@svelte-vitals/vite 0.32.1 → 0.32.2

package/dist/index.js

@@ -1,730 +1,771 @@
-import {
-  collectRenderedHeads,
-  isLoopbackOrigin
-} from "./chunk-KII3SU3J.js";
-
-// src/plugin.ts
-import { existsSync } from "fs";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join3, isAbsolute, dirname, relative as relative3, basename, sep as sep2 } from "path";
-import { CATEGORIES as CATEGORIES2 } from "@svelte-vitals/core";
-import {
-  defaultConfig,
-  resolveRuleOptions,
-  shouldSkipRangeCheck,
-  terminalSafe,
-  validateRuleSetting
-} from "@svelte-vitals/core/internal";
-import { CONFIG_FILENAMES, findUnknownRuleIds, knownRuleIds, ruleOptionsSpec } from "svelte-vitals";
-
-// src/analyze.ts
-import { defineConfig } from "@svelte-vitals/core";
-import {
-  allRules,
-  selectRules,
-  applyRuleSeverities,
-  applyOverrides,
-  applyInlineDirectives,
-  unknownDirectiveIds,
-  runRules,
-  withFailedRulesOff,
-  formatFailedRuleWarning,
-  skippedFileWarnings,
-  computeScore,
-  summarize,
-  hasFailureAtOrAbove,
-  formatConsoleReport,
-  formatJsonReport
-} from "@svelte-vitals/core/internal";
-import { loadConfigFile } from "svelte-vitals";
-
-// src/providers/rendered/project.ts
-import { access, readFile } from "fs/promises";
-import { join } from "path";
-import "@svelte-vitals/core";
-import {
-  ROBOTS_SOURCE_PATHS,
-  SITEMAP_SOURCE_PATHS,
-  SVELTE_CONFIG_FILES,
-  VITE_CONFIG_FILES,
-  resolveKitAliases,
-  resolveKitPathsBase
-} from "@svelte-vitals/core/internal";
+import { n as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-dIwCgCTG.js";
+import { existsSync, readFileSync } from "node:fs";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { CATEGORIES, defineConfig } from "@svelte-vitals/core";
+import { ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, allRules, applyInlineDirectives, applyOverrides, applyRuleSeverities, buildJsonReport, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, computeScore, defaultConfig, findMinifyDisabled, formatConsoleReport, formatFailedRuleWarning, formatJsonReport, hasFailureAtOrAbove, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, runRules, safeHref, selectRules, shouldSkipRangeCheck, skippedFileWarnings, summarize, terminalSafe, unknownDirectiveIds, validateRuleSetting, withFailedRulesOff, withReadLimit } from "@svelte-vitals/core/internal";
+import { CONFIG_FILENAMES, analyzeProject, findUnknownRuleIds, knownRuleIds, loadConfigFile, ruleOptionsSpec } from "svelte-vitals";
+import { glob } from "tinyglobby";
+//#region src/providers/rendered/project.ts
 async function exists(path) {
-  try {
-    await access(path);
-    return true;
-  } catch {
-    return false;
-  }
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
 }
 async function existsAny(cwd, paths) {
-  const found = await Promise.all(paths.map((p) => exists(join(cwd, p))));
-  return found.some(Boolean);
+	return (await Promise.all(paths.map((p) => exists(join(cwd, p))))).some(Boolean);
 }
 async function robotsRefsSitemap(cwd) {
-  try {
-    return /^\s*sitemap:/im.test(await readFile(join(cwd, "static/robots.txt"), "utf8"));
-  } catch {
-    return void 0;
-  }
+	try {
+		return /^\s*sitemap:/im.test(await readFile(join(cwd, "static/robots.txt"), "utf8"));
+	} catch {
+		return;
+	}
 }
+/** First existing config candidate with its source — same "only the first is loaded" rule as the CLI provider. */
 async function readFirstConfig(cwd, files) {
-  for (const file of files) {
-    const path = join(cwd, file);
-    if (!await exists(path)) continue;
-    try {
-      return { file, source: await readFile(path, "utf8") };
-    } catch {
-      return void 0;
-    }
-  }
-  return void 0;
+	for (const file of files) {
+		const path = join(cwd, file);
+		if (!await exists(path)) continue;
+		try {
+			return {
+				file,
+				source: await readFile(path, "utf8")
+			};
+		} catch {
+			return;
+		}
+	}
 }
+/** Project facts for plugin mode: robots/sitemap from source, htmlLang from rendered HTML. */
 async function collectRenderedProject(cwd, htmlLang) {
-  const [hasRobotsTxt, hasSitemap, viteConfig, svelteConfig] = await Promise.all([
-    existsAny(cwd, ROBOTS_SOURCE_PATHS),
-    existsAny(cwd, SITEMAP_SOURCE_PATHS),
-    readFirstConfig(cwd, VITE_CONFIG_FILES),
-    readFirstConfig(cwd, SVELTE_CONFIG_FILES)
-  ]);
-  const robotsReferencesSitemap = await robotsRefsSitemap(cwd);
-  const kitPathsBase = resolveKitPathsBase(viteConfig, svelteConfig);
-  const kitAliases = resolveKitAliases(viteConfig, svelteConfig);
-  return {
-    hasRobotsTxt,
-    hasSitemap,
-    htmlLang,
-    ...robotsReferencesSitemap !== void 0 ? { robotsReferencesSitemap } : {},
-    ...kitPathsBase ? { kitPathsBase } : {},
-    ...kitAliases ? { kitAliases } : {}
-  };
+	const [hasRobotsTxt, hasSitemap, viteConfig, svelteConfig] = await Promise.all([
+		existsAny(cwd, ROBOTS_SOURCE_PATHS),
+		existsAny(cwd, SITEMAP_SOURCE_PATHS),
+		readFirstConfig(cwd, VITE_CONFIG_FILES),
+		readFirstConfig(cwd, SVELTE_CONFIG_FILES)
+	]);
+	const robotsReferencesSitemap = await robotsRefsSitemap(cwd);
+	const kitPathsBase = resolveKitPathsBase(viteConfig, svelteConfig);
+	const kitAliases = resolveKitAliases(viteConfig, svelteConfig);
+	return {
+		hasRobotsTxt,
+		hasSitemap,
+		htmlLang,
+		...robotsReferencesSitemap !== void 0 ? { robotsReferencesSitemap } : {},
+		...kitPathsBase ? { kitPathsBase } : {},
+		...kitAliases ? { kitAliases } : {}
+	};
 }
-
-// src/providers/source/components.ts
-import { readFile as readFile2, access as access2 } from "fs/promises";
-import { join as join2 } from "path";
-import { glob } from "tinyglobby";
-import {
-  collectComponentFacts as collect,
-  collectKitModuleFacts as collectKit,
-  collectSourceFiles as collectFiles,
-  withReadLimit
-} from "@svelte-vitals/core/internal";
-var boundedRead = withReadLimit((path) => readFile2(path, "utf8"));
-var nodeRuntime = {
-  readFile: (path) => boundedRead(path),
-  async exists(path) {
-    try {
-      await access2(path);
-      return true;
-    } catch {
-      return false;
-    }
-  },
-  glob: (pattern, cwd) => glob(pattern, { cwd, dot: false }),
-  join: (...parts) => join2(...parts)
+//#endregion
+//#region src/providers/source/components.ts
+/**
+* Node-backed Runtime adapter (design §8). vite always runs in Node, so no
+* swappable runtime is needed here — this just satisfies the interface the
+* shared core implementation expects.
+*/
+const boundedRead = withReadLimit((path) => readFile(path, "utf8"));
+const nodeRuntime = {
+	readFile: (path) => boundedRead(path),
+	async exists(path) {
+		try {
+			await access(path);
+			return true;
+		} catch {
+			return false;
+		}
+	},
+	glob: (pattern, cwd) => glob(pattern, {
+		cwd,
+		dot: false
+	}),
+	join: (...parts) => join(...parts)
 };
-function collectComponentFacts(root) {
-  return collect(nodeRuntime, root);
+/**
+* Scan every `.svelte` component under `src/` for Correctness/Security/Architecture/
+* Bundle-Performance/Accessibility facts (build mode only). Implementation lives in
+* `@svelte-vitals/core` (plans/003) and is shared with the CLI package.
+*/
+function collectComponentFacts$1(root) {
+	return collectComponentFacts(nodeRuntime, root);
 }
-function collectKitModuleFacts(root, aliases) {
-  return collectKit(nodeRuntime, root, aliases);
+/** Scan SvelteKit route/hooks files for SSR shared-state facts (security/handler-state-write, security/server-module-state, security/shared-state-import; build mode only). */
+function collectKitModuleFacts$1(root, aliases) {
+	return collectKitModuleFacts(nodeRuntime, root, aliases);
 }
-function collectSourceFiles(root) {
-  return collectFiles(nodeRuntime, root);
+/** Every file under `src/` for directory-shaped Architecture rules (build mode only). */
+function collectSourceFiles$1(root) {
+	return collectSourceFiles(nodeRuntime, root);
 }
-
-// src/version.ts
-import { readFileSync } from "fs";
+//#endregion
+//#region src/version.ts
+/** Read this package's version from its own package.json so the report never drifts. */
 function readPackageVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
+	try {
+		return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "0.0.0";
+	} catch {
+		return "0.0.0";
+	}
 }
+/**
+* Read the *actually resolved* `@svelte-vitals/core` version — the rule engine
+* that determines which findings get reported. `@svelte-vitals/vite` and the
+* `svelte-vitals` CLI are versioned independently and can end up depending on
+* different core versions (e.g. a lockfile/registry cooldown resolving a CLI
+* `@latest` install down to an older release than what this plugin depends on);
+* surfacing this in the live dashboard lets users directly compare "rule engine
+* version" against the CLI's `--version` output instead of guessing from
+* unrelated outer package version numbers. `@svelte-vitals/core` stays an
+* external (unbundled) dependency in the tsup build, so this resolves against
+* the real installed package at runtime, not whatever was bundled in.
+*/
 function readCoreVersion() {
-  try {
-    const entry = import.meta.resolve("@svelte-vitals/core");
-    const pkg = JSON.parse(readFileSync(new URL("../package.json", entry), "utf8"));
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
+	try {
+		const entry = import.meta.resolve("@svelte-vitals/core");
+		return JSON.parse(readFileSync(new URL("../package.json", entry), "utf8")).version ?? "0.0.0";
+	} catch {
+		return "0.0.0";
+	}
 }
-
-// src/analyze.ts
+//#endregion
+//#region src/analyze.ts
+/**
+* Merge plugin options over an optional loaded config file, per-field precedence (an
+* explicit `options` value wins, otherwise the file, otherwise the built-in default).
+* Extracted so the dev-server fallback (plugin.ts) can build an options-only config
+* without re-reading the config file.
+*/
 function mergeConfig(options, fileConfig) {
-  const weights = options.weights ?? fileConfig?.weights;
-  const overrides = options.overrides ?? fileConfig?.overrides;
-  return defineConfig({
-    treatDynamicAs: options.treatDynamicAs ?? fileConfig?.treatDynamicAs ?? "pass",
-    metaComponents: options.metaComponents ?? fileConfig?.metaComponents ?? [],
-    rules: options.rules ?? fileConfig?.rules ?? {},
-    failOn: options.failOn ?? fileConfig?.failOn ?? "critical",
-    ...weights !== void 0 ? { weights } : {},
-    ...overrides !== void 0 ? { overrides } : {}
-  });
+	const weights = options.weights ?? fileConfig?.weights;
+	const overrides = options.overrides ?? fileConfig?.overrides;
+	return defineConfig({
+		treatDynamicAs: options.treatDynamicAs ?? fileConfig?.treatDynamicAs ?? "pass",
+		metaComponents: options.metaComponents ?? fileConfig?.metaComponents ?? [],
+		rules: options.rules ?? fileConfig?.rules ?? {},
+		failOn: options.failOn ?? fileConfig?.failOn ?? "critical",
+		...weights !== void 0 ? { weights } : {},
+		...overrides !== void 0 ? { overrides } : {}
+	});
 }
+/**
+* Resolve the effective config the same way the CLI's `analyzeProject` does — per-field
+* precedence: an explicit `options` value wins, otherwise `svelte-vitals.config.*` in
+* `cwd`, otherwise the built-in default. Shared by build-mode `analyze()` and the dev
+* dashboard (plugin.ts). `warnings` are the config file's non-fatal issues. Throws if
+* the config file itself is invalid (unknown rule id, malformed `overrides`, …) —
+* callers decide whether that's fatal (build) or a fall-back-to-defaults warning (dev).
+*/
 async function resolveConfig(cwd, options) {
-  const loaded = await loadConfigFile(cwd);
-  const config = mergeConfig(options, loaded?.config);
-  return { config, warnings: loaded?.warnings ?? [] };
+	const loaded = await loadConfigFile(cwd);
+	return {
+		config: mergeConfig(options, loaded?.config),
+		warnings: loaded?.warnings ?? []
+	};
 }
+/**
+* Collect prerendered heads + project facts + component facts, run the core pipeline, and
+* format reports. Config precedence: see `resolveConfig`. Pass `resolved` when the caller
+* already resolved config itself (build mode resolves it outside `analyze`'s try/catch so a
+* config-file validation error fails the build instead of being caught as an analysis error).
+*/
 async function analyze(prerenderPagesDir, cwd, options, extraProjectFacts, resolved) {
-  const { config, warnings } = resolved ?? await resolveConfig(cwd, options);
-  const [{ heads, headings, images, a11y, htmlLang }, components, sourceFiles] = await Promise.all([
-    collectRenderedHeads(prerenderPagesDir),
-    collectComponentFacts(cwd),
-    collectSourceFiles(cwd)
-  ]);
-  const project = {
-    ...await collectRenderedProject(cwd, htmlLang),
-    ...extraProjectFacts
-  };
-  const kitModules = await collectKitModuleFacts(cwd, project.kitAliases);
-  const selected = selectRules(allRules, config);
-  if (selected.some((r) => r.id === "a11y/unverified-id-ref")) {
-    warnings.push(
-      "a11y/unverified-id-ref has no effect in rendered mode \u2014 the prerendered document is always fully resolved."
-    );
-  }
-  const {
-    results: rawResults,
-    examined,
-    failedRules
-  } = await runRules(selected, {
-    heads,
-    headings,
-    images,
-    a11y,
-    project,
-    components,
-    config,
-    kitModules,
-    sourceFiles
-  });
-  const directives = /* @__PURE__ */ new Map();
-  for (const c of components) directives.set(c.file, c.suppressions ?? []);
-  for (const m of kitModules) directives.set(m.file, m.suppressions ?? []);
-  if (project.viteMinifyDisabled?.file)
-    directives.set(project.viteMinifyDisabled.file, project.viteMinifyDisabled.suppressions ?? []);
-  const results = applyInlineDirectives(
-    applyOverrides(applyRuleSeverities(rawResults, config), config),
-    directives,
-    selected,
-    config
-  );
-  warnings.push(...skippedFileWarnings([...components, ...kitModules]));
-  warnings.push(...unknownDirectiveIds(directives, allRules));
-  for (const f of failedRules) warnings.push(formatFailedRuleWarning(f));
-  const scoringConfig = withFailedRulesOff(
-    config,
-    failedRules.map((f) => f.id)
-  );
-  const { score } = computeScore(results, scoringConfig);
-  const summary = summarize(results, scoringConfig);
-  const failed = hasFailureAtOrAbove(summary, scoringConfig.failOn);
-  const coverageNote = `Analyzed ${heads.length} prerendered route(s). SSR/dynamic routes are not covered \u2014 run \`npx svelte-vitals\` for those.
+	const { config, warnings } = resolved ?? await resolveConfig(cwd, options);
+	const [{ heads, headings, images, a11y, htmlLang }, components, sourceFiles] = await Promise.all([
+		collectRenderedHeads(prerenderPagesDir),
+		collectComponentFacts$1(cwd),
+		collectSourceFiles$1(cwd)
+	]);
+	const project = {
+		...await collectRenderedProject(cwd, htmlLang),
+		...extraProjectFacts
+	};
+	const kitModules = await collectKitModuleFacts$1(cwd, project.kitAliases);
+	const selected = selectRules(allRules, config);
+	if (selected.some((r) => r.id === "a11y/unverified-id-ref")) warnings.push("a11y/unverified-id-ref has no effect in rendered mode — the prerendered document is always fully resolved.");
+	const { results: rawResults, examined, failedRules } = await runRules(selected, {
+		heads,
+		headings,
+		images,
+		a11y,
+		project,
+		components,
+		config,
+		kitModules,
+		sourceFiles
+	});
+	const directives = /* @__PURE__ */ new Map();
+	for (const c of components) directives.set(c.file, c.suppressions ?? []);
+	for (const m of kitModules) directives.set(m.file, m.suppressions ?? []);
+	if (project.viteMinifyDisabled?.file) directives.set(project.viteMinifyDisabled.file, project.viteMinifyDisabled.suppressions ?? []);
+	const results = applyInlineDirectives(applyOverrides(applyRuleSeverities(rawResults, config), config), directives, selected, config);
+	warnings.push(...skippedFileWarnings([...components, ...kitModules]));
+	warnings.push(...unknownDirectiveIds(directives, allRules));
+	for (const f of failedRules) warnings.push(formatFailedRuleWarning(f));
+	const scoringConfig = withFailedRulesOff(config, failedRules.map((f) => f.id));
+	const { score } = computeScore(results, scoringConfig);
+	const summary = summarize(results, scoringConfig);
+	const failed = hasFailureAtOrAbove(summary, scoringConfig.failOn);
+	const coverageNote = `Analyzed ${heads.length} prerendered route(s). SSR/dynamic routes are not covered — run \`npx svelte-vitals\` for those.
 Scanned ${components.length} component(s) under src/ for Correctness/Security/Architecture/Accessibility/Bundle findings.`;
-  const consoleReport = formatConsoleReport(results, scoringConfig, { mode: "rendered / plugin" }) + "\n" + coverageNote + "\n";
-  const jsonReport = formatJsonReport(
-    results,
-    scoringConfig,
-    { version: readPackageVersion() },
-    selected.map((r) => r.id),
-    examined
-  );
-  return {
-    score,
-    summary,
-    results,
-    consoleReport,
-    jsonReport,
-    routeCount: heads.length,
-    failed,
-    failOn: scoringConfig.failOn,
-    warnings
-  };
+	return {
+		score,
+		summary,
+		results,
+		consoleReport: formatConsoleReport(results, scoringConfig, { mode: "rendered / plugin" }) + "\n" + coverageNote + "\n",
+		jsonReport: formatJsonReport(results, scoringConfig, { version: readPackageVersion() }, selected.map((r) => r.id), examined),
+		routeCount: heads.length,
+		failed,
+		failOn: scoringConfig.failOn,
+		warnings
+	};
 }
-
-// src/minify-flag.ts
-import { readFile as readFile3 } from "fs/promises";
-import { relative } from "path";
-import {
-  collectSuppressions,
-  findMinifyDisabled
-} from "@svelte-vitals/core/internal";
+//#endregion
+//#region src/minify-flag.ts
+/**
+* performance/minify-disabled fact from the evaluated Vite user config (the value the plugin's
+* `config` hook sees) — exact, so it also catches function-form/conditional configs the CLI's
+* literal-only static pass skips.
+* The config source is re-parsed only to locate the line. `file` is never
+* fabricated: unset for an inline programmatic config (no `configFile` at
+* all), and always a posix-relative path to `root` (may start with `../` in
+* monorepos) — never an absolute path. `line` is set only when the literal
+* `minify: false` could be located in that file; a dynamic config that still
+* resolves to `minify: false` (or an unreadable file) omits it, since the
+* resolved value already proved the finding without needing a line.
+*/
 async function resolveMinifyDisabled(minify, configFile, root) {
-  if (minify !== false) return void 0;
-  if (!configFile) return {};
-  const rel = relative(root, configFile).split("\\").join("/");
-  const file = rel === "" ? configFile.split("\\").join("/") : rel;
-  let line;
-  let suppressions;
-  try {
-    const source = await readFile3(configFile, "utf8");
-    line = findMinifyDisabled(source)?.line;
-    suppressions = collectSuppressions(source);
-  } catch {
-  }
-  return {
-    file,
-    ...line !== void 0 ? { line } : {},
-    ...suppressions !== void 0 ? { suppressions } : {}
-  };
+	if (minify !== false) return void 0;
+	if (!configFile) return {};
+	const rel = relative(root, configFile).split("\\").join("/");
+	const file = rel === "" ? configFile.split("\\").join("/") : rel;
+	let line;
+	let suppressions;
+	try {
+		const source = await readFile(configFile, "utf8");
+		line = findMinifyDisabled(source)?.line;
+		suppressions = collectSuppressions(source);
+	} catch {}
+	return {
+		file,
+		...line !== void 0 ? { line } : {},
+		...suppressions !== void 0 ? { suppressions } : {}
+	};
 }
-
-// src/ui/middleware.ts
-import { CATEGORIES } from "@svelte-vitals/core";
-import { renderAppShell } from "@svelte-vitals/core/internal";
-
-// src/ui/snapshot.ts
-import "@svelte-vitals/core";
-import { buildJsonReport, safeHref, withFailedRulesOff as withFailedRulesOff2 } from "@svelte-vitals/core/internal";
+//#endregion
+//#region src/ui/snapshot.ts
+/**
+* `docsUrl` on an ingested (live) result flows into `/data.json` responses, which the
+* client script renders into an <a href> without going through `renderAppShell`'s own
+* sanitizer — so sanitize here too, server-side, covering both the embedded first paint
+* and every refetch.
+*/
 function sanitizeDocsUrl(issue) {
-  if (issue.docsUrl === void 0) return issue;
-  if (safeHref(issue.docsUrl) !== null) return issue;
-  return { ...issue, docsUrl: void 0 };
+	if (issue.docsUrl === void 0) return issue;
+	if (safeHref(issue.docsUrl) !== null) return issue;
+	return {
+		...issue,
+		docsUrl: void 0
+	};
 }
 function sanitizeReport(report) {
-  return {
-    ...report,
-    routes: report.routes.map((route) => ({ ...route, issues: route.issues.map(sanitizeDocsUrl) })),
-    siteIssues: report.siteIssues.map(sanitizeDocsUrl)
-  };
+	return {
+		...report,
+		routes: report.routes.map((route) => ({
+			...route,
+			issues: route.issues.map(sanitizeDocsUrl)
+		})),
+		siteIssues: report.siteIssues.map(sanitizeDocsUrl)
+	};
 }
+/**
+* Build the payload shared by the dashboard shell's embedded JSON and the /data.json endpoint.
+* `config` is never swapped for another config — plugin-option `weights`/`overrides` must
+* survive every request. `staticFailedRuleIds` (the whole-project runner's crashed-rule ids)
+* and the store's live-layer union (`store.failedRuleIds()`) are both layered onto `config` via
+* `withFailedRulesOff`, the same correction the CLI and build mode apply, so a rule that crashed
+* on either layer scores as not-run instead of inflating Health.
+*/
 function buildSnapshot(store, config, meta, staticFailedRuleIds) {
-  const failedRuleIds = [.../* @__PURE__ */ new Set([...staticFailedRuleIds ?? [], ...store.failedRuleIds()])];
-  const scoringConfig = withFailedRulesOff2(config, failedRuleIds);
-  return {
-    // No rule-id list threaded through: `report.rules` is seeded from `store.snapshot()`
-    // alone here, so presence means "produced a result", not "was selected" — unlike the
-    // `json` reporter (design doc 2026-08-03-json-rule-evidence-design.md, Not in scope).
-    report: sanitizeReport(buildJsonReport(store.snapshot(), scoringConfig, meta)),
-    badges: store.badges(),
-    analyzing: store.isAnalyzing(),
-    sequence: store.sequence(),
-    live: true,
-    meta
-  };
+	const failedRuleIds = [.../* @__PURE__ */ new Set([...staticFailedRuleIds ?? [], ...store.failedRuleIds()])];
+	const scoringConfig = withFailedRulesOff(config, failedRuleIds);
+	return {
+		report: sanitizeReport(buildJsonReport(store.snapshot(), scoringConfig, meta)),
+		badges: store.badges(),
+		analyzing: store.isAnalyzing(),
+		sequence: store.sequence(),
+		live: true,
+		meta
+	};
 }
-
-// src/ui/middleware.ts
-var SEVERITIES = /* @__PURE__ */ new Set(["critical", "warning", "info"]);
-var CATEGORY_SET = new Set(CATEGORIES);
+//#endregion
+//#region src/ui/middleware.ts
+const SEVERITIES = /* @__PURE__ */ new Set([
+	"critical",
+	"warning",
+	"info"
+]);
+const CATEGORY_SET = new Set(CATEGORIES);
 function isOptionalString(v) {
-  return v === void 0 || typeof v === "string";
+	return v === void 0 || typeof v === "string";
 }
+/**
+* Every field the dashboard renderer dereferences, so malformed ingest can't crash it:
+* `escapeHtml` needs strings for `id`/`message`/`category`/`location`/`recommendation`/
+* `docsUrl`/`fix.*`/`route`, `effectiveSeverity`/`classify` read `detection.presence|value`
+* and `severity`, and `line` is interpolated as a number. Optional fields must be absent
+* or well-typed — `category: 123` would pass `?? 'seo'` and then throw inside `escapeHtml`.
+* Real engine findings always satisfy all of this.
+*/
 function isResultLike(x) {
-  if (typeof x !== "object" || x === null) return false;
-  const r = x;
-  const d = r.detection;
-  const f = r.fix;
-  return typeof r.id === "string" && typeof r.message === "string" && typeof r.severity === "string" && SEVERITIES.has(r.severity) && typeof d === "object" && d !== null && typeof d.presence === "string" && typeof d.value === "string" && (r.category === void 0 || typeof r.category === "string" && CATEGORY_SET.has(r.category)) && isOptionalString(r.location) && isOptionalString(r.recommendation) && isOptionalString(r.docsUrl) && (f === void 0 || typeof f === "object" && f !== null && typeof f.description === "string" && isOptionalString(f.snippet) && isOptionalString(f.lang)) && (r.line === void 0 || typeof r.line === "number") && isOptionalString(r.route);
+	if (typeof x !== "object" || x === null) return false;
+	const r = x;
+	const d = r.detection;
+	const f = r.fix;
+	return typeof r.id === "string" && typeof r.message === "string" && typeof r.severity === "string" && SEVERITIES.has(r.severity) && typeof d === "object" && d !== null && typeof d.presence === "string" && typeof d.value === "string" && (r.category === void 0 || typeof r.category === "string" && CATEGORY_SET.has(r.category)) && isOptionalString(r.location) && isOptionalString(r.recommendation) && isOptionalString(r.docsUrl) && (f === void 0 || typeof f === "object" && f !== null && typeof f.description === "string" && isOptionalString(f.snippet) && isOptionalString(f.lang)) && (r.line === void 0 || typeof r.line === "number") && isOptionalString(r.route);
 }
+/**
+* Mount the dev UI at /__svelte-vitals/ : GET / (dashboard), POST /ingest, GET /events (SSE).
+* `store` is created and owned by the ui plugin (plugin.ts) so the analysis runner can also
+* write to it (`store.setStatic`) — this middleware only reads it and writes the live layer.
+*/
 function installUiMiddleware(server, config, version, store, coreVersion, getStaticFailedRuleIds) {
-  const clients = /* @__PURE__ */ new Set();
-  store.subscribe(() => {
-    for (const res of clients) {
-      try {
-        res.write("event: update\ndata: {}\n\n");
-      } catch {
-        clients.delete(res);
-      }
-    }
-  });
-  server.httpServer?.once("close", () => {
-    for (const res of clients) res.end();
-    clients.clear();
-  });
-  server.middlewares.use("/__svelte-vitals", (req, res) => {
-    const url = req.url ?? "/";
-    const origin = req.headers.origin;
-    const host = req.headers.host;
-    if (typeof origin === "string" && !isLoopbackOrigin(origin) || host === void 0 || !isLoopbackOrigin(`http://${host}`)) {
-      req.resume();
-      res.statusCode = 403;
-      res.end("svelte-vitals dev UI is only available from localhost");
-      return;
-    }
-    if (req.method === "POST" && url.startsWith("/ingest")) {
-      const chunks = [];
-      req.on("data", (c) => chunks.push(c));
-      req.on("end", () => {
-        try {
-          const { route, results, failedRuleIds } = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-          if (typeof route === "string" && Array.isArray(results)) {
-            const failedIds = Array.isArray(failedRuleIds) ? failedRuleIds.filter((id) => typeof id === "string") : [];
-            store.set(route, results.filter(isResultLike), failedIds);
-          }
-        } catch {
-        }
-        res.statusCode = 204;
-        res.end();
-      });
-      return;
-    }
-    if (url.startsWith("/events")) {
-      res.writeHead(200, {
-        "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
-      });
-      res.write("\n");
-      clients.add(res);
-      req.on("close", () => clients.delete(res));
-      return;
-    }
-    if (url.startsWith("/data.json")) {
-      try {
-        const snapshot = buildSnapshot(store, config, { version, coreVersion }, getStaticFailedRuleIds?.());
-        res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify(snapshot));
-      } catch {
-        res.statusCode = 500;
-        res.end("{}");
-      }
-      return;
-    }
-    try {
-      const html = renderAppShell(buildSnapshot(store, config, { version, coreVersion }, getStaticFailedRuleIds?.()));
-      res.setHeader("Content-Type", "text/html");
-      res.end(html);
-    } catch {
-      res.statusCode = 500;
-      res.end("svelte-vitals dashboard failed to render");
-    }
-  });
+	const clients = /* @__PURE__ */ new Set();
+	store.subscribe(() => {
+		for (const res of clients) try {
+			res.write("event: update\ndata: {}\n\n");
+		} catch {
+			clients.delete(res);
+		}
+	});
+	server.httpServer?.once("close", () => {
+		for (const res of clients) res.end();
+		clients.clear();
+	});
+	server.middlewares.use("/__svelte-vitals", (req, res) => {
+		const url = req.url ?? "/";
+		const origin = req.headers.origin;
+		const host = req.headers.host;
+		if (typeof origin === "string" && !isLoopbackOrigin(origin) || host === void 0 || !isLoopbackOrigin(`http://${host}`)) {
+			req.resume();
+			res.statusCode = 403;
+			res.end("svelte-vitals dev UI is only available from localhost");
+			return;
+		}
+		if (req.method === "POST" && url.startsWith("/ingest")) {
+			const chunks = [];
+			req.on("data", (c) => chunks.push(c));
+			req.on("end", () => {
+				try {
+					const { route, results, failedRuleIds } = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+					if (typeof route === "string" && Array.isArray(results)) {
+						const failedIds = Array.isArray(failedRuleIds) ? failedRuleIds.filter((id) => typeof id === "string") : [];
+						store.set(route, results.filter(isResultLike), failedIds);
+					}
+				} catch {}
+				res.statusCode = 204;
+				res.end();
+			});
+			return;
+		}
+		if (url.startsWith("/events")) {
+			res.writeHead(200, {
+				"Content-Type": "text/event-stream",
+				"Cache-Control": "no-cache",
+				Connection: "keep-alive"
+			});
+			res.write("\n");
+			clients.add(res);
+			req.on("close", () => clients.delete(res));
+			return;
+		}
+		if (url.startsWith("/data.json")) {
+			try {
+				const snapshot = buildSnapshot(store, config, {
+					version,
+					coreVersion
+				}, getStaticFailedRuleIds?.());
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify(snapshot));
+			} catch {
+				res.statusCode = 500;
+				res.end("{}");
+			}
+			return;
+		}
+		try {
+			const html = renderAppShell(buildSnapshot(store, config, {
+				version,
+				coreVersion
+			}, getStaticFailedRuleIds?.()));
+			res.setHeader("Content-Type", "text/html");
+			res.end(html);
+		} catch {
+			res.statusCode = 500;
+			res.end("svelte-vitals dashboard failed to render");
+		}
+	});
 }
-
-// src/ui/store.ts
+//#endregion
+//#region src/ui/store.ts
+/**
+* Merge rule (design doc §2): for a route with a live result set, static results whose
+* rule id appears in the live payload are replaced by the live ones — the handle reports
+* passing as well as failing results, so the rule ids present in the payload ARE the
+* evaluated set. Everything else — component/site-scoped findings (no route) and
+* unvisited routes — keeps the static result untouched. Pure function so it is
+* unit-testable without the store's mutable state.
+*/
 function composeSnapshot(staticResults, liveByRoute) {
-  const staticByRoute = /* @__PURE__ */ new Map();
-  const routeless = [];
-  for (const r of staticResults) {
-    if (r.route) {
-      const bucket = staticByRoute.get(r.route);
-      if (bucket) bucket.push(r);
-      else staticByRoute.set(r.route, [r]);
-    } else {
-      routeless.push(r);
-    }
-  }
-  const out = [...routeless];
-  for (const [route, live] of liveByRoute) {
-    const liveIds = new Set(live.map((r) => r.id));
-    const staticForRoute = staticByRoute.get(route) ?? [];
-    out.push(...staticForRoute.filter((r) => !liveIds.has(r.id)), ...live);
-    staticByRoute.delete(route);
-  }
-  for (const remaining of staticByRoute.values()) out.push(...remaining);
-  return out;
+	const staticByRoute = /* @__PURE__ */ new Map();
+	const routeless = [];
+	for (const r of staticResults) if (r.route) {
+		const bucket = staticByRoute.get(r.route);
+		if (bucket) bucket.push(r);
+		else staticByRoute.set(r.route, [r]);
+	} else routeless.push(r);
+	const out = [...routeless];
+	for (const [route, live] of liveByRoute) {
+		const liveIds = new Set(live.map((r) => r.id));
+		const staticForRoute = staticByRoute.get(route) ?? [];
+		out.push(...staticForRoute.filter((r) => !liveIds.has(r.id)), ...live);
+		staticByRoute.delete(route);
+	}
+	for (const remaining of staticByRoute.values()) out.push(...remaining);
+	return out;
 }
+/** Per-route provenance for the merged view: 'measured' where a live layer exists, else 'static'. */
 function composeBadges(staticResults, liveByRoute) {
-  const badges = {};
-  for (const r of staticResults) {
-    if (r.route) badges[r.route] = "static";
-  }
-  for (const route of liveByRoute.keys()) badges[route] = "measured";
-  return badges;
+	const badges = {};
+	for (const r of staticResults) if (r.route) badges[r.route] = "static";
+	for (const route of liveByRoute.keys()) badges[route] = "measured";
+	return badges;
 }
 function createStore() {
-  let staticResults = [];
-  const liveByRoute = /* @__PURE__ */ new Map();
-  const liveFailedByRoute = /* @__PURE__ */ new Map();
-  const subs = /* @__PURE__ */ new Set();
-  let analyzing = false;
-  let seq = 0;
-  function notify() {
-    seq += 1;
-    for (const fn of subs) fn();
-  }
-  return {
-    set(route, results, failedRuleIds) {
-      liveByRoute.set(
-        route,
-        results.map((r) => r.route ? r : { ...r, route })
-      );
-      if (failedRuleIds && failedRuleIds.length > 0) liveFailedByRoute.set(route, failedRuleIds);
-      else liveFailedByRoute.delete(route);
-      notify();
-    },
-    setStatic(results) {
-      staticResults = results;
-      notify();
-    },
-    setAnalyzing(next) {
-      analyzing = next;
-      notify();
-    },
-    isAnalyzing() {
-      return analyzing;
-    },
-    snapshot() {
-      return composeSnapshot(staticResults, liveByRoute);
-    },
-    badges() {
-      return composeBadges(staticResults, liveByRoute);
-    },
-    failedRuleIds() {
-      return [...new Set([...liveFailedByRoute.values()].flat())].sort();
-    },
-    sequence() {
-      return seq;
-    },
-    subscribe(fn) {
-      subs.add(fn);
-      return () => subs.delete(fn);
-    }
-  };
+	let staticResults = [];
+	const liveByRoute = /* @__PURE__ */ new Map();
+	const liveFailedByRoute = /* @__PURE__ */ new Map();
+	const subs = /* @__PURE__ */ new Set();
+	let analyzing = false;
+	let seq = 0;
+	function notify() {
+		seq += 1;
+		for (const fn of subs) fn();
+	}
+	return {
+		set(route, results, failedRuleIds) {
+			liveByRoute.set(route, results.map((r) => r.route ? r : {
+				...r,
+				route
+			}));
+			if (failedRuleIds && failedRuleIds.length > 0) liveFailedByRoute.set(route, failedRuleIds);
+			else liveFailedByRoute.delete(route);
+			notify();
+		},
+		setStatic(results) {
+			staticResults = results;
+			notify();
+		},
+		setAnalyzing(next) {
+			analyzing = next;
+			notify();
+		},
+		isAnalyzing() {
+			return analyzing;
+		},
+		snapshot() {
+			return composeSnapshot(staticResults, liveByRoute);
+		},
+		badges() {
+			return composeBadges(staticResults, liveByRoute);
+		},
+		failedRuleIds() {
+			return [...new Set([...liveFailedByRoute.values()].flat())].sort();
+		},
+		sequence() {
+			return seq;
+		},
+		subscribe(fn) {
+			subs.add(fn);
+			return () => subs.delete(fn);
+		}
+	};
 }
-
-// src/ui/analysis.ts
-import { relative as relative2, sep } from "path";
-import { analyzeProject } from "svelte-vitals";
+//#endregion
+//#region src/ui/analysis.ts
+/**
+* Owns the dev-dashboard's whole-project analysis lifecycle: an async run at startup,
+* a debounced re-run on source changes, and coalescing so a change that arrives mid-run
+* produces exactly one follow-up run rather than one per change (design doc §1).
+*/
 function createAnalysisRunner(opts) {
-  const debounceMs = opts.debounceMs ?? 500;
-  const analyze2 = opts.analyze ?? analyzeProject;
-  const parseCache = /* @__PURE__ */ new Map();
-  let stopped = false;
-  let running = false;
-  let pending = false;
-  let timer;
-  async function runOnce() {
-    if (stopped) return;
-    running = true;
-    opts.onStatusChange?.(true);
-    try {
-      const { results, failedRuleIds } = await analyze2({
-        cwd: opts.root,
-        treatDynamicAs: opts.treatDynamicAs,
-        metaComponents: opts.metaComponents,
-        rules: opts.rules,
-        failOn: opts.failOn,
-        parseCache
-      });
-      if (!stopped) {
-        if (failedRuleIds !== void 0) opts.onResults(results, failedRuleIds);
-        else opts.onResults(results);
-      }
-    } catch (err) {
-      if (!stopped) opts.onError(err);
-    } finally {
-      running = false;
-      opts.onStatusChange?.(false);
-      if (!stopped && pending) {
-        pending = false;
-        void runOnce();
-      }
-    }
-  }
-  return {
-    start() {
-      if (stopped) return;
-      void runOnce();
-    },
-    notifyChange(file) {
-      if (stopped) return;
-      const rel = relative2(opts.root, file).split(sep).join("/");
-      parseCache.delete(rel);
-      if (timer !== void 0) clearTimeout(timer);
-      timer = setTimeout(() => {
-        timer = void 0;
-        if (stopped) return;
-        if (running) pending = true;
-        else void runOnce();
-      }, debounceMs);
-    },
-    stop() {
-      stopped = true;
-      if (timer !== void 0) {
-        clearTimeout(timer);
-        timer = void 0;
-      }
-      pending = false;
-    }
-  };
+	const debounceMs = opts.debounceMs ?? 500;
+	const analyze = opts.analyze ?? analyzeProject;
+	const parseCache = /* @__PURE__ */ new Map();
+	let stopped = false;
+	let running = false;
+	let pending = false;
+	let timer;
+	async function runOnce() {
+		if (stopped) return;
+		running = true;
+		opts.onStatusChange?.(true);
+		try {
+			const { results, failedRuleIds } = await analyze({
+				cwd: opts.root,
+				treatDynamicAs: opts.treatDynamicAs,
+				metaComponents: opts.metaComponents,
+				rules: opts.rules,
+				failOn: opts.failOn,
+				parseCache
+			});
+			if (!stopped) if (failedRuleIds !== void 0) opts.onResults(results, failedRuleIds);
+			else opts.onResults(results);
+		} catch (err) {
+			if (!stopped) opts.onError(err);
+		} finally {
+			running = false;
+			opts.onStatusChange?.(false);
+			if (!stopped && pending) {
+				pending = false;
+				runOnce();
+			}
+		}
+	}
+	return {
+		start() {
+			if (stopped) return;
+			runOnce();
+		},
+		notifyChange(file) {
+			if (stopped) return;
+			const rel = relative(opts.root, file).split(sep).join("/");
+			parseCache.delete(rel);
+			if (timer !== void 0) clearTimeout(timer);
+			timer = setTimeout(() => {
+				timer = void 0;
+				if (stopped) return;
+				if (running) pending = true;
+				else runOnce();
+			}, debounceMs);
+		},
+		stop() {
+			stopped = true;
+			if (timer !== void 0) {
+				clearTimeout(timer);
+				timer = void 0;
+			}
+			pending = false;
+		}
+	};
 }
-
-// src/plugin.ts
-var CONFIG_BASENAMES = /* @__PURE__ */ new Set([
-  "svelte.config.js",
-  "svelte.config.ts",
-  // The svelte-vitals config names come from the CLI's own loader list, so the watcher
-  // can never drift from what analyze() actually loads.
-  ...CONFIG_FILENAMES,
-  "vite.config.js",
-  "vite.config.mjs",
-  "vite.config.ts",
-  "vite.config.cjs",
-  "vite.config.mts",
-  "vite.config.cts"
+//#endregion
+//#region src/plugin.ts
+const CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+	"svelte.config.js",
+	"svelte.config.ts",
+	...CONFIG_FILENAMES,
+	"vite.config.js",
+	"vite.config.mjs",
+	"vite.config.ts",
+	"vite.config.cjs",
+	"vite.config.mts",
+	"vite.config.cts"
 ]);
-var IGNORED_SEGMENTS = /* @__PURE__ */ new Set(["node_modules", ".svelte-kit", "build", "dist"]);
-var warn = (line) => console.warn(terminalSafe(line));
+const IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".svelte-kit",
+	"build",
+	"dist"
+]);
+/** Analyzed-repo-derived strings (rule messages, config warnings) can carry raw terminal escapes — sanitize at this sink boundary, not per interpolation. */
+const warn = (line) => console.warn(terminalSafe(line));
+/**
+* Whether a `server.watcher` event on `file` should trigger a dev-dashboard re-analysis:
+* anything under `src/` or `static/` (the default SvelteKit layout this dashboard assumes),
+* or a `svelte.config.*` / `svelte-vitals.config.*` / `vite.config.*` at any depth (editing
+* the Vite config can change the performance/minify-disabled fact) — excluding build/dependency
+* output so their churn never triggers a spurious re-run. Exported for tests.
+*/
 function isRelevant(file, root) {
-  const rel = relative3(root, file);
-  if (rel === "" || rel.startsWith("..")) return false;
-  const segments = rel.split(sep2);
-  if (segments.some((s) => IGNORED_SEGMENTS.has(s))) return false;
-  if (CONFIG_BASENAMES.has(basename(file))) return true;
-  return segments[0] === "src" || segments[0] === "static";
+	const rel = relative(root, file);
+	if (rel === "" || rel.startsWith("..")) return false;
+	const segments = rel.split(sep);
+	if (segments.some((s) => IGNORED_SEGMENTS.has(s))) return false;
+	if (CONFIG_BASENAMES.has(basename(file))) return true;
+	return segments[0] === "src" || segments[0] === "static";
 }
-var DEFAULT_PRERENDER_DIR = ".svelte-kit/output/prerendered/pages";
+const DEFAULT_PRERENDER_DIR = ".svelte-kit/output/prerendered/pages";
+/**
+* Validate the plugin's `rules` option the same way the CLI's config-file loader
+* validates a config file's `rules` map (design 2026-07-26, Finding 4): an unknown
+* rule id, an invalid `severity`, an unrecognized key in the object form, or an
+* unknown/mistyped/out-of-range option is fatal, not silently dropped.
+* `options.rules` never passes through `loadConfigFile` (that only validates
+* `svelte-vitals.config.*`), so this is the only check a plugin-option `rules`
+* value gets. Unknown ids are rejected first — as the CLI does — so a typo'd id
+* with options reports "unknown rule id", not a misleading "takes no options"
+* (2026-07-26 second review, Finding D). The setting shape itself is checked by
+* core's `validateRuleSetting`, shared with the CLI loader: TypeScript already
+* catches a bad severity for TS consumers, but a `vite.config.js` gets no such
+* help, and a silently-inert typo is the failure this whole check exists for.
+*/
 function validateRulesOption(rules) {
-  if (!rules) return;
-  const unknown = findUnknownRuleIds(Object.keys(rules));
-  if (unknown.length > 0) {
-    throw new Error(
-      `svelte-vitals: invalid \`rules\` option \u2014 unknown rule id(s): ${unknown.join(", ")}. Known rule ids: ${knownRuleIds().join(", ")}`
-    );
-  }
-  const errors = [];
-  for (const [id, setting] of Object.entries(rules)) {
-    errors.push(...validateRuleSetting(`rules.${id}`, id, setting, ruleOptionsSpec(id), { allowOptions: true }));
-  }
-  if (errors.length > 0) throw new Error(`svelte-vitals: invalid \`rules\` option \u2014 ${errors.join(" ")}`);
+	if (!rules) return;
+	const unknown = findUnknownRuleIds(Object.keys(rules));
+	if (unknown.length > 0) throw new Error(`svelte-vitals: invalid \`rules\` option — unknown rule id(s): ${unknown.join(", ")}. Known rule ids: ${knownRuleIds().join(", ")}`);
+	const errors = [];
+	for (const [id, setting] of Object.entries(rules)) errors.push(...validateRuleSetting(`rules.${id}`, id, setting, ruleOptionsSpec(id), { allowOptions: true }));
+	if (errors.length > 0) throw new Error(`svelte-vitals: invalid \`rules\` option — ${errors.join(" ")}`);
 }
+/**
+* Validate the plugin's `overrides` option (2026-07-26 second review, Finding C):
+* previously only `options.rules` was validated, so a typo inside
+* `overrides[].rules[id].options` — the field the changeset advertises as the
+* per-path home for options — silently dropped the option instead of failing
+* loudly. Same fatal/known-id/carve-out rules as the CLI's config-file loader
+* (both funnel through core's `validateRuleSetting`): unknown rule ids (rejected
+* before options, per Finding D) or categories are fatal; a category key may
+* carry a severity but never `options`; a rule-id key's options are validated
+* against the baseline resolved from `rules`, so an override that only narrows
+* one side of an already-widened range isn't falsely rejected (Finding A) —
+* including when the widening comes from another `overrides[]` entry rather than
+* the global `rules` layer (Finding A, third pass; see `shouldSkipRangeCheck`).
+*
+* `rulesLayerKnown` is false when the plugin got no `rules` option: `analyze()`
+* then resolves the global layer from `svelte-vitals.config.*` instead
+* (per-field precedence, `analyze.ts`), and that file can only be read
+* asynchronously — after this synchronous construction-time check. A config file
+* widening `max` while an override narrows `min` is a valid combination, so
+* judging the override against the built-in default alone would hard-fail a
+* `vite build` over a config that is correct at run time. The min/max
+* cross-check is therefore skipped in that case; every other check (unknown id,
+* unknown key, type, bounds) is unaffected, and `analyze()` still validates the
+* config file itself through `loadConfigFile`.
+*/
 function validateOverridesOption(overrides, rules) {
-  if (!overrides) return;
-  const rulesLayerKnown = rules !== void 0;
-  const baseConfig = { ...defaultConfig, rules: rules ?? {} };
-  const errors = [];
-  overrides.forEach((entry, i) => {
-    const entryRules = entry.rules ?? {};
-    const nonCategoryKeys = Object.keys(entryRules).filter((k) => !CATEGORIES2.includes(k));
-    const unknown = findUnknownRuleIds(nonCategoryKeys);
-    if (unknown.length > 0) {
-      throw new Error(
-        `svelte-vitals: invalid \`overrides\` option \u2014 overrides[${i}]: unknown rule id(s) or categories: ${unknown.join(", ")}. Known categories: ${CATEGORIES2.join(", ")}. Known rule ids: ${knownRuleIds().join(", ")}`
-      );
-    }
-    for (const [key, setting] of Object.entries(entryRules)) {
-      const isCategory = CATEGORIES2.includes(key);
-      const baseline = isCategory ? void 0 : resolveRuleOptions(key, ruleOptionsSpec(key), baseConfig);
-      errors.push(
-        ...validateRuleSetting(`overrides[${i}].rules.${key}`, key, setting, ruleOptionsSpec(key), {
-          allowOptions: !isCategory,
-          ...baseline !== void 0 ? { baseline } : {},
-          skipRangeCheck: !rulesLayerKnown || shouldSkipRangeCheck(overrides, i, key, setting)
-        })
-      );
-    }
-  });
-  if (errors.length > 0) throw new Error(`svelte-vitals: invalid \`overrides\` option \u2014 ${errors.join(" ")}`);
+	if (!overrides) return;
+	const rulesLayerKnown = rules !== void 0;
+	const baseConfig = {
+		...defaultConfig,
+		rules: rules ?? {}
+	};
+	const errors = [];
+	overrides.forEach((entry, i) => {
+		const entryRules = entry.rules ?? {};
+		const nonCategoryKeys = Object.keys(entryRules).filter((k) => !CATEGORIES.includes(k));
+		const unknown = findUnknownRuleIds(nonCategoryKeys);
+		if (unknown.length > 0) throw new Error(`svelte-vitals: invalid \`overrides\` option — overrides[${i}]: unknown rule id(s) or categories: ${unknown.join(", ")}. Known categories: ${CATEGORIES.join(", ")}. Known rule ids: ${knownRuleIds().join(", ")}`);
+		for (const [key, setting] of Object.entries(entryRules)) {
+			const isCategory = CATEGORIES.includes(key);
+			const baseline = isCategory ? void 0 : resolveRuleOptions(key, ruleOptionsSpec(key), baseConfig);
+			errors.push(...validateRuleSetting(`overrides[${i}].rules.${key}`, key, setting, ruleOptionsSpec(key), {
+				allowOptions: !isCategory,
+				...baseline !== void 0 ? { baseline } : {},
+				skipRangeCheck: !rulesLayerKnown || shouldSkipRangeCheck(overrides, i, key, setting)
+			}));
+		}
+	});
+	if (errors.length > 0) throw new Error(`svelte-vitals: invalid \`overrides\` option — ${errors.join(" ")}`);
 }
+/** svelte-vitals Vite/SvelteKit plugin. */
 function svelteVitals(options = {}) {
-  validateRulesOption(options.rules);
-  validateOverridesOption(options.overrides, options.rules);
-  let root = options.cwd ?? process.cwd();
-  let minify;
-  let configFile;
-  const buildPlugin = {
-    name: "svelte-vitals",
-    apply: "build",
-    enforce: "post",
-    config(userConfig) {
-      minify = userConfig.build?.minify;
-    },
-    configResolved(config) {
-      if (!options.cwd) root = config.root;
-      configFile = config.configFile;
-    },
-    async closeBundle() {
-      const pagesDir = options.prerenderDir ? options.prerenderDir : join3(root, DEFAULT_PRERENDER_DIR);
-      const resolved = isAbsolute(pagesDir) ? pagesDir : join3(root, pagesDir);
-      if (!existsSync(resolved)) return;
-      const resolvedConfig = await resolveConfig(root, options);
-      let result;
-      try {
-        const viteMinifyDisabled = await resolveMinifyDisabled(minify, configFile, root);
-        result = await analyze(
-          resolved,
-          root,
-          options,
-          viteMinifyDisabled ? { viteMinifyDisabled } : void 0,
-          resolvedConfig
-        );
-      } catch (err) {
-        warn(`svelte-vitals: skipped \u2014 analysis failed: ${err instanceof Error ? err.message : String(err)}`);
-        return;
-      }
-      for (const w of result.warnings) warn(`svelte-vitals: ${w}`);
-      if (result.routeCount === 0) return;
-      if (options.report !== false) {
-        const out = options.report === "json" ? result.jsonReport : result.consoleReport;
-        console.log(out);
-      }
-      if (options.outFile) {
-        const outPath = isAbsolute(options.outFile) ? options.outFile : join3(root, options.outFile);
-        await mkdir(dirname(outPath), { recursive: true });
-        await writeFile(outPath, result.jsonReport);
-      }
-      if (result.failed) {
-        throw new Error(`svelte-vitals: build failed \u2014 findings at or above "${result.failOn}".`);
-      }
-    }
-  };
-  if (options.ui === false) return buildPlugin;
-  const uiPlugin = {
-    name: "svelte-vitals:ui",
-    apply: "serve",
-    async configureServer(server) {
-      process.env.SVELTE_VITALS_UI = "1";
-      const uiRoot = options.cwd ?? server.config.root;
-      let config;
-      let warnings;
-      try {
-        ({ config, warnings } = await resolveConfig(uiRoot, options));
-      } catch (err) {
-        warn(
-          `svelte-vitals: config file invalid \u2014 dashboard using plugin options/defaults: ${err instanceof Error ? err.message : String(err)}`
-        );
-        config = mergeConfig(options, void 0);
-        warnings = [];
-      }
-      for (const w of warnings) warn(`svelte-vitals: ${w}`);
-      const store = createStore();
-      let staticFailedRuleIds = [];
-      const runner = createAnalysisRunner({
-        root: uiRoot,
-        treatDynamicAs: options.treatDynamicAs,
-        metaComponents: options.metaComponents,
-        rules: options.rules,
-        failOn: options.failOn,
-        onResults: (results, failedRuleIds) => {
-          store.setStatic(results);
-          staticFailedRuleIds = failedRuleIds ?? [];
-        },
-        onError: (err) => warn(`[svelte-vitals] dev analysis failed: ${err instanceof Error ? err.message : String(err)}`),
-        onStatusChange: (analyzing) => store.setAnalyzing(analyzing)
-      });
-      runner.start();
-      server.watcher?.on("all", (_event, file) => {
-        if (isRelevant(file, uiRoot)) runner.notifyChange(file);
-      });
-      server.httpServer?.once("close", () => {
-        delete process.env.SVELTE_VITALS_UI;
-        runner.stop();
-      });
-      installUiMiddleware(server, config, readPackageVersion(), store, readCoreVersion(), () => staticFailedRuleIds);
-      if (typeof server.printUrls === "function") {
-        const printUrls = server.printUrls.bind(server);
-        server.printUrls = () => {
-          printUrls();
-          const printed = server.resolvedUrls?.local?.[0] ?? server.resolvedUrls?.network?.[0];
-          if (printed) {
-            console.log(`  \u279C  svelte-vitals: ${new URL(printed).origin}/__svelte-vitals/`);
-          }
-        };
-      }
-    }
-  };
-  return [buildPlugin, uiPlugin];
+	validateRulesOption(options.rules);
+	validateOverridesOption(options.overrides, options.rules);
+	let root = options.cwd ?? process.cwd();
+	let minify;
+	let configFile;
+	const buildPlugin = {
+		name: "svelte-vitals",
+		apply: "build",
+		enforce: "post",
+		config(userConfig) {
+			minify = userConfig.build?.minify;
+		},
+		configResolved(config) {
+			if (!options.cwd) root = config.root;
+			configFile = config.configFile;
+		},
+		async closeBundle() {
+			const pagesDir = options.prerenderDir ? options.prerenderDir : join(root, DEFAULT_PRERENDER_DIR);
+			const resolved = isAbsolute(pagesDir) ? pagesDir : join(root, pagesDir);
+			if (!existsSync(resolved)) return;
+			const resolvedConfig = await resolveConfig(root, options);
+			let result;
+			try {
+				const viteMinifyDisabled = await resolveMinifyDisabled(minify, configFile, root);
+				result = await analyze(resolved, root, options, viteMinifyDisabled ? { viteMinifyDisabled } : void 0, resolvedConfig);
+			} catch (err) {
+				warn(`svelte-vitals: skipped — analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+				return;
+			}
+			for (const w of result.warnings) warn(`svelte-vitals: ${w}`);
+			if (result.routeCount === 0) return;
+			if (options.report !== false) {
+				const out = options.report === "json" ? result.jsonReport : result.consoleReport;
+				console.log(out);
+			}
+			if (options.outFile) {
+				const outPath = isAbsolute(options.outFile) ? options.outFile : join(root, options.outFile);
+				await mkdir(dirname(outPath), { recursive: true });
+				await writeFile(outPath, result.jsonReport);
+			}
+			if (result.failed) throw new Error(`svelte-vitals: build failed — findings at or above "${result.failOn}".`);
+		}
+	};
+	if (options.ui === false) return buildPlugin;
+	return [buildPlugin, {
+		name: "svelte-vitals:ui",
+		apply: "serve",
+		async configureServer(server) {
+			process.env.SVELTE_VITALS_UI = "1";
+			const uiRoot = options.cwd ?? server.config.root;
+			let config;
+			let warnings;
+			try {
+				({config, warnings} = await resolveConfig(uiRoot, options));
+			} catch (err) {
+				warn(`svelte-vitals: config file invalid — dashboard using plugin options/defaults: ${err instanceof Error ? err.message : String(err)}`);
+				config = mergeConfig(options, void 0);
+				warnings = [];
+			}
+			for (const w of warnings) warn(`svelte-vitals: ${w}`);
+			const store = createStore();
+			let staticFailedRuleIds = [];
+			const runner = createAnalysisRunner({
+				root: uiRoot,
+				treatDynamicAs: options.treatDynamicAs,
+				metaComponents: options.metaComponents,
+				rules: options.rules,
+				failOn: options.failOn,
+				onResults: (results, failedRuleIds) => {
+					store.setStatic(results);
+					staticFailedRuleIds = failedRuleIds ?? [];
+				},
+				onError: (err) => warn(`[svelte-vitals] dev analysis failed: ${err instanceof Error ? err.message : String(err)}`),
+				onStatusChange: (analyzing) => store.setAnalyzing(analyzing)
+			});
+			runner.start();
+			server.watcher?.on("all", (_event, file) => {
+				if (isRelevant(file, uiRoot)) runner.notifyChange(file);
+			});
+			server.httpServer?.once("close", () => {
+				delete process.env.SVELTE_VITALS_UI;
+				runner.stop();
+			});
+			installUiMiddleware(server, config, readPackageVersion(), store, readCoreVersion(), () => staticFailedRuleIds);
+			if (typeof server.printUrls === "function") {
+				const printUrls = server.printUrls.bind(server);
+				server.printUrls = () => {
+					printUrls();
+					const printed = server.resolvedUrls?.local?.[0] ?? server.resolvedUrls?.network?.[0];
+					if (printed) console.log(`  ➜  svelte-vitals: ${new URL(printed).origin}/__svelte-vitals/`);
+				};
+			}
+		}
+	}];
 }
-export {
-  svelteVitals
-};
+//#endregion
+export { svelteVitals };