/**
 * Canonical CVE / GHSA identifiers for deduplication across OSV and NVD.
 */
/** Pick a stable dedup key: prefer CVE-YYYY-NNNN when present in id or aliases. */
export function canonicalVulnId(id, aliases) {
    const all = [...(aliases ?? []), id];
    for (const raw of all) {
        const cve = raw.match(/CVE-\d{4}-\d+/i);
        if (cve)
            return cve[0].toUpperCase();
        const ghsa = raw.match(/GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/i);
        if (ghsa)
            return ghsa[0].toUpperCase();
    }
    return id.toUpperCase();
}
export function dedupeCveFindings(findings, aliasMap) {
    const byKey = new Map();
    for (const f of findings) {
        const key = canonicalVulnId(f.id, aliasMap?.get(f.id));
        const existing = byKey.get(key);
        if (!existing) {
            byKey.set(key, f);
            continue;
        }
        const sevRank = (s) => {
            const u = (s ?? '').toLowerCase();
            if (u === 'critical')
                return 4;
            if (u === 'high')
                return 3;
            if (u === 'medium')
                return 2;
            if (u === 'low')
                return 1;
            return 0;
        };
        if (sevRank(f.severity) > sevRank(existing.severity)) {
            byKey.set(key, f);
        }
    }
    return [...byKey.values()];
}
//# sourceMappingURL=cve-canonical.js.map