fad-checker 2.0.0 → 2.1.0

package/docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md

@@ -1,251 +0,0 @@
-# Design — Codecs & support multi-écosystème (C#/.NET, PHP, Python)
-
-**Date** : 2026-05-29
-**Statut** : approuvé (brainstorming) — prêt pour le plan d'implémentation
-
-## Objectif
-
-1. Réorganiser tout le code spécifique à un écosystème (aujourd'hui Maven + npm/yarn,
-   éparpillé dans `lib/core.js`, `lib/npm/*`, `lib/outdated.js`, `lib/osv.js`,
-   `lib/cve-report.js`, `fad-checker.js`) derrière une **interface codec** uniforme.
-2. Ajouter trois écosystèmes en **parité complète** (vuln, EOL, obsolete, outdated,
-   recette de fix dans le report) : **C#/.NET (nuget)**, **PHP (composer)**, **Python (pypi)**.
-
-## Décisions cadrées (brainstorming)
-
-- **Parité complète d'emblée** pour les 3 nouveaux écosystèmes.
-- **Big-bang** : extraction complète maven/npm vers des codecs (pas de cohabitation
-  « ancien monde / nouveau monde »). Le big-bang **réorganise, il ne réécrit pas** la
-  logique métier éprouvée (résolution POM/BOM, walker Maven Central, parsers lockfiles).
-- **depRecord généralisé** : schéma neutre `{ ecosystem, namespace, name, version,
-  versions[], coordKey, manifestPaths[], … }`.
-- **Règle de résolution de manifeste uniforme** (changement de philosophie) :
-  lockfile présent → on le prend ; sinon **fallback** sur le manifeste lâche
-  (`composer.json` / `requirements.txt` / `*.csproj` / `package.json`) **avec warning**.
-  Versions épinglées scannées, ranges/floating skippées individuellement + warning.
-- **TOML** : dépendance légère **`smol-toml`** (maintenue, zéro dép transitive, TOML 1.0).
-
-### ⚠️ Changement de contrat assumé (npm)
-
-Comportement actuel : un `package.json` sans `package-lock.json`/`yarn.lock` est
-**entièrement skippé** (warning chapitre 0). Nouveau comportement : il est **parsé en
-best-effort** (versions épinglées) avec warning `no-lockfile — résultats partiels`.
-Le test existant `no-lockfile` est adapté en conséquence (vérifie désormais le
-fallback+warning, plus le skip total).
-
-## Architecture
-
-### L'interface codec
-
-`lib/codecs/codec.interface.js` documente le contrat (objet, pas de classe imposée) :
-
-```js
-{
-  id,            // "maven" | "npm" | "yarn" | "nuget" | "composer" | "pypi"
-  label,         // "Maven", "npm", "NuGet", "Composer", "PyPI"
-  osvEcosystem,  // "Maven" | "npm" | "NuGet" | "Packagist" | "PyPI" | null
-
-  manifestNames,            // fichiers revendiqués par ce codec
-  detect(dir) -> bool,      // ce repo contient-il mes manifestes ?
-
-  collect(dir, opts) -> { deps: Map<coordKey, depRecord>, warnings: [] },
-
-  coordKey(dep),            // clé Map normalisée
-  formatCoord(dep),         // affichage report
-  osvPackageName(dep),      // nom pour OSV
-
-  checkRegistry(deps, opts) -> { outdated:[], deprecated:[] },
-  resolveEolProduct(dep) -> { product, label } | null,
-
-  recipe,                   // { label, pinSection, pinIntro, snippet(deps), directSection }
-  nativeScanners,           // scanners au-delà du tronc commun OSV/NVD
-}
-```
-
-### Le depRecord généralisé
-
-```js
-{
-  ecosystem,        // "maven"|"npm"|"yarn"|"nuget"|"composer"|"pypi"
-  namespace,        // groupId (maven) / scope @org (npm) / vendor (composer) / "" sinon
-  name,             // artifactId / package name
-  version,          // version représentative (la plus haute) pour affichage/EOL/outdated
-  versions[],       // toutes les versions concrètes distinctes (CVE/OSV itèrent dessus)
-  coordKey,         // clé de la Map, ex "maven:org.apache:log4j", "pypi:requests"
-  scope, isDev,
-  manifestPaths[],  // remplace pomPaths/manifestPaths
-  // transitif : via, viaPaths, depth
-  // lock-specific : lockType, resolved, integrity
-}
-```
-
-`coordKey` ne collisionne jamais entre écosystèmes (préfixe `ecosystem:`).
-
-### Registre des codecs
-
-`lib/codecs/index.js` :
-- `getCodec(id)` → codec
-- `allCodecs()` → tous les codecs enregistrés
-- `detectCodecs(srcDir)` → codecs dont `detect()` est vrai
-
-### Services partagés (agnostiques — plus aucun `if ecosystem === …`)
-
-- `lib/osv.js` — querybatch groupé par `codec.osvEcosystem`, nom via `codec.osvPackageName`.
-- `lib/nvd.js` — enrichment par CVE-id, totalement agnostique. **Activé pour tous les
-  écosystèmes** : dès qu'OSV remonte un `CVE-xxxx`, NVD/CPE s'appliquent.
-- `lib/cpe.js` — refinement / filtrage faux positifs sur les matches, agnostique.
-- Fetch `endoflife.date` — partagé ; le codec ne fournit que `{ product }`.
-- Cache (`~/.fad-checker/`) — partagé.
-
-### Scanners rattachés à un codec (`nativeScanners`)
-
-- `maven` → CVE-index local cvelistV5 (`lib/cve-download.js` + tier matching `lib/cve-match.js`).
-- `npm`/`yarn` → retire.js (`lib/retire.js`).
-- `nuget` / `composer` / `pypi` → aucun (couverts par OSV + NVD).
-
-### Flux d'orchestration (`fad-checker.js`)
-
-```
-1. detectCodecs(src) filtré par --ecosystem
-2. resolved = Map() ; pour chaque codec actif : merge codec.collect(src,opts).deps
-3. expansion transitive : déléguée au codec (maven → walker Maven Central ; autres → lock)
-4. vuln :
-   a. OSV (tronc commun) groupé par codec.osvEcosystem
-   b. nativeScanners par codec (maven: CVE-index ; npm/yarn: retire.js)
-   c. NVD enrichment (agnostique, par CVE-id)
-   d. CPE refinement (agnostique)
-5. EOL / obsolete / outdated : codec.resolveEolProduct + codec.checkRegistry
-6. render : sections pilotées par les codecs présents
-```
-
-## Spécifications par codec
-
-### maven (extrait)
-
-`collect()` enveloppe `lib/core.js` (parse POM, résolution parent, merge multi-profils,
-`<dependencyManagement>`, imports `scope=import`/BOM) **conservés tels quels** + walker
-`lib/transitive.js`. WebJars : `webjarToNpm()` reste **dans le codec maven** (un WebJar
-est un artifact Maven émettant une coord npm ; le codec maven route ces deps vers le
-chemin npm pour EOL/registre).
-
-| Aspect | Valeur |
-|---|---|
-| coordKey | `maven:groupId:artifactId` |
-| osvEcosystem | `Maven` |
-| nativeScanners | CVE-index cvelistV5 |
-| registre | Maven Central Solr |
-| obsolete | `data/known-obsolete.json` (curated) |
-| EOL | `by_group_artifact` / `by_group_prefix` |
-| recette | `<dependencyManagement>` + maj des deps directes |
-
-### npm / yarn (extrait)
-
-`collect()` enveloppe `lib/npm/parse.js` + `lib/npm/collect.js` (parsers
-package-lock v1/2/3, yarn.lock v1) **conservés**. Deux codecs partageant `osvEcosystem=npm`
-et le préfixe coordKey `npm:` ; `ecosystemType` distingue pour report/recette.
-
-| Aspect | Valeur |
-|---|---|
-| coordKey | `npm:name` (ou `npm:@scope/name`) |
-| osvEcosystem | `npm` |
-| nativeScanners | retire.js |
-| registre | npm registry (`deprecated` + `dist-tags.latest`) |
-| EOL | `by_npm_name` / `by_npm_scope` |
-| recette | `overrides` (npm) / `resolutions` (yarn) |
-
-### nuget (C#/.NET) — nouveau
-
-| Aspect | Valeur |
-|---|---|
-| manifestes | `packages.lock.json` (lock, résolu+transitif), `*.csproj` (`<PackageReference>`, XML via xml2js), `packages.config` (XML legacy) |
-| CPM | `Directory.Packages.props` lu comme **table de versions** ; `PackageReference` sans `Version` résolu contre `<PackageVersion>`, sinon warning `unresolved-versions` |
-| fallback | `.csproj` épinglé scanné ; floating (`1.*`, `[1.0,2.0)`) skip+warning |
-| coordKey | `nuget:<name-lower>` (NuGet case-insensitive ; casse d'origine gardée pour l'affichage) |
-| osvEcosystem | `NuGet` |
-| registre | `api.nuget.org` registration index → version stable max + `deprecation.reasons`/`alternatePackage` |
-| EOL | endoflife.date `dotnet` (target framework `net6.0`/`net48`…), `aspnet`, `entity-framework` via `by_nuget_name` |
-| recette | maj `<PackageReference>` + note CPM `Directory.Packages.props` |
-
-### composer (PHP) — nouveau
-
-| Aspect | Valeur |
-|---|---|
-| manifestes | `composer.lock` (JSON, `packages[]` + `packages-dev[]`, concret+transitif) ; `composer.json` sans lock → fallback+warning |
-| coordKey | `composer:vendor/package` (case-insensitive normalisé) |
-| osvEcosystem | `Packagist` |
-| registre | `repo.packagist.org/p2/{vendor}/{pkg}.json` → dernière version + champ **`abandoned`** (≈ deprecated, peut pointer un remplaçant) |
-| EOL | endoflife.date `php`, `laravel`, `symfony`, `drupal` via `by_composer_name` |
-| recette | `composer require vendor/pkg:^x` / bloc `composer.json` |
-
-### pypi (Python) — nouveau
-
-| Aspect | Valeur |
-|---|---|
-| manifestes | `poetry.lock` (TOML), `Pipfile.lock` (JSON), `uv.lock` / `pdm.lock` (TOML), `requirements.txt` (épinglé `==` seul) |
-| fallback | `requirements.txt` à ranges → skip+warning ; `pyproject.toml`/`Pipfile` sans lock → fallback+warning |
-| normalisation | PEP 503 : `Foo.Bar_baz` → `foo-bar-baz` pour clé/OSV/registre ; casse d'origine pour affichage |
-| coordKey | `pypi:<name-pep503>` |
-| osvEcosystem | `PyPI` |
-| registre | `pypi.org/pypi/{name}/json` → `info.version` (latest) + détection `yanked` par version + classifier `Development Status :: 7 - Inactive` comme signal obsolete |
-| EOL | endoflife.date `python`, `django`, `numpy`, `fastapi` via `by_pypi_name` |
-| recette | `pip install 'pkg>=x'` / ligne `requirements.txt` / bloc selon le lock détecté |
-
-## Données
-
-- `data/eol-mapping.json` gagne `by_nuget_name`, `by_composer_name`, `by_pypi_name`.
-  Ce fichier ne contient **que l'association coord → nom de produit endoflife.date** ;
-  les dates de cycle/EOL sont **récupérées en ligne** (endoflife.date) et **mises en
-  cache 7 jours**. Le mapping peut donc démarrer **minimal** (dotnet/php/python + quelques
-  frameworks) et s'enrichir au fil de l'eau par simple édition JSON, sans toucher au code.
-- `data/known-obsolete.json` reste Maven-only : les autres écosystèmes ont des champs
-  registre authoritatifs (`deprecation` NuGet, `abandoned` Packagist, `yanked` PyPI).
-
-## CLI
-
-- `--ecosystem` : enum → **liste** : `auto` (défaut, = `detect()` vrai) | `all` | liste
-  explicite `maven,nuget,pypi,…`.
-- `--no-<id>` génériques : `--no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi`.
-- `--no-js` conservé comme **alias** de `--no-npm`+`--no-yarn` (rétro-compat).
-- `--transitive` / `--transitive-depth` : s'appliquent au codec maven uniquement
-  (no-op documenté ailleurs ; les autres ont le transitif via lock).
-- `--snyk` : inchangé (POM nettoyé maven).
-
-## Report (`lib/cve-report.js`)
-
-- Sections par écosystème (1.a, 1.b, …) **générées dynamiquement** selon les codecs
-  présents, ordre stable : `maven, npm, yarn, nuget, composer, pypi`.
-- `RECIPE_SPECS` / `ECO_LABELS` / `ECO_MANIFEST_KIND` alimentés depuis `codec.label`,
-  `codec.recipe`, `codec.manifestNames` — fin des maps codées en dur.
-- `formatCoord(dep)` délégué au codec — fin des `if (ecosystem === "npm")` dans le rendu.
-
-## Tests
-
-Objectif : les 96 tests existants restent verts + nouveaux tests.
-
-- Fixtures : `csharp-app/` (.csproj + packages.lock.json + packages.config +
-  Directory.Packages.props), `php-app/` (composer.json + composer.lock),
-  `python-app/` (un répertoire par format : requirements.txt épinglé, poetry.lock,
-  Pipfile.lock, uv.lock).
-- Un fichier de test par codec (`nuget.test.js`, `composer.test.js`, `pypi.test.js`) :
-  parsing, coordKey, normalisation de noms (PEP 503, case-insensitive NuGet),
-  fallback no-lockfile.
-- Test de contrat paramétré sur `allCodecs()` : chaque codec implémente toute l'interface.
-- Fixture `polyglot/` mêlant les 5 écosystèmes (ou extension de `monorepo-mixed`).
-
-## Ordre d'exécution du big-bang (chaque étape laisse le pipeline fonctionnel)
-
-1. `codec.interface.js` + `lib/codecs/index.js` (registre vide).
-2. Généraliser le `depRecord` (`namespace`/`name`/`coordKey`/`manifestPaths`) — adapter
-   collecteurs + report + tests existants.
-3. Extraire `maven` et `npm`/`yarn` dans des codecs (déplacement, pas réécriture) ;
-   brancher l'orchestrateur sur le registre. **→ les 96 tests repassent ici.**
-4. Rendre `osv.js` / `nvd.js` / `cpe.js` / endoflife agnostiques (via codec).
-5. Ajouter `composer` (lock JSON, le plus simple), puis `pypi`, puis `nuget`.
-6. Report dynamique + CLI liste + fixtures + tests nouveaux.
-
-## Hors périmètre (YAGNI)
-
-- Pas de résolution de ranges/floating (cohérent lockfile-first ; ranges → warning).
-- Pas de support yarn-berry (déjà `unsupported` aujourd'hui), pas de pnpm dans ce lot.
-- Pas de scanner natif dédié pour nuget/composer/pypi (OSV + NVD suffisent à la parité).
-- Pas de curation obsolete pour les nouveaux écosystèmes (champs registre authoritatifs).

package/test/cli-ecosystem.test.js

@@ -1,30 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const { resolveActiveCodecs } = require("../lib/codecs/select");
-
-test("resolveActiveCodecs parses comma list and 'all'", () => {
-	const all = ["maven", "npm", "nuget", "composer", "pypi"];
-	assert.deepStrictEqual(resolveActiveCodecs("maven,pypi", all, {}), ["maven", "pypi"]);
-	assert.deepStrictEqual(resolveActiveCodecs("all", all, {}), all);
-	assert.deepStrictEqual(resolveActiveCodecs("auto", all, {}), all);
-});
-
-test("resolveActiveCodecs honors --no-<id> flags", () => {
-	const all = ["maven", "npm", "nuget"];
-	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noCodecs: ["npm"] }), ["maven", "nuget"]);
-});
-
-test("--no-js aliases to npm+yarn", () => {
-	const all = ["maven", "npm", "yarn", "nuget"];
-	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noJs: true }), ["maven", "nuget"]);
-});
-
-test("legacy 'both' maps to maven+npm/yarn only", () => {
-	const all = ["maven", "npm", "yarn", "nuget", "pypi"];
-	assert.deepStrictEqual(resolveActiveCodecs("both", all, {}), ["maven", "npm", "yarn"]);
-});
-
-test("explicit list intersects with available (auto-detect)", () => {
-	const detected = ["maven"];   // only maven detected on this tree
-	assert.deepStrictEqual(resolveActiveCodecs("maven,npm", detected, {}), ["maven"]);
-});

package/test/codec-edge-cases.test.js

@@ -1,131 +0,0 @@
-/**
- * Advanced edge-case + robustness tests for the composer/pypi/nuget codecs.
- * Uses temp dirs so we can throw malformed inputs at the collectors.
- */
-const test = require("node:test");
-const assert = require("node:assert");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-
-const composer = require("../lib/codecs/composer.codec");
-const pypi = require("../lib/codecs/pypi.codec");
-const nuget = require("../lib/codecs/nuget.codec");
-const { parseRequirementsTxt, pep503 } = require("../lib/codecs/pypi/parse");
-
-function tmp(prefix, files) {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-	for (const [name, content] of Object.entries(files)) {
-		const fp = path.join(dir, name);
-		fs.mkdirSync(path.dirname(fp), { recursive: true });
-		fs.writeFileSync(fp, content);
-	}
-	return dir;
-}
-
-/* ---------------- composer ---------------- */
-
-test("composer: ignoreTest drops dev packages; deps2Exclude filters by name", async () => {
-	const dir = tmp("comp-edge-", {
-		"composer.lock": JSON.stringify({
-			packages: [{ name: "guzzlehttp/guzzle", version: "7.4.5" }, { name: "acme/private", version: "1.0.0" }],
-			"packages-dev": [{ name: "phpunit/phpunit", version: "10.0.0" }],
-		}),
-	});
-	const noDev = await composer.collect(dir, { ignoreTest: true });
-	assert.ok(!noDev.deps.has("composer:phpunit/phpunit"), "dev dep dropped with ignoreTest");
-	assert.ok(noDev.deps.has("composer:guzzlehttp/guzzle"));
-	const excl = await composer.collect(dir, { deps2Exclude: /^acme\// });
-	assert.ok(!excl.deps.has("composer:acme/private"), "excluded by regex");
-});
-
-test("composer: malformed composer.lock does not throw, emits parse-error warning", async () => {
-	const dir = tmp("comp-bad-", { "composer.lock": "{ not valid json ]" });
-	const { deps, warnings } = await composer.collect(dir, {});
-	assert.strictEqual(deps.size, 0);
-	assert.ok(warnings.find(w => w.type === "parse-error"));
-});
-
-/* ---------------- pypi ---------------- */
-
-test("pypi: requirements.txt handles extras, env markers, -r/-e/comments", () => {
-	const dir = tmp("py-req-", {
-		"requirements.txt": [
-			"# header",
-			"requests[security]==2.31.0",          // extras → still pinned
-			'django==4.2 ; python_version >= "3.8"', // env marker dropped
-			"flask>=2.0",                            // range → skip
-			"-r other.txt",                          // include → skip
-			"-e .",                                  // editable → skip
-			"",
-		].join("\n"),
-	});
-	const r = parseRequirementsTxt(path.join(dir, "requirements.txt"));
-	const names = r.deps.map(d => d.name).sort();
-	assert.deepStrictEqual(names, ["django", "requests"]);
-	assert.strictEqual(r.deps.find(d => d.name === "requests").version, "2.31.0");
-	assert.strictEqual(r.skipped, 1);   // only flask>=2.0 counts as a skipped requirement spec
-});
-
-test("pypi: pep503 collapses mixed separators and casing", () => {
-	assert.strictEqual(pep503("Jinja2"), "jinja2");
-	assert.strictEqual(pep503("ruamel.yaml"), "ruamel-yaml");
-	assert.strictEqual(pep503("backports.zoneinfo"), "backports-zoneinfo");
-});
-
-test("pypi: lockfile wins over requirements.txt in the same directory", async () => {
-	const dir = tmp("py-prec-", {
-		"poetry.lock": '[[package]]\nname = "requests"\nversion = "2.31.0"\n',
-		"requirements.txt": "requests==1.0.0\n",
-	});
-	const { deps } = await pypi.collect(dir, {});
-	assert.strictEqual(deps.get("pypi:requests").version, "2.31.0", "poetry.lock should win over requirements.txt");
-});
-
-test("pypi: malformed poetry.lock does not throw", async () => {
-	const dir = tmp("py-bad-", { "poetry.lock": "this is = not [ valid toml" });
-	const { deps, warnings } = await pypi.collect(dir, {});
-	assert.strictEqual(deps.size, 0);
-	assert.ok(warnings.find(w => w.type === "parse-error"));
-});
-
-/* ---------------- nuget ---------------- */
-
-test("nuget: packages.lock.json dedups the same id across target frameworks", async () => {
-	const dir = tmp("nuget-multi-tfm-", {
-		"packages.lock.json": JSON.stringify({
-			version: 1,
-			dependencies: {
-				"net6.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
-				"net8.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
-			},
-		}),
-	});
-	const { deps } = await nuget.collect(dir, {});
-	assert.strictEqual(deps.size, 1, "same id+version across TFMs collapses to one entry");
-	assert.ok(deps.has("nuget:newtonsoft.json"));
-});
-
-test("nuget: Version as a child element is read", async () => {
-	const dir = tmp("nuget-child-", {
-		"app.csproj": `<Project Sdk="Microsoft.NET.Sdk"><ItemGroup><PackageReference Include="Serilog"><Version>2.12.0</Version></PackageReference></ItemGroup></Project>`,
-	});
-	const { deps } = await nuget.collect(dir, {});
-	assert.strictEqual(deps.get("nuget:serilog").version, "2.12.0");
-});
-
-test("nuget: packages.config collected via codec", async () => {
-	const dir = tmp("nuget-cfg-", {
-		"packages.config": `<?xml version="1.0"?><packages><package id="EntityFramework" version="6.4.4" /></packages>`,
-	});
-	const { deps } = await nuget.collect(dir, {});
-	assert.ok(deps.has("nuget:entityframework"));
-	assert.strictEqual(deps.get("nuget:entityframework").name, "EntityFramework");
-});
-
-test("nuget: malformed packages.lock.json does not throw", async () => {
-	const dir = tmp("nuget-bad-", { "packages.lock.json": "{ broken" });
-	const { deps, warnings } = await nuget.collect(dir, {});
-	assert.strictEqual(deps.size, 0);
-	assert.ok(warnings.find(w => w.type === "parse-error"));
-});

package/test/codec-integration.test.js

@@ -1,119 +0,0 @@
-/**
- * Cross-ecosystem integration tests — exercise all codecs together the way the
- * orchestrator does: detect → collect → merge into one Map → shared services.
- */
-const test = require("node:test");
-const assert = require("node:assert");
-const path = require("path");
-const { allCodecs, getCodec, detectCodecs } = require("../lib/codecs");
-const { assertCodecShape } = require("../lib/codecs/codec.interface");
-const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
-const { findEolProduct } = require("../lib/outdated");
-const { generateHtmlReport } = require("../lib/cve-report");
-
-const POLY = path.join(__dirname, "fixtures", "polyglot");
-
-// Collect every active codec into one Map, exactly like fad-checker.js main().
-async function collectAll(dir) {
-	const resolved = new Map();
-	const warnings = [];
-	for (const id of detectCodecs(dir).map(c => c.id)) {
-		if (id === "yarn") continue;
-		const { deps, warnings: w } = await getCodec(id).collect(dir, {});
-		for (const [k, v] of deps) resolved.set(k, v);
-		if (w) warnings.push(...w);
-	}
-	return { resolved, warnings };
-}
-
-test("every registered codec satisfies the interface contract", () => {
-	for (const c of allCodecs()) assertCodecShape(c);
-});
-
-test("detectCodecs finds all five ecosystems in the polyglot tree", () => {
-	const ids = detectCodecs(POLY).map(c => c.id).sort();
-	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi"]);
-});
-
-test("collecting all codecs merges into one Map with NO coordKey collisions", async () => {
-	const { resolved } = await collectAll(POLY);
-	// Every key unique (Map guarantees) AND every record's coordKey === its key.
-	for (const [k, d] of resolved) {
-		assert.strictEqual(d.coordKey, k, `coordKey mismatch for ${k}`);
-		assert.ok(d.ecosystem, `missing ecosystem for ${k}`);
-		assert.ok(d.name, `missing name for ${k}`);
-	}
-	// All five ecosystems represented.
-	const ecos = new Set([...resolved.values()].map(d => d.ecosystem));
-	for (const e of ["maven", "npm", "composer", "pypi", "nuget"]) assert.ok(ecos.has(e), `missing ${e} deps`);
-	// Spot-check one coord per ecosystem.
-	assert.ok(resolved.has("org.apache.logging.log4j:log4j-core"));
-	assert.ok(resolved.has("npm:lodash"));
-	assert.ok(resolved.has("composer:guzzlehttp/guzzle"));
-	assert.ok(resolved.has("pypi:requests"));
-	assert.ok(resolved.has("nuget:newtonsoft.json"));
-});
-
-test("coordKeys from different ecosystems never collide even for same bare name", () => {
-	const { coordKeyFor } = require("../lib/dep-record");
-	const keys = [
-		coordKeyFor("maven", "org.x", "thing"),
-		coordKeyFor("npm", "", "thing"),
-		coordKeyFor("composer", "vendor", "thing"),
-		coordKeyFor("pypi", "", "thing"),
-		coordKeyFor("nuget", "", "thing"),
-	];
-	assert.strictEqual(new Set(keys).size, keys.length, `collision among ${keys.join(", ")}`);
-});
-
-test("osv ecosystem + package name are correct for every codec", () => {
-	const cases = [
-		{ dep: { ecosystem: "maven", namespace: "org.apache", name: "log4j-core", groupId: "org.apache", artifactId: "log4j-core" }, eco: "Maven", pkg: "org.apache:log4j-core" },
-		{ dep: { ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }, eco: "npm", pkg: "lodash" },
-		{ dep: { ecosystem: "composer", namespace: "guzzlehttp", name: "guzzle" }, eco: "Packagist", pkg: "guzzlehttp/guzzle" },
-		{ dep: { ecosystem: "pypi", namespace: "", name: "requests" }, eco: "PyPI", pkg: "requests" },
-		{ dep: { ecosystem: "nuget", namespace: "", name: "Newtonsoft.Json" }, eco: "NuGet", pkg: "Newtonsoft.Json" },
-	];
-	for (const c of cases) {
-		assert.strictEqual(osvEcosystemFor(c.dep), c.eco, `osv eco for ${c.dep.ecosystem}`);
-		assert.strictEqual(osvPkgName(c.dep), c.pkg, `osv pkg for ${c.dep.ecosystem}`);
-	}
-});
-
-test("findEolProduct dispatches per ecosystem to the right product", () => {
-	assert.strictEqual(findEolProduct({ ecosystem: "maven", groupId: "org.apache.logging.log4j", artifactId: "log4j-core", namespace: "org.apache.logging.log4j", name: "log4j-core" })?.product, "log4j");
-	assert.strictEqual(findEolProduct({ ecosystem: "npm", artifactId: "angular", name: "angular" })?.product, "angularjs");
-	assert.strictEqual(findEolProduct({ ecosystem: "composer", namespace: "symfony", name: "console" })?.product, "symfony");
-	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "django" })?.product, "django");
-	assert.strictEqual(findEolProduct({ ecosystem: "nuget", name: "Microsoft.EntityFrameworkCore" })?.product, "efcore");
-	// unknown → null
-	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "totally-unknown-pkg" }), null);
-});
-
-test("generateHtmlReport renders findings from every ecosystem without throwing", async () => {
-	const { resolved } = await collectAll(POLY);
-	const deps = [...resolved.values()];
-	const mk = d => ({ dep: d, cve: { id: `CVE-TEST-${d.ecosystem}`, severity: "HIGH", score: 7.5, description: `vuln in ${d.name}` }, source: "osv", confidence: "exact" });
-	const html = generateHtmlReport({
-		cveMatches: deps.map(mk),
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		resolvedDeps: resolved,
-		projectInfo: { name: "polyglot", generatedAt: "2026-05-29", toolVersion: "test" },
-	});
-	assert.ok(html.startsWith("<!doctype html>"));
-	// Each ecosystem's section label should appear.
-	for (const label of ["Maven", "npm", "Composer", "PyPI", "NuGet"]) {
-		assert.ok(html.includes(label), `report should mention ${label}`);
-	}
-	// Ecosystem-tagged coordinates render (non-maven get a prefix).
-	assert.ok(html.includes("composer:") || html.includes("guzzlehttp/guzzle"));
-});
-
-test("every codec recipe renders a non-empty snippet from a sample finding", () => {
-	const sample = [{ groupId: "g", artifactId: "pkg", fixVersion: "1.2.3" }];
-	for (const c of allCodecs()) {
-		const out = c.recipe.snippet(sample);
-		assert.strictEqual(typeof out, "string");
-		assert.ok(out.length > 0, `${c.id} recipe snippet empty`);
-	}
-});

package/test/codecs.test.js

@@ -1,92 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const path = require("path");
-const { assertCodecShape } = require("../lib/codecs/codec.interface");
-
-const COMPLETE_STUB = {
-	id: "x", label: "X", osvEcosystem: "npm",
-	manifestNames: ["x.json"],
-	detect: () => false,
-	collect: async () => ({ deps: new Map(), warnings: [] }),
-	coordKey: d => `x:${d.name}`,
-	formatCoord: d => d.name,
-	osvPackageName: d => d.name,
-	checkRegistry: async () => ({ outdated: [], deprecated: [] }),
-	resolveEolProduct: () => null,
-	recipe: { label: "X", pinSection: "", pinIntro: () => "", snippet: () => "", directSection: "" },
-	nativeScanners: [],
-};
-
-test("assertCodecShape accepts a complete codec stub", () => {
-	assert.doesNotThrow(() => assertCodecShape(COMPLETE_STUB));
-});
-
-test("assertCodecShape rejects a codec missing a required method", () => {
-	assert.throws(() => assertCodecShape({ id: "y" }), /missing|y/i);
-});
-
-const maven = require("../lib/codecs/maven.codec");
-
-test("maven codec detects the simple fixture and collects deps with bare g:a coordKeys", async () => {
-	const dir = path.join(__dirname, "fixtures", "simple");
-	assert.strictEqual(maven.detect(dir), true);
-	const { deps } = await maven.collect(dir, {});
-	assert.ok(deps.size > 0);
-	for (const [k, d] of deps) {
-		assert.strictEqual(d.ecosystem, "maven");
-		assert.strictEqual(d.coordKey, k);
-		assert.ok(!k.startsWith("npm:") && !k.startsWith("nuget:"), `maven key ${k} must stay bare`);
-	}
-});
-
-const npm = require("../lib/codecs/npm.codec");
-
-test("npm codec collects from monorepo-mixed with npm: coordKeys", async () => {
-	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
-	assert.strictEqual(npm.detect(dir), true);
-	const { deps } = await npm.collect(dir, {});
-	assert.ok(deps.size > 0);
-	for (const [k, d] of deps) {
-		assert.ok(k.startsWith("npm:"), `key ${k} should be npm-namespaced`);
-		assert.strictEqual(d.ecosystem, "npm");
-		assert.strictEqual(d.coordKey, k);
-	}
-});
-
-test("yarn codec is a no-op collector (npm codec does the JS scan)", async () => {
-	const yarn = require("../lib/codecs/yarn.codec");
-	assert.strictEqual(yarn.id, "yarn");
-	const { deps } = await yarn.collect("/whatever", {});
-	assert.strictEqual(deps.size, 0);
-});
-
-const { getCodec, allCodecs, detectCodecs } = require("../lib/codecs");
-
-test("registry exposes maven/npm/yarn and validates their shape", () => {
-	const ids = allCodecs().map(c => c.id).sort();
-	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi", "yarn"]);
-	for (const c of allCodecs()) assertCodecShape(c);
-	assert.strictEqual(getCodec("maven").id, "maven");
-	assert.strictEqual(getCodec("nope"), null);
-});
-
-test("detectCodecs finds maven+npm on monorepo-mixed, not yarn duplicate", () => {
-	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
-	const detected = detectCodecs(dir).map(c => c.id);
-	assert.ok(detected.includes("maven"));
-	assert.ok(detected.includes("npm"));
-	assert.ok(!detected.includes("yarn"));
-});
-
-const recipes = require("../lib/codecs/recipes");
-
-test("each codec recipe exposes label + snippet function", () => {
-	for (const c of allCodecs()) {
-		assert.strictEqual(typeof c.recipe.label, "string");
-		assert.strictEqual(typeof c.recipe.snippet, "function");
-	}
-	// snippet output matches the legacy format
-	const xml = recipes.maven.snippet([{ groupId: "g", artifactId: "a", fixVersion: "1.0" }]);
-	assert.match(xml, /<dependencyManagement>/);
-	assert.match(xml, /<artifactId>a<\/artifactId>/);
-});