fix(test): run Jest as ESM to unbreak CI on main

[dmchaledev]

Summary

CI on main has been red since #9. The last three main workflow runs all fail at the Test step.

Root cause

Commit #9 ("fix: read SARIF tool version from package.json") added to src/sarif.ts:

const require = createRequire(import.meta.url);
const pkgVersion = require('../package.json').version as string;

The production build is ESM (module: NodeNext), so that's correct for npm run build. But jest.config.cjs forced ts-jest to compile tests with module: 'CommonJS', where:

• import.meta is illegal → TS1343
• const require collides with CommonJS's reserved require → TS2441

So two of three test suites failed to compile, npm test exited non-zero, and CI went red. The verbatim CI error:

src/sarif.ts:4:31 - error TS1343: The 'import.meta' meta-property is only
allowed when the '--module' option is 'es2020', ..., or 'nodenext'.
src/sarif.ts:4:7 - error TS2441: Duplicate identifier 'require'. ...
Test Suites: 2 failed, 1 passed, 3 total

Fix

Run Jest as ESM so the test environment matches the NodeNext ESM production build (rather than transpiling source to CommonJS):

• jest.config.cjs: switch to the ts-jest/presets/default-esm preset (useESM: true, extensionsToTreatAsEsm, non-hybrid module: ESNext).
• package.json: run Jest via node --experimental-vm-modules so ESM modules load.
• src/__tests__/sarif.test.ts: a stale test hardcoded expect(...version).toBe('0.0.1'). It was masked by the compile failure — fix: read SARIF tool version from package.json #9 made the version dynamic (now 1.0.1). It now asserts the SARIF driver version equals package.json's version and matches a SemVer shape, so it stays correct across version bumps.

Verification (local)

typecheck (tsc --noEmit)   OK
lint (eslint, 0 warnings)  OK
build (tsc)                OK
test                       3 suites passed, 75 tests passed
CLI smoke (--format=sarif) driver version = 1.0.1

No production code changes — only test config and one stale assertion.

Out of scope (noted for follow-up)

While investigating I noticed the README Quick Start and dev-to/launch-post.md advertise --output=sarif, but the CLI only accepts --format= (the canonical flag used everywhere else). The documented command currently errors with Unknown flag "--output=sarif" and exits 2. Left out of this PR to keep it focused on the CI fix — happy to send a separate doc fix.

https://claude.ai/code/session_01PQ2DZcjvnKu8ge5t6ufcn9

---

Generated by Claude Code