@mitre/hdf-converters 3.6.0-rc.2 → 3.6.0-rc.4

package/dist/index.js

@@ -1,8 +1,150 @@
 import { n as detectFormat, r as detectConverter, t as registerAllFingerprints } from "./register-all-CDfYvwQF.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, worstStatus } from "@mitre/hdf-utilities";
-import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, createDescription, createMinimalBaseline, createRequirement, createResult, severityToImpact as severityToImpact$1 } from "@mitre/hdf-schema";
+import { DEFAULT_MAX_INPUT_SIZE, buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
+import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+//#region ../hdf-validators/dist/index.js
+/**
+* Create and configure Ajv instance with all HDF schemas
+*/
+function createValidator() {
+	const ajv = new Ajv({
+		allErrors: true,
+		verbose: true,
+		strict: false,
+		validateFormats: true,
+		validateSchema: false
+	});
+	addFormats(ajv);
+	const registeredDateTime = ajv.formats["date-time"];
+	ajv.addFormat("date-time", {
+		type: "string",
+		validate: (v) => /^\d{4}-\d{2}-\d{2}[Tt]/.test(v) && registeredDateTime.validate(v)
+	});
+	ajv.addSchema(commonSchema);
+	ajv.addSchema(platformSchema);
+	ajv.addSchema(resultSchema);
+	ajv.addSchema(runnerSchema);
+	ajv.addSchema(statisticsSchema);
+	ajv.addSchema(targetSchema);
+	ajv.addSchema(parameterSchema);
+	ajv.addSchema(cvssSchema);
+	ajv.addSchema(epssSchema);
+	ajv.addSchema(kevSchema);
+	ajv.addSchema(affectedPackageSchema);
+	ajv.addSchema(bomSchema);
+	ajv.addSchema(amendmentsSchema);
+	ajv.addSchema(extensionsSchema);
+	ajv.addSchema(systemSchema);
+	ajv.addSchema(planSchema);
+	ajv.addSchema(comparisonSchema);
+	ajv.addSchema(eventsSchema);
+	ajv.addSchema(componentSchema);
+	ajv.addSchema(dataFlowSchema);
+	ajv.addSchema(hdfResultsSchema);
+	ajv.addSchema(hdfBaselineSchema);
+	ajv.addSchema(hdfComparisonSchema);
+	ajv.addSchema(hdfSystemSchema);
+	ajv.addSchema(hdfPlanSchema);
+	ajv.addSchema(hdfAmendmentsSchema);
+	ajv.addSchema(hdfRequirementChangeEventSchema);
+	ajv.addSchema(hdfEvidencePackageSchema);
+	return ajv;
+}
+const ajv = createValidator();
+let resultsValidator = null;
+function getResultsValidator() {
+	if (!resultsValidator) resultsValidator = ajv.compile(hdfResultsSchema);
+	return resultsValidator;
+}
+/**
+* Convert Ajv errors to ValidationError format
+*/
+function formatErrors(errors) {
+	if (!errors || errors.length === 0) return [];
+	return errors.map((err) => {
+		let field = err.instancePath.replace(/^\//, "").replace(/\//g, ".");
+		if (!field && err.schemaPath) {
+			const pathParts = err.schemaPath.split("/");
+			field = pathParts[pathParts.length - 1] || "(root)";
+		}
+		let message = err.message || "validation failed";
+		if (err.params) {
+			if ("missingProperty" in err.params) {
+				field = field ? `${field}.${err.params.missingProperty}` : err.params.missingProperty;
+				message = "is required";
+			} else if ("additionalProperty" in err.params) {
+				field = field ? `${field}.${err.params.additionalProperty}` : err.params.additionalProperty;
+				message = "is not allowed";
+			} else if ("limit" in err.params) message = `${message} (limit: ${err.params.limit})`;
+		}
+		return {
+			field: field || "(root)",
+			keyword: err.keyword,
+			...err.keyword === "format" && err.params && "format" in err.params ? { format: String(err.params.format) } : {},
+			message,
+			value: err.data
+		};
+	});
+}
+/**
+* Create ValidationResult from validator output
+*/
+function createResult$1(validator, data) {
+	const valid = validator(data);
+	const errors = formatErrors(validator.errors);
+	return {
+		valid: valid === true,
+		errors,
+		getErrorMessage() {
+			if (this.valid) return "";
+			return this.errors.map((e) => {
+				if (e.field === "(root)") return e.message;
+				return `${e.field}: ${e.message}`;
+			}).join("; ");
+		}
+	};
+}
+/**
+* Validate HDF Results document against schema
+*/
+function validateResults(data) {
+	return createResult$1(getResultsValidator(), data);
+}
+//#endregion
+//#region shared/typescript/amendmentchain.ts
+/**
+* Stamps `previousChecksum` across amendment overrides in document order,
+* linking each to the one before it and leaving the first unlinked.
+*
+* Every route that authors amendments calls this, so whether a document carries
+* tamper-evidence does not depend on which one wrote it. The checksum is the
+* canonical JSON form shared with the Go converters and with `hdf amend verify`,
+* so a chain written here verifies everywhere.
+*
+* The override is put through serializeHdf first, so what gets hashed is the
+* shape the document will actually carry. The TS converters hold
+* `appliedAt`/`expiresAt` as `Date` objects, which stringify with a `.000`
+* fraction that trimmed-UTC HDF output never carries; hashing them raw would
+* make every TS-written chain disagree with its own serialized document, and
+* with Go.
+*
+* Mutates the array in place, mirroring the Go helper.
+*/
+async function chainOverrides(overrides) {
+	let previous;
+	for (const override of overrides) {
+		if (previous === void 0) delete override.previousChecksum;
+		else override.previousChecksum = previous;
+		previous = {
+			algorithm: HashAlgorithm.Sha256,
+			value: await sha256(canonicalJson(JSON.parse(serializeHdf(override, 0))))
+		};
+	}
+}
+//#endregion
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -145,7 +287,7 @@ function mapCWEToNIST(cweIDs, fallback) {
 	}
 	return controls.size > 0 ? [...controls].sort() : fallback;
 }
-/** Matches CWE identifiers like "CWE-79", "CWE 89", "cwe22". */
+/** Matches CWE identifiers like "CWE-79", "CWE 89", "cwe22"; group 1 is the number. */
 const CWE_PATTERN$1 = /CWE[- ]?(\d+)/gi;
 /**
 * Extract all numeric CWE IDs from text.
@@ -161,23 +303,44 @@ function extractCWEIDs(text) {
 	ids.sort();
 	return ids;
 }
-/** Default maximum input size for converters (50MB) */
-const DEFAULT_MAX_INPUT_SIZE = 50 * 1024 * 1024;
 /**
-* Validates that input string doesn't exceed maximum allowed size.
-*
-* Note: string.length gives char count, not bytes. For multi-byte chars this
-* underestimates. This is acceptable as a coarse safety check — exact byte
-* counting would require TextEncoder.
-*
-* @param input - Raw input string to validate
-* @param converterName - Name of the converter (used in error message)
-* @param maxSize - Maximum allowed character count (defaults to DEFAULT_MAX_INPUT_SIZE)
-* @throws Error if input exceeds maxSize
+* Return the first candidate whose content is not empty or whitespace-only,
+* as-is (the emptiness test trims, the returned value does not). Returns '' when
+* every candidate is empty or whitespace. The caller supplies its own documented
+* fallback as the last candidate so the substituted value is meaningful per
+* field — this helper never invents a placeholder like "N/A". Use it where a
+* target schema requires a non-empty (often minLength:1) string and a source
+* value may be absent; it is a selection helper, not a normalizer, and never
+* decides to OMIT a field (that stays the caller's call). Go parity: FirstNonEmpty.
+*/
+function firstNonEmpty(...candidates) {
+	for (const c of candidates) if (c != null && c.trim() !== "") return c;
+	return "";
+}
+/**
+* The converter-facing face of the @mitre/hdf-utilities size guard: same
+* limit, same UTF-8 byte-length measure as Go's ValidateJSONSize, with the
+* converter name prefixed onto the error. A non-positive maxSize means "use
+* the default" (an explicitly-passed 0 never rejects all non-empty input).
+*/
+function validateInputSize$1(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZE) {
+	const limit = maxSize > 0 ? maxSize : DEFAULT_MAX_INPUT_SIZE;
+	try {
+		validateInputSize(input, limit);
+	} catch (err) {
+		throw new Error(`${converterName}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/** The schema's Severity enum keyed by its lowercase token. */
+const HDF_SEVERITIES = new Map(Object.values(Severity).map((s) => [s, s]));
+/**
+* Map a raw severity token onto the schema's Severity enum, case-insensitively.
+* The one place the enum vocabulary is spelled out for converters that must not
+* cast an off-vocabulary source value into the typed field. Whitespace is not
+* trimmed; callers own that normalization. Go parity: shared.ParseSeverity.
 */
-function validateInputSize(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZE) {
-	if (maxSize <= 0) maxSize = DEFAULT_MAX_INPUT_SIZE;
-	if (input.length > maxSize) throw new Error(`${converterName}: input exceeds maximum allowed size of ${maxSize} characters`);
+function parseSeverity(s) {
+	return HDF_SEVERITIES.get(s.toLowerCase());
 }
 /**
 * Parse an HDF document. The single ingest point for every HDF-consuming
@@ -202,6 +365,15 @@ function requireHdfResults(input, converterName) {
 	return requireHdfStructure(input, converterName, "baselines");
 }
 /**
+* The HDF Amendments counterpart of requireHdfResults, keyed on the top-level
+* `overrides` array instead of `baselines`.
+*/
+function requireHdfAmendments(input, converterName) {
+	const r = requireHdfStructure(input, converterName, "overrides");
+	if (r.items.length === 0) throw new Error(`${converterName}: invalid HDF structure: missing overrides field`);
+	return r;
+}
+/**
 * Reject malformed HDF input (empty, oversized, non-JSON, top-level array/null,
 * or a missing/wrong-typed structural key) before a converter zero-fills it into
 * a typed document. A parsed JSON `null` (or array, or primitive) is NOT an HDF
@@ -210,12 +382,16 @@ function requireHdfResults(input, converterName) {
 */
 function requireHdfStructure(input, converterName, field) {
 	if (input.length === 0) throw new Error(`${converterName}: empty input`);
-	validateInputSize(input, converterName);
+	validateInputSize$1(input, converterName);
 	const parsed = parseHdf(input);
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`${converterName}: invalid HDF structure: missing ${field} field`);
 	const doc = parsed;
 	const items = doc[field];
 	if (!Array.isArray(items)) throw new Error(`${converterName}: invalid HDF structure: missing ${field} field`);
+	if (field === "baselines") {
+		const violations = typeViolations(validateResults(doc));
+		if (violations.length > 0) throw new Error(`${converterName}: input is not valid HDF: ${violations.slice(0, 5).join("; ")}`);
+	}
 	return {
 		doc,
 		items
@@ -298,7 +474,7 @@ function ecosystemFromPurlType(type) {
 *   - purl alone
 *   - cpe alone
 */
-function buildAffectedPackage$2(opts) {
+function buildAffectedPackage$1(opts) {
 	const pkg = {};
 	if (opts.purl) pkg.purl = opts.purl;
 	if (opts.cpe) pkg.cpe = opts.cpe;
@@ -484,6 +660,36 @@ function deriveVerificationMethod(code) {
 	if (code === void 0 || code === null || code === "") return void 0;
 	return VerificationMethodEnum.Automated;
 }
+/**
+* Renames the HDF severity bands into the OSCAL risk characterization facet
+* vocabulary (medium is 'moderate' there, informational is 'info'). Returns ''
+* for anything outside the HDF vocabulary so callers omit the facet rather than
+* emit a value OSCAL does not define. Go peer: shared.OSCALSeverityFromHDF.
+*/
+const OSCAL_SEVERITY_BY_HDF_BAND = {
+	critical: "critical",
+	high: "high",
+	medium: "moderate",
+	low: "low",
+	informational: "info"
+};
+function oscalSeverityFromHdf(severity) {
+	const band = (severity ?? "").toLowerCase();
+	return Object.prototype.hasOwnProperty.call(OSCAL_SEVERITY_BY_HDF_BAND, band) ? OSCAL_SEVERITY_BY_HDF_BAND[band] : "";
+}
+/**
+* The expiresAt an override takes when the source tool records no expiration:
+* one calendar year after appliedAt, computed in UTC. A calendar year (not 365
+* days) keeps the date on the same month/day across leap years, and doing the
+* rollover in UTC keeps the result off the host timezone. Go peer:
+* shared.DefaultOverrideExpiry.
+*/
+function defaultOverrideExpiry(appliedAt) {
+	const expiresAt = /* @__PURE__ */ new Date();
+	expiresAt.setTime(appliedAt.getTime());
+	expiresAt.setUTCFullYear(expiresAt.getUTCFullYear() + 1);
+	return expiresAt;
+}
 function buildNoFindingsRequirement(id, codeDesc, startTime) {
 	return {
 		id,
@@ -511,6 +717,24 @@ const UNRATED_SEVERITY_VALUE = "unrated";
 function markUnratedSeverity(tags, severity) {
 	if (isUnratedSeverity(severity)) tags[UNRATED_SEVERITY_TAG] = UNRATED_SEVERITY_VALUE;
 }
+/**
+* The schema violations Go's typed decode would also reject.
+*
+* encoding/json refuses exactly two things: a JSON value whose type does not fit
+* the target field, and a string that will not parse into a time.Time. Every
+* other schema rule — required, enum, minItems, uuid and uri formats — decodes
+* cleanly into the generated structs, so rejecting it here would put the two
+* languages back out of step in the opposite direction.
+*
+* null is exempt for the same reason. Go unmarshals a JSON null into a slice,
+* map or pointer as nil and into anything else as a no-op, never as an error, so
+* a null cvss entry or a null results array reaches the converter there and must
+* reach it here too — several parity goldens pin exactly that.
+*/
+function typeViolations(result) {
+	if (result.valid) return [];
+	return (result.errors ?? []).filter((e) => e.value !== null).filter((e) => e.keyword === "type" || e.keyword === "format" && e.format === "date-time").map((e) => `${e.field ?? ""} ${e.message ?? ""}`.trim());
+}
 //#endregion
 //#region converters/legacyhdf-to-hdf/typescript/converter.ts
 /**
@@ -523,22 +747,13 @@ function markUnratedSeverity(tags, severity) {
 * - Results: snake_case → camelCase for all fields
 * - Overlay flattening: merge overlay/wrapper baselines so every requirement has results
 */
-/** Valid severity values per HDF v2.0 schema (matches the Go converter). */
-const VALID_SEVERITIES$1 = /* @__PURE__ */ new Set([
-	"critical",
-	"high",
-	"medium",
-	"low",
-	"informational"
-]);
 /**
 * Convert tags.severity string to a valid severity value.
 * Returns null if the value is not a recognized severity.
 */
 function tagSeverityToSeverity(tagSeverity) {
 	if (typeof tagSeverity !== "string") return null;
-	const normalized = tagSeverity.toLowerCase().trim();
-	return VALID_SEVERITIES$1.has(normalized) ? normalized : null;
+	return parseSeverity(tagSeverity.trim()) ?? null;
 }
 /**
 * Normalize status values from v1.0 to v2.0 format.
@@ -856,7 +1071,7 @@ function documentTimestamp(v1Data) {
 	return latest ? formatTimestamp(latest) : void 0;
 }
 function convertLegacyHdf(v1Data, converterVersion = "1.0.0") {
-	validateInputSize(JSON.stringify(v1Data), "legacyhdf-to-hdf");
+	validateInputSize$1(JSON.stringify(v1Data), "legacyhdf-to-hdf");
 	const v2 = {
 		baselines: (v1Data.profiles || []).map(convertProfile),
 		statistics: v1Data.statistics || {}
@@ -1327,7 +1542,7 @@ function buildBaseline$1(name, findings, resultsChecksum) {
 /** Converts an ASFF document to HDF Results JSON. */
 async function convertAsffToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("asff: empty input");
-	validateInputSize(input, "asff");
+	validateInputSize$1(input, "asff");
 	const findings = parseFindings$1(input);
 	const resultsChecksum = await inputChecksum(input);
 	const order = [];
@@ -1376,7 +1591,7 @@ const SARIF_ALIASES = {
 	note: .3
 };
 async function convertSarifToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "sarif");
+	validateInputSize$1(input, "sarif");
 	const resultsChecksum = await inputChecksum(input);
 	const sarif = parseJSON(input);
 	if (!sarif || typeof sarif !== "object") throw new Error("Invalid SARIF structure: not a valid JSON object");
@@ -1514,7 +1729,7 @@ function packageFromSarifProperties(props) {
 	if (props.purl) ecosystem = ecosystemFromPurlType(parsePurl(props.purl)?.type);
 	else if (props.ecosystem) ecosystem = ecosystemFromPurlType(props.ecosystem);
 	else if (name && version) ecosystem = Ecosystem.Generic;
-	return buildAffectedPackage$2({
+	return buildAffectedPackage$1({
 		name,
 		version,
 		ecosystem,
@@ -1650,9 +1865,7 @@ function buildSuppressionOverride(result, timestamp) {
 	const isFalsePositive = accepted.some((s) => justificationIndicatesFalsePositive(s.justification));
 	const type = isFalsePositive ? OverrideType.FalsePositive : OverrideType.Waiver;
 	const effective = isFalsePositive ? ResultStatus.NotApplicable : ResultStatus.Passed;
-	const expiresAt = /* @__PURE__ */ new Date();
-	expiresAt.setTime(timestamp.getTime());
-	expiresAt.setUTCFullYear(expiresAt.getUTCFullYear() + 1);
+	const expiresAt = defaultOverrideExpiry(timestamp);
 	return {
 		override: {
 			type,
@@ -1725,11 +1938,10 @@ function buildTags$4(result, rule, resolvedLevel, cweIds, nistControls, cciContr
 function extractSourceLocation$1(location) {
 	const uri = location.physicalLocation?.artifactLocation?.uri;
 	const line = location.physicalLocation?.region?.startLine;
-	if (!uri || !line) return;
-	return {
-		ref: uri,
-		line
-	};
+	const sourceLocation = {};
+	if (uri) sourceLocation.ref = uri;
+	if (line) sourceLocation.line = line;
+	return sourceLocation.ref !== void 0 || sourceLocation.line !== void 0 ? sourceLocation : void 0;
 }
 function createHDFResult(location, status, backtrace, suppressionMessage) {
 	const uri = location.physicalLocation?.artifactLocation?.uri || "";
@@ -1769,7 +1981,7 @@ const ARRAY_TAGS$2 = [
 */
 async function convertJunitToHdf(input, converterVersion = "1.0.0") {
 	if (!input || !input.trim()) throw new Error("Empty input");
-	validateInputSize(input, "junit");
+	validateInputSize$1(input, "junit");
 	const { suites, name } = parseJUnitXML(input);
 	const scanTime = resolveScanTime(suites);
 	const requirements = buildRequirements(suites, scanTime);
@@ -1790,7 +2002,7 @@ function hostComponents(suites) {
 	const hosts = [];
 	const seen = /* @__PURE__ */ new Set();
 	for (const suite of suites) {
-		const hostname = suite.hostname?.trim();
+		const hostname = suite["@_hostname"]?.trim();
 		if (!hostname || seen.has(hostname)) continue;
 		seen.add(hostname);
 		hosts.push({
@@ -1802,22 +2014,31 @@ function hostComponents(suites) {
 	return hosts;
 }
 function resolveScanTime(suites) {
-	for (const suite of suites) if (suite.timestamp) {
-		const parsed = parseTimestamp(suite.timestamp);
+	for (const suite of suites) if (suite["@_timestamp"]) {
+		const parsed = parseTimestamp(suite["@_timestamp"]);
 		if (parsed) return parsed;
 	}
 	return /* @__PURE__ */ new Date();
 }
 function parseJUnitXML(input) {
-	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2);
-	if (parsed.testsuites) return {
-		suites: parsed.testsuites.testsuite ?? [],
-		name: parsed.testsuites.name ? decodeXmlEntities$6(parsed.testsuites.name) : "JUnit Test Results"
-	};
+	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2, { attributeNamePrefix: "@_" });
+	if (parsed.testsuites) {
+		const suites = [...parsed.testsuites.testsuite ?? []];
+		const name = parsed.testsuites["@_name"] ? decodeXmlEntities$6(parsed.testsuites["@_name"]) : "JUnit Test Results";
+		const looseCases = parsed.testsuites.testcase ?? [];
+		if (looseCases.length > 0) suites.push({
+			"@_name": name,
+			testcase: looseCases
+		});
+		return {
+			suites,
+			name
+		};
+	}
 	if (parsed.testsuite) {
 		const suite = parsed.testsuite;
 		const suites = Array.isArray(suite) ? suite : [suite];
-		const suiteName = suites[0]?.name;
+		const suiteName = suites[0]?.["@_name"];
 		return {
 			suites,
 			name: suiteName ? decodeXmlEntities$6(suiteName) : "JUnit Test Results"
@@ -1848,14 +2069,14 @@ function testCaseToRequirement(tc, scanTime) {
 		startTime: scanTime
 	};
 	if (message !== void 0) result.message = message;
-	if (tc.time) {
-		const parsed = parseFloat(tc.time);
+	if (tc["@_time"]) {
+		const parsed = parseFloat(tc["@_time"]);
 		if (!isNaN(parsed)) result.runTime = parsed;
 	}
-	const name = decodeXmlEntities$6(tc.name);
+	const name = decodeXmlEntities$6(tc["@_name"]);
 	const descriptions = [{
 		label: "default",
-		data: `JUnit test: ${name} in ${tc.classname ? decodeXmlEntities$6(tc.classname) : "unknown"}`
+		data: `JUnit test: ${name} in ${tc["@_classname"] ? decodeXmlEntities$6(tc["@_classname"]) : "unknown"}`
 	}];
 	const { systemOut, systemErr } = collectSystemStreams(tc);
 	if (systemOut) descriptions.push({
@@ -1894,19 +2115,19 @@ function collectSystemStreams(tc) {
 	};
 }
 function buildID(tc) {
-	if (tc.classname) return `${decodeXmlEntities$6(tc.classname)}.${decodeXmlEntities$6(tc.name)}`;
-	return decodeXmlEntities$6(tc.name);
+	if (tc["@_classname"]) return `${decodeXmlEntities$6(tc["@_classname"])}.${decodeXmlEntities$6(tc["@_name"])}`;
+	return decodeXmlEntities$6(tc["@_name"]);
 }
 function resolveStatus(tc) {
 	if (tc.failure) {
-		const msg = buildFailureMessage(tc.failure.message ?? "", tc.failure.type ?? "", tc.failure["#text"] ?? "");
+		const msg = buildFailureMessage(tc.failure["@_message"] ?? "", tc.failure["@_type"] ?? "", tc.failure["#text"] ?? "");
 		return {
 			status: ResultStatus.Failed,
 			message: msg
 		};
 	}
 	if (tc.error) {
-		const msg = buildFailureMessage(tc.error.message ?? "", tc.error.type ?? "", tc.error["#text"] ?? "");
+		const msg = buildFailureMessage(tc.error["@_message"] ?? "", tc.error["@_type"] ?? "", tc.error["#text"] ?? "");
 		return {
 			status: ResultStatus.Error,
 			message: msg
@@ -1914,9 +2135,9 @@ function resolveStatus(tc) {
 	}
 	if (tc.skipped !== void 0) {
 		const skipped = typeof tc.skipped === "object" ? tc.skipped : null;
-		if (skipped?.message) return {
+		if (skipped?.["@_message"]) return {
 			status: ResultStatus.NotReviewed,
-			message: `Skipped: ${decodeXmlEntities$6(skipped.message)}`
+			message: `Skipped: ${decodeXmlEntities$6(skipped["@_message"])}`
 		};
 		return {
 			status: ResultStatus.NotReviewed,
@@ -1933,12 +2154,12 @@ function buildFailureMessage(message, typeName, body) {
 	return result;
 }
 function buildCodeDesc$10(tc) {
-	if (tc.classname) return `${decodeXmlEntities$6(tc.classname)} :: ${decodeXmlEntities$6(tc.name)}`;
-	return decodeXmlEntities$6(tc.name);
+	if (tc["@_classname"]) return `${decodeXmlEntities$6(tc["@_classname"])} :: ${decodeXmlEntities$6(tc["@_name"])}`;
+	return decodeXmlEntities$6(tc["@_name"]);
 }
 function noFindingsTarget(baselineName, suites) {
 	if (baselineName && baselineName !== "JUnit Test Results") return baselineName;
-	for (const s of suites) if (s.name) return decodeXmlEntities$6(s.name);
+	for (const s of suites) if (s["@_name"]) return decodeXmlEntities$6(s["@_name"]);
 	return "JUnit test suite";
 }
 //#endregion
@@ -2036,7 +2257,7 @@ function parseCpeVersion(testSystem) {
 }
 async function convertXccdfResultsToHdf(input, converterVersion = "1.0.0") {
 	if (!input || !input.trim()) throw new Error("Empty input");
-	validateInputSize(input, "xccdf-results");
+	validateInputSize$1(input, "xccdf-results");
 	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$1, { trimValues: false });
 	const arfParsed = parsed;
 	if (arfParsed["asset-report-collection"]) return convertArfCollection(arfParsed["asset-report-collection"], input, converterVersion);
@@ -2960,13 +3181,6 @@ function cklbTitle(cl) {
 //#endregion
 //#region shared/typescript/checklist/to-hdf.ts
 const CONVERTER_VERSION = "1.0.0";
-const VALID_SEVERITIES = /* @__PURE__ */ new Set([
-	"critical",
-	"high",
-	"medium",
-	"low",
-	"informational"
-]);
 /**
 * Map the format-neutral Checklist model to an HDF Results object.
 * controlType is derived per-Vuln from CCI->NIST; verificationMethod and
@@ -3038,7 +3252,8 @@ function vulnToRequirement(v, scanTime) {
 	if (v.legacyIDs && v.legacyIDs.length) tags["legacy_ids"] = v.legacyIDs;
 	if (v.extra && Object.keys(v.extra).length > 0) tags["cklMetadata"] = { ...v.extra };
 	const req = createRequirement(v.vulnNum, v.ruleTitle ?? v.vulnNum, descriptions, impact, [result], { tags });
-	if (VALID_SEVERITIES.has(severity)) req.severity = severity;
+	const hdfSeverity = parseSeverity(severity);
+	if (hdfSeverity !== void 0) req.severity = hdfSeverity;
 	const controlType = deriveControlTypeFromTags(nistTags);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
@@ -3105,9 +3320,9 @@ function stamp(v) {
 /** Maps a requirement onto the canonical effective-status input shape. */
 function requirementStatusInput(req) {
 	return {
-		impact: req.impact,
-		resultStatuses: (req.results ?? []).map((r) => String(r.status)),
-		overrides: (req.statusOverrides ?? []).map((o) => ({
+		impact: req.impact ?? 0,
+		resultStatuses: (req.results ?? []).filter((r) => r != null).map((r) => String(r.status)),
+		overrides: (req.statusOverrides ?? []).filter((o) => o != null).map((o) => ({
 			status: o.status ? String(o.status) : void 0,
 			appliedAt: stamp(o.appliedAt),
 			expiresAt: stamp(o.expiresAt)
@@ -3127,8 +3342,8 @@ function requirementEffectiveStatus(req) {
 * fields are synthesized best-effort so any HDF yields a valid checklist.
 */
 function hdfToChecklist(input) {
-	const hdf = parseHdf(input);
-	if (!hdf || !Array.isArray(hdf.baselines) || hdf.baselines.length === 0) throw new Error("hdf to checklist: HDF has no baselines");
+	const hdf = requireHdfResults(input, "hdf to checklist").doc;
+	if (hdf.baselines.length === 0) throw new Error("hdf to checklist: HDF has no baselines");
 	const ext = hdf.extensions ?? {};
 	const format = strVal(ext, "checklistFormat") || "ckl";
 	const cklbVersion = strVal(ext, "cklbVersion");
@@ -3255,7 +3470,7 @@ function formatOverride(o) {
 }
 function overrideSeverity(req) {
 	for (const o of req.statusOverrides ?? []) if (o.impact) return {
-		severity: qualSeverityFromImpact(o.impact.value),
+		severity: cklSeverityFromImpact(o.impact.value) || "low",
 		justification: o.reason ?? ""
 	};
 	return {
@@ -3263,20 +3478,20 @@ function overrideSeverity(req) {
 		justification: ""
 	};
 }
-function qualSeverityFromImpact(impact) {
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "medium";
-	return "low";
+function cklSeverityFromImpact(impact) {
+	switch (impactToSeverity(impact)) {
+		case "critical":
+		case "high": return "high";
+		case "medium": return "medium";
+		case "low": return "low";
+		default: return "";
+	}
 }
 function resolveSeverity(req, tags) {
 	const tagSev = strVal(tags, "severity");
 	if (tagSev) return tagSev;
 	if (req.severity) return String(req.severity).toLowerCase();
-	const i = req.impact ?? 0;
-	if (i >= .7) return "high";
-	if (i >= .4) return "medium";
-	if (i > 0) return "low";
-	return "";
+	return cklSeverityFromImpact(req.impact ?? 0);
 }
 function resolveCcis(tags) {
 	const direct = strSlice(tags, "cci");
@@ -3326,7 +3541,7 @@ function strSlice(m, key) {
 * skill Step 4d).
 */
 async function convertCklToHdf(input) {
-	validateInputSize(input, "ckl-to-hdf");
+	validateInputSize$1(input, "ckl-to-hdf");
 	const resultsChecksum = await inputChecksum(input);
 	const checklist = parseCkl(input);
 	return JSON.stringify(checklistToHdf(checklist, resultsChecksum, "ckl-to-hdf"), null, 2);
@@ -3343,7 +3558,7 @@ async function convertCklToHdf(input) {
 * skill Step 4d).
 */
 async function convertCklbToHdf(input) {
-	validateInputSize(input, "cklb-to-hdf");
+	validateInputSize$1(input, "cklb-to-hdf");
 	const resultsChecksum = await inputChecksum(input);
 	const checklist = parseCklb(input);
 	return JSON.stringify(checklistToHdf(checklist, resultsChecksum, "cklb-to-hdf"), null, 2);
@@ -3572,7 +3787,7 @@ function buildRequirement$18(query, startTime) {
 * @returns HDF JSON string
 */
 async function convertKicsToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "kics");
+	validateInputSize$1(input, "kics");
 	if (!input || input.trim().length === 0) throw new Error("kics: empty input");
 	const report = parseJSON(input);
 	if (!Array.isArray(report.queries) || typeof report.kics_version !== "string") throw new Error("kics: input does not look like a KICS report");
@@ -3635,10 +3850,11 @@ function lineOf(position) {
 }
 /**
 * Semgrep emits CWEs in prose form -- 'CWE-89: Improper Neutralization of ...'
-* -- while the mapping keys on the bare number.
+* -- while the mapping keys on the bare number. Read entry by entry so source
+* order is kept, matching the Go twin.
 */
 function extractCweIds(metadata) {
-	return normalizeToArray(metadata.cwe).map((entry) => /CWE-(\d+)/i.exec(entry)?.[1]).filter((id) => id !== void 0).map((id) => Number.parseInt(id, 10)).filter((id) => Number.isFinite(id));
+	return normalizeToArray(metadata.cwe).flatMap((entry) => extractCWEIDs(entry)).map((id) => Number.parseInt(id, 10)).filter((id) => Number.isFinite(id));
 }
 /**
 * The parsed CWE ids in the CWE-N catalog form the schema's cwe[] field asks
@@ -3658,6 +3874,15 @@ function impactFor(result) {
 	return severityToImpactWithAliases(severity, SEMGREP_SEVERITY_ALIASES, DEFAULT_IMPACT);
 }
 /**
+* Publishes the band the impact already implies, so the two fields cannot
+* disagree. An absent or redacted severity stays unset: the unrated tag is what
+* tells a consumer the 0.5 was a default, and a "medium" here would hide it.
+*/
+function severityFor(result) {
+	if (!isPresent(result.extra?.severity)) return;
+	return impactToSeverity(impactFor(result));
+}
+/**
 * Semgrep rule ids are dotted paths whose final segment is the rule name. The
 * JSON output carries no human-readable rule title anywhere -- unlike the SARIF
 * output, whose rule objects have `name` and `shortDescription` -- so one is
@@ -3794,6 +4019,8 @@ function buildRequirement$17(checkId, results, startTime) {
 		...refs.length > 0 ? { refs } : {},
 		...sourceLocation ? { sourceLocation } : {}
 	});
+	const severity = severityFor(representative);
+	if (severity !== void 0) requirement.severity = severity;
 	requirement.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags(tags.nist);
 	if (controlType !== void 0) requirement.controlType = controlType;
@@ -3870,7 +4097,7 @@ function buildCoverageRequirement(report, ruleCount, startTime) {
 * @returns HDF JSON string
 */
 async function convertSemgrepToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "semgrep");
+	validateInputSize$1(input, "semgrep");
 	if (!input || input.trim().length === 0) throw new Error("semgrep: empty input");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
@@ -4106,7 +4333,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const version = rep.version;
 	if (name && version) {
 		const ecosystem = ecosystemFromSnykPackageManager(packageManager);
-		const pkg = buildAffectedPackage$2({
+		const pkg = buildAffectedPackage$1({
 			name,
 			version,
 			ecosystem,
@@ -4153,7 +4380,7 @@ function convertSingleProject(report, resultsChecksum, scanTime) {
 */
 async function convertSnykToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("snyk: empty input");
-	validateInputSize(input, "snyk");
+	validateInputSize$1(input, "snyk");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
@@ -4261,31 +4488,27 @@ function buildCvssEntries$7(vuln) {
 }
 function mapGrypeTypeToEcosystem(grypeType) {
 	switch ((grypeType ?? "").toLowerCase()) {
-		case "rpm": return Ecosystem.RPM;
-		case "deb": return Ecosystem.Deb;
-		case "npm": return Ecosystem.Npm;
 		case "python": return Ecosystem.Pypi;
-		case "gem": return Ecosystem.Gem;
 		case "go-module": return Ecosystem.Go;
 		case "java-archive":
 		case "jenkins-plugin": return Ecosystem.Maven;
 		case "dotnet": return Ecosystem.Nuget;
 		case "rust-crate": return Ecosystem.Cargo;
-		default: return Ecosystem.Generic;
+		default: return ecosystemFromPurlType(grypeType);
 	}
 }
 function buildAffectedPackages(match) {
 	const artifact = match.artifact;
-	const pkg = {
+	const fix = match.vulnerability.fix;
+	const pkg = buildAffectedPackage$1({
 		name: artifact.name,
 		version: artifact.version,
-		ecosystem: mapGrypeTypeToEcosystem(artifact.type)
-	};
-	if (artifact.cpes && artifact.cpes.length > 0 && artifact.cpes[0]) pkg.cpe = artifact.cpes[0];
-	if (artifact.purl) pkg.purl = artifact.purl;
-	const fix = match.vulnerability.fix;
-	if (fix && fix.state === "fixed" && fix.versions && fix.versions.length > 0 && fix.versions[0]) pkg.fixedInVersion = fix.versions[0];
-	return [pkg];
+		ecosystem: mapGrypeTypeToEcosystem(artifact.type),
+		cpe: artifact.cpes?.[0],
+		purl: artifact.purl,
+		fixedInVersion: fix?.state === "fixed" ? fix.versions?.[0] : void 0
+	});
+	return pkg ? [pkg] : [];
 }
 const CWE_ID_PATTERN$2 = /^CWE-[1-9]\d*$/;
 function extractCwe(raw) {
@@ -4398,7 +4621,7 @@ function buildComponent$2(report, targetName) {
 	return component;
 }
 async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "grype");
+	validateInputSize$1(input, "grype");
 	const resultsChecksum = await inputChecksum(input);
 	const grypeData = parseJSON(input);
 	const requirements = [];
@@ -4472,9 +4695,7 @@ function buildWaiverOverride(ar) {
 	let reason = ar.decision_details || ar.name || "";
 	if (!reason) reason = "Risk accepted in DefectDojo";
 	const appliedAt = (ar.created ? parseTimestamp(ar.created) : null) ?? /* @__PURE__ */ new Date();
-	const oneYearOut = /* @__PURE__ */ new Date();
-	oneYearOut.setTime(appliedAt.getTime());
-	oneYearOut.setFullYear(oneYearOut.getFullYear() + 1);
+	const oneYearOut = defaultOverrideExpiry(appliedAt);
 	const expiresAt = (ar.expiration_date ? parseTimestamp(ar.expiration_date) : null) ?? oneYearOut;
 	return {
 		type: OverrideType.Waiver,
@@ -4506,9 +4727,7 @@ function falsePositiveReviewer(f) {
 function buildFalsePositiveOverride(f) {
 	const reason = f.mitigation || "Marked as false positive in DefectDojo";
 	const appliedAt = (f.mitigated ? parseTimestamp(f.mitigated) : null) ?? parseFindingDate(f.date) ?? /* @__PURE__ */ new Date();
-	const oneYearOut = /* @__PURE__ */ new Date();
-	oneYearOut.setTime(appliedAt.getTime());
-	oneYearOut.setUTCFullYear(oneYearOut.getUTCFullYear() + 1);
+	const oneYearOut = defaultOverrideExpiry(appliedAt);
 	return {
 		type: OverrideType.FalsePositive,
 		status: ResultStatus.NotApplicable,
@@ -4641,7 +4860,7 @@ function scannerName(f) {
 	return f.related_fields?.test?.test_type?.name || "DefectDojo";
 }
 async function convertDefectDojoToHdf(input, converterVersion = "0.1.0") {
-	validateInputSize(input, "defectdojo");
+	validateInputSize$1(input, "defectdojo");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseJSON(input);
 	const findings = Array.isArray(parsed) ? parsed : parsed.results ?? [];
@@ -4720,7 +4939,7 @@ function decodeEntitiesDeep(value) {
 * Convert Nessus XML scan results to HDF format
 */
 async function convertNessusToHdf(nessusXml, converterVersion = "1.0.0") {
-	validateInputSize(nessusXml, "nessus");
+	validateInputSize$1(nessusXml, "nessus");
 	const resultsChecksum = await inputChecksum(nessusXml);
 	const parsed = decodeEntitiesDeep(parseXmlWithArrays(nessusXml, [
 		"preference",
@@ -5181,7 +5400,7 @@ function foldNistControls(cweIds, owaspIds) {
 * @returns HDF JSON string
 */
 async function convertSonarqubeToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "sonarqube");
+	validateInputSize$1(input, "sonarqube");
 	const resultsChecksum = await inputChecksum(input);
 	const sonarData = parseJSON(input);
 	if (!sonarData || typeof sonarData !== "object") throw new Error("Invalid SonarQube structure: not a valid JSON object");
@@ -5519,7 +5738,7 @@ function buildRequirement$15(rule) {
 * @returns HDF JSON string
 */
 async function convertAwsConfigToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "aws-config");
+	validateInputSize$1(input, "aws-config");
 	const resultsChecksum = await inputChecksum(input);
 	const data = parseJSON(input);
 	if (!data || typeof data !== "object") throw new Error("Invalid AWS Config export: not a valid JSON object");
@@ -5657,7 +5876,7 @@ function parseInput(input) {
 * @returns HDF JSON string
 */
 async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "checkov");
+	validateInputSize$1(input, "checkov");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
@@ -5842,7 +6061,7 @@ function buildGosecExtensions(report) {
 * @returns HDF JSON string
 */
 async function convertGosecToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "gosec");
+	validateInputSize$1(input, "gosec");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
@@ -5916,7 +6135,7 @@ function convertVulnToRequirement(vuln) {
 	return req;
 }
 async function convertNiktoToHdf(input, converterVersion = "unknown") {
-	validateInputSize(input, "nikto");
+	validateInputSize$1(input, "nikto");
 	const resultsChecksum = await inputChecksum(input);
 	const niktoData = parseJSON(input);
 	const vulnGroups = /* @__PURE__ */ new Map();
@@ -6116,7 +6335,7 @@ function parseZapTimestamp(s) {
 	return parseTimestamp(s) ?? void 0;
 }
 async function convertZapToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "zap");
+	validateInputSize$1(input, "zap");
 	registerAllFingerprints();
 	const detected = detectConverter(input);
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
@@ -6655,7 +6874,7 @@ function buildBom(parts) {
 * oversized or undetectable input.
 */
 function parseBom(input) {
-	validateInputSize(input, CONVERTER);
+	validateInputSize$1(input, CONVERTER);
 	const obj = parseJSON(input);
 	const detected = detectFormat(obj);
 	if (!detected) throw new Error("bom-parser: could not detect a supported BOM format (expected CycloneDX or SPDX JSON)");
@@ -7273,9 +7492,7 @@ function analysisOverride(vuln, fallback) {
 		default: return;
 	}
 	const appliedAt = analysisAppliedAt(vuln, fallback);
-	const expiresAt = /* @__PURE__ */ new Date();
-	expiresAt.setTime(appliedAt.getTime());
-	expiresAt.setUTCFullYear(expiresAt.getUTCFullYear() + 1);
+	const expiresAt = defaultOverrideExpiry(appliedAt);
 	const override = {
 		type: disposition,
 		status: effectiveStatus,
@@ -7303,7 +7520,7 @@ function analysisOverride(vuln, fallback) {
 */
 async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("cyclonedx: empty input");
-	validateInputSize(input, "cyclonedx");
+	validateInputSize$1(input, "cyclonedx");
 	const bom = parseJSON(input);
 	if (!bom || typeof bom !== "object") throw new Error("cyclonedx: invalid JSON");
 	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx: missing or invalid bomFormat (expected "CycloneDX", got "${bom.bomFormat ?? "undefined"}")`);
@@ -7413,10 +7630,8 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 * @returns CSV string with sanitized output
 */
 function convertHdfToCsv(input) {
-	validateInputSize(input, "hdf-to-csv");
-	const hdf = parseHdf(input);
-	if (!hdf || typeof hdf !== "object" || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
-	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
+	const { doc: hdfDoc } = requireHdfResults(input, "hdf-to-csv");
+	const hdf = hdfDoc;
 	const rows = [];
 	const components = hdf.components || [];
 	const targetList = components.length > 0 ? components.map((t) => ({
@@ -7430,35 +7645,64 @@ function convertHdfToCsv(input) {
 		fqdn: "",
 		ipAddress: ""
 	}];
-	for (const baseline of hdf.baselines) for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
+	for (const baseline of hdf.baselines) {
+		if (!Array.isArray(baseline.requirements) || baseline.requirements.length === 0) throw new Error(`hdf-to-csv: baseline "${text(baseline.name)}" has no requirements`);
+		for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
+	}
 	return buildCsv(rows, { sanitize: true });
 }
 /**
+* A schema-required number as a number. Go decodes an absent one to the zero
+* value and cannot tell it apart from a real zero — impact 0 legitimately means
+* Not Applicable — so distinguishing them would need a schema validation pass
+* the converters deliberately do not do. Rendering 0 here matches what Go emits,
+* where reading .toFixed off an absent value threw a raw TypeError instead.
+*/
+function numeric(value) {
+	return typeof value === "number" ? value : 0;
+}
+/**
+* A schema-required string as text. Nested-invalid input reaches the converter
+* with these absent, and an absent value reached sanitizeCsvValue's String() as
+* the literal "undefined" — where Go, formatting a zero-value string, wrote
+* nothing. Every schema-required STRING cell goes through here; the numeric
+* ones go through numeric(), which serves the same purpose for a different type.
+*/
+function text(value) {
+	return typeof value === "string" ? value : "";
+}
+/** The requirement id as text; also names the requirement in the no-results error. */
+function requirementIdText$1(id) {
+	return text(id);
+}
+/**
 * Create a CSV row from baseline, requirement, and target data
 */
 function createRow(baseline, requirement, target) {
-	const description = requirement.descriptions.find((d) => d.label === "default")?.data || "";
+	const [firstResult] = Array.isArray(requirement.results) ? requirement.results : [];
+	if (!firstResult) throw new Error(`hdf-to-csv: requirement "${requirementIdText$1(requirement.id)}" has no results`);
+	if (!Array.isArray(requirement.descriptions) || requirement.descriptions.length === 0) throw new Error(`hdf-to-csv: requirement "${requirementIdText$1(requirement.id)}" has no descriptions`);
+	const description = descriptionByLabel(requirement, "default");
 	const check = descriptionByLabel(requirement, "check");
 	const fix = descriptionByLabel(requirement, "fix");
 	const rationale = descriptionByLabel(requirement, "rationale");
 	const code = requirement.code ?? "";
 	const references = flattenRefs(requirement.refs);
 	const severity = getSeverity(requirement);
-	const firstResult = requirement.results[0];
-	const status = firstResult?.status || "";
-	const message = firstResult?.message || "";
+	const status = firstResult.status;
+	const message = firstResult.message ?? "";
 	const nistControls = extractArrayFromTags(requirement.tags, "nist");
 	const cciControls = extractArrayFromTags(requirement.tags, "cci");
 	const effectiveStatus = requirementEffectiveStatus(requirement);
-	const effectiveImpact = (requirement.effectiveImpact ?? requirement.impact).toFixed(1);
+	const effectiveImpact = numeric(requirement.effectiveImpact ?? requirement.impact).toFixed(2);
 	const disposition = requirement.disposition ? String(requirement.disposition) : "";
 	return {
-		"Baseline ID": baseline.name,
+		"Baseline ID": text(baseline.name),
 		"Baseline Version": baseline.version || "",
 		"Baseline Title": baseline.title || "",
-		"Target ID": target.name,
-		"Target Type": target.type,
-		"Requirement ID": requirement.id,
+		"Target ID": text(target.name),
+		"Target Type": text(target.type),
+		"Requirement ID": requirementIdText$1(requirement.id),
 		"Requirement Title": requirement.title || "",
 		"Description": description,
 		"Check": check,
@@ -7467,8 +7711,8 @@ function createRow(baseline, requirement, target) {
 		"Code": code,
 		"References": references,
 		"Severity": severity,
-		"Impact": requirement.impact.toFixed(1),
-		"Status": String(status),
+		"Impact": numeric(requirement.impact).toFixed(2),
+		"Status": text(status),
 		"NIST Controls": nistControls,
 		"CCI Controls": cciControls,
 		"Control Type": requirement.controlType ?? "",
@@ -7482,8 +7726,8 @@ function createRow(baseline, requirement, target) {
 		"Applied By": joinOverrides(requirement.statusOverrides, (o) => o.appliedBy?.identifier ?? ""),
 		"Expires At": joinOverrides(requirement.statusOverrides, (o) => formatExpires(o.expiresAt)),
 		"CVSS": cvssScores(requirement.cvss),
-		"CWE": Array.isArray(requirement.cwe) ? requirement.cwe.join("; ") : "",
-		"EPSS": requirement.epss ? requirement.epss.score.toFixed(5) : "",
+		"CWE": (requirement.cwe ?? []).join("; "),
+		"EPSS": requirement.epss ? numeric(requirement.epss.score).toFixed(5) : "",
 		"KEV": requirement.kev ? requirement.kev.inKev ? "true" : "false" : "",
 		"Target FQDN": target.fqdn,
 		"Target IP": target.ipAddress
@@ -7497,6 +7741,7 @@ function joinOverrides(overrides, pick) {
 	if (!Array.isArray(overrides)) return "";
 	const out = [];
 	for (const o of overrides) {
+		if (o === null || o === void 0) continue;
 		const v = pick(o);
 		if (v) out.push(v);
 	}
@@ -7512,14 +7757,17 @@ function formatExpires(value) {
 }
 /**
 * Render each CVSS entry's score (computed when present, else base) to one
-* decimal, joined with '; ' to preserve multi-CVE findings.
+* decimal — the precision the CVSS spec defines and the source carries — joined
+* with '; ' to preserve multi-CVE findings. The Go peer rounds through a shared
+* helper matching toFixed, so a .x5 score renders the same digits in both.
 */
 function cvssScores(entries) {
 	if (!Array.isArray(entries)) return "";
 	const out = [];
 	for (const c of entries) {
+		if (c === null || c === void 0) continue;
 		const score = c.computedScore ?? c.baseScore;
-		if (score !== void 0) out.push(score.toFixed(1));
+		if (typeof score === "number") out.push(score.toFixed(1));
 	}
 	return out.join("; ");
 }
@@ -7531,13 +7779,10 @@ function getSeverity(requirement) {
 		if ("severity" in requirement.tags) {
 			const sev = requirement.tags.severity;
 			if (typeof sev === "string") return sev;
-			if (Array.isArray(sev) && sev.length > 0) return String(sev[0]);
+			if (Array.isArray(sev) && typeof sev[0] === "string") return sev[0];
 		}
 	}
-	const impact = requirement.impact;
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "medium";
-	return "low";
+	return impactToSeverity(requirement.impact);
 }
 /**
 * Extract array values from tags object and join with semicolons
@@ -7545,18 +7790,20 @@ function getSeverity(requirement) {
 function extractArrayFromTags(tags, key) {
 	if (!tags || typeof tags !== "object") return "";
 	const value = tags[key];
-	if (Array.isArray(value)) return value.map((v) => String(v)).join("; ");
+	if (Array.isArray(value)) return value.filter((v) => typeof v === "string").join("; ");
 	return "";
 }
 /**
 * Get the data of the first description matching a label. Empty when absent.
 */
 function descriptionByLabel(requirement, label) {
-	return requirement.descriptions.find((d) => d.label === label)?.data || "";
+	return requirement.descriptions.find((d) => d !== null && d !== void 0 && d.label === label)?.data || "";
 }
 /**
 * Flatten a requirement's refs to one string: each Reference rendered as its
-* url/uri (or a string `ref`); array-form refs are skipped. Joined with '; ' to
+* url/uri (or a string `ref`); array-form refs are skipped here, though a document
+* containing one never reaches this function in Go, whose typed decode rejects
+* it outright — a reject-versus-degrade split tracked on its own card. Joined with '; ' to
 * match the NIST/CCI column convention.
 */
 function flattenRefs(refs) {
@@ -8234,7 +8481,7 @@ function buildEvidences(req) {
 	return out;
 }
 function floatMetric(f) {
-	return String(f);
+	return formatJsonNumber(f);
 }
 //#endregion
 //#region converters/hdf-to-asff/typescript/converter.ts
@@ -8263,7 +8510,7 @@ const MAX_DESCRIPTION = 1024;
 const EPOCH_SENTINEL = "1970-01-01T00:00:00Z";
 function convertHdfToAsff(input, converterVersion = "0.1.0") {
 	const name = "hdf-to-asff";
-	validateInputSize(input, name);
+	validateInputSize$1(input, name);
 	const doc = parseHdf(input);
 	const baselines = asArr(doc.baselines);
 	if (!baselines) throw new Error(`${name}: invalid HDF structure: missing baselines field`);
@@ -8539,7 +8786,7 @@ function convertGroups(groups) {
 * @returns HDF Results JSON string
 */
 async function convertSplunkToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "splunk");
+	validateInputSize$1(input, "splunk");
 	const resultsChecksum = await inputChecksum(input);
 	const events = parseJSON(input);
 	if (!Array.isArray(events) || events.length === 0) throw new Error("No Splunk events found in input");
@@ -8655,9 +8902,24 @@ function convertStatistics(stats) {
 * The document is walked as a plain JSON tree and every key is emitted in
 * source-JSON order, so the output can never silently lag a schema addition the
 * way the previous hand-maintained struct mirror did (it dropped ~30 post-v3.2
-* fields). JSON.parse preserves object key insertion order, and the Go converter
-* walks the same normalized JSON in the same order, so the two languages emit
-* output that is identical after the shared XML golden normalization.
+* fields). The Go converter walks the same normalized JSON in the same order and
+* emits identical output after the shared XML golden normalization for every
+* shape this repo's fixtures and parity tests cover.
+*
+* Equality is NOT guaranteed in general. The largest seam is that JSON.parse
+* discards information before this builder ever runs, so anything it drops is
+* unreachable from the serializer; shared/xml-divergence-cases.json is the
+* census of THAT seam, read and pinned by both languages -- a duplicate key
+* keeps only the last value, an integer-like key is hoisted ahead of its
+* siblings, and a number too large for a double arrives as Infinity with its
+* token text gone. Closing any of them means parsing untrusted input with a
+* parser that preserves order, duplicates and the number token, a worse trade.
+*
+* That table is NOT the whole list, and at least one divergence has a different
+* cause: the underlying builder caps nesting depth where the Go peer does not,
+* so a deep enough document converts there and throws here (pinned by the
+* nesting-depth tests in both languages). A shape outside the fixture corpus
+* needs checking against the peer rather than assuming it is covered.
 */
 /**
 * Maps a container (plural) key to the element name emitted for each of its
@@ -8688,13 +8950,33 @@ function singularFor(key) {
 	return PLURAL_TO_SINGULAR[key] ?? "item";
 }
 /**
-* Wrap a primitive so fast-xml-parser renders it as element text rather than an
-* attribute.
+* Encode a JSON key to a legal XML element name, reporting whether it had to
+* change. HDF leaves object keys unconstrained — tags carry vendor-namespaced
+* keys like "sonarqube/hash", and additionalProperties lets a converter park
+* native fields anywhere — while XML constrains element names to Name, so an
+* unencoded key produced a document no parser could read.
+*
+* The kept set is ASCII — [A-Za-z0-9._-] — not the far wider set XML Name
+* allows, so the two languages agree by construction rather than by way of two
+* Unicode tables that can drift apart. It costs nothing here: no tag key in this
+* package's converter fixtures is non-ASCII. ':' is deliberately not kept —
+* it is a legal Name character but would invent an undeclared namespace prefix.
+*
+* Mirrored by xmlElementName in the Go converter and pinned to a shared table.
 */
-function wrapScalar(value) {
-	return { "#text": value };
+function xmlElementName(key) {
+	const out = [...key].map((ch) => /[A-Za-z0-9.\-_]/.test(ch) ? ch : "_").join("");
+	const [first = ""] = [...out];
+	const name = /[A-Za-z_]/.test(first) ? out : `_${out}`;
+	return [name, name !== key];
 }
 /**
+* The attribute holding the original key of a rewritten element. The prefix is
+* what separates an attribute from a child element in the builder; it cannot
+* collide with a child, because any key spelled this way is itself rewritten.
+*/
+const NAME_ATTR = "@_name";
+/**
 * True for a JSON scalar (string, number, bool) or a null/undefined placeholder.
 * Nested objects and arrays are not scalar, which selects the wrapped
 * object-array rendering.
@@ -8702,37 +8984,48 @@ function wrapScalar(value) {
 function isScalar(value) {
 	return value === null || value === void 0 || typeof value !== "object";
 }
+function present(value) {
+	return value !== null && value !== void 0;
+}
 /**
-* Convert an object-array item into its fast-xml-parser representation. Items
-* are objects (the object-array rule), but a scalar in a heterogeneous array is
-* wrapped so it renders as <singular>text</singular>, matching the Go walker.
+* Render one JSON key as the sibling nodes it becomes, mirroring the Go
+* writeValue case for case. A list rather than a single node because a scalar
+* array repeats its key unwrapped, and because two keys can encode to one
+* element name — preserveOrder keeps each at its own position, which a plain
+* object keyed by element name could not.
 */
-function toXmlValue(value) {
-	if (value === null || value === void 0) return;
-	if (Array.isArray(value)) return { item: value.filter((v) => v !== null && v !== void 0).map(toXmlValue) };
-	if (typeof value === "object") return buildObject(value);
-	return wrapScalar(value);
+function nodesFor(key, value) {
+	const [name, rewritten] = xmlElementName(key);
+	const attrs = rewritten ? { ":@": { [NAME_ATTR]: xmlSafeText(key) } } : {};
+	if (Array.isArray(value)) {
+		if (value.length === 0) return [{
+			[name]: [],
+			...attrs
+		}];
+		if (value.every(isScalar)) return value.filter(present).flatMap((item) => nodesFor(key, item));
+		const child = singularFor(key);
+		return [{
+			[name]: value.filter(present).flatMap((item) => nodesFor(child, item)),
+			...attrs
+		}];
+	}
+	if (typeof value === "object") return [{
+		[name]: buildNodes(value),
+		...attrs
+	}];
+	const text = typeof value === "string" ? xmlSafeText(value) : typeof value === "number" ? formatJsonNumber(value) : value;
+	return [{
+		[name]: [{ "#text": text }],
+		...attrs
+	}];
 }
 /**
-* Walk a JSON object into a fast-xml-parser-ready structure, emitting keys in
-* source order. Null-valued keys are omitted (parity with the old omitempty
-* semantics). A scalar array repeats its key unwrapped (<nist>AU-12</nist>); an
-* object array becomes a wrapper whose per-item child name comes from the
-* plural->singular map; an empty array becomes an empty wrapper element.
+* Walk a JSON object into fast-xml-parser preserveOrder nodes, emitting keys in
+* source order. Null-valued keys are omitted, matching the old omitempty
+* semantics and the Go peer.
 */
-function buildObject(obj) {
-	const out = {};
-	for (const [key, value] of Object.entries(obj)) {
-		if (value === null || value === void 0) continue;
-		if (Array.isArray(value)) {
-			const items = value.filter((v) => v !== null && v !== void 0);
-			if (value.length === 0) out[key] = {};
-			else if (value.every(isScalar)) out[key] = items.map((v) => wrapScalar(v));
-			else out[key] = { [singularFor(key)]: items.map(toXmlValue) };
-		} else if (typeof value === "object") out[key] = buildObject(value);
-		else out[key] = wrapScalar(value);
-	}
-	return out;
+function buildNodes(obj) {
+	return Object.entries(obj).flatMap(([key, value]) => present(value) ? nodesFor(key, value) : []);
 }
 /**
 * Convert HDF Results JSON to XML.
@@ -8741,11 +9034,14 @@ function buildObject(obj) {
 * @returns XML string
 */
 function convertHdfToXml(input) {
-	validateInputSize(input, "hdf-to-xml");
+	validateInputSize$1(input, "hdf-to-xml");
 	const hdf = parseHdf(input);
 	if (!hdf || typeof hdf !== "object" || Array.isArray(hdf) || !("baselines" in hdf)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdf.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
-	return buildXml({ HdfResults: buildObject(hdf) });
+	return `${buildXml([{ HdfResults: buildNodes(hdf) }], {
+		preserveOrder: true,
+		attributeNamePrefix: "@_"
+	}).trim()}\n`;
 }
 //#endregion
 //#region converters/gitlab-to-hdf/typescript/converter.ts
@@ -8868,7 +9164,7 @@ function buildCodeDesc$5(scanType, location) {
 	}
 }
 async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "gitlab");
+	validateInputSize$1(input, "gitlab");
 	const resultsChecksum = await inputChecksum(input);
 	const report = parseJSON(input);
 	const scanType = report.scan?.type ?? "sast";
@@ -8970,25 +9266,14 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 const BASELINE_NAME = "Trivy Scan";
 const STATIC_CCI = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 const CWE_ID_PATTERN$1 = /^CWE-[1-9]\d*$/;
-const IMPACT_MAP = {
-	critical: .9,
-	high: .7,
-	medium: .5,
-	low: .3,
-	unknown: .5,
-	none: 0,
-	info: 0
-};
-function severityToImpact$2(severity) {
-	return IMPACT_MAP[(severity || "").toLowerCase()] ?? .5;
-}
+const SEVERITY_ALIASES = { critical: .9 };
 /**
 * Route Trivy output to HDF Results: native Trivy JSON (SchemaVersion 2) is
 * parsed here; SARIF / CycloneDX / ASFF / GitLab are delegated to their
 * converters. TypeScript peer of shared/go/../trivy-to-hdf converter.go.
 */
 async function convertTrivyToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "trivy");
+	validateInputSize$1(input, "trivy");
 	if (!input?.trim()) throw new Error("trivy: empty input");
 	const probe = parseJSON(input);
 	if (typeof probe !== "object" || probe === null || Array.isArray(probe)) throw new Error("trivy: input is not a JSON object");
@@ -9031,7 +9316,7 @@ async function convertNative(input, converterVersion) {
 function convertVuln(v, res, startTime) {
 	const descriptions = [{
 		label: "default",
-		data: firstNonEmpty(v.Description, v.Title, v.VulnerabilityID)
+		data: firstNonEmpty(v.Description ?? "", v.Title ?? "", v.VulnerabilityID ?? "")
 	}];
 	if (v.FixedVersion) descriptions.push({
 		label: "fix",
@@ -9049,7 +9334,7 @@ function convertVuln(v, res, startTime) {
 		id: `Trivy/${v.VulnerabilityID ?? ""}`,
 		title: `Trivy found ${v.VulnerabilityID ?? ""} in ${pkgLabel(v.PkgName, v.InstalledVersion)}`,
 		descriptions,
-		impact: severityToImpact$2(v.Severity ?? ""),
+		impact: severityToImpactWithAliases(v.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		cwe: filterCwes(v.CweIDs),
 		cvss: buildCvssEntries$4(v.CVSS),
@@ -9061,18 +9346,18 @@ function convertVuln(v, res, startTime) {
 			status: ResultStatus.Failed,
 			codeDesc: buildVulnCodeDesc(v, res),
 			startTime,
-			message: `Severity: ${firstNonEmpty(v.Severity, "UNKNOWN")}`
+			message: `Severity: ${firstNonEmpty(v.Severity ?? "", "UNKNOWN")}`
 		}]
 	};
-	const ap = buildAffectedPackage$1(v);
-	if (ap.purl) req.affectedPackages = [ap];
+	const ap = buildTrivyAffectedPackage(v);
+	if (ap) req.affectedPackages = [ap];
 	if (v.PkgPath) req.sourceLocation = { ref: v.PkgPath };
 	return req;
 }
 function convertMisconf(m, res, startTime) {
 	const descriptions = [{
 		label: "default",
-		data: firstNonEmpty(m.Description, m.Message, m.Title)
+		data: firstNonEmpty(m.Description ?? "", m.Message ?? "", m.Title ?? "")
 	}];
 	if (m.Resolution) descriptions.push({
 		label: "fix",
@@ -9084,10 +9369,10 @@ function convertMisconf(m, res, startTime) {
 	});
 	markUnratedSeverity(tags, m.Severity);
 	const req = {
-		id: `Trivy/${firstNonEmpty(m.ID, m.AVDID)}`,
+		id: `Trivy/${firstNonEmpty(m.ID ?? "", m.AVDID ?? "")}`,
 		title: m.Title,
 		descriptions,
-		impact: severityToImpact$2(m.Severity ?? ""),
+		impact: severityToImpactWithAliases(m.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		refs: buildRefs$5([m.PrimaryURL, ...m.References ?? []]),
 		code: JSON.stringify(m, null, 2),
@@ -9095,7 +9380,7 @@ function convertMisconf(m, res, startTime) {
 		verificationMethod: VerificationMethodEnum.Automated,
 		results: [{
 			status: misconfStatus(m.Status),
-			codeDesc: firstNonEmpty(m.Message, m.Title),
+			codeDesc: firstNonEmpty(m.Message ?? "", m.Title ?? ""),
 			startTime
 		}]
 	};
@@ -9117,9 +9402,9 @@ function convertSecret(s, res, startTime) {
 		title: s.Title,
 		descriptions: [{
 			label: "default",
-			data: `${firstNonEmpty(s.Title, s.RuleID)} detected in ${res.Target ?? ""} (value redacted by Trivy).`
+			data: `${firstNonEmpty(s.Title ?? "", s.RuleID ?? "")} detected in ${res.Target ?? ""} (value redacted by Trivy).`
 		}],
-		impact: severityToImpact$2(s.Severity ?? ""),
+		impact: severityToImpactWithAliases(s.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		code: JSON.stringify(s, null, 2),
 		controlType: deriveControlTypeFromTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS),
@@ -9151,7 +9436,7 @@ function convertLicense(l, res, startTime) {
 			label: "default",
 			data: `Package ${l.PkgName ?? ""} uses the ${l.Name ?? ""} license (category: ${l.Category ?? ""}).`
 		}],
-		impact: severityToImpact$2(l.Severity ?? ""),
+		impact: severityToImpactWithAliases(l.Severity, SEVERITY_ALIASES, .5),
 		tags,
 		refs: buildRefs$5([l.Link]),
 		code: JSON.stringify(l, null, 2),
@@ -9232,33 +9517,19 @@ function buildCvssEntries$4(m) {
 	}
 	return entries.length > 0 ? entries : void 0;
 }
-const PURL_ECOSYSTEMS = {
-	deb: Ecosystem.Deb,
-	rpm: Ecosystem.RPM,
-	maven: Ecosystem.Maven,
-	npm: Ecosystem.Npm,
-	pypi: Ecosystem.Pypi,
-	gem: Ecosystem.Gem,
-	cargo: Ecosystem.Cargo,
-	golang: Ecosystem.Go,
-	nuget: Ecosystem.Nuget
-};
-function buildAffectedPackage$1(v) {
-	const ap = {};
-	if (v.PkgName) ap.name = v.PkgName;
-	if (v.InstalledVersion) ap.version = v.InstalledVersion;
-	if (v.FixedVersion) ap.fixedInVersion = v.FixedVersion;
+function buildTrivyAffectedPackage(v) {
 	const purl = v.PkgIdentifier?.PURL;
-	if (purl) {
-		ap.purl = purl;
-		const eco = ecosystemFromPurl(purl);
-		if (eco) ap.ecosystem = eco;
-	}
-	return ap;
+	return buildAffectedPackage$1({
+		name: v.PkgName,
+		version: v.InstalledVersion,
+		fixedInVersion: v.FixedVersion,
+		purl,
+		ecosystem: purl ? ecosystemFromPurl(purl) : void 0
+	});
 }
 function ecosystemFromPurl(purl) {
-	const type = (purl.replace(/^pkg:/, "").split(/[/@?]/)[0] ?? "").toLowerCase();
-	return PURL_ECOSYSTEMS[type];
+	const eco = ecosystemFromPurlType(purl.replace(/^pkg:/, "").split(/[/@?]/)[0] ?? "");
+	return eco === Ecosystem.Generic ? void 0 : eco;
 }
 function buildRefs$5(urls) {
 	const seen = /* @__PURE__ */ new Set();
@@ -9285,10 +9556,6 @@ function digestPart(ref) {
 	const at = ref.lastIndexOf("@");
 	return at >= 0 ? ref.slice(at + 1) : ref;
 }
-function firstNonEmpty(...vals) {
-	for (const v of vals) if (v) return v;
-	return "";
-}
 function putIf(m, key, val) {
 	if (val) m[key] = val;
 }
@@ -9448,7 +9715,7 @@ function buildRequirement$12(reqID, findings) {
 * @returns HDF JSON string
 */
 async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "trufflehog");
+	validateInputSize$1(input, "trufflehog");
 	const findings = !input || input.trim().length === 0 ? [] : parseFindings(input);
 	const resultsChecksum = await inputChecksum(input);
 	const limitedFindings = limitArrayWithWarning(findings, "finding");
@@ -9581,7 +9848,7 @@ function investigateReason(reason) {
 * @returns HDF JSON string
 */
 async function convertHipcheckToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "hipcheck");
+	validateInputSize$1(input, "hipcheck");
 	if (!input || input.trim().length === 0) throw new Error("hipcheck: empty input");
 	const report = parseJSON(input);
 	if (!report.hipcheck_version && !report.repo_name) throw new Error("hipcheck: input does not look like a Hipcheck report");
@@ -9704,7 +9971,7 @@ function buildIssueCode(issue) {
 */
 async function convertBurpsuiteToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("burpsuite: empty input");
-	validateInputSize(input, "burpsuite");
+	validateInputSize$1(input, "burpsuite");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseXmlWithArrays(input, ["issue"]);
 	if (!parsed.issues) throw new Error("burpsuite: invalid XML — missing <issues> root element");
@@ -10010,7 +10277,7 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 */
 async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("dbprotect: empty input");
-	validateInputSize(input, "dbprotect");
+	validateInputSize$1(input, "dbprotect");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseXmlWithArrays(input, [
 		"item",
@@ -10093,15 +10360,15 @@ function buildCvss$1(vuln) {
 		source: vuln.cve ?? vuln.id
 	});
 }
-const CWE_REGEX = /cwe[-_]?(\d+)/gi;
 /**
-* Extracts canonical CWE-N identifiers from a free-form string.
+* Extracts canonical CWE-N identifiers from a free-form string, deduplicated
+* in source order.
 */
 function parseCwes(raw) {
 	if (!raw) return [];
 	const out = [];
 	const seen = /* @__PURE__ */ new Set();
-	for (const m of raw.matchAll(CWE_REGEX)) {
+	for (const m of raw.matchAll(CWE_PATTERN$1)) {
 		const id = `CWE-${m[1]}`;
 		if (seen.has(id)) continue;
 		seen.add(id);
@@ -10128,7 +10395,9 @@ function debDistro(distro) {
 }
 /**
 * Maps a Twistlock package type plus the result's distro string to a schema
-* Ecosystem value. Defaults to 'generic' for unknown types.
+* Ecosystem value. Only the Twistlock spellings that differ from the PURL type
+* vocabulary are listed; the rest defer to the shared resolver, which falls
+* back to 'generic' for unknown types.
 */
 function resolveEcosystem(packageType, distro) {
 	const t = (packageType ?? "").toLowerCase();
@@ -10138,19 +10407,10 @@ function resolveEcosystem(packageType, distro) {
 			if (rhelDistro(d)) return Ecosystem.RPM;
 			if (debDistro(d)) return Ecosystem.Deb;
 			return Ecosystem.Generic;
-		case "rpm": return Ecosystem.RPM;
-		case "deb": return Ecosystem.Deb;
-		case "jar":
-		case "maven": return Ecosystem.Maven;
-		case "python":
-		case "pypi": return Ecosystem.Pypi;
-		case "nodejs":
-		case "npm": return Ecosystem.Npm;
-		case "gem": return Ecosystem.Gem;
-		case "nuget": return Ecosystem.Nuget;
-		case "go": return Ecosystem.Go;
-		case "cargo": return Ecosystem.Cargo;
-		default: return Ecosystem.Generic;
+		case "jar": return Ecosystem.Maven;
+		case "python": return Ecosystem.Pypi;
+		case "nodejs": return Ecosystem.Npm;
+		default: return ecosystemFromPurlType(t);
 	}
 }
 const FIX_VERSION_REGEX = /\d+(?:\.\d+)+[A-Za-z0-9._+\-]*/;
@@ -10165,20 +10425,18 @@ function extractFixedInVersion(vuln) {
 	return m ? m[0] : "";
 }
 /**
-* Builds an AffectedPackage entry from per-vulnerability fields. Returns
-* undefined when packageName or packageVersion are missing (both required).
+* Builds an AffectedPackage entry from per-vulnerability fields. Twistlock
+* carries no purl or cpe, so the shared builder returns undefined unless the
+* name + version + ecosystem triple is complete.
 */
 function buildAffectedPackage(vuln, packageTypes, distro) {
-	if (!vuln.packageName || !vuln.packageVersion) return void 0;
-	const pkgType = vuln.packageType ?? packageTypes.get(vuln.packageName);
-	const pkg = {
+	const pkgType = vuln.packageType ?? packageTypes.get(vuln.packageName ?? "");
+	return buildAffectedPackage$1({
 		name: vuln.packageName,
 		version: vuln.packageVersion,
-		ecosystem: resolveEcosystem(pkgType, distro)
-	};
-	const fixed = extractFixedInVersion(vuln);
-	if (fixed) pkg.fixedInVersion = fixed;
-	return pkg;
+		ecosystem: resolveEcosystem(pkgType, distro),
+		fixedInVersion: extractFixedInVersion(vuln)
+	});
 }
 /**
 * Indexes packageName → packageType from the result-level packages array.
@@ -10308,7 +10566,7 @@ function convertSingleResult(result, resultsChecksum) {
 */
 async function convertTwistlockToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("twistlock: empty input");
-	validateInputSize(input, "twistlock");
+	validateInputSize$1(input, "twistlock");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseJSON(input);
 	if (!parsed || typeof parsed !== "object") throw new Error("twistlock: invalid JSON");
@@ -10515,7 +10773,7 @@ function buildAffectedPackageFromComponent(c) {
 	let ecosystem;
 	if (c.purl) ecosystem = ecosystemFromPurlType(parsePurl(c.purl)?.type);
 	else if (c.name && c.version) ecosystem = ecosystemFromPurlType(void 0);
-	return buildAffectedPackage$2({
+	return buildAffectedPackage$1({
 		name: c.name,
 		version: c.version,
 		ecosystem,
@@ -10532,7 +10790,7 @@ function buildAffectedPackageFromComponent(c) {
 */
 async function convertDeptrackToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("deptrack: empty input");
-	validateInputSize(input, "deptrack");
+	validateInputSize$1(input, "deptrack");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseJSON(input);
 	if (!parsed || typeof parsed !== "object") throw new Error("deptrack: invalid JSON");
@@ -10787,7 +11045,7 @@ function buildAffectedPackageFromEntry(entry) {
 		ecosystem = ecosystemFromXraySource(parsed.scheme);
 	}
 	const fixed = entry.component_versions?.fixed_versions?.[0];
-	return buildAffectedPackage$2({
+	return buildAffectedPackage$1({
 		name,
 		version,
 		ecosystem: ecosystem ?? (name ? Ecosystem.Generic : void 0),
@@ -10802,7 +11060,7 @@ function buildAffectedPackageFromEntry(entry) {
 */
 async function convertJfrogXrayToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("jfrog-xray: empty input");
-	validateInputSize(input, "jfrog-xray");
+	validateInputSize$1(input, "jfrog-xray");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseJSON(input);
 	if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.data)) throw new Error("jfrog-xray: invalid JSON structure");
@@ -11019,7 +11277,7 @@ function buildRequirement$6(vuln, scanTime, ml) {
 	const refs = buildRefs$3(vuln);
 	if (refs) req.refs = refs;
 	const cpe23 = (vuln.cpes ?? []).find((c) => /^cpe:2\.3:[aho]:/.test(c));
-	const pkg = buildAffectedPackage$2({
+	const pkg = buildAffectedPackage$1({
 		name: vuln.package_name,
 		version: vuln.package_version,
 		ecosystem: vuln.package_name && vuln.package_version ? Ecosystem.Generic : void 0,
@@ -11104,7 +11362,7 @@ function buildComponent(report) {
 */
 async function convertNeuvectorToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("neuvector: empty input");
-	validateInputSize(input, "neuvector");
+	validateInputSize$1(input, "neuvector");
 	const scan = parseJSON(input);
 	if (!scan || typeof scan !== "object" || !("report" in scan)) throw new Error("neuvector: invalid JSON structure");
 	const resultsChecksum = await inputChecksum(input);
@@ -11346,7 +11604,7 @@ function buildRequirement$5(desc, vulns, snippetMap, startTimeStr) {
 */
 async function convertFortifyToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("fortify: empty input");
-	validateInputSize(input, "fortify");
+	validateInputSize$1(input, "fortify");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseXml(input, { stopNodes: ["FVDL.Description.Abstract", "FVDL.Description.Explanation"] });
 	if (!parsed.FVDL) throw new Error("fortify: invalid FVDL — missing <FVDL> root element");
@@ -11592,7 +11850,7 @@ function buildAffectedPackageFromRecord(rec) {
 	const version = rec["Package Version"];
 	if (!name || !version) return void 0;
 	const fixMatch = rec["Fix Status"] ? FIX_VERSION_PATTERN.exec(rec["Fix Status"]) : null;
-	return buildAffectedPackage$2({
+	return buildAffectedPackage$1({
 		name,
 		version,
 		ecosystem: ecosystemFromDistro(rec.Distro),
@@ -11629,7 +11887,7 @@ function buildBaseline(hostname, records, resultsChecksum, scanTime) {
 */
 async function convertPrismaToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("prisma: empty input");
-	validateInputSize(input, "prisma");
+	validateInputSize$1(input, "prisma");
 	const headers = (input.split(/\r?\n/, 1)[0] ?? "").split(",").map((h) => h.trim());
 	for (const col of REQUIRED_COLUMNS) if (!headers.includes(col)) throw new Error(`prisma: missing required CSV column "${col}"`);
 	const records = parseCsv(input);
@@ -11731,12 +11989,13 @@ function baseScoreFromBlock(block) {
 */
 function buildNetsparkerCvss(classification) {
 	const out = [];
-	for (const block of [classification?.cvss, classification?.cvss31]) {
+	const blocks = [[classification?.cvss, Version.The30], [classification?.cvss31, Version.The31]];
+	for (const [block, elementVersion] of blocks) {
 		const baseScore = baseScoreFromBlock(block);
 		const vector = block?.vector ?? "";
 		if (!vector && baseScore === void 0) continue;
 		out.push(buildCvss$3({
-			version: cvssVersionFromVector(vector),
+			version: cvssVersionFromVector(vector, elementVersion),
 			baseScore,
 			baseVector: vector
 		}));
@@ -11857,7 +12116,7 @@ function buildRequirement$3(vuln, initiated) {
 */
 async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("netsparker: empty input");
-	validateInputSize(input, "netsparker");
+	validateInputSize$1(input, "netsparker");
 	const resultsChecksum = await inputChecksum(input);
 	const parsed = parseXmlWithArrays(input, [
 		"vulnerability",
@@ -12018,7 +12277,7 @@ function buildRequirement$2(ruleID, finding, startTime) {
 */
 async function convertScoutsuiteToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("scoutsuite: empty input");
-	validateInputSize(input, "scoutsuite");
+	validateInputSize$1(input, "scoutsuite");
 	const jsonStr = stripJSPrefix(input);
 	const resultsChecksum = await inputChecksum(jsonStr);
 	const report = parseJSON(jsonStr);
@@ -12230,7 +12489,7 @@ function buildScannerBaseline(scannerName, results, shaMap, resultsChecksum) {
 */
 async function convertConveyorToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("conveyor: empty input");
-	validateInputSize(input, "conveyor");
+	validateInputSize$1(input, "conveyor");
 	const data = parseJSON(input);
 	if (!data || typeof data !== "object") throw new Error("conveyor: invalid JSON");
 	if (!data.api_response) throw new Error("conveyor: missing api_response field");
@@ -12702,7 +12961,7 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 */
 async function convertVeracodeToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("veracode: empty input");
-	validateInputSize(input, "veracode");
+	validateInputSize$1(input, "veracode");
 	const parsed = parseXml(input, {
 		attributeNamePrefix: "@_",
 		trimValues: false
@@ -12858,7 +13117,7 @@ function buildRequirement$1(cs, profiles, createdDateTime) {
 */
 async function convertMsftSecureScoreToHdf(input, converterVersion = "1.0.0") {
 	if (!input || input.trim().length === 0) throw new Error("msft-secure-score: empty input");
-	validateInputSize(input, "msft-secure-score");
+	validateInputSize$1(input, "msft-secure-score");
 	const combined = parseJSON(input);
 	if (!combined || typeof combined !== "object") throw new Error("msft-secure-score: invalid JSON");
 	if (!combined.secureScore?.value) throw new Error("msft-secure-score: missing secureScore.value");
@@ -12905,7 +13164,7 @@ async function convertMsftSecureScoreToHdf(input, converterVersion = "1.0.0") {
 * the output with MSDO-specific metadata.
 */
 async function convertMsftDefenderDevopsToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "msft-defender-devops");
+	validateInputSize$1(input, "msft-defender-devops");
 	const raw = parseJSON(input);
 	if (!raw || !Array.isArray(raw.runs)) throw new Error("Invalid MSDO SARIF structure: missing or invalid runs field");
 	const { components, runEnrichments } = extractEnrichments(raw);
@@ -13070,7 +13329,7 @@ function buildResultFromAssessment(a, scanTime) {
 * @returns HDF JSON string
 */
 async function convertMsftDefenderCloudToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "msft-defender-cloud");
+	validateInputSize$1(input, "msft-defender-cloud");
 	const scanTime = /* @__PURE__ */ new Date();
 	const resultsChecksum = await inputChecksum(input);
 	const raw = parseJSON(input);
@@ -13180,9 +13439,7 @@ function buildTriageOverride(alert, startTime) {
 		default: return null;
 	}
 	const appliedAt = (alert.resolvedDateTime ? parseTimestamp(alert.resolvedDateTime) : null) ?? (alert.lastUpdateDateTime ? parseTimestamp(alert.lastUpdateDateTime) : null) ?? startTime;
-	const expiresAt = /* @__PURE__ */ new Date();
-	expiresAt.setTime(appliedAt.getTime());
-	expiresAt.setUTCFullYear(expiresAt.getUTCFullYear() + 1);
+	const expiresAt = defaultOverrideExpiry(appliedAt);
 	return {
 		override: {
 			type: disposition,
@@ -13356,7 +13613,7 @@ function alertToRequirement(alert, scanTime) {
 * @returns HDF JSON string
 */
 async function convertMsftDefenderEndpointToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "msft-defender-endpoint");
+	validateInputSize$1(input, "msft-defender-endpoint");
 	const resultsChecksum = await inputChecksum(input);
 	const response = parseJSON(input);
 	if (!response || typeof response !== "object") throw new Error("Invalid Microsoft Defender for Endpoint structure: not a valid JSON object");
@@ -13408,7 +13665,7 @@ const BUILD_OPTIONS = {
 * @returns XCCDF 1.2 XML string
 */
 function convertHdfToXccdf(input) {
-	validateInputSize(input, "hdf-to-xccdf");
+	validateInputSize$1(input, "hdf-to-xccdf");
 	const hdfData = parseHdf(input);
 	if (!hdfData || typeof hdfData !== "object" || !("baselines" in hdfData)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdfData.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
@@ -13418,12 +13675,14 @@ function convertHdfToXccdf(input) {
 function wrap(value) {
 	return { "#text": value };
 }
-/** Map HDF impact (0.0-1.0) to XCCDF severity string. */
+/** Map HDF impact (0.0-1.0) to XCCDF severity via the shared band mapper. The
+*  XCCDF vocabulary has no critical band, so critical folds into high, and its
+*  zero band is spelled 'info'. */
 function impactToSeverity$2(impact) {
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "medium";
-	if (impact >= .1) return "low";
-	return "info";
+	const sev = impactToSeverity(impact);
+	if (sev === "critical") return "high";
+	if (sev === "informational") return "info";
+	return sev;
 }
 /** Map HDF result status to XCCDF result value. */
 function hdfStatusToXccdf(status) {
@@ -13441,7 +13700,44 @@ function findDescription(descriptions, label) {
 }
 /** Replace characters not valid in XCCDF IDs with underscores. */
 function sanitizeXccdfId(id) {
-	return id.replace(/[^a-zA-Z0-9_.\-]/g, "_");
+	return id.replace(/[^a-zA-Z0-9_.\-]/gu, "_");
+}
+/**
+* Supply the trailing name segment that benchmarkIdType and profileIdType
+* require via their .+ — a baseline with an empty name is valid HDF but
+* produced "xccdf_hdf_benchmark_", which the XSD rejects.
+*/
+function xccdfNamePart(name) {
+	return name === "" ? "unnamed" : name;
+}
+/**
+* Render an HDF tags.gid as a groupIdType: an NCName that must also match
+* xccdf_[^_]+_group_.+ (xccdf_1.2.xsd:821). HDF constrains gid not at all, and
+* most real data does not satisfy it — 783 of the 1216 distinct gid values in
+* this package's converter fixtures are bare STIG ids like "V-257777" — so copying one
+* through produced XSD-invalid output from valid HDF.
+*
+* A gid that already conforms is a genuine XCCDF group id (STIG content carries
+* "xccdf_mil.disa.stig_group_V-204393") and is passed through; anything else is
+* sanitized and namespaced under this converter, matching what the benchmark,
+* profile, and rule ids already do.
+*
+* Mirrored by xccdfGroupID in the Go converter. Exported so the shared table
+* can be asserted against the encoder directly, including the empty gid the
+* converter itself skips.
+*/
+function xccdfGroupId(gid) {
+	if (isXccdfGroupId(gid)) return gid;
+	return sanitizeXccdfId("xccdf_hdf_group_" + (gid === "" ? "unnamed" : gid));
+}
+/**
+* Whether a value already satisfies groupIdType. The character test is
+* ASCII-only, deliberately narrower than NCName: a conforming non-ASCII id is
+* re-encoded rather than trusted, which errs toward valid output and keeps the
+* check identical to the Go peer's.
+*/
+function isXccdfGroupId(id) {
+	return /^xccdf_[^_]+_group_.+$/.test(id) && /^[A-Za-z0-9._-]+$/.test(id);
 }
 /** Read a string-valued tag, or undefined if absent/non-string. */
 function tagString(tags, key) {
@@ -13466,12 +13762,22 @@ function toolTestSystem(tool) {
 	const name = tool.name ? cpeField(tool.name) : "tool";
 	return `cpe:/a:${name}:${name}:${cpeField(tool.version)}`;
 }
+/**
+* The requirement id as text for id construction. HDF makes id required, but
+* nested-invalid input reaches the converter and concatenating an absent id
+* wrote the literal string "undefined" into the emitted identifier — where Go,
+* concatenating a zero-value string, wrote nothing. Both satisfied the XCCDF
+* pattern, so no schema gate caught the divergence.
+*/
+function requirementIdText(id) {
+	return typeof id === "string" ? id : "";
+}
 /** Build the Benchmark XML object from HDF data. */
 function buildBenchmarkObj(hdfData) {
 	const empty = !hdfData.baselines || hdfData.baselines.length === 0;
 	const benchmark = {
 		[`${ATTR}xmlns`]: "http://checklists.nist.gov/xccdf/1.2",
-		[`${ATTR}id`]: empty ? "xccdf_hdf_benchmark_exported" : sanitizeXccdfId("xccdf_hdf_benchmark_" + hdfData.baselines[0].name),
+		[`${ATTR}id`]: empty ? "xccdf_hdf_benchmark_exported" : sanitizeXccdfId("xccdf_hdf_benchmark_" + xccdfNamePart(hdfData.baselines[0].name)),
 		[`${ATTR}resolved`]: "1",
 		status: wrap("incomplete")
 	};
@@ -13485,7 +13791,7 @@ function buildBenchmarkObj(hdfData) {
 	if (baseline.summary) benchmark.description = wrap(baseline.summary);
 	benchmark.version = wrap(baseline.version ?? "1.0");
 	benchmark.Profile = {
-		[`${ATTR}id`]: sanitizeXccdfId("xccdf_hdf_profile_" + baseline.name),
+		[`${ATTR}id`]: sanitizeXccdfId("xccdf_hdf_profile_" + xccdfNamePart(baseline.name)),
 		title: wrap(baseline.title ?? baseline.name)
 	};
 	const groups = [];
@@ -13502,7 +13808,7 @@ function buildBenchmarkObj(hdfData) {
 		if (idx === void 0) {
 			idx = groups.length;
 			groupIndex.set(gid, idx);
-			const group = { [`${ATTR}id`]: gid };
+			const group = { [`${ATTR}id`]: xccdfGroupId(gid) };
 			const gtitle = tagString(req.tags, "gtitle");
 			if (gtitle) group.title = wrap(gtitle);
 			group.Rule = [];
@@ -13512,12 +13818,13 @@ function buildBenchmarkObj(hdfData) {
 	}
 	if (groups.length > 0) benchmark.Group = groups;
 	if (flatRules.length > 0) benchmark.Rule = flatRules;
-	benchmark.TestResult = buildTestResultObj(hdfData, baseline);
+	const testResult = buildTestResultObj(hdfData, baseline);
+	if (testResult) benchmark.TestResult = testResult;
 	return benchmark;
 }
 /** Build an XCCDF Rule object from an HDF EvaluatedRequirement. */
 function buildRuleObj(req) {
-	const ruleId = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
+	const ruleId = sanitizeXccdfId("xccdf_hdf_rule_" + requirementIdText(req.id) + "_rule");
 	const rule = {
 		[`${ATTR}id`]: ruleId,
 		[`${ATTR}severity`]: impactToSeverity$2(req.impact),
@@ -13566,27 +13873,74 @@ function buildRuleObj(req) {
 		[`${ATTR}system`]: "http://oval.mitre.org/XMLSchema/oval-definitions-5",
 		"check-content": wrap(checkContent)
 	});
-	if (req.code) checks.push({
+	const code = firstNonEmpty(req.code ?? "");
+	if (code !== "") checks.push({
 		[`${ATTR}system`]: "http://inspec.io/",
-		"check-content": wrap(req.code)
+		"check-content": wrap(code)
 	});
 	if (checks.length > 0) rule.check = checks;
 	return rule;
 }
-/** Build the XCCDF TestResult object. */
+/**
+* The earliest and latest result time in a baseline.
+*
+* XCCDF makes TestResult/@end-time required while HDF's top-level timestamp is
+* optional, so a document without one still has to carry a scan window. It is
+* derived from the results rather than the wall clock, which would break both
+* determinism and the golden comparison. A TestResult is only built when a
+* baseline exists, and the HDF schema puts minItems 1 on both requirements and
+* results with startTime required on each, so a window is always available
+* here; undefined is returned anyway rather than assuming it.
+*
+* Times are emitted through formatTimestamp, HDF's canonical form, which is
+* documented as byte-identical to the RFC3339Nano string the Go converter
+* emits for the same instant.
+*
+* Mirrored by resultTimeWindow in the Go converter.
+*/
+function resultTimeWindow(baseline) {
+	let first;
+	let last;
+	for (const req of baseline.requirements) for (const res of req.results) {
+		const parsed = parseTimestamp(typeof res.startTime === "string" ? res.startTime : res.startTime.toISOString());
+		if (!parsed) continue;
+		const at = parsed.getTime();
+		const canonical = formatTimestamp(parsed);
+		if (!first || at < first.at) first = {
+			at,
+			text: canonical
+		};
+		if (!last || at > last.at) last = {
+			at,
+			text: canonical
+		};
+	}
+	return first && last ? {
+		first: first.text,
+		last: last.text
+	} : void 0;
+}
+/** Build the XCCDF TestResult object, or undefined when it cannot carry a time. */
 function buildTestResultObj(hdfData, baseline) {
 	const testResult = {
 		[`${ATTR}id`]: "xccdf_hdf_testresult_1",
 		title: wrap("HDF Assessment Results")
 	};
 	if (hdfData.timestamp) {
-		const ts = typeof hdfData.timestamp === "string" ? hdfData.timestamp : hdfData.timestamp.toISOString();
+		const raw = typeof hdfData.timestamp === "string" ? hdfData.timestamp : hdfData.timestamp.toISOString();
+		const parsedTs = parseTimestamp(raw);
+		const ts = parsedTs ? formatTimestamp(parsedTs) : raw;
 		testResult[`${ATTR}start-time`] = ts;
 		let endTime = ts;
 		const duration = hdfData.statistics?.duration;
 		const start = parseTimestamp(ts);
 		if (start && typeof duration === "number" && duration > 0) endTime = formatTimestamp(new Date(start.getTime() + duration * 1e3));
 		testResult[`${ATTR}end-time`] = endTime;
+	} else {
+		const window = resultTimeWindow(baseline);
+		if (!window) return;
+		testResult[`${ATTR}start-time`] = window.first;
+		testResult[`${ATTR}end-time`] = window.last;
 	}
 	const testSystem = toolTestSystem(hdfData.tool);
 	if (testSystem) testResult[`${ATTR}test-system`] = testSystem;
@@ -13599,7 +13953,7 @@ function buildTestResultObj(hdfData, baseline) {
 	let passed = 0;
 	let scorable = 0;
 	for (const req of baseline.requirements) {
-		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + req.id + "_rule");
+		const ruleIdRef = sanitizeXccdfId("xccdf_hdf_rule_" + requirementIdText(req.id) + "_rule");
 		const stigId = tagString(req.tags, "stig_id");
 		const statusInput = requirementStatusInput(req);
 		const resolved = computeEffectiveStatus(statusInput);
@@ -13611,7 +13965,9 @@ function buildTestResultObj(hdfData, baseline) {
 				scorable++;
 			} else if (status === "fail") scorable++;
 			const rr = { [`${ATTR}idref`]: ruleIdRef };
-			rr[`${ATTR}time`] = typeof result.startTime === "string" ? result.startTime : result.startTime.toISOString();
+			const rawStart = typeof result.startTime === "string" ? result.startTime : result.startTime.toISOString();
+			const parsedStart = parseTimestamp(rawStart);
+			rr[`${ATTR}time`] = parsedStart ? formatTimestamp(parsedStart) : rawStart;
 			if (stigId) rr[`${ATTR}version`] = stigId;
 			rr.result = wrap(status);
 			if (result.message) rr.message = wrap(result.message);
@@ -13633,6 +13989,11 @@ function buildTestResultObj(hdfData, baseline) {
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/shared.ts
+/**
+* Shared helper functions for OSCAL-to-HDF converters.
+*
+* Mirrors the Go helpers in converters/oscal-to-hdf/go/shared.go.
+*/
 const controlEnhancementRe = /^([a-z]{2}-\d+)\.(\d+)$/;
 const objectiveIDRe = /^([a-z]{2}-\d+(?:\.\d+)?)/;
 /**
@@ -13717,6 +14078,12 @@ function flattenPartsByName(parts, name) {
 	}
 	return pieces.join("\n").trim();
 }
+/** The one OSCAL spelling the standard severity map does not know; every other
+*  facet value is standard vocabulary. */
+const RISK_FACET_SEVERITY_ALIASES = { moderate: .5 };
+/** Sentinel for "this facet's value is not a severity" — impact is 0.0-1.0, so
+*  a negative can never be a real reading. */
+const UNRECOGNIZED_FACET_IMPACT = -1;
 /**
 * Extracts impact/severity from risk characterization facets.
 * Returns a normalized 0.0-1.0 impact value. Falls back to defaultImpact.
@@ -13725,15 +14092,10 @@ function extractRiskSeverity(characterizations, defaultImpact) {
 	if (!characterizations) return defaultImpact;
 	for (const c of characterizations) {
 		if (!c.facets) continue;
-		for (const f of c.facets) if (f.name === "impact" || f.name === "risk" || f.name === "likelihood") switch (f.value.toLowerCase()) {
-			case "critical": return .9;
-			case "high": return .7;
-			case "moderate":
-			case "medium": return .5;
-			case "low": return .3;
-			case "info":
-			case "informational":
-			case "none": return 0;
+		for (const f of c.facets) {
+			if (f.name !== "impact" && f.name !== "risk" && f.name !== "likelihood") continue;
+			const impact = severityToImpactWithAliases(f.value, RISK_FACET_SEVERITY_ALIASES, UNRECOGNIZED_FACET_IMPACT);
+			if (impact >= 0) return impact;
 		}
 	}
 	return defaultImpact;
@@ -13764,11 +14126,7 @@ function nistTagToControlId(tag) {
 * This is the reverse of extractRiskSeverity.
 */
 function impactToSeverity$1(impact) {
-	if (impact >= .9) return "critical";
-	if (impact >= .7) return "high";
-	if (impact >= .4) return "moderate";
-	if (impact >= .1) return "low";
-	return "info";
+	return oscalSeverityFromHdf(impactToSeverity(impact));
 }
 /**
 * Maps an HDF status string to an OSCAL risk status string.
@@ -13866,15 +14224,9 @@ function oscalString(s) {
 * @returns OSCAL SAR JSON string
 */
 async function convertHdfToOscalSar(input) {
-	validateInputSize(input, "hdf-to-oscal-sar");
-	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-sar: empty input");
-	let hdfResults;
-	try {
-		hdfResults = parseHdf(input);
-	} catch {
-		throw new Error("hdf-to-oscal-sar: failed to parse HDF JSON");
-	}
-	if (!hdfResults || typeof hdfResults !== "object" || !("baselines" in hdfResults)) throw new Error("hdf-to-oscal-sar: invalid HDF structure: missing baselines field");
+	const { doc: hdfResultsDoc } = requireHdfResults(input, "hdf-to-oscal-sar");
+	const hdfResults = hdfResultsDoc;
+	if (hdfResults.baselines.length === 0) throw new Error("hdf-to-oscal-sar: cannot represent an assessment with no evaluated baselines as OSCAL Assessment Results, which requires at least one result");
 	const doc = buildOSCALDocument(hdfResults);
 	return JSON.stringify(doc, null, 2);
 }
@@ -13976,7 +14328,7 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	const includeControls = [];
 	const seenControl = /* @__PURE__ */ new Set();
 	for (const req of baseline.requirements) {
-		const nistId = nistTagToControlId(req.id);
+		const nistId = nistTagToControlId(req.id ?? "");
 		if (nistId === "") continue;
 		const { finding, observation, risk, resource } = requirementToFindingSet(req, timestamp, toolActorUuid, subjects);
 		findings.push(finding);
@@ -13998,9 +14350,9 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 			start: assessmentStart(baseline, timestamp),
 			...resultProps.length > 0 ? { props: resultProps } : {},
 			"reviewed-controls": { "control-selections": [controlSelection] },
-			findings,
-			observations,
-			risks
+			...findings.length > 0 ? { findings } : {},
+			...observations.length > 0 ? { observations } : {},
+			...risks.length > 0 ? { risks } : {}
 		},
 		resources
 	};
@@ -14010,10 +14362,17 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 * component's UUID (componentId when present, otherwise a fresh one) identifies
 * the subject; the HDF component type is a valid OSCAL subject type token and
 * its name becomes the subject title.
+*
+* A component with no type is skipped rather than given one. OSCAL requires both
+* subject-uuid and type on a subject-reference, so the type cannot simply be
+* omitted, and hdf-results defines no default component type to fall back on.
+* String(c.type) turned an absent type into the literal "undefined" — a valid
+* OSCAL token, so a schema check could not see it, asserting a component type
+* the source never stated. Mirrors the Go peer.
 */
 function buildSubjects(components) {
 	if (!Array.isArray(components) || components.length === 0) return [];
-	return components.map((c) => ({
+	return components.filter((c) => oscalString(c.type ?? "") !== "").map((c) => ({
 		"subject-uuid": c.componentId && c.componentId !== "" ? c.componentId : crypto.randomUUID(),
 		type: String(c.type),
 		title: c.name
@@ -14023,7 +14382,7 @@ function buildSubjects(components) {
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
 */
 function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
-	const controlID = oscalToken(nistTagToControlId(req.id));
+	const controlID = oscalToken(nistTagToControlId(req.id ?? ""));
 	const results = req.results ?? [];
 	const descriptions = req.descriptions ?? [];
 	const { state, reason } = effectiveState(req);
@@ -14105,7 +14464,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 			uuid: resourceUuid,
 			title: `Check source code for ${req.id}`,
 			base64: {
-				value: Buffer.from(req.code, "utf-8").toString("base64"),
+				value: encodeBase64Utf8(req.code),
 				"media-type": "text/plain"
 			}
 		};
@@ -14287,14 +14646,7 @@ function sourceLocationText(loc) {
 }
 /** Maps an explicit HDF severity to the OSCAL risk facet value vocabulary. */
 function severityToFacetValue(s) {
-	switch (s) {
-		case "critical": return "critical";
-		case "high": return "high";
-		case "medium": return "moderate";
-		case "low": return "low";
-		case "informational": return "info";
-		default: return "";
-	}
+	return oscalSeverityFromHdf(s);
 }
 /**
 * Turns the requirement's fix description and any governing risk-acceptance
@@ -14380,17 +14732,27 @@ function riskStatusFromState(state) {
 * @returns OSCAL POA&M JSON string
 */
 async function convertHdfToOscalPoam(input) {
-	validateInputSize(input, "hdf-to-oscal-poam");
-	if (!input || input.trim().length === 0) throw new Error("hdf-to-oscal-poam: empty input");
-	let amendments;
-	try {
-		amendments = parseHdf(input);
-	} catch {
-		throw new Error("hdf-to-oscal-poam: failed to parse JSON");
-	}
-	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendments) };
+	const { doc: amendmentsDoc } = requireHdfAmendments(input, "hdf-to-oscal-poam");
+	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendmentsDoc) };
 	return JSON.stringify(doc, null, 2);
 }
+/**
+* Picks the document title, which OSCAL requires on metadata. The HDF name is
+* schema-required, so the fallbacks only matter for a document that slipped
+* through some other producer's validation.
+*/
+function poamTitle(a) {
+	return firstNonEmpty(a.name, a.amendmentId ?? "", "HDF Amendments");
+}
+/**
+* Supplies the text OSCAL requires for a risk's description and statement. HDF
+* puts no minLength on reason, so an override can legitimately carry none; the
+* fallback states that absence rather than inventing an impact assessment the
+* source never made.
+*/
+function riskRationale(override) {
+	return firstNonEmpty(override.reason, `No rationale was recorded for the ${String(override.type)} override applied to ${override.requirementId}.`);
+}
 /** HDF dates arrive as strings from JSON.parse but are typed as Date. */
 function toDate(value) {
 	if (value === void 0) return void 0;
@@ -14408,14 +14770,15 @@ var PartyRegistry = class {
 		this.byId = /* @__PURE__ */ new Map();
 	}
 	getOrAdd(id) {
-		const existing = this.byId.get(id.identifier);
+		const name = oscalString(id.identifier);
+		const existing = this.byId.get(name);
 		if (existing) return existing.uuid;
 		const party = {
 			uuid: crypto.randomUUID(),
 			type: "person",
-			name: id.identifier
+			...name === "" ? {} : { name }
 		};
-		this.byId.set(id.identifier, party);
+		this.byId.set(name, party);
 		return party.uuid;
 	}
 	list() {
@@ -14465,7 +14828,7 @@ function amendmentsToPOAM(amendments) {
 		observations.push(...itemObs);
 	}
 	const metadata = {
-		title: amendments.name,
+		title: poamTitle(amendments),
 		"last-modified": latestAppliedAt(amendments.overrides),
 		version: amendmentsVersion(amendments),
 		"oscal-version": OSCAL_VERSION
@@ -14483,9 +14846,9 @@ function amendmentsToPOAM(amendments) {
 		uuid: crypto.randomUUID(),
 		metadata,
 		"import-ssp": importSSP,
-		risks,
 		"poam-items": poamItems
 	};
+	if (risks.length > 0) poam.risks = risks;
 	if (observations.length > 0) poam.observations = observations;
 	const resources = externalRefResources(amendments.overrides);
 	if (resources.length > 0) poam["back-matter"] = { resources };
@@ -14498,10 +14861,9 @@ function amendmentsToPOAM(amendments) {
 function overrideToPOAMItem(override, parties) {
 	const riskUUID = crypto.randomUUID();
 	const riskStatus = override.status ? hdfStatusToOscalRiskStatus(String(override.status)) : "open";
-	const riskProps = [{
-		name: "impacted-control-id",
-		value: nistTagToControlId(override.requirementId)
-	}];
+	const controlID = nistTagToControlId(override.requirementId);
+	const riskProps = [];
+	pushStringProp(riskProps, "impacted-control-id", controlID);
 	if (override.type) riskProps.push({
 		name: "override-type",
 		value: String(override.type)
@@ -14510,18 +14872,9 @@ function overrideToPOAMItem(override, parties) {
 		name: "impact-override",
 		value: String(override.impact.value)
 	});
-	if (override.justification) riskProps.push({
-		name: "justification",
-		value: String(override.justification)
-	});
-	if (override.baselineRef) riskProps.push({
-		name: "baseline-ref",
-		value: override.baselineRef
-	});
-	if (override.componentRef) riskProps.push({
-		name: "component-ref",
-		value: override.componentRef
-	});
+	if (override.justification) pushStringProp(riskProps, "justification", String(override.justification));
+	if (override.baselineRef) pushStringProp(riskProps, "baseline-ref", override.baselineRef);
+	if (override.componentRef) pushStringProp(riskProps, "component-ref", override.componentRef);
 	const remediations = [];
 	if (override.milestones) for (const ms of override.milestones) {
 		const msProps = [];
@@ -14583,11 +14936,12 @@ function overrideToPOAMItem(override, parties) {
 		itemObs.push(evidenceObservation(ev, obsUUID, collected));
 		relatedObs.push({ "observation-uuid": obsUUID });
 	}
+	const rationale = riskRationale(override);
 	const risk = {
 		uuid: riskUUID,
 		title: override.requirementId,
-		description: override.reason,
-		statement: override.reason,
+		description: rationale,
+		statement: rationale,
 		status: riskStatus,
 		deadline,
 		props: riskProps,
@@ -14622,9 +14976,22 @@ function latestAppliedAt(overrides) {
 	}
 	return formatTimestampSeconds(latest ?? /* @__PURE__ */ new Date());
 }
+/**
+* Add a property whose value OSCAL types as StringDatatype, trimming it and
+* omitting the property entirely when nothing survives. A prop with an empty
+* value carries no more than an absent one and is schema-invalid. Mirrors
+* appendStringProp in the Go peer.
+*/
+function pushStringProp(props, name, value) {
+	const trimmed = oscalString(value ?? "");
+	if (trimmed !== "") props.push({
+		name,
+		value: trimmed
+	});
+}
 /** Sources metadata.version from the amendments document, defaulting when omitted. */
 function amendmentsVersion(a) {
-	return a.version && a.version !== "" ? a.version : "1.0.0";
+	return oscalString(a.version ?? "") || "1.0.0";
 }
 /**
 * Carries document identifiers and labels that have no first-class OSCAL home.
@@ -14632,17 +14999,33 @@ function amendmentsVersion(a) {
 */
 function metadataProps(a) {
 	const props = [];
-	if (a.amendmentId) props.push({
-		name: "amendment-id",
-		value: a.amendmentId
-	});
-	if (a.labels) for (const k of Object.keys(a.labels).sort()) props.push({
-		name: k,
-		value: a.labels[k],
-		class: "amendment-label"
-	});
+	if (a.amendmentId) pushStringProp(props, "amendment-id", a.amendmentId);
+	if (a.labels) for (const [key, value] of Object.entries(a.labels).sort(([x], [y]) => x < y ? -1 : x > y ? 1 : 0)) {
+		const prop = labelProp(key, value);
+		if (prop.value !== "") props.push(prop);
+	}
 	return props;
 }
+/**
+* Render one amendments label as a property. OSCAL types prop/@name as
+* TokenDatatype while HDF puts no constraint on label keys, so the key is
+* encoded and the source key kept in remarks when it had to change. Every label
+* key in this package's converter fixtures is token-shaped today, so this guards a shape real
+* data has not yet produced — but Kubernetes and OCI label keys are namespaced
+* with '/', which HDF permits and OSCAL rejects.
+*
+* Mirrored by labelProp in the Go converter.
+*/
+function labelProp(key, value) {
+	const name = oscalToken(key) === "" ? "_" : oscalToken(key);
+	const prop = {
+		name,
+		value: oscalString(value),
+		class: "amendment-label"
+	};
+	if (key !== "" && name !== key) prop.remarks = key;
+	return prop;
+}
 /** Picks the collection timestamp for evidence observations. */
 function observationCollected(override) {
 	return formatTimestampSeconds(toDate(override.appliedAt) ?? /* @__PURE__ */ new Date());
@@ -14656,14 +15039,8 @@ function evidenceObservation(ev, uuid, defaultCollected) {
 	if (ev.type === "url") re.href = ev.data;
 	else if (ev.data) re.remarks = ev.data;
 	const props = [];
-	if (ev.mimeType) props.push({
-		name: "mime-type",
-		value: ev.mimeType
-	});
-	if (ev.capturedBy && ev.capturedBy.identifier) props.push({
-		name: "captured-by",
-		value: ev.capturedBy.identifier
-	});
+	if (ev.mimeType) pushStringProp(props, "mime-type", ev.mimeType);
+	if (ev.capturedBy && ev.capturedBy.identifier) pushStringProp(props, "captured-by", ev.capturedBy.identifier);
 	return {
 		uuid,
 		description: desc,
@@ -14886,7 +15263,7 @@ function verdictLabels(a) {
 }
 async function convertIonchannelToHdf(input, converterVersion = "1.0.0") {
 	if (!input?.trim()) throw new Error("Empty input");
-	validateInputSize(input, "ionchannel");
+	validateInputSize$1(input, "ionchannel");
 	const analysis = parseJSON(input);
 	if (!Array.isArray(analysis.scan_summaries)) throw new Error(`Ion Channel scan_summaries invalid summary data (expecting array, got ${typeof analysis.scan_summaries})`);
 	let allDeps = [];
@@ -15248,12 +15625,8 @@ function supplierEvidence(sourceURI, description) {
 *
 * Spec: https://github.com/openvex/spec
 */
-/** One year in milliseconds. VEX statements are re-evaluated as new info
-*  arrives; one year is a defensive default consistent with the
-*  no-permanent-amendment rule on Standalone_Override. */
-const DEFAULT_EXPIRY_HORIZON_MS$3 = 365 * 24 * 60 * 60 * 1e3;
 async function convertOpenVexToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "openvex-to-hdf");
+	validateInputSize$1(input, "openvex-to-hdf");
 	const doc = parseJSON(input);
 	const docTime = (doc.timestamp ? parseTimestamp(doc.timestamp) : null) ?? /* @__PURE__ */ new Date();
 	const overrides = [];
@@ -15262,8 +15635,10 @@ async function convertOpenVexToHdf(input, converterVersion = "1.0.0") {
 		if (override) overrides.push(override);
 	}
 	if (overrides.length === 0) throw new Error("openvex-to-hdf: VEX document contains no actionable statements (all 'affected' or 'under_investigation'); no amendment to write");
+	const name = doc.author ? `OpenVEX statements from ${doc.author}` : "OpenVEX statements";
+	await chainOverrides(overrides);
 	return {
-		name: doc.author ? `OpenVEX statements from ${doc.author}` : "OpenVEX statements",
+		name,
 		description: `Imported VEX statements from ${truncateId(doc["@id"] ?? "")}`,
 		overrides,
 		appliedBy: identityFor$2(doc.author, doc.role),
@@ -15283,7 +15658,7 @@ function statementToOverride(stmt, doc, docTime) {
 	if (!requirementId) return void 0;
 	const stmtTime = (stmt.timestamp ? parseTimestamp(stmt.timestamp) : null) ?? docTime;
 	const author = stmt.author ?? doc.author ?? "";
-	const expiresAt = new Date(stmtTime.getTime() + DEFAULT_EXPIRY_HORIZON_MS$3);
+	const expiresAt = defaultOverrideExpiry(stmtTime);
 	const override = {
 		type: target.overrideType,
 		requirementId,
@@ -15343,9 +15718,8 @@ function truncateId(id) {
 *
 * Spec: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html
 */
-const DEFAULT_EXPIRY_HORIZON_MS$2 = 365 * 24 * 60 * 60 * 1e3;
 async function convertCsafVexToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "csaf-vex-to-hdf");
+	validateInputSize$1(input, "csaf-vex-to-hdf");
 	const doc = parseJSON(input);
 	if (doc.document?.category !== "csaf_vex") throw new Error(`csaf-vex-to-hdf: document.category is ${JSON.stringify(doc.document?.category)}; only 'csaf_vex' is supported`);
 	const dm = doc.document;
@@ -15357,6 +15731,7 @@ async function convertCsafVexToHdf(input, converterVersion = "1.0.0") {
 	for (const v of doc.vulnerabilities ?? []) overrides.push(...vulnerabilityToOverrides(v, publisher, tracking, docTime, productLookup));
 	if (overrides.length === 0) throw new Error("csaf-vex-to-hdf: CSAF VEX document contains no actionable statements (only affected/under_investigation/recommended); no amendment to write");
 	const publisherName = publisher.name ?? "";
+	await chainOverrides(overrides);
 	return {
 		name: publisherName ? `CSAF VEX statements from ${publisherName}` : "CSAF VEX statements",
 		description: `Imported VEX advisory ${tracking.id ?? ""}`,
@@ -15389,7 +15764,7 @@ function vulnerabilityToOverrides(vuln, publisher, tracking, docTime, productLoo
 function buildOverride(vuln, publisher, tracking, docTime, canonical, products, productLookup) {
 	const target = importTargetFor(canonical);
 	if (!target) return void 0;
-	const expiresAt = new Date(docTime.getTime() + DEFAULT_EXPIRY_HORIZON_MS$2);
+	const expiresAt = defaultOverrideExpiry(docTime);
 	const override = {
 		type: target.overrideType,
 		requirementId: vuln.cve,
@@ -15560,9 +15935,8 @@ function overlap(ids, scope) {
 *
 * Spec: https://cyclonedx.org/use-cases/#vulnerability-exploitability
 */
-const DEFAULT_EXPIRY_HORIZON_MS$1 = 365 * 24 * 60 * 60 * 1e3;
 async function convertCyclonedxVexToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "cyclonedx-vex-to-hdf");
+	validateInputSize$1(input, "cyclonedx-vex-to-hdf");
 	const bom = parseJSON(input);
 	if (bom.bomFormat !== "CycloneDX") throw new Error(`cyclonedx-vex-to-hdf: bomFormat is ${JSON.stringify(bom.bomFormat)}; only 'CycloneDX' is supported`);
 	const docTime = (bom.metadata?.timestamp ? parseTimestamp(bom.metadata.timestamp) : null) ?? /* @__PURE__ */ new Date();
@@ -15575,9 +15949,12 @@ async function convertCyclonedxVexToHdf(input, converterVersion = "1.0.0") {
 	}
 	if (overrides.length === 0) throw new Error("cyclonedx-vex-to-hdf: BOM contains no actionable VEX statements (only exploitable/in_triage or no analysis); no amendment to write");
 	const publisherName = publisher.identifier;
+	const name = publisherName && publisherName !== "cyclonedx-vex-import" ? `CycloneDX VEX statements from ${publisherName}` : "CycloneDX VEX statements";
+	const description = bom.serialNumber ? `Imported CycloneDX VEX ${bom.serialNumber}` : "Imported CycloneDX VEX";
+	await chainOverrides(overrides);
 	return {
-		name: publisherName && publisherName !== "cyclonedx-vex-import" ? `CycloneDX VEX statements from ${publisherName}` : "CycloneDX VEX statements",
-		description: bom.serialNumber ? `Imported CycloneDX VEX ${bom.serialNumber}` : "Imported CycloneDX VEX",
+		name,
+		description,
 		overrides,
 		appliedBy: publisher,
 		generator: {
@@ -15594,7 +15971,7 @@ function vulnerabilityToOverride(v, productLookup, docTime, publisher) {
 	const target = importTargetFor(canonical);
 	if (!target) return void 0;
 	const affectedPackages = affectedPackagesForVuln(v, productLookup);
-	const expiresAt = new Date(docTime.getTime() + DEFAULT_EXPIRY_HORIZON_MS$1);
+	const expiresAt = defaultOverrideExpiry(docTime);
 	const override = {
 		type: target.overrideType,
 		requirementId: v.id,
@@ -15728,8 +16105,6 @@ function publisherIdentityOrDefault(bom) {
 *
 * Spec: https://spdx.github.io/spdx-spec/v3.0.1/ (security profile)
 */
-/** One year in milliseconds — the override expiresAt horizon. */
-const DEFAULT_EXPIRY_HORIZON_MS = 365 * 24 * 60 * 60 * 1e3;
 /** Fallback system identity when no supplier agent resolves. */
 const DEFAULT_APPLIED_BY = "spdx-vex-import";
 /** The four SPDX-3 VEX assessment relationship subtypes -> canonical status. */
@@ -15740,7 +16115,7 @@ const VEX_STATUS_BY_TYPE = {
 	security_VexUnderInvestigationVulnAssessmentRelationship: VexStatus.UnderInvestigation
 };
 async function convertSpdxVexToHdf(input, converterVersion = "1.0.0") {
-	validateInputSize(input, "spdx-vex-to-hdf");
+	validateInputSize$1(input, "spdx-vex-to-hdf");
 	const graph = parseJSON(input)["@graph"] ?? [];
 	if (graph.length === 0) throw new Error("spdx-vex-to-hdf: document has no @graph elements");
 	const idx = buildIndex(graph);
@@ -15752,8 +16127,10 @@ async function convertSpdxVexToHdf(input, converterVersion = "1.0.0") {
 	}
 	if (overrides.length === 0) throw new Error("spdx-vex-to-hdf: SPDX document contains no actionable VEX statements (only affected/under_investigation); no amendment to write");
 	const appliedBy = documentIdentity(graph, idx);
+	const name = appliedBy.identifier && appliedBy.identifier !== DEFAULT_APPLIED_BY ? `SPDX VEX statements from ${appliedBy.identifier}` : "SPDX VEX statements";
+	await chainOverrides(overrides);
 	return {
-		name: appliedBy.identifier && appliedBy.identifier !== DEFAULT_APPLIED_BY ? `SPDX VEX statements from ${appliedBy.identifier}` : "SPDX VEX statements",
+		name,
 		description: "Imported SPDX 3.0.1 security-profile VEX statements",
 		overrides,
 		appliedBy,
@@ -15800,7 +16177,7 @@ function relationshipToOverride(rel, idx) {
 	const requirementId = cveIdentifier(vuln);
 	if (!requirementId) return void 0;
 	const appliedAt = createdAt(rel.creationInfo, idx) ?? createdAt(vuln?.creationInfo, idx) ?? /* @__PURE__ */ new Date();
-	const expiresAt = new Date(appliedAt.getTime() + DEFAULT_EXPIRY_HORIZON_MS);
+	const expiresAt = defaultOverrideExpiry(appliedAt);
 	const override = {
 		type: target.overrideType,
 		requirementId,
@@ -15897,16 +16274,11 @@ function buildCvss(rel, cve) {
 	return cvss;
 }
 function cvssVersion(relType, vector) {
-	if (vector?.startsWith("CVSS:")) {
-		const rest = vector.slice(5);
-		const slash = rest.indexOf("/");
-		if (slash > 0) switch (rest.slice(0, slash)) {
-			case "2.0": return Version.The20;
-			case "3.0": return Version.The30;
-			case "3.1": return Version.The31;
-			case "4.0": return Version.The40;
-		}
-	}
+	return cvssVersionFromVector(vector, cvssVersionFromRelType(relType));
+}
+/** Fallback when the vector carries no recognized prefix: the relationship
+*  subtype names the CVSS generation. */
+function cvssVersionFromRelType(relType) {
 	if ((relType ?? "").includes("CvssV2")) return Version.The20;
 	if ((relType ?? "").includes("CvssV4")) return Version.The40;
 	return Version.The31;
@@ -15965,7 +16337,7 @@ function isCvssType(type) {
 const GO_ZERO_TIME$1 = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 const CVE_ID_PATTERN$2 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$2 = /^Products:\s*(.+)$/m;
-const DEFAULT_PRODUCT_ID$2 = "HDFPID-0001";
+const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
 /** Map an HDF Cvss block to a CSAF score entry (cvss_v2/v3/v4 by version). */
 function buildCsafScore(cvss, products) {
 	const inner = {
@@ -15981,7 +16353,7 @@ function buildCsafScore(cvss, products) {
 	};
 }
 function convertHdfToCsafVex(input, converterVersion) {
-	validateInputSize(input, "hdf-to-csaf-vex");
+	validateInputSize$1(input, "hdf-to-csaf-vex");
 	const amendments = parseHdf(input);
 	const groups = groupByCVE(amendments.overrides ?? []);
 	const registry = /* @__PURE__ */ new Map();
@@ -16000,8 +16372,8 @@ function convertHdfToCsafVex(input, converterVersion) {
 	const doc = buildDocument(amendments, converterVersion);
 	doc.vulnerabilities = vulnerabilities;
 	doc.product_tree.full_product_names = names.length > 0 ? names : [{
-		name: DEFAULT_PRODUCT_ID$2,
-		product_id: DEFAULT_PRODUCT_ID$2
+		name: DEFAULT_PRODUCT_ID$1,
+		product_id: DEFAULT_PRODUCT_ID$1
 	}];
 	return JSON.stringify(doc, null, 2);
 }
@@ -16054,8 +16426,8 @@ function productEntriesFor(o) {
 		}));
 	}
 	return [{
-		name: DEFAULT_PRODUCT_ID$2,
-		product_id: DEFAULT_PRODUCT_ID$2
+		name: DEFAULT_PRODUCT_ID$1,
+		product_id: DEFAULT_PRODUCT_ID$1
 	}];
 }
 /** product_tree entries for the synthesized fixed-version products. */
@@ -16094,18 +16466,36 @@ function productIDsFor$1(o) {
 		const parts = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 		if (parts.length > 0) return parts;
 	}
-	return [DEFAULT_PRODUCT_ID$2];
+	return [DEFAULT_PRODUCT_ID$1];
 }
 function stripProductsLine$1(reason) {
 	return reason.replace(PRODUCTS_LINE$2, "").replace(/\n+$/, "");
 }
 /**
+* Fill CSAF references[].summary, which is required with minLength 1 while the
+* HDF description backing it is optional. The URL is the documented fallback:
+* the only text a reference always carries, where a placeholder would assert a
+* description the source never gave.
+*/
+function referenceSummary(description, url) {
+	return firstNonEmpty(description, url);
+}
+/**
+* The override reason with the machine-written 'Products:' line removed, or ''
+* when no prose remains. Both sinks it feeds — threats[].details and
+* notes[].text — are minLength 1 in CSAF, so an empty result means the element
+* is omitted, never emitted blank.
+*/
+function reasonProse(reason) {
+	return firstNonEmpty(stripProductsLine$1(reason ?? ""));
+}
+/**
 * Surface the override reason prose as a CSAF description note. Used on the
 * not_affected/fixed paths, which otherwise drop reason (the affected path
 * keeps it as threats[impact]).
 */
 function appendReasonNote(v, reason) {
-	const text = stripProductsLine$1(reason ?? "");
+	const text = reasonProse(reason);
 	if (!text) return;
 	v.notes = v.notes ?? [];
 	v.notes.push({
@@ -16182,11 +16572,12 @@ function buildVulnerability(group) {
 			emitted = true;
 		} else if (canonical === VexStatus.Affected) {
 			status.known_affected = (status.known_affected ?? []).concat(pids);
-			if (o.reason) {
+			const details = reasonProse(o.reason);
+			if (details) {
 				v.threats = v.threats ?? [];
 				v.threats.push({
 					category: "impact",
-					details: stripProductsLine$1(o.reason),
+					details,
 					product_ids: pids
 				});
 			}
@@ -16208,7 +16599,7 @@ function buildVulnerability(group) {
 			v.references = v.references ?? [];
 			v.references.push({
 				category: "external",
-				summary: e.description ?? "",
+				summary: referenceSummary(e.description, e.data),
 				url: e.data
 			});
 		}
@@ -16217,7 +16608,7 @@ function buildVulnerability(group) {
 			v.references = v.references ?? [];
 			v.references.push({
 				category: "external",
-				summary: r.description ?? "",
+				summary: referenceSummary(r.description, r.href),
 				url: r.href
 			});
 		}
@@ -16239,7 +16630,7 @@ function buildVulnerability(group) {
 	return {
 		cve: v.cve,
 		...v.notes && { notes: v.notes },
-		product_status: status,
+		...Object.keys(status).length > 0 && { product_status: status },
 		...v.flags && { flags: v.flags },
 		...v.threats && { threats: v.threats },
 		...v.remediations && { remediations: v.remediations },
@@ -16319,9 +16710,8 @@ const CVE_ID_PATTERN$1 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$1 = /^Products:\s*(.+)$/m;
 const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 const OPENVEX_NAMESPACE = "https://openvex.dev/docs/public/";
-const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
 async function convertHdfToOpenVex(input, converterVersion) {
-	validateInputSize(input, "hdf-to-openvex");
+	validateInputSize$1(input, "hdf-to-openvex");
 	const amendments = parseHdf(input);
 	const author = amendments.appliedBy?.identifier || "HDF Amendments Export";
 	const role = amendments.appliedBy?.description;
@@ -16361,19 +16751,12 @@ function overrideToStatement(o, docAuthor) {
 	if (o.type === OverrideType.Poam && canonical === VexStatus.Affected && allMilestonesCompleted$1(o)) canonical = VexStatus.Fixed;
 	const notAffected = canonical === VexStatus.NotAffected;
 	const justification = notAffected && o.justification ? String(o.justification) : "";
-	const reason = stripProductsLine(o.reason ?? "");
-	const impact = notAffected ? reason : "";
+	const reason = firstNonEmpty(stripProductsLine(o.reason ?? ""));
+	const impact = notAffected ? firstNonEmpty(reason, justification ? "" : noImpactRationaleRecorded(o)) : "";
 	let action = "";
-	let reasonEmitted = notAffected && impact !== "";
-	if (canonical === VexStatus.Fixed) action = firstMilestoneAction(o) || "Fix applied; consumer re-scan confirmed clean.";
-	else if (canonical === VexStatus.Affected) {
-		action = firstMilestoneAction(o);
-		if (!action) {
-			action = reason;
-			reasonEmitted = reason !== "";
-		}
-	}
-	const statusNotes = buildStatusNotes(o, reason, reasonEmitted, docAuthor);
+	if (canonical === VexStatus.Fixed) action = firstNonEmpty(firstMilestoneAction(o), "Fix applied; consumer re-scan confirmed clean.");
+	else if (canonical === VexStatus.Affected) action = firstNonEmpty(firstMilestoneAction(o), reason, noRemediationRecorded(o));
+	const statusNotes = buildStatusNotes(o, reason, reason !== "" && (impact === reason || action === reason), docAuthor);
 	return {
 		vulnerability: {
 			"@id": `https://nvd.nist.gov/vuln/detail/${o.requirementId}`,
@@ -16420,12 +16803,26 @@ function productsFor(o) {
 		const m = PRODUCTS_LINE$1.exec(o.reason ?? "");
 		if (m && m[1]) ids = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 	}
-	if (ids.length === 0) ids = [DEFAULT_PRODUCT_ID$1];
+	if (ids.length === 0) return void 0;
 	return ids.map((id) => ({ "@id": id }));
 }
+/**
+* States the absence OpenVEX has no other way to express: action_statement is
+* required on an affected statement, and a source override may carry neither a
+* milestone nor a reason to fill it.
+*/
+function noRemediationRecorded(o) {
+	return `No remediation action was recorded for the ${String(o.type)} override applied to ${o.requirementId}.`;
+}
+/**
+* The not_affected peer of noRemediationRecorded, for an override carrying
+* neither a justification enum nor a reason.
+*/
+function noImpactRationaleRecorded(o) {
+	return `No impact rationale was recorded for the ${String(o.type)} override applied to ${o.requirementId}.`;
+}
 function firstMilestoneAction(o) {
-	for (const m of o.milestones ?? []) if (m.description) return m.description;
-	return "";
+	return firstNonEmpty(...(o.milestones ?? []).map((m) => m.description));
 }
 function allMilestonesCompleted$1(o) {
 	if (!o.milestones || o.milestones.length === 0) return false;
@@ -16512,7 +16909,7 @@ function buildCdxRating(cvss) {
 	return rating;
 }
 async function convertHdfToCyclonedxVex(input, converterVersion) {
-	validateInputSize(input, "hdf-to-cyclonedx-vex");
+	validateInputSize$1(input, "hdf-to-cyclonedx-vex");
 	const amendments = parseHdf(input);
 	const componentRegistry = /* @__PURE__ */ new Map();
 	const vulnerabilities = [];
@@ -16712,7 +17109,7 @@ function detectOscalDocumentType(input) {
 * @returns HDF Baseline JSON string
 */
 async function convertOscalCatalogToHdf(input) {
-	validateInputSize(input, "oscal-catalog");
+	validateInputSize$1(input, "oscal-catalog");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc.catalog) throw new Error("oscal-catalog: input is not a catalog document (root key is not 'catalog')");
@@ -16833,7 +17230,7 @@ function catalogBaselineName(catalog) {
 * @returns HDF Baseline JSON string
 */
 async function convertOscalComponentToHdf(input) {
-	validateInputSize(input, "oscal-component-definition");
+	validateInputSize$1(input, "oscal-component-definition");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc["component-definition"]) throw new Error("oscal-component-definition: input is not a component-definition document (root key is not 'component-definition')");
@@ -16902,7 +17299,7 @@ function componentBaselineName(comp, compDef) {
 * @returns HDF Amendments JSON string
 */
 async function convertOscalPoamToHdf(input) {
-	validateInputSize(input, "oscal-poam");
+	validateInputSize$1(input, "oscal-poam");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc["plan-of-action-and-milestones"]) throw new Error("oscal-poam: input is not a plan-of-action-and-milestones document (root key is not 'plan-of-action-and-milestones')");
@@ -16914,6 +17311,7 @@ async function convertOscalPoamToHdf(input) {
 	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
 	const systemRef = poam["import-ssp"]?.href || void 0;
 	const appliedBy = extractAppliedBy(poam.metadata);
+	await chainOverrides(overrides);
 	return serializeHdf({
 		name: toKebabCase(poam.metadata.title, "oscal-poam"),
 		overrides,
@@ -16973,27 +17371,27 @@ function poamItemStatus(item, riskMap) {
 			const risk = riskMap.get(riskUuid);
 			if (risk) {
 				const status = oscalStatusToHdf(risk.status);
-				if (status === "passed") return "passed";
-				if (status === "failed") return "failed";
+				if (status === "passed") return ResultStatus.Passed;
+				if (status === "failed") return ResultStatus.Failed;
 			}
 		}
 	}
-	return "failed";
+	return ResultStatus.Failed;
 }
 function poamItemAppliedBy(poam) {
 	const rps = poam.metadata["responsible-parties"];
 	if (rps) {
 		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: "simple",
+			type: IdentityType.Simple,
 			identifier: rp["party-uuids"][0]
 		};
 		if (rps.length > 0 && rps[0]["party-uuids"].length > 0) return {
-			type: "simple",
+			type: IdentityType.Simple,
 			identifier: rps[0]["party-uuids"][0]
 		};
 	}
 	return {
-		type: "system",
+		type: IdentityType.System,
 		identifier: "oscal-poam-converter"
 	};
 }
@@ -17029,7 +17427,7 @@ function extractMilestones(item, riskMap) {
 				milestones.push({
 					description: task.description ? `${task.title}: ${task.description}` : task.title,
 					estimatedCompletion,
-					status: "pending"
+					status: MilestoneStatus.Pending
 				});
 			}
 		}
@@ -17040,7 +17438,7 @@ function extractAppliedBy(meta) {
 	const rps = meta["responsible-parties"];
 	if (rps) {
 		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: "simple",
+			type: IdentityType.Simple,
 			identifier: rp["party-uuids"][0]
 		};
 	}
@@ -17059,7 +17457,7 @@ function extractAppliedBy(meta) {
 * @returns HDF Plan JSON string
 */
 async function convertOscalSapToHdf(input) {
-	validateInputSize(input, "oscal-assessment-plan");
+	validateInputSize$1(input, "oscal-assessment-plan");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc["assessment-plan"]) throw new Error("oscal-assessment-plan: input is not an assessment-plan document (root key is not 'assessment-plan')");
@@ -17189,7 +17587,7 @@ function buildPlanDescription(ap) {
 * @returns HDF Results JSON string
 */
 async function convertOscalSarToHdf(input) {
-	validateInputSize(input, "oscal-assessment-results");
+	validateInputSize$1(input, "oscal-assessment-results");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc["assessment-results"]) throw new Error("oscal-assessment-results: input is not an assessment-results document (root key is not 'assessment-results')");
@@ -17498,7 +17896,7 @@ function sarBaselineName(result, sar) {
 * @returns HDF System JSON string
 */
 async function convertOscalSspToHdf(input) {
-	validateInputSize(input, "oscal-ssp");
+	validateInputSize$1(input, "oscal-ssp");
 	if (!input || input.trim().length === 0) throw new Error("empty input");
 	const doc = parseJSON(input);
 	if (!doc["system-security-plan"]) throw new Error("oscal-ssp: input is not a system-security-plan document (root key is not 'system-security-plan')");
@@ -17675,7 +18073,7 @@ function mapOSCALComponentType(oscalType) {
 * @returns HDF Baseline JSON string
 */
 async function convertOscalProfileToHdf(profileInput, catalogInput) {
-	validateInputSize(profileInput, "oscal-profile");
+	validateInputSize$1(profileInput, "oscal-profile");
 	if (!profileInput || profileInput.trim().length === 0) throw new Error("empty profile input");
 	if (!catalogInput || catalogInput.trim().length === 0) throw new Error("empty catalog input");
 	const profileDoc = parseJSON(profileInput);
@@ -17872,8 +18270,8 @@ function toRfc3339(d) {
 * TypeScript peer of shared/go/enrich_stix.go (kept at parity).
 */
 function enrichStix(resultsInput, bundleInput, opts) {
-	validateInputSize(resultsInput, "enrich-stix", opts?.maxSize);
-	validateInputSize(bundleInput, "enrich-stix", opts?.maxSize);
+	validateInputSize$1(resultsInput, "enrich-stix", opts?.maxSize);
+	validateInputSize$1(bundleInput, "enrich-stix", opts?.maxSize);
 	if (!resultsInput) throw new Error("enrich-stix: empty results input");
 	const bundle = parseStixBundle(bundleInput);
 	let parsed;