fad-checker 1.0.6 → 2.0.0

package/docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md

@@ -0,0 +1,251 @@
+# Design — Codecs & support multi-écosystème (C#/.NET, PHP, Python)
+
+**Date** : 2026-05-29
+**Statut** : approuvé (brainstorming) — prêt pour le plan d'implémentation
+
+## Objectif
+
+1. Réorganiser tout le code spécifique à un écosystème (aujourd'hui Maven + npm/yarn,
+   éparpillé dans `lib/core.js`, `lib/npm/*`, `lib/outdated.js`, `lib/osv.js`,
+   `lib/cve-report.js`, `fad-checker.js`) derrière une **interface codec** uniforme.
+2. Ajouter trois écosystèmes en **parité complète** (vuln, EOL, obsolete, outdated,
+   recette de fix dans le report) : **C#/.NET (nuget)**, **PHP (composer)**, **Python (pypi)**.
+
+## Décisions cadrées (brainstorming)
+
+- **Parité complète d'emblée** pour les 3 nouveaux écosystèmes.
+- **Big-bang** : extraction complète maven/npm vers des codecs (pas de cohabitation
+  « ancien monde / nouveau monde »). Le big-bang **réorganise, il ne réécrit pas** la
+  logique métier éprouvée (résolution POM/BOM, walker Maven Central, parsers lockfiles).
+- **depRecord généralisé** : schéma neutre `{ ecosystem, namespace, name, version,
+  versions[], coordKey, manifestPaths[], … }`.
+- **Règle de résolution de manifeste uniforme** (changement de philosophie) :
+  lockfile présent → on le prend ; sinon **fallback** sur le manifeste lâche
+  (`composer.json` / `requirements.txt` / `*.csproj` / `package.json`) **avec warning**.
+  Versions épinglées scannées, ranges/floating skippées individuellement + warning.
+- **TOML** : dépendance légère **`smol-toml`** (maintenue, zéro dép transitive, TOML 1.0).
+
+### ⚠️ Changement de contrat assumé (npm)
+
+Comportement actuel : un `package.json` sans `package-lock.json`/`yarn.lock` est
+**entièrement skippé** (warning chapitre 0). Nouveau comportement : il est **parsé en
+best-effort** (versions épinglées) avec warning `no-lockfile — résultats partiels`.
+Le test existant `no-lockfile` est adapté en conséquence (vérifie désormais le
+fallback+warning, plus le skip total).
+
+## Architecture
+
+### L'interface codec
+
+`lib/codecs/codec.interface.js` documente le contrat (objet, pas de classe imposée) :
+
+```js
+{
+  id,            // "maven" | "npm" | "yarn" | "nuget" | "composer" | "pypi"
+  label,         // "Maven", "npm", "NuGet", "Composer", "PyPI"
+  osvEcosystem,  // "Maven" | "npm" | "NuGet" | "Packagist" | "PyPI" | null
+
+  manifestNames,            // fichiers revendiqués par ce codec
+  detect(dir) -> bool,      // ce repo contient-il mes manifestes ?
+
+  collect(dir, opts) -> { deps: Map<coordKey, depRecord>, warnings: [] },
+
+  coordKey(dep),            // clé Map normalisée
+  formatCoord(dep),         // affichage report
+  osvPackageName(dep),      // nom pour OSV
+
+  checkRegistry(deps, opts) -> { outdated:[], deprecated:[] },
+  resolveEolProduct(dep) -> { product, label } | null,
+
+  recipe,                   // { label, pinSection, pinIntro, snippet(deps), directSection }
+  nativeScanners,           // scanners au-delà du tronc commun OSV/NVD
+}
+```
+
+### Le depRecord généralisé
+
+```js
+{
+  ecosystem,        // "maven"|"npm"|"yarn"|"nuget"|"composer"|"pypi"
+  namespace,        // groupId (maven) / scope @org (npm) / vendor (composer) / "" sinon
+  name,             // artifactId / package name
+  version,          // version représentative (la plus haute) pour affichage/EOL/outdated
+  versions[],       // toutes les versions concrètes distinctes (CVE/OSV itèrent dessus)
+  coordKey,         // clé de la Map, ex "maven:org.apache:log4j", "pypi:requests"
+  scope, isDev,
+  manifestPaths[],  // remplace pomPaths/manifestPaths
+  // transitif : via, viaPaths, depth
+  // lock-specific : lockType, resolved, integrity
+}
+```
+
+`coordKey` ne collisionne jamais entre écosystèmes (préfixe `ecosystem:`).
+
+### Registre des codecs
+
+`lib/codecs/index.js` :
+- `getCodec(id)` → codec
+- `allCodecs()` → tous les codecs enregistrés
+- `detectCodecs(srcDir)` → codecs dont `detect()` est vrai
+
+### Services partagés (agnostiques — plus aucun `if ecosystem === …`)
+
+- `lib/osv.js` — querybatch groupé par `codec.osvEcosystem`, nom via `codec.osvPackageName`.
+- `lib/nvd.js` — enrichment par CVE-id, totalement agnostique. **Activé pour tous les
+  écosystèmes** : dès qu'OSV remonte un `CVE-xxxx`, NVD/CPE s'appliquent.
+- `lib/cpe.js` — refinement / filtrage faux positifs sur les matches, agnostique.
+- Fetch `endoflife.date` — partagé ; le codec ne fournit que `{ product }`.
+- Cache (`~/.fad-checker/`) — partagé.
+
+### Scanners rattachés à un codec (`nativeScanners`)
+
+- `maven` → CVE-index local cvelistV5 (`lib/cve-download.js` + tier matching `lib/cve-match.js`).
+- `npm`/`yarn` → retire.js (`lib/retire.js`).
+- `nuget` / `composer` / `pypi` → aucun (couverts par OSV + NVD).
+
+### Flux d'orchestration (`fad-checker.js`)
+
+```
+1. detectCodecs(src) filtré par --ecosystem
+2. resolved = Map() ; pour chaque codec actif : merge codec.collect(src,opts).deps
+3. expansion transitive : déléguée au codec (maven → walker Maven Central ; autres → lock)
+4. vuln :
+   a. OSV (tronc commun) groupé par codec.osvEcosystem
+   b. nativeScanners par codec (maven: CVE-index ; npm/yarn: retire.js)
+   c. NVD enrichment (agnostique, par CVE-id)
+   d. CPE refinement (agnostique)
+5. EOL / obsolete / outdated : codec.resolveEolProduct + codec.checkRegistry
+6. render : sections pilotées par les codecs présents
+```
+
+## Spécifications par codec
+
+### maven (extrait)
+
+`collect()` enveloppe `lib/core.js` (parse POM, résolution parent, merge multi-profils,
+`<dependencyManagement>`, imports `scope=import`/BOM) **conservés tels quels** + walker
+`lib/transitive.js`. WebJars : `webjarToNpm()` reste **dans le codec maven** (un WebJar
+est un artifact Maven émettant une coord npm ; le codec maven route ces deps vers le
+chemin npm pour EOL/registre).
+
+| Aspect | Valeur |
+|---|---|
+| coordKey | `maven:groupId:artifactId` |
+| osvEcosystem | `Maven` |
+| nativeScanners | CVE-index cvelistV5 |
+| registre | Maven Central Solr |
+| obsolete | `data/known-obsolete.json` (curated) |
+| EOL | `by_group_artifact` / `by_group_prefix` |
+| recette | `<dependencyManagement>` + maj des deps directes |
+
+### npm / yarn (extrait)
+
+`collect()` enveloppe `lib/npm/parse.js` + `lib/npm/collect.js` (parsers
+package-lock v1/2/3, yarn.lock v1) **conservés**. Deux codecs partageant `osvEcosystem=npm`
+et le préfixe coordKey `npm:` ; `ecosystemType` distingue pour report/recette.
+
+| Aspect | Valeur |
+|---|---|
+| coordKey | `npm:name` (ou `npm:@scope/name`) |
+| osvEcosystem | `npm` |
+| nativeScanners | retire.js |
+| registre | npm registry (`deprecated` + `dist-tags.latest`) |
+| EOL | `by_npm_name` / `by_npm_scope` |
+| recette | `overrides` (npm) / `resolutions` (yarn) |
+
+### nuget (C#/.NET) — nouveau
+
+| Aspect | Valeur |
+|---|---|
+| manifestes | `packages.lock.json` (lock, résolu+transitif), `*.csproj` (`<PackageReference>`, XML via xml2js), `packages.config` (XML legacy) |
+| CPM | `Directory.Packages.props` lu comme **table de versions** ; `PackageReference` sans `Version` résolu contre `<PackageVersion>`, sinon warning `unresolved-versions` |
+| fallback | `.csproj` épinglé scanné ; floating (`1.*`, `[1.0,2.0)`) skip+warning |
+| coordKey | `nuget:<name-lower>` (NuGet case-insensitive ; casse d'origine gardée pour l'affichage) |
+| osvEcosystem | `NuGet` |
+| registre | `api.nuget.org` registration index → version stable max + `deprecation.reasons`/`alternatePackage` |
+| EOL | endoflife.date `dotnet` (target framework `net6.0`/`net48`…), `aspnet`, `entity-framework` via `by_nuget_name` |
+| recette | maj `<PackageReference>` + note CPM `Directory.Packages.props` |
+
+### composer (PHP) — nouveau
+
+| Aspect | Valeur |
+|---|---|
+| manifestes | `composer.lock` (JSON, `packages[]` + `packages-dev[]`, concret+transitif) ; `composer.json` sans lock → fallback+warning |
+| coordKey | `composer:vendor/package` (case-insensitive normalisé) |
+| osvEcosystem | `Packagist` |
+| registre | `repo.packagist.org/p2/{vendor}/{pkg}.json` → dernière version + champ **`abandoned`** (≈ deprecated, peut pointer un remplaçant) |
+| EOL | endoflife.date `php`, `laravel`, `symfony`, `drupal` via `by_composer_name` |
+| recette | `composer require vendor/pkg:^x` / bloc `composer.json` |
+
+### pypi (Python) — nouveau
+
+| Aspect | Valeur |
+|---|---|
+| manifestes | `poetry.lock` (TOML), `Pipfile.lock` (JSON), `uv.lock` / `pdm.lock` (TOML), `requirements.txt` (épinglé `==` seul) |
+| fallback | `requirements.txt` à ranges → skip+warning ; `pyproject.toml`/`Pipfile` sans lock → fallback+warning |
+| normalisation | PEP 503 : `Foo.Bar_baz` → `foo-bar-baz` pour clé/OSV/registre ; casse d'origine pour affichage |
+| coordKey | `pypi:<name-pep503>` |
+| osvEcosystem | `PyPI` |
+| registre | `pypi.org/pypi/{name}/json` → `info.version` (latest) + détection `yanked` par version + classifier `Development Status :: 7 - Inactive` comme signal obsolete |
+| EOL | endoflife.date `python`, `django`, `numpy`, `fastapi` via `by_pypi_name` |
+| recette | `pip install 'pkg>=x'` / ligne `requirements.txt` / bloc selon le lock détecté |
+
+## Données
+
+- `data/eol-mapping.json` gagne `by_nuget_name`, `by_composer_name`, `by_pypi_name`.
+  Ce fichier ne contient **que l'association coord → nom de produit endoflife.date** ;
+  les dates de cycle/EOL sont **récupérées en ligne** (endoflife.date) et **mises en
+  cache 7 jours**. Le mapping peut donc démarrer **minimal** (dotnet/php/python + quelques
+  frameworks) et s'enrichir au fil de l'eau par simple édition JSON, sans toucher au code.
+- `data/known-obsolete.json` reste Maven-only : les autres écosystèmes ont des champs
+  registre authoritatifs (`deprecation` NuGet, `abandoned` Packagist, `yanked` PyPI).
+
+## CLI
+
+- `--ecosystem` : enum → **liste** : `auto` (défaut, = `detect()` vrai) | `all` | liste
+  explicite `maven,nuget,pypi,…`.
+- `--no-<id>` génériques : `--no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi`.
+- `--no-js` conservé comme **alias** de `--no-npm`+`--no-yarn` (rétro-compat).
+- `--transitive` / `--transitive-depth` : s'appliquent au codec maven uniquement
+  (no-op documenté ailleurs ; les autres ont le transitif via lock).
+- `--snyk` : inchangé (POM nettoyé maven).
+
+## Report (`lib/cve-report.js`)
+
+- Sections par écosystème (1.a, 1.b, …) **générées dynamiquement** selon les codecs
+  présents, ordre stable : `maven, npm, yarn, nuget, composer, pypi`.
+- `RECIPE_SPECS` / `ECO_LABELS` / `ECO_MANIFEST_KIND` alimentés depuis `codec.label`,
+  `codec.recipe`, `codec.manifestNames` — fin des maps codées en dur.
+- `formatCoord(dep)` délégué au codec — fin des `if (ecosystem === "npm")` dans le rendu.
+
+## Tests
+
+Objectif : les 96 tests existants restent verts + nouveaux tests.
+
+- Fixtures : `csharp-app/` (.csproj + packages.lock.json + packages.config +
+  Directory.Packages.props), `php-app/` (composer.json + composer.lock),
+  `python-app/` (un répertoire par format : requirements.txt épinglé, poetry.lock,
+  Pipfile.lock, uv.lock).
+- Un fichier de test par codec (`nuget.test.js`, `composer.test.js`, `pypi.test.js`) :
+  parsing, coordKey, normalisation de noms (PEP 503, case-insensitive NuGet),
+  fallback no-lockfile.
+- Test de contrat paramétré sur `allCodecs()` : chaque codec implémente toute l'interface.
+- Fixture `polyglot/` mêlant les 5 écosystèmes (ou extension de `monorepo-mixed`).
+
+## Ordre d'exécution du big-bang (chaque étape laisse le pipeline fonctionnel)
+
+1. `codec.interface.js` + `lib/codecs/index.js` (registre vide).
+2. Généraliser le `depRecord` (`namespace`/`name`/`coordKey`/`manifestPaths`) — adapter
+   collecteurs + report + tests existants.
+3. Extraire `maven` et `npm`/`yarn` dans des codecs (déplacement, pas réécriture) ;
+   brancher l'orchestrateur sur le registre. **→ les 96 tests repassent ici.**
+4. Rendre `osv.js` / `nvd.js` / `cpe.js` / endoflife agnostiques (via codec).
+5. Ajouter `composer` (lock JSON, le plus simple), puis `pypi`, puis `nuget`.
+6. Report dynamique + CLI liste + fixtures + tests nouveaux.
+
+## Hors périmètre (YAGNI)
+
+- Pas de résolution de ranges/floating (cohérent lockfile-first ; ranges → warning).
+- Pas de support yarn-berry (déjà `unsupported` aujourd'hui), pas de pnpm dans ce lot.
+- Pas de scanner natif dédié pour nuget/composer/pypi (OSV + NVD suffisent à la parité).
+- Pas de curation obsolete pour les nouveaux écosystèmes (champs registre authoritatifs).

package/fad-checker.js

@@ -187,8 +187,14 @@ program
 	.option("--no-retire", "skip retire.js vendored-JS scan")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
 	.option("--transitive-depth <n>", "max transitive depth", "6")
-	.option("--ecosystem <eco>", "force ecosystem: auto|maven|npm|both (default: auto)", "auto")
-	.option("--no-js", "skip JS/npm/yarn manifests even if present (Maven-only)")
+	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi (default: auto = detected)", "auto")
+	.option("--no-maven", "skip the Maven codec")
+	.option("--no-npm", "skip the npm codec")
+	.option("--no-yarn", "skip the Yarn codec")
+	.option("--no-nuget", "skip the NuGet (C#/.NET) codec")
+	.option("--no-composer", "skip the Composer (PHP) codec")
+	.option("--no-pypi", "skip the PyPI (Python) codec")
+	.option("--no-js", "alias: skip JS/npm/yarn manifests even if present (Maven-only)")
 	.option("--repo <url...>", "extra Maven repository URL(s) to try before Maven Central. Supports https://user:pass@host/path/. Repeatable.")
 	.option("--add-repo <name>", "persist a Maven repo: --add-repo <name> <url> [--auth user:pass]")
 	.option("--remove-repo <name>", "remove a persisted Maven repo by name")
@@ -242,45 +248,53 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		console.log(chalk.gray(`📦 Maven repos: ${mavenRepos.map(r => r.name).join(" → ")}`));
 	}
 
-	const pomFiles = core.findPomFiles(options.src);
-	const allPomMetadata = core.newMetadataStore();
-	const allPropsByPom = {};
 	let wrotePom = 0;
 
-	// Ecosystem detection. --ecosystem flag overrides auto-detect.
-	const { hasJsManifests } = require("./lib/npm/collect");
+	// --- Codec detection + selection ---
+	const { detectCodecs, allCodecs, getCodec } = require("./lib/codecs");
+	const { resolveActiveCodecs } = require("./lib/codecs/select");
 	const eco = (options.ecosystem || "auto").toLowerCase();
-	const hasMaven = pomFiles.length > 0;
-	const hasJs = !options.js ? false : (eco === "npm" || eco === "both" || (eco === "auto" && hasJsManifests(options.src)));
-	const runMaven = (eco === "maven" || eco === "both" || (eco === "auto" && hasMaven));
-	const runNpm = hasJs && eco !== "maven";
+	const detected = (eco === "auto") ? detectCodecs(options.src).map(c => c.id) : allCodecs().map(c => c.id);
+	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi"].filter(id => options[id] === false);
+	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
+	const runMaven = activeIds.includes("maven");
+	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
+
+	// --- Collect deps from every active codec into one Map (coordKeys never collide) ---
+	const resolved = new Map();
+	let mavenCtx = null;
+	const collectWarnings = [];
+	for (const id of activeIds) {
+		if (id === "yarn") continue;   // the npm codec already collects yarn.lock
+		const codec = getCodec(id);
+		let res;
+		try {
+			res = await codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose });
+		} catch (err) {
+			console.warn(chalk.red(`❌  ${id} collect failed:`), chalk.dim(err.message));
+			continue;
+		}
+		for (const [k, v] of res.deps) resolved.set(k, v);
+		if (res.warnings?.length) collectWarnings.push(...res.warnings);
+		if (id === "maven") mavenCtx = res._maven;
+	}
 
 	if (!readOnly) {
 		try { await rimraf(options.target); } catch (_) { /* fresh dir */ }
 	}
 
-	if (runMaven) console.log(chalk.blue(`🔍 Found ${pomFiles.length} pom.xml files`));
+	if (runMaven && mavenCtx) console.log(chalk.blue(`🔍 Found ${mavenCtx.pomFiles.length} pom.xml files`));
 	if (runNpm)   console.log(chalk.blue(`🔍 JS manifests detected — npm/yarn pipeline enabled`));
 	console.log();
 
-	if (runMaven) {
-		// Phase 1: parse every pom
-		for (const pom of pomFiles) {
-			try { await core.parsePom(pom, allPomMetadata); }
-			catch (err) { console.warn(chalk.red("❌  parse failed:"), chalk.gray(pom), chalk.dim(err.message)); }
-		}
-
-		// Phase 2: resolve inheritance & merge profile deps
-		for (const pom of Object.keys(allPomMetadata.byPath)) {
-			try { await core.getAllInheritedProps(pom, allPomMetadata, allPropsByPom); }
-			catch (err) { console.error(`❌  inheritance failed for ${pom}:`, err.message); }
-		}
-
-		// Phase 3: rewrite cleaned POMs (or simulate, in --test mode)
+	// Maven POM rewrite (cleanup feature). Parse + inheritance already happened
+	// inside the maven codec's collect(); we reuse its metadata store here.
+	if (runMaven && mavenCtx) {
+		const { store, propsByPom, pomFiles } = mavenCtx;
 		const rewriteOpts = { srcRoot: options.src, targetRoot: options.target, deps2Exclude, verbose, readOnly };
 		for (const pom of pomFiles) {
 			try {
-				if (await core.rewritePoms(pom, allPomMetadata, allPropsByPom, rewriteOpts)) wrotePom++;
+				if (await core.rewritePoms(pom, store, propsByPom, rewriteOpts)) wrotePom++;
 			} catch (err) {
 				console.error(chalk.red(`❌  rewrite failed for ${pom}:`), err.message);
 			}
@@ -289,7 +303,8 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 
 	// ---------- Summary: parents missing / excluded ----------
 	let privateLibIds = [];
-	if (runMaven) {
+	if (runMaven && mavenCtx) {
+	const allPomMetadata = mavenCtx.store;   // reuse the codec's parsed metadata
 	console.log(chalk.cyanBright("\n─────────────────────────────────────────────"));
 	console.log(chalk.cyanBright("📦 Résumé des POM analysés :"));
 	console.log(chalk.cyanBright("─────────────────────────────────────────────\n"));
@@ -350,7 +365,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 
 	// ---------- Report flow (CVE / EOL / Obsolete) ----------
 	if (options.report) {
-		await runReportFlow(allPomMetadata, allPropsByPom, { runMaven, runNpm, privateLibIds, mavenRepos });
+		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, collectWarnings });
 	} else if (!readOnly) {
 		const target = options.target;
 		console.log(chalk.gray(`💡 Pour lancer Snyk depuis ${target} :`));
@@ -358,45 +373,35 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	}
 })();
 
-async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
-	const { runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [] } = ecoFlags;
-	const { collectResolvedDeps, expandWithTransitives, matchDepsAgainstCves } = require("./lib/cve-match");
-	const { ensureCveIndex } = require("./lib/cve-download");
+async function runReportFlow(resolved, ecoFlags = {}) {
+	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], collectWarnings = [] } = ecoFlags;
+	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
+	const { getCodec } = require("./lib/codecs");
 	const outdated = require("./lib/outdated");
 	const offline = !!options.offline;
 	if (offline) console.log(chalk.gray("   (--offline: cached data only, no network)"));
 
 	console.log(chalk.bold.cyan("\n📋 Rapport CVE / EOL / Obsolète\n") + chalk.gray("─────────────────────────────"));
 
-	// Collect deps + parent POMs
-	const resolved = runMaven
-		? collectResolvedDeps(allPomMetadata, allPropsByPom, {
-			ignoreTest: !!options.ignoreTest,
-			deps2Exclude,
-		})
-		: new Map();
-	const mavenCount = resolved.size;
-	if (runMaven) console.log(chalk.blue(`📚 ${mavenCount} dépendances Maven directes (incl. parent POMs)`));
-
-	// Merge npm/yarn deps into the same Map (keys are "npm:name", no collision with "g:a")
-	let npmWarnings = [];
+	// Deps were already collected per-codec by main(). Just report the counts.
+	const byEcoCount = {};
+	for (const d of resolved.values()) byEcoCount[d.ecosystem] = (byEcoCount[d.ecosystem] || 0) + 1;
+	if (runMaven) console.log(chalk.blue(`📚 ${byEcoCount.maven || 0} dépendances Maven directes (incl. parent POMs)`));
+	if (runNpm)   console.log(chalk.blue(`📦 ${byEcoCount.npm || 0} dépendances npm/yarn`));
+	for (const [ecoId, n] of Object.entries(byEcoCount)) {
+		if (ecoId === "maven" || ecoId === "npm") continue;
+		const label = (require("./lib/codecs").getCodec(ecoId)?.label) || ecoId;
+		console.log(chalk.blue(`📦 ${n} dépendances ${label}`));
+	}
+
+	// Warnings surfaced during collection (e.g. npm no-lockfile fallback).
+	const npmWarnings = collectWarnings || [];
 	let scanWarnings = [];
-	if (runNpm) {
-		const { collectNpmDeps } = require("./lib/npm/collect");
-		const npmDeps = collectNpmDeps(options.src, {
-			ignoreTest: !!options.ignoreTest,
-			deps2Exclude,
-			verbose,
-		});
-		for (const [k, v] of npmDeps) resolved.set(k, v);
-		console.log(chalk.blue(`📦 ${npmDeps.size} dépendances npm/yarn ajoutées (total: ${resolved.size})`));
-		npmWarnings = npmDeps.warnings || [];
-		if (npmWarnings.length) {
-			console.log(chalk.yellow(`⚠️  ${npmWarnings.length} JS manifest(s) sans lockfile — non scannés :`));
-			for (const w of npmWarnings) {
-				console.log(chalk.yellow(`     • ${w.manifestPath} — ${w.message}`));
-			}
+	if (npmWarnings.length) {
+		console.log(chalk.yellow(`⚠️  ${npmWarnings.length} manifest warning(s) :`));
+		for (const w of npmWarnings) {
+			console.log(chalk.yellow(`     • ${w.manifestPath} — ${w.message}`));
 		}
 	}
 	const directCount = resolved.size;
@@ -419,7 +424,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		}
 	}
 
-	if (options.transitive) {
+	if (options.transitive && runMaven) {
 		await expandWithTransitives(resolved, {
 			verbose,
 			offline,
@@ -430,20 +435,20 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		console.log(chalk.blue(`🌳 ${resolved.size - directCount} dépendances transitives ajoutées (total: ${resolved.size})`));
 	}
 
-	// 1. CVE
+	// 1. CVE — native scanner contributed by the maven codec (local cvelistV5 index).
 	let cveMatches = [];
 	let cveDataDate = null;
-	if (!(options.cveOffline || offline) || fs.existsSync(require("./lib/cve-download").CVE_INDEX_PATH)) {
-		try {
-			const idx = await ensureCveIndex({
-				force: !!options.cveRefresh && !offline,
-				offline: !!options.cveOffline || offline,
-				verbose,
-			});
-			cveDataDate = idx?.meta?.builtAt || null;
-			cveMatches = matchDepsAgainstCves(resolved, idx);
-		} catch (err) {
-			console.warn(chalk.yellow("⚠️  CVE scan skipped:"), err.message);
+	if (runMaven) {
+		const sc = (getCodec("maven").nativeScanners || []).find(s => s.kind === "cve");
+		const indexExists = fs.existsSync(require("./lib/cve-download").CVE_INDEX_PATH);
+		if (sc && (!(options.cveOffline || offline) || indexExists)) {
+			try {
+				const r = await sc.scan(resolved, { cveRefresh: !!options.cveRefresh, cveOffline: !!options.cveOffline, offline, verbose });
+				cveMatches = r.matches || [];
+				cveDataDate = r.meta?.cveDataDate || null;
+			} catch (err) {
+				console.warn(chalk.yellow("⚠️  CVE scan skipped:"), err.message);
+			}
 		}
 	}
 
@@ -469,12 +474,26 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 	// WebJars (Maven artifacts wrapping npm/bower libs), so it runs even in
 	// Maven-only mode. One fetch per package; no-ops when there are no targets.
 	try {
-		const { checkNpmRegistryDeps } = require("./lib/npm/registry");
+		const { checkNpmRegistryDeps } = require("./lib/codecs/npm/registry");
 		const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs });
 		obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
 		outdatedResults = outdatedResults.concat(npmReg.outdated);
 	} catch (err) { console.warn(chalk.yellow("⚠️  npm registry check skipped:"), err.message); }
 
+	// 4b. Per-codec registry for ecosystems beyond maven/npm (composer/pypi/nuget).
+	// maven (Maven Central) + npm (registry) are already covered above; this loop
+	// drives each remaining active codec's own registry (Packagist abandoned, etc.).
+	for (const id of activeIds) {
+		if (id === "maven" || id === "npm" || id === "yarn") continue;
+		const codec = getCodec(id);
+		if (!codec?.checkRegistry) continue;
+		try {
+			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs });
+			obsoleteResults = obsoleteResults.concat(reg.deprecated || []);
+			outdatedResults = outdatedResults.concat(reg.outdated || []);
+		} catch (err) { console.warn(chalk.yellow(`⚠️  ${id} registry check skipped:`), err.message); }
+	}
+
 	// Cross-section dedup: drop entries from outdated that already appear in EOL/Obsolete
 	const eolKeys = new Set(eolResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
 	const obsKeys = new Set(obsoleteResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
@@ -519,16 +538,23 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		}
 	}
 
-	// 5. retire.js — scans vendored JS files (jquery copies, bootstrap, pdf.js, …)
-	//    that live in the source tree without any lockfile to back them.
+	// 5. retire.js — native "vendored" scanner contributed by the npm codec. Scans
+	//    vendored JS files (jquery copies, bootstrap, pdf.js, …) that live in the
+	//    source tree without any lockfile to back them.
+	// Not gated by an active npm ecosystem: retire scans the source tree for
+	// vendored .js (which can live in a Maven project's resources too). The
+	// scanner is owned by the npm codec but runs whenever --retire is on.
 	let retireMatches = [];
 	if (options.retire) {
-		try {
-			const { scanWithRetire } = require("./lib/retire");
-			retireMatches = await scanWithRetire(options.src, { verbose, force: !!options.retireRefresh, offline });
-			console.log(chalk.blue(`🔎 retire.js: ${retireMatches.length} vendored-JS finding(s)`));
-		} catch (err) {
-			console.warn(chalk.yellow("⚠️  retire.js skipped:"), err.message);
+		const sc = (getCodec("npm").nativeScanners || []).find(s => s.kind === "vendored");
+		if (sc) {
+			try {
+				const r = await sc.scan(resolved, { src: options.src, verbose, retireRefresh: !!options.retireRefresh, offline });
+				retireMatches = r.matches || [];
+				console.log(chalk.blue(`🔎 retire.js: ${retireMatches.length} vendored-JS finding(s)`));
+			} catch (err) {
+				console.warn(chalk.yellow("⚠️  retire.js skipped:"), err.message);
+			}
 		}
 	}
 

package/lib/codecs/codec.interface.js

@@ -0,0 +1,27 @@
+/**
+ * lib/codecs/codec.interface.js — contrat que tout codec doit respecter.
+ *
+ * Pas de classe imposée : un codec est un objet litéral exportant ces clés.
+ * Voir docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md.
+ */
+const REQUIRED_KEYS = [
+	"id", "label", "osvEcosystem", "manifestNames",
+	"detect", "collect", "coordKey", "formatCoord", "osvPackageName",
+	"checkRegistry", "resolveEolProduct", "recipe", "nativeScanners",
+];
+const FUNCTION_KEYS = ["detect", "collect", "coordKey", "formatCoord", "osvPackageName", "checkRegistry", "resolveEolProduct"];
+
+function assertCodecShape(codec) {
+	if (!codec || typeof codec !== "object") throw new Error("codec must be an object");
+	for (const k of REQUIRED_KEYS) {
+		if (!(k in codec)) throw new Error(`codec "${codec.id || "?"}" missing required key: ${k}`);
+	}
+	for (const k of FUNCTION_KEYS) {
+		if (typeof codec[k] !== "function") throw new Error(`codec "${codec.id}" key ${k} must be a function`);
+	}
+	if (!Array.isArray(codec.manifestNames)) throw new Error(`codec "${codec.id}" manifestNames must be an array`);
+	if (!Array.isArray(codec.nativeScanners)) throw new Error(`codec "${codec.id}" nativeScanners must be an array`);
+	return true;
+}
+
+module.exports = { REQUIRED_KEYS, FUNCTION_KEYS, assertCodecShape };

package/lib/codecs/composer/parse.js

@@ -0,0 +1,59 @@
+/**
+ * lib/composer/parse.js — parse PHP Composer manifests.
+ *
+ *   composer.lock — { packages: [{name, version}], "packages-dev": [...] }
+ *                   versions are concrete (resolved) — the ideal source.
+ *   composer.json — { require: {name: range}, "require-dev": {...} }
+ *                   used only as a no-lock fallback (pinned exact versions).
+ *
+ * Composer names are "vendor/package", case-insensitive (lowercased by convention).
+ */
+const fs = require("fs");
+
+// "1.2.3" | "v1.2.3" | "dev-main" | "1.0.x-dev". Strip a leading "v" for OSV/registry.
+function normVersion(v) {
+	if (!v) return null;
+	return String(v).replace(/^v/, "");
+}
+function isConcrete(v) {
+	if (!v) return false;
+	return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v).replace(/^v/, ""));
+}
+function splitName(full) {
+	const i = full.indexOf("/");
+	if (i < 0) return { vendor: "", pkg: full };
+	return { vendor: full.slice(0, i), pkg: full.slice(i + 1) };
+}
+
+function parseComposerLock(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (arr, scope) => {
+		for (const p of arr || []) {
+			if (!p.name) continue;
+			const { vendor, pkg } = splitName(p.name);
+			deps.push({ name: p.name, vendor, pkg, version: normVersion(p.version), scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.packages, "prod");
+	push(json["packages-dev"], "dev");
+	return { manifestPath: filePath, manifestType: "composer.lock", deps };
+}
+
+function parseComposerJson(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (obj, scope) => {
+		for (const [name, version] of Object.entries(obj || {})) {
+			// Platform requirements aren't packages.
+			if (name === "php" || name.startsWith("ext-") || name.startsWith("lib-")) continue;
+			const { vendor, pkg } = splitName(name);
+			deps.push({ name, vendor, pkg, version: String(version), scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.require, "prod");
+	push(json["require-dev"], "dev");
+	return { manifestPath: filePath, manifestType: "composer.json", deps };
+}
+
+module.exports = { parseComposerLock, parseComposerJson, normVersion, isConcrete, splitName };