@mitre/hdf-diff 3.3.2 → 3.4.0

package/README.md

@@ -89,16 +89,32 @@ hdf diff old-results.json new-results.json
 hdf diff old-results.json new-results.json --format markdown
 hdf diff old-results.json new-results.json --json
 
-# System drift detection
+# System drift detection (auto-detected from document type)
 hdf diff old-system.json new-system.json
 
 # SBOM comparison
-hdf diff --sbom old-sbom.json new-sbom.json
+hdf diff --sbom old.cdx.json new.cdx.json
 
-# Baseline mode (golden baseline vs current scan)
-hdf diff --mode baseline golden.json current.json
+# Encode the security outcome in the exit code (10=fixes, 11=regressions, 12=mixed, 13=baseline change)
+hdf diff old-results.json new-results.json --detailed-exitcode
 ```
 
+Example output — a scan where one requirement regressed and one was added:
+
+```console
+$ hdf diff old-results.json new-results.json
+HDF Comparison: old-results.json → new-results.json
+
+ID       Title                          Old Status  New Status  State
+-------  -----------------------------  ----------  ----------  ---------
+REQ-001  Test Requirement               passed      failed      regressed
+REQ-002  Audit logging must be enabled  -           passed      new
+
+Summary: 0 fixed, 1 regressed, 1 new, 0 absent, 0 unchanged, 0 updated (2 total)
+```
+
+The same comparison with `--format markdown` renders a GitHub-friendly table; `--json` emits an HDF Comparison document (`formatVersion`, `summary`, `requirementDiffs[]`) suitable for CI gating.
+
 ## Go usage
 
 The diff engine is also available as a Go module:

package/dist/index.d.ts

@@ -235,9 +235,13 @@ interface HDFComparison {
   baselineDiffs: BaselineDiff[];
   /** Per-requirement diffs, sorted by id */
   requirementDiffs: RequirementDiff[];
-  /** Per-component diffs (systemDrift mode only) */
+  /** Per-component diffs (systemDrift mode only). A component's BOM changes
+   * surface as a field change on its boms[]. */
   componentDiffs?: ComponentDiff[];
-  /** Per-package diffs from embedded SBOM comparison (systemDrift mode only) */
+  /** RESERVED — not emitted by the current systemDrift comparison (component
+   * BOM changes surface via componentDiffs boms[] field changes; standalone SBOM
+   * package diffing is a separate `hdf diff <sbom> <sbom>` output). Retained for
+   * a future normalized package-level diff. */
   packageDiffs?: PackageDiff[];
   /** URI identifying the system being compared (systemDrift mode only) */
   systemRef?: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/sbom.ts","../src/types.ts","../src/diff.ts","../src/status.ts","../src/summary.ts","../src/normalize.ts","../src/matching/types.ts","../src/matching/exact-id.ts","../src/matching/mapped-id.ts","../src/matching/cci-match.ts","../src/matching/fuzzy-match.ts","../src/matching/srg-deterministic.ts","../src/matching/srg-cci-tiebreak.ts","../src/matching/vendor-fuzzy-title.ts","../src/matching/index.ts","../src/validate.ts","../src/exit-codes.ts","../src/renderers/types.ts","../src/renderers/json.ts","../src/renderers/markdown.ts","../src/renderers/terminal.ts","../src/renderers/csv.ts","../src/renderers/index.ts"],"mappings":";;AAcA;;;;;;;;;;;AAMU;UANO,WAAA;EACf,IAAA;EACA,IAAA;EACA,KAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA;AAAA;;;;UAMe,cAAA;EACf,YAAA,EAAc,WAAW;EACzB,KAAA;EACA,OAAA;EACA,OAAA;EACA,SAAA;AAAA;;;AAsByE;;;;ACpC3E;;;iBDoCgB,SAAA,CAAU,OAAA,UAAiB,OAAA,WAAkB,cAAc;;;;AAvC3E;;;;;;;;;;;AAMU;AAMV;;;;KCTY,YAAA;;;;;;;ADcD;AAsBX;;;;;;;KCNY,gBAAA;ADM+D;;;AAAA,UCQ1D,WAAA;EA5CL;EA8CV,EAAA;;;AA9CsB;AA8BxB;;;;AAA4B;AAc5B;EAYE,IAAA;;EAEA,QAAA;EAZA;EAcA,QAAA;EAFA;;;;AAQO;EAAP,OAAA;AAAA;;;;UAwBe,eAAA;EAsBf;EApBA,EAAA;EAuBc;EArBd,KAAA,EAAO,gBAAA;EA0BP;EAxBA,aAAA,EAAe,YAAA;EA2BJ;EAxBX,MAAA,EAAQ,MAAA;EA8BO;EA5Bf,KAAA,EAAO,MAAA;;EAGP,KAAA;EA2BA;EAzBA,kBAAA;EA6BA;EA3BA,kBAAA;EA+BA;EA7BA,SAAA;EAiCA;EA/BA,SAAA;EAmCA;EAhCA,YAAA,EAAc,WAAA;EAkCG;EA/BjB,aAAA;EAsCe;EApCf,eAAA;;EAGA,WAAA;AAAA;;;;UAMe,iBAAA;EA+Bf;EA7BA,KAAA;EA+BQ;EA7BR,SAAA;EA+BO;EA7BP,GAAA;EA+Bc;EA7Bd,MAAA;EA6ByB;EA3BzB,SAAA;EAiC2B;EA/B3B,OAAA;EA+B2B;EA7B3B,KAAA;EAiCA;EA/BA,YAAA;EAmCA;EAjCA,iBAAA;EAiCK;EA/BL,iBAAA;AAAA;;;;;UAOe,aAAA;EAsCf;EApCA,IAAA;EAsCmB;EApCnB,KAAA;EA0Ce;EAxCf,MAAA,EAAQ,MAAA;;EAER,KAAA,EAAO,MAAA;EAwCP;EAtCA,YAAA,EAAc,WAAA;AAAA;;AA0CL;AAMX;UA1CiB,YAAA;;EAEf,IAAA;EAkDW;EAhDX,UAAA;EAoDe;EAlDf,UAAA;EAsDiB;EApDjB,KAAA;AAAA;;;;UAMe,MAAA;EAwDI;EAtDnB,IAAA;EA8BA;EA5BA,KAAA;EAgCA;EA9BA,GAAA;EAgCA;EA9BA,cAAA;EAgCA;EA9BA,mBAAA;AAAA;;;;UAMe,UAAA;EA8BE;EA5BjB,KAAA;EA8BY;EA5BZ,IAAA;EAgCA;EA9BA,SAAA;AAAA;;;;UAMe,aAAA;EA4BI;EA1BnB,aAAA;EAgCe;EA9Bf,cAAA;;EAEA,SAAA;EAgCmB;EA9BnB,OAAA,EAAS,MAAA;EAqCW;EAnCpB,QAAA,GAAW,cAAA;EAmC4B;EAjCvC,OAAA,EAAS,iBAAA;EAoCC;EAlCV,aAAA,EAAe,YAAA;;EAEf,gBAAA,EAAkB,eAAA;EAgCuB;EA9BzC,cAAA,GAAiB,aAAA;EAiCM;EA/BvB,YAAA,GAF8B,WAAA;EAiCS;EA7BvC,SAAA;EAgCU;EA9BV,KAAA,GAAQ,eAAA;;EAER,WAAA,GAAc,MAAA,SAAe,UAAA;EA4BI;EA1BjC,UAAA,GAAa,MAAA;AAAA;;AC9Of;;UDoPiB,cAAA;EC1OM;ED4OrB,eAAA;EClPA;EDoPA,mBAAmB;AAAA;;KAOT,UAAA,GAAa,gBAAgB;;KAG7B,WAAA,GAAc,iBAAiB;;KAG/B,aAAA,GAAgB,aAAa;AC7LzC;AAAA,KDgMY,OAAA,GAAU,aAAa;;;AD/QnC;;;AAAA,UEOiB,WAAA;EFNf;EEQA,aAAA;EFNA;EEQA,cAAA;EFNA;EEQA,aAAA;EFPQ;EESR,kBAAA;EFHe;EEKf,YAAA,GAAe,MAAM;;EAErB,aAAA;EFNA;EEQA,cAAA;AAAA;;;;;AFJS;AAsBX;;;;iBEwCgB,OAAA,CACd,UAAA,EAAY,MAAA,mBACZ,UAAA,EAAY,MAAA,oBAA0B,MAAA,qBACtC,OAAA,GAAU,WAAA,GACT,aAAA;;;;AF5CwE;;;;ACpC3E;iBC64BgB,aAAA,CACd,WAAA,EAAa,MAAA,mBACb,WAAA,EAAa,MAAA,mBACb,OAAA,GAAU,WAAA,GACT,aAAA;;;ADj5BqB;AA8BxB;;;;AAA4B;iBC4hCZ,WAAA,CACd,SAAA,EAAW,MAAA,mBACX,SAAA,EAAW,MAAA,mBACX,OAAA,GAAU,WAAA,GACT,aAAA;;;AFjkCH;;;;;;;;;;AAAA,iBGsBgB,sBAAA,CACd,WAAA,EAAa,MAAM,mBACnB,kBAAA;AHlBQ;AAMV;;;AANU,iBGkEM,qBAAA,CACd,MAAA,EAAQ,MAAA,mBACR,MAAA,EAAQ,MAAA,mBACR,YAAA,WACA,YAAA,YACC,YAAA;;;;;;;;AH5DQ;iBG2IK,kBAAA,CACd,kBAAA,UACA,kBAAA,WACC,gBAAgB;;;AH/JnB;;;AAAA,iBITgB,cAAA,CAAe,YAAA,EAAc,eAAA,KAAoB,iBAAiB;;;;AJSlF;;;;;;;;;;;AAMU;iBKgCM,UAAA,CAAW,GAA4B,EAAvB,MAAM;;;;;iBAQtB,aAAA,CAAc,GAAA,EAAK,MAAA,oBAA0B,MAAM;;;;AL9CnE;;UMXiB,WAAA;ENWW;EMT1B,OAAA,EAAS,SAAA;ENWT;EMTA,YAAA,EAAc,MAAA;ENWd;EMTA,YAAA,EAAc,MAAA;AAAA;;ANWN;AAMV;UMXiB,SAAA;;EAEf,MAAA,EAAQ,MAAA;ENUR;EMRA,MAAA,EAAQ,MAAM;ENSd;EMPA,QAAA;ENSA;EMPA,UAAA;ENQS;EMNT,YAAA;AAAA;;;;UAMe,aAAA;ENsB0B;EMpBzC,IAAA;ENoByE;EMlBzE,KAAA,CAAM,OAAA,EAAS,MAAA,qBAA2B,OAAA,EAAS,MAAA,sBAA4B,WAAA;AAAA;;;ANrBjF;;;;;;AAAA,iBONgB,qBAAA,IAAyB,aAAa;;;APMtD;;;;;;;;;;AAAA,iBQFgB,sBAAA,CAAuB,OAAA,EAAS,MAAA,mBAAyB,aAAa;;;ARctF;;;;;;;;;;;AAKW;AAsBX;;;AA3BA,iBS+EgB,sBAAA,IAA0B,aAAa;;;AT3FvD;;;;;;;;AAAA,iBUSgB,QAAA,CAAS,IAAA,WAAe,GAAG;;;AVHjC;AAMV;iBUYgB,iBAAA,CAAkB,CAAA,EAAG,GAAA,UAAa,CAAA,EAAG,GAAG;;;;;;;;;;iBAmCxC,wBAAA,CAAyB,aAAA,YAAyB,aAAa;;;AV3D/E;;;;;;;;;;;AAMU;AAMV;AAZA,iBWagB,8BAAA,IAAkC,aAAa;;;;AXPrD;AAMV;;;;;;;;iBYqFgB,4BAAA,IAAgC,aAAa;;;AZjG7D;;;AAAA,iBaDgB,mBAAA,CAAoB,CAAA,UAAW,CAAS;;;;iBA8BxC,qBAAA,CAAsB,CAAA,UAAW,CAAS;;;;AbZ/C;AAsBX;;;;;;;;iBauEgB,8BAAA,CAA+B,eAAA,YAA2B,aAAa;;;;;;UCtGtE,YAAA;EdIA;EcFf,QAAA;;EAEA,kBAAA;EdCA;EcCA,YAAA,GAAe,MAAM;EdArB;EcEA,aAAA;AAAA;;;AdCS;AAsBX;;;;;;;;AAA2E;;;;iBc6B3D,iBAAA,CACd,OAAA,EAAS,MAAA,qBACT,OAAA,EAAS,MAAA,qBACT,OAAA,GAAU,YAAA,GACT,WAAA;;;;AdxEH;;UeRiB,gBAAA;EfQW;EeN1B,KAAA;EfQA;EeNA,MAAM;AAAA;;;;AfUE;AAMV;;;;;iBeJgB,kBAAA,CAAmB,GAAA,YAAe,gBAAgB;;;AfRlE;AAAA,cgBXa,cAAA;AAAA,cACA,gBAAA;AAAA,cACA,UAAA;;cAGA,uBAAA;AAAA,cACA,mBAAA;AAAA,cACA,wBAAA;AAAA,cACA,8BAAA;AAAA,cACA,mBAAA;AAAA,cACA,8BAAA;AAAA,cACA,wBAAA;AhBYb;;;;;;;;;;AAAA,iBgBAgB,eAAA,CAAgB,OAA0B,EAAjB,iBAAiB;AhBK/C;AAsBX;;;;;;;;AAA2E;;;;ACpC3E;;;ADcW,iBgBkBK,uBAAA,CAAwB,OAA0B,EAAjB,iBAAiB;;;KCjDtD,WAAA;AAAA,UAEK,aAAA;EjBYW;EiBV1B,MAAA,GAAS,WAAW;EjBUM;EiBR1B,YAAA;EjBUA;EiBRA,cAAA;EjBUA;EiBRA,KAAA;AAAA;;;;;;;;;;;;iBCec,UAAA,CACd,UAAA,EAAY,aAAA,EACZ,OAAA,GAAU,aAAa;;;;;;;;;;;;iBCmGT,cAAA,CACd,UAAA,EAAY,aAAA,EACZ,OAAA,GAAU,aAAa;;;;;;;;;;;;;iBCmDT,cAAA,CACd,UAAA,EAAY,aAAA,EACZ,OAAA,GAAU,aAAa;;;;;;;;;;;;;ApBjKf;iBqBuBM,SAAA,CACd,UAAA,EAAY,aAAA,EACZ,OAAA,GAAU,aAAa;;;;;;;;ArBzBf;AAMV;;iBsBLgB,MAAA,CACd,UAAA,EAAY,aAAA,EACZ,MAAA,4CACA,OAAA,GAAU,aAAa"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/sbom.ts","../src/types.ts","../src/diff.ts","../src/status.ts","../src/summary.ts","../src/normalize.ts","../src/matching/types.ts","../src/matching/exact-id.ts","../src/matching/mapped-id.ts","../src/matching/cci-match.ts","../src/matching/fuzzy-match.ts","../src/matching/srg-deterministic.ts","../src/matching/srg-cci-tiebreak.ts","../src/matching/vendor-fuzzy-title.ts","../src/matching/index.ts","../src/validate.ts","../src/exit-codes.ts","../src/renderers/types.ts","../src/renderers/json.ts","../src/renderers/markdown.ts","../src/renderers/terminal.ts","../src/renderers/csv.ts","../src/renderers/index.ts"],"mappings":";;;;;;;;;;;;;;UAciB;EACf;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;EACf,cAAc;EACd;EACA;EACA;EACA;;;;;;;;;;;iBAsBc,UAAU,iBAAiB,kBAAkB;;;;;;;;;;;;;;;;;;;;KCpCjD;;;;;;;;;;;;;;;KA8BA;;;;UAcK;;EAEf;;;;;;;;;;EAUA;;EAEA;;EAEA;;;;;;EAMA;;;;;UAwBe;;EAEf;;EAEA,OAAO;;EAEP,eAAe;;EAGf,QAAQ;;EAER,OAAO;;EAGP;;EAEA;;EAEA;;EAEA;;EAEA;;EAGA,cAAc;;EAGd;;EAEA;;EAGA;;;;;UAMe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;UAOe;;EAEf;;EAEA;;EAEA,QAAQ;;EAER,OAAO;;EAEP,cAAc;;;;;UAMC;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UAMe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;UAMe;;EAEf;;EAEA;;EAEA;;;;;UAMe;;EAEf;;EAEA;;EAEA;;EAEA,SAAS;;EAET,WAAW;;EAEX,SAAS;;EAET,eAAe;;EAEf,kBAAkB;;;EAGlB,iBAAiB;;;;;EAKjB,eALiB;;EAOjB;;EAEA,QAAQ;;EAER,cAAc,eAAe;;EAE7B,aAAa;;;;;UAME;;EAEf;;EAEA;;;KAOU,aAAa;;KAGb,cAAc;;KAGd,gBAAgB;;KAGhB,UAAU;;;;;;UC9QL;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,eAAe;;EAEf;;EAEA;;;;;;;;;;;iBA0Dc,QACd,YAAY,yBACZ,YAAY,0BAA0B,2BACtC,UAAU,cACT;;;;;;;;;iBA6zBa,cACd,aAAa,yBACb,aAAa,yBACb,UAAU,cACT;;;;;;;;;iBAyKa,YACd,WAAW,yBACX,WAAW,yBACX,UAAU,cACT;;;;;;;;;;;;;iBCziCa,uBACd,aAAa,yBACb;;;;;iBAgDc,sBACd,QAAQ,yBACR,QAAQ,yBACR,uBACA,wBACC;;;;;;;;;iBA+Ea,mBACd,4BACA,6BACC;;;;;;iBCxKa,eAAe,cAAc,oBAAoB;;;;;;;;;;;;;;;;iBC+CjD,WAAW,KAAK;;;;;iBAQhB,cAAc,KAAK,0BAA0B;;;;;;UCzD5C;;EAEf,SAAS;;EAET,cAAc;;EAEd,cAAc;;;;;UAMC;;EAEf,QAAQ;;EAER,QAAQ;;EAER;;EAEA;;EAEA;;;;;UAMe;;EAEf;;EAEA,MAAM,SAAS,2BAA2B,SAAS,4BAA4B;;;;;;;;;;iBC3BjE,yBAAyB;;;;;;;;;;;;;iBCIzB,uBAAuB,SAAS,yBAAyB;;;;;;;;;;;;;;;;;;iBC6FzD,0BAA0B;;;;;;;;;;;iBClF1B,SAAS,eAAe;;;;;iBAexB,kBAAkB,GAAG,aAAa,GAAG;;;;;;;;;;iBAmCrC,yBAAyB,yBAAyB;;;;;;;;;;;;;;;;iBC9ClD,kCAAkC;;;;;;;;;;;;;iBCoFlC,gCAAgC;;;;;;iBClGhC,oBAAoB,WAAW;;;;iBA8B/B,sBAAsB,WAAW;;;;;;;;;;;;;iBAiFjC,+BAA+B,2BAA2B;;;;;;UCtGzD;;EAEf;;EAEA;;EAEA,eAAe;;EAEf;;;;;;;;;;;;;;;;;iBAoDc,kBACd,SAAS,2BACT,SAAS,2BACT,UAAU,eACT;;;;;;UChFc;;EAEf;;EAEA;;;;;;;;;;;iBAYc,mBAAmB,eAAe;;;;cCnBrC;cACA;cACA;;cAGA;cACA;cACA;cACA;cACA;cACA;cACA;;;;;;;;;;;iBAYG,gBAAgB,SAAS;;;;;;;;;;;;;;;;;iBAuBzB,wBAAwB,SAAS;;;KCjDrC;UAEK;;EAEf,SAAS;;EAET;;EAEA;;EAEA;;;;;;;;;;;;;iBCec,WACd,YAAY,eACZ,UAAU;;;;;;;;;;;;iBCmGI,eACd,YAAY,eACZ,UAAU;;;;;;;;;;;;;iBCmDI,eACd,YAAY,eACZ,UAAU;;;;;;;;;;;;;;iBC1II,UACd,YAAY,eACZ,UAAU;;;;;;;;;;;iBCxBI,OACd,YAAY,eACZ,kDACA,UAAU"}

package/dist/index.js

@@ -1203,165 +1203,6 @@ function validateComparison(doc) {
 	};
 }
 //#endregion
-//#region src/sbom.ts
-/**
-* Compare two SBOM documents (CycloneDX or SPDX JSON strings) and return
-* package-level diffs.
-*
-* @param oldJson - JSON string of the old SBOM document
-* @param newJson - JSON string of the new SBOM document
-* @returns Structured diff result with per-package state and aggregate counts
-* @throws Error if either input is not valid JSON or not a recognized SBOM format
-*/
-function diffSboms(oldJson, newJson) {
-	const oldParsed = JSON.parse(oldJson);
-	const newParsed = JSON.parse(newJson);
-	const oldPackages = extractPackages(oldParsed);
-	const newPackages = extractPackages(newParsed);
-	const oldMap = buildPackageMap(oldPackages);
-	const newMap = buildPackageMap(newPackages);
-	const diffs = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const [key, oldPkg] of oldMap) {
-		seen.add(key);
-		const newPkg = newMap.get(key);
-		if (newPkg) if (oldPkg.version !== newPkg.version) diffs.push({
-			purl: newPkg.purl || newPkg.name,
-			name: newPkg.name,
-			state: "updated",
-			oldVersion: oldPkg.version,
-			newVersion: newPkg.version,
-			licenses: newPkg.licenses.length > 0 ? newPkg.licenses : void 0
-		});
-		else diffs.push({
-			purl: oldPkg.purl || oldPkg.name,
-			name: oldPkg.name,
-			state: "unchanged"
-		});
-		else diffs.push({
-			purl: oldPkg.purl || oldPkg.name,
-			name: oldPkg.name,
-			state: "removed",
-			oldVersion: oldPkg.version
-		});
-	}
-	for (const [key, newPkg] of newMap) if (!seen.has(key)) diffs.push({
-		purl: newPkg.purl || newPkg.name,
-		name: newPkg.name,
-		state: "added",
-		newVersion: newPkg.version,
-		licenses: newPkg.licenses.length > 0 ? newPkg.licenses : void 0
-	});
-	diffs.sort((a, b) => a.name.localeCompare(b.name));
-	let added = 0;
-	let removed = 0;
-	let updated = 0;
-	let unchanged = 0;
-	for (const d of diffs) switch (d.state) {
-		case "added":
-			added++;
-			break;
-		case "removed":
-			removed++;
-			break;
-		case "updated":
-			updated++;
-			break;
-		case "unchanged":
-			unchanged++;
-			break;
-	}
-	return {
-		packageDiffs: diffs,
-		added,
-		removed,
-		updated,
-		unchanged
-	};
-}
-/**
-* Extract packages from an SBOM document, auto-detecting the format.
-*/
-function extractPackages(doc) {
-	if (doc["bomFormat"] === "CycloneDX") return extractCycloneDXPackages(doc);
-	if (typeof doc["spdxVersion"] === "string") return extractSPDXPackages(doc);
-	throw new Error("Unrecognized SBOM format: expected CycloneDX (bomFormat) or SPDX (spdxVersion)");
-}
-/**
-* Extract packages from a CycloneDX document.
-* Reads components[] with purl, name, version fields.
-*/
-function extractCycloneDXPackages(doc) {
-	const components = doc["components"];
-	if (!Array.isArray(components)) return [];
-	return components.map((comp) => {
-		const licenses = extractCycloneDXLicenses(comp);
-		return {
-			purl: comp["purl"] ?? "",
-			name: comp["name"] ?? "",
-			version: comp["version"] ?? "",
-			licenses
-		};
-	});
-}
-/**
-* Extract license strings from a CycloneDX component.
-* CycloneDX licenses can be in `licenses[].license.id` or `licenses[].license.name`.
-*/
-function extractCycloneDXLicenses(comp) {
-	const licensesArr = comp["licenses"];
-	if (!Array.isArray(licensesArr)) return [];
-	const result = [];
-	for (const entry of licensesArr) {
-		const license = entry["license"];
-		if (license) {
-			const id = license["id"];
-			const name = license["name"];
-			if (id) result.push(id);
-			else if (name) result.push(name);
-		}
-	}
-	return result;
-}
-/**
-* Extract packages from an SPDX document.
-* Reads packages[] with name, versionInfo, and externalRefs (for PURL).
-*/
-function extractSPDXPackages(doc) {
-	const packages = doc["packages"];
-	if (!Array.isArray(packages)) return [];
-	return packages.map((pkg) => {
-		const purl = extractSPDXPurl(pkg);
-		const license = pkg["licenseConcluded"] ?? pkg["licenseDeclared"] ?? "";
-		return {
-			purl,
-			name: pkg["name"] ?? "",
-			version: pkg["versionInfo"] ?? "",
-			licenses: license && license !== "NOASSERTION" ? [license] : []
-		};
-	});
-}
-/**
-* Extract a PURL from an SPDX package's externalRefs array.
-*/
-function extractSPDXPurl(pkg) {
-	const refs = pkg["externalRefs"];
-	if (!Array.isArray(refs)) return "";
-	for (const ref of refs) if (ref["referenceType"] === "purl") return ref["referenceLocator"] ?? "";
-	return "";
-}
-/**
-* Build a lookup map of packages indexed by name (version-independent key).
-*/
-function buildPackageMap(packages) {
-	const map = /* @__PURE__ */ new Map();
-	for (const pkg of packages) {
-		const key = pkg.name || pkg.purl;
-		if (key) map.set(key, pkg);
-	}
-	return map;
-}
-//#endregion
 //#region src/diff.ts
 const DEFAULT_TRACKED_FIELDS = [
 	"impact",
@@ -2197,7 +2038,8 @@ const COMPONENT_TRACKED_FIELDS = [
 	"description",
 	"baselineRefs",
 	"inputOverrides",
-	"sbomRef",
+	"boms",
+	"integrity",
 	"targetSelector"
 ];
 /**
@@ -2279,8 +2121,6 @@ function diffSystems(oldSystem, newSystem, options) {
 	const dataFlowChanges = diffDataFlows(oldSystem, newSystem);
 	if (dataFlowChanges.length > 0) extensions["dataFlowChanges"] = dataFlowChanges;
 	if (Object.keys(extensions).length > 0) comparison.extensions = extensions;
-	const allPackageDiffs = diffEmbeddedSboms(pairs);
-	if (allPackageDiffs.length > 0) comparison.packageDiffs = allPackageDiffs;
 	if (options?.validateOutput) {
 		const result = validateComparison(comparison);
 		/* c8 ignore start */
@@ -2391,24 +2231,6 @@ function diffDataFlows(oldSystem, newSystem) {
 	return changes;
 }
 /**
-* Diff embedded SBOMs across matched component pairs.
-*/
-function diffEmbeddedSboms(pairs) {
-	const allDiffs = [];
-	for (const { oldComp, newComp } of pairs) {
-		if (!oldComp || !newComp) continue;
-		const oldSbom = oldComp["sbom"];
-		const newSbom = newComp["sbom"];
-		if (!oldSbom || !newSbom) continue;
-		if (typeof oldSbom !== "object" || typeof newSbom !== "object") continue;
-		try {
-			const result = diffSboms(JSON.stringify(oldSbom), JSON.stringify(newSbom));
-			allDiffs.push(...result.packageDiffs);
-		} catch {}
-	}
-	return allDiffs;
-}
-/**
 * Compute field-level changes for component or system fields.
 * Uses JSON Patch-like op/path format.
 */
@@ -2894,6 +2716,165 @@ function render(comparison, format, options) {
 	}
 }
 //#endregion
+//#region src/sbom.ts
+/**
+* Compare two SBOM documents (CycloneDX or SPDX JSON strings) and return
+* package-level diffs.
+*
+* @param oldJson - JSON string of the old SBOM document
+* @param newJson - JSON string of the new SBOM document
+* @returns Structured diff result with per-package state and aggregate counts
+* @throws Error if either input is not valid JSON or not a recognized SBOM format
+*/
+function diffSboms(oldJson, newJson) {
+	const oldParsed = JSON.parse(oldJson);
+	const newParsed = JSON.parse(newJson);
+	const oldPackages = extractPackages(oldParsed);
+	const newPackages = extractPackages(newParsed);
+	const oldMap = buildPackageMap(oldPackages);
+	const newMap = buildPackageMap(newPackages);
+	const diffs = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [key, oldPkg] of oldMap) {
+		seen.add(key);
+		const newPkg = newMap.get(key);
+		if (newPkg) if (oldPkg.version !== newPkg.version) diffs.push({
+			purl: newPkg.purl || newPkg.name,
+			name: newPkg.name,
+			state: "updated",
+			oldVersion: oldPkg.version,
+			newVersion: newPkg.version,
+			licenses: newPkg.licenses.length > 0 ? newPkg.licenses : void 0
+		});
+		else diffs.push({
+			purl: oldPkg.purl || oldPkg.name,
+			name: oldPkg.name,
+			state: "unchanged"
+		});
+		else diffs.push({
+			purl: oldPkg.purl || oldPkg.name,
+			name: oldPkg.name,
+			state: "removed",
+			oldVersion: oldPkg.version
+		});
+	}
+	for (const [key, newPkg] of newMap) if (!seen.has(key)) diffs.push({
+		purl: newPkg.purl || newPkg.name,
+		name: newPkg.name,
+		state: "added",
+		newVersion: newPkg.version,
+		licenses: newPkg.licenses.length > 0 ? newPkg.licenses : void 0
+	});
+	diffs.sort((a, b) => a.name.localeCompare(b.name));
+	let added = 0;
+	let removed = 0;
+	let updated = 0;
+	let unchanged = 0;
+	for (const d of diffs) switch (d.state) {
+		case "added":
+			added++;
+			break;
+		case "removed":
+			removed++;
+			break;
+		case "updated":
+			updated++;
+			break;
+		case "unchanged":
+			unchanged++;
+			break;
+	}
+	return {
+		packageDiffs: diffs,
+		added,
+		removed,
+		updated,
+		unchanged
+	};
+}
+/**
+* Extract packages from an SBOM document, auto-detecting the format.
+*/
+function extractPackages(doc) {
+	if (doc["bomFormat"] === "CycloneDX") return extractCycloneDXPackages(doc);
+	if (typeof doc["spdxVersion"] === "string") return extractSPDXPackages(doc);
+	throw new Error("Unrecognized SBOM format: expected CycloneDX (bomFormat) or SPDX (spdxVersion)");
+}
+/**
+* Extract packages from a CycloneDX document.
+* Reads components[] with purl, name, version fields.
+*/
+function extractCycloneDXPackages(doc) {
+	const components = doc["components"];
+	if (!Array.isArray(components)) return [];
+	return components.map((comp) => {
+		const licenses = extractCycloneDXLicenses(comp);
+		return {
+			purl: comp["purl"] ?? "",
+			name: comp["name"] ?? "",
+			version: comp["version"] ?? "",
+			licenses
+		};
+	});
+}
+/**
+* Extract license strings from a CycloneDX component.
+* CycloneDX licenses can be in `licenses[].license.id` or `licenses[].license.name`.
+*/
+function extractCycloneDXLicenses(comp) {
+	const licensesArr = comp["licenses"];
+	if (!Array.isArray(licensesArr)) return [];
+	const result = [];
+	for (const entry of licensesArr) {
+		const license = entry["license"];
+		if (license) {
+			const id = license["id"];
+			const name = license["name"];
+			if (id) result.push(id);
+			else if (name) result.push(name);
+		}
+	}
+	return result;
+}
+/**
+* Extract packages from an SPDX document.
+* Reads packages[] with name, versionInfo, and externalRefs (for PURL).
+*/
+function extractSPDXPackages(doc) {
+	const packages = doc["packages"];
+	if (!Array.isArray(packages)) return [];
+	return packages.map((pkg) => {
+		const purl = extractSPDXPurl(pkg);
+		const license = pkg["licenseConcluded"] ?? pkg["licenseDeclared"] ?? "";
+		return {
+			purl,
+			name: pkg["name"] ?? "",
+			version: pkg["versionInfo"] ?? "",
+			licenses: license && license !== "NOASSERTION" ? [license] : []
+		};
+	});
+}
+/**
+* Extract a PURL from an SPDX package's externalRefs array.
+*/
+function extractSPDXPurl(pkg) {
+	const refs = pkg["externalRefs"];
+	if (!Array.isArray(refs)) return "";
+	for (const ref of refs) if (ref["referenceType"] === "purl") return ref["referenceLocator"] ?? "";
+	return "";
+}
+/**
+* Build a lookup map of packages indexed by name (version-independent key).
+*/
+function buildPackageMap(packages) {
+	const map = /* @__PURE__ */ new Map();
+	for (const pkg of packages) {
+		const key = pkg.name || pkg.purl;
+		if (key) map.set(key, pkg);
+	}
+	return map;
+}
+//#endregion
 export { EXIT_DETAILED_BASELINE_CHANGED, EXIT_DETAILED_DRIFT_ONLY, EXIT_DETAILED_ERROR, EXIT_DETAILED_FIXES_ONLY, EXIT_DETAILED_IDENTICAL, EXIT_DETAILED_MIXED, EXIT_DETAILED_REGRESSIONS_ONLY, EXIT_DIFFERENCES, EXIT_ERROR, EXIT_IDENTICAL, classifyChangeReasons, classifyDiffStatus, computeDetailedExitCode, computeEffectiveStatus, computeExitCode, computeSummary, createCciMatchStrategy, createExactIdStrategy, createFuzzyTitleStrategy, createMappedIdStrategy, createSrgCciTiebreakStrategy, createSrgDeterministicStrategy, createVendorFuzzyTitleStrategy, diffBaselines, diffHdf, diffSboms, diffSystems, isV1Format, jaccardSimilarity, levenshteinDistance, matchRequirements, normalizeToV2, normalizedLevenshtein, render, renderCsv, renderJson, renderMarkdown, renderTerminal, tokenize, validateComparison };
 
 //# sourceMappingURL=index.js.map