Modernize tooling: npm, vitest, TypeScript 6, Node 22+, ESLint flat config

[LoveAndCoding]

Summary

• Switch package manager from yarn to npm (remove yarn.lock, add package-lock.json, update CI to npm ci)
• Migrate the full test suite off jest onto vitest: new root vitest.config.ts covers unit/integration/e2e, jest.fn/jest.mock/jest.MockedClass/jest.MockedFunction usages converted to vitest's vi equivalents, jest/ts-jest/@types/jest removed
• Bump TypeScript to ^6.0.3 (not 7.x — that hard-crashes typescript-eslint 8.x today, confirmed empirically) and @types/node to ^22.9.4; fix the ~180 stricter compile errors this surfaced without changing runtime behavior
• Raise the Node engines floor to >=22 (18 and 20 are both past EOL, and vitest 4.x/ESLint 10 require Node ≥20 anyway); update CI's Node matrix to 22.x/24.x
• Migrate ESLint to flat config (eslint.config.js) with ESLint 10 + the unified typescript-eslint 8 package, replacing .eslintrc.js/.eslintignore; preserve the old warn-level severity for no-explicit-any/no-unused-vars since the v8 recommended config promotes them to errors by default
• Delete the dead pre-TypeScript test/test.js + test-connection-*.js files (they called a since-removed default Imap export); the specific historical-bug scenarios they encoded are written up in docs/superpowers/specs/2026-07-12-legacy-regression-scenarios-to-reverify.md for re-verification once FETCH/IDLE are (re)implemented
• Add prettier as a real, runnable devDependency (config already existed but the package was never installed); wire the compliance suite into CI (it existed but was never run there); fix vitest's reportOnFailure default so coverage still gets reported when a test fails, matching jest's old behavior

Real bugs found and fixed along the way

• A copy-paste index bug in parser/encoding.ts (seq[j] instead of rpl[j])
• A socket-access race in connection.ts around close/end
• FlagList.hasWildcard was never initialized
• A useDefineForClassFields landmine the TS target bump would otherwise have caused: every lexer token's .type property would have silently gone undefined (fixed by removing redundant field re-declarations)

Flagged, not fixed

• parser.ts: parseTokens() returns null for malformed input, which flows into this.push(null) — normally Node's signal to end a stream. Types now correctly reflect this reality; whether that's the intended behavior is unclear and left as-is.
• ThreadMessage.get children() (in parser/structure/thread.ts) returns this.children instead of this._children — infinite recursion if ever called. Not a compile error, so untouched, just flagged.
• 179 pre-existing lint errors remain (mostly no-useless-escape in the regex-heavy parser code) — predate this work and were never enforced in CI before, so lint is non-blocking (continue-on-error) rather than failing every future PR on unrelated backlog.
• 252 files aren't currently prettier-clean; no blanket reformat was run since that's a large, separate, no-logic-change diff.

Test plan

• npm run build
• npm run typecheck
• npm run typecheck:compliance
• npm test (231/232 — the 1 failure is the same pre-existing one already documented as expected)
• npm run test:compliance (800 failed/431 passed — byte-identical to the pre-modernization baseline)
• npm run lint (non-blocking; pre-existing debt only)

---

Generated by Claude Code