ccqa-tools 1.40.3 → 1.40.5

package/dist/coverage/next-loader.cjs

@@ -1,56 +1,81 @@
 let node_path = require("node:path");
 let acorn = require("acorn");
+let node_module = require("node:module");
 //#region src/coverage/instrument/select.ts
+const SOURCE_EXTENSIONS = [
+	".js",
+	".mjs",
+	".cjs",
+	".jsx",
+	".ts",
+	".mts",
+	".cts",
+	".tsx"
+];
+/**
+* Decides whether a file is part of the project under test, returning its id
+* if so. Returning the id here — rather than a plain boolean — spares the
+* caller a second `fileIdFor` pass over the same path.
+*
+* `node_modules` is excluded unconditionally: instrumenting dependencies costs
+* the most and answers the least — nobody adds a test because a library file
+* went unreached.
+*/
+function shouldInstrument(filename, config) {
+	if (filename.includes(`${node_path.sep}node_modules${node_path.sep}`)) return void 0;
+	if (!SOURCE_EXTENSIONS.some((extension) => filename.endsWith(extension))) return void 0;
+	const id = fileIdFor(filename, config.root);
+	if (id === void 0) return void 0;
+	return config.include.some((prefix) => id === prefix || id.startsWith(`${prefix}/`)) ? id : void 0;
+}
 /** Path relative to the project root, in posix form so ids match across hosts. */
 function fileIdFor(filename, root) {
 	const rel = (0, node_path.relative)((0, node_path.resolve)(root), filename);
 	if (rel.startsWith("..") || rel === "") return void 0;
 	return rel.split(node_path.sep).join("/");
 }
-//#endregion
-//#region src/coverage/instrument/transform.ts
 /**
-* Rewrites a module so that entering it, or entering one of its functions,
-* calls `globalThis.__ccqaCoverage`.
-*
-* Two properties drive the whole shape:
-*
-* - **Insertions only, never a newline.** Line numbers survive untouched, so
-*   the source map the application already ships keeps pointing at the right
-*   lines and stack traces stay readable. A codegen round-trip would have
-*   forced us to produce and merge maps of our own.
-* - **File granularity.** The record is "this file ran", so there is no need to
-*   track statements or branches, and the whole class of line/branch
-*   normalisation bugs that follow V8-to-istanbul conversion never appears.
+* The exact texts both instrumenter dialects splice in, built in one place so
+* a file instrumented from TypeScript and one instrumented from compiled
+* JavaScript are byte-identical where it matters.
 */
-const DEFAULT_MAX_DEPTH = 2;
+function probeTexts(fileId) {
+	const local = `__ccqa_${hash(fileId)}`;
+	const literal = JSON.stringify(fileId);
+	return {
+		enter: `;${local}&&${local}(${literal});`,
+		prologue: `;var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+	};
+}
+/** Applies insert-only edits (no newlines) so line numbers survive untouched. */
+function splice(code, edits) {
+	const parts = [];
+	let last = 0;
+	for (const edit of edits) {
+		parts.push(code.slice(last, edit.offset), edit.text);
+		last = edit.offset;
+	}
+	parts.push(code.slice(last));
+	return parts.join("");
+}
 function transform(code, options) {
 	const program = parseProgram(code);
 	if (program === void 0) return void 0;
-	const local = `__ccqa_${hash(options.fileId)}`;
-	const literal = JSON.stringify(options.fileId);
-	const enter = `${local}&&${local}(${literal});`;
+	const { enter, prologue } = probeTexts(options.fileId);
 	const points = [];
-	collect(program, options.maxDepth ?? DEFAULT_MAX_DEPTH, points);
+	collect$1(program, options.maxDepth ?? 2, points);
 	if (code.length === 0) return void 0;
-	const prologueAt = afterDirectives(code, program);
+	const prologueAt = afterDirectives$1(code, program);
 	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
 		offset,
 		text: enter
 	}));
 	edits.push({
 		offset: prologueAt,
-		text: `var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+		text: prologue
 	});
 	edits.sort((a, b) => a.offset - b.offset);
-	const parts = [];
-	let last = 0;
-	for (const edit of edits) {
-		parts.push(code.slice(last, edit.offset), edit.text);
-		last = edit.offset;
-	}
-	parts.push(code.slice(last));
-	return parts.join("");
+	return splice(code, edits);
 }
 function parseProgram(code) {
 	for (const sourceType of ["module", "script"]) try {
@@ -70,7 +95,7 @@ function parseProgram(code) {
 * instrumentation would be changing the behaviour it is supposed to observe.
 * Applies to a function body as much as to the module.
 */
-function afterDirectives(code, program) {
+function afterDirectives$1(code, program) {
 	let offset = program.start;
 	if (code.startsWith("#!")) {
 		const newline = code.indexOf("\n");
@@ -93,7 +118,7 @@ const FUNCTION_TYPES = new Set([
 	"FunctionExpression",
 	"ArrowFunctionExpression"
 ]);
-function collect(root, maxDepth, points) {
+function collect$1(root, maxDepth, points) {
 	walk(root, 0, false);
 	function walk(node, depth, inClass) {
 		const isFunction = FUNCTION_TYPES.has(node.type);
@@ -110,13 +135,13 @@ function collect(root, maxDepth, points) {
 			if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
 			const value = node[key];
 			if (Array.isArray(value)) {
-				for (const item of value) if (isNode(item)) walk(item, nextDepth, childInClass(node, key, inClass));
-			} else if (isNode(value)) walk(value, nextDepth, childInClass(node, key, inClass));
+				for (const item of value) if (isNode(item)) walk(item, nextDepth, childInClass$1(node, key, inClass));
+			} else if (isNode(value)) walk(value, nextDepth, childInClass$1(node, key, inClass));
 		}
 	}
 }
 /** True while walking the value of a class member, false again inside its body. */
-function childInClass(parent, key, inherited) {
+function childInClass$1(parent, key, inherited) {
 	if (parent.type === "MethodDefinition" || parent.type === "PropertyDefinition") return key === "value";
 	if (FUNCTION_TYPES.has(parent.type)) return false;
 	return inherited;
@@ -134,20 +159,162 @@ function hash(value) {
 	return (h >>> 0).toString(36);
 }
 //#endregion
+//#region src/coverage/instrument/transform-ts.ts
+/**
+* TypeScript/TSX form of the instrumenter.
+*
+* The webpack post-loader sees compiled JavaScript and parses with acorn;
+* Turbopack hands loaders the *original* source, before its own TypeScript
+* and JSX transforms, so this dialect parses with the `typescript` compiler
+* API instead and splices the same probes into the untranspiled text. The
+* output stays TypeScript — the bundler's own pipeline compiles it after us —
+* which is what keeps this file free of any JSX/downlevel emit of its own.
+*
+* Same contract as `transform`: insertions only, never a newline, so line
+* numbers and the framework's source maps survive untouched.
+*
+* `typescript` is loaded lazily and is not a dependency of this package: this
+* path only runs at build time inside a project that compiles TypeScript,
+* where the compiler is present by definition. It is resolved from the
+* *project* first — resolving from this package's own position would lean on
+* the package manager's hoisting, and could pick a different compiler than
+* the one the project builds with. When it is somehow absent the file is
+* left uninstrumented and the loader warns.
+*/
+const ownRequire = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+let tsModule;
+function loadTypescript(resolveFrom) {
+	if (tsModule !== void 0) return tsModule;
+	if (resolveFrom !== void 0) try {
+		tsModule = (0, node_module.createRequire)((0, node_path.join)(resolveFrom, "noop.js"))("typescript");
+		return tsModule;
+	} catch {}
+	try {
+		tsModule = ownRequire("typescript");
+	} catch {
+		tsModule = null;
+	}
+	return tsModule;
+}
+/** Whether the TypeScript dialect can run at all in this process. */
+function typescriptAvailable(resolveFrom) {
+	return loadTypescript(resolveFrom) !== null;
+}
+function transformTs(code, options) {
+	const ts = loadTypescript(options.resolveFrom);
+	if (ts === null || code.length === 0) return void 0;
+	const kind = scriptKindFor(ts, options.extension ?? ".tsx");
+	const sourceFile = ts.createSourceFile("module.tsx", code, ts.ScriptTarget.Latest, false, kind);
+	const diagnostics = sourceFile.parseDiagnostics;
+	if (Array.isArray(diagnostics) && diagnostics.length > 0) return void 0;
+	const { enter, prologue } = probeTexts(options.fileId);
+	const points = [];
+	collect(ts, sourceFile, options.maxDepth ?? 2, points);
+	const first = sourceFile.statements[0];
+	const base = first === void 0 ? code.length : first.getStart(sourceFile);
+	const prologueAt = afterDirectives(ts, sourceFile.statements, base);
+	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
+		offset,
+		text: enter
+	}));
+	edits.push({
+		offset: prologueAt,
+		text: prologue
+	});
+	edits.sort((a, b) => a.offset - b.offset);
+	return splice(code, edits);
+}
+function scriptKindFor(ts, extension) {
+	switch (extension) {
+		case ".ts":
+		case ".mts":
+		case ".cts": return ts.ScriptKind.TS;
+		case ".jsx": return ts.ScriptKind.JSX;
+		case ".js":
+		case ".mjs":
+		case ".cjs": return ts.ScriptKind.JSX;
+		default: return ts.ScriptKind.TSX;
+	}
+}
+function collect(ts, sourceFile, maxDepth, points) {
+	walk(sourceFile, 0, false);
+	function walk(node, depth, inClass) {
+		const isFunction = isFunctionLike(ts, node);
+		const nextDepth = isFunction ? depth + 1 : depth;
+		if (isFunction) {
+			const wanted = inClass || nextDepth <= maxDepth;
+			const body = node.body;
+			if (wanted && body !== void 0 && ts.isBlock(body)) points.push(afterDirectives(ts, body.statements, body.getStart(sourceFile) + 1));
+		}
+		ts.forEachChild(node, (child) => walk(child, nextDepth, childInClass(ts, node, child, inClass)));
+	}
+}
+function isFunctionLike(ts, node) {
+	return ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node) || ts.isConstructorDeclaration(node) || ts.isGetAccessorDeclaration(node) || ts.isSetAccessorDeclaration(node);
+}
+/**
+* Mirrors the acorn walk's rule: true for the function a class member *is* or
+* holds, false again once inside any function body. In this AST a class
+* method is itself the function-like — there is no separate `value` node —
+* so membership is decided when the class hands its members down.
+*/
+function childInClass(ts, parent, child, inherited) {
+	if (ts.isClassDeclaration(parent) || ts.isClassExpression(parent)) return ts.isMethodDeclaration(child) || ts.isConstructorDeclaration(child) || ts.isGetAccessorDeclaration(child) || ts.isSetAccessorDeclaration(child) || ts.isPropertyDeclaration(child);
+	if (ts.isPropertyDeclaration(parent)) return child === parent.initializer;
+	if (isFunctionLike(ts, parent)) return false;
+	return inherited;
+}
+/**
+* Same rule as the acorn dialect: a directive prologue only counts while it
+* is still the first thing in its scope, and `"use client"` / `"use server"`
+* are directives to Next, so nothing may be inserted ahead of them.
+*/
+function afterDirectives(ts, statements, from) {
+	let offset = from;
+	for (const statement of statements) {
+		if (!ts.isExpressionStatement(statement)) break;
+		if (!ts.isStringLiteral(statement.expression)) break;
+		offset = statement.end;
+	}
+	return offset;
+}
+//#endregion
 //#region src/coverage/next/loader.ts
 /**
-* webpack loader form of the instrumenter, for code that reaches the runtime as
-* part of a bundle and so is invisible to the load hooks.
+* The loader form of the instrumenter, for code that reaches the runtime as
+* part of a bundle and so is invisible to the load hooks. One loader, two
+* dialects, because the two bundlers hand it different inputs:
+*
+* - **webpack** registers it with `enforce: "post"`, so it sees compiled
+*   JavaScript and parses with acorn (`dialect: "compiled"`, the default).
+* - **Turbopack** has no post phase — rule loaders run on the *original*
+*   TypeScript/TSX — so that registration passes `dialect: "source"` and the
+*   file is parsed with the `typescript` compiler API instead.
 *
-* It is registered with `enforce: "post"` so it sees JavaScript: webpack runs
-* post loaders last, after the framework's own TypeScript/JSX transform, which
-* keeps this file free of a TypeScript parser.
+* Scoping also differs: webpack's rule carries `include`/`exclude` matchers,
+* while Turbopack rules are extension globs, so the source dialect gets the
+* include prefixes as options and filters through `shouldInstrument` — the
+* same decision the runtime load hooks use.
 */
 function ccqaCoverageLoader(source) {
-	const root = this.getOptions?.().root ?? process.cwd();
-	const fileId = fileIdFor(this.resourcePath, root);
+	const options = this.getOptions?.() ?? {};
+	const root = options.root ?? process.cwd();
+	const dialect = options.dialect ?? "compiled";
+	const fileId = dialect === "source" ? shouldInstrument(this.resourcePath, {
+		root,
+		include: options.include ?? []
+	}) : fileIdFor(this.resourcePath, root);
 	if (fileId === void 0) return source;
-	const instrumented = transform(source, { fileId });
+	if (source.trim().length === 0) return source;
+	if (dialect === "source" && !typescriptAvailable(root)) {
+		this.emitWarning?.(/* @__PURE__ */ new Error(`ccqa-tools needs the \`typescript\` package to instrument Turbopack builds; ${fileId} left uninstrumented`));
+		return source;
+	}
+	const instrumented = dialect === "source" ? transformTs(source, {
+		fileId,
+		extension: (0, node_path.extname)(this.resourcePath),
+		resolveFrom: root
+	}) : transform(source, { fileId });
 	if (instrumented === void 0) {
 		this.emitWarning?.(/* @__PURE__ */ new Error(`ccqa-tools could not parse ${fileId}; left uninstrumented`));
 		return source;

package/dist/coverage/next-loader.d.cts

@@ -1,17 +1,30 @@
 //#region src/coverage/next/loader.d.ts
 /**
- * webpack loader form of the instrumenter, for code that reaches the runtime as
- * part of a bundle and so is invisible to the load hooks.
+ * The loader form of the instrumenter, for code that reaches the runtime as
+ * part of a bundle and so is invisible to the load hooks. One loader, two
+ * dialects, because the two bundlers hand it different inputs:
  *
- * It is registered with `enforce: "post"` so it sees JavaScript: webpack runs
- * post loaders last, after the framework's own TypeScript/JSX transform, which
- * keeps this file free of a TypeScript parser.
+ * - **webpack** registers it with `enforce: "post"`, so it sees compiled
+ *   JavaScript and parses with acorn (`dialect: "compiled"`, the default).
+ * - **Turbopack** has no post phase — rule loaders run on the *original*
+ *   TypeScript/TSX — so that registration passes `dialect: "source"` and the
+ *   file is parsed with the `typescript` compiler API instead.
+ *
+ * Scoping also differs: webpack's rule carries `include`/`exclude` matchers,
+ * while Turbopack rules are extension globs, so the source dialect gets the
+ * include prefixes as options and filters through `shouldInstrument` — the
+ * same decision the runtime load hooks use.
  */
+interface LoaderOptions {
+  root?: string;
+  /** How the input is parsed; see the module comment. */
+  dialect?: "compiled" | "source";
+  /** Root-relative directory prefixes to instrument (source dialect only). */
+  include?: string[];
+}
 interface LoaderContext {
   resourcePath: string;
-  getOptions?: () => {
-    root?: string;
-  };
+  getOptions?: () => LoaderOptions;
   emitWarning?: (warning: Error) => void;
 }
 declare function ccqaCoverageLoader(this: LoaderContext, source: string): string;

package/dist/coverage/next-loader.d.ts

@@ -1,17 +1,30 @@
 //#region src/coverage/next/loader.d.ts
 /**
- * webpack loader form of the instrumenter, for code that reaches the runtime as
- * part of a bundle and so is invisible to the load hooks.
+ * The loader form of the instrumenter, for code that reaches the runtime as
+ * part of a bundle and so is invisible to the load hooks. One loader, two
+ * dialects, because the two bundlers hand it different inputs:
  *
- * It is registered with `enforce: "post"` so it sees JavaScript: webpack runs
- * post loaders last, after the framework's own TypeScript/JSX transform, which
- * keeps this file free of a TypeScript parser.
+ * - **webpack** registers it with `enforce: "post"`, so it sees compiled
+ *   JavaScript and parses with acorn (`dialect: "compiled"`, the default).
+ * - **Turbopack** has no post phase — rule loaders run on the *original*
+ *   TypeScript/TSX — so that registration passes `dialect: "source"` and the
+ *   file is parsed with the `typescript` compiler API instead.
+ *
+ * Scoping also differs: webpack's rule carries `include`/`exclude` matchers,
+ * while Turbopack rules are extension globs, so the source dialect gets the
+ * include prefixes as options and filters through `shouldInstrument` — the
+ * same decision the runtime load hooks use.
  */
+interface LoaderOptions {
+  root?: string;
+  /** How the input is parsed; see the module comment. */
+  dialect?: "compiled" | "source";
+  /** Root-relative directory prefixes to instrument (source dialect only). */
+  include?: string[];
+}
 interface LoaderContext {
   resourcePath: string;
-  getOptions?: () => {
-    root?: string;
-  };
+  getOptions?: () => LoaderOptions;
   emitWarning?: (warning: Error) => void;
 }
 declare function ccqaCoverageLoader(this: LoaderContext, source: string): string;

package/dist/coverage/next-loader.js

@@ -1,56 +1,81 @@
-import { relative, resolve, sep } from "node:path";
+import { extname, join, relative, resolve, sep } from "node:path";
 import { parse } from "acorn";
+import { createRequire } from "node:module";
 //#region src/coverage/instrument/select.ts
+const SOURCE_EXTENSIONS = [
+	".js",
+	".mjs",
+	".cjs",
+	".jsx",
+	".ts",
+	".mts",
+	".cts",
+	".tsx"
+];
+/**
+* Decides whether a file is part of the project under test, returning its id
+* if so. Returning the id here — rather than a plain boolean — spares the
+* caller a second `fileIdFor` pass over the same path.
+*
+* `node_modules` is excluded unconditionally: instrumenting dependencies costs
+* the most and answers the least — nobody adds a test because a library file
+* went unreached.
+*/
+function shouldInstrument(filename, config) {
+	if (filename.includes(`${sep}node_modules${sep}`)) return void 0;
+	if (!SOURCE_EXTENSIONS.some((extension) => filename.endsWith(extension))) return void 0;
+	const id = fileIdFor(filename, config.root);
+	if (id === void 0) return void 0;
+	return config.include.some((prefix) => id === prefix || id.startsWith(`${prefix}/`)) ? id : void 0;
+}
 /** Path relative to the project root, in posix form so ids match across hosts. */
 function fileIdFor(filename, root) {
 	const rel = relative(resolve(root), filename);
 	if (rel.startsWith("..") || rel === "") return void 0;
 	return rel.split(sep).join("/");
 }
-//#endregion
-//#region src/coverage/instrument/transform.ts
 /**
-* Rewrites a module so that entering it, or entering one of its functions,
-* calls `globalThis.__ccqaCoverage`.
-*
-* Two properties drive the whole shape:
-*
-* - **Insertions only, never a newline.** Line numbers survive untouched, so
-*   the source map the application already ships keeps pointing at the right
-*   lines and stack traces stay readable. A codegen round-trip would have
-*   forced us to produce and merge maps of our own.
-* - **File granularity.** The record is "this file ran", so there is no need to
-*   track statements or branches, and the whole class of line/branch
-*   normalisation bugs that follow V8-to-istanbul conversion never appears.
+* The exact texts both instrumenter dialects splice in, built in one place so
+* a file instrumented from TypeScript and one instrumented from compiled
+* JavaScript are byte-identical where it matters.
 */
-const DEFAULT_MAX_DEPTH = 2;
+function probeTexts(fileId) {
+	const local = `__ccqa_${hash(fileId)}`;
+	const literal = JSON.stringify(fileId);
+	return {
+		enter: `;${local}&&${local}(${literal});`,
+		prologue: `;var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+	};
+}
+/** Applies insert-only edits (no newlines) so line numbers survive untouched. */
+function splice(code, edits) {
+	const parts = [];
+	let last = 0;
+	for (const edit of edits) {
+		parts.push(code.slice(last, edit.offset), edit.text);
+		last = edit.offset;
+	}
+	parts.push(code.slice(last));
+	return parts.join("");
+}
 function transform(code, options) {
 	const program = parseProgram(code);
 	if (program === void 0) return void 0;
-	const local = `__ccqa_${hash(options.fileId)}`;
-	const literal = JSON.stringify(options.fileId);
-	const enter = `${local}&&${local}(${literal});`;
+	const { enter, prologue } = probeTexts(options.fileId);
 	const points = [];
-	collect(program, options.maxDepth ?? DEFAULT_MAX_DEPTH, points);
+	collect$1(program, options.maxDepth ?? 2, points);
 	if (code.length === 0) return void 0;
-	const prologueAt = afterDirectives(code, program);
+	const prologueAt = afterDirectives$1(code, program);
 	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
 		offset,
 		text: enter
 	}));
 	edits.push({
 		offset: prologueAt,
-		text: `var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+		text: prologue
 	});
 	edits.sort((a, b) => a.offset - b.offset);
-	const parts = [];
-	let last = 0;
-	for (const edit of edits) {
-		parts.push(code.slice(last, edit.offset), edit.text);
-		last = edit.offset;
-	}
-	parts.push(code.slice(last));
-	return parts.join("");
+	return splice(code, edits);
 }
 function parseProgram(code) {
 	for (const sourceType of ["module", "script"]) try {
@@ -70,7 +95,7 @@ function parseProgram(code) {
 * instrumentation would be changing the behaviour it is supposed to observe.
 * Applies to a function body as much as to the module.
 */
-function afterDirectives(code, program) {
+function afterDirectives$1(code, program) {
 	let offset = program.start;
 	if (code.startsWith("#!")) {
 		const newline = code.indexOf("\n");
@@ -93,7 +118,7 @@ const FUNCTION_TYPES = new Set([
 	"FunctionExpression",
 	"ArrowFunctionExpression"
 ]);
-function collect(root, maxDepth, points) {
+function collect$1(root, maxDepth, points) {
 	walk(root, 0, false);
 	function walk(node, depth, inClass) {
 		const isFunction = FUNCTION_TYPES.has(node.type);
@@ -110,13 +135,13 @@ function collect(root, maxDepth, points) {
 			if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
 			const value = node[key];
 			if (Array.isArray(value)) {
-				for (const item of value) if (isNode(item)) walk(item, nextDepth, childInClass(node, key, inClass));
-			} else if (isNode(value)) walk(value, nextDepth, childInClass(node, key, inClass));
+				for (const item of value) if (isNode(item)) walk(item, nextDepth, childInClass$1(node, key, inClass));
+			} else if (isNode(value)) walk(value, nextDepth, childInClass$1(node, key, inClass));
 		}
 	}
 }
 /** True while walking the value of a class member, false again inside its body. */
-function childInClass(parent, key, inherited) {
+function childInClass$1(parent, key, inherited) {
 	if (parent.type === "MethodDefinition" || parent.type === "PropertyDefinition") return key === "value";
 	if (FUNCTION_TYPES.has(parent.type)) return false;
 	return inherited;
@@ -134,20 +159,162 @@ function hash(value) {
 	return (h >>> 0).toString(36);
 }
 //#endregion
+//#region src/coverage/instrument/transform-ts.ts
+/**
+* TypeScript/TSX form of the instrumenter.
+*
+* The webpack post-loader sees compiled JavaScript and parses with acorn;
+* Turbopack hands loaders the *original* source, before its own TypeScript
+* and JSX transforms, so this dialect parses with the `typescript` compiler
+* API instead and splices the same probes into the untranspiled text. The
+* output stays TypeScript — the bundler's own pipeline compiles it after us —
+* which is what keeps this file free of any JSX/downlevel emit of its own.
+*
+* Same contract as `transform`: insertions only, never a newline, so line
+* numbers and the framework's source maps survive untouched.
+*
+* `typescript` is loaded lazily and is not a dependency of this package: this
+* path only runs at build time inside a project that compiles TypeScript,
+* where the compiler is present by definition. It is resolved from the
+* *project* first — resolving from this package's own position would lean on
+* the package manager's hoisting, and could pick a different compiler than
+* the one the project builds with. When it is somehow absent the file is
+* left uninstrumented and the loader warns.
+*/
+const ownRequire = createRequire(import.meta.url);
+let tsModule;
+function loadTypescript(resolveFrom) {
+	if (tsModule !== void 0) return tsModule;
+	if (resolveFrom !== void 0) try {
+		tsModule = createRequire(join(resolveFrom, "noop.js"))("typescript");
+		return tsModule;
+	} catch {}
+	try {
+		tsModule = ownRequire("typescript");
+	} catch {
+		tsModule = null;
+	}
+	return tsModule;
+}
+/** Whether the TypeScript dialect can run at all in this process. */
+function typescriptAvailable(resolveFrom) {
+	return loadTypescript(resolveFrom) !== null;
+}
+function transformTs(code, options) {
+	const ts = loadTypescript(options.resolveFrom);
+	if (ts === null || code.length === 0) return void 0;
+	const kind = scriptKindFor(ts, options.extension ?? ".tsx");
+	const sourceFile = ts.createSourceFile("module.tsx", code, ts.ScriptTarget.Latest, false, kind);
+	const diagnostics = sourceFile.parseDiagnostics;
+	if (Array.isArray(diagnostics) && diagnostics.length > 0) return void 0;
+	const { enter, prologue } = probeTexts(options.fileId);
+	const points = [];
+	collect(ts, sourceFile, options.maxDepth ?? 2, points);
+	const first = sourceFile.statements[0];
+	const base = first === void 0 ? code.length : first.getStart(sourceFile);
+	const prologueAt = afterDirectives(ts, sourceFile.statements, base);
+	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
+		offset,
+		text: enter
+	}));
+	edits.push({
+		offset: prologueAt,
+		text: prologue
+	});
+	edits.sort((a, b) => a.offset - b.offset);
+	return splice(code, edits);
+}
+function scriptKindFor(ts, extension) {
+	switch (extension) {
+		case ".ts":
+		case ".mts":
+		case ".cts": return ts.ScriptKind.TS;
+		case ".jsx": return ts.ScriptKind.JSX;
+		case ".js":
+		case ".mjs":
+		case ".cjs": return ts.ScriptKind.JSX;
+		default: return ts.ScriptKind.TSX;
+	}
+}
+function collect(ts, sourceFile, maxDepth, points) {
+	walk(sourceFile, 0, false);
+	function walk(node, depth, inClass) {
+		const isFunction = isFunctionLike(ts, node);
+		const nextDepth = isFunction ? depth + 1 : depth;
+		if (isFunction) {
+			const wanted = inClass || nextDepth <= maxDepth;
+			const body = node.body;
+			if (wanted && body !== void 0 && ts.isBlock(body)) points.push(afterDirectives(ts, body.statements, body.getStart(sourceFile) + 1));
+		}
+		ts.forEachChild(node, (child) => walk(child, nextDepth, childInClass(ts, node, child, inClass)));
+	}
+}
+function isFunctionLike(ts, node) {
+	return ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node) || ts.isConstructorDeclaration(node) || ts.isGetAccessorDeclaration(node) || ts.isSetAccessorDeclaration(node);
+}
+/**
+* Mirrors the acorn walk's rule: true for the function a class member *is* or
+* holds, false again once inside any function body. In this AST a class
+* method is itself the function-like — there is no separate `value` node —
+* so membership is decided when the class hands its members down.
+*/
+function childInClass(ts, parent, child, inherited) {
+	if (ts.isClassDeclaration(parent) || ts.isClassExpression(parent)) return ts.isMethodDeclaration(child) || ts.isConstructorDeclaration(child) || ts.isGetAccessorDeclaration(child) || ts.isSetAccessorDeclaration(child) || ts.isPropertyDeclaration(child);
+	if (ts.isPropertyDeclaration(parent)) return child === parent.initializer;
+	if (isFunctionLike(ts, parent)) return false;
+	return inherited;
+}
+/**
+* Same rule as the acorn dialect: a directive prologue only counts while it
+* is still the first thing in its scope, and `"use client"` / `"use server"`
+* are directives to Next, so nothing may be inserted ahead of them.
+*/
+function afterDirectives(ts, statements, from) {
+	let offset = from;
+	for (const statement of statements) {
+		if (!ts.isExpressionStatement(statement)) break;
+		if (!ts.isStringLiteral(statement.expression)) break;
+		offset = statement.end;
+	}
+	return offset;
+}
+//#endregion
 //#region src/coverage/next/loader.ts
 /**
-* webpack loader form of the instrumenter, for code that reaches the runtime as
-* part of a bundle and so is invisible to the load hooks.
+* The loader form of the instrumenter, for code that reaches the runtime as
+* part of a bundle and so is invisible to the load hooks. One loader, two
+* dialects, because the two bundlers hand it different inputs:
+*
+* - **webpack** registers it with `enforce: "post"`, so it sees compiled
+*   JavaScript and parses with acorn (`dialect: "compiled"`, the default).
+* - **Turbopack** has no post phase — rule loaders run on the *original*
+*   TypeScript/TSX — so that registration passes `dialect: "source"` and the
+*   file is parsed with the `typescript` compiler API instead.
 *
-* It is registered with `enforce: "post"` so it sees JavaScript: webpack runs
-* post loaders last, after the framework's own TypeScript/JSX transform, which
-* keeps this file free of a TypeScript parser.
+* Scoping also differs: webpack's rule carries `include`/`exclude` matchers,
+* while Turbopack rules are extension globs, so the source dialect gets the
+* include prefixes as options and filters through `shouldInstrument` — the
+* same decision the runtime load hooks use.
 */
 function ccqaCoverageLoader(source) {
-	const root = this.getOptions?.().root ?? process.cwd();
-	const fileId = fileIdFor(this.resourcePath, root);
+	const options = this.getOptions?.() ?? {};
+	const root = options.root ?? process.cwd();
+	const dialect = options.dialect ?? "compiled";
+	const fileId = dialect === "source" ? shouldInstrument(this.resourcePath, {
+		root,
+		include: options.include ?? []
+	}) : fileIdFor(this.resourcePath, root);
 	if (fileId === void 0) return source;
-	const instrumented = transform(source, { fileId });
+	if (source.trim().length === 0) return source;
+	if (dialect === "source" && !typescriptAvailable(root)) {
+		this.emitWarning?.(/* @__PURE__ */ new Error(`ccqa-tools needs the \`typescript\` package to instrument Turbopack builds; ${fileId} left uninstrumented`));
+		return source;
+	}
+	const instrumented = dialect === "source" ? transformTs(source, {
+		fileId,
+		extension: extname(this.resourcePath),
+		resolveFrom: root
+	}) : transform(source, { fileId });
 	if (instrumented === void 0) {
 		this.emitWarning?.(/* @__PURE__ */ new Error(`ccqa-tools could not parse ${fileId}; left uninstrumented`));
 		return source;

package/dist/coverage/next.cjs

@@ -1,6 +1,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let node_module = require("node:module");
 let node_path = require("node:path");
+//#region src/coverage/instrument/select.ts
+const SOURCE_EXTENSIONS = [
+	".js",
+	".mjs",
+	".cjs",
+	".jsx",
+	".ts",
+	".mts",
+	".cts",
+	".tsx"
+];
+//#endregion
 //#region src/coverage/wire.ts
 /**
 * Enables the instrumentation. Unset means the register hook is never loaded
@@ -69,12 +81,22 @@ function debugLog(config, message) {
 * coverage already reads V8's own counters and needs nothing injected.
 */
 const require$1 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
-/** Wraps a Next config, preserving any `webpack` hook it already has. */
+/**
+* Wraps a Next config, preserving any `webpack` hook and `turbopack` rules it
+* already has. Both bundlers are wired because the config does not know which
+* one will build it: webpack gets a post-loader over compiled JavaScript,
+* Turbopack — which has no post phase and never calls the `webpack` hook —
+* gets rule loaders that instrument the original TypeScript instead. Missing
+* either half means a Turbopack (or webpack) build silently ships
+* uninstrumented server code whose only coverage is the module-load boot set.
+*/
 function withCoverage(config, options = {}) {
 	if (!(options.enabled ?? process.env["CCQA_COVERAGE"] !== void 0)) return config;
 	const root = (0, node_path.resolve)(options.root ?? readConfig().root);
-	const include = (options.include ?? ["src"]).map((dir) => (0, node_path.resolve)(root, dir));
+	const relativeInclude = (options.include ?? readConfig().include).map((dir) => dir.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, ""));
+	const include = relativeInclude.map((dir) => (0, node_path.resolve)(root, dir));
 	const previous = config.webpack;
+	debugLog(readConfig(), `instrumenting server bundles under ${include.join(", ")}`);
 	return {
 		...config,
 		webpack(webpackConfig, context) {
@@ -84,7 +106,7 @@ function withCoverage(config, options = {}) {
 			next.module.rules ??= [];
 			next.module.rules.push({
 				enforce: "post",
-				test: /\.(?:[cm]?js|jsx|tsx?)$/,
+				test: /\.(?:[cm]?[jt]s|jsx|tsx)$/,
 				include,
 				exclude: /[\\/]node_modules[\\/]/,
 				use: [{
@@ -92,10 +114,49 @@ function withCoverage(config, options = {}) {
 					options: { root }
 				}]
 			});
-			debugLog(readConfig(), `instrumenting server bundles under ${include.join(", ")}`);
 			return next;
-		}
+		},
+		turbopack: withTurbopackRules(config.turbopack, root, relativeInclude)
+	};
+}
+/**
+* Turbopack rule globs match by extension, everywhere — there is no
+* `include` matcher — so project scoping happens inside the loader through
+* `shouldInstrument`. The rule's condition does what the webpack half's
+* `isServer` gate and `exclude` matcher do: `not browser` keeps probes out
+* of client bundles, `not foreign` keeps dependencies out of the loader
+* entirely. No `as` is set, so the instrumented output stays the same module
+* type and flows through the framework's own TypeScript pipeline.
+*
+* One measured trap: Turbopack serves unchanged files from its persistent
+* cache without consulting rules again, so judging a rule change by an
+* incremental build lies — a rule "not firing" may just be a warm cache.
+*/
+function withTurbopackRules(existing, root, include) {
+	const rule = {
+		condition: { all: [{ not: "browser" }, { not: "foreign" }] },
+		loaders: [{
+			loader: require$1.resolve("./next-loader.cjs"),
+			options: {
+				root,
+				include,
+				dialect: "source"
+			}
+		}]
 	};
+	const rules = { ...existing?.rules };
+	for (const extension of SOURCE_EXTENSIONS) {
+		const glob = `*${extension}`;
+		rules[glob] = [...toArray(rules[glob]), rule];
+	}
+	return {
+		...existing,
+		rules
+	};
+}
+function toArray(value) {
+	if (value === void 0) return [];
+	return Array.isArray(value) ? value : [value];
 }
 //#endregion
 exports.withCoverage = withCoverage;

package/dist/coverage/next.d.cts

@@ -17,6 +17,10 @@
  * `__ccqaCoverage` calls to browsers, where the front-end side of ccqa's
  * coverage already reads V8's own counters and needs nothing injected.
  */
+type TurbopackRules = Record<string, unknown>;
+interface TurbopackConfig {
+  rules?: TurbopackRules;
+}
 interface CoverageNextOptions {
   /** Project root that file ids are relative to. Defaults to `process.cwd()`. */
   root?: string;
@@ -25,9 +29,18 @@ interface CoverageNextOptions {
   /** Set false to build without instrumentation while keeping the config in place. */
   enabled?: boolean;
 }
-/** Wraps a Next config, preserving any `webpack` hook it already has. */
+/**
+ * Wraps a Next config, preserving any `webpack` hook and `turbopack` rules it
+ * already has. Both bundlers are wired because the config does not know which
+ * one will build it: webpack gets a post-loader over compiled JavaScript,
+ * Turbopack — which has no post phase and never calls the `webpack` hook —
+ * gets rule loaders that instrument the original TypeScript instead. Missing
+ * either half means a Turbopack (or webpack) build silently ships
+ * uninstrumented server code whose only coverage is the module-load boot set.
+ */
 declare function withCoverage<T extends {
   webpack?: unknown;
+  turbopack?: TurbopackConfig;
 }>(config: T, options?: CoverageNextOptions): T;
 //#endregion
 export { CoverageNextOptions, withCoverage };

package/dist/coverage/next.d.ts

@@ -17,6 +17,10 @@
  * `__ccqaCoverage` calls to browsers, where the front-end side of ccqa's
  * coverage already reads V8's own counters and needs nothing injected.
  */
+type TurbopackRules = Record<string, unknown>;
+interface TurbopackConfig {
+  rules?: TurbopackRules;
+}
 interface CoverageNextOptions {
   /** Project root that file ids are relative to. Defaults to `process.cwd()`. */
   root?: string;
@@ -25,9 +29,18 @@ interface CoverageNextOptions {
   /** Set false to build without instrumentation while keeping the config in place. */
   enabled?: boolean;
 }
-/** Wraps a Next config, preserving any `webpack` hook it already has. */
+/**
+ * Wraps a Next config, preserving any `webpack` hook and `turbopack` rules it
+ * already has. Both bundlers are wired because the config does not know which
+ * one will build it: webpack gets a post-loader over compiled JavaScript,
+ * Turbopack — which has no post phase and never calls the `webpack` hook —
+ * gets rule loaders that instrument the original TypeScript instead. Missing
+ * either half means a Turbopack (or webpack) build silently ships
+ * uninstrumented server code whose only coverage is the module-load boot set.
+ */
 declare function withCoverage<T extends {
   webpack?: unknown;
+  turbopack?: TurbopackConfig;
 }>(config: T, options?: CoverageNextOptions): T;
 //#endregion
 export { CoverageNextOptions, withCoverage };

package/dist/coverage/next.js

@@ -1,5 +1,17 @@
 import { createRequire } from "node:module";
 import { resolve } from "node:path";
+//#region src/coverage/instrument/select.ts
+const SOURCE_EXTENSIONS = [
+	".js",
+	".mjs",
+	".cjs",
+	".jsx",
+	".ts",
+	".mts",
+	".cts",
+	".tsx"
+];
+//#endregion
 //#region src/coverage/wire.ts
 /**
 * Enables the instrumentation. Unset means the register hook is never loaded
@@ -68,12 +80,22 @@ function debugLog(config, message) {
 * coverage already reads V8's own counters and needs nothing injected.
 */
 const require = createRequire(import.meta.url);
-/** Wraps a Next config, preserving any `webpack` hook it already has. */
+/**
+* Wraps a Next config, preserving any `webpack` hook and `turbopack` rules it
+* already has. Both bundlers are wired because the config does not know which
+* one will build it: webpack gets a post-loader over compiled JavaScript,
+* Turbopack — which has no post phase and never calls the `webpack` hook —
+* gets rule loaders that instrument the original TypeScript instead. Missing
+* either half means a Turbopack (or webpack) build silently ships
+* uninstrumented server code whose only coverage is the module-load boot set.
+*/
 function withCoverage(config, options = {}) {
 	if (!(options.enabled ?? process.env["CCQA_COVERAGE"] !== void 0)) return config;
 	const root = resolve(options.root ?? readConfig().root);
-	const include = (options.include ?? ["src"]).map((dir) => resolve(root, dir));
+	const relativeInclude = (options.include ?? readConfig().include).map((dir) => dir.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, ""));
+	const include = relativeInclude.map((dir) => resolve(root, dir));
 	const previous = config.webpack;
+	debugLog(readConfig(), `instrumenting server bundles under ${include.join(", ")}`);
 	return {
 		...config,
 		webpack(webpackConfig, context) {
@@ -83,7 +105,7 @@ function withCoverage(config, options = {}) {
 			next.module.rules ??= [];
 			next.module.rules.push({
 				enforce: "post",
-				test: /\.(?:[cm]?js|jsx|tsx?)$/,
+				test: /\.(?:[cm]?[jt]s|jsx|tsx)$/,
 				include,
 				exclude: /[\\/]node_modules[\\/]/,
 				use: [{
@@ -91,10 +113,49 @@ function withCoverage(config, options = {}) {
 					options: { root }
 				}]
 			});
-			debugLog(readConfig(), `instrumenting server bundles under ${include.join(", ")}`);
 			return next;
-		}
+		},
+		turbopack: withTurbopackRules(config.turbopack, root, relativeInclude)
+	};
+}
+/**
+* Turbopack rule globs match by extension, everywhere — there is no
+* `include` matcher — so project scoping happens inside the loader through
+* `shouldInstrument`. The rule's condition does what the webpack half's
+* `isServer` gate and `exclude` matcher do: `not browser` keeps probes out
+* of client bundles, `not foreign` keeps dependencies out of the loader
+* entirely. No `as` is set, so the instrumented output stays the same module
+* type and flows through the framework's own TypeScript pipeline.
+*
+* One measured trap: Turbopack serves unchanged files from its persistent
+* cache without consulting rules again, so judging a rule change by an
+* incremental build lies — a rule "not firing" may just be a warm cache.
+*/
+function withTurbopackRules(existing, root, include) {
+	const rule = {
+		condition: { all: [{ not: "browser" }, { not: "foreign" }] },
+		loaders: [{
+			loader: require.resolve("./next-loader.cjs"),
+			options: {
+				root,
+				include,
+				dialect: "source"
+			}
+		}]
 	};
+	const rules = { ...existing?.rules };
+	for (const extension of SOURCE_EXTENSIONS) {
+		const glob = `*${extension}`;
+		rules[glob] = [...toArray(rules[glob]), rule];
+	}
+	return {
+		...existing,
+		rules
+	};
+}
+function toArray(value) {
+	if (value === void 0) return [];
+	return Array.isArray(value) ? value : [value];
 }
 //#endregion
 export { withCoverage };

package/dist/coverage/register.cjs

@@ -557,31 +557,36 @@ function readSourceMappingUrl(code) {
 	for (const match of code.matchAll(SOURCE_MAPPING_URL)) found = match[1];
 	return found;
 }
-//#endregion
-//#region src/coverage/instrument/transform.ts
 /**
-* Rewrites a module so that entering it, or entering one of its functions,
-* calls `globalThis.__ccqaCoverage`.
-*
-* Two properties drive the whole shape:
-*
-* - **Insertions only, never a newline.** Line numbers survive untouched, so
-*   the source map the application already ships keeps pointing at the right
-*   lines and stack traces stay readable. A codegen round-trip would have
-*   forced us to produce and merge maps of our own.
-* - **File granularity.** The record is "this file ran", so there is no need to
-*   track statements or branches, and the whole class of line/branch
-*   normalisation bugs that follow V8-to-istanbul conversion never appears.
+* The exact texts both instrumenter dialects splice in, built in one place so
+* a file instrumented from TypeScript and one instrumented from compiled
+* JavaScript are byte-identical where it matters.
 */
-const DEFAULT_MAX_DEPTH = 2;
+function probeTexts(fileId) {
+	const local = `__ccqa_${hash(fileId)}`;
+	const literal = JSON.stringify(fileId);
+	return {
+		enter: `;${local}&&${local}(${literal});`,
+		prologue: `;var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+	};
+}
+/** Applies insert-only edits (no newlines) so line numbers survive untouched. */
+function splice(code, edits) {
+	const parts = [];
+	let last = 0;
+	for (const edit of edits) {
+		parts.push(code.slice(last, edit.offset), edit.text);
+		last = edit.offset;
+	}
+	parts.push(code.slice(last));
+	return parts.join("");
+}
 function transform(code, options) {
 	const program = parseProgram(code);
 	if (program === void 0) return void 0;
-	const local = `__ccqa_${hash(options.fileId)}`;
-	const literal = JSON.stringify(options.fileId);
-	const enter = `${local}&&${local}(${literal});`;
+	const { enter, prologue } = probeTexts(options.fileId);
 	const points = [];
-	collect(program, options.maxDepth ?? DEFAULT_MAX_DEPTH, points);
+	collect(program, options.maxDepth ?? 2, points);
 	if (code.length === 0) return void 0;
 	const prologueAt = afterDirectives(code, program);
 	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
@@ -590,17 +595,10 @@ function transform(code, options) {
 	}));
 	edits.push({
 		offset: prologueAt,
-		text: `var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+		text: prologue
 	});
 	edits.sort((a, b) => a.offset - b.offset);
-	const parts = [];
-	let last = 0;
-	for (const edit of edits) {
-		parts.push(code.slice(last, edit.offset), edit.text);
-		last = edit.offset;
-	}
-	parts.push(code.slice(last));
-	return parts.join("");
+	return splice(code, edits);
 }
 function parseProgram(code) {
 	for (const sourceType of ["module", "script"]) try {

package/dist/coverage/register.js

@@ -532,31 +532,36 @@ function readSourceMappingUrl(code) {
 	for (const match of code.matchAll(SOURCE_MAPPING_URL)) found = match[1];
 	return found;
 }
-//#endregion
-//#region src/coverage/instrument/transform.ts
 /**
-* Rewrites a module so that entering it, or entering one of its functions,
-* calls `globalThis.__ccqaCoverage`.
-*
-* Two properties drive the whole shape:
-*
-* - **Insertions only, never a newline.** Line numbers survive untouched, so
-*   the source map the application already ships keeps pointing at the right
-*   lines and stack traces stay readable. A codegen round-trip would have
-*   forced us to produce and merge maps of our own.
-* - **File granularity.** The record is "this file ran", so there is no need to
-*   track statements or branches, and the whole class of line/branch
-*   normalisation bugs that follow V8-to-istanbul conversion never appears.
+* The exact texts both instrumenter dialects splice in, built in one place so
+* a file instrumented from TypeScript and one instrumented from compiled
+* JavaScript are byte-identical where it matters.
 */
-const DEFAULT_MAX_DEPTH = 2;
+function probeTexts(fileId) {
+	const local = `__ccqa_${hash(fileId)}`;
+	const literal = JSON.stringify(fileId);
+	return {
+		enter: `;${local}&&${local}(${literal});`,
+		prologue: `;var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+	};
+}
+/** Applies insert-only edits (no newlines) so line numbers survive untouched. */
+function splice(code, edits) {
+	const parts = [];
+	let last = 0;
+	for (const edit of edits) {
+		parts.push(code.slice(last, edit.offset), edit.text);
+		last = edit.offset;
+	}
+	parts.push(code.slice(last));
+	return parts.join("");
+}
 function transform(code, options) {
 	const program = parseProgram(code);
 	if (program === void 0) return void 0;
-	const local = `__ccqa_${hash(options.fileId)}`;
-	const literal = JSON.stringify(options.fileId);
-	const enter = `${local}&&${local}(${literal});`;
+	const { enter, prologue } = probeTexts(options.fileId);
 	const points = [];
-	collect(program, options.maxDepth ?? DEFAULT_MAX_DEPTH, points);
+	collect(program, options.maxDepth ?? 2, points);
 	if (code.length === 0) return void 0;
 	const prologueAt = afterDirectives(code, program);
 	const edits = points.filter((offset) => offset > prologueAt).map((offset) => ({
@@ -565,17 +570,10 @@ function transform(code, options) {
 	}));
 	edits.push({
 		offset: prologueAt,
-		text: `var ${local}=globalThis.__ccqaCoverage;${local}&&${local}(${literal},true);`
+		text: prologue
 	});
 	edits.sort((a, b) => a.offset - b.offset);
-	const parts = [];
-	let last = 0;
-	for (const edit of edits) {
-		parts.push(code.slice(last, edit.offset), edit.text);
-		last = edit.offset;
-	}
-	parts.push(code.slice(last));
-	return parts.join("");
+	return splice(code, edits);
 }
 function parseProgram(code) {
 	for (const sourceType of ["module", "script"]) try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa-tools",
-  "version": "1.40.3",
+  "version": "1.40.5",
   "type": "module",
   "description": "Instrumentation the application under test installs, for ccqa. Currently: per-spec reach coverage.",
   "repository": {