@mitre/hdf-utilities 3.4.4 → 3.5.1

package/dist/index.js

@@ -34,6 +34,17 @@ function severityToImpact(severity) {
 	const normalized = severity.toLowerCase();
 	return severityMap[normalized] ?? .5;
 }
+/**
+* Round an HDF impact value to 2 decimal places — its canonical precision —
+* eliminating the representation noise that binary float division leaves behind
+* (e.g. 9.8 / 10 = 0.9800000000000001). Impact is defined on 0.0–1.0 with a
+* natural 0.01 grid (a 1-decimal CVSS score / 10), so this is lossless in
+* intent. Use it wherever impact is COMPUTED (divided or otherwise
+* arithmetically derived), not when assigned from a literal band.
+*/
+function roundImpact(x) {
+	return Math.round(x * 100) / 100;
+}
 function impactToSeverity(impact) {
 	if (impact === null) return null;
 	if (impact >= .9) return "critical";
@@ -67,8 +78,481 @@ function cvssScoreToSeverity(score) {
 	return "critical";
 }
 //#endregion
+//#region src/status/index.ts
+/**
+* Canonical HDF result-status ordering and effective-status computation.
+*
+* This is the single source of truth for worst-wins roll-up and
+* effective-status selection across hdf-libs (mirrored in Go as
+* hdf-utilities/go status.go). The precedence rules are published in
+* site/docs/architecture/status-determination.md; do not re-implement them.
+*/
+/** Canonical worst-wins ordering, worst first. */
+const STATUS_SEVERITY_ORDER = [
+	"error",
+	"failed",
+	"passed",
+	"notApplicable",
+	"notReviewed"
+];
+/** Severity rank of a status: higher = worse. Unknown statuses rank -1. */
+function statusRank(status) {
+	const idx = STATUS_SEVERITY_ORDER.indexOf(status);
+	return idx === -1 ? -1 : STATUS_SEVERITY_ORDER.length - 1 - idx;
+}
+/**
+* Rolls a list of result statuses up to the worst one. An empty list (or a
+* list of only unknown statuses) rolls up to "notReviewed".
+*/
+function worstStatus(statuses) {
+	let worst = "notReviewed";
+	let worstRank = -1;
+	for (const s of statuses) {
+		const r = statusRank(s);
+		if (r > worstRank) {
+			worstRank = r;
+			worst = s;
+		}
+	}
+	return worst;
+}
+function isExpired(override, ref) {
+	if (!override.expiresAt) return false;
+	const expires = parseTimestamp(override.expiresAt);
+	return expires !== null && expires <= ref;
+}
+/**
+* Selects the override that governs a requirement: the most recently applied
+* (by appliedAt) non-expired override that carries a status — matching the
+* schema's definition of disposition ("the most recent non-expired
+* override"). Returns undefined when no override governs.
+*/
+function governingStatusOverride(overrides, referenceTimestamp) {
+	const i = governingStatusOverrideIndex(overrides, referenceTimestamp);
+	return i >= 0 ? overrides[i] : void 0;
+}
+/**
+* Returns the index of the most recently applied (by appliedAt) non-expired
+* override among those for which `eligible` returns true, or -1 when none
+* qualifies. Generalizes governing-override selection to per-field
+* eligibility: the schema defines effectiveStatus, effectiveImpact, and
+* disposition each as "the most recent non-expired override" carrying the
+* relevant field, so callers pass the field-presence check as the predicate.
+*/
+function governingOverrideIndex(overrides, eligible, referenceTimestamp) {
+	const ref = refTime(referenceTimestamp);
+	let governing = -1;
+	for (let i = 0; i < overrides.length; i++) {
+		const override = overrides[i];
+		if (!override || !eligible(i) || isExpired(override, ref)) continue;
+		if (governing === -1 || appliedTime(override) > appliedTime(overrides[governing])) governing = i;
+	}
+	return governing;
+}
+/**
+* Index variant of {@link governingStatusOverride}: returns -1 when no
+* override governs. Callers holding richer concrete override types use the
+* index to recover their own object.
+*/
+function governingStatusOverrideIndex(overrides, referenceTimestamp) {
+	return governingOverrideIndex(overrides, (i) => !!overrides[i]?.status, referenceTimestamp);
+}
+function appliedTime(override) {
+	if (!override.appliedAt) return Number.NEGATIVE_INFINITY;
+	return parseTimestamp(override.appliedAt)?.getTime() ?? Number.NEGATIVE_INFINITY;
+}
+function refTime(referenceTimestamp) {
+	return (referenceTimestamp ? parseTimestamp(referenceTimestamp) : null) ?? /* @__PURE__ */ new Date();
+}
+/**
+* Determines a requirement's effective status — the single canonical
+* implementation of the precedence in status-determination.md:
+*
+* 1. impact === 0 → "notApplicable", regardless of results or overrides
+* 2. the governing (most recent non-expired) status override's status
+* 3. the stored effectiveStatus, honored only when NO overrides are present —
+*    effectiveStatus is state derived from overrides, so when every override
+*    has expired it is stale and the result roll-up wins
+* 4. worst-wins roll-up of the result statuses
+* 5. no results → "notReviewed"
+*/
+function computeEffectiveStatus(input, referenceTimestamp) {
+	if (input.impact === 0) return "notApplicable";
+	const overrides = input.overrides ?? [];
+	if (overrides.length > 0) {
+		const governing = governingStatusOverride(overrides, referenceTimestamp);
+		if (governing?.status) return governing.status;
+		return worstStatus(input.resultStatuses ?? []);
+	}
+	if (input.effectiveStatus) return input.effectiveStatus;
+	return worstStatus(input.resultStatuses ?? []);
+}
+//#endregion
+//#region src/cvss/cvss40-data.json
+var cvss40_data_default = {
+	_comment: "CVSS 4.0 scoring data tables extracted VERBATIM from the FIRST reference calculator (https://github.com/FIRSTdotorg/cvss-v4-calculator; cvss_lookup.js / max_composed.js / max_severity.js). Regenerate via scratchpad/extract-data.mjs. Consumed byte-identical by Go (go/cvss40-data.json, //go:embed) and TS (src/cvss/cvss40-data.json).",
+	lookup: {
+		"100000": 9.8,
+		"100001": 9.5,
+		"100010": 9.4,
+		"100011": 8.7,
+		"100020": 9.1,
+		"100021": 8.1,
+		"100100": 9.4,
+		"100101": 8.9,
+		"100110": 8.6,
+		"100111": 7.4,
+		"100120": 7.7,
+		"100121": 6.4,
+		"100200": 8.7,
+		"100201": 7.5,
+		"100210": 7.4,
+		"100211": 6.3,
+		"100220": 6.3,
+		"100221": 4.9,
+		"101000": 9.4,
+		"101001": 8.9,
+		"101010": 8.8,
+		"101011": 7.7,
+		"101020": 7.6,
+		"101021": 6.7,
+		"101100": 8.6,
+		"101101": 7.6,
+		"101110": 7.4,
+		"101111": 5.8,
+		"101120": 5.9,
+		"101121": 5,
+		"101200": 7.2,
+		"101201": 5.7,
+		"101210": 5.7,
+		"101211": 5.2,
+		"101220": 5.2,
+		"101221": 2.5,
+		"102001": 8.3,
+		"102011": 7,
+		"102021": 5.4,
+		"102101": 6.5,
+		"102111": 5.8,
+		"102121": 2.6,
+		"102201": 5.3,
+		"102211": 2.1,
+		"102221": 1.3,
+		"110000": 9.5,
+		"110001": 9,
+		"110010": 8.8,
+		"110011": 7.6,
+		"110020": 7.6,
+		"110021": 7,
+		"110100": 9,
+		"110101": 7.7,
+		"110110": 7.5,
+		"110111": 6.2,
+		"110120": 6.1,
+		"110121": 5.3,
+		"110200": 7.7,
+		"110201": 6.6,
+		"110210": 6.8,
+		"110211": 5.9,
+		"110220": 5.2,
+		"110221": 3,
+		"111000": 8.9,
+		"111001": 7.8,
+		"111010": 7.6,
+		"111011": 6.7,
+		"111020": 6.2,
+		"111021": 5.8,
+		"111100": 7.4,
+		"111101": 5.9,
+		"111110": 5.7,
+		"111111": 5.7,
+		"111120": 4.7,
+		"111121": 2.3,
+		"111200": 6.1,
+		"111201": 5.2,
+		"111210": 5.7,
+		"111211": 2.9,
+		"111220": 2.4,
+		"111221": 1.6,
+		"112001": 7.1,
+		"112011": 5.9,
+		"112021": 3,
+		"112101": 5.8,
+		"112111": 2.6,
+		"112121": 1.5,
+		"112201": 2.3,
+		"112211": 1.3,
+		"112221": .6,
+		"200000": 9.3,
+		"200001": 8.7,
+		"200010": 8.6,
+		"200011": 7.2,
+		"200020": 7.5,
+		"200021": 5.8,
+		"200100": 8.6,
+		"200101": 7.4,
+		"200110": 7.4,
+		"200111": 6.1,
+		"200120": 5.6,
+		"200121": 3.4,
+		"200200": 7,
+		"200201": 5.4,
+		"200210": 5.2,
+		"200211": 4,
+		"200220": 4,
+		"200221": 2.2,
+		"201000": 8.5,
+		"201001": 7.5,
+		"201010": 7.4,
+		"201011": 5.5,
+		"201020": 6.2,
+		"201021": 5.1,
+		"201100": 7.2,
+		"201101": 5.7,
+		"201110": 5.5,
+		"201111": 4.1,
+		"201120": 4.6,
+		"201121": 1.9,
+		"201200": 5.3,
+		"201201": 3.6,
+		"201210": 3.4,
+		"201211": 1.9,
+		"201220": 1.9,
+		"201221": .8,
+		"202001": 6.4,
+		"202011": 5.1,
+		"202021": 2,
+		"202101": 4.7,
+		"202111": 2.1,
+		"202121": 1.1,
+		"202201": 2.4,
+		"202211": .9,
+		"202221": .4,
+		"210000": 8.8,
+		"210001": 7.5,
+		"210010": 7.3,
+		"210011": 5.3,
+		"210020": 6,
+		"210021": 5,
+		"210100": 7.3,
+		"210101": 5.5,
+		"210110": 5.9,
+		"210111": 4,
+		"210120": 4.1,
+		"210121": 2,
+		"210200": 5.4,
+		"210201": 4.3,
+		"210210": 4.5,
+		"210211": 2.2,
+		"210220": 2,
+		"210221": 1.1,
+		"211000": 7.5,
+		"211001": 5.5,
+		"211010": 5.8,
+		"211011": 4.5,
+		"211020": 4,
+		"211021": 2.1,
+		"211100": 6.1,
+		"211101": 5.1,
+		"211110": 4.8,
+		"211111": 1.8,
+		"211120": 2,
+		"211121": .9,
+		"211200": 4.6,
+		"211201": 1.8,
+		"211210": 1.7,
+		"211211": .7,
+		"211220": .8,
+		"211221": .2,
+		"212001": 5.3,
+		"212011": 2.4,
+		"212021": 1.4,
+		"212101": 2.4,
+		"212111": 1.2,
+		"212121": .5,
+		"212201": 1,
+		"212211": .3,
+		"212221": .1,
+		"000000": 10,
+		"000001": 9.9,
+		"000010": 9.8,
+		"000011": 9.5,
+		"000020": 9.5,
+		"000021": 9.2,
+		"000100": 10,
+		"000101": 9.6,
+		"000110": 9.3,
+		"000111": 8.7,
+		"000120": 9.1,
+		"000121": 8.1,
+		"000200": 9.3,
+		"000201": 9,
+		"000210": 8.9,
+		"000211": 8,
+		"000220": 8.1,
+		"000221": 6.8,
+		"001000": 9.8,
+		"001001": 9.5,
+		"001010": 9.5,
+		"001011": 9.2,
+		"001020": 9,
+		"001021": 8.4,
+		"001100": 9.3,
+		"001101": 9.2,
+		"001110": 8.9,
+		"001111": 8.1,
+		"001120": 8.1,
+		"001121": 6.5,
+		"001200": 8.8,
+		"001201": 8,
+		"001210": 7.8,
+		"001211": 7,
+		"001220": 6.9,
+		"001221": 4.8,
+		"002001": 9.2,
+		"002011": 8.2,
+		"002021": 7.2,
+		"002101": 7.9,
+		"002111": 6.9,
+		"002121": 5,
+		"002201": 6.9,
+		"002211": 5.5,
+		"002221": 2.7,
+		"010000": 9.9,
+		"010001": 9.7,
+		"010010": 9.5,
+		"010011": 9.2,
+		"010020": 9.2,
+		"010021": 8.5,
+		"010100": 9.5,
+		"010101": 9.1,
+		"010110": 9,
+		"010111": 8.3,
+		"010120": 8.4,
+		"010121": 7.1,
+		"010200": 9.2,
+		"010201": 8.1,
+		"010210": 8.2,
+		"010211": 7.1,
+		"010220": 7.2,
+		"010221": 5.3,
+		"011000": 9.5,
+		"011001": 9.3,
+		"011010": 9.2,
+		"011011": 8.5,
+		"011020": 8.5,
+		"011021": 7.3,
+		"011100": 9.2,
+		"011101": 8.2,
+		"011110": 8,
+		"011111": 7.2,
+		"011120": 7,
+		"011121": 5.9,
+		"011200": 8.4,
+		"011201": 7,
+		"011210": 7.1,
+		"011211": 5.2,
+		"011220": 5,
+		"011221": 3,
+		"012001": 8.6,
+		"012011": 7.5,
+		"012021": 5.2,
+		"012101": 7.1,
+		"012111": 5.2,
+		"012121": 2.9,
+		"012201": 6.3,
+		"012211": 2.9,
+		"012221": 1.7
+	},
+	maxComposed: {
+		"eq1": {
+			"0": ["AV:N/PR:N/UI:N/"],
+			"1": [
+				"AV:A/PR:N/UI:N/",
+				"AV:N/PR:L/UI:N/",
+				"AV:N/PR:N/UI:P/"
+			],
+			"2": ["AV:P/PR:N/UI:N/", "AV:A/PR:L/UI:P/"]
+		},
+		"eq2": {
+			"0": ["AC:L/AT:N/"],
+			"1": ["AC:H/AT:N/", "AC:L/AT:P/"]
+		},
+		"eq3": {
+			"0": {
+				"0": ["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"],
+				"1": ["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/", "VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"]
+			},
+			"1": {
+				"0": ["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/", "VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"],
+				"1": [
+					"VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/",
+					"VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/",
+					"VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/",
+					"VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/",
+					"VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"
+				]
+			},
+			"2": { "1": ["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"] }
+		},
+		"eq4": {
+			"0": ["SC:H/SI:S/SA:S/"],
+			"1": ["SC:H/SI:H/SA:H/"],
+			"2": ["SC:L/SI:L/SA:L/"]
+		},
+		"eq5": {
+			"0": ["E:A/"],
+			"1": ["E:P/"],
+			"2": ["E:U/"]
+		}
+	},
+	maxSeverity: {
+		"eq1": {
+			"0": 1,
+			"1": 4,
+			"2": 5
+		},
+		"eq2": {
+			"0": 1,
+			"1": 2
+		},
+		"eq3eq6": {
+			"0": {
+				"0": 7,
+				"1": 6
+			},
+			"1": {
+				"0": 8,
+				"1": 8
+			},
+			"2": { "1": 10 }
+		},
+		"eq4": {
+			"0": 6,
+			"1": 5,
+			"2": 4
+		},
+		"eq5": {
+			"0": 1,
+			"1": 1,
+			"2": 1
+		}
+	}
+};
+//#endregion
 //#region src/cvss/index.ts
 /**
+* CVSS vector parsing and validation utilities.
+*
+* Supports CVSS 2.0 (legacy, no prefix), 3.0, 3.1, and 4.0 vector strings.
+* Parsing is permissive: it splits any well-shaped key:value pair separated
+* by `/`. Validation is strict per the FIRST grammar for each version.
+*
+* References:
+*  - CVSS 2.0:  https://www.first.org/cvss/v2/guide
+*  - CVSS 3.1:  https://www.first.org/cvss/v3.1/specification-document
+*  - CVSS 4.0:  https://www.first.org/cvss/v4.0/specification-document
+*/
+/**
 * Allowed values for each metric, keyed by CVSS major version.
 *
 * Sourced from FIRST specifications (linked above). Only metrics present
@@ -704,6 +1188,362 @@ function validateCvssVector(vector, version) {
 		errors
 	};
 }
+const CVSS31_AV = {
+	N: .85,
+	A: .62,
+	L: .55,
+	P: .2
+};
+const CVSS31_AC = {
+	L: .77,
+	H: .44
+};
+const CVSS31_UI = {
+	N: .85,
+	R: .62
+};
+const CVSS31_CIA = {
+	N: 0,
+	L: .22,
+	H: .56
+};
+const CVSS31_PR_UNCHANGED = {
+	N: .85,
+	L: .62,
+	H: .27
+};
+const CVSS31_PR_CHANGED = {
+	N: .85,
+	L: .68,
+	H: .5
+};
+const CVSS31_E = {
+	X: 1,
+	H: 1,
+	F: .97,
+	P: .94,
+	U: .91
+};
+const CVSS31_RL = {
+	X: 1,
+	U: 1,
+	W: .97,
+	T: .96,
+	O: .95
+};
+const CVSS31_RC = {
+	X: 1,
+	C: 1,
+	R: .96,
+	U: .92
+};
+/**
+* CVSS 3.1 Roundup (spec §7.4): the smallest number, to one decimal place, that
+* is >= the input — computed via integer math to avoid the floating-point edge
+* cases 3.0 rounding suffered.
+*/
+function roundUp31(x) {
+	const intInput = Math.round(x * 1e5);
+	if (intInput % 1e4 === 0) return intInput / 1e5;
+	return (Math.floor(intInput / 1e4) + 1) / 10;
+}
+function cvss31TemporalWeight(table, metrics, key) {
+	const v = metrics.get(key);
+	if (v === void 0) return 1;
+	const w = table[v];
+	if (w === void 0) throw new Error(`cvss: invalid 3.1 ${key} value "${v}"`);
+	return w;
+}
+/**
+* Compute the CVSS 3.1 Base and Temporal (Threat) scores for a vector string.
+*
+* Only CVSS 3.1 is supported here — CVSS 4.0's MacroVector engine lives
+* separately — so any other version throws rather than returning a wrong number.
+* The peer of the Go `ComputeCvssScore` (kept byte-identical via shared fixtures).
+*
+* @throws if the version is not 3.1, a required base metric is missing, or any
+*   metric value is out of the 3.1 enum.
+*/
+function computeCvssScore(vector) {
+	const { version, metrics } = parseCvssVector(vector);
+	if (version !== "3.1") throw new Error(`cvss: score compute supports only CVSS 3.1, got "${version}"`);
+	for (const k of [
+		"AV",
+		"AC",
+		"PR",
+		"UI",
+		"S",
+		"C",
+		"I",
+		"A"
+	]) if (!metrics.has(k)) throw new Error(`cvss: missing required 3.1 base metric "${k}"`);
+	const scope = metrics.get("S");
+	if (scope !== "U" && scope !== "C") throw new Error(`cvss: invalid 3.1 Scope value "${scope ?? ""}"`);
+	const scopeChanged = scope === "C";
+	const prTable = scopeChanged ? CVSS31_PR_CHANGED : CVSS31_PR_UNCHANGED;
+	const lookup = (table, metric) => {
+		const key = metrics.get(metric);
+		const w = key === void 0 ? void 0 : table[key];
+		if (w === void 0) throw new Error(`cvss: invalid 3.1 metric value ${metric}:"${key ?? ""}"`);
+		return w;
+	};
+	const av = lookup(CVSS31_AV, "AV");
+	const ac = lookup(CVSS31_AC, "AC");
+	const ui = lookup(CVSS31_UI, "UI");
+	const pr = lookup(prTable, "PR");
+	const c = lookup(CVSS31_CIA, "C");
+	const i = lookup(CVSS31_CIA, "I");
+	const a = lookup(CVSS31_CIA, "A");
+	const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+	const impact = scopeChanged ? 7.52 * (iss - .029) - 3.25 * Math.pow(iss - .02, 15) : 6.42 * iss;
+	const exploitability = 8.22 * av * ac * pr * ui;
+	let baseScore;
+	if (impact <= 0) baseScore = 0;
+	else if (scopeChanged) baseScore = roundUp31(Math.min(1.08 * (impact + exploitability), 10));
+	else baseScore = roundUp31(Math.min(impact + exploitability, 10));
+	const e = cvss31TemporalWeight(CVSS31_E, metrics, "E");
+	const rl = cvss31TemporalWeight(CVSS31_RL, metrics, "RL");
+	const rc = cvss31TemporalWeight(CVSS31_RC, metrics, "RC");
+	const temporalScore = roundUp31(baseScore * e * rl * rc);
+	return {
+		version: "3.1",
+		baseScore,
+		temporalScore
+	};
+}
+const CVSS40 = cvss40_data_default;
+const CVSS40_AV = {
+	N: 0,
+	A: .1,
+	L: .2,
+	P: .3
+};
+const CVSS40_PR = {
+	N: 0,
+	L: .1,
+	H: .2
+};
+const CVSS40_UI = {
+	N: 0,
+	P: .1,
+	A: .2
+};
+const CVSS40_AC = {
+	L: 0,
+	H: .1
+};
+const CVSS40_AT = {
+	N: 0,
+	P: .1
+};
+const CVSS40_VC = {
+	H: 0,
+	L: .1,
+	N: .2
+};
+const CVSS40_SC = {
+	H: .1,
+	L: .2,
+	N: .3
+};
+const CVSS40_SI = {
+	S: 0,
+	H: .1,
+	L: .2,
+	N: .3
+};
+const CVSS40_CR = {
+	H: 0,
+	M: .1,
+	L: .2
+};
+/** Throw on an unexpected missing table entry rather than fabricate a value. */
+function req(value, what) {
+	if (value === void 0) throw new Error(`cvss: 4.0 data table missing ${what}`);
+	return value;
+}
+/**
+* Resolve the effective value of a metric, mirroring the reference m(): E:X and
+* unset default to A (worst case); CR/IR/AR:X and unset default to H; a present,
+* non-X Modified (M-prefixed) metric overrides its base.
+*/
+function cvss40Metric(sel, metric) {
+	const selected = sel.get(metric) ?? "";
+	if (metric === "E" && (selected === "" || selected === "X")) return "A";
+	if ((metric === "CR" || metric === "IR" || metric === "AR") && (selected === "" || selected === "X")) return "H";
+	const modified = sel.get("M" + metric);
+	if (modified !== void 0 && modified !== "X") return modified;
+	return selected;
+}
+function cvss40MacroVectorFromSel(sel) {
+	const mv = (k) => cvss40Metric(sel, k);
+	let eq1 = "2";
+	if (mv("AV") === "N" && mv("PR") === "N" && mv("UI") === "N") eq1 = "0";
+	else if ((mv("AV") === "N" || mv("PR") === "N" || mv("UI") === "N") && mv("AV") !== "P") eq1 = "1";
+	let eq2 = "1";
+	if (mv("AC") === "L" && mv("AT") === "N") eq2 = "0";
+	let eq3 = "2";
+	if (mv("VC") === "H" && mv("VI") === "H") eq3 = "0";
+	else if (mv("VC") === "H" || mv("VI") === "H" || mv("VA") === "H") eq3 = "1";
+	let eq4 = "2";
+	if (mv("MSI") === "S" || mv("MSA") === "S") eq4 = "0";
+	else if (mv("SC") === "H" || mv("SI") === "H" || mv("SA") === "H") eq4 = "1";
+	let eq5 = "2";
+	if (mv("E") === "A") eq5 = "0";
+	else if (mv("E") === "P") eq5 = "1";
+	let eq6 = "1";
+	if (mv("CR") === "H" && mv("VC") === "H" || mv("IR") === "H" && mv("VI") === "H" || mv("AR") === "H" && mv("VA") === "H") eq6 = "0";
+	return eq1 + eq2 + eq3 + eq4 + eq5 + eq6;
+}
+/** Parse a CVSS 4.0 vector and return its MacroVector string. */
+function cvss40MacroVector(vector) {
+	return cvss40MacroVectorFromSel(parseCvssVector(vector).metrics);
+}
+/** Pull a metric's value out of a composed max-vector string (reference extractValueMetric). */
+function cvss40ExtractMetric(metric, s) {
+	const idx = s.indexOf(metric);
+	if (idx < 0) return "";
+	const rest = s.slice(idx + metric.length + 1);
+	const slash = rest.indexOf("/");
+	return slash >= 0 ? rest.slice(0, slash) : rest;
+}
+/** value minus the lower macro's score, or NaN when that lower macro does not exist. */
+function cvss40AvailDist(value, lowerMacro) {
+	const s = CVSS40.lookup[lowerMacro];
+	return s === void 0 ? NaN : value - s;
+}
+function cvss40Score(sel) {
+	const mv = (k) => cvss40Metric(sel, k);
+	if (mv("VC") === "N" && mv("VI") === "N" && mv("VA") === "N" && mv("SC") === "N" && mv("SI") === "N" && mv("SA") === "N") return 0;
+	const macro = cvss40MacroVectorFromSel(sel);
+	let value = req(CVSS40.lookup[macro], `lookup[${macro}]`);
+	const c0 = macro.charAt(0);
+	const c1 = macro.charAt(1);
+	const c2 = macro.charAt(2);
+	const c3 = macro.charAt(3);
+	const c4 = macro.charAt(4);
+	const c5 = macro.charAt(5);
+	const d = (i) => macro.charCodeAt(i) - 48;
+	const eq3 = d(2);
+	const eq6 = d(5);
+	const rep = (i, digit) => macro.slice(0, i) + String(digit) + macro.slice(i + 1);
+	const availDistEq1 = cvss40AvailDist(value, rep(0, d(0) + 1));
+	const availDistEq2 = cvss40AvailDist(value, rep(1, d(1) + 1));
+	const availDistEq4 = cvss40AvailDist(value, rep(3, d(3) + 1));
+	const availDistEq5 = cvss40AvailDist(value, rep(4, d(4) + 1));
+	let availDistEq3eq6 = NaN;
+	if (eq3 === 1 && eq6 === 1 || eq3 === 0 && eq6 === 1) availDistEq3eq6 = cvss40AvailDist(value, rep(2, eq3 + 1));
+	else if (eq3 === 1 && eq6 === 0) availDistEq3eq6 = cvss40AvailDist(value, rep(5, eq6 + 1));
+	else if (eq3 === 0 && eq6 === 0) {
+		const left = CVSS40.lookup[rep(5, eq6 + 1)];
+		const right = CVSS40.lookup[rep(2, eq3 + 1)];
+		if (left !== void 0 && right !== void 0) availDistEq3eq6 = value - Math.max(left, right);
+		else if (right !== void 0) availDistEq3eq6 = value - right;
+	} else availDistEq3eq6 = cvss40AvailDist(value, macro.slice(0, 2) + String(eq3 + 1) + macro.slice(3, 5) + String(eq6 + 1));
+	const eq1Maxes = req(CVSS40.maxComposed.eq1[c0], `maxComposed.eq1[${c0}]`);
+	const eq2Maxes = req(CVSS40.maxComposed.eq2[c1], `maxComposed.eq2[${c1}]`);
+	const eq3eq6Maxes = req(req(CVSS40.maxComposed.eq3[c2], `maxComposed.eq3[${c2}]`)[c5], `maxComposed.eq3[${c2}][${c5}]`);
+	const eq4Maxes = req(CVSS40.maxComposed.eq4[c3], `maxComposed.eq4[${c3}]`);
+	const eq5Maxes = req(CVSS40.maxComposed.eq5[c4], `maxComposed.eq5[${c4}]`);
+	const maxVectors = [];
+	for (const a of eq1Maxes) for (const b of eq2Maxes) for (const c of eq3eq6Maxes) for (const e of eq4Maxes) for (const f of eq5Maxes) maxVectors.push(a + b + c + e + f);
+	const dist = (table, metric, maxVector) => req(table[mv(metric)], `level ${metric}:${mv(metric)}`) - req(table[cvss40ExtractMetric(metric, maxVector)], `max level ${metric}`);
+	let sdAV = 0, sdPR = 0, sdUI = 0, sdAC = 0, sdAT = 0, sdVC = 0, sdVI = 0, sdVA = 0;
+	let sdSC = 0, sdSI = 0, sdSA = 0, sdCR = 0, sdIR = 0, sdAR = 0;
+	for (const maxVector of maxVectors) {
+		sdAV = dist(CVSS40_AV, "AV", maxVector);
+		sdPR = dist(CVSS40_PR, "PR", maxVector);
+		sdUI = dist(CVSS40_UI, "UI", maxVector);
+		sdAC = dist(CVSS40_AC, "AC", maxVector);
+		sdAT = dist(CVSS40_AT, "AT", maxVector);
+		sdVC = dist(CVSS40_VC, "VC", maxVector);
+		sdVI = dist(CVSS40_VC, "VI", maxVector);
+		sdVA = dist(CVSS40_VC, "VA", maxVector);
+		sdSC = dist(CVSS40_SC, "SC", maxVector);
+		sdSI = dist(CVSS40_SI, "SI", maxVector);
+		sdSA = dist(CVSS40_SI, "SA", maxVector);
+		sdCR = dist(CVSS40_CR, "CR", maxVector);
+		sdIR = dist(CVSS40_CR, "IR", maxVector);
+		sdAR = dist(CVSS40_CR, "AR", maxVector);
+		if ([
+			sdAV,
+			sdPR,
+			sdUI,
+			sdAC,
+			sdAT,
+			sdVC,
+			sdVI,
+			sdVA,
+			sdSC,
+			sdSI,
+			sdSA,
+			sdCR,
+			sdIR,
+			sdAR
+		].some((v) => v < 0)) continue;
+		break;
+	}
+	const curEq1 = sdAV + sdPR + sdUI;
+	const curEq2 = sdAC + sdAT;
+	const curEq3eq6 = sdVC + sdVI + sdVA + sdCR + sdIR + sdAR;
+	const curEq4 = sdSC + sdSI + sdSA;
+	const step = .1;
+	const maxSevEq1 = req(CVSS40.maxSeverity.eq1[c0], `maxSeverity.eq1[${c0}]`) * step;
+	const maxSevEq2 = req(CVSS40.maxSeverity.eq2[c1], `maxSeverity.eq2[${c1}]`) * step;
+	const maxSevEq3eq6 = req(req(CVSS40.maxSeverity.eq3eq6[c2], `maxSeverity.eq3eq6[${c2}]`)[c5], `maxSeverity.eq3eq6[${c2}][${c5}]`) * step;
+	const maxSevEq4 = req(CVSS40.maxSeverity.eq4[c3], `maxSeverity.eq4[${c3}]`) * step;
+	let nExisting = 0;
+	let normEq1 = 0, normEq2 = 0, normEq3eq6 = 0, normEq4 = 0;
+	const normEq5 = 0;
+	if (!Number.isNaN(availDistEq1)) {
+		nExisting++;
+		normEq1 = availDistEq1 * (curEq1 / maxSevEq1);
+	}
+	if (!Number.isNaN(availDistEq2)) {
+		nExisting++;
+		normEq2 = availDistEq2 * (curEq2 / maxSevEq2);
+	}
+	if (!Number.isNaN(availDistEq3eq6)) {
+		nExisting++;
+		normEq3eq6 = availDistEq3eq6 * (curEq3eq6 / maxSevEq3eq6);
+	}
+	if (!Number.isNaN(availDistEq4)) {
+		nExisting++;
+		normEq4 = availDistEq4 * (curEq4 / maxSevEq4);
+	}
+	if (!Number.isNaN(availDistEq5)) nExisting++;
+	const meanDistance = nExisting === 0 ? 0 : (normEq1 + normEq2 + normEq3eq6 + normEq4 + normEq5) / nExisting;
+	value -= meanDistance;
+	if (value < 0) value = 0;
+	if (value > 10) value = 10;
+	return Math.round(value * 10) / 10;
+}
+/** Remove the E: segment so the Base score reflects the worst-case default (E:X → E:A). */
+function cvss40StripExploitMaturity(vector) {
+	return vector.split("/").filter((seg) => !seg.startsWith("E:")).join("/");
+}
+/**
+* Compute the CVSS 4.0 score for a vector string, split into a Base score
+* (`baseScore`, with Exploit Maturity stripped to its worst-case default E:A) and
+* a Threat score (`temporalScore`, with the E value present in the vector). For a
+* base-only vector the two are equal. The peer of the Go `ComputeCvss40Score`,
+* kept byte-identical via the shared data file and parity fixture.
+*
+* @throws if the version is not 4.0, a required base metric is missing, or any
+*   metric value is out of the 4.0 enum.
+*/
+function computeCvss40Score(vector) {
+	const { version } = parseCvssVector(vector);
+	if (version !== "4.0") throw new Error(`cvss: 4.0 score compute supports only CVSS 4.0, got "${version}"`);
+	const { valid, errors } = validateCvssVector(vector, "4.0");
+	if (!valid) throw new Error(`cvss: invalid 4.0 vector: ${errors.join("; ")}`);
+	const temporalScore = cvss40Score(parseCvssVector(vector).metrics);
+	return {
+		version: "4.0",
+		baseScore: cvss40Score(parseCvssVector(cvss40StripExploitMaturity(vector)).metrics),
+		temporalScore
+	};
+}
 //#endregion
 //#region src/cpe/index.ts
 const CPE_PREFIX = "cpe:2.3:";
@@ -926,6 +1766,6 @@ function safeDecode(s) {
 	}
 }
 //#endregion
-export { buildCsv, buildCsvArray, buildXml, cvssScoreToSeverity, extractColumn, extractColumn as extractCsvColumn, extractTextFromXml, findRows as findCsvRows, findRows, findValuesByKey as findJsonValues, findValuesByKey, findValuesByKey as findXmlValues, formatTimestamp, formatTimestampSeconds, generateHash, hashObject, impactToSeverity, isValidCsv, isValidJSON, isValidXml, normalizeHdfTimestamps, parseCpe, parseCsv, parseCsvArray, parseCvssVector, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, sanitizeCsvArray, sanitizeCsvObject, sanitizeCsvValue, severityToImpact, sha256, sha512, stringifyJSON, stripHtml, trimUtcFraction, validateCvssVector, verifyHash };
+export { STATUS_SEVERITY_ORDER, buildCsv, buildCsvArray, buildXml, computeCvss40Score, computeCvssScore, computeEffectiveStatus, cvss40MacroVector, cvssScoreToSeverity, extractColumn, extractColumn as extractCsvColumn, extractTextFromXml, findRows as findCsvRows, findRows, findValuesByKey as findJsonValues, findValuesByKey, findValuesByKey as findXmlValues, formatTimestamp, formatTimestampSeconds, generateHash, governingOverrideIndex, governingStatusOverride, governingStatusOverrideIndex, hashObject, impactToSeverity, isValidCsv, isValidJSON, isValidXml, normalizeHdfTimestamps, parseCpe, parseCsv, parseCsvArray, parseCvssVector, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, roundImpact, sanitizeCsvArray, sanitizeCsvObject, sanitizeCsvValue, severityToImpact, sha256, sha512, statusRank, stringifyJSON, stripHtml, trimUtcFraction, validateCvssVector, verifyHash, worstStatus };
 
 //# sourceMappingURL=index.js.map