import { parseSemver } from './health-scorer.js';
// ---------------------------------------------------------------------------
// Known vulnerable ranges (subset of well-known public CVEs)
// ---------------------------------------------------------------------------
const KNOWN_VULNERABLE_RANGES = {
    lodash: {
        ranges: [
            { minVersion: '0.0.0', maxVersion: '4.17.21', cves: ['CVE-2021-23337', 'CVE-2020-8203'] },
        ],
    },
    qs: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '6.7.3', cves: ['CVE-2022-24999'] }],
    },
    axios: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '1.6.0', cves: ['CVE-2023-45857'] }],
    },
    'node-fetch': {
        ranges: [{ minVersion: '0.0.0', maxVersion: '2.6.7', cves: ['CVE-2022-0235'] }],
    },
    minimist: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '1.2.6', cves: ['CVE-2021-44906'] }],
    },
    moment: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '2.29.4', cves: ['CVE-2022-24785'] }],
    },
    jsonwebtoken: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '9.0.0', cves: ['CVE-2022-23529'] }],
    },
    'serialize-javascript': {
        ranges: [{ minVersion: '0.0.0', maxVersion: '3.1.0', cves: ['CVE-2020-7660'] }],
    },
    'path-parse': {
        ranges: [{ minVersion: '0.0.0', maxVersion: '1.0.7', cves: ['CVE-2021-23343'] }],
    },
    glob: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '7.2.3', cves: ['CVE-2021-21315'] }],
    },
    tar: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '6.1.11', cves: ['CVE-2021-37712'] }],
    },
    semver: {
        ranges: [{ minVersion: '0.0.0', maxVersion: '7.5.2', cves: ['CVE-2022-25883'] }],
    },
};
// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
/**
 * Return true if version is in [minVersion, maxVersion) range.
 * Uses a best-effort semver comparison.
 */
function isInRange(version, range) {
    const cur = parseSemver(version);
    const min = parseSemver(range.minVersion);
    const max = parseSemver(range.maxVersion);
    if (!cur || !min || !max) {
        return false;
    }
    const curNum = cur.major * 1_000_000 + cur.minor * 1_000 + cur.patch;
    const minNum = min.major * 1_000_000 + min.minor * 1_000 + min.patch;
    const maxNum = max.major * 1_000_000 + max.minor * 1_000 + max.patch;
    return curNum >= minNum && curNum < maxNum;
}
/**
 * Check if a dependency version matches any known vulnerable range.
 * Returns the list of CVE IDs if vulnerable, empty array otherwise.
 */
function findCves(name, version) {
    const pkg = KNOWN_VULNERABLE_RANGES[name];
    if (!pkg) {
        return [];
    }
    const cves = [];
    for (const range of pkg.ranges) {
        if (isInRange(version, range)) {
            cves.push(...range.cves);
        }
    }
    return cves;
}
// ---------------------------------------------------------------------------
// Public API
// ---------------------------------------------------------------------------
/**
 * Scan dependencies for known vulnerabilities.
 * Updates statusCode to 'vulnerable' and populates cves[] when matched.
 * The _projectPath parameter is reserved for future network-based scanning.
 */
export function scanForVulnerabilities(deps, _projectPath) {
    return deps.map((dep) => {
        if (dep.statusCode === 'vulnerable') {
            return dep;
        }
        const cves = findCves(dep.name, dep.currentVersion);
        if (cves.length === 0) {
            return dep;
        }
        return {
            ...dep,
            statusCode: 'vulnerable',
            severity: 'critical',
            cves,
        };
    });
}
export { KNOWN_VULNERABLE_RANGES };
//# sourceMappingURL=vulnerability-scanner.js.map