vulnsig 0.1.0

package/README.md

@@ -0,0 +1,2 @@
+# threatprint-ts
+The TS implementation of Threatprint

package/dist/color.d.ts

@@ -0,0 +1,2 @@
+import type { HueResult } from './types.js';
+export declare function scoreToHue(score: number): HueResult;

package/dist/color.js

@@ -0,0 +1,24 @@
+export function scoreToHue(score) {
+    const w = Math.max(0, Math.min(10, score)) / 10;
+    // Light Yellow (low) → Orange (mid) → Dark Red (high)
+    //   0 = light yellow  hsl(55, 95%, 55%)
+    //   5 = orange         hsl(25, 95%, 53%)
+    //  10 = dark red       hsl(0, 80%, 28%)
+    let hue;
+    if (w <= 0.5) {
+        // light yellow → orange: hue 55 → 25
+        hue = 55 - (w / 0.5) * 30;
+    }
+    else {
+        // orange → dark red: hue 25 → 0
+        hue = 25 - ((w - 0.5) / 0.5) * 25;
+    }
+    const sat = 85 + (1 - w) * 10; // 95% at low → 85% at high
+    // Lightness multiplier: asymmetric — subtle brightening for low scores,
+    // aggressive darkening for high scores (8-10 distinguishability)
+    //   score 0: 1.15, score 5: 1.0, score 10: 0.55
+    const light = w <= 0.5
+        ? 1.0 + (0.5 - w) * 0.3 // low end:  1.0 → 1.15
+        : 1.0 - (w - 0.5) * 0.9; // high end: 1.0 → 0.55
+    return { hue, sat, light };
+}

package/dist/geometry.d.ts

@@ -0,0 +1,7 @@
+export declare function arcPath(cx: number, cy: number, innerR: number, outerR: number, startDeg: number, endDeg: number): string;
+export declare function starPath(cx: number, cy: number, points: number, outerR: number, innerR: number): string;
+export declare function radialCuts(startDeg: number, endDeg: number, cutWidth: number, gapDeg: number): {
+    startDeg: number;
+    endDeg: number;
+}[];
+export declare function ringFill(magnitude: number, hue: number, sat: number, light?: number): string;

package/dist/geometry.js

@@ -0,0 +1,52 @@
+const DEG2RAD = Math.PI / 180;
+export function arcPath(cx, cy, innerR, outerR, startDeg, endDeg) {
+    const s = startDeg * DEG2RAD;
+    const e = endDeg * DEG2RAD;
+    const la = endDeg - startDeg > 180 ? 1 : 0;
+    const osx = cx + Math.cos(s) * outerR;
+    const osy = cy + Math.sin(s) * outerR;
+    const oex = cx + Math.cos(e) * outerR;
+    const oey = cy + Math.sin(e) * outerR;
+    const iex = cx + Math.cos(e) * innerR;
+    const iey = cy + Math.sin(e) * innerR;
+    const isx = cx + Math.cos(s) * innerR;
+    const isy = cy + Math.sin(s) * innerR;
+    return `M${osx},${osy} A${outerR},${outerR} 0 ${la},1 ${oex},${oey} L${iex},${iey} A${innerR},${innerR} 0 ${la},0 ${isx},${isy} Z`;
+}
+export function starPath(cx, cy, points, outerR, innerR) {
+    let d = '';
+    for (let i = 0; i < points; i++) {
+        const oa = (Math.PI * 2 * i) / points - Math.PI / 2;
+        const ia = (Math.PI * 2 * (i + 0.5)) / points - Math.PI / 2;
+        const ox = cx + Math.cos(oa) * outerR;
+        const oy = cy + Math.sin(oa) * outerR;
+        const ix = cx + Math.cos(ia) * innerR;
+        const iy = cy + Math.sin(ia) * innerR;
+        d += (i === 0 ? `M${ox},${oy}` : `L${ox},${oy}`) + `L${ix},${iy}`;
+    }
+    return d + 'Z';
+}
+export function radialCuts(startDeg, endDeg, cutWidth, gapDeg) {
+    const cuts = [];
+    const sectorSpan = endDeg - startDeg;
+    const step = cutWidth + gapDeg;
+    // Number of visible segments = numCuts + 1, each gapDeg wide.
+    // Total = numCuts * cutWidth + (numCuts + 1) * gapDeg = sectorSpan
+    // Solve: numCuts = floor((sectorSpan - gapDeg) / step)
+    const numCuts = Math.floor((sectorSpan - gapDeg) / step);
+    const patternSpan = numCuts * cutWidth + (numCuts + 1) * gapDeg;
+    const offset = (sectorSpan - patternSpan) / 2;
+    for (let i = 0; i < numCuts; i++) {
+        const cutStart = startDeg + offset + (i + 1) * gapDeg + i * cutWidth;
+        const cutEnd = cutStart + cutWidth;
+        cuts.push({ startDeg: cutStart, endDeg: cutEnd });
+    }
+    return cuts;
+}
+export function ringFill(magnitude, hue, sat, light = 1) {
+    if (magnitude <= 0.01)
+        return `hsla(${hue}, ${sat * 0.1}%, ${12 * light}%, 0.9)`;
+    if (magnitude <= 0.5)
+        return `hsla(${hue}, ${sat * 0.5}%, ${35 * light}%, 0.92)`;
+    return `hsla(${hue}, ${sat * 0.9}%, ${58 * light}%, 0.95)`;
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { renderGlyph } from './render.js';
+export { parseCVSS } from './parse.js';
+export { scoreToHue } from './color.js';
+export { calculateScore } from './score.js';
+export type { RenderOptions, ParsedMetrics, HueResult } from './types.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export { renderGlyph } from './render.js';
+export { parseCVSS } from './parse.js';
+export { scoreToHue } from './color.js';
+export { calculateScore } from './score.js';

package/dist/parse.d.ts

@@ -0,0 +1,8 @@
+import type { ParsedMetrics } from './types.js';
+export declare const METRIC_DEFS: Record<string, {
+    severity: Record<string, number>;
+}>;
+export declare function parseCVSS(vector: string): ParsedMetrics;
+export declare function detectCVSSVersion(vector: string): '3.0' | '3.1' | '4.0';
+export declare function isVersion3(version: '3.0' | '3.1' | '4.0'): boolean;
+export declare function getSeverity(metrics: ParsedMetrics, key: string): number;

package/dist/parse.js

@@ -0,0 +1,49 @@
+export const METRIC_DEFS = {
+    AV: { severity: { N: 1.0, A: 0.7, L: 0.4, P: 0.15 } },
+    AC: { severity: { L: 1.0, H: 0.4 } },
+    AT: { severity: { N: 1.0, P: 0.4 } },
+    PR: { severity: { N: 1.0, L: 0.6, H: 0.2 } },
+    UI: { severity: { N: 1.0, P: 0.6, A: 0.2, R: 0.2 } }, // R for CVSS 3.0/3.1
+    VC: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    VI: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    VA: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    SC: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    SI: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    SA: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    // CVSS 3.0/3.1 metrics (C/I/A without V prefix, S for scope)
+    C: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    I: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    A: { severity: { H: 1.0, L: 0.5, N: 0.0 } },
+    S: { severity: { C: 1.0, U: 0.0 } }, // Scope: Changed or Unchanged
+};
+export function parseCVSS(vector) {
+    const m = {};
+    for (const part of vector.split('/')) {
+        const [key, val] = part.split(':');
+        if (METRIC_DEFS[key])
+            m[key] = val;
+    }
+    return m;
+}
+export function detectCVSSVersion(vector) {
+    if (vector.startsWith('CVSS:3.1/')) {
+        return '3.1';
+    }
+    else if (vector.startsWith('CVSS:3.0/')) {
+        return '3.0';
+    }
+    else if (vector.startsWith('CVSS:4.0/')) {
+        return '4.0';
+    }
+    throw new Error(`Unsupported CVSS version. Vector must start with 'CVSS:3.0/', 'CVSS:3.1/', or 'CVSS:4.0/'`);
+}
+export function isVersion3(version) {
+    return version === '3.0' || version === '3.1';
+}
+export function getSeverity(metrics, key) {
+    const def = METRIC_DEFS[key];
+    const val = metrics[key];
+    if (!def || !val)
+        return 0;
+    return def.severity[val] ?? 0;
+}

package/dist/render.d.ts

@@ -0,0 +1,2 @@
+import type { RenderOptions } from './types.js';
+export declare function renderGlyph(options: RenderOptions): string;

package/dist/render.js

@@ -0,0 +1,157 @@
+import { parseCVSS, getSeverity, detectCVSSVersion, isVersion3 } from './parse.js';
+import { calculateScore } from './score.js';
+import { scoreToHue } from './color.js';
+import { arcPath, starPath, radialCuts, ringFill } from './geometry.js';
+export function renderGlyph(options) {
+    const { vector, size = 120 } = options;
+    const metrics = parseCVSS(vector);
+    const version = detectCVSSVersion(vector);
+    // Score precedence: explicit → auto-calculate → fallback 5.0
+    let score;
+    if (options.score != null) {
+        score = options.score;
+    }
+    else {
+        score = calculateScore(vector);
+    }
+    const { hue, sat, light } = scoreToHue(score);
+    // Metric severities - handle CVSS 3.0, 3.1, and 4.0
+    const ac = getSeverity(metrics, 'AC');
+    // For CVSS 3.0/3.1, AT doesn't exist, so always treat as solid (AT:N)
+    const at = isVersion3(version) ? 1.0 : getSeverity(metrics, 'AT');
+    // For CVSS 3.0/3.1, use C/I/A instead of VC/VI/VA
+    const vc = isVersion3(version) ? getSeverity(metrics, 'C') : getSeverity(metrics, 'VC');
+    const vi = isVersion3(version) ? getSeverity(metrics, 'I') : getSeverity(metrics, 'VI');
+    const va = isVersion3(version) ? getSeverity(metrics, 'A') : getSeverity(metrics, 'VA');
+    // For CVSS 3.0/3.1, if S:C (Changed), both bands mirror C/I/A. If S:U (Unchanged), no split.
+    let sc, si, sa;
+    if (isVersion3(version)) {
+        const scopeChanged = getSeverity(metrics, 'S') > 0.5; // S:C = 1.0, S:U = 0.0
+        if (scopeChanged) {
+            // Split band: both bands mirror C/I/A
+            sc = vc;
+            si = vi;
+            sa = va;
+        }
+        else {
+            // No split
+            sc = 0;
+            si = 0;
+            sa = 0;
+        }
+    }
+    else {
+        // CVSS 4.0: use SC/SI/SA directly
+        sc = getSeverity(metrics, 'SC');
+        si = getSeverity(metrics, 'SI');
+        sa = getSeverity(metrics, 'SA');
+    }
+    const hasAnySub = sc > 0 || si > 0 || sa > 0;
+    const atPresent = at < 0.5;
+    const cx = 60, cy = 60;
+    const petalCount = { N: 8, A: 6, L: 4, P: 3 }[metrics.AV] || 8;
+    // Geometry constants
+    const ringWidth = 4.375;
+    const ringGap = 1.5;
+    const outerR = 44;
+    const hueRingR = outerR + ringGap + ringWidth / 2;
+    const subInnerR = outerR - ringWidth;
+    const vulnOuterR = subInnerR - ringGap;
+    const vulnInnerR = vulnOuterR - ringWidth;
+    const innerR = vulnInnerR;
+    const gapDeg = 3;
+    const cutGapDeg = 4;
+    const cutWidthDeg = 3;
+    const starOuterR = innerR - 2;
+    const starInnerR = starOuterR * (0.55 - ac * 0.35);
+    // PR stroke
+    const prRaw = metrics.PR;
+    const prStrokeWidth = prRaw === 'H' ? 3.2 : prRaw === 'L' ? 1.0 : 0;
+    // UI spikes/bumps
+    const uiRaw = metrics.UI;
+    const spikeBase = hueRingR + ringWidth / 2 - 0.5;
+    // Star fill — match the outer hue ring color
+    const sfSat = sat;
+    const sfLight = 52 * light;
+    const sfAlpha = 0.85;
+    const bgColor = `hsl(${hue}, 4%, 5%)`;
+    // Deterministic gradient ID from vector hash
+    const gradId = 'sg-' + simpleHash(vector);
+    // Sectors
+    const sectors = [
+        { key: 'C', s: -150 + gapDeg / 2, e: -30 - gapDeg / 2, vuln: vc, sub: sc },
+        { key: 'I', s: -30 + gapDeg / 2, e: 90 - gapDeg / 2, vuln: vi, sub: si },
+        { key: 'A', s: 90 + gapDeg / 2, e: 210 - gapDeg / 2, vuln: va, sub: sa },
+    ];
+    const parts = [];
+    // Defs
+    parts.push(`<defs><radialGradient id="${gradId}" cx="50%" cy="50%" r="50%">`);
+    parts.push(`<stop offset="0%" stop-color="hsla(${hue}, ${sfSat * 1.1}%, ${sfLight + 6}%, ${Math.min(1, sfAlpha + 0.1)})"/>`);
+    parts.push(`<stop offset="100%" stop-color="hsla(${hue}, ${sfSat}%, ${sfLight}%, ${sfAlpha})"/>`);
+    parts.push(`</radialGradient></defs>`);
+    // Z-order 1: UI:N Spikes
+    if (uiRaw === 'N') {
+        for (let i = 0; i < petalCount; i++) {
+            const a = (Math.PI * 2 * i) / petalCount - Math.PI / 2;
+            const x1 = cx + Math.cos(a) * spikeBase;
+            const y1 = cy + Math.sin(a) * spikeBase;
+            const x2 = cx + Math.cos(a) * (spikeBase + 3.4);
+            const y2 = cy + Math.sin(a) * (spikeBase + 3.4);
+            parts.push(`<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="hsl(${hue}, ${sat}%, ${52 * light}%)" stroke-width="3.0" stroke-linecap="round"/>`);
+        }
+    }
+    // Z-order 2: UI:P Bumps
+    if (uiRaw === 'P') {
+        const bumpR = 4.6;
+        for (let i = 0; i < petalCount; i++) {
+            const a = (Math.PI * 2 * i) / petalCount - Math.PI / 2;
+            const bx = cx + Math.cos(a) * spikeBase;
+            const by = cy + Math.sin(a) * spikeBase;
+            const perpL = a - Math.PI / 2;
+            const perpR = a + Math.PI / 2;
+            const x1 = bx + Math.cos(perpL) * bumpR;
+            const y1 = by + Math.sin(perpL) * bumpR;
+            const x2 = bx + Math.cos(perpR) * bumpR;
+            const y2 = by + Math.sin(perpR) * bumpR;
+            parts.push(`<path d="M${x1},${y1} A${bumpR},${bumpR} 0 0,1 ${x2},${y2} Z" fill="hsl(${hue}, ${sat}%, ${52 * light}%)"/>`);
+        }
+    }
+    // Z-order 3: Background circle
+    parts.push(`<circle cx="${cx}" cy="${cy}" r="${innerR}" fill="${bgColor}"/>`);
+    // Z-order 4: Star fill
+    const starD = starPath(cx, cy, petalCount, starOuterR, starInnerR);
+    parts.push(`<path d="${starD}" fill="url(#${gradId})" stroke="none"/>`);
+    // Z-order 5: Star stroke (PR:N = no stroke)
+    if (prStrokeWidth > 0) {
+        parts.push(`<path d="${starD}" fill="none" stroke="hsl(${hue}, ${sat}%, ${72 * light}%)" stroke-width="${prStrokeWidth}" stroke-linejoin="round"/>`);
+    }
+    // Z-order 6 & 7: CIA ring sectors
+    for (const sec of sectors) {
+        // Vuln band (inner)
+        const vulnBandOuter = hasAnySub ? vulnOuterR : outerR;
+        parts.push(`<path d="${arcPath(cx, cy, vulnInnerR, vulnBandOuter, sec.s, sec.e)}" fill="${ringFill(sec.vuln, hue, sat, light)}"/>`);
+        // Sub band (outer) — only when split
+        if (hasAnySub) {
+            parts.push(`<path d="${arcPath(cx, cy, subInnerR, outerR, sec.s, sec.e)}" fill="${ringFill(sec.sub, hue, sat, light)}"/>`);
+        }
+    }
+    // Z-order 8: AT:P radial cuts
+    if (atPresent) {
+        for (const sec of sectors) {
+            const cuts = radialCuts(sec.s, sec.e, cutWidthDeg, cutGapDeg);
+            for (const cut of cuts) {
+                parts.push(`<path d="${arcPath(cx, cy, vulnInnerR - 0.5, outerR + 0.5, cut.startDeg, cut.endDeg)}" fill="${bgColor}"/>`);
+            }
+        }
+    }
+    // Z-order 9: Outer hue ring
+    parts.push(`<circle cx="${cx}" cy="${cy}" r="${hueRingR}" fill="none" stroke="hsl(${hue}, ${sat}%, ${52 * light}%)" stroke-width="${ringWidth}"/>`);
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" viewBox="0 0 120 120" style="overflow:visible">${parts.join('')}</svg>`;
+}
+function simpleHash(str) {
+    let h = 0;
+    for (let i = 0; i < str.length; i++) {
+        h = ((h << 5) - h + str.charCodeAt(i)) | 0;
+    }
+    return Math.abs(h).toString(36);
+}

package/dist/score.d.ts

@@ -0,0 +1 @@
+export declare function calculateScore(vector: string): number;

package/dist/score.js

@@ -0,0 +1,29 @@
+import aeCvss from 'ae-cvss-calculator';
+import { detectCVSSVersion } from './parse.js';
+// ae-cvss-calculator is a CJS webpack bundle; the default export
+// contains all named exports when imported from ESM.
+const { Cvss4P0, Cvss3P1, Cvss3P0 } = aeCvss;
+export function calculateScore(vector) {
+    try {
+        const version = detectCVSSVersion(vector);
+        if (version === '3.1') {
+            const cvss = new Cvss3P1();
+            cvss.applyVector(vector);
+            return cvss.calculateScores().base ?? 5.0;
+        }
+        else if (version === '3.0') {
+            const cvss = new Cvss3P0();
+            cvss.applyVector(vector);
+            return cvss.calculateScores().base ?? 5.0;
+        }
+        else {
+            // CVSS 4.0 (validated by detectCVSSVersion)
+            const cvss = new Cvss4P0();
+            cvss.applyVector(vector);
+            return cvss.calculateScores().base ?? cvss.calculateScores().overall;
+        }
+    }
+    catch {
+        return 5.0;
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,30 @@
+export interface RenderOptions {
+    /** CVSS 4.0, CVSS 3.1, or CVSS 3.0 vector string */
+    vector: string;
+    /** Explicit score override (0-10). Auto-calculated when null. */
+    score?: number | null;
+    /** Rendered size in pixels. Default: 120 */
+    size?: number;
+}
+export interface ParsedMetrics {
+    AV: 'N' | 'A' | 'L' | 'P';
+    AC: 'L' | 'H';
+    AT?: 'N' | 'P';
+    PR: 'N' | 'L' | 'H';
+    UI: 'N' | 'P' | 'A' | 'R';
+    VC?: 'H' | 'L' | 'N';
+    VI?: 'H' | 'L' | 'N';
+    VA?: 'H' | 'L' | 'N';
+    SC?: 'H' | 'L' | 'N';
+    SI?: 'H' | 'L' | 'N';
+    SA?: 'H' | 'L' | 'N';
+    C?: 'H' | 'L' | 'N';
+    I?: 'H' | 'L' | 'N';
+    A?: 'H' | 'L' | 'N';
+    S?: 'C' | 'U';
+}
+export interface HueResult {
+    hue: number;
+    sat: number;
+    light: number;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "vulnsig",
+  "version": "0.1.0",
+  "description": "Render CVSS vulnerability vectors as expressive SVG glyphs",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint src/",
+    "format": "prettier --write src/",
+    "format:check": "prettier --check src/",
+    "test": "vitest run",
+    "preview": "npm run build && node scripts/preview.mjs && open doc/preview.html",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "cvss",
+    "vulnerability",
+    "svg",
+    "glyph",
+    "security",
+    "threatprint"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "ae-cvss-calculator": "^1.0.9"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.0.1",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.8.1",
+    "typescript": "^5.4.0",
+    "typescript-eslint": "^8.56.0",
+    "vitest": "^4.0.18"
+  }
+}