fix: repair broken Jest suite (CI red since SARIF version change) + add --output alias

[dmchaledev]

Summary

CI has been failing on main since d0bf659 ("read SARIF tool version from package.json"). That commit added createRequire(import.meta.url) to src/sarif.ts, which ts-jest's CommonJS transform cannot compile (TS1343: 'import.meta' is only allowed when '--module' is es2020/esnext/nodenext…, plus a duplicate-require error).

The breakage was silent: any test suite that imports sarif.ts (directly or transitively) failed to compile, so it never ran. Only scorer.test.ts was actually executing — 3 of 4 suites were dead, and the npm test step in CI exits non-zero.

Before:  Test Suites: 3 failed, 1 passed   (10 tests ran)
After:   Test Suites: 4 passed             (86 tests ran)

What changed

• Run Jest in ES module mode (ts-jest/presets/default-esm + useESM, and node --experimental-vm-modules in the test script). This matches the package's real ESM runtime ("type": "module", module: NodeNext) so import.meta compiles instead of being forced through a CommonJS transform.
• Fix a stale test assertion: sarif.test.ts hardcoded the SARIF tool version as "0.0.1". Since d0bf659 reads it dynamically from package.json (1.0.1), the assertion was wrong — it just never ran. It now validates against the real package.json version.
• Accept --output= as an alias for --format= in the CLI. The README quick-start and the published dev.to launch post both document --output=sarif, but the CLI only understood --format= — so the documented copy-paste command errored out with exit code 2. Both flags now work.
• Extract a pure, testable parseArgs() from main() and guard main() so it only runs when invoked as the binary (not when imported by tests). Adds cli.test.ts covering arg parsing, the --output alias, and error cases.

Verification

All run locally and pass:

• npx tsc --noEmit — clean
• npm run lint — 0 warnings
• npm test — 86 passed, 4 suites
• npm run build — clean
• node dist/cli.js ./examples/vulnerable-config.json --output=sarif --exit-code — now emits SARIF (previously: Error: Unknown flag "--output=sarif", exit 2)

https://claude.ai/code/session_01NxTdGKzVSjYp5eWKEmnV7a

---

Generated by Claude Code