1---
 2layout: page
 3title: Nest Imported Fields Under imports Struct
 4---
 5
 6- **ADR:** 0015
 7- **Proposal Author(s):** @jpower432
 8- **Status:** Accepted
 9
10## Context
11
12`ControlCatalog`, and `ThreatCatalog` used top-level hyphenated fields (`imported-controls`, `imported-threats`, `imported-capabilities`) to declare entries sourced from external artifacts.
13CUE cannot reference hyphenated sibling fields from hidden validation structs because quoted identifiers in expression context resolve as string literals, not field references.
14
15## Decision
16
17Replace top-level `imported-*` fields with a nested `imports` struct on each catalog type, mirroring the Policy pattern.
18
19| **Before** | **After** |
20|:---|:---|
21| `imported-controls: [...]` | `imports.controls: [...]` |
22| `imported-threats: [...]` | `imports.threats: [...]` |
23| `imported-capabilities: [...]` | `imports.capabilities: [...]` |
24
25New CUE definitions introduced:
26
27- `#ControlCatalogImports` — wraps `controls`
28- `#ThreatCatalogImports` — wraps `threats` and `capabilities`
29
30## Consequences
31
32Breaking change for any adopter using `imported-controls`, `imported-threats`, or `imported-capabilities` in YAML/JSON artifacts
33