@mitre/hdf-schema 3.3.2 → 3.4.1

package/dist/ts/hdf.js

@@ -1,6 +1,4 @@
 /**
- * The comparison operator used when evaluating this input against observed values.
- *
  * Comparison operator for evaluating the input value against observed values. Numeric:
  * eq/ne/lt/le/gt/ge. String: eq/ne/contains/matches. Collection: in/notIn.
  */
@@ -18,8 +16,6 @@ export var ComparisonOperator;
     ComparisonOperator["NotIn"] = "notIn";
 })(ComparisonOperator || (ComparisonOperator = {}));
 /**
- * The data type of this input.
- *
  * The data type of the input value. Aligns with InSpec input types.
  */
 export var InputType;
@@ -32,12 +28,12 @@ export var InputType;
     InputType["String"] = "String";
 })(InputType || (InputType = {}));
 /**
- * The hash algorithm used for the checksum.
- *
- * Supported cryptographic hash algorithms for checksums and integrity verification.
+ * Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers
+ * container-image and other artifact digests that use it.
  */
 export var HashAlgorithm;
 (function (HashAlgorithm) {
+    HashAlgorithm["Blake3"] = "blake3";
     HashAlgorithm["Sha256"] = "sha256";
     HashAlgorithm["Sha384"] = "sha384";
     HashAlgorithm["Sha512"] = "sha512";
@@ -90,15 +86,9 @@ export var ControlType;
     ControlType["Technical"] = "technical";
 })(ControlType || (ControlType = {}));
 /**
- * Qualitative severity band corresponding to baseScore. CVSS 2.0 does not natively use
- * 'none' or 'critical' bands; map accordingly when populating.
- *
  * Qualitative CVSS severity band. Aligns with FIRST/NVD bands: none=0.0, low=0.1-3.9,
- * medium=4.0-6.9, high=7.0-8.9, critical=9.0-10.0. Distinct from the broader Severity enum
- * used on Requirement_Core (which includes 'informational').
- *
- * Qualitative severity band corresponding to computedScore. Same band convention as
- * baseSeverity.
+ * medium=4.0-6.9, high=7.0-8.9, critical=9.0-10.0. Distinct from the broader Severity enum used on
+ * Requirement_Core (which includes 'informational').
  */
 export var CVSSSeverity;
 (function (CVSSSeverity) {
@@ -120,29 +110,19 @@ export var Version;
     Version["The40"] = "4.0";
 })(Version || (Version = {}));
 /**
- * The type of the most recent non-expired override or POAM governing this requirement.
- * Indicates why the requirement is in its current state (e.g., waiver, falsePositive,
- * riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or
- * POAMs apply.
- *
- * The type of amendment, aligned with FedRAMP deviation request categories. 'waiver': risk
- * accepted by Authorizing Official. 'attestation': manually verified by assessor. 'poam':
- * remediation tracked (no status change). 'inherited': control provided by another
- * component or system. 'falsePositive': scanner incorrectly identified a finding — for
- * compliance scans (STIG, CIS), the check actually passes, so status is typically set to
- * 'passed'; for vulnerability scans (CVE, SCA), the flagged vulnerability does not apply to
- * this system, so status is typically set to 'notApplicable'. The disposition field on the
- * requirement distinguishes false positives from genuinely not-applicable findings.
- * 'riskAdjustment': impact score adjusted based on environmental context (FedRAMP Risk
- * Adjustment); does not change pass/fail status, only impact via the impact field.
- * 'operationalRequirement': deviation required by operational constraints (FedRAMP
- * Operational Requirement); the finding cannot be remediated because the system requires
- * the affected functionality. Remains an open risk. Migration note: 'exception' was removed
- * in v3.1.0 — use 'waiver' with status 'notApplicable' instead.
- *
- * The type of override applied to this requirement.
- *
- * The type of amendment.
+ * The type of amendment, aligned with FedRAMP deviation request categories. 'waiver': risk accepted
+ * by Authorizing Official. 'attestation': manually verified by assessor. 'poam': remediation
+ * tracked (no status change). 'inherited': control provided by another component or system.
+ * 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the
+ * check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE,
+ * SCA), the flagged vulnerability does not apply to this system, so status is typically set to
+ * 'notApplicable'. The disposition field on the requirement distinguishes false positives from
+ * genuinely not-applicable findings. 'riskAdjustment': impact score adjusted based on environmental
+ * context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact
+ * field. 'operationalRequirement': deviation required by operational constraints (FedRAMP
+ * Operational Requirement); the finding cannot be remediated because the system requires the
+ * affected functionality. Remains an open risk. Migration note: 'exception' was removed in v3.1.0 —
+ * use 'waiver' with status 'notApplicable' instead.
  */
 export var OverrideType;
 (function (OverrideType) {
@@ -155,20 +135,9 @@ export var OverrideType;
     OverrideType["Waiver"] = "waiver";
 })(OverrideType || (OverrideType = {}));
 /**
- * The current effective compliance status of this requirement after applying the most
- * recent non-expired override with a status field, or computed from results (worst-wins) if
- * no status-bearing overrides exist.
- *
- * The status of an individual test result. 'notApplicable' indicates the requirement does
- * not apply to the target. 'notReviewed' indicates the requirement was not assessed (e.g.,
- * requires manual verification).
- *
- * The status of this test within the requirement. Example: 'failed'.
- *
- * The new status this override sets for the requirement. Optional when only impact is being
- * overridden.
- *
- * The new status this amendment sets. Optional when only impact is being overridden.
+ * The status of an individual test result. 'notApplicable' indicates the requirement does not apply
+ * to the target. 'notReviewed' indicates the requirement was not assessed (e.g., requires manual
+ * verification).
  */
 export var ResultStatus;
 (function (ResultStatus) {
@@ -180,11 +149,16 @@ export var ResultStatus;
 })(ResultStatus || (ResultStatus = {}));
 /**
  * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for automated systems, 'simple' for basic string identifiers without additional
- * classification, or 'other' for custom identity systems.
+ * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
+ * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
+ * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
+ * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
+ * 'simple' for basic string identifiers without additional classification, or 'other' for
+ * custom identity systems.
  */
 export var IdentityType;
 (function (IdentityType) {
+    IdentityType["Agent"] = "agent";
     IdentityType["Email"] = "email";
     IdentityType["Other"] = "other";
     IdentityType["Simple"] = "simple";
@@ -225,9 +199,6 @@ export var POAMType;
     POAMType["VendorDependency"] = "vendorDependency";
 })(POAMType || (POAMType = {}));
 /**
- * Explicit severity rating. Typically derived from impact score but provided explicitly for
- * clarity.
- *
  * Severity rating for a requirement. Typically derived from the numeric impact score.
  */
 export var Severity;
@@ -239,28 +210,21 @@ export var Severity;
     Severity["Medium"] = "medium";
 })(Severity || (Severity = {}));
 /**
- * Structured controlled-vocabulary classification for why this override applies.
- * Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive
- * and attestation overrides where the structured category enables filtering and lossless
- * round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the
- * precedent vocabulary and rationale.
- *
- * Structured controlled-vocabulary reason for an override, complementing the free-text
- * 'reason' field. 'reason' carries the human-readable rationale an auditor reads;
- * 'justification' carries the machine-readable category enabling filtering, aggregation,
- * and lossless round-trip with structured ecosystems (VEX, OSCAL, FedRAMP DR). Both fields
- * may be present simultaneously and are NOT redundant: 'reason' explains the specific
- * circumstance; 'justification' classifies it. Authors SHOULD populate both when a
- * controlled-vocabulary value applies — the enum value alone is not self-explanatory to an
- * auditor. The vocabulary is drawn from the VEX ecosystem: the first five values are common
- * across OpenVEX, CSAF VEX, and CycloneDX VEX; the remaining six (requires_configuration /
- * requires_dependency / requires_environment / protected_by_compiler / protected_at_runtime
- * / protected_at_perimeter) are CycloneDX-specific and describe why the vulnerable code
- * path is unreachable in the deployed configuration. The enum is extended additively across
- * schema versions as other ecosystems' controlled vocabularies are integrated; documents
- * using values added in a newer schema version will fail validation against an older
- * schema. Consumers SHOULD validate against the schema version declared by the document
- * ($schema) rather than assume a fixed vocabulary.
+ * Structured controlled-vocabulary reason for an override, complementing the free-text 'reason'
+ * field. 'reason' carries the human-readable rationale an auditor reads; 'justification' carries
+ * the machine-readable category enabling filtering, aggregation, and lossless round-trip with
+ * structured ecosystems (VEX, OSCAL, FedRAMP DR). Both fields may be present simultaneously and are
+ * NOT redundant: 'reason' explains the specific circumstance; 'justification' classifies it.
+ * Authors SHOULD populate both when a controlled-vocabulary value applies — the enum value alone is
+ * not self-explanatory to an auditor. The vocabulary is drawn from the VEX ecosystem: the first
+ * five values are common across OpenVEX, CSAF VEX, and CycloneDX VEX; the remaining six
+ * (requires_configuration / requires_dependency / requires_environment / protected_by_compiler /
+ * protected_at_runtime / protected_at_perimeter) are CycloneDX-specific and describe why the
+ * vulnerable code path is unreachable in the deployed configuration. The enum is extended
+ * additively across schema versions as other ecosystems' controlled vocabularies are integrated;
+ * documents using values added in a newer schema version will fail validation against an older
+ * schema. Consumers SHOULD validate against the schema version declared by the document ($schema)
+ * rather than assume a fixed vocabulary.
  */
 export var Justification;
 (function (Justification) {
@@ -277,19 +241,12 @@ export var Justification;
     Justification["VulnerableCodeNotPresent"] = "vulnerable_code_not_present";
 })(Justification || (Justification = {}));
 /**
- * How this requirement is intended to be verified. Disambiguates the two cases that null
- * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
- * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
- * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
- * runs without operator action; 'hybrid' = part automated, part manual. Optional: when
- * omitted, consumers should not infer a default.
- *
- * How a requirement is intended to be verified. Disambiguates the two cases that null
- * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
- * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
- * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
- * runs without operator action; 'hybrid' = part automated, part manual. Named '_Enum' to
- * disambiguate from the unrelated Verification_Method DID-context struct.
+ * How a requirement is intended to be verified. Disambiguates the two cases that null 'code'
+ * overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation,
+ * e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet,
+ * e.g. a STIG rule lacking a fix). 'automated' = a check exists and runs without operator action;
+ * 'hybrid' = part automated, part manual. Named '_Enum' to disambiguate from the unrelated
+ * Verification_Method DID-context struct.
  */
 export var VerificationMethodEnum;
 (function (VerificationMethodEnum) {
@@ -298,6 +255,29 @@ export var VerificationMethodEnum;
     VerificationMethodEnum["ManualByDesign"] = "manual-by-design";
     VerificationMethodEnum["ManualPendingAutomation"] = "manual-pending-automation";
 })(VerificationMethodEnum || (VerificationMethodEnum = {}));
+/**
+ * Relationship of this dataset to baseDatasetRefs, parallel to the model extension's
+ * adaptationType. Minimal + extensible: filtered (subset by rule), augmented
+ * (added/synthesized records), merged (union of sources), sampled (statistical draw).
+ */
+export var DatasetDerivationType;
+(function (DatasetDerivationType) {
+    DatasetDerivationType["Augmented"] = "augmented";
+    DatasetDerivationType["Filtered"] = "filtered";
+    DatasetDerivationType["Merged"] = "merged";
+    DatasetDerivationType["Sampled"] = "sampled";
+})(DatasetDerivationType || (DatasetDerivationType = {}));
+/**
+ * Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation
+ * vocabulary (the only typed lineage enum in the ecosystem).
+ */
+export var ModelAdaptationType;
+(function (ModelAdaptationType) {
+    ModelAdaptationType["Adapter"] = "adapter";
+    ModelAdaptationType["Finetune"] = "finetune";
+    ModelAdaptationType["Merge"] = "merge";
+    ModelAdaptationType["Quantized"] = "quantized";
+})(ModelAdaptationType || (ModelAdaptationType = {}));
 export var CloudProvider;
 (function (CloudProvider) {
     CloudProvider["Aws"] = "aws";
@@ -307,18 +287,12 @@ export var CloudProvider;
     CloudProvider["Other"] = "other";
 })(CloudProvider || (CloudProvider = {}));
 /**
- * Format of the SBOM (embedded or referenced). Required when sbom or sbomRef is present.
- */
-export var SBOMFormat;
-(function (SBOMFormat) {
-    SBOMFormat["Cyclonedx"] = "cyclonedx";
-    SBOMFormat["Spdx"] = "spdx";
-})(SBOMFormat || (SBOMFormat = {}));
-/**
- * Component type discriminator. Same values as Target types.
+ * Component type discriminator. Same values as Target types, plus aiModel and dataset (thin
+ * AI subject components whose detail lives in an attached ai-model / dataset BOM).
  */
 export var TargetType;
 (function (TargetType) {
+    TargetType["AIModel"] = "aiModel";
     TargetType["Application"] = "application";
     TargetType["Artifact"] = "artifact";
     TargetType["CloudAccount"] = "cloudAccount";
@@ -327,13 +301,12 @@ export var TargetType;
     TargetType["ContainerInstance"] = "containerInstance";
     TargetType["ContainerPlatform"] = "containerPlatform";
     TargetType["Database"] = "database";
+    TargetType["Dataset"] = "dataset";
     TargetType["Host"] = "host";
     TargetType["Network"] = "network";
     TargetType["Repository"] = "repository";
 })(TargetType || (TargetType = {}));
 /**
- * The category of this annotation.
- *
  * The category of an annotation attached to a comparison.
  */
 export var AnnotationCategory;
@@ -357,13 +330,11 @@ export var BaselineDiffState;
     BaselineDiffState["Updated"] = "updated";
 })(BaselineDiffState || (BaselineDiffState = {}));
 /**
- * The mode of comparison being performed.
- *
- * The mode of comparison. 'temporal' compares the same target over time. 'baseline'
- * compares against a golden reference. 'fleet' compares across multiple systems.
- * 'multiSource' compares outputs from different scanners. 'baselineEvolution' compares two
- * baseline documents to detect requirement changes between versions. 'systemDrift' compares
- * two system documents to detect component-level changes.
+ * The mode of comparison. 'temporal' compares the same target over time. 'baseline' compares
+ * against a golden reference. 'fleet' compares across multiple systems. 'multiSource' compares
+ * outputs from different scanners. 'baselineEvolution' compares two baseline documents to detect
+ * requirement changes between versions. 'systemDrift' compares two system documents to detect
+ * component-level changes.
  */
 export var ComparisonMode;
 (function (ComparisonMode) {
@@ -402,8 +373,6 @@ export var ChangeReason;
     ChangeReason["TargetChanged"] = "targetChanged";
 })(ChangeReason || (ChangeReason = {}));
 /**
- * How the conflict was resolved.
- *
  * How a conflict between multiple scanner results was resolved.
  */
 export var ConflictResolution;
@@ -414,13 +383,9 @@ export var ConflictResolution;
     ConflictResolution["Unresolved"] = "unresolved";
 })(ConflictResolution || (ConflictResolution = {}));
 /**
- * The strategy that was used to match this requirement across sources.
- *
- * The strategy used to match requirements across sources. 'exactId' matches by identical
- * IDs. 'mappedId' uses an ID mapping table. 'cciMatch'/'nistMatch' match by framework
- * identifiers. 'fuzzyTitle'/'fuzzyContent' use text similarity.
- *
- * The primary strategy used to match requirements across sources.
+ * The strategy used to match requirements across sources. 'exactId' matches by identical IDs.
+ * 'mappedId' uses an ID mapping table. 'cciMatch'/'nistMatch' match by framework identifiers.
+ * 'fuzzyTitle'/'fuzzyContent' use text similarity.
  */
 export var MatchStrategy;
 (function (MatchStrategy) {
@@ -432,12 +397,10 @@ export var MatchStrategy;
     MatchStrategy["NISTMatch"] = "nistMatch";
 })(MatchStrategy || (MatchStrategy = {}));
 /**
- * The state of this requirement in the comparison.
- *
- * SARIF-compatible vocabulary extended for security. 'new' = present only in new source,
- * 'absent' = present only in old, 'unchanged' = same effective status, 'updated' = status
- * changed (generic), 'fixed' = was failing now passing, 'regressed' = was passing now
- * failing, 'moved' = reorganized same content, 'split'/'merged' = reserved for v1.1.
+ * SARIF-compatible vocabulary extended for security. 'new' = present only in new source, 'absent' =
+ * present only in old, 'unchanged' = same effective status, 'updated' = status changed (generic),
+ * 'fixed' = was failing now passing, 'regressed' = was passing now failing, 'moved' = reorganized
+ * same content, 'split'/'merged' = reserved for v1.1.
  */
 export var RequirementState;
 (function (RequirementState) {
@@ -478,8 +441,6 @@ export var OriginalFormat;
     OriginalFormat["Xccdf"] = "xccdf";
 })(OriginalFormat || (OriginalFormat = {}));
 /**
- * The role of this source in the comparison.
- *
  * The role of a source document in the comparison.
  */
 export var SourceRole;
@@ -491,8 +452,6 @@ export var SourceRole;
     SourceRole["System"] = "system";
 })(SourceRole || (SourceRole = {}));
 /**
- * Current Authorization to Operate (ATO) status.
- *
  * Authorization to Operate (ATO) status for the system.
  */
 export var AuthorizationStatus;
@@ -505,8 +464,6 @@ export var AuthorizationStatus;
     AuthorizationStatus["Revoked"] = "revoked";
 })(AuthorizationStatus || (AuthorizationStatus = {}));
 /**
- * FIPS 199 security categorization (impact level).
- *
  * FIPS 199 security categorization level (impact level).
  */
 export var CategorizationLevel;
@@ -536,10 +493,8 @@ export var Direction;
     Direction["Unidirectional"] = "unidirectional";
 })(Direction || (Direction = {}));
 /**
- * The type of assessment plan.
- *
- * The type of assessment. 'automated' for scanner-driven, 'manual' for human-performed,
- * 'hybrid' for both.
+ * The type of assessment. 'automated' for scanner-driven, 'manual' for human-performed, 'hybrid'
+ * for both.
  */
 export var PlanType;
 (function (PlanType) {
@@ -548,17 +503,18 @@ export var PlanType;
     PlanType["Manual"] = "manual";
 })(PlanType || (PlanType = {}));
 /**
- * The type of HDF document being referenced.
- *
- * The type of document referenced in the evidence package.
+ * The type of document referenced in the evidence package. 'bom' covers any
+ * Bill-of-Materials/manifest document (SBOM, AI model/dataset, and reserved future kinds) — its
+ * specific kind is carried by the referenced document's bomType, not by a per-kind Content_Type
+ * value.
  */
 export var ContentType;
 (function (ContentType) {
+    ContentType["BOM"] = "bom";
     ContentType["HdfAmendments"] = "hdf-amendments";
     ContentType["HdfBaseline"] = "hdf-baseline";
     ContentType["HdfComparison"] = "hdf-comparison";
     ContentType["HdfPlan"] = "hdf-plan";
     ContentType["HdfResults"] = "hdf-results";
     ContentType["HdfSystem"] = "hdf-system";
-    ContentType["Sbom"] = "sbom";
 })(ContentType || (ContentType = {}));