@mitre/hdf-schema 3.4.4 → 3.5.1

package/dist/ts/hdf.ts

@@ -12,11 +12,23 @@ export interface HDFResults {
      * references.
      */
     components?: Component[];
+    /**
+     * Present ONLY on reconciled result sets: lineage recording the seed snapshot and event
+     * watermark this document was reassembled from (ADR-0005). Documents produced directly by a
+     * scan omit this field. When present, generator names the reconciling tool.
+     */
+    derivation?: Derivation;
     /**
      * Reserved for tool-specific data not defined in the HDF standard. Use this to preserve
      * original tool output, auxiliary data, or custom metadata.
      */
     extensions?: { [key: string]: any };
+    /**
+     * Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any
+     * URI-addressable artifact) relevant to this assessment as a whole. Inert context; see
+     * External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Information about the tool that generated this file.
      */
@@ -132,6 +144,12 @@ export interface EvaluatedBaseline {
      * The email address or other contact information of the copyright holder(s).
      */
     copyrightEmail?: string;
+    /**
+     * Optional references to external artifacts relevant to this baseline (CTI/STIX,
+     * advisories, source catalogs, or any URI-addressable artifact). Travels with the baseline
+     * definition. Inert context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Optional key-value labels for flexible grouping. Well-known keys: system, component,
      * environment, region, team. Values must be strings.
@@ -212,6 +230,158 @@ export interface Dependency {
     [property: string]: any;
 }
 
+/**
+ * A generalized reference to any external artifact by identity and/or location, modeled on the STIX
+ * 2.1 `external_references` common property. Purpose-agnostic: cite a CVE, an ATT&CK technique, a
+ * STIX bundle/object, a BOM, a runbook, or any vendor artifact — including kinds with no dedicated
+ * HDF reference category. `sourceName` names the system; `externalId` cites by id within that
+ * system; `href` locates it. `sourceName` + `externalId` is equivalently a URN
+ * (`urn:<sourceName>:<externalId>`, RFC 8141), so the by-identity and by-location forms stay
+ * interconvertible. A reference is inert context: it overrides nothing, so it carries only
+ * lightweight optional `addedBy`/`addedAt` attribution, never override machinery.
+ */
+export interface ExternalReference {
+    /**
+     * When this reference was attached (RFC 3339 / trimmed-UTC per HDF timestamp convention).
+     */
+    addedAt?: Date;
+    /**
+     * Who attached this reference. Lightweight, flat attribution — a reference overrides
+     * nothing, so it has no chaining/superseding/disposition.
+     */
+    addedBy?: Identity;
+    /**
+     * Integrity hash of the referenced artifact. Reuses the HDF `Checksum` primitive (not STIX
+     * `hashes`). Meaningful only with a retrievable `href`.
+     */
+    checksum?: Checksum;
+    /**
+     * Human-readable description of what is referenced. Satisfies the at-least-one rule on its
+     * own when neither id nor href is available.
+     */
+    description?: string;
+    /**
+     * Optional lossless embedded copy of the referenced artifact — the raw STIX object, EPSS
+     * record, advisory, or annotation payload — preserved verbatim. Composes with
+     * `href`/`externalId` (which point at the artifact) and `checksum` (which ties the copy to
+     * the source): a single entry can both point and embed. HDF stays payload-agnostic — the
+     * content is carried untouched, never normalized into HDF fields — so this does not
+     * duplicate the source ontology (e.g. STIX rides here unchanged).
+     */
+    document?: { [key: string]: any };
+    /**
+     * Identifier of the artifact within `sourceName` (e.g., 'CVE-2021-44228' for source 'cve',
+     * 'T1059' for 'mitre-att&ck'). Cite by id without needing a URL. Together with `sourceName`
+     * this is a URN.
+     */
+    externalId?: string;
+    /**
+     * Location of the artifact. `uri-reference` (not `uri`) so a bare internal
+     * `#fragment`/`#uuid` reference is expressible alongside absolute URLs.
+     * `checksum`/`mediaType` apply only to a retrievable `href`.
+     */
+    href?: string;
+    /**
+     * Open token classifying the referenced/embedded payload, turning a bare reference into an
+     * enrichment envelope. Deliberately open (like `sourceName`/`rel`), not a closed enum.
+     * Documented starter vocabulary: 'threat-intel' (STIX/CTI object), 'annotation' (human
+     * triage note), 'exploitation' (EPSS/KEV signal carried as context), 'advisory'
+     * (vendor/security advisory). Use the `x-` prefix for custom kinds.
+     */
+    kind?: string;
+    /**
+     * IANA media type of the referenced artifact when retrievable (RFC 6838), e.g.,
+     * 'application/json'. Meaningful only with `href`.
+     */
+    mediaType?: string;
+    /**
+     * Open relationship token describing how this reference relates to the referencing object.
+     * Deliberately open (cf. OSCAL `rel` allow-other, RFC 8288 extension relations). Documented
+     * starter vocabulary: 'reference' (generic), 'definition' (defines the concept), 'evidence'
+     * (supporting evidence), 'investigate' (a live pivot to investigate), 'canonical' (the
+     * authoritative source).
+     */
+    rel?: string;
+    /**
+     * Name of the external system/source being referenced (e.g., 'cve', 'mitre-att&ck', 'stix',
+     * 'taxii', or any vendor label). Open string — not a closed enum. Use the `x-` prefix
+     * convention for custom/experimental sources, mirroring `bomType`.
+     */
+    sourceName: string;
+    [property: string]: any;
+}
+
+/**
+ * Represents an identity that performed an action, such as capturing evidence or applying an
+ * override.
+ */
+export interface Identity {
+    /**
+     * Optional description of the identity or identity system, particularly useful when type is
+     * 'other'.
+     */
+    description?: string;
+    /**
+     * The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'.
+     */
+    identifier: string;
+    /**
+     * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
+     * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
+     * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
+     * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
+     * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
+     * 'simple' for basic string identifiers without additional classification, or 'other' for
+     * custom identity systems.
+     */
+    type: IdentityType;
+    [property: string]: any;
+}
+
+/**
+ * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
+ * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
+ * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
+ * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
+ * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
+ * 'simple' for basic string identifiers without additional classification, or 'other' for
+ * custom identity systems.
+ */
+export enum IdentityType {
+    Agent = "agent",
+    Email = "email",
+    Other = "other",
+    Simple = "simple",
+    System = "system",
+    Username = "username",
+}
+
+/**
+ * Cryptographic checksum for baseline integrity verification.
+ */
+export interface Checksum {
+    /**
+     * The hash algorithm used for the checksum.
+     */
+    algorithm: HashAlgorithm;
+    /**
+     * The checksum value.
+     */
+    value: string;
+    [property: string]: any;
+}
+
+/**
+ * Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers
+ * container-image and other artifact digests that use it.
+ */
+export enum HashAlgorithm {
+    Blake3 = "blake3",
+    Sha256 = "sha256",
+    Sha384 = "sha384",
+    Sha512 = "sha512",
+}
+
 /**
  * Describes a group of requirements, such as those defined in a single file.
  */
@@ -351,32 +521,6 @@ export interface Integrity {
     [property: string]: any;
 }
 
-/**
- * Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers
- * container-image and other artifact digests that use it.
- */
-export enum HashAlgorithm {
-    Blake3 = "blake3",
-    Sha256 = "sha256",
-    Sha384 = "sha384",
-    Sha512 = "sha512",
-}
-
-/**
- * Cryptographic checksum for baseline integrity verification.
- */
-export interface Checksum {
-    /**
-     * The hash algorithm used for the checksum.
-     */
-    algorithm: HashAlgorithm;
-    /**
-     * The checksum value.
-     */
-    value: string;
-    [property: string]: any;
-}
-
 /**
  * A requirement that has been evaluated, including any findings.
  */
@@ -413,6 +557,16 @@ export interface EvaluatedRequirement {
      * POAMs apply.
      */
     disposition?: OverrideType;
+    /**
+     * Checksum of this requirement's resolved effective posture, for per-control change
+     * detection in continuous monitoring. sha256 over the canonical JSON object with keys
+     * status, impact, disposition (in that order), holding the resolved effective status,
+     * resolved effective impact, and governing override type (null when nothing governs), with
+     * override expiry anchored to the document timestamp. Flips exactly when the operative
+     * status, impact, or disposition changes; stable under all other churn (result details,
+     * timestamps, tags). Optional; stamped by tooling (hdf convert, hdf amend apply).
+     */
+    effectiveChecksum?: Checksum;
     /**
      * The current effective impact score (0.0–1.0) after applying the most recent non-expired
      * override with an impact field. Absent when no impact overrides apply; consumers should
@@ -504,6 +658,13 @@ export interface EvaluatedRequirement {
      * family/id but should not assume a default.
      */
     controlType?: ControlType;
+    /**
+     * Optional references to external artifacts relevant to this requirement (CTI/STIX
+     * correlation, advisories, control/definition sources, or any URI-addressable artifact).
+     * Applies to both baseline requirement definitions and evaluated requirements. Inert
+     * context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * The set of references to external documents.
      */
@@ -841,51 +1002,6 @@ export interface Evidence {
     [property: string]: any;
 }
 
-/**
- * Represents an identity that performed an action, such as capturing evidence or applying an
- * override.
- */
-export interface Identity {
-    /**
-     * Optional description of the identity or identity system, particularly useful when type is
-     * 'other'.
-     */
-    description?: string;
-    /**
-     * The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'.
-     */
-    identifier: string;
-    /**
-     * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
-     * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
-     * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
-     * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
-     * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
-     * 'simple' for basic string identifiers without additional classification, or 'other' for
-     * custom identity systems.
-     */
-    type: IdentityType;
-    [property: string]: any;
-}
-
-/**
- * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
- * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
- * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
- * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
- * 'simple' for basic string identifiers without additional classification, or 'other' for
- * custom identity systems.
- */
-export enum IdentityType {
-    Agent = "agent",
-    Email = "email",
-    Other = "other",
-    Simple = "simple",
-    System = "system",
-    Username = "username",
-}
-
 /**
  * The type of evidence being provided.
  */
@@ -947,9 +1063,12 @@ export interface Poam {
      */
     evidence?: Evidence[];
     /**
-     * Optional expiration date for this POA&M requiring review/renewal. ISO 8601 format.
+     * Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding;
+     * without a deadline it lets a failing requirement duck remediation indefinitely. Source a
+     * real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default.
+     * ISO 8601 format.
      */
-    expiresAt?: Date;
+    expiresAt: Date;
     /**
      * Detailed explanation of the plan, including what actions will be taken.
      */
@@ -1214,6 +1333,13 @@ export interface StatusOverride {
      * permanent overrides allowed. ISO 8601 format.
      */
     expiresAt: Date;
+    /**
+     * Optional references to the external artifacts behind this override (e.g. the STIX
+     * bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from
+     * `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences
+     * for the inline (results-embedded) override carrier.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Override to the requirement's impact score. At least one of status or impact must be set.
      */
@@ -1934,6 +2060,57 @@ export enum TargetType {
     Repository = "repository",
 }
 
+/**
+ * Derived-document lineage for a reconciled result set (an hdf-results produced by
+ * applyChangeEvents rather than a scanner). Records exactly which seed and event horizon the
+ * document represents so it can never masquerade as primary scan evidence. Conceptually PROV
+ * qualified derivation: derived entity, used entity (seed), activity (event application),
+ * generation time (asOf).
+ */
+export interface Derivation {
+    /**
+     * The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of
+     * PROV's generatedAtTime.
+     */
+    asOf: Date;
+    /**
+     * Number of change events applied to the seed to produce this document.
+     */
+    eventsApplied: number;
+    /**
+     * The authoritative snapshot this document was reassembled from, pinned by content.
+     */
+    seed: Seed;
+    /**
+     * URI of the event-stream producer context whose events were applied (matches the events'
+     * envelope source).
+     */
+    source: string;
+    /**
+     * The event watermark: the highest per-key sequence number applied. Downstream precedence
+     * rule: a full-scan document supersedes the reconciled view as of its scan time; between
+     * scans, the reconciled document with the highest throughSequence is the current posture.
+     */
+    throughSequence: number;
+    [property: string]: any;
+}
+
+/**
+ * The authoritative snapshot this document was reassembled from, pinned by content.
+ */
+export interface Seed {
+    /**
+     * Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by
+     * content, not just location.
+     */
+    checksum: Checksum;
+    /**
+     * URI to the seed snapshot document (relative path or absolute URL).
+     */
+    uri: string;
+    [property: string]: any;
+}
+
 /**
  * Information about the tool that generated this HDF file.
  */
@@ -2082,9 +2259,13 @@ export interface StatisticBlock {
  */
 export interface Tool {
     /**
-     * The file format, if it is a recognized named format shared by multiple tools. Examples:
-     * 'SARIF', 'XCCDF'. Omit for tool-specific formats where the tool name already implies the
-     * format (Nessus XML, gosec JSON).
+     * The named format of the source data, when it follows a recognized format specification
+     * with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF',
+     * 'OSCAL') or one of several named output formats a single tool produces ('FVDL',
+     * 'exec-json', 'FPF'). Never a serialization structure — 'JSON', 'XML', and 'CSV' are
+     * encodings, not formats. Omit for a tool's native output: an absent format means the
+     * tool's own shape, and data arriving as a named format is converted by that format's
+     * converter, which sets this field alongside the producing tool's name.
      */
     format?: string;
     /**
@@ -2146,6 +2327,12 @@ export interface HDFBaseline {
      * The email address or other contact information of the copyright holder(s).
      */
     copyrightEmail?: string;
+    /**
+     * Optional references to external artifacts relevant to this baseline (CTI/STIX,
+     * advisories, source catalogs, or any URI-addressable artifact). Travels with the baseline
+     * definition. Inert context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Optional key-value labels for flexible grouping. Well-known keys: system, component,
      * environment, region, team. Values must be strings.
@@ -2234,6 +2421,13 @@ export interface BaselineRequirement {
      * family/id but should not assume a default.
      */
     controlType?: ControlType;
+    /**
+     * Optional references to external artifacts relevant to this requirement (CTI/STIX
+     * correlation, advisories, control/definition sources, or any URI-addressable artifact).
+     * Applies to both baseline requirement definitions and evaluated requirements. Inert
+     * context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * The set of references to external documents.
      */
@@ -2289,6 +2483,11 @@ export interface HDFComparison {
      * Reserved for tool-specific data not defined in the HDF standard.
      */
     extensions?: { [key: string]: any };
+    /**
+     * Optional references to external artifacts relevant to this comparison (CTI/STIX,
+     * advisories, or any URI-addressable artifact). Inert context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Schema version for this comparison format.
      */
@@ -2578,12 +2777,17 @@ export interface RequirementDiff {
 }
 
 /**
- * The reason a requirement's state changed between sources.
+ * The reason a requirement's state changed between sources. 'dispositionChanged' = the governing
+ * override type differs between the sources (e.g. a waiver replaced a riskAdjustment);
+ * 'effectiveImpactChanged' = the post-override impact score differs while the base impact may be
+ * unchanged.
  */
 export enum ChangeReason {
     BaselineUpgraded = "baselineUpgraded",
     ConfigChanged = "configChanged",
     ControlMapped = "controlMapped",
+    DispositionChanged = "dispositionChanged",
+    EffectiveImpactChanged = "effectiveImpactChanged",
     ImpactChanged = "impactChanged",
     MetadataChanged = "metadataChanged",
     OverrideAdded = "overrideAdded",
@@ -3065,6 +3269,12 @@ export interface HDFSystem {
      * Description of the system's purpose and mission.
      */
     description?: string;
+    /**
+     * Optional references to external artifacts describing this system's threat environment or
+     * context (CTI/STIX, BOMs, advisories, or any URI-addressable artifact). Inert context; see
+     * External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Information about the tool that generated this system document.
      */
@@ -3247,6 +3457,12 @@ export interface HDFPlan {
      * Description of the plan's purpose and scope.
      */
     description?: string;
+    /**
+     * Optional references to external artifacts relevant to this assessment plan (CTI/STIX,
+     * advisories, methodology docs, or any URI-addressable artifact). Inert context; see
+     * External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Information about the tool that generated this plan.
      */
@@ -3495,6 +3711,12 @@ export interface StandaloneOverride {
      * format.
      */
     expiresAt: Date;
+    /**
+     * Optional references to the external artifacts behind this override (e.g. the STIX
+     * bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from
+     * `evidence`; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Override to the requirement's impact score. At least one of status or impact must be set.
      */
@@ -3570,6 +3792,12 @@ export interface HDFEvidencePackage {
      * here rather than transcoding them.
      */
     externalEvidence?: ExternalEvidenceReference[];
+    /**
+     * Optional references to external artifacts relevant to this evidence package (CTI/STIX,
+     * BOMs, advisories, or any URI-addressable artifact) beyond the document references it
+     * already carries. Inert context; see External_Reference.
+     */
+    externalReferences?: ExternalReference[];
     /**
      * Information about the tool that generated this document.
      */
@@ -3790,3 +4018,126 @@ export interface ExternalEvidenceTimeRange {
     start?: Date;
     [property: string]: any;
 }
+
+/**
+ * A single continuous-monitoring wire event: one requirement's effective posture changed on one
+ * system component. The streaming increment of a systemDrift hdf-comparison — events fold into
+ * comparisons and reassemble into hdf-results, they never mutate documents in place. One event per
+ * wire document (NDJSON-friendly). The envelope (identity, ordering, hash chain) is the shared
+ * Change_Event_Envelope primitive; the payload carries the producer-computable change state, a thin
+ * before projection, and the full after requirement (the evidence a responder opens the event for).
+ * Design: ADR-0005.
+ */
+export interface HDFRequirementChangeEvent {
+    /**
+     * The full requirement as evaluated after the change — required and non-null for every
+     * state except absent (null there: the requirement left the assessment scope). Full content
+     * is load-bearing twice over: reassembly parity (applyChangeEvents cannot reproduce changed
+     * result content from a projection) and triage (the failing results[] ARE the 'why' a
+     * responder opens the event for).
+     */
+    after: any;
+    /**
+     * Thin projection of the prior effective posture, for at-a-glance alerting without a
+     * state-store lookup. Null exactly when state is new (no prior posture exists). The full
+     * prior state is recoverable from the consumer's materialized state; the envelope's
+     * priorChecksum covers the integrity of that recovery.
+     */
+    before: any;
+    /**
+     * Why the state changed. An overrideExpired flip is a different triage than resultChanged:
+     * the control did not get worse, a waiver lapsed.
+     */
+    changeReasons?: EventChangeReason[];
+    /**
+     * Canonical requirement identifier — the same identity as Requirement_Diff.id and the
+     * requirement's id in hdf-results. Together with the envelope's (systemRef, componentId)
+     * this forms the durable entity key. A requirement renumbering is emitted as absent + new
+     * under the two keys, never an in-place key change; batch comparison reconciles renames via
+     * its oldId/newId matching.
+     */
+    requirementId: string;
+    /**
+     * The producer-computable subset of Requirement_State: new | absent | updated | fixed |
+     * regressed. fixed and regressed carry the direction SARIF's baselineState lacks; project
+     * down to SARIF's closed 4 values for external interop.
+     */
+    state: EventRequirementState;
+    /**
+     * componentId of the system component this event concerns.
+     */
+    componentId: string;
+    /**
+     * Identity of this event occurrence, unique per source. (source, eventId) is the
+     * deduplication key: consumers may treat events with identical source and eventId as
+     * duplicates. UUIDv7 (time-ordered) is recommended but not required.
+     */
+    eventId: string;
+    /**
+     * The effectiveChecksum of the entity state this event supersedes, forming a per-key hash
+     * chain: a mismatch or gap against stored state is detectable, letting a consumer mark the
+     * key unverified instead of serving stale posture. Null at chain start (no prior state,
+     * e.g. a new entity or the first event after a seed). The chain provides tamper/gap
+     * evidence given a trusted head; completeness is anchored out-of-band by periodic
+     * re-centering rescans.
+     */
+    priorChecksum: any;
+    /**
+     * The versioned schema $id this event validates against, so events self-describe on
+     * heterogeneous streams. Recommended on every wire event.
+     */
+    schemaRef?: string;
+    /**
+     * Monotonically increasing sequence number per entity key. The ONLY ordering authority for
+     * folding: consumers keep the greatest sequence per key regardless of arrival order or
+     * timestamp. Deliberately per-entity-key (event-sourcing aggregate-version practice) rather
+     * than per-source.
+     */
+    sequence: number;
+    /**
+     * URI identifying the producer context that emitted this event (for example, a scanner
+     * instance and profile). eventId uniqueness and sequence numbering are scoped per source.
+     */
+    source: string;
+    /**
+     * URI to the hdf-system document (authorization boundary) this event applies to. Resolves
+     * to the latest version of the evolving system document.
+     */
+    systemRef: string;
+    /**
+     * Occurrence time of the observed change (RFC 3339, trimmed UTC). Display and audit
+     * metadata only — NEVER an ordering key; ordering is sequence's job.
+     */
+    timestamp: Date;
+    [property: string]: any;
+}
+
+/**
+ * The producer-computable subset of the comparison vocabulary's Change_Reason, value-identical with
+ * the parent enum (test-enforced). Batch-only reasons (baselineUpgraded, controlMapped,
+ * scannerChanged, targetChanged, metadataChanged) require cross-corpus context and are excluded.
+ */
+export enum EventChangeReason {
+    ConfigChanged = "configChanged",
+    ImpactChanged = "impactChanged",
+    OverrideAdded = "overrideAdded",
+    OverrideExpired = "overrideExpired",
+    OverrideModified = "overrideModified",
+    OverrideRemoved = "overrideRemoved",
+    ResultChanged = "resultChanged",
+}
+
+/**
+ * The producer-computable subset of the comparison vocabulary's Requirement_State. Kept
+ * value-identical with the parent enum (test-enforced): the batch-only states (moved, split,
+ * merged) are outputs of cross-document identity resolution a per-key producer cannot compute.
+ * Declared as a distinct named type (rather than a $ref intersection) so generated Go/TS types keep
+ * stable, distinct enum names.
+ */
+export enum EventRequirementState {
+    Absent = "absent",
+    Fixed = "fixed",
+    New = "new",
+    Regressed = "regressed",
+    Updated = "updated",
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/hdf-schema",
-  "version": "3.4.4",
+  "version": "3.5.1",
   "description": "JSON schemas and multi-language type definitions for Heimdall Data Format (HDF)",
   "publishConfig": {
     "access": "public"
@@ -59,7 +59,7 @@
   "dependencies": {
     "ajv": "^8.17.0",
     "ajv-formats": "^3.0.0",
-    "@mitre/hdf-utilities": "^3.4.4"
+    "@mitre/hdf-utilities": "^3.5.1"
   },
   "devDependencies": {
     "@hyperjump/json-schema": "^1.17.2",