@mitre/hdf-diff 3.1.0 → 3.3.0

package/dist/index.js

@@ -1,4 +1,5 @@
 import { validateComparison as validateComparison$1 } from "@mitre/hdf-validators";
+import { parseCvssVector } from "@mitre/hdf-utilities";
 //#region src/status.ts
 /** Status severity ranking — higher index = worse */
 const STATUS_SEVERITY = [
@@ -398,7 +399,7 @@ function createMappedIdStrategy(mapping) {
 * Extract CCI identifiers from a requirement's tags.
 * Looks for `tags.cci` as an array of strings.
 */
-function extractCcis(req) {
+function extractCcis$1(req) {
 	const tags = req["tags"];
 	if (!tags) return [];
 	const cci = tags["cci"];
@@ -406,6 +407,65 @@ function extractCcis(req) {
 	return cci.filter((c) => typeof c === "string");
 }
 /**
+* Extract CWE identifiers from a requirement.
+*
+* Prefers the structured `req.cwe[]` field (introduced in Evaluated_Requirement
+* Wave 1) when present and non-empty. Falls back to `tags.cwe` for compatibility
+* with HDF files emitted before the structured field existed. `tags.cwe` may be
+* either an array of strings or a single string.
+*
+* Exported for reuse by sibling matchers (e.g. srg-cci-tiebreak) and to make
+* the preference order directly testable.
+*/
+function extractCwes$1(req) {
+	const cwe = req["cwe"];
+	if (Array.isArray(cwe)) {
+		const filtered = cwe.filter((c) => typeof c === "string");
+		if (filtered.length > 0) return filtered;
+	}
+	const tags = req["tags"];
+	if (!tags) return [];
+	const tagCwe = tags["cwe"];
+	if (Array.isArray(tagCwe)) return tagCwe.filter((c) => typeof c === "string");
+	if (typeof tagCwe === "string") return [tagCwe];
+	return [];
+}
+/**
+* Build a key → [requirement-indices] map for unambiguous-pair lookup.
+*/
+function indexByKey(reqs, keys) {
+	const map = /* @__PURE__ */ new Map();
+	for (let i = 0; i < reqs.length; i++) for (const key of keys(reqs[i])) {
+		const list = map.get(key);
+		if (list) list.push(i);
+		else map.set(key, [i]);
+	}
+	return map;
+}
+/**
+* Pair indices by an unambiguous shared key (exactly 1 old + 1 new per key),
+* skipping any indices already claimed in `matchedOld` / `matchedNew`.
+*/
+function pairUnambiguous(oldMap, newMap, matchedOld, matchedNew) {
+	const pairs = [];
+	const allKeys = new Set([...oldMap.keys(), ...newMap.keys()]);
+	for (const key of allKeys) {
+		const oldIndices = oldMap.get(key) ?? [];
+		const newIndices = newMap.get(key) ?? [];
+		if (oldIndices.length !== 1 || newIndices.length !== 1) continue;
+		const oldIdx = oldIndices[0];
+		const newIdx = newIndices[0];
+		if (matchedOld.has(oldIdx) || matchedNew.has(newIdx)) continue;
+		pairs.push({
+			oldIdx,
+			newIdx
+		});
+		matchedOld.add(oldIdx);
+		matchedNew.add(newIdx);
+	}
+	return pairs;
+}
+/**
 * Create a CCI-based matching strategy.
 *
 * Matches requirements that share the same CCI identifier in `tags.cci`.
@@ -414,51 +474,44 @@ function extractCcis(req) {
 * by multiple old or multiple new requirements) are skipped, and those
 * requirements are left unmatched.
 *
-* Confidence is 0.8 for unambiguous matches.
+* As a fallback, also pairs unambiguous CWE matches (preferring the
+* structured `req.cwe[]` field over the legacy `tags.cwe`). This catches
+* CVE-ecosystem findings where CCI is absent but CWE is present.
+*
+* Confidence is 0.8 for CCI matches and 0.6 for CWE-fallback matches.
 */
 function createCciMatchStrategy() {
 	return {
 		name: "cciMatch",
 		match(oldReqs, newReqs) {
-			const result = {
-				matched: [],
-				unmatchedOld: [],
-				unmatchedNew: []
-			};
-			const oldCciMap = /* @__PURE__ */ new Map();
-			for (let i = 0; i < oldReqs.length; i++) for (const cci of extractCcis(oldReqs[i])) {
-				const list = oldCciMap.get(cci);
-				if (list) list.push(i);
-				else oldCciMap.set(cci, [i]);
-			}
-			const newCciMap = /* @__PURE__ */ new Map();
-			for (let i = 0; i < newReqs.length; i++) for (const cci of extractCcis(newReqs[i])) {
-				const list = newCciMap.get(cci);
-				if (list) list.push(i);
-				else newCciMap.set(cci, [i]);
-			}
 			const matchedOldIndices = /* @__PURE__ */ new Set();
 			const matchedNewIndices = /* @__PURE__ */ new Set();
-			const allCcis = new Set([...oldCciMap.keys(), ...newCciMap.keys()]);
-			for (const cci of allCcis) {
-				const oldIndices = oldCciMap.get(cci) ?? [];
-				const newIndices = newCciMap.get(cci) ?? [];
-				if (oldIndices.length !== 1 || newIndices.length !== 1) continue;
-				const oldIdx = oldIndices[0];
-				const newIdx = newIndices[0];
-				if (matchedOldIndices.has(oldIdx) || matchedNewIndices.has(newIdx)) continue;
-				result.matched.push({
-					oldReq: oldReqs[oldIdx],
-					newReq: newReqs[newIdx],
-					strategy: "cciMatch",
-					confidence: .8
-				});
-				matchedOldIndices.add(oldIdx);
-				matchedNewIndices.add(newIdx);
-			}
-			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) result.unmatchedOld.push(oldReqs[i]);
-			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) result.unmatchedNew.push(newReqs[i]);
-			return result;
+			const matched = [];
+			const oldCciMap = indexByKey(oldReqs, extractCcis$1);
+			const newCciMap = indexByKey(newReqs, extractCcis$1);
+			for (const { oldIdx, newIdx } of pairUnambiguous(oldCciMap, newCciMap, matchedOldIndices, matchedNewIndices)) matched.push({
+				oldReq: oldReqs[oldIdx],
+				newReq: newReqs[newIdx],
+				strategy: "cciMatch",
+				confidence: .8
+			});
+			const oldCweMap = indexByKey(oldReqs, (r) => extractCwes$1(r));
+			const newCweMap = indexByKey(newReqs, (r) => extractCwes$1(r));
+			for (const { oldIdx, newIdx } of pairUnambiguous(oldCweMap, newCweMap, matchedOldIndices, matchedNewIndices)) matched.push({
+				oldReq: oldReqs[oldIdx],
+				newReq: newReqs[newIdx],
+				strategy: "cciMatch",
+				confidence: .6
+			});
+			const unmatchedOld = [];
+			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) unmatchedOld.push(oldReqs[i]);
+			const unmatchedNew = [];
+			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) unmatchedNew.push(newReqs[i]);
+			return {
+				matched,
+				unmatchedOld,
+				unmatchedNew
+			};
 		}
 	};
 }
@@ -648,6 +701,437 @@ function createFuzzyTitleStrategy(minConfidence) {
 	};
 }
 //#endregion
+//#region src/matching/srg-deterministic.ts
+/**
+* Extract the SRG-OS ID from a requirement's tags.gtitle field.
+* Returns null if missing or not a string.
+*/
+function extractGtitle$1(req) {
+	const tags = req["tags"];
+	if (!tags) return null;
+	const gtitle = tags["gtitle"];
+	if (typeof gtitle !== "string" || gtitle === "") return null;
+	return gtitle;
+}
+/**
+* Create a deterministic SRG matching strategy (Tier 1 of the delta pipeline).
+*
+* Matches requirements by exact `tags.gtitle` (SRG-OS requirement ID).
+*
+* For each gtitle shared between old and new:
+* - 1 old + 1 new → single MatchPair (confidence 1.0, relationship "primary")
+* - 1 new + N old → N MatchPairs (first old "primary", rest "related")
+* - N new + 1 old → N MatchPairs (first new "primary", rest "related")
+* - N:M (both > 1) → skip, leave for fallback strategies
+*
+* Requirements without a gtitle pass through as unmatched.
+*/
+function createSrgDeterministicStrategy() {
+	return {
+		name: "srgDeterministic",
+		match(oldReqs, newReqs) {
+			const oldGtitleMap = /* @__PURE__ */ new Map();
+			for (let i = 0; i < oldReqs.length; i++) {
+				const g = extractGtitle$1(oldReqs[i]);
+				if (g) {
+					const list = oldGtitleMap.get(g);
+					if (list) list.push(i);
+					else oldGtitleMap.set(g, [i]);
+				}
+			}
+			const newGtitleMap = /* @__PURE__ */ new Map();
+			for (let i = 0; i < newReqs.length; i++) {
+				const g = extractGtitle$1(newReqs[i]);
+				if (g) {
+					const list = newGtitleMap.get(g);
+					if (list) list.push(i);
+					else newGtitleMap.set(g, [i]);
+				}
+			}
+			const matched = [];
+			const matchedOldIndices = /* @__PURE__ */ new Set();
+			const matchedNewIndices = /* @__PURE__ */ new Set();
+			const claimedOldIndices = /* @__PURE__ */ new Set();
+			for (const [gtitle, newIdxList] of newGtitleMap) {
+				const oldIdxList = oldGtitleMap.get(gtitle);
+				if (!oldIdxList || oldIdxList.length === 0) continue;
+				const nc = newIdxList.length;
+				const oc = oldIdxList.length;
+				if (nc > 1 && oc > 1) continue;
+				for (const ni of newIdxList) {
+					let primaryOldSet = false;
+					for (const oi of oldIdxList) {
+						let relationship;
+						if (oc === 1) {
+							relationship = claimedOldIndices.has(oi) ? "related" : "primary";
+							if (relationship === "primary") claimedOldIndices.add(oi);
+						} else {
+							relationship = primaryOldSet ? "related" : "primary";
+							primaryOldSet = true;
+						}
+						matched.push({
+							oldReq: oldReqs[oi],
+							newReq: newReqs[ni],
+							strategy: "srgDeterministic",
+							confidence: 1,
+							relationship
+						});
+						matchedOldIndices.add(oi);
+					}
+					matchedNewIndices.add(ni);
+				}
+			}
+			const unmatchedOld = [];
+			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) unmatchedOld.push(oldReqs[i]);
+			const unmatchedNew = [];
+			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) unmatchedNew.push(newReqs[i]);
+			return {
+				matched,
+				unmatchedOld,
+				unmatchedNew
+			};
+		}
+	};
+}
+//#endregion
+//#region src/matching/srg-cci-tiebreak.ts
+/** Composite score weights matching SAF CLI's Tier 2. */
+const CCI_WEIGHT = .7;
+const TITLE_WEIGHT = .3;
+/**
+* Extract CCI identifiers from a requirement's tags.cci.
+*/
+function extractCcis(req) {
+	const tags = req["tags"];
+	if (!tags) return /* @__PURE__ */ new Set();
+	const cci = tags["cci"];
+	if (!Array.isArray(cci)) return /* @__PURE__ */ new Set();
+	return new Set(cci.filter((c) => typeof c === "string"));
+}
+/**
+* Extract CWE identifiers from a requirement.
+*
+* Prefers the structured `req.cwe[]` field (introduced in Evaluated_Requirement
+* Wave 1) when present and non-empty. Falls back to `tags.cwe` (array or string)
+* for compatibility with HDF files emitted before the structured field existed.
+*
+* Exported so callers and tests can verify the preference order directly.
+*/
+function extractCwes(req) {
+	const cwe = req["cwe"];
+	if (Array.isArray(cwe)) {
+		const filtered = cwe.filter((c) => typeof c === "string");
+		if (filtered.length > 0) return new Set(filtered);
+	}
+	const tags = req["tags"];
+	if (!tags) return /* @__PURE__ */ new Set();
+	const tagCwe = tags["cwe"];
+	if (Array.isArray(tagCwe)) return new Set(tagCwe.filter((c) => typeof c === "string"));
+	if (typeof tagCwe === "string") return new Set([tagCwe]);
+	return /* @__PURE__ */ new Set();
+}
+/**
+* Extract tags.gtitle from a requirement.
+*/
+function extractGtitle(req) {
+	const tags = req["tags"];
+	if (!tags) return null;
+	const gtitle = tags["gtitle"];
+	if (typeof gtitle !== "string" || gtitle === "") return null;
+	return gtitle;
+}
+/**
+* Extract title from a requirement.
+*/
+function safeTitle$1(req) {
+	const title = req["title"];
+	return typeof title === "string" ? title : "";
+}
+/**
+* Jaccard similarity between two sets.
+*/
+function cciJaccard(a, b) {
+	if (a.size === 0 && b.size === 0) return 0;
+	let intersectionSize = 0;
+	for (const x of a) if (b.has(x)) intersectionSize++;
+	const unionSize = a.size + b.size - intersectionSize;
+	return intersectionSize / unionSize;
+}
+/**
+* Simple whitespace-split token Jaccard similarity.
+*/
+function tokenJaccard(a, b) {
+	const ta = new Set(a.toLowerCase().split(/\s+/).filter((t) => t.length > 0));
+	const tb = new Set(b.toLowerCase().split(/\s+/).filter((t) => t.length > 0));
+	if (ta.size === 0 || tb.size === 0) return 0;
+	let intersectionSize = 0;
+	for (const x of ta) if (tb.has(x)) intersectionSize++;
+	const unionSize = ta.size + tb.size - intersectionSize;
+	return intersectionSize / unionSize;
+}
+/**
+* Create an SRG CCI Tiebreak matching strategy (Tier 2 of the delta pipeline).
+*
+* Handles ambiguous SRG matches where multiple old or new requirements share
+* the same tags.gtitle. Uses a composite score of CCI Jaccard (70%) and
+* token Jaccard on titles (30%) to pick the best match.
+*
+* Only activates for gtitle groups with multiple candidates (>1 old or >1 new).
+* 1:1 matches are left for srgDeterministic (Tier 1).
+*/
+function createSrgCciTiebreakStrategy() {
+	return {
+		name: "srgCciTiebreak",
+		match(oldReqs, newReqs) {
+			const oldGtitleMap = /* @__PURE__ */ new Map();
+			for (let i = 0; i < oldReqs.length; i++) {
+				const g = extractGtitle(oldReqs[i]);
+				if (g) {
+					const list = oldGtitleMap.get(g);
+					if (list) list.push(i);
+					else oldGtitleMap.set(g, [i]);
+				}
+			}
+			const newGtitleMap = /* @__PURE__ */ new Map();
+			for (let i = 0; i < newReqs.length; i++) {
+				const g = extractGtitle(newReqs[i]);
+				if (g) {
+					const list = newGtitleMap.get(g);
+					if (list) list.push(i);
+					else newGtitleMap.set(g, [i]);
+				}
+			}
+			const matched = [];
+			const matchedOldIndices = /* @__PURE__ */ new Set();
+			const matchedNewIndices = /* @__PURE__ */ new Set();
+			for (const [gtitle, newIdxList] of newGtitleMap) {
+				const oldIdxList = oldGtitleMap.get(gtitle);
+				if (!oldIdxList || oldIdxList.length === 0) continue;
+				const nc = newIdxList.length;
+				const oc = oldIdxList.length;
+				if (nc === 1 && oc === 1) continue;
+				for (const ni of newIdxList) {
+					if (matchedNewIndices.has(ni)) continue;
+					const newCcis = extractCcis(newReqs[ni]);
+					const newTitle = safeTitle$1(newReqs[ni]);
+					const newCwes = extractCwes(newReqs[ni]);
+					let bestIdx = -1;
+					let bestComposite = -1;
+					let bestCci = 0;
+					let bestCwe = -1;
+					let bestIsUnclaimed = false;
+					for (const oi of oldIdxList) {
+						const oldCcis = extractCcis(oldReqs[oi]);
+						const oldTitle = safeTitle$1(oldReqs[oi]);
+						const oldCwes = extractCwes(oldReqs[oi]);
+						const cci = cciJaccard(newCcis, oldCcis);
+						const title = tokenJaccard(newTitle, oldTitle);
+						const cwe = cciJaccard(newCwes, oldCwes);
+						const composite = CCI_WEIGHT * cci + TITLE_WEIGHT * title;
+						const isUnclaimed = !matchedOldIndices.has(oi);
+						if (bestIdx === -1 || isUnclaimed && !bestIsUnclaimed || isUnclaimed === bestIsUnclaimed && composite > bestComposite || isUnclaimed === bestIsUnclaimed && composite === bestComposite && cwe > bestCwe) {
+							bestIdx = oi;
+							bestComposite = composite;
+							bestCci = cci;
+							bestCwe = cwe;
+							bestIsUnclaimed = isUnclaimed;
+						}
+					}
+					if (bestIdx >= 0) {
+						const relationship = matchedOldIndices.has(bestIdx) ? "related" : "primary";
+						matched.push({
+							oldReq: oldReqs[bestIdx],
+							newReq: newReqs[ni],
+							strategy: "srgCciTiebreak",
+							confidence: Math.max(bestCci, 0),
+							relationship
+						});
+						matchedOldIndices.add(bestIdx);
+						matchedNewIndices.add(ni);
+					}
+				}
+			}
+			const unmatchedOld = [];
+			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) unmatchedOld.push(oldReqs[i]);
+			const unmatchedNew = [];
+			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) unmatchedNew.push(newReqs[i]);
+			return {
+				matched,
+				unmatchedOld,
+				unmatchedNew
+			};
+		}
+	};
+}
+//#endregion
+//#region src/matching/vendor-fuzzy-title.ts
+/** Default threshold for accepting a Levenshtein match. */
+const DEFAULT_ACCEPT_THRESHOLD = .45;
+/** Modal verbs that mark the start of compliance statements. */
+const COMPLIANCE_MODALS = new Set([
+	"must",
+	"will",
+	"shall",
+	"should",
+	"may",
+	"needs"
+]);
+/**
+* Compute the Levenshtein edit distance between two strings.
+*/
+function levenshteinDistance(a, b) {
+	const m = a.length;
+	const n = b.length;
+	if (m === 0) return n;
+	if (n === 0) return m;
+	let prev = new Array(n + 1);
+	let curr = new Array(n + 1);
+	for (let j = 0; j <= n; j++) prev[j] = j;
+	for (let i = 1; i <= m; i++) {
+		curr[0] = i;
+		for (let j = 1; j <= n; j++) {
+			const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+			curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+		}
+		[prev, curr] = [curr, prev];
+	}
+	return prev[n];
+}
+/**
+* Normalized Levenshtein distance (0.0 = identical, 1.0 = completely different).
+*/
+function normalizedLevenshtein(a, b) {
+	const maxLen = Math.max(a.length, b.length);
+	if (maxLen === 0) return 0;
+	return levenshteinDistance(a, b) / maxLen;
+}
+/**
+* Extract tokens before the first modal verb in a title.
+*/
+function tokensBeforeModal(title) {
+	const tokens = title.split(/\s+/).filter((t) => t.length > 0);
+	const modalIdx = tokens.findIndex((t) => COMPLIANCE_MODALS.has(t.toLowerCase()));
+	return modalIdx === -1 ? tokens : tokens.slice(0, modalIdx);
+}
+/**
+* Auto-detect the dominant vendor prefix in a corpus of titles.
+*
+* Tries progressively shorter leading-token prefixes. Returns the prefix
+* that appears in > 50% of titles, stopping before modal verbs.
+* Returns '' when no prefix reaches the threshold.
+*/
+function autoDetectPrefix(titles, threshold = .5) {
+	if (titles.length === 0) return "";
+	const leading = titles.map((t) => tokensBeforeModal(t));
+	const maxLen = Math.max(...leading.map((l) => l.length));
+	for (let n = maxLen; n > 0; n--) {
+		const counts = /* @__PURE__ */ new Map();
+		for (const l of leading) if (l.length >= n) {
+			const key = l.slice(0, n).join(" ");
+			counts.set(key, (counts.get(key) ?? 0) + 1);
+		}
+		let bestKey = "";
+		let bestCount = 0;
+		for (const [key, count] of counts) if (count > bestCount) {
+			bestKey = key;
+			bestCount = count;
+		}
+		if (bestCount / titles.length > threshold) return bestKey;
+	}
+	return "";
+}
+/**
+* Strip a detected vendor prefix from a title.
+*/
+function normalizeTitle(title, prefix) {
+	if (!prefix) return title;
+	if (title === prefix) return "";
+	if (title.startsWith(prefix + " ")) return title.slice(prefix.length + 1);
+	return title;
+}
+/**
+* Extract title string from a requirement.
+*/
+function safeTitle(req) {
+	const title = req["title"];
+	return typeof title === "string" ? title : "";
+}
+/**
+* Create a vendor fuzzy title matching strategy (Tier 3 of the delta pipeline).
+*
+* Cross-vendor matching with auto-detected vendor prefix stripping.
+* Uses normalized Levenshtein distance to compare titles after removing
+* the dominant vendor prefix (e.g., "RHEL 9" or "Amazon Linux 2023").
+*
+* Accepts matches below threshold 0.45 (confidence = 1.0 - distance).
+* Greedy best-match.
+*
+* @param acceptThreshold Max normalized Levenshtein distance to accept (default: 0.45)
+*/
+function createVendorFuzzyTitleStrategy(acceptThreshold) {
+	const threshold = acceptThreshold ?? DEFAULT_ACCEPT_THRESHOLD;
+	return {
+		name: "vendorFuzzyTitle",
+		match(oldReqs, newReqs) {
+			const oldTitles = oldReqs.map(safeTitle).filter((t) => t.length > 0);
+			const newTitles = newReqs.map(safeTitle).filter((t) => t.length > 0);
+			const oldPrefix = autoDetectPrefix(oldTitles);
+			const newPrefix = autoDetectPrefix(newTitles);
+			const oldNorm = [];
+			for (let i = 0; i < oldReqs.length; i++) {
+				const t = safeTitle(oldReqs[i]);
+				if (t) oldNorm.push({
+					idx: i,
+					normalized: normalizeTitle(t, oldPrefix)
+				});
+			}
+			const newNorm = [];
+			for (let i = 0; i < newReqs.length; i++) {
+				const t = safeTitle(newReqs[i]);
+				if (t) newNorm.push({
+					idx: i,
+					normalized: normalizeTitle(t, newPrefix)
+				});
+			}
+			const candidates = [];
+			for (const old of oldNorm) for (const nw of newNorm) {
+				if (!old.normalized || !nw.normalized) continue;
+				const dist = normalizedLevenshtein(old.normalized, nw.normalized);
+				if (dist < threshold) candidates.push({
+					oldIdx: old.idx,
+					newIdx: nw.idx,
+					distance: dist
+				});
+			}
+			candidates.sort((a, b) => a.distance - b.distance);
+			const matched = [];
+			const matchedOldIndices = /* @__PURE__ */ new Set();
+			const matchedNewIndices = /* @__PURE__ */ new Set();
+			for (const c of candidates) {
+				if (matchedOldIndices.has(c.oldIdx) || matchedNewIndices.has(c.newIdx)) continue;
+				matched.push({
+					oldReq: oldReqs[c.oldIdx],
+					newReq: newReqs[c.newIdx],
+					strategy: "vendorFuzzyTitle",
+					confidence: 1 - c.distance,
+					relationship: "primary"
+				});
+				matchedOldIndices.add(c.oldIdx);
+				matchedNewIndices.add(c.newIdx);
+			}
+			const unmatchedOld = [];
+			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) unmatchedOld.push(oldReqs[i]);
+			const unmatchedNew = [];
+			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) unmatchedNew.push(newReqs[i]);
+			return {
+				matched,
+				unmatchedOld,
+				unmatchedNew
+			};
+		}
+	};
+}
+//#endregion
 //#region src/matching/index.ts
 /**
 * Create a strategy instance by name, using the provided options for
@@ -659,6 +1143,9 @@ function createStrategy(name, options) {
 		case "mappedId": return createMappedIdStrategy(options.mappingTable ?? {});
 		case "cciMatch": return createCciMatchStrategy();
 		case "fuzzyTitle": return createFuzzyTitleStrategy(options.minConfidence);
+		case "srgDeterministic": return createSrgDeterministicStrategy();
+		case "srgCciTiebreak": return createSrgCciTiebreakStrategy();
+		case "vendorFuzzyTitle": return createVendorFuzzyTitleStrategy(options.minConfidence !== void 0 && options.minConfidence > 0 ? 1 - options.minConfidence : void 0);
 		default: throw new Error(`Unknown matching strategy: '${name}'`);
 	}
 }
@@ -1168,13 +1655,26 @@ function comparePair(oldNormalized, newNormalized, oldTimestamp, newTimestamp, t
 		requirementDiffs
 	};
 }
+/** Field names handled by dedicated CVE-ecosystem diff handlers (not generic JSON compare). */
+const CVE_ECOSYSTEM_FIELDS = new Set([
+	"cvss",
+	"epss",
+	"kev",
+	"cwe",
+	"affectedPackages"
+]);
 /**
 * Compute field-level changes for tracked fields between two requirements.
 * Uses JSON Patch-like op/path format.
+*
+* Always runs the CVE-ecosystem handlers (cvss, epss, kev, cwe, affectedPackages)
+* in addition to whatever scalar fields are in trackedFields, since these
+* structured types need richer diff than generic JSON comparison provides.
 */
 function computeFieldChanges(oldReq, newReq, trackedFields) {
 	const changes = [];
 	for (const field of trackedFields) {
+		if (CVE_ECOSYSTEM_FIELDS.has(field)) continue;
 		const oldVal = oldReq[field];
 		const newVal = newReq[field];
 		if (JSON.stringify(oldVal) !== JSON.stringify(newVal)) if (oldVal === void 0 && newVal !== void 0) changes.push({
@@ -1194,6 +1694,367 @@ function computeFieldChanges(oldReq, newReq, trackedFields) {
 			newValue: newVal
 		});
 	}
+	changes.push(...diffCvssArray(oldReq["cvss"], newReq["cvss"]));
+	changes.push(...diffEpss(oldReq["epss"], newReq["epss"]));
+	changes.push(...diffKev(oldReq["kev"], newReq["kev"]));
+	changes.push(...diffCweSet(oldReq["cwe"], newReq["cwe"]));
+	changes.push(...diffAffectedPackages(oldReq["affectedPackages"], newReq["affectedPackages"]));
+	return changes;
+}
+const CVSS_VECTOR_FIELDS = [
+	"baseVector",
+	"threatVector",
+	"environmentalVector",
+	"supplementalVector"
+];
+/**
+* Parse a CVSS vector string into a map of metric-code → value.
+*
+* Accepts both v3.x ("CVSS:3.1/AV:N/AC:L/...") and v4.0 ("CVSS:4.0/AV:N/...")
+* shapes, plus partial vectors that omit the version prefix (e.g., the
+* `threatVector` field is conventionally just the threat metrics).
+*
+* Returns `null` for inputs that don't look like CVSS vectors so callers
+* can fall back to a scalar string compare.
+*
+* Delegates to `parseCvssVector` from `@mitre/hdf-utilities` but adapts the
+* return shape: returns null for empty/unparseable inputs so call sites can
+* fall back to scalar string compare.
+*/
+function parseCvssVector$1(vec) {
+	if (typeof vec !== "string" || vec.length === 0) return null;
+	const parsed = parseCvssVector(vec);
+	if (parsed.metrics.size === 0) return null;
+	return {
+		version: parsed.version === "unknown" ? void 0 : parsed.version,
+		metrics: parsed.metrics
+	};
+}
+/**
+* Diff a single pair of cvss entries (same source). Emits per-field changes
+* including decomposed per-metric vector diffs.
+*/
+function diffCvssEntry(source, oldEntry, newEntry) {
+	const changes = [];
+	const allKeys = new Set([...Object.keys(oldEntry), ...Object.keys(newEntry)]);
+	for (const key of allKeys) {
+		if (key === "source") continue;
+		const oldVal = oldEntry[key];
+		const newVal = newEntry[key];
+		if (JSON.stringify(oldVal) === JSON.stringify(newVal)) continue;
+		if (CVSS_VECTOR_FIELDS.includes(key)) {
+			if (typeof oldVal === "string" && typeof newVal === "string") {
+				const oldParsed = parseCvssVector$1(oldVal);
+				const newParsed = parseCvssVector$1(newVal);
+				if (oldParsed && newParsed) {
+					const metricKeys = new Set([...oldParsed.metrics.keys(), ...newParsed.metrics.keys()]);
+					for (const m of metricKeys) {
+						const o = oldParsed.metrics.get(m);
+						const n = newParsed.metrics.get(m);
+						if (o === n) continue;
+						if (o === void 0 && n !== void 0) changes.push({
+							op: "add",
+							path: `cvss[${source}].${key}.${m}`,
+							newValue: n
+						});
+						else if (o !== void 0 && n === void 0) changes.push({
+							op: "remove",
+							path: `cvss[${source}].${key}.${m}`,
+							oldValue: o
+						});
+						else changes.push({
+							op: "replace",
+							path: `cvss[${source}].${key}.${m}`,
+							oldValue: o,
+							newValue: n
+						});
+					}
+					continue;
+				}
+			} else if (oldVal === void 0 && typeof newVal === "string") {
+				const parsed = parseCvssVector$1(newVal);
+				if (parsed) {
+					for (const [m, v] of parsed.metrics) changes.push({
+						op: "add",
+						path: `cvss[${source}].${key}.${m}`,
+						newValue: v
+					});
+					continue;
+				}
+			} else if (typeof oldVal === "string" && newVal === void 0) {
+				const parsed = parseCvssVector$1(oldVal);
+				if (parsed) {
+					for (const [m, v] of parsed.metrics) changes.push({
+						op: "remove",
+						path: `cvss[${source}].${key}.${m}`,
+						oldValue: v
+					});
+					continue;
+				}
+			}
+		}
+		if (oldVal === void 0) changes.push({
+			op: "add",
+			path: `cvss[${source}].${key}`,
+			newValue: newVal
+		});
+		else if (newVal === void 0) changes.push({
+			op: "remove",
+			path: `cvss[${source}].${key}`,
+			oldValue: oldVal
+		});
+		else changes.push({
+			op: "replace",
+			path: `cvss[${source}].${key}`,
+			oldValue: oldVal,
+			newValue: newVal
+		});
+	}
+	return changes;
+}
+/**
+* Diff old vs new cvss[] arrays. Entries are matched by `source` (CVE ID
+* or scoring authority); added/removed entries emit whole-entry add/remove
+* records; matched pairs are decomposed via diffCvssEntry.
+*/
+function diffCvssArray(oldField, newField) {
+	const oldArr = Array.isArray(oldField) ? oldField : [];
+	const newArr = Array.isArray(newField) ? newField : [];
+	if (oldArr.length === 0 && newArr.length === 0) return [];
+	const oldBySource = /* @__PURE__ */ new Map();
+	for (const e of oldArr) if (typeof e?.source === "string") oldBySource.set(e.source, e);
+	const newBySource = /* @__PURE__ */ new Map();
+	for (const e of newArr) if (typeof e?.source === "string") newBySource.set(e.source, e);
+	const changes = [];
+	const allSources = new Set([...oldBySource.keys(), ...newBySource.keys()]);
+	for (const source of allSources) {
+		const o = oldBySource.get(source);
+		const n = newBySource.get(source);
+		if (o && !n) changes.push({
+			op: "remove",
+			path: `cvss[${source}]`,
+			oldValue: o
+		});
+		else if (!o && n) changes.push({
+			op: "add",
+			path: `cvss[${source}]`,
+			newValue: n
+		});
+		else if (o && n) changes.push(...diffCvssEntry(source, o, n));
+	}
+	return changes;
+}
+/** Diff the optional `epss` object (score, percentile, date). */
+function diffEpss(oldField, newField) {
+	if (oldField === void 0 && newField === void 0) return [];
+	if (oldField === void 0) return [{
+		op: "add",
+		path: "epss",
+		newValue: newField
+	}];
+	if (newField === void 0) return [{
+		op: "remove",
+		path: "epss",
+		oldValue: oldField
+	}];
+	if (typeof oldField !== "object" || typeof newField !== "object" || oldField === null || newField === null) {
+		if (JSON.stringify(oldField) === JSON.stringify(newField)) return [];
+		return [{
+			op: "replace",
+			path: "epss",
+			oldValue: oldField,
+			newValue: newField
+		}];
+	}
+	const oldObj = oldField;
+	const newObj = newField;
+	const changes = [];
+	const allKeys = new Set([...Object.keys(oldObj), ...Object.keys(newObj)]);
+	for (const key of allKeys) {
+		const o = oldObj[key];
+		const n = newObj[key];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (o === void 0) changes.push({
+			op: "add",
+			path: `epss.${key}`,
+			newValue: n
+		});
+		else if (n === void 0) changes.push({
+			op: "remove",
+			path: `epss.${key}`,
+			oldValue: o
+		});
+		else changes.push({
+			op: "replace",
+			path: `epss.${key}`,
+			oldValue: o,
+			newValue: n
+		});
+	}
+	return changes;
+}
+/**
+* Diff the optional `kev` object. Flips of `inKev` from false→true (or
+* fresh add with `inKev: true`) get an annotated `message` field calling
+* out the CISA KEV catalog inclusion.
+*/
+function diffKev(oldField, newField) {
+	if (oldField === void 0 && newField === void 0) return [];
+	if (oldField === void 0) {
+		const change = {
+			op: "add",
+			path: "kev",
+			newValue: newField
+		};
+		const nObj = newField;
+		if (nObj && nObj["inKev"] === true) change.message = `Newly added to CISA KEV catalog as of ${typeof nObj["dateAdded"] === "string" ? nObj["dateAdded"] : "unknown date"}`;
+		return [change];
+	}
+	if (newField === void 0) return [{
+		op: "remove",
+		path: "kev",
+		oldValue: oldField
+	}];
+	if (typeof oldField !== "object" || typeof newField !== "object" || oldField === null || newField === null) {
+		if (JSON.stringify(oldField) === JSON.stringify(newField)) return [];
+		return [{
+			op: "replace",
+			path: "kev",
+			oldValue: oldField,
+			newValue: newField
+		}];
+	}
+	const oldObj = oldField;
+	const newObj = newField;
+	const changes = [];
+	const allKeys = new Set([...Object.keys(oldObj), ...Object.keys(newObj)]);
+	for (const key of allKeys) {
+		const o = oldObj[key];
+		const n = newObj[key];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		let change;
+		if (o === void 0) change = {
+			op: "add",
+			path: `kev.${key}`,
+			newValue: n
+		};
+		else if (n === void 0) change = {
+			op: "remove",
+			path: `kev.${key}`,
+			oldValue: o
+		};
+		else change = {
+			op: "replace",
+			path: `kev.${key}`,
+			oldValue: o,
+			newValue: n
+		};
+		if (key === "inKev" && o === false && n === true) {
+			const dateAdded = typeof newObj["dateAdded"] === "string" ? newObj["dateAdded"] : "unknown date";
+			change.message = `Newly added to CISA KEV catalog as of ${dateAdded}`;
+		}
+		changes.push(change);
+	}
+	return changes;
+}
+/** Diff the `cwe[]` field as a set — order does not matter. */
+function diffCweSet(oldField, newField) {
+	const toSet = (v) => {
+		if (!Array.isArray(v)) return /* @__PURE__ */ new Set();
+		return new Set(v.filter((x) => typeof x === "string"));
+	};
+	const oldSet = toSet(oldField);
+	const newSet = toSet(newField);
+	if (oldSet.size === 0 && newSet.size === 0) return [];
+	const changes = [];
+	for (const c of newSet) if (!oldSet.has(c)) changes.push({
+		op: "add",
+		path: "cwe",
+		newValue: c
+	});
+	for (const c of oldSet) if (!newSet.has(c)) changes.push({
+		op: "remove",
+		path: "cwe",
+		oldValue: c
+	});
+	return changes;
+}
+/** Build the natural key for an AffectedPackage: `name@version`. */
+function packageKey(pkg) {
+	const name = pkg?.name;
+	const version = pkg?.version;
+	if (typeof name !== "string" || name.length === 0) return null;
+	if (typeof version !== "string" || version.length === 0) return null;
+	return `${name}@${version}`;
+}
+/**
+* Diff a single pair of affectedPackages entries (matched by name+version).
+* Emits per-field changes for cpe / purl / fixedInVersion and any other
+* non-key fields that differ.
+*/
+function diffAffectedPackageEntry(key, oldPkg, newPkg) {
+	const changes = [];
+	const allKeys = new Set([...Object.keys(oldPkg), ...Object.keys(newPkg)]);
+	for (const k of allKeys) {
+		if (k === "name" || k === "version") continue;
+		const o = oldPkg[k];
+		const n = newPkg[k];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (o === void 0) changes.push({
+			op: "add",
+			path: `affectedPackages[${key}].${k}`,
+			newValue: n
+		});
+		else if (n === void 0) changes.push({
+			op: "remove",
+			path: `affectedPackages[${key}].${k}`,
+			oldValue: o
+		});
+		else changes.push({
+			op: "replace",
+			path: `affectedPackages[${key}].${k}`,
+			oldValue: o,
+			newValue: n
+		});
+	}
+	return changes;
+}
+/**
+* Diff old vs new affectedPackages[] arrays. Entries are matched by the
+* `name@version` tuple; added/removed packages emit whole-entry records;
+* matched pairs are decomposed via diffAffectedPackageEntry.
+*/
+function diffAffectedPackages(oldField, newField) {
+	const oldArr = Array.isArray(oldField) ? oldField : [];
+	const newArr = Array.isArray(newField) ? newField : [];
+	if (oldArr.length === 0 && newArr.length === 0) return [];
+	const oldByKey = /* @__PURE__ */ new Map();
+	for (const p of oldArr) {
+		const k = packageKey(p);
+		if (k) oldByKey.set(k, p);
+	}
+	const newByKey = /* @__PURE__ */ new Map();
+	for (const p of newArr) {
+		const k = packageKey(p);
+		if (k) newByKey.set(k, p);
+	}
+	const changes = [];
+	const allKeys = new Set([...oldByKey.keys(), ...newByKey.keys()]);
+	for (const key of allKeys) {
+		const o = oldByKey.get(key);
+		const n = newByKey.get(key);
+		if (o && !n) changes.push({
+			op: "remove",
+			path: `affectedPackages[${key}]`,
+			oldValue: o
+		});
+		else if (!o && n) changes.push({
+			op: "add",
+			path: `affectedPackages[${key}]`,
+			newValue: n
+		});
+		else if (o && n) changes.push(...diffAffectedPackageEntry(key, o, n));
+	}
 	return changes;
 }
 /**
@@ -1670,7 +2531,7 @@ function stripSnapshots(req) {
 	return rest;
 }
 /**
-* Render an HdfComparison as a JSON string.
+* Render an HDFComparison as a JSON string.
 *
 * - `detail: 'summary'` -- only `{ formatVersion, comparisonMode, summary }`
 * - `detail: 'control'` -- full document but `before`/`after` stripped from requirementDiffs
@@ -1784,7 +2645,7 @@ function renderStateSection(state, diffs, detail) {
 	return lines.join("\n");
 }
 /**
-* Render an HdfComparison as a Markdown string.
+* Render an HDFComparison as a Markdown string.
 *
 * - `detail: 'summary'` -- summary table only
 * - `detail: 'control'` -- summary + per-requirement tables by state
@@ -1920,7 +2781,7 @@ function buildHeaderLine(comparison, useColor) {
 	return header;
 }
 /**
-* Render an HdfComparison for terminal display with optional ANSI colors.
+* Render an HDFComparison for terminal display with optional ANSI colors.
 *
 * - `detail: 'summary'` -- just the summary line
 * - `detail: 'control'` -- requirement list + summary (excludes unchanged)
@@ -1973,7 +2834,7 @@ function formatFieldChanges(req) {
 	}).join("; ");
 }
 /**
-* Render an HdfComparison as a CSV string.
+* Render an HDFComparison as a CSV string.
 *
 * One row per requirement. Columns:
 * - ID, Title, State, Old Status, New Status, Impact (Old), Impact (New), Change Reasons
@@ -2019,7 +2880,7 @@ function renderCsv(comparison, options) {
 /**
 * Convenience function to render a comparison in any supported format.
 *
-* @param comparison - The HdfComparison document to render
+* @param comparison - The HDFComparison document to render
 * @param format - Output format: 'json', 'markdown', 'terminal', or 'csv'
 * @param options - Rendering options (detail level, filters, color)
 * @returns The rendered string
@@ -2033,6 +2894,6 @@ function render(comparison, format, options) {
 	}
 }
 //#endregion
-export { EXIT_DETAILED_BASELINE_CHANGED, EXIT_DETAILED_DRIFT_ONLY, EXIT_DETAILED_ERROR, EXIT_DETAILED_FIXES_ONLY, EXIT_DETAILED_IDENTICAL, EXIT_DETAILED_MIXED, EXIT_DETAILED_REGRESSIONS_ONLY, EXIT_DIFFERENCES, EXIT_ERROR, EXIT_IDENTICAL, classifyChangeReasons, classifyDiffStatus, computeDetailedExitCode, computeEffectiveStatus, computeExitCode, computeSummary, createCciMatchStrategy, createExactIdStrategy, createFuzzyTitleStrategy, createMappedIdStrategy, diffBaselines, diffHdf, diffSboms, diffSystems, isV1Format, jaccardSimilarity, matchRequirements, normalizeToV2, render, renderCsv, renderJson, renderMarkdown, renderTerminal, tokenize, validateComparison };
+export { EXIT_DETAILED_BASELINE_CHANGED, EXIT_DETAILED_DRIFT_ONLY, EXIT_DETAILED_ERROR, EXIT_DETAILED_FIXES_ONLY, EXIT_DETAILED_IDENTICAL, EXIT_DETAILED_MIXED, EXIT_DETAILED_REGRESSIONS_ONLY, EXIT_DIFFERENCES, EXIT_ERROR, EXIT_IDENTICAL, classifyChangeReasons, classifyDiffStatus, computeDetailedExitCode, computeEffectiveStatus, computeExitCode, computeSummary, createCciMatchStrategy, createExactIdStrategy, createFuzzyTitleStrategy, createMappedIdStrategy, createSrgCciTiebreakStrategy, createSrgDeterministicStrategy, createVendorFuzzyTitleStrategy, diffBaselines, diffHdf, diffSboms, diffSystems, isV1Format, jaccardSimilarity, levenshteinDistance, matchRequirements, normalizeToV2, normalizedLevenshtein, render, renderCsv, renderJson, renderMarkdown, renderTerminal, tokenize, validateComparison };
 
 //# sourceMappingURL=index.js.map