@mitre/hdf-generators 2.0.0

package/LICENSE.md

@@ -0,0 +1,55 @@
+# License
+
+Copyright © 2025 The MITRE Corporation.
+
+Approved for Public Release; Distribution Unlimited. Case Number 18-3678.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may
+not use this file except in compliance with the License. You may obtain a
+copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+License for the specific language governing permissions and limitations
+under the License.
+
+## Redistribution Terms
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+- Redistributions of source code must retain the above copyright/digital
+  rights legend, this list of conditions and the following Notice.
+- Redistributions in binary form must reproduce the above
+  copyright/digital rights legend, this list of conditions and the
+  following Notice in the documentation and/or other materials provided
+  with the distribution.
+- Neither the name of The MITRE Corporation nor the names of its contributors
+  may be used to endorse or promote products derived from this software
+  without specific prior written permission.
+
+## Notice
+
+The MITRE Corporation grants permission to reproduce, distribute, modify, and
+otherwise use this software to the extent permitted by the licensed terms
+provided in the LICENSE file included with this project.
+
+This software was produced by The MITRE Corporation for the U.S. Government
+under contract. As such the U.S. Government has certain use and data
+rights in this software. No use other than those granted to the U.S.
+Government, or to those acting on behalf of the U.S. Government, under
+these contract arrangements is authorized without the express written
+permission of The MITRE Corporation.
+
+Some files in this codebase were generated by generative AI, under the
+direction and review of The MITRE Corporation employees, for the purpose of
+development efficiency. All AI-generated code functionality was validated
+by standard quality and assurance testing.
+
+For further information, please contact The MITRE Corporation,
+Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539,
+(703) 983-6000.

package/README.md

@@ -0,0 +1,82 @@
+# @mitre/hdf-generators
+
+Generate InSpec profile stubs from HDF Baseline definitions.
+
+## What it does
+
+Takes an HDF Baseline JSON document (requirement definitions with metadata, descriptions, and tags) and generates a complete InSpec profile directory structure:
+
+- `inspec.yml` — profile metadata (name, maintainer, license, version, platform supports)
+- `controls/*.rb` — one control file per requirement with `describe` blocks, tags, and impact
+
+This bridges from HDF's tool-agnostic baseline format to InSpec's executable compliance-as-code format.
+
+## Relationship to other packages
+
+| Package | Relationship |
+|---------|-------------|
+| **hdf-schema** | Provides the `HDFBaseline` type that generators consume |
+| **hdf-converters** | Converters produce baselines (e.g., XCCDF benchmark → HDF baseline) that generators can then turn into InSpec profiles |
+| **hdf-cli** | `hdf generate inspec-profile` command wraps this library |
+| **hdf-mappings** | Baselines may contain NIST/CCI tags from hdf-mappings |
+
+## Installation
+
+```bash
+npm install @mitre/hdf-generators
+```
+
+## Usage (TypeScript)
+
+```typescript
+import { generateInSpecProfile } from '@mitre/hdf-generators';
+import type { HDFBaseline } from '@mitre/hdf-schema';
+
+const baseline: HDFBaseline = JSON.parse(fs.readFileSync('baseline.json', 'utf8'));
+
+const profile = generateInSpecProfile(baseline, {
+  maintainer: 'MITRE SAF',
+  copyright: 'MITRE Corporation',
+  license: 'Apache-2.0',
+});
+
+// profile.inspecYml — string content for inspec.yml
+// profile.controls  — Map<string, string> of filename → Ruby control code
+```
+
+### Individual stubs
+
+```typescript
+import { generateControlStub, generateInSpecYml, escapeQuotes } from '@mitre/hdf-generators';
+
+// Generate a single control file
+const ruby = generateControlStub(requirement);
+
+// Generate inspec.yml
+const yml = generateInSpecYml(baseline, { maintainer: 'Team', license: 'Apache-2.0' });
+```
+
+## Usage (Go)
+
+```go
+import generators "github.com/mitre/hdf-generators"
+
+profile := generators.GenerateInSpecProfile(baseline, generators.ProfileMetadata{
+    Maintainer: "MITRE SAF",
+    License:    "Apache-2.0",
+})
+// profile.InspecYml — string
+// profile.Controls  — map[string]string
+```
+
+## CLI usage
+
+```bash
+hdf generate inspec-profile baseline.json output-dir/
+hdf generate inspec-profile baseline.json output-dir/ --maintainer "MITRE SAF"
+hdf generate inspec-profile baseline.json output-dir/ --single-file
+```
+
+## License
+
+Apache-2.0 © MITRE Corporation

package/dist/control-stub.d.ts

@@ -0,0 +1,16 @@
+import type { BaselineRequirement } from '@mitre/hdf-schema';
+/**
+ * Generate a Ruby InSpec control stub from an HDF BaselineRequirement.
+ *
+ * Output follows the InSpec DSL ordering convention:
+ *   control 'ID' do
+ *     title ...
+ *     desc ...
+ *     desc 'check', ...
+ *     impact ...
+ *     tag key: value
+ *     <code or stub comment>
+ *   end
+ */
+export declare function generateControlStub(req: BaselineRequirement): string;
+//# sourceMappingURL=control-stub.d.ts.map

package/dist/control-stub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-stub.d.ts","sourceRoot":"","sources":["../src/control-stub.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAsDpE"}

package/dist/control-stub.js

@@ -0,0 +1,81 @@
+import { escapeQuotes } from './ruby-escape.js';
+/**
+ * Generate a Ruby InSpec control stub from an HDF BaselineRequirement.
+ *
+ * Output follows the InSpec DSL ordering convention:
+ *   control 'ID' do
+ *     title ...
+ *     desc ...
+ *     desc 'check', ...
+ *     impact ...
+ *     tag key: value
+ *     <code or stub comment>
+ *   end
+ */
+export function generateControlStub(req) {
+    const lines = [];
+    lines.push(`control '${req.id}' do`);
+    // Title
+    if (req.title) {
+        lines.push(`  title ${escapeQuotes(req.title)}`);
+    }
+    // Descriptions: default first (as bare `desc`), then labeled
+    const defaultDesc = req.descriptions.find((d) => d.label === 'default');
+    if (defaultDesc) {
+        lines.push(`  desc ${escapeQuotes(defaultDesc.data)}`);
+    }
+    const seenDefault = new Set();
+    for (const d of req.descriptions) {
+        if (d.label === 'default') {
+            if (seenDefault.has('default')) {
+                continue; // skip duplicate default
+            }
+            seenDefault.add('default');
+            continue; // already emitted above as bare desc
+        }
+        lines.push(`  desc '${d.label}', ${escapeQuotes(d.data)}`);
+    }
+    // Impact — always render with at least one decimal place for 0 and whole numbers
+    if (req.impact !== undefined) {
+        const impactStr = Number.isInteger(req.impact)
+            ? req.impact.toFixed(1)
+            : String(req.impact);
+        lines.push(`  impact ${impactStr}`);
+    }
+    // Tags
+    for (const [key, value] of Object.entries(req.tags)) {
+        lines.push(`  ${formatTag(key, value)}`);
+    }
+    // Code body or stub placeholder
+    if (req.code) {
+        lines.push('');
+        lines.push(req.code);
+    }
+    else {
+        lines.push('');
+        lines.push('  # TODO: Add InSpec test code here');
+    }
+    lines.push('end');
+    lines.push(''); // trailing newline
+    return lines.join('\n');
+}
+/** Format a single tag key-value pair as Ruby DSL. */
+function formatTag(key, value) {
+    if (value === null || value === undefined) {
+        return `tag ${key}: nil`;
+    }
+    if (Array.isArray(value)) {
+        // Ruby array syntax: tag key: ['val1', 'val2']
+        const items = value.map((v) => `'${String(v)}'`).join(', ');
+        return `tag ${key}: [${items}]`;
+    }
+    if (typeof value === 'boolean') {
+        return `tag ${key}: ${value}`;
+    }
+    if (typeof value === 'string') {
+        return `tag ${key}: ${escapeQuotes(value)}`;
+    }
+    // Fallback for other types (numbers, objects)
+    return `tag ${key}: ${JSON.stringify(value)}`;
+}
+//# sourceMappingURL=control-stub.js.map

package/dist/control-stub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-stub.js","sourceRoot":"","sources":["../src/control-stub.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAwB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAErC,QAAQ;IACR,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,WAAW,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,6DAA6D;IAC7D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,SAAS,CAAC,yBAAyB;YACrC,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3B,SAAS,CAAC,qCAAqC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,iFAAiF;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;IACP,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC;IAChC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;IAEnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,+CAA+C;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO,OAAO,GAAG,MAAM,KAAK,GAAG,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,OAAO,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED,8CAA8C;IAC9C,OAAO,OAAO,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { GeneratorOptions, ProfileMetadata, InSpecProfile } from './types.js';
+export { escapeQuotes } from './ruby-escape.js';
+export { generateControlStub } from './control-stub.js';
+export { generateInSpecYml } from './inspec-yml.js';
+export { generateInSpecProfile } from './profile-generator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { escapeQuotes } from './ruby-escape.js';
+export { generateControlStub } from './control-stub.js';
+export { generateInSpecYml } from './inspec-yml.js';
+export { generateInSpecProfile } from './profile-generator.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/inspec-yml.d.ts

@@ -0,0 +1,10 @@
+import type { HdfBaseline } from '@mitre/hdf-schema';
+import type { GeneratorOptions } from './types.js';
+/**
+ * Generate an inspec.yml YAML string from an HDF Baseline and options.
+ *
+ * Uses string interpolation — no YAML library needed since the structure
+ * is fixed and shallow.
+ */
+export declare function generateInSpecYml(baseline: HdfBaseline, options?: GeneratorOptions): string;
+//# sourceMappingURL=inspec-yml.d.ts.map

package/dist/inspec-yml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspec-yml.d.ts","sourceRoot":"","sources":["../src/inspec-yml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,CAoGR"}

package/dist/inspec-yml.js

@@ -0,0 +1,113 @@
+/**
+ * Generate an inspec.yml YAML string from an HDF Baseline and options.
+ *
+ * Uses string interpolation — no YAML library needed since the structure
+ * is fixed and shallow.
+ */
+export function generateInSpecYml(baseline, options) {
+    const lines = [];
+    const meta = options?.metadata;
+    // Required: name
+    lines.push(`name: ${baseline.name}`);
+    // Optional metadata fields
+    if (baseline.title) {
+        lines.push(`title: ${baseline.title}`);
+    }
+    const maintainer = meta?.maintainer ?? baseline.maintainer;
+    if (maintainer) {
+        lines.push(`maintainer: ${maintainer}`);
+    }
+    const copyright = meta?.copyright ?? baseline.copyright;
+    if (copyright) {
+        lines.push(`copyright: ${copyright}`);
+    }
+    const license = meta?.license ?? baseline.license;
+    if (license) {
+        lines.push(`license: ${license}`);
+    }
+    if (baseline.summary) {
+        lines.push(`summary: ${baseline.summary}`);
+    }
+    // Version: metadata override takes priority
+    const version = meta?.version ?? baseline.version;
+    if (version) {
+        lines.push(`version: '${version}'`);
+    }
+    // InSpec version constraint
+    const inspecVersion = options?.inspecVersion ?? '~>6.0';
+    lines.push(`inspec_version: '${inspecVersion}'`);
+    // Supports array
+    if (baseline.supports && baseline.supports.length > 0) {
+        lines.push('supports:');
+        for (const support of baseline.supports) {
+            const entries = [];
+            if (support.platformName) {
+                entries.push(`  platform-name: ${support.platformName}`);
+            }
+            if (support.platformFamily) {
+                entries.push(`  platform-family: ${support.platformFamily}`);
+            }
+            if (support.platform) {
+                entries.push(`  platform: ${support.platform}`);
+            }
+            if (support.release) {
+                entries.push(`  release: ${support.release}`);
+            }
+            if (entries.length > 0) {
+                lines.push(`- ${entries[0].trimStart()}`);
+                for (let i = 1; i < entries.length; i++) {
+                    lines.push(entries[i]);
+                }
+            }
+        }
+    }
+    // Depends array
+    if (baseline.depends && baseline.depends.length > 0) {
+        lines.push('depends:');
+        for (const dep of baseline.depends) {
+            const entries = [];
+            if (dep.name)
+                entries.push(`name: ${dep.name}`);
+            if (dep.git)
+                entries.push(`git: ${dep.git}`);
+            if (dep.url)
+                entries.push(`url: ${dep.url}`);
+            if (dep.path)
+                entries.push(`path: ${dep.path}`);
+            if (dep.branch)
+                entries.push(`branch: ${dep.branch}`);
+            if (dep.compliance)
+                entries.push(`compliance: ${dep.compliance}`);
+            if (dep.supermarket)
+                entries.push(`supermarket: ${dep.supermarket}`);
+            if (entries.length > 0) {
+                lines.push(`- ${entries[0]}`);
+                for (let i = 1; i < entries.length; i++) {
+                    lines.push(`  ${entries[i]}`);
+                }
+            }
+        }
+    }
+    // Inputs array
+    if (baseline.inputs && baseline.inputs.length > 0) {
+        lines.push('inputs:');
+        for (const input of baseline.inputs) {
+            for (const [key, value] of Object.entries(input)) {
+                lines.push(`- ${key}: ${formatYamlValue(value)}`);
+            }
+        }
+    }
+    lines.push(''); // trailing newline
+    return lines.join('\n');
+}
+/** Format a value for inline YAML output. */
+function formatYamlValue(value) {
+    if (typeof value === 'boolean')
+        return String(value);
+    if (typeof value === 'number')
+        return String(value);
+    if (typeof value === 'string')
+        return value;
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=inspec-yml.js.map

package/dist/inspec-yml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspec-yml.js","sourceRoot":"","sources":["../src/inspec-yml.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAqB,EACrB,OAA0B;IAE1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,CAAC;IAE/B,iBAAiB;IACjB,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAErC,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;IAC3D,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,oBAAoB,aAAa,GAAG,CAAC,CAAC;IAEjD,iBAAiB;IACjB,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,GAAG,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,6CAA6C;AAC7C,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/profile-generator.d.ts

@@ -0,0 +1,11 @@
+import type { HdfBaseline } from '@mitre/hdf-schema';
+import type { GeneratorOptions, InSpecProfile } from './types.js';
+/**
+ * Generate an in-memory InSpec profile from an HDF Baseline.
+ *
+ * Returns an InSpecProfile with inspec.yml content and a Map of
+ * control filenames to Ruby source code. No file I/O — the CLI
+ * is responsible for writing files to disk.
+ */
+export declare function generateInSpecProfile(baseline: HdfBaseline, options?: GeneratorOptions): InSpecProfile;
+//# sourceMappingURL=profile-generator.d.ts.map

package/dist/profile-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-generator.d.ts","sourceRoot":"","sources":["../src/profile-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,aAAa,CAsBf"}

package/dist/profile-generator.js

@@ -0,0 +1,31 @@
+import { generateControlStub } from './control-stub.js';
+import { generateInSpecYml } from './inspec-yml.js';
+/**
+ * Generate an in-memory InSpec profile from an HDF Baseline.
+ *
+ * Returns an InSpecProfile with inspec.yml content and a Map of
+ * control filenames to Ruby source code. No file I/O — the CLI
+ * is responsible for writing files to disk.
+ */
+export function generateInSpecProfile(baseline, options) {
+    const inspecYml = generateInSpecYml(baseline, options);
+    const controls = new Map();
+    if (baseline.requirements.length === 0) {
+        return { inspecYml, controls };
+    }
+    if (options?.singleFile) {
+        // All controls in a single file
+        const stubs = baseline.requirements.map((req) => generateControlStub(req));
+        controls.set('controls/controls.rb', stubs.join('\n'));
+    }
+    else {
+        // One file per control — sanitize ID for safe filenames
+        for (const req of baseline.requirements) {
+            const safeId = req.id.replace(/\.\./g, '').replace(/[/\\]/g, '') || 'unknown';
+            const filename = `controls/${safeId}.rb`;
+            controls.set(filename, generateControlStub(req));
+        }
+    }
+    return { inspecYml, controls };
+}
+//# sourceMappingURL=profile-generator.js.map

package/dist/profile-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-generator.js","sourceRoot":"","sources":["../src/profile-generator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqB,EACrB,OAA0B;IAE1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,gCAAgC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,wDAAwD;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;YAC9E,MAAM,QAAQ,GAAG,YAAY,MAAM,KAAK,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC"}

package/dist/ruby-escape.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Escape a string for use as a Ruby string literal.
+ *
+ * Strategy:
+ * - If the string contains both single and double quotes → %q() wrapper
+ * - If the string contains only single quotes → double-quoted with escaping
+ * - Otherwise → single-quoted with escaping
+ *
+ * Ported from ts-inspec-objects escapeQuotes(), cross-referenced with
+ * inspec-parser's RubyRebuilder.
+ */
+export declare function escapeQuotes(s: string): string;
+//# sourceMappingURL=ruby-escape.d.ts.map

package/dist/ruby-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby-escape.d.ts","sourceRoot":"","sources":["../src/ruby-escape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB9C"}

package/dist/ruby-escape.js

@@ -0,0 +1,26 @@
+/**
+ * Escape a string for use as a Ruby string literal.
+ *
+ * Strategy:
+ * - If the string contains both single and double quotes → %q() wrapper
+ * - If the string contains only single quotes → double-quoted with escaping
+ * - Otherwise → single-quoted with escaping
+ *
+ * Ported from ts-inspec-objects escapeQuotes(), cross-referenced with
+ * inspec-parser's RubyRebuilder.
+ */
+export function escapeQuotes(s) {
+    const hasSingle = s.includes("'");
+    const hasDouble = s.includes('"');
+    if (hasSingle && hasDouble) {
+        // %q() — escape backslashes before ) so Ruby doesn't treat \) as escaped delimiter
+        return `%q(${s.replace(/\\\)/g, '\\\\)')})`;
+    }
+    if (hasSingle) {
+        // Double-quoted: escape backslashes, then double quotes
+        return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+    }
+    // Single-quoted: escape backslashes, then single quotes
+    return `'${s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+//# sourceMappingURL=ruby-escape.js.map

package/dist/ruby-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby-escape.js","sourceRoot":"","sources":["../src/ruby-escape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,mFAAmF;QACnF,OAAO,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;IAC9C,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,wDAAwD;QACxD,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAC9D,CAAC;IAED,wDAAwD;IACxD,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Options for controlling InSpec profile generation.
+ */
+export interface GeneratorOptions {
+    /** Put all controls in a single controls.rb file instead of one file per control. */
+    singleFile?: boolean;
+    /** Override baseline metadata in the generated inspec.yml. */
+    metadata?: ProfileMetadata;
+    /** InSpec version constraint for inspec.yml. Default: '~>6.0'. */
+    inspecVersion?: string;
+}
+/**
+ * Metadata overrides for the generated inspec.yml.
+ */
+export interface ProfileMetadata {
+    maintainer?: string;
+    copyright?: string;
+    license?: string;
+    version?: string;
+}
+/**
+ * An in-memory InSpec profile. No file I/O — the CLI is responsible for writing.
+ */
+export interface InSpecProfile {
+    /** The inspec.yml content as a YAML string. */
+    inspecYml: string;
+    /** Map of filename (e.g. 'controls/SV-238196.rb') to Ruby source code. */
+    controls: Map<string, string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@mitre/hdf-generators",
+  "version": "2.0.0",
+  "description": "Generate InSpec profile stubs from HDF Baseline definitions",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mitre/hdf-libs.git",
+    "directory": "hdf-generators"
+  },
+  "author": "MITRE Corporation",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@mitre/hdf-schema": "2.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "keywords": [
+    "hdf",
+    "heimdall",
+    "inspec",
+    "generator",
+    "profile",
+    "stig"
+  ],
+  "scripts": {
+    "build": "pnpm clean && tsc",
+    "clean": "rimraf dist",
+    "test": "pnpm run test:ts",
+    "test:ts": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint src test",
+    "lint:fix": "eslint src test --fix"
+  }
+}