@mitre/hdf-fixtures 3.6.0 → 3.7.0-rc.1

package/LICENSE.md

@@ -0,0 +1,55 @@
+# License
+
+Copyright © 2025 The MITRE Corporation.
+
+Approved for Public Release; Distribution Unlimited. Case Number 18-3678.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may
+not use this file except in compliance with the License. You may obtain a
+copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+License for the specific language governing permissions and limitations
+under the License.
+
+## Redistribution Terms
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+- Redistributions of source code must retain the above copyright/digital
+  rights legend, this list of conditions and the following Notice.
+- Redistributions in binary form must reproduce the above
+  copyright/digital rights legend, this list of conditions and the
+  following Notice in the documentation and/or other materials provided
+  with the distribution.
+- Neither the name of The MITRE Corporation nor the names of its contributors
+  may be used to endorse or promote products derived from this software
+  without specific prior written permission.
+
+## Notice
+
+The MITRE Corporation grants permission to reproduce, distribute, modify, and
+otherwise use this software to the extent permitted by the licensed terms
+provided in the LICENSE file included with this project.
+
+This software was produced by The MITRE Corporation for the U.S. Government
+under contract. As such the U.S. Government has certain use and data
+rights in this software. No use other than those granted to the U.S.
+Government, or to those acting on behalf of the U.S. Government, under
+these contract arrangements is authorized without the express written
+permission of The MITRE Corporation.
+
+Some files in this codebase were generated by generative AI, under the
+direction and review of The MITRE Corporation employees, for the purpose of
+development efficiency. All AI-generated code functionality was validated
+by standard quality and assurance testing.
+
+For further information, please contact The MITRE Corporation,
+Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539,
+(703) 983-6000.

package/README.md

@@ -45,8 +45,7 @@ them via the materialize-to-tmp-file helper in `converter_test.go`).
 
 ## Fixture provenance
 
-All fixtures here are **real tool output**, never fabricated (per
-CLAUDE.md's fixture-integrity rule).
+Fixtures here are **real tool output**, or a schema-valid document derived from one, never invented data — a converter tested against invented data proves nothing about real data. The one hand-authored file, `results/minimal.json`, exists to be the smallest schema-valid HDF Results document and is validated as such; it asserts nothing about any tool's output shape.
 
 ### `results/` — HDF Results docs
 
@@ -54,6 +53,9 @@ CLAUDE.md's fixture-integrity rule).
 |------|--------|-----------|
 | `inspec-multilayered.json` | InSpec runner, multi-overlay scan | hdf-extension-graph TS + Go tests + hdf-parsers parser parity test. The bug-exhibiting fixture for `hdf-libs-2nm0` — bare timestamps that broke parsers before #83/#828d landed. Moved from `hdf-extension-graph/test/fixtures/multilayered-inspec.json`. |
 | `minimal.json` | Hand-crafted minimal valid HDF Results doc | hdf-to-xml converter (TS + Go) + hdf-parsers integration test + hdf-validators integration test. The smallest schema-valid HDF Results document — single baseline, one passing requirement. Moved from `hdf-converters/converters/hdf-to-xml/fixtures/input/minimal.json`. |
+| `duplicate-baselines.json` | Prisma Cloud HDF results (`prisma-to-hdf`) — 16 baselines, 94 requirements, repeated (name, id) keys. Constructed for merge/correlation testing, PR #362. | hdf-engine TS + Go (filter/query index-uniqueness) + hdf-cli MCP tools (inspect/aggregate/compliance). Moved from `hdf-engine/testdata/duplicate-baselines.json` and `hdf-cli/internal/mcp/tools/testdata/duplicate-baselines.json`. |
+| `merge-grype.json` | Grype HDF results (`grype-to-hdf`, Grype 0.79.3) — one baseline, duplicate requirement ids. Constructed for merge/correlation testing, PR #362. | hdf-engine TS + Go (merge parity) + hdf-cli MCP tools (query correlation, multi-source). Moved from `hdf-engine/testdata/merge-grype.json` and `hdf-cli/internal/mcp/tools/testdata/grype-duplicate-ids.json`. |
+| `merge-zap.json` | OWASP ZAP HDF results (`zap-to-hdf`, ZAP 2.7.0) — four baselines/components, no ids. Constructed for merge/correlation testing, PR #362. | hdf-engine TS + Go (merge parity) + hdf-cli MCP tools (inspect, sources, query multi-source) + hdf-cli MCP evals (sources validation). Moved from `hdf-engine/testdata/merge-zap.json` and `hdf-cli/internal/mcp/tools/testdata/zap-webgoat.json`. |
 
 ### `baseline/` — HDF Baseline docs
 
@@ -81,7 +83,6 @@ runner config.
 | `container-scan.json` | Generic container scan, `-05:00` offset | same |
 | `three-layer-overlay.json` | Three-layer overlay chain, `+00:00` offset | same |
 | `wrapper.json` | InSpec wrapper-profile structure | legacyhdf-to-hdf converter (TS + Go) + hdf-parsers flatten integration test |
-| `three-layer-rhel7.json` | Three-layer RHEL7 overlay (was `Three_Layer_RHEL7_Overlay_Example.json`) | hdf-parsers flatten integration test. Moved from `hdf-schema/test/fixtures/`. |
 
 ## Validation gate
 

package/dist/index.d.ts

@@ -3,28 +3,33 @@ interface FixtureRef {
   path: string;
   read: () => string;
 }
-declare const results: {
+export declare const results: {
   readonly inspecMultilayered: FixtureRef;
   readonly minimal: FixtureRef;
+  readonly duplicateBaselines: FixtureRef;
+  readonly mergeGrype: FixtureRef;
+  readonly mergeZap: FixtureRef;
 };
-declare const baseline: {
+export declare const baseline: {
   readonly win2022Stig: FixtureRef;
 };
-declare const amendments: {
+export declare const amendments: {
   readonly uc01Fixed: FixtureRef;
   readonly multiCve: FixtureRef;
 };
-declare const inspec: {
+export declare const inspec: {
   readonly ubi9Scan: FixtureRef;
   readonly containerScan: FixtureRef;
   readonly threeLayerOverlay: FixtureRef;
-  readonly threeLayerRhel7: FixtureRef;
   readonly wrapper: FixtureRef;
 };
-declare const all: {
+export declare const all: {
   readonly results: {
     readonly inspecMultilayered: FixtureRef;
     readonly minimal: FixtureRef;
+    readonly duplicateBaselines: FixtureRef;
+    readonly mergeGrype: FixtureRef;
+    readonly mergeZap: FixtureRef;
   };
   readonly baseline: {
     readonly win2022Stig: FixtureRef;
@@ -37,10 +42,8 @@ declare const all: {
     readonly ubi9Scan: FixtureRef;
     readonly containerScan: FixtureRef;
     readonly threeLayerOverlay: FixtureRef;
-    readonly threeLayerRhel7: FixtureRef;
     readonly wrapper: FixtureRef;
   };
 };
 //#endregion
-export { all, amendments, baseline, inspec, results };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";UA0BU;EACR;EACA;;cAYW;+BAAA;oBAAA;;cAMA;wBAAA;;cAKA;sBAAA;qBAAA;;cAQA;;;;;;;cAQA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";UA0BU;EACR;EACA;;qBAYW;;;;;;;qBASA;wBAAA;;qBAKA;sBAAA;qBAAA;;qBAQA;;;;;;qBAOA"}

package/dist/index.js

@@ -13,7 +13,10 @@ function fixture(category, name) {
 }
 const results = {
 	inspecMultilayered: fixture("results", "inspec-multilayered.json"),
-	minimal: fixture("results", "minimal.json")
+	minimal: fixture("results", "minimal.json"),
+	duplicateBaselines: fixture("results", "duplicate-baselines.json"),
+	mergeGrype: fixture("results", "merge-grype.json"),
+	mergeZap: fixture("results", "merge-zap.json")
 };
 const baseline = { win2022Stig: fixture("baseline", "win2022-stig.json") };
 const amendments = {
@@ -24,7 +27,6 @@ const inspec = {
 	ubi9Scan: fixture("inspec", "ubi9-scan.json"),
 	containerScan: fixture("inspec", "container-scan.json"),
 	threeLayerOverlay: fixture("inspec", "three-layer-overlay.json"),
-	threeLayerRhel7: fixture("inspec", "three-layer-rhel7.json"),
 	wrapper: fixture("inspec", "wrapper.json")
 };
 const all = {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// @mitre/hdf-fixtures — shared real-world HDF reference data for cross-package\n// consumers (parsers, validators, hdf-extension-graph). Each entry exposes the\n// on-disk path AND a read() helper. Both Go and TS test code reach the same\n// physical files via the parallel APIs (this module + ../fixtures.go).\n//\n// Boundary rule (per bead hdf-libs-e95o): converter fixtures stay with the\n// converter as its tested contract; files here are wild-data references for\n// cross-cutting tests. Inclusion requires the fixture is actually consumed\n// by more than one workspace package — not just \"might be useful someday.\"\n//\n// Layout: top-level directories are by HDF document type (`results/`,\n// `baseline/`, `amendments/`) plus `inspec/` for InSpec runner output (non-HDF;\n// kept for cross-language parser parity tests verifying both languages\n// reject non-HDF inputs the same way).\n//\n// Provenance for every fixture is documented in ../README.md.\nimport { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\n// Compute paths relative to the package root, not the dist/ output dir, so\n// fixtures resolve correctly both in dev (running tsx) and after bundling.\nconst PACKAGE_ROOT = path.resolve(__dirname, '..');\n\ninterface FixtureRef {\n  path: string;\n  read: () => string;\n}\n\nfunction fixture(category: string, name: string): FixtureRef {\n  const filePath = path.join(PACKAGE_ROOT, category, name);\n  return {\n    path: filePath,\n    read: () => readFileSync(filePath, 'utf-8'),\n  };\n}\n\n// HDF Results documents.\nexport const results = {\n  inspecMultilayered: fixture('results', 'inspec-multilayered.json'),\n  minimal: fixture('results', 'minimal.json'),\n} as const;\n\n// HDF Baseline documents.\nexport const baseline = {\n  win2022Stig: fixture('baseline', 'win2022-stig.json'),\n} as const;\n\n// HDF Amendments documents.\nexport const amendments = {\n  uc01Fixed: fixture('amendments', 'uc-01-fixed-amendments.json'),\n  multiCve: fixture('amendments', 'multi-cve-amendments.json'),\n} as const;\n\n// InSpec runner output — NOT HDF. Kept here for cross-language parser\n// parity tests that verify both Go and TS parsers reject non-HDF inputs the\n// same way, and for the legacyhdf-to-hdf converter (its tests load these too).\nexport const inspec = {\n  ubi9Scan: fixture('inspec', 'ubi9-scan.json'),\n  containerScan: fixture('inspec', 'container-scan.json'),\n  threeLayerOverlay: fixture('inspec', 'three-layer-overlay.json'),\n  threeLayerRhel7: fixture('inspec', 'three-layer-rhel7.json'),\n  wrapper: fixture('inspec', 'wrapper.json'),\n} as const;\n\nexport const all = {\n  results,\n  baseline,\n  amendments,\n  inspec,\n} as const;\n"],"mappings":";;;;AAoBA,MAAM,YAAY,KAAK,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC;AAI7D,MAAM,eAAe,KAAK,QAAQ,WAAW,IAAI;AAOjD,SAAS,QAAQ,UAAkB,MAA0B;CAC3D,MAAM,WAAW,KAAK,KAAK,cAAc,UAAU,IAAI;CACvD,OAAO;EACL,MAAM;EACN,YAAY,aAAa,UAAU,OAAO;CAC5C;AACF;AAGA,MAAa,UAAU;CACrB,oBAAoB,QAAQ,WAAW,0BAA0B;CACjE,SAAS,QAAQ,WAAW,cAAc;AAC5C;AAGA,MAAa,WAAW,EACtB,aAAa,QAAQ,YAAY,mBAAmB,EACtD;AAGA,MAAa,aAAa;CACxB,WAAW,QAAQ,cAAc,6BAA6B;CAC9D,UAAU,QAAQ,cAAc,2BAA2B;AAC7D;AAKA,MAAa,SAAS;CACpB,UAAU,QAAQ,UAAU,gBAAgB;CAC5C,eAAe,QAAQ,UAAU,qBAAqB;CACtD,mBAAmB,QAAQ,UAAU,0BAA0B;CAC/D,iBAAiB,QAAQ,UAAU,wBAAwB;CAC3D,SAAS,QAAQ,UAAU,cAAc;AAC3C;AAEA,MAAa,MAAM;CACjB;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// @mitre/hdf-fixtures — shared real-world HDF reference data for cross-package\n// consumers (parsers, validators, hdf-extension-graph). Each entry exposes the\n// on-disk path AND a read() helper. Both Go and TS test code reach the same\n// physical files via the parallel APIs (this module + ../fixtures.go).\n//\n// Boundary rule (per bead hdf-libs-e95o): converter fixtures stay with the\n// converter as its tested contract; files here are wild-data references for\n// cross-cutting tests. Inclusion requires the fixture is actually consumed\n// by more than one workspace package — not just \"might be useful someday.\"\n//\n// Layout: top-level directories are by HDF document type (`results/`,\n// `baseline/`, `amendments/`) plus `inspec/` for InSpec runner output (non-HDF;\n// kept for cross-language parser parity tests verifying both languages\n// reject non-HDF inputs the same way).\n//\n// Provenance for every fixture is documented in ../README.md.\nimport { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\n// Compute paths relative to the package root, not the dist/ output dir, so\n// fixtures resolve correctly both in dev (running tsx) and after bundling.\nconst PACKAGE_ROOT = path.resolve(__dirname, '..');\n\ninterface FixtureRef {\n  path: string;\n  read: () => string;\n}\n\nfunction fixture(category: string, name: string): FixtureRef {\n  const filePath = path.join(PACKAGE_ROOT, category, name);\n  return {\n    path: filePath,\n    read: () => readFileSync(filePath, 'utf-8'),\n  };\n}\n\n// HDF Results documents.\nexport const results = {\n  inspecMultilayered: fixture('results', 'inspec-multilayered.json'),\n  minimal: fixture('results', 'minimal.json'),\n  duplicateBaselines: fixture('results', 'duplicate-baselines.json'),\n  mergeGrype: fixture('results', 'merge-grype.json'),\n  mergeZap: fixture('results', 'merge-zap.json'),\n} as const;\n\n// HDF Baseline documents.\nexport const baseline = {\n  win2022Stig: fixture('baseline', 'win2022-stig.json'),\n} as const;\n\n// HDF Amendments documents.\nexport const amendments = {\n  uc01Fixed: fixture('amendments', 'uc-01-fixed-amendments.json'),\n  multiCve: fixture('amendments', 'multi-cve-amendments.json'),\n} as const;\n\n// InSpec runner output — NOT HDF. Kept here for cross-language parser\n// parity tests that verify both Go and TS parsers reject non-HDF inputs the\n// same way, and for the legacyhdf-to-hdf converter (its tests load these too).\nexport const inspec = {\n  ubi9Scan: fixture('inspec', 'ubi9-scan.json'),\n  containerScan: fixture('inspec', 'container-scan.json'),\n  threeLayerOverlay: fixture('inspec', 'three-layer-overlay.json'),\n  wrapper: fixture('inspec', 'wrapper.json'),\n} as const;\n\nexport const all = {\n  results,\n  baseline,\n  amendments,\n  inspec,\n} as const;\n"],"mappings":";;;;AAoBA,MAAM,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAI7D,MAAM,eAAe,KAAK,QAAQ,WAAW,IAAI;AAOjD,SAAS,QAAQ,UAAkB,MAA0B;CAC3D,MAAM,WAAW,KAAK,KAAK,cAAc,UAAU,IAAI;CACvD,OAAO;EACL,MAAM;EACN,YAAY,aAAa,UAAU,OAAO;CAC5C;AACF;AAGA,MAAa,UAAU;CACrB,oBAAoB,QAAQ,WAAW,0BAA0B;CACjE,SAAS,QAAQ,WAAW,cAAc;CAC1C,oBAAoB,QAAQ,WAAW,0BAA0B;CACjE,YAAY,QAAQ,WAAW,kBAAkB;CACjD,UAAU,QAAQ,WAAW,gBAAgB;AAC/C;AAGA,MAAa,WAAW,EACtB,aAAa,QAAQ,YAAY,mBAAmB,EACtD;AAGA,MAAa,aAAa;CACxB,WAAW,QAAQ,cAAc,6BAA6B;CAC9D,UAAU,QAAQ,cAAc,2BAA2B;AAC7D;AAKA,MAAa,SAAS;CACpB,UAAU,QAAQ,UAAU,gBAAgB;CAC5C,eAAe,QAAQ,UAAU,qBAAqB;CACtD,mBAAmB,QAAQ,UAAU,0BAA0B;CAC/D,SAAS,QAAQ,UAAU,cAAc;AAC3C;AAEA,MAAa,MAAM;CACjB;CACA;CACA;CACA;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/hdf-fixtures",
-  "version": "3.6.0",
+  "version": "3.7.0-rc.1",
   "description": "Shared real-world HDF reference fixtures for cross-package consumers (parsers, validators, extension-graph)",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,15 +17,6 @@
     "baseline",
     "inspec"
   ],
-  "scripts": {
-    "build": "tsdown",
-    "clean": "rimraf dist",
-    "test": "echo 'No TypeScript tests in hdf-fixtures (Go gate runs via test:go)' && exit 0",
-    "test:ts": "echo 'No TypeScript tests in hdf-fixtures (Go gate runs via test:go)' && exit 0",
-    "type-check": "tsc --noEmit",
-    "lint": "eslint src",
-    "test:go": "go test ./..."
-  },
   "repository": {
     "type": "git",
     "url": "https://github.com/mitre/hdf-libs.git",
@@ -35,5 +26,14 @@
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "clean": "rimraf dist",
+    "test": "echo 'No TypeScript tests in hdf-fixtures (Go gate runs via test:go)' && exit 0",
+    "test:ts": "echo 'No TypeScript tests in hdf-fixtures (Go gate runs via test:go)' && exit 0",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint src",
+    "test:go": "go test ./..."
   }
-}
+}