@mitre/hdf-schema 3.5.0 → 3.6.0-rc.1

package/dist/ts/hdf.d.ts

@@ -265,11 +265,13 @@ export interface ExternalReference {
     description?: string;
     /**
      * Optional lossless embedded copy of the referenced artifact — the raw STIX object, EPSS
-     * record, advisory, or annotation payload — preserved verbatim. Composes with
-     * `href`/`externalId` (which point at the artifact) and `checksum` (which ties the copy to
-     * the source): a single entry can both point and embed. HDF stays payload-agnostic — the
-     * content is carried untouched, never normalized into HDF fields — so this does not
-     * duplicate the source ontology (e.g. STIX rides here unchanged).
+     * record, advisory, or annotation payload — preserved verbatim.
+     *
+     * Composes with `href`/`externalId` (which point at the artifact) and `checksum` (which
+     * ties the copy to the source): a single entry can both point and embed.
+     *
+     * HDF stays payload-agnostic — the content is carried untouched, never normalized into HDF
+     * fields — so this does not duplicate the source ontology (e.g. STIX rides here unchanged).
      */
     document?: {
         [key: string]: any;
@@ -288,10 +290,15 @@ export interface ExternalReference {
     href?: string;
     /**
      * Open token classifying the referenced/embedded payload, turning a bare reference into an
-     * enrichment envelope. Deliberately open (like `sourceName`/`rel`), not a closed enum.
+     * enrichment envelope.
+     *
+     * Deliberately open (like `sourceName`/`rel`), not a closed enum.
+     *
      * Documented starter vocabulary: 'threat-intel' (STIX/CTI object), 'annotation' (human
      * triage note), 'exploitation' (EPSS/KEV signal carried as context), 'advisory'
-     * (vendor/security advisory). Use the `x-` prefix for custom kinds.
+     * (vendor/security advisory).
+     *
+     * Use the `x-` prefix for custom kinds.
      */
     kind?: string;
     /**
@@ -330,25 +337,27 @@ export interface Identity {
      */
     identifier: string;
     /**
-     * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
-     * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
-     * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
-     * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
-     * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
-     * 'simple' for basic string identifiers without additional classification, or 'other' for
-     * custom identity systems.
+     * The type of identifier.
+     *
+     * Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic
+     * non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting
+     * with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny
+     * (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure
+     * under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string
+     * identifiers without additional classification, or 'other' for custom identity systems.
      */
     type: IdentityType;
     [property: string]: any;
 }
 /**
- * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
- * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
- * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
- * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
- * 'simple' for basic string identifiers without additional classification, or 'other' for
- * custom identity systems.
+ * The type of identifier.
+ *
+ * Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic
+ * non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting
+ * with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny
+ * (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure
+ * under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string
+ * identifiers without additional classification, or 'other' for custom identity systems.
  */
 export declare enum IdentityType {
     Agent = "agent",
@@ -553,12 +562,17 @@ export interface EvaluatedRequirement {
     disposition?: OverrideType;
     /**
      * Checksum of this requirement's resolved effective posture, for per-control change
-     * detection in continuous monitoring. sha256 over the canonical JSON object with keys
-     * status, impact, disposition (in that order), holding the resolved effective status,
-     * resolved effective impact, and governing override type (null when nothing governs), with
-     * override expiry anchored to the document timestamp. Flips exactly when the operative
-     * status, impact, or disposition changes; stable under all other churn (result details,
-     * timestamps, tags). Optional; stamped by tooling (hdf convert, hdf amend apply).
+     * detection in continuous monitoring.
+     *
+     * sha256 over the canonical JSON object with keys status, impact, disposition (in that
+     * order), holding the resolved effective status, resolved effective impact, and governing
+     * override type (null when nothing governs), with override expiry anchored to the document
+     * timestamp.
+     *
+     * Flips exactly when the operative status, impact, or disposition changes; stable under all
+     * other churn (result details, timestamps, tags).
+     *
+     * Optional; stamped by tooling (hdf convert, hdf amend apply).
      */
     effectiveChecksum?: Checksum;
     /**
@@ -630,10 +644,14 @@ export interface EvaluatedRequirement {
         [key: string]: any;
     };
     /**
-     * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
-     * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
-     * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
-     * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+     * Whether the requirement is mandatory within its baseline.
+     *
+     * Distinct from severity (risk weight) and status (lifecycle state).
+     *
+     * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+     * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+     * carry richer semantics; layer those onto props[]/tags{}).
+     *
      * Optional: when omitted, consumers should treat the requirement as 'required' by
      * convention.
      */
@@ -647,11 +665,15 @@ export interface EvaluatedRequirement {
     code?: string;
     /**
      * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
-     * categories. 'policy' = an authored governance statement; 'procedure' = a documented
-     * process; 'technical' = an enforced technical configuration; 'management' = a
+     * categories.
+     *
+     * 'policy' = an authored governance statement; 'procedure' = a documented process;
+     * 'technical' = an enforced technical configuration; 'management' = a
      * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
-     * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
-     * family/id but should not assume a default.
+     * AT, IR, MA families).
+     *
+     * Optional: when omitted, consumers may infer heuristically from family/id but should not
+     * assume a default.
      */
     controlType?: ControlType;
     /**
@@ -670,12 +692,17 @@ export interface EvaluatedRequirement {
      */
     title?: string;
     /**
-     * How this requirement is intended to be verified. Disambiguates the two cases that null
-     * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
-     * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
-     * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
-     * runs without operator action; 'hybrid' = part automated, part manual. Optional: when
-     * omitted, consumers should not infer a default.
+     * How this requirement is intended to be verified.
+     *
+     * Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the
+     * requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs);
+     * 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule
+     * lacking a fix).
+     *
+     * 'automated' = a check exists and runs without operator action; 'hybrid' = part automated,
+     * part manual.
+     *
+     * Optional: when omitted, consumers should not infer a default.
      */
     verificationMethod?: VerificationMethodEnum;
     [property: string]: any;
@@ -695,7 +722,7 @@ export interface AffectedPackage {
      * Optional CPE 2.3 URI identifying the affected product. Validated leniently: only the
      * 'cpe:2.3:' prefix and the part-type letter ('a' application, 'h' hardware, 'o' operating
      * system) are enforced here. Use `hdf-utilities.parseCpe` for full-grammar parsing.
-     * Example: 'cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*'.
+     * Example: `cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*`.
      */
     cpe?: string;
     /**
@@ -715,11 +742,16 @@ export interface AffectedPackage {
      */
     name?: string;
     /**
-     * Optional Package URL (PURL) identifying the affected package. Validated leniently: only
-     * the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE follows the PURL grammar (a
-     * letter followed by letters, digits, '.', '+', or '-') and is matched case-insensitively
-     * to mirror `hdf-utilities.parsePurl`'s accept-and-warn behavior. Use `parsePurl` for full
-     * PURL parsing. Example: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'.
+     * Optional Package URL (PURL) identifying the affected package.
+     *
+     * Validated leniently: only the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE
+     * follows the PURL grammar (a letter followed by letters, digits, '.', '+', or '-') and is
+     * matched case-insensitively to mirror `hdf-utilities.parsePurl`'s accept-and-warn
+     * behavior.
+     *
+     * Use `parsePurl` for full PURL parsing.
+     *
+     * Example: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'.
      */
     purl?: string;
     /**
@@ -747,10 +779,14 @@ export declare enum Ecosystem {
     RPM = "rpm"
 }
 /**
- * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
- * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
- * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
- * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+ * Whether the requirement is mandatory within its baseline.
+ *
+ * Distinct from severity (risk weight) and status (lifecycle state).
+ *
+ * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+ * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+ * carry richer semantics; layer those onto props[]/tags{}).
+ *
  * Optional: when omitted, consumers should treat the requirement as 'required' by
  * convention.
  */
@@ -761,11 +797,15 @@ export declare enum Applicability {
 }
 /**
  * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
- * categories. 'policy' = an authored governance statement; 'procedure' = a documented
- * process; 'technical' = an enforced technical configuration; 'management' = a
+ * categories.
+ *
+ * 'policy' = an authored governance statement; 'procedure' = a documented process;
+ * 'technical' = an enforced technical configuration; 'management' = a
  * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
- * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
- * family/id but should not assume a default.
+ * AT, IR, MA families).
+ *
+ * Optional: when omitted, consumers may infer heuristically from family/id but should not
+ * assume a default.
  */
 export declare enum ControlType {
     Management = "management",
@@ -795,11 +835,15 @@ export interface Cvss {
     baseSeverity?: CVSSSeverity;
     /**
      * Optional Base metric group vector string as emitted by the source (e.g.,
-     * 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'). For CVSS 2.0 the version prefix is
-     * omitted. Some vendor tools emit a final baseScore without the vector — in that case this
-     * field is absent and the score cannot be recomputed or decomposed. The pattern accepts any
-     * version-prefixed or prefix-less metric token sequence; semantic validity of individual
-     * metrics is checked by hdf-utilities, not by the schema.
+     * 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H').
+     *
+     * For CVSS 2.0 the version prefix is omitted.
+     *
+     * Some vendor tools emit a final baseScore without the vector — in that case this field is
+     * absent and the score cannot be recomputed or decomposed.
+     *
+     * The pattern accepts any version-prefixed or prefix-less metric token sequence; semantic
+     * validity of individual metrics is checked by hdf-utilities, not by the schema.
      */
     baseVector?: string;
     /**
@@ -886,19 +930,19 @@ export interface Description {
     [property: string]: any;
 }
 /**
- * The type of amendment, aligned with FedRAMP deviation request categories. 'waiver': risk accepted
- * by Authorizing Official. 'attestation': manually verified by assessor. 'poam': remediation
- * tracked (no status change). 'inherited': control provided by another component or system.
- * 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the
- * check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE,
- * SCA), the flagged vulnerability does not apply to this system, so status is typically set to
- * 'notApplicable'. The disposition field on the requirement distinguishes false positives from
- * genuinely not-applicable findings. 'riskAdjustment': impact score adjusted based on environmental
- * context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact
- * field. 'operationalRequirement': deviation required by operational constraints (FedRAMP
- * Operational Requirement); the finding cannot be remediated because the system requires the
- * affected functionality. Remains an open risk. Migration note: 'exception' was removed in v3.1.0 —
- * use 'waiver' with status 'notApplicable' instead.
+ * The type of amendment, aligned with FedRAMP deviation request categories. - 'waiver': risk
+ * accepted by Authorizing Official. - 'attestation': manually verified by assessor. - 'poam':
+ * remediation tracked (no status change). - 'inherited': control provided by another component or
+ * system. - 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG,
+ * CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans
+ * (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set
+ * to 'notApplicable'. The disposition field on the requirement distinguishes false positives from
+ * genuinely not-applicable findings. - 'riskAdjustment': impact score adjusted based on
+ * environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact
+ * via the impact field. - 'operationalRequirement': deviation required by operational constraints
+ * (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires
+ * the affected functionality. Remains an open risk. Migration note: 'exception' was removed in
+ * v3.1.0 — use 'waiver' with status 'notApplicable' instead.
  */
 export declare enum OverrideType {
     Attestation = "attestation",
@@ -1470,11 +1514,16 @@ export interface Component {
     inputOverrides?: InputOverride[];
     /**
      * Cryptographic integrity of this component's underlying artifact — model weights or
-     * shards, dataset archive, container image, or package bytes. An array supports
-     * multi-file/sharded artifacts. This is the single, generic home for artifact/subject
-     * integrity across all component types (it replaced the former per-type Container_Image
-     * digest and Artifact checksum fields). Distinct from BOM-document integrity (Bom.hashes[])
-     * and from the document tamper-evidence Integrity type.
+     * shards, dataset archive, container image, or package bytes.
+     *
+     * An array supports multi-file/sharded artifacts.
+     *
+     * This is the single, generic home for artifact/subject integrity across all component
+     * types (it replaced the former per-type Container_Image digest and Artifact checksum
+     * fields).
+     *
+     * Distinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence
+     * Integrity type.
      */
     integrity?: Checksum[];
     /**
@@ -2219,10 +2268,13 @@ export interface Tool {
      * The named format of the source data, when it follows a recognized format specification
      * with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF',
      * 'OSCAL') or one of several named output formats a single tool produces ('FVDL',
-     * 'exec-json', 'FPF'). Never a serialization structure — 'JSON', 'XML', and 'CSV' are
-     * encodings, not formats. Omit for a tool's native output: an absent format means the
-     * tool's own shape, and data arriving as a named format is converted by that format's
-     * converter, which sets this field alongside the producing tool's name.
+     * 'exec-json', 'FPF').
+     *
+     * Never a serialization structure — 'JSON', 'XML', and 'CSV' are encodings, not formats.
+     *
+     * Omit for a tool's native output: an absent format means the tool's own shape, and data
+     * arriving as a named format is converted by that format's converter, which sets this field
+     * alongside the producing tool's name.
      */
     format?: string;
     /**
@@ -2356,10 +2408,14 @@ export interface BaselineRequirement {
         [key: string]: any;
     };
     /**
-     * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
-     * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
-     * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
-     * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+     * Whether the requirement is mandatory within its baseline.
+     *
+     * Distinct from severity (risk weight) and status (lifecycle state).
+     *
+     * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+     * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+     * carry richer semantics; layer those onto props[]/tags{}).
+     *
      * Optional: when omitted, consumers should treat the requirement as 'required' by
      * convention.
      */
@@ -2373,11 +2429,15 @@ export interface BaselineRequirement {
     code?: string;
     /**
      * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
-     * categories. 'policy' = an authored governance statement; 'procedure' = a documented
-     * process; 'technical' = an enforced technical configuration; 'management' = a
+     * categories.
+     *
+     * 'policy' = an authored governance statement; 'procedure' = a documented process;
+     * 'technical' = an enforced technical configuration; 'management' = a
      * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
-     * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
-     * family/id but should not assume a default.
+     * AT, IR, MA families).
+     *
+     * Optional: when omitted, consumers may infer heuristically from family/id but should not
+     * assume a default.
      */
     controlType?: ControlType;
     /**
@@ -2400,12 +2460,17 @@ export interface BaselineRequirement {
      */
     title?: string;
     /**
-     * How this requirement is intended to be verified. Disambiguates the two cases that null
-     * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
-     * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
-     * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
-     * runs without operator action; 'hybrid' = part automated, part manual. Optional: when
-     * omitted, consumers should not infer a default.
+     * How this requirement is intended to be verified.
+     *
+     * Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the
+     * requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs);
+     * 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule
+     * lacking a fix).
+     *
+     * 'automated' = a check exists and runs without operator action; 'hybrid' = part automated,
+     * part manual.
+     *
+     * Optional: when omitted, consumers should not infer a default.
      */
     verificationMethod?: VerificationMethodEnum;
     [property: string]: any;
@@ -3593,24 +3658,29 @@ export interface HDFAmendments {
  * branches gated on 'type': when type is 'operationalRequirement', neither 'status' nor 'impact'
  * may be set — the override records accepted risk without changing the finding
  * (documentation-only). For all other types, at least one of 'status' or 'impact' must be set. This
- * rule aligns with: (1) OSCAL Assessment Results — finding.target.status and
+ * rule aligns with: - OSCAL Assessment Results — finding.target.status and
  * finding.associated-risk[].facet[] are separate axes
- * (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/); (2) FedRAMP
+ * (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/) - FedRAMP
  * deviation request types — Risk Adjustment changes impact only, Operational Requirement documents
  * acceptance only, False Positive changes status
- * (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/); (3) NIST SP
- * 800-37 RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment
- * status (https://csrc.nist.gov/pubs/sp/800/37/r2/final).
+ * (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/) - NIST SP 800-37
+ * RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment status
+ * (https://csrc.nist.gov/pubs/sp/800/37/r2/final).
  */
 export interface StandaloneOverride {
     /**
      * Software packages this amendment is scoped to, distinct from componentRef (which scopes
-     * to an HDF-internal Component by UUID). Use when the source amendment format references
-     * packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M
-     * `subjects[]`, FedRAMP component-aware amendments. Symmetric with
-     * Evaluated_Requirement.affectedPackages, which scopes findings to the same package
-     * vocabulary. When omitted, the amendment applies system-wide (or only to componentRef when
-     * that is set).
+     * to an HDF-internal Component by UUID).
+     *
+     * Use when the source amendment format references packages by purl/cpe/name+version — e.g.,
+     * VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware
+     * amendments.
+     *
+     * Symmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same
+     * package vocabulary.
+     *
+     * When omitted, the amendment applies system-wide (or only to componentRef when that is
+     * set).
      */
     affectedPackages?: AffectedPackage[];
     /**
@@ -4004,10 +4074,12 @@ export interface HDFRequirementChangeEvent {
     /**
      * The effectiveChecksum of the entity state this event supersedes, forming a per-key hash
      * chain: a mismatch or gap against stored state is detectable, letting a consumer mark the
-     * key unverified instead of serving stale posture. Null at chain start (no prior state,
-     * e.g. a new entity or the first event after a seed). The chain provides tamper/gap
-     * evidence given a trusted head; completeness is anchored out-of-band by periodic
-     * re-centering rescans.
+     * key unverified instead of serving stale posture.
+     *
+     * Null at chain start (no prior state, e.g. a new entity or the first event after a seed).
+     *
+     * The chain provides tamper/gap evidence given a trusted head; completeness is anchored
+     * out-of-band by periodic re-centering rescans.
      */
     priorChecksum: any;
     /**

package/dist/ts/hdf.js

@@ -1,11 +1,12 @@
 /**
- * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
- * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
- * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
- * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
- * 'simple' for basic string identifiers without additional classification, or 'other' for
- * custom identity systems.
+ * The type of identifier.
+ *
+ * Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic
+ * non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting
+ * with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny
+ * (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure
+ * under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string
+ * identifiers without additional classification, or 'other' for custom identity systems.
  */
 export var IdentityType;
 (function (IdentityType) {
@@ -74,10 +75,14 @@ export var Ecosystem;
     Ecosystem["RPM"] = "rpm";
 })(Ecosystem || (Ecosystem = {}));
 /**
- * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
- * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
- * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
- * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+ * Whether the requirement is mandatory within its baseline.
+ *
+ * Distinct from severity (risk weight) and status (lifecycle state).
+ *
+ * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+ * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+ * carry richer semantics; layer those onto props[]/tags{}).
+ *
  * Optional: when omitted, consumers should treat the requirement as 'required' by
  * convention.
  */
@@ -89,11 +94,15 @@ export var Applicability;
 })(Applicability || (Applicability = {}));
 /**
  * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
- * categories. 'policy' = an authored governance statement; 'procedure' = a documented
- * process; 'technical' = an enforced technical configuration; 'management' = a
+ * categories.
+ *
+ * 'policy' = an authored governance statement; 'procedure' = a documented process;
+ * 'technical' = an enforced technical configuration; 'management' = a
  * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
- * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
- * family/id but should not assume a default.
+ * AT, IR, MA families).
+ *
+ * Optional: when omitted, consumers may infer heuristically from family/id but should not
+ * assume a default.
  */
 export var ControlType;
 (function (ControlType) {
@@ -128,19 +137,19 @@ export var Version;
     Version["The40"] = "4.0";
 })(Version || (Version = {}));
 /**
- * The type of amendment, aligned with FedRAMP deviation request categories. 'waiver': risk accepted
- * by Authorizing Official. 'attestation': manually verified by assessor. 'poam': remediation
- * tracked (no status change). 'inherited': control provided by another component or system.
- * 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the
- * check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE,
- * SCA), the flagged vulnerability does not apply to this system, so status is typically set to
- * 'notApplicable'. The disposition field on the requirement distinguishes false positives from
- * genuinely not-applicable findings. 'riskAdjustment': impact score adjusted based on environmental
- * context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact
- * field. 'operationalRequirement': deviation required by operational constraints (FedRAMP
- * Operational Requirement); the finding cannot be remediated because the system requires the
- * affected functionality. Remains an open risk. Migration note: 'exception' was removed in v3.1.0 —
- * use 'waiver' with status 'notApplicable' instead.
+ * The type of amendment, aligned with FedRAMP deviation request categories. - 'waiver': risk
+ * accepted by Authorizing Official. - 'attestation': manually verified by assessor. - 'poam':
+ * remediation tracked (no status change). - 'inherited': control provided by another component or
+ * system. - 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG,
+ * CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans
+ * (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set
+ * to 'notApplicable'. The disposition field on the requirement distinguishes false positives from
+ * genuinely not-applicable findings. - 'riskAdjustment': impact score adjusted based on
+ * environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact
+ * via the impact field. - 'operationalRequirement': deviation required by operational constraints
+ * (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires
+ * the affected functionality. Remains an open risk. Migration note: 'exception' was removed in
+ * v3.1.0 — use 'waiver' with status 'notApplicable' instead.
  */
 export var OverrideType;
 (function (OverrideType) {