@mitre/hdf-schema 3.7.1 → 3.7.2-rc.1

package/dist/go/hdf.go

@@ -470,8 +470,11 @@ type EvaluatedRequirement struct {
 	SourceLocation                                                                              *SourceLocation         `json:"sourceLocation,omitempty"`
 	// Chronological history of all overrides applied to this requirement. Overrides are                                
 	// intentional changes to the compliance status and/or impact score (waivers, attestations,                         
-	// false positives, risk adjustments). Most recent override should be first in array.                               
-	// Preserves full audit trail.                                                                                      
+	// false positives, risk adjustments). Array order is NOT significant: consumers resolve the                        
+	// governing override by appliedAt (the most recently applied non-expired one), never by                            
+	// position. Earlier revisions of this description asked for most-recent-first, but nothing                         
+	// enforces it and producers commonly append, so position is frequently the opposite of                             
+	// recency. Preserves full audit trail.                                                                             
 	StatusOverrides                                                                             []StatusOverride        `json:"statusOverrides,omitempty"`
 	// The requirement identifier. Example: 'SV-238196'.                                                                
 	ID                                                                                          string                  `json:"id"`

package/dist/index.js

@@ -12,7 +12,7 @@ export const hdfComparisonSchema = {"$schema":"https://json-schema.org/draft/202
 export const hdfEvidencePackageSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-evidence-package/v3.7.0","title":"HDF Evidence Package","description":"Bundles references to all HDF documents for audit, authorization, and compliance review. Each content entry references a document by type, URI, and checksum for integrity verification.","type":"object","unevaluatedProperties":false,"required":["name","contents"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to external artifacts relevant to this evidence package (CTI/STIX, BOMs, advisories, or any URI-addressable artifact) beyond the document references it already carries. Inert context; see External_Reference."},"packageId":{"type":"string","format":"uuid","description":"Unique identifier for this evidence package. Optional in casual use, expected in production ATO submissions. Auto-generated if omitted during creation."},"name":{"type":"string","description":"Human-readable name for this evidence package. Example: 'Enterprise Portal ATO Evidence - Q1 2026'."},"description":{"type":"string","description":"Description of the evidence package's purpose and scope."},"systemRef":{"type":"string","format":"uri-reference","description":"URI to the hdf-system document this evidence package covers."},"planRef":{"type":"string","format":"uri-reference","description":"URI to the hdf-plan document that drove this assessment. Used for completeness verification — every baseline in the plan should have a corresponding results document in this package."},"preparedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity","description":"Identity of who prepared this evidence package."},"preparedAt":{"type":"string","format":"date-time","description":"When this evidence package was prepared. ISO 8601 format."},"contents":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/Content_Reference"},"description":"References to HDF documents included in this evidence package."},"externalEvidence":{"type":"array","items":{"$ref":"#/$defs/External_Evidence_Reference"},"description":"References to external native-format evidence (log/telemetry corpora and other artifacts) carried by URI + integrity hash + format discriminator, without recreating the data inside HDF. Logs in ECS/OCSF/etc. are legitimate accreditation evidence; HDF indexes them here rather than transcoding them."},"completenessCheck":{"$ref":"#/$defs/Completeness_Check","description":"Summary of assessment completeness and compliance status."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature","description":"Digital signature covering the entire evidence package."},"labels":{"type":"object","additionalProperties":{"type":"string"},"description":"Optional key-value labels for grouping and querying evidence packages."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this evidence package has not been tampered with."},"version":{"type":"string","description":"Version of this evidence package."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator","description":"Information about the tool that generated this document."}},"$defs":{"Content_Type":{"type":"string","enum":["hdf-system","hdf-baseline","hdf-plan","hdf-results","hdf-amendments","hdf-comparison","bom"],"description":"The type of document referenced in the evidence package. 'bom' covers any Bill-of-Materials/manifest document (SBOM, AI model/dataset, and reserved future kinds) — its specific kind is carried by the referenced document's bomType, not by a per-kind Content_Type value.","title":"Content Type"},"Content_Reference":{"type":"object","unevaluatedProperties":false,"required":["type","uri"],"properties":{"type":{"$ref":"#/$defs/Content_Type","description":"The type of HDF document being referenced."},"uri":{"type":"string","format":"uri-reference","description":"URI to the document. Can be a relative path or absolute URL."},"checksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Cryptographic checksum for verifying the referenced document's integrity."},"description":{"type":"string","description":"Optional description of this content entry."},"componentRef":{"type":"string","format":"uuid","description":"componentId of the component this content entry relates to. Use to link SBOMs, results, or other documents to a specific system component."}},"examples":[{"type":"hdf-system","uri":"portal-prod.hdf-system.json","checksum":{"algorithm":"sha256","value":"aaa111..."}},{"type":"hdf-results","uri":"portal-scan-march-2026.json","checksum":{"algorithm":"sha256","value":"ddd444..."},"description":"March 2026 monthly scan results"},{"type":"bom","uri":"https://artifacts.agency.gov/sbom/webtier.cdx.json","description":"WebTier CycloneDX SBOM (bomType=sbom)"}],"description":"A reference to an HDF document or BOM/manifest included in the evidence package.","title":"Content Reference"},"External_Evidence_Format":{"type":"string","title":"External Evidence Format","anyOf":[{"enum":["ecs","ocsf","cyclonedx","spdx","raw-log"]},{"pattern":"^x-[a-z0-9]+(-[a-z0-9]+)*$"}],"description":"The native format of the referenced external evidence.\n\nReserved values are OPEN, referenceable, serialized standards: ecs (Elastic Common Schema), ocsf (Open Cybersecurity Schema Framework), cyclonedx, spdx, raw-log (unstructured/native logs).\n\nCustom or vendor-specific kinds MUST use an 'x-' prefix (e.g. 'x-splunk-export') so they cannot collide with a value later promoted into the reserved set.\n\nAdding a reserved value is a schema version bump.","$comment":"Reserved values must be OPEN, serialized, uri+hash-referenceable artifacts. Query-time normalization MODELS are deliberately EXCLUDED because they have no portable stored artifact to reference: Splunk CIM is a search-time 'schema-on-the-fly' over Splunk-internal indexes, and Microsoft ASIM is a set of query-time KQL parsers over Sentinel tables. To carry Splunk/Sentinel-derived evidence, reference its EXPORTED result set (JSON/CSV/NDJSON) via an 'x-' format + mediaType — never the model name. 'schema-one' is intentionally NOT yet reserved: it has no open public spec (as of 2026-07), and reserving a value whose shape/version is unverified would violate the fixture-integrity rule; it will be added once the authoritative spec is obtained. Carriage is reference-only and never parses the payload, so a large/complex or spec-gated format (e.g. Schema One) is still referenceable as an opaque 'x-' value."},"External_Evidence_Time_Range":{"type":"object","title":"External Evidence Time Range","unevaluatedProperties":false,"properties":{"start":{"type":"string","format":"date-time","description":"Start of the time window the corpus covers (ISO 8601)."},"end":{"type":"string","format":"date-time","description":"End of the time window the corpus covers (ISO 8601)."}},"description":"The time window a referenced external evidence corpus covers."},"External_Evidence_Metadata":{"type":"object","title":"External Evidence Metadata","unevaluatedProperties":false,"properties":{"recordCount":{"type":"integer","minimum":0,"description":"Approximate number of records/events in the referenced corpus."},"timeRange":{"$ref":"#/$defs/External_Evidence_Time_Range","description":"The time window the referenced evidence covers."},"collector":{"type":"string","description":"The tool/pipeline that collected or produced the corpus. Example: 'aws-security-lake', 'elastic-agent'."}},"description":"Descriptive metadata about a referenced external evidence corpus. Does not affect integrity."},"External_Evidence_Reference":{"type":"object","unevaluatedProperties":false,"required":["uri","format"],"properties":{"uri":{"type":"string","format":"uri-reference","description":"URI to the external native-format evidence artifact (log/telemetry corpus, etc.). Can be a relative path or absolute URL. The data stays canonical in its native format — HDF references it, never parses or transcodes it."},"format":{"$ref":"#/$defs/External_Evidence_Format","description":"The native format discriminator of the referenced artifact."},"checksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Cryptographic checksum of the referenced artifact for integrity verification.","$comment":"Strongly recommended for external evidence — a point-in-time reference without an integrity hash is weakly auditable. Kept out of `description` so this usage-specific note does not aggregate into the shared Checksum type's generated Go doc comment (quicktype concatenates $ref-sibling descriptions onto the referenced type)."},"mediaType":{"type":"string","description":"Optional IANA media type describing the on-disk serialization, orthogonal to 'format' (the semantic standard). Examples: application/x-ndjson, application/json, application/vnd.apache.parquet, text/csv."},"formatVersion":{"type":"string","description":"Optional producer-declared version of the format (e.g. ECS '9.4.0', OCSF '1.8.0'). Free-text and untrusted — HDF does not validate it against a registry."},"description":{"type":"string","description":"Optional human-readable description of this evidence entry."},"metadata":{"$ref":"#/$defs/External_Evidence_Metadata","description":"Optional descriptive metadata about the referenced corpus. Does not affect integrity."}},"examples":[{"uri":"https://evidence.agency.gov/logs/portal-2026-q1.ndjson","format":"ecs","formatVersion":"9.4.0","mediaType":"application/x-ndjson","checksum":{"algorithm":"sha256","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},"metadata":{"recordCount":4200000,"timeRange":{"start":"2026-01-01T00:00:00Z","end":"2026-03-31T23:59:59Z"},"collector":"elastic-agent"}},{"uri":"s3://agency-security-lake/ocsf/portal/2026/q1/","format":"ocsf","formatVersion":"1.8.0","mediaType":"application/vnd.apache.parquet","metadata":{"collector":"aws-security-lake"}},{"uri":"siem/auth-events-2026-q1.json","format":"x-splunk-export","mediaType":"application/json"}],"description":"A reference to external native-format evidence (log/telemetry corpus or other artifact) carried by URI + integrity hash + format discriminator. Reference-only: the artifact is never embedded (corpora can be huge) or transcoded (that would be lossy) — it stays canonical in its native format and HDF acts as the structured index.","$comment":"Deliberately distinct from two look-alike primitives — the shared DRY is the common Checksum type, not the container. Bom (boms[] on components/system) models component COMPOSITION and is richer: also embeddable (document) and normalizable into HDF's queryable shape (packages/model/dataset). Content_Reference (contents[]) references HDF-ECOSYSTEM documents and BOMs by Content_Type. External_Evidence_Reference is reference-only and OPAQUE (HDF never inspects it), for NATIVE non-HDF log/telemetry corpora indexed as accreditation evidence; it carries log-specific metadata (recordCount/timeRange/collector) the other two do not. Do not merge these — collapsing them would mix incompatible discriminator axes and lose Bom's normalization. Examples, in order: 1) ECS log corpus carried by reference (NDJSON) — HDF never parses it; the hash pins integrity; 2) OCSF telemetry landed as Parquet in a security data lake; 3) A Splunk export carried as an opaque x- custom format — CIM/ASIM are query-time models, so reference the EXPORT, not the model.","title":"External Evidence Reference"},"SBOM_Coverage":{"type":"object","unevaluatedProperties":false,"properties":{"componentsWithSbom":{"type":"integer","minimum":0,"description":"Number of system components that have an associated SBOM."},"totalComponents":{"type":"integer","minimum":0,"description":"Total number of components in the system."}},"description":"SBOM coverage statistics for the system.","$comment":"This metric intentionally measures SOFTWARE (SBOM) inventory coverage only. Coverage accounting for ai-model/dataset/other BOM kinds is deliberately out of scope for now; a future generalized bomCoverage metric may be added. This is a distinct software-inventory metric, not an oversight of the Content_Type 'sbom'->'bom' generalization — do not rename or generalize it.","title":"SBOM Coverage"},"Completeness_Check":{"type":"object","unevaluatedProperties":false,"properties":{"allBaselinesAssessed":{"type":"boolean","description":"Whether all baselines referenced by system components have assessment results."},"allComponentsCovered":{"type":"boolean","description":"Whether all system components have at least one matching target in the results."},"expiredWaivers":{"type":"integer","minimum":0,"description":"Number of waivers/amendments that have expired."},"unresolvedPoams":{"type":"integer","minimum":0,"description":"Number of POA&M items that are still open (not completed)."},"compliancePercent":{"type":"number","minimum":0,"maximum":100,"description":"Overall compliance percentage across all assessments."},"sbomCoverage":{"$ref":"#/$defs/SBOM_Coverage","description":"SBOM coverage across system components.","$comment":"Intentionally software-inventory (SBOM) coverage only; ai-model/dataset/other BOM kinds are out of scope for this metric for now."}},"description":"Informational summary of assessment completeness. Not authoritative — tools should compute these from the referenced documents.","title":"Completeness Check"}},"examples":[{"name":"Enterprise Portal ATO Evidence - Q1 2026","systemRef":"portal-prod.hdf-system.json","preparedBy":{"type":"email","identifier":"compliance@agency.gov"},"preparedAt":"2026-03-31T12:00:00Z","contents":[{"type":"hdf-system","uri":"portal-prod.hdf-system.json","checksum":{"algorithm":"sha256","value":"aaa111"}},{"type":"hdf-baseline","uri":"rhel9-stig.hdf-baseline.json","checksum":{"algorithm":"sha256","value":"bbb222"}},{"type":"hdf-plan","uri":"portal-monthly-scan.hdf-plan.json","checksum":{"algorithm":"sha256","value":"ccc333"}},{"type":"hdf-results","uri":"portal-scan-march.json","checksum":{"algorithm":"sha256","value":"ddd444"}},{"type":"hdf-amendments","uri":"portal-waivers-q1.json","checksum":{"algorithm":"sha256","value":"eee555"}},{"type":"hdf-comparison","uri":"portal-diff-feb-mar.json","checksum":{"algorithm":"sha256","value":"fff666"}}],"completenessCheck":{"allBaselinesAssessed":true,"allComponentsCovered":true,"expiredWaivers":0,"unresolvedPoams":2,"compliancePercent":95.8,"sbomCoverage":{"componentsWithSbom":3,"totalComponents":5}}}]};
 export const hdfPlanSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-plan/v3.7.0","title":"HDF Plan","description":"Defines an assessment plan — what baselines to run against which targets, with resolved inputs and scheduling. Maps to OSCAL Assessment Plan.","type":"object","unevaluatedProperties":false,"required":["name","assessments"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to external artifacts relevant to this assessment plan (CTI/STIX, advisories, methodology docs, or any URI-addressable artifact). Inert context; see External_Reference."},"planId":{"type":"string","format":"uuid","description":"Unique identifier for this plan. Optional in casual use, expected in production documents. Auto-generated if omitted during creation."},"name":{"type":"string","description":"Human-readable plan name. Example: 'Portal Monthly Assessment'."},"type":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/plan/v3.7.0#/$defs/Plan_Type","description":"The type of assessment plan."},"description":{"type":"string","description":"Description of the plan's purpose and scope."},"systemRef":{"type":"string","format":"uri-reference","description":"URI to the hdf-system document this plan targets. Example: 'portal-prod.hdf-system.json'."},"assessments":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/plan/v3.7.0#/$defs/Assessment"},"description":"The assessments to perform. Each assessment pairs a baseline with targets and resolved inputs."},"schedule":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/plan/v3.7.0#/$defs/Schedule","description":"Optional scheduling configuration for recurring assessments."},"labels":{"type":"object","additionalProperties":{"type":"string"},"description":"Optional key-value labels for grouping and querying plans."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this plan document has not been tampered with."},"version":{"type":"string","description":"Version of this plan document."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator","description":"Information about the tool that generated this plan."}},"examples":[{"name":"Portal Monthly Assessment","type":"automated","systemRef":"portal-prod.hdf-system.json","assessments":[{"baselineRef":"RHEL9-STIG","targetSelector":{"labels.component":"WebTier"},"inputs":{"max_concurrent_sessions":5,"password_min_length":15},"runner":{"name":"cinc-auditor","version":"6.8.1"}}],"schedule":{"cron":"0 2 1 * *","notifyOnRegression":["security-team@agency.gov"]}}]};
 export const hdfRequirementChangeEventSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","title":"HDF Requirement Change Event","description":"A single continuous-monitoring wire event: one requirement's effective posture changed on one system component.\n\nThe streaming increment of a systemDrift hdf-comparison — events fold into comparisons and reassemble into hdf-results, they never mutate documents in place.\n\nOne event per wire document (NDJSON-friendly).\n\nThe envelope (identity, ordering, hash chain) is the shared Change_Event_Envelope primitive; the payload carries the producer-computable change state, a thin before projection, and the full after requirement (the evidence a responder opens the event for).\n\nDesign: ADR-0005.","type":"object","unevaluatedProperties":false,"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Change_Event_Envelope"},{"if":{"properties":{"state":{"const":"absent"}},"required":["state"]},"then":{"properties":{"after":{"type":"null"}}},"else":{"properties":{"after":{"$ref":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"}}}},{"if":{"properties":{"state":{"const":"new"}},"required":["state"]},"then":{"properties":{"before":{"type":"null"}}},"else":{"properties":{"before":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Effective_Projection"}}}}],"required":["requirementId","state","before","after"],"properties":{"requirementId":{"type":"string","description":"Canonical requirement identifier — the same identity as Requirement_Diff.id and the requirement's id in hdf-results. Together with the envelope's (systemRef, componentId) this forms the durable entity key. A requirement renumbering is emitted as absent + new under the two keys, never an in-place key change; batch comparison reconciles renames via its oldId/newId matching."},"state":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Event_Requirement_State","description":"The producer-computable subset of Requirement_State: new | absent | updated | fixed | regressed. fixed and regressed carry the direction SARIF's baselineState lacks; project down to SARIF's closed 4 values for external interop."},"changeReasons":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Event_Change_Reason"},"description":"Why the state changed. An overrideExpired flip is a different triage than resultChanged: the control did not get worse, a waiver lapsed."},"before":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Effective_Projection"},{"type":"null"}],"description":"Thin projection of the prior effective posture, for at-a-glance alerting without a state-store lookup. Null exactly when state is new (no prior posture exists). The full prior state is recoverable from the consumer's materialized state; the envelope's priorChecksum covers the integrity of that recovery."},"after":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"},{"type":"null"}],"description":"The full requirement as evaluated after the change — required and non-null for every state except absent (null there: the requirement left the assessment scope). Full content is load-bearing twice over: reassembly parity (applyChangeEvents cannot reproduce changed result content from a projection) and triage (the failing results[] ARE the 'why' a responder opens the event for)."}},"$comment":"Examples, in order: 1) fixed — the common remediation event: a failing SSH FIPS-cipher control was fixed and rescanned. priorChecksum is the effectiveChecksum of the prior failed posture; after carries the full passing requirement including its new effectiveChecksum (the next chain link); 2) regressed via overrideExpired — the waiver that held this control at passed lapsed, so effective posture regressed to failed with NO new scan finding. A different triage than resultChanged: renew or remediate. priorChecksum is the waived posture's checksum; the expired override remains in statusOverrides as the audit record; 3) new — a requirement entered assessment scope (chain start for this key): before is null, priorChecksum is null. The full after payload is what makes the new key materializable by applyChangeEvents; 4) absent — the requirement left assessment scope (component decommissioned or benchmark rule retired): after is null by definition; the thin before preserves the last observed posture for downstream views; 5) updated via impactChanged — a riskAdjustment override lowered effective impact while the control stayed failed: status unchanged, so neither fixed nor regressed. after carries the override and the recomputed effectiveChecksum over the adjusted posture.","examples":[{"eventId":"0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01","source":"inspec://web01/rhel9-stig","sequence":412,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-22T14:03:11Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","priorChecksum":{"algorithm":"sha256","value":"704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"},"requirementId":"RHEL-09-255065","state":"fixed","changeReasons":["resultChanged"],"before":{"effectiveStatus":"failed","effectiveImpact":0.5},"after":{"id":"RHEL-09-255065","title":"RHEL 9 SSH server must use FIPS-validated ciphers","impact":0.5,"tags":{"severity":"medium","nist":["AC-17 (2)"]},"descriptions":[{"label":"default","data":"Verify the sshd Ciphers configuration lists only FIPS-validated algorithms."}],"results":[{"status":"passed","codeDesc":"sshd config Ciphers is expected to match FIPS-validated cipher list","startTime":"2026-07-22T14:03:11Z"}],"effectiveChecksum":{"algorithm":"sha256","value":"73908440a3b44d76de559753babfea36987a618b80ee9d26adcf29cb5c7a5217"}}},{"eventId":"0190f6f2-3b6c-7f5e-c2d9-5a3f7b9c1e23","source":"reconciler://apptier/override-sweep","sequence":97,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-21T00:00:05Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","priorChecksum":{"algorithm":"sha256","value":"d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"},"requirementId":"SV-230365","state":"regressed","changeReasons":["overrideExpired"],"before":{"effectiveStatus":"passed","effectiveImpact":0.5},"after":{"id":"SV-230365","title":"RHEL 9 passwords must have a minimum of 15 characters","impact":0.5,"tags":{"severity":"medium","nist":["IA-5 (1) (a)"]},"descriptions":[{"label":"default","data":"Verify pwquality.conf minlen is 15 or greater."}],"results":[{"status":"failed","codeDesc":"pwquality.conf minlen is expected to be >= 15","startTime":"2026-07-20T02:00:00Z","message":"expected 8 to be >= 15"}],"statusOverrides":[{"type":"waiver","status":"passed","reason":"Compensating control: PIV/CAC smart card authentication enforced, password login disabled","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2026-07-20T00:00:00Z"}],"effectiveChecksum":{"algorithm":"sha256","value":"704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"}}},{"eventId":"0190f6f2-4c7d-8a6f-d3ea-6b4a8c0d2f34","source":"inspec://web01/rhel9-stig","sequence":1,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-22T14:03:12Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","priorChecksum":null,"requirementId":"RHEL-09-671010","state":"new","before":null,"after":{"id":"RHEL-09-671010","title":"RHEL 9 must implement DoD-approved encryption in the OpenSSL package","impact":0.7,"tags":{"severity":"high","nist":["SC-13"]},"descriptions":[{"label":"default","data":"Verify the system-wide crypto policy is FIPS."}],"results":[{"status":"passed","codeDesc":"update-crypto-policies --show is expected to eq FIPS","startTime":"2026-07-22T14:03:12Z"}],"effectiveChecksum":{"algorithm":"sha256","value":"4171cbc81dd74dedba74d3d51bf854602c1bd870d386dad1f830df9272d95557"}}},{"eventId":"0190f6f2-5d8e-9b7a-e4fb-7c5b9d1e3a45","source":"inspec://web01/rhel9-stig","sequence":413,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-23T08:00:00Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","priorChecksum":{"algorithm":"sha256","value":"704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"},"requirementId":"RHEL-09-255065","state":"absent","before":{"effectiveStatus":"failed","effectiveImpact":0.5},"after":null},{"eventId":"0190f6f2-6e9f-0c8b-f5ac-8d6c0e2f4b56","source":"reconciler://apptier/amend-apply","sequence":414,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-24T10:15:00Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0","priorChecksum":{"algorithm":"sha256","value":"704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"},"requirementId":"RHEL-09-255065","state":"updated","changeReasons":["overrideAdded","impactChanged"],"before":{"effectiveStatus":"failed","effectiveImpact":0.5},"after":{"id":"RHEL-09-255065","title":"RHEL 9 SSH server must use FIPS-validated ciphers","impact":0.5,"tags":{"severity":"medium","nist":["AC-17 (2)"]},"descriptions":[{"label":"default","data":"Verify the sshd Ciphers configuration lists only FIPS-validated algorithms."}],"results":[{"status":"failed","codeDesc":"sshd config Ciphers is expected to match FIPS-validated cipher list","startTime":"2026-07-22T14:03:11Z"}],"statusOverrides":[{"type":"riskAdjustment","impact":{"value":0.2},"reason":"Network segmentation limits exposure; management interface not internet-reachable","appliedBy":{"type":"email","identifier":"isso@agency.gov"},"appliedAt":"2026-07-24T10:15:00Z","expiresAt":"2099-12-31T00:00:00Z"}],"effectiveImpact":0.2,"disposition":"riskAdjustment","effectiveChecksum":{"algorithm":"sha256","value":"872635e1dd14903c660ae7e863c599d31f55bfa60be19394a629c63f851841c4"}}}]};
-export const hdfResultsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0","type":"object","unevaluatedProperties":false,"required":["baselines"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."},"id":{"type":"string","format":"uuid","description":"Unique identifier for this assessment run."},"timestamp":{"type":"string","format":"date-time","description":"When this assessment was executed."},"components":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"},"description":"The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."},"baselines":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Baseline"},"description":"Information on the baselines that were evaluated, including findings."},"statistics":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0#/$defs/Statistics","description":"Statistics for the assessment run, including duration and result counts."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator","description":"Information about the tool that generated this file."},"tool":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Tool","description":"The security tool that produced the assessment data in this file."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this file."},"preAmendmentChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.","$comment":"Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.","examples":[{"algorithm":"sha256","value":"9599ce7889e99b70ef5d0f3efa4215e35059c10a7e89b9314cbf4ded8fdbad38"}]},"runner":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0#/$defs/Runner","description":"Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."},"remediation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Remediation","description":"Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."},"systemRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-system document describing the system under assessment. May be a relative path, absolute URI, or fragment identifier."},"planRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."},"derivation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Derivation","description":"Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific data not defined in the HDF standard. Use this to preserve original tool output, auxiliary data, or custom metadata."}},"examples":[{"baselines":[{"name":"web-server-hardening","title":"Web Server Security Baseline","version":"1.0.0","summary":"Security hardening checks for Apache HTTP Server","requirements":[{"id":"SV-100001","title":"Web server must use TLS 1.2 or higher","impact":0.7,"tags":{"nist":["SC-8","SC-23"]},"descriptions":[{"label":"default","data":"The web server must be configured to use TLS 1.2 or higher for all encrypted connections."}],"results":[{"status":"passed","codeDesc":"SSL configuration is expected to include TLSv1.2","startTime":"2025-06-15T14:30:00Z","runTime":0.042}]},{"id":"SV-100002","title":"Web server must have X-Frame-Options header set","impact":0.5,"tags":{"nist":["SA-11","RA-5"]},"descriptions":[{"label":"default","data":"The anti-clickjacking X-Frame-Options header must be present on all responses."}],"results":[{"status":"failed","codeDesc":"HTTP response headers are expected to include X-Frame-Options","startTime":"2025-06-15T14:30:01Z","message":"X-Frame-Options header not found in response"}]}]}],"components":[{"type":"application","name":"Apache HTTP Server 2.4"}],"generator":{"name":"nikto-to-hdf","version":"1.0.0"},"tool":{"name":"Nikto"}}],"description":"The top level value containing all assessment results.","title":"HDF Results","$defs":{"Evaluated_Baseline":{"type":"object","unevaluatedProperties":false,"required":["name","requirements"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Baseline_Metadata"}],"properties":{"depends":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Dependency"},"description":"The set of dependencies this baseline depends on."},"parentBaseline":{"type":"string","description":"The name of the parent baseline if this is a dependency of another."},"description":{"type":"string","description":"The description - should be more detailed than the summary."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this baseline has not been tampered with."},"originalChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."},"resultsChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."},"statusMessage":{"type":"string","description":"An explanation of the baseline status. Example: why it was skipped, failed to load, or any other status details."},"requirements":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Requirement"},"minItems":1,"description":"The set of requirements including any findings. A baseline must have at least one requirement."},"groups":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Group"},"description":"A set of descriptions for the requirement groups."},"inputs":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0#/$defs/Input"},"description":"Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific baseline metadata not defined in the HDF standard."}},"description":"Information on a baseline that was evaluated, including any findings.","title":"Evaluated Baseline"},"Evaluated_Requirement":{"type":"object","unevaluatedProperties":false,"required":["id","impact","tags","results","descriptions"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Core"}],"properties":{"descriptions":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Description"},"contains":{"type":"object","required":["label"],"properties":{"label":{"const":"default"}}},"description":"Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."},"severity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Severity","description":"Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."},"sourceLocation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Source_Location","description":"The explicit location of the requirement within the source code."},"results":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Result"},"description":"The set of all tests within the requirement and their results."},"statusOverrides":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"},"description":"Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."},"poams":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/POAM"},"description":"Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."},"effectiveStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status","description":"The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."},"effectiveImpact":{"type":"number","minimum":0,"maximum":1,"description":"The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."},"disposition":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type","description":"The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."},"effectiveChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"},"description":"Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."},"cvss":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss"},"description":"Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."},"epss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0#/$defs/Epss","description":"FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."},"kev":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0#/$defs/Kev","description":"CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."},"cwe":{"type":"array","items":{"type":"string","pattern":"^CWE-[1-9]\\d*$"},"description":"Common Weakness Enumeration IDs associated with this finding. Use CWE-N format with no leading zeros (matches the MITRE catalog convention). For NIST control mappings derived from CWE, see tags.nist."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"},"description":"Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."}},"$comment":"Examples, in order: 1) Passing requirement — no overrides, no disposition; 2) Waiver — AO accepted risk, status overridden to passed; 3) False positive (compliance scan) — STIG check was wrong, requirement actually passes; 4) False positive (CVE scan) — vulnerability does not apply to this build; 5) Risk adjustment — impact lowered, pass/fail unchanged; 6) Operational requirement — cannot remediate, remains open risk; 7) POAM — remediation tracked, status unchanged.","examples":[{"id":"SV-230222","title":"RHEL 9 must use SSH protocol version 2","impact":0.7,"tags":{"nist":["SC-8"]},"descriptions":[{"label":"default","data":"SSH must use protocol version 2."}],"results":[{"status":"passed","codeDesc":"sshd_config Protocol is expected to eq 2","startTime":"2026-01-15T10:00:00Z"}],"effectiveStatus":"passed"},{"id":"SV-230300","title":"RHEL 9 must enforce password complexity","impact":0.5,"tags":{"nist":["IA-5 (1)"]},"descriptions":[{"label":"default","data":"Passwords must meet complexity requirements."}],"results":[{"status":"failed","codeDesc":"pwquality.conf minlen is expected to be >= 15","startTime":"2026-01-15T10:00:00Z","message":"expected 8 to be >= 15"}],"statusOverrides":[{"type":"waiver","status":"passed","reason":"Compensating control: PIV/CAC smart card authentication enforced for all users, password login disabled","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z"}],"effectiveStatus":"passed","disposition":"waiver","effectiveChecksum":{"algorithm":"sha256","value":"d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"}},{"id":"SV-230410","title":"RHEL 9 must have sshd PermitRootLogin disabled","impact":0.7,"tags":{"nist":["AC-6"]},"descriptions":[{"label":"default","data":"Direct root login via SSH must be disabled."}],"results":[{"status":"failed","codeDesc":"sshd_config PermitRootLogin is expected to eq 'no'","startTime":"2026-01-15T10:00:00Z","message":"expected 'prohibit-password' to eq 'no'"}],"statusOverrides":[{"type":"falsePositive","status":"passed","reason":"Scanner requires literal 'no' but 'prohibit-password' is equally restrictive (disables password-based root login). Manual review confirms root cannot authenticate via SSH.","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-01-16T14:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"passed","disposition":"falsePositive"},{"id":"CVE-2026-12345","title":"libxml2 buffer overflow in xmlParseEntityDecl","impact":0.9,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Buffer overflow in libxml2 entity parsing allows remote code execution."}],"results":[{"status":"failed","codeDesc":"libxml2 >= 2.9.0 is expected to be patched for CVE-2026-12345","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"falsePositive","status":"notApplicable","reason":"CVE scanner matched libxml2 version signature, but the vulnerable entity parsing module is compiled out of our build (--without-legacy flag). The affected code path does not exist in the binary.","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-01-16T09:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"notApplicable","disposition":"falsePositive"},{"id":"CVE-2026-67890","title":"OpenSSL timing side-channel in RSA decryption","impact":0.7,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Timing side-channel may allow RSA private key recovery."}],"results":[{"status":"failed","codeDesc":"openssl >= 3.1.0 is expected to be patched for CVE-2026-67890","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"riskAdjustment","impact":{"value":0.3},"reason":"The RSA key exchange path is unreachable in our deployment — all TLS connections use ECDHE. Attack requires local network access to the TLS terminator, which is in an isolated VLAN.","appliedBy":{"type":"email","identifier":"security-architect@org.gov"},"appliedAt":"2026-01-17T10:00:00Z","expiresAt":"2026-07-17T00:00:00Z"}],"effectiveStatus":"failed","effectiveImpact":0.3,"disposition":"riskAdjustment"},{"id":"SV-230500","title":"RHEL 9 must disable USB mass storage","impact":0.5,"tags":{"nist":["MP-7"]},"descriptions":[{"label":"default","data":"USB mass storage kernel module must be disabled."}],"results":[{"status":"failed","codeDesc":"Kernel module 'usb-storage' is expected to be disabled","startTime":"2026-01-15T10:00:00Z","message":"usb-storage module is loaded"}],"statusOverrides":[{"type":"operationalRequirement","status":"failed","reason":"Air-gapped system requires USB transfer for classified data ingestion per operational procedure OP-2026-003. Compensating controls: USB ports are physically secured, all transfers are logged and require two-person integrity.","appliedBy":{"type":"email","identifier":"system-owner@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2026-07-20T00:00:00Z"}],"effectiveStatus":"failed","disposition":"operationalRequirement"},{"id":"SV-230350","title":"RHEL 9 must be patched within 30 days of release","impact":0.7,"tags":{"nist":["SI-2"]},"descriptions":[{"label":"default","data":"Security patches must be applied within 30 days."}],"results":[{"status":"failed","codeDesc":"Package updates are expected to be current within 30 days","startTime":"2026-01-15T10:00:00Z","message":"15 packages have patches older than 30 days"}],"poams":[{"type":"remediation","explanation":"Patch deployment blocked by vendor compatibility testing. Vendor confirmed fix for Q2 2026.","appliedBy":{"type":"email","identifier":"ops@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Vendor releases compatible patch","estimatedCompletion":"2026-04-01T00:00:00Z","status":"pending"},{"description":"Deploy to production","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"}]}],"effectiveStatus":"failed","disposition":"poam"}],"description":"A requirement that has been evaluated, including any findings.","title":"Evaluated Requirement"}}};
+export const hdfResultsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0","type":"object","unevaluatedProperties":false,"required":["baselines"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."},"id":{"type":"string","format":"uuid","description":"Unique identifier for this assessment run."},"timestamp":{"type":"string","format":"date-time","description":"When this assessment was executed."},"components":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"},"description":"The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."},"baselines":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Baseline"},"description":"Information on the baselines that were evaluated, including findings."},"statistics":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0#/$defs/Statistics","description":"Statistics for the assessment run, including duration and result counts."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator","description":"Information about the tool that generated this file."},"tool":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Tool","description":"The security tool that produced the assessment data in this file."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this file."},"preAmendmentChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.","$comment":"Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.","examples":[{"algorithm":"sha256","value":"9599ce7889e99b70ef5d0f3efa4215e35059c10a7e89b9314cbf4ded8fdbad38"}]},"runner":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0#/$defs/Runner","description":"Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."},"remediation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Remediation","description":"Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."},"systemRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-system document describing the system under assessment. May be a relative path, absolute URI, or fragment identifier."},"planRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."},"derivation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Derivation","description":"Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific data not defined in the HDF standard. Use this to preserve original tool output, auxiliary data, or custom metadata."}},"examples":[{"baselines":[{"name":"web-server-hardening","title":"Web Server Security Baseline","version":"1.0.0","summary":"Security hardening checks for Apache HTTP Server","requirements":[{"id":"SV-100001","title":"Web server must use TLS 1.2 or higher","impact":0.7,"tags":{"nist":["SC-8","SC-23"]},"descriptions":[{"label":"default","data":"The web server must be configured to use TLS 1.2 or higher for all encrypted connections."}],"results":[{"status":"passed","codeDesc":"SSL configuration is expected to include TLSv1.2","startTime":"2025-06-15T14:30:00Z","runTime":0.042}]},{"id":"SV-100002","title":"Web server must have X-Frame-Options header set","impact":0.5,"tags":{"nist":["SA-11","RA-5"]},"descriptions":[{"label":"default","data":"The anti-clickjacking X-Frame-Options header must be present on all responses."}],"results":[{"status":"failed","codeDesc":"HTTP response headers are expected to include X-Frame-Options","startTime":"2025-06-15T14:30:01Z","message":"X-Frame-Options header not found in response"}]}]}],"components":[{"type":"application","name":"Apache HTTP Server 2.4"}],"generator":{"name":"nikto-to-hdf","version":"1.0.0"},"tool":{"name":"Nikto"}}],"description":"The top level value containing all assessment results.","title":"HDF Results","$defs":{"Evaluated_Baseline":{"type":"object","unevaluatedProperties":false,"required":["name","requirements"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Baseline_Metadata"}],"properties":{"depends":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Dependency"},"description":"The set of dependencies this baseline depends on."},"parentBaseline":{"type":"string","description":"The name of the parent baseline if this is a dependency of another."},"description":{"type":"string","description":"The description - should be more detailed than the summary."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this baseline has not been tampered with."},"originalChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."},"resultsChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."},"statusMessage":{"type":"string","description":"An explanation of the baseline status. Example: why it was skipped, failed to load, or any other status details."},"requirements":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Requirement"},"minItems":1,"description":"The set of requirements including any findings. A baseline must have at least one requirement."},"groups":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Group"},"description":"A set of descriptions for the requirement groups."},"inputs":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0#/$defs/Input"},"description":"Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific baseline metadata not defined in the HDF standard."}},"description":"Information on a baseline that was evaluated, including any findings.","title":"Evaluated Baseline"},"Evaluated_Requirement":{"type":"object","unevaluatedProperties":false,"required":["id","impact","tags","results","descriptions"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Core"}],"properties":{"descriptions":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Description"},"contains":{"type":"object","required":["label"],"properties":{"label":{"const":"default"}}},"description":"Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."},"severity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Severity","description":"Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."},"sourceLocation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Source_Location","description":"The explicit location of the requirement within the source code."},"results":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Result"},"description":"The set of all tests within the requirement and their results."},"statusOverrides":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"},"description":"Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Array order is NOT significant: consumers resolve the governing override by appliedAt (the most recently applied non-expired one), never by position. Earlier revisions of this description asked for most-recent-first, but nothing enforces it and producers commonly append, so position is frequently the opposite of recency. Preserves full audit trail."},"poams":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/POAM"},"description":"Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."},"effectiveStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status","description":"The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."},"effectiveImpact":{"type":"number","minimum":0,"maximum":1,"description":"The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."},"disposition":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type","description":"The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."},"effectiveChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"},"description":"Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."},"cvss":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss"},"description":"Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."},"epss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0#/$defs/Epss","description":"FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."},"kev":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0#/$defs/Kev","description":"CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."},"cwe":{"type":"array","items":{"type":"string","pattern":"^CWE-[1-9]\\d*$"},"description":"Common Weakness Enumeration IDs associated with this finding. Use CWE-N format with no leading zeros (matches the MITRE catalog convention). For NIST control mappings derived from CWE, see tags.nist."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"},"description":"Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."}},"$comment":"Examples, in order: 1) Passing requirement — no overrides, no disposition; 2) Waiver — AO accepted risk, status overridden to passed; 3) False positive (compliance scan) — STIG check was wrong, requirement actually passes; 4) False positive (CVE scan) — vulnerability does not apply to this build; 5) Risk adjustment — impact lowered, pass/fail unchanged; 6) Operational requirement — cannot remediate, remains open risk; 7) POAM — remediation tracked, status unchanged.","examples":[{"id":"SV-230222","title":"RHEL 9 must use SSH protocol version 2","impact":0.7,"tags":{"nist":["SC-8"]},"descriptions":[{"label":"default","data":"SSH must use protocol version 2."}],"results":[{"status":"passed","codeDesc":"sshd_config Protocol is expected to eq 2","startTime":"2026-01-15T10:00:00Z"}],"effectiveStatus":"passed"},{"id":"SV-230300","title":"RHEL 9 must enforce password complexity","impact":0.5,"tags":{"nist":["IA-5 (1)"]},"descriptions":[{"label":"default","data":"Passwords must meet complexity requirements."}],"results":[{"status":"failed","codeDesc":"pwquality.conf minlen is expected to be >= 15","startTime":"2026-01-15T10:00:00Z","message":"expected 8 to be >= 15"}],"statusOverrides":[{"type":"waiver","status":"passed","reason":"Compensating control: PIV/CAC smart card authentication enforced for all users, password login disabled","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z"}],"effectiveStatus":"passed","disposition":"waiver","effectiveChecksum":{"algorithm":"sha256","value":"d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"}},{"id":"SV-230410","title":"RHEL 9 must have sshd PermitRootLogin disabled","impact":0.7,"tags":{"nist":["AC-6"]},"descriptions":[{"label":"default","data":"Direct root login via SSH must be disabled."}],"results":[{"status":"failed","codeDesc":"sshd_config PermitRootLogin is expected to eq 'no'","startTime":"2026-01-15T10:00:00Z","message":"expected 'prohibit-password' to eq 'no'"}],"statusOverrides":[{"type":"falsePositive","status":"passed","reason":"Scanner requires literal 'no' but 'prohibit-password' is equally restrictive (disables password-based root login). Manual review confirms root cannot authenticate via SSH.","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-01-16T14:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"passed","disposition":"falsePositive"},{"id":"CVE-2026-12345","title":"libxml2 buffer overflow in xmlParseEntityDecl","impact":0.9,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Buffer overflow in libxml2 entity parsing allows remote code execution."}],"results":[{"status":"failed","codeDesc":"libxml2 >= 2.9.0 is expected to be patched for CVE-2026-12345","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"falsePositive","status":"notApplicable","reason":"CVE scanner matched libxml2 version signature, but the vulnerable entity parsing module is compiled out of our build (--without-legacy flag). The affected code path does not exist in the binary.","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-01-16T09:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"notApplicable","disposition":"falsePositive"},{"id":"CVE-2026-67890","title":"OpenSSL timing side-channel in RSA decryption","impact":0.7,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Timing side-channel may allow RSA private key recovery."}],"results":[{"status":"failed","codeDesc":"openssl >= 3.1.0 is expected to be patched for CVE-2026-67890","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"riskAdjustment","impact":{"value":0.3},"reason":"The RSA key exchange path is unreachable in our deployment — all TLS connections use ECDHE. Attack requires local network access to the TLS terminator, which is in an isolated VLAN.","appliedBy":{"type":"email","identifier":"security-architect@org.gov"},"appliedAt":"2026-01-17T10:00:00Z","expiresAt":"2026-07-17T00:00:00Z"}],"effectiveStatus":"failed","effectiveImpact":0.3,"disposition":"riskAdjustment"},{"id":"SV-230500","title":"RHEL 9 must disable USB mass storage","impact":0.5,"tags":{"nist":["MP-7"]},"descriptions":[{"label":"default","data":"USB mass storage kernel module must be disabled."}],"results":[{"status":"failed","codeDesc":"Kernel module 'usb-storage' is expected to be disabled","startTime":"2026-01-15T10:00:00Z","message":"usb-storage module is loaded"}],"statusOverrides":[{"type":"operationalRequirement","status":"failed","reason":"Air-gapped system requires USB transfer for classified data ingestion per operational procedure OP-2026-003. Compensating controls: USB ports are physically secured, all transfers are logged and require two-person integrity.","appliedBy":{"type":"email","identifier":"system-owner@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2026-07-20T00:00:00Z"}],"effectiveStatus":"failed","disposition":"operationalRequirement"},{"id":"SV-230350","title":"RHEL 9 must be patched within 30 days of release","impact":0.7,"tags":{"nist":["SI-2"]},"descriptions":[{"label":"default","data":"Security patches must be applied within 30 days."}],"results":[{"status":"failed","codeDesc":"Package updates are expected to be current within 30 days","startTime":"2026-01-15T10:00:00Z","message":"15 packages have patches older than 30 days"}],"poams":[{"type":"remediation","explanation":"Patch deployment blocked by vendor compatibility testing. Vendor confirmed fix for Q2 2026.","appliedBy":{"type":"email","identifier":"ops@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Vendor releases compatible patch","estimatedCompletion":"2026-04-01T00:00:00Z","status":"pending"},{"description":"Deploy to production","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"}]}],"effectiveStatus":"failed","disposition":"poam"}],"description":"A requirement that has been evaluated, including any findings.","title":"Evaluated Requirement"}}};
 export const hdfSystemSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-system/v3.7.0","title":"HDF System","description":"Describes a system's authorization boundary, components, and interconnections. Maps to OSCAL SSP system-characteristics and FedRAMP system inventory.","type":"object","unevaluatedProperties":false,"required":["name","components"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to external artifacts describing this system's threat environment or context (CTI/STIX, BOMs, advisories, or any URI-addressable artifact). Inert context; see External_Reference."},"systemId":{"type":"string","format":"uuid","description":"Stable UUID (RFC 4122) for this system. Enables cross-document correlation independent of file location. Optional in casual use, expected in production documents."},"owner":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity","description":"Team or individual responsible for this system's authorization and compliance. Maps to OSCAL responsible-party with role 'system-owner'."},"name":{"type":"string","description":"Human-readable system name. Example: 'Enterprise Portal Production'."},"identifier":{"type":"string","description":"System identifier from an authoritative source. Example: eMASS system ID, FedRAMP package ID."},"identifierScheme":{"type":"string","format":"uri-reference","description":"URI identifying the scheme of the system identifier. Example: 'https://emass.mil', 'https://fedramp.gov'."},"description":{"type":"string","description":"Description of the system's purpose and mission."},"authorizationStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Authorization_Status","description":"Current Authorization to Operate (ATO) status."},"authorizationDate":{"type":"string","format":"date-time","description":"Date the current authorization status was granted. ISO 8601 format."},"categorizationLevel":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Categorization_Level","description":"FIPS 199 security categorization (impact level)."},"boundaryDescription":{"type":"string","description":"Description of the system's authorization boundary. Example: network CIDR blocks, cloud VPC IDs, physical locations."},"components":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"},"description":"System components within the authorization boundary. Uses the full polymorphic Component type with stable identity (componentId), external references, and generalized BOM attachment (boms[])."},"controlDesignations":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Control_Designation"},"description":"Declares which controls are common, hybrid, or system-specific, and which component provides them. Maps to NIST SP 800-53 control designations and OSCAL leveraged-authorizations."},"dataFlows":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/data-flow/v3.7.0#/$defs/Data_Flow"},"description":"Inter-component data flows describing how components communicate. Supports local, cross-system, and external flows. Replaces the interconnections[] field."},"boms":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0#/$defs/Bom"},"description":"System-scoped Bills of Materials whose subject is the authorization boundary rather than a single component (e.g. a SaaSBOM of services, a KBOM of cluster inventory, an OBOM). Component-scoped BOMs (SBOM, ai-model) attach on the component instead. See primitives/bom.schema.json."},"labels":{"type":"object","additionalProperties":{"type":"string"},"description":"Optional key-value labels for grouping and querying systems."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this system document has not been tampered with."},"version":{"type":"string","description":"Version of this system document."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator","description":"Information about the tool that generated this system document."}},"examples":[{"name":"Enterprise Portal Production","identifier":"SYS-2024-00142","identifierScheme":"https://emass.mil","authorizationStatus":"authorized","authorizationDate":"2025-06-15T00:00:00Z","categorizationLevel":"moderate","boundaryDescription":"All resources in prod VPC (10.0.0.0/16)","components":[{"name":"WebTier","type":"application","componentId":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","description":"RHEL 9 web servers running the portal","baselineRefs":["RHEL9-STIG","DISA-Container-STIG"],"boms":[{"bomType":"sbom","format":"cyclonedx","ref":"https://artifacts.agency.gov/sbom/webtier-2026-03.cdx.json"}]},{"name":"DatabaseTier","type":"database","componentId":"11111111-2222-3333-4444-555555555555","baselineRefs":["PostgreSQL-15-STIG"]}],"dataFlows":[{"from":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","to":"11111111-2222-3333-4444-555555555555","protocol":"jdbc","port":5432,"direction":"unidirectional","description":"Web tier connects to database"}]}]};
 export const affectedPackageSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0","title":"HDF Affected Package Primitives","description":"Types for representing the software package(s) affected by a vulnerability finding.","$defs":{"Affected_Package":{"type":"object","unevaluatedProperties":false,"anyOf":[{"required":["name","version","ecosystem"]},{"required":["purl"]},{"required":["cpe"]}],"properties":{"name":{"type":"string","description":"The package name as published in its ecosystem. Examples: 'openssl' (rpm), 'lodash' (npm), 'org.apache.logging.log4j:log4j-core' (maven, group:artifact)."},"version":{"type":"string","description":"The exact version of the package that the vulnerability scanner observed. Use the ecosystem's native version string verbatim (e.g., '1.1.1k-7.el8_4' for rpm, '4.17.20' for npm)."},"ecosystem":{"type":"string","enum":["npm","pypi","rpm","deb","maven","gem","nuget","go","cargo","generic"],"description":"The packaging ecosystem the package belongs to. Use 'generic' for hardware, firmware, or anything outside the listed language/OS package managers."},"cpe":{"type":"string","pattern":"^cpe:2\\.3:[aho]:.*","description":"Optional CPE 2.3 URI identifying the affected product. Validated leniently: only the 'cpe:2.3:' prefix and the part-type letter ('a' application, 'h' hardware, 'o' operating system) are enforced here. Use `hdf-utilities.parseCpe` for full-grammar parsing. Example: `cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*`."},"purl":{"type":"string","pattern":"^pkg:[A-Za-z0-9.+-]+/.+","description":"Optional Package URL (PURL) identifying the affected package.\n\nValidated leniently: only the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE follows the PURL grammar (a letter followed by letters, digits, '.', '+', or '-') and is matched case-insensitively to mirror `hdf-utilities.parsePurl`'s accept-and-warn behavior.\n\nUse `parsePurl` for full PURL parsing.\n\nExample: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'."},"fixedInVersion":{"type":"string","description":"Optional version string identifying the first release that contains the fix for the vulnerability. Use the same version syntax as `version`. Example: '1.1.1l' fixes 'openssl@1.1.1k'."}},"$comment":"Examples, in order: 1) RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan; 2) NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier; 3) Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings; 4) Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed; 5) purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly; 6) cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.","examples":[{"name":"openssl","version":"1.1.1k-7.el8_4","ecosystem":"rpm","cpe":"cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*","purl":"pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64","fixedInVersion":"1.1.1l"},{"name":"lodash","version":"4.17.20","ecosystem":"npm","purl":"pkg:npm/lodash@4.17.20","fixedInVersion":"4.17.21"},{"name":"requests","version":"2.28.1","ecosystem":"pypi"},{"name":"org.apache.logging.log4j:log4j-core","version":"2.14.1","ecosystem":"maven","cpe":"cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","fixedInVersion":"2.17.1"},{"purl":"pkg:npm/lodash@4.17.20"},{"cpe":"cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*"}],"description":"Represents a package referenced by a vulnerability finding or by an amendment's scope.\n\nOn Evaluated_Requirement.affectedPackages it says 'this CVE affects these package versions'. On Standalone_Override.affectedPackages it says 'this amendment is scoped to these packages' (used by VEX, OSCAL POA&M, FedRAMP component-aware amendments).\n\nNOT a system-level component identifier — see `components[]` on hdf-system for those.\n\nValidity requires at least one of: (name + version + ecosystem), purl alone, or cpe alone.\n\npurl and cpe are self-describing identifiers that encode name/version implicitly, so either may stand on its own; the name+version+ecosystem combination is the explicit form for sources without formal identifiers.","title":"Affected Package"}}};
 export const amendmentsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0","title":"HDF Amendment Primitives","description":"Types for waivers, attestations, and POA&Ms that modify requirement compliance status.","$defs":{"Override_Type":{"type":"string","enum":["waiver","attestation","poam","inherited","falsePositive","riskAdjustment","operationalRequirement"],"description":"The type of amendment, aligned with FedRAMP deviation request categories.\n\n- 'waiver': risk accepted by Authorizing Official.\n- 'attestation': manually verified by assessor.\n- 'poam': remediation tracked (no status change).\n- 'inherited': control provided by another component or system.\n- 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set to 'notApplicable'. The disposition field on the requirement distinguishes false positives from genuinely not-applicable findings.\n- 'riskAdjustment': impact score adjusted based on environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact field.\n- 'operationalRequirement': deviation required by operational constraints (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires the affected functionality. Remains an open risk.\n\nMigration note: 'exception' was removed in v3.1.0 — use 'waiver' with status 'notApplicable' instead.","title":"Override Type"},"Justification":{"type":"string","enum":["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist","requires_configuration","requires_dependency","requires_environment","protected_by_compiler","protected_at_runtime","protected_at_perimeter"],"description":"Structured controlled-vocabulary reason for an override, complementing the free-text 'reason' field. 'reason' carries the human-readable rationale an auditor reads; 'justification' carries the machine-readable category enabling filtering, aggregation, and lossless round-trip with structured ecosystems (VEX, OSCAL, FedRAMP DR). Both fields may be present simultaneously and are NOT redundant: 'reason' explains the specific circumstance; 'justification' classifies it. Authors SHOULD populate both when a controlled-vocabulary value applies — the enum value alone is not self-explanatory to an auditor.\n\nThe vocabulary is drawn from the VEX ecosystem: the first five values are common across OpenVEX, CSAF VEX, and CycloneDX VEX; the remaining six (requires_configuration / requires_dependency / requires_environment / protected_by_compiler / protected_at_runtime / protected_at_perimeter) are CycloneDX-specific and describe why the vulnerable code path is unreachable in the deployed configuration.\n\nThe enum is extended additively across schema versions as other ecosystems' controlled vocabularies are integrated; documents using values added in a newer schema version will fail validation against an older schema. Consumers SHOULD validate against the schema version declared by the document ($schema) rather than assume a fixed vocabulary.","title":"Justification"},"Impact_Override":{"type":"object","required":["value"],"unevaluatedProperties":false,"properties":{"value":{"type":"number","minimum":0,"maximum":1,"description":"The overridden impact score (0.0–1.0)."}},"description":"An override to the requirement's impact score. The prior impact is the original result value or the preceding override in the chain.","title":"Impact Override"},"Standalone_Override":{"type":"object","description":"A standalone override to a requirement's compliance status or risk impact.\n\nValidation has two branches gated on 'type': when type is 'operationalRequirement', neither 'status' nor 'impact' may be set — the override records accepted risk without changing the finding (documentation-only). For all other types, at least one of 'status' or 'impact' must be set.\n\nThis rule aligns with:\n- OSCAL Assessment Results — finding.target.status and finding.associated-risk[].facet[] are separate axes (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/)\n- FedRAMP deviation request types — Risk Adjustment changes impact only, Operational Requirement documents acceptance only, False Positive changes status (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/)\n- NIST SP 800-37 RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment status (https://csrc.nist.gov/pubs/sp/800/37/r2/final).","unevaluatedProperties":false,"required":["type","requirementId","reason","appliedBy","appliedAt","expiresAt"],"if":{"properties":{"type":{"enum":["operationalRequirement"]}},"required":["type"]},"then":{"not":{"anyOf":[{"required":["status"]},{"required":["impact"]}]}},"else":{"anyOf":[{"required":["status"]},{"required":["impact"]}]},"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"},"description":"Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."},"type":{"$ref":"#/$defs/Override_Type","description":"The type of amendment."},"requirementId":{"type":"string","minLength":1,"description":"The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."},"baselineRef":{"type":"string","description":"Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."},"status":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status","description":"The new status this amendment sets. Optional when only impact is being overridden."},"impact":{"$ref":"#/$defs/Impact_Override","description":"Override to the requirement's impact score. At least one of status or impact must be set."},"reason":{"type":"string","description":"Justification for this amendment."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity","description":"Identity of who applied this amendment."},"appliedAt":{"type":"string","format":"date-time","description":"When this amendment was applied. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"When this amendment expires and must be reviewed. No permanent amendments. ISO 8601 format."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"},"description":"Supporting evidence (screenshots, logs, URLs, documents)."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature","description":"Digital signature for non-repudiation."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum","description":"SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."},"cvss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss","$comment":"When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.","description":"Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."},"justification":{"$ref":"#/$defs/Justification","description":"Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."},"milestones":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"},"description":"Remediation milestones (primarily for POA&M type amendments)."},"inheritedFrom":{"type":"string","format":"uuid","description":"componentId of the local component that provides this control. Set when the provider is in the same system. Omit for external or cross-system providers; the reason field explains the source. Primarily used with type 'inherited'."},"componentRef":{"type":"string","format":"uuid","description":"componentId of the component this amendment is scoped to. When set, the amendment only applies to the specified component. When omitted, the amendment applies system-wide."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"},"description":"Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."}},"$comment":"Example 7: VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.","examples":[{"type":"waiver","requirementId":"SV-257777","baselineRef":"RHEL9-STIG","status":"passed","reason":"Compensating control: session timeout set to 15 min","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-15T10:00:00Z","expiresAt":"2026-06-30T00:00:00Z","evidence":[{"type":"url","data":"https://jira.agency.gov/CYBER-4521","description":"ISSM approval with compensating control documentation"}]},{"type":"falsePositive","requirementId":"SV-258010","baselineRef":"RHEL9-STIG","status":"passed","reason":"STIG check misidentified sshd_config syntax; manual review confirms compliant configuration","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"CVE scanner matched library signature but the vulnerable code path is not present in our build — dependency is compiled with the affected module disabled","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"riskAdjustment","requirementId":"SV-258020","baselineRef":"RHEL9-STIG","impact":{"value":0.3},"reason":"CVE-123 is in a dead code path, unreachable from any entry point","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"poam","requirementId":"SV-258001","baselineRef":"RHEL9-STIG","status":"failed","reason":"Patch requires vendor release, expected Q2 2026","appliedBy":{"type":"email","identifier":"sysadmin@agency.gov"},"appliedAt":"2026-01-20T09:00:00Z","expiresAt":"2026-07-01T00:00:00Z","milestones":[{"description":"Vendor patch release","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"},{"description":"Apply patch to all servers","estimatedCompletion":"2026-05-01T00:00:00Z","status":"pending"}]},{"type":"inherited","requirementId":"SV-230368","baselineRef":"RHEL9-STIG","status":"notApplicable","reason":"IA-2 is a common control provided by Keycloak SSO. This application has no local authentication mechanism.","inheritedFrom":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","appliedBy":{"type":"email","identifier":"issm@agency.gov"},"appliedAt":"2026-03-26T10:00:00Z","expiresAt":"2026-09-26T00:00:00Z"},{"type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"Vulnerable code path is not present in our build — dependency compiled with the affected module disabled","justification":"vulnerable_code_not_present","appliedBy":{"type":"email","identifier":"secops@org.gov"},"appliedAt":"2026-05-01T10:00:00Z","expiresAt":"2027-05-01T00:00:00Z","affectedPackages":[{"purl":"pkg:npm/lodash@4.17.20"},{"purl":"pkg:rpm/openssl@1.1.1k-2.el8","fixedInVersion":"1.1.1k-3.el8"}]}],"title":"Standalone Override"}}};

package/dist/schemas/hdf-comparison.schema.json

@@ -4929,7 +4929,7 @@
               "items": {
                 "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"
               },
-              "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
+              "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Array order is NOT significant: consumers resolve the governing override by appliedAt (the most recently applied non-expired one), never by position. Earlier revisions of this description asked for most-recent-first, but nothing enforces it and producers commonly append, so position is frequently the opposite of recency. Preserves full audit trail."
             },
             "poams": {
               "type": "array",

package/dist/schemas/hdf-requirement-change-event.schema.json

@@ -2130,7 +2130,7 @@
               "items": {
                 "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"
               },
-              "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
+              "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Array order is NOT significant: consumers resolve the governing override by appliedAt (the most recently applied non-expired one), never by position. Earlier revisions of this description asked for most-recent-first, but nothing enforces it and producers commonly append, so position is frequently the opposite of recency. Preserves full audit trail."
             },
             "poams": {
               "type": "array",

package/dist/schemas/hdf-results.schema.json

@@ -304,7 +304,7 @@
           "items": {
             "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"
           },
-          "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
+          "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Array order is NOT significant: consumers resolve the governing override by appliedAt (the most recently applied non-expired one), never by position. Earlier revisions of this description asked for most-recent-first, but nothing enforces it and producers commonly append, so position is frequently the opposite of recency. Preserves full audit trail."
         },
         "poams": {
           "type": "array",

package/dist/ts/hdf.d.ts

@@ -637,8 +637,11 @@ export interface EvaluatedRequirement {
     /**
      * Chronological history of all overrides applied to this requirement. Overrides are
      * intentional changes to the compliance status and/or impact score (waivers, attestations,
-     * false positives, risk adjustments). Most recent override should be first in array.
-     * Preserves full audit trail.
+     * false positives, risk adjustments). Array order is NOT significant: consumers resolve the
+     * governing override by appliedAt (the most recently applied non-expired one), never by
+     * position. Earlier revisions of this description asked for most-recent-first, but nothing
+     * enforces it and producers commonly append, so position is frequently the opposite of
+     * recency. Preserves full audit trail.
      */
     statusOverrides?: StatusOverride[];
     /**

package/dist/ts/hdf.ts

@@ -643,8 +643,11 @@ export interface EvaluatedRequirement {
     /**
      * Chronological history of all overrides applied to this requirement. Overrides are
      * intentional changes to the compliance status and/or impact score (waivers, attestations,
-     * false positives, risk adjustments). Most recent override should be first in array.
-     * Preserves full audit trail.
+     * false positives, risk adjustments). Array order is NOT significant: consumers resolve the
+     * governing override by appliedAt (the most recently applied non-expired one), never by
+     * position. Earlier revisions of this description asked for most-recent-first, but nothing
+     * enforces it and producers commonly append, so position is frequently the opposite of
+     * recency. Preserves full audit trail.
      */
     statusOverrides?: StatusOverride[];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/hdf-schema",
-  "version": "3.7.1",
+  "version": "3.7.2-rc.1",
   "description": "JSON schemas and multi-language type definitions for Heimdall Data Format (HDF)",
   "publishConfig": {
     "access": "public"
@@ -65,19 +65,17 @@
   "dependencies": {
     "ajv": "^8.17.0",
     "ajv-formats": "^3.0.0",
-    "@mitre/hdf-utilities": "^3.7.1"
+    "@mitre/hdf-utilities": "^3.7.2-rc.1"
   },
   "devDependencies": {
     "@hyperjump/json-schema": "^1.17.2",
     "concurrently": "^9.2.1",
-    "cpy-cli": "^7.0.0",
     "http-server": "^14.1.1",
-    "nodemon": "^3.1.11",
     "quicktype-core": "^23.0.0",
     "tsx": "^4.20.6"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=24.0.0"
   },
   "keywords": [
     "hdf",
@@ -90,10 +88,10 @@
   ],
   "scripts": {
     "build": "pnpm run clean && pnpm run build:schemas && pnpm run build:types && pnpm run build:index",
-    "build:schemas": "node --import tsx src/bundle-schemas.ts && cpy 'dist/schemas/*.schema.json' '../hdf-validators/go/schemas/' --flat",
+    "build:schemas": "node --import tsx src/bundle-schemas.ts && node --import tsx src/sync-validator-schemas.ts",
     "build:types": "node --import tsx src/generate-types.ts",
     "build:index": "node --import tsx src/create-index.ts",
-    "watch:schemas": "nodemon --watch src/schemas --ext json --exec 'tsx src/bundle-schemas.ts'",
+    "watch:schemas": "node --watch-path=src/schemas --import tsx src/bundle-schemas.ts",
     "serve:schemas": "npx http-server dist/schemas -p 8081 --cors",
     "dev:viewer": "pnpm run build:schemas && concurrently \"pnpm run watch:schemas\" \"pnpm run serve:schemas\"",
     "clean": "rimraf dist",