// dep-auditor/abandonment-registry.ts — SPEC-025 tech debt: abandonment detection via registry date
// Uses npm registry API to check last publish date and determine if a package is abandoned.
const TIMEOUT_MS = 5000;
const DEFAULT_THRESHOLD_YEARS = 2;
// ---------------------------------------------------------------------------
// npm registry — last publish date
// ---------------------------------------------------------------------------
/**
 * Fetch the last publish date for an npm package.
 * GET https://registry.npmjs.org/${pkg}
 * Extracts time.modified field (ISO date string).
 * Returns null on any error (network, timeout, parse, missing field).
 */
export async function fetchNpmLastPublish(pkg) {
    return new Promise((resolve) => {
        import('node:https')
            .then(({ default: https }) => {
            /* v8 ignore start */
            const url = `https://registry.npmjs.org/${encodeURIComponent(pkg)}`;
            const req = https.get(url, { timeout: TIMEOUT_MS }, (res) => {
                let data = '';
                res.on('data', (chunk) => {
                    data += chunk.toString();
                });
                res.on('end', () => {
                    try {
                        const parsed = JSON.parse(data);
                        const modified = parsed.time?.modified;
                        resolve(typeof modified === 'string' ? modified : null);
                    }
                    catch {
                        resolve(null);
                    }
                });
            });
            req.on('error', () => {
                resolve(null);
            });
            req.on('timeout', () => {
                req.destroy();
                resolve(null);
            });
            /* v8 ignore stop */
        })
            .catch(() => {
            resolve(null);
        });
    });
}
// ---------------------------------------------------------------------------
// Date-based abandonment logic
// ---------------------------------------------------------------------------
/**
 * Determine if a package is abandoned based on its last publish date.
 * A package is considered abandoned if its last publish is older than
 * `thresholdYears` years (default: 2).
 * Returns false when lastPublish is null (cannot determine).
 */
export function isAbandonedByDate(lastPublish, thresholdYears = DEFAULT_THRESHOLD_YEARS) {
    if (!lastPublish) {
        return false;
    }
    const lastDate = new Date(lastPublish);
    if (isNaN(lastDate.getTime())) {
        return false;
    }
    const now = new Date();
    const thresholdMs = thresholdYears * 365 * 24 * 60 * 60 * 1000;
    return now.getTime() - lastDate.getTime() > thresholdMs;
}
// ---------------------------------------------------------------------------
// Combined check
// ---------------------------------------------------------------------------
/**
 * Check if a package is abandoned by fetching its last publish date from the registry
 * and evaluating it against the threshold.
 * Currently only npm is supported with live registry calls.
 * PyPI and crates.io return { abandoned: false, lastPublish: null } as stubs
 * (their registry APIs require different endpoints/authentication).
 */
export async function checkAbandonmentViaRegistry(pkg, ecosystem) {
    if (ecosystem !== 'npm') {
        // PyPI and crates.io stubs — future enhancement
        return { abandoned: false, lastPublish: null };
    }
    const lastPublish = await fetchNpmLastPublish(pkg);
    return { abandoned: isAbandonedByDate(lastPublish), lastPublish };
}
//# sourceMappingURL=abandonment-registry.js.map