test: add debug logger unit coverage

[WilliamK112]

What changed and why

Adds dedicated unit coverage for createDebugLogger, including:

• disabled-session no-op behavior without filesystem writes or stderr output
• timestamped log filename and formatted line output
• one-time announcePath behavior
• plain-string, object, and circular-value detail formatting
• the enabled session close no-op

The tests mock node:fs and use a fixed clock, so they never create real log files. The focused suite reaches 100% statement, branch, function, and line coverage for src/output/debug.ts.

Closes #1029

Validation

• npm ci
• npm run lint:tests
• npm run build
• node dist/index.js advisories sync — 227,853 records synced
• npm test -- --runInBand — 132 suites, 1,648 tests passed
• focused coverage — 100% statements, branches, functions, and lines

[sonukapoor]

Nice work, William - the tests trace through every real branch in createDebugLogger and formatJson, the ESM mock setup with unstable_mockModule + beforeAll dynamic import is correct, and the fixed clock keeps it deterministic. One optional gap: null as details isn't covered - it bypasses the === undefined check and hits JSON.stringify(null) which returns "null" (the string-conversion fallback never fires). Not a blocker, but if you want to squeeze out the last branch:

it("serializes null details as JSON null", () => {
  const debug = createDebugLogger(true);
  debug.log("request", null);
  expect(appendFileSyncMock).toHaveBeenCalledWith(
    expect.any(String),
    "2026-08-23T06:00:00.000Z [debug] request null\n",
    "utf8",
  );
});

Happy to merge as-is if you'd rather leave it.

[sonukapoor]

Merged - thank you @WilliamK112!

[sonukapoor]

One small ask - if you haven't already, a star on the repo goes a long way for an open source project like this: https://github.com/OWASP/cve-lite-cli. Thanks again!