@magnaboy/code-analysis

Reusable coverage, dependency consistency and source-code analysis for Node.js projects.

Install

npm i -D @magnaboy/code-analysis

Requires Node 25+ and ESM.

Coverage summaries

The package reads the coverage-summary.json format emitted by Istanbul and Vitest's json-summary reporter.

import { readCoverageSummary, writeCoverageSummary } from '@magnaboy/code-analysis';

const summary = await readCoverageSummary('coverage/coverage-summary.json');
console.log(summary.total.lines.pct);

await writeCoverageSummary({
	packageRoot: process.cwd(),
	includeProvider: true
});

Paths, package names and provider notes can be overridden. Reports use stable file ordering and normalized forward-slash paths so committed summaries remain diffable across platforms.

Regression gates

import { coverageDropError, parseSummaryPercentage } from '@magnaboy/code-analysis';

const previous = parseSummaryPercentage(committedReport);
const error = previous === null ? null : coverageDropError(previous, summary.total.lines.pct, 2);

CLI

code-analysis coverage-summary . --provider

Run code-analysis coverage-summary --help for path options.

JaCoCo

collectJacocoCoverage, parseJacocoXml and writeJacocoCoverageSummary convert JaCoCo XML into the same normalized coverage model and Istanbul-compatible JSON. Source roots are explicit, so the APIs work for Java, Kotlin and mixed JVM projects without assuming an Android layout.

SCC reports

The scc APIs discover native or WSL installations, build shell-free commands, condense per-file output deterministically and write reports only when their contents change. Extensions, minimum file size and report length are configurable.

Function complexity reports

runCodeStatsCli and collectCodeStats from @magnaboy/code-analysis/code-stats include function metrics for TypeScript, TSX and Kotlin in the existing code-statistics run. No additional repository scripts are needed. The parsers ship as WebAssembly dependencies; no JVM, compiler or native parser build is required.

• TOP-functions.txt: top 40 most complex and longest functions, separately for each language and file kind.
• functions.txt: all parsed functions, sorted by file and source location for Git diffs.
• function-issues.txt: syntax the parsers could not read; affected functions are omitted and the CLI warns.

Rows identify the function, module, one-based source location, declaration length and decision complexity. The score starts at 1 and adds one for each if, loop, catch, conditional expression, non-default switch case, Kotlin when condition, logical short-circuit operator or Kotlin Elvis operator. Logical assignments count; optional chaining, default parameters, scope functions and nesting depth do not. This is a versioned decision count, not Biome cognitive complexity or detekt's metric. Compare scores within one language.

Methods, accessors, local functions and lambdas have separate scores. Nested function decisions do not inflate their parent's score. Length is the inclusive declaration span, including comments, blanks and nested functions. Overloads without bodies are omitted. Names include enclosing classes/functions; locations distinguish overloads and anonymous callbacks. Source, test, generated and vendored functions have separate rankings.

The existing --check, --no-stage and default staging behavior include these reports. --since still compares the file ledger only; use git diff on the function reports for their history. Moving declarations changes their recorded locations. Parser versions appear in the headers so upgrades are visible in Git.

Workspace dependency versions

analyzePnpmWorkspaceDependencies finds inconsistent registry dependency specs across pnpm workspace packages. Workspace, catalog, file, link, Git and npm-alias specs are excluded. Analysis and text formatting are separate APIs so callers can produce their own CI output.