@npm-safe/core-dsh 1.0.5

package/dist/index.js

@@ -0,0 +1,711 @@
+/**
+ * Unified composition layer for @npm-safe/core.
+ *
+ * {@link NpmSafeEngine} combines the database, cache, registry client, rate
+ * limiter, static analyzer, and refresh scheduler into a single facade that
+ * exposes the full public API of the engine.
+ *
+ * @module index
+ */
+import { DatabaseManager } from './store/database.js';
+import { CacheManager } from './store/cache-manager.js';
+import { NpmRegistryClient } from './registry/client.js';
+import { NpmRegistryError } from './registry/types.js';
+import { TokenBucket } from './scheduler/rate-limiter.js';
+import { StaticAnalyzer } from './scanner/static-rules.js';
+import { RefreshScheduler } from './scheduler/refresh-scheduler.js';
+import { SecurityLevel } from './scanner/types.js';
+import { RuleConfigManager } from './scanner/rule-config.js';
+import { loadRulesFromDirectory } from './scanner/rule-loader.js';
+import { LEVEL_RANK, readDependencies, readLockfileDependencies } from './scanner/ci-scan.js';
+import { createLlmProvider } from './llm/provider.js';
+import { LlmConfigManager } from './llm/llm-config.js';
+// ============================================================================
+// Engine
+// ============================================================================
+/**
+ * Unified facade that composes every @npm-safe/core module into a single
+ * public API surface.
+ *
+ * Construct an instance with optional {@link NpmSafeEngineOptions}, then use
+ * its methods to check, search, watch, refresh, and configure npm packages.
+ *
+ * @example
+ * ```ts
+ * const engine = new NpmSafeEngine({ dbPath: './my-cache.db' });
+ * const result = await engine.checkPackage('lodash');
+ * console.log(result.security.overallLevel);
+ * await engine.close();
+ * ```
+ */
+export class NpmSafeEngine {
+    /** Database connection manager. */
+    database;
+    /** Cache read/write layer. */
+    cache;
+    /** HTTP client for the npm registry. */
+    client;
+    /** Token bucket rate limiter. */
+    limiter;
+    /** Static analysis engine. */
+    analyzer;
+    /** Per-rule configuration (enabled / severity / options). */
+    ruleConfig;
+    /** Auto-refresh scheduler. */
+    scheduler;
+    /** LLM provider configuration manager. */
+    llmConfig;
+    /** Optional semantic security scanner. */
+    llmProvider;
+    /**
+     * @param options - Optional configuration overrides; see
+     *   {@link NpmSafeEngineOptions} for available options.
+     */
+    constructor(options) {
+        this.database = new DatabaseManager(options?.dbPath ?? './npm-safe.db');
+        this.cache = new CacheManager(this.database, {
+            cacheTtlMs: options?.cacheTtlMs,
+        });
+        this.client = new NpmRegistryClient({
+            baseUrl: options?.registryUrl,
+            proxy: options?.proxy,
+        });
+        this.limiter = new TokenBucket(options?.rateLimit ?? 5, options?.rateLimitBurst ?? 10);
+        this.ruleConfig = new RuleConfigManager(options?.rulesConfigPath);
+        this.analyzer = new StaticAnalyzer(undefined, this.ruleConfig);
+        this.llmConfig = new LlmConfigManager(options?.llmConfigPath);
+        this.llmProvider = options?.llm
+            ? createLlmProvider(options.llm)
+            : this.llmConfig.createProvider();
+        this.scheduler = new RefreshScheduler(this.client, this.cache, this.limiter, this.analyzer, () => this.llmProvider);
+        void this.loadRulePlugins(options?.rulesDir);
+    }
+    // --------------------------------------------------------------------------
+    // Package checking & searching
+    // --------------------------------------------------------------------------
+    /**
+     * Check a package by name, returning cached data if still fresh, or fetching
+     * from the registry, running static analysis, and caching the result.
+     *
+     * When the package does not exist on the registry (HTTP 404) the returned
+     * {@link CheckResult.exists} is `false` and the security / registry info
+     * fields are empty. All other errors (network failure, timeout, …) are
+     * rethrown so the caller can handle them appropriately.
+     *
+     * Pass `{ forceRefresh: true }` to skip the cache-hit fast path entirely
+     * and always re-fetch from the registry. Pass `{ signal }` to make the
+     * check cooperatively cancellable — an abort settles the promise promptly
+     * with `DOMException('The operation was aborted.', 'AbortError')`.
+     *
+     * @param name - Fully-qualified package name (scope included when scoped).
+     * @param options - Optional check options (forceRefresh, signal).
+     * @returns A promise that resolves to the check result.
+     */
+    async checkPackage(name, options) {
+        // 1. Try the cache first — unless forceRefresh bypasses it entirely.
+        if (!options?.forceRefresh) {
+            const cached = await this.cache.getPackage(name);
+            if (cached !== null) {
+                const latestVersion = cached['dist-tags'].latest;
+                const staticScan = await this.cache.getSecurityReport(name, latestVersion);
+                const llmScan = this.llmProvider
+                    ? (await this.cache.getLlmScanReport(name, latestVersion)) ??
+                        await this.scanWithLlm(cached, latestVersion, options?.signal)
+                    : undefined;
+                return this.buildCheckResult(name, true, latestVersion, staticScan ?? null, llmScan, {
+                    description: cached.description ?? '',
+                    homepage: cached.homepage ?? '',
+                    repository: repositoryToString(cached.repository),
+                }, null);
+            }
+        }
+        // 2. Cache miss, stale, or forceRefresh — fetch from the registry.
+        try {
+            const meta = await this.client.getPackageMetadata(name, {
+                signal: options?.signal,
+            });
+            const latestVersion = meta['dist-tags'].latest;
+            // Persist the fresh metadata before running analysis so the cache is
+            // updated even if analysis fails downstream.
+            await this.cache.setPackage(meta);
+            // Derive a package.json-like object from the latest version manifest
+            // for the static analyzer. The spread + double-cast is needed because
+            // AbbreviatedVersion is a readonly interface, not a plain object.
+            const manifest = meta.versions[latestVersion];
+            const packageJson = manifest
+                ? { ...manifest }
+                : undefined;
+            const readme = meta.readme ?? '';
+            const report = this.analyzer.analyze(readme, packageJson);
+            await this.cache.setSecurityReport(report);
+            const llmScan = this.llmProvider
+                ? await this.scanWithLlm(meta, latestVersion, options?.signal)
+                : undefined;
+            return this.buildCheckResult(name, true, latestVersion, report, llmScan, {
+                description: meta.description ?? '',
+                homepage: meta.homepage ?? '',
+                repository: repositoryToString(meta.repository),
+            }, new Date().toISOString());
+        }
+        catch (err) {
+            // A 404 from the registry means the package simply does not exist —
+            // return a graceful "not found" result instead of throwing.
+            if (err instanceof NpmRegistryError && err.statusCode === 404) {
+                return this.buildCheckResult(name, false, '', null, undefined, null, null);
+            }
+            throw err;
+        }
+    }
+    /**
+     * Search the npm registry for packages matching a text query.
+     *
+     * @param query - Free-text search query.
+     * @param options - Optional search options. `options.size` caps the number
+     *   of results (defaults to 20); `options.signal` is forwarded to the
+     *   registry client for cooperative cancellation. Search is not cached, so
+     *   there is no `forceRefresh` option here.
+     * @returns An array of search-result hits, ordered by relevance.
+     */
+    async searchPackages(query, options) {
+        return this.client.searchPackages(query, {
+            size: options?.size,
+            signal: options?.signal,
+        });
+    }
+    /**
+     * Check many packages in parallel with a shared concurrency cap.
+     *
+     * Every check consumes one token from the rate limiter, so the batch
+     * respects the configured request budget even when running concurrently.
+     * Individual failures are isolated: a package that throws (network error,
+     * timeout, …) yields a `{ ok: false, error }` entry instead of rejecting
+     * the whole batch. Use `checkPackage` when the raw error must propagate.
+     *
+     * @param names - Package names to check.
+     * @param options - Batch options (concurrency, progress callback).
+     * @returns One entry per input name, in input order.
+     */
+    async checkPackages(names, options) {
+        const concurrency = Math.max(1, Math.min(options?.concurrency ?? 5, names.length || 1));
+        const results = new Array(names.length);
+        let next = 0;
+        let done = 0;
+        const worker = async () => {
+            for (;;) {
+                // Short-circuit at the top of each iteration so an aborted batch
+                // settles promptly instead of the worker catch swallowing the
+                // AbortError as a per-package error and continuing to iterate
+                // (cooperative cancellation).
+                if (options?.signal?.aborted)
+                    break;
+                const index = next++;
+                if (index >= names.length)
+                    return;
+                const name = names[index];
+                try {
+                    await this.limiter.consume(1);
+                    const result = await this.checkPackage(name, {
+                        signal: options?.signal,
+                    });
+                    const entry = { name, ok: true, result };
+                    results[index] = entry;
+                    done++;
+                    options?.onProgress?.(done, names.length, entry);
+                }
+                catch (error) {
+                    const entry = {
+                        name,
+                        ok: false,
+                        error: error instanceof Error ? error.message : String(error),
+                    };
+                    results[index] = entry;
+                    done++;
+                    options?.onProgress?.(done, names.length, entry);
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: concurrency }, () => worker()));
+        return results;
+    }
+    // --------------------------------------------------------------------------
+    // CI scan
+    // --------------------------------------------------------------------------
+    /**
+     * Scan a project's dependencies and return a CI report with a failure gate.
+     *
+     * Reads dependencies from `package.json` (or `package-lock.json` when
+     * `options.lockfile` is set), checks each one via {@link checkPackage}, and
+     * aggregates the results into a {@link CiReport}. The report's `failed` flag
+     * is `true` when any dependency reaches `options.failLevel` (inclusive) or
+     * when any check throws.
+     *
+     * This method is a pure computation — it does NOT log, format, or set process
+     * exit codes. The caller (CLI or plugin) renders the report and maps `failed`
+     * to an exit code.
+     *
+     * When `options.signal` is supplied, the loop short-circuits at the top of
+     * each iteration on abort and rejects with
+     * `DOMException('The operation was aborted.', 'AbortError')` so an aborted
+     * scan does not keep iterating deps (cooperative cancellation).
+     *
+     * @param options - Optional scan configuration. Defaults:
+     *   `dir = process.cwd()`, `failLevel = SecurityLevel.Dangerous`.
+     * @returns A {@link CiReport} describing every checked dependency.
+     */
+    async ciScan(options) {
+        const dir = options?.dir ?? process.cwd();
+        const failLevel = options?.failLevel ?? SecurityLevel.Dangerous;
+        const deps = options?.lockfile
+            ? readLockfileDependencies(dir, !options?.prod)
+            : readDependencies(dir, !options?.prod);
+        const results = [];
+        const summary = {
+            safe: 0,
+            suspicious: 0,
+            dangerous: 0,
+            unknown: 0,
+            errors: 0,
+        };
+        for (const dep of deps) {
+            // Short-circuit at the top of each iteration so an aborted scan does
+            // not keep iterating deps (cooperative cancellation). The throw is
+            // BEFORE the try/catch so it propagates instead of being swallowed as
+            // a per-package error.
+            if (options?.signal?.aborted) {
+                throw new DOMException('The operation was aborted.', 'AbortError');
+            }
+            try {
+                const result = await this.checkPackage(dep.name, {
+                    signal: options?.signal,
+                });
+                const level = result.security.overallLevel;
+                results.push({
+                    name: dep.name,
+                    exists: result.exists,
+                    version: result.latestVersion,
+                    level,
+                    score: result.security.overallScore,
+                    findingCount: result.security.staticScan?.findings.length ?? 0,
+                });
+                summary[level] = (summary[level] ?? 0) + 1;
+                if (result.exists) {
+                    await this.recordCheckHistory(result);
+                }
+            }
+            catch (err) {
+                results.push({
+                    name: dep.name,
+                    exists: false,
+                    version: '',
+                    level: SecurityLevel.Unknown,
+                    score: 0,
+                    findingCount: 0,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                summary.errors++;
+            }
+        }
+        const failRank = LEVEL_RANK[failLevel];
+        const failed = summary.errors > 0 ||
+            results.some((r) => r.exists &&
+                LEVEL_RANK[r.level] !== undefined &&
+                LEVEL_RANK[r.level] <= failRank);
+        return {
+            dir,
+            scannedAt: new Date().toISOString(),
+            dependencyCount: deps.length,
+            failLevel,
+            failed,
+            summary,
+            packages: results,
+        };
+    }
+    // --------------------------------------------------------------------------
+    // Watchlist
+    // --------------------------------------------------------------------------
+    /**
+     * Returns the list of package names currently on the watchlist.
+     *
+     * @returns All watched package names, in insertion order.
+     */
+    async getWatchlist() {
+        return this.cache.getWatchlist();
+    }
+    /**
+     * Add a package to the watchlist. Idempotent — adding a name that is already
+     * watched is a no-op.
+     *
+     * @param name - Fully-qualified package name to watch.
+     */
+    async addToWatchlist(name) {
+        return this.cache.addToWatchlist(name);
+    }
+    /**
+     * Remove a package from the watchlist. No-op if the name was not watched.
+     *
+     * @param name - Fully-qualified package name to stop watching.
+     */
+    async removeFromWatchlist(name) {
+        return this.cache.removeFromWatchlist(name);
+    }
+    // --------------------------------------------------------------------------
+    // Refresh
+    // --------------------------------------------------------------------------
+    /**
+     * Refresh a single package: fetch its latest metadata from the registry,
+     * re-run static analysis, and persist the results.
+     *
+     * Per-package failures are surfaced via the scheduler's `refresh:error`
+     * event and represented by a `false` result rather than thrown, so a
+     * failing package does not abort a batch. An external abort
+     * (`options.signal` aborted) propagates as
+     * `DOMException('The operation was aborted.', 'AbortError')`.
+     *
+     * @param name - Fully-qualified package name to refresh.
+     * @param options - Optional refresh options. `options.signal` is forwarded
+     *   to the registry fetch and LLM scan.
+     */
+    async refreshPackage(name, options) {
+        return this.scheduler.refreshPackage(name, options);
+    }
+    /**
+     * Refresh every package whose cached metadata has passed its TTL.
+     *
+     * Packages are processed sequentially so the rate limiter is respected.
+     * When `options.signal` is supplied, the loop short-circuits at the top of
+     * each iteration on abort and rejects with
+     * `DOMException('The operation was aborted.', 'AbortError')`.
+     *
+     * @param options - Optional refresh options. `options.signal` is forwarded
+     *   to each per-package refresh.
+     */
+    async refreshAll(options) {
+        return this.scheduler.refreshAll(options);
+    }
+    // --------------------------------------------------------------------------
+    // Settings
+    // --------------------------------------------------------------------------
+    /**
+     * Retrieve a setting value by key.
+     *
+     * @param key - Settings key.
+     * @returns The stored value, or `null` if the key is unset.
+     */
+    async getSetting(key) {
+        return this.cache.getSetting(key);
+    }
+    /**
+     * Upsert a setting value by key.
+     *
+     * @param key - Settings key.
+     * @param value - Value to persist.
+     */
+    async setSetting(key, value) {
+        return this.cache.setSetting(key, value);
+    }
+    // --------------------------------------------------------------------------
+    // Check history
+    // --------------------------------------------------------------------------
+    /**
+     * Record a check into the persistent history database. Used by the CLI and
+     * the desktop extension so history is shared across both frontends.
+     *
+     * @param result - A check result for an existing package.
+     */
+    async recordCheckHistory(result) {
+        if (!result.exists)
+            return;
+        await this.recordHistoryEntry({
+            packageName: result.packageName,
+            level: result.security.overallLevel,
+            score: result.security.overallScore,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    /**
+     * Append a raw history entry (newest-first, capped at 1000).
+     */
+    async recordHistoryEntry(entry) {
+        await this.cache.addHistoryEntry(entry);
+    }
+    /**
+     * Return the persistent check history, newest first (capped at 1000).
+     */
+    async getCheckHistory(limit) {
+        return this.cache.getHistory(limit);
+    }
+    /**
+     * Clear the persistent check history.
+     */
+    async clearCheckHistory() {
+        return this.cache.clearHistory();
+    }
+    // --------------------------------------------------------------------------
+    // Rule plugin management
+    // --------------------------------------------------------------------------
+    /**
+     * Register a scan rule at runtime. A rule with the same id replaces the
+     * existing one.
+     *
+     * @param rule - The rule to register.
+     */
+    registerRule(rule) {
+        this.analyzer.registerRule(rule);
+    }
+    /**
+     * Remove a scan rule by id.
+     *
+     * @param ruleId - Id of the rule to remove.
+     * @returns `true` if a rule was removed, `false` if no such rule exists.
+     */
+    unregisterRule(ruleId) {
+        return this.analyzer.unregisterRule(ruleId);
+    }
+    /**
+     * Describe every registered rule with its effective status.
+     *
+     * @returns Rule descriptors in registration order.
+     */
+    listRules() {
+        return this.analyzer.listRules();
+    }
+    /**
+     * Enable or disable a rule (persisted in the rules config file).
+     *
+     * @param ruleId - Id of the rule.
+     * @param enabled - Whether the rule should run.
+     */
+    setRuleEnabled(ruleId, enabled) {
+        this.ruleConfig.setEnabled(ruleId, enabled);
+    }
+    /**
+     * Override a rule's severity (persisted). Pass `undefined` to clear the
+     * override and return to the rule's default severity.
+     *
+     * @param ruleId - Id of the rule.
+     * @param severity - Severity override, or `undefined` to clear.
+     */
+    setRuleSeverity(ruleId, severity) {
+        this.ruleConfig.setSeverity(ruleId, severity);
+    }
+    /**
+     * Set free-form options for a rule (persisted). Rule implementations can
+     * read these via the rule config manager.
+     *
+     * @param ruleId - Id of the rule.
+     * @param options - Free-form options.
+     */
+    setRuleOptions(ruleId, options) {
+        this.ruleConfig.setOptions(ruleId, options);
+    }
+    /**
+     * Access the rule configuration manager for low-level inspection.
+     *
+     * @returns The rule configuration manager backing this engine.
+     */
+    getRuleConfig() {
+        return this.ruleConfig;
+    }
+    /**
+     * Load third-party rules from a directory of ES module files.
+     *
+     * Each `*.mjs` / `*.js` file may export a `rule`, `rules`, or `default`
+     * binding holding one or more {@link ScanRule}s. Files that fail to load
+     * are skipped.
+     *
+     * @param dir - Directory to scan. Defaults to `~/.npm-safe/rules/`.
+     * @returns The number of rules loaded.
+     */
+    async loadRulePlugins(dir) {
+        const results = await loadRulesFromDirectory(dir);
+        let count = 0;
+        for (const result of results) {
+            for (const rule of result.rules) {
+                this.analyzer.registerRule(rule);
+                count++;
+            }
+        }
+        return count;
+    }
+    // --------------------------------------------------------------------------
+    // LLM configuration
+    // --------------------------------------------------------------------------
+    /**
+     * Get the raw LLM configuration, including the API key.
+     *
+     * @returns The current persisted LLM config.
+     */
+    getLlmConfig() {
+        return this.llmConfig.getConfig();
+    }
+    /**
+     * Get a masked, display-safe view of the LLM status.
+     *
+     * @returns Status object safe to render in a UI.
+     */
+    getLlmStatus() {
+        return this.llmConfig.getStatus();
+    }
+    /**
+     * Update the LLM configuration and recreate the provider.
+     *
+     * The change is persisted immediately. If LLM scanning is disabled or no
+     * API key is available, the provider is set to `undefined` so the rest of the
+     * engine continues unaffected.
+     *
+     * @param update - Partial config update. Pass `{ enabled: false }` to disable.
+     */
+    setLlmConfig(update) {
+        this.llmConfig.setConfig(update);
+        this.llmProvider = this.llmConfig.createProvider();
+        this.scheduler.setLlmProvider(this.llmProvider);
+    }
+    /**
+     * Test whether the current LLM configuration can connect to its provider.
+     *
+     * @returns `true` if the provider is enabled, configured, and the test call
+     *   succeeds; `false` otherwise.
+     */
+    async testLlmConnection() {
+        return this.llmConfig.testConnection();
+    }
+    // --------------------------------------------------------------------------
+    // Auto-refresh lifecycle
+    // --------------------------------------------------------------------------
+    /**
+     * Start the periodic auto-refresh loop.
+     *
+     * The first refresh cycle kicks off immediately in the background; subsequent
+     * cycles repeat at `intervalMs`. Safe to call multiple times — calling while
+     * already running resets the interval.
+     *
+     * @param intervalMs - Milliseconds between refresh cycles.
+     *   Defaults to 1 hour.
+     */
+    startAutoRefresh(intervalMs) {
+        this.scheduler.start(intervalMs);
+    }
+    /**
+     * Stop the periodic auto-refresh loop.
+     *
+     * Safe to call when the scheduler is not running. Any in-flight refresh
+     * continues to completion.
+     */
+    stopAutoRefresh() {
+        this.scheduler.stop();
+    }
+    // --------------------------------------------------------------------------
+    // Lifecycle
+    // --------------------------------------------------------------------------
+    /**
+     * Release all resources held by the engine.
+     *
+     * Stops the auto-refresh scheduler, disposes the rate-limiter timer, and
+     * closes the database connection. After calling this method the engine
+     * instance must not be used for further operations.
+     */
+    close() {
+        this.scheduler.stop();
+        this.limiter.dispose();
+        this.database.close();
+    }
+    // --------------------------------------------------------------------------
+    // Internal helpers
+    // --------------------------------------------------------------------------
+    /**
+     * Assemble a {@link CheckResult} from its constituent parts.
+     */
+    buildCheckResult(packageName, exists, latestVersion, staticScan, llmScan, registryInfo, cachedAt) {
+        const overallScore = combineScores(staticScan, llmScan);
+        return {
+            packageName,
+            exists,
+            latestVersion,
+            security: {
+                overallLevel: scoreToSecurityLevel(overallScore),
+                overallScore,
+                staticScan,
+                llmScan,
+            },
+            registryInfo,
+            cachedAt,
+        };
+    }
+    async scanWithLlm(meta, version, signal) {
+        if (!this.llmProvider) {
+            return { enabled: false, reason: 'LLM provider is not configured.' };
+        }
+        const manifest = meta.versions[version];
+        try {
+            const report = await this.llmProvider.scan({
+                packageName: meta.name,
+                version,
+                description: meta.description ?? '',
+                readme: meta.readme ?? '',
+                packageJson: manifest ? { ...manifest } : undefined,
+                signal,
+            });
+            await this.cache.setLlmScanReport(meta.name, version, report);
+            return report;
+        }
+        catch (error) {
+            // An external abort must propagate as AbortError so the caller
+            // settles promptly (cooperative cancellation) instead of receiving
+            // a disabled LLM report and returning normally.
+            if (signal?.aborted) {
+                throw new DOMException('The operation was aborted.', 'AbortError');
+            }
+            const report = {
+                enabled: false,
+                reason: error instanceof Error ? error.message : String(error),
+                scannedAt: new Date().toISOString(),
+            };
+            await this.cache.setLlmScanReport(meta.name, version, report);
+            return report;
+        }
+    }
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Normalize a {@link PackageRepository} value to a plain string.
+ *
+ * Structured descriptors are rendered as `"type:url"`; shorthand strings are
+ * returned verbatim; `undefined` produces an empty string.
+ *
+ * @param repo - Repository descriptor from registry metadata.
+ * @returns A string representation suitable for display.
+ */
+function repositoryToString(repo) {
+    if (repo === undefined)
+        return '';
+    if (typeof repo === 'string')
+        return repo;
+    return `${repo.type}:${repo.url}`;
+}
+function combineScores(staticScan, llmScan) {
+    if (!staticScan)
+        return 0;
+    if (!llmScan?.enabled)
+        return staticScan.score;
+    return Math.round(staticScan.score * 0.6 + (100 - (llmScan.suspiciousScore ?? 0)) * 0.4);
+}
+function scoreToSecurityLevel(score) {
+    if (score >= 80)
+        return SecurityLevel.Safe;
+    if (score >= 50)
+        return SecurityLevel.Suspicious;
+    if (score >= 20)
+        return SecurityLevel.Dangerous;
+    return SecurityLevel.Unknown;
+}
+export { createLlmProvider, LlmProviderError } from './llm/provider.js';
+export { LlmConfigManager, getDefaultLlmConfigPath } from './llm/llm-config.js';
+export { RuleConfigManager } from './scanner/rule-config.js';
+export { loadRulesFromDirectory } from './scanner/rule-loader.js';
+export { DatabaseManager } from './store/database.js';
+export { CacheManager, DEFAULT_CACHE_TTL_MS, MAX_CHECK_HISTORY } from './store/cache-manager.js';
+export { SecurityLevel, Severity } from './scanner/types.js';
+export { LEVEL_RANK, readDependencies, readLockfileDependencies } from './scanner/ci-scan.js';
+//# sourceMappingURL=index.js.map