@svelte-vitals/vite 0.36.1 → 0.36.3

package/dist/hooks/index.js

@@ -1,6 +1,6 @@
-import { i as parseHtmlHead, r as toOccurrenceMap, t as isLoopbackOrigin } from "../loopback-nE7_C-y_.js";
+import { i as toOccurrenceMap, o as parseHtmlHead, t as isLoopbackOrigin } from "../loopback-CE47i4VD.js";
 import { defineConfig } from "@svelte-vitals/core";
-import { allRules, applyRuleSeverities, defaultProject, effectiveSeverity, formatFailedRuleWarning, isPenalized, runRules, selectRules, terminalSafe } from "@svelte-vitals/core/internal";
+import { allRules, defaultProject, effectiveSeverity, formatFailedRuleWarning, isPenalized, runAnalysis, selectRules, terminalSafe } from "@svelte-vitals/core/internal";
 import { DEV } from "esm-env";
 //#region src/hooks/handle.ts
 /** Stable signature of a route's penalized findings, so ingest is skipped when a repeat visit finds nothing new. */
@@ -66,16 +66,14 @@ async function analyzeAndIngest(html, route, origin, rules, config, lastSignatur
 			idCandidates: [...new Set(ids)],
 			fullyResolved: true
 		}];
-		const { results: ruleResults, failedRules } = await runRules(rules, {
+		const { results, failedRules, failedRuleIds } = await runAnalysis(rules, {
 			heads: [head],
 			headings,
 			images,
 			a11y,
 			project: defaultProject,
 			config
-		});
-		const results = applyRuleSeverities(ruleResults, config);
-		const failedRuleIds = failedRules.map((f) => f.id);
+		}, /* @__PURE__ */ new Map());
 		if (failedRules.length > 0 && globalThis.process?.env?.SVELTE_VITALS_DEBUG) for (const f of failedRules) warn(formatFailedRuleWarning(f));
 		const signature = `${findingSignature(results, config)}|failed:${[...failedRuleIds].sort().join(",")}`;
 		if (lastSignature.get(route) === signature) return;

package/dist/index.js

@@ -1,11 +1,10 @@
-import { n as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-nE7_C-y_.js";
+import { a as globFiles, n as isSameOrigin, r as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-CE47i4VD.js";
 import { existsSync, readFileSync } from "node:fs";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
 import { CATEGORIES, defineConfig } from "@svelte-vitals/core";
-import { ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, allRules, applyInlineDirectives, applyOverrides, applyRuleSeverities, buildJsonReport, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, computeScore, defaultConfig, findMinifyDisabled, formatConsoleReport, formatFailedRuleWarning, formatJsonReport, hasFailureAtOrAbove, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, runRules, safeHref, selectRules, shouldSkipRangeCheck, skippedFileWarnings, summarize, terminalSafe, unknownDirectiveIds, validateRuleSetting, withFailedRulesOff, withReadLimit } from "@svelte-vitals/core/internal";
+import { ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, addFactsDirectives, allRules, buildJsonReport, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, computeScore, defaultConfig, findMinifyDisabled, formatConsoleReport, formatFailedRuleWarning, formatJsonReport, hasFailureAtOrAbove, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, runAnalysis, safeHref, selectRules, shouldSkipRangeCheck, skippedFileWarnings, summarize, terminalSafe, unknownDirectiveIds, validateRuleSetting, withFailedRulesOff, withReadLimit } from "@svelte-vitals/core/internal";
 import { CONFIG_FILENAMES, analyzeProject, findUnknownRuleIds, knownRuleIds, loadConfigFile, registryTag, ruleOptionsSpec } from "svelte-vitals";
-import { glob } from "tinyglobby";
 //#region src/providers/rendered/project.ts
 async function exists(path) {
 	try {
@@ -78,10 +77,7 @@ const nodeRuntime = {
 			return false;
 		}
 	},
-	glob: (pattern, cwd) => glob(pattern, {
-		cwd,
-		dot: false
-	}),
+	glob: (pattern, cwd) => globFiles(pattern, cwd),
 	join: (...parts) => join(...parts)
 };
 /**
@@ -185,7 +181,13 @@ async function analyze(prerenderPagesDir, cwd, options, extraProjectFacts, resol
 	const kitModules = await collectKitModuleFacts$1(cwd, project.kitAliases);
 	const selected = selectRules(allRules, config);
 	if (selected.some((r) => r.id === "a11y/unverified-id-ref")) warnings.push("a11y/unverified-id-ref has no effect in rendered mode — the prerendered document is always fully resolved.");
-	const { results: rawResults, examined, failedRules } = await runRules(selected, {
+	const directives = /* @__PURE__ */ new Map();
+	addFactsDirectives(directives, {
+		components,
+		kitModules,
+		viteMinifyDisabled: project.viteMinifyDisabled
+	});
+	const { results, examined, failedRules, scoringConfig } = await runAnalysis(selected, {
 		heads,
 		headings,
 		images,
@@ -195,16 +197,10 @@ async function analyze(prerenderPagesDir, cwd, options, extraProjectFacts, resol
 		config,
 		kitModules,
 		sourceFiles
-	});
-	const directives = /* @__PURE__ */ new Map();
-	for (const c of components) directives.set(c.file, c.suppressions ?? []);
-	for (const m of kitModules) directives.set(m.file, m.suppressions ?? []);
-	if (project.viteMinifyDisabled?.file) directives.set(project.viteMinifyDisabled.file, project.viteMinifyDisabled.suppressions ?? []);
-	const results = applyInlineDirectives(applyOverrides(applyRuleSeverities(rawResults, config), config), directives, selected, config);
+	}, directives);
 	warnings.push(...skippedFileWarnings([...components, ...kitModules]));
 	warnings.push(...unknownDirectiveIds(directives, allRules));
 	for (const f of failedRules) warnings.push(formatFailedRuleWarning(f));
-	const scoringConfig = withFailedRulesOff(config, failedRules.map((f) => f.id));
 	const { score } = computeScore(results, scoringConfig);
 	const summary = summarize(results, scoringConfig);
 	const failed = hasFailureAtOrAbove(summary, scoringConfig.failOn);
@@ -308,6 +304,7 @@ const SEVERITIES = /* @__PURE__ */ new Set([
 	"info"
 ]);
 const CATEGORY_SET = new Set(CATEGORIES);
+const INGEST_BODY_LIMIT = 4194304;
 function isOptionalString(v) {
 	return v === void 0 || typeof v === "string";
 }
@@ -348,7 +345,8 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		const url = req.url ?? "/";
 		const origin = req.headers.origin;
 		const host = req.headers.host;
-		if (typeof origin === "string" && !isLoopbackOrigin(origin) || host === void 0 || !isLoopbackOrigin(`http://${host}`)) {
+		const isTls = Boolean(req.socket?.encrypted);
+		if (host === void 0 || !isLoopbackOrigin(`http://${host}`) || typeof origin === "string" && !isSameOrigin(origin, host, isTls)) {
 			req.resume();
 			res.statusCode = 403;
 			res.end("svelte-vitals dev UI is only available from localhost");
@@ -356,8 +354,23 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		}
 		if (req.method === "POST" && url.startsWith("/ingest")) {
 			const chunks = [];
-			req.on("data", (c) => chunks.push(c));
+			let received = 0;
+			let tooLarge = false;
+			req.on("data", (c) => {
+				if (tooLarge) return;
+				received += c.length;
+				if (received > INGEST_BODY_LIMIT) {
+					tooLarge = true;
+					chunks.length = 0;
+					res.statusCode = 413;
+					res.end();
+					req.destroy();
+					return;
+				}
+				chunks.push(c);
+			});
 			req.on("end", () => {
+				if (tooLarge) return;
 				try {
 					const { route, results, failedRuleIds } = JSON.parse(Buffer.concat(chunks).toString("utf8"));
 					if (typeof route === "string" && Array.isArray(results)) {

package/dist/{loopback-nE7_C-y_.js → loopback-CE47i4VD.js}

@@ -1,48 +1,11 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { IDREF_ATTRS, LANDMARK_ROLES, decodeFragmentId, isTopFragment, resolveRole, splitTokens, stripTextDirective } from "@svelte-vitals/core/internal";
-import { glob } from "tinyglobby";
+import { glob, readFile, stat } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { ASIDE_DEMOTING_TAGS, IDREF_ATTRS, NAMING_ATTRS, SECTIONING_TAGS, decodeFragmentId, isClassicScriptType, isTopFragment, resolveLandmark, splitTokens, stripTextDirective } from "@svelte-vitals/core/internal";
 import { parse } from "node-html-parser";
 //#region src/providers/rendered/parse-html.ts
 function attrValue(v) {
 	return v !== void 0 && v.trim().length > 0 ? "static" : "absent";
 }
-const JS_MIME_TYPES = /* @__PURE__ */ new Set([
-	"application/ecmascript",
-	"application/javascript",
-	"application/x-ecmascript",
-	"application/x-javascript",
-	"text/ecmascript",
-	"text/javascript",
-	"text/javascript1.0",
-	"text/javascript1.1",
-	"text/javascript1.2",
-	"text/javascript1.3",
-	"text/javascript1.4",
-	"text/javascript1.5",
-	"text/jscript",
-	"text/livescript",
-	"text/x-ecmascript",
-	"text/x-javascript"
-]);
-function isClassicScriptType(type) {
-	if (type === void 0) return true;
-	const normalized = type.trim().toLowerCase();
-	return normalized === "" || JS_MIME_TYPES.has(normalized);
-}
-const SECTIONING_TAGS = /* @__PURE__ */ new Set([
-	"article",
-	"aside",
-	"main",
-	"nav",
-	"section"
-]);
-const ASIDE_DEMOTING_TAGS = /* @__PURE__ */ new Set([
-	"article",
-	"aside",
-	"nav",
-	"section"
-]);
 /** Whole-document scan (not body-scoped: app.html shell ids/refs are real occurrences too). */
 function collectA11y(root) {
 	const landmarks = [];
@@ -54,16 +17,13 @@ function collectA11y(root) {
 		const tag = el.rawTagName?.toLowerCase();
 		if (tag && ctx.inBody) elementTags.add(tag);
 		const roleAttr = el.getAttribute("role");
-		let landmark;
-		if (roleAttr !== void 0) {
-			const role = resolveRole(splitTokens(roleAttr));
-			landmark = role && LANDMARK_ROLES.has(role) ? role : void 0;
-		} else if (tag === "main") landmark = "main";
-		else if ((tag === "header" || tag === "footer") && ctx.sectioning === 0) landmark = tag === "header" ? "banner" : "contentinfo";
-		else if (tag === "aside") {
-			const named = ["aria-label", "aria-labelledby"].some((a) => (el.getAttribute(a) ?? "").trim().length > 0);
-			landmark = ctx.asideDemoting === 0 || named ? "complementary" : void 0;
-		}
+		const landmark = resolveLandmark({
+			tag,
+			roleTokens: roleAttr !== void 0 ? splitTokens(roleAttr) : void 0,
+			named: tag === "aside" && NAMING_ATTRS.some((a) => (el.getAttribute(a) ?? "").trim().length > 0),
+			insideSectioning: ctx.sectioning > 0,
+			insideAsideDemoting: ctx.asideDemoting > 0
+		});
 		if (landmark) {
 			landmarks.push(landmark);
 			const within = ctx.landmarks.at(-1);
@@ -221,6 +181,32 @@ function parseHtmlHead(html) {
 	};
 }
 //#endregion
+//#region src/glob.ts
+/**
+* `node:fs` glob constrained to the contract callers rely on: files only (fs.glob also matches
+* directories), cwd-relative POSIX-separated paths on every platform (fs.glob returns platform
+* separators), dotfiles excluded (fs.glob's default). A symlink's Dirent never reports isFile(),
+* so symlinks are stat'd and kept when they point at a file; symlinked *directories* are not
+* traversed — fs.glob never descends into them. Duplicated in the CLI package — core purity
+* (no `node:` imports in core) rules out the shared home.
+*/
+async function globFiles(pattern, cwd) {
+	const out = [];
+	for await (const entry of glob(pattern, {
+		cwd,
+		withFileTypes: true
+	})) {
+		const path = join(entry.parentPath, entry.name);
+		if (!entry.isFile()) {
+			if (!entry.isSymbolicLink()) continue;
+			if (!(await stat(path).catch(() => null))?.isFile()) continue;
+		}
+		const rel = relative(cwd, path);
+		out.push(sep === "/" ? rel : rel.split(sep).join("/"));
+	}
+	return out;
+}
+//#endregion
 //#region src/providers/rendered/collect.ts
 /** Group raw occurrence keys (one entry per hit, in document order) by key, `file` attached, `line: 0` (rendered mode does not track source lines). */
 function toOccurrenceMap(keys, file) {
@@ -240,7 +226,7 @@ function deriveRouteFromHtmlPath(relPath) {
 }
 /** Read every prerendered HTML page under `prerenderPagesDir` into ResolvedHead[]. */
 async function collectRenderedHeads(prerenderPagesDir) {
-	const files = (await glob("**/*.html", { cwd: prerenderPagesDir })).sort();
+	const files = (await globFiles("**/*.html", prerenderPagesDir)).sort();
 	const parsedFiles = await Promise.all(files.map(async (rel) => ({
 		rel,
 		parsed: parseHtmlHead(await readFile(join(prerenderPagesDir, rel), "utf8"))
@@ -317,5 +303,26 @@ function isLoopbackOrigin(origin) {
 		return false;
 	}
 }
+/**
+* Whether `origin` (an Origin header value) names exactly the server this request reached —
+* `host` is the Host header, `hostname[:port]`, and `secure` is whether the connection is TLS.
+* Compared as hostname + effective port: each side's omitted port resolves to its own scheme's
+* default (the Origin's from its URL scheme, the Host's from `secure`), so `https://localhost`
+* never matches a plain-http server on :80 and `https://localhost:443` does match a TLS server
+* whose Host is `localhost:443`. The Origin's scheme is otherwise not compared: under
+* `server.https` the Origin is https while the Host header is unchanged.
+*/
+function isSameOrigin(origin, host, secure = false) {
+	try {
+		const o = new URL(origin);
+		const h = new URL(`${secure ? "https" : "http"}://${host}`);
+		return o.hostname === h.hostname && effectivePort(o) === effectivePort(h);
+	} catch {
+		return false;
+	}
+}
+function effectivePort(url) {
+	return url.port || (url.protocol === "https:" ? "443" : "80");
+}
 //#endregion
-export { parseHtmlHead as i, collectRenderedHeads as n, toOccurrenceMap as r, isLoopbackOrigin as t };
+export { globFiles as a, toOccurrenceMap as i, isSameOrigin as n, parseHtmlHead as o, collectRenderedHeads as r, isLoopbackOrigin as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svelte-vitals/vite",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "description": "Vite/SvelteKit plugin for svelte-vitals — analyzes prerendered HTML during vite build, plus a live dev dashboard.",
   "type": "module",
   "license": "MIT",
@@ -40,13 +40,12 @@
   ],
   "dependencies": {
     "esm-env": "^1.2.2",
-    "node-html-parser": "^9.0.1",
-    "tinyglobby": "^0.2.17"
+    "node-html-parser": "^9.0.2"
   },
   "peerDependencies": {
-    "@svelte-vitals/core": "^0.50.1",
+    "@svelte-vitals/core": "^0.51.1",
     "@sveltejs/kit": "^2.70.3",
-    "svelte-vitals": "^0.54.1",
+    "svelte-vitals": "^0.54.3",
     "vite": "^8.2.2"
   },
   "peerDependenciesMeta": {
@@ -55,12 +54,12 @@
     }
   },
   "devDependencies": {
-    "@svelte-vitals/core": "0.50.1",
+    "@svelte-vitals/core": "0.51.1",
     "@sveltejs/kit": "^2.70.3",
     "@types/node": "^24.13.3",
-    "happy-dom": "^20.11.6",
-    "svelte": "^5.56.10",
-    "svelte-vitals": "0.54.1",
+    "happy-dom": "^20.12.0",
+    "svelte": "^5.57.0",
+    "svelte-vitals": "0.54.3",
     "vite": "^8.2.2"
   },
   "scripts": {