@mitre/hdf-converters 3.6.0 → 3.7.0

package/dist/index.js

@@ -1,8 +1,8 @@
-import { n as detectFormat, r as detectConverter, t as registerAllFingerprints } from "./register-all-CDfYvwQF.js";
+import { n as detectFormat, o as isCheckovTestCaseName, r as detectConverter, t as registerAllFingerprints } from "./register-all-BEuKQGEZ.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { DEFAULT_MAX_INPUT_SIZE, buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
+import { buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
-import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistToCci } from "@mitre/hdf-mappings";
+import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, SUPPORTED_NIST_REVISIONS, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCheckovCciNistMapping, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistExists, nistToCci, normalizeNistId } from "@mitre/hdf-mappings";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
 //#region ../hdf-validators/dist/index.js
@@ -250,6 +250,13 @@ function limitArray(items, maxItems = DEFAULT_MAX_ITEMS) {
 	};
 }
 /**
+* Emit a non-fatal converter warning as "WARNING: <message>" on stderr, the
+* TypeScript counterpart of Go's log.Printf("WARNING: ...").
+*/
+function emitConverterWarning(message) {
+	console.warn(`WARNING: ${message}`);
+}
+/**
 * Limit an array and log a warning if truncated.
 *
 * Wraps {@link limitArray} with a console.warn call when items are truncated.
@@ -261,7 +268,7 @@ function limitArray(items, maxItems = DEFAULT_MAX_ITEMS) {
 */
 function limitArrayWithWarning(items, label, maxItems = DEFAULT_MAX_ITEMS) {
 	const { items: limited, truncated } = limitArray(items, maxItems);
-	if (truncated) console.warn(`WARNING: Input truncated at ${limited.length} ${label} items (original: ${items.length})`);
+	if (truncated) emitConverterWarning(`Input truncated at ${limited.length} ${label} items (original: ${items.length})`);
 	return limited;
 }
 /**
@@ -323,10 +330,9 @@ function firstNonEmpty(...candidates) {
 * converter name prefixed onto the error. A non-positive maxSize means "use
 * the default" (an explicitly-passed 0 never rejects all non-empty input).
 */
-function validateInputSize$1(input, converterName, maxSize = DEFAULT_MAX_INPUT_SIZE) {
-	const limit = maxSize > 0 ? maxSize : DEFAULT_MAX_INPUT_SIZE;
+function validateInputSize$1(input, converterName, maxSize = 0) {
 	try {
-		validateInputSize(input, limit);
+		validateInputSize(input, maxSize);
 	} catch (err) {
 		throw new Error(`${converterName}: ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -747,6 +753,24 @@ function typeViolations(result) {
 * - Results: snake_case → camelCase for all fields
 * - Overlay flattening: merge overlay/wrapper baselines so every requirement has results
 */
+/** Reserved passthrough key for the components round-trip carrier. */
+const RESERVED_COMPONENTS_KEY = "hdf_components";
+/**
+* Copy provenance into a null-prototype object, keeping only own enumerable keys
+* and dropping the reserved carrier key. A null prototype makes `__proto__`/
+* `constructor` entries plain data rather than a prototype-pollution vector, and
+* only a plain (non-array) object is treated as provenance. Returns undefined
+* when there is nothing to carry.
+*/
+function sanitizeProvenance(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return;
+	const out = Object.create(null);
+	for (const [key, value] of Object.entries(raw)) {
+		if (key === RESERVED_COMPONENTS_KEY) continue;
+		out[key] = value;
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
 /**
 * Convert tags.severity string to a valid severity value.
 * Returns null if the value is not a recognized severity.
@@ -813,7 +837,7 @@ function convertResult(v1Result) {
 	if (v1Result.exception !== void 0) v2Result.exception = v1Result.exception;
 	if (v1Result.backtrace !== void 0) v2Result.backtrace = v1Result.backtrace;
 	if (v1Result.resource_class !== void 0) v2Result.resource = v1Result.resource_class;
-	if (v1Result.resource_id !== void 0) v2Result.resourceId = v1Result.resource_id;
+	if (v1Result.resource_id !== void 0 && v1Result.resource_id !== null) v2Result.resourceId = typeof v1Result.resource_id === "string" ? v1Result.resource_id : canonicalJson(v1Result.resource_id);
 	return v2Result;
 }
 /**
@@ -879,7 +903,12 @@ function convertControl(v1Control) {
 		impact: v1Control.impact
 	};
 	if (v1Control.title !== void 0) v2Req.title = v1Control.title;
-	if (v1Control.descriptions !== void 0) v2Req.descriptions = v1Control.descriptions;
+	const descriptions = [...v1Control.descriptions ?? []];
+	if (!descriptions.some((d) => d.label === "default")) descriptions.unshift({
+		label: "default",
+		data: v1Control.desc ?? ""
+	});
+	v2Req.descriptions = descriptions;
 	if (v1Control.tags !== void 0) v2Req.tags = v1Control.tags;
 	if (v1Control.code !== void 0) v2Req.code = v1Control.code;
 	if (Array.isArray(v1Control.refs)) {
@@ -1087,6 +1116,7 @@ function convertLegacyHdf(v1Data, converterVersion = "1.0.0") {
 		}
 		v2.components = [component];
 	}
+	if (Array.isArray(v1Data.passthrough?.hdf_components) && v1Data.passthrough.hdf_components.length > 0) v2.components = v1Data.passthrough.hdf_components;
 	v2.generator = v1Data.generator ?? {
 		name: "legacyhdf-to-hdf",
 		version: converterVersion
@@ -1094,13 +1124,15 @@ function convertLegacyHdf(v1Data, converterVersion = "1.0.0") {
 	v2.tool = toolIdentity(v1Data.version);
 	const timestamp = documentTimestamp(v1Data);
 	if (timestamp) v2.timestamp = timestamp;
+	const carriedProvenance = sanitizeProvenance(v1Data.passthrough);
 	const knownV1Fields = /* @__PURE__ */ new Set([
 		"version",
 		"platform",
 		"profiles",
 		"statistics",
 		"generator",
-		"timestamp"
+		"timestamp",
+		"passthrough"
 	]);
 	const extensionFields = {};
 	for (const [key, value] of Object.entries(v1Data)) if (!knownV1Fields.has(key)) extensionFields[key] = value;
@@ -1108,6 +1140,10 @@ function convertLegacyHdf(v1Data, converterVersion = "1.0.0") {
 		...extensionFields,
 		v1_version: v1Data.version
 	};
+	if (carriedProvenance) v2.extensions = {
+		...v2.extensions ?? {},
+		passthrough: carriedProvenance
+	};
 	return flattenOverlays(v2).results;
 }
 /**
@@ -1537,7 +1573,8 @@ function buildBaseline$1(name, findings, resultsChecksum) {
 			groups.set(id, [f]);
 		}
 	}
-	return createMinimalBaseline(name, order.map((id) => buildRequirement$19(id, groups.get(id))), { resultsChecksum });
+	const requirements = order.map((id) => buildRequirement$19(id, groups.get(id)));
+	return createMinimalBaseline(name, requirements, { resultsChecksum });
 }
 /** Converts an ASFF document to HDF Results JSON. */
 async function convertAsffToHdf(input, converterVersion = "1.0.0") {
@@ -1983,14 +2020,16 @@ async function convertJunitToHdf(input, converterVersion = "1.0.0") {
 	if (!input || !input.trim()) throw new Error("Empty input");
 	validateInputSize$1(input, "junit");
 	const { suites, name } = parseJUnitXML(input);
+	warnIfCheckov(suites);
 	const scanTime = resolveScanTime(suites);
 	const requirements = buildRequirements(suites, scanTime);
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("junit-no-findings", `JUnit scanned ${noFindingsTarget(name, suites)} and reported zero findings.`, scanTime));
+	const resultsChecksum = await inputChecksum(input);
 	return buildHdfResults({
 		generatorName: "junit-to-hdf",
 		converterVersion,
 		toolName: "JUnit XML",
-		baselines: [createMinimalBaseline(name, requirements, { resultsChecksum: await inputChecksum(input) })],
+		baselines: [createMinimalBaseline(name, requirements, { resultsChecksum })],
 		components: [{
 			type: TargetType.Application,
 			name
@@ -1998,6 +2037,10 @@ async function convertJunitToHdf(input, converterVersion = "1.0.0") {
 		timestamp: scanTime
 	});
 }
+const CHECKOV_JUNIT_WARNING = "input looks like Checkov JUnit XML. junit-to-hdf keeps only Checkov's display strings and drops the check_id, severity and guideline that control mappings key on; re-run Checkov with -o json and convert that output with checkov-to-hdf instead.";
+function warnIfCheckov(suites) {
+	if (suites.some((suite) => (suite.testcase ?? []).some((tc) => isCheckovTestCaseName(String(tc["@_name"] ?? ""))))) emitConverterWarning(CHECKOV_JUNIT_WARNING);
+}
 function hostComponents(suites) {
 	const hosts = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -2020,10 +2063,19 @@ function resolveScanTime(suites) {
 	}
 	return /* @__PURE__ */ new Date();
 }
+function flattenSuites(suites) {
+	const out = [];
+	for (const suite of suites) {
+		const { testsuite: nested, ...rest } = suite;
+		out.push(rest);
+		if (nested) out.push(...flattenSuites(nested));
+	}
+	return out;
+}
 function parseJUnitXML(input) {
 	const parsed = parseXmlWithArrays(input, ARRAY_TAGS$2, { attributeNamePrefix: "@_" });
 	if (parsed.testsuites) {
-		const suites = [...parsed.testsuites.testsuite ?? []];
+		const suites = flattenSuites(parsed.testsuites.testsuite ?? []);
 		const name = parsed.testsuites["@_name"] ? decodeXmlEntities$6(parsed.testsuites["@_name"]) : "JUnit Test Results";
 		const looseCases = parsed.testsuites.testcase ?? [];
 		if (looseCases.length > 0) suites.push({
@@ -2037,11 +2089,12 @@ function parseJUnitXML(input) {
 	}
 	if (parsed.testsuite) {
 		const suite = parsed.testsuite;
-		const suites = Array.isArray(suite) ? suite : [suite];
-		const suiteName = suites[0]?.["@_name"];
+		const rootSuites = Array.isArray(suite) ? suite : [suite];
+		const suiteName = rootSuites[0]?.["@_name"];
+		const name = suiteName ? decodeXmlEntities$6(suiteName) : "JUnit Test Results";
 		return {
-			suites,
-			name: suiteName ? decodeXmlEntities$6(suiteName) : "JUnit Test Results"
+			suites: flattenSuites(rootSuites),
+			name
 		};
 	}
 	throw new Error("Input is not a JUnit XML document: expected <testsuites> or <testsuite> root element");
@@ -2949,7 +3002,11 @@ function cklVulnToModel(v) {
 }
 /** Serialize the Checklist model to CKL XML (with declaration). */
 function serializeCkl(cl) {
-	return `<?xml version="1.0" encoding="UTF-8"?>\n${buildXml({ CHECKLIST: {
+	if (cl.stigs.length === 0) throw new Error("serialize ckl: checklist has no stigs");
+	cl.stigs.forEach((s, i) => {
+		if (s.vulns.length === 0) throw new Error(`serialize ckl: stig ${i + 1} has no rules`);
+	});
+	const xmlObj = { CHECKLIST: {
 		ASSET: {
 			ROLE: cl.asset.role || "None",
 			ASSET_TYPE: cl.asset.assetType || "Computing",
@@ -2968,7 +3025,8 @@ function serializeCkl(cl) {
 			STIG_INFO: { SI_DATA: stigInfoSiData(s) },
 			VULN: s.vulns.map(modelVulnToCkl)
 		})) }
-	} }, BUILD_OPTIONS$1)}`;
+	} };
+	return `<?xml version="1.0" encoding="UTF-8"?>\n${buildXml(xmlObj, BUILD_OPTIONS$1)}`;
 }
 function stigInfoSiData(s) {
 	return [
@@ -3121,6 +3179,10 @@ function cklbRuleToModel(r) {
 }
 /** Serialize the Checklist model to CKLB JSON. */
 function serializeCklb(cl) {
+	if (cl.stigs.length === 0) throw new Error("serialize cklb: checklist has no stigs");
+	cl.stigs.forEach((s, i) => {
+		if (s.vulns.length === 0) throw new Error(`serialize cklb: stig ${i + 1} has no rules`);
+	});
 	const doc = {
 		title: cklbTitle(cl),
 		cklb_version: cl.cklbVersion || "1.0",
@@ -3150,7 +3212,7 @@ function serializeCklb(cl) {
 			uuid: s.uuid ?? "",
 			...s.referenceIdentifier ? { reference_identifier: s.referenceIdentifier } : {},
 			rules: s.vulns.map((v) => ({
-				group_id: v.groupID || v.vulnNum,
+				group_id: v.groupID || v.vulnNum || "",
 				group_title: v.groupTitle ?? "",
 				rule_id: v.ruleID ?? "",
 				rule_version: v.ruleVer ?? "",
@@ -3208,7 +3270,8 @@ function checklistToHdf(cl, resultsChecksum, generatorName) {
 	return hdf;
 }
 function stigToBaseline(s, resultsChecksum, scanTime) {
-	const baseline = createMinimalBaseline("STIG Checklist Scan", s.vulns.map((v) => vulnToRequirement(v, scanTime)), { resultsChecksum });
+	const requirements = s.vulns.map((v) => vulnToRequirement(v, scanTime));
+	const baseline = createMinimalBaseline("STIG Checklist Scan", requirements, { resultsChecksum });
 	if (s.title) baseline.title = s.title;
 	if (s.version) baseline.version = s.version;
 	const ext = baselineExtensions(s);
@@ -3344,6 +3407,9 @@ function requirementEffectiveStatus(req) {
 function hdfToChecklist(input) {
 	const hdf = requireHdfResults(input, "hdf to checklist").doc;
 	if (hdf.baselines.length === 0) throw new Error("hdf to checklist: HDF has no baselines");
+	hdf.baselines.forEach((bl, i) => {
+		if (!bl || !Array.isArray(bl.requirements) || bl.requirements.length === 0) throw new Error(`hdf to checklist: baseline ${i + 1} has no requirements`);
+	});
 	const ext = hdf.extensions ?? {};
 	const format = strVal(ext, "checklistFormat") || "ckl";
 	const cklbVersion = strVal(ext, "cklbVersion");
@@ -3470,7 +3536,7 @@ function formatOverride(o) {
 }
 function overrideSeverity(req) {
 	for (const o of req.statusOverrides ?? []) if (o.impact) return {
-		severity: cklSeverityFromImpact(o.impact.value) || "low",
+		severity: cklSeverityOrFloor(o.impact.value),
 		justification: o.reason ?? ""
 	};
 	return {
@@ -3487,11 +3553,14 @@ function cklSeverityFromImpact(impact) {
 		default: return "";
 	}
 }
+function cklSeverityOrFloor(impact) {
+	return cklSeverityFromImpact(impact) || "low";
+}
 function resolveSeverity(req, tags) {
 	const tagSev = strVal(tags, "severity");
 	if (tagSev) return tagSev;
 	if (req.severity) return String(req.severity).toLowerCase();
-	return cklSeverityFromImpact(req.impact ?? 0);
+	return cklSeverityOrFloor(req.impact ?? 0);
 }
 function resolveCcis(tags) {
 	const direct = strSlice(tags, "cci");
@@ -4120,9 +4189,10 @@ async function convertSemgrepToHdf(input, converterVersion = "1.0.0") {
 	}
 	if (report.errors.length > 0) requirements.push(buildErrorsRequirement(report.errors, startTime));
 	requirements.push(buildCoverageRequirement(report, groups.size, startTime));
+	const resultsChecksum = await inputChecksum(input);
 	const baseline = createMinimalBaseline("Semgrep Scan", requirements, {
 		title: "Semgrep static analysis scan",
-		resultsChecksum: await inputChecksum(input)
+		resultsChecksum
 	});
 	return buildHdfResults({
 		generatorName: "semgrep-to-hdf",
@@ -4363,9 +4433,10 @@ function convertSingleProject(report, resultsChecksum, scanTime) {
 		const target = report.projectName ?? report.path ?? "project";
 		requirements.push(buildNoFindingsRequirement("snyk-no-findings", `Snyk scanned ${target} and reported zero vulnerable components.`, scanTime));
 	}
+	const title = `Snyk Project: ${report.projectName ?? ""} Snyk Path: ${report.path ?? ""}`;
 	return createMinimalBaseline("Snyk Scan", requirements, {
 		resultsChecksum,
-		title: `Snyk Project: ${report.projectName ?? ""} Snyk Path: ${report.path ?? ""}`,
+		title,
 		summary: report.summary
 	});
 }
@@ -4558,7 +4629,8 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 		message,
 		startTime
 	};
-	const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS));
+	const cciTags = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
+	const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, cciTags);
 	markUnratedSeverity(tags, severity);
 	const requirement = {
 		id: isIgnored ? `Grype-Ignored-Match/${cveId}` : `Grype/${cveId}`,
@@ -4597,8 +4669,13 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	if (kev) requirement.kev = kev;
 	return requirement;
 }
+function grypeTargetName(target) {
+	if (typeof target === "string") return target || "Grype Scan";
+	return target?.userInput || "Grype Scan";
+}
 function buildComponent$2(report, targetName) {
-	const t = report.source?.target;
+	const rawTarget = report.source?.target;
+	const t = typeof rawTarget === "object" ? rawTarget : void 0;
 	const firstRepoDigest = t?.repoDigests?.find((d) => d);
 	const firstTag = t?.tags?.find((tag) => tag);
 	const isImage = Boolean(t && (t.imageID || t.manifestDigest || firstRepoDigest || firstTag));
@@ -4625,7 +4702,7 @@ async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 	const resultsChecksum = await inputChecksum(input);
 	const grypeData = parseJSON(input);
 	const requirements = [];
-	const targetName = grypeData.source?.target?.userInput || "Grype Scan";
+	const targetName = grypeTargetName(grypeData.source?.target);
 	const scanTime = grypeData.descriptor?.timestamp ? parseTimestamp(grypeData.descriptor.timestamp) : null;
 	const resultStart = scanTime ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	if (grypeData.matches && grypeData.matches.length > 0) {
@@ -5680,10 +5757,13 @@ function buildResult(r) {
 	const q = r.EvaluationResultIdentifier.EvaluationResultQualifier;
 	const status = mapComplianceStatus(r.ComplianceType);
 	const codeDesc = buildCodeDesc$8(q);
-	return createResult(status, buildResultMessage(codeDesc, r.Annotation, status), {
+	const message = buildResultMessage(codeDesc, r.Annotation, status);
+	const startTime = (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
+	const runTime = computeRunTime$1(r.ConfigRuleInvokedTime, r.ResultRecordedTime);
+	return createResult(status, message, {
 		codeDesc,
-		startTime: (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z"),
-		runTime: computeRunTime$1(r.ConfigRuleInvokedTime, r.ResultRecordedTime)
+		startTime,
+		runTime
 	});
 }
 /**
@@ -5747,8 +5827,9 @@ async function convertAwsConfigToHdf(input, converterVersion = "1.0.0") {
 	/* v8 ignore next -- truncation only triggers with >100K items */
 	if (truncatedRules) console.warn(`WARNING: Input truncated at ${limitedRules.length} ConfigRule items (original: ${data.ConfigRules.length})`);
 	checkRevisionAlignment(limitedRules);
+	const requirements = limitedRules.map(buildRequirement$15);
 	const baseline = {
-		...createMinimalBaseline("AWS Config", limitedRules.map(buildRequirement$15), { resultsChecksum }),
+		...createMinimalBaseline("AWS Config", requirements, { resultsChecksum }),
 		title: "AWS Config Compliance Results",
 		version: "1.0.0",
 		maintainer: "Amazon Web Services"
@@ -5826,11 +5907,25 @@ function renderCodeBlock(codeBlock) {
 /**
 * Converts a group of checks sharing a check_id into one EvaluatedRequirement.
 */
+/**
+* Resolves a check's NIST controls and CCIs from the Checkov mapping dataset,
+* falling back to the static-analysis controls when unmapped. Mirrors Go's controlsFor.
+*/
+function controlsFor(checkId) {
+	const mapping = getCheckovCciNistMapping(checkId);
+	if (mapping && mapping.nist.length > 0) return mapping;
+	const fallback = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+	return {
+		nist: fallback,
+		cci: nistToCci(fallback)
+	};
+}
 function buildRequirement$14(checkId, group, scanTime) {
 	const checks = group.map((c) => c.check);
 	const rep = checks[0];
 	const impact = getImpact$8(rep.severity);
-	const tags = { nist: [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS] };
+	const { nist, cci } = controlsFor(checkId);
+	const tags = buildNistCciTags(nist, cci);
 	const checkTypes = [...new Set(group.map((c) => c.checkType).filter((t) => t !== ""))].sort();
 	if (checkTypes.length > 0) tags["check_type"] = checkTypes;
 	if (rep.bc_check_id) tags["bc_check_id"] = rep.bc_check_id;
@@ -5853,7 +5948,7 @@ function buildRequirement$14(checkId, group, scanTime) {
 		if (Array.isArray(rep.file_line_range) && typeof rep.file_line_range[0] === "number") loc.line = rep.file_line_range[0];
 		req.sourceLocation = loc;
 	}
-	const controlType = deriveControlTypeFromTags([...DEFAULT_STATIC_ANALYSIS_NIST_TAGS]);
+	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	return req;
 }
@@ -6358,7 +6453,8 @@ async function convertZapToHdf(input, converterVersion = "1.0.0") {
 			requirements.push(buildNoFindingsRequirement("zap-no-findings", `OWASP ZAP scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
 		}
 		const baselineTitle = site["@name"] || site["@host"] ? `OWASP ZAP Scan of ${site["@name"] ?? targetName}` : "OWASP ZAP Scan";
-		const baseline = createMinimalBaseline(multiSite ? `OWASP ZAP Scan: ${siteLabel(site, i)}` : "OWASP ZAP Scan", requirements, {
+		const scanLabel = multiSite ? `OWASP ZAP Scan: ${siteLabel(site, i)}` : "OWASP ZAP Scan";
+		const baseline = createMinimalBaseline(scanLabel, requirements, {
 			resultsChecksum,
 			title: baselineTitle,
 			summary
@@ -6967,8 +7063,9 @@ function statusOf(req) {
 			expiresAt: getStr(o, "expiresAt") || void 0
 		}];
 	});
+	const impact = typeof req.impact === "number" ? req.impact : 1;
 	const rollup = computeEffectiveStatus({
-		impact: typeof req.impact === "number" ? req.impact : 1,
+		impact,
 		resultStatuses: resultStatuses(req),
 		overrides: overrideInputs
 	});
@@ -7083,11 +7180,17 @@ var RawNumber = class {
 		this.token = token;
 	}
 };
-/** Wrap a number as a RawNumber whose token always bears a decimal point. */
+/**
+* Wrap a number as a RawNumber whose token always bears a decimal point.
+*
+* formatJsonNumber renders positionally at every magnitude, matching Go's
+* strconv 'f'. String() would switch to exponent notation outside
+* [1e-6, 1e21) and emit a token with no decimal point at all — defeating the
+* one thing this function exists to guarantee, and diverging from the Go peer.
+*/
 function floatNumber(f) {
-	let s = String(f);
-	if (!/[.eE]/.test(s)) s += ".0";
-	return new RawNumber(s);
+	const s = Object.is(f, -0) ? "0" : formatJsonNumber(f);
+	return new RawNumber(s.includes(".") ? s : s + ".0");
 }
 const RAWNUM_MARK = String.fromCharCode(1);
 const RAWNUM_RE = /"\\u0001(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\\u0001"/g;
@@ -8235,13 +8338,15 @@ function buildFinding$1(req, baseline, docTimestamp, tool, generator, component,
 	if (device) finding.device = device;
 	setIf(finding, "raw_data", getStr(req, "code"));
 	setIf(finding, "message", firstResultMessage$1(req));
-	const evidences = buildEvidences(req);
-	if (evidences.length > 0) finding.evidences = evidences;
 	setIf(finding, "status_detail", st.rollup);
-	const remediation = remediationText$1(req);
-	if (remediation !== "") finding.remediation = { desc: remediation };
 	if (hasCVSS) finding.vulnerabilities = buildVulnerabilities(cvssList, req);
-	else finding.compliance = buildCompliance(req, baseline, title, st.raw);
+	else {
+		const evidences = buildEvidences(req);
+		if (evidences.length > 0) finding.evidences = evidences;
+		const remediation = remediationText$1(req);
+		if (remediation !== "") finding.remediation = { desc: remediation };
+		finding.compliance = buildCompliance(req, baseline, title, st.raw);
+	}
 	return finding;
 }
 function severityID(req) {
@@ -8585,8 +8690,10 @@ function buildFinding(req, ctx) {
 	const rem = remediation(req);
 	if (rem) finding.Remediation = rem;
 	const refs = allRefURLs(req);
-	if (refs.length > 0) if (vulns.length > 0) vulns[0].ReferenceUrls = refs;
-	else finding.SourceUrl = refs[0];
+	if (refs.length > 0) {
+		if (vulns.length > 0) vulns[0].ReferenceUrls = refs;
+		else finding.SourceUrl = refs[0];
+	}
 	if (vulns.length > 0) finding.Vulnerabilities = vulns;
 	return finding;
 }
@@ -8814,9 +8921,7 @@ async function convertSplunkToHdf(input, converterVersion = "1.0.0") {
 			case "profile":
 				profiles.push(event);
 				break;
-			case "control":
-				controls.push(event);
-				break;
+			case "control": controls.push(event);
 		}
 		if (headers.length !== 1) throw new Error(`Expected 1 header event, got ${headers.length}`);
 		const header = headers[0];
@@ -9235,9 +9340,10 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 		const ts = startTime ? parseTimestamp(startTime) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date();
 		requirements.push(buildNoFindingsRequirement("gitlab-no-findings", `GitLab ${label} scan via ${scannerName} reported zero findings.`, ts));
 	}
+	const baselineTitle = `GitLab ${label} Security Scan`;
 	const baseline = createMinimalBaseline("GitLab Security Scan", requirements, {
 		resultsChecksum,
-		title: `GitLab ${label} Security Scan`,
+		title: baselineTitle,
 		summary: `Scanner: ${scannerName}${scannerVersion ? ` v${scannerVersion}` : ""}`
 	});
 	const tool = { name: scannerName };
@@ -9728,10 +9834,11 @@ async function convertTrufflehogToHdf(input, converterVersion = "1.0.0") {
 		const target = findGitRepoURL(limitedFindings) ?? limitedFindings[0]?.SourceName ?? "the target source";
 		requirements.push(buildNoFindingsRequirement("trufflehog-no-findings", `TruffleHog scanned ${target} and reported zero findings.`, /* @__PURE__ */ new Date()));
 	}
+	const baselineTitle = `TruffleHog Scan (${limitedFindings[0]?.SourceName ?? "trufflehog"})`;
 	const hdf = {
 		baselines: [createMinimalBaseline("TruffleHog Scan", requirements, {
 			resultsChecksum,
-			title: `TruffleHog Scan (${limitedFindings[0]?.SourceName ?? "trufflehog"})`
+			title: baselineTitle
 		})],
 		generator: {
 			name: "trufflehog-to-hdf",
@@ -9861,10 +9968,12 @@ async function convertHipcheckToHdf(input, converterVersion = "1.0.0") {
 	for (const e of report.errored ?? []) requirements.push(buildErroredRequirement(e, startTime));
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("hipcheck-no-findings", `Hipcheck analyzed ${repoIdent(report)} and reported zero analyses.`, startTime));
 	const summary = buildSummary$1(report.recommendation ?? {});
+	const title = `Hipcheck analysis of ${repoIdent(report)} @ ${report.repo_head ?? ""}`;
+	const resultsChecksum = await inputChecksum(input);
 	const baseline = createMinimalBaseline("Hipcheck Scan", requirements, {
-		title: `Hipcheck analysis of ${repoIdent(report)} @ ${report.repo_head ?? ""}`,
+		title,
 		summary,
-		resultsChecksum: await inputChecksum(input)
+		resultsChecksum
 	});
 	const ident = repoIdent(report);
 	return buildHdfResults({
@@ -9996,9 +10105,10 @@ async function convertBurpsuiteToHdf(input, converterVersion = "1.0.0") {
 	for (const [issueType, groupIssues] of groups) requirements.push(buildRequirement$11(issueType, groupIssues, resultStartTime));
 	const targetName = limitedIssues.length > 0 ? (limitedIssues[0].host?.["#text"] ?? "Unknown").trim() : "Unknown";
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("burpsuite-no-findings", `Burp Suite scanned ${targetName} and reported zero findings.`, /* @__PURE__ */ new Date()));
+	const title = `BurpSuite Scan: ${targetName}`;
 	const baseline = createMinimalBaseline("BurpSuite Scan", requirements, {
 		resultsChecksum,
-		title: `BurpSuite Scan: ${targetName}`
+		title
 	});
 	const tool = { name: "BurpSuite" };
 	if (burpVersion) tool.version = burpVersion;
@@ -10174,9 +10284,11 @@ function buildScanTarget(f) {
 	const assetType = (f["Asset Type"] ?? "").trim();
 	const asset = (f["Asset"] ?? "").trim();
 	let name = instance;
-	if (!name) if (ip && port) name = `${ip}:${port}`;
-	else if (ip) name = ip;
-	else name = asset;
+	if (!name) {
+		if (ip && port) name = `${ip}:${port}`;
+		else if (ip) name = ip;
+		else name = asset;
+	}
 	if (!name) return;
 	const comp = {
 		name,
@@ -10215,7 +10327,8 @@ function parseDate(dateStr) {
 	const trimmed = dateStr.trim();
 	if (!trimmed) return ZERO_DATE;
 	const month = /^([A-Z][a-z]{2}) (\d{1,2}) (\d{4}) (\d{2}:\d{2})$/.exec(trimmed);
-	return parseTimestamp(month ? `${month[3]}-${MONTH_ABBR[month[1]] ?? "00"}-${month[2].padStart(2, "0")} ${month[4]}` : trimmed) ?? ZERO_DATE;
+	const normalized = month ? `${month[3]}-${MONTH_ABBR[month[1]] ?? "00"}-${month[2].padStart(2, "0")} ${month[4]}` : trimmed;
+	return parseTimestamp(normalized) ?? ZERO_DATE;
 }
 /**
 * Derives the top-level HDF timestamp from the source, preferring the "Start
@@ -10256,7 +10369,8 @@ function buildRequirement$10(checkID, findings, hasStatus) {
 		data: formatDesc$1(rep)
 	}];
 	const results = findings.map((f) => {
-		return createResult(hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed, void 0, {
+		const status = hasStatus ? getStatus$2(f["Result Status"] ?? "") : ResultStatus.Failed;
+		return createResult(status, void 0, {
 			codeDesc: f["Details"] ?? "",
 			startTime: parseDate(f["Date"] ?? ""),
 			backtrace: getBacktrace(f["Result Status"] ?? "")
@@ -10302,10 +10416,12 @@ async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 	const requirements = [];
 	for (const [checkID, findingGroup] of groups) requirements.push(buildRequirement$10(checkID, findingGroup, hasStatus));
 	const firstFinding = limitedFindings[0];
+	const title = firstFinding["Job Name"] ?? "";
+	const summary = formatSummary(firstFinding);
 	const baseline = createMinimalBaseline("DBProtect Scan", requirements, {
 		resultsChecksum,
-		title: firstFinding["Job Name"] ?? "",
-		summary: formatSummary(firstFinding)
+		title,
+		summary
 	});
 	const policy = firstFinding["Policy"] ?? "";
 	if (policy) baseline.version = policy;
@@ -10323,7 +10439,9 @@ async function convertDbprotectToHdf(input, converterVersion = "1.0.0") {
 //#region converters/twistlock-to-hdf/typescript/converter.ts
 const TWISTLOCK_ALIASES = {
 	important: .9,
-	moderate: .5
+	moderate: .5,
+	unimportant: .3,
+	negligible: 0
 };
 function twistlockSeverityToImpact(severity) {
 	return severityToImpactWithAliases(severity, TWISTLOCK_ALIASES, .5);
@@ -10551,10 +10669,12 @@ function convertSingleResult(result, resultsChecksum) {
 		const target = result.name ?? result.repository ?? result.id ?? "scan target";
 		requirements.push(buildNoFindingsRequirement("twistlock-no-findings", `Twistlock scanned ${target} and reported zero vulnerable components.`, /* @__PURE__ */ new Date()));
 	}
+	const title = buildTitle$1(result);
+	const summary = buildSummary(result);
 	return createMinimalBaseline("Twistlock Scan", requirements, {
 		resultsChecksum,
-		title: buildTitle$1(result),
-		summary: buildSummary(result)
+		title,
+		summary
 	});
 }
 /**
@@ -10802,9 +10922,10 @@ async function convertDeptrackToHdf(input, converterVersion = "1.0.0") {
 		const projectName = parsed.project?.name ?? parsed.project?.uuid ?? "";
 		requirements.push(buildNoFindingsRequirement("deptrack-no-findings", `Dependency-Track analyzed ${projectName} and reported zero vulnerable components.`, /* @__PURE__ */ new Date()));
 	}
+	const title = `Dependency-Track: ${parsed.project?.name ?? ""} ${parsed.project?.version ?? ""}`;
 	const baseline = createMinimalBaseline("Dependency-Track Scan", requirements, {
 		resultsChecksum,
-		title: `Dependency-Track: ${parsed.project?.name ?? ""} ${parsed.project?.version ?? ""}`,
+		title,
 		summary: parsed.project?.description
 	});
 	const targetName = parsed.project?.name ?? parsed.project?.uuid ?? "";
@@ -11383,9 +11504,10 @@ async function convertNeuvectorToHdf(input, converterVersion = "1.0.0") {
 	}
 	const target = targetNameFromReport(scan.report);
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("neuvector-no-findings", `NeuVector scanned ${target} and reported zero vulnerable components.`, scanTime));
+	const title = imageTitle(scan.report);
 	const baseline = createMinimalBaseline("NeuVector Scan", requirements, {
 		resultsChecksum,
-		title: imageTitle(scan.report)
+		title
 	});
 	const cmds = scan.report.cmds ?? [];
 	if (cmds.length > 0) baseline.extensions = { neuvector: { cmds } };
@@ -11624,12 +11746,15 @@ async function convertFortifyToHdf(input, converterVersion = "1.0.0") {
 	});
 	const targetName = fvdl.Build?.SourceBasePath ?? fvdl.Build?.BuildID ?? "Unknown";
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("fortify-no-findings", `Fortify scanned ${targetName} and reported zero findings.`, /* @__PURE__ */ new Date()));
+	const title = "Fortify Static Analyzer Scan";
+	const summary = `Fortify Static Analyzer Scan of UUID: ${fvdl.UUID ?? ""}`;
+	const version = fvdl.EngineData?.EngineVersion ?? "";
 	const hdfResult = {
 		baselines: [createMinimalBaseline("Fortify Scan", requirements, {
 			resultsChecksum,
-			title: "Fortify Static Analyzer Scan",
-			summary: `Fortify Static Analyzer Scan of UUID: ${fvdl.UUID ?? ""}`,
-			version: fvdl.EngineData?.EngineVersion ?? "",
+			title,
+			summary,
+			version,
 			status: "loaded"
 		})],
 		components: [{
@@ -11875,9 +12000,11 @@ function groupByHostname(records) {
 * Builds an HDF baseline from all records for a single host.
 */
 function buildBaseline(hostname, records, resultsChecksum, scanTime) {
-	return createMinimalBaseline("Prisma Cloud Scan", limitArrayWithWarning(records, "finding").map((rec) => buildRequirement$4(rec, scanTime)), {
+	const requirements = limitArrayWithWarning(records, "finding").map((rec) => buildRequirement$4(rec, scanTime));
+	const title = `Prisma Cloud Scan (${hostname})`;
+	return createMinimalBaseline("Prisma Cloud Scan", requirements, {
 		resultsChecksum,
-		title: `Prisma Cloud Scan (${hostname})`
+		title
 	});
 }
 /**
@@ -12143,6 +12270,7 @@ async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 		const startTime = (initiated ? parseNetsparkerTimestamp(initiated) : null) ?? /* @__PURE__ */ new Date();
 		requirements.push(buildNoFindingsRequirement("netsparker-no-findings", `${toolName} scanned ${targetName} and reported zero findings.`, startTime));
 	}
+	const title = `${toolName} Enterprise Scan ID: ${target["scan-id"] ?? ""} URL: ${target.url ?? ""}`;
 	return buildHdfResults({
 		generatorName: "netsparker-to-hdf",
 		converterVersion,
@@ -12150,7 +12278,7 @@ async function convertNetsparkerToHdf(input, converterVersion = "1.0.0") {
 		timestamp,
 		baselines: [createMinimalBaseline("Netsparker Scan", requirements, {
 			resultsChecksum,
-			title: `${toolName} Enterprise Scan ID: ${target["scan-id"] ?? ""} URL: ${target.url ?? ""}`
+			title
 		})],
 		components: [{
 			name: targetName,
@@ -12222,7 +12350,9 @@ function getNistControls(ruleID) {
 	return ctrl.split("|");
 }
 /**
-* Collapses all service findings into a flat list of (ruleID, finding) pairs.
+* Flattens every service's findings into one ordered list, services then rule
+* keys sorted for deterministic output. Each entry stands alone, so no finding
+* can be displaced by another service's.
 */
 function collapseFindings(report) {
 	const result = [];
@@ -12235,15 +12365,33 @@ function collapseFindings(report) {
 		const ruleNames = Object.keys(svc.findings).sort();
 		for (const ruleName of ruleNames) {
 			const finding = svc.findings[ruleName];
-			if (finding) result.push([ruleName, finding]);
+			if (finding) result.push({
+				service: serviceName,
+				ruleID: ruleName,
+				finding
+			});
 		}
 	}
 	return result;
 }
 /**
+* Returns the HDF requirement ID for each finding. A rule key is the ID on its
+* own, which is what every ScoutSuite report produces: a key names one rule file,
+* whose path binds it to a single service. Should a key arrive under two services
+* anyway, both are qualified with their service so the IDs stay unique —
+* qualifying only on collision keeps ordinary output unchanged rather than
+* renaming every requirement for a case that does not occur. Mirrors Go's
+* assignRequirementIDs.
+*/
+function assignRequirementIDs(found) {
+	const occurrences = /* @__PURE__ */ new Map();
+	for (const sf of found) occurrences.set(sf.ruleID, (occurrences.get(sf.ruleID) ?? 0) + 1);
+	return found.map((sf) => (occurrences.get(sf.ruleID) ?? 0) > 1 ? `${sf.service}:${sf.ruleID}` : sf.ruleID);
+}
+/**
 * Builds a single EvaluatedRequirement from a ScoutSuite finding.
 */
-function buildRequirement$2(ruleID, finding, startTime) {
+function buildRequirement$2(id, ruleID, finding, startTime) {
 	const nist = getNistControls(ruleID);
 	const tags = buildNistCciTags(nist, nistToCci(nist));
 	const compliance = complianceStrings(finding.compliance);
@@ -12258,11 +12406,13 @@ function buildRequirement$2(ruleID, finding, startTime) {
 	});
 	const refs = [];
 	for (const url of finding.references ?? []) if (url) refs.push({ url });
-	const resultObj = createResult(getStatus$1(finding.checked_items, finding.flagged_items), getMessage(finding.checked_items, finding.flagged_items, finding.items), {
+	const status = getStatus$1(finding.checked_items, finding.flagged_items);
+	const message = getMessage(finding.checked_items, finding.flagged_items, finding.items);
+	const resultObj = createResult(status, message, {
 		codeDesc: finding.description,
 		startTime: (startTime ? parseTimestamp(startTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	});
-	const req = createRequirement(ruleID, finding.description, descriptions, getImpact$1(finding.level), [resultObj], { tags });
+	const req = createRequirement(id, finding.description, descriptions, getImpact$1(finding.level), [resultObj], { tags });
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
@@ -12284,12 +12434,15 @@ async function convertScoutsuiteToHdf(input, converterVersion = "1.0.0") {
 	const resultsChecksum = await inputChecksum(jsonStr);
 	const report = parseJSON(jsonStr);
 	if (!report || typeof report !== "object") throw new Error("scoutsuite: invalid JSON");
-	const requirements = limitArrayWithWarning(collapseFindings(report), "finding").map(([ruleID, finding]) => buildRequirement$2(ruleID, finding, report.last_run.time));
+	const limitedPairs = limitArrayWithWarning(collapseFindings(report), "finding");
+	const ids = assignRequirementIDs(limitedPairs);
+	const requirements = limitedPairs.map((sf, i) => buildRequirement$2(ids[i], sf.ruleID, sf.finding, report.last_run.time));
 	const targetName = `${report.last_run.ruleset_name} ruleset:${report.provider_name}:${report.account_id}`;
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("scoutsuite-no-findings", `ScoutSuite scanned ${targetName} and reported zero findings.`, /* @__PURE__ */ new Date()));
+	const title = `Scout Suite Report using ${report.last_run.ruleset_name} ruleset on ${report.provider_name} with account ${report.account_id}`;
 	const baseline = createMinimalBaseline("ScoutSuite Scan", requirements, {
 		resultsChecksum,
-		title: `Scout Suite Report using ${report.last_run.ruleset_name} ruleset on ${report.provider_name} with account ${report.account_id}`,
+		title,
 		summary: report.last_run.ruleset_about
 	});
 	return buildHdfResults({
@@ -12357,17 +12510,17 @@ function buildCodeDesc$1(section, scannerName) {
 		parts.push(`body:${bodyToString(section.body)}`);
 		parts.push(`body_format:${section.body_format ?? ""}`);
 		parts.push(`classification:${section.classification ?? ""}`);
-		parts.push(`depth:${section.depth ?? 0}`);
+		parts.push(`depth:${formatJsonNumber(section.depth ?? 0)}`);
 		if (section.heuristic) {
 			parts.push(`heuristic_heur_id:${section.heuristic.heur_id ?? ""}`);
-			parts.push(`heuristic_score:${section.heuristic.score ?? 0}`);
+			parts.push(`heuristic_score:${formatJsonNumber(section.heuristic.score ?? 0)}`);
 			parts.push(`heuristic_name:${section.heuristic.name ?? ""}`);
 		}
 	} else if (scannerName === "CodeQuality") {
 		parts.push(`body:${bodyToString(section.body)}`);
 		parts.push(`body_format:${section.body_format ?? ""}`);
 		parts.push(`classification:${section.classification ?? ""}`);
-		parts.push(`depth:${section.depth ?? 0}`);
+		parts.push(`depth:${formatJsonNumber(section.depth ?? 0)}`);
 		parts.push(`title_text:${section.title_text ?? ""}`);
 	} else return JSON.stringify(section);
 	return parts.join("\n");
@@ -12475,11 +12628,13 @@ function buildRequirementFromResult(result, filename) {
 * Builds an HDF baseline for a single scanner's results.
 */
 function buildScannerBaseline(scannerName, results, shaMap, resultsChecksum) {
-	return createMinimalBaseline("Conveyor Scan", results.map((result) => {
+	const requirements = results.map((result) => {
 		return buildRequirementFromResult(result, shaMap.get(result.sha256) ?? "");
-	}), {
+	});
+	const title = `Conveyor Scan (${scannerName})`;
+	return createMinimalBaseline("Conveyor Scan", requirements, {
 		resultsChecksum,
-		title: `Conveyor Scan (${scannerName})`
+		title
 	});
 }
 /**
@@ -12574,7 +12729,8 @@ function decodeXmlEntities(s) {
 /** Parse Veracode timestamp format ("2021-12-29 22:16:36 UTC") to Date. */
 function parseVeracodeTimestamp(ts) {
 	if (!ts) return void 0;
-	return parseTimestamp(ts.replace(" UTC", "Z").replace(" ", "T")) ?? void 0;
+	const normalized = ts.replace(" UTC", "Z").replace(" ", "T");
+	return parseTimestamp(normalized) ?? void 0;
 }
 /** Format description paragraphs into text. */
 function formatDesc(desc) {
@@ -13095,11 +13251,12 @@ function buildRequirement$1(cs, profiles, createdDateTime) {
 	}
 	if (cs.on === "true") tags.on = true;
 	else if (cs.on === "false") tags.on = false;
-	const req = createRequirement(id, title, descriptions, impact, [{
+	const results = [{
 		status,
 		codeDesc: cs.implementationStatus || "No implementation status provided",
 		startTime: parseTimestamp(cs.lastSynced ?? "") ?? parseTimestamp(createdDateTime ?? "") ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
-	}], {
+	}];
+	const req = createRequirement(id, title, descriptions, impact, results, {
 		tags,
 		...refs.length > 0 ? { refs } : {}
 	});
@@ -13464,9 +13621,10 @@ function formatEvidence$1(evidence) {
 	for (const ev of evidence) {
 		const odataType = ev["@odata.type"] ?? "";
 		if (odataType.includes("deviceEvidence")) parts.push(`Device: ${ev.deviceDnsName ?? "unknown"} (OS: ${ev.osPlatform ?? "unknown"})`);
-		else if (odataType.includes("processEvidence")) if (ev.imageFile) parts.push(`Process: ${ev.imageFile.filePath ?? ""}\\${ev.imageFile.fileName ?? ""} (Command: ${ev.processCommandLine ?? ""})`);
-		else parts.push(`Process: (Command: ${ev.processCommandLine ?? ""})`);
-		else if (odataType.includes("fileEvidence")) parts.push(`File: ${ev.filePath ?? ""}\\${ev.fileName ?? ""}`);
+		else if (odataType.includes("processEvidence")) {
+			if (ev.imageFile) parts.push(`Process: ${ev.imageFile.filePath ?? ""}\\${ev.imageFile.fileName ?? ""} (Command: ${ev.processCommandLine ?? ""})`);
+			else parts.push(`Process: (Command: ${ev.processCommandLine ?? ""})`);
+		} else if (odataType.includes("fileEvidence")) parts.push(`File: ${ev.filePath ?? ""}\\${ev.fileName ?? ""}`);
 		else parts.push(`Evidence type: ${odataType}`);
 	}
 	return parts.join("\n");
@@ -13671,12 +13829,18 @@ function convertHdfToXccdf(input) {
 	const hdfData = parseHdf(input);
 	if (!hdfData || typeof hdfData !== "object" || !("baselines" in hdfData)) throw new Error("Invalid HDF structure: missing baselines field");
 	if (!Array.isArray(hdfData.baselines)) throw new Error("Invalid HDF structure: baselines must be an array");
-	return `<?xml version="1.0" encoding="UTF-8"?>\n${buildXml({ Benchmark: buildBenchmarkObj(hdfData) }, BUILD_OPTIONS)}`;
+	const xmlObj = { Benchmark: buildBenchmarkObj(hdfData) };
+	return `<?xml version="1.0" encoding="UTF-8"?>\n${buildXml(xmlObj, BUILD_OPTIONS)}`;
 }
 /** Wrap a primitive value to force it as a text node in XML output. */
 function wrap(value) {
 	return { "#text": value };
 }
+/** Map an XCCDF result to the severity of its message: an error result is the
+*  checking engine reporting a fault, any other is check output. */
+function messageSeverity(status) {
+	return status === "error" ? "error" : "info";
+}
 /** Map HDF impact (0.0-1.0) to XCCDF severity via the shared band mapper. The
 *  XCCDF vocabulary has no critical band, so critical folds into high, and its
 *  zero band is spelled 'info'. */
@@ -13904,7 +14068,8 @@ function resultTimeWindow(baseline) {
 	let first;
 	let last;
 	for (const req of baseline.requirements) for (const res of req.results) {
-		const parsed = parseTimestamp(typeof res.startTime === "string" ? res.startTime : res.startTime.toISOString());
+		const text = typeof res.startTime === "string" ? res.startTime : res.startTime.toISOString();
+		const parsed = parseTimestamp(text);
 		if (!parsed) continue;
 		const at = parsed.getTime();
 		const canonical = formatTimestamp(parsed);
@@ -13972,7 +14137,10 @@ function buildTestResultObj(hdfData, baseline) {
 			rr[`${ATTR}time`] = parsedStart ? formatTimestamp(parsedStart) : rawStart;
 			if (stigId) rr[`${ATTR}version`] = stigId;
 			rr.result = wrap(status);
-			if (result.message) rr.message = wrap(result.message);
+			if (result.message) rr.message = {
+				[`${ATTR}severity`]: messageSeverity(status),
+				"#text": result.message
+			};
 			if (result.codeDesc) rr.check = {
 				[`${ATTR}system`]: "http://oval.mitre.org/XMLSchema/oval-definitions-5",
 				"check-content": wrap(result.codeDesc)
@@ -13990,6 +14158,752 @@ function buildTestResultObj(hdfData, baseline) {
 	return testResult;
 }
 //#endregion
+//#region converters/oscal-to-hdf/go/oscal-vocabulary.json
+var oscal_vocabulary_default = {
+	$comment: "The HDF OSCAL extension vocabulary (ADR-0014 §1.5): every prop an hdf-libs OSCAL exporter emits or importer reads by name, with the namespace it belongs to. The Go oscal package embeds this file and the TypeScript peer imports it; it is the only place a prop name or the HDF namespace URI is defined. 'objects' are OSCAL JSON paths; 'hdfField' is the HDF path the prop carries, or null when it carries none; 'legacy' is true exactly for the names exporters emitted without ns before ADR-0014, which the read helpers accept without ns for one minor release (§1.4).",
+	namespace: "https://mitre.github.io/hdf-libs/ns/oscal",
+	defaultNamespace: "http://csrc.nist.gov/ns/oscal",
+	props: [
+		{
+			"name": "hdf-requirement-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]", "plan-of-action-and-milestones.risks[]"],
+			"meaning": "The HDF requirement id the finding assesses, or the requirement id of the override the POA&M risk represents, exactly as the source recorded it; omitted when the id is empty. The finding target-id carries an OSCAL token encoding of it, which is not injective, and the POA&M item and risk titles are display text.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].id, overrides[].requirementId",
+			"legacy": true
+		},
+		{
+			"name": "baseline-version",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[]"],
+			"meaning": "The version of the HDF baseline the result reports.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].version",
+			"legacy": true
+		},
+		{
+			"name": "nist",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A NIST SP 800-53 control the requirement maps to, one prop per mapping, in source order.",
+			"valueFormat": "String (§1.7), NIST control notation as the source spelled it",
+			"hdfField": "baselines[].requirements[].tags.nist[]",
+			"legacy": true
+		},
+		{
+			"name": "cci",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A DISA Control Correlation Identifier the requirement maps to, one prop per mapping, in source order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].tags.cci[]",
+			"legacy": true
+		},
+		{
+			"name": "control-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The requirement's control type.",
+			"valueFormat": "One of policy, procedure, technical, management, operational",
+			"hdfField": "baselines[].requirements[].controlType",
+			"legacy": true
+		},
+		{
+			"name": "verification-method",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "How the requirement is verified.",
+			"valueFormat": "One of automated, manual-by-design, manual-pending-automation, hybrid",
+			"hdfField": "baselines[].requirements[].verificationMethod",
+			"legacy": true
+		},
+		{
+			"name": "applicability",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "Whether the requirement is required, optional or advisory.",
+			"valueFormat": "One of required, optional, advisory",
+			"hdfField": "baselines[].requirements[].applicability",
+			"legacy": true
+		},
+		{
+			"name": "cwe",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A CWE identifier associated with the requirement, one prop per identifier, in source order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].cwe[]",
+			"legacy": true
+		},
+		{
+			"name": "epss-score",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The EPSS exploitation probability score.",
+			"valueFormat": "Decimal number from 0 to 1",
+			"hdfField": "baselines[].requirements[].epss.score",
+			"legacy": true
+		},
+		{
+			"name": "epss-percentile",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The EPSS percentile of the score.",
+			"valueFormat": "Decimal number from 0 to 1",
+			"hdfField": "baselines[].requirements[].epss.percentile",
+			"legacy": true
+		},
+		{
+			"name": "kev",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The vulnerability is in the CISA Known Exploited Vulnerabilities catalog; emitted only when it is.",
+			"valueFormat": "The literal true",
+			"hdfField": "baselines[].requirements[].kev.inKev",
+			"legacy": true
+		},
+		{
+			"name": "kev-due-date",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The remediation due date the KEV catalog sets for the vulnerability.",
+			"valueFormat": "String (§1.7), a date as the source recorded it",
+			"hdfField": "baselines[].requirements[].kev.dueDate",
+			"legacy": true
+		},
+		{
+			"name": "cvss-base-score",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A CVSS base score, one prop per CVSS record that carries one, in source order.",
+			"valueFormat": "Decimal number from 0 to 10",
+			"hdfField": "baselines[].requirements[].cvss[].baseScore",
+			"legacy": true
+		},
+		{
+			"name": "cvss-base-vector",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A CVSS base vector, one prop per CVSS record that carries one, in source order.",
+			"valueFormat": "String (§1.7), a CVSS vector string",
+			"hdfField": "baselines[].requirements[].cvss[].baseVector",
+			"legacy": true
+		},
+		{
+			"name": "reference",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "A requirement reference that is plain text rather than a URL or URI (those become finding links).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].refs[].ref",
+			"legacy": true
+		},
+		{
+			"name": "check",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "Pre-ADR only: a one-line preview of the requirement's check text, with the full text in remarks. No longer emitted; the check text is carried in observation relevant-evidence marked with description-label.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].descriptions[label=check].data",
+			"legacy": true
+		},
+		{
+			"name": "fix",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "Pre-ADR only: a one-line preview of the requirement's fix text when no risk was emitted, with the full text in remarks. No longer emitted; the fix text is carried in a risk remediation or observation relevant-evidence marked with description-label.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].descriptions[label=fix].data",
+			"legacy": true
+		},
+		{
+			"name": "rationale",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "Pre-ADR only: a one-line preview of the requirement's rationale text, with the full text in remarks. No longer emitted; the rationale is carried in the finding target description.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].descriptions[label=rationale].data",
+			"legacy": true
+		},
+		{
+			"name": "description-label",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].relevant-evidence[]", "assessment-results.results[].risks[].remediations[]"],
+			"meaning": "Marks the object as carrying the text of the HDF description with this label; evidence entries hold the full text in remarks, remediations in description.",
+			"valueFormat": "One of check, fix",
+			"hdfField": "baselines[].requirements[].descriptions[].label",
+			"legacy": false
+		},
+		{
+			"name": "empty-field",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["Any object that carries HDF props"],
+			"meaning": "An optional HDF string field that is present but empty; the importer returns it present and empty (§1.7.3).",
+			"valueFormat": "The HDF JSON property name, dot-separated relative to the OSCAL object that carries the marker (e.g. systemRef, checksum.value); for props that share a group, the field within that group (e.g. key, fixedInVersion) (§1.7.5)",
+			"hdfField": null,
+			"legacy": false
+		},
+		{
+			"name": "absent-field",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["Any object that carries HDF props"],
+			"meaning": "OSCAL requires a value the HDF field does not have, so the object holds display fallback text; the importer leaves the field absent and never reads the fallback as HDF data (§1.7.4).",
+			"valueFormat": "The HDF JSON property name, dot-separated relative to the OSCAL object that carries the marker (e.g. systemRef, checksum.value); for props that share a group, the field within that group (e.g. key, fixedInVersion) (§1.7.5)",
+			"hdfField": null,
+			"legacy": false
+		},
+		{
+			"name": "amendment-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata"],
+			"meaning": "The identifier of the HDF amendments document.",
+			"valueFormat": "String (§1.7), a UUID",
+			"hdfField": "amendmentId",
+			"legacy": true
+		},
+		{
+			"name": "override-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The type of the HDF override the risk represents. A risk carrying it in the HDF namespace is HDF-produced (ADR-0014 §4.3), so the importer reads every §4.6 field from its HDF props; a risk carrying it without ns is a pre-ADR export, which imports through the pre-ADR mapping.",
+			"valueFormat": "An HDF override type, such as waiver, poam or falsePositive",
+			"hdfField": "overrides[].type",
+			"legacy": true
+		},
+		{
+			"name": "impact-override",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The impact the override assigns to the requirement.",
+			"valueFormat": "Decimal number from 0 to 1",
+			"hdfField": "overrides[].impact.value",
+			"legacy": true
+		},
+		{
+			"name": "justification",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The controlled-vocabulary justification for the override.",
+			"valueFormat": "An HDF override justification value",
+			"hdfField": "overrides[].justification",
+			"legacy": true
+		},
+		{
+			"name": "baseline-ref",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The baseline the override is scoped to.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].baselineRef",
+			"legacy": true
+		},
+		{
+			"name": "component-ref",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The component the override is scoped to.",
+			"valueFormat": "String (§1.7), a UUID",
+			"hdfField": "overrides[].componentRef",
+			"legacy": true
+		},
+		{
+			"name": "milestone-status",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[].remediations[].tasks[]"],
+			"meaning": "The status of the milestone the remediation task represents. Documents exported before ADR-0014 carry it on the remediation, and import through the pre-ADR mapping (§4.3), which does not read it.",
+			"valueFormat": "An HDF milestone status",
+			"hdfField": "overrides[].milestones[].status",
+			"legacy": true
+		},
+		{
+			"name": "completed-at",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[].remediations[].tasks[]"],
+			"meaning": "When the milestone was completed.",
+			"valueFormat": "RFC 3339 date-time in UTC",
+			"hdfField": "overrides[].milestones[].completedAt",
+			"legacy": true
+		},
+		{
+			"name": "completed-by",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[].remediations[].tasks[]"],
+			"meaning": "Pre-ADR only: the identifier of whoever completed the milestone. No longer emitted; the task's responsible-roles entry with role-id completed-by names the party.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].milestones[].completedBy.identifier",
+			"legacy": true
+		},
+		{
+			"name": "mime-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.observations[]"],
+			"meaning": "The media type of the evidence the observation carries.",
+			"valueFormat": "String (§1.7), a media type",
+			"hdfField": "overrides[].evidence[].mimeType",
+			"legacy": true
+		},
+		{
+			"name": "captured-by",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.observations[]"],
+			"meaning": "Pre-ADR only: the identifier of whoever captured the evidence. No longer emitted; the observation's origins actor names the party.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].evidence[].capturedBy.identifier",
+			"legacy": true
+		},
+		{
+			"name": "source-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The name of the source of the external reference the resource carries.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].externalReferences[].sourceName",
+			"legacy": true
+		},
+		{
+			"name": "external-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The identifier the source assigns to the external reference the resource carries.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].externalReferences[].externalId",
+			"legacy": true
+		},
+		{
+			"name": "override-status",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The status the override sets, emitted only when the override sets one; the risk status is closed for passed and notApplicable and open otherwise.",
+			"valueFormat": "An HDF result status: passed, failed, notApplicable, notReviewed or error",
+			"hdfField": "overrides[].status",
+			"legacy": false
+		},
+		{
+			"name": "inherited-from",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The componentId of the local component that provides the control the override inherits.",
+			"valueFormat": "String (§1.7), a UUID",
+			"hdfField": "overrides[].inheritedFrom",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The name of a package the override is scoped to; every prop of one package shares the group package-<n>, n its 1-based position in source order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].affectedPackages[].name",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-version",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The version of a package the override is scoped to, grouped as affected-package-name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].affectedPackages[].version",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-ecosystem",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The ecosystem of a package the override is scoped to, grouped as affected-package-name.",
+			"valueFormat": "An HDF package ecosystem, such as npm, rpm or generic",
+			"hdfField": "overrides[].affectedPackages[].ecosystem",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-cpe",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The CPE 2.3 name of a package the override is scoped to, grouped as affected-package-name.",
+			"valueFormat": "String (§1.7), a CPE 2.3 name",
+			"hdfField": "overrides[].affectedPackages[].cpe",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-purl",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The package URL of a package the override is scoped to, grouped as affected-package-name.",
+			"valueFormat": "String (§1.7), a package URL",
+			"hdfField": "overrides[].affectedPackages[].purl",
+			"legacy": false
+		},
+		{
+			"name": "affected-package-fixed-in-version",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "The first version of a package the override is scoped to that contains the fix, grouped as affected-package-name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].affectedPackages[].fixedInVersion",
+			"legacy": false
+		},
+		{
+			"name": "evidence-encoding",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.observations[]"],
+			"meaning": "The encoding the evidence data declares; data whose encoding is exactly base64 is carried in the linked resource as-is.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].evidence[].encoding",
+			"legacy": false
+		},
+		{
+			"name": "evidence-size",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.observations[]"],
+			"meaning": "The size of the evidence data in bytes.",
+			"valueFormat": "Decimal number",
+			"hdfField": "overrides[].evidence[].size",
+			"legacy": false
+		},
+		{
+			"name": "reference-rel",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The relationship of the external reference the resource carries to the override.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].externalReferences[].rel",
+			"legacy": false
+		},
+		{
+			"name": "reference-media-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The media type of the artifact the external reference points at.",
+			"valueFormat": "String (§1.7), a media type",
+			"hdfField": "overrides[].externalReferences[].mediaType",
+			"legacy": false
+		},
+		{
+			"name": "checksum-algorithm",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The hash algorithm of the checksum of the artifact the external reference points at.",
+			"valueFormat": "One of sha256, sha384, sha512, blake3",
+			"hdfField": "overrides[].externalReferences[].checksum.algorithm",
+			"legacy": false
+		},
+		{
+			"name": "checksum-value",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The checksum of the artifact the external reference points at.",
+			"valueFormat": "String (§1.7), a hex digest",
+			"hdfField": "overrides[].externalReferences[].checksum.value",
+			"legacy": false
+		},
+		{
+			"name": "added-by",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "Who attached the external reference: the uuid of the metadata party carrying the identity.",
+			"valueFormat": "A party UUID",
+			"hdfField": "overrides[].externalReferences[].addedBy",
+			"legacy": false
+		},
+		{
+			"name": "added-at",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "When the external reference was attached.",
+			"valueFormat": "RFC 3339 date-time in UTC",
+			"hdfField": "overrides[].externalReferences[].addedAt",
+			"legacy": false
+		},
+		{
+			"name": "reference-kind",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.back-matter.resources[]"],
+			"meaning": "The kind of payload the external reference classifies, such as threat-intel or advisory.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "overrides[].externalReferences[].kind",
+			"legacy": false
+		},
+		{
+			"name": "identity-identifier",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata.parties[]"],
+			"meaning": "The identifier of the HDF identity the party carries; omitted when the identifier is empty. The party name is display text.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "Identity.identifier",
+			"legacy": false
+		},
+		{
+			"name": "identity-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata.parties[]"],
+			"meaning": "The type of the HDF identity the party carries; the party type is display text. The party remarks hold the identity description.",
+			"valueFormat": "One of email, username, system, agent, simple, other",
+			"hdfField": "Identity.type",
+			"legacy": false
+		},
+		{
+			"name": "amendments-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata"],
+			"meaning": "The name of the HDF amendments document; omitted when the name is empty. The metadata title is display text.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "name",
+			"legacy": false
+		},
+		{
+			"name": "label-key",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata"],
+			"meaning": "The key of an amendments label, with class amendment-label and group label-<n>, n the label's 1-based position in sorted key order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "labels (key)",
+			"legacy": false
+		},
+		{
+			"name": "label-value",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.metadata"],
+			"meaning": "The value of the amendments label its group names, with class amendment-label.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "labels (value)",
+			"legacy": false
+		},
+		{
+			"name": "impacted-control-id",
+			"ns": "https://fedramp.gov/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.risks[]"],
+			"meaning": "FedRAMP vocabulary: a control impacted by the POA&M item. The POA&M exporter emits it and the importer reads it as the override requirement id.",
+			"valueFormat": "OSCAL control id token",
+			"hdfField": "overrides[].requirementId",
+			"legacy": true
+		},
+		{
+			"name": "POAM-ID",
+			"ns": "https://fedramp.gov/ns/oscal",
+			"objects": ["plan-of-action-and-milestones.poam-items[]"],
+			"meaning": "FedRAMP vocabulary: the CSP-assigned POA&M tracking identifier. The importer reads it as the override requirement id when no related risk carries impacted-control-id.",
+			"valueFormat": "String, a CSP tracking number",
+			"hdfField": "overrides[].requirementId",
+			"legacy": false
+		},
+		{
+			"name": "CORE",
+			"ns": "https://fedramp.gov/ns/oscal",
+			"objects": [
+				"catalog.controls[]",
+				"catalog.groups[].controls[]",
+				"profile.modify.alters[].adds[]"
+			],
+			"meaning": "FedRAMP vocabulary: the control must be included in every FedRAMP assessment. The importer maps the value true to applicability required.",
+			"valueFormat": "The literal true",
+			"hdfField": "requirements[].applicability",
+			"legacy": false
+		},
+		{
+			"name": "assessment-type",
+			"ns": "https://fedramp.gov/ns/oscal",
+			"objects": ["assessment-plan.metadata"],
+			"meaning": "FedRAMP vocabulary: the type of assessment. The importer maps automated and manual to the plan type.",
+			"valueFormat": "String",
+			"hdfField": "type",
+			"legacy": false
+		},
+		{
+			"name": "label",
+			"ns": "http://csrc.nist.gov/ns/oscal",
+			"objects": ["catalog.controls[]", "catalog.groups[].controls[]"],
+			"meaning": "NIST vocabulary: a human-readable label for the control, which may be rendered in place of its identifier.",
+			"valueFormat": "String",
+			"hdfField": "requirements[].tags.label",
+			"legacy": false
+		},
+		{
+			"name": "sort-id",
+			"ns": "http://csrc.nist.gov/ns/oscal",
+			"objects": ["catalog.controls[]", "catalog.groups[].controls[]"],
+			"meaning": "NIST vocabulary: an alternative identifier that sorts easily among the other controls in the document.",
+			"valueFormat": "String",
+			"hdfField": "requirements[].tags.sort-id",
+			"legacy": false
+		},
+		{
+			"name": "version",
+			"ns": "http://csrc.nist.gov/ns/oscal",
+			"objects": ["assessment-plan.assessment-assets.components[]"],
+			"meaning": "NIST vocabulary: the version of the component. The importer reads it from the first assessment-asset component as the runner version.",
+			"valueFormat": "String",
+			"hdfField": "assessments[].runner.version",
+			"legacy": false
+		},
+		{
+			"name": "type",
+			"ns": "http://csrc.nist.gov/ns/oscal",
+			"objects": ["assessment-results.back-matter.resources[]"],
+			"meaning": "NIST vocabulary: the kind of resource. HDF emits the value evidence on the resource holding a requirement's source code.",
+			"valueFormat": "A NIST resource type; HDF emits evidence",
+			"hdfField": null,
+			"legacy": false
+		}
+	]
+};
+//#endregion
+//#region converters/oscal-to-hdf/typescript/vocabulary.ts
+/**
+* The HDF OSCAL extension vocabulary (ADR-0014 §1.5) and the helpers that emit
+* and read its props. The table is the JSON file the Go peer embeds, imported
+* directly so both languages read one file; the bundler inlines it into dist.
+*/
+/**
+* Validates a decoded vocabulary table and indexes its rows by name, throwing on
+* a malformed table. Mirrors newVocabulary in Go.
+*/
+function validateVocabularyTable(raw) {
+	const table = raw ?? {};
+	if (typeof table.namespace !== "string" || table.namespace === "") throw new Error("oscal: the OSCAL vocabulary table has no namespace");
+	if (typeof table.defaultNamespace !== "string" || table.defaultNamespace === "") throw new Error("oscal: the OSCAL vocabulary table has no defaultNamespace");
+	if (!Array.isArray(table.props) || table.props.length === 0) throw new Error("oscal: the OSCAL vocabulary table has no rows");
+	const byName = /* @__PURE__ */ new Map();
+	for (const row of table.props) {
+		if (byName.has(row.name)) throw new Error(`oscal: the OSCAL vocabulary table defines "${row.name}" twice`);
+		byName.set(row.name, row);
+	}
+	return {
+		namespace: table.namespace,
+		defaultNamespace: table.defaultNamespace,
+		props: table.props,
+		byName
+	};
+}
+const table = validateVocabularyTable(oscal_vocabulary_default);
+const byName = table.byName;
+function mustVocabularyRow(name) {
+	const row = byName.get(name);
+	if (!row) throw new Error(`oscal: "${name}" is not a row of the OSCAL vocabulary`);
+	return row;
+}
+/** Whether a UTF-16 code unit is ECMAScript \s whitespace, which is BMP-only. */
+function isWhitespace(unit) {
+	return /\s/.test(unit);
+}
+/**
+* Renders an HDF value as an OSCAL StringDatatype (ADR-0014 §1.7.1): each run of
+* line terminators becomes one space, ECMAScript whitespace is trimmed from both
+* edges, and a value with nothing left becomes "_". An empty value stays empty;
+* carrying it is the caller's decision (§1.7.3). Mirrors NormalizePropValue in Go.
+*/
+function normalizePropValue(value) {
+	if (value === "") return "";
+	const joined = value.replace(/[\r\n\u2028\u2029]+/g, " ");
+	let start = 0;
+	while (start < joined.length && isWhitespace(joined[start])) start++;
+	let end = joined.length;
+	while (end > start && isWhitespace(joined[end - 1])) end--;
+	const normalized = joined.slice(start, end);
+	return normalized === "" ? "_" : normalized;
+}
+/**
+* Builds the prop a vocabulary row names, in that row's namespace (omitted for
+* NIST's default namespace). The value is normalized (§1.7.1), and an HDF prop
+* whose value changed carries the exact value in remarks (§1.7.2). Returns
+* undefined for an empty value, which writes no prop. An unknown name throws:
+* every prop an exporter emits must be a row. Mirrors VocabularyProp in Go.
+*/
+function vocabularyProp(name, value) {
+	const row = mustVocabularyRow(name);
+	if (value === "") return void 0;
+	const prop = {
+		name: row.name,
+		value: normalizePropValue(value)
+	};
+	if (row.ns !== table.defaultNamespace) prop.ns = row.ns;
+	if (row.ns === table.namespace && prop.value !== value) prop.remarks = value;
+	return prop;
+}
+/** Pushes vocabularyProp(name, value) onto props when it writes a prop. */
+function pushVocabularyProp(props, name, value) {
+	const prop = vocabularyProp(name, value);
+	if (prop) props.push(prop);
+}
+/** Marks an optional HDF string field that is present but empty (§1.7.3). */
+function emptyFieldProp(field) {
+	return mustFieldProp("empty-field", field);
+}
+/** Marks an HDF field OSCAL required a display fallback for (§1.7.4). */
+function absentFieldProp(field) {
+	return mustFieldProp("absent-field", field);
+}
+function mustFieldProp(name, field) {
+	const prop = vocabularyProp(name, field);
+	if (!prop) throw new Error(`oscal: ${name} needs the name of an HDF field`);
+	return prop;
+}
+/**
+* Matches a prop to a row by name and namespace. An absent ns is NIST's default
+* namespace, except that for a legacy row it is also accepted as the row's own prop.
+*/
+function matchVocabularyProp(row, index, p) {
+	if (p.name !== row.name) return void 0;
+	const ns = p.ns ?? "";
+	let legacy = false;
+	if ((ns === "" ? table.defaultNamespace : ns) !== row.ns) {
+		if (ns !== "" || !row.legacy) return void 0;
+		legacy = true;
+	}
+	return {
+		index,
+		value: row.ns === table.namespace && p.remarks ? p.remarks : p.value,
+		legacy
+	};
+}
+/** The first prop in props that is the named row's prop. Mirrors FindVocabularyProp in Go. */
+function findVocabularyProp(props, name) {
+	return findVocabularyProps(props, name)[0];
+}
+/** Every prop in props that is the named row's prop, in order. Mirrors FindVocabularyProps in Go. */
+function findVocabularyProps(props, name) {
+	const row = byName.get(name);
+	if (!row || !props) return [];
+	const matches = [];
+	props.forEach((p, i) => {
+		const m = matchVocabularyProp(row, i, p);
+		if (m) matches.push(m);
+	});
+	return matches;
+}
+/**
+* The first prop in props that is the named row's prop and carries group; an
+* empty group matches only ungrouped props. Mirrors FindGroupedVocabularyProp in Go.
+*/
+function findGroupedVocabularyProp(props, name, group) {
+	return findVocabularyProps(props, name).find((m) => (props[m.index].group ?? "") === group);
+}
+/**
+* Whether props carry the marker prop (empty-field or absent-field) naming field
+* within group (§1.7.3, §1.7.4). Mirrors HasFieldMarker in Go.
+*/
+function hasFieldMarker(props, marker, field, group) {
+	return findVocabularyProps(props, marker).some((m) => m.value === field && (props[m.index].group ?? "") === group);
+}
+/**
+* Reads an optional HDF string field: the named row's prop value when present, an
+* empty string when empty-field names field (§1.7.3), and undefined when the field
+* is absent. Mirrors VocabularyString in Go.
+*/
+function vocabularyString(props, name, field, group) {
+	const match = findGroupedVocabularyProp(props, name, group);
+	if (match) return match.value;
+	return hasFieldMarker(props, "empty-field", field, group) ? "" : void 0;
+}
+/**
+* Whether p is HDF's own and so must never be carried as a foreign prop: every
+* prop in the HDF namespace, and a prop with no ns whose name is a legacy row
+* (§1.4, §3.1). Mirrors ConsumedVocabularyProp in Go.
+*/
+function consumedVocabularyProp(p) {
+	if (p.ns === table.namespace) return true;
+	return (p.ns ?? "") === "" && byName.get(p.name)?.legacy === true;
+}
+//#endregion
 //#region converters/oscal-to-hdf/typescript/shared.ts
 /**
 * Shared helper functions for OSCAL-to-HDF converters.
@@ -14023,7 +14937,7 @@ function controlIdsToNistTags(ids) {
 	return tags;
 }
 /**
-* Extracts the base control ID from a SAR objective ID.
+* Extracts the base control ID from an assessment-plan objective ID.
 * "ac-1.a.1_obj.1" -> "ac-1"
 */
 function extractControlIdFromObjectiveId(objectiveId) {
@@ -14111,28 +15025,96 @@ function extractMetadata(m) {
 		lastModified: String(m["last-modified"])
 	};
 }
-/** Matches NIST 800-53 tags with enhancements like "AC-2 (3)". */
-const nistEnhancementReverseRe = /^([A-Z]{2}-\d+)\s*\((\d+)\)$/;
 /**
-* Converts NIST 800-53 notation back to OSCAL control ID.
-* "AC-1" -> "ac-1", "AC-2 (3)" -> "ac-2.3", "SI-7 (1)" -> "si-7.1"
+* Returns the canonical OSCAL id of the NIST control a target-id names, when the
+* target, ignoring ASCII letter case, is a control ("ac-2", "ac-2.3"), optionally
+* followed by dot-separated parts and an objective or statement suffix
+* ("ac-2.3_obj.a", "au-1_smt.a", "ac-1.a.1_obj.1"), and NIST defines that control
+* at any supported revision; otherwise undefined, including for a target shaped
+* like a control NIST does not define. Mirrors Go's ConfirmedControlID.
 */
-function nistTagToControlId(tag) {
-	tag = tag.trim();
-	const m = nistEnhancementReverseRe.exec(tag);
-	if (m) return `${m[1].toLowerCase()}.${m[2]}`;
-	return tag.toLowerCase();
+function confirmedControlId(targetId) {
+	const target = asciiLower(targetId);
+	const controlId = objectiveIDRe.exec(target)?.[0];
+	if (controlId === void 0 || !isObjectiveOrStatementSuffix(target.slice(controlId.length))) return;
+	const tag = controlIdToNistTag(controlId);
+	return SUPPORTED_NIST_REVISIONS.some((rev) => nistExists(tag, rev)) ? nistTagToControlId(tag) : void 0;
+}
+/** Lowercases only ASCII letters, so Go and TypeScript fold identically. */
+function asciiLower(s) {
+	return s.replace(/[A-Z]/g, (c) => c.toLowerCase());
 }
 /**
-* Converts a 0.0-1.0 impact value to an OSCAL severity string.
-* This is the reverse of extractRiskSeverity.
+* Whether rest, what follows a control id in a lowercased target-id, is empty or
+* names an objective or statement of that control: optional dot-separated
+* letter-and-digit parts, then "_obj" or "_smt", alone or followed by non-empty
+* dot-separated parts.
 */
-function impactToSeverity$1(impact) {
-	return oscalSeverityFromHdf(impactToSeverity(impact));
+function isObjectiveOrStatementSuffix(rest) {
+	if (rest === "") return true;
+	const cut = rest.indexOf("_");
+	if (cut < 0) return false;
+	const parts = rest.slice(0, cut);
+	if (parts !== "") {
+		if (!parts.startsWith(".")) return false;
+		if (parts.slice(1).split(".").some((part) => part === "" || !isLowerAlphanumeric(part))) return false;
+	}
+	const [kind, ...after] = rest.slice(cut + 1).split(".");
+	return (kind === "obj" || kind === "smt") && !after.includes("");
+}
+function isLowerAlphanumeric(part) {
+	return [...part].every((c) => c >= "a" && c <= "z" || c >= "0" && c <= "9");
 }
 /**
-* Maps an HDF status string to an OSCAL risk status string.
-* "passed"/"notApplicable" -> "closed", everything else -> "open".
+* Converts NIST 800-53 notation, in any spelling normalizeNistId accepts, to the
+* OSCAL id of the control it names; a statement part names its control. Anything
+* else is returned trimmed and lowercased.
+* "AC-1" -> "ac-1", "ac-2 (3)" -> "ac-2.3", "AC-8 c 1" -> "ac-8"
+*/
+function nistTagToControlId(tag) {
+	return nistTagToControlRef(tag).controlId;
+}
+/**
+* Converts NIST 800-53 notation to the OSCAL control id and, for a statement
+* part, the OSCAL statement id ("AC-8 c 1" -> "ac-8", "ac-8_smt.c.1";
+* "AC-2 (3) (a)" -> "ac-2.3", "ac-2.3_smt.a"). statementId is empty when the tag
+* names a whole control. A tag that is not a NIST spelling is returned trimmed and
+* lowercased as controlId. Mirrors Go's NistTagToControlRef.
+*/
+function nistTagToControlRef(tag) {
+	const trimmed = tag.trim();
+	const normalized = normalizeNistId(trimmed.split(/\s+/).join(" "));
+	if (normalized === void 0) return {
+		controlId: trimmed.toLowerCase(),
+		statementId: ""
+	};
+	const [head, ...parts] = normalized.split(" ");
+	const [family, number] = head.split("-");
+	let controlId = `${family.toLowerCase()}-${unpadNistNumber(number)}`;
+	if (parts.length > 0 && parts[0][0] >= "0" && parts[0][0] <= "9") controlId += `.${unpadNistNumber(parts.shift())}`;
+	if (parts.length === 0) return {
+		controlId,
+		statementId: ""
+	};
+	return {
+		controlId,
+		statementId: `${controlId}_smt.${parts.map(unpadNistNumber).join(".")}`
+	};
+}
+/** Strips the zero normalizeNistId pads a one-digit number with. */
+function unpadNistNumber(part) {
+	return part.length === 2 && part.startsWith("0") ? part.slice(1) : part;
+}
+/**
+* Converts a 0.0-1.0 impact value to an OSCAL severity string.
+* This is the reverse of extractRiskSeverity.
+*/
+function impactToSeverity$1(impact) {
+	return oscalSeverityFromHdf(impactToSeverity(impact));
+}
+/**
+* Maps an HDF status string to an OSCAL risk status string.
+* "passed"/"notApplicable" -> "closed", everything else -> "open".
 */
 function hdfStatusToOscalRiskStatus(status) {
 	if (status === "passed" || status === "notApplicable") return "closed";
@@ -14141,6 +15123,22 @@ function hdfStatusToOscalRiskStatus(status) {
 /** OSCAL specification version used in reverse converter output documents. */
 const OSCAL_VERSION = "1.1.2";
 /**
+* Builds the description-label prop that marks an OSCAL prose home with the HDF
+* description label whose text it carries.
+*/
+function descriptionLabelProp(label) {
+	const prop = vocabularyProp("description-label", label);
+	if (!prop) throw new Error(`oscal: description label ${JSON.stringify(label)} yields no description-label prop`);
+	return prop;
+}
+/**
+* Returns props' description-label, or '' when there is none; a
+* description-label in any other namespace is foreign.
+*/
+function descriptionLabel(props) {
+	return findVocabularyProp(props, "description-label")?.value ?? "";
+}
+/**
 * Converts a title to kebab-case, truncated to 80 characters.
 * Shared utility used by multiple converters for deriving names.
 */
@@ -14185,8 +15183,7 @@ function toKebabCase(title, fallback) {
 *
 * Two different ids can encode to the same token ('a/b' and 'a:b' both yield
 * 'a_b'), which is why callers must also record the source id in the emitted
-* document — for SAR that is a prop on the finding, trimmed because OSCAL's
-* StringDatatype forbids a padded value.
+* document — for SAR that is the finding's hdf-requirement-id prop.
 */
 function oscalToken(s) {
 	if (s === "") return "";
@@ -14220,6 +15217,33 @@ function oscalString(s) {
 * Results JSON and produces an OSCAL 1.1.2 assessment-results JSON document.
 */
 /**
+* Adds a control, or one statement of it, to the reviewed-controls selection, one
+* entry per control. A control selected whole carries no statement-ids, because
+* listing any would narrow the selection to them. Mirrors Go's selectControl.
+*/
+function selectControl(controls, index, controlId, statementId) {
+	const i = index.get(controlId);
+	if (i === void 0) {
+		index.set(controlId, controls.length);
+		controls.push(statementId === "" ? { "control-id": controlId } : {
+			"control-id": controlId,
+			"statement-ids": [statementId]
+		});
+		return;
+	}
+	const selection = controls[i];
+	const statementIds = selection["statement-ids"];
+	if (statementIds === void 0) return;
+	if (statementId === "") delete selection["statement-ids"];
+	else if (!statementIds.includes(statementId)) statementIds.push(statementId);
+}
+/**
+* Accompanies the include-all selection of a result whose baseline names no
+* control, so the selection is not read as a claim. Mirrors Go's
+* noIdentifiableControlsRemark.
+*/
+const NO_IDENTIFIABLE_CONTROLS_REMARK = "No controls were identifiable in the assessed input, so none is listed individually. OSCAL requires a control selection; include-all is emitted to satisfy it and does not assert that any control was assessed.";
+/**
 * Convert HDF Results JSON to OSCAL Assessment Results (SAR) JSON.
 *
 * @param input - HDF Results JSON string
@@ -14319,18 +15343,15 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	let description = "Converted from HDF results";
 	if (baseline.description && baseline.description !== "") description = baseline.description;
 	const resultProps = [];
-	if (baseline.version && baseline.version !== "") resultProps.push({
-		name: "baseline-version",
-		value: baseline.version
-	});
+	if (typeof baseline.version === "string") pushVocabularyProp(resultProps, "baseline-version", baseline.version);
 	const findings = [];
 	const observations = [];
 	const risks = [];
 	const resources = [];
 	const includeControls = [];
-	const seenControl = /* @__PURE__ */ new Set();
+	const controlIndex = /* @__PURE__ */ new Map();
 	for (const req of baseline.requirements) {
-		const nistId = nistTagToControlId(req.id ?? "");
+		const { controlId: nistId, statementId } = nistTagToControlRef(req.id ?? "");
 		if (nistId === "") continue;
 		const { finding, observation, risk, resource } = requirementToFindingSet(req, timestamp, toolActorUuid, subjects);
 		findings.push(finding);
@@ -14338,12 +15359,12 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 		if (risk) risks.push(risk);
 		if (resource) resources.push(resource);
 		const cid = oscalToken(nistId);
-		if (cid !== "" && !seenControl.has(cid)) {
-			seenControl.add(cid);
-			includeControls.push({ "control-id": cid });
-		}
+		if (cid !== "") selectControl(includeControls, controlIndex, cid, statementId);
 	}
-	const controlSelection = includeControls.length > 0 ? { "include-controls": includeControls } : {};
+	const controlSelection = includeControls.length > 0 ? { "include-controls": includeControls } : {
+		"include-all": {},
+		remarks: NO_IDENTIFIABLE_CONTROLS_REMARK
+	};
 	return {
 		result: {
 			uuid: crypto.randomUUID(),
@@ -14384,31 +15405,17 @@ function buildSubjects(components) {
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
 */
 function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
-	const controlID = oscalToken(nistTagToControlId(req.id ?? ""));
+	const { controlId, statementId } = nistTagToControlRef(req.id ?? "");
+	const [targetType, targetId] = statementId === "" ? ["objective-id", oscalToken(controlId)] : ["statement-id", statementId];
 	const results = req.results ?? [];
 	const descriptions = req.descriptions ?? [];
 	const { state, reason } = effectiveState(req);
 	const findingDesc = extractDefaultDescription(descriptions);
-	const props = [{
-		name: "hdf-requirement-id",
-		value: oscalString(req.id)
-	}];
+	const props = [];
 	const addProp = (name, value) => {
-		if (value !== "") props.push({
-			name,
-			value
-		});
-	};
-	const addProseProp = (name, text) => {
-		const preview = previewLine(text);
-		if (preview === "") return;
-		const p = {
-			name,
-			value: preview
-		};
-		if (preview !== text) p.remarks = text;
-		props.push(p);
+		pushVocabularyProp(props, name, value);
 	};
+	addProp("hdf-requirement-id", req.id);
 	const descriptionByLabel = (label) => {
 		const d = descriptions.find((x) => x.label === label);
 		return d ? d.data : "";
@@ -14421,9 +15428,6 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	};
 	pushTagValues("nist");
 	pushTagValues("cci");
-	addProseProp("check", descriptionByLabel("check"));
-	addProseProp("rationale", descriptionByLabel("rationale"));
-	if (req.impact <= 0) addProseProp("fix", descriptionByLabel("fix"));
 	if (req.controlType) addProp("control-type", req.controlType);
 	if (req.verificationMethod) addProp("verification-method", req.verificationMethod);
 	if (req.applicability) addProp("applicability", req.applicability);
@@ -14451,7 +15455,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 			href: o.uri,
 			rel: "reference"
 		});
-		else if (typeof o.ref === "string") addProseProp("reference", o.ref);
+		else if (typeof o.ref === "string") addProp("reference", o.ref);
 	}
 	for (const er of req.externalReferences ?? []) if (typeof er.href === "string" && er.href !== "") links.push({
 		href: er.href,
@@ -14465,6 +15469,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 		resource = {
 			uuid: resourceUuid,
 			title: `Check source code for ${req.id}`,
+			props: [vocabularyProp("type", "evidence")],
 			base64: {
 				value: encodeBase64Utf8(req.code),
 				"media-type": "text/plain"
@@ -14479,9 +15484,11 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	if (reason) targetStatus.reason = reason;
 	const remarks = overrideRemarks(req);
 	if (remarks) targetStatus.remarks = remarks;
+	const rationale = descriptionByLabel("rationale");
 	const target = {
-		type: "objective-id",
-		"target-id": controlID,
+		type: targetType,
+		"target-id": targetId,
+		...rationale !== "" ? { description: rationale } : {},
 		status: targetStatus
 	};
 	const finding = {
@@ -14506,7 +15513,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 			...relevantEvidence.length > 0 ? { "relevant-evidence": relevantEvidence } : {}
 		};
 		finding["related-observations"] = [{ "observation-uuid": obsUUID }];
-	}
+	} else warnUncarriedProse(req);
 	let risk;
 	if (req.impact > 0) {
 		const riskUUID = crypto.randomUUID();
@@ -14548,8 +15555,8 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	};
 }
 /**
-* Reduces prose to a single line legal as an OSCAL StringDatatype prop value:
-* the first non-empty line, trimmed, truncated to 120 code points.
+* Reduces prose to a single line for an OSCAL single-line field: the first
+* non-empty line, trimmed, truncated to 120 code points.
 */
 function previewLine(text) {
 	for (let line of text.split("\n")) {
@@ -14557,7 +15564,7 @@ function previewLine(text) {
 		if (line === "") continue;
 		const maxRunes = 120;
 		const runes = Array.from(line);
-		if (runes.length > maxRunes) line = `${runes.slice(0, maxRunes - 3).join("").trim()}...`;
+		if (runes.length > maxRunes) line = `${runes.slice(0, 117).join("").trim()}...`;
 		return line;
 	}
 	return "";
@@ -14612,9 +15619,10 @@ function overrideRemarks(req) {
 	return parts.join("; ");
 }
 /**
-* Collects the requirement's refs, evidence, and source location into OSCAL
-* observation relevant-evidence — the home the reverse SAR importer reads back
-* into HDF refs (via href) and evidence (via description).
+* Collects the requirement's refs, evidence and source location, then its check
+* (and impact-0 fix) prose, into OSCAL observation relevant-evidence — the home
+* the reverse SAR importer reads back into HDF refs (via href), evidence (via
+* description) and check/fix (via description-label).
 */
 function buildRelevantEvidence(req) {
 	const ev = [];
@@ -14638,8 +15646,37 @@ function buildRelevantEvidence(req) {
 		const loc = sourceLocationText(req.sourceLocation);
 		if (loc) ev.push({ description: "Source location: " + loc });
 	}
+	for (const label of observationProseLabels(req)) {
+		const text = descriptionText(req, label);
+		ev.push({
+			description: previewLine(text),
+			props: [descriptionLabelProp(label)],
+			remarks: text
+		});
+	}
 	return ev;
 }
+/** Data of the requirement's first description with the label, or ''. */
+function descriptionText(req, label) {
+	return (req.descriptions ?? []).find((d) => d.label === label)?.data ?? "";
+}
+/**
+* Description labels whose text the requirement's observation carries as
+* labelled evidence: check, and fix when impact is 0 (otherwise fix's home is
+* the risk remediation). A description with no preview text carries nothing.
+*/
+function observationProseLabels(req) {
+	return (req.impact <= 0 ? ["check", "fix"] : ["check"]).filter((label) => previewLine(descriptionText(req, label)) !== "");
+}
+/**
+* Reports observation-scoped prose lost because a requirement with no results
+* emits no observation.
+*/
+function warnUncarriedProse(req) {
+	const labels = observationProseLabels(req);
+	if (labels.length === 1) emitConverterWarning(`hdf-to-oscal-sar: requirement ${JSON.stringify(req.id)} has no results, so no observation holds its ${labels[0]} description; it was not carried`);
+	else if (labels.length > 1) emitConverterWarning(`hdf-to-oscal-sar: requirement ${JSON.stringify(req.id)} has no results, so no observation holds its ${labels.join(" and ")} descriptions; they were not carried`);
+}
 /** Renders a source location as "ref:line", degrading to whichever is present. */
 function sourceLocationText(loc) {
 	const ref = loc.ref ?? "";
@@ -14652,8 +15689,9 @@ function severityToFacetValue(s) {
 }
 /**
 * Turns the requirement's fix description and any governing risk-acceptance
-* override into OSCAL risk remediations — the home the reverse importer reads
-* back as the HDF remediation description.
+* override into OSCAL risk remediations. The reverse importer reads the
+* labelled fix back as the HDF fix description and the rest as the remediation
+* description.
 */
 function buildRemediations(req) {
 	const rems = [];
@@ -14662,7 +15700,8 @@ function buildRemediations(req) {
 		uuid: crypto.randomUUID(),
 		lifecycle: "recommendation",
 		title: "Recommended fix",
-		description: fix.data
+		description: fix.data,
+		props: [descriptionLabelProp("fix")]
 	});
 	const overrides = req.statusOverrides ?? [];
 	if (req.disposition && overrides.length > 0) {
@@ -14726,6 +15765,13 @@ function riskStatusFromState(state) {
 * Converts HDF Amendments to OSCAL Plan of Action and Milestones (POA&M) format.
 *
 * This is the reverse direction of the oscal-poam to HDF converter.
+*
+* Every amendments field has an OSCAL home the importer reads back exactly
+* (ADR-0014 §4.6), with four exclusions: the document integrity and signature,
+* the generator (the importer stamps its own), and each override's signature and
+* previousChecksum. A signature covers the original HDF bytes and the checksum
+* chain covers document order; neither survives a format change, and the
+* importer re-chains the overrides it reads.
 */
 /**
 * Convert HDF Amendments JSON to OSCAL POA&M JSON.
@@ -14738,6 +15784,12 @@ async function convertHdfToOscalPoam(input) {
 	const doc = { "plan-of-action-and-milestones": amendmentsToPOAM(amendmentsDoc) };
 	return JSON.stringify(doc, null, 2);
 }
+/** Role ids of the metadata roles the exporter defines. */
+const ROLE_PREPARED_BY = "prepared-by";
+const ROLE_APPROVED_BY = "approved-by";
+const ROLE_COMPLETED_BY = "completed-by";
+/** Marks the risk-log entry whose start is the override's appliedAt and whose logged-by names its appliedBy. */
+const OVERRIDE_APPLIED_TITLE = "Override applied";
 /**
 * Picks the document title, which OSCAL requires on metadata. The HDF name is
 * schema-required, so the fallbacks only matter for a document that slipped
@@ -14747,13 +15799,25 @@ function poamTitle(a) {
 	return firstNonEmpty(a.name, a.amendmentId ?? "", "HDF Amendments");
 }
 /**
+* Stands in for an empty requirementId: HDF puts no minLength on it, and OSCAL
+* 1.2.x requires risk and POA&M item titles to be non-empty. It is display text
+* only; the requirement id rides in hdf-requirement-id. Mirrors Go's
+* unidentifiedRequirementTitle.
+*/
+const UNIDENTIFIED_REQUIREMENT_TITLE = "Unidentified requirement";
+/** The title of the risk and POA&M item an override produces. */
+function requirementTitle(override) {
+	return firstNonEmpty(override.requirementId, UNIDENTIFIED_REQUIREMENT_TITLE);
+}
+/**
 * Supplies the text OSCAL requires for a risk's description and statement. HDF
 * puts no minLength on reason, so an override can legitimately carry none; the
 * fallback states that absence rather than inventing an impact assessment the
-* source never made.
+* source never made, and names the requirement only when there is one.
 */
 function riskRationale(override) {
-	return firstNonEmpty(override.reason, `No rationale was recorded for the ${String(override.type)} override applied to ${override.requirementId}.`);
+	const absence = firstNonEmpty(override.requirementId) === "" ? `No rationale was recorded for the ${String(override.type)} override.` : `No rationale was recorded for the ${String(override.type)} override applied to ${override.requirementId}.`;
+	return firstNonEmpty(override.reason, absence);
 }
 /** HDF dates arrive as strings from JSON.parse but are typed as Date. */
 function toDate(value) {
@@ -14763,72 +15827,87 @@ function toDate(value) {
 	return d;
 }
 /**
-* Deduplicates HDF identities into OSCAL metadata parties. A party keeps its
-* UUID across reuse so origin actors and responsible parties reference the same
-* entry. Insertion order is preserved for deterministic output.
+* Deduplicates HDF identities into OSCAL metadata parties, one per distinct
+* (identifier, type, description) triple; an absent and an empty description are
+* distinct. Insertion order is preserved for deterministic output.
 */
 var PartyRegistry = class {
 	constructor() {
-		this.byId = /* @__PURE__ */ new Map();
+		this.byKey = /* @__PURE__ */ new Map();
 	}
 	getOrAdd(id) {
-		const name = oscalString(id.identifier);
-		const existing = this.byId.get(name);
+		const key = JSON.stringify([
+			id.identifier,
+			id.type,
+			id.description ?? null
+		]);
+		const existing = this.byKey.get(key);
 		if (existing) return existing.uuid;
+		const name = oscalString(id.identifier);
+		const props = [];
+		pushVocabularyProp(props, "identity-identifier", id.identifier ?? "");
+		pushVocabularyProp(props, "identity-type", String(id.type));
+		if (id.description === "") props.push(emptyFieldProp("description"));
 		const party = {
 			uuid: crypto.randomUUID(),
 			type: "person",
-			...name === "" ? {} : { name }
+			...name === "" ? {} : { name },
+			...props.length > 0 ? { props } : {},
+			...id.description ? { remarks: id.description } : {}
 		};
-		this.byId.set(name, party);
+		this.byKey.set(key, party);
 		return party.uuid;
 	}
 	list() {
-		return [...this.byId.values()];
+		return [...this.byKey.values()];
 	}
 };
 /**
 * Converts parsed HDFAmendments to an OSCAL PlanOfActionAndMilestones.
 */
 function amendmentsToPOAM(amendments) {
-	const parties = new PartyRegistry();
+	const b = {
+		parties: new PartyRegistry(),
+		observations: [],
+		resources: [],
+		completedBy: false
+	};
 	const roles = [];
 	const responsibleParties = [];
 	if (amendments.appliedBy) {
-		const uuid = parties.getOrAdd(amendments.appliedBy);
+		const uuid = b.parties.getOrAdd(amendments.appliedBy);
 		roles.push({
-			id: "prepared-by",
+			id: ROLE_PREPARED_BY,
 			title: "Prepared By"
 		});
 		responsibleParties.push({
-			"role-id": "prepared-by",
+			"role-id": ROLE_PREPARED_BY,
 			"party-uuids": [uuid]
 		});
 	}
 	if (amendments.approvedBy) {
-		const uuid = parties.getOrAdd(amendments.approvedBy);
+		const uuid = b.parties.getOrAdd(amendments.approvedBy);
 		roles.push({
-			id: "approved-by",
+			id: ROLE_APPROVED_BY,
 			title: "Approved By"
 		});
 		responsibleParties.push({
-			"role-id": "approved-by",
+			"role-id": ROLE_APPROVED_BY,
 			"party-uuids": [uuid]
 		});
 	}
-	for (const override of amendments.overrides) parties.getOrAdd(override.appliedBy);
-	let importSSP;
-	if (amendments.systemRef && amendments.systemRef !== "") importSSP = { href: amendments.systemRef };
-	else importSSP = { href: "#" };
+	for (const override of amendments.overrides) b.parties.getOrAdd(override.appliedBy);
 	const poamItems = [];
 	const risks = [];
-	const observations = [];
 	for (const override of amendments.overrides) {
-		const { item, itemRisks, itemObs } = overrideToPOAMItem(override, parties);
+		const { item, risk } = overrideToPOAMItem(override, b);
 		poamItems.push(item);
-		risks.push(...itemRisks);
-		observations.push(...itemObs);
+		risks.push(risk);
 	}
+	if (b.completedBy) roles.push({
+		id: ROLE_COMPLETED_BY,
+		title: "Completed By"
+	});
 	const metadata = {
 		title: poamTitle(amendments),
 		"last-modified": latestAppliedAt(amendments.overrides),
@@ -14836,139 +15915,201 @@ function amendmentsToPOAM(amendments) {
 		"oscal-version": OSCAL_VERSION
 	};
 	if (amendments.description) metadata.remarks = amendments.description;
-	const partyList = parties.list();
+	const partyList = b.parties.list();
 	if (partyList.length > 0) metadata.parties = partyList;
-	if (roles.length > 0) {
-		metadata.roles = roles;
-		metadata["responsible-parties"] = responsibleParties;
-	}
+	if (roles.length > 0) metadata.roles = roles;
+	if (responsibleParties.length > 0) metadata["responsible-parties"] = responsibleParties;
 	const metaProps = metadataProps(amendments);
 	if (metaProps.length > 0) metadata.props = metaProps;
 	const poam = {
 		uuid: crypto.randomUUID(),
 		metadata,
-		"import-ssp": importSSP,
+		"import-ssp": { href: amendments.systemRef ? amendments.systemRef : "#" },
 		"poam-items": poamItems
 	};
 	if (risks.length > 0) poam.risks = risks;
-	if (observations.length > 0) poam.observations = observations;
-	const resources = externalRefResources(amendments.overrides);
-	if (resources.length > 0) poam["back-matter"] = { resources };
+	if (b.observations.length > 0) poam.observations = b.observations;
+	if (b.resources.length > 0) poam["back-matter"] = { resources: b.resources };
 	return poam;
 }
 /**
-* Converts a single StandaloneOverride to a POAMItem, its associated Risk, and
-* any evidence observations.
+* Carries an optional HDF string field: its prop when the value is non-empty,
+* empty-field when it is present and empty (§1.7.3), and nothing when it is
+* absent. Mirrors appendOptionalString in Go.
 */
-function overrideToPOAMItem(override, parties) {
+function pushOptionalString(props, name, field, value) {
+	if (value === void 0 || value === null) return;
+	if (value === "") {
+		props.push(emptyFieldProp(field));
+		return;
+	}
+	pushVocabularyProp(props, name, value);
+}
+/** Renders HDF text as single-line OSCAL display text, falling back when there is none. */
+function displayLine(text, fallback) {
+	return normalizePropValue(text) || fallback;
+}
+/** The HDF canonical trimmed-UTC form of a date, keeping its millisecond fraction. */
+function timestamp(value) {
+	const d = toDate(value);
+	return d ? formatTimestamp(d) : void 0;
+}
+/**
+* Converts a single StandaloneOverride to a POAMItem and its risk, adding its
+* evidence observations, back-matter resources and parties to the builder.
+*/
+function overrideToPOAMItem(override, b) {
 	const riskUUID = crypto.randomUUID();
 	const riskStatus = override.status ? hdfStatusToOscalRiskStatus(String(override.status)) : "open";
-	const controlID = nistTagToControlId(override.requirementId);
-	const riskProps = [];
-	pushStringProp(riskProps, "impacted-control-id", controlID);
-	if (override.type) riskProps.push({
-		name: "override-type",
-		value: String(override.type)
-	});
-	if (override.impact && typeof override.impact.value === "number") riskProps.push({
-		name: "impact-override",
-		value: String(override.impact.value)
-	});
-	if (override.justification) pushStringProp(riskProps, "justification", String(override.justification));
-	if (override.baselineRef) pushStringProp(riskProps, "baseline-ref", override.baselineRef);
-	if (override.componentRef) pushStringProp(riskProps, "component-ref", override.componentRef);
-	const remediations = [];
-	if (override.milestones) for (const ms of override.milestones) {
-		const msProps = [];
-		if (ms.status) msProps.push({
-			name: "milestone-status",
-			value: String(ms.status)
-		});
-		let tasks;
-		const d = ms.estimatedCompletion ? toDate(ms.estimatedCompletion) : void 0;
-		if (d) {
-			const eta = formatTimestampSeconds(d);
-			const taskProps = milestoneCompletionProps(ms);
-			tasks = [{
-				uuid: crypto.randomUUID(),
-				type: "milestone",
-				title: ms.description,
-				timing: { "within-date-range": {
-					start: eta,
-					end: eta
-				} },
-				...taskProps.length > 0 ? { props: taskProps } : {}
-			}];
-		}
-		remediations.push({
-			uuid: crypto.randomUUID(),
-			lifecycle: "planned",
-			title: ms.description,
-			description: ms.description,
-			props: msProps.length > 0 ? msProps : void 0,
-			tasks
-		});
+	const applier = b.parties.getOrAdd(override.appliedBy);
+	const remediations = milestoneRemediations(override.milestones ?? [], b);
+	const characterizations = cvssCharacterizations(override.cvss, applier);
+	const riskLog = riskLogFor(override, applier, riskStatus);
+	const deadline = timestamp(override.expiresAt);
+	const itemObs = [];
+	for (const ev of override.evidence ?? []) {
+		const obs = evidenceObservation(ev, override.appliedAt, b);
+		b.observations.push(obs);
+		itemObs.push(obs.uuid);
 	}
-	const characterizations = [];
-	if (override.cvss) {
-		const actorUUID = parties.getOrAdd(override.appliedBy);
-		characterizations.push({
-			origin: { actors: [{
-				"actor-uuid": actorUUID,
-				type: "party"
-			}] },
-			facets: cvssFacets(override.cvss)
+	const links = [];
+	for (const ref of override.externalReferences ?? []) {
+		const res = referenceResource(ref, b);
+		b.resources.push(res);
+		links.push({
+			href: `#${res.uuid}`,
+			rel: "reference"
 		});
 	}
-	let riskLog;
-	const expiresDate = override.expiresAt ? toDate(override.expiresAt) : void 0;
-	if (expiresDate && expiresDate.getTime() > 0) riskLog = { entries: [{
-		uuid: crypto.randomUUID(),
-		title: "Scheduled review",
-		description: "Amendment expiration date",
-		start: formatTimestampSeconds(expiresDate),
-		"status-change": riskStatus
-	}] };
-	const deadline = expiresDate && expiresDate.getTime() > 0 ? formatTimestampSeconds(expiresDate) : void 0;
-	const itemObs = [];
-	const relatedObs = [];
-	const collected = observationCollected(override);
-	if (override.evidence) for (const ev of override.evidence) {
-		const obsUUID = crypto.randomUUID();
-		itemObs.push(evidenceObservation(ev, obsUUID, collected));
-		relatedObs.push({ "observation-uuid": obsUUID });
-	}
 	const rationale = riskRationale(override);
 	const risk = {
 		uuid: riskUUID,
-		title: override.requirementId,
+		title: requirementTitle(override),
 		description: rationale,
 		statement: rationale,
+		props: riskProps(override),
+		...links.length > 0 ? { links } : {},
 		status: riskStatus,
-		deadline,
-		props: riskProps,
-		characterizations: characterizations.length > 0 ? characterizations : void 0,
-		remediations: remediations.length > 0 ? remediations : void 0,
-		"risk-log": riskLog
+		...deadline ? { deadline } : {},
+		...characterizations.length > 0 ? { characterizations } : {},
+		...remediations.length > 0 ? { remediations } : {},
+		...riskLog ? { "risk-log": riskLog } : {}
 	};
 	return {
 		item: {
 			uuid: crypto.randomUUID(),
-			title: override.requirementId,
+			title: requirementTitle(override),
 			description: override.reason,
-			"related-risks": [{ "risk-uuid": riskUUID }],
-			...relatedObs.length > 0 ? { "related-observations": relatedObs } : {}
+			...itemObs.length > 0 ? { "related-observations": itemObs.map((uuid) => ({ "observation-uuid": uuid })) } : {},
+			"related-risks": [{ "risk-uuid": riskUUID }]
 		},
-		itemRisks: [risk],
-		itemObs
+		risk
 	};
 }
 /**
+* Carries the override's identity, disposition and scope. The FedRAMP
+* impacted-control-id is added only for a requirement id NIST defines.
+*/
+function riskProps(override) {
+	const props = [];
+	pushVocabularyProp(props, "hdf-requirement-id", override.requirementId ?? "");
+	if (nistExists(override.requirementId ?? "")) pushVocabularyProp(props, "impacted-control-id", nistTagToControlId(override.requirementId));
+	pushVocabularyProp(props, "override-type", String(override.type));
+	if (override.status !== void 0) pushVocabularyProp(props, "override-status", String(override.status));
+	if (override.impact && typeof override.impact.value === "number") pushVocabularyProp(props, "impact-override", floatNumber(override.impact.value).token);
+	if (override.justification !== void 0) pushVocabularyProp(props, "justification", String(override.justification));
+	pushOptionalString(props, "baseline-ref", "baselineRef", override.baselineRef);
+	pushOptionalString(props, "component-ref", "componentRef", override.componentRef);
+	pushOptionalString(props, "inherited-from", "inheritedFrom", override.inheritedFrom);
+	(override.affectedPackages ?? []).forEach((pkg, i) => {
+		props.push(...affectedPackageProps(pkg, `package-${i + 1}`));
+	});
+	return props;
+}
+/** Carries one affected package, every prop in its group. */
+function affectedPackageProps(pkg, group) {
+	const props = [];
+	pushOptionalString(props, "affected-package-name", "name", pkg.name);
+	pushOptionalString(props, "affected-package-version", "version", pkg.version);
+	pushOptionalString(props, "affected-package-ecosystem", "ecosystem", pkg.ecosystem === void 0 ? void 0 : String(pkg.ecosystem));
+	pushOptionalString(props, "affected-package-cpe", "cpe", pkg.cpe);
+	pushOptionalString(props, "affected-package-purl", "purl", pkg.purl);
+	pushOptionalString(props, "affected-package-fixed-in-version", "fixedInVersion", pkg.fixedInVersion);
+	return props.map((p) => ({
+		...p,
+		group
+	}));
+}
+/** Records when and by whom the override was applied, and its scheduled review at expiry. */
+function riskLogFor(override, applier, riskStatus) {
+	const entries = [];
+	const appliedAt = timestamp(override.appliedAt);
+	if (appliedAt) entries.push({
+		uuid: crypto.randomUUID(),
+		title: OVERRIDE_APPLIED_TITLE,
+		start: appliedAt,
+		"logged-by": [{ "party-uuid": applier }]
+	});
+	const expiresAt = timestamp(override.expiresAt);
+	if (expiresAt) entries.push({
+		uuid: crypto.randomUUID(),
+		title: "Scheduled review",
+		description: "Amendment expiration date",
+		start: expiresAt,
+		"status-change": riskStatus
+	});
+	return entries.length > 0 ? { entries } : void 0;
+}
+/**
+* Renders each milestone as a planned remediation whose title and description are
+* the milestone's and whose task carries its title, schedule, status and
+* completion. An untitled milestone is titled "Milestone <n>" and marked
+* absent-field on both objects (§1.7.4). Mirrors milestoneRemediations in Go.
+*/
+function milestoneRemediations(milestones, b) {
+	return milestones.map((ms, i) => {
+		const marker = ms.title === void 0 ? [absentFieldProp("title")] : [];
+		const title = ms.title ?? `Milestone ${i + 1}`;
+		const rem = {
+			uuid: crypto.randomUUID(),
+			lifecycle: "planned",
+			title,
+			description: ms.description,
+			...marker.length > 0 ? { props: marker } : {}
+		};
+		const eta = timestamp(ms.estimatedCompletion);
+		if (eta) {
+			const props = [...marker];
+			pushVocabularyProp(props, "milestone-status", String(ms.status));
+			const completedAt = timestamp(ms.completedAt);
+			if (completedAt) pushVocabularyProp(props, "completed-at", completedAt);
+			const task = {
+				uuid: crypto.randomUUID(),
+				type: "milestone",
+				title,
+				...props.length > 0 ? { props } : {},
+				timing: { "within-date-range": {
+					start: eta,
+					end: eta
+				} }
+			};
+			if (ms.completedBy) {
+				b.completedBy = true;
+				task["responsible-roles"] = [{
+					"role-id": ROLE_COMPLETED_BY,
+					"party-uuids": [b.parties.getOrAdd(ms.completedBy)]
+				}];
+			}
+			rem.tasks = [task];
+		}
+		return rem;
+	});
+}
+/**
 * Returns the most recent override appliedAt for metadata.last-modified.
-* Sourcing it from the input keeps output deterministic and lets the reverse
-* importer recover appliedAt. Falls back to the wall clock only when no override
-* carries a date (appliedAt is schema-required, so real documents always supply
-* one).
+* Sourcing it from the input keeps output deterministic. Falls back to the wall
+* clock only when no override carries a date (appliedAt is schema-required, so
+* real documents always supply one).
 */
 function latestAppliedAt(overrides) {
 	let latest;
@@ -14979,160 +16120,182 @@ function latestAppliedAt(overrides) {
 	return formatTimestampSeconds(latest ?? /* @__PURE__ */ new Date());
 }
 /**
-* Add a property whose value OSCAL types as StringDatatype, trimming it and
-* omitting the property entirely when nothing survives. A prop with an empty
-* value carries no more than an absent one and is schema-invalid. Mirrors
-* appendStringProp in the Go peer.
+* Sources metadata.version from the amendments document. OSCAL requires a
+* version, so an absent or empty one is written as 1.0.0 and marked by a metadata prop.
 */
-function pushStringProp(props, name, value) {
-	const trimmed = oscalString(value ?? "");
-	if (trimmed !== "") props.push({
-		name,
-		value: trimmed
-	});
-}
-/** Sources metadata.version from the amendments document, defaulting when omitted. */
 function amendmentsVersion(a) {
 	return oscalString(a.version ?? "") || "1.0.0";
 }
 /**
-* Carries document identifiers and labels that have no first-class OSCAL home.
-* Labels are emitted in sorted key order for deterministic output.
+* Carries the document fields that have no first-class OSCAL home and marks the
+* display fallbacks OSCAL forced. Labels are key/value prop pairs grouped in
+* sorted key order.
 */
 function metadataProps(a) {
 	const props = [];
-	if (a.amendmentId) pushStringProp(props, "amendment-id", a.amendmentId);
-	if (a.labels) for (const [key, value] of Object.entries(a.labels).sort(([x], [y]) => x < y ? -1 : x > y ? 1 : 0)) {
-		const prop = labelProp(key, value);
-		if (prop.value !== "") props.push(prop);
-	}
+	pushVocabularyProp(props, "amendments-name", a.name ?? "");
+	pushOptionalString(props, "amendment-id", "amendmentId", a.amendmentId);
+	if (a.description === "") props.push(emptyFieldProp("description"));
+	pushFallbackMarker(props, "systemRef", a.systemRef);
+	pushFallbackMarker(props, "version", a.version);
+	Object.keys(a.labels ?? {}).sort(byCodePoint).forEach((key, i) => {
+		const group = `label-${i + 1}`;
+		props.push(labelProp("label-key", "key", key, group), labelProp("label-value", "value", a.labels[key], group));
+	});
 	return props;
 }
 /**
-* Render one amendments label as a property. OSCAL types prop/@name as
-* TokenDatatype while HDF puts no constraint on label keys, so the key is
-* encoded and the source key kept in remarks when it had to change. Every label
-* key in this package's converter fixtures is token-shaped today, so this guards a shape real
-* data has not yet produced — but Kubernetes and OCI label keys are namespaced
-* with '/', which HDF permits and OSCAL rejects.
-*
-* Mirrored by labelProp in the Go converter.
+* Marks an OSCAL-required field written as a display fallback: absent-field when
+* the HDF field is absent, empty-field when it is empty.
 */
-function labelProp(key, value) {
-	const name = oscalToken(key) === "" ? "_" : oscalToken(key);
-	const prop = {
-		name,
-		value: oscalString(value),
-		class: "amendment-label"
+function pushFallbackMarker(props, field, value) {
+	if (value === void 0) props.push(absentFieldProp(field));
+	else if (value === "") props.push(emptyFieldProp(field));
+}
+/** Renders one half of an amendments label; an empty key or value is carried by empty-field (§1.7.3). */
+function labelProp(name, field, value, group) {
+	return {
+		...vocabularyProp(name, value) ?? emptyFieldProp(field),
+		class: "amendment-label",
+		group
 	};
-	if (key !== "" && name !== key) prop.remarks = key;
-	return prop;
 }
-/** Picks the collection timestamp for evidence observations. */
-function observationCollected(override) {
-	return formatTimestampSeconds(toDate(override.appliedAt) ?? /* @__PURE__ */ new Date());
+/** An RFC 3986 URI with a scheme, whose characters are all ones a URI may contain. */
+const ABSOLUTE_URI = /^[A-Za-z][A-Za-z0-9+.-]*:[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=%]*$/;
+/** Whether evidence data is carried as the observation's relevant-evidence href rather than in a back-matter resource. */
+function evidenceDataIsHref(ev) {
+	switch (String(ev.type)) {
+		case "url": return true;
+		case "screenshot":
+		case "file": return ABSOLUTE_URI.test(ev.data);
+		default: return false;
+	}
 }
 /** Renders a single HDF Evidence item as an OSCAL observation. */
-function evidenceObservation(ev, uuid, defaultCollected) {
-	const captured = ev.capturedAt ? toDate(ev.capturedAt) : void 0;
-	const collected = captured ? formatTimestampSeconds(captured) : defaultCollected;
-	const desc = ev.description && ev.description !== "" ? ev.description : "supporting evidence";
-	const re = { description: desc };
-	if (ev.type === "url") re.href = ev.data;
-	else if (ev.data) re.remarks = ev.data;
+function evidenceObservation(ev, appliedAt, b) {
 	const props = [];
-	if (ev.mimeType) pushStringProp(props, "mime-type", ev.mimeType);
-	if (ev.capturedBy && ev.capturedBy.identifier) pushStringProp(props, "captured-by", ev.capturedBy.identifier);
+	let display = "Supporting evidence";
+	let description = display;
+	if (ev.description === void 0) props.push(absentFieldProp("description"));
+	else {
+		description = ev.description;
+		display = displayLine(ev.description, display);
+	}
+	pushOptionalString(props, "mime-type", "mimeType", ev.mimeType);
+	pushOptionalString(props, "evidence-encoding", "encoding", ev.encoding);
+	if (typeof ev.size === "number") pushVocabularyProp(props, "evidence-size", floatNumber(ev.size).token);
+	let collected = timestamp(ev.capturedAt);
+	if (collected === void 0) {
+		collected = timestamp(appliedAt) ?? formatTimestamp(/* @__PURE__ */ new Date());
+		props.push(absentFieldProp("capturedAt"));
+	}
+	const re = { description: display };
+	let links;
+	if (evidenceDataIsHref(ev)) re.href = ev.data;
+	else {
+		const res = {
+			uuid: crypto.randomUUID(),
+			base64: {
+				...ev.mimeType ? { "media-type": normalizePropValue(ev.mimeType) } : {},
+				value: ev.encoding === "base64" ? ev.data : encodeBase64Utf8(ev.data)
+			}
+		};
+		b.resources.push(res);
+		links = [{
+			href: `#${res.uuid}`,
+			rel: "evidence"
+		}];
+	}
 	return {
-		uuid,
-		description: desc,
+		uuid: crypto.randomUUID(),
+		description,
+		...props.length > 0 ? { props } : {},
+		...links ? { links } : {},
 		methods: ["EXAMINE"],
 		types: [String(ev.type)],
+		...ev.capturedBy ? { origins: [{ actors: [{
+			type: "party",
+			"actor-uuid": b.parties.getOrAdd(ev.capturedBy)
+		}] }] } : {},
 		collected,
-		...props.length > 0 ? { props } : {},
 		"relevant-evidence": [re]
 	};
 }
 /**
-* Decomposes an HDF Cvss record into OSCAL risk facets. A version facet is
-* always present so the characterization carries at least one facet.
+* Carries an HDF Cvss record as one risk characterization: a facet per present
+* field in the CVSS system for its version, attributed to the override's applier.
 */
-function cvssFacets(c) {
+function cvssCharacterizations(c, applier) {
+	if (!c) return [];
 	const system = `http://www.first.org/cvss/v${String(c.version)}`;
-	const facets = [{
-		name: "cvss_version",
-		system,
-		value: String(c.version)
-	}];
-	const add = (name, value) => {
-		if (value !== void 0 && value !== null && value !== "") facets.push({
+	const props = [];
+	const facets = [];
+	const add = (name, field, value) => {
+		if (value === void 0 || value === null) return;
+		if (value === "") {
+			props.push(emptyFieldProp(field));
+			return;
+		}
+		const facet = {
 			name,
 			system,
-			value
-		});
+			value: normalizePropValue(value)
+		};
+		if (facet.value !== value) facet.remarks = value;
+		facets.push(facet);
 	};
-	add("base_score", num(c.baseScore));
-	add("base_severity", c.baseSeverity ? String(c.baseSeverity) : void 0);
-	add("base_vector", c.baseVector ?? void 0);
-	add("threat_score", num(c.threatScore));
-	add("threat_vector", c.threatVector ?? void 0);
-	add("environmental_score", num(c.environmentalScore));
-	add("environmental_vector", c.environmentalVector ?? void 0);
-	add("computed_score", num(c.computedScore));
-	add("computed_severity", c.computedSeverity ? String(c.computedSeverity) : void 0);
-	add("supplemental_vector", c.supplementalVector ?? void 0);
-	add("source", c.source ?? void 0);
-	return facets;
-}
-function num(n) {
-	return typeof n === "number" ? String(n) : void 0;
-}
-/**
-* Collects every override's external references into back-matter resources —
-* the OSCAL home for advisories, STIX, and CTI feeds.
-*/
-function externalRefResources(overrides) {
-	const resources = [];
-	for (const o of overrides) {
-		if (!o.externalReferences) continue;
-		for (const ref of o.externalReferences) {
-			const res = {
-				uuid: crypto.randomUUID(),
-				title: ref.sourceName
-			};
-			if (ref.description && ref.description !== "") res.description = ref.description;
-			if (ref.href && ref.href !== "") res.rlinks = [{ href: ref.href }];
-			const props = [];
-			if (ref.sourceName) props.push({
-				name: "source-name",
-				value: ref.sourceName
-			});
-			if (ref.externalId) props.push({
-				name: "external-id",
-				value: ref.externalId
-			});
-			if (props.length > 0) res.props = props;
-			resources.push(res);
-		}
-	}
-	return resources;
+	const score = (name, field, value) => {
+		if (typeof value === "number") add(name, field, floatNumber(value).token);
+	};
+	add("cvss_version", "version", String(c.version));
+	score("base_score", "baseScore", c.baseScore);
+	add("base_severity", "baseSeverity", c.baseSeverity === void 0 ? void 0 : String(c.baseSeverity));
+	add("base_vector", "baseVector", c.baseVector);
+	score("threat_score", "threatScore", c.threatScore);
+	add("threat_vector", "threatVector", c.threatVector);
+	score("environmental_score", "environmentalScore", c.environmentalScore);
+	add("environmental_vector", "environmentalVector", c.environmentalVector);
+	score("computed_score", "computedScore", c.computedScore);
+	add("computed_severity", "computedSeverity", c.computedSeverity === void 0 ? void 0 : String(c.computedSeverity));
+	add("supplemental_vector", "supplementalVector", c.supplementalVector);
+	add("source", "source", c.source);
+	return [{
+		...props.length > 0 ? { props } : {},
+		origin: { actors: [{
+			type: "party",
+			"actor-uuid": applier
+		}] },
+		facets
+	}];
 }
-/**
-* Carries the actual completion attribution that the estimated-completion
-* timing cannot express.
-*/
-function milestoneCompletionProps(ms) {
+/** Carries one external reference as a back-matter resource. */
+function referenceResource(ref, b) {
 	const props = [];
-	const completedAt = ms.completedAt ? toDate(ms.completedAt) : void 0;
-	if (completedAt) props.push({
-		name: "completed-at",
-		value: formatTimestampSeconds(completedAt)
-	});
-	if (ms.completedBy && ms.completedBy.identifier) props.push({
-		name: "completed-by",
-		value: ms.completedBy.identifier
-	});
-	return props;
+	pushVocabularyProp(props, "source-name", ref.sourceName ?? "");
+	pushOptionalString(props, "external-id", "externalId", ref.externalId);
+	if (ref.href === "") props.push(emptyFieldProp("href"));
+	if (ref.description === "") props.push(emptyFieldProp("description"));
+	pushOptionalString(props, "reference-rel", "rel", ref.rel);
+	pushOptionalString(props, "reference-media-type", "mediaType", ref.mediaType);
+	if (ref.checksum) {
+		pushOptionalString(props, "checksum-algorithm", "checksum.algorithm", String(ref.checksum.algorithm));
+		pushOptionalString(props, "checksum-value", "checksum.value", ref.checksum.value);
+	}
+	if (ref.addedBy) pushVocabularyProp(props, "added-by", b.parties.getOrAdd(ref.addedBy));
+	const addedAt = timestamp(ref.addedAt);
+	if (addedAt) pushVocabularyProp(props, "added-at", addedAt);
+	pushOptionalString(props, "reference-kind", "kind", ref.kind);
+	return {
+		uuid: crypto.randomUUID(),
+		title: ref.sourceName,
+		...ref.description ? { description: ref.description } : {},
+		...props.length > 0 ? { props } : {},
+		...ref.href ? { rlinks: [{ href: ref.href }] } : {},
+		...ref.document ? { base64: {
+			"media-type": "application/json",
+			value: encodeBase64Utf8(stringifyLine(canonicalize$1(ref.document)))
+		} } : {}
+	};
 }
 //#endregion
 //#region converters/ionchannel-to-hdf/typescript/converter.ts
@@ -15231,7 +16394,8 @@ function analysisTimestamp(a) {
 }
 function buildScanRequirement(scan, analysis) {
 	const title = scan.description || `${titleCaseFirst(scan.name)} scan`;
-	const descriptions = [createDescription("default", scan.summary || `${titleCaseFirst(scan.name)} scan summary`)];
+	const desc = scan.summary || `${titleCaseFirst(scan.name)} scan summary`;
+	const descriptions = [createDescription("default", desc)];
 	const results = [{
 		status: ResultStatus.NotReviewed,
 		codeDesc: `${scan.name} scan summary`,
@@ -15296,11 +16460,13 @@ async function convertIonchannelToHdf(input, converterVersion = "1.0.0") {
 			outdated_version: dep.outdated_version,
 			dependencies: dep.dependencies
 		}, null, 2);
-		const req = createRequirement(depId, title, [createDescription("default", `Dependency ${dep.org}/${dep.name}`)], 0, [{
+		const descriptions = [createDescription("default", `Dependency ${dep.org}/${dep.name}`)];
+		const results = [{
 			status: ResultStatus.NotReviewed,
 			codeDesc: "Dependency inventory item",
 			startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
-		}], { tags });
+		}];
+		const req = createRequirement(depId, title, descriptions, 0, results, { tags });
 		req.code = code;
 		req.controlType = deriveControlTypeFromTags(DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS);
 		req.verificationMethod = VerificationMethodEnum.Automated;
@@ -16128,7 +17294,7 @@ async function convertSpdxVexToHdf(input, converterVersion = "1.0.0") {
 		if (o) overrides.push(o);
 	}
 	if (overrides.length === 0) throw new Error("spdx-vex-to-hdf: SPDX document contains no actionable VEX statements (only affected/under_investigation); no amendment to write");
-	const appliedBy = documentIdentity(graph, idx);
+	const appliedBy = documentIdentity$1(graph, idx);
 	const name = appliedBy.identifier && appliedBy.identifier !== DEFAULT_APPLIED_BY ? `SPDX VEX statements from ${appliedBy.identifier}` : "SPDX VEX statements";
 	await chainOverrides(overrides);
 	return {
@@ -16238,7 +17404,7 @@ function identityFor(creationInfoRef, idx) {
 		identifier: DEFAULT_APPLIED_BY
 	};
 }
-function documentIdentity(graph, idx) {
+function documentIdentity$1(graph, idx) {
 	for (const el of graph) if (el.type === "SpdxDocument") {
 		const id = identityFor(el.creationInfo, idx);
 		if (id.identifier !== DEFAULT_APPLIED_BY) return id;
@@ -16339,19 +17505,58 @@ function isCvssType(type) {
 const GO_ZERO_TIME$1 = /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 const CVE_ID_PATTERN$2 = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE$2 = /^Products:\s*(.+)$/m;
-const DEFAULT_PRODUCT_ID$1 = "HDFPID-0001";
-/** Map an HDF Cvss block to a CSAF score entry (cvss_v2/v3/v4 by version). */
-function buildCsafScore(cvss, products) {
+const DEFAULT_PRODUCT_ID = "HDFPID-0001";
+const DEFAULT_PRODUCT_NAME = "No product identity was recorded in the source amendment";
+/**
+* Map an HDF Cvss_Severity band to the FIRST.org severityType enum: the same
+* five bands, which FIRST spells uppercase. Pinned in both languages to
+* fixtures/cvss-score-cases.json and to the vendored schema's enum.
+*/
+function csafSeverity(s) {
+	return s.toUpperCase();
+}
+/**
+* Map an HDF Cvss block to a CSAF score entry, or undefined when the block
+* cannot be exported.
+*
+* A score is emitted only when every field the FIRST.org schema for its
+* version requires is present: version, vectorString and baseScore, plus
+* baseSeverity for 3.x and 4.0 (2.0 defines no severity, so none is emitted
+* for it). HDF requires only version, so legal HDF can fall short, and the
+* choice is to drop such a block rather than emit it partially: a partial
+* score fails the CSAF schema, and conforming consumers reject a document that
+* fails it, so it would cost every statement in the export, not just itself.
+* Nothing is synthesized to close the gap — a vector cannot be recovered from
+* a score, and a band the source never stated would be asserted in its name —
+* and the drop is logged so the loss is visible. A block with no base metrics
+* at all is consumer enrichment by design (threat or environmental deltas on a
+* riskAdjustment); CSAF scores carry base metrics, so nothing exportable was
+* lost and it is skipped silently.
+*/
+function buildCsafScore(cvss, cve, products) {
+	const { version, baseVector, baseScore, baseSeverity } = cvss;
+	const hasVector = Boolean(baseVector);
+	const hasScore = typeof baseScore === "number";
+	const hasSeverity = typeof baseSeverity === "string";
+	if (!hasVector && !hasScore && !hasSeverity) return void 0;
+	const v2 = version.startsWith("2");
+	if (!baseVector || typeof baseScore !== "number" || !v2 && !hasSeverity) {
+		emitConverterWarning(`hdf-to-csaf-vex: ${cve}: CVSS ${version} score not exported, CSAF requires ${[
+			...hasVector ? [] : ["vectorString"],
+			...hasScore ? [] : ["baseScore"],
+			...v2 || hasSeverity ? [] : ["baseSeverity"]
+		].join(", ")}`);
+		return;
+	}
 	const inner = {
-		version: cvss.version,
-		...cvss.baseVector && { vectorString: cvss.baseVector },
-		...typeof cvss.baseScore === "number" && { baseScore: cvss.baseScore },
-		...cvss.baseSeverity && { baseSeverity: cvss.baseSeverity }
+		version,
+		vectorString: baseVector,
+		baseScore
 	};
-	if (inner.vectorString === void 0 && inner.baseScore === void 0) return;
+	if (!v2 && hasSeverity) inner.baseSeverity = csafSeverity(baseSeverity);
 	return {
-		[cvss.version.startsWith("4") ? "cvss_v4" : cvss.version.startsWith("2") ? "cvss_v2" : "cvss_v3"]: inner,
-		products
+		products,
+		[version.startsWith("4") ? "cvss_v4" : v2 ? "cvss_v2" : "cvss_v3"]: inner
 	};
 }
 function convertHdfToCsafVex(input, converterVersion) {
@@ -16374,8 +17579,8 @@ function convertHdfToCsafVex(input, converterVersion) {
 	const doc = buildDocument(amendments, converterVersion);
 	doc.vulnerabilities = vulnerabilities;
 	doc.product_tree.full_product_names = names.length > 0 ? names : [{
-		name: DEFAULT_PRODUCT_ID$1,
-		product_id: DEFAULT_PRODUCT_ID$1
+		name: DEFAULT_PRODUCT_NAME,
+		product_id: DEFAULT_PRODUCT_ID
 	}];
 	return JSON.stringify(doc, null, 2);
 }
@@ -16428,8 +17633,8 @@ function productEntriesFor(o) {
 		}));
 	}
 	return [{
-		name: DEFAULT_PRODUCT_ID$1,
-		product_id: DEFAULT_PRODUCT_ID$1
+		name: DEFAULT_PRODUCT_NAME,
+		product_id: DEFAULT_PRODUCT_ID
 	}];
 }
 /** product_tree entries for the synthesized fixed-version products. */
@@ -16468,7 +17673,7 @@ function productIDsFor$1(o) {
 		const parts = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 		if (parts.length > 0) return parts;
 	}
-	return [DEFAULT_PRODUCT_ID$1];
+	return [DEFAULT_PRODUCT_ID];
 }
 function stripProductsLine$1(reason) {
 	return reason.replace(PRODUCTS_LINE$2, "").replace(/\n+$/, "");
@@ -16524,7 +17729,7 @@ function buildVulnerability(group) {
 	for (const o of group.overrides) {
 		const pids = productIDsFor$1(o);
 		if (o.cvss) {
-			const score = buildCsafScore(o.cvss, pids);
+			const score = buildCsafScore(o.cvss, group.cve, pids);
 			if (score) {
 				v.scores = (v.scores ?? []).concat(score);
 				emitted = true;
@@ -16852,7 +18057,6 @@ const CVE_ID_PATTERN = /^CVE-\d{4}-\d{4,}$/;
 const PRODUCTS_LINE = /^Products:\s*(.+)$/m;
 const RAW_JUST_LINE = /^VEX justification:\s*(.+)$/m;
 const RESPONSE_LINE = /^Response:.*$/gm;
-const DEFAULT_PRODUCT_ID = "HDFPID-0001";
 /**
 * Build CycloneDX affects[].versions[] for a package with a fixedInVersion:
 * the current version is `affected`, and `>= fixedInVersion` is `unaffected`,
@@ -16943,7 +18147,7 @@ async function convertHdfToCyclonedxVex(input, converterVersion) {
 		serialNumber: await buildSerialNumber(input, amendments),
 		version: 1,
 		metadata: buildMetadata(amendments, earliest ?? /* @__PURE__ */ new Date(), converterVersion, overrideIdentities),
-		components,
+		...components.length > 0 && { components },
 		vulnerabilities
 	};
 	return JSON.stringify(bom, null, 2);
@@ -16974,7 +18178,7 @@ function overrideToVulnerability(o, componentRegistry) {
 		references.push({
 			id: o.requirementId,
 			source: {
-				name: e.description ?? "",
+				...e.description && { name: e.description },
 				url: e.data
 			}
 		});
@@ -17000,13 +18204,13 @@ function overrideToVulnerability(o, componentRegistry) {
 		...unranged && { recommendation: `Upgrade to ${unranged.fixedInVersion}` },
 		...advisories.length > 0 && { advisories },
 		analysis,
-		affects: pids.map((pid) => {
+		...pids.length > 0 && { affects: pids.map((pid) => {
 			const versions = buildCdxAffectsVersions(pkgById.get(pid));
 			return versions ? {
 				ref: pid,
 				versions
 			} : { ref: pid };
-		})
+		}) }
 	};
 }
 function canonicalToCycloneDXState(canonical) {
@@ -17040,7 +18244,7 @@ function productIDsFor(o) {
 		const parts = m[1].split(",").map((s) => s.trim()).filter(Boolean);
 		if (parts.length > 0) return parts;
 	}
-	return [DEFAULT_PRODUCT_ID];
+	return [];
 }
 function stripReasonAnnotations(reason) {
 	return reason.replace(PRODUCTS_LINE, "").replace(RAW_JUST_LINE, "").replace(RESPONSE_LINE, "").trim();
@@ -17240,11 +18444,13 @@ async function convertOscalComponentToHdf(input) {
 	if (!compDef.components || compDef.components.length === 0) throw new Error("oscal-component-definition: document contains no components");
 	const integrity = await inputIntegrity(input);
 	const meta = extractMetadata(compDef.metadata);
-	const comp = compDef.components[0];
 	const requirements = [];
-	for (const ci of comp["control-implementations"] ?? []) for (const ir of ci["implemented-requirements"] ?? []) requirements.push(implementedRequirementToBaselineRequirement(ir));
+	for (const comp of compDef.components) for (const ci of comp["control-implementations"] ?? []) {
+		const limited = limitArrayWithWarning(ci["implemented-requirements"] ?? [], "implemented requirement");
+		for (const ir of limited) requirements.push(implementedRequirementToBaselineRequirement(ir, comp));
+	}
 	const baseline = {
-		name: componentBaselineName(comp, compDef),
+		name: definitionBaselineName(compDef),
 		title: meta.title,
 		version: meta.version,
 		status: "loaded",
@@ -17258,7 +18464,16 @@ async function convertOscalComponentToHdf(input) {
 	return JSON.stringify(baseline, null, 2);
 }
 /** Converts a single ImplementedRequirement to a BaselineRequirement. */
-function implementedRequirementToBaselineRequirement(ir) {
+/**
+* Qualifies the control with the component's uuid. OSCAL requires both a uuid
+* and a title on every component but only guarantees the uuid is unique, so a
+* title would still collide when one product appears twice — the duplicate-ID
+* defect this qualification prevents. The title rides in a tag instead.
+*/
+function requirementId(comp, nistTag) {
+	return comp?.uuid ? `${comp.uuid}/${nistTag}` : nistTag;
+}
+function implementedRequirementToBaselineRequirement(ir, comp) {
 	const nistTag = controlIdToNistTag(ir["control-id"]);
 	const descriptions = [];
 	descriptions.push({
@@ -17275,23 +18490,37 @@ function implementedRequirementToBaselineRequirement(ir) {
 			data: stmt.remarks
 		});
 	}
+	const tags = { nist: [nistTag] };
+	if (comp?.title) tags.component = comp.title;
+	if (comp?.uuid) tags.componentUuid = comp.uuid;
 	return {
-		id: nistTag,
+		id: requirementId(comp, nistTag),
 		title: nistTag,
 		impact: .5,
 		descriptions,
-		tags: { nist: [nistTag] }
+		tags
 	};
 }
-/** Derives a baseline name from the component or component-definition metadata. */
-function componentBaselineName(comp, compDef) {
-	return toKebabCase(comp.title || compDef.metadata.title, "oscal-component-definition");
+/**
+* Derives the baseline name: a single-component definition is named for its
+* component, a multi-component one for the definition itself.
+*/
+function definitionBaselineName(compDef) {
+	let name = compDef.metadata.title;
+	if (compDef.components?.length === 1 && compDef.components[0].title) name = compDef.components[0].title;
+	return toKebabCase(name, "oscal-component-definition");
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/converter-poam.ts
 /**
 * OSCAL Plan of Action and Milestones (POA&M) to HDF Amendments converter.
 *
+* A POA&M hdf-to-oscal-poam produced returns every amendments field it carries
+* (ADR-0014 §4.6), apart from the integrity fields and generator that contract
+* excludes. Foreign POA&Ms, and HDF exports from before the ADR (§4.3), keep the
+* mapping they had before it: type "poam", with their own extension props not
+* carried (§3.6).
+*
 * Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_poam.go.
 */
 /**
@@ -17310,30 +18539,113 @@ async function convertOscalPoamToHdf(input) {
 	const meta = extractMetadata(poam.metadata);
 	const riskMap = buildRiskMap$1(poam.risks ?? []);
 	const overrides = [];
-	for (const item of poam["poam-items"]) overrides.push(poamItemToOverride(item, riskMap, poam));
-	const systemRef = poam["import-ssp"]?.href || void 0;
-	const appliedBy = extractAppliedBy(poam.metadata);
+	let hdfProduced = false;
+	for (const item of poam["poam-items"]) {
+		const override = poamItemToOverride(item, riskMap, poam);
+		if (!override) continue;
+		if (hdfProducedRisk(item, riskMap)) hdfProduced = true;
+		overrides.push(override);
+	}
+	if (overrides.length === 0) throw new Error(`oscal-poam-to-hdf: no poam-item names a requirement; every one of the ${poam["poam-items"].length} items was skipped`);
 	await chainOverrides(overrides);
-	return serializeHdf({
+	const preparedBy = firstResponsibleParty(poam.metadata, "prepared-by");
+	const amendments = {
 		name: toKebabCase(poam.metadata.title, "oscal-poam"),
 		overrides,
 		integrity,
-		systemRef,
+		systemRef: poam["import-ssp"]?.href || void 0,
 		version: meta.version,
-		appliedBy,
+		appliedBy: preparedBy === "" ? void 0 : {
+			type: IdentityType.Simple,
+			identifier: preparedBy
+		},
 		generator: {
 			name: "oscal-poam-to-hdf",
 			version: "1.0.0"
 		}
-	});
+	};
+	if (hdfProduced) readHdfDocumentFields(poam, amendments);
+	return serializeHdf(amendments);
+}
+/**
+* Reads the amendments document fields from their ADR-0014 §4.6 homes, which a
+* POA&M carries only when one of its risks is HDF-produced (§4.3).
+*/
+function readHdfDocumentFields(poam, amendments) {
+	const props = poam.metadata.props;
+	amendments.name = findGroupedVocabularyProp(props, "amendments-name", "")?.value ?? "";
+	if (poam.metadata.remarks) amendments.description = poam.metadata.remarks;
+	else if (hasFieldMarker(props, "empty-field", "description", "")) amendments.description = "";
+	amendments.appliedBy = documentIdentity(poam, "prepared-by");
+	const approvedBy = partyIdentity(poam, firstResponsibleParty(poam.metadata, "approved-by"));
+	if (approvedBy) amendments.approvedBy = approvedBy;
+	const amendmentId = vocabularyString(props, "amendment-id", "amendmentId", "");
+	if (amendmentId !== void 0) amendments.amendmentId = amendmentId;
+	const labels = amendmentLabels(props);
+	if (labels) amendments.labels = labels;
+	amendments.systemRef = markedField(props, "systemRef", amendments.systemRef);
+	amendments.version = markedField(props, "version", amendments.version);
+}
+/**
+* Applies the metadata markers for an OSCAL-required field the exporter wrote a
+* display fallback for: absent-field leaves it absent and empty-field returns it empty.
+*/
+function markedField(props, field, value) {
+	if (hasFieldMarker(props, "absent-field", field, "")) return void 0;
+	if (hasFieldMarker(props, "empty-field", field, "")) return "";
+	return value;
+}
+/** Reads the label-key and label-value pairs, one per label-<n> group. */
+function amendmentLabels(props) {
+	const groups = /* @__PURE__ */ new Set();
+	for (const m of [...findVocabularyProps(props, "label-key"), ...findVocabularyProps(props, "empty-field")]) {
+		const p = props[m.index];
+		if (p.class === "amendment-label" && p.group) groups.add(p.group);
+	}
+	if (groups.size === 0) return void 0;
+	const labels = {};
+	for (const group of groups) {
+		const key = vocabularyString(props, "label-key", "key", group);
+		const value = vocabularyString(props, "label-value", "value", group);
+		if (key !== void 0 && value !== void 0) labels[key] = value;
+	}
+	return labels;
 }
 function buildRiskMap$1(risks) {
 	const m = /* @__PURE__ */ new Map();
 	for (const risk of risks) m.set(risk.uuid, risk);
 	return m;
 }
+/**
+* The item's first related risk that carries override-type in the HDF namespace,
+* which makes it HDF-produced (ADR-0014 §4.3), or undefined.
+*/
+function hdfProducedRisk(item, riskMap) {
+	return overrideTypeRisk(item, riskMap, false);
+}
+/** The item's first related risk whose override-type prop is (legacy) or is not (!legacy) matched through the pre-ADR fallback. */
+function overrideTypeRisk(item, riskMap, legacy) {
+	for (const rr of item["related-risks"] ?? []) {
+		const risk = rr["risk-uuid"] ? riskMap.get(rr["risk-uuid"]) : void 0;
+		if (risk && findVocabularyProp(risk.props, "override-type")?.legacy === legacy) return risk;
+	}
+}
+/** Converts a poam-item to an override, or undefined for a pre-ADR item with no requirement id, which is skipped. */
 function poamItemToOverride(item, riskMap, poam) {
-	const requirementId = extractRequirementIdFromPOAMItem(item, riskMap);
+	const risk = hdfProducedRisk(item, riskMap);
+	if (risk) {
+		if (hdfRequirementId(risk) === void 0) {
+			emitConverterWarning(`Skipping poam-item "${item.uuid}" titled "${item.title}": its HDF-produced risk has no hdf-requirement-id`);
+			return;
+		}
+		return hdfOverride(item, risk, riskMap, poam);
+	}
+	const requirementId = foreignRequirementId(item, riskMap);
+	if (requirementId === void 0) {
+		emitConverterWarning(`Skipping poam-item "${item.uuid}" titled "${item.title}": its pre-ADR risk has no impacted-control-id`);
+		return;
+	}
+	const milestones = extractMilestones(item, riskMap);
 	return {
 		type: OverrideType.Poam,
 		requirementId,
@@ -17342,9 +18654,306 @@ function poamItemToOverride(item, riskMap, poam) {
 		appliedBy: poamItemAppliedBy(poam),
 		appliedAt: poamItemAppliedAt(poam, requirementId),
 		expiresAt: poamItemExpiresAt(item, riskMap, requirementId),
-		milestones: extractMilestones(item, riskMap)
+		...milestones.length > 0 ? { milestones } : {}
+	};
+}
+/**
+* The requirement id an HDF-produced risk carries. An absent or empty prop names
+* no requirement, and StandaloneOverride.requirementId is required and non-empty,
+* so the item is skipped rather than imported unusable.
+*/
+function hdfRequirementId(risk) {
+	return findVocabularyProp(risk.props, "hdf-requirement-id")?.value || void 0;
+}
+/**
+* Reads every override field from its ADR-0014 §4.6 home on an HDF-produced risk.
+* An absent prop is an absent field: nothing is derived from titles or uuids.
+*/
+function hdfOverride(item, risk, riskMap, poam) {
+	const props = risk.props;
+	const requirementId = hdfRequirementId(risk) ?? "";
+	const entry = overrideAppliedEntry(risk);
+	const appliedAt = entry && parseTimestamp(String(entry.start)) || poamItemAppliedAt(poam, requirementId);
+	const override = {
+		type: findVocabularyProp(props, "override-type").value,
+		requirementId,
+		reason: item.description,
+		appliedBy: poamItemAppliedBy(poam),
+		appliedAt,
+		expiresAt: poamItemExpiresAt(item, riskMap, requirementId)
+	};
+	const status = findVocabularyProp(props, "override-status");
+	if (status) override.status = status.value;
+	const impact = findVocabularyProp(props, "impact-override");
+	if (impact && impact.value.trim() !== "" && !isNaN(Number(impact.value))) override.impact = { value: Number(impact.value) };
+	const justification = findVocabularyProp(props, "justification");
+	if (justification) override.justification = justification.value;
+	const baselineRef = vocabularyString(props, "baseline-ref", "baselineRef", "");
+	if (baselineRef !== void 0) override.baselineRef = baselineRef;
+	const componentRef = vocabularyString(props, "component-ref", "componentRef", "");
+	if (componentRef !== void 0) override.componentRef = componentRef;
+	const inheritedFrom = vocabularyString(props, "inherited-from", "inheritedFrom", "");
+	if (inheritedFrom !== void 0) override.inheritedFrom = inheritedFrom;
+	const packages = affectedPackages(props);
+	if (packages.length > 0) override.affectedPackages = packages;
+	const loggedBy = entry?.["logged-by"]?.[0]?.["party-uuid"];
+	const applier = loggedBy === void 0 ? void 0 : partyIdentity(poam, loggedBy);
+	if (applier) override.appliedBy = applier;
+	const milestones = hdfMilestones(risk, poam);
+	if (milestones.length > 0) override.milestones = milestones;
+	const cvss = riskCvss(risk);
+	if (cvss) override.cvss = cvss;
+	const evidence = itemEvidence(item, poam);
+	if (evidence.length > 0) override.evidence = evidence;
+	const refs = riskReferences(risk, poam);
+	if (refs.length > 0) override.externalReferences = refs;
+	return override;
+}
+/** The risk-log entry recording when the override was applied. */
+function overrideAppliedEntry(risk) {
+	return risk["risk-log"]?.entries.find((e) => e.title === "Override applied");
+}
+/** Reads the package-<n> prop groups in position order. */
+function affectedPackages(props) {
+	const positions = /* @__PURE__ */ new Set();
+	for (const p of props ?? []) {
+		const m = /^package-(\d+)$/.exec(p.group ?? "");
+		if (m && consumedVocabularyProp(p) && Number(m[1]) > 0) positions.add(Number(m[1]));
+	}
+	return [...positions].sort((a, b) => a - b).map((position) => {
+		const group = `package-${position}`;
+		const pkg = {};
+		const name = vocabularyString(props, "affected-package-name", "name", group);
+		if (name !== void 0) pkg.name = name;
+		const version = vocabularyString(props, "affected-package-version", "version", group);
+		if (version !== void 0) pkg.version = version;
+		const ecosystem = vocabularyString(props, "affected-package-ecosystem", "ecosystem", group);
+		if (ecosystem !== void 0) pkg.ecosystem = ecosystem;
+		const cpe = vocabularyString(props, "affected-package-cpe", "cpe", group);
+		if (cpe !== void 0) pkg.cpe = cpe;
+		const purl = vocabularyString(props, "affected-package-purl", "purl", group);
+		if (purl !== void 0) pkg.purl = purl;
+		const fixedInVersion = vocabularyString(props, "affected-package-fixed-in-version", "fixedInVersion", group);
+		if (fixedInVersion !== void 0) pkg.fixedInVersion = fixedInVersion;
+		return pkg;
+	});
+}
+/** The first party uuid metadata assigns to roleId, or ''. */
+function firstResponsibleParty(meta, roleId) {
+	for (const rp of meta["responsible-parties"] ?? []) if (rp["role-id"] === roleId && rp["party-uuids"].length > 0) return rp["party-uuids"][0];
+	return "";
+}
+/** Reads the HDF identity a metadata party carries, or undefined for a party that carries none. */
+function partyIdentity(poam, partyUuid) {
+	const party = (poam.metadata.parties ?? []).find((p) => p.uuid === partyUuid);
+	if (!party) return void 0;
+	const identityType = findVocabularyProp(party.props, "identity-type");
+	if (!identityType) return void 0;
+	const id = {
+		identifier: findVocabularyProp(party.props, "identity-identifier")?.value ?? "",
+		type: identityType.value
+	};
+	if (party.remarks) id.description = party.remarks;
+	else if (hasFieldMarker(party.props, "empty-field", "description", "")) id.description = "";
+	return id;
+}
+/** The identity metadata assigns to roleId: the HDF identity its party carries, or else the party uuid as a simple identifier. */
+function documentIdentity(poam, roleId) {
+	const partyUuid = firstResponsibleParty(poam.metadata, roleId);
+	if (partyUuid === "") return void 0;
+	return partyIdentity(poam, partyUuid) ?? {
+		type: IdentityType.Simple,
+		identifier: partyUuid
 	};
 }
+/**
+* Mirrors the schema's Milestone.title pattern: an OSCAL task title is
+* markup-line, which a foreign producer may wrap or pad.
+*/
+const MILESTONE_TITLE_PATTERN = /^[^ \t\n\r]([^\n\r]*[^ \t\n\r])?$/;
+/** Reads each planned remediation task of an HDF-produced risk as a milestone whose description is the remediation description. */
+function hdfMilestones(risk, poam) {
+	const milestones = [];
+	for (const rem of risk.remediations ?? []) {
+		if (rem.lifecycle !== "planned") continue;
+		for (const task of rem.tasks ?? []) {
+			const end = task.timing?.["within-date-range"]?.end;
+			const estimatedCompletion = end && parseTimestamp(String(end));
+			if (!estimatedCompletion) continue;
+			const status = findVocabularyProp(task.props, "milestone-status");
+			const ms = {
+				description: rem.description,
+				estimatedCompletion,
+				status: status?.value ?? MilestoneStatus.Pending
+			};
+			if (!hasFieldMarker(task.props, "absent-field", "title", "")) {
+				const title = task.title ?? "";
+				if (MILESTONE_TITLE_PATTERN.test(title)) ms.title = title;
+				else emitConverterWarning(`Dropping the title of task "${task.uuid}": ${JSON.stringify(title)} is not the single line Milestone.title is`);
+			}
+			const completedAt = findVocabularyProp(task.props, "completed-at");
+			const completedAtDate = completedAt && parseTimestamp(completedAt.value);
+			if (completedAtDate) ms.completedAt = completedAtDate;
+			for (const rr of task["responsible-roles"] ?? []) {
+				const partyUuid = rr["party-uuids"]?.[0];
+				const completer = rr["role-id"] === "completed-by" && partyUuid !== void 0 ? partyIdentity(poam, partyUuid) : void 0;
+				if (completer) ms.completedBy = completer;
+			}
+			milestones.push(ms);
+		}
+	}
+	return milestones;
+}
+/** Begins the facet system of every CVSS version. */
+const CVSS_SYSTEM_PREFIX = "http://www.first.org/cvss/v";
+/** Reads the characterization whose facets all use a CVSS system. */
+function riskCvss(risk) {
+	for (const ch of risk.characterizations ?? []) {
+		if (ch.facets.length === 0 || !ch.facets.every((f) => f.system.startsWith(CVSS_SYSTEM_PREFIX))) continue;
+		const values = new Map(ch.facets.map((f) => [f.name, f.remarks || f.value]));
+		const str = (name, field) => values.get(name) ?? (hasFieldMarker(ch.props, "empty-field", field, "") ? "" : void 0);
+		const score = (name) => {
+			const value = values.get(name);
+			return value !== void 0 && value.trim() !== "" && !isNaN(Number(value)) ? Number(value) : void 0;
+		};
+		const severity = (name) => values.get(name);
+		return {
+			version: values.get("cvss_version"),
+			baseScore: score("base_score"),
+			baseSeverity: severity("base_severity"),
+			baseVector: str("base_vector", "baseVector"),
+			threatScore: score("threat_score"),
+			threatVector: str("threat_vector", "threatVector"),
+			environmentalScore: score("environmental_score"),
+			environmentalVector: str("environmental_vector", "environmentalVector"),
+			computedScore: score("computed_score"),
+			computedSeverity: severity("computed_severity"),
+			supplementalVector: str("supplemental_vector", "supplementalVector"),
+			source: str("source", "source")
+		};
+	}
+}
+/**
+* Reads the evidence observations an HDF-produced item lists. An observation with
+* no payload is not an HDF evidence item (ADR-0014 §4.6 gives Evidence.data no
+* other home) and Evidence.data is required and non-empty, so a foreign
+* observation listed alongside the exported ones is skipped.
+*/
+function itemEvidence(item, poam) {
+	const evidence = [];
+	for (const ro of item["related-observations"] ?? []) {
+		const obs = (poam.observations ?? []).find((o) => o.uuid === ro["observation-uuid"]);
+		if (!obs) continue;
+		const ev = observationEvidence(obs, poam);
+		if (ev.data === "") {
+			emitConverterWarning(`Skipping evidence observation "${obs.uuid}": no relevant-evidence href and no evidence resource`);
+			continue;
+		}
+		evidence.push(ev);
+	}
+	return evidence;
+}
+/** Decodes base64 to the UTF-8 text it encodes, or undefined when it is not base64. */
+function decodeBase64Utf8(value) {
+	try {
+		const binary = atob(value);
+		return new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+	} catch {
+		return;
+	}
+}
+/** Reads one evidence item from its observation (ADR-0014 §4.6 Evidence table). */
+function observationEvidence(obs, poam) {
+	const props = obs.props;
+	const ev = {
+		type: obs.types?.[0] ?? "",
+		data: ""
+	};
+	if (!hasFieldMarker(props, "absent-field", "description", "")) ev.description = obs.description;
+	const mimeType = vocabularyString(props, "mime-type", "mimeType", "");
+	if (mimeType !== void 0) ev.mimeType = mimeType;
+	const encoding = vocabularyString(props, "evidence-encoding", "encoding", "");
+	if (encoding !== void 0) ev.encoding = encoding;
+	const size = findVocabularyProp(props, "evidence-size");
+	if (size && size.value.trim() !== "" && !isNaN(Number(size.value))) ev.size = Number(size.value);
+	if (!hasFieldMarker(props, "absent-field", "capturedAt", "")) {
+		const capturedAt = parseTimestamp(String(obs.collected));
+		if (capturedAt) ev.capturedAt = capturedAt;
+	}
+	for (const origin of obs.origins ?? []) for (const actor of origin.actors) {
+		const capturer = actor.type === "party" && ev.capturedBy === void 0 ? partyIdentity(poam, actor["actor-uuid"]) : void 0;
+		if (capturer) ev.capturedBy = capturer;
+	}
+	const href = obs["relevant-evidence"]?.[0]?.href;
+	if (href) {
+		ev.data = href;
+		return ev;
+	}
+	for (const link of obs.links ?? []) {
+		const res = backMatterResource(poam, link);
+		if (link.rel !== "evidence" || !res?.base64) continue;
+		ev.data = encoding === "base64" ? res.base64.value : decodeBase64Utf8(res.base64.value) ?? res.base64.value;
+		break;
+	}
+	return ev;
+}
+/** Resolves a link to the back-matter resource its "#<uuid>" href names. */
+function backMatterResource(poam, link) {
+	if (!link.href.startsWith("#")) return void 0;
+	return (poam["back-matter"]?.resources ?? []).find((r) => r.uuid === link.href.slice(1));
+}
+/** Reads the external references an HDF-produced risk links to (ADR-0014 §4.6 External reference table). */
+function riskReferences(risk, poam) {
+	const refs = [];
+	for (const link of risk.links ?? []) {
+		const res = backMatterResource(poam, link);
+		if (link.rel !== "reference" || !res) continue;
+		const props = res.props;
+		const ref = { sourceName: findVocabularyProp(props, "source-name")?.value ?? "" };
+		const externalId = vocabularyString(props, "external-id", "externalId", "");
+		if (externalId !== void 0) ref.externalId = externalId;
+		if (res.rlinks && res.rlinks.length > 0) ref.href = res.rlinks[0].href;
+		else if (hasFieldMarker(props, "empty-field", "href", "")) ref.href = "";
+		if (res.description) ref.description = res.description;
+		else if (hasFieldMarker(props, "empty-field", "description", "")) ref.description = "";
+		const rel = vocabularyString(props, "reference-rel", "rel", "");
+		if (rel !== void 0) ref.rel = rel;
+		const mediaType = vocabularyString(props, "reference-media-type", "mediaType", "");
+		if (mediaType !== void 0) ref.mediaType = mediaType;
+		const algorithm = vocabularyString(props, "checksum-algorithm", "checksum.algorithm", "");
+		if (algorithm !== void 0) ref.checksum = {
+			algorithm,
+			value: vocabularyString(props, "checksum-value", "checksum.value", "") ?? ""
+		};
+		const addedBy = findVocabularyProp(props, "added-by");
+		const adder = addedBy ? partyIdentity(poam, addedBy.value) : void 0;
+		if (adder) ref.addedBy = adder;
+		const addedAt = findVocabularyProp(props, "added-at");
+		const addedAtDate = addedAt && parseTimestamp(addedAt.value);
+		if (addedAtDate) ref.addedAt = addedAtDate;
+		const kind = vocabularyString(props, "reference-kind", "kind", "");
+		if (kind !== void 0) ref.kind = kind;
+		const documentJson = res.base64 ? decodeBase64Utf8(res.base64.value) : void 0;
+		if (documentJson !== void 0) try {
+			const document = JSON.parse(documentJson);
+			if (document !== null && typeof document === "object" && !Array.isArray(document)) ref.document = document;
+		} catch {}
+		refs.push(ref);
+	}
+	return refs;
+}
+/**
+* The requirement id of an item that is not HDF-produced. A pre-ADR HDF export's id
+* comes only from its legacy impacted-control-id, never from a title (ADR-0014 §4.3),
+* so it is undefined for one that has none, which the conversion skips. Mirrors
+* foreignRequirementID in Go.
+*/
+function foreignRequirementId(item, riskMap) {
+	const preADR = overrideTypeRisk(item, riskMap, true);
+	if (!preADR) return extractRequirementIdFromPOAMItem(item, riskMap);
+	const control = findVocabularyProp(preADR.props, "impacted-control-id");
+	return control ? controlIdToNistTag(control.value) : void 0;
+}
 function extractRequirementIdFromPOAMItem(item, riskMap) {
 	for (const rr of item["related-risks"] ?? []) {
 		const riskUuid = rr["risk-uuid"];
@@ -17381,17 +18990,16 @@ function poamItemStatus(item, riskMap) {
 	return ResultStatus.Failed;
 }
 function poamItemAppliedBy(poam) {
+	const preparedBy = firstResponsibleParty(poam.metadata, "prepared-by");
+	if (preparedBy !== "") return {
+		type: IdentityType.Simple,
+		identifier: preparedBy
+	};
 	const rps = poam.metadata["responsible-parties"];
-	if (rps) {
-		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: IdentityType.Simple,
-			identifier: rp["party-uuids"][0]
-		};
-		if (rps.length > 0 && rps[0]["party-uuids"].length > 0) return {
-			type: IdentityType.Simple,
-			identifier: rps[0]["party-uuids"][0]
-		};
-	}
+	if (rps && rps.length > 0 && rps[0]["party-uuids"].length > 0) return {
+		type: IdentityType.Simple,
+		identifier: rps[0]["party-uuids"][0]
+	};
 	return {
 		type: IdentityType.System,
 		identifier: "oscal-poam-converter"
@@ -17436,15 +19044,6 @@ function extractMilestones(item, riskMap) {
 	}
 	return milestones;
 }
-function extractAppliedBy(meta) {
-	const rps = meta["responsible-parties"];
-	if (rps) {
-		for (const rp of rps) if (rp["role-id"] === "prepared-by" && rp["party-uuids"].length > 0) return {
-			type: IdentityType.Simple,
-			identifier: rp["party-uuids"][0]
-		};
-	}
-}
 //#endregion
 //#region converters/oscal-to-hdf/typescript/converter-sap.ts
 /**
@@ -17598,11 +19197,18 @@ async function convertOscalSarToHdf(input) {
 	const scanTime = /* @__PURE__ */ new Date();
 	const baselines = [];
 	for (const result of sar.results) {
+		const title = result.title || result.uuid;
 		if (!result.findings || result.findings.length === 0) {
-			console.warn(`WARNING: Skipping assessment result "${result.title || result.uuid}": no findings (empty result set)`);
+			emitConverterWarning(`Skipping assessment result "${title}": no findings (empty result set)`);
+			continue;
+		}
+		const { groups, skipped } = groupFindingsByRequirement(result.findings);
+		for (const f of skipped) emitConverterWarning(`Skipping finding "${f.uuid}" titled "${f.title}": empty target-id`);
+		if (groups.size === 0) {
+			emitConverterWarning(`Skipping assessment result "${title}": no finding has a target-id`);
 			continue;
 		}
-		const baseline = await resultToEvaluatedBaseline(result, sar, input, scanTime);
+		const baseline = await resultToEvaluatedBaseline(result, groups, sar, input, scanTime);
 		baselines.push(baseline);
 	}
 	const planRef = sar["import-ap"]?.href || void 0;
@@ -17625,27 +19231,51 @@ async function convertOscalSarToHdf(input) {
 		planRef
 	});
 }
-async function resultToEvaluatedBaseline(result, sar, rawInput, scanTime) {
+/**
+* Groups findings by requirement id in first-seen order (a Map keeps insertion
+* order), within the finding cap, and returns the findings skipped for an empty
+* target-id. Mirrors Go's groupFindingsByRequirement.
+*/
+function groupFindingsByRequirement(findings) {
+	const groups = /* @__PURE__ */ new Map();
+	const skipped = [];
+	for (const f of limitArrayWithWarning(findings, "finding")) {
+		const id = sarRequirementId(f);
+		if (id === void 0) {
+			skipped.push(f);
+			continue;
+		}
+		const existing = groups.get(id);
+		if (existing) existing.push(f);
+		else groups.set(id, [f]);
+	}
+	return {
+		groups,
+		skipped
+	};
+}
+/**
+* The HDF requirement id a finding belongs to (ADR-0014 §4.5): the HDF-namespaced
+* hdf-requirement-id when present; else the NIST control a roster-confirmed
+* target names; else the target-id verbatim. Undefined for a finding whose
+* target-id is empty. Mirrors Go's sarRequirementID.
+*/
+function sarRequirementId(f) {
+	const targetId = f.target["target-id"];
+	if (!targetId) return void 0;
+	const prop = findVocabularyProp(f.props, "hdf-requirement-id");
+	if (prop && prop.value !== "") return prop.value;
+	const controlId = confirmedControlId(targetId);
+	return controlId === void 0 ? targetId : controlIdToNistTag(controlId);
+}
+async function resultToEvaluatedBaseline(result, groups, sar, rawInput, scanTime) {
 	const checksum = await inputChecksum(rawInput);
 	const obsMap = buildObservationMap(result.observations ?? []);
 	const riskMap = buildRiskMap(result.risks ?? []);
-	const controlOrder = [];
-	const controlMap = /* @__PURE__ */ new Map();
-	for (const f of result.findings ?? []) {
-		const controlId = extractControlIdFromFinding(f);
-		const existing = controlMap.get(controlId);
-		if (existing) existing.push(f);
-		else {
-			controlOrder.push(controlId);
-			controlMap.set(controlId, [f]);
-		}
-	}
 	const requirements = [];
-	for (const controlId of controlOrder) {
-		const req = findingsToEvaluatedRequirement(controlId, controlMap.get(controlId), obsMap, riskMap, result, scanTime);
-		requirements.push(req);
-	}
-	const baseline = createMinimalBaseline(sarBaselineName(result, sar), requirements, {
+	for (const [id, findings] of groups) requirements.push(findingsToEvaluatedRequirement(id, findings, obsMap, riskMap, result, scanTime));
+	const name = sarBaselineName(result, sar);
+	const baseline = createMinimalBaseline(name, requirements, {
 		resultsChecksum: checksum,
 		integrity: await inputIntegrity(rawInput),
 		status: "loaded",
@@ -17654,17 +19284,17 @@ async function resultToEvaluatedBaseline(result, sar, rawInput, scanTime) {
 	if (result.description) baseline.description = result.description;
 	return baseline;
 }
-function findingsToEvaluatedRequirement(controlId, findings, obsMap, riskMap, result, scanTime) {
-	const nistTag = controlIdToNistTag(controlId);
-	const title = findings[0].title || nistTag;
+function findingsToEvaluatedRequirement(id, findings, obsMap, riskMap, result, scanTime) {
+	const title = findings[0].title || id;
 	const impact = sarFindingsImpact(findings, riskMap);
 	const descriptions = sarBuildDescriptions(findings, obsMap, riskMap);
 	const refs = sarBuildRefs(findings, obsMap);
 	const results = [];
 	for (const f of findings) results.push(findingToRequirementResult(f, obsMap, riskMap, result, scanTime));
-	const nistTags = [nistTag];
-	const req = createRequirement(nistTag, title, descriptions, impact, results, {
-		tags: buildNistCciTags(nistTags, nistToCci(nistTags)),
+	const nistTags = sarConfirmedNistTags(findings);
+	const tags = buildNistCciTags(nistTags, nistToCci(nistTags));
+	const req = createRequirement(id, title, descriptions, impact, results, {
+		tags,
 		...refs ? { refs } : {}
 	});
 	const controlType = deriveControlTypeFromTags(nistTags);
@@ -17686,13 +19316,14 @@ function findingToRequirementResult(f, obsMap, riskMap, result, scanTime) {
 		startTime
 	});
 }
-function extractControlIdFromFinding(f) {
-	const targetId = f.target["target-id"];
-	if (!targetId) return "unknown";
-	let controlId = extractControlIdFromObjectiveId(targetId);
-	const idx = controlId.indexOf("_");
-	if (idx > 0) controlId = controlId.slice(0, idx);
-	return controlId;
+/** The distinct NIST controls, in NIST notation, the findings' targets confirm, in finding order. */
+function sarConfirmedNistTags(findings) {
+	const controlIds = [];
+	for (const f of findings) {
+		const controlId = confirmedControlId(f.target["target-id"]);
+		if (controlId !== void 0) controlIds.push(controlId);
+	}
+	return controlIdsToNistTags(controlIds);
 }
 function mapFindingStatus(f) {
 	const status = oscalStatusToHdf(f.target.status.state);
@@ -17751,19 +19382,19 @@ function sarBuildDescriptions(findings, obsMap, riskMap) {
 		label: "default",
 		data: findingDescs.join("\n") || ""
 	});
-	const obsDescs = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of findings) for (const ref of f["related-observations"] ?? []) {
-		const obsUuid = ref["observation-uuid"];
-		if (!obsUuid || seen.has(obsUuid)) continue;
-		seen.add(obsUuid);
-		const obs = obsMap.get(obsUuid);
-		if (obs?.description) obsDescs.push(obs.description);
-	}
-	if (obsDescs.length > 0) descriptions.push({
+	const rationales = findings.map((f) => f.target.description ?? "").filter((d) => d !== "");
+	if (rationales.length > 0) descriptions.push({
 		label: "rationale",
-		data: obsDescs.join("\n")
+		data: rationales.join("\n")
 	});
+	const labelled = collectLabelledProse(findings, obsMap, riskMap);
+	for (const label of ["check", "fix"]) {
+		const texts = labelled.get(label);
+		if (texts) descriptions.push({
+			label,
+			data: texts.join("\n")
+		});
+	}
 	const statement = collectRiskStatements(findings, riskMap);
 	if (statement) descriptions.push({
 		label: "statement",
@@ -17781,6 +19412,46 @@ function sarBuildDescriptions(findings, obsMap, riskMap) {
 	});
 	return descriptions;
 }
+/** The HDF description label a relevant-evidence entry carries ("check" or "fix"), or '' for foreign evidence. */
+function evidenceDescriptionLabel(ev) {
+	const label = descriptionLabel(ev.props);
+	return label === "check" || label === "fix" ? label : "";
+}
+/** Whether a remediation is HDF's fix prose home. */
+function isLabelledFix(rem) {
+	return descriptionLabel(rem.props) === "fix";
+}
+/**
+* Gathers the check and fix text HDF wrote into labelled relevant-evidence
+* entries (full text from remarks) and labelled remediations, in finding order,
+* reading each observation and risk once.
+*/
+function collectLabelledProse(findings, obsMap, riskMap) {
+	const texts = /* @__PURE__ */ new Map();
+	const add = (label, text) => {
+		texts.set(label, [...texts.get(label) ?? [], text]);
+	};
+	const seenObs = /* @__PURE__ */ new Set();
+	const seenRisk = /* @__PURE__ */ new Set();
+	for (const f of findings) {
+		for (const ref of f["related-observations"] ?? []) {
+			const obs = obsMap.get(ref["observation-uuid"]);
+			if (!obs || seenObs.has(ref["observation-uuid"])) continue;
+			seenObs.add(ref["observation-uuid"]);
+			for (const ev of obs["relevant-evidence"] ?? []) {
+				const label = evidenceDescriptionLabel(ev);
+				if (label !== "") add(label, ev.remarks || ev.description);
+			}
+		}
+		for (const ref of f["related-risks"] ?? []) {
+			const risk = riskMap.get(ref["risk-uuid"]);
+			if (!risk || seenRisk.has(ref["risk-uuid"])) continue;
+			seenRisk.add(ref["risk-uuid"]);
+			for (const rem of risk.remediations ?? []) if (isLabelledFix(rem)) add("fix", rem.description);
+		}
+	}
+	return texts;
+}
 function collectRiskStatements(findings, riskMap) {
 	const statements = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -17802,6 +19473,7 @@ function collectRemediations(findings, riskMap) {
 		seen.add(riskUuid);
 		const risk = riskMap.get(riskUuid);
 		for (const rem of risk?.remediations ?? []) {
+			if (isLabelledFix(rem)) continue;
 			const text = remediationText(rem);
 			if (text) remediations.push(text);
 		}
@@ -17823,7 +19495,7 @@ function collectEvidenceDescriptions(findings, obsMap) {
 		seenObs.add(obsUuid);
 		const obs = obsMap.get(obsUuid);
 		for (const ev of obs?.["relevant-evidence"] ?? []) {
-			if (!ev.description || seenText.has(ev.description)) continue;
+			if (!ev.description || seenText.has(ev.description) || evidenceDescriptionLabel(ev) !== "") continue;
 			seenText.add(ev.description);
 			descs.push(ev.description);
 		}
@@ -18024,6 +19696,7 @@ function sspComponentToHDFComponent(sc, componentControls) {
 		name: sc.title,
 		type: mapOSCALComponentType(sc.type)
 	};
+	if (sc.uuid) comp.componentId = sc.uuid;
 	if (sc.description) comp.description = sc.description;
 	const controls = componentControls.get(sc.uuid);
 	if (controls && controls.size > 0) {
@@ -18252,7 +19925,7 @@ function stixObjectCVEs(obj) {
 }
 //#endregion
 //#region shared/typescript/enrichStix.ts
-const DEFAULT_REVIEW_HORIZON_MS = 2160 * 60 * 60 * 1e3;
+const DEFAULT_REVIEW_HORIZON_MS = 7776e6;
 /** Format a Date as canonical trimmed-UTC RFC3339 (seconds precision, matching Go's time.RFC3339). */
 function toRfc3339(d) {
 	return d.toISOString().replace(/\.\d{3}Z$/, "Z");