@mitre/hdf-converters 3.7.0 → 3.7.1

package/dist/index.js

@@ -1,7 +1,7 @@
 import { n as detectFormat, o as isCheckovTestCaseName, r as detectConverter, t as registerAllFingerprints } from "./register-all-BEuKQGEZ.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
 import { buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
-import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
+import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, CloudProvider, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
 import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, SUPPORTED_NIST_REVISIONS, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCheckovCciNistMapping, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistExists, nistToCci, normalizeNistId } from "@mitre/hdf-mappings";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
@@ -5292,16 +5292,25 @@ function calculateImpact(item, isCompliance) {
 	}
 	return severityToImpactWithAliases(item["severity"], NESSUS_ALIASES, 0);
 }
+/**
+* Substitutes the shared remediation fallback when a lookup resolved nothing, so
+* the CCI path and the plugin-family path behave alike. A finding the mapping
+* tables do not cover is still a flaw to remediate, and an empty nist tag would
+* drop it from every NIST-based view.
+*/
+function orDefaultNist(controls) {
+	return controls.length > 0 ? controls : [...DEFAULT_REMEDIATION_NIST_TAGS$1];
+}
 function buildTags$3(item, isCompliance) {
 	const tags = { rid: isCompliance ? parseComplianceRef(item["compliance-reference"], "Rule-ID").join(",") : item["pluginID"] };
 	if (isCompliance && item["compliance-reference"]) {
 		const cciTags = parseComplianceRef(item["compliance-reference"], "CCI");
 		tags.cci = cciTags;
 		const mappedControls = cciTags.flatMap((cci) => getCCINistMappings(cci) ?? []);
-		tags.nist = [...new Set(mappedControls)].sort();
+		tags.nist = orDefaultNist([...new Set(mappedControls)].sort());
 	} else {
 		const nistControls = getNessusNistControl(item["pluginFamily"], item["pluginID"]);
-		tags.nist = nistControls ? nistControls.split("|") : [];
+		tags.nist = orDefaultNist(nistControls ? nistControls.split("|") : []);
 	}
 	if (isCompliance && item["compliance-reference"]) {
 		const stigId = parseComplianceRef(item["compliance-reference"], "STIG-ID").join(",");
@@ -14173,6 +14182,15 @@ var oscal_vocabulary_default = {
 			"hdfField": "baselines[].requirements[].id, overrides[].requirementId",
 			"legacy": true
 		},
+		{
+			"name": "requirement-title",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].findings[]"],
+			"meaning": "The exact HDF requirement title the finding reports. Requirement_Core.title is prose that may carry line breaks (§2); the finding title is display text OSCAL types single-line, so the exact title is preserved here while the display title is normalized (§4.3).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].requirements[].title",
+			"legacy": false
+		},
 		{
 			"name": "baseline-version",
 			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
@@ -14182,6 +14200,24 @@ var oscal_vocabulary_default = {
 			"hdfField": "baselines[].version",
 			"legacy": true
 		},
+		{
+			"name": "baseline-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[]"],
+			"meaning": "The exact HDF baseline name the result reports, so an HDF-produced SAR round-trips the name that hdf-diff and baseline references key on. The result title is display text and is not injective, so two baselines sharing a title would otherwise collide (§4.3, §4.5).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].name",
+			"legacy": false
+		},
+		{
+			"name": "baseline-title",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[]"],
+			"meaning": "The exact HDF baseline title the result reports, distinct from the baseline name (baseline-name). The result title is display text OSCAL types single-line, so a title carrying a line terminator is preserved here while the display title is normalized (§4.3).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "baselines[].title",
+			"legacy": false
+		},
 		{
 			"name": "nist",
 			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
@@ -14353,6 +14389,393 @@ var oscal_vocabulary_default = {
 			"hdfField": null,
 			"legacy": false
 		},
+		{
+			"name": "component-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The exact HDF component name the assessment subject reconstitutes. The subject title is display text OSCAL types single-line, so a name carrying a line terminator is preserved here while the display title is normalized (§4.3).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].name",
+			"legacy": false
+		},
+		{
+			"name": "component-description",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The description of the component the assessment subject reconstitutes.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].description",
+			"legacy": false
+		},
+		{
+			"name": "component-hostname",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's short OS-reported hostname.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].hostname",
+			"legacy": false
+		},
+		{
+			"name": "component-fqdn",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's fully qualified domain name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].fqdn",
+			"legacy": false
+		},
+		{
+			"name": "component-domain",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's directory domain.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].domain",
+			"legacy": false
+		},
+		{
+			"name": "component-ip-address",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's IP address.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].ipAddress",
+			"legacy": false
+		},
+		{
+			"name": "component-mac-address",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's MAC address.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].macAddress",
+			"legacy": false
+		},
+		{
+			"name": "component-os-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's operating system name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].osName",
+			"legacy": false
+		},
+		{
+			"name": "component-os-version",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A host component's operating system version.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].osVersion",
+			"legacy": false
+		},
+		{
+			"name": "component-image-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container image component's image id.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].imageId",
+			"legacy": false
+		},
+		{
+			"name": "component-registry",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container image component's registry.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].registry",
+			"legacy": false
+		},
+		{
+			"name": "component-repository",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container image component's repository.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].repository",
+			"legacy": false
+		},
+		{
+			"name": "component-tag",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container image component's tag.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].tag",
+			"legacy": false
+		},
+		{
+			"name": "component-container-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container instance component's running container id.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].containerId",
+			"legacy": false
+		},
+		{
+			"name": "component-image",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container instance component's source image.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].image",
+			"legacy": false
+		},
+		{
+			"name": "component-runtime",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container instance component's runtime.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].runtime",
+			"legacy": false
+		},
+		{
+			"name": "component-platform-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container platform component's platform type.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].platformType",
+			"legacy": false
+		},
+		{
+			"name": "component-cluster-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container platform component's cluster name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].clusterName",
+			"legacy": false
+		},
+		{
+			"name": "component-namespace",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A container platform component's namespace.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].namespace",
+			"legacy": false
+		},
+		{
+			"name": "component-version",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A component's version (container platform, application, artifact, database, aiModel or dataset).",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].version",
+			"legacy": false
+		},
+		{
+			"name": "component-provider",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud account or cloud resource component's cloud provider.",
+			"valueFormat": "An HDF cloud provider value (aws, azure, gcp, oci, other)",
+			"hdfField": "components[].provider",
+			"legacy": false
+		},
+		{
+			"name": "component-account-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud account component's account identifier.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].accountId",
+			"legacy": false
+		},
+		{
+			"name": "component-region",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud account or cloud resource component's region.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].region",
+			"legacy": false
+		},
+		{
+			"name": "component-resource-type",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud resource component's resource type.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].resourceType",
+			"legacy": false
+		},
+		{
+			"name": "component-resource-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud resource component's provider-specific resource id.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].resourceId",
+			"legacy": false
+		},
+		{
+			"name": "component-arn",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A cloud resource component's Amazon Resource Name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].arn",
+			"legacy": false
+		},
+		{
+			"name": "component-url",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A repository or application component's URL.",
+			"valueFormat": "String (§1.7), a URL",
+			"hdfField": "components[].url",
+			"legacy": false
+		},
+		{
+			"name": "component-branch",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A repository component's scanned branch.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].branch",
+			"legacy": false
+		},
+		{
+			"name": "component-commit",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A repository component's scanned commit SHA.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].commit",
+			"legacy": false
+		},
+		{
+			"name": "component-environment",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "An application component's environment.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].environment",
+			"legacy": false
+		},
+		{
+			"name": "component-package-manager",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "An artifact component's package manager.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].packageManager",
+			"legacy": false
+		},
+		{
+			"name": "component-package-name",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "An artifact component's package name.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].packageName",
+			"legacy": false
+		},
+		{
+			"name": "component-cidr",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A network component's CIDR block.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].cidr",
+			"legacy": false
+		},
+		{
+			"name": "component-gateway",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A network component's gateway address.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].gateway",
+			"legacy": false
+		},
+		{
+			"name": "component-engine",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A database component's engine.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].engine",
+			"legacy": false
+		},
+		{
+			"name": "component-host",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A database component's host.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].host",
+			"legacy": false
+		},
+		{
+			"name": "component-port",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A database component's port.",
+			"valueFormat": "Decimal number, a TCP port",
+			"hdfField": "components[].port",
+			"legacy": false
+		},
+		{
+			"name": "component-model-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "An aiModel component's provider/registry model id.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].modelId",
+			"legacy": false
+		},
+		{
+			"name": "component-dataset-id",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "A dataset component's provider/registry dataset id.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].datasetId",
+			"legacy": false
+		},
+		{
+			"name": "component-label-key",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The key of a component label, grouped component-label-<n>, n the label's 1-based position in sorted key order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].labels (key)",
+			"legacy": false
+		},
+		{
+			"name": "component-label-value",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The value of the component label its group names.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].labels (value)",
+			"legacy": false
+		},
+		{
+			"name": "component-external-id-key",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The scheme of a component external id, grouped component-external-id-<n>, n its 1-based position in sorted key order.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].externalIds (key)",
+			"legacy": false
+		},
+		{
+			"name": "component-external-id-value",
+			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
+			"objects": ["assessment-results.results[].observations[].subjects[]", "assessment-results.results[].local-definitions.components[]"],
+			"meaning": "The value of the component external id its group names.",
+			"valueFormat": "String (§1.7)",
+			"hdfField": "components[].externalIds (value)",
+			"legacy": false
+		},
 		{
 			"name": "amendment-id",
 			"ns": "https://mitre.github.io/hdf-libs/ns/oscal",
@@ -14776,6 +15199,10 @@ function validateVocabularyTable(raw) {
 }
 const table = validateVocabularyTable(oscal_vocabulary_default);
 const byName = table.byName;
+/** NIST's default namespace, which a prop with no ns belongs to. */
+function vocabularyDefaultNamespace() {
+	return table.defaultNamespace;
+}
 function mustVocabularyRow(name) {
 	const row = byName.get(name);
 	if (!row) throw new Error(`oscal: "${name}" is not a row of the OSCAL vocabulary`);
@@ -15209,6 +15636,346 @@ function oscalString(s) {
 	return s.trim();
 }
 //#endregion
+//#region converters/oscal-to-hdf/typescript/component-props.ts
+/**
+* The one mapping from HDF component identity fields to the HDF-namespaced props
+* that carry them on an OSCAL assessment subject (ADR-0014 §4.5), driven by both
+* the SAR exporter and the SAR importer. Mirrors the Go peer component_props.go.
+*/
+/** The hdf-results bounds on Component.port. */
+const MIN_PORT = 1;
+const MAX_PORT = 65535;
+/**
+* The whole grammar a port prop may use. Go and JavaScript disagree over what a
+* lenient numeric parse accepts ("80abc", "1e3"), so the grammar is spelled out
+* rather than left to either language's parser.
+*/
+const DECIMAL_DIGITS = /^[0-9]+$/;
+function componentPort(v) {
+	if (!DECIMAL_DIGITS.test(v)) return void 0;
+	const n = Number(v);
+	if (!Number.isSafeInteger(n) || n < MIN_PORT || n > MAX_PORT) return void 0;
+	return n;
+}
+/**
+* The Cloud_Provider enum in sorted order, read from the generated schema types'
+* runtime enum rather than a hand-kept copy; the Go peer reports the same order so
+* the two warnings read alike.
+*/
+function cloudProviderValues() {
+	return Object.values(CloudProvider).map(String).sort();
+}
+function validCloudProvider(v) {
+	return Object.values(CloudProvider).some((p) => String(p) === v);
+}
+function stringField(prop, field) {
+	return {
+		prop,
+		field,
+		get: (c) => c[field],
+		set: (c, v) => {
+			c[field] = v;
+			return true;
+		}
+	};
+}
+function stringMapField(field, prefix) {
+	return {
+		field,
+		prefix,
+		keyProp: `${prefix}-key`,
+		valueProp: `${prefix}-value`,
+		get: (c) => c[field],
+		set: (c, m) => {
+			c[field] = m;
+		}
+	};
+}
+/**
+* The table order is the order the exporter emits props in, and the test pins it to
+* the components[] rows of the vocabulary table.
+*/
+const COMPONENT_PROPS = [
+	{
+		prop: "component-name",
+		field: "name",
+		required: true,
+		get: (c) => c.name,
+		set: (c, v) => {
+			c.name = v;
+			return true;
+		}
+	},
+	stringField("component-description", "description"),
+	stringField("component-hostname", "hostname"),
+	stringField("component-fqdn", "fqdn"),
+	stringField("component-domain", "domain"),
+	stringField("component-ip-address", "ipAddress"),
+	stringField("component-mac-address", "macAddress"),
+	stringField("component-os-name", "osName"),
+	stringField("component-os-version", "osVersion"),
+	stringField("component-image-id", "imageId"),
+	stringField("component-registry", "registry"),
+	stringField("component-repository", "repository"),
+	stringField("component-tag", "tag"),
+	stringField("component-container-id", "containerId"),
+	stringField("component-image", "image"),
+	stringField("component-runtime", "runtime"),
+	stringField("component-platform-type", "platformType"),
+	stringField("component-cluster-name", "clusterName"),
+	stringField("component-namespace", "namespace"),
+	stringField("component-version", "version"),
+	{
+		prop: "component-provider",
+		field: "provider",
+		accepts: `one of ${cloudProviderValues().join(", ")}`,
+		get: (c) => c.provider ?? void 0,
+		set: (c, v) => {
+			if (!validCloudProvider(v)) return false;
+			c.provider = v;
+			return true;
+		}
+	},
+	stringField("component-account-id", "accountId"),
+	stringField("component-region", "region"),
+	stringField("component-resource-type", "resourceType"),
+	stringField("component-resource-id", "resourceId"),
+	stringField("component-arn", "arn"),
+	stringField("component-url", "url"),
+	stringField("component-branch", "branch"),
+	stringField("component-commit", "commit"),
+	stringField("component-environment", "environment"),
+	stringField("component-package-manager", "packageManager"),
+	stringField("component-package-name", "packageName"),
+	stringField("component-cidr", "cidr"),
+	stringField("component-gateway", "gateway"),
+	stringField("component-engine", "engine"),
+	stringField("component-host", "host"),
+	{
+		prop: "component-port",
+		field: "port",
+		accepts: `a decimal integer in ${MIN_PORT}..${MAX_PORT}`,
+		get: (c) => c.port === void 0 ? void 0 : String(c.port),
+		set: (c, v) => {
+			const n = componentPort(v);
+			if (n === void 0) return false;
+			c.port = n;
+			return true;
+		}
+	},
+	stringField("component-model-id", "modelId"),
+	stringField("component-dataset-id", "datasetId")
+];
+const COMPONENT_GROUP_PROPS = [stringMapField("labels", "component-label"), stringMapField("externalIds", "component-external-id")];
+/**
+* Carries a component's identity fields as HDF-namespaced props, in table order. A
+* present-but-empty optional string is carried by an empty-field marker (§1.7.3);
+* an absent field emits nothing. Mirrors the Go peer.
+*/
+function componentSubjectProps(c) {
+	const props = [];
+	for (const e of COMPONENT_PROPS) {
+		const v = e.get(c);
+		if (v === void 0) continue;
+		if (v === "") {
+			if (!e.required) props.push(emptyFieldProp(e.field));
+			continue;
+		}
+		pushVocabularyProp(props, e.prop, v);
+	}
+	for (const g of COMPONENT_GROUP_PROPS) appendComponentMap(props, g, g.get(c));
+	return props;
+}
+/**
+* Fills a component's identity fields from the HDF-namespaced props on its
+* subject, leaving a field the props do not carry as the caller set it. A value
+* outside its HDF field's domain — which a foreign or hand-edited SAR can carry —
+* is dropped with a warning rather than written into a document the HDF validator
+* would reject. Mirrors the Go peer.
+*/
+function readComponentSubjectProps(c, props) {
+	for (const e of COMPONENT_PROPS) {
+		const v = readComponentProp(props, e);
+		if (v === void 0) continue;
+		if (!e.set(c, v)) emitConverterWarning(`Dropping ${e.prop} ${JSON.stringify(v)} on component ${JSON.stringify(c.name)}: not ${e.accepts}`);
+	}
+	for (const g of COMPONENT_GROUP_PROPS) {
+		const m = readComponentMap(props, g);
+		if (m) g.set(c, m);
+	}
+}
+/**
+* Reads the HDF value the props carry for one entry. A required field has no
+* empty-field marker to consult, so its prop is read wherever it sits rather than
+* through the optional-string helper.
+*/
+function readComponentProp(props, e) {
+	if (e.required) return findVocabularyProp(props, e.prop)?.value;
+	return vocabularyString(props, e.prop, e.field, "");
+}
+/**
+* Carries a component string map as grouped key/value props in sorted key order,
+* one group per entry, so the importer can rebuild the map. An empty key or value
+* is carried by an empty-field marker in the same group (§1.7.3). Keys sort by
+* Unicode code point, which is what Go's map-key sort produces; the default sort
+* compares UTF-16 code units and would number the groups differently.
+*/
+function appendComponentMap(props, g, m) {
+	if (!m) return;
+	Object.keys(m).sort(byCodePoint).forEach((k, i) => {
+		const group = `${g.prefix}-${i + 1}`;
+		props.push(groupedComponentProp(g.keyProp, "key", group, k));
+		props.push(groupedComponentProp(g.valueProp, "value", group, m[k]));
+	});
+}
+/** Builds one grouped map prop, degrading to an empty-field marker when empty. */
+function groupedComponentProp(name, field, group, value) {
+	if (value === "") return {
+		...emptyFieldProp(field),
+		group
+	};
+	return {
+		...vocabularyProp(name, value),
+		group
+	};
+}
+/**
+* Rebuilds a component string map from grouped key/value props. Groups are
+* numbered from 1 in the order the exporter emitted them (sorted key order), so
+* reading stops at the first group with neither a key nor a value.
+*/
+function readComponentMap(props, g) {
+	const m = {};
+	for (let n = 1;; n++) {
+		const group = `${g.prefix}-${n}`;
+		const key = vocabularyString(props, g.keyProp, "key", group);
+		const value = vocabularyString(props, g.valueProp, "value", group);
+		if (key === void 0 && value === void 0) break;
+		m[key ?? ""] = value ?? "";
+	}
+	return Object.keys(m).length > 0 ? m : void 0;
+}
+//#endregion
+//#region converters/oscal-to-hdf/typescript/carriage.ts
+/**
+* Foreign-prop carriage through HDF for OSCAL SAR (ADR-0014 §3). The importer
+* stores every OSCAL prop it does not consume in the reserved requirement tag
+* `oscal-props`, and the exporter re-emits them. Mirrors the Go peer in
+* converters/oscal-to-hdf/go/carriage.go.
+*/
+/** The reserved HDF requirement tag that carries unconsumed OSCAL SAR props. */
+const OSCAL_PROPS_TAG = "oscal-props";
+/**
+* Appends a carriage entry for every prop that HDF does not consume (ADR-0014
+* §3.1). `on` is the OSCAL object the props hang on. Source order is preserved.
+*/
+function carryForeignProps(entries, on, props) {
+	for (const p of props ?? []) {
+		if (consumedVocabularyProp(p)) continue;
+		const entry = {
+			on,
+			name: p.name,
+			value: p.value
+		};
+		if (p.ns) entry.ns = p.ns;
+		if (p.class) entry.class = p.class;
+		if (p.group) entry.group = p.group;
+		if (p.uuid) entry.uuid = p.uuid;
+		if (p.remarks) entry.remarks = p.remarks;
+		entries.push(entry);
+	}
+}
+const isStr = (v) => typeof v === "string";
+const CARRIAGE_ON = [
+	"finding",
+	"observation",
+	"risk"
+];
+const CARRIAGE_OPTIONAL_MEMBERS = [
+	"ns",
+	"class",
+	"group",
+	"uuid",
+	"remarks"
+];
+const CARRIAGE_MEMBERS = /* @__PURE__ */ new Set([
+	"on",
+	"name",
+	"value",
+	...CARRIAGE_OPTIONAL_MEMBERS
+]);
+/**
+* Whether one decoded oscal-props entry conforms to
+* shared/oscal-props.schema.json. A foreign document may put anything in the tag,
+* and an entry the emitter would turn into a non-string OSCAL prop member, or
+* place on no object at all, is not carriage but corruption. Mirrors the Go peer.
+*/
+function validCarriedProp(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return false;
+	const o = entry;
+	for (const k of Object.keys(o)) if (!CARRIAGE_MEMBERS.has(k)) return false;
+	if (!isStr(o.on) || !CARRIAGE_ON.includes(o.on)) return false;
+	if (!isStr(o.name) || o.name.length === 0) return false;
+	if (!isStr(o.value)) return false;
+	for (const k of CARRIAGE_OPTIONAL_MEMBERS) if (k in o && !isStr(o[k])) return false;
+	return true;
+}
+/**
+* Reads the oscal-props entries stored on requirement `requirementId`'s tags.
+* Carriage is best-effort preservation, so reading is per-entry tolerant: a
+* conforming entry is kept, a malformed one is dropped, and the requirement's
+* drops are reported once. Mirrors the Go peer.
+*/
+function readCarriedProps(tags, requirementId) {
+	const raw = tags?.[OSCAL_PROPS_TAG];
+	if (raw === void 0) return [];
+	if (!Array.isArray(raw)) {
+		emitConverterWarning(`Dropping the oscal-props tag on requirement ${JSON.stringify(requirementId)}: it is not an array`);
+		return [];
+	}
+	const entries = raw.filter(validCarriedProp);
+	const dropped = raw.length - entries.length;
+	if (dropped > 0) emitConverterWarning(`Dropping ${dropped} malformed oscal-props ${dropped === 1 ? "entry" : "entries"} on requirement ${JSON.stringify(requirementId)}`);
+	return entries;
+}
+/** The entries whose `on` matches, in carried order. */
+function carriedFor(entries, on) {
+	return entries.filter((e) => e.on === on);
+}
+/**
+* Re-emits carried entries onto an object's props after its own props (ADR-0014
+* §3.4), skipping any entry whose (ns, name, value) is already present — an
+* absent ns compares equal to NIST's default namespace.
+*/
+function appendCarriedProps(props, entries) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const p of props) seen.add(carriageKey(p.ns, p.name, p.value));
+	for (const e of entries) {
+		const key = carriageKey(e.ns, e.name, e.value);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		const prop = {
+			name: e.name,
+			value: e.value
+		};
+		if (e.ns) prop.ns = e.ns;
+		if (e.class) prop.class = e.class;
+		if (e.group) prop.group = e.group;
+		if (e.uuid) prop.uuid = e.uuid;
+		if (e.remarks) prop.remarks = e.remarks;
+		props.push(prop);
+	}
+	return props;
+}
+function carriageKey(ns, name, value) {
+	const namespace = ns === void 0 || ns === "" ? vocabularyDefaultNamespace() : ns;
+	return JSON.stringify([
+		namespace,
+		name,
+		value
+	]);
+}
+//#endregion
 //#region converters/hdf-to-oscal-sar/typescript/converter.ts
 /**
 * Converts HDF Results to OSCAL Assessment Results (SAR) format.
@@ -15283,7 +16050,7 @@ function buildOSCALDocument(hdfResults) {
 		parties: [{
 			uuid: toolActorUuid,
 			type: "organization",
-			name: toolPartyName(hdfResults)
+			name: normalizePropValue(toolPartyName(hdfResults))
 		}]
 	};
 	let importAP;
@@ -15343,6 +16110,8 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	let description = "Converted from HDF results";
 	if (baseline.description && baseline.description !== "") description = baseline.description;
 	const resultProps = [];
+	pushVocabularyProp(resultProps, "baseline-name", baseline.name);
+	if (baseline.title && baseline.title !== "") pushVocabularyProp(resultProps, "baseline-title", baseline.title);
 	if (typeof baseline.version === "string") pushVocabularyProp(resultProps, "baseline-version", baseline.version);
 	const findings = [];
 	const observations = [];
@@ -15368,10 +16137,11 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 	return {
 		result: {
 			uuid: crypto.randomUUID(),
-			title,
+			title: normalizePropValue(title),
 			description,
 			start: assessmentStart(baseline, timestamp),
 			...resultProps.length > 0 ? { props: resultProps } : {},
+			...subjects.length > 0 ? { "local-definitions": { components: componentDefsFromSubjects(subjects) } } : {},
 			"reviewed-controls": { "control-selections": [controlSelection] },
 			...findings.length > 0 ? { findings } : {},
 			...observations.length > 0 ? { observations } : {},
@@ -15384,7 +16154,9 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 * Turns the top-level HDF components[] into OSCAL assessment subjects. Each
 * component's UUID (componentId when present, otherwise a fresh one) identifies
 * the subject; the HDF component type is a valid OSCAL subject type token and
-* its name becomes the subject title.
+* its name becomes the subject title. A subject holds only uuid/type/title, so
+* each component's type-specific identity fields ride as HDF-namespaced props on
+* the subject (ADR-0014 §1.5) and reconstitute on read-back.
 *
 * A component with no type is skipped rather than given one. OSCAL requires both
 * subject-uuid and type on a subject-reference, so the type cannot simply be
@@ -15395,11 +16167,60 @@ function baselineToResult(baseline, timestamp, toolActorUuid, subjects) {
 */
 function buildSubjects(components) {
 	if (!Array.isArray(components) || components.length === 0) return [];
-	return components.filter((c) => oscalString(c.type ?? "") !== "").map((c) => ({
-		"subject-uuid": c.componentId && c.componentId !== "" ? c.componentId : crypto.randomUUID(),
-		type: String(c.type),
-		title: c.name
-	}));
+	const subjects = [];
+	for (const c of components) {
+		if (oscalString(c.type ?? "") === "") {
+			emitConverterWarning(`hdf-to-oscal-sar: component "${c.name}" has no type, which an OSCAL assessment subject requires; not carried`);
+			continue;
+		}
+		const subject = {
+			"subject-uuid": c.componentId && c.componentId !== "" ? c.componentId : crypto.randomUUID(),
+			type: String(c.type),
+			title: normalizePropValue(c.name)
+		};
+		const props = componentSubjectProps(c);
+		if (props.length > 0) subject.props = props;
+		subjects.push(subject);
+		warnUncarriedComponentFields(c);
+	}
+	return subjects;
+}
+/**
+* Turns the assessment subjects into result-level OSCAL system-components so the
+* assessed components survive a round trip even when no requirement produces an
+* observation (ADR-0014 §4.5). Each component keeps the subject's identity
+* (uuid/type/title and the HDF-namespaced props); the OSCAL-required description
+* and status have no HDF counterpart, so they are display fallbacks the importer
+* never reads back — the exact identity lives entirely in the props. Mirrors Go.
+*/
+function componentDefsFromSubjects(subjects) {
+	return subjects.map((s) => {
+		const display = s.title !== "" ? s.title : "Assessed component";
+		return {
+			uuid: s["subject-uuid"],
+			type: s.type,
+			title: display,
+			description: display,
+			...s.props ? { props: s.props } : {},
+			status: { state: "other" }
+		};
+	});
+}
+/**
+* Reports component identity beyond the type-specific fields a SAR subject can
+* hold — owner, BOMs, artifact integrity, and the migration-only fields — so it
+* is not silently dropped (matching the lossy-conversion warning UX). Mirrors Go.
+*/
+function warnUncarriedComponentFields(c) {
+	const dropped = [];
+	if (c.owner) dropped.push("owner");
+	if (Array.isArray(c.boms) && c.boms.length > 0) dropped.push("boms");
+	if (Array.isArray(c.integrity) && c.integrity.length > 0) dropped.push("integrity");
+	if (Array.isArray(c.baselineRefs) && c.baselineRefs.length > 0) dropped.push("baselineRefs");
+	if (Array.isArray(c.inputOverrides) && c.inputOverrides.length > 0) dropped.push("inputOverrides");
+	if (c.targetSelector && Object.keys(c.targetSelector).length > 0) dropped.push("targetSelector");
+	if (dropped.length === 0) return;
+	emitConverterWarning(`hdf-to-oscal-sar: component "${c.name}" carries ${dropped.join(", ")}, which an OSCAL SAR assessment subject cannot represent; not carried`);
 }
 /**
 * Converts an EvaluatedRequirement into a Finding, optional Observation, and optional Risk.
@@ -15462,13 +16283,18 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 		rel: "reference"
 	});
 	let title = req.id;
-	if (req.title && req.title !== "") title = req.title;
+	if (req.title && req.title !== "") {
+		title = req.title;
+		pushVocabularyProp(props, "requirement-title", req.title);
+	}
+	const carried = readCarriedProps(req.tags, req.id);
+	appendCarriedProps(props, carriedFor(carried, "finding"));
 	let resource;
 	if (req.code != null && req.code.trim() !== "") {
 		const resourceUuid = crypto.randomUUID();
 		resource = {
 			uuid: resourceUuid,
-			title: `Check source code for ${req.id}`,
+			title: normalizePropValue(`Check source code for ${req.id}`),
 			props: [vocabularyProp("type", "evidence")],
 			base64: {
 				value: encodeBase64Utf8(req.code),
@@ -15493,7 +16319,7 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	};
 	const finding = {
 		uuid: crypto.randomUUID(),
-		title,
+		title: normalizePropValue(title),
 		description: findingDesc || title,
 		props: props.length > 0 ? props : void 0,
 		links: links.length > 0 ? links : void 0,
@@ -15502,15 +16328,16 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 	let observation;
 	if (results.length > 0) {
 		const obsUUID = crypto.randomUUID();
-		const obsDesc = buildObservationDescription(results);
 		const relevantEvidence = buildRelevantEvidence(req);
+		const obsProps = appendCarriedProps([], carriedFor(carried, "observation"));
 		observation = {
 			uuid: obsUUID,
-			description: obsDesc,
+			description: "",
 			methods: ["TEST"],
 			collected: formatAssessmentTime(earliestResultTime(results), timestamp),
 			...subjects.length > 0 ? { subjects } : {},
-			...relevantEvidence.length > 0 ? { "relevant-evidence": relevantEvidence } : {}
+			...relevantEvidence.length > 0 ? { "relevant-evidence": relevantEvidence } : {},
+			...obsProps.length > 0 ? { props: obsProps } : {}
 		};
 		finding["related-observations"] = [{ "observation-uuid": obsUUID }];
 	} else warnUncarriedProse(req);
@@ -15525,9 +16352,10 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 		}
 		const remediations = buildRemediations(req);
 		const deadline = riskDeadline(req);
+		const riskProps = appendCarriedProps([], carriedFor(carried, "risk"));
 		risk = {
 			uuid: riskUUID,
-			title: `Risk for ${req.id}`,
+			title: normalizePropValue(`Risk for ${req.id}`),
 			description: `Impact: ${req.impact.toFixed(1)} (${severity})`,
 			statement: `Impact: ${req.impact.toFixed(1)} (${severity})`,
 			status: riskStatusFromState(state),
@@ -15543,10 +16371,12 @@ function requirementToFindingSet(req, timestamp, toolActorUuid, subjects) {
 				}]
 			}],
 			...remediations.length > 0 ? { remediations } : {},
-			...deadline ? { deadline } : {}
+			...deadline ? { deadline } : {},
+			...riskProps.length > 0 ? { props: riskProps } : {}
 		};
 		finding["related-risks"] = [{ "risk-uuid": riskUUID }];
 	}
+	if (observation) observation.description = observationDisplayDescription(roundTripStatus(state), observation, risk, title);
 	return {
 		finding,
 		observation,
@@ -15740,17 +16570,50 @@ function extractDefaultDescription(descriptions) {
 	return "";
 }
 /**
-* Concatenates result code descriptions and messages.
+* Synthesizes an observation's display description from the OSCAL objects the
+* exporter emits, mirroring how the reverse SAR importer reconstructs a result's
+* status, codeDesc and message. Deriving it from the emitted observation and risk
+* — not from the HDF result's stored codeDesc/message — makes the SAR round trip
+* idempotent on observation.description (ADR-0014 §3.5): the string already equals
+* what the importer reads back and the next export re-synthesizes, so the first
+* HDF-produced export equals the second. observation.description is display text,
+* not a prose home (ADR-0014 §2); the requirement's real prose rides its own homes
+* (finding.target.description, relevant-evidence, risk.remediations).
 */
-function buildObservationDescription(results) {
+function observationDisplayDescription(status, obs, risk, fallbackTitle) {
+	let desc = `[${status}] ${reconstructedCodeDesc(obs, fallbackTitle)}`;
+	const msg = reconstructedRiskMessage(risk);
+	if (msg !== "") desc += ": " + msg;
+	return desc;
+}
+/**
+* The HDF status the emitted finding's target state maps back to on import
+* (oscal-to-hdf mapFindingStatus): an unrecognized state is notReviewed, as there.
+*/
+function roundTripStatus(state) {
+	return oscalStatusToHdf(state) ?? "notReviewed";
+}
+/** Mirrors oscal-to-hdf buildCodeDesc for the single observation the exporter emits. */
+function reconstructedCodeDesc(obs, fallbackTitle) {
 	const parts = [];
-	for (const r of results) {
-		let desc = `[${r.status}] ${r.codeDesc}`;
-		if (r.message && r.message !== "") desc += ": " + r.message;
-		parts.push(desc);
+	if (obs.methods && obs.methods.length > 0) parts.push("Methods: " + obs.methods.join(", "));
+	for (const subj of obs.subjects ?? []) {
+		let subjDesc = subj.type;
+		if (subj.title) subjDesc = subj.title + " (" + subj.type + ")";
+		parts.push("Subject: " + subjDesc);
 	}
-	if (parts.length === 0) return "No observations recorded";
-	return parts.join("\n");
+	if (parts.length === 0) return fallbackTitle;
+	return parts.join("; ");
+}
+/**
+* Mirrors oscal-to-hdf buildRiskMessage for the single risk the exporter emits
+* (undefined when the requirement's impact is 0).
+*/
+function reconstructedRiskMessage(risk) {
+	if (!risk) return "";
+	let msg = risk.title;
+	if (risk.description) msg += ": " + risk.description;
+	return msg;
 }
 /**
 * Maps OSCAL finding state to risk status.
@@ -15796,7 +16659,7 @@ const OVERRIDE_APPLIED_TITLE = "Override applied";
 * through some other producer's validation.
 */
 function poamTitle(a) {
-	return firstNonEmpty(a.name, a.amendmentId ?? "", "HDF Amendments");
+	return normalizePropValue(firstNonEmpty(a.name, a.amendmentId ?? "", "HDF Amendments"));
 }
 /**
 * Stands in for an empty requirementId: HDF puts no minLength on it, and OSCAL
@@ -15807,7 +16670,7 @@ function poamTitle(a) {
 const UNIDENTIFIED_REQUIREMENT_TITLE = "Unidentified requirement";
 /** The title of the risk and POA&M item an override produces. */
 function requirementTitle(override) {
-	return firstNonEmpty(override.requirementId, UNIDENTIFIED_REQUIREMENT_TITLE);
+	return normalizePropValue(firstNonEmpty(override.requirementId, UNIDENTIFIED_REQUIREMENT_TITLE));
 }
 /**
 * Supplies the text OSCAL requires for a risk's description and statement. HDF
@@ -15843,7 +16706,7 @@ var PartyRegistry = class {
 		]);
 		const existing = this.byKey.get(key);
 		if (existing) return existing.uuid;
-		const name = oscalString(id.identifier);
+		const name = normalizePropValue(id.identifier ?? "");
 		const props = [];
 		pushVocabularyProp(props, "identity-identifier", id.identifier ?? "");
 		pushVocabularyProp(props, "identity-type", String(id.type));
@@ -16287,7 +17150,7 @@ function referenceResource(ref, b) {
 	pushOptionalString(props, "reference-kind", "kind", ref.kind);
 	return {
 		uuid: crypto.randomUUID(),
-		title: ref.sourceName,
+		title: normalizePropValue(ref.sourceName ?? ""),
 		...ref.description ? { description: ref.description } : {},
 		...props.length > 0 ? { props } : {},
 		...ref.href ? { rlinks: [{ href: ref.href }] } : {},
@@ -18521,6 +19384,12 @@ function definitionBaselineName(compDef) {
 * mapping they had before it: type "poam", with their own extension props not
 * carried (§3.6).
 *
+* Foreign-prop carriage is SAR-only (ADR-0014 §3.6): unlike a SAR requirement's
+* tags, Standalone_Override has no extension slot (unevaluatedProperties: false),
+* so a foreign POA&M's own extension props are a stated loss on import — there is
+* no oscal-props tag here and none is invented. HDF-produced POA&Ms are
+* unaffected; every HDF field round-trips through §4.6.
+*
 * Mirrors the Go implementation in converters/oscal-to-hdf/go/converter_poam.go.
 */
 /**
@@ -19208,7 +20077,7 @@ async function convertOscalSarToHdf(input) {
 			emitConverterWarning(`Skipping assessment result "${title}": no finding has a target-id`);
 			continue;
 		}
-		const baseline = await resultToEvaluatedBaseline(result, groups, sar, input, scanTime);
+		const baseline = await resultToEvaluatedBaseline(result, groups, input, scanTime);
 		baselines.push(baseline);
 	}
 	const planRef = sar["import-ap"]?.href || void 0;
@@ -19217,6 +20086,7 @@ async function convertOscalSarToHdf(input) {
 		const t = parseTimestamp(meta.lastModified);
 		if (t) timestamp = t;
 	}
+	const components = sarComponents(sar);
 	return serializeHdf({
 		baselines,
 		generator: {
@@ -19228,10 +20098,76 @@ async function convertOscalSarToHdf(input) {
 			format: "OSCAL"
 		},
 		timestamp: timestamp ?? /* @__PURE__ */ new Date(),
-		planRef
+		planRef,
+		...components.length > 0 ? { components } : {}
 	});
 }
 /**
+* The set of OSCAL subject types that are HDF component types. A foreign SAR's
+* subject types (component, inventory-item, party, …) are not among them, so
+* those subjects do not reconstitute as HDF components. Mirrors the Go peer.
+*/
+const HDF_COMPONENT_TYPES = /* @__PURE__ */ new Set([
+	"host",
+	"containerImage",
+	"containerInstance",
+	"containerPlatform",
+	"cloudAccount",
+	"cloudResource",
+	"repository",
+	"application",
+	"artifact",
+	"network",
+	"database",
+	"aiModel",
+	"dataset"
+]);
+/**
+* Reconstitutes the top-level HDF components from a SAR. The authoritative home is
+* each result's local-definitions.components (ADR-0014 §4.5), which survives even
+* when no requirement produced an observation; the per-observation subjects are
+* read too for documents exported before the result-level home existed. Components are deduplicated by uuid in first-seen document order — a
+* component appears identically at the result level and on every observation — and
+* one whose type is not an HDF component type is left alone so foreign SARs gain no
+* invalid components. Mirrors Go.
+*/
+function sarComponents(sar) {
+	const components = [];
+	const seen = /* @__PURE__ */ new Set();
+	const add = (subj) => {
+		const uuid = subj["subject-uuid"];
+		if (!uuid || seen.has(uuid) || !HDF_COMPONENT_TYPES.has(subj.type)) return;
+		seen.add(uuid);
+		components.push(subjectToComponent(subj));
+	};
+	for (const result of sar.results) {
+		for (const sc of result["local-definitions"]?.components ?? []) add({
+			"subject-uuid": sc.uuid,
+			type: sc.type,
+			title: sc.title,
+			props: sc.props
+		});
+		for (const obs of result.observations ?? []) for (const subj of obs.subjects ?? []) add(subj);
+	}
+	return components;
+}
+/**
+* Rebuilds one HDF component from an assessment subject: the subject uuid is the
+* componentId (ADR-0014 §4.5 SSP analog), and every type-specific identity field
+* comes from the HDF-namespaced props the exporter stamped on the subject. The
+* subject title is the name a foreign subject carries no component-name prop for
+* (§4.3, §4.5). Mirrors the Go peer.
+*/
+function subjectToComponent(subj) {
+	const c = {
+		type: subj.type,
+		name: subj.title ?? "",
+		componentId: subj["subject-uuid"]
+	};
+	readComponentSubjectProps(c, subj.props);
+	return c;
+}
+/**
 * Groups findings by requirement id in first-seen order (a Map keeps insertion
 * order), within the finding cap, and returns the findings skipped for an empty
 * target-id. Mirrors Go's groupFindingsByRequirement.
@@ -19268,24 +20204,25 @@ function sarRequirementId(f) {
 	const controlId = confirmedControlId(targetId);
 	return controlId === void 0 ? targetId : controlIdToNistTag(controlId);
 }
-async function resultToEvaluatedBaseline(result, groups, sar, rawInput, scanTime) {
+async function resultToEvaluatedBaseline(result, groups, rawInput, scanTime) {
 	const checksum = await inputChecksum(rawInput);
 	const obsMap = buildObservationMap(result.observations ?? []);
 	const riskMap = buildRiskMap(result.risks ?? []);
 	const requirements = [];
 	for (const [id, findings] of groups) requirements.push(findingsToEvaluatedRequirement(id, findings, obsMap, riskMap, result, scanTime));
-	const name = sarBaselineName(result, sar);
+	const name = sarBaselineName(result);
 	const baseline = createMinimalBaseline(name, requirements, {
 		resultsChecksum: checksum,
 		integrity: await inputIntegrity(rawInput),
 		status: "loaded",
-		title: result.title
+		title: sarBaselineTitle(result)
 	});
 	if (result.description) baseline.description = result.description;
 	return baseline;
 }
 function findingsToEvaluatedRequirement(id, findings, obsMap, riskMap, result, scanTime) {
-	const title = findings[0].title || id;
+	const firstFinding = findings[0];
+	const title = sarRequirementTitle(firstFinding) || id;
 	const impact = sarFindingsImpact(findings, riskMap);
 	const descriptions = sarBuildDescriptions(findings, obsMap, riskMap);
 	const refs = sarBuildRefs(findings, obsMap);
@@ -19293,6 +20230,8 @@ function findingsToEvaluatedRequirement(id, findings, obsMap, riskMap, result, s
 	for (const f of findings) results.push(findingToRequirementResult(f, obsMap, riskMap, result, scanTime));
 	const nistTags = sarConfirmedNistTags(findings);
 	const tags = buildNistCciTags(nistTags, nistToCci(nistTags));
+	const carried = sarCarriedProps(findings, obsMap, riskMap);
+	if (carried.length > 0) tags[OSCAL_PROPS_TAG] = carried;
 	const req = createRequirement(id, title, descriptions, impact, results, {
 		tags,
 		...refs ? { refs } : {}
@@ -19325,6 +20264,33 @@ function sarConfirmedNistTags(findings) {
 	}
 	return controlIdsToNistTags(controlIds);
 }
+/**
+* Collects the carriage entries for a requirement (ADR-0014 §3.1): every
+* unconsumed prop on its finding(s), then on their related observations, then on
+* their related risks. Observations and risks are read once each (deduplicated
+* by UUID). Mirrors Go's sarCarriedProps.
+*/
+function sarCarriedProps(findings, obsMap, riskMap) {
+	const entries = [];
+	for (const f of findings) carryForeignProps(entries, "finding", f.props);
+	const seenObs = /* @__PURE__ */ new Set();
+	for (const f of findings) for (const ref of f["related-observations"] ?? []) {
+		const uuid = ref["observation-uuid"];
+		if (!uuid || seenObs.has(uuid)) continue;
+		seenObs.add(uuid);
+		const obs = obsMap.get(uuid);
+		if (obs) carryForeignProps(entries, "observation", obs.props);
+	}
+	const seenRisk = /* @__PURE__ */ new Set();
+	for (const f of findings) for (const ref of f["related-risks"] ?? []) {
+		const uuid = ref["risk-uuid"];
+		if (!uuid || seenRisk.has(uuid)) continue;
+		seenRisk.add(uuid);
+		const risk = riskMap.get(uuid);
+		if (risk) carryForeignProps(entries, "risk", risk.props);
+	}
+	return entries;
+}
 function mapFindingStatus(f) {
 	const status = oscalStatusToHdf(f.target.status.state);
 	if (status === "passed") return ResultStatus.Passed;
@@ -19553,8 +20519,19 @@ function parseResultStartTime(result) {
 	}
 	return /* @__PURE__ */ new Date(0);
 }
-function sarBaselineName(result, sar) {
-	return toKebabCase(result.title || sar.metadata.title, "oscal-assessment-results");
+function sarBaselineName(result) {
+	const match = findVocabularyProp(result.props, "baseline-name");
+	if (match) return match.value;
+	const kebab = toKebabCase(result.title ?? "", "");
+	return kebab === "" ? result.uuid : `${kebab}--${result.uuid}`;
+}
+function sarBaselineTitle(result) {
+	const match = findVocabularyProp(result.props, "baseline-title");
+	return match ? match.value : result.title ?? "";
+}
+function sarRequirementTitle(f) {
+	const match = findVocabularyProp(f.props, "requirement-title");
+	return match ? match.value : f.title ?? "";
 }
 //#endregion
 //#region converters/oscal-to-hdf/typescript/converter-ssp.ts