@mitre/hdf-diff 3.2.0 → 3.3.1

package/dist/index.js

@@ -1,4 +1,5 @@
 import { validateComparison as validateComparison$1 } from "@mitre/hdf-validators";
+import { parseCvssVector } from "@mitre/hdf-utilities";
 //#region src/status.ts
 /** Status severity ranking — higher index = worse */
 const STATUS_SEVERITY = [
@@ -9,9 +10,9 @@ const STATUS_SEVERITY = [
 	"error"
 ];
 /** Statuses that count as "passing" for fixed/regressed classification */
-const PASSING_STATUSES = new Set(["passed"]);
+const PASSING_STATUSES = /* @__PURE__ */ new Set(["passed"]);
 /** Statuses that count as "failing" for fixed/regressed classification */
-const FAILING_STATUSES = new Set([
+const FAILING_STATUSES = /* @__PURE__ */ new Set([
 	"failed",
 	"error",
 	"notReviewed"
@@ -406,6 +407,65 @@ function extractCcis$1(req) {
 	return cci.filter((c) => typeof c === "string");
 }
 /**
+* Extract CWE identifiers from a requirement.
+*
+* Prefers the structured `req.cwe[]` field (introduced in Evaluated_Requirement
+* Wave 1) when present and non-empty. Falls back to `tags.cwe` for compatibility
+* with HDF files emitted before the structured field existed. `tags.cwe` may be
+* either an array of strings or a single string.
+*
+* Exported for reuse by sibling matchers (e.g. srg-cci-tiebreak) and to make
+* the preference order directly testable.
+*/
+function extractCwes$1(req) {
+	const cwe = req["cwe"];
+	if (Array.isArray(cwe)) {
+		const filtered = cwe.filter((c) => typeof c === "string");
+		if (filtered.length > 0) return filtered;
+	}
+	const tags = req["tags"];
+	if (!tags) return [];
+	const tagCwe = tags["cwe"];
+	if (Array.isArray(tagCwe)) return tagCwe.filter((c) => typeof c === "string");
+	if (typeof tagCwe === "string") return [tagCwe];
+	return [];
+}
+/**
+* Build a key → [requirement-indices] map for unambiguous-pair lookup.
+*/
+function indexByKey(reqs, keys) {
+	const map = /* @__PURE__ */ new Map();
+	for (let i = 0; i < reqs.length; i++) for (const key of keys(reqs[i])) {
+		const list = map.get(key);
+		if (list) list.push(i);
+		else map.set(key, [i]);
+	}
+	return map;
+}
+/**
+* Pair indices by an unambiguous shared key (exactly 1 old + 1 new per key),
+* skipping any indices already claimed in `matchedOld` / `matchedNew`.
+*/
+function pairUnambiguous(oldMap, newMap, matchedOld, matchedNew) {
+	const pairs = [];
+	const allKeys = /* @__PURE__ */ new Set([...oldMap.keys(), ...newMap.keys()]);
+	for (const key of allKeys) {
+		const oldIndices = oldMap.get(key) ?? [];
+		const newIndices = newMap.get(key) ?? [];
+		if (oldIndices.length !== 1 || newIndices.length !== 1) continue;
+		const oldIdx = oldIndices[0];
+		const newIdx = newIndices[0];
+		if (matchedOld.has(oldIdx) || matchedNew.has(newIdx)) continue;
+		pairs.push({
+			oldIdx,
+			newIdx
+		});
+		matchedOld.add(oldIdx);
+		matchedNew.add(newIdx);
+	}
+	return pairs;
+}
+/**
 * Create a CCI-based matching strategy.
 *
 * Matches requirements that share the same CCI identifier in `tags.cci`.
@@ -414,58 +474,51 @@ function extractCcis$1(req) {
 * by multiple old or multiple new requirements) are skipped, and those
 * requirements are left unmatched.
 *
-* Confidence is 0.8 for unambiguous matches.
+* As a fallback, also pairs unambiguous CWE matches (preferring the
+* structured `req.cwe[]` field over the legacy `tags.cwe`). This catches
+* CVE-ecosystem findings where CCI is absent but CWE is present.
+*
+* Confidence is 0.8 for CCI matches and 0.6 for CWE-fallback matches.
 */
 function createCciMatchStrategy() {
 	return {
 		name: "cciMatch",
 		match(oldReqs, newReqs) {
-			const result = {
-				matched: [],
-				unmatchedOld: [],
-				unmatchedNew: []
-			};
-			const oldCciMap = /* @__PURE__ */ new Map();
-			for (let i = 0; i < oldReqs.length; i++) for (const cci of extractCcis$1(oldReqs[i])) {
-				const list = oldCciMap.get(cci);
-				if (list) list.push(i);
-				else oldCciMap.set(cci, [i]);
-			}
-			const newCciMap = /* @__PURE__ */ new Map();
-			for (let i = 0; i < newReqs.length; i++) for (const cci of extractCcis$1(newReqs[i])) {
-				const list = newCciMap.get(cci);
-				if (list) list.push(i);
-				else newCciMap.set(cci, [i]);
-			}
 			const matchedOldIndices = /* @__PURE__ */ new Set();
 			const matchedNewIndices = /* @__PURE__ */ new Set();
-			const allCcis = new Set([...oldCciMap.keys(), ...newCciMap.keys()]);
-			for (const cci of allCcis) {
-				const oldIndices = oldCciMap.get(cci) ?? [];
-				const newIndices = newCciMap.get(cci) ?? [];
-				if (oldIndices.length !== 1 || newIndices.length !== 1) continue;
-				const oldIdx = oldIndices[0];
-				const newIdx = newIndices[0];
-				if (matchedOldIndices.has(oldIdx) || matchedNewIndices.has(newIdx)) continue;
-				result.matched.push({
-					oldReq: oldReqs[oldIdx],
-					newReq: newReqs[newIdx],
-					strategy: "cciMatch",
-					confidence: .8
-				});
-				matchedOldIndices.add(oldIdx);
-				matchedNewIndices.add(newIdx);
-			}
-			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) result.unmatchedOld.push(oldReqs[i]);
-			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) result.unmatchedNew.push(newReqs[i]);
-			return result;
+			const matched = [];
+			const oldCciMap = indexByKey(oldReqs, extractCcis$1);
+			const newCciMap = indexByKey(newReqs, extractCcis$1);
+			for (const { oldIdx, newIdx } of pairUnambiguous(oldCciMap, newCciMap, matchedOldIndices, matchedNewIndices)) matched.push({
+				oldReq: oldReqs[oldIdx],
+				newReq: newReqs[newIdx],
+				strategy: "cciMatch",
+				confidence: .8
+			});
+			const oldCweMap = indexByKey(oldReqs, (r) => extractCwes$1(r));
+			const newCweMap = indexByKey(newReqs, (r) => extractCwes$1(r));
+			for (const { oldIdx, newIdx } of pairUnambiguous(oldCweMap, newCweMap, matchedOldIndices, matchedNewIndices)) matched.push({
+				oldReq: oldReqs[oldIdx],
+				newReq: newReqs[newIdx],
+				strategy: "cciMatch",
+				confidence: .6
+			});
+			const unmatchedOld = [];
+			for (let i = 0; i < oldReqs.length; i++) if (!matchedOldIndices.has(i)) unmatchedOld.push(oldReqs[i]);
+			const unmatchedNew = [];
+			for (let i = 0; i < newReqs.length; i++) if (!matchedNewIndices.has(i)) unmatchedNew.push(newReqs[i]);
+			return {
+				matched,
+				unmatchedOld,
+				unmatchedNew
+			};
 		}
 	};
 }
 //#endregion
 //#region src/matching/fuzzy-match.ts
 /** Common English stop words to exclude from tokenization */
-const STOP_WORDS = new Set([
+const STOP_WORDS = /* @__PURE__ */ new Set([
 	"a",
 	"an",
 	"the",
@@ -756,6 +809,28 @@ function extractCcis(req) {
 	return new Set(cci.filter((c) => typeof c === "string"));
 }
 /**
+* Extract CWE identifiers from a requirement.
+*
+* Prefers the structured `req.cwe[]` field (introduced in Evaluated_Requirement
+* Wave 1) when present and non-empty. Falls back to `tags.cwe` (array or string)
+* for compatibility with HDF files emitted before the structured field existed.
+*
+* Exported so callers and tests can verify the preference order directly.
+*/
+function extractCwes(req) {
+	const cwe = req["cwe"];
+	if (Array.isArray(cwe)) {
+		const filtered = cwe.filter((c) => typeof c === "string");
+		if (filtered.length > 0) return new Set(filtered);
+	}
+	const tags = req["tags"];
+	if (!tags) return /* @__PURE__ */ new Set();
+	const tagCwe = tags["cwe"];
+	if (Array.isArray(tagCwe)) return new Set(tagCwe.filter((c) => typeof c === "string"));
+	if (typeof tagCwe === "string") return /* @__PURE__ */ new Set([tagCwe]);
+	return /* @__PURE__ */ new Set();
+}
+/**
 * Extract tags.gtitle from a requirement.
 */
 function extractGtitle(req) {
@@ -839,21 +914,26 @@ function createSrgCciTiebreakStrategy() {
 					if (matchedNewIndices.has(ni)) continue;
 					const newCcis = extractCcis(newReqs[ni]);
 					const newTitle = safeTitle$1(newReqs[ni]);
+					const newCwes = extractCwes(newReqs[ni]);
 					let bestIdx = -1;
 					let bestComposite = -1;
 					let bestCci = 0;
+					let bestCwe = -1;
 					let bestIsUnclaimed = false;
 					for (const oi of oldIdxList) {
 						const oldCcis = extractCcis(oldReqs[oi]);
 						const oldTitle = safeTitle$1(oldReqs[oi]);
+						const oldCwes = extractCwes(oldReqs[oi]);
 						const cci = cciJaccard(newCcis, oldCcis);
 						const title = tokenJaccard(newTitle, oldTitle);
+						const cwe = cciJaccard(newCwes, oldCwes);
 						const composite = CCI_WEIGHT * cci + TITLE_WEIGHT * title;
 						const isUnclaimed = !matchedOldIndices.has(oi);
-						if (bestIdx === -1 || isUnclaimed && !bestIsUnclaimed || isUnclaimed === bestIsUnclaimed && composite > bestComposite) {
+						if (bestIdx === -1 || isUnclaimed && !bestIsUnclaimed || isUnclaimed === bestIsUnclaimed && composite > bestComposite || isUnclaimed === bestIsUnclaimed && composite === bestComposite && cwe > bestCwe) {
 							bestIdx = oi;
 							bestComposite = composite;
 							bestCci = cci;
+							bestCwe = cwe;
 							bestIsUnclaimed = isUnclaimed;
 						}
 					}
@@ -888,7 +968,7 @@ function createSrgCciTiebreakStrategy() {
 /** Default threshold for accepting a Levenshtein match. */
 const DEFAULT_ACCEPT_THRESHOLD = .45;
 /** Modal verbs that mark the start of compliance statements. */
-const COMPLIANCE_MODALS = new Set([
+const COMPLIANCE_MODALS = /* @__PURE__ */ new Set([
 	"must",
 	"will",
 	"shall",
@@ -1482,7 +1562,7 @@ function comparePair(oldNormalized, newNormalized, oldTimestamp, newTimestamp, t
 	for (const b of oldBaselines) oldBaselineMap.set(b.name, b);
 	const newBaselineMap = /* @__PURE__ */ new Map();
 	for (const b of newBaselines) newBaselineMap.set(b.name, b);
-	const allBaselineNames = new Set([...oldBaselineMap.keys(), ...newBaselineMap.keys()]);
+	const allBaselineNames = /* @__PURE__ */ new Set([...oldBaselineMap.keys(), ...newBaselineMap.keys()]);
 	const baselineDiffs = [];
 	for (const name of allBaselineNames) {
 		const oldB = oldBaselineMap.get(name);
@@ -1575,13 +1655,26 @@ function comparePair(oldNormalized, newNormalized, oldTimestamp, newTimestamp, t
 		requirementDiffs
 	};
 }
+/** Field names handled by dedicated CVE-ecosystem diff handlers (not generic JSON compare). */
+const CVE_ECOSYSTEM_FIELDS = /* @__PURE__ */ new Set([
+	"cvss",
+	"epss",
+	"kev",
+	"cwe",
+	"affectedPackages"
+]);
 /**
 * Compute field-level changes for tracked fields between two requirements.
 * Uses JSON Patch-like op/path format.
+*
+* Always runs the CVE-ecosystem handlers (cvss, epss, kev, cwe, affectedPackages)
+* in addition to whatever scalar fields are in trackedFields, since these
+* structured types need richer diff than generic JSON comparison provides.
 */
 function computeFieldChanges(oldReq, newReq, trackedFields) {
 	const changes = [];
 	for (const field of trackedFields) {
+		if (CVE_ECOSYSTEM_FIELDS.has(field)) continue;
 		const oldVal = oldReq[field];
 		const newVal = newReq[field];
 		if (JSON.stringify(oldVal) !== JSON.stringify(newVal)) if (oldVal === void 0 && newVal !== void 0) changes.push({
@@ -1601,6 +1694,367 @@ function computeFieldChanges(oldReq, newReq, trackedFields) {
 			newValue: newVal
 		});
 	}
+	changes.push(...diffCvssArray(oldReq["cvss"], newReq["cvss"]));
+	changes.push(...diffEpss(oldReq["epss"], newReq["epss"]));
+	changes.push(...diffKev(oldReq["kev"], newReq["kev"]));
+	changes.push(...diffCweSet(oldReq["cwe"], newReq["cwe"]));
+	changes.push(...diffAffectedPackages(oldReq["affectedPackages"], newReq["affectedPackages"]));
+	return changes;
+}
+const CVSS_VECTOR_FIELDS = [
+	"baseVector",
+	"threatVector",
+	"environmentalVector",
+	"supplementalVector"
+];
+/**
+* Parse a CVSS vector string into a map of metric-code → value.
+*
+* Accepts both v3.x ("CVSS:3.1/AV:N/AC:L/...") and v4.0 ("CVSS:4.0/AV:N/...")
+* shapes, plus partial vectors that omit the version prefix (e.g., the
+* `threatVector` field is conventionally just the threat metrics).
+*
+* Returns `null` for inputs that don't look like CVSS vectors so callers
+* can fall back to a scalar string compare.
+*
+* Delegates to `parseCvssVector` from `@mitre/hdf-utilities` but adapts the
+* return shape: returns null for empty/unparseable inputs so call sites can
+* fall back to scalar string compare.
+*/
+function parseCvssVector$1(vec) {
+	if (typeof vec !== "string" || vec.length === 0) return null;
+	const parsed = parseCvssVector(vec);
+	if (parsed.metrics.size === 0) return null;
+	return {
+		version: parsed.version === "unknown" ? void 0 : parsed.version,
+		metrics: parsed.metrics
+	};
+}
+/**
+* Diff a single pair of cvss entries (same source). Emits per-field changes
+* including decomposed per-metric vector diffs.
+*/
+function diffCvssEntry(source, oldEntry, newEntry) {
+	const changes = [];
+	const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldEntry), ...Object.keys(newEntry)]);
+	for (const key of allKeys) {
+		if (key === "source") continue;
+		const oldVal = oldEntry[key];
+		const newVal = newEntry[key];
+		if (JSON.stringify(oldVal) === JSON.stringify(newVal)) continue;
+		if (CVSS_VECTOR_FIELDS.includes(key)) {
+			if (typeof oldVal === "string" && typeof newVal === "string") {
+				const oldParsed = parseCvssVector$1(oldVal);
+				const newParsed = parseCvssVector$1(newVal);
+				if (oldParsed && newParsed) {
+					const metricKeys = /* @__PURE__ */ new Set([...oldParsed.metrics.keys(), ...newParsed.metrics.keys()]);
+					for (const m of metricKeys) {
+						const o = oldParsed.metrics.get(m);
+						const n = newParsed.metrics.get(m);
+						if (o === n) continue;
+						if (o === void 0 && n !== void 0) changes.push({
+							op: "add",
+							path: `cvss[${source}].${key}.${m}`,
+							newValue: n
+						});
+						else if (o !== void 0 && n === void 0) changes.push({
+							op: "remove",
+							path: `cvss[${source}].${key}.${m}`,
+							oldValue: o
+						});
+						else changes.push({
+							op: "replace",
+							path: `cvss[${source}].${key}.${m}`,
+							oldValue: o,
+							newValue: n
+						});
+					}
+					continue;
+				}
+			} else if (oldVal === void 0 && typeof newVal === "string") {
+				const parsed = parseCvssVector$1(newVal);
+				if (parsed) {
+					for (const [m, v] of parsed.metrics) changes.push({
+						op: "add",
+						path: `cvss[${source}].${key}.${m}`,
+						newValue: v
+					});
+					continue;
+				}
+			} else if (typeof oldVal === "string" && newVal === void 0) {
+				const parsed = parseCvssVector$1(oldVal);
+				if (parsed) {
+					for (const [m, v] of parsed.metrics) changes.push({
+						op: "remove",
+						path: `cvss[${source}].${key}.${m}`,
+						oldValue: v
+					});
+					continue;
+				}
+			}
+		}
+		if (oldVal === void 0) changes.push({
+			op: "add",
+			path: `cvss[${source}].${key}`,
+			newValue: newVal
+		});
+		else if (newVal === void 0) changes.push({
+			op: "remove",
+			path: `cvss[${source}].${key}`,
+			oldValue: oldVal
+		});
+		else changes.push({
+			op: "replace",
+			path: `cvss[${source}].${key}`,
+			oldValue: oldVal,
+			newValue: newVal
+		});
+	}
+	return changes;
+}
+/**
+* Diff old vs new cvss[] arrays. Entries are matched by `source` (CVE ID
+* or scoring authority); added/removed entries emit whole-entry add/remove
+* records; matched pairs are decomposed via diffCvssEntry.
+*/
+function diffCvssArray(oldField, newField) {
+	const oldArr = Array.isArray(oldField) ? oldField : [];
+	const newArr = Array.isArray(newField) ? newField : [];
+	if (oldArr.length === 0 && newArr.length === 0) return [];
+	const oldBySource = /* @__PURE__ */ new Map();
+	for (const e of oldArr) if (typeof e?.source === "string") oldBySource.set(e.source, e);
+	const newBySource = /* @__PURE__ */ new Map();
+	for (const e of newArr) if (typeof e?.source === "string") newBySource.set(e.source, e);
+	const changes = [];
+	const allSources = /* @__PURE__ */ new Set([...oldBySource.keys(), ...newBySource.keys()]);
+	for (const source of allSources) {
+		const o = oldBySource.get(source);
+		const n = newBySource.get(source);
+		if (o && !n) changes.push({
+			op: "remove",
+			path: `cvss[${source}]`,
+			oldValue: o
+		});
+		else if (!o && n) changes.push({
+			op: "add",
+			path: `cvss[${source}]`,
+			newValue: n
+		});
+		else if (o && n) changes.push(...diffCvssEntry(source, o, n));
+	}
+	return changes;
+}
+/** Diff the optional `epss` object (score, percentile, date). */
+function diffEpss(oldField, newField) {
+	if (oldField === void 0 && newField === void 0) return [];
+	if (oldField === void 0) return [{
+		op: "add",
+		path: "epss",
+		newValue: newField
+	}];
+	if (newField === void 0) return [{
+		op: "remove",
+		path: "epss",
+		oldValue: oldField
+	}];
+	if (typeof oldField !== "object" || typeof newField !== "object" || oldField === null || newField === null) {
+		if (JSON.stringify(oldField) === JSON.stringify(newField)) return [];
+		return [{
+			op: "replace",
+			path: "epss",
+			oldValue: oldField,
+			newValue: newField
+		}];
+	}
+	const oldObj = oldField;
+	const newObj = newField;
+	const changes = [];
+	const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldObj), ...Object.keys(newObj)]);
+	for (const key of allKeys) {
+		const o = oldObj[key];
+		const n = newObj[key];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (o === void 0) changes.push({
+			op: "add",
+			path: `epss.${key}`,
+			newValue: n
+		});
+		else if (n === void 0) changes.push({
+			op: "remove",
+			path: `epss.${key}`,
+			oldValue: o
+		});
+		else changes.push({
+			op: "replace",
+			path: `epss.${key}`,
+			oldValue: o,
+			newValue: n
+		});
+	}
+	return changes;
+}
+/**
+* Diff the optional `kev` object. Flips of `inKev` from false→true (or
+* fresh add with `inKev: true`) get an annotated `message` field calling
+* out the CISA KEV catalog inclusion.
+*/
+function diffKev(oldField, newField) {
+	if (oldField === void 0 && newField === void 0) return [];
+	if (oldField === void 0) {
+		const change = {
+			op: "add",
+			path: "kev",
+			newValue: newField
+		};
+		const nObj = newField;
+		if (nObj && nObj["inKev"] === true) change.message = `Newly added to CISA KEV catalog as of ${typeof nObj["dateAdded"] === "string" ? nObj["dateAdded"] : "unknown date"}`;
+		return [change];
+	}
+	if (newField === void 0) return [{
+		op: "remove",
+		path: "kev",
+		oldValue: oldField
+	}];
+	if (typeof oldField !== "object" || typeof newField !== "object" || oldField === null || newField === null) {
+		if (JSON.stringify(oldField) === JSON.stringify(newField)) return [];
+		return [{
+			op: "replace",
+			path: "kev",
+			oldValue: oldField,
+			newValue: newField
+		}];
+	}
+	const oldObj = oldField;
+	const newObj = newField;
+	const changes = [];
+	const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldObj), ...Object.keys(newObj)]);
+	for (const key of allKeys) {
+		const o = oldObj[key];
+		const n = newObj[key];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		let change;
+		if (o === void 0) change = {
+			op: "add",
+			path: `kev.${key}`,
+			newValue: n
+		};
+		else if (n === void 0) change = {
+			op: "remove",
+			path: `kev.${key}`,
+			oldValue: o
+		};
+		else change = {
+			op: "replace",
+			path: `kev.${key}`,
+			oldValue: o,
+			newValue: n
+		};
+		if (key === "inKev" && o === false && n === true) {
+			const dateAdded = typeof newObj["dateAdded"] === "string" ? newObj["dateAdded"] : "unknown date";
+			change.message = `Newly added to CISA KEV catalog as of ${dateAdded}`;
+		}
+		changes.push(change);
+	}
+	return changes;
+}
+/** Diff the `cwe[]` field as a set — order does not matter. */
+function diffCweSet(oldField, newField) {
+	const toSet = (v) => {
+		if (!Array.isArray(v)) return /* @__PURE__ */ new Set();
+		return new Set(v.filter((x) => typeof x === "string"));
+	};
+	const oldSet = toSet(oldField);
+	const newSet = toSet(newField);
+	if (oldSet.size === 0 && newSet.size === 0) return [];
+	const changes = [];
+	for (const c of newSet) if (!oldSet.has(c)) changes.push({
+		op: "add",
+		path: "cwe",
+		newValue: c
+	});
+	for (const c of oldSet) if (!newSet.has(c)) changes.push({
+		op: "remove",
+		path: "cwe",
+		oldValue: c
+	});
+	return changes;
+}
+/** Build the natural key for an AffectedPackage: `name@version`. */
+function packageKey(pkg) {
+	const name = pkg?.name;
+	const version = pkg?.version;
+	if (typeof name !== "string" || name.length === 0) return null;
+	if (typeof version !== "string" || version.length === 0) return null;
+	return `${name}@${version}`;
+}
+/**
+* Diff a single pair of affectedPackages entries (matched by name+version).
+* Emits per-field changes for cpe / purl / fixedInVersion and any other
+* non-key fields that differ.
+*/
+function diffAffectedPackageEntry(key, oldPkg, newPkg) {
+	const changes = [];
+	const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldPkg), ...Object.keys(newPkg)]);
+	for (const k of allKeys) {
+		if (k === "name" || k === "version") continue;
+		const o = oldPkg[k];
+		const n = newPkg[k];
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (o === void 0) changes.push({
+			op: "add",
+			path: `affectedPackages[${key}].${k}`,
+			newValue: n
+		});
+		else if (n === void 0) changes.push({
+			op: "remove",
+			path: `affectedPackages[${key}].${k}`,
+			oldValue: o
+		});
+		else changes.push({
+			op: "replace",
+			path: `affectedPackages[${key}].${k}`,
+			oldValue: o,
+			newValue: n
+		});
+	}
+	return changes;
+}
+/**
+* Diff old vs new affectedPackages[] arrays. Entries are matched by the
+* `name@version` tuple; added/removed packages emit whole-entry records;
+* matched pairs are decomposed via diffAffectedPackageEntry.
+*/
+function diffAffectedPackages(oldField, newField) {
+	const oldArr = Array.isArray(oldField) ? oldField : [];
+	const newArr = Array.isArray(newField) ? newField : [];
+	if (oldArr.length === 0 && newArr.length === 0) return [];
+	const oldByKey = /* @__PURE__ */ new Map();
+	for (const p of oldArr) {
+		const k = packageKey(p);
+		if (k) oldByKey.set(k, p);
+	}
+	const newByKey = /* @__PURE__ */ new Map();
+	for (const p of newArr) {
+		const k = packageKey(p);
+		if (k) newByKey.set(k, p);
+	}
+	const changes = [];
+	const allKeys = /* @__PURE__ */ new Set([...oldByKey.keys(), ...newByKey.keys()]);
+	for (const key of allKeys) {
+		const o = oldByKey.get(key);
+		const n = newByKey.get(key);
+		if (o && !n) changes.push({
+			op: "remove",
+			path: `affectedPackages[${key}]`,
+			oldValue: o
+		});
+		else if (!o && n) changes.push({
+			op: "add",
+			path: `affectedPackages[${key}]`,
+			newValue: n
+		});
+		else if (o && n) changes.push(...diffAffectedPackageEntry(key, o, n));
+	}
 	return changes;
 }
 /**
@@ -1915,7 +2369,7 @@ function diffDataFlows(oldSystem, newSystem) {
 	for (const f of oldFlows) oldMap.set(flowKey(f), f);
 	const newMap = /* @__PURE__ */ new Map();
 	for (const f of newFlows) newMap.set(flowKey(f), f);
-	const allKeys = new Set([...oldMap.keys(), ...newMap.keys()]);
+	const allKeys = /* @__PURE__ */ new Set([...oldMap.keys(), ...newMap.keys()]);
 	const changes = [];
 	for (const key of allKeys) {
 		const oldF = oldMap.get(key);
@@ -2077,7 +2531,7 @@ function stripSnapshots(req) {
 	return rest;
 }
 /**
-* Render an HdfComparison as a JSON string.
+* Render an HDFComparison as a JSON string.
 *
 * - `detail: 'summary'` -- only `{ formatVersion, comparisonMode, summary }`
 * - `detail: 'control'` -- full document but `before`/`after` stripped from requirementDiffs
@@ -2191,7 +2645,7 @@ function renderStateSection(state, diffs, detail) {
 	return lines.join("\n");
 }
 /**
-* Render an HdfComparison as a Markdown string.
+* Render an HDFComparison as a Markdown string.
 *
 * - `detail: 'summary'` -- summary table only
 * - `detail: 'control'` -- summary + per-requirement tables by state
@@ -2327,7 +2781,7 @@ function buildHeaderLine(comparison, useColor) {
 	return header;
 }
 /**
-* Render an HdfComparison for terminal display with optional ANSI colors.
+* Render an HDFComparison for terminal display with optional ANSI colors.
 *
 * - `detail: 'summary'` -- just the summary line
 * - `detail: 'control'` -- requirement list + summary (excludes unchanged)
@@ -2380,7 +2834,7 @@ function formatFieldChanges(req) {
 	}).join("; ");
 }
 /**
-* Render an HdfComparison as a CSV string.
+* Render an HDFComparison as a CSV string.
 *
 * One row per requirement. Columns:
 * - ID, Title, State, Old Status, New Status, Impact (Old), Impact (New), Change Reasons
@@ -2426,7 +2880,7 @@ function renderCsv(comparison, options) {
 /**
 * Convenience function to render a comparison in any supported format.
 *
-* @param comparison - The HdfComparison document to render
+* @param comparison - The HDFComparison document to render
 * @param format - Output format: 'json', 'markdown', 'terminal', or 'csv'
 * @param options - Rendering options (detail level, filters, color)
 * @returns The rendered string