fixes type issues, using node:test

Author: timbastin

package-lock.json

@@ -152,7 +152,7 @@
   },
   "devDependencies": {
     "@types/mocha": "^10.0.10",
-    "@types/node": "22.x",
+    "@types/node": "22.19.19",
     "@types/vscode": "^1.120.0",
     "@vscode/test-cli": "^0.0.12",
     "@vscode/test-electron": "^2.5.2",

package.json

@@ -16,7 +16,7 @@ const DEBOUNCE_MS = 400;
  * decorations. Debounced per document, with a generation counter + AbortController
  * so superseded refreshes are cancelled and their stale results dropped.
  */
-export class InsightController {
+export class InsightController  {
 	private readonly generations = new Map<string, number>();
 	private readonly debounceTimers = new Map<string, ReturnType<typeof setTimeout>>();
 	private readonly inflight = new Map<string, AbortController>();

src/controller.ts

@@ -9,6 +9,8 @@ import { resolveVersion } from '../packageJson/resolveVersion';
 import { countTransitive } from '../packageJson/transitive';
 import { InspectSummary, PurlCache } from './cache';
 import { mapWithConcurrency } from './pool';
+import { purlNameKey } from '../utils';
+export { purlNameKey } from '../utils';
 
 /** A per-package map of open risks in the connected asset, keyed by purlNameKey. */
 export type AssetXref = Map<string, AssetRisk>;
@@ -117,19 +119,3 @@ function distill(resp: PurlInspectResponse): InspectSummary {
 		project,
 	};
 }
-
-/**
- * Canonical version-less key for matching purls across the package.json side and
- * the backend. Drops qualifiers/subpath, decodes the `%40` the backend uses for
- * scoped npm packages, removes the version, and lowercases. So both
- * `pkg:npm/@sentry/nextjs@8` and `pkg:npm/%40sentry/nextjs@8` -> `pkg:npm/@sentry/nextjs`.
- */
-export function purlNameKey(purl: string): string {
-	let s = purl.split('?')[0].split('#')[0].replace(/%40/gi, '@');
-	const lastSlash = s.lastIndexOf('/');
-	const versionAt = s.indexOf('@', lastSlash < 0 ? 0 : lastSlash);
-	if (versionAt !== -1) {
-		s = s.slice(0, versionAt);
-	}
-	return s.toLowerCase();
-}

src/enrich/enrich.ts

@@ -1,10 +1,11 @@
 import * as assert from 'assert';
-import { purlNameKey } from '../enrich/enrich';
+import { describe, it } from 'node:test';
+import { purlNameKey } from '../utils';
 import { Lockfile } from '../packageJson/lockfile';
 import { cleanRange } from '../packageJson/resolveVersion';
 import { countTransitive } from '../packageJson/transitive';
 
-suite('countTransitive', () => {
+describe('countTransitive', () => {
 	const lock: Lockfile = {
 		dir: '/x',
 		lockfileVersion: 3,
@@ -18,12 +19,12 @@ suite('countTransitive', () => {
 		},
 	};
 
-	test('counts unique transitive deps and ignores unrelated packages', () => {
+	it('counts unique transitive deps and ignores unrelated packages', () => {
 		// a -> b, c ; b -> c. Nested d is not in a's manifest deps, standalone unreachable.
 		assert.strictEqual(countTransitive(lock, 'a'), 2);
 	});
 
-	test('prefers the nested copy when resolving', () => {
+	it('prefers the nested copy when resolving', () => {
 		const nested: Lockfile = {
 			dir: '/x',
 			lockfileVersion: 3,
@@ -39,41 +40,41 @@ suite('countTransitive', () => {
 		assert.strictEqual(countTransitive(nested, 'a'), 2);
 	});
 
-	test('returns undefined for missing package or non-v2/v3 lockfile', () => {
+	it('returns undefined for missing package or non-v2/v3 lockfile', () => {
 		assert.strictEqual(countTransitive(lock, 'missing'), undefined);
 		assert.strictEqual(countTransitive({ dir: '/x', lockfileVersion: 1, dependencies: {} }, 'a'), undefined);
 		assert.strictEqual(countTransitive(undefined, 'a'), undefined);
 	});
 });
 
-suite('cleanRange', () => {
-	test('extracts a concrete version from a range', () => {
+describe('cleanRange', () => {
+	it('extracts a concrete version from a range', () => {
 		assert.strictEqual(cleanRange('^4.17.21'), '4.17.21');
 		assert.strictEqual(cleanRange('~1.2.3'), '1.2.3');
 		assert.strictEqual(cleanRange('>=1.0.0 <2.0.0'), '1.0.0');
 		assert.strictEqual(cleanRange('1.2.3-beta.1'), '1.2.3-beta.1');
 	});
 
-	test('returns undefined for non-concrete specs', () => {
+	it('returns undefined for non-concrete specs', () => {
 		assert.strictEqual(cleanRange('*'), undefined);
 		assert.strictEqual(cleanRange('latest'), undefined);
 		assert.strictEqual(cleanRange('workspace:*'), undefined);
 		assert.strictEqual(cleanRange('1.2.x'), undefined);
 	});
 });
 
-suite('purlNameKey', () => {
-	test('collapses backend %40 and literal @ scoped purls to the same key', () => {
+describe('purlNameKey', () => {
+	it('collapses backend %40 and literal @ scoped purls to the same key', () => {
 		assert.strictEqual(purlNameKey('pkg:npm/%40sentry/nextjs@8.0.0'), 'pkg:npm/@sentry/nextjs');
 		assert.strictEqual(purlNameKey('pkg:npm/@sentry/nextjs@8.0.0'), 'pkg:npm/@sentry/nextjs');
 	});
 
-	test('strips version and qualifiers for unscoped purls', () => {
+	it('strips version and qualifiers for unscoped purls', () => {
 		assert.strictEqual(purlNameKey('pkg:npm/next@14.2.0'), 'pkg:npm/next');
 		assert.strictEqual(purlNameKey('pkg:npm/next@14.2.0?type=module'), 'pkg:npm/next');
 	});
 
-	test('keeps the name when there is no version', () => {
+	it('keeps the name when there is no version', () => {
 		assert.strictEqual(purlNameKey('pkg:npm/%40scope/name'), 'pkg:npm/@scope/name');
 		assert.strictEqual(purlNameKey('pkg:npm/next'), 'pkg:npm/next');
 	});

src/test/packageGraph.test.ts

@@ -1,5 +1,6 @@
 import * as assert from 'assert';
 import { createHash } from 'node:crypto';
+import { describe, it } from 'node:test';
 import { p256 } from '@noble/curves/p256';
 import { deriveFingerprint, isValidTokenFormat, signRequest } from '../api/signing';
 
@@ -10,25 +11,25 @@ const FIXED = '1a73970f31816d996ab514c4ffea04b6dee0eadc107267d0c911fd817a7b5167'
 const GOLDEN_FINGERPRINT = 'b6c40569c43b73924a56e90e4130916b556afe42b20e45ba6fcd9a25d4378c96';
 const EMPTY_BODY_DIGEST = 'sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:';
 
-suite('signing', () => {
-	test('fingerprint matches the Go-computed golden value', () => {
+describe('signing', () => {
+	it('fingerprint matches the Go-computed golden value', () => {
 		assert.strictEqual(deriveFingerprint(FIXED), GOLDEN_FINGERPRINT);
 	});
 
-	test('content-digest is the structured sha-256 of the empty body', () => {
+	it('content-digest is the structured sha-256 of the empty body', () => {
 		const headers = signRequest(FIXED, { method: 'GET' });
 		assert.strictEqual(headers['Content-Digest'], EMPTY_BODY_DIGEST);
 	});
 
-	test('signature-input covers @method and content-digest with created + alg', () => {
+	it('signature-input covers @method and content-digest with created + alg', () => {
 		const headers = signRequest(FIXED, { method: 'GET' });
 		assert.match(
 			headers['Signature-Input'],
 			/^sig77=\("@method" "content-digest"\);created=\d+;alg="ecdsa-p256-sha256"$/,
 		);
 	});
 
-	test('signature verifies against the derived public key (round trip)', () => {
+	it('signature verifies against the derived public key (round trip)', () => {
 		const headers = signRequest(FIXED, { method: 'GET' });
 		const created = /created=(\d+)/.exec(headers['Signature-Input'])?.[1];
 		const params = `("@method" "content-digest");created=${created};alg="ecdsa-p256-sha256"`;
@@ -39,7 +40,7 @@ suite('signing', () => {
 		assert.ok(p256.verify(rs, hash, pub));
 	});
 
-	test('isValidTokenFormat accepts hex keys and rejects junk', () => {
+	it('isValidTokenFormat accepts hex keys and rejects junk', () => {
 		assert.ok(isValidTokenFormat(FIXED));
 		assert.ok(isValidTokenFormat(`0x${FIXED}`));
 		assert.ok(!isValidTokenFormat('not-a-token'));

src/test/signing.test.ts

@@ -0,0 +1,15 @@
+/**
+ * Canonical version-less key for matching purls across the package.json side and
+ * the backend. Drops qualifiers/subpath, decodes the `%40` the backend uses for
+ * scoped npm packages, removes the version, and lowercases. So both
+ * `pkg:npm/@sentry/nextjs@8` and `pkg:npm/%40sentry/nextjs@8` -> `pkg:npm/@sentry/nextjs`.
+ */
+export function purlNameKey(purl: string): string {
+	let s = purl.split('?')[0].split('#')[0].replace(/%40/gi, '@');
+	const lastSlash = s.lastIndexOf('/');
+	const versionAt = s.indexOf('@', lastSlash < 0 ? 0 : lastSlash);
+	if (versionAt !== -1) {
+		s = s.slice(0, versionAt);
+	}
+	return s.toLowerCase();
+}

src/utils.ts

@@ -4,10 +4,12 @@
 		"target": "ES2022",
 		"outDir": "out",
 		"lib": [
-			"ES2022"
+			"ES2022",
+			"DOM"
 		],
 		"sourceMap": true,
 		"rootDir": "src",
+		"types": ["node"],
 		"strict": true,   /* enable all strict type-checking options */
 		/* Additional Checks */
 		// "noImplicitReturns": true, /* Report error when not all code paths in function return a value. */