@mitre/hdf-schema 3.5.0 → 3.6.0-rc.1

package/dist/ts/hdf.ts

@@ -262,11 +262,13 @@ export interface ExternalReference {
     description?: string;
     /**
      * Optional lossless embedded copy of the referenced artifact — the raw STIX object, EPSS
-     * record, advisory, or annotation payload — preserved verbatim. Composes with
-     * `href`/`externalId` (which point at the artifact) and `checksum` (which ties the copy to
-     * the source): a single entry can both point and embed. HDF stays payload-agnostic — the
-     * content is carried untouched, never normalized into HDF fields — so this does not
-     * duplicate the source ontology (e.g. STIX rides here unchanged).
+     * record, advisory, or annotation payload — preserved verbatim.
+     *
+     * Composes with `href`/`externalId` (which point at the artifact) and `checksum` (which
+     * ties the copy to the source): a single entry can both point and embed.
+     *
+     * HDF stays payload-agnostic — the content is carried untouched, never normalized into HDF
+     * fields — so this does not duplicate the source ontology (e.g. STIX rides here unchanged).
      */
     document?: { [key: string]: any };
     /**
@@ -283,10 +285,15 @@ export interface ExternalReference {
     href?: string;
     /**
      * Open token classifying the referenced/embedded payload, turning a bare reference into an
-     * enrichment envelope. Deliberately open (like `sourceName`/`rel`), not a closed enum.
+     * enrichment envelope.
+     *
+     * Deliberately open (like `sourceName`/`rel`), not a closed enum.
+     *
      * Documented starter vocabulary: 'threat-intel' (STIX/CTI object), 'annotation' (human
      * triage note), 'exploitation' (EPSS/KEV signal carried as context), 'advisory'
-     * (vendor/security advisory). Use the `x-` prefix for custom kinds.
+     * (vendor/security advisory).
+     *
+     * Use the `x-` prefix for custom kinds.
      */
     kind?: string;
     /**
@@ -326,26 +333,28 @@ export interface Identity {
      */
     identifier: string;
     /**
-     * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
-     * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
-     * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
-     * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
-     * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
-     * 'simple' for basic string identifiers without additional classification, or 'other' for
-     * custom identity systems.
+     * The type of identifier.
+     *
+     * Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic
+     * non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting
+     * with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny
+     * (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure
+     * under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string
+     * identifiers without additional classification, or 'other' for custom identity systems.
      */
     type: IdentityType;
     [property: string]: any;
 }
 
 /**
- * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
- * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
- * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
- * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
- * 'simple' for basic string identifiers without additional classification, or 'other' for
- * custom identity systems.
+ * The type of identifier.
+ *
+ * Use 'email' for email addresses, 'username' for user accounts, 'system' for deterministic
+ * non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting
+ * with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny
+ * (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure
+ * under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string
+ * identifiers without additional classification, or 'other' for custom identity systems.
  */
 export enum IdentityType {
     Agent = "agent",
@@ -559,12 +568,17 @@ export interface EvaluatedRequirement {
     disposition?: OverrideType;
     /**
      * Checksum of this requirement's resolved effective posture, for per-control change
-     * detection in continuous monitoring. sha256 over the canonical JSON object with keys
-     * status, impact, disposition (in that order), holding the resolved effective status,
-     * resolved effective impact, and governing override type (null when nothing governs), with
-     * override expiry anchored to the document timestamp. Flips exactly when the operative
-     * status, impact, or disposition changes; stable under all other churn (result details,
-     * timestamps, tags). Optional; stamped by tooling (hdf convert, hdf amend apply).
+     * detection in continuous monitoring.
+     *
+     * sha256 over the canonical JSON object with keys status, impact, disposition (in that
+     * order), holding the resolved effective status, resolved effective impact, and governing
+     * override type (null when nothing governs), with override expiry anchored to the document
+     * timestamp.
+     *
+     * Flips exactly when the operative status, impact, or disposition changes; stable under all
+     * other churn (result details, timestamps, tags).
+     *
+     * Optional; stamped by tooling (hdf convert, hdf amend apply).
      */
     effectiveChecksum?: Checksum;
     /**
@@ -634,10 +648,14 @@ export interface EvaluatedRequirement {
      */
     tags: { [key: string]: any };
     /**
-     * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
-     * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
-     * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
-     * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+     * Whether the requirement is mandatory within its baseline.
+     *
+     * Distinct from severity (risk weight) and status (lifecycle state).
+     *
+     * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+     * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+     * carry richer semantics; layer those onto props[]/tags{}).
+     *
      * Optional: when omitted, consumers should treat the requirement as 'required' by
      * convention.
      */
@@ -651,11 +669,15 @@ export interface EvaluatedRequirement {
     code?: string;
     /**
      * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
-     * categories. 'policy' = an authored governance statement; 'procedure' = a documented
-     * process; 'technical' = an enforced technical configuration; 'management' = a
+     * categories.
+     *
+     * 'policy' = an authored governance statement; 'procedure' = a documented process;
+     * 'technical' = an enforced technical configuration; 'management' = a
      * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
-     * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
-     * family/id but should not assume a default.
+     * AT, IR, MA families).
+     *
+     * Optional: when omitted, consumers may infer heuristically from family/id but should not
+     * assume a default.
      */
     controlType?: ControlType;
     /**
@@ -674,12 +696,17 @@ export interface EvaluatedRequirement {
      */
     title?: string;
     /**
-     * How this requirement is intended to be verified. Disambiguates the two cases that null
-     * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
-     * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
-     * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
-     * runs without operator action; 'hybrid' = part automated, part manual. Optional: when
-     * omitted, consumers should not infer a default.
+     * How this requirement is intended to be verified.
+     *
+     * Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the
+     * requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs);
+     * 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule
+     * lacking a fix).
+     *
+     * 'automated' = a check exists and runs without operator action; 'hybrid' = part automated,
+     * part manual.
+     *
+     * Optional: when omitted, consumers should not infer a default.
      */
     verificationMethod?: VerificationMethodEnum;
     [property: string]: any;
@@ -700,7 +727,7 @@ export interface AffectedPackage {
      * Optional CPE 2.3 URI identifying the affected product. Validated leniently: only the
      * 'cpe:2.3:' prefix and the part-type letter ('a' application, 'h' hardware, 'o' operating
      * system) are enforced here. Use `hdf-utilities.parseCpe` for full-grammar parsing.
-     * Example: 'cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*'.
+     * Example: `cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*`.
      */
     cpe?: string;
     /**
@@ -720,11 +747,16 @@ export interface AffectedPackage {
      */
     name?: string;
     /**
-     * Optional Package URL (PURL) identifying the affected package. Validated leniently: only
-     * the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE follows the PURL grammar (a
-     * letter followed by letters, digits, '.', '+', or '-') and is matched case-insensitively
-     * to mirror `hdf-utilities.parsePurl`'s accept-and-warn behavior. Use `parsePurl` for full
-     * PURL parsing. Example: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'.
+     * Optional Package URL (PURL) identifying the affected package.
+     *
+     * Validated leniently: only the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE
+     * follows the PURL grammar (a letter followed by letters, digits, '.', '+', or '-') and is
+     * matched case-insensitively to mirror `hdf-utilities.parsePurl`'s accept-and-warn
+     * behavior.
+     *
+     * Use `parsePurl` for full PURL parsing.
+     *
+     * Example: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'.
      */
     purl?: string;
     /**
@@ -754,10 +786,14 @@ export enum Ecosystem {
 }
 
 /**
- * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
- * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
- * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
- * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+ * Whether the requirement is mandatory within its baseline.
+ *
+ * Distinct from severity (risk weight) and status (lifecycle state).
+ *
+ * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+ * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+ * carry richer semantics; layer those onto props[]/tags{}).
+ *
  * Optional: when omitted, consumers should treat the requirement as 'required' by
  * convention.
  */
@@ -769,11 +805,15 @@ export enum Applicability {
 
 /**
  * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
- * categories. 'policy' = an authored governance statement; 'procedure' = a documented
- * process; 'technical' = an enforced technical configuration; 'management' = a
+ * categories.
+ *
+ * 'policy' = an authored governance statement; 'procedure' = a documented process;
+ * 'technical' = an enforced technical configuration; 'management' = a
  * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
- * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
- * family/id but should not assume a default.
+ * AT, IR, MA families).
+ *
+ * Optional: when omitted, consumers may infer heuristically from family/id but should not
+ * assume a default.
  */
 export enum ControlType {
     Management = "management",
@@ -804,11 +844,15 @@ export interface Cvss {
     baseSeverity?: CVSSSeverity;
     /**
      * Optional Base metric group vector string as emitted by the source (e.g.,
-     * 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'). For CVSS 2.0 the version prefix is
-     * omitted. Some vendor tools emit a final baseScore without the vector — in that case this
-     * field is absent and the score cannot be recomputed or decomposed. The pattern accepts any
-     * version-prefixed or prefix-less metric token sequence; semantic validity of individual
-     * metrics is checked by hdf-utilities, not by the schema.
+     * 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H').
+     *
+     * For CVSS 2.0 the version prefix is omitted.
+     *
+     * Some vendor tools emit a final baseScore without the vector — in that case this field is
+     * absent and the score cannot be recomputed or decomposed.
+     *
+     * The pattern accepts any version-prefixed or prefix-less metric token sequence; semantic
+     * validity of individual metrics is checked by hdf-utilities, not by the schema.
      */
     baseVector?: string;
     /**
@@ -899,19 +943,19 @@ export interface Description {
 }
 
 /**
- * The type of amendment, aligned with FedRAMP deviation request categories. 'waiver': risk accepted
- * by Authorizing Official. 'attestation': manually verified by assessor. 'poam': remediation
- * tracked (no status change). 'inherited': control provided by another component or system.
- * 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the
- * check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE,
- * SCA), the flagged vulnerability does not apply to this system, so status is typically set to
- * 'notApplicable'. The disposition field on the requirement distinguishes false positives from
- * genuinely not-applicable findings. 'riskAdjustment': impact score adjusted based on environmental
- * context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact
- * field. 'operationalRequirement': deviation required by operational constraints (FedRAMP
- * Operational Requirement); the finding cannot be remediated because the system requires the
- * affected functionality. Remains an open risk. Migration note: 'exception' was removed in v3.1.0 —
- * use 'waiver' with status 'notApplicable' instead.
+ * The type of amendment, aligned with FedRAMP deviation request categories. - 'waiver': risk
+ * accepted by Authorizing Official. - 'attestation': manually verified by assessor. - 'poam':
+ * remediation tracked (no status change). - 'inherited': control provided by another component or
+ * system. - 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG,
+ * CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans
+ * (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set
+ * to 'notApplicable'. The disposition field on the requirement distinguishes false positives from
+ * genuinely not-applicable findings. - 'riskAdjustment': impact score adjusted based on
+ * environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact
+ * via the impact field. - 'operationalRequirement': deviation required by operational constraints
+ * (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires
+ * the affected functionality. Remains an open risk. Migration note: 'exception' was removed in
+ * v3.1.0 — use 'waiver' with status 'notApplicable' instead.
  */
 export enum OverrideType {
     Attestation = "attestation",
@@ -1498,11 +1542,16 @@ export interface Component {
     inputOverrides?: InputOverride[];
     /**
      * Cryptographic integrity of this component's underlying artifact — model weights or
-     * shards, dataset archive, container image, or package bytes. An array supports
-     * multi-file/sharded artifacts. This is the single, generic home for artifact/subject
-     * integrity across all component types (it replaced the former per-type Container_Image
-     * digest and Artifact checksum fields). Distinct from BOM-document integrity (Bom.hashes[])
-     * and from the document tamper-evidence Integrity type.
+     * shards, dataset archive, container image, or package bytes.
+     *
+     * An array supports multi-file/sharded artifacts.
+     *
+     * This is the single, generic home for artifact/subject integrity across all component
+     * types (it replaced the former per-type Container_Image digest and Artifact checksum
+     * fields).
+     *
+     * Distinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence
+     * Integrity type.
      */
     integrity?: Checksum[];
     /**
@@ -2262,10 +2311,13 @@ export interface Tool {
      * The named format of the source data, when it follows a recognized format specification
      * with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF',
      * 'OSCAL') or one of several named output formats a single tool produces ('FVDL',
-     * 'exec-json', 'FPF'). Never a serialization structure — 'JSON', 'XML', and 'CSV' are
-     * encodings, not formats. Omit for a tool's native output: an absent format means the
-     * tool's own shape, and data arriving as a named format is converted by that format's
-     * converter, which sets this field alongside the producing tool's name.
+     * 'exec-json', 'FPF').
+     *
+     * Never a serialization structure — 'JSON', 'XML', and 'CSV' are encodings, not formats.
+     *
+     * Omit for a tool's native output: an absent format means the tool's own shape, and data
+     * arriving as a named format is converted by that format's converter, which sets this field
+     * alongside the producing tool's name.
      */
     format?: string;
     /**
@@ -2397,10 +2449,14 @@ export interface BaselineRequirement {
      */
     tags: { [key: string]: any };
     /**
-     * Whether the requirement is mandatory within its baseline. Distinct from severity (risk
-     * weight) and status (lifecycle state). Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop,
-     * FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group
-     * memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).
+     * Whether the requirement is mandatory within its baseline.
+     *
+     * Distinct from severity (risk weight) and status (lifecycle state).
+     *
+     * Maps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:'
+     * markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may
+     * carry richer semantics; layer those onto props[]/tags{}).
+     *
      * Optional: when omitted, consumers should treat the requirement as 'required' by
      * convention.
      */
@@ -2414,11 +2470,15 @@ export interface BaselineRequirement {
     code?: string;
     /**
      * Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A
-     * categories. 'policy' = an authored governance statement; 'procedure' = a documented
-     * process; 'technical' = an enforced technical configuration; 'management' = a
+     * categories.
+     *
+     * 'policy' = an authored governance statement; 'procedure' = a documented process;
+     * 'technical' = an enforced technical configuration; 'management' = a
      * programmatic/management activity; 'operational' = a recurring operational activity (e.g.
-     * AT, IR, MA families). Optional: when omitted, consumers may infer heuristically from
-     * family/id but should not assume a default.
+     * AT, IR, MA families).
+     *
+     * Optional: when omitted, consumers may infer heuristically from family/id but should not
+     * assume a default.
      */
     controlType?: ControlType;
     /**
@@ -2441,12 +2501,17 @@ export interface BaselineRequirement {
      */
     title?: string;
     /**
-     * How this requirement is intended to be verified. Disambiguates the two cases that null
-     * 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable
-     * to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could
-     * exist but does not yet, e.g. a STIG rule lacking a fix). 'automated' = a check exists and
-     * runs without operator action; 'hybrid' = part automated, part manual. Optional: when
-     * omitted, consumers should not infer a default.
+     * How this requirement is intended to be verified.
+     *
+     * Disambiguates the two cases that null 'code' overloads: 'manual-by-design' (the
+     * requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs);
+     * 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule
+     * lacking a fix).
+     *
+     * 'automated' = a check exists and runs without operator action; 'hybrid' = part automated,
+     * part manual.
+     *
+     * Optional: when omitted, consumers should not infer a default.
      */
     verificationMethod?: VerificationMethodEnum;
     [property: string]: any;
@@ -3658,24 +3723,29 @@ export interface HDFAmendments {
  * branches gated on 'type': when type is 'operationalRequirement', neither 'status' nor 'impact'
  * may be set — the override records accepted risk without changing the finding
  * (documentation-only). For all other types, at least one of 'status' or 'impact' must be set. This
- * rule aligns with: (1) OSCAL Assessment Results — finding.target.status and
+ * rule aligns with: - OSCAL Assessment Results — finding.target.status and
  * finding.associated-risk[].facet[] are separate axes
- * (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/); (2) FedRAMP
+ * (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/) - FedRAMP
  * deviation request types — Risk Adjustment changes impact only, Operational Requirement documents
  * acceptance only, False Positive changes status
- * (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/); (3) NIST SP
- * 800-37 RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment
- * status (https://csrc.nist.gov/pubs/sp/800/37/r2/final).
+ * (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/) - NIST SP 800-37
+ * RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment status
+ * (https://csrc.nist.gov/pubs/sp/800/37/r2/final).
  */
 export interface StandaloneOverride {
     /**
      * Software packages this amendment is scoped to, distinct from componentRef (which scopes
-     * to an HDF-internal Component by UUID). Use when the source amendment format references
-     * packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M
-     * `subjects[]`, FedRAMP component-aware amendments. Symmetric with
-     * Evaluated_Requirement.affectedPackages, which scopes findings to the same package
-     * vocabulary. When omitted, the amendment applies system-wide (or only to componentRef when
-     * that is set).
+     * to an HDF-internal Component by UUID).
+     *
+     * Use when the source amendment format references packages by purl/cpe/name+version — e.g.,
+     * VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware
+     * amendments.
+     *
+     * Symmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same
+     * package vocabulary.
+     *
+     * When omitted, the amendment applies system-wide (or only to componentRef when that is
+     * set).
      */
     affectedPackages?: AffectedPackage[];
     /**
@@ -4076,10 +4146,12 @@ export interface HDFRequirementChangeEvent {
     /**
      * The effectiveChecksum of the entity state this event supersedes, forming a per-key hash
      * chain: a mismatch or gap against stored state is detectable, letting a consumer mark the
-     * key unverified instead of serving stale posture. Null at chain start (no prior state,
-     * e.g. a new entity or the first event after a seed). The chain provides tamper/gap
-     * evidence given a trusted head; completeness is anchored out-of-band by periodic
-     * re-centering rescans.
+     * key unverified instead of serving stale posture.
+     *
+     * Null at chain start (no prior state, e.g. a new entity or the first event after a seed).
+     *
+     * The chain provides tamper/gap evidence given a trusted head; completeness is anchored
+     * out-of-band by periodic re-centering rescans.
      */
     priorChecksum: any;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/hdf-schema",
-  "version": "3.5.0",
+  "version": "3.6.0-rc.1",
   "description": "JSON schemas and multi-language type definitions for Heimdall Data Format (HDF)",
   "publishConfig": {
     "access": "public"
@@ -17,6 +17,10 @@
       "types": "./dist/helpers.d.ts",
       "import": "./dist/helpers.js"
     },
+    "./testhdf": {
+      "types": "./testhdf/index.d.ts",
+      "import": "./testhdf/index.js"
+    },
     "./hdf-results": {
       "types": "./dist/ts/hdf.d.ts",
       "import": "./dist/ts/hdf.js"
@@ -47,7 +51,9 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "testhdf/index.js",
+    "testhdf/index.d.ts"
   ],
   "repository": {
     "type": "git",
@@ -59,7 +65,7 @@
   "dependencies": {
     "ajv": "^8.17.0",
     "ajv-formats": "^3.0.0",
-    "@mitre/hdf-utilities": "^3.5.0"
+    "@mitre/hdf-utilities": "^3.6.0-rc.1"
   },
   "devDependencies": {
     "@hyperjump/json-schema": "^1.17.2",
@@ -93,7 +99,7 @@
     "clean": "rimraf dist",
     "test": "pnpm run test:ts",
     "test:ts": "vitest run",
-    "test:go": "echo 'No Go tests in hdf-schema'",
+    "test:go": "cd testhdf/go && go test ./...",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "type-check": "tsc --noEmit",

package/testhdf/index.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Type definitions for the test-only HDF builders (index.js).
+ */
+import type {
+  HDFResults,
+  EvaluatedBaseline,
+  EvaluatedRequirement,
+  RequirementResult,
+} from '../dist/ts/hdf.js';
+
+export interface ReqOptions {
+  severity?: string;
+  impact?: number;
+  status?: string;
+  tags?: Record<string, unknown>;
+  code?: string;
+  cwe?: string[];
+  title?: string;
+  /** codeDesc of the (default) result. */
+  codeDesc?: string;
+  /** startTime (ISO string) of the (default) result. */
+  startTime?: string;
+  /** Data for the default description. */
+  desc?: string;
+  /** Extra [label, data] descriptions appended after the default. */
+  addDesc?: Array<[string, string]>;
+  /** Replace the requirement's results wholesale. */
+  results?: RequirementResult[];
+}
+
+export function req(id: string, opts?: ReqOptions): EvaluatedRequirement;
+export function baseline(name: string, ...reqs: EvaluatedRequirement[]): EvaluatedBaseline;
+export function doc(...baselines: EvaluatedBaseline[]): HDFResults;
+export function results(...reqs: EvaluatedRequirement[]): HDFResults;
+
+import type {
+  HDFBaseline,
+  BaselineRequirement,
+  HDFAmendments,
+  StandaloneOverride,
+  HDFSystem,
+  Component,
+  HDFPlan,
+  Assessment,
+  HDFEvidencePackage,
+  ContentReference,
+  HDFRequirementChangeEvent,
+  HDFComparison,
+} from '../dist/ts/hdf.js';
+
+export interface BaselineReqOptions {
+  impact?: number;
+  tags?: Record<string, unknown>;
+  desc?: string;
+}
+export function baselineReq(id: string, opts?: BaselineReqOptions): BaselineRequirement;
+export function baselineDoc(name: string, ...reqs: BaselineRequirement[]): HDFBaseline;
+
+export interface OverrideOptions {
+  status?: string;
+  reason?: string;
+  appliedBy?: { type: string; identifier: string };
+  milestones?: unknown[];
+}
+export function override(type: string, reqId: string, opts?: OverrideOptions): StandaloneOverride;
+export function amendments(name: string, ...overrides: StandaloneOverride[]): HDFAmendments;
+
+export function component(name: string, type: string, opts?: Record<string, unknown>): Component;
+export function system(name: string, ...components: Component[]): HDFSystem;
+
+export function assessment(baselineRef: string): Assessment;
+export function plan(name: string, ...assessments: Assessment[]): HDFPlan;
+
+export function content(uri: string, type: string): ContentReference;
+export function evidencePackage(name: string, ...contents: ContentReference[]): HDFEvidencePackage;
+
+export interface ChangeEventOptions {
+  state?: string;
+  before?: unknown;
+  after?: unknown;
+  priorChecksum?: unknown;
+}
+export function changeEvent(reqId: string, opts?: ChangeEventOptions): HDFRequirementChangeEvent;
+
+export function comparison(mode: string): HDFComparison;