@svelte-vitals/vite 0.36.2 → 0.36.4

package/dist/hooks/index.js

@@ -1,4 +1,4 @@
-import { a as parseHtmlHead, r as toOccurrenceMap, t as isLoopbackOrigin } from "../loopback-OZjFnUGp.js";
+import { i as toOccurrenceMap, r as parseHtmlHead, t as isLoopbackOrigin } from "../loopback-D9pGJXl6.js";
 import { defineConfig } from "@svelte-vitals/core";
 import { allRules, defaultProject, effectiveSeverity, formatFailedRuleWarning, isPenalized, runAnalysis, selectRules, terminalSafe } from "@svelte-vitals/core/internal";
 import { DEV } from "esm-env";
@@ -8,24 +8,37 @@ function findingSignature(results, config) {
 	return results.filter((r) => isPenalized(r.detection, config.treatDynamicAs)).map((r) => `${r.id}:${effectiveSeverity(r, config)}:${r.detection.presence}:${r.detection.value}`).sort().join("|");
 }
 const warn = (line) => console.warn(terminalSafe(line));
+/** A dashboard that never answers must not block the route's later ingests forever. */
+const INGEST_TIMEOUT_MS = 1e4;
+/** True only when the dashboard acknowledged the POST. */
 async function postIngest(origin, route, results, failedRuleIds) {
 	if (!isLoopbackOrigin(origin)) {
 		if (globalThis.process?.env?.SVELTE_VITALS_DEBUG) warn(`svelte-vitals: live UI ingest skipped for non-loopback origin ${origin} — open the dashboard via localhost`);
-		return;
+		return false;
 	}
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), INGEST_TIMEOUT_MS);
 	try {
-		await fetch(`${origin}/__svelte-vitals/ingest`, {
+		const res = await fetch(`${origin}/__svelte-vitals/ingest`, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify({
 				route,
 				results,
 				failedRuleIds
-			})
+			}),
+			signal: controller.signal
 		});
-	} catch {}
+		if (!res.ok && globalThis.process?.env?.SVELTE_VITALS_DEBUG) warn(`svelte-vitals: live UI ingest for ${route} rejected with HTTP ${res.status}`);
+		return res.ok;
+	} catch (err) {
+		if (globalThis.process?.env?.SVELTE_VITALS_DEBUG) warn(`svelte-vitals: live UI ingest for ${route} failed: ${err instanceof Error ? err.message : String(err)}`);
+		return false;
+	} finally {
+		clearTimeout(timer);
+	}
 }
-async function analyzeAndIngest(html, route, origin, rules, config, lastSignature) {
+async function analyzeAndIngest(html, route, origin, rules, config, queued, inflight) {
 	try {
 		const { tags, headings: levels, images: imgs, landmarks, nestedLandmarks, ids, idRefs } = parseHtmlHead(html);
 		const head = {
@@ -76,9 +89,19 @@ async function analyzeAndIngest(html, route, origin, rules, config, lastSignatur
 		}, /* @__PURE__ */ new Map());
 		if (failedRules.length > 0 && globalThis.process?.env?.SVELTE_VITALS_DEBUG) for (const f of failedRules) warn(formatFailedRuleWarning(f));
 		const signature = `${findingSignature(results, config)}|failed:${[...failedRuleIds].sort().join(",")}`;
-		if (lastSignature.get(route) === signature) return;
-		lastSignature.set(route, signature);
-		if (globalThis.process?.env?.SVELTE_VITALS_UI) postIngest(origin, route, results, failedRuleIds);
+		if (queued.get(route)?.signature === signature) return;
+		if (!globalThis.process?.env?.SVELTE_VITALS_UI) return;
+		const entry = { signature };
+		queued.set(route, entry);
+		const next = (inflight.get(route) ?? Promise.resolve()).then(async () => {
+			if (!await postIngest(origin, route, results, failedRuleIds) && queued.get(route) === entry) queued.delete(route);
+		});
+		inflight.set(route, next);
+		try {
+			await next;
+		} finally {
+			if (inflight.get(route) === next) inflight.delete(route);
+		}
 	} catch (err) {
 		if (globalThis.process?.env?.SVELTE_VITALS_DEBUG) warn(`svelte-vitals: dev analysis failed: ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -96,12 +119,13 @@ function svelteVitalsHandle(options = {}) {
 		rules: options.rules ?? {}
 	});
 	const rules = selectRules(allRules, config).filter((r) => r.scope === "route" && !r.crossRoute);
-	const lastSignature = /* @__PURE__ */ new Map();
+	const queued = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
 	return ({ event, resolve }) => {
 		let buffer = "";
 		return resolve(event, { transformPageChunk: ({ html, done }) => {
 			buffer += html;
-			if (done && event.route.id != null) analyzeAndIngest(buffer, event.route.id, event.url.origin, rules, config, lastSignature);
+			if (done && event.route.id != null) analyzeAndIngest(buffer, event.route.id, event.url.origin, rules, config, queued, inflight);
 			return html;
 		} });
 	};

package/dist/index.js

@@ -1,10 +1,88 @@
-import { i as globFiles, n as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-OZjFnUGp.js";
+import { i as toOccurrenceMap, n as isSameOrigin, r as parseHtmlHead, t as isLoopbackOrigin } from "./loopback-D9pGJXl6.js";
 import { existsSync, readFileSync } from "node:fs";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
 import { CATEGORIES, defineConfig } from "@svelte-vitals/core";
-import { ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, addFactsDirectives, allRules, buildJsonReport, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, computeScore, defaultConfig, findMinifyDisabled, formatConsoleReport, formatFailedRuleWarning, formatJsonReport, hasFailureAtOrAbove, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, runAnalysis, safeHref, selectRules, shouldSkipRangeCheck, skippedFileWarnings, summarize, terminalSafe, unknownDirectiveIds, validateRuleSetting, withFailedRulesOff, withReadLimit } from "@svelte-vitals/core/internal";
-import { CONFIG_FILENAMES, analyzeProject, findUnknownRuleIds, knownRuleIds, loadConfigFile, registryTag, ruleOptionsSpec } from "svelte-vitals";
+import { ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, addFactsDirectives, allRules, buildJsonReport, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, computeScore, defaultConfig, findMinifyDisabled, formatConsoleReport, formatFailedRuleWarning, formatJsonReport, hasFailureAtOrAbove, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRuleOptions, runAnalysis, safeHref, selectRules, shouldSkipRangeCheck, skippedFileWarnings, summarize, terminalSafe, unknownDirectiveIds, validateRuleSetting, withFailedRulesOff } from "@svelte-vitals/core/internal";
+import { CONFIG_FILENAMES, analyzeProject, createNodeRuntime, findUnknownRuleIds, knownRuleIds, loadConfigFile, registryTag, ruleOptionsSpec } from "svelte-vitals";
+//#region src/providers/rendered/collect.ts
+/** Map a prerendered HTML path (relative to pages/, POSIX) to its route. */
+function deriveRouteFromHtmlPath(relPath) {
+	let p = relPath.replace(/\\/g, "/").replace(/\.html$/, "");
+	if (p === "index") return "/";
+	if (p.endsWith("/index")) p = p.slice(0, -6);
+	return "/" + p;
+}
+/** Read every prerendered HTML page under `prerenderPagesDir` into ResolvedHead[]. */
+async function collectRenderedHeads(prerenderPagesDir) {
+	const rt = createNodeRuntime();
+	const files = (await rt.glob("**/*.html", prerenderPagesDir)).sort();
+	const parsedFiles = await Promise.all(files.map(async (rel) => ({
+		rel,
+		parsed: parseHtmlHead(await rt.readFile(rt.join(prerenderPagesDir, rel)))
+	})));
+	const heads = [];
+	const headings = [];
+	const images = [];
+	const a11y = [];
+	let htmlLang = {
+		presence: "none",
+		value: "absent"
+	};
+	for (const { rel, parsed } of parsedFiles) {
+		if (htmlLang.presence === "none" && parsed.htmlLang.presence === "own") htmlLang = parsed.htmlLang;
+		const route = deriveRouteFromHtmlPath(rel);
+		heads.push({
+			route,
+			source: "rendered",
+			tags: parsed.tags,
+			file: rel
+		});
+		headings.push({
+			route,
+			headings: parsed.headings.map((level) => ({
+				level,
+				line: 0,
+				file: rel
+			}))
+		});
+		images.push({
+			route,
+			images: parsed.images.map((img) => ({
+				...img,
+				file: rel
+			}))
+		});
+		a11y.push({
+			route,
+			landmarks: toOccurrenceMap(parsed.landmarks, rel),
+			nestedLandmarks: parsed.nestedLandmarks.map((n) => ({
+				...n,
+				file: rel,
+				line: 0
+			})),
+			ids: toOccurrenceMap(parsed.ids, rel),
+			idRefs: parsed.idRefs.map((r) => ({
+				...r,
+				file: rel,
+				line: 0
+			})),
+			idCandidates: [...new Set(parsed.ids)],
+			fullyResolved: true,
+			elementTags: parsed.elementTags,
+			elementsClosed: true,
+			file: rel
+		});
+	}
+	return {
+		heads,
+		headings,
+		images,
+		a11y,
+		htmlLang
+	};
+}
+//#endregion
 //#region src/providers/rendered/project.ts
 async function exists(path) {
 	try {
@@ -61,25 +139,7 @@ async function collectRenderedProject(cwd, htmlLang) {
 }
 //#endregion
 //#region src/providers/source/components.ts
-/**
-* Node-backed Runtime adapter (design §8). vite always runs in Node, so no
-* swappable runtime is needed here — this just satisfies the interface the
-* shared core implementation expects.
-*/
-const boundedRead = withReadLimit((path) => readFile(path, "utf8"));
-const nodeRuntime = {
-	readFile: (path) => boundedRead(path),
-	async exists(path) {
-		try {
-			await access(path);
-			return true;
-		} catch {
-			return false;
-		}
-	},
-	glob: (pattern, cwd) => globFiles(pattern, cwd),
-	join: (...parts) => join(...parts)
-};
+const nodeRuntime = createNodeRuntime();
 /**
 * Scan every `.svelte` component under `src/` for Correctness/Security/Architecture/
 * Bundle-Performance/Accessibility facts (build mode only). Implementation lives in
@@ -304,6 +364,7 @@ const SEVERITIES = /* @__PURE__ */ new Set([
 	"info"
 ]);
 const CATEGORY_SET = new Set(CATEGORIES);
+const INGEST_BODY_LIMIT = 4194304;
 function isOptionalString(v) {
 	return v === void 0 || typeof v === "string";
 }
@@ -329,6 +390,7 @@ function isResultLike(x) {
 */
 function installUiMiddleware(server, config, version, store, coreVersion, getStaticFailedRuleIds) {
 	const clients = /* @__PURE__ */ new Set();
+	const currentConfig = () => typeof config === "function" ? config() : config;
 	store.subscribe(() => {
 		for (const res of clients) try {
 			res.write("event: update\ndata: {}\n\n");
@@ -344,7 +406,8 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		const url = req.url ?? "/";
 		const origin = req.headers.origin;
 		const host = req.headers.host;
-		if (typeof origin === "string" && !isLoopbackOrigin(origin) || host === void 0 || !isLoopbackOrigin(`http://${host}`)) {
+		const isTls = Boolean(req.socket?.encrypted);
+		if (host === void 0 || !isLoopbackOrigin(`http://${host}`) || typeof origin === "string" && !isSameOrigin(origin, host, isTls)) {
 			req.resume();
 			res.statusCode = 403;
 			res.end("svelte-vitals dev UI is only available from localhost");
@@ -352,8 +415,23 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		}
 		if (req.method === "POST" && url.startsWith("/ingest")) {
 			const chunks = [];
-			req.on("data", (c) => chunks.push(c));
+			let received = 0;
+			let tooLarge = false;
+			req.on("data", (c) => {
+				if (tooLarge) return;
+				received += c.length;
+				if (received > INGEST_BODY_LIMIT) {
+					tooLarge = true;
+					chunks.length = 0;
+					res.statusCode = 413;
+					res.end();
+					req.destroy();
+					return;
+				}
+				chunks.push(c);
+			});
 			req.on("end", () => {
+				if (tooLarge) return;
 				try {
 					const { route, results, failedRuleIds } = JSON.parse(Buffer.concat(chunks).toString("utf8"));
 					if (typeof route === "string" && Array.isArray(results)) {
@@ -379,7 +457,7 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		}
 		if (url.startsWith("/data.json")) {
 			try {
-				const snapshot = buildSnapshot(store, config, {
+				const snapshot = buildSnapshot(store, currentConfig(), {
 					version,
 					coreVersion
 				}, getStaticFailedRuleIds?.());
@@ -392,7 +470,7 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 			return;
 		}
 		try {
-			const html = renderAppShell(buildSnapshot(store, config, {
+			const html = renderAppShell(buildSnapshot(store, currentConfig(), {
 				version,
 				coreVersion
 			}, getStaticFailedRuleIds?.()));
@@ -439,6 +517,12 @@ function composeBadges(staticResults, liveByRoute) {
 	for (const route of liveByRoute.keys()) badges[route] = "measured";
 	return badges;
 }
+/**
+* In-memory findings store for the dev UI. Owned by the ui plugin, shared between the
+* analysis runner (writes the static, whole-project layer) and the ingest middleware
+* (writes the live, per-route layer from rendered pages). `snapshot()`/`badges()` expose
+* the merged view per the design doc (2026-07-08-dev-dashboard-whole-project-design.md §2).
+*/
 function createStore() {
 	let staticResults = [];
 	const liveByRoute = /* @__PURE__ */ new Map();
@@ -451,6 +535,11 @@ function createStore() {
 		for (const fn of subs) fn();
 	}
 	return {
+		/**
+		* Replace a route's live findings (route stamped onto results missing one) and notify
+		* subscribers. `failedRuleIds` replaces that route's live-layer failed-rule set — an
+		* omitted or empty array clears it, so a route re-analyzed with no failures recovers.
+		*/
 		set(route, results, failedRuleIds) {
 			liveByRoute.set(route, results.map((r) => r.route ? r : {
 				...r,
@@ -464,6 +553,7 @@ function createStore() {
 			staticResults = results;
 			notify();
 		},
+		/** Whether a whole-project analysis run is in flight; participates in subscribe/notify like a findings change. */
 		setAnalyzing(next) {
 			analyzing = next;
 			notify();
@@ -471,15 +561,19 @@ function createStore() {
 		isAnalyzing() {
 			return analyzing;
 		},
+		/** Composed findings across both layers — feed straight into buildJsonReport. */
 		snapshot() {
 			return composeSnapshot(staticResults, liveByRoute);
 		},
+		/** Per-route provenance for the dashboard's badges: 'measured' (live) or 'static'. */
 		badges() {
 			return composeBadges(staticResults, liveByRoute);
 		},
+		/** Union of failed rule ids across every live (ingested) route, for `withFailedRulesOff`. */
 		failedRuleIds() {
 			return [...new Set([...liveFailedByRoute.values()].flat())].sort();
 		},
+		/** Bumped once per notify() — lets consumers discard stale fetches. */
 		sequence() {
 			return seq;
 		},
@@ -504,12 +598,13 @@ function createAnalysisRunner(opts) {
 	let running = false;
 	let pending = false;
 	let timer;
+	let lastWarningsKey;
 	async function runOnce() {
 		if (stopped) return;
 		running = true;
 		opts.onStatusChange?.(true);
 		try {
-			const { results, failedRuleIds } = await analyze({
+			const result = await analyze({
 				cwd: opts.root,
 				treatDynamicAs: opts.treatDynamicAs,
 				metaComponents: opts.metaComponents,
@@ -517,8 +612,13 @@ function createAnalysisRunner(opts) {
 				failOn: opts.failOn,
 				parseCache
 			});
+			const { results, failedRuleIds } = result;
 			if (!stopped) if (failedRuleIds !== void 0) opts.onResults(results, failedRuleIds);
 			else opts.onResults(results);
+			const warnings = result.warnings ?? [];
+			const key = warnings.join("\n");
+			if (!stopped && warnings.length > 0 && key !== lastWarningsKey) opts.onWarnings?.(warnings);
+			lastWarningsKey = key;
 		} catch (err) {
 			if (!stopped) opts.onError(err);
 		} finally {
@@ -531,10 +631,12 @@ function createAnalysisRunner(opts) {
 		}
 	}
 	return {
+		/** Kick off the first whole-project analysis. Fire-and-forget — never blocks the caller. */
 		start() {
 			if (stopped) return;
 			runOnce();
 		},
+		/** A relevant source file changed; schedule a debounced re-analysis. */
 		notifyChange(file) {
 			if (stopped) return;
 			const rel = relative(opts.root, file).split(sep).join("/");
@@ -719,15 +821,23 @@ function svelteVitals(options = {}) {
 			process.env.SVELTE_VITALS_UI = "1";
 			const uiRoot = options.cwd ?? server.config.root;
 			let config;
-			let warnings;
-			try {
-				({config, warnings} = await resolveConfig(uiRoot, options));
-			} catch (err) {
-				warn(`svelte-vitals: config file invalid — dashboard using plugin options/defaults: ${err instanceof Error ? err.message : String(err)}`);
-				config = mergeConfig(options, void 0);
-				warnings = [];
-			}
-			for (const w of warnings) warn(`svelte-vitals: ${w}`);
+			let printedConfigWarnings = /* @__PURE__ */ new Set();
+			let configGeneration = 0;
+			const applyConfig = async () => {
+				const generation = ++configGeneration;
+				try {
+					const resolved = await resolveConfig(uiRoot, options);
+					if (generation !== configGeneration) return;
+					config = resolved.config;
+					printedConfigWarnings = new Set(resolved.warnings);
+					for (const w of resolved.warnings) warn(`svelte-vitals: ${w}`);
+				} catch (err) {
+					if (generation !== configGeneration) return;
+					warn(`svelte-vitals: config file invalid — dashboard using ${config ? "the previous config" : "plugin options/defaults"}: ${err instanceof Error ? err.message : String(err)}`);
+					config ??= mergeConfig(options, void 0);
+				}
+			};
+			await applyConfig();
 			const store = createStore();
 			let staticFailedRuleIds = [];
 			const runner = createAnalysisRunner({
@@ -741,17 +851,28 @@ function svelteVitals(options = {}) {
 					staticFailedRuleIds = failedRuleIds ?? [];
 				},
 				onError: (err) => warn(`svelte-vitals: dev analysis failed: ${err instanceof Error ? err.message : String(err)}`),
+				onWarnings: (warnings) => {
+					for (const w of warnings) if (!printedConfigWarnings.has(w)) warn(`svelte-vitals: ${w}`);
+				},
 				onStatusChange: (analyzing) => store.setAnalyzing(analyzing)
 			});
 			runner.start();
+			let configTimer;
 			server.watcher?.on("all", (_event, file) => {
-				if (isRelevant(file, uiRoot)) runner.notifyChange(file);
+				if (!isRelevant(file, uiRoot)) return;
+				if (CONFIG_FILENAMES.includes(basename(file))) {
+					clearTimeout(configTimer);
+					configTimer = setTimeout(() => void applyConfig().then(() => runner.notifyChange(file)), 500);
+					return;
+				}
+				runner.notifyChange(file);
 			});
 			server.httpServer?.once("close", () => {
 				delete process.env.SVELTE_VITALS_UI;
+				clearTimeout(configTimer);
 				runner.stop();
 			});
-			installUiMiddleware(server, config, readPackageVersion(), store, readCoreVersion(), () => staticFailedRuleIds);
+			installUiMiddleware(server, () => config, readPackageVersion(), store, readCoreVersion(), () => staticFailedRuleIds);
 			if (typeof server.printUrls === "function") {
 				const printUrls = server.printUrls.bind(server);
 				server.printUrls = () => {

package/dist/{loopback-OZjFnUGp.js → loopback-D9pGJXl6.js}

@@ -1,5 +1,3 @@
-import { glob, readFile, stat } from "node:fs/promises";
-import { join, relative, sep } from "node:path";
 import { ASIDE_DEMOTING_TAGS, IDREF_ATTRS, NAMING_ATTRS, SECTIONING_TAGS, decodeFragmentId, isClassicScriptType, isTopFragment, resolveLandmark, splitTokens, stripTextDirective } from "@svelte-vitals/core/internal";
 import { parse } from "node-html-parser";
 //#region src/providers/rendered/parse-html.ts
@@ -180,34 +178,6 @@ function parseHtmlHead(html) {
 		...collectA11y(root)
 	};
 }
-//#endregion
-//#region src/glob.ts
-/**
-* `node:fs` glob constrained to the contract callers rely on: files only (fs.glob also matches
-* directories), cwd-relative POSIX-separated paths on every platform (fs.glob returns platform
-* separators), dotfiles excluded (fs.glob's default). A symlink's Dirent never reports isFile(),
-* so symlinks are stat'd and kept when they point at a file; symlinked *directories* are not
-* traversed — fs.glob never descends into them. Duplicated in the CLI package — core purity
-* (no `node:` imports in core) rules out the shared home.
-*/
-async function globFiles(pattern, cwd) {
-	const out = [];
-	for await (const entry of glob(pattern, {
-		cwd,
-		withFileTypes: true
-	})) {
-		const path = join(entry.parentPath, entry.name);
-		if (!entry.isFile()) {
-			if (!entry.isSymbolicLink()) continue;
-			if (!(await stat(path).catch(() => null))?.isFile()) continue;
-		}
-		const rel = relative(cwd, path);
-		out.push(sep === "/" ? rel : rel.split(sep).join("/"));
-	}
-	return out;
-}
-//#endregion
-//#region src/providers/rendered/collect.ts
 /** Group raw occurrence keys (one entry per hit, in document order) by key, `file` attached, `line: 0` (rendered mode does not track source lines). */
 function toOccurrenceMap(keys, file) {
 	const out = Object.create(null);
@@ -217,81 +187,6 @@ function toOccurrenceMap(keys, file) {
 	});
 	return out;
 }
-/** Map a prerendered HTML path (relative to pages/, POSIX) to its route. */
-function deriveRouteFromHtmlPath(relPath) {
-	let p = relPath.replace(/\\/g, "/").replace(/\.html$/, "");
-	if (p === "index") return "/";
-	if (p.endsWith("/index")) p = p.slice(0, -6);
-	return "/" + p;
-}
-/** Read every prerendered HTML page under `prerenderPagesDir` into ResolvedHead[]. */
-async function collectRenderedHeads(prerenderPagesDir) {
-	const files = (await globFiles("**/*.html", prerenderPagesDir)).sort();
-	const parsedFiles = await Promise.all(files.map(async (rel) => ({
-		rel,
-		parsed: parseHtmlHead(await readFile(join(prerenderPagesDir, rel), "utf8"))
-	})));
-	const heads = [];
-	const headings = [];
-	const images = [];
-	const a11y = [];
-	let htmlLang = {
-		presence: "none",
-		value: "absent"
-	};
-	for (const { rel, parsed } of parsedFiles) {
-		if (htmlLang.presence === "none" && parsed.htmlLang.presence === "own") htmlLang = parsed.htmlLang;
-		const route = deriveRouteFromHtmlPath(rel);
-		heads.push({
-			route,
-			source: "rendered",
-			tags: parsed.tags,
-			file: rel
-		});
-		headings.push({
-			route,
-			headings: parsed.headings.map((level) => ({
-				level,
-				line: 0,
-				file: rel
-			}))
-		});
-		images.push({
-			route,
-			images: parsed.images.map((img) => ({
-				...img,
-				file: rel
-			}))
-		});
-		a11y.push({
-			route,
-			landmarks: toOccurrenceMap(parsed.landmarks, rel),
-			nestedLandmarks: parsed.nestedLandmarks.map((n) => ({
-				...n,
-				file: rel,
-				line: 0
-			})),
-			ids: toOccurrenceMap(parsed.ids, rel),
-			idRefs: parsed.idRefs.map((r) => ({
-				...r,
-				file: rel,
-				line: 0
-			})),
-			idCandidates: [...new Set(parsed.ids)],
-			fullyResolved: true,
-			elementTags: parsed.elementTags,
-			elementsClosed: true,
-			file: rel
-		});
-	}
-	return {
-		heads,
-		headings,
-		images,
-		a11y,
-		htmlLang
-	};
-}
 //#endregion
 //#region src/loopback.ts
 /** Only the local dev server hosts the ingest endpoint, so never POST off-box. */
@@ -303,5 +198,26 @@ function isLoopbackOrigin(origin) {
 		return false;
 	}
 }
+/**
+* Whether `origin` (an Origin header value) names exactly the server this request reached —
+* `host` is the Host header, `hostname[:port]`, and `secure` is whether the connection is TLS.
+* Compared as hostname + effective port: each side's omitted port resolves to its own scheme's
+* default (the Origin's from its URL scheme, the Host's from `secure`), so `https://localhost`
+* never matches a plain-http server on :80 and `https://localhost:443` does match a TLS server
+* whose Host is `localhost:443`. The Origin's scheme is otherwise not compared: under
+* `server.https` the Origin is https while the Host header is unchanged.
+*/
+function isSameOrigin(origin, host, secure = false) {
+	try {
+		const o = new URL(origin);
+		const h = new URL(`${secure ? "https" : "http"}://${host}`);
+		return o.hostname === h.hostname && effectivePort(o) === effectivePort(h);
+	} catch {
+		return false;
+	}
+}
+function effectivePort(url) {
+	return url.port || (url.protocol === "https:" ? "443" : "80");
+}
 //#endregion
-export { parseHtmlHead as a, globFiles as i, collectRenderedHeads as n, toOccurrenceMap as r, isLoopbackOrigin as t };
+export { toOccurrenceMap as i, isSameOrigin as n, parseHtmlHead as r, isLoopbackOrigin as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svelte-vitals/vite",
-  "version": "0.36.2",
+  "version": "0.36.4",
   "description": "Vite/SvelteKit plugin for svelte-vitals — analyzes prerendered HTML during vite build, plus a live dev dashboard.",
   "type": "module",
   "license": "MIT",
@@ -43,9 +43,9 @@
     "node-html-parser": "^9.0.2"
   },
   "peerDependencies": {
-    "@svelte-vitals/core": "^0.51.0",
+    "@svelte-vitals/core": "^0.51.2",
     "@sveltejs/kit": "^2.70.3",
-    "svelte-vitals": "^0.54.2",
+    "svelte-vitals": "^0.54.4",
     "vite": "^8.2.2"
   },
   "peerDependenciesMeta": {
@@ -54,12 +54,12 @@
     }
   },
   "devDependencies": {
-    "@svelte-vitals/core": "0.51.0",
+    "@svelte-vitals/core": "0.51.2",
     "@sveltejs/kit": "^2.70.3",
     "@types/node": "^24.13.3",
-    "happy-dom": "^20.11.15",
+    "happy-dom": "^20.13.2",
     "svelte": "^5.57.0",
-    "svelte-vitals": "0.54.2",
+    "svelte-vitals": "0.54.4",
     "vite": "^8.2.2"
   },
   "scripts": {