svelte-vitals 0.44.0 → 0.44.1

package/dist/bin.js

@@ -10,7 +10,7 @@ import {
   readPackageVersion,
   readPkg,
   run
-} from "./chunk-WD5TSADH.js";
+} from "./chunk-4MC7STFI.js";
 import {
   consoleIO,
   parseCliArgs,
@@ -132,6 +132,7 @@ function resolveArgs(argv) {
   const errors = [];
   for (const flag of VALUE_FLAGS) {
     const v = argv[flag];
+    if (flag === "out-file" && v === "-") continue;
     if (v !== void 0 && (typeof v !== "string" || v.trim() === "" || v.startsWith("-"))) {
       errors.push(`svelte-vitals: --${flag} requires a value.`);
     }
@@ -193,6 +194,15 @@ function resolveArgs(argv) {
   const failOn = failOnValid ? failOnRaw : void 0;
   const weights = parseWeights(argv.weights, errors);
   const categories = parseCategories(argv.category, errors);
+  if (categories !== void 0 && categories.length > 0 && allow.length > 0) {
+    const excluded = allow.filter((id) => !unknown.includes(id)).filter((id) => !categories.includes(id.split("/")[0]));
+    if (excluded.length > 0) {
+      errors.push(
+        `svelte-vitals: --rules id(s) excluded by --category ${categories.join(", ")}: ${excluded.join(", ")}`
+      );
+      errors.push("Add the rule's category to --category, or drop the rule from --rules.");
+    }
+  }
   const score = Boolean(argv.score);
   if (score && typeof argv.reporter === "string") {
     warnings.push("svelte-vitals: --score overrides --reporter; reporter output suppressed.");
@@ -395,7 +405,7 @@ ${lines}`;
   }).join("\n\n");
 }
 function sharedBody(version) {
-  return `<!-- Generated by \`svelte-vitals install\` (svelte-vitals ${version}). Re-run with --force to refresh. -->
+  return `<!-- Generated by \`svelte-vitals install\` (svelte-vitals ${version}). Re-run \`svelte-vitals install --refresh\` to regenerate. -->
 
 # svelte-vitals
 
@@ -442,7 +452,7 @@ name: improve-svelte
 description: Survey a whole SvelteKit codebase as a senior Svelte/SvelteKit engineer, using svelte-vitals' scan as evidence, then produce a prioritized audit and self-contained implementation plans for other agents (or cheaper models) to execute. Read-only on source code \u2014 it plans improvements, it does not apply them. Use when the user asks to "improve this SvelteKit app", "audit this codebase", "make this app more SEO/performance/security solid", or wants a roadmap of fixes rather than a review of a single diff. For routine regression checks while writing code, use the \`svelte-vitals\` skill instead.
 ---
 
-<!-- Generated by \`svelte-vitals install\` (svelte-vitals ${version}). Re-run with --force to refresh. -->
+<!-- Generated by \`svelte-vitals install\` (svelte-vitals ${version}). Re-run \`svelte-vitals install --refresh\` to regenerate. -->
 
 # improve-svelte
 

package/dist/{chunk-WD5TSADH.js → chunk-4MC7STFI.js}

@@ -17,7 +17,8 @@ import {
   defineConfig,
   selectRules,
   applyRuleSeverities,
-  applyOverrides
+  applyOverrides,
+  settingSeverity
 } from "@svelte-vitals/core";
 
 // src/runtime/node.ts
@@ -863,6 +864,7 @@ function isAutoDetectedGithub(explicit, env = process.env) {
 
 // src/changed-files.ts
 import { execFileSync } from "child_process";
+import { defaultConfig as defaultConfig2, isPenalized } from "@svelte-vitals/core";
 function git(args, cwd) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\0");
 }
@@ -881,8 +883,10 @@ function getChangedFiles(cwd, opts) {
     return void 0;
   }
 }
-function filterToChangedFiles(results, changed) {
-  return results.filter((r) => r.location !== void 0 && changed.has(r.location));
+function filterToChangedFiles(results, changed, config = defaultConfig2) {
+  return results.filter(
+    (r) => r.location !== void 0 && changed.has(r.location) && (isPenalized(r.detection, config.treatDynamicAs) || r.route === void 0)
+  );
 }
 
 // src/baseline.ts
@@ -890,6 +894,7 @@ import { execFileSync as execFileSync2 } from "child_process";
 import { mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join as join4 } from "path";
+import { defaultConfig as defaultConfig3, isPenalized as isPenalized2 } from "@svelte-vitals/core";
 function git2(args, cwd) {
   return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 }
@@ -932,15 +937,16 @@ function checkoutBaseline(cwd, ref) {
     return void 0;
   }
 }
-function filterToNewFindings(results, baselineResults) {
-  const baselineKeys = new Set(baselineResults.map(findingKey));
-  return results.filter((r) => !baselineKeys.has(findingKey(r)));
+function filterToNewFindings(results, baselineResults, config = defaultConfig3) {
+  const penalized = (rs) => rs.filter((r) => isPenalized2(r.detection, config.treatDynamicAs));
+  const baselineKeys = new Set(penalized(baselineResults).map(findingKey));
+  return penalized(results).filter((r) => !baselineKeys.has(findingKey(r)));
 }
 
 // src/suppressions.ts
 import { readFileSync as readFileSync2, writeFileSync } from "fs";
 import { join as join6 } from "path";
-import { isPenalized } from "@svelte-vitals/core";
+import { isPenalized as isPenalized3 } from "@svelte-vitals/core";
 
 // src/config-file.ts
 import { existsSync as existsSync2 } from "fs";
@@ -948,7 +954,7 @@ import { join as join5 } from "path";
 import { pathToFileURL } from "url";
 import {
   CATEGORIES,
-  defaultConfig as defaultConfig2,
+  defaultConfig as defaultConfig4,
   resolveRuleOptions,
   shouldSkipRangeCheck,
   validateRuleSetting
@@ -1072,7 +1078,7 @@ function validateConfigFile(raw, path) {
       }
       for (const [key, setting] of Object.entries(entry.rules)) {
         const isCategory = CATEGORIES.includes(key);
-        const baseline = isCategory ? void 0 : resolveRuleOptions(key, ruleOptionsSpec(key), { ...defaultConfig2, rules: config.rules ?? {} });
+        const baseline = isCategory ? void 0 : resolveRuleOptions(key, ruleOptionsSpec(key), { ...defaultConfig4, rules: config.rules ?? {} });
         const skipRangeCheck = shouldSkipRangeCheck(rawOverrides, i, key, setting);
         validateSetting(path, `overrides[${i}].rules`, key, setting, !isCategory, baseline, skipRangeCheck);
       }
@@ -1188,7 +1194,7 @@ function writeSuppressions(cwd, results, config) {
   const seen = /* @__PURE__ */ new Set();
   const entries = [];
   for (const r of results) {
-    if (!isPenalized(r.detection, config.treatDynamicAs)) continue;
+    if (!isPenalized3(r.detection, config.treatDynamicAs)) continue;
     const entry = toEntry(r);
     const key = findingKey(entry);
     if (seen.has(key)) continue;
@@ -1200,20 +1206,23 @@ function writeSuppressions(cwd, results, config) {
   writeFileSync(path, JSON.stringify({ version: 1, suppressions: entries }, null, 2) + "\n");
   return entries.length;
 }
-function applySuppressions(results, entries, config) {
+function applySuppressions(results, entries, config, allResults) {
   const keys = new Set(entries.map((e) => findingKey(e)));
-  const usedKeys = /* @__PURE__ */ new Set();
   const kept = [];
   let suppressed = 0;
   for (const r of results) {
     const key = findingKey(r);
-    if (keys.has(key) && isPenalized(r.detection, config.treatDynamicAs)) {
+    if (keys.has(key) && isPenalized3(r.detection, config.treatDynamicAs)) {
       suppressed++;
-      usedKeys.add(key);
       continue;
     }
     kept.push(r);
   }
+  const usedKeys = /* @__PURE__ */ new Set();
+  for (const r of allResults ?? results) {
+    const key = findingKey(r);
+    if (keys.has(key) && isPenalized3(r.detection, config.treatDynamicAs)) usedKeys.add(key);
+  }
   const stale = [...keys].filter((k) => !usedKeys.has(k)).length;
   return { results: kept, suppressed, stale };
 }
@@ -1491,6 +1500,28 @@ import { defineConfig as defineConfig2 } from "@svelte-vitals/core";
 function spinnerEnabled(opts) {
   return opts.reporter === "console" && opts.stderrIsTTY && !isAutoDetectedAgent(opts.rawReporter, opts.env) && colorEnabled({ reporter: opts.reporter, isTTY: opts.stderrIsTTY, env: opts.env, noColorFlag: opts.noColorFlag });
 }
+function formatGlob(glob2) {
+  return Array.isArray(glob2) ? `[${glob2.map((g) => `'${g}'`).join(", ")}]` : `'${glob2}'`;
+}
+function overridesOffWarnings(allowRules, overrides) {
+  if (!allowRules || allowRules.length === 0 || !overrides || overrides.length === 0) return [];
+  const warnings = [];
+  for (const ruleId of allowRules) {
+    const category = ruleId.split("/")[0] ?? ruleId;
+    for (const entry of overrides) {
+      const severity = settingSeverity(entry.rules[ruleId]) ?? settingSeverity(entry.rules[category]);
+      if (severity !== "off") continue;
+      const scope = [
+        entry.route !== void 0 ? `route: ${formatGlob(entry.route)}` : void 0,
+        entry.files !== void 0 ? `files: ${formatGlob(entry.files)}` : void 0
+      ].filter((s) => s !== void 0).join(", ");
+      warnings.push(
+        `--rules '${ruleId}' is scoped 'off' by overrides entry { ${scope} } \u2014 findings there will not be reported. --rules overrides a global 'off' but not a scoped one.`
+      );
+    }
+  }
+  return warnings;
+}
 async function analyzeProject(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const rt = createNodeRuntime();
@@ -1511,7 +1542,11 @@ async function analyzeProject(opts = {}) {
     ...file?.overrides !== void 0 ? { overrides: file.overrides } : {}
   });
   await detectProject(rt, cwd);
-  const warnings = [...loaded?.warnings ?? [], ...await checkVersionFloor(rt, cwd)];
+  const warnings = [
+    ...loaded?.warnings ?? [],
+    ...await checkVersionFloor(rt, cwd),
+    ...overridesOffWarnings(opts.allowRules, config.overrides)
+  ];
   const { heads, images, headings, project, components, kitModules, sourceFiles } = await collectAll(rt, cwd, config, {
     route: opts.route,
     parseCache: opts.parseCache
@@ -1549,7 +1584,7 @@ async function applyScope(results, opts) {
         "svelte-vitals: could not determine changed files (not a git repo, git unavailable, or bad ref); analyzing all."
       );
     } else {
-      scoped = filterToChangedFiles(scoped, changed);
+      scoped = filterToChangedFiles(scoped, changed, opts.config);
     }
   }
   if (opts.baseline !== void 0) {
@@ -1561,7 +1596,7 @@ async function applyScope(results, opts) {
     } else {
       try {
         const base = await analyzeProject({ ...opts.analyzeOpts, cwd: checkout.analyzeCwd });
-        scoped = filterToNewFindings(scoped, base.results);
+        scoped = filterToNewFindings(scoped, base.results, opts.config);
       } catch {
         errorLog(`svelte-vitals: baseline analysis of '${opts.baseline}' failed; reporting all findings.`);
       } finally {
@@ -1572,11 +1607,16 @@ async function applyScope(results, opts) {
   if (!opts.noSuppressions && opts.config) {
     const entries = loadSuppressions(opts.cwd);
     if (entries !== void 0) {
-      const { results: afterSuppressions, suppressed, stale } = applySuppressions(scoped, entries, opts.config);
+      const {
+        results: afterSuppressions,
+        suppressed,
+        stale
+      } = applySuppressions(scoped, entries, opts.config, results);
       scoped = afterSuppressions;
-      if (suppressed > 0 || stale > 0) {
+      const routeScoped = opts.analyzeOpts?.route !== void 0;
+      if (suppressed > 0 || stale > 0 && !routeScoped) {
         errorLog(
-          `svelte-vitals: ${suppressed} finding(s) suppressed by ${SUPPRESSIONS_FILE}` + (stale > 0 ? ` (${stale} stale entr${stale === 1 ? "y" : "ies"} \u2014 re-run --update-suppressions to prune)` : "") + "."
+          `svelte-vitals: ${suppressed} finding(s) suppressed by ${SUPPRESSIONS_FILE}` + (stale > 0 && !routeScoped ? ` (${stale} stale entr${stale === 1 ? "y" : "ies"} \u2014 re-run --update-suppressions to prune)` : "") + "."
         );
       }
     }
@@ -1675,6 +1715,12 @@ async function run(opts = {}) {
   try {
     const { config, version } = analysis;
     if (opts.updateSuppressions) {
+      if (opts.route !== void 0) {
+        errorLog(
+          `svelte-vitals: --update-suppressions cannot be combined with --route ('${opts.route}') \u2014 it would prune every suppression entry outside that route from ${SUPPRESSIONS_FILE}. Re-run --update-suppressions without --route.`
+        );
+        return 2;
+      }
       const count = writeSuppressions(cwd, analysis.results, config);
       errorLog(`svelte-vitals: wrote ${count} suppression(s) to ${SUPPRESSIONS_FILE}.`);
       return 0;

package/dist/index.d.ts

@@ -268,6 +268,12 @@ interface ApplyScopeOptions {
     /** Disable applying svelte-vitals-suppressions.json for this run. */
     noSuppressions?: boolean;
     errorLog?: (line: string) => void;
+    /**
+     * Also doubles as this call's route-scoping signal: `analyzeOpts.route !== undefined`
+     * tells the suppressions block that `results` (this function's first argument) was
+     * itself collected route-scoped, not just project-wide-then-narrowed — see the comment
+     * at that check.
+     */
     analyzeOpts?: AnalyzeOptions;
 }
 /**

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   ruleOptionsSpec,
   run,
   spinnerEnabled
-} from "./chunk-WD5TSADH.js";
+} from "./chunk-4MC7STFI.js";
 export {
   ProjectError,
   analyzeProject,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "svelte-vitals",
-  "version": "0.44.0",
-  "description": "A SvelteKit SEO checker — not a runtime Web Vitals reporter. Static analysis of your routes' head metadata.",
+  "version": "0.44.1",
+  "description": "A deterministic SvelteKit code-health scanner (SEO, performance, correctness, security, architecture) — not a runtime Web Vitals reporter.",
   "type": "module",
   "license": "MIT",
   "author": "Kazuma Oe (https://github.com/oekazuma)",
@@ -11,7 +11,11 @@
     "seo",
     "meta-tags",
     "cli",
-    "svelte-vitals"
+    "svelte-vitals",
+    "performance",
+    "security",
+    "code-quality",
+    "static-analysis"
   ],
   "repository": {
     "type": "git",
@@ -44,7 +48,7 @@
     "magicast": "^0.5.4",
     "svelte": "^5.56.8",
     "tinyglobby": "^0.2.17",
-    "@svelte-vitals/core": "0.38.0"
+    "@svelte-vitals/core": "0.39.0"
   },
   "devDependencies": {
     "@types/estree": "^1.0.9",