@svelte-vitals/core 0.41.1 → 0.42.0

package/dist/index.d.ts

@@ -762,13 +762,6 @@ type TextOrExpr = AST.Text | AST.ExpressionTag;
  * the standard fragment, nodes, consequent, alternate, and body keys.
  */
 declare const CHILD_NODE_KEYS: string[];
-/**
- * Determine a value's kind from a list of child/text nodes (design §4, §11):
- *   - any ExpressionTag present  → 'dynamic' (e.g. {data.title}); we do NOT
- *     follow the expression — that would turn this into runtime analysis.
- *   - non-whitespace Text only   → 'static'
- *   - empty / whitespace only    → 'absent'
- */
 declare function valueFromNodes(nodes: TextOrExpr[]): Value;
 /** The literal text of a node list when fully static (no ExpressionTag), else undefined. */
 declare function textFromNodes(nodes: TextOrExpr[]): string | undefined;
@@ -811,6 +804,11 @@ declare function selectRules(rules: Rule[], config: Config): Rule[];
  * second, parallel notion of "not counted" for callers to keep in sync.
  */
 declare function withFailedRulesOff(config: Config, failedRuleIds: readonly string[]): Config;
+/** One-line "rule failed and was skipped" warning; capped to the message's first line so a stack trace can't flood a terminal. */
+declare function formatFailedRuleWarning(f: {
+    id: string;
+    message: string;
+}): string;
 /** Apply per-rule severity overrides to results (design §6). */
 declare function applyRuleSeverities(results: Result[], config: Config): Result[];
 /** An override entry with its globs compiled once. Build with `compileOverrides`. */
@@ -1539,6 +1537,23 @@ interface ConsoleReportOptions {
  */
 declare function formatConsoleReport(results: Result[], config: Config, options?: ConsoleReportOptions): string;
 
+/**
+ * Strip ANSI/OSC escape sequences and C0 control characters (except `\n`/`\t`) from a
+ * string before it reaches a terminal. POSIX file/route names can contain almost any
+ * byte, so a hostile repo can smuggle a terminal-title rewrite, cursor move, or other
+ * escape-sequence trick into what looks like plain report text.
+ *
+ * Only OSC and CSI sequences are pattern-matched and removed whole (payload included) —
+ * those cover title-bar writes and cursor/screen control, the two classes with a real
+ * blast radius. Any other `ESC` byte (rarer single/two-byte forms like reset or
+ * save-cursor) falls through to the final C0 sweep below, which drops the lone `ESC`
+ * but — deliberately, not swallowing an adjacent legitimate character — leaves whatever
+ * printable byte follows it as stray text.
+ * ponytail: doesn't special-case every Fe escape form; broaden the CSI/OSC patterns if a
+ * concrete non-CSI/OSC sequence turns out to matter.
+ */
+declare function terminalSafe(text: string): string;
+
 interface ScoreModel {
     routeAverage: number;
     sitePenalty: number;
@@ -1670,6 +1685,20 @@ declare function formatMarkdownReport(results: Result[], config: Config, meta: {
     version: string;
 }): string;
 
+type Band = 'good' | 'warn' | 'poor';
+declare const BAND_COLOR: Record<Band, string>;
+declare function scoreBand(score: number): Band;
+declare function escapeHtml(s: string): string;
+/**
+ * Return the URL only when it uses a safe http/https scheme, else null.
+ * Guards a finding's `docsUrl` against `javascript:`/`data:` hrefs — escapeHtml
+ * neutralizes attribute breakout but not a malicious scheme. Browsers strip
+ * ASCII whitespace (tab/newline/CR) from a URL before resolving its scheme (so
+ * `java\tscript:` runs as `javascript:`), so strip whitespace first; anything not
+ * plainly http(s):// afterward is rejected. Pure string work — no `URL` global,
+ * keeping core runtime-agnostic and lib-minimal.
+ */
+declare function safeHref(url: string): string | null;
 /** Provenance of a route's findings: real rendered page vs. source-only analysis. */
 type RouteBadge = 'measured' | 'static';
 interface AppSnapshot {
@@ -1719,19 +1748,4 @@ declare function formatHtmlReport(results: Result[], config: Config, meta: {
     coreVersion?: string;
 }): string;
 
-type Band = 'good' | 'warn' | 'poor';
-declare const BAND_COLOR: Record<Band, string>;
-declare function scoreBand(score: number): Band;
-declare function escapeHtml(s: string): string;
-/**
- * Return the URL only when it uses a safe http/https scheme, else null.
- * Guards a finding's `docsUrl` against `javascript:`/`data:` hrefs — escapeHtml
- * neutralizes attribute breakout but not a malicious scheme. Browsers strip
- * ASCII whitespace (tab/newline/CR) from a URL before resolving its scheme (so
- * `java\tscript:` runs as `javascript:`), so strip whitespace first; anything not
- * plainly http(s):// afterward is rejected. Pure string work — no `URL` global,
- * keeping core runtime-agnostic and lib-minimal.
- */
-declare function safeHref(url: string): string | null;
-
-export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CATEGORIES, CHILD_NODE_KEYS, type Category, type Classification, type CompiledOverride, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type FailedRule, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitAlias, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type RawKitAliases, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleEvidence, type RuleInfo, type RuleOptionInfo, type RuleOptionSpec, type RuleOptions, type RuleOptionsSpec, type RuleOverride, type RuleSetting, type RuleSettingObject, type Runtime, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, VITE_CONFIG_FILES, type Value, type ViteKitConfigResult, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, compileOverrides, computeHealth, computeScore, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRepoLocalPath, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, summarize, textFromNodes, validateRuleOptions, validateRuleSetting, valueFromNodes, withFailedRulesOff };
+export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CATEGORIES, CHILD_NODE_KEYS, type Category, type Classification, type CompiledOverride, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type FailedRule, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitAlias, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type RawKitAliases, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleEvidence, type RuleInfo, type RuleOptionInfo, type RuleOptionSpec, type RuleOptions, type RuleOptionsSpec, type RuleOverride, type RuleSetting, type RuleSettingObject, type Runtime, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, VITE_CONFIG_FILES, type Value, type ViteKitConfigResult, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, compileOverrides, computeHealth, computeScore, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, formatAgentReport, formatConsoleReport, formatFailedRuleWarning, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRepoLocalPath, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, summarize, terminalSafe, textFromNodes, validateRuleOptions, validateRuleSetting, valueFromNodes, withFailedRulesOff };