@mitre/hdf-converters 3.4.2 → 3.4.4

package/dist/index.js

@@ -2,7 +2,7 @@ import { n as detectConverter, t as registerAllFingerprints } from "./register-a
 import { flattenOverlays } from "@mitre/hdf-parsers";
 import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
-import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
+import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -753,30 +753,6 @@ function convertProfile(v1Profile) {
 	if (v1Profile.depends?.length) v2Baseline.depends = v1Profile.depends.map(convertDependency);
 	return v2Baseline;
 }
-/**
-* Convert HDF v1.0 results to v2.0 format.
-*
-* Performs comprehensive transformation at all levels:
-* - Top-level: version removed, profiles → baselines, platform → components
-* - Baselines: sha256 → checksum, controls → requirements, field renaming
-* - Requirements: snake_case → camelCase, status → effectiveStatus
-* - Results: snake_case → camelCase for all fields
-*
-* @param v1Data - HDF v1.0 results object
-* @returns HDF v2.0 results object
-*
-* @example
-* ```typescript
-* const v1 = {
-*   version: "1.0.0",
-*   platform: { name: "ubuntu", release: "20.04" },
-*   profiles: [...],
-*   statistics: {...}
-* };
-* const v2 = convertV1ToV2(v1);
-* // v2 = { baselines: [...], components: [{...}], statistics: {...} }
-* ```
-*/
 function convertV1ToV2(v1Data) {
 	validateInputSize(JSON.stringify(v1Data), "legacyhdf-to-hdf");
 	const v2 = {
@@ -973,7 +949,7 @@ function controlId(f) {
 * the shared awsconfig mapping, falling back to the static analysis default
 * bundle (matching the SAF CLI) when no config rule applies.
 */
-function nistTags(group) {
+function nistTags$1(group) {
 	if (group.length > 0 && productOf(group[0]) === "trivy" && trivyCVE(group[0])) return DEFAULT_REMEDIATION_NIST_TAGS$1;
 	const out = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -981,10 +957,15 @@ function nistTags(group) {
 		seen.add(tag);
 		out.push(tag);
 	}
-	return out.length > 0 ? out : DEFAULT_STATIC_ANALYSIS_NIST_TAGS;
+	if (out.length > 0) return out;
+	if (group.length > 0 && isConfigRuleFinding(group[0])) return DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS;
+	return DEFAULT_STATIC_ANALYSIS_NIST_TAGS;
+}
+function isConfigRuleFinding(f) {
+	return f.ProductFields?.["RelatedAWSResources:0/type"] === "AWS::Config::ConfigRule";
 }
 function configRuleNist(f) {
-	if (f.ProductFields?.["RelatedAWSResources:0/type"] !== "AWS::Config::ConfigRule") return [];
+	if (!isConfigRuleFinding(f)) return [];
 	const name = f.ProductFields?.["RelatedAWSResources:0/name"];
 	if (!name) return [];
 	return getAwsConfigNistControlsBySubstring(name);
@@ -1093,7 +1074,7 @@ function buildRequirement$17(id, group) {
 		label: "fix",
 		data: fix
 	});
-	const nist = nistTags(group);
+	const nist = nistTags$1(group);
 	const tags = nist.length > 0 ? buildNistCciTags(nist, nistToCci(nist)) : {};
 	const results = group.map(buildResult$2);
 	const req = createRequirement(id, primary.Title ?? "", descriptions, impact, results, { tags });
@@ -1252,7 +1233,7 @@ function convertResultGroup(ruleId, rule, sarifResults) {
 	const sourceLocation = firstResult.locations && firstResult.locations.length > 0 ? extractSourceLocation$1(firstResult.locations[0]) : void 0;
 	const results = [];
 	for (const sr of sarifResults) results.push(...convertSarifResultToHDFResults(sr));
-	const descriptions = buildDescriptions$1(description, rule, firstResult);
+	const descriptions = buildDescriptions$2(description, rule, firstResult);
 	const options = { tags: buildTags$3(firstResult, rule, ruleLevel, cweIds, nistControls, cciControls) };
 	if (sourceLocation) options.sourceLocation = sourceLocation;
 	const req = createRequirement(ruleId, title, descriptions, impact, results, options);
@@ -1429,7 +1410,7 @@ function extractBacktrace(codeFlows) {
 	}
 	return backtrace;
 }
-function buildDescriptions$1(defaultDesc, rule, result) {
+function buildDescriptions$2(defaultDesc, rule, result) {
 	const descriptions = [createDescription("default", defaultDesc)];
 	if (rule) {
 		if (rule.fullDescription?.text) descriptions.push(createDescription("rationale", rule.fullDescription.text));
@@ -3021,7 +3002,7 @@ function extractCwe(raw) {
 	const out = raw.filter((c) => CWE_ID_PATTERN.test(c));
 	return out.length === 0 ? void 0 : out;
 }
-function buildEpss$1(entries) {
+function buildEpss$2(entries) {
 	if (!entries || entries.length === 0) return void 0;
 	const e = entries[0];
 	if (!e.date) return void 0;
@@ -3039,7 +3020,7 @@ function buildKev(k) {
 	if (k.notes) out.notes = k.notes;
 	return out;
 }
-function convertMatchToRequirement(match, isIgnored) {
+function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	const vuln = match.vulnerability;
 	const cveId = vuln.id;
 	const severity = vuln.severity;
@@ -3062,11 +3043,12 @@ function convertMatchToRequirement(match, isIgnored) {
 		status,
 		codeDesc: buildCodeDesc$8(match),
 		message,
-		startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
+		startTime
 	};
 	const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS));
 	const requirement = {
 		id: isIgnored ? `Grype-Ignored-Match/${cveId}` : `Grype/${cveId}`,
+		title: `Grype found a vulnerability to ${cveId} in ${targetName}`,
 		impact,
 		results: [result],
 		tags,
@@ -3094,7 +3076,7 @@ function convertMatchToRequirement(match, isIgnored) {
 	requirement.affectedPackages = buildAffectedPackages(match);
 	const cwe = extractCwe(vuln.cwe);
 	if (cwe) requirement.cwe = cwe;
-	const epss = buildEpss$1(vuln.epss);
+	const epss = buildEpss$2(vuln.epss);
 	if (epss) requirement.epss = epss;
 	const kev = buildKev(vuln.kev);
 	if (kev) requirement.kev = kev;
@@ -3105,19 +3087,21 @@ async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 	const resultsChecksum = await inputChecksum(input);
 	const grypeData = parseJSON(input);
 	const requirements = [];
+	const targetName = grypeData.source?.target?.userInput || "Grype Scan";
+	const scanTime = grypeData.descriptor?.timestamp ? parseTimestamp(grypeData.descriptor.timestamp) : null;
+	const resultStart = scanTime ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	if (grypeData.matches && grypeData.matches.length > 0) {
 		const { items: limitedMatches, truncated: truncatedMatches } = limitArray(grypeData.matches);
 		/* v8 ignore next -- truncation only triggers with >100K items */
 		if (truncatedMatches) console.warn(`WARNING: Input truncated at ${limitedMatches.length} match items (original: ${grypeData.matches.length})`);
-		for (const match of limitedMatches) requirements.push(convertMatchToRequirement(match, false));
+		for (const match of limitedMatches) requirements.push(convertMatchToRequirement(match, false, targetName, resultStart));
 	}
 	if (grypeData.ignoredMatches && grypeData.ignoredMatches.length > 0) {
 		const { items: limitedIgnored, truncated: truncatedIgnored } = limitArray(grypeData.ignoredMatches);
 		/* v8 ignore next -- truncation only triggers with >100K items */
 		if (truncatedIgnored) console.warn(`WARNING: Input truncated at ${limitedIgnored.length} ignoredMatch items (original: ${grypeData.ignoredMatches.length})`);
-		for (const match of limitedIgnored) requirements.push(convertMatchToRequirement(match, true));
+		for (const match of limitedIgnored) requirements.push(convertMatchToRequirement(match, true, targetName, resultStart));
 	}
-	const targetName = grypeData.source?.target?.userInput || "Grype Scan";
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("grype-no-findings", `Grype scanned ${targetName} and reported zero vulnerable components.`, /* @__PURE__ */ new Date()));
 	const baseline = createMinimalBaseline(targetName, requirements, { resultsChecksum });
 	return buildHdfResults({
@@ -3130,7 +3114,190 @@ async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 			type: TargetType.Artifact,
 			name: targetName
 		}],
-		timestamp: (grypeData.descriptor?.timestamp ? parseTimestamp(grypeData.descriptor.timestamp) : null) ?? /* @__PURE__ */ new Date()
+		timestamp: scanTime ?? void 0
+	});
+}
+//#endregion
+//#region converters/defectdojo-to-hdf/typescript/converter.ts
+function deriveStatus(f) {
+	if (f.out_of_scope) return ResultStatus.NotApplicable;
+	if (f.false_p) return ResultStatus.Failed;
+	if (f.risk_accepted) return ResultStatus.Failed;
+	if (f.is_mitigated) return ResultStatus.Passed;
+	if (f.under_review) return ResultStatus.NotReviewed;
+	return ResultStatus.Failed;
+}
+function triageTags(f) {
+	return {
+		"defectdojo/active": f.active ?? false,
+		"defectdojo/verified": f.verified ?? false,
+		"defectdojo/false_p": f.false_p ?? false,
+		"defectdojo/is_mitigated": f.is_mitigated ?? false,
+		"defectdojo/risk_accepted": f.risk_accepted ?? false,
+		"defectdojo/out_of_scope": f.out_of_scope ?? false,
+		"defectdojo/under_review": f.under_review ?? false
+	};
+}
+function riskAcceptanceOwner(ar) {
+	if (ar.owner_email) return {
+		type: IdentityType.Email,
+		identifier: ar.owner_email
+	};
+	if (ar.owner_username) return {
+		type: IdentityType.Username,
+		identifier: ar.owner_username
+	};
+	if (ar.owner !== void 0 && ar.owner !== null && `${ar.owner}` !== "") return {
+		type: IdentityType.Simple,
+		identifier: `defectdojo-user-${ar.owner}`
+	};
+	return {
+		type: IdentityType.Simple,
+		identifier: "defectdojo-risk-acceptance-owner"
+	};
+}
+function buildWaiverOverride(ar) {
+	let reason = ar.decision_details || ar.name || "";
+	if (!reason) reason = "Risk accepted in DefectDojo";
+	const appliedAt = (ar.created ? parseTimestamp(ar.created) : null) ?? /* @__PURE__ */ new Date();
+	const oneYearOut = /* @__PURE__ */ new Date();
+	oneYearOut.setTime(appliedAt.getTime());
+	oneYearOut.setFullYear(oneYearOut.getFullYear() + 1);
+	const expiresAt = (ar.expiration_date ? parseTimestamp(ar.expiration_date) : null) ?? oneYearOut;
+	return {
+		type: OverrideType.Waiver,
+		status: ResultStatus.Passed,
+		reason,
+		appliedBy: riskAcceptanceOwner(ar),
+		appliedAt,
+		expiresAt
+	};
+}
+function findingId(f) {
+	return f.unique_id_from_tool || f.vuln_id_from_tool || `DefectDojo-Finding-${f.id}`;
+}
+function cveList(f) {
+	return (f.vulnerability_ids ?? []).map((v) => v.vulnerability_id).filter(Boolean);
+}
+function cvssBand(score) {
+	switch (cvssScoreToSeverity(score)) {
+		case "critical": return CVSSSeverity.Critical;
+		case "high": return CVSSSeverity.High;
+		case "medium": return CVSSSeverity.Medium;
+		case "low": return CVSSSeverity.Low;
+		default: return CVSSSeverity.None;
+	}
+}
+function buildCvss$1(f) {
+	const out = [];
+	const add = (version, vector, score) => {
+		if ((score === void 0 || score === null) && !vector) return;
+		const entry = { version };
+		if (score !== void 0 && score !== null) {
+			entry.baseScore = score;
+			entry.baseSeverity = cvssBand(score);
+		}
+		if (vector) entry.baseVector = vector;
+		out.push(entry);
+	};
+	add(Version.The31, f.cvssv3, f.cvssv3_score);
+	add(Version.The40, f.cvssv4, f.cvssv4_score);
+	return out;
+}
+function buildEpss$1(f) {
+	if (f.epss_score === void 0 || f.epss_score === null || !f.date) return void 0;
+	return {
+		score: f.epss_score,
+		percentile: f.epss_percentile ?? 0,
+		date: f.date
+	};
+}
+function nistTags(f) {
+	return f.cwe && f.cwe > 0 ? mapCWEToNIST([`CWE-${f.cwe}`], DEFAULT_STATIC_ANALYSIS_NIST_TAGS) : DEFAULT_STATIC_ANALYSIS_NIST_TAGS;
+}
+function buildDescriptions$1(f) {
+	const descs = [{
+		label: "default",
+		data: f.description || f.title || "No description provided."
+	}];
+	if (f.mitigation) descs.push({
+		label: "fix",
+		data: f.mitigation
+	});
+	if (f.impact) descs.push({
+		label: "impact",
+		data: f.impact
+	});
+	return descs;
+}
+function codeDesc(f) {
+	const parts = [f.title];
+	if (f.component_name) parts.push(`Component: ${f.component_name}${f.component_version ? "@" + f.component_version : ""}`);
+	if (f.file_path) parts.push(`Location: ${f.file_path}${f.line !== void 0 && f.line !== null ? ":" + f.line : ""}`);
+	const cves = cveList(f);
+	if (cves.length > 0) parts.push(`CVE: ${cves.join(", ")}`);
+	return parts.join(" | ");
+}
+function convertFinding(f) {
+	const nist = nistTags(f);
+	const tags = buildNistCciTags(nist, nistToCci(nist), triageTags(f));
+	const result = {
+		status: deriveStatus(f),
+		codeDesc: codeDesc(f),
+		startTime: (f.date ? parseTimestamp(f.date) : null) ?? /* @__PURE__ */ new Date()
+	};
+	const req = {
+		id: findingId(f),
+		impact: severityToImpact(f.severity),
+		results: [result],
+		tags,
+		descriptions: buildDescriptions$1(f)
+	};
+	const controlType = deriveControlTypeFromTags(nist);
+	if (controlType !== void 0) req.controlType = controlType;
+	const cvss = buildCvss$1(f);
+	if (cvss.length > 0) req.cvss = cvss;
+	const epss = buildEpss$1(f);
+	if (epss) req.epss = epss;
+	if (f.cwe && f.cwe > 0) req.cwe = [`CWE-${f.cwe}`];
+	const firstRisk = f.accepted_risks?.[0];
+	if (f.risk_accepted && firstRisk) {
+		req.statusOverrides = [buildWaiverOverride(firstRisk)];
+		req.effectiveStatus = ResultStatus.Passed;
+		req.disposition = OverrideType.Waiver;
+		tags["defectdojo/decision"] = firstRisk.decision ?? "";
+	}
+	return req;
+}
+function scannerName(f) {
+	return f.related_fields?.test?.test_type?.name || "DefectDojo";
+}
+async function convertDefectDojoToHdf(input, converterVersion = "0.1.0") {
+	validateInputSize(input, "defectdojo");
+	const resultsChecksum = await inputChecksum(input);
+	const parsed = parseJSON(input);
+	const findings = Array.isArray(parsed) ? parsed : parsed.results ?? [];
+	const order = [];
+	const byScanner = /* @__PURE__ */ new Map();
+	for (const f of findings) {
+		const name = scannerName(f);
+		if (!byScanner.has(name)) {
+			order.push(name);
+			byScanner.set(name, []);
+		}
+		byScanner.get(name).push(convertFinding(f));
+	}
+	const baselines = order.map((name) => {
+		const baseline = createMinimalBaseline(`DefectDojo: ${name}`, byScanner.get(name), { resultsChecksum });
+		baseline.title = name;
+		return baseline;
+	});
+	if (baselines.length === 0) baselines.push(createMinimalBaseline("DefectDojo", [buildNoFindingsRequirement("defectdojo-no-findings", "DefectDojo reported zero findings.", /* @__PURE__ */ new Date())], { resultsChecksum }));
+	return buildHdfResults({
+		generatorName: "defectdojo-to-hdf",
+		converterVersion,
+		toolName: "DefectDojo",
+		baselines
 	});
 }
 //#endregion
@@ -3920,8 +4087,9 @@ function buildNotApplicableResult(rule) {
 	});
 }
 function buildRequirement$15(rule) {
-	const nist = buildNistTags$3(rule.Source.SourceIdentifier, rule.ConfigRuleName);
-	const tags = nist.length > 0 ? { nist } : {};
+	const rawNist = buildNistTags$3(rule.Source.SourceIdentifier, rule.ConfigRuleName);
+	const nist = rawNist.length > 0 ? rawNist : DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS;
+	const tags = { nist };
 	const descriptions = [{
 		label: "default",
 		data: rule.Description
@@ -6882,6 +7050,140 @@ async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
 	return serializeHdf(hdf);
 }
 //#endregion
+//#region converters/hipcheck-to-hdf/typescript/converter.ts
+/** "owner/name" when both are present, else whichever is non-empty (never a
+* bare "owner/" or "/name"). */
+function repoIdent(r) {
+	const owner = r.repo_owner ?? "";
+	const name = r.repo_name ?? "";
+	if (owner && name) return `${owner}/${name}`;
+	return name || owner;
+}
+/** Build NIST/CCI tags for an analysis name via the hipcheck mapping. */
+function analysisTags(name) {
+	const nist = getHipcheckNistControls(name);
+	if (nist.length === 0) return {
+		tags: buildNistCciTags([], []),
+		nist: []
+	};
+	return {
+		tags: buildNistCciTags(nist, nistToCci(nist)),
+		nist
+	};
+}
+function applyClassification(req, nist) {
+	const controlType = deriveControlTypeFromTags(nist);
+	if (controlType !== void 0) req.controlType = controlType;
+	req.verificationMethod = VerificationMethodEnum.Automated;
+}
+function buildAnalysisRequirement(a, status, startTime) {
+	const { tags, nist } = analysisTags(a.name);
+	const message = a.message ?? "";
+	const descriptions = [{
+		label: "default",
+		data: message
+	}];
+	if (a.policy_expr) descriptions.push({
+		label: "check",
+		data: a.policy_expr
+	});
+	let resultMessage = message;
+	if (a.concerns && a.concerns.length > 0) resultMessage = `${message}\nConcerns:\n- ${a.concerns.join("\n- ")}`;
+	const result = {
+		status,
+		codeDesc: a.policy_expr ?? "",
+		message: resultMessage,
+		startTime
+	};
+	const req = createRequirement(a.name, a.name, descriptions, .5, [result], { tags });
+	applyClassification(req, nist);
+	return req;
+}
+function buildErroredRequirement(e, startTime) {
+	const { tags, nist } = analysisTags(e.name);
+	const msg = flattenError(e.error);
+	const result = {
+		status: ResultStatus.Error,
+		codeDesc: "",
+		message: msg,
+		startTime
+	};
+	const req = createRequirement(e.name, e.name, [{
+		label: "default",
+		data: msg
+	}], .5, [result], { tags });
+	applyClassification(req, nist);
+	return req;
+}
+/** Render Hipcheck's recursive error chain as "msg: source: ...". */
+function flattenError(e) {
+	const parts = [];
+	for (let cur = e; cur; cur = cur.source) if (cur.msg) parts.push(cur.msg);
+	return parts.length > 0 ? parts.join(": ") : "unknown error";
+}
+/** Render a risk score without trailing zeros (0.42, 0.33, 0), matching Go. */
+function formatScore(f) {
+	return String(f);
+}
+/** Render the overall recommendation as baseline summary prose. */
+function buildSummary$1(rec) {
+	const base = `Hipcheck recommendation: ${rec.kind ?? ""} (risk score ${formatScore(rec.risk_score ?? 0)}, policy '${rec.risk_policy ?? ""}').`;
+	if ((rec.kind ?? "").toLowerCase() !== "investigate") return base;
+	const suffix = investigateReason(rec.reason);
+	return suffix ? `${base} ${suffix}` : base;
+}
+/** Decode the polymorphic `reason` into a sentence, or "". */
+function investigateReason(reason) {
+	if (reason === null || reason === void 0) return "";
+	if (typeof reason === "string") {
+		if (reason === "Policy") return "Investigation triggered because the risk score exceeded the policy threshold.";
+		return `Investigation reason: ${reason}.`;
+	}
+	if (typeof reason === "object") {
+		const failed = reason.FailedAnalyses;
+		if (Array.isArray(failed) && failed.length > 0) return `Investigation forced by failed analyses: ${failed.join(", ")}.`;
+	}
+	return "";
+}
+/**
+* Converts a MITRE Hipcheck `hc check --format json` report to HDF Results.
+*
+* @param input - Hipcheck JSON report string
+* @returns HDF JSON string
+*/
+async function convertHipcheckToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize(input, "hipcheck");
+	if (!input || input.trim().length === 0) throw new Error("hipcheck: empty input");
+	const report = parseJSON(input);
+	if (!report.hipcheck_version && !report.repo_name) throw new Error("hipcheck: input does not look like a Hipcheck report");
+	const startTime = (report.analyzed_at ? parseTimestamp(report.analyzed_at) : void 0) ?? /* @__PURE__ */ new Date();
+	const requirements = [];
+	for (const a of report.passing ?? []) requirements.push(buildAnalysisRequirement(a, ResultStatus.Passed, startTime));
+	for (const a of report.failing ?? []) requirements.push(buildAnalysisRequirement(a, ResultStatus.Failed, startTime));
+	for (const e of report.errored ?? []) requirements.push(buildErroredRequirement(e, startTime));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("hipcheck-no-findings", `Hipcheck analyzed ${repoIdent(report)} and reported zero analyses.`, startTime));
+	const summary = buildSummary$1(report.recommendation ?? {});
+	const baseline = createMinimalBaseline("Hipcheck Scan", requirements, {
+		title: `Hipcheck analysis of ${repoIdent(report)} @ ${report.repo_head ?? ""}`,
+		summary,
+		resultsChecksum: await inputChecksum(input)
+	});
+	const ident = repoIdent(report);
+	return buildHdfResults({
+		generatorName: "hipcheck-to-hdf",
+		converterVersion,
+		toolName: "Hipcheck",
+		toolFormat: "JSON",
+		toolVersion: report.hipcheck_version,
+		baselines: [baseline],
+		components: ident ? [{
+			name: ident,
+			type: TargetType.Repository
+		}] : void 0,
+		timestamp: /* @__PURE__ */ new Date()
+	});
+}
+//#endregion
 //#region converters/burpsuite-to-hdf/typescript/converter.ts
 const IMPACT_MAPPING$5 = {
 	"high": .7,
@@ -12748,6 +13050,6 @@ function substituteParams(text, overrides) {
 	return result;
 }
 //#endregion
-export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
+export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
 
 //# sourceMappingURL=index.js.map