A static code analysis tool for JavaScript and TypeScript.

If you want to install the CLI, you would need to have Deno installed first and then on the command line, you would want to run the following command:

$ deno install --name nocuous --allow-read --allow-net -f jsr:@higher-order-testing/nocuous/cli

You can also "pin" to a specific version by using nocuous@{version} instead, for example jsr:@higher-order-testing/nocuous@1.1.0/cli.

The CLI comes with integrated help which can be accessed via the --help flag.

If you want to incorporate the API into an application, you need to import it into your code. For example the following will analyze the Deno std assertion library and its dependencies resolving with a map of statistics:

import { instantiate, stats } from "jsr:@higher-order-testing/nocuous";
await instantiate();
const results = await stats(new URL("https://jsr.io/@std/assert/1.0.6/mod.ts"));
console.log(results);

The tool uses swc as a Rust library to parse code and then run analysis over the parsed code. It is then compiled to Web Assembly and exposed as an all-in-one API. Code is loaded via the JavaScript runtime and a resolver can be provided to allow for custom resolution logic.

The statistics collected around code toxicity are based directly on Erik Dörnenburg's article How toxic is your code?.

The default metrics are based on what is suggested in the article. When applying to TypeScript/JavaScript there are some adaptation that is required:

Copyright 2019 - 2024 Kitson P. Kelly. MIT License.