@mitre/hdf-converters 3.6.0-rc.2 → 3.6.0-rc.3

package/dist/index.js

@@ -1,8 +1,150 @@
 import { n as detectFormat, r as detectConverter, t as registerAllFingerprints } from "./register-all-CDfYvwQF.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, worstStatus } from "@mitre/hdf-utilities";
-import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
+import { buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
+import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+//#region ../hdf-validators/dist/index.js
+/**
+* Create and configure Ajv instance with all HDF schemas
+*/
+function createValidator() {
+	const ajv = new Ajv({
+		allErrors: true,
+		verbose: true,
+		strict: false,
+		validateFormats: true,
+		validateSchema: false
+	});
+	addFormats(ajv);
+	const registeredDateTime = ajv.formats["date-time"];
+	ajv.addFormat("date-time", {
+		type: "string",
+		validate: (v) => /^\d{4}-\d{2}-\d{2}[Tt]/.test(v) && registeredDateTime.validate(v)
+	});
+	ajv.addSchema(commonSchema);
+	ajv.addSchema(platformSchema);
+	ajv.addSchema(resultSchema);
+	ajv.addSchema(runnerSchema);
+	ajv.addSchema(statisticsSchema);
+	ajv.addSchema(targetSchema);
+	ajv.addSchema(parameterSchema);
+	ajv.addSchema(cvssSchema);
+	ajv.addSchema(epssSchema);
+	ajv.addSchema(kevSchema);
+	ajv.addSchema(affectedPackageSchema);
+	ajv.addSchema(bomSchema);
+	ajv.addSchema(amendmentsSchema);
+	ajv.addSchema(extensionsSchema);
+	ajv.addSchema(systemSchema);
+	ajv.addSchema(planSchema);
+	ajv.addSchema(comparisonSchema);
+	ajv.addSchema(eventsSchema);
+	ajv.addSchema(componentSchema);
+	ajv.addSchema(dataFlowSchema);
+	ajv.addSchema(hdfResultsSchema);
+	ajv.addSchema(hdfBaselineSchema);
+	ajv.addSchema(hdfComparisonSchema);
+	ajv.addSchema(hdfSystemSchema);
+	ajv.addSchema(hdfPlanSchema);
+	ajv.addSchema(hdfAmendmentsSchema);
+	ajv.addSchema(hdfRequirementChangeEventSchema);
+	ajv.addSchema(hdfEvidencePackageSchema);
+	return ajv;
+}
+const ajv = createValidator();
+let resultsValidator = null;
+function getResultsValidator() {
+	if (!resultsValidator) resultsValidator = ajv.compile(hdfResultsSchema);
+	return resultsValidator;
+}
+/**
+* Convert Ajv errors to ValidationError format
+*/
+function formatErrors(errors) {
+	if (!errors || errors.length === 0) return [];
+	return errors.map((err) => {
+		let field = err.instancePath.replace(/^\//, "").replace(/\//g, ".");
+		if (!field && err.schemaPath) {
+			const pathParts = err.schemaPath.split("/");
+			field = pathParts[pathParts.length - 1] || "(root)";
+		}
+		let message = err.message || "validation failed";
+		if (err.params) {
+			if ("missingProperty" in err.params) {
+				field = field ? `${field}.${err.params.missingProperty}` : err.params.missingProperty;
+				message = "is required";
+			} else if ("additionalProperty" in err.params) {
+				field = field ? `${field}.${err.params.additionalProperty}` : err.params.additionalProperty;
+				message = "is not allowed";
+			} else if ("limit" in err.params) message = `${message} (limit: ${err.params.limit})`;
+		}
+		return {
+			field: field || "(root)",
+			keyword: err.keyword,
+			...err.keyword === "format" && err.params && "format" in err.params ? { format: String(err.params.format) } : {},
+			message,
+			value: err.data
+		};
+	});
+}
+/**
+* Create ValidationResult from validator output
+*/
+function createResult$1(validator, data) {
+	const valid = validator(data);
+	const errors = formatErrors(validator.errors);
+	return {
+		valid: valid === true,
+		errors,
+		getErrorMessage() {
+			if (this.valid) return "";
+			return this.errors.map((e) => {
+				if (e.field === "(root)") return e.message;
+				return `${e.field}: ${e.message}`;
+			}).join("; ");
+		}
+	};
+}
+/**
+* Validate HDF Results document against schema
+*/
+function validateResults(data) {
+	return createResult$1(getResultsValidator(), data);
+}
+//#endregion
+//#region shared/typescript/amendmentchain.ts
+/**
+* Stamps `previousChecksum` across amendment overrides in document order,
+* linking each to the one before it and leaving the first unlinked.
+*
+* Every route that authors amendments calls this, so whether a document carries
+* tamper-evidence does not depend on which one wrote it. The checksum is the
+* canonical JSON form shared with the Go converters and with `hdf amend verify`,
+* so a chain written here verifies everywhere.
+*
+* The override is put through serializeHdf first, so what gets hashed is the
+* shape the document will actually carry. The TS converters hold
+* `appliedAt`/`expiresAt` as `Date` objects, which stringify with a `.000`
+* fraction that trimmed-UTC HDF output never carries; hashing them raw would
+* make every TS-written chain disagree with its own serialized document, and
+* with Go.
+*
+* Mutates the array in place, mirroring the Go helper.
+*/
+async function chainOverrides(overrides) {
+	let previous;
+	for (const override of overrides) {
+		if (previous === void 0) delete override.previousChecksum;
+		else override.previousChecksum = previous;
+		previous = {
+			algorithm: HashAlgorithm.Sha256,
+			value: await sha256(canonicalJson(JSON.parse(serializeHdf(override, 0))))
+		};
+	}
+}
+//#endregion
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -161,6 +303,20 @@ function extractCWEIDs(text) {
 	ids.sort();
 	return ids;
 }
+/**
+* Return the first candidate whose content is not empty or whitespace-only,
+* as-is (the emptiness test trims, the returned value does not). Returns '' when
+* every candidate is empty or whitespace. The caller supplies its own documented
+* fallback as the last candidate so the substituted value is meaningful per
+* field — this helper never invents a placeholder like "N/A". Use it where a
+* target schema requires a non-empty (often minLength:1) string and a source
+* value may be absent; it is a selection helper, not a normalizer, and never
+* decides to OMIT a field (that stays the caller's call). Go parity: FirstNonEmpty.
+*/
+function firstNonEmpty(...candidates) {
+	for (const c of candidates) if (c != null && c.trim() !== "") return c;
+	return "";
+}
 /** Default maximum input size for converters (50MB) */
 const DEFAULT_MAX_INPUT_SIZE = 50 * 1024 * 1024;
 /**
@@ -202,6 +358,15 @@ function requireHdfResults(input, converterName) {
 	return requireHdfStructure(input, converterName, "baselines");
 }
 /**
+* The HDF Amendments counterpart of requireHdfResults, keyed on the top-level
+* `overrides` array instead of `baselines`.
+*/
+function requireHdfAmendments(input, converterName) {
+	const r = requireHdfStructure(input, converterName, "overrides");
+	if (r.items.length === 0) throw new Error(`${converterName}: invalid HDF structure: missing overrides field`);
+	return r;
+}
+/**
 * Reject malformed HDF input (empty, oversized, non-JSON, top-level array/null,
 * or a missing/wrong-typed structural key) before a converter zero-fills it into
 * a typed document. A parsed JSON `null` (or array, or primitive) is NOT an HDF
@@ -216,6 +381,10 @@ function requireHdfStructure(input, converterName, field) {
 	const doc = parsed;
 	const items = doc[field];
 	if (!Array.isArray(items)) throw new Error(`${converterName}: invalid HDF structure: missing ${field} field`);
+	if (field === "baselines") {
+		const violations = typeViolations(validateResults(doc));
+		if (violations.length > 0) throw new Error(`${converterName}: input is not valid HDF: ${violations.slice(0, 5).join("; ")}`);
+	}
 	return {
 		doc,
 		items
@@ -511,6 +680,24 @@ const UNRATED_SEVERITY_VALUE = "unrated";
 function markUnratedSeverity(tags, severity) {
 	if (isUnratedSeverity(severity)) tags[UNRATED_SEVERITY_TAG] = UNRATED_SEVERITY_VALUE;
 }
+/**
+* The schema violations Go's typed decode would also reject.
+*
+* encoding/json refuses exactly two things: a JSON value whose type does not fit
+* the target field, and a string that will not parse into a time.Time. Every
+* other schema rule — required, enum, minItems, uuid and uri formats — decodes
+* cleanly into the generated structs, so rejecting it here would put the two
+* languages back out of step in the opposite direction.
+*
+* null is exempt for the same reason. Go unmarshals a JSON null into a slice,
+* map or pointer as nil and into anything else as a no-op, never as an error, so
+* a null cvss entry or a null results array reaches the converter there and must
+* reach it here too — several parity goldens pin exactly that.
+*/
+function typeViolations(result) {
+	if (result.valid) return [];
+	return (result.errors ?? []).filter((e) => e.value !== null).filter((e) => e.keyword === "type" || e.keyword === "format" && e.format === "date-time").map((e) => `${e.field ?? ""} ${e.message ?? ""}`.trim());
+}
 //#endregion
 //#region converters/legacyhdf-to-hdf/typescript/converter.ts
 /**
@@ -1725,11 +1912,10 @@ function buildTags$4(result, rule, resolvedLevel, cweIds, nistControls, cciContr
 function extractSourceLocation$1(location) {
 	const uri = location.physicalLocation?.artifactLocation?.uri;
 	const line = location.physicalLocation?.region?.startLine;
-	if (!uri || !line) return;
-	return {
-		ref: uri,
-		line
-	};
+	const sourceLocation = {};
+	if (uri) sourceLocation.ref = uri;
+	if (line) sourceLocation.line = line;
+	return sourceLocation.ref !== void 0 || sourceLocation.line !== void 0 ? sourceLocation : void 0;
 }
 function createHDFResult(location, status, backtrace, suppressionMessage) {
 	const uri = location.physicalLocation?.artifactLocation?.uri || "";
@@ -1790,7 +1976,7 @@ function hostComponents(suites) {
 	const hosts = [];
 	const seen = /* @__PURE__ */ new Set();
 	for (const suite of suites) {
-		const hostname = suite.hostname?.trim();
+		const hostname = suite["@_hostname"]?.trim();
 		if (!hostname || seen.has(hostname)) continue;
 		seen.add(hostname);
 		hosts.push({
@@ -1802,22 +1988,31 @@ function hostComponents(suites) {
 	return hosts;
 }
 function resolveScanTime(suites) {
-	for (const suite of suites) if (suite.timestamp) {
-		const parsed = parseTimestamp(suite.timestamp);
+	for (const suite of suites) if (suite["@_timestamp"]) {
+		const parsed = parseTimestamp(suite["@_timestamp"]);
 		if (parsed) return parsed;
 	}
 	return /* @__PURE__ */ new Date();
 }
 function parseJUnitXML(input) {
-	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2);
-	if (parsed.testsuites) return {
-		suites: parsed.testsuites.testsuite ?? [],
-		name: parsed.testsuites.name ? decodeXmlEntities$6(parsed.testsuites.name) : "JUnit Test Results"
-	};
+	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2, { attributeNamePrefix: "@_" });
+	if (parsed.testsuites) {
+		const suites = [...parsed.testsuites.testsuite ?? []];
+		const name = parsed.testsuites["@_name"] ? decodeXmlEntities$6(parsed.testsuites["@_name"]) : "JUnit Test Results";
+		const looseCases = parsed.testsuites.testcase ?? [];
+		if (looseCases.length > 0) suites.push({
+			"@_name": name,
+			testcase: looseCases
+		});
+		return {
+			suites,
+			name
+		};
+	}
 	if (parsed.testsuite) {
 		const suite = parsed.testsuite;
 		const suites = Array.isArray(suite) ? suite : [suite];
-		const suiteName = suites[0]?.name;
+		const suiteName = suites[0]?.["@_name"];
 		return {
 			suites,
 			name: suiteName ? decodeXmlEntities$6(suiteName) : "JUnit Test Results"
@@ -1848,14 +2043,14 @@ function testCaseToRequirement(tc, scanTime) {
 		startTime: scanTime
 	};
 	if (message !== void 0) result.message = message;
-	if (tc.time) {
-		const parsed = parseFloat(tc.time);
+	if (tc["@_time"]) {
+		const parsed = parseFloat(tc["@_time"]);
 		if (!isNaN(parsed)) result.runTime = parsed;
 	}
-	const name = decodeXmlEntities$6(tc.name);
+	const name = decodeXmlEntities$6(tc["@_name"]);
 	const descriptions = [{
 		label: "default",
-		data: `JUnit test: ${name} in ${tc.classname ? decodeXmlEntities$6(tc.classname) : "unknown"}`
+		data: `JUnit test: ${name} in ${tc["@_classname"] ? decodeXmlEntities$6(tc["@_classname"]) : "unknown"}`
 	}];
 	const { systemOut, systemErr } = collectSystemStreams(tc);
 	if (systemOut) descriptions.push({
@@ -1894,19 +2089,19 @@ function collectSystemStreams(tc) {
 	};
 }
 function buildID(tc) {
-	if (tc.classname) return `${decodeXmlEntities$6(tc.classname)}.${decodeXmlEntities$6(tc.name)}`;
-	return decodeXmlEntities$6(tc.name);
+	if (tc["@_classname"]) return `${decodeXmlEntities$6(tc["@_classname"])}.${decodeXmlEntities$6(tc["@_name"])}`;
+	return decodeXmlEntities$6(tc["@_name"]);
 }
 function resolveStatus(tc) {
 	if (tc.failure) {
-		const msg = buildFailureMessage(tc.failure.message ?? "", tc.failure.type ?? "", tc.failure["#text"] ?? "");
+		const msg = buildFailureMessage(tc.failure["@_message"] ?? "", tc.failure["@_type"] ?? "", tc.failure["#text"] ?? "");
 		return {
 			status: ResultStatus.Failed,
 			message: msg
 		};
 	}
 	if (tc.error) {
-		const msg = buildFailureMessage(tc.error.message ?? "", tc.error.type ?? "", tc.error["#text"] ?? "");
+		const msg = buildFailureMessage(tc.error["@_message"] ?? "", tc.error["@_type"] ?? "", tc.error["#text"] ?? "");
 		return {
 			status: ResultStatus.Error,
 			message: msg
@@ -1914,9 +2109,9 @@ function resolveStatus(tc) {
 	}
 	if (tc.skipped !== void 0) {
 		const skipped = typeof tc.skipped === "object" ? tc.skipped : null;
-		if (skipped?.message) return {
+		if (skipped?.["@_message"]) return {
 			status: ResultStatus.NotReviewed,
-			message: `Skipped: ${decodeXmlEntities$6(skipped.message)}`
+			message: `Skipped: ${decodeXmlEntities$6(skipped["@_message"])}`
 		};
 		return {
 			status: ResultStatus.NotReviewed,
@@ -1933,12 +2128,12 @@ function buildFailureMessage(message, typeName, body) {
 	return result;
 }
 function buildCodeDesc$10(tc) {
-	if (tc.classname) return `${decodeXmlEntities$6(tc.classname)} :: ${decodeXmlEntities$6(tc.name)}`;
-	return decodeXmlEntities$6(tc.name);
+	if (tc["@_classname"]) return `${decodeXmlEntities$6(tc["@_classname"])} :: ${decodeXmlEntities$6(tc["@_name"])}`;
+	return decodeXmlEntities$6(tc["@_name"]);
 }
 function noFindingsTarget(baselineName, suites) {
 	if (baselineName && baselineName !== "JUnit Test Results") return baselineName;
-	for (const s of suites) if (s.name) return decodeXmlEntities$6(s.name);
+	for (const s of suites) if (s["@_name"]) return decodeXmlEntities$6(s["@_name"]);
 	return "JUnit test suite";
 }
 //#endregion
@@ -3105,9 +3300,9 @@ function stamp(v) {
 /** Maps a requirement onto the canonical effective-status input shape. */
 function requirementStatusInput(req) {
 	return {
-		impact: req.impact,
-		resultStatuses: (req.results ?? []).map((r) => String(r.status)),
-		overrides: (req.statusOverrides ?? []).map((o) => ({
+		impact: req.impact ?? 0,
+		resultStatuses: (req.results ?? []).filter((r) => r != null).map((r) => String(r.status)),
+		overrides: (req.statusOverrides ?? []).filter((o) => o != null).map((o) => ({
 			status: o.status ? String(o.status) : void 0,
 			appliedAt: stamp(o.appliedAt),
 			expiresAt: stamp(o.expiresAt)
@@ -7413,10 +7608,8 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 * @returns CSV string with sanitized output
 */
 function convertHdfToCsv(input) {
-	validateInputSize(input, "hdf-to-csv");
-	const hdf = parseHdf(input);
-	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
-	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
+	const { doc: hdfDoc } = requireHdfResults(input, "hdf-to-csv");
+	const hdf = hdfDoc;
 	const rows = [];
 	const components = hdf.components || [];
 	const targetList = components.length > 0 ? components.map((t) => ({
@@ -7430,35 +7623,64 @@ function convertHdfToCsv(input) {
 		fqdn: "",
 		ipAddress: ""
 	}];
-	for (const baseline of hdf.baselines) for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
+	for (const baseline of hdf.baselines) {
+		if (!Array.isArray(baseline.requirements) || baseline.requirements.length === 0) throw new Error(`hdf-to-csv: baseline "${text(baseline.name)}" has no requirements`);
+		for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
+	}
 	return buildCsv(rows, { sanitize: true });
 }
 /**
+* A schema-required number as a number. Go decodes an absent one to the zero
+* value and cannot tell it apart from a real zero — impact 0 legitimately means
+* Not Applicable — so distinguishing them would need a schema validation pass
+* the converters deliberately do not do. Rendering 0 here matches what Go emits,
+* where reading .toFixed off an absent value threw a raw TypeError instead.
+*/
+function numeric(value) {
+	return typeof value === "number" ? value : 0;
+}
+/**
+* A schema-required string as text. Nested-invalid input reaches the converter
+* with these absent, and an absent value reached sanitizeCsvValue's String() as
+* the literal "undefined" — where Go, formatting a zero-value string, wrote
+* nothing. Every schema-required STRING cell goes through here; the numeric
+* ones go through numeric(), which serves the same purpose for a different type.
+*/
+function text(value) {
+	return typeof value === "string" ? value : "";
+}
+/** The requirement id as text; also names the requirement in the no-results error. */
+function requirementIdText$1(id) {
+	return text(id);
+}
+/**
 * Create a CSV row from baseline, requirement, and target data
 */
 function createRow(baseline, requirement, target) {
-	const description = requirement.descriptions.find((d) => d.label === "default")?.data || "";
+	const [firstResult] = Array.isArray(requirement.results) ? requirement.results : [];
+	if (!firstResult) throw new Error(`hdf-to-csv: requirement "${requirementIdText$1(requirement.id)}" has no results`);
+	if (!Array.isArray(requirement.descriptions) || requirement.descriptions.length === 0) throw new Error(`hdf-to-csv: requirement "${requirementIdText$1(requirement.id)}" has no descriptions`);
+	const description = descriptionByLabel(requirement, "default");
 	const check = descriptionByLabel(requirement, "check");
 	const fix = descriptionByLabel(requirement, "fix");
 	const rationale = descriptionByLabel(requirement, "rationale");
 	const code = requirement.code ?? "";
 	const references = flattenRefs(requirement.refs);
 	const severity = getSeverity(requirement);
-	const firstResult = requirement.results[0];
-	const status = firstResult?.status || "";
-	const message = firstResult?.message || "";
+	const status = firstResult.status;
+	const message = firstResult.message ?? "";
 	const nistControls = extractArrayFromTags(requirement.tags, "nist");
 	const cciControls = extractArrayFromTags(requirement.tags, "cci");
 	const effectiveStatus = requirementEffectiveStatus(requirement);
-	const effectiveImpact = (requirement.effectiveImpact ?? requirement.impact).toFixed(1);
+	const effectiveImpact = numeric(requirement.effectiveImpact ?? requirement.impact).toFixed(2);
 	const disposition = requirement.disposition ? String(requirement.disposition) : "";
 	return {
-		"Baseline ID": baseline.name,
+		"Baseline ID": text(baseline.name),
 		"Baseline Version": baseline.version || "",
 		"Baseline Title": baseline.title || "",
-		"Target ID": target.name,
-		"Target Type": target.type,
-		"Requirement ID": requirement.id,
+		"Target ID": text(target.name),
+		"Target Type": text(target.type),
+		"Requirement ID": requirementIdText$1(requirement.id),
 		"Requirement Title": requirement.title || "",
 		"Description": description,
 		"Check": check,
@@ -7467,8 +7689,8 @@ function createRow(baseline, requirement, target) {
 		"Code": code,
 		"References": references,
 		"Severity": severity,
-		"Impact": requirement.impact.toFixed(1),
-		"Status": String(status),
+		"Impact": numeric(requirement.impact).toFixed(2),
+		"Status": text(status),
 		"NIST Controls": nistControls,
 		"CCI Controls": cciControls,
 		"Control Type": requirement.controlType ?? "",
@@ -7482,8 +7704,8 @@ function createRow(baseline, requirement, target) {
 		"Applied By": joinOverrides(requirement.statusOverrides, (o) => o.appliedBy?.identifier ?? ""),
 		"Expires At": joinOverrides(requirement.statusOverrides, (o) => formatExpires(o.expiresAt)),
 		"CVSS": cvssScores(requirement.cvss),
-		"CWE": Array.isArray(requirement.cwe) ? requirement.cwe.join("; ") : "",
-		"EPSS": requirement.epss ? requirement.epss.score.toFixed(5) : "",
+		"CWE": (requirement.cwe ?? []).join("; "),
+		"EPSS": requirement.epss ? numeric(requirement.epss.score).toFixed(5) : "",
 		"KEV": requirement.kev ? requirement.kev.inKev ? "true" : "false" : "",
 		"Target FQDN": target.fqdn,
 		"Target IP": target.ipAddress
@@ -7497,6 +7719,7 @@ function joinOverrides(overrides, pick) {
 	if (!Array.isArray(overrides)) return "";
 	const out = [];
 	for (const o of overrides) {
+		if (o === null || o === void 0) continue;
 		const v = pick(o);
 		if (v) out.push(v);
 	}
@@ -7512,14 +7735,17 @@ function formatExpires(value) {
 }
 /**
 * Render each CVSS entry's score (computed when present, else base) to one
-* decimal, joined with '; ' to preserve multi-CVE findings.
+* decimal — the precision the CVSS spec defines and the source carries — joined
+* with '; ' to preserve multi-CVE findings. The Go peer rounds through a shared
+* helper matching toFixed, so a .x5 score renders the same digits in both.
 */
 function cvssScores(entries) {
 	if (!Array.isArray(entries)) return "";
 	const out = [];
 	for (const c of entries) {
+		if (c === null || c === void 0) continue;
 		const score = c.computedScore ?? c.baseScore;
-		if (score !== void 0) out.push(score.toFixed(1));
+		if (typeof score === "number") out.push(score.toFixed(1));
 	}
 	return out.join("; ");
 }
@@ -7531,7 +7757,7 @@ function getSeverity(requirement) {
 		if ("severity" in requirement.tags) {
 			const sev = requirement.tags.severity;
 			if (typeof sev === "string") return sev;
-			if (Array.isArray(sev) && sev.length > 0) return String(sev[0]);
+			if (Array.isArray(sev) && typeof sev[0] === "string") return sev[0];
 		}
 	}
 	const impact = requirement.impact;
@@ -7545,18 +7771,20 @@ function getSeverity(requirement) {
 function extractArrayFromTags(tags, key) {
 	if (!tags || typeof tags !== "object") return "";
 	const value = tags[key];
-	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
+	if (Array.isArray(value)) return value.filter((v) => typeof v === "string").join("; ");
 	return "";
 }
 /**
 * Get the data of the first description matching a label. Empty when absent.
 */
 function descriptionByLabel(requirement, label) {
-	return requirement.descriptions.find((d) => d.label === label)?.data || "";
+	return requirement.descriptions.find((d) => d !== null && d !== void 0 && d.label === label)?.data || "";
 }
 /**
 * Flatten a requirement's refs to one string: each Reference rendered as its
-* url/uri (or a string `ref`); array-form refs are skipped. Joined with '; ' to
+* url/uri (or a string `ref`); array-form refs are skipped here, though a document
+* containing one never reaches this function in Go, whose typed decode rejects
+* it outright — a reject-versus-degrade split tracked on its own card. Joined with '; ' to
 * match the NIST/CCI column convention.
 */
 function flattenRefs(refs) {
@@ -8655,9 +8883,20 @@ function convertStatistics(stats) {
 * The document is walked as a plain JSON tree and every key is emitted in
 * source-JSON order, so the output can never silently lag a schema addition the
 * way the previous hand-maintained struct mirror did (it dropped ~30 post-v3.2
-* fields). JSON.parse preserves object key insertion order, and the Go converter
-* walks the same normalized JSON in the same order, so the two languages emit
-* output that is identical after the shared XML golden normalization.
+* fields). The Go converter walks the same normalized JSON in the same order, so
+* the two languages emit output that is identical after the shared XML golden
+* normalization for every shape this repo's fixtures and parity tests cover.
+*
+* Equality after that normalization is NOT guaranteed in general, and the reason
+* is structural rather than a fixed list of cases: JSON.parse loses duplicate
+* keys and hoists
+* array-index keys before this builder ever runs, V8's number-to-string forms
+* differ from Go's strconv at the extremes, and Go's encoding/xml sanitizes every
+* XML-illegal rune to U+FFFD where this builder emits it verbatim. This builder
+* also caps nesting depth, which the Go peer does not. Anything landing in those
+* seams can differ; known instances are tracked as cards under the
+* exporter-conformance epic. Assume a shape outside the fixture corpus needs
+* checking against the peer rather than that it is covered.
 */
 /**
 * Maps a container (plural) key to the element name emitted for each of its
@@ -8688,13 +8927,33 @@ function singularFor(key) {
 	return PLURAL_TO_SINGULAR[key] ?? "item";
 }
 /**
-* Wrap a primitive so fast-xml-parser renders it as element text rather than an
-* attribute.
+* Encode a JSON key to a legal XML element name, reporting whether it had to
+* change. HDF leaves object keys unconstrained — tags carry vendor-namespaced
+* keys like "sonarqube/hash", and additionalProperties lets a converter park
+* native fields anywhere — while XML constrains element names to Name, so an
+* unencoded key produced a document no parser could read.
+*
+* The kept set is ASCII — [A-Za-z0-9._-] — not the far wider set XML Name
+* allows, so the two languages agree by construction rather than by way of two
+* Unicode tables that can drift apart. It costs nothing here: no tag key in this
+* package's converter fixtures is non-ASCII. ':' is deliberately not kept —
+* it is a legal Name character but would invent an undeclared namespace prefix.
+*
+* Mirrored by xmlElementName in the Go converter and pinned to a shared table.
 */
-function wrapScalar(value) {
-	return { "#text": value };
+function xmlElementName(key) {
+	const out = [...key].map((ch) => /[A-Za-z0-9.\-_]/.test(ch) ? ch : "_").join("");
+	const [first = ""] = [...out];
+	const name = /[A-Za-z_]/.test(first) ? out : `_${out}`;
+	return [name, name !== key];
 }
 /**
+* The attribute holding the original key of a rewritten element. The prefix is
+* what separates an attribute from a child element in the builder; it cannot
+* collide with a child, because any key spelled this way is itself rewritten.
+*/
+const NAME_ATTR = "@_name";
+/**
 * True for a JSON scalar (string, number, bool) or a null/undefined placeholder.
 * Nested objects and arrays are not scalar, which selects the wrapped
 * object-array rendering.
@@ -8702,37 +8961,48 @@ function wrapScalar(value) {
 function isScalar(value) {
 	return value === null || value === void 0 || typeof value !== "object";
 }
+function present(value) {
+	return value !== null && value !== void 0;
+}
 /**
-* Convert an object-array item into its fast-xml-parser representation. Items
-* are objects (the object-array rule), but a scalar in a heterogeneous array is
-* wrapped so it renders as <singular>text</singular>, matching the Go walker.
+* Render one JSON key as the sibling nodes it becomes, mirroring the Go
+* writeValue case for case. A list rather than a single node because a scalar
+* array repeats its key unwrapped, and because two keys can encode to one
+* element name — preserveOrder keeps each at its own position, which a plain
+* object keyed by element name could not.
 */
-function toXmlValue(value) {
-	if (value === null || value === void 0) return;
-	if (Array.isArray(value)) return { item: value.filter((v) => v !== null && v !== void 0).map(toXmlValue) };
-	if (typeof value === "object") return buildObject(value);
-	return wrapScalar(value);
+function nodesFor(key, value) {
+	const [name, rewritten] = xmlElementName(key);
+	const attrs = rewritten ? { ":@": { [NAME_ATTR]: xmlSafeText(key) } } : {};
+	if (Array.isArray(value)) {
+		if (value.length === 0) return [{
+			[name]: [],
+			...attrs
+		}];
+		if (value.every(isScalar)) return value.filter(present).flatMap((item) => nodesFor(key, item));
+		const child = singularFor(key);
+		return [{
+			[name]: value.filter(present).flatMap((item) => nodesFor(child, item)),
+			...attrs
+		}];
+	}
+	if (typeof value === "object") return [{
+		[name]: buildNodes(value),
+		...attrs
+	}];
+	const text = typeof value === "string" ? xmlSafeText(value) : value;
+	return [{
+		[name]: [{ "#text": text }],
+		...attrs
+	}];
 }
 /**
-* Walk a JSON object into a fast-xml-parser-ready structure, emitting keys in
-* source order. Null-valued keys are omitted (parity with the old omitempty
-* semantics). A scalar array repeats its key unwrapped (<nist>AU-12</nist>); an
-* object array becomes a wrapper whose per-item child name comes from the
-* plural->singular map; an empty array becomes an empty wrapper element.
+* Walk a JSON object into fast-xml-parser preserveOrder nodes, emitting keys in
+* source order. Null-valued keys are omitted, matching the old omitempty
+* semantics and the Go peer.
 */
-function buildObject(obj) {
-	const out = {};
-	for (const [key, value] of Object.entries(obj)) {
-		if (value === null || value === void 0) continue;
-		if (Array.isArray(value)) {
-			const items = value.filter((v) => v !== null && v !== void 0);
-			if (value.length === 0) out[key] = {};
-			else if (value.every(isScalar)) out[key] = items.map((v) => wrapScalar(v));
-			else out[key] = { [singularFor(key)]: items.map(toXmlValue) };
-		} else if (typeof value === "object") out[key] = buildObject(value);
-		else out[key] = wrapScalar(value);
-	}
-	return out;
+function buildNodes(obj) {
+	return Object.entries(obj).flatMap(([key, value]) => present(value) ? nodesFor(key, value) : []);
 }
 /**
 * Convert HDF Results JSON to XML.
@@ -8745,7 +9015,10 @@ function convertHdfToXml(input) {
 	const hdf = parseHdf(input);
 	if (!hdf || typeof hdf !== "object" || Array.isArray(hdf) || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
-	return buildXml({ HdfResults: buildObject(hdf) });
+	return `${buildXml([{ HdfResults: buildNodes(hdf) }], {
+		preserveOrder: true,
+		attributeNamePrefix: "@_"
+	}).trim()}\n`;
 }
 //#endregion
 //#region converters/gitlab-to-hdf/typescript/converter.ts
@@ -8970,18 +9243,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 const BASELINE_NAME = "Trivy Scan";
 const STATIC_CCI = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 const CWE_ID_PATTERN$1 = /^CWE-[1-9]\d*$/;
-const IMPACT_MAP = {
-	critical: .9,
-	high: .7,
-	medium: .5,
-	low: .3,
-	unknown: .5,
-	none: 0,
-	info: 0
-};
-function severityToImpact$2(severity) {
-	return IMPACT_MAP[(severity || "").toLowerCase()] ?? .5;
-}
+const SEVERITY_ALIASES = { critical: .9 };
 /**
 * Route Trivy output to HDF Results: native Trivy JSON (SchemaVersion 2) is
 * parsed here; SARIF / CycloneDX / ASFF / GitLab are delegated to their
@@ -9031,7 +9293,7 @@ async function convertNative(input, converterVersion) {
 function convertVuln(v, res, startTime) {
 	const descriptions = [{
 		label: "default",
-		data: firstNonEmpty(v.Description, v.Title, v.VulnerabilityID)
+		data: firstNonEmpty(v.Description ?? "", v.Title ?? "", v.VulnerabilityID ?? "")
 	}];
 	if (v.FixedVersion) descriptions.push({
 		label: "fix",
@@ -9049,7 +9311,7 @@ function convertVuln(v, res, startTime) {
 		id: `Trivy/${v.VulnerabilityID ?? ""}`,
 		title: `Trivy found ${v.VulnerabilityID ?? ""} in ${pkgLabel(v.PkgName, v.InstalledVersion)}`,
 		descriptions,
-		impact: severityToImpact$2(v.Severity ?? ""),
+		impact: severityToImpactWithAliases(v.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		cwe: filterCwes(v.CweIDs),
 		cvss: buildCvssEntries$4(v.CVSS),
@@ -9061,7 +9323,7 @@ function convertVuln(v, res, startTime) {
 			status: ResultStatus.Failed,
 			codeDesc: buildVulnCodeDesc(v, res),
 			startTime,
-			message: `Severity: ${firstNonEmpty(v.Severity, "UNKNOWN")}`
+			message: `Severity: ${firstNonEmpty(v.Severity ?? "", "UNKNOWN")}`
 		}]
 	};
 	const ap = buildAffectedPackage$1(v);
@@ -9072,7 +9334,7 @@ function convertVuln(v, res, startTime) {
 function convertMisconf(m, res, startTime) {
 	const descriptions = [{
 		label: "default",
-		data: firstNonEmpty(m.Description, m.Message, m.Title)
+		data: firstNonEmpty(m.Description ?? "", m.Message ?? "", m.Title ?? "")
 	}];
 	if (m.Resolution) descriptions.push({
 		label: "fix",
@@ -9084,10 +9346,10 @@ function convertMisconf(m, res, startTime) {
 	});
 	markUnratedSeverity(tags, m.Severity);
 	const req = {
-		id: `Trivy/${firstNonEmpty(m.ID, m.AVDID)}`,
+		id: `Trivy/${firstNonEmpty(m.ID ?? "", m.AVDID ?? "")}`,
 		title: m.Title,
 		descriptions,
-		impact: severityToImpact$2(m.Severity ?? ""),
+		impact: severityToImpactWithAliases(m.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		refs: buildRefs$5([m.PrimaryURL, ...m.References ?? []]),
 		code: JSON.stringify(m, null, 2),
@@ -9095,7 +9357,7 @@ function convertMisconf(m, res, startTime) {
 		verificationMethod: VerificationMethodEnum.Automated,
 		results: [{
 			status: misconfStatus(m.Status),
-			codeDesc: firstNonEmpty(m.Message, m.Title),
+			codeDesc: firstNonEmpty(m.Message ?? "", m.Title ?? ""),
 			startTime
 		}]
 	};
@@ -9117,9 +9379,9 @@ function convertSecret(s, res, startTime) {
 		title: s.Title,
 		descriptions: [{
 			label: "default",
-			data: `${firstNonEmpty(s.Title, s.RuleID)} detected in ${res.Target ?? ""} (value redacted by Trivy).`
+			data: `${firstNonEmpty(s.Title ?? "", s.RuleID ?? "")} detected in ${res.Target ?? ""} (value redacted by Trivy).`
 		}],
-		impact: severityToImpact$2(s.Severity ?? ""),
+		impact: severityToImpactWithAliases(s.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		code: JSON.stringify(s, null, 2),
 		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
@@ -9151,7 +9413,7 @@ function convertLicense(l, res, startTime) {
 			label: "default",
 			data: `Package ${l.PkgName ?? ""} uses the ${l.Name ?? ""} license (category: ${l.Category ?? ""}).`
 		}],
-		impact: severityToImpact$2(l.Severity ?? ""),
+		impact: severityToImpactWithAliases(l.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		refs: buildRefs$5([l.Link]),
 		code: JSON.stringify(l, null, 2),
@@ -9232,17 +9494,6 @@ function buildCvssEntries$4(m) {
 	}
 	return entries.length > 0 ? entries : void 0;
 }
-const PURL_ECOSYSTEMS = {
-	deb: Ecosystem.Deb,
-	rpm: Ecosystem.RPM,
-	maven: Ecosystem.Maven,
-	npm: Ecosystem.Npm,
-	pypi: Ecosystem.Pypi,
-	gem: Ecosystem.Gem,
-	cargo: Ecosystem.Cargo,
-	golang: Ecosystem.Go,
-	nuget: Ecosystem.Nuget
-};
 function buildAffectedPackage$1(v) {
 	const ap = {};
 	if (v.PkgName) ap.name = v.PkgName;
@@ -9257,8 +9508,8 @@ function buildAffectedPackage$1(v) {
 	return ap;
 }
 function ecosystemFromPurl(purl) {
-	const type = (purl.replace(/^pkg:/, "").split(/[/@?]/)[0] ?? "").toLowerCase();
-	return PURL_ECOSYSTEMS[type];
+	const eco = ecosystemFromPurlType(purl.replace(/^pkg:/, "").split(/[/@?]/)[0] ?? "");
+	return eco === Ecosystem.Generic ? void 0 : eco;
 }
 function buildRefs$5(urls) {
 	const seen = /* @__PURE__ */ new Set();
@@ -9285,10 +9536,6 @@ function digestPart(ref) {
 	const at = ref.lastIndexOf("@");
 	return at >= 0 ? ref.slice(at + 1) : ref;
 }
-function firstNonEmpty(...vals) {
-	for (const v of vals) if (v) return v;
-	return "";
-}
 function putIf(m, key, val) {
 	if (val) m[key] = val;
 }
@@ -13441,7 +13688,44 @@ function findDescription(descriptions, label) {
 }
 /** Replace characters not valid in XCCDF IDs with underscores. */
 function sanitizeXccdfId(id) {
-	return id.replace(/[^a-zA-Z0-9_.\-]/g, "_");
+	return id.replace(/[^a-zA-Z0-9_.\-]/gu, "_");
+}
+/**
+* Supply the trailing name segment that benchmarkIdType and profileIdType
+* require via their .+ — a baseline with an empty name is valid HDF but
+* produced "xccdf_hdf_benchmark_", which the XSD rejects.
+*/
+function xccdfNamePart(name) {
+	return name === "" ? "unnamed" : name;
+}
+/**
+* Render an HDF tags.gid as a groupIdType: an NCName that must also match
+* xccdf_[^_]+_group_.+ (xccdf_1.2.xsd:821). HDF constrains gid not at all, and
+* most real data does not satisfy it — 783 of the 1216 distinct gid values in
+* this package's converter fixtures are bare STIG ids like "V-257777" — so copying one
+* through produced XSD-invalid output from valid HDF.
+*
+* A gid that already conforms is a genuine XCCDF group id (STIG content carries
+* "xccdf_mil.disa.stig_group_V-204393") and is passed through; anything else is
+* sanitized and namespaced under this converter, matching what the benchmark,
+* profile, and rule ids already do.
+*
+* Mirrored by xccdfGroupID in the Go converter. Exported so the shared table
+* can be asserted against the encoder directly, including the empty gid the
+* converter itself skips.
+*/
+function xccdfGroupId(gid) {
+	if (isXccdfGroupId(gid)) return gid;
+	return sanitizeXccdfId("xccdf_hdf_group_" + (gid === "" ? "unnamed" : gid));
+}
+/**
+* Whether a value already satisfies groupIdType. The character test is
+* ASCII-only, deliberately narrower than NCName: a conforming non-ASCII id is
+* re-encoded rather than trusted, which errs toward valid output and keeps the
+* check identical to the Go peer's.
+*/
+function isXccdfGroupId(id) {
+	return /^xccdf_[^_]+_group_.+$/.test(id) && /^[A-Za-z0-9._-]+$/.test(id);
 }
 /** Read a string-valued tag, or undefined if absent/non-string. */
 function tagString(tags, key) {
@@ -13466,12 +13750,22 @@ function toolTestSystem(tool) {
 	const name = tool.name ? cpeField(tool.name) : "tool";
 	return `cpe:/a:${name}:${name}:${cpeField(tool.version)}`;
 }
+/**
+* The requirement id as text for id construction. HDF makes id required, but
+* nested-invalid input reaches the converter and concatenating an absent id
+* wrote the literal string "undefined" into the emitted identifier — where Go,
+* concatenating a zero-value string, wrote nothing. Both satisfied the XCCDF
+* pattern, so no schema gate caught the divergence.
+*/
+function requirementIdText(id) {
+	return typeof id === "string" ? id : "";
+}
 /** Build the Benchmark XML object from HDF data. */
 function buildBenchmarkObj(hdfData) {
 	const empty = !hdfData.baselines || hdfData.baselines.length === 0;
 	const benchmark = {
 		[`${ATTR}xmlns`]: "http://checklists.nist.gov/xccdf/1.2",
-		[`${ATTR}id`]: empty ? "xccdf_hdf_benchmark_exported" : sanitizeXccdfId("xccdf_hdf_benchmark_" + hdfData.baselines[0].name),
+		[`${ATTR}id`]: empty ? "xccdf_hdf_benchmark_exported" : sanitizeXccdfId("xccdf_hdf_benchmark_" + xccdfNamePart(hdfData.baselines[0].name)),
 		[`${ATTR}resolved`]: "1",
 		status: wrap("incomplete")
 	};
@@ -13485,7 +13779,7 @@ function buildBenchmarkObj(hdfData) {
 	if (baseline.summary) benchmark.description = wrap(baseline.summary);
 	benchmark.version = wrap(baseline.version ?? "1.0");
 	benchmark.Profile = {
-		[`${ATTR}id`]: sanitizeXccdfId("xccdf_hdf_profile_" + baseline.name),
+		[`${ATTR}id`]: sanitizeXccdfId("xccdf_hdf_profile_" + xccdfNamePart(baseline.name)),
 		title: wrap(baseline.title ?? baseline.name)
 	};
 	const groups = [];
@@ -13502,7 +13796,7 @@ function buildBenchmarkObj(hdfData) {
 		if (idx === void 0) {
 			idx = groups.length;
 			groupIndex.set(gid, idx);
-			const group = { [`${ATTR}id`]: gid };
+			const group = { [`${ATTR}id`]: xccdfGroupId(gid) };
 			const gtitle = tagString(req.tags, "gtitle");
 			if (gtitle) group.title = wrap(gtitle);
 			group.Rule = [];
@@ -13512,12 +13806,13 @@ function buildBenchmarkObj(hdfData) {
 	}
 	if (groups.length > 0) benchmark.Group = groups;
 	if (flatRules.length > 0) benchmark.Rule = flatRules;
-	benchmark.TestResult = buildTestResultObj(hdfData, baseline);
+	const testResult = buildTestResultObj(hdfData, baseline);
+	if (testResult) benchmark.TestResult = testResult;
 	return benchmark;
 }
 /** Build an XCCDF Rule object from an HDF EvaluatedRequirement. */
 function buildRuleObj(req) {
-	const ruleId = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
+	const ruleId = sanitizeXccdfId("xccdf_hdf_rule_" + requirementIdText(req.id) + "_rule");
 	const rule = {
 		[`${ATTR}id`]: ruleId,
 		[`${ATTR}severity`]: impactToSeverity$2(req.impact),
@@ -13566,27 +13861,74 @@ function buildRuleObj(req) {
 		[`${ATTR}system`]: "http://oval.mitre.org/XMLSchema/oval-definitions-5",
 		"check-content": wrap(checkContent)
 	});
-	if (req.code) checks.push({
+	const code = firstNonEmpty(req.code ?? "");
+	if (code !== "") checks.push({
 		[`${ATTR}system`]: "http://inspec.io/",
-		"check-content": wrap(req.code)
+		"check-content": wrap(code)
 	});
 	if (checks.length > 0) rule.check = checks;
 	return rule;
 }
-/** Build the XCCDF TestResult object. */
+/**
+* The earliest and latest result time in a baseline.
+*
+* XCCDF makes TestResult/@end-time required while HDF's top-level timestamp is
+* optional, so a document without one still has to carry a scan window. It is
+* derived from the results rather than the wall clock, which would break both
+* determinism and the golden comparison. A TestResult is only built when a
+* baseline exists, and the HDF schema puts minItems 1 on both requirements and
+* results with startTime required on each, so a window is always available
+* here; undefined is returned anyway rather than assuming it.
+*
+* Times are emitted through formatTimestamp, HDF's canonical form, which is
+* documented as byte-identical to the RFC3339Nano string the Go converter
+* emits for the same instant.
+*
+* Mirrored by resultTimeWindow in the Go converter.
+*/
+function resultTimeWindow(baseline) {
+	let first;
+	let last;
+	for (const req of baseline.requirements) for (const res of req.results) {
+		const parsed = parseTimestamp(typeof res.startTime === "string" ? res.startTime : res.startTime.toISOString());
+		if (!parsed) continue;
+		const at = parsed.getTime();
+		const canonical = formatTimestamp(parsed);
+		if (!first || at < first.at) first = {
+			at,
+			text: canonical
+		};
+		if (!last || at > last.at) last = {
+			at,
+			text: canonical
+		};
+	}
+	return first && last ? {
+		first: first.text,
+		last: last.text
+	} : void 0;
+}
+/** Build the XCCDF TestResult object, or undefined when it cannot carry a time. */
 function buildTestResultObj(hdfData, baseline) {
 	const testResult = {
 		[`${ATTR}id`]: "xccdf_hdf_testresult_1",
 		title: wrap("HDF Assessment Results")
 	};
 	if (hdfData.timestamp) {
-		const ts = typeof hdfData.timestamp === "string" ? hdfData.timestamp : hdfData.timestamp.toISOString();
+		const raw = typeof hdfData.timestamp === "string" ? hdfData.timestamp : hdfData.timestamp.toISOString();
+		const parsedTs = parseTimestamp(raw);
+		const ts = parsedTs ? formatTimestamp(parsedTs) : raw;
 		testResult[`${ATTR}start-time`] = ts;
 		let endTime = ts;
 		const duration = hdfData.statistics?.duration;
 		const start = parseTimestamp(ts);
 		if (start && typeof duration === "number" && duration > 0) endTime = formatTimestamp(new Date(start.getTime() + duration * 1e3));
 		testResult[`${ATTR}end-time`] = endTime;
+	} else {
+		const window = resultTimeWindow(baseline);
+		if (!window) return;
+		testResult[`${ATTR}start-time`] = window.first;
+		testResult[`${ATTR}end-time`] = window.last;
 	}
 	const testSystem = toolTestSystem(hdfData.tool);
 	if (testSystem) testResult[`${ATTR}test-system`] = testSystem;
@@ -13599,7 +13941,7 @@ function buildTestResultObj(hdfData, baseline) {
 	let passed = 0;
 	let scorable = 0;
 	for (const req of baseline.requirements) {
-		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
+		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + requirementIdText(req.id) + "_rule");
 		const stigId = tagString(req.tags, "stig_id");
 		const statusInput = requirementStatusInput(req);
 		const resolved = computeEffectiveStatus(statusInput);
@@ -13611,7 +13953,9 @@ function buildTestResultObj(hdfData, baseline) {
 				scorable++;
 			} else if (status === "fail") scorable++;
 			const rr = { [`${ATTR}idref`]: ruleIdRef };
-			rr[`${ATTR}time`] = typeof result.startTime === "string" ? result.startTime : result.startTime.toISOString();
+			const rawStart = typeof result.startTime === "string" ? result.startTime : result.startTime.toISOString();
+			const parsedStart = parseTimestamp(rawStart);
+			rr[`${ATTR}time`] = parsedStart ? formatTimestamp(parsedStart) : rawStart;
 			if (stigId) rr[`${ATTR}version`] = stigId;
 			rr.result = wrap(status);
 			if (result.message) rr.message = wrap(result.message);
@@ -13866,15 +14210,9 @@ function oscalString(s) {
 * @returns OSCAL SAR JSON string
 */
 async function convertHdfToOscalSar(input) {
-	validateInputSize(input, "hdf-to-oscal-sar");
-	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-sar: empty input");
-	let hdfResults;
-	try {
-		hdfResults = parseHdf(input);
-	} catch {
-		throw new Error("hdf-to-oscal-sar: failed to parse HDF JSON");
-	}
-	if (!hdfResults || typeof hdfResults !== "object" || !("baselines" in hdfResults)) throw new Error("hdf-to-oscal-sar: invalid HDF structure: missing baselines field");
+	const { doc: hdfResultsDoc } = requireHdfResults(input, "hdf-to-oscal-sar");
+	const hdfResults = hdfResultsDoc;
+	if (hdfResults.baselines.length === 0) throw new Error("hdf-to-oscal-sar: cannot represent an assessment with no evaluated baselines as OSCAL Assessment Results, which requires at least one result");
 	const doc = buildOSCALDocument(hdfResults);
 	return JSON.stringify(doc, null, 2);
 }
@@ -13976,7 +14314,7 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	const includeControls = [];
 	const seenControl = /* @__PURE__ */ new Set();
 	for (const req of baseline.requirements) {
-		const nistId = nistTagToControlId(req.id);
+		const nistId = nistTagToControlId(req.id ?? "");
 		if (nistId === "") continue;
 		const { finding, observation, risk, resource } = requirementToFindingSet(req, timestamp, toolActorUuid, subjects);
 		findings.push(finding);
@@ -13998,9 +14336,9 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 			start: assessmentStart(baseline, timestamp),
 			...resultProps.length > 0 ? { props: resultProps } : {},
 			"reviewed-controls": { "control-selections": [controlSelection] },
-			findings,
-			observations,
-			risks
+			...findings.length > 0 ? { findings } : {},
+			...observations.length > 0 ? { observations } : {},
+			...risks.length > 0 ? { risks } : {}
 		},
 		resources
 	};
@@ -14010,10 +14348,17 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 * component's UUID (componentId when present, otherwise a fresh one) identifies
 * the subject; the HDF component type is a valid OSCAL subject type token and
 * its name becomes the subject title.
+*
+* A component with no type is skipped rather than given one. OSCAL requires both
+* subject-uuid and type on a subject-reference, so the type cannot simply be
+* omitted, and hdf-results defines no default component type to fall back on.
+* String(c.type) turned an absent type into the literal "undefined" — a valid
+* OSCAL token, so a schema check could not see it, asserting a component type
+* the source never stated. Mirrors the Go peer.
 */
 function buildSubjects(components) {
 	if (!Array.isArray(components) || components.length === 0) return [];
-	return components.map((c) => ({
+	return components.filter((c) => oscalString(c.type ?? "") !== "").map((c) => ({
 		"subject-uuid": c.componentId && c.componentId !== "" ? c.componentId : crypto.randomUUID(),
 		type: String(c.type),
 		title: c.name
@@ -14023,7 +14368,7 @@ function buildSubjects(components) {
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
 */
 function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
-	const controlID = oscalToken(nistTagToControlId(req.id));
+	const controlID = oscalToken(nistTagToControlId(req.id ?? ""));
 	const results = req.results ?? [];
 	const descriptions = req.descriptions ?? [];
 	const { state, reason } = effectiveState(req);
@@ -14380,17 +14725,27 @@ function riskStatusFromState(state) {
 * @returns OSCAL POA&M JSON string
 */
 async function convertHdfToOscalPoam(input) {
-	validateInputSize(input, "hdf-to-oscal-poam");
-	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-poam: empty input");
-	let amendments;
-	try {
-		amendments = parseHdf(input);
-	} catch {
-		throw new Error("hdf-to-oscal-poam: failed to parse JSON");
-	}
-	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendments) };
+	const { doc: amendmentsDoc } = requireHdfAmendments(input, "hdf-to-oscal-poam");
+	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendmentsDoc) };
 	return JSON.stringify(doc, null, 2);
 }
+/**
+* Picks the document title, which OSCAL requires on metadata. The HDF name is
+* schema-required, so the fallbacks only matter for a document that slipped
+* through some other producer's validation.
+*/
+function poamTitle(a) {
+	return firstNonEmpty(a.name, a.amendmentId ?? "", "HDF Amendments");
+}
+/**
+* Supplies the text OSCAL requires for a risk's description and statement. HDF
+* puts no minLength on reason, so an override can legitimately carry none; the
+* fallback states that absence rather than inventing an impact assessment the
+* source never made.
+*/
+function riskRationale(override) {
+	return firstNonEmpty(override.reason, `No rationale was recorded for the ${String(override.type)} override applied to ${override.requirementId}.`);
+}
 /** HDF dates arrive as strings from JSON.parse but are typed as Date. */
 function toDate(value) {
 	if (value === void 0) return void 0;
@@ -14408,14 +14763,15 @@ var PartyRegistry = class {
 		this.byId = /* @__PURE__ */ new Map();
 	}
 	getOrAdd(id) {
-		const existing = this.byId.get(id.identifier);
+		const name = oscalString(id.identifier);
+		const existing = this.byId.get(name);
 		if (existing) return existing.uuid;
 		const party = {
 			uuid: crypto.randomUUID(),
 			type: "person",
-			name: id.identifier
+			...name === "" ? {} : { name }
 		};
-		this.byId.set(id.identifier, party);
+		this.byId.set(name, party);
 		return party.uuid;
 	}
 	list() {
@@ -14465,7 +14821,7 @@ function amendmentsToPOAM(amendments) {
 		observations.push(...itemObs);
 	}
 	const metadata = {
-		title: amendments.name,
+		title: poamTitle(amendments),
 		"last-modified": latestAppliedAt(amendments.overrides),
 		version: amendmentsVersion(amendments),
 		"oscal-version": OSCAL_VERSION
@@ -14483,9 +14839,9 @@ function amendmentsToPOAM(amendments) {
 		uuid: crypto.randomUUID(),
 		metadata,
 		"import-ssp": importSSP,
-		risks,
 		"poam-items": poamItems
 	};
+	if (risks.length > 0) poam.risks = risks;
 	if (observations.length > 0) poam.observations = observations;
 	const resources = externalRefResources(amendments.overrides);
 	if (resources.length > 0) poam["back-matter"] = { resources };
@@ -14498,10 +14854,9 @@ function amendmentsToPOAM(amendments) {
 function overrideToPOAMItem(override, parties) {
 	const riskUUID = crypto.randomUUID();
 	const riskStatus = override.status ? hdfStatusToOscalRiskStatus(String(override.status)) : "open";
-	const riskProps = [{
-		name: "impacted-control-id",
-		value: nistTagToControlId(override.requirementId)
-	}];
+	const controlID = nistTagToControlId(override.requirementId);
+	const riskProps = [];
+	pushStringProp(riskProps, "impacted-control-id", controlID);
 	if (override.type) riskProps.push({
 		name: "override-type",
 		value: String(override.type)
@@ -14510,18 +14865,9 @@ function overrideToPOAMItem(override, parties) {
 		name: "impact-override",
 		value: String(override.impact.value)
 	});
-	if (override.justification) riskProps.push({
-		name: "justification",
-		value: String(override.justification)
-	});
-	if (override.baselineRef) riskProps.push({
-		name: "baseline-ref",
-		value: override.baselineRef
-	});
-	if (override.componentRef) riskProps.push({
-		name: "component-ref",
-		value: override.componentRef
-	});
+	if (override.justification) pushStringProp(riskProps, "justification", String(override.justification));
+	if (override.baselineRef) pushStringProp(riskProps, "baseline-ref", override.baselineRef);
+	if (override.componentRef) pushStringProp(riskProps, "component-ref", override.componentRef);
 	const remediations = [];
 	if (override.milestones) for (const ms of override.milestones) {
 		const msProps = [];
@@ -14583,11 +14929,12 @@ function overrideToPOAMItem(override, parties) {
 		itemObs.push(evidenceObservation(ev, obsUUID, collected));
 		relatedObs.push({ "observation-uuid": obsUUID });
 	}
+	const rationale = riskRationale(override);
 	const risk = {
 		uuid: riskUUID,
 		title: override.requirementId,
-		description: override.reason,
-		statement: override.reason,
+		description: rationale,
+		statement: rationale,
 		status: riskStatus,
 		deadline,
 		props: riskProps,
@@ -14622,9 +14969,22 @@ function latestAppliedAt(overrides) {
 	}
 	return formatTimestampSeconds(latest ?? /* @__PURE__ */ new Date());
 }
+/**
+* Add a property whose value OSCAL types as StringDatatype, trimming it and
+* omitting the property entirely when nothing survives. A prop with an empty
+* value carries no more than an absent one and is schema-invalid. Mirrors
+* appendStringProp in the Go peer.
+*/
+function pushStringProp(props, name, value) {
+	const trimmed = oscalString(value ?? "");
+	if (trimmed !== "") props.push({
+		name,
+		value: trimmed
+	});
+}
 /** Sources metadata.version from the amendments document, defaulting when omitted. */
 function amendmentsVersion(a) {
-	return a.version && a.version !== "" ? a.version : "1.0.0";
+	return oscalString(a.version ?? "") || "1.0.0";
 }
 /**
 * Carries document identifiers and labels that have no first-class OSCAL home.
@@ -14632,17 +14992,33 @@ function amendmentsVersion(a) {
 */
 function metadataProps(a) {
 	const props = [];
-	if (a.amendmentId) props.push({
-		name: "amendment-id",
-		value: a.amendmentId
-	});
-	if (a.labels) for (const k of Object.keys(a.labels).sort()) props.push({
-		name: k,
-		value: a.labels[k],
-		class: "amendment-label"
-	});
+	if (a.amendmentId) pushStringProp(props, "amendment-id", a.amendmentId);
+	if (a.labels) for (const [key, value] of Object.entries(a.labels).sort(([x], [y]) => x < y ? -1 : x > y ? 1 : 0)) {
+		const prop = labelProp(key, value);
+		if (prop.value !== "") props.push(prop);
+	}
 	return props;
 }
+/**
+* Render one amendments label as a property. OSCAL types prop/@name as
+* TokenDatatype while HDF puts no constraint on label keys, so the key is
+* encoded and the source key kept in remarks when it had to change. Every label
+* key in this package's converter fixtures is token-shaped today, so this guards a shape real
+* data has not yet produced — but Kubernetes and OCI label keys are namespaced
+* with '/', which HDF permits and OSCAL rejects.
+*
+* Mirrored by labelProp in the Go converter.
+*/
+function labelProp(key, value) {
+	const name = oscalToken(key) === "" ? "_" : oscalToken(key);
+	const prop = {
+		name,
+		value: oscalString(value),
+		class: "amendment-label"
+	};
+	if (key !== "" && name !== key) prop.remarks = key;
+	return prop;
+}
 /** Picks the collection timestamp for evidence observations. */
 function observationCollected(override) {
 	return formatTimestampSeconds(toDate(override.appliedAt) ?? /* @__PURE__ */ new Date());
@@ -14656,14 +15032,8 @@ function evidenceObservation(ev, uuid, defaultCollected) {
 	if (ev.type === "url") re.href = ev.data;
 	else if (ev.data) re.remarks = ev.data;
 	const props = [];
-	if (ev.mimeType) props.push({
-		name: "mime-type",
-		value: ev.mimeType
-	});
-	if (ev.capturedBy && ev.capturedBy.identifier) props.push({
-		name: "captured-by",
-		value: ev.capturedBy.identifier
-	});
+	if (ev.mimeType) pushStringProp(props, "mime-type", ev.mimeType);
+	if (ev.capturedBy && ev.capturedBy.identifier) pushStringProp(props, "captured-by", ev.capturedBy.identifier);
 	return {
 		uuid,
 		description: desc,
@@ -15262,8 +15632,10 @@ async function convertOpenVexToHdf(input, converterVersion = "1.0.0") {
 		if (override) overrides.push(override);
 	}
 	if (overrides.length === 0) throw new Error("openvex-to-hdf: VEX document contains no actionable statements (all 'affected' or 'under_investigation'); no amendment to write");
+	const name = doc.author ? `OpenVEX statements from ${doc.author}` : "OpenVEX statements";
+	await chainOverrides(overrides);
 	return {
-		name: doc.author ? `OpenVEX statements from ${doc.author}` : "OpenVEX statements",
+		name,
 		description: `Imported VEX statements from ${truncateId(doc["@id"] ?? "")}`,
 		overrides,
 		appliedBy: identityFor$2(doc.author, doc.role),
@@ -15357,6 +15729,7 @@ async function convertCsafVexToHdf(input, converterVersion = "1.0.0") {
 	for (const v of doc.vulnerabilities ?? []) overrides.push(...vulnerabilityToOverrides(v, publisher, tracking, docTime, productLookup));
 	if (overrides.length === 0) throw new Error("csaf-vex-to-hdf: CSAF VEX document contains no actionable statements (only affected/under_investigation/recommended); no amendment to write");
 	const publisherName = publisher.name ?? "";
+	await chainOverrides(overrides);
 	return {
 		name: publisherName ? `CSAF VEX statements from ${publisherName}` : "CSAF VEX statements",
 		description: `Imported VEX advisory ${tracking.id ?? ""}`,
@@ -15575,9 +15948,12 @@ async function convertCyclonedxVexToHdf(input, converterVersion = "1.0.0") {
 	}
 	if (overrides.length === 0) throw new Error("cyclonedx-vex-to-hdf: BOM contains no actionable VEX statements (only exploitable/in_triage or no analysis); no amendment to write");
 	const publisherName = publisher.identifier;
+	const name = publisherName && publisherName !== "cyclonedx-vex-import" ? `CycloneDX VEX statements from ${publisherName}` : "CycloneDX VEX statements";
+	const description = bom.serialNumber ? `Imported CycloneDX VEX ${bom.serialNumber}` : "Imported CycloneDX VEX";
+	await chainOverrides(overrides);
 	return {
-		name: publisherName && publisherName !== "cyclonedx-vex-import" ? `CycloneDX VEX statements from ${publisherName}` : "CycloneDX VEX statements",
-		description: bom.serialNumber ? `Imported CycloneDX VEX ${bom.serialNumber}` : "Imported CycloneDX VEX",
+		name,
+		description,
 		overrides,
 		appliedBy: publisher,
 		generator: {
@@ -15752,8 +16128,10 @@ async function convertSpdxVexToHdf(input, converterVersion = "1.0.0") {
 	}
 	if (overrides.length === 0) throw new Error("spdx-vex-to-hdf: SPDX document contains no actionable VEX statements (only affected/under_investigation); no amendment to write");
 	const appliedBy = documentIdentity(graph, idx);
+	const name = appliedBy.identifier && appliedBy.identifier !== DEFAULT_APPLIED_BY ? `SPDX VEX statements from ${appliedBy.identifier}` : "SPDX VEX statements";
+	await chainOverrides(overrides);
 	return {
-		name: appliedBy.identifier && appliedBy.identifier !== DEFAULT_APPLIED_BY ? `SPDX VEX statements from ${appliedBy.identifier}` : "SPDX VEX statements",
+		name,
 		description: "Imported SPDX 3.0.1 security-profile VEX statements",
 		overrides,
 		appliedBy,
@@ -15965,7 +16343,7 @@ function isCvssType(type) {
 const GO_ZERO_TIME$1 = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 const CVE_ID_PATTERN$2 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$2 = /^Products:\s*(.+)$/m;
-const DEFAULT_PRODUCT_ID$2 = "HDFPID-0001";
+const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
 /** Map an HDF Cvss block to a CSAF score entry (cvss_v2/v3/v4 by version). */
 function buildCsafScore(cvss, products) {
 	const inner = {
@@ -16000,8 +16378,8 @@ function convertHdfToCsafVex(input, converterVersion) {
 	const doc = buildDocument(amendments, converterVersion);
 	doc.vulnerabilities = vulnerabilities;
 	doc.product_tree.full_product_names = names.length > 0 ? names : [{
-		name: DEFAULT_PRODUCT_ID$2,
-		product_id: DEFAULT_PRODUCT_ID$2
+		name: DEFAULT_PRODUCT_ID$1,
+		product_id: DEFAULT_PRODUCT_ID$1
 	}];
 	return JSON.stringify(doc, null, 2);
 }
@@ -16054,8 +16432,8 @@ function productEntriesFor(o) {
 		}));
 	}
 	return [{
-		name: DEFAULT_PRODUCT_ID$2,
-		product_id: DEFAULT_PRODUCT_ID$2
+		name: DEFAULT_PRODUCT_ID$1,
+		product_id: DEFAULT_PRODUCT_ID$1
 	}];
 }
 /** product_tree entries for the synthesized fixed-version products. */
@@ -16094,18 +16472,36 @@ function productIDsFor$1(o) {
 		const parts = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 		if (parts.length > 0) return parts;
 	}
-	return [DEFAULT_PRODUCT_ID$2];
+	return [DEFAULT_PRODUCT_ID$1];
 }
 function stripProductsLine$1(reason) {
 	return reason.replace(PRODUCTS_LINE$2, "").replace(/\n+$/, "");
 }
 /**
+* Fill CSAF references[].summary, which is required with minLength 1 while the
+* HDF description backing it is optional. The URL is the documented fallback:
+* the only text a reference always carries, where a placeholder would assert a
+* description the source never gave.
+*/
+function referenceSummary(description, url) {
+	return firstNonEmpty(description, url);
+}
+/**
+* The override reason with the machine-written 'Products:' line removed, or ''
+* when no prose remains. Both sinks it feeds — threats[].details and
+* notes[].text — are minLength 1 in CSAF, so an empty result means the element
+* is omitted, never emitted blank.
+*/
+function reasonProse(reason) {
+	return firstNonEmpty(stripProductsLine$1(reason ?? ""));
+}
+/**
 * Surface the override reason prose as a CSAF description note. Used on the
 * not_affected/fixed paths, which otherwise drop reason (the affected path
 * keeps it as threats[impact]).
 */
 function appendReasonNote(v, reason) {
-	const text = stripProductsLine$1(reason ?? "");
+	const text = reasonProse(reason);
 	if (!text) return;
 	v.notes = v.notes ?? [];
 	v.notes.push({
@@ -16182,11 +16578,12 @@ function buildVulnerability(group) {
 			emitted = true;
 		} else if (canonical === VexStatus.Affected) {
 			status.known_affected = (status.known_affected ?? []).concat(pids);
-			if (o.reason) {
+			const details = reasonProse(o.reason);
+			if (details) {
 				v.threats = v.threats ?? [];
 				v.threats.push({
 					category: "impact",
-					details: stripProductsLine$1(o.reason),
+					details,
 					product_ids: pids
 				});
 			}
@@ -16208,7 +16605,7 @@ function buildVulnerability(group) {
 			v.references = v.references ?? [];
 			v.references.push({
 				category: "external",
-				summary: e.description ?? "",
+				summary: referenceSummary(e.description, e.data),
 				url: e.data
 			});
 		}
@@ -16217,7 +16614,7 @@ function buildVulnerability(group) {
 			v.references = v.references ?? [];
 			v.references.push({
 				category: "external",
-				summary: r.description ?? "",
+				summary: referenceSummary(r.description, r.href),
 				url: r.href
 			});
 		}
@@ -16239,7 +16636,7 @@ function buildVulnerability(group) {
 	return {
 		cve: v.cve,
 		...v.notes && { notes: v.notes },
-		product_status: status,
+		...Object.keys(status).length > 0 && { product_status: status },
 		...v.flags && { flags: v.flags },
 		...v.threats && { threats: v.threats },
 		...v.remediations && { remediations: v.remediations },
@@ -16319,7 +16716,6 @@ const CVE_ID_PATTERN$1 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$1 = /^Products:\s*(.+)$/m;
 const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 const OPENVEX_NAMESPACE = "https://openvex.dev/docs/public/";
-const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
 async function convertHdfToOpenVex(input, converterVersion) {
 	validateInputSize(input, "hdf-to-openvex");
 	const amendments = parseHdf(input);
@@ -16361,19 +16757,12 @@ function overrideToStatement(o, docAuthor) {
 	if (o.type === OverrideType.Poam && canonical === VexStatus.Affected && allMilestonesCompleted$1(o)) canonical = VexStatus.Fixed;
 	const notAffected = canonical === VexStatus.NotAffected;
 	const justification = notAffected && o.justification ? String(o.justification) : "";
-	const reason = stripProductsLine(o.reason ?? "");
-	const impact = notAffected ? reason : "";
+	const reason = firstNonEmpty(stripProductsLine(o.reason ?? ""));
+	const impact = notAffected ? firstNonEmpty(reason, justification ? "" : noImpactRationaleRecorded(o)) : "";
 	let action = "";
-	let reasonEmitted = notAffected && impact !== "";
-	if (canonical === VexStatus.Fixed) action = firstMilestoneAction(o) || "Fix applied; consumer re-scan confirmed clean.";
-	else if (canonical === VexStatus.Affected) {
-		action = firstMilestoneAction(o);
-		if (!action) {
-			action = reason;
-			reasonEmitted = reason !== "";
-		}
-	}
-	const statusNotes = buildStatusNotes(o, reason, reasonEmitted, docAuthor);
+	if (canonical === VexStatus.Fixed) action = firstNonEmpty(firstMilestoneAction(o), "Fix applied; consumer re-scan confirmed clean.");
+	else if (canonical === VexStatus.Affected) action = firstNonEmpty(firstMilestoneAction(o), reason, noRemediationRecorded(o));
+	const statusNotes = buildStatusNotes(o, reason, reason !== "" && (impact === reason || action === reason), docAuthor);
 	return {
 		vulnerability: {
 			"@id": `https://nvd.nist.gov/vuln/detail/${o.requirementId}`,
@@ -16420,12 +16809,26 @@ function productsFor(o) {
 		const m = PRODUCTS_LINE$1.exec(o.reason ?? "");
 		if (m && m[1]) ids = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 	}
-	if (ids.length === 0) ids = [DEFAULT_PRODUCT_ID$1];
+	if (ids.length === 0) return void 0;
 	return ids.map((id) => ({ "@id": id }));
 }
+/**
+* States the absence OpenVEX has no other way to express: action_statement is
+* required on an affected statement, and a source override may carry neither a
+* milestone nor a reason to fill it.
+*/
+function noRemediationRecorded(o) {
+	return `No remediation action was recorded for the ${String(o.type)} override applied to ${o.requirementId}.`;
+}
+/**
+* The not_affected peer of noRemediationRecorded, for an override carrying
+* neither a justification enum nor a reason.
+*/
+function noImpactRationaleRecorded(o) {
+	return `No impact rationale was recorded for the ${String(o.type)} override applied to ${o.requirementId}.`;
+}
 function firstMilestoneAction(o) {
-	for (const m of o.milestones ?? []) if (m.description) return m.description;
-	return "";
+	return firstNonEmpty(...(o.milestones ?? []).map((m) => m.description));
 }
 function allMilestonesCompleted$1(o) {
 	if (!o.milestones || o.milestones.length === 0) return false;
@@ -16914,6 +17317,7 @@ async function convertOscalPoamToHdf(input) {
 	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
 	const systemRef = poam["import-ssp"]?.href || void 0;
 	const appliedBy = extractAppliedBy(poam.metadata);
+	await chainOverrides(overrides);
 	return serializeHdf({
 		name: toKebabCase(poam.metadata.title, "oscal-poam"),
 		overrides,