guardrail-security 1.0.0

package/dist/supply-chain/typosquat.js

@@ -0,0 +1,257 @@
+"use strict";
+/**
+ * Typosquatting Detection
+ *
+ * Detects potential typosquatting attacks against popular packages
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.typosquatDetector = exports.TyposquatDetector = void 0;
+/**
+ * Top 100 most popular npm packages (simplified list)
+ */
+const POPULAR_PACKAGES = [
+    'react', 'vue', 'angular', 'express', 'next', 'axios', 'lodash', 'webpack',
+    'typescript', 'eslint', 'prettier', 'jest', 'mocha', 'chai', 'babel',
+    'moment', 'dayjs', 'date-fns', 'redux', 'mobx', 'rxjs', 'socket.io',
+    'fastify', 'koa', 'hapi', 'nestjs', 'prisma', 'mongoose', 'sequelize',
+    'typeorm', 'knex', 'pg', 'mysql', 'redis', 'mongodb', 'sqlite3',
+    'passport', 'jsonwebtoken', 'bcrypt', 'crypto-js', 'uuid', 'nanoid',
+    'dotenv', 'config', 'yargs', 'commander', 'inquirer', 'chalk', 'ora',
+    'debug', 'winston', 'pino', 'morgan', 'cors', 'helmet', 'compression',
+    'multer', 'body-parser', 'cookie-parser', 'express-session', 'passport',
+    'nodemailer', 'sendgrid', 'twilio', 'stripe', 'aws-sdk', 'google-cloud',
+    'firebase', 'azure', 'docker', 'kubernetes', 'terraform', 'ansible',
+    'jenkins', 'gitlab', 'github', 'bitbucket', 'jira', 'confluence',
+    'slack', 'discord', 'telegram', 'whatsapp', 'sentry', 'datadog',
+    'newrelic', 'prometheus', 'grafana', 'elasticsearch', 'kibana', 'logstash',
+    'kafka', 'rabbitmq', 'celery', 'bull', 'agenda', 'cron', 'node-schedule',
+];
+class TyposquatDetector {
+    popularPackages;
+    constructor() {
+        this.popularPackages = new Set(POPULAR_PACKAGES);
+    }
+    /**
+     * Detect typosquatting
+     */
+    async detectTyposquatting(packageName) {
+        const patterns = [];
+        let targetPackage;
+        let maxSimilarity = 0;
+        // Check against popular packages
+        for (const popular of this.popularPackages) {
+            // Skip if exact match
+            if (packageName === popular) {
+                continue;
+            }
+            // Check various typosquatting techniques
+            const techniques = [
+                this.checkCharacterSwap(packageName, popular),
+                this.checkMissingCharacter(packageName, popular),
+                this.checkExtraCharacter(packageName, popular),
+                this.checkHomoglyph(packageName, popular),
+                this.checkCombosquatting(packageName, popular),
+                this.checkLevenshtein(packageName, popular),
+            ];
+            for (const technique of techniques) {
+                if (technique.isMatch) {
+                    patterns.push(technique.pattern);
+                    if (technique.similarity > maxSimilarity) {
+                        maxSimilarity = technique.similarity;
+                        targetPackage = popular;
+                    }
+                }
+            }
+        }
+        return {
+            isTyposquat: patterns.length > 0,
+            suspiciousPackage: packageName,
+            targetPackage,
+            similarity: maxSimilarity,
+            patterns,
+        };
+    }
+    /**
+     * Check for character swap (e.g., raect vs react)
+     */
+    checkCharacterSwap(pkg, popular) {
+        if (Math.abs(pkg.length - popular.length) > 0) {
+            return { isMatch: false, pattern: '', similarity: 0 };
+        }
+        // Try swapping adjacent characters
+        for (let i = 0; i < popular.length - 1; i++) {
+            const swapped = popular.substring(0, i) +
+                popular[i + 1] +
+                popular[i] +
+                popular.substring(i + 2);
+            if (swapped === pkg) {
+                return {
+                    isMatch: true,
+                    pattern: 'character_swap',
+                    similarity: 0.95,
+                };
+            }
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Check for missing character (e.g., reat vs react)
+     */
+    checkMissingCharacter(pkg, popular) {
+        if (pkg.length !== popular.length - 1) {
+            return { isMatch: false, pattern: '', similarity: 0 };
+        }
+        // Try removing each character
+        for (let i = 0; i < popular.length; i++) {
+            const removed = popular.substring(0, i) + popular.substring(i + 1);
+            if (removed === pkg) {
+                return {
+                    isMatch: true,
+                    pattern: 'missing_character',
+                    similarity: 0.9,
+                };
+            }
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Check for extra character (e.g., reactt vs react)
+     */
+    checkExtraCharacter(pkg, popular) {
+        if (pkg.length !== popular.length + 1) {
+            return { isMatch: false, pattern: '', similarity: 0 };
+        }
+        // Try removing each character from pkg
+        for (let i = 0; i < pkg.length; i++) {
+            const removed = pkg.substring(0, i) + pkg.substring(i + 1);
+            if (removed === popular) {
+                return {
+                    isMatch: true,
+                    pattern: 'extra_character',
+                    similarity: 0.9,
+                };
+            }
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Check for homoglyph substitution (e.g., react with Cyrillic 'а')
+     */
+    checkHomoglyph(pkg, popular) {
+        // Common homoglyphs
+        const homoglyphs = {
+            'a': ['а', 'ɑ', 'α'], // Cyrillic/Greek a
+            'e': ['е', ' е'], // Cyrillic e
+            'o': ['о', 'ο', '0'], // Cyrillic/Greek o, zero
+            'i': ['і', 'ı', 'l', '1'], // Cyrillic i, Turkish i, l, one
+            'c': ['с', 'ϲ'], // Cyrillic c
+            'p': ['р'], // Cyrillic p
+            'x': ['х', 'χ'], // Cyrillic/Greek x
+        };
+        // Normalize both strings
+        const normalize = (str) => {
+            let normalized = str;
+            for (const [latin, alternates] of Object.entries(homoglyphs)) {
+                for (const alt of alternates) {
+                    normalized = normalized.replace(new RegExp(alt, 'g'), latin);
+                }
+            }
+            return normalized;
+        };
+        const normalizedPkg = normalize(pkg);
+        if (normalizedPkg === popular && normalizedPkg !== pkg) {
+            return {
+                isMatch: true,
+                pattern: 'homoglyph',
+                similarity: 0.95,
+            };
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Check for combosquatting (e.g., react-native-safe vs react)
+     */
+    checkCombosquatting(pkg, popular) {
+        if (pkg.includes(popular) && pkg !== popular) {
+            // Check if it's just adding common suffixes/prefixes
+            const commonAdditions = ['-js', '-node', '-utils', '-core', '-plugin', '-webpack', '-babel'];
+            for (const addition of commonAdditions) {
+                if (pkg === popular + addition || pkg === addition + popular) {
+                    return {
+                        isMatch: true,
+                        pattern: 'combosquatting',
+                        similarity: 0.7,
+                    };
+                }
+            }
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Check Levenshtein distance
+     */
+    checkLevenshtein(pkg, popular) {
+        const distance = this.levenshteinDistance(pkg, popular);
+        const maxLength = Math.max(pkg.length, popular.length);
+        const similarity = 1 - (distance / maxLength);
+        // Consider it suspicious if similarity > 0.8
+        if (similarity >= 0.8 && similarity < 1.0) {
+            return {
+                isMatch: true,
+                pattern: 'levenshtein_distance',
+                similarity,
+            };
+        }
+        return { isMatch: false, pattern: '', similarity: 0 };
+    }
+    /**
+     * Calculate Levenshtein distance
+     */
+    levenshteinDistance(a, b) {
+        const matrix = [];
+        // Initialize matrix with proper dimensions
+        for (let i = 0; i <= b.length; i++) {
+            matrix[i] = [];
+            for (let j = 0; j <= a.length; j++) {
+                matrix[i][j] = 0;
+            }
+        }
+        // Set first column
+        for (let i = 0; i <= b.length; i++) {
+            matrix[i][0] = i;
+        }
+        // Set first row
+        for (let j = 0; j <= a.length; j++) {
+            matrix[0][j] = j;
+        }
+        for (let i = 1; i <= b.length; i++) {
+            for (let j = 1; j <= a.length; j++) {
+                if (b.charAt(i - 1) === a.charAt(j - 1)) {
+                    matrix[i][j] = matrix[i - 1][j - 1];
+                }
+                else {
+                    matrix[i][j] = Math.min(matrix[i - 1][j - 1] + 1, // substitution
+                    matrix[i][j - 1] + 1, // insertion
+                    matrix[i - 1][j] + 1 // deletion
+                    );
+                }
+            }
+        }
+        return matrix[b.length][a.length];
+    }
+    /**
+     * Get popular packages list
+     */
+    async getPopularPackages() {
+        return Array.from(this.popularPackages);
+    }
+    /**
+     * Add custom popular package
+     */
+    addPopularPackage(packageName) {
+        this.popularPackages.add(packageName);
+    }
+}
+exports.TyposquatDetector = TyposquatDetector;
+// Export singleton
+exports.typosquatDetector = new TyposquatDetector();

package/dist/supply-chain/vulnerability-db.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Vulnerability Database Integration
+ *
+ * Integrates with multiple vulnerability databases:
+ * - OSV (Open Source Vulnerabilities)
+ * - GitHub Security Advisories
+ * - NVD (National Vulnerability Database)
+ */
+export interface Vulnerability {
+    id: string;
+    source: 'osv' | 'github' | 'nvd' | 'npm';
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    cvssScore?: number;
+    title: string;
+    description: string;
+    affectedVersions: string[];
+    patchedVersions: string[];
+    references: string[];
+    publishedAt: Date;
+    updatedAt: Date;
+    cwe?: string[];
+}
+export interface VulnerabilityCheckResult {
+    package: string;
+    version: string;
+    vulnerabilities: Vulnerability[];
+    isVulnerable: boolean;
+    highestSeverity: 'none' | 'low' | 'medium' | 'high' | 'critical';
+    recommendedVersion?: string;
+}
+export interface VulnerabilityReport {
+    projectPath: string;
+    scanDate: Date;
+    totalPackages: number;
+    vulnerablePackages: number;
+    results: VulnerabilityCheckResult[];
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+}
+export declare class VulnerabilityDatabase {
+    private osvApiUrl;
+    private npmAuditUrl;
+    /**
+     * Check a single package for vulnerabilities
+     */
+    checkPackage(name: string, version: string): Promise<VulnerabilityCheckResult>;
+    /**
+     * Check multiple packages in bulk
+     */
+    checkPackages(packages: {
+        name: string;
+        version: string;
+    }[]): Promise<VulnerabilityCheckResult[]>;
+    /**
+     * Query OSV (Open Source Vulnerabilities) API
+     */
+    private queryOSV;
+    /**
+     * Parse OSV API response
+     */
+    private parseOSVResponse;
+    /**
+     * Query npm audit API
+     */
+    private queryNpmAudit;
+    /**
+     * Parse npm audit response
+     */
+    private parseNpmAuditResponse;
+    /**
+     * Map OSV severity to standard levels
+     */
+    private mapOSVSeverity;
+    /**
+     * Extract affected versions from OSV format
+     */
+    private extractAffectedVersions;
+    /**
+     * Extract patched versions from OSV format
+     */
+    private extractPatchedVersions;
+    /**
+     * Deduplicate vulnerabilities by ID
+     */
+    private deduplicateVulnerabilities;
+    /**
+     * Build result object
+     */
+    private buildResult;
+    /**
+     * Generate a full vulnerability report for a project
+     */
+    generateReport(projectPath: string, packages: {
+        name: string;
+        version: string;
+    }[]): Promise<VulnerabilityReport>;
+    /**
+     * Clear vulnerability cache
+     */
+    clearCache(): void;
+    /**
+     * Get cache statistics
+     */
+    getCacheStats(): {
+        size: number;
+        oldestEntry: Date | null;
+    };
+}
+export declare const vulnerabilityDatabase: VulnerabilityDatabase;
+//# sourceMappingURL=vulnerability-db.d.ts.map

package/dist/supply-chain/vulnerability-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-db.d.ts","sourceRoot":"","sources":["../../src/supply-chain/vulnerability-db.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAKD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,WAAW,CAAkE;IAIrF;;OAEG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoCpF;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAevG;;OAEG;YACW,QAAQ;IA6BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;OAEG;YACW,aAAa;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmB7B;;OAEG;IACH,OAAO,CAAC,cAAc;IAYtB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;OAEG;IACH,OAAO,CAAC,WAAW;IAwBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4BtH;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE;CAY5D;AAGD,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/dist/supply-chain/vulnerability-db.js

@@ -0,0 +1,310 @@
+"use strict";
+/**
+ * Vulnerability Database Integration
+ *
+ * Integrates with multiple vulnerability databases:
+ * - OSV (Open Source Vulnerabilities)
+ * - GitHub Security Advisories
+ * - NVD (National Vulnerability Database)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vulnerabilityDatabase = exports.VulnerabilityDatabase = void 0;
+const vulnerabilityCache = new Map();
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000; // 6 hours
+class VulnerabilityDatabase {
+    osvApiUrl = 'https://api.osv.dev/v1';
+    npmAuditUrl = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk';
+    // GitHub API available for future enhancement with authentication
+    // private githubApiUrl = 'https://api.github.com/advisories';
+    /**
+     * Check a single package for vulnerabilities
+     */
+    async checkPackage(name, version) {
+        const cacheKey = `${name}@${version}`;
+        const cached = vulnerabilityCache.get(cacheKey);
+        if (cached && (Date.now() - cached.fetchedAt.getTime()) < CACHE_TTL_MS) {
+            return this.buildResult(name, version, cached.data);
+        }
+        const vulnerabilities = [];
+        // Query multiple sources in parallel
+        const [osvVulns, npmVulns] = await Promise.allSettled([
+            this.queryOSV(name, version),
+            this.queryNpmAudit(name, version),
+        ]);
+        if (osvVulns.status === 'fulfilled') {
+            vulnerabilities.push(...osvVulns.value);
+        }
+        if (npmVulns.status === 'fulfilled') {
+            vulnerabilities.push(...npmVulns.value);
+        }
+        // Deduplicate by ID
+        const uniqueVulns = this.deduplicateVulnerabilities(vulnerabilities);
+        // Cache the result
+        vulnerabilityCache.set(cacheKey, {
+            data: uniqueVulns,
+            fetchedAt: new Date(),
+        });
+        return this.buildResult(name, version, uniqueVulns);
+    }
+    /**
+     * Check multiple packages in bulk
+     */
+    async checkPackages(packages) {
+        const batchSize = 20;
+        const results = [];
+        for (let i = 0; i < packages.length; i += batchSize) {
+            const batch = packages.slice(i, i + batchSize);
+            const batchResults = await Promise.all(batch.map(pkg => this.checkPackage(pkg.name, pkg.version)));
+            results.push(...batchResults);
+        }
+        return results;
+    }
+    /**
+     * Query OSV (Open Source Vulnerabilities) API
+     */
+    async queryOSV(packageName, version) {
+        try {
+            const response = await fetch(`${this.osvApiUrl}/query`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    package: {
+                        name: packageName,
+                        ecosystem: 'npm',
+                    },
+                    version: version,
+                }),
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!response.ok) {
+                return [];
+            }
+            const data = await response.json();
+            return this.parseOSVResponse(data);
+        }
+        catch (error) {
+            console.error(`OSV query failed for ${packageName}@${version}:`, error);
+            return [];
+        }
+    }
+    /**
+     * Parse OSV API response
+     */
+    parseOSVResponse(data) {
+        if (!data.vulns || !Array.isArray(data.vulns)) {
+            return [];
+        }
+        return data.vulns.map((vuln) => ({
+            id: vuln.id,
+            source: 'osv',
+            severity: this.mapOSVSeverity(vuln.severity),
+            cvssScore: vuln.severity?.[0]?.score,
+            title: vuln.summary || vuln.id,
+            description: vuln.details || '',
+            affectedVersions: this.extractAffectedVersions(vuln.affected),
+            patchedVersions: this.extractPatchedVersions(vuln.affected),
+            references: (vuln.references || []).map((r) => r.url),
+            publishedAt: new Date(vuln.published || Date.now()),
+            updatedAt: new Date(vuln.modified || Date.now()),
+            cwe: vuln.database_specific?.cwe_ids || [],
+        }));
+    }
+    /**
+     * Query npm audit API
+     */
+    async queryNpmAudit(packageName, version) {
+        try {
+            const response = await fetch(this.npmAuditUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    [packageName]: [version],
+                }),
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!response.ok) {
+                return [];
+            }
+            const data = await response.json();
+            return this.parseNpmAuditResponse(data, packageName);
+        }
+        catch (error) {
+            console.error(`npm audit query failed for ${packageName}@${version}:`, error);
+            return [];
+        }
+    }
+    /**
+     * Parse npm audit response
+     */
+    parseNpmAuditResponse(data, packageName) {
+        const advisories = data[packageName] || [];
+        return advisories.map((advisory) => ({
+            id: `npm-${advisory.id || advisory.github_advisory_id}`,
+            source: 'npm',
+            severity: advisory.severity || 'medium',
+            cvssScore: advisory.cvss?.score,
+            title: advisory.title || 'Security Advisory',
+            description: advisory.overview || advisory.recommendation || '',
+            affectedVersions: [advisory.vulnerable_versions || '*'],
+            patchedVersions: [advisory.patched_versions || 'No patch available'],
+            references: [advisory.url].filter(Boolean),
+            publishedAt: new Date(advisory.created || Date.now()),
+            updatedAt: new Date(advisory.updated || Date.now()),
+            cwe: advisory.cwe ? [advisory.cwe] : [],
+        }));
+    }
+    /**
+     * Map OSV severity to standard levels
+     */
+    mapOSVSeverity(severity) {
+        if (!severity || !Array.isArray(severity) || severity.length === 0) {
+            return 'medium';
+        }
+        const score = severity[0]?.score || 0;
+        if (score >= 9.0)
+            return 'critical';
+        if (score >= 7.0)
+            return 'high';
+        if (score >= 4.0)
+            return 'medium';
+        return 'low';
+    }
+    /**
+     * Extract affected versions from OSV format
+     */
+    extractAffectedVersions(affected) {
+        if (!affected || !Array.isArray(affected)) {
+            return ['*'];
+        }
+        const versions = [];
+        for (const aff of affected) {
+            if (aff.versions) {
+                versions.push(...aff.versions);
+            }
+            if (aff.ranges) {
+                for (const range of aff.ranges) {
+                    if (range.events) {
+                        const introduced = range.events.find((e) => e.introduced);
+                        const fixed = range.events.find((e) => e.fixed);
+                        if (introduced) {
+                            versions.push(`>=${introduced.introduced}${fixed ? ` <${fixed.fixed}` : ''}`);
+                        }
+                    }
+                }
+            }
+        }
+        return versions.length > 0 ? versions : ['*'];
+    }
+    /**
+     * Extract patched versions from OSV format
+     */
+    extractPatchedVersions(affected) {
+        if (!affected || !Array.isArray(affected)) {
+            return [];
+        }
+        const versions = [];
+        for (const aff of affected) {
+            if (aff.ranges) {
+                for (const range of aff.ranges) {
+                    if (range.events) {
+                        const fixed = range.events.find((e) => e.fixed);
+                        if (fixed) {
+                            versions.push(fixed.fixed);
+                        }
+                    }
+                }
+            }
+        }
+        return versions;
+    }
+    /**
+     * Deduplicate vulnerabilities by ID
+     */
+    deduplicateVulnerabilities(vulns) {
+        const seen = new Set();
+        return vulns.filter(vuln => {
+            if (seen.has(vuln.id)) {
+                return false;
+            }
+            seen.add(vuln.id);
+            return true;
+        });
+    }
+    /**
+     * Build result object
+     */
+    buildResult(name, version, vulnerabilities) {
+        const severityOrder = { critical: 4, high: 3, medium: 2, low: 1, none: 0 };
+        let highestSeverity = 'none';
+        for (const vuln of vulnerabilities) {
+            if (severityOrder[vuln.severity] > severityOrder[highestSeverity]) {
+                highestSeverity = vuln.severity;
+            }
+        }
+        // Find recommended version from patches
+        const patchedVersions = vulnerabilities.flatMap(v => v.patchedVersions).filter(Boolean);
+        const recommendedVersion = patchedVersions.length > 0 ? patchedVersions[0] : undefined;
+        return {
+            package: name,
+            version,
+            vulnerabilities,
+            isVulnerable: vulnerabilities.length > 0,
+            highestSeverity,
+            recommendedVersion,
+        };
+    }
+    /**
+     * Generate a full vulnerability report for a project
+     */
+    async generateReport(projectPath, packages) {
+        const results = await this.checkPackages(packages);
+        const summary = {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+        };
+        for (const result of results) {
+            for (const vuln of result.vulnerabilities) {
+                summary[vuln.severity]++;
+            }
+        }
+        const vulnerablePackages = results.filter(r => r.isVulnerable).length;
+        return {
+            projectPath,
+            scanDate: new Date(),
+            totalPackages: packages.length,
+            vulnerablePackages,
+            results,
+            summary,
+        };
+    }
+    /**
+     * Clear vulnerability cache
+     */
+    clearCache() {
+        vulnerabilityCache.clear();
+    }
+    /**
+     * Get cache statistics
+     */
+    getCacheStats() {
+        let oldest = null;
+        for (const entry of vulnerabilityCache.values()) {
+            if (!oldest || entry.fetchedAt < oldest) {
+                oldest = entry.fetchedAt;
+            }
+        }
+        return {
+            size: vulnerabilityCache.size,
+            oldestEntry: oldest,
+        };
+    }
+}
+exports.VulnerabilityDatabase = VulnerabilityDatabase;
+// Export singleton
+exports.vulnerabilityDatabase = new VulnerabilityDatabase();