) {
-		if (!param.id) continue;
-		const values = overrides.get(param.id);
-		if (values) param.label = values.join(", ");
-	}
-	if (ctrl.parts) for (const part of ctrl.parts) replaceParamInsertions(part, overrides);
+/** Creates HDF Description entries from control parts. */
+function buildCatalogDescriptions(ctrl) {
+	const descriptions = [];
+	const statement = flattenPartsByName(ctrl.parts, "statement");
+	descriptions.push({
+		label: "default",
+		data: statement || ""
+	});
+	const guidance = flattenPartsByName(ctrl.parts, "guidance");
+	if (guidance) descriptions.push({
+		label: "rationale",
+		data: guidance
+	});
+	const check = flattenPartsByName(ctrl.parts, "assessment-objective");
+	if (check) descriptions.push({
+		label: "check",
+		data: check
+	});
+	return descriptions;
 }
-function replaceParamInsertions(part, overrides) {
-	if (part.prose) part.prose = substituteParams(part.prose, overrides);
-	if (part.parts) for (const child of part.parts) replaceParamInsertions(child, overrides);
+/** Builds the tags map for an OSCAL catalog control. */
+function buildCatalogTags(ctrl) {
+	const tags = {};
+	tags["nist"] = [controlIdToNistTag(ctrl.id)];
+	const label = extractPropValue(ctrl.props, "label");
+	if (label !== void 0) tags["label"] = label;
+	const sortId = extractPropValue(ctrl.props, "sort-id");
+	if (sortId !== void 0) tags["sort-id"] = sortId;
+	return tags;
 }
-/** Replaces OSCAL parameter insertion patterns: {{ insert: param, <param-id> }} */
-function substituteParams(text, overrides) {
-	let result = text;
-	for (const [paramId, values] of overrides) {
-		const placeholder = `{{ insert: param, ${paramId} }}`;
-		const replacement = values.join(", ");
-		result = result.split(placeholder).join(replacement);
-	}
-	return result;
+/** Derives a baseline name from catalog metadata. */
+function catalogBaselineName(catalog) {
+	return toKebabCase(catalog.metadata.title, "oscal-catalog");
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/converter-component.ts
@@ -11527,164 +11942,160 @@ function componentBaselineName(comp, compDef) {
 	return toKebabCase(comp.title || compDef.metadata.title, "oscal-component-definition");
 }
 //#endregion
-//#region converters/oscal-to-hdf/typescript/converter-ssp.ts
+//#region converters/oscal-to-hdf/typescript/converter-poam.ts
 /**
-* OSCAL System Security Plan (SSP) to HDF System converter.
+* OSCAL Plan of Action and Milestones (POA&M) to HDF Amendments converter.
 *
-* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_ssp.go.
+* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_poam.go.
 */
 /**
-* Converts an OSCAL System Security Plan document to HDF System JSON.
+* Converts an OSCAL POA&M document to HDF Amendments JSON.
 *
-* @param input - Raw JSON string containing an OSCAL SSP
-* @returns HDF System JSON string
+* @param input - Raw JSON string containing an OSCAL POA&M
+* @returns HDF Amendments JSON string
 */
-async function convertOscalSspToHdf(input) {
-	validateInputSize(input, "oscal-ssp");
+async function convertOscalPoamToHdf(input) {
+	validateInputSize(input, "oscal-poam");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
-	if (!doc["system-security-plan"]) throw new Error("oscal-ssp: input is not a system-security-plan document (root key is not 'system-security-plan')");
-	const ssp = doc["system-security-plan"];
+	if (!doc["plan-of-action-and-milestones"]) throw new Error("oscal-poam: input is not a plan-of-action-and-milestones document (root key is not 'plan-of-action-and-milestones')");
+	const poam = doc["plan-of-action-and-milestones"];
 	const integrity = await inputIntegrity(input);
-	const system = {
-		name: sspSystemName(ssp),
+	const meta = extractMetadata(poam.metadata);
+	const riskMap = buildRiskMap$1(poam.risks ?? []);
+	const overrides = [];
+	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
+	const systemRef = poam["import-ssp"]?.href || void 0;
+	const appliedBy = extractAppliedBy(poam.metadata);
+	return serializeHdf({
+		name: toKebabCase(poam.metadata.title, "oscal-poam"),
+		overrides,
 		integrity,
-		components: [],
+		systemRef,
+		version: meta.version,
+		appliedBy,
 		generator: {
-			name: "oscal-ssp-to-hdf",
+			name: "oscal-poam-to-hdf",
 			version: "1.0.0"
 		}
-	};
-	const sc = ssp["system-characteristics"];
-	if (sc) {
-		if (sc.description) {
-			let desc = sc.description;
-			if (sc["authorization-boundary"]?.description) desc += "\n\nAuthorization Boundary: " + sc["authorization-boundary"].description;
-			system.description = desc;
-		}
-		const sil = sc["security-impact-level"];
-		if (sil) system.categorizationLevel = sspCategorizationLevel(sil) ?? void 0;
-		else if (sc["security-sensitivity-level"]) system.categorizationLevel = mapSensitivityToCategorizationLevel(sc["security-sensitivity-level"]) ?? void 0;
-		if (sc.status) system.authorizationStatus = sspAuthorizationStatus(sc.status.state) ?? void 0;
-		if (sc["authorization-boundary"]?.description) system.boundaryDescription = sc["authorization-boundary"].description;
-		const systemIds = sc["system-ids"];
-		if (systemIds && systemIds.length > 0) {
-			system.identifier = systemIds[0].id;
-			if (systemIds[0]["identifier-type"]) system.identifierScheme = systemIds[0]["identifier-type"];
-		}
-	}
-	const meta = extractMetadata(ssp.metadata);
-	if (meta.version) system.version = meta.version;
-	const componentControls = buildComponentControlMap(ssp["control-implementation"]);
-	const si = ssp["system-implementation"];
-	if (si?.components) for (const comp of si.components) system.components.push(sspComponentToHDFComponent(comp, componentControls));
-	return JSON.stringify(system, null, 2);
+	});
 }
-function sspSystemName(ssp) {
-	const sc = ssp["system-characteristics"];
-	if (sc?.["system-name"]) return sc["system-name"];
-	if (ssp.metadata.title) return ssp.metadata.title;
-	return "oscal-ssp";
+function buildRiskMap$1(risks) {
+	const m = /* @__PURE__ */ new Map();
+	for (const risk of risks) m.set(risk.uuid, risk);
+	return m;
 }
-function sspCategorizationLevel(sil) {
-	const levels = [
-		sil["security-objective-confidentiality"] ?? "",
-		sil["security-objective-integrity"] ?? "",
-		sil["security-objective-availability"] ?? ""
-	];
-	let highest = "";
-	for (const l of levels) {
-		const normalized = normalizeFIPSLevel(l);
-		if (fipsLevelRank(normalized) > fipsLevelRank(highest)) highest = normalized;
-	}
-	if (!highest) return null;
-	switch (highest) {
-		case "high": return CategorizationLevel.High;
-		case "moderate": return CategorizationLevel.Moderate;
-		case "low": return CategorizationLevel.Low;
-		default: return null;
-	}
+function poamItemToOverride(item, riskMap, poam) {
+	const requirementId = extractRequirementIdFromPOAMItem(item, riskMap);
+	return {
+		type: OverrideType.Poam,
+		requirementId,
+		reason: poamItemReason(item),
+		status: poamItemStatus(item, riskMap),
+		appliedBy: poamItemAppliedBy(poam),
+		appliedAt: poamItemAppliedAt(poam, requirementId),
+		expiresAt: poamItemExpiresAt(item, riskMap, requirementId),
+		milestones: extractMilestones(item, riskMap)
+	};
 }
-function normalizeFIPSLevel(level) {
-	let lower = level.toLowerCase();
-	lower = lower.replace(/^fips-199-/, "");
-	switch (lower) {
-		case "high": return "high";
-		case "moderate":
-		case "medium": return "moderate";
-		case "low": return "low";
-		default: return "";
+function extractRequirementIdFromPOAMItem(item, riskMap) {
+	for (const rr of item["related-risks"] ?? []) {
+		const riskUuid = rr["risk-uuid"];
+		if (riskUuid) {
+			const risk = riskMap.get(riskUuid);
+			if (risk) {
+				const controlId = extractPropValue(risk.props, "impacted-control-id");
+				if (controlId) return controlIdToNistTag(controlId);
+			}
+		}
 	}
+	const poamId = extractPropValue(item.props, "POAM-ID");
+	if (poamId) return poamId;
+	if (item.title) return item.title;
+	return "unknown";
 }
-function fipsLevelRank(level) {
-	switch (level) {
-		case "high": return 3;
-		case "moderate": return 2;
-		case "low": return 1;
-		default: return 0;
-	}
+function poamItemReason(item) {
+	if (item.description) return item.description;
+	if (item.title) return item.title;
+	return "POA&M item";
 }
-function mapSensitivityToCategorizationLevel(level) {
-	const normalized = normalizeFIPSLevel(level);
-	if (!normalized) return null;
-	switch (normalized) {
-		case "high": return CategorizationLevel.High;
-		case "moderate": return CategorizationLevel.Moderate;
-		case "low": return CategorizationLevel.Low;
-		default: return null;
+function poamItemStatus(item, riskMap) {
+	for (const rr of item["related-risks"] ?? []) {
+		const riskUuid = rr["risk-uuid"];
+		if (riskUuid) {
+			const risk = riskMap.get(riskUuid);
+			if (risk) {
+				const status = oscalStatusToHdf(risk.status);
+				if (status === "passed") return "passed";
+				if (status === "failed") return "failed";
+			}
+		}
 	}
+	return "failed";
 }
-function sspAuthorizationStatus(state) {
-	switch (state.toLowerCase()) {
-		case "operational": return AuthorizationStatus.Authorized;
-		case "under-development": return AuthorizationStatus.PendingAuthorization;
-		case "disposition": return AuthorizationStatus.Revoked;
-		case "other": return AuthorizationStatus.NotYetRequested;
-		default: return null;
+function poamItemAppliedBy(poam) {
+	const rps = poam.metadata["responsible-parties"];
+	if (rps) {
+		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
+			type: "simple",
+			identifier: rp["party-uuids"][0]
+		};
+		if (rps.length > 0 && rps[0]["party-uuids"].length > 0) return {
+			type: "simple",
+			identifier: rps[0]["party-uuids"][0]
+		};
 	}
+	return {
+		type: "system",
+		identifier: "oscal-poam-converter"
+	};
 }
-function buildComponentControlMap(ci) {
-	const result = /* @__PURE__ */ new Map();
-	if (!ci) return result;
-	for (const ir of ci["implemented-requirements"] ?? []) {
-		const controlId = ir["control-id"];
-		for (const bc of ir["by-components"] ?? []) addComponentControl(result, bc["component-uuid"], controlId);
-		for (const stmt of ir.statements ?? []) for (const bc of stmt["by-components"] ?? []) addComponentControl(result, bc["component-uuid"], controlId);
-	}
-	return result;
+function poamItemAppliedAt(poam, requirementId) {
+	const t = poam.metadata["last-modified"] && parseTimestamp(String(poam.metadata["last-modified"]));
+	if (t) return t;
+	throw new Error(`poam-item "${requirementId}": no usable metadata.last-modified for appliedAt`);
 }
-function addComponentControl(m, compUUID, controlId) {
-	let controls = m.get(compUUID);
-	if (!controls) {
-		controls = /* @__PURE__ */ new Set();
-		m.set(compUUID, controls);
+function poamItemExpiresAt(item, riskMap, requirementId) {
+	for (const rr of item["related-risks"] ?? []) {
+		const riskUuid = rr["risk-uuid"];
+		if (!riskUuid) continue;
+		const risk = riskMap.get(riskUuid);
+		if (!risk?.deadline) continue;
+		const t = parseTimestamp(String(risk.deadline));
+		if (t) return t;
 	}
-	controls.add(controlId);
+	throw new Error(`poam-item "${requirementId}": no related risk carries a usable deadline; a POA&M requires a time commitment`);
 }
-function sspComponentToHDFComponent(sc, componentControls) {
-	const comp = {
-		name: sc.title,
-		type: mapOSCALComponentType(sc.type)
-	};
-	if (sc.description) comp.description = sc.description;
-	const controls = componentControls.get(sc.uuid);
-	if (controls && controls.size > 0) {
-		const refs = [];
-		for (const controlId of controls) refs.push(controlIdToNistTag(controlId));
-		if (refs.length > 0) comp.baselineRefs = refs;
+function extractMilestones(item, riskMap) {
+	const milestones = [];
+	for (const rr of item["related-risks"] ?? []) {
+		const riskUuid = rr["risk-uuid"];
+		if (!riskUuid) continue;
+		const risk = riskMap.get(riskUuid);
+		if (!risk) continue;
+		for (const rem of risk.remediations ?? []) {
+			if (rem.lifecycle !== "planned") continue;
+			for (const task of rem.tasks ?? []) {
+				const end = task.timing?.["within-date-range"]?.end;
+				const estimatedCompletion = end && parseTimestamp(String(end));
+				if (!estimatedCompletion) continue;
+				milestones.push({
+					description: task.description ? `${task.title}: ${task.description}` : task.title,
+					estimatedCompletion,
+					status: "pending"
+				});
+			}
+		}
 	}
-	return comp;
+	return milestones;
 }
-function mapOSCALComponentType(oscalType) {
-	switch (oscalType.toLowerCase()) {
-		case "software":
-		case "this-system": return TargetType.Application;
-		case "service": return TargetType.Application;
-		case "hardware": return TargetType.Host;
-		case "network": return TargetType.Network;
-		case "database": return TargetType.Database;
-		case "storage": return TargetType.Artifact;
-		default: return TargetType.Application;
+function extractAppliedBy(meta) {
+	const rps = meta["responsible-parties"];
+	if (rps) {
+		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
+			type: "simple",
+			identifier: rp["party-uuids"][0]
+		};
 	}
 }
 //#endregion
@@ -11790,181 +12201,32 @@ function buildTargetSelector(ap) {
 	const selector = {};
 	for (const subject of subjects) {
 		if (subject.type) {
-			const key = "subject-type";
-			if (selector[key] !== void 0) selector[key] += "," + subject.type;
-			else selector[key] = subject.type;
-		}
-		if (subject["include-all"] !== void 0) selector["include-" + subject.type] = "all";
-	}
-	if (Object.keys(selector).length === 0) return null;
-	return selector;
-}
-function determinePlanType(ap) {
-	const aType = extractPropValue(ap.metadata.props, "assessment-type");
-	if (aType) switch (aType.toLowerCase()) {
-		case "automated": return PlanType.Automated;
-		case "manual": return PlanType.Manual;
-	}
-	if (ap.tasks && ap.tasks.length > 0) return PlanType.Hybrid;
-}
-function buildPlanDescription(ap) {
-	const parts = [];
-	if (ap.metadata.remarks) parts.push(ap.metadata.remarks);
-	if (ap["terms-and-conditions"]?.parts && ap["terms-and-conditions"].parts.length > 0) {
-		const terms = flattenParts(ap["terms-and-conditions"].parts);
-		if (terms) parts.push("Terms and Conditions: " + terms);
-	}
-	if (parts.length === 0) return void 0;
-	return parts.join("\n\n");
-}
-//#endregion
-//#region converters/oscal-to-hdf/typescript/converter-poam.ts
-/**
-* OSCAL Plan of Action and Milestones (POA&M) to HDF Amendments converter.
-*
-* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_poam.go.
-*/
-/**
-* Converts an OSCAL POA&M document to HDF Amendments JSON.
-*
-* @param input - Raw JSON string containing an OSCAL POA&M
-* @returns HDF Amendments JSON string
-*/
-async function convertOscalPoamToHdf(input) {
-	validateInputSize(input, "oscal-poam");
-	if (!input || input.trim().length === 0) throw new Error("empty input");
-	const doc = parseJSON(input);
-	if (!doc["plan-of-action-and-milestones"]) throw new Error("oscal-poam: input is not a plan-of-action-and-milestones document (root key is not 'plan-of-action-and-milestones')");
-	const poam = doc["plan-of-action-and-milestones"];
-	const integrity = await inputIntegrity(input);
-	const meta = extractMetadata(poam.metadata);
-	const riskMap = buildRiskMap$1(poam.risks ?? []);
-	const overrides = [];
-	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
-	const systemRef = poam["import-ssp"]?.href || void 0;
-	const appliedBy = extractAppliedBy(poam.metadata);
-	return serializeHdf({
-		name: toKebabCase(poam.metadata.title, "oscal-poam"),
-		overrides,
-		integrity,
-		systemRef,
-		version: meta.version,
-		appliedBy,
-		generator: {
-			name: "oscal-poam-to-hdf",
-			version: "1.0.0"
-		}
-	});
-}
-function buildRiskMap$1(risks) {
-	const m = /* @__PURE__ */ new Map();
-	for (const risk of risks) m.set(risk.uuid, risk);
-	return m;
-}
-function poamItemToOverride(item, riskMap, poam) {
-	return {
-		type: OverrideType.Poam,
-		requirementId: extractRequirementIdFromPOAMItem(item, riskMap),
-		reason: poamItemReason(item),
-		status: poamItemStatus(item, riskMap),
-		appliedBy: poamItemAppliedBy(poam),
-		appliedAt: poamItemAppliedAt(poam),
-		expiresAt: poamItemExpiresAt(),
-		milestones: extractMilestones(item, riskMap)
-	};
-}
-function extractRequirementIdFromPOAMItem(item, riskMap) {
-	for (const rr of item["related-risks"] ?? []) {
-		const riskUuid = rr["risk-uuid"];
-		if (riskUuid) {
-			const risk = riskMap.get(riskUuid);
-			if (risk) {
-				const controlId = extractPropValue(risk.props, "impacted-control-id");
-				if (controlId) return controlIdToNistTag(controlId);
-			}
-		}
-	}
-	const poamId = extractPropValue(item.props, "POAM-ID");
-	if (poamId) return poamId;
-	if (item.title) return item.title;
-	return "unknown";
-}
-function poamItemReason(item) {
-	if (item.description) return item.description;
-	if (item.title) return item.title;
-	return "POA&M item";
-}
-function poamItemStatus(item, riskMap) {
-	for (const rr of item["related-risks"] ?? []) {
-		const riskUuid = rr["risk-uuid"];
-		if (riskUuid) {
-			const risk = riskMap.get(riskUuid);
-			if (risk) {
-				const status = oscalStatusToHdf(risk.status);
-				if (status === "passed") return "passed";
-				if (status === "failed") return "failed";
-			}
-		}
-	}
-	return "failed";
-}
-function poamItemAppliedBy(poam) {
-	const rps = poam.metadata["responsible-parties"];
-	if (rps) {
-		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: "simple",
-			identifier: rp["party-uuids"][0]
-		};
-		if (rps.length > 0 && rps[0]["party-uuids"].length > 0) return {
-			type: "simple",
-			identifier: rps[0]["party-uuids"][0]
-		};
-	}
-	return {
-		type: "system",
-		identifier: "oscal-poam-converter"
-	};
-}
-function poamItemAppliedAt(poam) {
-	if (poam.metadata["last-modified"]) {
-		const t = parseTimestamp(String(poam.metadata["last-modified"]));
-		if (t) return t;
+			const key = "subject-type";
+			if (selector[key] !== void 0) selector[key] += "," + subject.type;
+			else selector[key] = subject.type;
+		}
+		if (subject["include-all"] !== void 0) selector["include-" + subject.type] = "all";
 	}
-	return /* @__PURE__ */ new Date();
-}
-function poamItemExpiresAt() {
-	const d = /* @__PURE__ */ new Date();
-	d.setFullYear(d.getFullYear() + 1);
-	return d;
+	if (Object.keys(selector).length === 0) return null;
+	return selector;
 }
-function extractMilestones(item, riskMap) {
-	const milestones = [];
-	for (const rr of item["related-risks"] ?? []) {
-		const riskUuid = rr["risk-uuid"];
-		if (!riskUuid) continue;
-		const risk = riskMap.get(riskUuid);
-		if (!risk) continue;
-		for (const rem of risk.remediations ?? []) {
-			if (rem.lifecycle !== "planned") continue;
-			const estimatedCompletion = /* @__PURE__ */ new Date();
-			estimatedCompletion.setMonth(estimatedCompletion.getMonth() + 3);
-			milestones.push({
-				description: rem.title + ": " + rem.description,
-				estimatedCompletion,
-				status: "pending"
-			});
-		}
+function determinePlanType(ap) {
+	const aType = extractPropValue(ap.metadata.props, "assessment-type");
+	if (aType) switch (aType.toLowerCase()) {
+		case "automated": return PlanType.Automated;
+		case "manual": return PlanType.Manual;
 	}
-	return milestones;
+	if (ap.tasks && ap.tasks.length > 0) return PlanType.Hybrid;
 }
-function extractAppliedBy(meta) {
-	const rps = meta["responsible-parties"];
-	if (rps) {
-		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: "simple",
-			identifier: rp["party-uuids"][0]
-		};
+function buildPlanDescription(ap) {
+	const parts = [];
+	if (ap.metadata.remarks) parts.push(ap.metadata.remarks);
+	if (ap["terms-and-conditions"]?.parts && ap["terms-and-conditions"].parts.length > 0) {
+		const terms = flattenParts(ap["terms-and-conditions"].parts);
+		if (terms) parts.push("Terms and Conditions: " + terms);
 	}
+	if (parts.length === 0) return void 0;
+	return parts.join("\n\n");
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/converter-sar.ts
@@ -12075,99 +12337,417 @@ function extractControlIdFromFinding(f) {
 	if (idx > 0) controlId = controlId.slice(0, idx);
 	return controlId;
 }
-function mapFindingStatus(f) {
-	const status = oscalStatusToHdf(f.target.status.state);
-	if (status === "passed") return ResultStatus.Passed;
-	if (status === "failed") return ResultStatus.Failed;
-	return ResultStatus.NotReviewed;
+function mapFindingStatus(f) {
+	const status = oscalStatusToHdf(f.target.status.state);
+	if (status === "passed") return ResultStatus.Passed;
+	if (status === "failed") return ResultStatus.Failed;
+	return ResultStatus.NotReviewed;
+}
+function buildCodeDesc(f, obsMap) {
+	const parts = [];
+	for (const ref of f["related-observations"] ?? []) {
+		const obsUuid = ref["observation-uuid"];
+		if (!obsUuid) continue;
+		const obs = obsMap.get(obsUuid);
+		if (!obs) continue;
+		if (obs.methods && obs.methods.length > 0) parts.push("Methods: " + obs.methods.join(", "));
+		for (const subj of obs.subjects ?? []) {
+			let subjDesc = subj.type;
+			if (subj.title) subjDesc = subj.title + " (" + subj.type + ")";
+			parts.push("Subject: " + subjDesc);
+		}
+	}
+	if (parts.length === 0) return f.title;
+	return parts.join("; ");
+}
+function buildRiskMessage(f, riskMap) {
+	const messages = [];
+	for (const ref of f["related-risks"] ?? []) {
+		const riskUuid = ref["risk-uuid"];
+		if (!riskUuid) continue;
+		const risk = riskMap.get(riskUuid);
+		if (!risk) continue;
+		let msg = risk.title;
+		if (risk.description) msg += ": " + risk.description;
+		messages.push(msg);
+	}
+	return messages.join("\n");
+}
+function sarFindingsImpact(findings, riskMap) {
+	let highestImpact = -1;
+	for (const f of findings) for (const ref of f["related-risks"] ?? []) {
+		const riskUuid = ref["risk-uuid"];
+		if (!riskUuid) continue;
+		const risk = riskMap.get(riskUuid);
+		if (!risk) continue;
+		const impact = extractRiskSeverity(risk.characterizations, -1);
+		if (impact > highestImpact) highestImpact = impact;
+	}
+	if (highestImpact < 0) return .5;
+	return highestImpact;
+}
+function sarBuildDescriptions(findings, obsMap) {
+	const descriptions = [];
+	const findingDescs = [];
+	for (const f of findings) if (f.description) findingDescs.push(f.description);
+	descriptions.push({
+		label: "default",
+		data: findingDescs.join("\n") || ""
+	});
+	const obsDescs = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of findings) for (const ref of f["related-observations"] ?? []) {
+		const obsUuid = ref["observation-uuid"];
+		if (!obsUuid || seen.has(obsUuid)) continue;
+		seen.add(obsUuid);
+		const obs = obsMap.get(obsUuid);
+		if (obs?.description) obsDescs.push(obs.description);
+	}
+	if (obsDescs.length > 0) descriptions.push({
+		label: "rationale",
+		data: obsDescs.join("\n")
+	});
+	return descriptions;
+}
+function buildObservationMap(observations) {
+	const m = /* @__PURE__ */ new Map();
+	for (const obs of observations) m.set(obs.uuid, obs);
+	return m;
+}
+function buildRiskMap(risks) {
+	const m = /* @__PURE__ */ new Map();
+	for (const risk of risks) m.set(risk.uuid, risk);
+	return m;
+}
+function parseResultStartTime(result) {
+	if (result.start) {
+		const t = parseTimestamp(String(result.start));
+		if (t) return t;
+	}
+	return /* @__PURE__ */ new Date(0);
+}
+function sarBaselineName(result, sar) {
+	return toKebabCase(result.title || sar.metadata.title, "oscal-assessment-results");
+}
+//#endregion
+//#region converters/oscal-to-hdf/typescript/converter-ssp.ts
+/**
+* OSCAL System Security Plan (SSP) to HDF System converter.
+*
+* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_ssp.go.
+*/
+/**
+* Converts an OSCAL System Security Plan document to HDF System JSON.
+*
+* @param input - Raw JSON string containing an OSCAL SSP
+* @returns HDF System JSON string
+*/
+async function convertOscalSspToHdf(input) {
+	validateInputSize(input, "oscal-ssp");
+	if (!input || input.trim().length === 0) throw new Error("empty input");
+	const doc = parseJSON(input);
+	if (!doc["system-security-plan"]) throw new Error("oscal-ssp: input is not a system-security-plan document (root key is not 'system-security-plan')");
+	const ssp = doc["system-security-plan"];
+	const integrity = await inputIntegrity(input);
+	const system = {
+		name: sspSystemName(ssp),
+		integrity,
+		components: [],
+		generator: {
+			name: "oscal-ssp-to-hdf",
+			version: "1.0.0"
+		}
+	};
+	const sc = ssp["system-characteristics"];
+	if (sc) {
+		if (sc.description) {
+			let desc = sc.description;
+			if (sc["authorization-boundary"]?.description) desc += "\n\nAuthorization Boundary: " + sc["authorization-boundary"].description;
+			system.description = desc;
+		}
+		const sil = sc["security-impact-level"];
+		if (sil) system.categorizationLevel = sspCategorizationLevel(sil) ?? void 0;
+		else if (sc["security-sensitivity-level"]) system.categorizationLevel = mapSensitivityToCategorizationLevel(sc["security-sensitivity-level"]) ?? void 0;
+		if (sc.status) system.authorizationStatus = sspAuthorizationStatus(sc.status.state) ?? void 0;
+		if (sc["authorization-boundary"]?.description) system.boundaryDescription = sc["authorization-boundary"].description;
+		const systemIds = sc["system-ids"];
+		if (systemIds && systemIds.length > 0) {
+			system.identifier = systemIds[0].id;
+			if (systemIds[0]["identifier-type"]) system.identifierScheme = systemIds[0]["identifier-type"];
+		}
+	}
+	const meta = extractMetadata(ssp.metadata);
+	if (meta.version) system.version = meta.version;
+	const componentControls = buildComponentControlMap(ssp["control-implementation"]);
+	const si = ssp["system-implementation"];
+	if (si?.components) for (const comp of si.components) system.components.push(sspComponentToHDFComponent(comp, componentControls));
+	return JSON.stringify(system, null, 2);
+}
+function sspSystemName(ssp) {
+	const sc = ssp["system-characteristics"];
+	if (sc?.["system-name"]) return sc["system-name"];
+	if (ssp.metadata.title) return ssp.metadata.title;
+	return "oscal-ssp";
+}
+function sspCategorizationLevel(sil) {
+	const levels = [
+		sil["security-objective-confidentiality"] ?? "",
+		sil["security-objective-integrity"] ?? "",
+		sil["security-objective-availability"] ?? ""
+	];
+	let highest = "";
+	for (const l of levels) {
+		const normalized = normalizeFIPSLevel(l);
+		if (fipsLevelRank(normalized) > fipsLevelRank(highest)) highest = normalized;
+	}
+	if (!highest) return null;
+	switch (highest) {
+		case "high": return CategorizationLevel.High;
+		case "moderate": return CategorizationLevel.Moderate;
+		case "low": return CategorizationLevel.Low;
+		default: return null;
+	}
+}
+function normalizeFIPSLevel(level) {
+	let lower = level.toLowerCase();
+	lower = lower.replace(/^fips-199-/, "");
+	switch (lower) {
+		case "high": return "high";
+		case "moderate":
+		case "medium": return "moderate";
+		case "low": return "low";
+		default: return "";
+	}
+}
+function fipsLevelRank(level) {
+	switch (level) {
+		case "high": return 3;
+		case "moderate": return 2;
+		case "low": return 1;
+		default: return 0;
+	}
+}
+function mapSensitivityToCategorizationLevel(level) {
+	const normalized = normalizeFIPSLevel(level);
+	if (!normalized) return null;
+	switch (normalized) {
+		case "high": return CategorizationLevel.High;
+		case "moderate": return CategorizationLevel.Moderate;
+		case "low": return CategorizationLevel.Low;
+		default: return null;
+	}
+}
+function sspAuthorizationStatus(state) {
+	switch (state.toLowerCase()) {
+		case "operational": return AuthorizationStatus.Authorized;
+		case "under-development": return AuthorizationStatus.PendingAuthorization;
+		case "disposition": return AuthorizationStatus.Revoked;
+		case "other": return AuthorizationStatus.NotYetRequested;
+		default: return null;
+	}
+}
+function buildComponentControlMap(ci) {
+	const result = /* @__PURE__ */ new Map();
+	if (!ci) return result;
+	for (const ir of ci["implemented-requirements"] ?? []) {
+		const controlId = ir["control-id"];
+		for (const bc of ir["by-components"] ?? []) addComponentControl(result, bc["component-uuid"], controlId);
+		for (const stmt of ir.statements ?? []) for (const bc of stmt["by-components"] ?? []) addComponentControl(result, bc["component-uuid"], controlId);
+	}
+	return result;
+}
+function addComponentControl(m, compUUID, controlId) {
+	let controls = m.get(compUUID);
+	if (!controls) {
+		controls = /* @__PURE__ */ new Set();
+		m.set(compUUID, controls);
+	}
+	controls.add(controlId);
 }
-function buildCodeDesc(f, obsMap) {
-	const parts = [];
-	for (const ref of f["related-observations"] ?? []) {
-		const obsUuid = ref["observation-uuid"];
-		if (!obsUuid) continue;
-		const obs = obsMap.get(obsUuid);
-		if (!obs) continue;
-		if (obs.methods && obs.methods.length > 0) parts.push("Methods: " + obs.methods.join(", "));
-		for (const subj of obs.subjects ?? []) {
-			let subjDesc = subj.type;
-			if (subj.title) subjDesc = subj.title + " (" + subj.type + ")";
-			parts.push("Subject: " + subjDesc);
+function sspComponentToHDFComponent(sc, componentControls) {
+	const comp = {
+		name: sc.title,
+		type: mapOSCALComponentType(sc.type)
+	};
+	if (sc.description) comp.description = sc.description;
+	const controls = componentControls.get(sc.uuid);
+	if (controls && controls.size > 0) {
+		const refs = [];
+		for (const controlId of controls) refs.push(controlIdToNistTag(controlId));
+		if (refs.length > 0) {
+			refs.sort();
+			comp.baselineRefs = refs;
 		}
 	}
-	if (parts.length === 0) return f.title;
-	return parts.join("; ");
+	return comp;
 }
-function buildRiskMessage(f, riskMap) {
-	const messages = [];
-	for (const ref of f["related-risks"] ?? []) {
-		const riskUuid = ref["risk-uuid"];
-		if (!riskUuid) continue;
-		const risk = riskMap.get(riskUuid);
-		if (!risk) continue;
-		let msg = risk.title;
-		if (risk.description) msg += ": " + risk.description;
-		messages.push(msg);
+function mapOSCALComponentType(oscalType) {
+	switch (oscalType.toLowerCase()) {
+		case "software":
+		case "this-system": return TargetType.Application;
+		case "service": return TargetType.Application;
+		case "hardware": return TargetType.Host;
+		case "network": return TargetType.Network;
+		case "database": return TargetType.Database;
+		case "storage": return TargetType.Artifact;
+		default: return TargetType.Application;
 	}
-	return messages.join("\n");
 }
-function sarFindingsImpact(findings, riskMap) {
-	let highestImpact = -1;
-	for (const f of findings) for (const ref of f["related-risks"] ?? []) {
-		const riskUuid = ref["risk-uuid"];
-		if (!riskUuid) continue;
-		const risk = riskMap.get(riskUuid);
-		if (!risk) continue;
-		const impact = extractRiskSeverity(risk.characterizations, -1);
-		if (impact > highestImpact) highestImpact = impact;
+//#endregion
+//#region converters/oscal-to-hdf/typescript/converter-profile.ts
+/**
+* OSCAL Profile to HDF Baseline converter.
+*
+* Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_profile.go.
+*
+* This implements the "simple resolver" -- it handles:
+* - A single catalog import
+* - include-controls with with-ids filtering
+* - set-parameters from modify section
+* - merge as-is (preserve catalog structure)
+*
+* It does NOT handle:
+* - Multiple imports
+* - Nested profile imports
+* - alter directives
+* - Complex merge strategies
+*/
+/**
+* Converts an OSCAL Profile against a provided catalog to HDF Baseline JSON.
+*
+* @param profileInput - Raw JSON string containing an OSCAL profile
+* @param catalogInput - Raw JSON string containing an OSCAL catalog
+* @returns HDF Baseline JSON string
+*/
+async function convertOscalProfileToHdf(profileInput, catalogInput) {
+	validateInputSize(profileInput, "oscal-profile");
+	if (!profileInput || profileInput.trim().length === 0) throw new Error("empty profile input");
+	if (!catalogInput || catalogInput.trim().length === 0) throw new Error("empty catalog input");
+	const profileDoc = parseJSON(profileInput);
+	if (!profileDoc.profile) throw new Error("oscal-profile: input is not a profile document (root key is not 'profile')");
+	const profile = profileDoc.profile;
+	const catalogDoc = parseJSON(catalogInput);
+	if (!catalogDoc.catalog) throw new Error("oscal-profile: catalog input is not a catalog document (root key is not 'catalog')");
+	const catalog = catalogDoc.catalog;
+	if (!profile.imports || profile.imports.length === 0) throw new Error("oscal-profile: profile has no imports");
+	if (profile.imports.length > 1) throw new Error(`oscal-profile: profile has ${profile.imports.length} imports -- this converter only supports single-catalog imports. Use NIST's oscal-cli to resolve complex profiles, or use a pre-resolved catalog`);
+	if (profile.modify?.alters && profile.modify.alters.length > 0) throw new Error(`oscal-profile: profile contains ${profile.modify.alters.length} alter directives -- this converter only supports parameter overrides. Use NIST's oscal-cli to resolve profiles with alter directives, or use a pre-resolved catalog`);
+	const imp = profile.imports[0];
+	const resolvedCatalog = filterCatalog(catalog, collectIncludedIDs(imp), collectExcludedIDs(imp));
+	if (profile.modify?.["set-parameters"]) applyParameterOverrides(resolvedCatalog, profile.modify["set-parameters"]);
+	resolvedCatalog.metadata = profile.metadata;
+	resolvedCatalog.uuid = profile.uuid;
+	const baseline = await catalogToBaseline(resolvedCatalog, profileInput);
+	baseline.integrity = await inputIntegrity(profileInput);
+	return JSON.stringify(baseline, null, 2);
+}
+/** Extracts all control IDs from an import's include-controls. Returns null if include all. */
+function collectIncludedIDs(imp) {
+	const includeControls = imp["include-controls"];
+	if (!includeControls || includeControls.length === 0) return null;
+	const ids = /* @__PURE__ */ new Set();
+	for (const ic of includeControls) for (const id of ic["with-ids"] ?? []) ids.add(id);
+	return ids;
+}
+/** Extracts all control IDs from an import's exclude-controls. */
+function collectExcludedIDs(imp) {
+	const excludeControls = imp["exclude-controls"];
+	if (!excludeControls || excludeControls.length === 0) return null;
+	const ids = /* @__PURE__ */ new Set();
+	for (const ec of excludeControls) for (const id of ec["with-ids"] ?? []) ids.add(id);
+	return ids;
+}
+/** Creates a new catalog containing only the controls matching filters. */
+function filterCatalog(catalog, includedIDs, excludedIDs) {
+	const includeAll = includedIDs === null;
+	const result = {
+		uuid: catalog.uuid,
+		metadata: catalog.metadata,
+		"back-matter": catalog["back-matter"],
+		groups: [],
+		controls: []
+	};
+	for (const group of catalog.groups ?? []) {
+		const filtered = filterGroupControls(group, includedIDs, excludedIDs, includeAll);
+		if (filtered.controls && filtered.controls.length > 0) result.groups.push(filtered);
 	}
-	if (highestImpact < 0) return .5;
-	return highestImpact;
+	for (const ctrl of catalog.controls ?? []) if (shouldIncludeControl(ctrl.id, includedIDs, excludedIDs, includeAll)) {
+		const filteredCtrl = filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll);
+		result.controls.push(filteredCtrl);
+	}
+	return result;
 }
-function sarBuildDescriptions(findings, obsMap) {
-	const descriptions = [];
-	const findingDescs = [];
-	for (const f of findings) if (f.description) findingDescs.push(f.description);
-	descriptions.push({
-		label: "default",
-		data: findingDescs.join("\n") || ""
-	});
-	const obsDescs = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of findings) for (const ref of f["related-observations"] ?? []) {
-		const obsUuid = ref["observation-uuid"];
-		if (!obsUuid || seen.has(obsUuid)) continue;
-		seen.add(obsUuid);
-		const obs = obsMap.get(obsUuid);
-		if (obs?.description) obsDescs.push(obs.description);
+function filterGroupControls(group, includedIDs, excludedIDs, includeAll) {
+	const filtered = {
+		id: group.id,
+		class: group.class,
+		title: group.title,
+		props: group.props,
+		parts: group.parts,
+		controls: []
+	};
+	for (const ctrl of group.controls ?? []) if (shouldIncludeControl(ctrl.id, includedIDs, excludedIDs, includeAll)) {
+		const filteredCtrl = filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll);
+		filtered.controls.push(filteredCtrl);
 	}
-	if (obsDescs.length > 0) descriptions.push({
-		label: "rationale",
-		data: obsDescs.join("\n")
-	});
-	return descriptions;
+	return filtered;
 }
-function buildObservationMap(observations) {
-	const m = /* @__PURE__ */ new Map();
-	for (const obs of observations) m.set(obs.uuid, obs);
-	return m;
+function filterControlEnhancements(ctrl, includedIDs, excludedIDs, includeAll) {
+	const result = {
+		id: ctrl.id,
+		class: ctrl.class,
+		title: ctrl.title,
+		params: ctrl.params,
+		props: ctrl.props,
+		links: ctrl.links,
+		parts: ctrl.parts,
+		controls: []
+	};
+	for (const enh of ctrl.controls ?? []) if (shouldIncludeControl(enh.id, includedIDs, excludedIDs, includeAll)) result.controls.push(enh);
+	return result;
 }
-function buildRiskMap(risks) {
-	const m = /* @__PURE__ */ new Map();
-	for (const risk of risks) m.set(risk.uuid, risk);
-	return m;
+function shouldIncludeControl(id, includedIDs, excludedIDs, includeAll) {
+	if (excludedIDs !== null && excludedIDs.has(id)) return false;
+	if (includeAll) return true;
+	return includedIDs !== null && includedIDs.has(id);
 }
-function parseResultStartTime(result) {
-	if (result.start) {
-		const t = parseTimestamp(String(result.start));
-		if (t) return t;
+/** Applies set-parameters from the profile's modify section to the resolved catalog. */
+function applyParameterOverrides(catalog, setParams) {
+	if (setParams.length === 0) return;
+	const overrides = /* @__PURE__ */ new Map();
+	for (const sp of setParams) if (sp["param-id"]) overrides.set(sp["param-id"], sp.values ?? []);
+	for (const group of catalog.groups ?? []) for (const ctrl of group.controls ?? []) {
+		applyParamOverridesToControl(ctrl, overrides);
+		for (const enh of ctrl.controls ?? []) applyParamOverridesToControl(enh, overrides);
+	}
+	for (const ctrl of catalog.controls ?? []) {
+		applyParamOverridesToControl(ctrl, overrides);
+		for (const enh of ctrl.controls ?? []) applyParamOverridesToControl(enh, overrides);
 	}
-	return /* @__PURE__ */ new Date(0);
 }
-function sarBaselineName(result, sar) {
-	return toKebabCase(result.title || sar.metadata.title, "oscal-assessment-results");
+function applyParamOverridesToControl(ctrl, overrides) {
+	if (ctrl.params) for (const param of ctrl.params) {
+		if (!param.id) continue;
+		const values = overrides.get(param.id);
+		if (values) param.label = values.join(", ");
+	}
+	if (ctrl.parts) for (const part of ctrl.parts) replaceParamInsertions(part, overrides);
+}
+function replaceParamInsertions(part, overrides) {
+	if (part.prose) part.prose = substituteParams(part.prose, overrides);
+	if (part.parts) for (const child of part.parts) replaceParamInsertions(child, overrides);
+}
+/** Replaces OSCAL parameter insertion patterns: {{ insert: param, <param-id> }} */
+function substituteParams(text, overrides) {
+	let result = text;
+	for (const [paramId, values] of overrides) {
+		const placeholder = `{{ insert: param, ${paramId} }}`;
+		const replacement = values.join(", ");
+		result = result.split(placeholder).join(replacement);
+	}
+	return result;
 }
 //#endregion
-export { convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
+export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
 
 //# sourceMappingURL=index.js.map