/** Number of milliseconds in one month (approximate). */
const MS_PER_MONTH = 30 * 24 * 60 * 60 * 1000;
/** Check if a package major is EOL per catalog. */
function isEol(catalog, ecosystem, pkg, major) {
    const ecoEntry = catalog.ecosystems[ecosystem];
    if (!ecoEntry?.eolPackages) {
        return false;
    }
    return ecoEntry.eolPackages.some((e) => e.name === pkg && e.major === major);
}
/** Check if a package has known security CVEs in catalog. */
function hasSecurityRisk(catalog, ecosystem, pkg) {
    const ecoEntry = catalog.ecosystems[ecosystem];
    if (!ecoEntry?.securityRiskPackages) {
        return false;
    }
    return ecoEntry.securityRiskPackages.includes(pkg);
}
/** Determine how many months ago a stable release date occurred. Returns null if no date given. */
function monthsAgo(isoDate, now) {
    if (!isoDate) {
        return null;
    }
    const releaseDate = new Date(isoDate);
    if (isNaN(releaseDate.getTime())) {
        return null;
    }
    return (now.getTime() - releaseDate.getTime()) / MS_PER_MONTH;
}
/** Get the EOL date string for a specific package major, if present. */
function getEolDate(catalog, ecosystem, pkg, major) {
    const ecoEntry = catalog.ecosystems[ecosystem];
    if (!ecoEntry?.eolPackages) {
        return undefined;
    }
    const found = ecoEntry.eolPackages.find((e) => e.name === pkg && e.major === major);
    return found?.eolDate;
}
/** Assess risk for a pending migration. Returns risk, reason, and migration window. */
export function assessMigrationRisk(catalog, ecosystem, pkg, currentMajor, latestMajor, now = new Date()) {
    const thresholds = catalog.riskThresholds;
    // C6: security risk → critical
    if (hasSecurityRisk(catalog, ecosystem, pkg)) {
        return {
            risk: 'critical',
            reason: `${pkg} v${String(currentMajor)} has known security CVEs — upgrade to v${String(latestMajor)} immediately`,
            migrationWindow: 'immediate',
        };
    }
    // C7: current major is EOL → high
    if (isEol(catalog, ecosystem, pkg, currentMajor)) {
        const eolDate = getEolDate(catalog, ecosystem, pkg, currentMajor);
        const dateLabel = eolDate ? ` (EOL since ${eolDate})` : '';
        return {
            risk: 'high',
            reason: `${pkg} v${String(currentMajor)} is end-of-life${dateLabel} — no security patches`,
            migrationWindow: 'next-sprint',
        };
    }
    // C8/C9: use latest-major EOL date as proxy for stable release date
    // We use the EOL date of (latestMajor-1) as the rough release window for latestMajor
    // If no date info, default to medium
    const prevMajorEolDate = getEolDate(catalog, ecosystem, pkg, latestMajor - 1);
    const age = monthsAgo(prevMajorEolDate, now);
    if (age !== null) {
        // C9: latest major released <3 months ago → low (wait-and-see)
        if (age < thresholds.newReleaseMonthsForLow) {
            return {
                risk: 'low',
                reason: `${pkg} v${String(latestMajor)} was released recently — wait for ecosystem to stabilise`,
                migrationWindow: 'backlog',
            };
        }
        // C8: latest major has been stable >6 months → medium
        if (age >= thresholds.stableMonthsForMedium) {
            return {
                risk: 'medium',
                reason: `${pkg} v${String(latestMajor)} has been stable for ${Math.floor(age)} months — plan upgrade`,
                migrationWindow: 'backlog',
            };
        }
    }
    // Default: medium when version gap exists but no date metadata
    const gap = latestMajor - currentMajor;
    return {
        risk: 'medium',
        reason: `${pkg} is ${String(gap)} major version(s) behind (v${String(currentMajor)} → v${String(latestMajor)})`,
        migrationWindow: 'backlog',
    };
}
//# sourceMappingURL=risk-assessor.js.map