@mitre/hdf-converters 3.5.1 → 3.6.0-rc.1

package/dist/index.js

@@ -1,6 +1,6 @@
-import { n as detectFormat, r as detectConverter, t as registerAllFingerprints } from "./register-all-As5mLT-V.js";
+import { n as detectFormat, r as detectConverter, t as registerAllFingerprints } from "./register-all-CDfYvwQF.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, impactToSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, roundImpact, severityToImpact, sha256, stripHtml as stripHTML, trimUtcFraction, worstStatus } from "@mitre/hdf-utilities";
+import { buildCsv, buildXml, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, worstStatus } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
 //#region shared/typescript/converterutil.ts
@@ -26,6 +26,32 @@ async function inputChecksum(input) {
 		value: await sha256(input)
 	};
 }
+const DIGEST_HASH_ALGORITHMS = {
+	sha256: HashAlgorithm.Sha256,
+	sha384: HashAlgorithm.Sha384,
+	sha512: HashAlgorithm.Sha512,
+	blake3: HashAlgorithm.Blake3
+};
+/**
+* Convert a "<algo>:<hex>" digest into a Component.integrity checksum, folding
+* the algorithm prefix into Checksum.algorithm. Returns undefined for an empty
+* digest, one with no algorithm prefix, or one whose algorithm the closed
+* Hash_Algorithm enum cannot represent (e.g. sha1/md5) — it never mislabels a
+* digest under a wrong algorithm. Callers whose digest is embedded in a larger
+* reference ("name@sha256:hex") must extract the "<algo>:<hex>" portion first.
+* Go peer: DigestToChecksums.
+*/
+function digestToChecksums(digest) {
+	if (!digest) return void 0;
+	const i = digest.indexOf(":");
+	if (i < 0) return void 0;
+	const algorithm = DIGEST_HASH_ALGORITHMS[digest.slice(0, i)];
+	if (!algorithm) return void 0;
+	return [{
+		algorithm,
+		value: digest.slice(i + 1)
+	}];
+}
 /**
 * Compute an Integrity object (for root-level document integrity) from raw input.
 *
@@ -135,6 +161,20 @@ function extractCWEIDs(text) {
 	ids.sort();
 	return ids;
 }
+/**
+* Return the first candidate whose content is not empty or whitespace-only,
+* as-is (the emptiness test trims, the returned value does not). Returns '' when
+* every candidate is empty or whitespace. The caller supplies its own documented
+* fallback as the last candidate so the substituted value is meaningful per
+* field — this helper never invents a placeholder like "N/A". Use it where a
+* target schema requires a non-empty (often minLength:1) string and a source
+* value may be absent; it is a selection helper, not a normalizer, and never
+* decides to OMIT a field (that stays the caller's call). Go parity: FirstNonEmpty.
+*/
+function firstNonEmpty(...candidates) {
+	for (const c of candidates) if (c.trim() !== "") return c;
+	return "";
+}
 /** Default maximum input size for converters (50MB) */
 const DEFAULT_MAX_INPUT_SIZE = 50 * 1024 * 1024;
 /**
@@ -165,6 +205,37 @@ function parseHdf(input) {
 	return parseJSON(normalizeHdfTimestamps(input));
 }
 /**
+* The shared structural-input guard for HDF Results exporters: the prologue
+* every exporter needs — empty guard, input-size validation, parse, and a
+* top-level `baselines` array check — returning the parsed document and its
+* baselines. Extracted from exportmap.runExport so non-exportmap exporters stop
+* reinventing (and skipping) it. The "missing baselines field" wording matches
+* exportmap and hdf-to-oscal-sar, so there is no consumer-visible message churn.
+*/
+function requireHdfResults(input, converterName) {
+	return requireHdfStructure(input, converterName, "baselines");
+}
+/**
+* Reject malformed HDF input (empty, oversized, non-JSON, top-level array/null,
+* or a missing/wrong-typed structural key) before a converter zero-fills it into
+* a typed document. A parsed JSON `null` (or array, or primitive) is NOT an HDF
+* document object, so it produces the canonical missing-field error rather than
+* a TypeError — matching Go's nil-map no-op on `null`.
+*/
+function requireHdfStructure(input, converterName, field) {
+	if (input.length === 0) throw new Error(`${converterName}: empty input`);
+	validateInputSize(input, converterName);
+	const parsed = parseHdf(input);
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`${converterName}: invalid HDF structure: missing ${field} field`);
+	const doc = parsed;
+	const items = doc[field];
+	if (!Array.isArray(items)) throw new Error(`${converterName}: invalid HDF structure: missing ${field} field`);
+	return {
+		doc,
+		items
+	};
+}
+/**
 * Read a timestamp field off a parsed HDF document.
 *
 * The generated schema types these as `Date` (startTime, appliedAt, ...), but
@@ -241,7 +312,7 @@ function ecosystemFromPurlType(type) {
 *   - purl alone
 *   - cpe alone
 */
-function buildAffectedPackage$1(opts) {
+function buildAffectedPackage$2(opts) {
 	const pkg = {};
 	if (opts.purl) pkg.purl = opts.purl;
 	if (opts.cpe) pkg.cpe = opts.cpe;
@@ -444,6 +515,16 @@ function buildNoFindingsRequirement(id, codeDesc, startTime) {
 		tags: {}
 	};
 }
+/**
+* Shared marker converters emit when a source severity is unrated
+* (isUnratedSeverity), so a defaulted impact stays distinguishable from a
+* genuine rated medium. TS peer of MarkUnratedSeverity in converterutil.go.
+*/
+const UNRATED_SEVERITY_TAG = "severity_rating";
+const UNRATED_SEVERITY_VALUE = "unrated";
+function markUnratedSeverity(tags, severity) {
+	if (isUnratedSeverity(severity)) tags[UNRATED_SEVERITY_TAG] = UNRATED_SEVERITY_VALUE;
+}
 //#endregion
 //#region converters/legacyhdf-to-hdf/typescript/converter.ts
 /**
@@ -457,7 +538,7 @@ function buildNoFindingsRequirement(id, codeDesc, startTime) {
 * - Overlay flattening: merge overlay/wrapper baselines so every requirement has results
 */
 /** Valid severity values per HDF v2.0 schema (matches the Go converter). */
-const VALID_SEVERITIES = /* @__PURE__ */ new Set([
+const VALID_SEVERITIES$1 = /* @__PURE__ */ new Set([
 	"critical",
 	"high",
 	"medium",
@@ -471,7 +552,7 @@ const VALID_SEVERITIES = /* @__PURE__ */ new Set([
 function tagSeverityToSeverity(tagSeverity) {
 	if (typeof tagSeverity !== "string") return null;
 	const normalized = tagSeverity.toLowerCase().trim();
-	return VALID_SEVERITIES.has(normalized) ? normalized : null;
+	return VALID_SEVERITIES$1.has(normalized) ? normalized : null;
 }
 /**
 * Normalize status values from v1.0 to v2.0 format.
@@ -489,8 +570,9 @@ function normalizeStatus$1(status) {
 }
 /**
 * Compute effectiveStatus from impact and v2 results via the canonical
-* worst-wins ordering in @mitre/hdf-utilities (impact=0 → notApplicable;
-* error > failed > passed > notApplicable > notReviewed).
+* worst-wins ordering in @mitre/hdf-utilities (impact=0 → notApplicable
+* unless the roll-up is error; error > failed > passed > notApplicable >
+* notReviewed).
 */
 function computeEffectiveStatus$1(impact, results) {
 	return computeEffectiveStatus({
@@ -499,6 +581,18 @@ function computeEffectiveStatus$1(impact, results) {
 	});
 }
 /**
+* Encodes a control-level execution error the source tool reported but did not
+* record as a result, reusing the earliest recorded result time (matching the
+* Go converter).
+*/
+function synthesizedErrorResult(results) {
+	return {
+		status: "error",
+		codeDesc: "Synthesized from the source control-level error status: the tool reported an execution error not reflected in any recorded result",
+		startTime: results.map((r) => r.startTime).filter((t) => typeof t === "string" && t !== "" && t !== "0001-01-01T00:00:00Z").sort()[0] ?? "0001-01-01T00:00:00Z"
+	};
+}
+/**
 * Convert v1.0 result to v2.0 result.
 * Transforms snake_case field names to camelCase.
 */
@@ -592,9 +686,10 @@ function convertControl(v1Control) {
 		if (refs) v2Req.refs = refs;
 	}
 	if (v1Control.source_location !== void 0) v2Req.sourceLocation = v1Control.source_location;
-	if (v1Control.status !== void 0) v2Req.effectiveStatus = normalizeStatus$1(v1Control.status);
+	const controlLevelError = v1Control.status !== void 0 && normalizeStatus$1(v1Control.status) === "error";
 	if (v1Control.results && Array.isArray(v1Control.results)) v2Req.results = v1Control.results.map(convertResult);
-	if (!v2Req.effectiveStatus) v2Req.effectiveStatus = computeEffectiveStatus$1(v1Control.impact, v2Req.results ?? []);
+	if (controlLevelError && !(v2Req.results ?? []).some((r) => r.status === "error")) v2Req.results = [...v2Req.results ?? [], synthesizedErrorResult(v2Req.results ?? [])];
+	v2Req.effectiveStatus = computeEffectiveStatus$1(v1Control.impact, v2Req.results ?? []);
 	v2Req.severity = tagSeverityToSeverity(v1Control.tags?.severity) ?? impactToSeverity(v1Control.impact);
 	const rawNist = v1Control.tags?.nist;
 	if (Array.isArray(rawNist)) {
@@ -774,7 +869,7 @@ function documentTimestamp(v1Data) {
 	}
 	return latest ? formatTimestamp(latest) : void 0;
 }
-function convertV1ToV2(v1Data, converterVersion = "1.0.0") {
+function convertLegacyHdf(v1Data, converterVersion = "1.0.0") {
 	validateInputSize(JSON.stringify(v1Data), "legacyhdf-to-hdf");
 	const v2 = {
 		baselines: (v1Data.profiles || []).map(convertProfile),
@@ -820,7 +915,7 @@ function convertV1ToV2(v1Data, converterVersion = "1.0.0") {
 * @param data - Unknown data to validate
 * @returns true if data looks like HDF v1.0
 */
-function isHDFV1(data) {
+function isLegacyHdf(data) {
 	if (typeof data !== "object" || data === null) return false;
 	const obj = data;
 	return typeof obj.version === "string" && Array.isArray(obj.profiles) && typeof obj.platform === "object" && obj.platform !== null;
@@ -1194,7 +1289,7 @@ function trivyLocation(o) {
 	if (el && el !== "0" && el !== sl) loc += `-${el}`;
 	return loc;
 }
-function buildRequirement$17(id, group) {
+function buildRequirement$19(id, group) {
 	const primary = group[0];
 	const impact = Math.max(...group.map(findingImpact));
 	const descriptions = [{
@@ -1241,7 +1336,7 @@ function buildBaseline$1(name, findings, resultsChecksum) {
 			groups.set(id, [f]);
 		}
 	}
-	return createMinimalBaseline(name, order.map((id) => buildRequirement$17(id, groups.get(id))), { resultsChecksum });
+	return createMinimalBaseline(name, order.map((id) => buildRequirement$19(id, groups.get(id))), { resultsChecksum });
 }
 /** Converts an ASFF document to HDF Results JSON. */
 async function convertAsffToHdf(input, converterVersion = "1.0.0") {
@@ -1289,7 +1384,7 @@ async function convertAsffToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/sarif-to-hdf/typescript/converter.ts
-const IMPACT_MAPPING$9 = {
+const SARIF_ALIASES = {
 	error: .7,
 	warning: .5,
 	note: .3
@@ -1361,17 +1456,17 @@ function convertResultGroup(ruleId, rule, sarifResults, timestamp) {
 	const firstResult = sarifResults[0];
 	const { title, description } = deriveMetadata(firstResult, rule);
 	let cweIds = extractCweFromRule(rule);
-	if (cweIds.length === 0) cweIds = extractCweIds(resolveMessageText(firstResult.message, rule));
+	if (cweIds.length === 0) cweIds = extractCweIds$1(resolveMessageText(firstResult.message, rule));
 	const nistControls = mapCWEToNIST(cweIds, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	const cciControls = nistToCci(nistControls);
 	const ruleLevel = resolveRuleLevel(rule, sarifResults);
-	const impact = IMPACT_MAPPING$9[ruleLevel] || .1;
+	const impact = severityToImpactWithAliases(ruleLevel, SARIF_ALIASES, 0) || .1;
 	const sourceLocation = firstResult.locations && firstResult.locations.length > 0 ? extractSourceLocation$1(firstResult.locations[0]) : void 0;
 	const results = [];
 	for (const sr of sarifResults) results.push(...convertSarifResultToHDFResults(sr));
 	const descriptions = buildDescriptions$2(description, rule, firstResult);
 	const allSuppressions = sarifResults.flatMap((sr) => sr.suppressions ?? []);
-	const options = { tags: buildTags$3(firstResult, rule, ruleLevel, cweIds, nistControls, cciControls, allSuppressions) };
+	const options = { tags: buildTags$4(firstResult, rule, ruleLevel, cweIds, nistControls, cciControls, allSuppressions) };
 	if (sourceLocation) options.sourceLocation = sourceLocation;
 	const req = createRequirement(ruleId, title, descriptions, impact, results, options);
 	const controlType = deriveControlTypeFromTags(nistControls);
@@ -1431,7 +1526,7 @@ function packageFromSarifProperties(props) {
 	if (props.purl) ecosystem = ecosystemFromPurlType(parsePurl(props.purl)?.type);
 	else if (props.ecosystem) ecosystem = ecosystemFromPurlType(props.ecosystem);
 	else if (name && version) ecosystem = Ecosystem.Generic;
-	return buildAffectedPackage$1({
+	return buildAffectedPackage$2({
 		name,
 		version,
 		ecosystem,
@@ -1520,7 +1615,7 @@ function extractCweFromRule(rule) {
 	}
 	return [];
 }
-function extractCweIds(text) {
+function extractCweIds$1(text) {
 	return extractCWEIDs(text).map((id) => `CWE-${id}`);
 }
 function mapKindToStatus(kind) {
@@ -1602,7 +1697,7 @@ function buildDescriptions$2(defaultDesc, rule, result) {
 	if (result.fixes && result.fixes.length > 0 && result.fixes[0]?.description?.text) descriptions.push(createDescription("fix", result.fixes[0].description.text));
 	return descriptions;
 }
-function buildTags$3(result, rule, resolvedLevel, cweIds, nistControls, cciControls, allSuppressions) {
+function buildTags$4(result, rule, resolvedLevel, cweIds, nistControls, cciControls, allSuppressions) {
 	const tags = {
 		severity: resolvedLevel,
 		cwe: cweIds,
@@ -2181,7 +2276,7 @@ function ruleResultToRequirement(rr, ruleIndex, groupIndex, scanTime) {
 	const req = createRequirement(id, title, descriptions, impact, [result], { tags });
 	const code = buildCheckCode(check);
 	if (code) req.code = code;
-	const refs = buildRefs$9(ruleDef?.reference);
+	const refs = buildRefs$10(ruleDef?.reference);
 	if (refs.length > 0) req.refs = refs;
 	const hdfSeverity = xccdfSeverityToHdf(severity);
 	if (hdfSeverity) req.severity = hdfSeverity;
@@ -2338,7 +2433,7 @@ function checkDescriptionData(check) {
 * href, when present, populates url. References that carry nothing are skipped.
 * Inner keys are inserted alphabetically to match Go's map JSON ordering.
 */
-function buildRefs$9(refs) {
+function buildRefs$10(refs) {
 	if (!refs) return [];
 	const out = [];
 	for (const r of refs) {
@@ -2863,6 +2958,13 @@ function cklbTitle(cl) {
 //#endregion
 //#region shared/typescript/checklist/to-hdf.ts
 const CONVERTER_VERSION = "1.0.0";
+const VALID_SEVERITIES = /* @__PURE__ */ new Set([
+	"critical",
+	"high",
+	"medium",
+	"low",
+	"informational"
+]);
 /**
 * Map the format-neutral Checklist model to an HDF Results object.
 * controlType is derived per-Vuln from CCI->NIST; verificationMethod and
@@ -2934,7 +3036,7 @@ function vulnToRequirement(v, scanTime) {
 	if (v.legacyIDs && v.legacyIDs.length) tags["legacy_ids"] = v.legacyIDs;
 	if (v.extra && Object.keys(v.extra).length > 0) tags["cklMetadata"] = { ...v.extra };
 	const req = createRequirement(v.vulnNum, v.ruleTitle ?? v.vulnNum, descriptions, impact, [result], { tags });
-	if (severity) req.severity = severity;
+	if (VALID_SEVERITIES.has(severity)) req.severity = severity;
 	const controlType = deriveControlTypeFromTags(nistTags);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
@@ -2985,6 +3087,36 @@ function setIf$1(m, key, val) {
 	if (val) m[key] = val;
 }
 //#endregion
+//#region shared/typescript/status.ts
+/**
+* Bridge from schema-typed requirements onto the canonical effective-status
+* helper in @mitre/hdf-utilities, so every consumer computes status through
+* the single shared implementation (twin of shared/go/status.go). The stored
+* effectiveStatus field is never read — it is an output cache (see
+* status-determination.md).
+*/
+/** RFC3339 string from a schema timestamp (quicktype Date or raw string). */
+function stamp(v) {
+	if (v instanceof Date) return v.toISOString();
+	if (typeof v === "string" && v !== "") return v;
+}
+/** Maps a requirement onto the canonical effective-status input shape. */
+function requirementStatusInput(req) {
+	return {
+		impact: req.impact,
+		resultStatuses: (req.results ?? []).map((r) => String(r.status)),
+		overrides: (req.statusOverrides ?? []).map((o) => ({
+			status: o.status ? String(o.status) : void 0,
+			appliedAt: stamp(o.appliedAt),
+			expiresAt: stamp(o.expiresAt)
+		}))
+	};
+}
+/** The requirement's canonical effective status via the shared ladder. */
+function requirementEffectiveStatus(req) {
+	return computeEffectiveStatus(requirementStatusInput(req));
+}
+//#endregion
 //#region shared/typescript/checklist/from-hdf.ts
 /**
 * Map HDF Results back to the format-neutral Checklist model. When the HDF
@@ -3077,7 +3209,7 @@ function requirementToVuln(req) {
 	};
 }
 function effectiveOrRawStatus(req) {
-	return req.effectiveStatus ?? req.results?.[0]?.status;
+	return requirementEffectiveStatus(req);
 }
 function composeFindingDetails(req) {
 	const results = req.results ?? [];
@@ -3252,6 +3384,527 @@ function convertHdfToCklb(input) {
 	return serializeCklb(hdfToChecklist(input));
 }
 //#endregion
+//#region converters/kics-to-hdf/typescript/mapping-data.ts
+const kicsMappingData = {};
+//#endregion
+//#region converters/kics-to-hdf/typescript/converter.ts
+/**
+* KICS publishes five severities. SARIF collapses CRITICAL and HIGH into
+* `error`; converting the native format keeps them apart, which is a large part
+* of why this converter exists. The shared standard map covers four of them,
+* with INFO at the canonical 0.0 tier like every other converter: the
+* effective-status layer maps impact-0 requirements to notApplicable, so
+* info-tier findings stay visible in the output without entering the
+* compliance ratio. TRACE is KICS-specific and joins the info tier as an
+* alias — the Go peer of this table is kicsSeverityAliases.
+*/
+const KICS_SEVERITY_ALIASES = { trace: 0 };
+const DEFAULT_IMPACT$1 = .5;
+/**
+* Records which tier resolved a requirement's NIST tags, so a reviewed mapping
+* stays distinguishable from a CWE-derived guess and from a static default.
+* Follows the precedent set by UNRATED_SEVERITY_TAG in converterutil, which
+* exists so a defaulted impact stays distinguishable from a genuine rated one.
+*
+* The per-query table is authoritative, matching how the Checkov and AWS Config
+* mappers in the v1 line work: the rule-to-control decision is reviewed before
+* shipping rather than computed at conversion time, which is also what lets
+* those tables carry control enhancements. CWE is a fallback because it is a
+* lossy proxy — only 30 of the 102 CWEs KICS uses resolve against the CWE→NIST
+* table, 52% of queries by volume.
+*/
+const NIST_MAPPING_TAG = "nistMapping";
+const NIST_MAPPING_TABLE = "mapped";
+const NIST_MAPPING_CWE = "cwe-derived";
+const NIST_MAPPING_FALLBACK = "static-fallback";
+function impactFor$1(severity) {
+	return severityToImpactWithAliases(severity, KICS_SEVERITY_ALIASES, DEFAULT_IMPACT$1);
+}
+/** KICS emits the bare number, e.g. "778". Normalize before the lookup. */
+function cweIdentifiers(query) {
+	const raw = query.cwe;
+	if (raw === void 0 || raw === null || String(raw).trim() === "") return [];
+	const id = String(raw).trim().replace(/^CWE-/i, "");
+	return /^\d+$/.test(id) ? [`CWE-${id}`] : [];
+}
+function locationFor(file) {
+	const parts = [`File: ${file.file_name || "unknown"}`];
+	if (typeof file.line === "number" && file.line > 0) parts.push(`Line: ${file.line}`);
+	if (file.resource_type) parts.push(`Resource type: ${file.resource_type}`);
+	if (file.resource_name && file.resource_name !== "unknown") parts.push(`Resource: ${file.resource_name}`);
+	if (file.search_key) parts.push(`Key: ${file.search_key}`);
+	if (file.similarity_id) parts.push(`Similarity ID: ${file.similarity_id}`);
+	return parts.join("\n");
+}
+/**
+* The remediation pair. SARIF keeps only `actual_value` inside its message, so
+* a SARIF-derived control can say what the configuration is but never what it
+* should be.
+*/
+function evidenceFor(file) {
+	const parts = [];
+	if (file.expected_value) parts.push(`Expected: ${file.expected_value}`);
+	if (file.actual_value) parts.push(`Actual: ${file.actual_value}`);
+	if (file.issue_type) parts.push(`Issue type: ${file.issue_type}`);
+	if (file.search_value) parts.push(`Search value: ${file.search_value}`);
+	return parts.join("\n");
+}
+/**
+* Resolution order: the reviewed per-query table, then the query's CWE, then the
+* static-analysis defaults. `table` is a parameter so all three tiers are
+* testable without shipping unreviewed rows in the table itself.
+*/
+function resolveControls(query, table = kicsMappingData) {
+	const entry = typeof query.query_id === "string" && Object.prototype.hasOwnProperty.call(table, query.query_id) ? table[query.query_id] : void 0;
+	if (entry !== void 0 && entry.nist.length > 0) return {
+		nist: entry.nist,
+		cci: entry.cci,
+		source: NIST_MAPPING_TABLE
+	};
+	const fromCwe = mapCWEToNIST(cweIdentifiers(query), []);
+	if (fromCwe.length > 0) return {
+		nist: fromCwe,
+		cci: nistToCci(fromCwe),
+		source: NIST_MAPPING_CWE
+	};
+	const fallback = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+	return {
+		nist: fallback,
+		cci: nistToCci(fallback),
+		source: NIST_MAPPING_FALLBACK
+	};
+}
+function tagsFor$1(query) {
+	const cwe = cweIdentifiers(query);
+	const { nist, cci, source } = resolveControls(query);
+	const extras = { [NIST_MAPPING_TAG]: source };
+	if (cwe.length > 0) extras.cwe = cwe;
+	if (query.severity) extras.severity = query.severity;
+	if (query.platform) extras.platform = query.platform;
+	if (query.cloud_provider) extras.cloudProvider = query.cloud_provider;
+	if (query.category) extras.category = query.category;
+	if (query.query_url) extras.queryUrl = query.query_url;
+	if (query.risk_score != null) extras.riskScore = String(query.risk_score);
+	if (query.description_id) extras.descriptionId = query.description_id;
+	if (query.experimental) extras.experimental = true;
+	const issueTypes = [...new Set((query.files ?? []).map((f) => f.issue_type).filter(Boolean))];
+	if (issueTypes.length > 0) extras.issueType = issueTypes;
+	const resourceTypes = [...new Set((query.files ?? []).map((f) => f.resource_type).filter(Boolean))];
+	if (resourceTypes.length > 0) extras.resourceType = resourceTypes;
+	markUnratedSeverity(extras, query.severity);
+	return buildNistCciTags(nist, cci, extras);
+}
+/**
+* KICS reports violations only. Its output carries no record of the queries
+* that ran without finding anything — `queries[]` contains only those that
+* fired — so no passing requirement can be derived from it, and a converted
+* profile is failures-only by construction.
+*
+* That makes the compliance percentage misleading on its own: a scan where 72
+* of 2,034 queries fired renders as 100% failed. This requirement carries the
+* denominator so the ratio is legible.
+*
+* Impact 0 and status notApplicable both keep it out of the score: the
+* effective-status layer (computeEffectiveStatus) maps impact-0 requirements
+* to notApplicable before statuses are counted, and notApplicable is the one
+* status the compliance rollup excludes from both numerator and denominator.
+* Emitting notApplicable as the raw status too keeps raw-status consumers
+* agreeing with the effective view — Passed would export to CKL as
+* NotAFinding, a compliant-looking control that was never checked, and count
+* as a free pass in raw status rollups.
+*/
+function buildCoverageRequirement$1(report, startTime) {
+	const executed = report.queries_total ?? 0;
+	const fired = (report.queries ?? []).filter((q) => (q.files ?? []).length > 0).length;
+	const summary = `KICS executed ${executed} queries against ${report.files_scanned ?? 0} file(s) (${report.files_parsed ?? 0} parsed); ${fired} produced findings. KICS reports violations only and does not enumerate the queries that ran without finding anything, so no passing requirements can be derived from its output and the compliance ratio should not be read as a pass rate.`;
+	return {
+		id: "kics-scan-coverage",
+		title: "KICS scan coverage",
+		impact: 0,
+		descriptions: [{
+			label: "default",
+			data: summary
+		}],
+		results: [{
+			status: ResultStatus.NotApplicable,
+			codeDesc: summary,
+			startTime
+		}],
+		tags: {
+			queriesExecuted: executed,
+			queriesWithFindings: fired,
+			filesScanned: report.files_scanned ?? 0,
+			filesParsed: report.files_parsed ?? 0,
+			filesFailedToScan: report.files_failed_to_scan ?? 0,
+			queriesFailedToExecute: report.queries_failed_to_execute ?? 0
+		}
+	};
+}
+function buildRequirement$18(query, startTime) {
+	const tags = tagsFor$1(query);
+	const descriptions = [{
+		label: "default",
+		data: query.description ?? ""
+	}];
+	const results = (query.files ?? []).map((file) => ({
+		status: ResultStatus.Failed,
+		codeDesc: locationFor(file),
+		message: evidenceFor(file),
+		startTime
+	}));
+	const requirement = createRequirement(query.query_id || query.query_name || "unknown", query.query_name || query.query_id || "Unnamed KICS query", descriptions, impactFor$1(query.severity), results, { tags });
+	requirement.verificationMethod = VerificationMethodEnum.Automated;
+	const controlType = deriveControlTypeFromTags(tags.nist);
+	if (controlType !== void 0) requirement.controlType = controlType;
+	return requirement;
+}
+/**
+* Converts native `kics scan --report-formats json` output to HDF.
+*
+* KICS also emits SARIF, which carries its CWE taxonomy properly. What SARIF
+* drops is the remediation pair (`expected_value`), the add-a-block versus
+* fix-a-value distinction (`issue_type`), the stable finding fingerprint
+* (`similarity_id`), and one level of severity granularity.
+*
+* @param input - KICS JSON report string
+* @returns HDF JSON string
+*/
+async function convertKicsToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize(input, "kics");
+	if (!input || input.trim().length === 0) throw new Error("kics: empty input");
+	const report = parseJSON(input);
+	if (!Array.isArray(report.queries) || typeof report.kics_version !== "string") throw new Error("kics: input does not look like a KICS report");
+	const startTime = /* @__PURE__ */ new Date();
+	const requirements = report.queries.filter((q) => Array.isArray(q.files) && q.files.length > 0).map((q) => buildRequirement$18(q, startTime));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("kics-no-findings", `KICS scanned ${report.files_scanned ?? 0} file(s) and reported no findings.`, startTime));
+	requirements.push(buildCoverageRequirement$1(report, startTime));
+	const baseline = createMinimalBaseline("KICS Scan", requirements, {
+		title: "KICS infrastructure-as-code scan",
+		resultsChecksum: await inputChecksum(input)
+	});
+	return buildHdfResults({
+		generatorName: "kics-to-hdf",
+		converterVersion,
+		toolName: "KICS",
+		toolVersion: report.kics_version,
+		toolFormat: "json",
+		baselines: [baseline],
+		timestamp: startTime
+	});
+}
+//#endregion
+//#region converters/semgrep-to-hdf/typescript/converter.ts
+/**
+* Semgrep's native three-level scale mapped onto the canonical impact tiers,
+* mirroring the sarif converter's error/warning/note aliases. INFO is
+* deliberately 0.3 (an actionable low, semgrep's analogue of SARIF 'note'),
+* not the canonical 0.0 info tier. Supply-chain severities
+* (critical/high/medium/low) resolve through the shared canonical map.
+*/
+const SEMGREP_SEVERITY_ALIASES = {
+	error: .7,
+	warning: .5,
+	info: .3
+};
+/**
+* An unrecognized or absent severity is treated as moderate; the absent case
+* additionally carries the shared unrated marker so consumers can tell a
+* defaulted 0.5 from a genuine medium.
+*/
+const DEFAULT_IMPACT = .5;
+/** Fields Semgrep redacts in unauthenticated (OSS) scans. */
+const REDACTED_PLACEHOLDER = "requires login";
+const SCAN_ERRORS_ID = "semgrep-scan-errors";
+const COVERAGE_ID = "semgrep-scan-coverage";
+function isPresent(value) {
+	return typeof value === "string" && value.length > 0 && value !== REDACTED_PLACEHOLDER;
+}
+/**
+* Array entries are filtered per-entry (non-string members dropped); a bare
+* empty string is treated as absent, matching the Go StringOrSlice decoder.
+*/
+function normalizeToArray(value) {
+	if (Array.isArray(value)) return value.filter((entry) => typeof entry === "string");
+	return typeof value === "string" && value !== "" ? [value] : [];
+}
+function lineOf(position) {
+	const line = position?.line;
+	return typeof line === "number" && line > 0 ? line : void 0;
+}
+/**
+* Semgrep emits CWEs in prose form -- 'CWE-89: Improper Neutralization of ...'
+* -- while the mapping keys on the bare number.
+*/
+function extractCweIds(metadata) {
+	return normalizeToArray(metadata.cwe).map((entry) => /CWE-(\d+)/i.exec(entry)?.[1]).filter((id) => id !== void 0).map((id) => Number.parseInt(id, 10)).filter((id) => Number.isFinite(id));
+}
+/**
+* The parsed CWE ids in the CWE-N catalog form the schema's cwe[] field asks
+* for, deduplicated in source order.
+*/
+function cweCatalogFor(metadata) {
+	return [...new Set(extractCweIds(metadata).map((id) => `CWE-${id}`))];
+}
+function nistControlsFor(metadata) {
+	const controls = extractCweIds(metadata).map((cweId) => getCweNistControl(cweId)).filter(isPresent);
+	const deduped = [...new Set(controls)];
+	return deduped.length > 0 ? deduped : [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1];
+}
+function impactFor(result) {
+	const severity = result.extra?.severity;
+	if (!isPresent(severity)) return DEFAULT_IMPACT;
+	return severityToImpactWithAliases(severity, SEMGREP_SEVERITY_ALIASES, DEFAULT_IMPACT);
+}
+/**
+* Semgrep rule ids are dotted paths whose final segment is the rule name. The
+* JSON output carries no human-readable rule title anywhere -- unlike the SARIF
+* output, whose rule objects have `name` and `shortDescription` -- so one is
+* derived. Separator runs collapse and only the first character of each word
+* is uppercased, matching the Go twin exactly.
+*/
+function titleFor(checkId) {
+	const segments = checkId.split(".").filter((segment) => segment.length > 0);
+	return (segments[segments.length - 1] ?? checkId).split(/[-_]+/).filter((word) => word.length > 0).map((word) => word[0].toUpperCase() + word.slice(1)).join(" ");
+}
+function codeDescFor(result) {
+	const path = isPresent(result.path) ? result.path : "unknown";
+	const startLine = lineOf(result.start);
+	const endLine = lineOf(result.end);
+	if (startLine === void 0) return `Path: ${path}`;
+	return `Path: ${path}, ${endLine === void 0 || endLine === startLine ? `line ${startLine}` : `lines ${startLine}-${endLine}`}`;
+}
+/**
+* Points at the first occurrence of the rule; per-occurrence locations remain
+* on each result's codeDesc.
+*/
+function sourceLocationFor(result) {
+	if (!isPresent(result.path)) return;
+	const location = { ref: result.path };
+	const line = lineOf(result.start);
+	if (line !== void 0) location.line = line;
+	return location;
+}
+function messageFor(result) {
+	const parts = [];
+	if (isPresent(result.extra?.lines)) parts.push(`Matched code:\n${result.extra.lines}`);
+	if (isPresent(result.extra?.fix)) parts.push(`Suggested fix -- replace the matched code with:\n${result.extra.fix}`);
+	return parts.join("\n\n");
+}
+/** Documentation and cross-framework links, deduplicated. */
+function referencesFor(metadata) {
+	const urls = [
+		...normalizeToArray(metadata.references),
+		metadata.source,
+		metadata.shortlink,
+		metadata["source-rule-url"],
+		typeof metadata.asvs?.control_url === "string" ? metadata.asvs.control_url : void 0
+	].filter(isPresent);
+	return [...new Set(urls)];
+}
+/** The deduplicated reference URLs in refs[], their structured HDF home. */
+function refsFor(metadata) {
+	return referencesFor(metadata).map((url) => ({ url }));
+}
+function asvsOf(metadata) {
+	const asvs = metadata.asvs;
+	if (asvs && typeof asvs === "object" && !Array.isArray(asvs) && Object.keys(asvs).length > 0) return asvs;
+}
+function tagsFor(metadata, checkId, severity) {
+	const nist = [...new Set(nistControlsFor(metadata))];
+	const cci = nistToCci(nist);
+	const extras = { checkId };
+	const cwe = normalizeToArray(metadata.cwe);
+	if (cwe.length > 0) extras.cwe = cwe;
+	const owasp = normalizeToArray(metadata.owasp);
+	if (owasp.length > 0) extras.owasp = owasp;
+	const subcategory = normalizeToArray(metadata.subcategory);
+	if (subcategory.length > 0) extras.subcategory = subcategory;
+	const technology = normalizeToArray(metadata.technology);
+	if (technology.length > 0) extras.technology = technology;
+	const vulnerabilityClass = normalizeToArray(metadata.vulnerability_class);
+	if (vulnerabilityClass.length > 0) extras.vulnerabilityClass = vulnerabilityClass;
+	if (isPresent(severity)) extras.severity = severity;
+	if (isPresent(metadata.confidence)) extras.confidence = metadata.confidence;
+	if (isPresent(metadata.likelihood)) extras.likelihood = metadata.likelihood;
+	if (isPresent(metadata.impact)) extras.semgrepImpact = metadata.impact;
+	if (isPresent(metadata.category)) extras.category = metadata.category;
+	if (isPresent(metadata["bandit-code"])) extras.banditCode = metadata["bandit-code"];
+	const asvs = asvsOf(metadata);
+	if (asvs) extras.asvs = asvs;
+	markUnratedSeverity(extras, isPresent(severity) ? severity : "");
+	return buildNistCciTags(nist, cci, extras);
+}
+function codePositionFor(position) {
+	const line = lineOf(position);
+	if (line === void 0) return;
+	const out = { line };
+	const col = position?.col;
+	if (typeof col === "number" && col > 0) out.col = col;
+	return out;
+}
+/**
+* Serializes the curated match envelope into requirement.code for the CODE
+* tab: the rule source itself is not present in semgrep's JSON output, and the
+* raw finding bytes are not byte-stable across the Go/TS pair (escape forms
+* differ), so both languages serialize this envelope field-for-field in the
+* same order. Rule metadata is deliberately excluded — it is already carried
+* structurally in tags, cwe[], and refs[] — and redacted fields are filtered
+* per the converter's redaction policy.
+*/
+function codeFor(result) {
+	const envelope = { check_id: result.check_id };
+	if (isPresent(result.path)) envelope.path = result.path;
+	const start = codePositionFor(result.start);
+	if (start) envelope.start = start;
+	const end = codePositionFor(result.end);
+	if (end) envelope.end = end;
+	const extra = {};
+	if (isPresent(result.extra?.message)) extra.message = result.extra.message;
+	if (isPresent(result.extra?.severity)) extra.severity = result.extra.severity;
+	if (isPresent(result.extra?.lines)) extra.lines = result.extra.lines;
+	if (isPresent(result.extra?.fix)) extra.fix = result.extra.fix;
+	if (Object.keys(extra).length > 0) envelope.extra = extra;
+	return JSON.stringify(envelope, null, 2);
+}
+/** Every occurrence of one rule becomes a result under a single requirement. */
+function buildRequirement$17(checkId, results, startTime) {
+	const representative = results[0];
+	const metadata = representative.extra?.metadata ?? {};
+	const message = representative.extra?.message;
+	const descriptions = [{
+		label: "default",
+		data: typeof message === "string" ? message : ""
+	}];
+	const requirementResults = results.map((result) => ({
+		status: ResultStatus.Failed,
+		codeDesc: codeDescFor(result),
+		message: messageFor(result),
+		startTime
+	}));
+	const tags = tagsFor(metadata, checkId, representative.extra?.severity);
+	const cwe = cweCatalogFor(metadata);
+	const refs = refsFor(metadata);
+	const sourceLocation = sourceLocationFor(representative);
+	const requirement = createRequirement(checkId, titleFor(checkId), descriptions, impactFor(representative), requirementResults, {
+		tags,
+		code: codeFor(representative),
+		...cwe.length > 0 ? { cwe } : {},
+		...refs.length > 0 ? { refs } : {},
+		...sourceLocation ? { sourceLocation } : {}
+	});
+	requirement.verificationMethod = VerificationMethodEnum.Automated;
+	const controlType = deriveControlTypeFromTags(tags.nist);
+	if (controlType !== void 0) requirement.controlType = controlType;
+	return requirement;
+}
+/**
+* Scan failures become their own requirement so a file that failed to parse is
+* visible rather than buried: absence of findings in it is not evidence of
+* compliance. errors[].level drives the status: level 'error' entries are scan
+* failures (status error), while level 'warn' entries are advisory (e.g.
+* PartialParsing — the file was partially analyzed), a genuine non-evaluation
+* of those paths that must not dominate worst-wins rollups, so they map to
+* notReviewed.
+*/
+function buildErrorsRequirement(errors, startTime) {
+	const results = errors.map((error) => {
+		const kind = Array.isArray(error.type) ? String(error.type[0]) : String(error.type ?? "Unknown");
+		const level = isPresent(error.level) ? error.level : "";
+		const message = typeof error.message === "string" ? error.message : "";
+		return {
+			status: level.toLowerCase() === "warn" ? ResultStatus.NotReviewed : ResultStatus.Error,
+			codeDesc: `Path: ${isPresent(error.path) ? error.path : "unknown"}`,
+			message: level === "" ? `${kind}: ${message}` : `${kind} [${level}]: ${message}`,
+			startTime
+		};
+	});
+	const tags = buildNistCciTags([...DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1], []);
+	markUnratedSeverity(tags, "");
+	const requirement = createRequirement(SCAN_ERRORS_ID, "Semgrep scan errors", [{
+		label: "default",
+		data: "Errors reported by Semgrep while scanning. A file that failed to parse was not fully analyzed."
+	}], DEFAULT_IMPACT, results, { tags });
+	requirement.verificationMethod = VerificationMethodEnum.Automated;
+	return requirement;
+}
+/**
+* Records the scan's denominator. Semgrep reports violations only, so a
+* converted profile is failures-only by construction and its compliance ratio
+* is not a pass rate; this record carries the scanned count and the caveat.
+* Impact 0 makes the effective-status layer derive notApplicable — the only
+* status the compliance rollup excludes — and the raw status matches so
+* raw-status consumers (and CKL export, where Passed would render NotAFinding)
+* agree with the effective view. Mirrors kics-scan-coverage.
+*/
+function scannedCount(report) {
+	return Array.isArray(report.paths?.scanned) ? report.paths.scanned.length : 0;
+}
+function buildCoverageRequirement(report, ruleCount, startTime) {
+	const filesScanned = scannedCount(report);
+	const errorCount = report.errors?.length ?? 0;
+	const summary = `Semgrep scanned ${filesScanned} file(s); ${ruleCount} rule(s) produced findings and ${errorCount} scan error(s) were reported. Semgrep reports violations only and does not enumerate the rules that ran without finding anything, so no passing requirements can be derived from its output and the compliance ratio should not be read as a pass rate.`;
+	return createRequirement(COVERAGE_ID, "Semgrep scan coverage", [{
+		label: "default",
+		data: summary
+	}], 0, [{
+		status: ResultStatus.NotApplicable,
+		codeDesc: summary,
+		startTime
+	}], { tags: {
+		filesScanned,
+		rulesWithFindings: ruleCount,
+		scanErrors: errorCount
+	} });
+}
+/**
+* Converts native `semgrep scan --json` output to HDF Results. SARIF input is
+* detected and delegated to the SARIF converter.
+*
+* Native JSON is converted here because SARIF keeps the rule metadata only as
+* untyped prose tags on the rule object and drops impact, likelihood, the ASVS
+* control mapping, reference URLs and vulnerability_class outright.
+*
+* @param input - Semgrep JSON report string
+* @returns HDF JSON string
+*/
+async function convertSemgrepToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize(input, "semgrep");
+	if (!input || input.trim().length === 0) throw new Error("semgrep: empty input");
+	registerAllFingerprints();
+	const detected = detectConverter(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
+	const report = parseJSON(input);
+	if (report === null || typeof report !== "object" || !Array.isArray(report.results) || !Array.isArray(report.errors)) throw new Error("semgrep: input does not look like a Semgrep report");
+	const startTime = /* @__PURE__ */ new Date();
+	const groups = /* @__PURE__ */ new Map();
+	for (const result of report.results) {
+		if (typeof result?.check_id !== "string" || result.check_id === "") continue;
+		const existing = groups.get(result.check_id);
+		if (existing) existing.push(result);
+		else groups.set(result.check_id, [result]);
+	}
+	const requirements = [];
+	for (const [checkId, results] of groups) requirements.push(buildRequirement$17(checkId, results, startTime));
+	if (groups.size === 0) {
+		const scanned = scannedCount(report);
+		requirements.push(buildNoFindingsRequirement("semgrep-no-findings", `Semgrep scanned ${scanned} file(s) and reported no findings.`, startTime));
+	}
+	if (report.errors.length > 0) requirements.push(buildErrorsRequirement(report.errors, startTime));
+	requirements.push(buildCoverageRequirement(report, groups.size, startTime));
+	const baseline = createMinimalBaseline("Semgrep Scan", requirements, {
+		title: "Semgrep static analysis scan",
+		resultsChecksum: await inputChecksum(input)
+	});
+	return buildHdfResults({
+		generatorName: "semgrep-to-hdf",
+		converterVersion,
+		toolName: "Semgrep",
+		toolVersion: typeof report.version === "string" ? report.version : void 0,
+		baselines: [baseline],
+		timestamp: startTime
+	});
+}
+//#endregion
 //#region converters/snyk-to-hdf/typescript/converter.ts
 /**
 * Re-serialize the parsed vulnerability into indented JSON for requirement.code
@@ -3418,6 +4071,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	};
 	if (rep.identifiers.CVE && rep.identifiers.CVE.length > 0) tags["cve"] = rep.identifiers.CVE;
 	if (rep.identifiers.GHSA && rep.identifiers.GHSA.length > 0) tags["ghsaid"] = rep.identifiers.GHSA;
+	markUnratedSeverity(tags, rep.severity);
 	const descriptions = [{
 		label: "default",
 		data: rep.description
@@ -3435,7 +4089,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 		delete result.message;
 		return result;
 	});
-	const req = createRequirement(vulnID, rep.title, descriptions, severityToImpact$1(rep.severity), results, { tags });
+	const req = createRequirement(vulnID, rep.title, descriptions, severityToImpact$1(rep.severity ?? ""), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -3450,7 +4104,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const version = rep.version;
 	if (name && version) {
 		const ecosystem = ecosystemFromSnykPackageManager(packageManager);
-		const pkg = buildAffectedPackage$1({
+		const pkg = buildAffectedPackage$2({
 			name,
 			version,
 			ecosystem,
@@ -3531,17 +4185,12 @@ async function convertSnykToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/grype-to-hdf/typescript/converter.ts
-const IMPACT_MAPPING$8 = /* @__PURE__ */ new Map([
-	["critical", .9],
-	["high", .7],
-	["medium", .5],
-	["low", .3],
-	["negligible", 0],
-	["unknown", .5]
-]);
+const GRYPE_ALIASES = {
+	critical: .9,
+	negligible: 0
+};
 function getImpact$9(severity) {
-	if (!severity) return .5;
-	return IMPACT_MAPPING$8.get(severity.toLowerCase()) ?? .5;
+	return severityToImpactWithAliases(severity, GRYPE_ALIASES, .5);
 }
 function isNegligibleOrUnknown(severity) {
 	if (!severity) return true;
@@ -3593,7 +4242,7 @@ function buildCodeDesc$9(match) {
 	}
 	return parts.join(" | ");
 }
-function buildCvssEntries$6(vuln) {
+function buildCvssEntries$7(vuln) {
 	if (!vuln.cvss || vuln.cvss.length === 0) return;
 	const entries = [];
 	for (const c of vuln.cvss) {
@@ -3636,10 +4285,10 @@ function buildAffectedPackages(match) {
 	if (fix && fix.state === "fixed" && fix.versions && fix.versions.length > 0 && fix.versions[0]) pkg.fixedInVersion = fix.versions[0];
 	return [pkg];
 }
-const CWE_ID_PATTERN$1 = /^CWE-[1-9]\d*$/;
+const CWE_ID_PATTERN$2 = /^CWE-[1-9]\d*$/;
 function extractCwe(raw) {
 	if (!raw || raw.length === 0) return void 0;
-	const out = raw.filter((c) => CWE_ID_PATTERN$1.test(c));
+	const out = raw.filter((c) => CWE_ID_PATTERN$2.test(c));
 	return out.length === 0 ? void 0 : out;
 }
 function buildEpss$3(entries) {
@@ -3671,7 +4320,6 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	const refs = getReferences(vuln, match.relatedVulnerabilities);
 	let status;
 	if (isIgnored) status = ResultStatus.NotReviewed;
-	else if (isNegligibleOrUnknown(severity)) status = ResultStatus.NotApplicable;
 	else status = ResultStatus.Failed;
 	const messageParts = [];
 	if (isIgnored) messageParts.push("This vulnerability was ignored by configured rules.");
@@ -3686,6 +4334,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 		startTime
 	};
 	const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS));
+	markUnratedSeverity(tags, severity);
 	const requirement = {
 		id: isIgnored ? `Grype-Ignored-Match/${cveId}` : `Grype/${cveId}`,
 		title: `Grype found a vulnerability to ${cveId} in ${targetName}`,
@@ -3712,7 +4361,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	};
 	const controlType = deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	if (controlType !== void 0) requirement.controlType = controlType;
-	const cvss = buildCvssEntries$6(vuln);
+	const cvss = buildCvssEntries$7(vuln);
 	if (cvss) requirement.cvss = cvss;
 	requirement.affectedPackages = buildAffectedPackages(match);
 	const cwe = extractCwe(vuln.cwe);
@@ -3723,7 +4372,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	if (kev) requirement.kev = kev;
 	return requirement;
 }
-function buildComponent$1(report, targetName) {
+function buildComponent$2(report, targetName) {
 	const t = report.source?.target;
 	const firstRepoDigest = t?.repoDigests?.find((d) => d);
 	const firstTag = t?.tags?.find((tag) => tag);
@@ -3741,10 +4390,8 @@ function buildComponent$1(report, targetName) {
 	if (image) component.image = image;
 	if (report.distro?.name) component.osName = report.distro.name;
 	if (report.distro?.version) component.osVersion = report.distro.version;
-	if (t.manifestDigest) component.integrity = [{
-		algorithm: HashAlgorithm.Sha256,
-		value: t.manifestDigest.replace(/^sha256:/, "")
-	}];
+	const integrity = digestToChecksums(t.manifestDigest);
+	if (integrity) component.integrity = integrity;
 	if (t.architecture) component.labels = { architecture: t.architecture };
 	return component;
 }
@@ -3776,7 +4423,7 @@ async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 		toolName: "Grype",
 		toolVersion: grypeData.descriptor?.version,
 		baselines: [baseline],
-		components: [buildComponent$1(grypeData, targetName)],
+		components: [buildComponent$2(grypeData, targetName)],
 		timestamp: scanTime ?? void 0
 	});
 }
@@ -4024,7 +4671,7 @@ async function convertDefectDojoToHdf(input, converterVersion = "0.1.0") {
 //#region converters/nessus-to-hdf/typescript/converter.ts
 const CVE_SOURCE_RE = /^CVE-\d{4}-\d{4,}$/;
 const CWE_PATTERN = /CWE[- ]?(\d+)/gi;
-const IMPACT_MAPPING$7 = {
+const NESSUS_ALIASES = {
 	"4": .9,
 	"3": .7,
 	"i": .7,
@@ -4038,7 +4685,7 @@ const IMPACT_MAPPING$7 = {
 * Strip HTML tags from a string
 */
 function parseHtml(html) {
-	return html.replace(/<[^>]*>/g, "").trim();
+	return replaceHtmlTags(html, "").trim();
 }
 const NAMED_ENTITIES$3 = {
 	lt: "<",
@@ -4168,8 +4815,8 @@ function convertReportItemToRequirement(item, host) {
 	const title = isCompliance ? item["compliance-check-name"] || item["pluginName"] : item["pluginName"];
 	const descriptions = buildDescriptions(item, isCompliance);
 	const impact = calculateImpact(item, isCompliance);
-	const tags = buildTags$2(item, isCompliance);
-	const refs = buildRefs$8(item);
+	const tags = buildTags$3(item, isCompliance);
+	const refs = buildRefs$9(item);
 	const results = [buildResult$1(item, host, isCompliance)];
 	const code = JSON.stringify(item, null, 2);
 	const nistTags = tags["nist"];
@@ -4188,7 +4835,7 @@ function convertReportItemToRequirement(item, host) {
 	if (controlType !== void 0) req.controlType = controlType;
 	if (verificationMethod !== void 0) req.verificationMethod = verificationMethod;
 	if (!isCompliance) {
-		const cvssEntries = buildCvssEntries$5(item);
+		const cvssEntries = buildCvssEntries$6(item);
 		if (cvssEntries.length > 0) req.cvss = cvssEntries;
 		const cweIDs = buildCweIDs(item);
 		if (cweIDs.length > 0) req.cwe = cweIDs;
@@ -4202,7 +4849,7 @@ function convertReportItemToRequirement(item, host) {
 * the schema models cvss as a multi-entry array (Nessus emits one entry per
 * item; multi-vendor convergence may yield more).
 */
-function buildCvssEntries$5(item) {
+function buildCvssEntries$6(item) {
 	const source = (item.cvss_score_source || "").trim();
 	if (!source || !CVE_SOURCE_RE.test(source)) return [];
 	const hasV3 = !!(item.cvss3_vector || item.cvss3_base_score);
@@ -4342,12 +4989,12 @@ function buildDescriptions(item, isCompliance) {
 }
 function calculateImpact(item, isCompliance) {
 	if (isCompliance && item["compliance-reference"]) {
-		const catKey = parseComplianceRef(item["compliance-reference"], "CAT")[0]?.toLowerCase();
-		return catKey ? IMPACT_MAPPING$7[catKey] ?? .5 : .5;
+		const cat = parseComplianceRef(item["compliance-reference"], "CAT")[0];
+		return cat ? severityToImpactWithAliases(cat, NESSUS_ALIASES, .5) : .5;
 	}
-	return IMPACT_MAPPING$7[item["severity"]] ?? 0;
+	return severityToImpactWithAliases(item["severity"], NESSUS_ALIASES, 0);
 }
-function buildTags$2(item, isCompliance) {
+function buildTags$3(item, isCompliance) {
 	const tags = { rid: isCompliance ? parseComplianceRef(item["compliance-reference"], "Rule-ID").join(",") : item["pluginID"] };
 	if (isCompliance && item["compliance-reference"]) {
 		const cciTags = parseComplianceRef(item["compliance-reference"], "CCI");
@@ -4370,7 +5017,7 @@ function buildTags$2(item, isCompliance) {
 	if (item.cvss_base_score) tags.cvss_base_score = item.cvss_base_score;
 	return tags;
 }
-function buildRefs$8(item) {
+function buildRefs$9(item) {
 	const refs = [];
 	if (item.see_also) for (const url of item.see_also.split(/\s+/).filter(Boolean)) refs.push({ url });
 	return refs.length > 0 ? refs : void 0;
@@ -4436,31 +5083,29 @@ function isIPAddress(s) {
 //#endregion
 //#region converters/sonarqube-to-hdf/typescript/converter.ts
 /**
-* Deprecated legacy severity to impact mapping.
+* Deprecated legacy severity aliases to impact scores.
 * Canonical reference: heimdall2 sonarqube-mapper.ts IMPACT_MAPPING.
-*/
-const SEVERITY_IMPACT_MAPPING = {
-	BLOCKER: 1,
-	CRITICAL: .7,
-	MAJOR: .5,
-	MINOR: .3,
-	INFO: 0
+* Note: SonarQube "CRITICAL" maps to 0.7, not the standard 1.0; INFO resolves
+* to 0.0 via the shared standard map.
+*/
+const SONARQUBE_ALIASES = {
+	blocker: 1,
+	critical: .7,
+	major: .5,
+	minor: .3
 };
-/** MQR software-quality severity to impact mapping. */
-const MQR_IMPACT_MAPPING = {
-	BLOCKER: 1,
-	HIGH: .7,
-	MEDIUM: .5,
-	LOW: .3,
-	INFO: 0
-};
-/** MQR severities ordered weakest to strongest. */
+/**
+* The one MQR severity the standard map lacks; HIGH/MEDIUM/LOW/INFO already
+* resolve to 0.7/0.5/0.3/0.0 via severityToImpactWithAliases.
+*/
+const MQR_ALIASES = { blocker: 1 };
+/** MQR severities ordered weakest to strongest (lowercase keys; Go parity). */
 const MQR_SEVERITY_RANK = {
-	INFO: 0,
-	LOW: 1,
-	MEDIUM: 2,
-	HIGH: 3,
-	BLOCKER: 4
+	info: 0,
+	low: 1,
+	medium: 2,
+	high: 3,
+	blocker: 4
 };
 /**
 * Which severity axis drove a requirement's severity/impact. Emitted as the
@@ -4485,17 +5130,18 @@ const byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 function selectSeverity(issue) {
 	const impacts = issue.impacts ?? [];
 	if (impacts.length > 0) {
-		const worst = impacts.reduce((a, b) => MQR_SEVERITY_RANK[b.severity] > MQR_SEVERITY_RANK[a.severity] ? b : a);
+		const rank = (s) => MQR_SEVERITY_RANK[s.toLowerCase()] ?? 0;
+		const worst = impacts.reduce((a, b) => rank(b.severity) > rank(a.severity) ? b : a);
 		return {
 			severity: worst.severity,
 			source: SEVERITY_SOURCE_MQR,
-			impact: MQR_IMPACT_MAPPING[worst.severity] ?? .5
+			impact: severityToImpactWithAliases(worst.severity, MQR_ALIASES, .5)
 		};
 	}
 	return {
-		severity: issue.severity,
+		severity: issue.severity ?? "",
 		source: SEVERITY_SOURCE_LEGACY,
-		impact: SEVERITY_IMPACT_MAPPING[issue.severity] ?? .5
+		impact: severityToImpactWithAliases(issue.severity, SONARQUBE_ALIASES, .5)
 	};
 }
 /**
@@ -4504,6 +5150,28 @@ function selectSeverity(issue) {
 * SonarQube is fundamentally a static analysis tool. Matches heimdall2.
 */
 const DEFAULT_NIST_TAGS = ["SA-11"];
+const OWASP_TAG_PATTERN = /owasp[-:]?a0*(\d{1,2})/gi;
+const OWASP_2017_PATTERN = /top 10 2017[\s\S]{0,30}?category\s*a0*(\d{1,2})/gi;
+/** Records a normalized OWASP-2017 category (A1..A10) when n is in range. */
+function addOwaspId(set, n) {
+	if (n === void 0) return;
+	const v = parseInt(n, 10);
+	if (v >= 1 && v <= 10) set.add(`A${v}`);
+}
+/**
+* Combines CWE-derived and OWASP-derived NIST controls. The SA-11 default
+* applies only when neither source yields a mapping.
+*/
+function foldNistControls(cweIds, owaspIds) {
+	const set = /* @__PURE__ */ new Set();
+	for (const c of mapCWEToNIST(cweIds, [])) set.add(c);
+	for (const id of owaspIds) {
+		const ctrl = getOwaspNistControl(id);
+		if (ctrl) for (const c of ctrl.split("|")) set.add(c);
+	}
+	if (set.size === 0) return [...DEFAULT_NIST_TAGS];
+	return Array.from(set).sort();
+}
 /**
 * Convert SonarQube issues JSON to HDF format
 *
@@ -4593,8 +5261,8 @@ function convertRuleToRequirement(ruleKey, issues, componentMap, ruleMap) {
 	const description = extractDescription(rule);
 	const firstIssue = issues[0];
 	const { severity, source: severitySource, impact } = selectSeverity(firstIssue);
-	const { cweIds, owaspTags, allTags } = extractTags(rule, issues);
-	const nistControls = mapCWEToNIST(cweIds, DEFAULT_NIST_TAGS);
+	const { cweIds, owaspIds, allTags } = extractTags(rule, issues);
+	const nistControls = foldNistControls(cweIds, owaspIds);
 	const cciControls = nistToCci(nistControls);
 	const results = issues.map((issue) => createResultFromIssue(issue, componentMap));
 	const issueWithLocation = issues.find((i) => i.line !== void 0);
@@ -4604,7 +5272,7 @@ function convertRuleToRequirement(ruleKey, issues, componentMap, ruleMap) {
 		severitySource,
 		type: firstIssue.type.toLowerCase(),
 		cwe: cweIds,
-		owasp: owaspTags,
+		owasp: owaspIds,
 		nist: nistControls,
 		cci: cciControls,
 		...firstIssue.effort ? { effort: firstIssue.effort } : {},
@@ -4635,11 +5303,11 @@ function convertRuleToRequirement(ruleKey, issues, componentMap, ruleMap) {
 function extractDescription(rule) {
 	if (!rule) return "";
 	if (rule.mdDesc) return rule.mdDesc;
-	if (rule.htmlDesc) return rule.htmlDesc.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim();
+	if (rule.htmlDesc) return stripHtml(rule.htmlDesc);
 	if (rule.descriptionSections && rule.descriptionSections.length > 0) {
 		const rootCause = rule.descriptionSections.find((s) => s.key === "root_cause");
-		if (rootCause) return rootCause.content.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim();
-		const parts = rule.descriptionSections.map((s) => s.content.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim()).filter((s) => s.length > 0);
+		if (rootCause) return stripHtml(rootCause.content);
+		const parts = rule.descriptionSections.map((s) => stripHtml(s.content)).filter((s) => s.length > 0);
 		if (parts.length > 0) return parts.join("\n\n");
 	}
 	return rule.name || "";
@@ -4653,7 +5321,7 @@ function extractTags(rule, issues) {
 		for (const tag of ruleTags) {
 			const lowerTag = tag.toLowerCase();
 			if (lowerTag.startsWith("cwe-") || lowerTag.includes("cwe")) for (const id of extractCWEIDs(tag)) cweSet.add(`CWE-${id}`);
-			if (lowerTag.includes("owasp")) owaspSet.add(tag);
+			for (const m of tag.matchAll(OWASP_TAG_PATTERN)) addOwaspId(owaspSet, m[1]);
 			const parts = tag.split(":");
 			if (parts.length === 2) {
 				const [category, value] = parts;
@@ -4663,20 +5331,24 @@ function extractTags(rule, issues) {
 		}
 	}
 	for (const issue of issues) if (issue.tags) for (const tag of issue.tags) {
-		const lowerTag = tag.toLowerCase();
-		if (lowerTag.startsWith("cwe-")) for (const id of extractCWEIDs(tag)) cweSet.add(`CWE-${id}`);
-		if (lowerTag.includes("owasp")) owaspSet.add(tag);
+		if (tag.toLowerCase().startsWith("cwe-")) for (const id of extractCWEIDs(tag)) cweSet.add(`CWE-${id}`);
+		for (const m of tag.matchAll(OWASP_TAG_PATTERN)) addOwaspId(owaspSet, m[1]);
 	}
 	if (rule?.htmlDesc || rule?.mdDesc) {
 		const desc = (rule.htmlDesc || "") + (rule.mdDesc || "");
 		for (const id of extractCWEIDs(desc)) cweSet.add(`CWE-${id}`);
 	}
 	if (rule?.descriptionSections) for (const section of rule.descriptionSections) for (const id of extractCWEIDs(section.content)) cweSet.add(`CWE-${id}`);
+	if (rule) {
+		const texts = [rule.htmlDesc || "", rule.mdDesc || ""];
+		for (const section of rule.descriptionSections ?? []) texts.push(section.content);
+		for (const text of texts) for (const m of text.matchAll(OWASP_2017_PATTERN)) addOwaspId(owaspSet, m[1]);
+	}
 	const allTags = {};
 	for (const [category, values] of allTagsMap) allTags[category] = Array.from(values);
 	return {
 		cweIds: Array.from(cweSet),
-		owaspTags: Array.from(owaspSet),
+		owaspIds: Array.from(owaspSet).sort((a, b) => parseInt(a.slice(1), 10) - parseInt(b.slice(1), 10)),
 		allTags
 	};
 }
@@ -4941,6 +5613,7 @@ function buildRequirement$14(checkId, group, scanTime) {
 	const checkTypes = [...new Set(group.map((c) => c.checkType).filter((t) => t !== ""))].sort();
 	if (checkTypes.length > 0) tags["check_type"] = checkTypes;
 	if (rep.bc_check_id) tags["bc_check_id"] = rep.bc_check_id;
+	markUnratedSeverity(tags, rep.severity);
 	const descriptions = [{
 		label: "default",
 		data: rep.check_name
@@ -5033,14 +5706,6 @@ async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
 //#endregion
 //#region converters/gosec-to-hdf/typescript/converter.ts
 /**
-* Severity to HDF impact mapping for gosec.
-*/
-const IMPACT_MAPPING$6 = {
-	HIGH: .7,
-	MEDIUM: .5,
-	LOW: .3
-};
-/**
 * Returns the first-class CWE identifiers for an issue in "CWE-N" form,
 * or an empty array when the issue carries no CWE.
 */
@@ -5104,10 +5769,11 @@ function issueToResult(issue, scanTime) {
 */
 function buildRequirement$13(ruleId, issues, scanTime) {
 	const rep = issues[0];
-	const impact = IMPACT_MAPPING$6[rep.severity.toUpperCase()] ?? .5;
+	const impact = severityToImpact(rep.severity);
 	const nist = mapCWEToNIST([rep.cwe.id], DEFAULT_REMEDIATION_NIST_TAGS$1);
 	const tags = { nist };
 	if (rep.confidence) tags.confidence = rep.confidence;
+	markUnratedSeverity(tags, rep.severity);
 	const results = issues.map((issue) => issueToResult(issue, scanTime));
 	const descriptions = [{
 		label: "default",
@@ -5357,7 +6023,7 @@ function buildSourceLocation$3(alert) {
 	return { ref: inst.uri };
 }
 const REF_URL_RE = /https?:\/\/[^\s<>"']+/g;
-function buildRefs$7(reference) {
+function buildRefs$8(reference) {
 	if (!reference) return;
 	const urls = reference.match(REF_URL_RE);
 	if (!urls || urls.length === 0) return;
@@ -5432,7 +6098,7 @@ function buildSiteRequirements(site, startTime) {
 		if (code !== void 0) req.code = code;
 		const sourceLocation = buildSourceLocation$3(alert);
 		if (sourceLocation !== void 0) req.sourceLocation = sourceLocation;
-		const refs = buildRefs$7(alert.reference);
+		const refs = buildRefs$8(alert.reference);
 		if (refs !== void 0) req.refs = refs;
 		requirements.push(req);
 	}
@@ -6052,13 +6718,7 @@ function stringSlice(v) {
 * the canonical worst-wins ordering from @mitre/hdf-utilities.
 */
 function worstOfResults(req) {
-	const results = asArr(req.results) ?? [];
-	const statuses = [];
-	for (const rRaw of results) {
-		const r = asMap(rRaw);
-		if (r) statuses.push(getStr(r, "status"));
-	}
-	return worstStatus(statuses);
+	return worstStatus(resultStatuses(req));
 }
 /**
 * Whether an HDF Result_Status is a failing verdict. Only 'failed' fails;
@@ -6069,20 +6729,46 @@ function worstOfResults(req) {
 function isFailing(status) {
 	return status === "failed";
 }
-/** Resolve the status context for a requirement. */
+/**
+* Resolve the status context for a requirement via the canonical
+* effective-status ladder — the stored effectiveStatus field is never read
+* (see status-determination.md; the field is an output cache).
+*/
 function statusOf(req) {
 	const raw = worstOfResults(req);
-	const effective = getStr(req, "effectiveStatus");
-	const overrides = asArr(req.statusOverrides);
-	const rollup = effective !== "" ? effective : raw;
+	const overrides = asArr(req.statusOverrides) ?? [];
+	const overrideInputs = overrides.flatMap((oRaw) => {
+		const o = asMap(oRaw);
+		if (!o) return [];
+		return [{
+			status: getStr(o, "status") || void 0,
+			appliedAt: getStr(o, "appliedAt") || void 0,
+			expiresAt: getStr(o, "expiresAt") || void 0
+		}];
+	});
+	const rollup = computeEffectiveStatus({
+		impact: typeof req.impact === "number" ? req.impact : 1,
+		resultStatuses: resultStatuses(req),
+		overrides: overrideInputs
+	});
+	const governed = governingStatusOverride(overrideInputs) !== void 0;
 	return {
 		raw,
-		effective,
 		rollup,
-		overridden: overrides !== void 0 && overrides.length > 0 || "effectiveStatus" in req,
-		suppressed: isFailing(raw) && !isFailing(rollup)
+		overridden: overrides.length > 0,
+		suppressed: governed && isFailing(raw) && !isFailing(rollup)
 	};
 }
+/** Lists results[].status losslessly for the canonical roll-up. */
+function resultStatuses(req) {
+	const results = asArr(req.results) ?? [];
+	const statuses = [];
+	for (const rRaw of results) {
+		const r = asMap(rRaw);
+		if (r) statuses.push(getStr(r, "status"));
+	}
+	return statuses;
+}
 function firstComponent(doc) {
 	const comps = asArr(doc.components);
 	if (!comps || comps.length === 0) return void 0;
@@ -6238,10 +6924,7 @@ function stringifyLine(v) {
 * the missing-baselines error and drives validateInputSize.
 */
 function runExport(input, converterName, build) {
-	validateInputSize(input, converterName);
-	const doc = parseHdf(input);
-	const baselines = asArr(doc.baselines);
-	if (!baselines) throw new Error(`${converterName}: invalid HDF structure: missing baselines field`);
+	const { doc, items: baselines } = requireHdfResults(input, converterName);
 	const docTimestamp = getStr(doc, "timestamp");
 	const tool = asMap(doc.tool);
 	const generator = asMap(doc.generator);
@@ -6299,6 +6982,19 @@ const CVSS_METHODS = /* @__PURE__ */ new Set([
 	"CVSSv4"
 ]);
 /**
+* Reports whether no rating carries rating information: no CVSS score and no
+* rated severity token. Covers the empty-ratings default and the fabricated-
+* "medium" (empty severity, no score) paths, both of which land on impact 0.5
+* without the source having asserted a severity.
+*/
+function vulnIsUnrated(ratings) {
+	for (const rating of ratings) {
+		if (rating.method && CVSS_METHODS.has(rating.method) && rating.score !== void 0 && rating.score !== null) return false;
+		if (!isUnratedSeverity(rating.severity)) return false;
+	}
+	return true;
+}
+/**
 * Computes the maximum impact across all ratings for a vulnerability.
 * Prefers CVSS score/10 when available, falls back to severityToImpact().
 */
@@ -6328,7 +7024,7 @@ function cvssVersionFromMethod(method, vector) {
 		default: return cvssVersionFromVector(vector);
 	}
 }
-function buildCvssEntries$4(ratings) {
+function buildCvssEntries$5(ratings) {
 	const entries = [];
 	for (const r of ratings) {
 		const hasCvssMethod = r.method !== void 0 && CVSS_METHODS.has(r.method);
@@ -6349,7 +7045,7 @@ function buildCvssEntries$4(ratings) {
 * de-duplicated across all three in first-seen order. Returns undefined when the
 * vulnerability carries no links.
 */
-function buildRefs$6(vuln) {
+function buildRefs$7(vuln) {
 	const seen = /* @__PURE__ */ new Set();
 	const refs = [];
 	const add = (url) => {
@@ -6633,8 +7329,9 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 			nist,
 			cci: nistToCci(nist)
 		};
+		if (vulnIsUnrated(ratings)) markUnratedSeverity(tags, "");
 		const cweIds = cwes.map((c) => `CWE-${c}`);
-		const cvssEntries = buildCvssEntries$4(ratings);
+		const cvssEntries = buildCvssEntries$5(ratings);
 		const descriptions = [];
 		const defaultParts = [];
 		if (vuln.description) defaultParts.push(`Description: ${vuln.description}`);
@@ -6667,7 +7364,7 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 		req.code = buildVulnCode$1(vuln);
 		if (cvssEntries.length > 0) req.cvss = cvssEntries;
 		if (cweIds.length > 0) req.cwe = cweIds;
-		const refs = buildRefs$6(vuln);
+		const refs = buildRefs$7(vuln);
 		if (refs !== void 0) req.refs = refs;
 		const controlType = deriveControlTypeFromTags(nist);
 		if (controlType !== void 0) req.controlType = controlType;
@@ -6750,7 +7447,7 @@ function createRow(baseline, requirement, target) {
 	const message = firstResult?.message || "";
 	const nistControls = extractArrayFromTags(requirement.tags, "nist");
 	const cciControls = extractArrayFromTags(requirement.tags, "cci");
-	const effectiveStatus = requirement.effectiveStatus ? String(requirement.effectiveStatus) : String(status);
+	const effectiveStatus = requirementEffectiveStatus(requirement);
 	const effectiveImpact = (requirement.effectiveImpact ?? requirement.impact).toFixed(1);
 	const disposition = requirement.disposition ? String(requirement.disposition) : "";
 	return {
@@ -7904,7 +8601,7 @@ async function convertSplunkToHdf(input, converterVersion = "1.0.0") {
 				}) : [];
 				const options = { tags: control.tags ?? {} };
 				if (control.source_location) options.sourceLocation = control.source_location;
-				const req = createRequirement(control.id, control.title, descriptions, control.impact, results, options);
+				const req = createRequirement(control.id, control.title, descriptions, control.impact ?? 0, results, options);
 				if (!req.title) delete req.title;
 				if (control.code) req.code = control.code;
 				const nistTagsRaw = control.tags?.["nist"];
@@ -8050,7 +8747,7 @@ function convertHdfToXml(input) {
 }
 //#endregion
 //#region converters/gitlab-to-hdf/typescript/converter.ts
-function buildRefs$5(vuln) {
+function buildRefs$6(vuln) {
 	const refs = [];
 	const seen = /* @__PURE__ */ new Set();
 	const appendUrl = (url) => {
@@ -8190,6 +8887,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 		const extras = {};
 		for (const [key, values] of Object.entries(idTags)) extras[key] = values;
 		const tags = buildNistCciTags(nistTags, cciTags, Object.keys(extras).length > 0 ? extras : void 0);
+		markUnratedSeverity(tags, vuln.severity);
 		const descriptions = [];
 		if (vuln.description) descriptions.push({
 			label: "default",
@@ -8224,7 +8922,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 			descriptions,
 			verificationMethod: VerificationMethodEnum.Automated
 		};
-		const refs = buildRefs$5(vuln);
+		const refs = buildRefs$6(vuln);
 		if (refs) req.refs = refs;
 		const controlType = deriveControlTypeFromTags(nistTags);
 		if (controlType !== void 0) req.controlType = controlType;
@@ -8266,6 +8964,307 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 	return serializeHdf(hdf);
 }
 //#endregion
+//#region converters/trivy-to-hdf/typescript/converter.ts
+const BASELINE_NAME = "Trivy Scan";
+const STATIC_CCI = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
+const CWE_ID_PATTERN$1 = /^CWE-[1-9]\d*$/;
+const SEVERITY_ALIASES = { critical: .9 };
+/**
+* Route Trivy output to HDF Results: native Trivy JSON (SchemaVersion 2) is
+* parsed here; SARIF / CycloneDX / ASFF / GitLab are delegated to their
+* converters. TypeScript peer of shared/go/../trivy-to-hdf converter.go.
+*/
+async function convertTrivyToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize(input, "trivy");
+	if (!input?.trim()) throw new Error("trivy: empty input");
+	const probe = parseJSON(input);
+	if (typeof probe !== "object" || probe === null || Array.isArray(probe)) throw new Error("trivy: input is not a JSON object");
+	if (isNativeTrivy(probe)) return convertNative(input, converterVersion);
+	if (probe.bomFormat === "CycloneDX") return convertCyclonedxToHdf(input, converterVersion);
+	if ("runs" in probe && "version" in probe) return convertSarifToHdf(input, converterVersion);
+	if ("Findings" in probe || "ProductArn" in probe) return convertAsffToHdf(input, converterVersion);
+	if ("vulnerabilities" in probe) return convertGitlabToHdf(input, converterVersion);
+	throw new Error("trivy: not a recognized Trivy output format (native JSON, SARIF, CycloneDX, ASFF, or GitLab)");
+}
+function isNativeTrivy(m) {
+	return "SchemaVersion" in m && "ArtifactName" in m && "ArtifactType" in m;
+}
+async function convertNative(input, converterVersion) {
+	const report = parseJSON(input);
+	const resultsChecksum = await inputChecksum(input);
+	const scanTime = report.CreatedAt ? parseTimestamp(report.CreatedAt) : null;
+	const startTime = scanTime ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
+	const requirements = [];
+	for (const res of report.Results ?? []) {
+		for (const v of res.Vulnerabilities ?? []) requirements.push(convertVuln(v, res, startTime));
+		for (const m of res.Misconfigurations ?? []) requirements.push(convertMisconf(m, res, startTime));
+		for (const s of res.Secrets ?? []) requirements.push(convertSecret(s, res, startTime));
+		for (const l of res.Licenses ?? []) requirements.push(convertLicense(l, res, startTime));
+	}
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("trivy-no-findings", `Trivy scanned ${report.ArtifactName ?? "the target"} and reported zero findings.`, startTime));
+	const baseline = createMinimalBaseline(BASELINE_NAME, requirements, { resultsChecksum });
+	if (report.ArtifactName) baseline.title = report.ArtifactName;
+	const component = buildComponent$1(report);
+	return buildHdfResults({
+		generatorName: "trivy-to-hdf",
+		converterVersion,
+		toolName: "Trivy",
+		toolVersion: report.Trivy?.Version,
+		baselines: [baseline],
+		components: component ? [component] : void 0,
+		timestamp: scanTime ?? void 0
+	});
+}
+function convertVuln(v, res, startTime) {
+	const descriptions = [{
+		label: "default",
+		data: firstNonEmpty(v.Description ?? "", v.Title ?? "", v.VulnerabilityID ?? "")
+	}];
+	if (v.FixedVersion) descriptions.push({
+		label: "fix",
+		data: `Fixed in version ${v.FixedVersion}.`
+	});
+	const extras = { class: res.Class };
+	putIf(extras, "trivy_type", res.Type);
+	putIf(extras, "severity_source", v.SeveritySource);
+	putIf(extras, "data_source", v.DataSource?.Name);
+	putIf(extras, "published_date", v.PublishedDate);
+	if (v.VendorSeverity && Object.keys(v.VendorSeverity).length > 0) extras.vendor_severity = v.VendorSeverity;
+	const tags = buildTags$2(extras);
+	markUnratedSeverity(tags, v.Severity);
+	const req = {
+		id: `Trivy/${v.VulnerabilityID ?? ""}`,
+		title: `Trivy found ${v.VulnerabilityID ?? ""} in ${pkgLabel(v.PkgName, v.InstalledVersion)}`,
+		descriptions,
+		impact: severityToImpactWithAliases(v.Severity, SEVERITY_ALIASES, .5),
+		tags,
+		cwe: filterCwes(v.CweIDs),
+		cvss: buildCvssEntries$4(v.CVSS),
+		refs: buildRefs$5([v.PrimaryURL, ...v.References ?? []]),
+		code: JSON.stringify(v, null, 2),
+		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
+		verificationMethod: VerificationMethodEnum.Automated,
+		results: [{
+			status: ResultStatus.Failed,
+			codeDesc: buildVulnCodeDesc(v, res),
+			startTime,
+			message: `Severity: ${firstNonEmpty(v.Severity ?? "", "UNKNOWN")}`
+		}]
+	};
+	const ap = buildAffectedPackage$1(v);
+	if (ap.purl) req.affectedPackages = [ap];
+	if (v.PkgPath) req.sourceLocation = { ref: v.PkgPath };
+	return req;
+}
+function convertMisconf(m, res, startTime) {
+	const descriptions = [{
+		label: "default",
+		data: firstNonEmpty(m.Description ?? "", m.Message ?? "", m.Title ?? "")
+	}];
+	if (m.Resolution) descriptions.push({
+		label: "fix",
+		data: m.Resolution
+	});
+	const tags = buildTags$2({
+		class: res.Class,
+		...m.Type ? { misconfig_type: m.Type } : {}
+	});
+	markUnratedSeverity(tags, m.Severity);
+	const req = {
+		id: `Trivy/${firstNonEmpty(m.ID ?? "", m.AVDID ?? "")}`,
+		title: m.Title,
+		descriptions,
+		impact: severityToImpactWithAliases(m.Severity, SEVERITY_ALIASES, .5),
+		tags,
+		refs: buildRefs$5([m.PrimaryURL, ...m.References ?? []]),
+		code: JSON.stringify(m, null, 2),
+		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
+		verificationMethod: VerificationMethodEnum.Automated,
+		results: [{
+			status: misconfStatus(m.Status),
+			codeDesc: firstNonEmpty(m.Message ?? "", m.Title ?? ""),
+			startTime
+		}]
+	};
+	if (res.Target) {
+		const sl = { ref: res.Target };
+		if (m.CauseMetadata?.StartLine && m.CauseMetadata.StartLine > 0) sl.line = m.CauseMetadata.StartLine;
+		req.sourceLocation = sl;
+	}
+	return req;
+}
+function convertSecret(s, res, startTime) {
+	const tags = buildTags$2({
+		class: res.Class,
+		...s.Category ? { secret_category: s.Category } : {}
+	});
+	markUnratedSeverity(tags, s.Severity);
+	const req = {
+		id: `Trivy/secret/${s.RuleID ?? ""}@${res.Target ?? ""}:${s.StartLine ?? 0}`,
+		title: s.Title,
+		descriptions: [{
+			label: "default",
+			data: `${firstNonEmpty(s.Title ?? "", s.RuleID ?? "")} detected in ${res.Target ?? ""} (value redacted by Trivy).`
+		}],
+		impact: severityToImpactWithAliases(s.Severity, SEVERITY_ALIASES, .5),
+		tags,
+		code: JSON.stringify(s, null, 2),
+		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
+		verificationMethod: VerificationMethodEnum.Automated,
+		results: [{
+			status: ResultStatus.Failed,
+			codeDesc: s.Match ?? "",
+			startTime
+		}]
+	};
+	if (res.Target) {
+		const sl = { ref: res.Target };
+		if (s.StartLine && s.StartLine > 0) sl.line = s.StartLine;
+		req.sourceLocation = sl;
+	}
+	return req;
+}
+function convertLicense(l, res, startTime) {
+	const extras = { class: res.Class };
+	putIf(extras, "license_category", l.Category);
+	putIf(extras, "package", l.PkgName);
+	if (l.Confidence && l.Confidence > 0) extras.confidence = l.Confidence;
+	const tags = buildTags$2(extras);
+	markUnratedSeverity(tags, l.Severity);
+	const req = {
+		id: `Trivy/license/${l.PkgName ?? ""}/${l.Name ?? ""}`,
+		title: `${l.Name ?? ""} (${l.Category ?? ""})`,
+		descriptions: [{
+			label: "default",
+			data: `Package ${l.PkgName ?? ""} uses the ${l.Name ?? ""} license (category: ${l.Category ?? ""}).`
+		}],
+		impact: severityToImpactWithAliases(l.Severity, SEVERITY_ALIASES, .5),
+		tags,
+		refs: buildRefs$5([l.Link]),
+		code: JSON.stringify(l, null, 2),
+		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
+		verificationMethod: VerificationMethodEnum.Automated,
+		results: [{
+			status: ResultStatus.Failed,
+			codeDesc: `${l.PkgName ?? ""}: ${l.Name ?? ""} license`,
+			startTime
+		}]
+	};
+	if (l.FilePath) req.sourceLocation = { ref: l.FilePath };
+	return req;
+}
+function buildComponent$1(report) {
+	if (!report.ArtifactName) return void 0;
+	if (report.ArtifactType !== "container_image") return {
+		name: report.ArtifactName,
+		type: TargetType.Artifact
+	};
+	const c = {
+		name: report.ArtifactName,
+		type: TargetType.ContainerImage
+	};
+	const md = report.Metadata;
+	if (!md) return c;
+	if (md.ImageID) c.imageId = md.ImageID;
+	if (md.OS?.Family) c.osName = md.OS.Family;
+	if (md.OS?.Name) c.osVersion = md.OS.Name;
+	const repoDigest = md.RepoDigests?.[0];
+	if (repoDigest) {
+		c.image = repoDigest;
+		const integrity = digestToChecksums(digestPart(repoDigest));
+		if (integrity) c.integrity = integrity;
+	}
+	if (md.ImageConfig?.architecture) c.labels = { architecture: md.ImageConfig.architecture };
+	return c;
+}
+function buildTags$2(extras) {
+	return buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, STATIC_CCI, extras);
+}
+function misconfStatus(status) {
+	switch ((status ?? "").toUpperCase()) {
+		case "PASS": return ResultStatus.Passed;
+		case "EXCEPTION": return ResultStatus.NotApplicable;
+		default: return ResultStatus.Failed;
+	}
+}
+function filterCwes(cwes) {
+	if (!cwes) return void 0;
+	const out = cwes.filter((c) => CWE_ID_PATTERN$1.test(c));
+	return out.length > 0 ? out : void 0;
+}
+function buildCvssEntries$4(m) {
+	if (!m || Object.keys(m).length === 0) return void 0;
+	const entries = [];
+	for (const src of Object.keys(m).sort()) {
+		const c = m[src];
+		if (!c) continue;
+		if (c.V2Vector || c.V2Score !== void 0) entries.push(buildCvss$3({
+			version: Version.The20,
+			baseVector: c.V2Vector,
+			baseScore: c.V2Score,
+			source: src
+		}));
+		if (c.V3Vector || c.V3Score !== void 0) entries.push(buildCvss$3({
+			version: cvssVersionFromVector(c.V3Vector, Version.The31),
+			baseVector: c.V3Vector,
+			baseScore: c.V3Score,
+			source: src
+		}));
+		if (c.V40Vector || c.V40Score !== void 0) entries.push(buildCvss$3({
+			version: Version.The40,
+			baseVector: c.V40Vector,
+			baseScore: c.V40Score,
+			source: src
+		}));
+	}
+	return entries.length > 0 ? entries : void 0;
+}
+function buildAffectedPackage$1(v) {
+	const ap = {};
+	if (v.PkgName) ap.name = v.PkgName;
+	if (v.InstalledVersion) ap.version = v.InstalledVersion;
+	if (v.FixedVersion) ap.fixedInVersion = v.FixedVersion;
+	const purl = v.PkgIdentifier?.PURL;
+	if (purl) {
+		ap.purl = purl;
+		const eco = ecosystemFromPurl(purl);
+		if (eco) ap.ecosystem = eco;
+	}
+	return ap;
+}
+function ecosystemFromPurl(purl) {
+	const eco = ecosystemFromPurlType(purl.replace(/^pkg:/, "").split(/[/@?]/)[0] ?? "");
+	return eco === Ecosystem.Generic ? void 0 : eco;
+}
+function buildRefs$5(urls) {
+	const seen = /* @__PURE__ */ new Set();
+	const refs = [];
+	for (const u of urls) {
+		if (!u || seen.has(u)) continue;
+		seen.add(u);
+		refs.push({ url: u });
+	}
+	return refs.length > 0 ? refs : void 0;
+}
+function buildVulnCodeDesc(v, res) {
+	const parts = [`Package: ${v.PkgName ?? ""}@${v.InstalledVersion ?? ""}`];
+	if (res.Type) parts.push(`Type: ${res.Type}`);
+	if (v.PkgPath) parts.push(`Location: ${v.PkgPath}`);
+	if (v.FixedVersion) parts.push(`Fixed: ${v.FixedVersion}`);
+	return parts.join(" | ");
+}
+function pkgLabel(name, version) {
+	if (!version) return name ?? "";
+	return `${name ?? ""}@${version}`;
+}
+function digestPart(ref) {
+	const at = ref.lastIndexOf("@");
+	return at >= 0 ? ref.slice(at + 1) : ref;
+}
+function putIf(m, key, val) {
+	if (val) m[key] = val;
+}
+//#endregion
 //#region converters/trufflehog-to-hdf/typescript/converter.ts
 /** Hardcoded NIST/CCI constants for credential exposure findings. */
 const TRUFFLEHOG_NIST = ["IA-5 (7)"];
@@ -8586,14 +9585,9 @@ async function convertHipcheckToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/burpsuite-to-hdf/typescript/converter.ts
-const IMPACT_MAPPING$5 = {
-	"high": .7,
-	"medium": .5,
-	"low": .3,
-	"information": .3
-};
+const BURPSUITE_ALIASES = { information: .3 };
 function getImpact$7(severity) {
-	return IMPACT_MAPPING$5[severity.toLowerCase()] ?? .3;
+	return severityToImpactWithAliases(severity, BURPSUITE_ALIASES, .3);
 }
 /**
 * Extract CWE identifiers from HTML text.
@@ -8778,13 +9772,6 @@ function buildRequirement$11(issueType, issues, startTime) {
 }
 //#endregion
 //#region converters/dbprotect-to-hdf/typescript/converter.ts
-/** Impact mapping from heimdall2 DBProtect mapper */
-const IMPACT_MAPPING$4 = {
-	high: .7,
-	medium: .5,
-	low: .3,
-	informational: 0
-};
 const NAMED_ENTITIES$2 = {
 	amp: "&",
 	lt: "<",
@@ -8848,10 +9835,9 @@ function getStatus$2(status) {
 function getBacktrace(resultStatus) {
 	return resultStatus === "Failed" ? ["DB Protect Failed Check"] : void 0;
 }
-/** Maps DBProtect risk level to HDF impact value */
+/** Maps DBProtect risk level to HDF impact via the shared standard map (Go parity). */
 function getImpact$6(riskDV) {
-	const impact = IMPACT_MAPPING$4[riskDV.toLowerCase()];
-	return impact !== void 0 ? impact : .5;
+	return severityToImpactWithAliases(riskDV, {}, .5);
 }
 /** Creates a description string from a finding's task and check category */
 function formatDesc$1(f) {
@@ -8967,6 +9953,7 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 	const tags = buildNistCciTags(nist, nistToCci(nist));
 	const checkCategory = rep["Check Category"] ?? "";
 	if (checkCategory) tags.check_category = checkCategory;
+	markUnratedSeverity(tags, rep["Risk DV"]);
 	const descriptions = [{
 		label: "default",
 		data: formatDesc$1(rep)
@@ -9037,21 +10024,12 @@ async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/twistlock-to-hdf/typescript/converter.ts
-/**
-* Maps Twistlock severity strings to HDF impact values.
-* Includes "important" (alias for critical) and "moderate" (alias for medium)
-* which appear in some Twistlock outputs.
-*/
+const TWISTLOCK_ALIASES = {
+	important: .9,
+	moderate: .5
+};
 function twistlockSeverityToImpact(severity) {
-	switch (severity.toLowerCase()) {
-		case "critical":
-		case "important": return .9;
-		case "high": return .7;
-		case "medium":
-		case "moderate": return .5;
-		case "low": return .3;
-		default: return .5;
-	}
+	return severityToImpactWithAliases(severity, TWISTLOCK_ALIASES, .5);
 }
 /**
 * Builds the baseline title from scan result data.
@@ -9247,6 +10225,7 @@ function buildRequirement$9(vuln, packageTypes, distro) {
 	const extras = { cveid: [vuln.id] };
 	if (typeof vuln.cvss === "number" && vuln.cvss > 0) extras["cvss_base_score"] = vuln.cvss;
 	const tags = buildNistCciTags(nist, cciTags, extras);
+	markUnratedSeverity(tags, vuln.severity);
 	const descriptions = [{
 		label: "default",
 		data: vuln.description
@@ -9508,7 +10487,7 @@ function buildAffectedPackageFromComponent(c) {
 	let ecosystem;
 	if (c.purl) ecosystem = ecosystemFromPurlType(parsePurl(c.purl)?.type);
 	else if (c.name && c.version) ecosystem = ecosystemFromPurlType(void 0);
-	return buildAffectedPackage$1({
+	return buildAffectedPackage$2({
 		name: c.name,
 		version: c.version,
 		ecosystem,
@@ -9726,6 +10705,7 @@ function buildRequirement$7(entryID, entries, scanTime) {
 		cci: nistToCci(nist)
 	};
 	if (cveIDs.length > 0) tags["cve"] = cveIDs;
+	markUnratedSeverity(tags, rep.severity);
 	const descriptions = [{
 		label: "default",
 		data: formatDescription(rep)
@@ -9779,7 +10759,7 @@ function buildAffectedPackageFromEntry(entry) {
 		ecosystem = ecosystemFromXraySource(parsed.scheme);
 	}
 	const fixed = entry.component_versions?.fixed_versions?.[0];
-	return buildAffectedPackage$1({
+	return buildAffectedPackage$2({
 		name,
 		version,
 		ecosystem: ecosystem ?? (name ? Ecosystem.Generic : void 0),
@@ -10011,7 +10991,7 @@ function buildRequirement$6(vuln, scanTime, ml) {
 	const refs = buildRefs$3(vuln);
 	if (refs) req.refs = refs;
 	const cpe23 = (vuln.cpes ?? []).find((c) => /^cpe:2\.3:[aho]:/.test(c));
-	const pkg = buildAffectedPackage$1({
+	const pkg = buildAffectedPackage$2({
 		name: vuln.package_name,
 		version: vuln.package_version,
 		ecosystem: vuln.package_name && vuln.package_version ? Ecosystem.Generic : void 0,
@@ -10033,12 +11013,6 @@ function imageTitle(report) {
 function targetNameFromReport(report) {
 	return `${report.registry}/${report.repository}:${report.tag}`;
 }
-const DIGEST_ALGORITHMS = {
-	sha256: HashAlgorithm.Sha256,
-	sha384: HashAlgorithm.Sha384,
-	sha512: HashAlgorithm.Sha512,
-	blake3: HashAlgorithm.Blake3
-};
 /**
 * Splits NeuVector's base_os "name:version" form (e.g. "alpine:3.12.1") into OS
 * name and version. A value with no ":" is the name with no version; an empty
@@ -10060,28 +11034,6 @@ function splitBaseOS(baseOS) {
 	};
 }
 /**
-* Turns the report digest ("sha256:<hex>") into the component's Integrity
-* checksum, folding the algorithm prefix into Checksum.algorithm. Returns
-* undefined when the report carries no digest.
-*/
-function digestIntegrity(digest) {
-	if (!digest) return;
-	let algorithm = HashAlgorithm.Sha256;
-	let value = digest;
-	const i = digest.indexOf(":");
-	if (i >= 0) {
-		const mapped = DIGEST_ALGORITHMS[digest.slice(0, i)];
-		if (mapped) {
-			algorithm = mapped;
-			value = digest.slice(i + 1);
-		}
-	}
-	return [{
-		algorithm,
-		value
-	}];
-}
-/**
 * Assembles the scan-wide containerImage component from the report's image
 * identity. base_os → osName/osVersion, digest → integrity, plus
 * imageId/registry/repository/tag when the report carries them.
@@ -10104,7 +11056,7 @@ function buildComponent(report) {
 	if (report.registry) component.registry = report.registry;
 	if (report.repository) component.repository = report.repository;
 	if (report.tag) component.tag = report.tag;
-	const integrity = digestIntegrity(report.digest);
+	const integrity = digestToChecksums(report.digest);
 	if (integrity) component.integrity = integrity;
 	return component;
 }
@@ -10323,8 +11275,9 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 		label: "tips",
 		data: tipsData
 	});
-	let impact = 0;
-	if (vulns.length > 0) impact = roundImpact(parseFloat(vulns[0].InstanceInfo?.InstanceSeverity ?? "0") / 5);
+	const instanceSeverity = parseFloat(vulns[0]?.InstanceInfo?.InstanceSeverity ?? "0");
+	const impact = instanceSeverity > 0 ? roundImpact(instanceSeverity / 5) : 0;
+	if (!(instanceSeverity > 0)) markUnratedSeverity(tags, "");
 	const { items: limitedVulns, truncated } = limitArray(vulns);
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncated) console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${vulns.length})`);
@@ -10522,6 +11475,7 @@ function buildRequirement$4(rec, scanTime) {
 	const extras = {};
 	if (rec["CVE ID"]) extras["cve"] = [rec["CVE ID"]];
 	const tags = buildNistCciTags(nist, cciTags, Object.keys(extras).length > 0 ? extras : void 0);
+	markUnratedSeverity(tags, rec.Severity);
 	const descriptions = [{
 		label: "default",
 		data: rec.Description
@@ -10610,7 +11564,7 @@ function buildAffectedPackageFromRecord(rec) {
 	const version = rec["Package Version"];
 	if (!name || !version) return void 0;
 	const fixMatch = rec["Fix Status"] ? FIX_VERSION_PATTERN.exec(rec["Fix Status"]) : null;
-	return buildAffectedPackage$1({
+	return buildAffectedPackage$2({
 		name,
 		version,
 		ecosystem: ecosystemFromDistro(rec.Distro),
@@ -10680,16 +11634,9 @@ async function convertPrismaToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/netsparker-to-hdf/typescript/converter.ts
-const IMPACT_MAPPING$3 = {
-	"critical": 1,
-	"high": .7,
-	"medium": .5,
-	"low": .3,
-	"best_practice": 0,
-	"information": 0
-};
+const NETSPARKER_ALIASES = { best_practice: 0 };
 function getImpact$2(severity) {
-	return IMPACT_MAPPING$3[severity.toLowerCase()] ?? .5;
+	return severityToImpactWithAliases(severity, NETSPARKER_ALIASES, .5);
 }
 const NETSPARKER_US_DATETIME = /^\d{2}\/\d{2}\/\d{4} \d{1,2}:\d{2} (AM|PM)$/;
 function parseNetsparkerTimestamp(s) {
@@ -10824,6 +11771,7 @@ function buildRequirement$3(vuln, initiated) {
 	const pci32 = vuln.classification?.pci32;
 	if (pci32) extras.pci32 = pci32;
 	const tags = buildNistCciTags(nist, cciTags, Object.keys(extras).length > 0 ? extras : void 0);
+	markUnratedSeverity(tags, vuln.severity);
 	const descriptions = [{
 		label: "default",
 		data: formatControlDesc(vuln) || vuln.name || ""
@@ -11219,14 +12167,16 @@ function buildRequirementFromResult(result, filename) {
 	const startTime = (startTimeStr ? parseTimestamp(startTimeStr) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const runTime = computeRunTime(result.response.milestones?.service_started, result.response.milestones?.service_completed);
 	const score = result.result.score;
-	const status = determineStatus(score);
-	const toResult = (codeDesc) => createResult(status, void 0, {
+	const scoreless = score === void 0 || score === null;
+	const status = scoreless ? ResultStatus.NotReviewed : determineStatus(score);
+	const message = scoreless ? "Conveyor result carries no score; verdict not evaluated." : void 0;
+	const toResult = (codeDesc) => createResult(status, message, {
 		codeDesc,
 		startTime,
 		runTime
 	});
 	const results = result.result.sections.length > 0 ? result.result.sections.map((section) => toResult(buildCodeDesc$1(section, scannerName))) : [toResult(`No sections reported by ${scannerName}`)];
-	const req = createRequirement(result.sha256, filename, descriptions, scoreToImpact(score), results, { tags });
+	const req = createRequirement(result.sha256, filename, descriptions, scoreless ? 0 : scoreToImpact(score), results, { tags });
 	req.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags([...nist]);
 	if (controlType !== void 0) req.controlType = controlType;
@@ -11301,17 +12251,17 @@ async function convertConveyorToHdf(input, converterVersion = "1.0.0") {
 */
 /** Attribute prefix used by fast-xml-parser — all XML attributes are accessed via `@_name`. */
 const A = "@_";
-/** Veracode severity level (0-5) to HDF impact mapping. */
-const IMPACT_MAPPING$2 = /* @__PURE__ */ new Map([
-	["5", .9],
-	["4", .7],
-	["3", .5],
-	["2", .3],
-	["1", .1],
-	["0", 0]
-]);
+/** Veracode severity level (0-5) aliases; mirrors Go's veracodeAliases. */
+const VERACODE_ALIASES = {
+	"5": .9,
+	"4": .7,
+	"3": .5,
+	"2": .3,
+	"1": .1,
+	"0": 0
+};
 function veracodeSeverityToImpact(severity) {
-	return IMPACT_MAPPING$2.get(severity) ?? .1;
+	return severityToImpactWithAliases(severity, VERACODE_ALIASES, .1);
 }
 /** Get an attribute from a parsed XML node, entity-decoded. */
 function attr(node, name) {
@@ -11556,12 +12506,12 @@ function buildCWERequirements(severities, firstBuildDate) {
 	for (const sev of severities) {
 		const impact = veracodeSeverityToImpact(attr(sev, "level"));
 		const categories = ensureArray(sev.category);
-		for (const cat of categories) requirements.push(buildCWERequirement(cat, impact, firstBuildDate));
+		for (const cat of categories) requirements.push(buildCWERequirement(cat, attr(sev, "level"), impact, firstBuildDate));
 	}
 	return requirements;
 }
 /** Build a single CWE-based requirement from a category. */
-function buildCWERequirement(cat, impact, firstBuildDate) {
+function buildCWERequirement(cat, sevLevel, impact, firstBuildDate) {
 	const cwes = ensureArray(cat.cwe);
 	const cweIDs = cwes.map((c) => attr(c, "cweid")).filter(Boolean);
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_REMEDIATION_NIST_TAGS$1);
@@ -11574,6 +12524,7 @@ function buildCWERequirement(cat, impact, firstBuildDate) {
 		if (values.length > 0) extras[key] = values;
 	}
 	const tags = buildNistCciTags(nist, cciTags, extras);
+	markUnratedSeverity(tags, sevLevel);
 	const cweList = cweIDs.map((id) => `CWE-${id}`);
 	const descriptions = [{
 		label: "default",
@@ -11685,6 +12636,7 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	else nist = DEFAULT_REMEDIATION_NIST_TAGS$1;
 	const cciTags = nistToCci(nist);
 	const tags = buildNistCciTags(nist, cciTags, {});
+	markUnratedSeverity(tags, attr(vuln, "severity"));
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
 	const results = components.map((comp) => createResult(ResultStatus.Failed, void 0, {
 		codeDesc: formatSCACodeDesc(comp),
@@ -12017,14 +12969,6 @@ function repoNameFromURI(uri) {
 //#endregion
 //#region converters/msft-defender-cloud-to-hdf/typescript/converter.ts
 /**
-* Severity to HDF impact mapping.
-*/
-const IMPACT_MAPPING$1 = {
-	high: .7,
-	medium: .5,
-	low: .3
-};
-/**
 * Maps Azure status code to HDF ResultStatus.
 */
 function mapStatus(code) {
@@ -12052,7 +12996,7 @@ function extractSubscriptionID(resourcePath) {
 function buildRequirement(assessmentID, assessments, scanTime) {
 	const rep = assessments[0];
 	const meta = rep.properties.metadata;
-	const impact = IMPACT_MAPPING$1[meta.severity.toLowerCase()] ?? .5;
+	const impact = severityToImpact(meta.severity);
 	const tags = {};
 	if (meta.categories.length > 0) tags["categories"] = meta.categories;
 	if (meta.tactics.length > 0) tags["tactics"] = meta.tactics;
@@ -12144,21 +13088,6 @@ async function convertMsftDefenderCloudToHdf(input, converterVersion = "1.0.0")
 //#endregion
 //#region converters/msft-defender-endpoint-to-hdf/typescript/converter.ts
 /**
-* Severity to HDF impact mapping.
-*/
-const IMPACT_MAPPING = {
-	high: .7,
-	medium: .5,
-	low: .3,
-	informational: 0
-};
-/**
-* Maps MDE severity to HDF impact value.
-*/
-function severityToImpact$2(severity) {
-	return IMPACT_MAPPING[severity.toLowerCase()] ?? .5;
-}
-/**
 * An MDE alert is a detection that fired, so every alert is a raw Failed result.
 * Consumer triage (falsePositive, expected-activity) never flips the raw status —
 * it rides in a structured Status_Override that carries effectiveStatus + full
@@ -12262,7 +13191,7 @@ function formatMessage(alert) {
 	const parts = [];
 	parts.push(`Alert: ${alert.title}`);
 	parts.push(`Status: ${alert.status}`);
-	parts.push(`Severity: ${alert.severity}`);
+	parts.push(`Severity: ${alert.severity ?? ""}`);
 	if (alert.threatDisplayName) parts.push(`Threat: ${alert.threatDisplayName}`);
 	if (alert.alertWebUrl) parts.push(`URL: ${alert.alertWebUrl}`);
 	return parts.join("\n");
@@ -12357,7 +13286,7 @@ function deriveScanTimestamp(alerts) {
 * Converts a single MDE alert to an HDF EvaluatedRequirement.
 */
 function alertToRequirement(alert, scanTime) {
-	const impact = severityToImpact$2(alert.severity);
+	const impact = severityToImpact(alert.severity);
 	const codeDesc = formatEvidence$1(alert.evidence ?? []);
 	const message = formatMessage(alert);
 	const startTime = resolveStartTime(alert, scanTime);
@@ -12644,7 +13573,9 @@ function buildTestResultObj(hdfData, baseline) {
 	for (const req of baseline.requirements) {
 		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
 		const stigId = tagString(req.tags, "stig_id");
-		const effective = req.effectiveStatus ? hdfStatusToXccdf(req.effectiveStatus) : void 0;
+		const statusInput = requirementStatusInput(req);
+		const resolved = computeEffectiveStatus(statusInput);
+		const effective = resolved !== worstStatus(statusInput.resultStatuses ?? []) ? hdfStatusToXccdf(resolved) : void 0;
 		for (const result of req.results) {
 			const status = effective ?? hdfStatusToXccdf(result.status);
 			if (status === "pass") {
@@ -12829,11 +13760,69 @@ function toKebabCase(title, fallback) {
 	if (!title) return fallback;
 	let name = title.toLowerCase();
 	name = name.replace(/[^a-z0-9]/g, "-");
-	while (name.includes("--")) name = name.replace(/--/g, "-");
-	name = name.replace(/^-+|-+$/g, "");
+	name = name.replace(/-+/g, "-");
+	let start = 0;
+	while (start < name.length && name[start] === "-") start++;
+	let end = name.length;
+	while (end > start && name[end - 1] === "-") end--;
+	name = name.slice(start, end);
 	if (name.length > 80) name = name.slice(0, 80);
 	return name;
 }
+/**
+* Encode an arbitrary identifier into OSCAL's TokenDatatype shape:
+* `^(\p{L}|_)(\p{L}|\p{N}|[.\-_])*$`
+*
+* HDF requirement ids come from whatever the source tool numbers its rules with,
+* and only some of those shapes are already tokens. Measured across this
+* package's converter fixtures, 46% are not (57% of the distinct ids): package-style ids
+* carrying '/', CIS control numbers starting with a digit, advisory ids carrying
+* ':'. Copying one of those into a token-typed OSCAL field produces a document
+* the target schema rejects while the converter resolves successfully.
+*
+* The kept set is deliberately ASCII — [A-Za-z0-9._-] — rather than the wider
+* \p{L}/\p{N} the pattern permits. Delegating to each platform's Unicode tables
+* looked equivalent and was not: V8's \p{L}/\p{N} and Go's unicode package are
+* built from different Unicode versions, and comparing the two implementations
+* across the whole code-point range turned up 4657 characters they disagree on.
+* An explicit ASCII set has no such dependency and is identical in both languages
+* by construction. It costs nothing on real data: no requirement id in this
+* package's converter fixtures is non-ASCII, and a non-ASCII one
+* is preserved in full by the caller's source-id prop regardless.
+*
+* Every character outside that set becomes '_', and a leading '_' is prepended
+* when the result would not start with a letter or '_'. An id built only from
+* the kept characters is returned unchanged; note that this is narrower than
+* token shape, so a token-valid non-ASCII id such as "café" is still rewritten.
+*
+* Two different ids can encode to the same token ('a/b' and 'a:b' both yield
+* 'a_b'), which is why callers must also record the source id in the emitted
+* document — for SAR that is a prop on the finding, trimmed because OSCAL's
+* StringDatatype forbids a padded value.
+*/
+function oscalToken(s) {
+	if (s === "") return "";
+	const out = [...s].map((ch) => /[A-Za-z0-9.\-_]/.test(ch) ? ch : "_").join("");
+	const [first = ""] = [...out];
+	return /[A-Za-z_]/.test(first) ? out : `_${out}`;
+}
+/**
+* Render a value for a field OSCAL types as StringDatatype, whose pattern
+* `^\S(.*\S)?$` forbids an empty value and any leading or trailing whitespace.
+* HDF constrains none of the strings that feed those fields — no minLength
+* anywhere in hdf-amendments — so a padded or empty value is valid HDF that
+* would otherwise produce a document the target schema rejects at exit 0.
+*
+* Returns '' when nothing survives trimming, which callers treat as "omit this
+* field" rather than substituting a placeholder: OSCAL marks most of these
+* fields optional, so leaving one out says exactly as much as the source did.
+* The companion for token-typed fields is oscalToken.
+*
+* Mirrors OSCALString in the Go peer.
+*/
+function oscalString(s) {
+	return s.trim();
+}
 //#endregion
 //#region converters/hdf-to-oscal-sar/typescript/converter.ts
 /**
@@ -12896,12 +13885,18 @@ function buildOSCALDocument(hdfResults) {
 	else importAP = { href: "#" };
 	const subjects = buildSubjects(hdfResults.components);
 	const results = [];
-	for (const baseline of hdfResults.baselines) results.push(baselineToResult(baseline, timestamp, toolActorUuid, subjects));
+	const resources = [];
+	for (const baseline of hdfResults.baselines) {
+		const { result, resources: baselineResources } = baselineToResult(baseline, timestamp, toolActorUuid, subjects);
+		results.push(result);
+		resources.push(...baselineResources);
+	}
 	return { "assessment-results": {
 		uuid: crypto.randomUUID(),
 		metadata,
 		"import-ap": importAP,
-		results
+		results,
+		...resources.length > 0 ? { "back-matter": { resources } } : {}
 	} };
 }
 /** Earliest startTime across the results, or undefined if none carry one. */
@@ -12933,7 +13928,8 @@ function assessmentStart(baseline, fallback) {
 	return formatAssessmentTime(earliest, fallback);
 }
 /**
-* Converts a single EvaluatedBaseline to an OSCAL Result.
+* Converts a single EvaluatedBaseline to an OSCAL Result plus any back-matter
+* resources (embedded check source code) its findings link to.
 */
 function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	let title = baseline.name;
@@ -12948,14 +13944,18 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	const findings = [];
 	const observations = [];
 	const risks = [];
+	const resources = [];
 	const includeControls = [];
 	const seenControl = /* @__PURE__ */ new Set();
 	for (const req of baseline.requirements) {
-		const { finding, observation, risk } = requirementToFindingSet(req, timestamp, toolActorUuid, subjects);
+		const nistId = nistTagToControlId(req.id);
+		if (nistId === "") continue;
+		const { finding, observation, risk, resource } = requirementToFindingSet(req, timestamp, toolActorUuid, subjects);
 		findings.push(finding);
 		if (observation) observations.push(observation);
 		if (risk) risks.push(risk);
-		const cid = nistTagToControlId(req.id);
+		if (resource) resources.push(resource);
+		const cid = oscalToken(nistId);
 		if (cid !== "" && !seenControl.has(cid)) {
 			seenControl.add(cid);
 			includeControls.push({ "control-id": cid });
@@ -12963,15 +13963,18 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	}
 	const controlSelection = includeControls.length > 0 ? { "include-controls": includeControls } : {};
 	return {
-		uuid: crypto.randomUUID(),
-		title,
-		description,
-		start: assessmentStart(baseline, timestamp),
-		...resultProps.length > 0 ? { props: resultProps } : {},
-		"reviewed-controls": { "control-selections": [controlSelection] },
-		findings,
-		observations,
-		risks
+		result: {
+			uuid: crypto.randomUUID(),
+			title,
+			description,
+			start: assessmentStart(baseline, timestamp),
+			...resultProps.length > 0 ? { props: resultProps } : {},
+			"reviewed-controls": { "control-selections": [controlSelection] },
+			findings,
+			observations,
+			risks
+		},
+		resources
 	};
 }
 /**
@@ -12992,18 +13995,35 @@ function buildSubjects(components) {
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
 */
 function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
-	const controlID = nistTagToControlId(req.id);
+	const controlID = oscalToken(nistTagToControlId(req.id));
 	const results = req.results ?? [];
 	const descriptions = req.descriptions ?? [];
-	const { state, reason } = effectiveState(req, results);
+	const { state, reason } = effectiveState(req);
 	const findingDesc = extractDefaultDescription(descriptions);
-	const props = [];
+	const props = [{
+		name: "hdf-requirement-id",
+		value: oscalString(req.id)
+	}];
 	const addProp = (name, value) => {
 		if (value !== "") props.push({
 			name,
 			value
 		});
 	};
+	const addProseProp = (name, text) => {
+		const preview = previewLine(text);
+		if (preview === "") return;
+		const p = {
+			name,
+			value: preview
+		};
+		if (preview !== text) p.remarks = text;
+		props.push(p);
+	};
+	const descriptionByLabel = (label) => {
+		const d = descriptions.find((x) => x.label === label);
+		return d ? d.data : "";
+	};
 	const pushTagValues = (key) => {
 		const raw = req.tags?.[key];
 		if (Array.isArray(raw)) {
@@ -13012,15 +14032,9 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	};
 	pushTagValues("nist");
 	pushTagValues("cci");
-	if (req.code != null) addProp("code", req.code);
-	for (const label of [
-		"check",
-		"fix",
-		"rationale"
-	]) {
-		const d = descriptions.find((x) => x.label === label);
-		addProp(label, d ? d.data : "");
-	}
+	addProseProp("check", descriptionByLabel("check"));
+	addProseProp("rationale", descriptionByLabel("rationale"));
+	if (req.impact <= 0) addProseProp("fix", descriptionByLabel("fix"));
 	if (req.controlType) addProp("control-type", req.controlType);
 	if (req.verificationMethod) addProp("verification-method", req.verificationMethod);
 	if (req.applicability) addProp("applicability", req.applicability);
@@ -13048,10 +14062,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 			href: o.uri,
 			rel: "reference"
 		});
-		else if (typeof o.ref === "string") props.push({
-			name: "reference",
-			value: o.ref
-		});
+		else if (typeof o.ref === "string") addProseProp("reference", o.ref);
 	}
 	for (const er of req.externalReferences ?? []) if (typeof er.href === "string" && er.href !== "") links.push({
 		href: er.href,
@@ -13059,6 +14070,22 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	});
 	let title = req.id;
 	if (req.title && req.title !== "") title = req.title;
+	let resource;
+	if (req.code != null && req.code.trim() !== "") {
+		const resourceUuid = crypto.randomUUID();
+		resource = {
+			uuid: resourceUuid,
+			title: `Check source code for ${req.id}`,
+			base64: {
+				value: Buffer.from(req.code, "utf-8").toString("base64"),
+				"media-type": "text/plain"
+			}
+		};
+		links.push({
+			href: `#${resourceUuid}`,
+			rel: "code"
+		});
+	}
 	const targetStatus = { state };
 	if (reason) targetStatus.reason = reason;
 	const remarks = overrideRemarks(req);
@@ -13127,16 +14154,32 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	return {
 		finding,
 		observation,
-		risk
+		risk,
+		resource
 	};
 }
 /**
-* Derives the OSCAL finding target state/reason from the requirement's
-* effectiveStatus when present, otherwise from aggregated raw results.
+* Reduces prose to a single line legal as an OSCAL StringDatatype prop value:
+* the first non-empty line, trimmed, truncated to 120 code points.
+*/
+function previewLine(text) {
+	for (let line of text.split("\n")) {
+		line = line.trim();
+		if (line === "") continue;
+		const maxRunes = 120;
+		const runes = Array.from(line);
+		if (runes.length > maxRunes) line = `${runes.slice(0, maxRunes - 3).join("").trim()}...`;
+		return line;
+	}
+	return "";
+}
+/**
+* Derives the OSCAL finding target state/reason from the canonical ladder —
+* the stored effectiveStatus field is never read (it is an output cache; see
+* status-determination.md).
 */
-function effectiveState(req, results) {
-	if (req.effectiveStatus) return oscalStateFromStatus(req.effectiveStatus);
-	return aggregateStatus(results);
+function effectiveState(req) {
+	return oscalStateFromStatus(requirementEffectiveStatus(req));
 }
 /** Maps a single HDF result status to an OSCAL finding target state/reason. */
 function oscalStateFromStatus(status) {
@@ -13268,62 +14311,6 @@ function formatFloat(n) {
 	return String(n);
 }
 /**
-* Determines the overall finding status from requirement results.
-*/
-function aggregateStatus(results) {
-	if (results.length === 0) return {
-		state: "not-satisfied",
-		reason: "other"
-	};
-	let hasFailed = false;
-	let hasError = false;
-	let hasNotReviewed = false;
-	let hasNotApplicable = false;
-	let allPassed = true;
-	for (const r of results) switch (r.status) {
-		case "passed": break;
-		case "failed":
-			hasFailed = true;
-			allPassed = false;
-			break;
-		case "error":
-			hasError = true;
-			allPassed = false;
-			break;
-		case "notReviewed":
-			hasNotReviewed = true;
-			allPassed = false;
-			break;
-		case "notApplicable":
-			hasNotApplicable = true;
-			allPassed = false;
-			break;
-		default:
-			allPassed = false;
-			break;
-	}
-	if (allPassed) return {
-		state: "satisfied",
-		reason: ""
-	};
-	if (hasFailed || hasError) return {
-		state: "not-satisfied",
-		reason: ""
-	};
-	if (hasNotReviewed) return {
-		state: "not-satisfied",
-		reason: "other"
-	};
-	if (hasNotApplicable) return {
-		state: "not-satisfied",
-		reason: "not-applicable"
-	};
-	return {
-		state: "not-satisfied",
-		reason: ""
-	};
-}
-/**
 * Finds the "default" labeled description.
 */
 function extractDefaultDescription(descriptions) {
@@ -14522,7 +15509,11 @@ function advisoryURI(publisher, tracking) {
 	/* c8 ignore next */
 	const id = tracking.id ?? "";
 	const ns = publisher.namespace;
-	if (ns && id) return `${ns.replace(/\/+$/, "")}/${id}`;
+	if (ns && id) {
+		let end = ns.length;
+		while (end > 0 && ns[end - 1] === "/") end--;
+		return `${ns.slice(0, end)}/${id}`;
+	}
 	return id;
 }
 function overlap(ids, scope) {
@@ -17017,6 +18008,6 @@ function capStixExternalRefs(container, label) {
 	container.externalReferences = [...other, ...capped];
 }
 //#endregion
-export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSpdxVexToHdf, convertSplunkToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertV1ToV2, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, detectStixBundle, enrichStix, isHDFV1, parseStixBundle };
+export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertKicsToHdf, convertLegacyHdf, convertLegacyHdf as convertV1ToV2, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSemgrepToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSpdxVexToHdf, convertSplunkToHdf, convertTrivyToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, detectStixBundle, enrichStix, isLegacyHdf as isHDFV1, isLegacyHdf, parseStixBundle };
 
 //# sourceMappingURL=index.js.map