npm - @svelte-vitals/core - Versions diffs - 0.41.0 → 0.42.0 - Mend

@svelte-vitals/core 0.41.0 → 0.42.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -612,6 +612,29 @@ interface KitModuleFacts {
     parseFailed?: true;
 }
+/**
+ * Resolve an import specifier to a path relative to the analyzed project's root (the
+ * cwd svelte-vitals runs from — not necessarily a repo root; in a monorepo the project
+ * may live at e.g. `apps/web/`) against the importing file, or undefined when it cannot
+ * be a project-local module: the caller's `aliases` list decides which non-relative
+ * specifiers resolve, defaulting to `$lib` → `src/lib`; `./`/`../` resolve against the
+ * importing file's directory; bare packages and other aliases are skipped (they can't
+ * be resolved to a project-local path at all). Also undefined when a relative
+ * specifier's `..` segments escape the project root (see `normalizePosix`), or when a
+ * matched alias's value is itself absolute (e.g. `/opt/shared/src`, or a posixified Windows
+ * drive-letter path like `C:/shared/src`): an absolute target is outside the analyzed project by
+ * definition, and without this check `normalizePosix` would quietly drop the leading empty
+ * segment and hand back a project-relative-LOOKING path that actually names a different file.
+ *
+ * Exported from the package's public barrel because `architecture/private-scope-import`
+ * and `architecture/route-component-import` (inside `packages/core`) both need resolution
+ * that is not restricted to runes modules, unlike `resolveRunesModuleSpecifier` — and
+ * because `resolveComponentPath` (`packages/cli/src/providers/source/resolve.ts`), which
+ * drives transitive `<head>`/heading resolution, delegates its alias/`$lib`/relative
+ * mapping here too, rather than duplicating it. This is the single site for every
+ * repo-local specifier resolution in the repo.
+ */
+declare function resolveRepoLocalPath(spec: string, importerFile: string, aliases?: readonly KitAlias[]): string | undefined;
 /**
  * Resolve an import specifier to a repo-relative `.svelte.ts`/`.svelte.js` path, or
  * undefined when it cannot be a runes module: delegates to `resolveRepoLocalPath` with
@@ -739,13 +762,6 @@ type TextOrExpr = AST.Text | AST.ExpressionTag;
  * the standard fragment, nodes, consequent, alternate, and body keys.
  */
 declare const CHILD_NODE_KEYS: string[];
-/**
- * Determine a value's kind from a list of child/text nodes (design §4, §11):
- *   - any ExpressionTag present  → 'dynamic' (e.g. {data.title}); we do NOT
- *     follow the expression — that would turn this into runtime analysis.
- *   - non-whitespace Text only   → 'static'
- *   - empty / whitespace only    → 'absent'
- */
 declare function valueFromNodes(nodes: TextOrExpr[]): Value;
 /** The literal text of a node list when fully static (no ExpressionTag), else undefined. */
 declare function textFromNodes(nodes: TextOrExpr[]): string | undefined;
@@ -780,6 +796,19 @@ declare function settingSeverity(setting: RuleSetting | undefined): Severity | '
 declare function settingOptions(setting: RuleSetting | undefined): RuleOptions | undefined;
 /** Drop rules disabled via config (design §6). */
 declare function selectRules(rules: Rule[], config: Config): Rule[];
+/**
+ * `config` with `failedRuleIds` (from `runRules`' `failedRules`) forced `'off'`: a rule that threw
+ * examined nothing, so leaving it in the inventory would score it as if it had run clean, silently
+ * inflating Health. Reuses the exact mechanism a `rules: { id: 'off' }` config entry already gets —
+ * `selectRules`/`buildInventory` both drop an `'off'` id from the denominator — rather than adding a
+ * second, parallel notion of "not counted" for callers to keep in sync.
+ */
+declare function withFailedRulesOff(config: Config, failedRuleIds: readonly string[]): Config;
+/** One-line "rule failed and was skipped" warning; capped to the message's first line so a stack trace can't flood a terminal. */
+declare function formatFailedRuleWarning(f: {
+    id: string;
+    message: string;
+}): string;
 /** Apply per-rule severity overrides to results (design §6). */
 declare function applyRuleSeverities(results: Result[], config: Config): Result[];
 /** An override entry with its globs compiled once. Build with `compileOverrides`. */
@@ -1009,14 +1038,21 @@ declare function docsUrlFor(id: string): string;
  */
 declare function isPenalized(detection: Detection, treatDynamicAs: TreatDynamicAs): boolean;
+interface FailedRule {
+    id: string;
+    message: string;
+}
 /**
  * Run a set of rules against a shared context and collect their findings.
  * Rules are independent, so they run concurrently; results are flattened in
- * rule order for stable output.
+ * rule order for stable output. A rule that throws (sync or async) contributes
+ * no results instead of taking the whole run down with it — dev tooling must
+ * never throw — and is reported in `failedRules` instead.
  */
 declare function runRules(rules: Rule[], ctx: RuleContext): Promise<{
     results: Result[];
     examined: Record<string, Record<string, number>>;
+    failedRules: FailedRule[];
 }>;
 /**
@@ -1501,6 +1537,23 @@ interface ConsoleReportOptions {
  */
 declare function formatConsoleReport(results: Result[], config: Config, options?: ConsoleReportOptions): string;
+/**
+ * Strip ANSI/OSC escape sequences and C0 control characters (except `\n`/`\t`) from a
+ * string before it reaches a terminal. POSIX file/route names can contain almost any
+ * byte, so a hostile repo can smuggle a terminal-title rewrite, cursor move, or other
+ * escape-sequence trick into what looks like plain report text.
+ *
+ * Only OSC and CSI sequences are pattern-matched and removed whole (payload included) —
+ * those cover title-bar writes and cursor/screen control, the two classes with a real
+ * blast radius. Any other `ESC` byte (rarer single/two-byte forms like reset or
+ * save-cursor) falls through to the final C0 sweep below, which drops the lone `ESC`
+ * but — deliberately, not swallowing an adjacent legitimate character — leaves whatever
+ * printable byte follows it as stray text.
+ * ponytail: doesn't special-case every Fe escape form; broaden the CSI/OSC patterns if a
+ * concrete non-CSI/OSC sequence turns out to matter.
+ */
+declare function terminalSafe(text: string): string;
 interface ScoreModel {
     routeAverage: number;
     sitePenalty: number;
@@ -1632,6 +1685,20 @@ declare function formatMarkdownReport(results: Result[], config: Config, meta: {
     version: string;
 }): string;
+type Band = 'good' | 'warn' | 'poor';
+declare const BAND_COLOR: Record<Band, string>;
+declare function scoreBand(score: number): Band;
+declare function escapeHtml(s: string): string;
+/**
+ * Return the URL only when it uses a safe http/https scheme, else null.
+ * Guards a finding's `docsUrl` against `javascript:`/`data:` hrefs — escapeHtml
+ * neutralizes attribute breakout but not a malicious scheme. Browsers strip
+ * ASCII whitespace (tab/newline/CR) from a URL before resolving its scheme (so
+ * `java\tscript:` runs as `javascript:`), so strip whitespace first; anything not
+ * plainly http(s):// afterward is rejected. Pure string work — no `URL` global,
+ * keeping core runtime-agnostic and lib-minimal.
+ */
+declare function safeHref(url: string): string | null;
 /** Provenance of a route's findings: real rendered page vs. source-only analysis. */
 type RouteBadge = 'measured' | 'static';
 interface AppSnapshot {
@@ -1681,19 +1748,4 @@ declare function formatHtmlReport(results: Result[], config: Config, meta: {
     coreVersion?: string;
 }): string;
-type Band = 'good' | 'warn' | 'poor';
-declare const BAND_COLOR: Record<Band, string>;
-declare function scoreBand(score: number): Band;
-declare function escapeHtml(s: string): string;
-/**
- * Return the URL only when it uses a safe http/https scheme, else null.
- * Guards a finding's `docsUrl` against `javascript:`/`data:` hrefs — escapeHtml
- * neutralizes attribute breakout but not a malicious scheme. Browsers strip
- * ASCII whitespace (tab/newline/CR) from a URL before resolving its scheme (so
- * `java\tscript:` runs as `javascript:`), so strip whitespace first; anything not
- * plainly http(s):// afterward is rejected. Pure string work — no `URL` global,
- * keeping core runtime-agnostic and lib-minimal.
- */
-declare function safeHref(url: string): string | null;
-export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CATEGORIES, CHILD_NODE_KEYS, type Category, type Classification, type CompiledOverride, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitAlias, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type RawKitAliases, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleEvidence, type RuleInfo, type RuleOptionInfo, type RuleOptionSpec, type RuleOptions, type RuleOptionsSpec, type RuleOverride, type RuleSetting, type RuleSettingObject, type Runtime, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, VITE_CONFIG_FILES, type Value, type ViteKitConfigResult, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, compileOverrides, computeHealth, computeScore, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, summarize, textFromNodes, validateRuleOptions, validateRuleSetting, valueFromNodes };
+export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CATEGORIES, CHILD_NODE_KEYS, type Category, type Classification, type CompiledOverride, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type FailedRule, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitAlias, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type RawKitAliases, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleEvidence, type RuleInfo, type RuleOptionInfo, type RuleOptionSpec, type RuleOptions, type RuleOptionsSpec, type RuleOverride, type RuleSetting, type RuleSettingObject, type Runtime, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, VITE_CONFIG_FILES, type Value, type ViteKitConfigResult, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, compileOverrides, computeHealth, computeScore, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, formatAgentReport, formatConsoleReport, formatFailedRuleWarning, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRepoLocalPath, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, summarize, terminalSafe, textFromNodes, validateRuleOptions, validateRuleSetting, valueFromNodes, withFailedRulesOff };