@mitre/hdf-converters 3.4.4 → 3.5.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { n as detectConverter, t as registerAllFingerprints } from "./register-all-WRR-vAZf.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction } from "@mitre/hdf-utilities";
-import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
+import { buildCsv, buildXml, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, roundImpact, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction, worstStatus } from "@mitre/hdf-utilities";
+import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
 /**
@@ -150,6 +150,7 @@ const DEFAULT_MAX_INPUT_SIZE = 50 * 1024 * 1024;
 * @throws Error if input exceeds maxSize
 */
 function validateInputSize(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZE) {
+	if (maxSize <= 0) maxSize = DEFAULT_MAX_INPUT_SIZE;
 	if (input.length > maxSize) throw new Error(`${converterName}: input exceeds maximum allowed size of ${maxSize} characters`);
 }
 /**
@@ -487,35 +488,15 @@ function normalizeStatus$1(status) {
 	}[status] || "notReviewed";
 }
 /**
-* Compute effectiveStatus from impact and v2 results.
-* Implements InSpec enhanced outcomes precedence:
-*   impact=0 → notApplicable
-*   error > failed > passed > notApplicable > notReviewed
-*
-* See docs/design/status-determination.md for full specification.
+* Compute effectiveStatus from impact and v2 results via the canonical
+* worst-wins ordering in @mitre/hdf-utilities (impact=0 → notApplicable;
+* error > failed > passed > notApplicable > notReviewed).
 */
-function computeEffectiveStatus(impact, results) {
-	if (impact === 0) return "notApplicable";
-	if (results.length === 0) return "notReviewed";
-	let hasFailed = false;
-	let hasPassed = false;
-	let hasNotApplicable = false;
-	for (const r of results) switch (r.status) {
-		case "error": return "error";
-		case "failed":
-			hasFailed = true;
-			break;
-		case "passed":
-			hasPassed = true;
-			break;
-		case "notApplicable":
-			hasNotApplicable = true;
-			break;
-	}
-	if (hasFailed) return "failed";
-	if (hasPassed) return "passed";
-	if (hasNotApplicable) return "notApplicable";
-	return "notReviewed";
+function computeEffectiveStatus$1(impact, results) {
+	return computeEffectiveStatus({
+		impact,
+		resultStatuses: results.map((r) => r.status)
+	});
 }
 /**
 * Convert v1.0 result to v2.0 result.
@@ -613,7 +594,7 @@ function convertControl(v1Control) {
 	if (v1Control.source_location !== void 0) v2Req.sourceLocation = v1Control.source_location;
 	if (v1Control.status !== void 0) v2Req.effectiveStatus = normalizeStatus$1(v1Control.status);
 	if (v1Control.results && Array.isArray(v1Control.results)) v2Req.results = v1Control.results.map(convertResult);
-	if (!v2Req.effectiveStatus) v2Req.effectiveStatus = computeEffectiveStatus(v1Control.impact, v2Req.results ?? []);
+	if (!v2Req.effectiveStatus) v2Req.effectiveStatus = computeEffectiveStatus$1(v1Control.impact, v2Req.results ?? []);
 	v2Req.severity = tagSeverityToSeverity(v1Control.tags?.severity) ?? impactToSeverity(v1Control.impact);
 	const rawNist = v1Control.tags?.nist;
 	if (Array.isArray(rawNist)) {
@@ -753,7 +734,47 @@ function convertProfile(v1Profile) {
 	if (v1Profile.depends?.length) v2Baseline.depends = v1Profile.depends.map(convertDependency);
 	return v2Baseline;
 }
-function convertV1ToV2(v1Data) {
+/** Parse the leading major-version integer; -1 when the string has none. */
+function inspecMajor(version) {
+	const major = /^(\d+)/.exec(version ?? "")?.[1];
+	return major !== void 0 ? parseInt(major, 10) : -1;
+}
+/**
+* Map the source's top-level version to tool metadata. A genuine InSpec
+* exec-json run carries the InSpec CLI version (major >= 2 for every modern
+* release), so those flip the tool to InSpec/exec-json. A legacy HDF v1
+* document with no InSpec provenance (e.g. a bare "1.0.0" format marker) keeps
+* the historical label.
+*/
+function toolIdentity(version) {
+	if (inspecMajor(version) >= 2) return {
+		name: "InSpec",
+		version,
+		format: "exec-json"
+	};
+	return { name: "Heimdall Data Format v1" };
+}
+/**
+* The assessment's execution time for the top-level timestamp. An explicit
+* source timestamp wins; otherwise it is the latest (last-observed) result
+* start_time — the assessment's effective as-of instant, the value
+* `hdf events derive` consumes. Returns undefined only when the source carries
+* no usable time; never the wall clock. Canonical trimmed-UTC form.
+*/
+function documentTimestamp(v1Data) {
+	if (v1Data.timestamp) {
+		const t = parseTimestamp(v1Data.timestamp);
+		if (t) return formatTimestamp(t);
+	}
+	let latest;
+	for (const profile of v1Data.profiles || []) for (const control of profile.controls || []) for (const result of control.results || []) {
+		if (!result.start_time) continue;
+		const t = parseTimestamp(result.start_time);
+		if (t && (!latest || t > latest)) latest = t;
+	}
+	return latest ? formatTimestamp(latest) : void 0;
+}
+function convertV1ToV2(v1Data, converterVersion = "1.0.0") {
 	validateInputSize(JSON.stringify(v1Data), "legacyhdf-to-hdf");
 	const v2 = {
 		baselines: (v1Data.profiles || []).map(convertProfile),
@@ -770,9 +791,13 @@ function convertV1ToV2(v1Data) {
 		}
 		v2.components = [component];
 	}
-	if (v1Data.generator) v2.generator = v1Data.generator;
-	v2.tool = { name: "Heimdall Data Format v1" };
-	if (v1Data.timestamp) v2.timestamp = v1Data.timestamp;
+	v2.generator = v1Data.generator ?? {
+		name: "legacyhdf-to-hdf",
+		version: converterVersion
+	};
+	v2.tool = toolIdentity(v1Data.version);
+	const timestamp = documentTimestamp(v1Data);
+	if (timestamp) v2.timestamp = timestamp;
 	const knownV1Fields = /* @__PURE__ */ new Set([
 		"version",
 		"platform",
@@ -801,6 +826,63 @@ function isHDFV1(data) {
 	return typeof obj.version === "string" && Array.isArray(obj.profiles) && typeof obj.platform === "object" && obj.platform !== null;
 }
 //#endregion
+//#region shared/typescript/cvss.ts
+/**
+* Returns the schema CVSS Version enum for a vector-string prefix (CVSS:2.0/,
+* CVSS:3.0/, CVSS:4.0/). An absent or unrecognized prefix (including CVSS:3.1/)
+* defaults to 3.1 — the version modern scanners emit most often.
+*/
+function cvssVersionFromVector(vector) {
+	if (!vector) return Version.The31;
+	if (vector.startsWith("CVSS:2.0/")) return Version.The20;
+	if (vector.startsWith("CVSS:3.0/")) return Version.The30;
+	if (vector.startsWith("CVSS:4.0/")) return Version.The40;
+	return Version.The31;
+}
+/**
+* Maps a bare CVSS version number ("2.0"/"3.0"/"3.1"/"4.0") — as emitted in a
+* structured version field rather than a vector prefix — to the schema Version
+* enum. Unrecognized values default to 3.1.
+*/
+function cvssVersionFromString(v) {
+	switch (v) {
+		case "2.0": return Version.The20;
+		case "3.0": return Version.The30;
+		case "4.0": return Version.The40;
+		default: return Version.The31;
+	}
+}
+/**
+* Maps a CVSS base/computed score to the schema CVSSSeverity enum via the shared
+* band thresholds in cvssScoreToSeverity. Scores below the low threshold (and
+* non-finite inputs, per cvssScoreToSeverity) map to the "none" band.
+*/
+function cvssSeverityFromScore(score) {
+	switch (cvssScoreToSeverity(score)) {
+		case "critical": return CVSSSeverity.Critical;
+		case "high": return CVSSSeverity.High;
+		case "medium": return CVSSSeverity.Medium;
+		case "low": return CVSSSeverity.Low;
+		default: return CVSSSeverity.None;
+	}
+}
+/**
+* Assembles a Cvss from the base-metric fields a converter provides. version is
+* always set. baseScore (and its derived baseSeverity) is set only when a finite
+* number is supplied; baseVector and source are set only when non-empty. Consumers
+* needing threat/environmental/computed enrichment set those fields on the result.
+*/
+function buildCvss$2(input) {
+	const cv = { version: input.version };
+	if (typeof input.baseScore === "number" && Number.isFinite(input.baseScore)) {
+		cv.baseScore = input.baseScore;
+		cv.baseSeverity = cvssSeverityFromScore(input.baseScore);
+	}
+	if (input.baseVector) cv.baseVector = input.baseVector;
+	if (input.source) cv.source = input.source;
+	return cv;
+}
+//#endregion
 //#region converters/asff-to-hdf/typescript/converter.ts
 /**
 * AWS Security Finding Format (ASFF) to HDF converter.
@@ -865,14 +947,17 @@ function severityLabelToImpact(label) {
 /**
 * findingImpact derives a 0.0–1.0 impact. Suppressed findings are forced to 0.
 * Security Hub's INFORMATIONAL is up-graded to MEDIUM (Security Hub over-marks
-* findings INFORMATIONAL without context).
+* findings INFORMATIONAL without context). FindingProviderFields.Severity — the
+* provider's own rating — is preferred over the top-level Severity, which
+* Security Hub may overwrite on ingest.
 */
 function findingImpact(f) {
 	if (f.Workflow?.Status === "SUPPRESSED") return 0;
-	let label = f.Severity?.Label;
+	const sev = f.FindingProviderFields?.Severity?.Label ? f.FindingProviderFields.Severity : f.Severity;
+	let label = sev?.Label;
 	if (isSecurityHub(f) && (label ?? "").toUpperCase() === "INFORMATIONAL") label = "MEDIUM";
 	if (label) return severityLabelToImpact(label);
-	if (typeof f.Severity?.Normalized === "number") return f.Severity.Normalized / 100;
+	if (typeof sev?.Normalized === "number") return sev.Normalized / 100;
 	return 0;
 }
 function productArnParts(arn) {
@@ -1037,6 +1122,37 @@ function vulnerabilitySummary(f) {
 		return parts.join("; ");
 	}).join("\n");
 }
+/**
+* Assembles requirement.cvss[] from a finding's ASFF Vulnerabilities[]. Each Cvss
+* entry carrying a BaseScore becomes one structured Cvss via the shared builder.
+* ASFF's Cvss shape has no vector string, so only version, score, and source map;
+* an entry without a BaseScore contributes nothing.
+*/
+function vulnCvss(f) {
+	const out = [];
+	for (const v of f.Vulnerabilities ?? []) for (const c of v.Cvss ?? []) {
+		if (typeof c.BaseScore !== "number") continue;
+		out.push(buildCvss$2({
+			version: cvssVersionFromString(c.Version),
+			baseScore: c.BaseScore,
+			source: c.Source
+		}));
+	}
+	return out;
+}
+/**
+* Collects the CVE ids a finding's Vulnerabilities[] carry (dedup, first-seen
+* order) for tags.cve. ASFF stores the CVE in Vulnerabilities[].Id.
+*/
+function vulnCves(f) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const v of f.Vulnerabilities ?? []) if (v.Id && !seen.has(v.Id)) {
+		seen.add(v.Id);
+		out.push(v.Id);
+	}
+	return out;
+}
 function trivyMessage(f) {
 	const o = f.Resources?.[0]?.Details?.Other;
 	if (!o) return "";
@@ -1076,10 +1192,15 @@ function buildRequirement$17(id, group) {
 	});
 	const nist = nistTags$1(group);
 	const tags = nist.length > 0 ? buildNistCciTags(nist, nistToCci(nist)) : {};
+	const cves = vulnCves(primary);
+	if (cves.length > 0) tags.cve = cves;
 	const results = group.map(buildResult$2);
 	const req = createRequirement(id, primary.Title ?? "", descriptions, impact, results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
+	const cvss = vulnCvss(primary);
+	if (cvss.length > 0) req.cvss = cvss;
+	req.code = JSON.stringify(primary, null, 2);
 	const refs = [];
 	if (primary.SourceUrl) refs.push({ url: primary.SourceUrl });
 	const seen = /* @__PURE__ */ new Set();
@@ -1135,10 +1256,7 @@ async function convertAsffToHdf(input, converterVersion = "1.0.0") {
 			name: "asff-to-hdf",
 			version: converterVersion
 		},
-		tool: {
-			name: "AWS Security Finding Format",
-			format: "JSON"
-		},
+		tool: { name: "AWS Security Finding Format" },
 		timestamp: /* @__PURE__ */ new Date()
 	};
 	if (accounts.length > 0) {
@@ -1240,6 +1358,8 @@ function convertResultGroup(ruleId, rule, sarifResults) {
 	const controlType = deriveControlTypeFromTags(nistControls);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const snippet = (firstResult.locations ?? []).map((loc) => loc.physicalLocation?.region?.snippet?.text).find((text) => Boolean(text));
+	if (snippet) req.code = snippet;
 	const seenKeys = /* @__PURE__ */ new Set();
 	const packages = [];
 	for (const sr of sarifResults) {
@@ -1494,7 +1614,6 @@ async function convertJunitToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "junit-to-hdf",
 		converterVersion,
 		toolName: "JUnit XML",
-		toolFormat: "XML",
 		baselines: [createMinimalBaseline(name, requirements, { resultsChecksum: await inputChecksum(input) })],
 		components: [{
 			type: TargetType.Application,
@@ -1546,7 +1665,7 @@ function testCaseToRequirement(tc, scanTime) {
 	const { status, message } = resolveStatus(tc);
 	const result = {
 		status,
-		codeDesc: buildCodeDesc$9(tc),
+		codeDesc: buildCodeDesc$10(tc),
 		startTime: scanTime
 	};
 	if (message !== void 0) result.message = message;
@@ -1603,7 +1722,7 @@ function buildFailureMessage(message, typeName, body) {
 	if (body) result += "\n" + decodeXmlEntities$5(body);
 	return result;
 }
-function buildCodeDesc$9(tc) {
+function buildCodeDesc$10(tc) {
 	if (tc.classname) return `${decodeXmlEntities$5(tc.classname)} :: ${decodeXmlEntities$5(tc.name)}`;
 	return decodeXmlEntities$5(tc.name);
 }
@@ -1615,6 +1734,25 @@ function noFindingsTarget(baselineName, suites) {
 //#endregion
 //#region converters/xccdf-results-to-hdf/typescript/converter.ts
 /**
+* Map XCCDF's severity vocabulary (unknown|info|low|medium|high) onto HDF's
+* (critical|high|medium|low|informational). Casting the raw attribute straight to
+* Severity emitted schema-invalid documents, since XCCDF "unknown" and "info" are
+* not HDF severities.
+*
+* "unknown" states that severity was not determined. HDF cannot express that, so
+* emit no severity at all rather than assert "informational", which would silently
+* downgrade a rule whose severity is merely unstated.
+*/
+function xccdfSeverityToHdf(severity) {
+	switch (severity.toLowerCase()) {
+		case "high": return Severity.High;
+		case "medium": return Severity.Medium;
+		case "low": return Severity.Low;
+		case "info": return Severity.Informational;
+		default: return;
+	}
+}
+/**
 * Walk the Group tree depth-first, collecting every rule at any depth. Rules may
 * sit directly on a Group that also has nested Groups.
 */
@@ -1859,6 +1997,12 @@ function ruleResultToRequirement(rr, ruleIndex, scanTime) {
 		label: "default",
 		data: stripHTML(extractVulnDiscussion(extractText(ruleDef?.description)))
 	}];
+	const check = selectCheck(ruleDef?.check);
+	const checkContent = extractCheckContent(check);
+	if (checkContent) descriptions.push({
+		label: "check",
+		data: stripHTML(checkContent)
+	});
 	const fixtext = extractFixtext(ruleDef?.fixtext);
 	if (fixtext) descriptions.push({
 		label: "fix",
@@ -1875,6 +2019,10 @@ function ruleResultToRequirement(rr, ruleIndex, scanTime) {
 	const tags = buildCciNistTags(extractCCIs([...rr.ident ?? [], ...ruleDef?.ident ?? []]));
 	const nistTags = tags["nist"];
 	const req = createRequirement(id, title, descriptions, impact, [result], { tags });
+	const code = buildCheckCode(check);
+	if (code) req.code = code;
+	const hdfSeverity = xccdfSeverityToHdf(severity);
+	if (hdfSeverity) req.severity = hdfSeverity;
 	const controlType = deriveControlTypeFromTags(nistTags);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
@@ -1923,6 +2071,35 @@ function decodeXmlEntities$4(s) {
 		return name !== void 0 ? NAMED_ENTITIES$4[name] ?? match : match;
 	});
 }
+/**
+* Extract plain text from a field that may be a string or {#text: string}.
+*/
+/**
+* A rule can carry several <check> elements (SSG emits SCE, OVAL and OCIL for the
+* same rule). Go decodes <check> into one struct field, so encoding/xml overwrites
+* it and the last element wins; match that or the two languages disagree.
+*/
+function checkPriority(system) {
+	const s = system ?? "";
+	if (s.includes("oval.mitre.org")) return 0;
+	if (s.includes("open-scap.org") || s.includes("/SCE")) return 1;
+	if (s.includes("ocil")) return 2;
+	return 3;
+}
+function selectCheck(check) {
+	if (check === void 0) return void 0;
+	const checks = Array.isArray(check) ? check : [check];
+	let best;
+	let bestPri = Infinity;
+	for (const c of checks) {
+		const p = checkPriority(c.system);
+		if (p < bestPri) {
+			best = c;
+			bestPri = p;
+		}
+	}
+	return best;
+}
 function extractText(field) {
 	if (field === void 0 || field === null) return "";
 	if (typeof field === "string") return decodeXmlEntities$4(field);
@@ -1945,6 +2122,67 @@ function extractFixtext(field) {
 	return decodeXmlEntities$4(field["#text"] ?? "");
 }
 /**
+* Extract check-content text from a check element.
+*/
+function extractCheckContent(check) {
+	if (!check) return "";
+	const cc = check["check-content"];
+	if (!cc) return "";
+	if (typeof cc === "string") return decodeXmlEntities$4(cc);
+	if (Array.isArray(cc)) {
+		const first = cc[0];
+		if (typeof first === "string") return decodeXmlEntities$4(first);
+		if (first && typeof first === "object" && "#text" in first) return decodeXmlEntities$4(first["#text"] ?? "");
+		return "";
+	}
+	return decodeXmlEntities$4(cc["#text"] ?? "");
+}
+/**
+* Extract the OVAL/SCE check-content-ref (name + href) from a check element.
+* check-content-ref is not forced into an array, so handle both single and
+* (rare) multi cases, taking the first.
+*/
+function extractCheckContentRef(check) {
+	if (!check) return {
+		name: "",
+		href: ""
+	};
+	let ref = check["check-content-ref"];
+	if (Array.isArray(ref)) ref = ref[0];
+	if (!ref || typeof ref !== "object") return {
+		name: "",
+		href: ""
+	};
+	return {
+		name: ref.name ?? "",
+		href: ref.href ?? ""
+	};
+}
+/**
+* Render a rule's selected <check> as the indented-JSON blob carried in
+* requirement.code — the automated-check logic (system + OVAL/SCE definition
+* reference + any inline content). Returns '' when the check is empty so the
+* caller leaves code unset rather than fabricating one. Key order and the
+* escape-free JSON.stringify mirror the Go buildCheckCode for byte parity.
+*/
+function buildCheckCode(check) {
+	if (!check) return "";
+	const system = check.system ?? "";
+	const ref = extractCheckContentRef(check);
+	const content = extractCheckContent(check).trim();
+	if (!system && !ref.name && !ref.href && !content) return "";
+	const code = {};
+	if (system) code.system = system;
+	if (ref.name || ref.href) {
+		const refObj = {};
+		if (ref.name) refObj.name = ref.name;
+		if (ref.href) refObj.href = ref.href;
+		code.checkContentRef = refObj;
+	}
+	if (content) code.checkContent = content;
+	return JSON.stringify(code, null, 2);
+}
+/**
 * Extract the VulnDiscussion text from an XCCDF description that contains
 * embedded XML like `<VulnDiscussion>...</VulnDiscussion>`. If no
 * VulnDiscussion tag is found, returns the original text.
@@ -2759,6 +2997,19 @@ function synthesizePurl(ecosystem, name, version) {
 	if (ecosystem === Ecosystem.Generic) return void 0;
 	return `pkg:${ecosystem}/${name}@${version}`;
 }
+/**
+* Assembles the structured cvss[] entry for a Snyk vulnerability from its
+* cvssScore (base score) and CVSSv3 (base vector, carrying a CVSS:3.1/ prefix).
+* Returns [] when the source carries neither so the field is omitted.
+*/
+function buildSnykCvss(vuln) {
+	if (!vuln.cvssScore && !vuln.CVSSv3) return [];
+	return [buildCvss$2({
+		version: cvssVersionFromVector(vuln.CVSSv3),
+		baseScore: vuln.cvssScore,
+		baseVector: vuln.CVSSv3
+	})];
+}
 function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const rep = vulns[0];
 	const cweIDs = rep.identifiers.CWE ?? [];
@@ -2767,8 +3018,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 		nist,
 		cci: nistToCci(nist)
 	};
-	if (cweIDs.length > 0) tags["cweid"] = cweIDs;
-	if (rep.identifiers.CVE && rep.identifiers.CVE.length > 0) tags["cveid"] = rep.identifiers.CVE;
+	if (rep.identifiers.CVE && rep.identifiers.CVE.length > 0) tags["cve"] = rep.identifiers.CVE;
 	if (rep.identifiers.GHSA && rep.identifiers.GHSA.length > 0) tags["ghsaid"] = rep.identifiers.GHSA;
 	const descriptions = [{
 		label: "default",
@@ -2786,6 +3036,9 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const cvss = buildSnykCvss(rep);
+	if (cvss.length > 0) req.cvss = cvss;
+	if (cweIDs.length > 0) req.cwe = cweIDs;
 	const name = rep.packageName ?? rep.moduleName;
 	const version = rep.version;
 	if (name && version) {
@@ -2861,7 +3114,6 @@ async function convertSnykToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "snyk-to-hdf",
 		converterVersion,
 		toolName: "Snyk",
-		toolFormat: "JSON",
 		baselines,
 		components: [{
 			name: targetName,
@@ -2920,7 +3172,7 @@ function getReferences(vuln, relatedVulns) {
 	}
 	return Array.from(refs);
 }
-function buildCodeDesc$8(match) {
+function buildCodeDesc$9(match) {
 	const parts = [];
 	parts.push(`Package: ${match.artifact.name}@${match.artifact.version}`);
 	if (match.artifact.type) parts.push(`Type: ${match.artifact.type}`);
@@ -2934,35 +3186,16 @@ function buildCodeDesc$8(match) {
 	}
 	return parts.join(" | ");
 }
-function cvssVersionToSchema(v) {
-	switch (v) {
-		case "2.0": return Version.The20;
-		case "3.0": return Version.The30;
-		case "4.0": return Version.The40;
-		default: return Version.The31;
-	}
-}
-function cvssBandSeverity(score) {
-	switch (cvssScoreToSeverity(score)) {
-		case "critical": return CVSSSeverity.Critical;
-		case "high": return CVSSSeverity.High;
-		case "medium": return CVSSSeverity.Medium;
-		case "low": return CVSSSeverity.Low;
-		default: return CVSSSeverity.None;
-	}
-}
-function buildCvssEntries$1(vuln) {
+function buildCvssEntries$5(vuln) {
 	if (!vuln.cvss || vuln.cvss.length === 0) return;
 	const entries = [];
 	for (const c of vuln.cvss) {
-		const entry = { version: cvssVersionToSchema(c.version) };
-		if (c.vector) entry.baseVector = c.vector;
-		const score = c.metrics?.baseScore;
-		if (typeof score === "number" && Number.isFinite(score)) {
-			entry.baseScore = score;
-			entry.baseSeverity = cvssBandSeverity(score);
-		}
-		if (vuln.id) entry.source = vuln.id;
+		const entry = buildCvss$2({
+			version: cvssVersionFromString(c.version),
+			baseScore: c.metrics?.baseScore,
+			baseVector: c.vector,
+			source: vuln.id
+		});
 		if (entry.baseVector === void 0 && entry.baseScore === void 0) continue;
 		entries.push(entry);
 	}
@@ -2996,10 +3229,10 @@ function buildAffectedPackages(match) {
 	if (fix && fix.state === "fixed" && fix.versions && fix.versions.length > 0 && fix.versions[0]) pkg.fixedInVersion = fix.versions[0];
 	return [pkg];
 }
-const CWE_ID_PATTERN = /^CWE-[1-9]\d*$/;
+const CWE_ID_PATTERN$1 = /^CWE-[1-9]\d*$/;
 function extractCwe(raw) {
 	if (!raw || raw.length === 0) return void 0;
-	const out = raw.filter((c) => CWE_ID_PATTERN.test(c));
+	const out = raw.filter((c) => CWE_ID_PATTERN$1.test(c));
 	return out.length === 0 ? void 0 : out;
 }
 function buildEpss$2(entries) {
@@ -3041,7 +3274,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	const message = messageParts.join(" ");
 	const result = {
 		status,
-		codeDesc: buildCodeDesc$8(match),
+		codeDesc: buildCodeDesc$9(match),
 		message,
 		startTime
 	};
@@ -3050,6 +3283,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 		id: isIgnored ? `Grype-Ignored-Match/${cveId}` : `Grype/${cveId}`,
 		title: `Grype found a vulnerability to ${cveId} in ${targetName}`,
 		impact,
+		code: JSON.stringify(match, null, 2),
 		results: [result],
 		tags,
 		descriptions: [
@@ -3071,7 +3305,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	};
 	const controlType = deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	if (controlType !== void 0) requirement.controlType = controlType;
-	const cvss = buildCvssEntries$1(vuln);
+	const cvss = buildCvssEntries$5(vuln);
 	if (cvss) requirement.cvss = cvss;
 	requirement.affectedPackages = buildAffectedPackages(match);
 	const cwe = extractCwe(vuln.cwe);
@@ -3179,26 +3413,15 @@ function findingId(f) {
 function cveList(f) {
 	return (f.vulnerability_ids ?? []).map((v) => v.vulnerability_id).filter(Boolean);
 }
-function cvssBand(score) {
-	switch (cvssScoreToSeverity(score)) {
-		case "critical": return CVSSSeverity.Critical;
-		case "high": return CVSSSeverity.High;
-		case "medium": return CVSSSeverity.Medium;
-		case "low": return CVSSSeverity.Low;
-		default: return CVSSSeverity.None;
-	}
-}
 function buildCvss$1(f) {
 	const out = [];
 	const add = (version, vector, score) => {
 		if ((score === void 0 || score === null) && !vector) return;
-		const entry = { version };
-		if (score !== void 0 && score !== null) {
-			entry.baseScore = score;
-			entry.baseSeverity = cvssBand(score);
-		}
-		if (vector) entry.baseVector = vector;
-		out.push(entry);
+		out.push(buildCvss$2({
+			version,
+			baseScore: score,
+			baseVector: vector
+		}));
 	};
 	add(Version.The31, f.cvssv3, f.cvssv3_score);
 	add(Version.The40, f.cvssv4, f.cvssv4_score);
@@ -3241,6 +3464,8 @@ function codeDesc(f) {
 function convertFinding(f) {
 	const nist = nistTags(f);
 	const tags = buildNistCciTags(nist, nistToCci(nist), triageTags(f));
+	const cves = cveList(f);
+	if (cves.length > 0) tags.cve = cves;
 	const result = {
 		status: deriveStatus(f),
 		codeDesc: codeDesc(f),
@@ -3260,6 +3485,7 @@ function convertFinding(f) {
 	const epss = buildEpss$1(f);
 	if (epss) req.epss = epss;
 	if (f.cwe && f.cwe > 0) req.cwe = [`CWE-${f.cwe}`];
+	req.code = JSON.stringify(f, null, 2);
 	const firstRisk = f.accepted_risks?.[0];
 	if (f.risk_accepted && firstRisk) {
 		req.statusOverrides = [buildWaiverOverride(firstRisk)];
@@ -3468,7 +3694,7 @@ function convertReportItemToRequirement(item, host) {
 	if (controlType !== void 0) req.controlType = controlType;
 	if (verificationMethod !== void 0) req.verificationMethod = verificationMethod;
 	if (!isCompliance) {
-		const cvssEntries = buildCvssEntries(item);
+		const cvssEntries = buildCvssEntries$4(item);
 		if (cvssEntries.length > 0) req.cvss = cvssEntries;
 		const cweIDs = buildCweIDs(item);
 		if (cweIDs.length > 0) req.cwe = cweIDs;
@@ -3482,7 +3708,7 @@ function convertReportItemToRequirement(item, host) {
 * the schema models cvss as a multi-entry array (Nessus emits one entry per
 * item; multi-vendor convergence may yield more).
 */
-function buildCvssEntries(item) {
+function buildCvssEntries$4(item) {
 	const source = (item.cvss_score_source || "").trim();
 	if (!source || !CVE_SOURCE_RE.test(source)) return [];
 	const hasV3 = !!(item.cvss3_vector || item.cvss3_base_score);
@@ -3513,15 +3739,13 @@ function buildCvssEntries(item) {
 	if (baseVector) entry.baseVector = baseVector;
 	if (baseScore !== void 0) {
 		entry.baseScore = baseScore;
-		const baseSeverity = mapCvssSeverity(baseScore);
-		if (baseSeverity !== void 0) entry.baseSeverity = baseSeverity;
+		entry.baseSeverity = cvssSeverityFromScore(baseScore);
 	}
 	if (threatVector !== void 0 && threatVector !== "") entry.threatVector = threatVector;
 	if (threatScore !== void 0) {
 		entry.threatScore = threatScore;
 		entry.computedScore = threatScore;
-		const computedSeverity = mapCvssSeverity(threatScore);
-		if (computedSeverity !== void 0) entry.computedSeverity = computedSeverity;
+		entry.computedSeverity = cvssSeverityFromScore(threatScore);
 	}
 	return [entry];
 }
@@ -3552,16 +3776,6 @@ function parseFloatOrUndef(s) {
 	const f = Number.parseFloat(s);
 	return Number.isFinite(f) ? f : void 0;
 }
-function mapCvssSeverity(score) {
-	switch (cvssScoreToSeverity(score)) {
-		case "critical": return CVSSSeverity.Critical;
-		case "high": return CVSSSeverity.High;
-		case "medium": return CVSSSeverity.Medium;
-		case "low": return CVSSSeverity.Low;
-		case "none": return CVSSSeverity.None;
-		default: return;
-	}
-}
 /**
 * Extract CWE IDs from a ReportItem's <cwe> elements. Nessus emits bare
 * numeric IDs (e.g. <cwe>200</cwe>); occasionally pipe-separated or prefixed
@@ -4048,7 +4262,7 @@ function buildCheckText(rule) {
 	}
 	return parts.join("<br/>");
 }
-function buildCodeDesc$7(q) {
+function buildCodeDesc$8(q) {
 	return `config_rule_name: ${q.ConfigRuleName}, resource_type: ${q.ResourceType}, resource_id: ${q.ResourceId}`;
 }
 function buildResultMessage(codeDesc, annotation, status) {
@@ -4065,7 +4279,7 @@ function computeRunTime(invoked, recorded) {
 function buildResult(r) {
 	const q = r.EvaluationResultIdentifier.EvaluationResultQualifier;
 	const status = mapComplianceStatus(r.ComplianceType);
-	const codeDesc = buildCodeDesc$7(q);
+	const codeDesc = buildCodeDesc$8(q);
 	return createResult(status, buildResultMessage(codeDesc, r.Annotation, status), {
 		codeDesc,
 		startTime: (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
@@ -4193,12 +4407,32 @@ function checkToResult(check, scanTime) {
 	});
 }
 /**
+* Renders checkov's code_block ([[lineno, "source"], ...]) into a readable,
+* line-numbered source snippet for the Heimdall CODE tab. Returns undefined when
+* the code_block is absent or not an array so requirement.code is omitted.
+*/
+function renderCodeBlock(codeBlock) {
+	if (!Array.isArray(codeBlock)) return void 0;
+	const lines = [];
+	for (const entry of codeBlock) {
+		if (!Array.isArray(entry) || entry.length < 2) continue;
+		const lineno = entry[0];
+		const src = typeof entry[1] === "string" ? entry[1] : "";
+		const trimmed = src.endsWith("\n") ? src.slice(0, -1) : src;
+		lines.push(`${lineno} ${trimmed}`);
+	}
+	return lines.length ? lines.join("\n") : void 0;
+}
+/**
 * Converts a group of checks sharing a check_id into one EvaluatedRequirement.
 */
-function buildRequirement$14(checkId, checks, scanTime) {
+function buildRequirement$14(checkId, group, scanTime) {
+	const checks = group.map((c) => c.check);
 	const rep = checks[0];
 	const impact = getImpact$8(rep.severity);
 	const tags = { nist: [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS] };
+	const checkTypes = [...new Set(group.map((c) => c.checkType).filter((t) => t !== ""))].sort();
+	if (checkTypes.length > 0) tags["check_type"] = checkTypes;
 	const descriptions = [{
 		label: "default",
 		data: rep.check_name
@@ -4210,6 +4444,8 @@ function buildRequirement$14(checkId, checks, scanTime) {
 	const results = checks.map((check) => checkToResult(check, scanTime));
 	const req = createRequirement(checkId, rep.check_name, descriptions, impact, results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const code = renderCodeBlock(rep.code_block);
+	if (code !== void 0) req.code = code;
 	const controlType = deriveControlTypeFromTags([...DEFAULT_STATIC_ANALYSIS_NIST_TAGS]);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
@@ -4246,18 +4482,23 @@ async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
 	for (const report of reports) {
 		checkTypes.push(report.check_type);
 		if (!version && report.summary.checkov_version) version = report.summary.checkov_version;
-		allChecks.push(...report.results.passed_checks);
-		allChecks.push(...report.results.failed_checks);
-		allChecks.push(...report.results.skipped_checks);
+		for (const check of [
+			...report.results.passed_checks,
+			...report.results.failed_checks,
+			...report.results.skipped_checks
+		]) allChecks.push({
+			check,
+			checkType: report.check_type
+		});
 	}
 	const { items: limitedChecks, truncated } = limitArray(allChecks);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedChecks.length} check items (original: ${allChecks.length})`);
 	const groups = /* @__PURE__ */ new Map();
-	for (const check of limitedChecks) {
-		const existing = groups.get(check.check_id);
-		if (existing) existing.push(check);
-		else groups.set(check.check_id, [check]);
+	for (const entry of limitedChecks) {
+		const existing = groups.get(entry.check.check_id);
+		if (existing) existing.push(entry);
+		else groups.set(entry.check.check_id, [entry]);
 	}
 	const requirements = [];
 	for (const [checkId, checks] of groups) requirements.push(buildRequirement$14(checkId, checks, scanTime));
@@ -4272,7 +4513,6 @@ async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
 		converterVersion,
 		toolName: "Checkov",
 		toolVersion: version,
-		toolFormat: format,
 		baselines: [baseline],
 		timestamp: scanTime
 	});
@@ -4288,6 +4528,13 @@ const IMPACT_MAPPING$6 = {
 	LOW: .3
 };
 /**
+* Returns the first-class CWE identifiers for an issue in "CWE-N" form,
+* or an empty array when the issue carries no CWE.
+*/
+function cweIds(issue) {
+	return issue.cwe.id ? [`CWE-${issue.cwe.id}`] : [];
+}
+/**
 * Returns true if the issue is suppressed (via nosec flag or suppressions list).
 */
 function isSuppressed(issue) {
@@ -4324,13 +4571,7 @@ function buildRequirement$13(ruleId, issues, scanTime) {
 	const rep = issues[0];
 	const impact = IMPACT_MAPPING$6[rep.severity.toUpperCase()] ?? .5;
 	const nist = mapCWEToNIST([rep.cwe.id], DEFAULT_REMEDIATION_NIST_TAGS$1);
-	const tags = {
-		nist,
-		cwe: {
-			id: rep.cwe.id,
-			url: rep.cwe.url
-		}
-	};
+	const tags = { nist };
 	const results = issues.map((issue) => issueToResult(issue, scanTime));
 	const descriptions = [{
 		label: "default",
@@ -4340,6 +4581,9 @@ function buildRequirement$13(ruleId, issues, scanTime) {
 		data: `CWE-${rep.cwe.id}: ${rep.cwe.url}`
 	}];
 	const req = createRequirement(ruleId, rep.details, descriptions, impact, results, { tags });
+	const cwe = cweIds(rep);
+	if (cwe.length > 0) req.cwe = cwe;
+	req.code = rep.code;
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -4392,7 +4636,7 @@ function buildNistTags$2(niktoId) {
 	if (control) return [control];
 	return [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
 }
-function buildCodeDesc$6(vuln) {
+function buildCodeDesc$7(vuln) {
 	const parts = [];
 	if (vuln.url) parts.push(`URL: ${vuln.url}`);
 	if (vuln.method) parts.push(`Method: ${vuln.method}`);
@@ -4403,7 +4647,7 @@ function convertVulnToRequirement(vuln) {
 	const cciTags = nistToCci(nistTags);
 	const result = {
 		status: ResultStatus.Failed,
-		codeDesc: buildCodeDesc$6(vuln),
+		codeDesc: buildCodeDesc$7(vuln),
 		startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	};
 	const extras = {};
@@ -4446,7 +4690,7 @@ async function convertNiktoToHdf(input, converterVersion = "unknown") {
 		const req = convertVulnToRequirement(primary);
 		if (vulns.length > 1) for (let i = 1; i < vulns.length; i++) req.results.push({
 			status: ResultStatus.Failed,
-			codeDesc: buildCodeDesc$6(vulns[i]),
+			codeDesc: buildCodeDesc$7(vulns[i]),
 			startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 		});
 		requirements.push(req);
@@ -4460,7 +4704,6 @@ async function convertNiktoToHdf(input, converterVersion = "unknown") {
 		generatorName: "nikto-to-hdf",
 		converterVersion,
 		toolName: "Nikto",
-		toolFormat: "JSON",
 		baselines: [createMinimalBaseline(targetName, requirements, {
 			resultsChecksum,
 			title: `Nikto Target: ${targetName}`,
@@ -4493,7 +4736,13 @@ function buildNistTags$1(cweid) {
 	}
 	return [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
 }
-function buildCodeDesc$5(instance) {
+function buildCwe(cweid) {
+	if (!cweid || cweid === "0") return;
+	const cweNum = parseInt(cweid, 10);
+	if (isNaN(cweNum)) return;
+	return [`CWE-${cweNum}`];
+}
+function buildCodeDesc$6(instance) {
 	const parts = [];
 	if (instance.uri) parts.push(`URI: ${instance.uri}`);
 	if (instance.method) parts.push(`Method: ${instance.method}`);
@@ -4501,6 +4750,21 @@ function buildCodeDesc$5(instance) {
 	if (instance.evidence) parts.push(`Evidence: ${instance.evidence}`);
 	return parts.join(" | ");
 }
+function representativeInstance(instances) {
+	if (!instances || instances.length === 0) return;
+	return instances.find((inst) => inst.attack) ?? instances[0];
+}
+function buildRequirementCode$1(alert) {
+	const inst = representativeInstance(alert.instances);
+	if (!inst) return;
+	const parts = [];
+	const requestLine = `${inst.method ?? ""} ${inst.uri ?? ""}`.trim();
+	if (requestLine) parts.push(requestLine);
+	if (inst.param) parts.push(`Param: ${inst.param}`);
+	if (inst.attack) parts.push(`Attack: ${inst.attack}`);
+	if (parts.length === 0) return;
+	return parts.join("\n");
+}
 function buildCheckDescription(alert) {
 	const parts = [];
 	if (alert.solution) {
@@ -4513,33 +4777,11 @@ function buildCheckDescription(alert) {
 	}
 	return parts.join("\n");
 }
-function selectSite(sites) {
-	if (sites.length === 0) return void 0;
-	let best = sites[0];
-	for (let i = 1; i < sites.length; i++) {
-		const site = sites[i];
-		if ((site.alerts?.length ?? 0) > (best.alerts?.length ?? 0)) best = site;
-	}
-	return best;
-}
-const ZAP_RFC1123_LIKE = /^[A-Za-z]{3}, \d{1,2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2}$/;
-function parseZapTimestamp(s) {
-	const trimmed = s.trim();
-	if (ZAP_RFC1123_LIKE.test(trimmed)) {
-		const d = /* @__PURE__ */ new Date(`${trimmed} GMT`);
-		if (!isNaN(d.getTime())) return d;
-	}
-	return parseTimestamp(s) ?? void 0;
+function siteLabel(site, index) {
+	return site["@host"] || site["@name"] || `site ${index + 1}`;
 }
-async function convertZapToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "zap");
-	registerAllFingerprints();
-	const detected = detectConverter(input);
-	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
-	const resultsChecksum = await inputChecksum(input);
-	const zapData = parseJSON(input);
-	const site = selectSite(Array.isArray(zapData.site) ? zapData.site : []);
-	const alerts = site?.alerts ?? [];
+function buildSiteRequirements(site) {
+	const alerts = site.alerts ?? [];
 	const pluginIdCount = /* @__PURE__ */ new Map();
 	const { items: limitedAlerts, truncated } = limitArray(alerts);
 	/* v8 ignore next -- truncation only triggers with >100K items */
@@ -4552,7 +4794,6 @@ async function convertZapToHdf(input, converterVersion = "1.0.0") {
 		const nistTags = buildNistTags$1(alert.cweid ?? "");
 		const cciTags = nistToCci(nistTags);
 		const extras = {};
-		if (alert.cweid) extras.cweid = alert.cweid;
 		if (alert.wascid) extras.wascid = alert.wascid;
 		if (alert.riskdesc) extras.riskdesc = alert.riskdesc;
 		if (alert.confidence) extras.confidence = alert.confidence;
@@ -4564,7 +4805,7 @@ async function convertZapToHdf(input, converterVersion = "1.0.0") {
 			for (const instance of limitedInstances) {
 				const result = {
 					status: ResultStatus.Failed,
-					codeDesc: buildCodeDesc$5(instance),
+					codeDesc: buildCodeDesc$6(instance),
 					startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 				};
 				if (instance.attack) result.message = instance.attack;
@@ -4591,40 +4832,76 @@ async function convertZapToHdf(input, converterVersion = "1.0.0") {
 			descriptions,
 			verificationMethod: VerificationMethodEnum.Automated
 		};
+		const cwe = buildCwe(alert.cweid);
+		if (cwe !== void 0) req.cwe = cwe;
 		const controlType = deriveControlTypeFromTags(nistTags);
 		if (controlType !== void 0) req.controlType = controlType;
+		const code = buildRequirementCode$1(alert);
+		if (code !== void 0) req.code = code;
 		requirements.push(req);
 	}
-	const targetName = site?.["@host"] ?? "Unknown Host";
-	const siteName = site?.["@name"] ?? "";
-	const baselineName = site && (site["@name"] || site["@host"]) ? `OWASP ZAP Scan of ${site["@name"] ?? targetName}` : "OWASP ZAP Scan";
-	if (requirements.length === 0) {
-		let target = siteName || targetName;
-		if (!target || target === "Unknown Host") target = "the target site";
-		requirements.push(buildNoFindingsRequirement("zap-no-findings", `OWASP ZAP scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
+	return requirements;
+}
+const ZAP_RFC1123_LIKE = /^[A-Za-z]{3}, \d{1,2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2}$/;
+function parseZapTimestamp(s) {
+	const trimmed = s.trim();
+	if (ZAP_RFC1123_LIKE.test(trimmed)) {
+		const d = /* @__PURE__ */ new Date(`${trimmed} GMT`);
+		if (!isNaN(d.getTime())) return d;
 	}
-	const baseline = createMinimalBaseline("OWASP ZAP Scan", requirements, {
-		resultsChecksum,
-		title: baselineName,
-		summary: `ZAP Version ${zapData["@version"] ?? "unknown"}`
-	});
-	const tool = {
-		name: "OWASP ZAP",
-		format: "JSON"
-	};
-	if (zapData["@version"]) tool.version = zapData["@version"];
+	return parseTimestamp(s) ?? void 0;
+}
+async function convertZapToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize(input, "zap");
+	registerAllFingerprints();
+	const detected = detectConverter(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
+	const resultsChecksum = await inputChecksum(input);
+	const zapData = parseJSON(input);
+	const sites = Array.isArray(zapData.site) ? zapData.site : [];
+	const multiSite = sites.length > 1;
+	const summary = `ZAP Version ${zapData["@version"] ?? "unknown"}`;
+	const baselines = [];
 	const components = [];
-	if (site?.["@name"]) components.push({
-		name: targetName,
-		type: TargetType.Application,
-		url: site["@name"]
-	});
-	else if (targetName !== "Unknown Host") components.push({
-		name: targetName,
-		type: TargetType.Application
+	sites.forEach((site, i) => {
+		const targetName = site["@host"] ?? "Unknown Host";
+		const siteName = site["@name"] ?? "";
+		const requirements = buildSiteRequirements(site);
+		if (requirements.length === 0) {
+			let target = siteName || targetName;
+			if (!target || target === "Unknown Host") target = "the target site";
+			requirements.push(buildNoFindingsRequirement("zap-no-findings", `OWASP ZAP scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
+		}
+		const baselineTitle = site["@name"] || site["@host"] ? `OWASP ZAP Scan of ${site["@name"] ?? targetName}` : "OWASP ZAP Scan";
+		const baseline = createMinimalBaseline(multiSite ? `OWASP ZAP Scan: ${siteLabel(site, i)}` : "OWASP ZAP Scan", requirements, {
+			resultsChecksum,
+			title: baselineTitle,
+			summary
+		});
+		if (site["@host"]) baseline.labels = { component: site["@host"] };
+		baselines.push(baseline);
+		if (site["@name"]) components.push({
+			name: targetName,
+			type: TargetType.Application,
+			url: site["@name"]
+		});
+		else if (targetName !== "Unknown Host") components.push({
+			name: targetName,
+			type: TargetType.Application
+		});
 	});
+	if (baselines.length === 0) {
+		const requirements = [buildNoFindingsRequirement("zap-no-findings", "OWASP ZAP scanned the target site and reported zero findings.", /* @__PURE__ */ new Date())];
+		baselines.push(createMinimalBaseline("OWASP ZAP Scan", requirements, {
+			resultsChecksum,
+			title: "OWASP ZAP Scan",
+			summary
+		}));
+	}
+	const tool = { name: "OWASP ZAP" };
+	if (zapData["@version"]) tool.version = zapData["@version"];
 	const hdf = {
-		baselines: [baseline],
+		baselines,
 		components,
 		generator: {
 			name: "zap-to-hdf",
@@ -5242,23 +5519,18 @@ function stringSlice(v) {
 	if (Array.isArray(v)) return v.filter((e) => typeof e === "string");
 	return [];
 }
-/** Most-significant status across a requirement's results[] (lossless). */
+/**
+* Most-significant status across a requirement's results[] (lossless), using
+* the canonical worst-wins ordering from @mitre/hdf-utilities.
+*/
 function worstOfResults(req) {
 	const results = asArr(req.results) ?? [];
-	const precedence = [
-		"failed",
-		"error",
-		"passed",
-		"notReviewed",
-		"notApplicable"
-	];
-	const present = /* @__PURE__ */ new Set();
+	const statuses = [];
 	for (const rRaw of results) {
 		const r = asMap(rRaw);
-		if (r) present.add(getStr(r, "status"));
+		if (r) statuses.push(getStr(r, "status"));
 	}
-	for (const s of precedence) if (present.has(s)) return s;
-	return "notReviewed";
+	return worstStatus(statuses);
 }
 /**
 * Whether an HDF Result_Status is a failing verdict. Only 'failed' fails;
@@ -5514,10 +5786,34 @@ function maxImpact(ratings) {
 	return max;
 }
 /**
-* Formats the ratings as a human-readable tag string.
+* Assembles structured requirement.cvss[] entries from the CycloneDX ratings. A
+* rating contributes an entry only when it carries a CVSS method
+* (CVSSv2/v3/v31/v4) and at least a score or a vector — ratings that only state a
+* qualitative severity (method "other") carry no CVSS metrics and are left out,
+* their severity already reflected in the requirement impact.
 */
-function formatRatingsTag(ratings) {
-	return ratings.map((r) => `${r.source?.name ?? "Unknown"} - ${r.severity ?? "unrated"}`).join(", ");
+function cvssVersionFromMethod(method, vector) {
+	if (vector !== void 0 && vector.startsWith("CVSS:")) return cvssVersionFromVector(vector);
+	switch (method) {
+		case "CVSSv2": return cvssVersionFromString("2.0");
+		case "CVSSv4": return cvssVersionFromString("4.0");
+		default: return cvssVersionFromVector(vector);
+	}
+}
+function buildCvssEntries$3(ratings) {
+	const entries = [];
+	for (const r of ratings) {
+		const hasCvssMethod = r.method !== void 0 && CVSS_METHODS.has(r.method);
+		const hasMetric = r.score !== void 0 && r.score !== null || r.vector !== void 0 && r.vector !== "";
+		if (!hasCvssMethod || !hasMetric) continue;
+		entries.push(buildCvss$2({
+			version: cvssVersionFromMethod(r.method, r.vector),
+			baseScore: r.score,
+			baseVector: r.vector,
+			source: r.source?.name
+		}));
+	}
+	return entries;
 }
 /**
 * Formats a component reference as a code_desc string.
@@ -5585,8 +5881,8 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 			nist,
 			cci: nistToCci(nist)
 		};
-		if (cwes.length > 0) tags["cweid"] = cwes.map((c) => `CWE-${c}`);
-		if (ratings.length > 0) tags["ratings"] = formatRatingsTag(ratings);
+		const cweIds = cwes.map((c) => `CWE-${c}`);
+		const cvssEntries = buildCvssEntries$3(ratings);
 		const descriptions = [];
 		const defaultParts = [];
 		if (vuln.description) defaultParts.push(`Description: ${vuln.description}`);
@@ -5614,6 +5910,8 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 		const results = affects.length > 0 ? affects.map((affect) => toResult(formatCodeDesc$4(componentLookup, affect.ref))) : [toResult(`Vulnerability ${vuln.id}`)];
 		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
 		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
+		if (cvssEntries.length > 0) req.cvss = cvssEntries;
+		if (cweIds.length > 0) req.cwe = cweIds;
 		const controlType = deriveControlTypeFromTags(nist);
 		if (controlType !== void 0) req.controlType = controlType;
 		requirements.push(req);
@@ -5637,7 +5935,6 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "cyclonedx-to-hdf",
 		converterVersion,
 		toolName: "CycloneDX",
-		toolFormat: "JSON",
 		baselines: [baseline],
 		components: [{
 			...targetComponent,
@@ -6748,7 +7045,7 @@ function collectIdentifierTags(identifiers) {
 	}
 	return result;
 }
-function buildCodeDesc$4(scanType, location) {
+function buildCodeDesc$5(scanType, location) {
 	if (!location) return "";
 	switch (scanType) {
 		case "sast":
@@ -6826,7 +7123,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 		});
 		const result = {
 			status: ResultStatus.Failed,
-			codeDesc: buildCodeDesc$4(scanType, vuln.location),
+			codeDesc: buildCodeDesc$5(scanType, vuln.location),
 			startTime: startTime ? parseTimestamp(startTime) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z") : /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 		};
 		const impact = gitlabSeverityToImpact(vuln.severity ?? "Unknown");
@@ -6834,6 +7131,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 			id: vuln.id,
 			title: vuln.name ?? vuln.id,
 			impact,
+			code: JSON.stringify(vuln, null, 2),
 			results: [result],
 			tags,
 			descriptions,
@@ -6853,10 +7151,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 		title: `GitLab ${label} Security Scan`,
 		summary: `Scanner: ${scannerName}${scannerVersion ? ` v${scannerVersion}` : ""}`
 	});
-	const tool = {
-		name: scannerName,
-		format: "JSON"
-	};
+	const tool = { name: scannerName };
 	if (scannerVersion) tool.version = scannerVersion;
 	const components = [];
 	const targetType = scanTypeToTargetType(scanType);
@@ -6889,6 +7184,20 @@ const TRUFFLEHOG_CCI = [
 	"CCI-002367"
 ];
 /**
+* A verified secret is a confirmed-live credential (TruffleHog reached the
+* provider and the credential authenticated) and rates high; an unverified
+* candidate rates medium.
+*/
+const IMPACT_VERIFIED = .7;
+const IMPACT_UNVERIFIED = .5;
+/**
+* Rate a requirement by its strongest signal: any verified finding in the group
+* elevates the whole requirement to the verified impact.
+*/
+function groupImpact(findings) {
+	return findings.some((f) => f.Verified) ? IMPACT_VERIFIED : IMPACT_UNVERIFIED;
+}
+/**
 * Parse TruffleHog input as JSON array, single object, or NDJSON.
 */
 function parseFindings(input) {
@@ -6948,7 +7257,7 @@ function buildMessage(f) {
 /**
 * Build the Result.CodeDesc as JSON of SourceMetadata.
 */
-function buildCodeDesc$3(f) {
+function buildCodeDesc$4(f) {
 	return JSON.stringify(f.SourceMetadata ?? {});
 }
 /**
@@ -6991,12 +7300,12 @@ function buildRequirement$12(reqID, findings) {
 		data: rep.DetectorDescription ?? `${rep.DetectorName} secret detected by ${rep.DecoderName} decoder`
 	}];
 	const results = findings.map((f) => createResult(ResultStatus.Failed, buildMessage(f), {
-		codeDesc: buildCodeDesc$3(f),
+		codeDesc: buildCodeDesc$4(f),
 		startTime: getTimestamp(f)
 	}));
 	const sourceFile = getSourceFile(rep);
 	const sourceLine = getSourceLine(rep);
-	const req = createRequirement(reqID, title, descriptions, .5, results, {
+	const req = createRequirement(reqID, title, descriptions, groupImpact(findings), results, {
 		tags,
 		sourceLocation: sourceFile ? {
 			ref: sourceFile,
@@ -7036,10 +7345,7 @@ async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
 			name: "trufflehog-to-hdf",
 			version: converterVersion
 		},
-		tool: {
-			name: "TruffleHog",
-			format: "JSON"
-		},
+		tool: { name: "TruffleHog" },
 		timestamp: /* @__PURE__ */ new Date()
 	};
 	const repoURL = findGitRepoURL(limitedFindings);
@@ -7173,7 +7479,6 @@ async function convertHipcheckToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "hipcheck-to-hdf",
 		converterVersion,
 		toolName: "Hipcheck",
-		toolFormat: "JSON",
 		toolVersion: report.hipcheck_version,
 		baselines: [baseline],
 		components: ident ? [{
@@ -7246,10 +7551,7 @@ async function convertBurpsuiteToHdf(input, converterVersion = "1.0.0") {
 		resultsChecksum,
 		title: `BurpSuite Scan: ${targetName}`
 	});
-	const tool = {
-		name: "BurpSuite",
-		format: "XML"
-	};
+	const tool = { name: "BurpSuite" };
 	if (burpVersion) tool.version = burpVersion;
 	const hdf = {
 		baselines: [baseline],
@@ -7418,6 +7720,17 @@ function parseDate(dateStr) {
 	return parseTimestamp(month ? `${month[3]}-${MONTH_ABBR[month[1]] ?? "00"}-${month[2].padStart(2, "0")} ${month[4]}` : trimmed) ?? ZERO;
 }
 /**
+* Renders a finding's parsed row (column→value map) as the indented JSON blob
+* carried in requirement.code. DBProtect ships no literal check source, so the
+* row itself is the richest available representation. Keys are sorted so the
+* bytes match the Go twin, whose encoding/json emits map keys in sorted order.
+*/
+function marshalFindingCode(f) {
+	const sorted = {};
+	for (const key of Object.keys(f).sort()) sorted[key] = f[key];
+	return JSON.stringify(sorted, null, 2);
+}
+/**
 * Builds a single EvaluatedRequirement from a group of findings sharing a Check ID.
 */
 function buildRequirement$10(checkID, findings, hasStatus) {
@@ -7436,6 +7749,7 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 	});
 	const req = createRequirement(checkID, rep["Check"] ?? "", descriptions, getImpact$6(rep["Risk DV"] ?? ""), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	req.code = marshalFindingCode(rep);
 	const controlType = deriveControlTypeFromTags([...nist]);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
@@ -7487,7 +7801,6 @@ async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "dbprotect-to-hdf",
 		converterVersion,
 		toolName: "DBProtect",
-		toolFormat: "XML",
 		baselines: [baseline],
 		components: [{
 			name: targetName,
@@ -7531,30 +7844,6 @@ function buildSummary(result) {
 	return `Package Vulnerability Summary: ${result.vulnerabilityDistribution ? String(result.vulnerabilityDistribution.total) : "N/A"} Application Compliance Issue Total: ${result.complianceDistribution ? String(result.complianceDistribution.total) : "N/A"}`;
 }
 /**
-* Detects CVSS schema version enum from the vector prefix. Defaults to 3.1
-* since modern Twistlock exclusively emits 3.x output.
-*/
-function cvssVersionFromVector(vector) {
-	if (!vector) return Version.The31;
-	if (vector.startsWith("CVSS:2.0/")) return Version.The20;
-	if (vector.startsWith("CVSS:3.0/")) return Version.The30;
-	if (vector.startsWith("CVSS:4.0/")) return Version.The40;
-	return Version.The31;
-}
-/**
-* Maps cvssScoreToSeverity('low'|'medium'|...) into the CVSSSeverity enum.
-*/
-function cvssSeverityFromScore(score) {
-	switch (cvssScoreToSeverity(score)) {
-		case "none": return CVSSSeverity.None;
-		case "low": return CVSSSeverity.Low;
-		case "medium": return CVSSSeverity.Medium;
-		case "high": return CVSSSeverity.High;
-		case "critical": return CVSSSeverity.Critical;
-		default: return;
-	}
-}
-/**
 * Builds a Cvss entry from a Twistlock vulnerability. Returns undefined only
 * when neither a score nor a vector is available. When the vendor emits a
 * score but no vector (common in Twistlock/Prisma Cloud output), the Cvss
@@ -7565,16 +7854,12 @@ function buildCvss(vuln) {
 	const hasScore = typeof vuln.cvss === "number" && Number.isFinite(vuln.cvss);
 	const hasVector = !!vuln.vector;
 	if (!hasScore && !hasVector) return void 0;
-	const cv = { version: cvssVersionFromVector(vuln.vector) };
-	if (hasScore) {
-		cv.baseScore = vuln.cvss;
-		const sev = cvssSeverityFromScore(vuln.cvss);
-		if (sev !== void 0) cv.baseSeverity = sev;
-	}
-	if (hasVector) cv.baseVector = vuln.vector;
-	const source = vuln.cve ?? vuln.id;
-	if (source) cv.source = source;
-	return cv;
+	return buildCvss$2({
+		version: cvssVersionFromVector(vuln.vector),
+		baseScore: hasScore ? vuln.cvss : void 0,
+		baseVector: vuln.vector,
+		source: vuln.cve ?? vuln.id
+	});
 }
 const CWE_REGEX = /cwe[-_]?(\d+)/gi;
 /**
@@ -7764,7 +8049,6 @@ async function convertTwistlockToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "twistlock-to-hdf",
 		converterVersion,
 		toolName: "Twistlock",
-		toolFormat: "JSON",
 		baselines,
 		components: [component],
 		timestamp: /* @__PURE__ */ new Date()
@@ -7805,16 +8089,32 @@ function getCweIDs(cwes) {
 	return cwes.map((cwe) => `CWE-${cwe.cweId}`);
 }
 /**
+* Collects CVE identifiers from vulnerability.aliases[].cveId, deduped in
+* first-seen order. The finding.matrix (requirement id) is a UUID composite, so
+* the CVE has no other home; it goes to tags.cve (interim, pending an
+* identifiers[] schema field).
+*/
+function getCVEs(vuln) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const alias of vuln.aliases ?? []) if (alias.cveId && !seen.has(alias.cveId)) {
+		seen.add(alias.cveId);
+		out.push(alias.cveId);
+	}
+	return out;
+}
+/**
 * Builds a single EvaluatedRequirement from a Dependency-Track finding.
 */
 function buildRequirement$8(finding, timestamp) {
 	const cweIDs = getCweIDs(finding.vulnerability.cwes);
+	const cveIDs = getCVEs(finding.vulnerability);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	const tags = {
 		nist,
 		cci: nistToCci(nist)
 	};
-	if (cweIDs.length > 0) tags["cweIds"] = cweIDs;
+	if (cveIDs.length > 0) tags["cve"] = cveIDs;
 	const descriptions = [{
 		label: "default",
 		data: finding.vulnerability.description ?? ""
@@ -7834,8 +8134,10 @@ function buildRequirement$8(finding, timestamp) {
 	})];
 	const req = createRequirement(finding.matrix, getTitle$1(finding), descriptions, getImpact$5(finding.vulnerability.severity), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	req.code = JSON.stringify(finding, null, 2);
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
+	if (cweIDs.length > 0) req.cwe = cweIDs;
 	const pkg = buildAffectedPackageFromComponent(finding.component);
 	if (pkg) req.affectedPackages = [pkg];
 	return req;
@@ -7887,7 +8189,7 @@ async function convertDeptrackToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "deptrack-to-hdf",
 		converterVersion,
 		toolName: "Dependency-Track",
-		toolFormat: "JSON",
+		toolFormat: "FPF",
 		baselines: [baseline],
 		components: [{
 			name: targetName,
@@ -7906,12 +8208,79 @@ async function hashID(summary) {
 	return (await sha256(summary)).substring(0, 32);
 }
 /**
-* Extract CWE identifiers from the first CVE entry.
+* Collect the distinct CWE identifiers across every CVE entry, preserving
+* first-seen order. These feed both requirement.cwe[] and the CWE→NIST mapping.
 */
 function extractCWEs$1(entry) {
-	const cves = entry.component_versions?.more_details?.cves;
-	if (!cves || cves.length === 0) return [];
-	return cves[0]?.cwe ?? [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cve of entry.component_versions?.more_details?.cves ?? []) for (const cwe of cve.cwe ?? []) if (cwe && !seen.has(cwe)) {
+		seen.add(cwe);
+		out.push(cwe);
+	}
+	return out;
+}
+/**
+* Collect the distinct CVE identifiers across every CVE entry, preserving
+* first-seen order. The requirement id is a summary hash (never the CVE), so
+* tags.cve is where the CVE list lives.
+*/
+function extractCVEs$1(entry) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cve of entry.component_versions?.more_details?.cves ?? []) if (cve.cve && !seen.has(cve.cve)) {
+		seen.add(cve.cve);
+		out.push(cve.cve);
+	}
+	return out;
+}
+/**
+* Split a JFrog cvss_v2/cvss_v3 field ("<score>/<vector>", e.g.
+* "9.8/CVSS:3.1/AV:N/...") on the FIRST "/" into the numeric base score and the
+* remaining vector. A field with no "/" is a bare score with no vector; an
+* unparseable score yields undefined (the vector may still stand alone).
+*/
+function parseCvssField(field) {
+	if (!field) return { vector: "" };
+	const idx = field.indexOf("/");
+	let scorePart = field;
+	let vector = "";
+	if (idx >= 0) {
+		scorePart = field.slice(0, idx);
+		vector = field.slice(idx + 1);
+	}
+	const parsed = Number.parseFloat(scorePart.trim());
+	return {
+		score: Number.isFinite(parsed) ? parsed : void 0,
+		vector
+	};
+}
+/**
+* Assemble the structured requirement.cvss[] for a group's representative
+* entry. Each CVE contributes its v3 metric (version from the vector prefix)
+* then its v2 metric (always CVSS 2.0 — the cvss_v2 vector prefix is
+* inconsistent, so the field name is the authority). A field with neither a
+* score nor a vector is skipped.
+*/
+function buildCvssEntries$2(cves) {
+	const out = [];
+	for (const cve of cves ?? []) {
+		const v3 = parseCvssField(cve.cvss_v3);
+		if (v3.score !== void 0 || v3.vector !== "") out.push(buildCvss$2({
+			version: cvssVersionFromVector(v3.vector),
+			baseScore: v3.score,
+			baseVector: v3.vector,
+			source: cve.cve
+		}));
+		const v2 = parseCvssField(cve.cvss_v2);
+		if (v2.score !== void 0 || v2.vector !== "") out.push(buildCvss$2({
+			version: cvssVersionFromString("2.0"),
+			baseScore: v2.score,
+			baseVector: v2.vector,
+			source: cve.cve
+		}));
+	}
+	return out;
 }
 /**
 * Build description from more_details, including CVE data.
@@ -7949,17 +8318,57 @@ function formatCodeDesc$1(entry) {
 	return parts.join("\n").replace(/,/g, ", ");
 }
 /**
+* Render an Xray entry as the indented JSON blob carried in the requirement's
+* code field (the ionchannel pattern), so Heimdall's CODE tab shows the raw
+* finding. The object is reconstructed with a fixed key order and full field set
+* matching the Go twin's struct marshal, keeping Go and TS byte-identical
+* (verified by the shared snapshot test).
+*/
+function marshalEntryCode(entry) {
+	const cv = entry.component_versions;
+	const md = cv?.more_details;
+	const cves = md?.cves;
+	const codeObject = {
+		id: entry.id ?? "",
+		severity: entry.severity ?? "",
+		summary: entry.summary ?? "",
+		issue_type: entry.issue_type ?? "",
+		provider: entry.provider ?? "",
+		component: entry.component ?? "",
+		source_id: entry.source_id ?? "",
+		source_comp_id: entry.source_comp_id ?? "",
+		component_versions: {
+			id: cv?.id ?? "",
+			vulnerable_versions: cv?.vulnerable_versions ?? null,
+			fixed_versions: cv?.fixed_versions ?? null,
+			more_details: {
+				cves: cves ? cves.map((c) => ({
+					cve: c.cve ?? "",
+					cwe: c.cwe ?? null,
+					cvss_v2: c.cvss_v2 ?? "",
+					cvss_v3: c.cvss_v3 ?? ""
+				})) : null,
+				description: md?.description ?? "",
+				provider: md?.provider ?? ""
+			}
+		},
+		edited: entry.edited ?? ""
+	};
+	return JSON.stringify(codeObject, null, 2);
+}
+/**
 * Builds a single EvaluatedRequirement from a group of entries sharing an ID.
 */
 function buildRequirement$7(entryID, entries, scanTime) {
 	const rep = entries[0];
 	const cweIDs = extractCWEs$1(rep);
+	const cveIDs = extractCVEs$1(rep);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	const tags = {
 		nist,
 		cci: nistToCci(nist)
 	};
-	if (cweIDs.length > 0) tags["cweid"] = cweIDs;
+	if (cveIDs.length > 0) tags["cve"] = cveIDs;
 	const descriptions = [{
 		label: "default",
 		data: formatDescription(rep)
@@ -7970,9 +8379,13 @@ function buildRequirement$7(entryID, entries, scanTime) {
 		startTime: scanTime
 	}));
 	const req = createRequirement(entryID, rep.summary, descriptions, severityToImpact$1(rep.severity), results, { tags });
+	req.code = marshalEntryCode(rep);
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	if (cweIDs.length > 0) req.cwe = cweIDs;
+	const cvss = buildCvssEntries$2(rep.component_versions?.more_details?.cves);
+	if (cvss.length > 0) req.cvss = cvss;
 	const pkg = buildAffectedPackageFromEntry(rep);
 	if (pkg) req.affectedPackages = [pkg];
 	return req;
@@ -8051,7 +8464,6 @@ async function convertJfrogXrayToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "jfrog-xray-to-hdf",
 		converterVersion,
 		toolName: "JFrog Xray",
-		toolFormat: "JSON",
 		baselines: [createMinimalBaseline("JFrog Xray Scan", requirements, { resultsChecksum })],
 		components: [{
 			name: "JFrog Xray Scan",
@@ -8070,6 +8482,43 @@ function extractCWEs(description) {
 	return extractCWEIDs(description).map((id) => `CWE-${id}`);
 }
 /**
+* Collects the distinct CVE identifiers a vulnerability carries in its cves[]
+* field, preserving first-seen order. The requirement ID is a
+* name/package/version composite (not the CVE), so tags.cve is where the CVE
+* list lives.
+*/
+function extractCVEs(vuln) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cve of vuln.cves ?? []) if (cve && !seen.has(cve)) {
+		seen.add(cve);
+		out.push(cve);
+	}
+	return out;
+}
+/**
+* Assembles the structured requirement.cvss[] from the scoring a vulnerability
+* carries. NeuVector emits a CVSS v3 vector (version-prefixed) and, separately,
+* a legacy v2 vector (prefix-less). The v3 metric is preferred; the v2 metric
+* is the fallback. A vulnerability with neither vector contributes no entry —
+* its score still drives impact.
+*/
+function buildCvssEntries$1(vuln) {
+	if (vuln.vectors_v3) return [buildCvss$2({
+		version: cvssVersionFromVector(vuln.vectors_v3),
+		baseScore: vuln.score_v3 > 0 ? vuln.score_v3 : void 0,
+		baseVector: vuln.vectors_v3,
+		source: "NeuVector"
+	})];
+	if (vuln.vectors) return [buildCvss$2({
+		version: cvssVersionFromString("2.0"),
+		baseScore: vuln.score > 0 ? vuln.score : void 0,
+		baseVector: vuln.vectors,
+		source: "NeuVector"
+	})];
+	return [];
+}
+/**
 * Computes the HDF impact from NeuVector CVSS scores.
 * Prefers CVSS v3 score; falls back to CVSS v2 if v3 is 0.
 * Impact is normalized to 0.0-1.0 by dividing by 10.
@@ -8098,29 +8547,66 @@ function vulnMessage(vuln) {
 	if (!vuln.fixed_version) return `Vulnerable package ${vuln.package_name} is at version ${vuln.package_version}. No fixed version available.`;
 	return `Vulnerable package ${vuln.package_name} is at version ${vuln.package_version}. Update to fixed version ${vuln.fixed_version}.`;
 }
+const WHITESPACE_RUN = /[ \t\n\r]+/g;
+const CODE_DESC_SNIPPET_RUNES = 100;
+/**
+* Returns the CVSS score used in code_desc: CVSS v3 preferred, else v2.
+*/
+function cvssScore(vuln) {
+	return vuln.score_v3 > 0 ? vuln.score_v3 : vuln.score;
+}
+/**
+* Collapses the description to a single line and truncates it to
+* CODE_DESC_SNIPPET_RUNES code points (Array.from matches Go's []rune).
+*/
+function descSnippet(description) {
+	const collapsed = description.replace(WHITESPACE_RUN, " ").trim();
+	const runes = Array.from(collapsed);
+	return runes.length > CODE_DESC_SNIPPET_RUNES ? runes.slice(0, CODE_DESC_SNIPPET_RUNES).join("") + "…" : collapsed;
+}
+/**
+* Builds the pipe-joined result code_desc from the fields the vuln carries:
+* package@version | name | CVSS score | description snippet. Only parts the
+* source actually provides are included.
+*/
+function buildCodeDesc$3(vuln) {
+	const parts = [];
+	if (vuln.package_name) parts.push(vuln.package_version ? `${vuln.package_name}@${vuln.package_version}` : vuln.package_name);
+	if (vuln.name) parts.push(vuln.name);
+	const score = cvssScore(vuln);
+	if (score > 0) parts.push(`CVSS ${score}`);
+	const snippet = descSnippet(vuln.description);
+	if (snippet) parts.push(snippet);
+	return parts.join(" | ");
+}
 /**
 * Builds a single EvaluatedRequirement from a NeuVector vulnerability.
 */
 function buildRequirement$6(vuln, scanTime) {
 	const cweIDs = extractCWEs(vuln.description);
+	const cveIDs = extractCVEs(vuln);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_REMEDIATION_NIST_TAGS);
 	const tags = {
 		nist,
 		cci: nistToCci(nist)
 	};
-	if (cweIDs.length > 0) tags["cwe"] = cweIDs;
+	if (cveIDs.length > 0) tags["cve"] = cveIDs;
 	const descriptions = [{
 		label: "default",
 		data: vuln.description
 	}];
 	const results = [createResult(ResultStatus.Failed, vulnMessage(vuln), {
-		codeDesc: "",
+		codeDesc: buildCodeDesc$3(vuln),
 		startTime: scanTime
 	})];
 	const req = createRequirement(vulnID(vuln), vulnTitle(vuln), descriptions, getImpact$4(vuln), results, { tags });
+	req.code = JSON.stringify(vuln, null, 2);
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	if (cweIDs.length > 0) req.cwe = cweIDs;
+	const cvss = buildCvssEntries$1(vuln);
+	if (cvss.length > 0) req.cvss = cvss;
 	const cpe23 = (vuln.cpes ?? []).find((c) => /^cpe:2\.3:[aho]:/.test(c));
 	const pkg = buildAffectedPackage$1({
 		name: vuln.package_name,
@@ -8182,7 +8668,6 @@ async function convertNeuvectorToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "neuvector-to-hdf",
 		converterVersion,
 		toolName: "NeuVector",
-		toolFormat: "JSON",
 		baselines: [createMinimalBaseline("NeuVector Scan", requirements, {
 			resultsChecksum,
 			title: imageTitle(scan.report)
@@ -8201,7 +8686,9 @@ async function convertNeuvectorToHdf(input, converterVersion = "1.0.0") {
 //#endregion
 //#region converters/fortify-to-hdf/typescript/converter.ts
 const NIST_REFERENCE_NAME = "Standards Mapping - NIST Special Publication 800-53 Revision 4";
+const CWE_REFERENCE_NAME = "Standards Mapping - Common Weakness Enumeration";
 const NIST_PATTERN = /[a-zA-Z]{2}-\d+/g;
+const CWE_ID_PATTERN = /\d+/g;
 const NAMED_ENTITIES$1 = {
 	lt: "<",
 	gt: ">",
@@ -8241,6 +8728,18 @@ function extractNISTFromReferences(refs) {
 	}
 	return [];
 }
+function extractCWEFromReferences(refs) {
+	for (const ref of refs) if (ref.Author === CWE_REFERENCE_NAME) {
+		const matches = ref.Title?.match(CWE_ID_PATTERN);
+		if (matches && matches.length > 0) return matches.map((m) => `CWE-${m}`);
+	}
+	return [];
+}
+function mergeCweNist(nist, cweIDs) {
+	const merged = [...nist];
+	for (const ctrl of mapCWEToNIST(cweIDs, [])) if (!merged.includes(ctrl)) merged.push(ctrl);
+	return merged;
+}
 function formatSnippet(snippet) {
 	const text = (snippet.Text ?? "").trim();
 	return `Path: ${snippet.File ?? ""}\nStartLine: ${snippet.StartLine ?? ""}, EndLine: ${snippet.EndLine ?? ""}\nCode:\n${text}`;
@@ -8263,8 +8762,26 @@ function buildCodeDesc$2(vuln, snippetMap) {
 	if (parts.length === 0) return `ClassID: ${vuln.ClassInfo?.ClassID ?? ""}, InstanceID: ${vuln.InstanceInfo?.InstanceID ?? ""}`;
 	return parts.join("\n");
 }
+function buildRequirementCode(vulns, snippetMap) {
+	if (vulns.length === 0) return void 0;
+	const parts = [];
+	const entries = ensureArray(vulns[0].AnalysisInfo?.Unified?.Trace?.Primary?.Entry);
+	for (const entry of entries) {
+		if (!entry.Node) continue;
+		const snippetID = entry.Node.SourceLocation?.snippet;
+		if (!snippetID) continue;
+		const snippet = snippetMap.get(snippetID);
+		if (!snippet) continue;
+		const text = (snippet.Text ?? "").trim();
+		if (text) parts.push(text);
+	}
+	if (parts.length === 0) return void 0;
+	return parts.join("\n");
+}
 function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
-	let nistTags = extractNISTFromReferences(ensureArray(desc.References?.Reference));
+	const refs = ensureArray(desc.References?.Reference);
+	const cweIDs = extractCWEFromReferences(refs);
+	let nistTags = mergeCweNist(extractNISTFromReferences(refs), cweIDs);
 	if (nistTags.length === 0) nistTags = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1];
 	const cciTags = nistToCci(nistTags);
 	const tags = buildNistCciTags(nistTags, cciTags);
@@ -8280,7 +8797,7 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 		data: stripFvdlMarkup(desc.Recommendations)
 	});
 	let impact = 0;
-	if (vulns.length > 0) impact = parseFloat(vulns[0].ClassInfo?.DefaultSeverity ?? "0") / 5;
+	if (vulns.length > 0) impact = parseFloat(vulns[0].InstanceInfo?.InstanceSeverity ?? "0") / 5;
 	const { items: limitedVulns, truncated } = limitArray(vulns);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${vulns.length})`);
@@ -8298,8 +8815,11 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 		results,
 		verificationMethod: VerificationMethodEnum.Automated
 	};
+	if (cweIDs.length > 0) req.cwe = cweIDs;
 	const controlType = deriveControlTypeFromTags(nistTags);
 	if (controlType !== void 0) req.controlType = controlType;
+	const code = buildRequirementCode(vulns, snippetMap);
+	if (code !== void 0) req.code = code;
 	return req;
 }
 /**
@@ -8456,6 +8976,8 @@ function buildRequirement$4(rec, scanTime) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const cvss = buildCvssEntries(rec);
+	if (cvss) req.cvss = cvss;
 	if (rec["CVE ID"]) {
 		const pkg = buildAffectedPackageFromRecord(rec);
 		if (pkg) req.affectedPackages = [pkg];
@@ -8463,6 +8985,32 @@ function buildRequirement$4(rec, scanTime) {
 	return req;
 }
 /**
+* Maps the CSV CVSS column to a structured cvss[] entry. Prisma emits a bare
+* base score with no vector, so version defaults to 3.1 via the shared helper.
+* Config rows carry "0.00" (or blank); only a positive score yields an entry,
+* and the source is the associated CVE when present.
+*/
+function buildCvssEntries(rec) {
+	const score = parseCvssScore(rec.CVSS);
+	if (score === void 0) return void 0;
+	return [buildCvss$2({
+		version: cvssVersionFromString(void 0),
+		baseScore: score,
+		source: rec["CVE ID"] || void 0
+	})];
+}
+/**
+* Parses the CVSS column, returning undefined for blank, non-numeric, or
+* non-positive scores (the placeholder value on config rows).
+*/
+function parseCvssScore(field) {
+	const s = field?.trim();
+	if (!s) return void 0;
+	const v = Number.parseFloat(s);
+	if (!Number.isFinite(v) || v <= 0) return void 0;
+	return v;
+}
+/**
 * Distro slugs in Prisma look like `redhat-RHEL7`, `debian-buster`,
 * `alpine-3.14`, `ubuntu-20.04`. Only the leading vendor segment is
 * mapped — unknown vendors fall back to `generic` rather than guessing.
@@ -8555,7 +9103,6 @@ async function convertPrismaToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "prisma-to-hdf",
 		converterVersion,
 		toolName: "Prisma Cloud",
-		toolFormat: "CSV",
 		baselines,
 		components,
 		timestamp: scanTime
@@ -8612,6 +9159,36 @@ function formatControlDesc(vuln) {
 	return parts.join("\n");
 }
 /**
+* Returns the parsed Base-metric score from a CVSS block, or undefined when
+* there is no Base score or its value does not parse as a finite number.
+*/
+function baseScoreFromBlock(block) {
+	const scores = block?.score ?? [];
+	for (const s of scores) if ((s.type ?? "").toLowerCase() === "base") {
+		const v = parseFloat((s.value ?? "").trim());
+		return Number.isFinite(v) ? v : void 0;
+	}
+}
+/**
+* Assembles the structured cvss[] from the <cvss> (3.0) and <cvss31> (3.1)
+* classification blocks. Each block carrying a vector or a Base score becomes
+* one entry; the schema version derives from the vector prefix.
+*/
+function buildNetsparkerCvss(classification) {
+	const out = [];
+	for (const block of [classification?.cvss, classification?.cvss31]) {
+		const baseScore = baseScoreFromBlock(block);
+		const vector = block?.vector ?? "";
+		if (!vector && baseScore === void 0) continue;
+		out.push(buildCvss$2({
+			version: cvssVersionFromVector(vector),
+			baseScore,
+			baseVector: vector
+		}));
+	}
+	return out;
+}
+/**
 * Performs dual NIST mapping from both CWE and OWASP IDs.
 * Returns a deduplicated sorted list of NIST controls, falling back to
 * DEFAULT_STATIC_ANALYSIS_NIST_TAGS if no mappings are found.
@@ -8683,6 +9260,10 @@ function buildRequirement$3(vuln, initiated) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const rawRequest = vuln["http-request"]?.content;
+	if (rawRequest) req.code = rawRequest;
+	const cvss = buildNetsparkerCvss(vuln.classification);
+	if (cvss.length > 0) req.cvss = cvss;
 	return req;
 }
 /**
@@ -8696,7 +9277,7 @@ async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("netsparker: empty input");
 	validateInputSize(input, "netsparker");
 	const resultsChecksum = await inputChecksum(input);
-	const parsed = parseXmlWithArrays(input, ["vulnerability"]);
+	const parsed = parseXmlWithArrays(input, ["vulnerability", "score"]);
 	const isInvicti = !!parsed["invicti-enterprise"];
 	const data = parsed["invicti-enterprise"] ?? parsed["netsparker-enterprise"] ?? {};
 	if (!data.vulnerabilities && !data.target) throw new Error("netsparker: invalid XML — missing expected root element");
@@ -8717,7 +9298,6 @@ async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "netsparker-to-hdf",
 		converterVersion,
 		toolName,
-		toolFormat: "XML",
 		baselines: [createMinimalBaseline("Netsparker Scan", requirements, {
 			resultsChecksum,
 			title: `${toolName} Enterprise Scan ID: ${target["scan-id"] ?? ""} URL: ${target.url ?? ""}`
@@ -8851,7 +9431,6 @@ async function convertScoutsuiteToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "scoutsuite-to-hdf",
 		converterVersion,
 		toolName: "ScoutSuite",
-		toolFormat: "JSON",
 		toolVersion: report.last_run.version,
 		baselines: [baseline],
 		components: [{
@@ -9015,7 +9594,6 @@ async function convertConveyorToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "conveyor-to-hdf",
 		converterVersion,
 		toolName: "Conveyor",
-		toolFormat: "JSON",
 		baselines,
 		components: [{
 			name: targetName,
@@ -9097,23 +9675,6 @@ function formatRecommendations(rec) {
 	}
 	return parts.join("\n");
 }
-/** Format CWE data for the cweid tag. */
-function formatCWEData(cwes) {
-	return cwes.map((c) => {
-		let entry = `CWE-${attr(c, "cweid")}: ${attr(c, "cwename")}`;
-		const categories = [
-			["pcrirelated", attr(c, "pcirelated")],
-			["owasp", attr(c, "owasp")],
-			["sans", attr(c, "sans")],
-			["certc", attr(c, "certc")],
-			["certcpp", attr(c, "certcpp")],
-			["certjava", attr(c, "certjava")],
-			["owaspmobile", attr(c, "owaspmobile")]
-		];
-		for (const [name, val] of categories) if (val) entry += `${name}: ${val}\n`;
-		return entry;
-	}).join("\n");
-}
 /** Format CWE descriptions for the cweDescription tag. */
 function formatCWEDesc(cwes) {
 	return cwes.map((c) => {
@@ -9174,6 +9735,54 @@ function formatSCACodeDesc(comp) {
 	}
 	return parts.join("\n");
 }
+/**
+* Synthesize a static flaw's source-context locus from its function prototype
+* and source-file position. Returns '' when the flaw carries neither a prototype
+* nor a source location (the NOT-IN-SOURCE case).
+*/
+function synthesizeFlawCode(flaw) {
+	let locus = attr(flaw, "sourcefilepath") + attr(flaw, "sourcefile");
+	const line = attr(flaw, "line");
+	if (locus && line) locus += `:${line}`;
+	const proto = attr(flaw, "functionprototype");
+	if (proto && locus) return `${proto} at ${locus}`;
+	if (proto) return proto;
+	return locus;
+}
+/**
+* Serialize a CVE and its affected components as indented JSON. Field order is
+* load-bearing: it must match the Go twin's struct declaration order so the two
+* `code` strings are byte-identical.
+*/
+function buildSCACode(vuln, components) {
+	const entry = {
+		cve_id: attr(vuln, "cve_id"),
+		cvss_score: attr(vuln, "cvss_score"),
+		severity: attr(vuln, "severity"),
+		cwe_id: attr(vuln, "cwe_id"),
+		first_found_date: attr(vuln, "first_found_date"),
+		cve_summary: attr(vuln, "cve_summary"),
+		severity_desc: attr(vuln, "severity_desc"),
+		components: components.map((comp) => {
+			const filePathsElem = comp.file_paths;
+			const fps = filePathsElem ? ensureArray(filePathsElem.file_path) : [];
+			return {
+				component_id: attr(comp, "component_id"),
+				file_name: attr(comp, "file_name"),
+				sha1: attr(comp, "sha1"),
+				version: attr(comp, "version"),
+				library: attr(comp, "library"),
+				library_id: attr(comp, "library_id"),
+				vendor: attr(comp, "vendor"),
+				description: attr(comp, "description"),
+				max_cvss_score: attr(comp, "max_cvss_score"),
+				added_date: attr(comp, "added_date"),
+				file_paths: fps.map((fp) => attr(fp, "value"))
+			};
+		})
+	};
+	return JSON.stringify(entry, null, 2);
+}
 /** Build CWE-based requirements from severity categories. */
 function buildCWERequirements(severities, firstBuildDate) {
 	const requirements = [];
@@ -9187,14 +9796,14 @@ function buildCWERequirements(severities, firstBuildDate) {
 /** Build a single CWE-based requirement from a category. */
 function buildCWERequirement(cat, impact, firstBuildDate) {
 	const cwes = ensureArray(cat.cwe);
-	const nist = mapCWEToNIST(cwes.map((c) => attr(c, "cweid")).filter(Boolean), DEFAULT_REMEDIATION_NIST_TAGS$1);
+	const cweIDs = cwes.map((c) => attr(c, "cweid")).filter(Boolean);
+	const nist = mapCWEToNIST(cweIDs, DEFAULT_REMEDIATION_NIST_TAGS$1);
 	const cciTags = nistToCci(nist);
 	const extras = {};
-	const cweData = formatCWEData(cwes);
-	if (cweData) extras.cweid = cweData;
 	const cweDescStr = formatCWEDesc(cwes);
 	if (cweDescStr) extras.cweDescription = cweDescStr;
 	const tags = buildNistCciTags(nist, cciTags, extras);
+	const cweList = cweIDs.map((id) => `CWE-${id}`);
 	const descriptions = [{
 		label: "default",
 		data: formatDesc(cat.desc)
@@ -9216,6 +9825,10 @@ function buildCWERequirement(cat, impact, firstBuildDate) {
 		const staticflaws = c.staticflaws;
 		return ensureArray(staticflaws?.flaw).map((flaw) => attr(flaw, "sourcefile")).filter(Boolean);
 	}).join("\n");
+	const codeLines = cwes.flatMap((c) => {
+		const staticflaws = c.staticflaws;
+		return ensureArray(staticflaws?.flaw).map((flaw) => synthesizeFlawCode(flaw)).filter(Boolean);
+	});
 	const req = createRequirement(attr(cat, "categoryid"), attr(cat, "categoryname"), descriptions, impact, results, {
 		tags,
 		sourceLocation: sourceRef ? { ref: sourceRef } : void 0
@@ -9223,6 +9836,8 @@ function buildCWERequirement(cat, impact, firstBuildDate) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	if (cweList.length > 0) req.cwe = cweList;
+	if (codeLines.length > 0) req.code = codeLines.join("\n");
 	return req;
 }
 /** Build CVE-based requirements from SCA components. */
@@ -9257,6 +9872,30 @@ function buildCVERequirements(sca, firstBuildDate) {
 		return buildCVERequirement(entry.vuln, entry.components, firstBuildDate);
 	});
 }
+/**
+* Assemble the structured CVSS entry for an SCA CVE. Veracode reports a bare
+* numeric base score (no vector, no version), so the version defaults to 3.1 via
+* the shared helper. When the vulnerability itself carries no cvss_score, the
+* first affected component's max_cvss_score is used as a fallback. A missing or
+* non-numeric score yields no entry.
+*/
+function buildVeracodeCvss(vuln, components) {
+	let scoreStr = attr(vuln, "cvss_score");
+	if (!scoreStr) for (const comp of components) {
+		const max = attr(comp, "max_cvss_score");
+		if (max) {
+			scoreStr = max;
+			break;
+		}
+	}
+	if (!scoreStr) return [];
+	const score = Number(scoreStr);
+	if (!Number.isFinite(score)) return [];
+	return [buildCvss$2({
+		version: cvssVersionFromString(void 0),
+		baseScore: score
+	})];
+}
 /** Build a single CVE-based requirement. */
 function buildCVERequirement(vuln, components, firstBuildDate) {
 	const impact = veracodeSeverityToImpact(attr(vuln, "severity"));
@@ -9265,9 +9904,7 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	if (cweID) nist = mapCWEToNIST([cweID.replace(/^CWE-/, "")], DEFAULT_REMEDIATION_NIST_TAGS$1);
 	else nist = DEFAULT_REMEDIATION_NIST_TAGS$1;
 	const cciTags = nistToCci(nist);
-	const extras = {};
-	if (cweID) extras.cwe = cweID;
-	const tags = buildNistCciTags(nist, cciTags, extras);
+	const tags = buildNistCciTags(nist, cciTags, {});
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
 	const results = components.map((comp) => createResult(ResultStatus.Failed, void 0, {
 		codeDesc: formatSCACodeDesc(comp),
@@ -9291,6 +9928,10 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
+	const cvss = buildVeracodeCvss(vuln, components);
+	if (cvss.length > 0) req.cvss = cvss;
+	if (cweID) req.cwe = [cweID];
+	req.code = buildSCACode(vuln, components);
 	return req;
 }
 /**
@@ -9336,7 +9977,6 @@ async function convertVeracodeToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "veracode-to-hdf",
 		converterVersion,
 		toolName: "Veracode",
-		toolFormat: "XML",
 		baselines: [baseline],
 		components: [{
 			name: targetName,
@@ -9444,7 +10084,6 @@ async function convertMsftSecureScoreToHdf(input, converterVersion = "1.0.0") {
 		generatorName: "msft-secure-score-to-hdf",
 		converterVersion,
 		toolName: "Microsoft Secure Score",
-		toolFormat: "JSON",
 		baselines: combined.secureScore.value.map((ss) => {
 			if (!tenantId) tenantId = ss.azureTenantId;
 			const { items: limitedControlScores, truncated } = limitArray(ss.controlScores);
@@ -9680,7 +10319,6 @@ async function convertMsftDefenderCloudToHdf(input, converterVersion = "1.0.0")
 		generatorName: "msft-defender-cloud-to-hdf",
 		converterVersion,
 		toolName: "Microsoft Defender for Cloud",
-		toolFormat: "JSON",
 		baselines: [baseline],
 		components,
 		timestamp: scanTime
@@ -9956,8 +10594,6 @@ function buildRuleObj(req) {
 	}
 	const rationale = findDescription(req.descriptions, "rationale");
 	if (rationale) rule.rationale = wrap(rationale);
-	const fixtext = findDescription(req.descriptions, "fix");
-	if (fixtext) rule.fixtext = wrap(fixtext);
 	const idents = [];
 	if (req.tags && Array.isArray(req.tags["cci"])) for (const cci of req.tags["cci"]) idents.push({
 		[`${ATTR}system`]: "http://cyber.mil/cci",
@@ -9968,6 +10604,8 @@ function buildRuleObj(req) {
 		"#text": n
 	});
 	if (idents.length > 0) rule.ident = idents;
+	const fixtext = findDescription(req.descriptions, "fix");
+	if (fixtext) rule.fixtext = wrap(fixtext);
 	const checks = [];
 	const checkContent = findDescription(req.descriptions, "check");
 	if (checkContent) checks.push({
@@ -9998,12 +10636,19 @@ function buildTestResultObj(hdfData, baseline) {
 		if (target.ipAddress) testResult["target-address"] = wrap(target.ipAddress);
 	} else testResult.target = wrap("unknown");
 	const ruleResults = [];
+	let passed = 0;
+	let scorable = 0;
 	for (const req of baseline.requirements) {
 		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
 		for (const result of req.results) {
+			const status = hdfStatusToXccdf(result.status);
+			if (status === "pass") {
+				passed++;
+				scorable++;
+			} else if (status === "fail") scorable++;
 			const rr = {
 				[`${ATTR}idref`]: ruleIdRef,
-				result: wrap(hdfStatusToXccdf(result.status))
+				result: wrap(status)
 			};
 			rr[`${ATTR}time`] = typeof result.startTime === "string" ? result.startTime : result.startTime.toISOString();
 			if (result.message) rr.message = wrap(result.message);
@@ -10015,6 +10660,12 @@ function buildTestResultObj(hdfData, baseline) {
 		}
 	}
 	testResult["rule-result"] = ruleResults;
+	const score = scorable > 0 ? passed / scorable * 100 : 0;
+	testResult.score = {
+		[`${ATTR}system`]: "urn:xccdf:scoring:default",
+		[`${ATTR}maximum`]: "100.000000",
+		"#text": score.toFixed(6)
+	};
 	return testResult;
 }
 //#endregion
@@ -10207,23 +10858,40 @@ async function convertHdfToOscalSar(input) {
 	return JSON.stringify(doc, null, 2);
 }
 /**
+* Human-readable assessment-tool label from the HDF tool/generator identity,
+* falling back when neither is present.
+*/
+function toolPartyName(hdfResults) {
+	const tool = hdfResults.tool;
+	if (tool?.name) return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+	const gen = hdfResults.generator;
+	if (gen?.name) return gen.version ? `${gen.name} ${gen.version}` : gen.name;
+	return "HDF Assessment Tool";
+}
+/**
 * Constructs the full OSCAL assessment-results document from HDF results.
 */
 function buildOSCALDocument(hdfResults) {
 	let timestamp = formatTimestampSeconds(/* @__PURE__ */ new Date());
 	const documentTime = hdfTime(hdfResults.timestamp);
 	if (documentTime) timestamp = formatTimestampSeconds(documentTime);
+	const toolActorUuid = crypto.randomUUID();
 	const metadata = {
 		title: "HDF Assessment Results Export",
 		"last-modified": timestamp,
 		version: "1.0.0",
-		"oscal-version": OSCAL_VERSION
+		"oscal-version": OSCAL_VERSION,
+		parties: [{
+			uuid: toolActorUuid,
+			type: "organization",
+			name: toolPartyName(hdfResults)
+		}]
 	};
 	let importAP;
 	if (hdfResults.planRef && hdfResults.planRef !== "") importAP = { href: hdfResults.planRef };
 	else importAP = { href: "#" };
 	const results = [];
-	for (const baseline of hdfResults.baselines) results.push(baselineToResult(baseline, timestamp));
+	for (const baseline of hdfResults.baselines) results.push(baselineToResult(baseline, timestamp, toolActorUuid));
 	return { "assessment-results": {
 		uuid: crypto.randomUUID(),
 		metadata,
@@ -10262,7 +10930,7 @@ function assessmentStart(baseline, fallback) {
 /**
 * Converts a single EvaluatedBaseline to an OSCAL Result.
 */
-function baselineToResult(baseline, timestamp) {
+function baselineToResult(baseline, timestamp, toolActorUuid) {
 	let title = baseline.name;
 	if (baseline.title && baseline.title !== "") title = baseline.title;
 	let description = "Converted from HDF results";
@@ -10270,17 +10938,26 @@ function baselineToResult(baseline, timestamp) {
 	const findings = [];
 	const observations = [];
 	const risks = [];
+	const includeControls = [];
+	const seenControl = /* @__PURE__ */ new Set();
 	for (const req of baseline.requirements) {
-		const { finding, observation, risk } = requirementToFindingSet(req, timestamp);
+		const { finding, observation, risk } = requirementToFindingSet(req, timestamp, toolActorUuid);
 		findings.push(finding);
 		if (observation) observations.push(observation);
 		if (risk) risks.push(risk);
+		const cid = nistTagToControlId(req.id);
+		if (cid !== "" && !seenControl.has(cid)) {
+			seenControl.add(cid);
+			includeControls.push({ "control-id": cid });
+		}
 	}
+	const controlSelection = includeControls.length > 0 ? { "include-controls": includeControls } : {};
 	return {
 		uuid: crypto.randomUUID(),
 		title,
 		description,
 		start: assessmentStart(baseline, timestamp),
+		"reviewed-controls": { "control-selections": [controlSelection] },
 		findings,
 		observations,
 		risks
@@ -10289,49 +10966,39 @@ function baselineToResult(baseline, timestamp) {
 /**
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
 */
-function requirementToFindingSet(req, timestamp) {
+function requirementToFindingSet(req, timestamp, toolActorUuid) {
 	const controlID = nistTagToControlId(req.id);
-	const { state, reason } = aggregateStatus(req.results);
-	const findingDesc = extractDefaultDescription(req.descriptions);
+	const results = req.results ?? [];
+	const descriptions = req.descriptions ?? [];
+	const { state, reason } = aggregateStatus(results);
+	const findingDesc = extractDefaultDescription(descriptions);
 	const props = [];
+	const addProp = (name, value) => {
+		if (value !== "") props.push({
+			name,
+			value
+		});
+	};
 	const pushTagValues = (key) => {
 		const raw = req.tags?.[key];
 		if (Array.isArray(raw)) {
-			for (const v of raw) if (typeof v === "string") props.push({
-				name: key,
-				value: v
-			});
+			for (const v of raw) if (typeof v === "string") addProp(key, v);
 		}
 	};
 	pushTagValues("nist");
 	pushTagValues("cci");
-	if (req.code) props.push({
-		name: "code",
-		value: req.code
-	});
+	if (req.code != null) addProp("code", req.code);
 	for (const label of [
 		"check",
 		"fix",
 		"rationale"
 	]) {
-		const d = req.descriptions.find((x) => x.label === label);
-		if (d) props.push({
-			name: label,
-			value: d.data
-		});
+		const d = descriptions.find((x) => x.label === label);
+		addProp(label, d ? d.data : "");
 	}
-	if (req.controlType) props.push({
-		name: "control-type",
-		value: req.controlType
-	});
-	if (req.verificationMethod) props.push({
-		name: "verification-method",
-		value: req.verificationMethod
-	});
-	if (req.applicability) props.push({
-		name: "applicability",
-		value: req.applicability
-	});
+	if (req.controlType) addProp("control-type", req.controlType);
+	if (req.verificationMethod) addProp("verification-method", req.verificationMethod);
+	if (req.applicability) addProp("applicability", req.applicability);
 	const links = [];
 	if (Array.isArray(req.refs)) for (const r of req.refs) {
 		const o = r;
@@ -10360,19 +11027,19 @@ function requirementToFindingSet(req, timestamp) {
 	const finding = {
 		uuid: crypto.randomUUID(),
 		title,
-		description: findingDesc || "",
+		description: findingDesc || title,
 		props: props.length > 0 ? props : void 0,
 		links: links.length > 0 ? links : void 0,
 		target
 	};
 	let observation;
-	if (req.results.length > 0) {
+	if (results.length > 0) {
 		const obsUUID = crypto.randomUUID();
 		observation = {
 			uuid: obsUUID,
-			description: buildObservationDescription(req.results),
+			description: buildObservationDescription(results),
 			methods: ["TEST"],
-			collected: formatAssessmentTime(earliestResultTime(req.results), timestamp)
+			collected: formatAssessmentTime(earliestResultTime(results), timestamp)
 		};
 		finding["related-observations"] = [{ "observation-uuid": obsUUID }];
 	}
@@ -10386,11 +11053,17 @@ function requirementToFindingSet(req, timestamp) {
 			description: `Impact: ${req.impact.toFixed(1)} (${severity})`,
 			statement: `Impact: ${req.impact.toFixed(1)} (${severity})`,
 			status: riskStatusFromState(state),
-			characterizations: [{ facets: [{
-				name: "impact",
-				system: "https://fedramp.gov",
-				value: severity
-			}] }]
+			characterizations: [{
+				origin: { actors: [{
+					type: "party",
+					"actor-uuid": toolActorUuid
+				}] },
+				facets: [{
+					name: "impact",
+					system: "https://fedramp.gov",
+					value: severity
+				}]
+			}]
 		};
 		finding["related-risks"] = [{ "risk-uuid": riskUUID }];
 	}
@@ -10690,15 +11363,56 @@ function buildTags(dep) {
 	if (dep.parentDependencies.length > 0) extras.parentDependencies = dep.parentDependencies;
 	return buildNistCciTags(nist, cciTags, extras);
 }
+function titleCaseFirst(s) {
+	return s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+function buildScanRequirement(scan) {
+	const title = scan.description || `${titleCaseFirst(scan.name)} scan`;
+	const descriptions = [createDescription("default", scan.summary || `${titleCaseFirst(scan.name)} scan summary`)];
+	const results = [{
+		status: ResultStatus.NotReviewed,
+		codeDesc: `${scan.name} scan summary`,
+		startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
+	}];
+	const req = createRequirement(`scan-${scan.name}`, title, descriptions, 0, results, { tags: {
+		name: scan.name,
+		type: scan.results?.type ?? ""
+	} });
+	req.code = JSON.stringify(scan.results?.data ?? {}, null, 2);
+	req.verificationMethod = VerificationMethodEnum.Automated;
+	return req;
+}
+function verdictDescription(a) {
+	let desc = `Ion Channel analysis verdict: ${a.passed ? "PASSED" : "FAILED"}`;
+	if (a.risk) desc += ` (risk: ${a.risk})`;
+	if (a.ruleset_name) {
+		desc += `. Ruleset: ${a.ruleset_name}`;
+		if (a.ruleset_id) desc += ` (${a.ruleset_id})`;
+	}
+	return `${desc}.`;
+}
+function verdictLabels(a) {
+	const labels = { passed: String(a.passed) };
+	if (a.risk) labels.risk = a.risk;
+	if (a.ruleset_name) labels.ruleset_name = a.ruleset_name;
+	if (a.ruleset_id) labels.ruleset_id = a.ruleset_id;
+	return labels;
+}
 async function convertIonchannelToHdf(input, converterVersion = "1.0.0") {
 	if (!input?.trim()) throw new Error("Empty input");
 	validateInputSize(input, "ionchannel");
 	const analysis = parseJSON(input);
 	if (!Array.isArray(analysis.scan_summaries)) throw new Error(`Ion Channel scan_summaries invalid summary data (expecting array, got ${typeof analysis.scan_summaries})`);
 	let allDeps = [];
-	for (const scan of analysis.scan_summaries) if (scan.name === "dependency") {
-		allDeps = scan.results?.data?.dependencies ?? [];
-		break;
+	const nonDepScans = [];
+	let foundDep = false;
+	for (const scan of analysis.scan_summaries) {
+		if (scan.name === "dependency" && !foundDep) {
+			allDeps = scan.results?.data?.dependencies ?? [];
+			foundDep = true;
+			continue;
+		}
+		nonDepScans.push(scan);
 	}
 	const requirements = buildDependencyGraph(allDeps).map((dep) => {
 		const depId = `dependency-${dep.org}/${dep.name}`;
@@ -10739,12 +11453,27 @@ async function convertIonchannelToHdf(input, converterVersion = "1.0.0") {
 		status: "loaded"
 	});
 	baseline.maintainer = "saf@groups.mitre.org";
+	baseline.description = verdictDescription(analysis);
+	baseline.labels = verdictLabels(analysis);
+	const baselines = [baseline];
+	for (const scan of nonDepScans) {
+		const scanBaseline = createMinimalBaseline(`Ion Channel ${scan.name} Scan`, [buildScanRequirement(scan)], {
+			title: `Ion Channel Analysis of ${analysis.source}`,
+			summary: scan.summary,
+			integrity: {
+				algorithm: resultsChecksum.algorithm,
+				checksum: resultsChecksum.value
+			},
+			status: "loaded"
+		});
+		scanBaseline.maintainer = "saf@groups.mitre.org";
+		baselines.push(scanBaseline);
+	}
 	return buildHdfResults({
 		generatorName: "ionchannel-to-hdf",
 		converterVersion,
 		toolName: "Ion Channel",
-		toolFormat: "JSON",
-		baselines: [baseline],
+		baselines,
 		timestamp: /* @__PURE__ */ new Date()
 	});
 }
@@ -11717,7 +12446,8 @@ function buildDocument(amendments, converterVersion) {
 			...notes.length > 0 && { notes },
 			publisher: {
 				category: "other",
-				name: publisherName
+				name: publisherName,
+				namespace: "https://saf.mitre.org"
 			},
 			tracking: {
 				id: trackingId,
@@ -12027,7 +12757,11 @@ function buildMetadata(a, docTime, converterVersion) {
 }
 async function buildSerialNumber(input, a) {
 	if (a.amendmentId) return `urn:uuid:${a.amendmentId}`;
-	return `urn:uuid:${(await sha256(input)).slice(0, 32)}`;
+	const c = (await sha256(input)).slice(0, 32).split("");
+	c[12] = "5";
+	c[16] = (parseInt(c[16], 16) & 3 | 8).toString(16);
+	const h = c.join("");
+	return `urn:uuid:${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/detect.ts
@@ -13050,6 +13784,225 @@ function substituteParams(text, overrides) {
 	return result;
 }
 //#endregion
-export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, isHDFV1 };
+//#region shared/typescript/stix.ts
+/** Parse and validate a STIX 2.1 bundle. Objects are kept raw for lossless carriage. */
+function parseStixBundle(input) {
+	if (!input) throw new Error("stix: empty input");
+	let raw;
+	try {
+		raw = JSON.parse(input);
+	} catch (e) {
+		throw new Error(`stix: parsing bundle: ${e.message}`);
+	}
+	const obj = raw ?? {};
+	if (obj.type !== "bundle") throw new Error(`stix: not a STIX bundle (type=${JSON.stringify(obj.type)})`);
+	if (!Array.isArray(obj.objects)) throw new Error("stix: bundle has no objects[]");
+	return {
+		type: "bundle",
+		id: typeof obj.id === "string" ? obj.id : void 0,
+		objects: obj.objects.filter((o) => typeof o === "object" && o !== null && !Array.isArray(o))
+	};
+}
+/** Report whether the input looks like a STIX 2.1 bundle, without throwing. */
+function detectStixBundle(input) {
+	try {
+		const o = JSON.parse(input);
+		return o?.type === "bundle" && Array.isArray(o.objects);
+	} catch {
+		return false;
+	}
+}
+/** A STIX object's id ('' if absent). */
+function stixObjectId(obj) {
+	return typeof obj.id === "string" ? obj.id : "";
+}
+/**
+* The CVE ids a STIX object cites via external_references (source_name "cve").
+* A STIX vulnerability records its CVE this way, not in a native field
+* (STIX 2.1 §4.19).
+*/
+function stixObjectCVEs(obj) {
+	const refs = obj.external_references;
+	if (!Array.isArray(refs)) return [];
+	const cves = [];
+	for (const r of refs) {
+		const ref = r;
+		if (typeof ref.source_name === "string" && ref.source_name.toLowerCase() === "cve" && typeof ref.external_id === "string" && ref.external_id) cves.push(ref.external_id);
+	}
+	return cves;
+}
+//#endregion
+//#region shared/typescript/enrichStix.ts
+const DEFAULT_REVIEW_HORIZON_MS = 2160 * 60 * 60 * 1e3;
+/** Format a Date as canonical trimmed-UTC RFC3339 (seconds precision, matching Go's time.RFC3339). */
+function toRfc3339(d) {
+	return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+/**
+* Overlay a STIX 2.1 bundle onto an existing HDF results document, attaching
+* each STIX object as an inert externalReferences[] entry: a CVE-bearing object
+* attaches to the finding whose requirementId is that CVE (fanning out to every
+* match), and everything else — non-CVE objects and CVEs with no matching
+* finding — attaches to the results root. Each entry carries the raw STIX object
+* losslessly in `document`.
+*
+* Informational only: authors no overrides and fabricates no status/impact (the
+* E:A recompute is a separate, opt-in step). The results document is preserved
+* verbatim except for the appended references — manipulated structurally so
+* every pre-existing field, including timestamp strings, round-trips unchanged.
+* TypeScript peer of shared/go/enrich_stix.go (kept at parity).
+*/
+function enrichStix(resultsInput, bundleInput, opts) {
+	validateInputSize(resultsInput, "enrich-stix", opts?.maxSize);
+	validateInputSize(bundleInput, "enrich-stix", opts?.maxSize);
+	if (!resultsInput) throw new Error("enrich-stix: empty results input");
+	const bundle = parseStixBundle(bundleInput);
+	let parsed;
+	try {
+		parsed = JSON.parse(resultsInput);
+	} catch (e) {
+		throw new Error(`enrich-stix: parsing results: ${e.message}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("enrich-stix: results input is not a JSON object");
+	const doc = parsed;
+	const reqById = indexRequirementsById(doc);
+	for (const obj of bundle.objects) {
+		let matched = false;
+		for (const cve of stixObjectCVEs(obj)) for (const req of reqById.get(cve) ?? []) {
+			appendExternalReference(req, buildStixRef(obj, "investigate"));
+			matched = true;
+		}
+		if (!matched) appendExternalReference(doc, buildStixRef(obj, "reference"));
+	}
+	if (opts?.recomputeCvss) recomputeExploitation(bundle, reqById, opts);
+	return JSON.stringify(doc, null, 2);
+}
+/**
+* Author an inline riskAdjustment on each CVE-matched finding that has a 3.1 base
+* vector and whose CVE carries a structural exploitation signal in the bundle.
+* Applies CVSS Exploit Maturity E:H (the 3.1 analog of 4.0 E:A) and recomputes
+* the Threat score. Skips (no fabrication) when a base vector is absent or non-3.1.
+* TypeScript peer of recomputeExploitation in enrich_stix.go.
+*/
+function recomputeExploitation(bundle, reqById, opts) {
+	const appliedAt = opts.asOf ?? /* @__PURE__ */ new Date();
+	const expiresAt = new Date(appliedAt.getTime() + (opts.reviewHorizonMs ?? DEFAULT_REVIEW_HORIZON_MS));
+	for (const [cve, src] of exploitedCves(bundle)) for (const req of reqById.get(cve) ?? []) {
+		const entry = findBaseVectorEntry(req, cve);
+		if (!entry) continue;
+		const baseVector = entry.baseVector;
+		let score;
+		try {
+			score = computeCvssScore(`${baseVector}/E:H`);
+		} catch {
+			continue;
+		}
+		const ov = buildRiskAdjustment(cve, baseVector, score, src, appliedAt, expiresAt);
+		req.statusOverrides = [...Array.isArray(req.statusOverrides) ? req.statusOverrides : [], ov];
+	}
+}
+/**
+* Map each CVE with a structural exploitation signal in the bundle to the STIX
+* object providing it: a sighting (sighting_of_ref), a targets/exploits
+* relationship (target_ref), or an indicator/report (object_refs).
+*/
+function exploitedCves(bundle) {
+	const vulnCves = /* @__PURE__ */ new Map();
+	for (const o of bundle.objects) if (o.type === "vulnerability") {
+		const id = stixObjectId(o);
+		vulnCves.set(id, [...vulnCves.get(id) ?? [], ...stixObjectCVEs(o)]);
+	}
+	const exploited = /* @__PURE__ */ new Map();
+	const mark = (vulnId, src) => {
+		for (const cve of vulnCves.get(vulnId) ?? []) if (!exploited.has(cve)) exploited.set(cve, src);
+	};
+	for (const o of bundle.objects) if (o.type === "sighting" && typeof o.sighting_of_ref === "string") mark(o.sighting_of_ref, o);
+	else if (o.type === "relationship" && (o.relationship_type === "targets" || o.relationship_type === "exploits") && typeof o.target_ref === "string") mark(o.target_ref, o);
+	else if ((o.type === "indicator" || o.type === "report") && Array.isArray(o.object_refs)) {
+		for (const r of o.object_refs) if (typeof r === "string") mark(r, o);
+	}
+	return exploited;
+}
+/** The finding's cvss[] entry carrying a base vector for the CVE (or a version-agnostic entry). */
+function findBaseVectorEntry(req, cve) {
+	const arr = req.cvss;
+	if (!Array.isArray(arr)) return void 0;
+	for (const e of arr) {
+		const m = e;
+		const bv = m.baseVector;
+		if (typeof bv === "string" && bv) {
+			const id = m.id;
+			if (id === void 0 || id === cve) return m;
+		}
+	}
+}
+/** Build the inline riskAdjustment recording the E:H-recomputed Threat score + STIX source. */
+function buildRiskAdjustment(cve, baseVector, score, src, appliedAt, expiresAt) {
+	return {
+		type: "riskAdjustment",
+		reason: `${cve} actively exploited per STIX threat intelligence (${stixObjectId(src)}); CVSS Threat recomputed with Exploit Maturity E:H.`,
+		impact: { value: roundImpact(score.temporalScore / 10) },
+		appliedBy: {
+			type: "other",
+			identifier: "hdf-enrich"
+		},
+		appliedAt: toRfc3339(appliedAt),
+		expiresAt: toRfc3339(expiresAt),
+		cvss: {
+			version: "3.1",
+			id: cve,
+			baseVector,
+			baseScore: score.baseScore,
+			threatVector: "E:H",
+			threatScore: score.temporalScore,
+			computedScore: score.temporalScore
+		},
+		externalReferences: [buildStixRef(src, "evidence")]
+	};
+}
+/** Map each finding id to the requirement objects carrying it (fan-out across baselines). */
+function indexRequirementsById(doc) {
+	const index = /* @__PURE__ */ new Map();
+	const baselines = Array.isArray(doc.baselines) ? doc.baselines : [];
+	for (const b of baselines) {
+		const reqs = b?.requirements;
+		if (!Array.isArray(reqs)) continue;
+		for (const r of reqs) {
+			const req = r;
+			if (typeof req.id === "string" && req.id) {
+				const list = index.get(req.id) ?? [];
+				list.push(req);
+				index.set(req.id, list);
+			}
+		}
+	}
+	return index;
+}
+/** Build an External_Reference envelope carrying the raw STIX object in `document`. `rel` is an open token. */
+function buildStixRef(obj, rel) {
+	const ref = {
+		sourceName: "stix",
+		kind: "threat-intel",
+		rel,
+		document: obj
+	};
+	const id = stixObjectId(obj);
+	if (id) ref.externalId = id;
+	else ref.description = stixFallbackDescription(obj);
+	return ref;
+}
+/** Human-readable description for an id-less STIX object: its name, else a
+*  type-derived label, else a generic one — so its reference satisfies anyOf. */
+function stixFallbackDescription(obj) {
+	if (typeof obj.name === "string" && obj.name) return obj.name;
+	if (typeof obj.type === "string" && obj.type) return `STIX ${obj.type} object`;
+	return "STIX object";
+}
+/** Append a reference to a container's externalReferences[], creating it if absent. */
+function appendExternalReference(container, ref) {
+	container.externalReferences = [...Array.isArray(container.externalReferences) ? container.externalReferences : [], ref];
+}
+//#endregion
+export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, detectStixBundle, enrichStix, isHDFV1, parseStixBundle };
 
 //# sourceMappingURL=index.js.map