feat: use jiti for plugin loading

.prettierignore

@@ -3,3 +3,6 @@
 /coverage
 /.nx
 __snapshots__
+
+# Test fixtures with intentional syntax errors
+packages/utils/mocks/fixtures/actually-invalid.js

package.json

@@ -74,12 +74,13 @@
     "@types/benchmark": "^2.1.5",
     "@types/debug": "^4.1.12",
     "@types/eslint": "^8.44.2",
+    "@types/jsdom": "^27.0.0",
     "@types/node": "^22.13.4",
     "@types/react": "18.3.1",
     "@types/react-dom": "18.3.0",
     "@vitejs/plugin-react": "^5.0.0",
     "@vitest/coverage-v8": "1.3.1",
-    "@vitest/eslint-plugin": "^1.1.38",
+    "@vitest/eslint-plugin": "^1.6.6",
     "@vitest/ui": "1.3.1",
     "benchmark": "^2.1.4",
     "chrome-launcher": "^1.1.2",
@@ -102,7 +103,7 @@
     "husky": "^8.0.0",
     "inquirer": "^9.3.7",
     "jest-extended": "^6.0.0",
-    "jiti": "2.4.2",
+    "jiti": "^2.4.2",
     "jsdom": "~24.0.0",
     "jsonc-eslint-parser": "^2.4.0",
     "knip": "^5.33.3",

packages/cli/mocks/core-config-middleware.int-helper.ts

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+/**
+ * Helper script for testing coreConfigMiddleware with tsconfig path resolution.
+ * This script is executed in a subprocess to test the middleware in isolation.
+ *
+ * Usage: tsx core-config-middleware.int-helper.ts <configPath> [tsconfigPath]
+ *
+ * Note: Logger output is redirected to stderr to avoid interfering with JSON output on stdout.
+ */
+import { coreConfigMiddleware } from '../src/lib/implementation/core-config.middleware.js';
+
+// Redirect console.log and process.stdout.write to stderr to prevent logger output
+// from interfering with JSON output
+const originalLog = console.log;
+const originalWrite = process.stdout.write.bind(process.stdout);
+
+console.log = (...args: unknown[]) => {
+  process.stderr.write(args.join(' ') + '\n');
+};
+
+process.stdout.write = ((chunk: any, ...args: any[]): boolean => {
+  return process.stderr.write(chunk, ...args);
+}) as typeof process.stdout.write;
+
+const [configPath, tsconfigPath] = process.argv.slice(2);
+
+if (!configPath) {
+  console.error('Error: configPath is required');
+  process.exit(1);
+}
+
+try {
+  const result = await coreConfigMiddleware({
+    config: configPath,
+    ...(tsconfigPath && { tsconfig: tsconfigPath }),
+    plugins: [],
+    onlyPlugins: [],
+    skipPlugins: [],
+  });
+
+  // Restore original stdout.write before outputting JSON
+  process.stdout.write = originalWrite;
+
+  // Use originalLog to write JSON to stdout
+  originalLog(
+    JSON.stringify({
+      success: true,
+      config: result.config,
+    }),
+  );
+  process.exit(0);
+} catch (error) {
+  console.error(error);
+  process.exit(1);
+}

packages/cli/src/lib/implementation/core-config.middleware.int.test.ts

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { executeProcess } from '@code-pushup/utils';
 import { coreConfigMiddleware } from './core-config.middleware.js';
 
 const configDirPath = path.join(
@@ -12,7 +13,33 @@ const configDirPath = path.join(
   'mocks',
   'configs',
 );
-
+const helperPath = path.join(
+  fileURLToPath(path.dirname(import.meta.url)),
+  '..',
+  '..',
+  '..',
+  '..',
+  'cli',
+  'mocks',
+  'core-config-middleware.int-helper.ts',
+);
+const runMiddlewareInCwd = async (configPath: string, tsconfigPath?: string) =>
+  await executeProcess({
+    command: 'npx',
+    args: [
+      'tsx',
+      helperPath,
+      configPath,
+      ...(tsconfigPath ? [tsconfigPath] : []),
+    ],
+    cwd: configDirPath,
+    env: {
+      ...process.env,
+      // Disable all logger output to avoid interfering with JSON output
+      CP_VERBOSE: 'false',
+      CI: 'false',
+    },
+  });
 describe('coreConfigMiddleware', () => {
   const CLI_DEFAULTS = {
     plugins: [],
@@ -30,15 +57,16 @@ describe('coreConfigMiddleware', () => {
   });
 
   it('should load config which relies on provided --tsconfig', async () => {
-    await expect(
-      coreConfigMiddleware({
-        config: path.join(
-          configDirPath,
-          'code-pushup.needs-tsconfig.config.ts',
-        ),
-        tsconfig: path.join(configDirPath, 'tsconfig.json'),
-        ...CLI_DEFAULTS,
-      }),
-    ).resolves.toBeTruthy();
+    const { stdout, code } = await runMiddlewareInCwd(
+      'code-pushup.needs-tsconfig.config.ts',
+      path.join(configDirPath, 'tsconfig.json'),
+    );
+
+    expect(code).toBe(0);
+    const output = JSON.parse(stdout);
+    expect(output).toStrictEqual({
+      success: true,
+      config: expect.any(String),
+    });
   });
 });

packages/plugin-axe/src/lib/axe-core-polyfilled.ts

@@ -0,0 +1,46 @@
+/**
+ * Axe-core Polyfilled Import
+ *
+ * This file ensures the jsdom polyfill runs BEFORE axe-core is imported.
+ * Static imports are evaluated in order, so the polyfill import must come first.
+ *
+ * WHY THIS EXISTS:
+ * axe-core has side effects on import - it expects global `window` and `document` objects
+ * to be available when the module is loaded. In Node.js environments, these don't exist
+ * by default. This polyfill creates a virtual DOM using JSDOM and sets these globals
+ * before axe-core is imported.
+ *
+ * IMPORT ORDER IS CRITICAL:
+ * 1. jsdom.polyfill.ts is imported first (sets up globalThis.window and globalThis.document)
+ * 2. axe-core is imported second (now globals exist)
+ *
+ * IMPORT CHAIN:
+ * 1. This file (imports polyfill, then imports axe-core)
+ * 2. safe-axe-core-import.ts (re-exports for clean imports)
+ *
+ * USAGE:
+ * Do NOT import from this file directly. Use safe-axe-core-import.ts instead.
+ *
+ * @see https://github.com/dequelabs/axe-core/issues/3962
+ */
+// CRITICAL: This import MUST come before axe-core import
+// It sets up globalThis.window and globalThis.document as side effects
+// eslint-disable-next-line import/no-unassigned-import
+// Now safe to import axe-core - globals exist due to polyfill above
+// This import MUST come after the polyfill import
+import axe from 'axe-core';
+import './jsdom.polyfill.js';
+
+// Re-export axe as default
+export default axe;
+
+// Re-export all types used throughout the codebase
+export type {
+  AxeResults,
+  NodeResult,
+  Result,
+  IncompleteResult,
+  RuleMetadata,
+  ImpactValue,
+  CrossTreeSelector,
+} from 'axe-core';

packages/plugin-axe/src/lib/groups.int.test.ts

@@ -1,5 +1,5 @@
-import axe from 'axe-core';
 import { axeCategoryGroupSlugSchema, axeWcagTagSchema } from './groups.js';
+import axe from './safe-axe-core-import.js';
 
 describe('axeCategoryGroupSlugSchema', () => {
   const axeCategoryTags = axe

packages/plugin-axe/src/lib/jsdom.polyfill.ts

@@ -0,0 +1,32 @@
+/**
+ * JSDOM Polyfill Setup
+ *
+ * WHY THIS EXISTS:
+ * axe-core has side effects on import - it expects global `window` and `document` objects
+ * to be available when the module is loaded. In Node.js environments, these don't exist
+ * by default. This polyfill creates a virtual DOM using JSDOM and sets these globals
+ * before axe-core is imported.
+ *
+ * HOW IT WORKS:
+ * - Creates a minimal JSDOM instance with a basic HTML document
+ * - Sets globalThis.window and globalThis.document to the JSDOM window/document
+ * - This must be imported BEFORE any axe-core imports to ensure globals exist
+ *
+ * IMPORT CHAIN:
+ * This file is imported first by axe-core-polyfilled.ts, which then safely imports
+ * axe-core. All other files should import from safe-axe-core-import.ts, not directly
+ * from this file or from 'axe-core'.
+ *
+ * @see https://github.com/dequelabs/axe-core/issues/3962
+ */
+// @ts-ignore - jsdom types are in devDependencies at root level
+import { JSDOM } from 'jsdom';
+
+const html = `<!DOCTYPE html>\n<html></html>`;
+const { window: jsdomWindow } = new JSDOM(html);
+
+// Set globals for axe-core compatibility
+// eslint-disable-next-line  functional/immutable-data
+globalThis.window = jsdomWindow as unknown as Window & typeof globalThis;
+// eslint-disable-next-line  functional/immutable-data
+globalThis.document = jsdomWindow.document;

packages/plugin-axe/src/lib/meta/transform.ts

@@ -1,4 +1,3 @@
-import axe from 'axe-core';
 import type { Audit, Group } from '@code-pushup/models';
 import { objectToEntries, wrapTags } from '@code-pushup/utils';
 import type { AxePreset } from '../config.js';
@@ -7,6 +6,7 @@ import {
   CATEGORY_GROUPS,
   getWcagPresetTags,
 } from '../groups.js';
+import axe from '../safe-axe-core-import.js';
 
 /** Loads Axe rules filtered by the specified preset. */
 export function loadAxeRules(preset: AxePreset): axe.RuleMetadata[] {

packages/plugin-axe/src/lib/runner/run-axe.ts

@@ -1,6 +1,5 @@
 import { AxeBuilder } from '@axe-core/playwright';
 import ansis from 'ansis';
-import type { AxeResults } from 'axe-core';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import {
@@ -17,6 +16,7 @@ import {
   logger,
   pluralizeToken,
 } from '@code-pushup/utils';
+import type { AxeResults } from '../safe-axe-core-import.js';
 import { type SetupFunction, runSetup } from './setup.js';
 import { toAuditOutputs } from './transform.js';
 

packages/plugin-axe/src/lib/runner/runner.unit.test.ts

@@ -1,5 +1,9 @@
-import type { AxeResults, IncompleteResult, Result } from 'axe-core';
 import { type AuditOutput, DEFAULT_PERSIST_CONFIG } from '@code-pushup/models';
+import type {
+  AxeResults,
+  IncompleteResult,
+  Result,
+} from '../safe-axe-core-import.js';
 import type { AxeUrlResult } from './run-axe.js';
 import { createRunnerFunction } from './runner.js';
 import * as setup from './setup.js';

packages/plugin-axe/src/lib/runner/transform.ts

@@ -1,4 +1,3 @@
-import axe from 'axe-core';
 import type {
   AuditOutput,
   AuditOutputs,
@@ -10,6 +9,7 @@ import {
   pluralizeToken,
   truncateIssueMessage,
 } from '@code-pushup/utils';
+import axe from '../safe-axe-core-import.js';
 
 /**
  * Transforms Axe results into audit outputs.

packages/plugin-axe/src/lib/runner/transform.unit.test.ts

@@ -1,5 +1,9 @@
-import type { AxeResults, CheckResult, NodeResult, Result } from 'axe-core';
 import type { AuditOutput } from '@code-pushup/models';
+import type {
+  AxeResults,
+  NodeResult,
+  Result,
+} from '../safe-axe-core-import.js';
 import { toAuditOutputs } from './transform.js';
 
 function createMockCheck(overrides: Partial<CheckResult> = {}): CheckResult {

packages/plugin-axe/src/lib/safe-axe-core-import.ts

@@ -0,0 +1,33 @@
+/**
+ * Safe Axe-core Import Entry Point
+ *
+ * This is the ONLY safe way to import axe-core in this codebase.
+ * All files should import from this module instead of importing directly from 'axe-core'.
+ *
+ * WHY THIS EXISTS:
+ * axe-core requires global `window` and `document` objects to exist when imported.
+ * Due to ES module import hoisting, we need a fixed import chain to ensure the
+ * jsdom polyfill runs before axe-core loads.
+ *
+ * IMPORT CHAIN:
+ * jsdom.polyfill.ts → axe-core-polyfilled.ts → safe-axe-core-import.ts → your code
+ *
+ * USAGE:
+ * Instead of: import axe from 'axe-core';
+ * Use:        import axe from './safe-axe-core-import.js';
+ *
+ * Instead of: import type { AxeResults } from 'axe-core';
+ * Use:        import type { AxeResults } from './safe-axe-core-import.js';
+ */
+
+// Re-export everything from the polyfilled version
+export { default } from './axe-core-polyfilled.js';
+export type {
+  AxeResults,
+  NodeResult,
+  Result,
+  IncompleteResult,
+  RuleMetadata,
+  ImpactValue,
+  CrossTreeSelector,
+} from './axe-core-polyfilled.js';

packages/utils/mocks/fixtures/actually-invalid.js

@@ -0,0 +1,4 @@
+// This is an actually invalid JavaScript file with syntax errors
+const x = {
+  missing: "closing brace"
+// Unclosed object

packages/utils/mocks/fixtures/helper-module.ts

@@ -0,0 +1,2 @@
+export const helperValue = 'helper-module-value';
+export default helperValue;

packages/utils/mocks/fixtures/tsconfig-paths-test.json

@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "paths": {
+      "@test/helper": ["./helper-module.ts"]
+    }
+  }
+}

packages/utils/mocks/fixtures/uses-path-alias.ts

@@ -0,0 +1,8 @@
+// eslint-disable-next-line import/no-unresolved
+import helperValue from '@test/helper';
+
+const config = {
+  value: helperValue,
+};
+
+export default config;

packages/utils/package.json

@@ -30,14 +30,15 @@
     "@code-pushup/models": "0.113.0",
     "ansis": "^3.3.0",
     "build-md": "^0.4.2",
-    "bundle-require": "^5.1.0",
     "esbuild": "^0.25.2",
     "ora": "^9.0.0",
     "semver": "^7.6.0",
     "simple-git": "^3.20.0",
     "string-width": "^8.1.0",
     "wrap-ansi": "^9.0.2",
-    "zod": "^4.2.1"
+    "zod": "^4.2.1",
+    "jiti": "^2.4.2",
+    "typescript": "5.7.3"
   },
   "peerDependencies": {
     "@nx/devkit": ">=17.0.0"

packages/utils/src/index.ts

@@ -32,6 +32,7 @@ export {
   type ProcessObserver,
   type ProcessResult,
 } from './lib/execute-process.js';
+export { loadTargetConfig } from './lib/load-ts-config.js';
 export {
   crawlFileSystem,
   createReportPath,