svelte-vitals 0.54.6 → 0.54.7

package/dist/{analyze-B1DhJ_wC.js → analyze-D5CKrnVf.js}

@@ -1,4 +1,4 @@
-import { c as findUnknownRuleIds, h as readPackageVersion, i as run, l as knownRuleIds, m as readCoreVersion, p as isReporterName } from "./src-CNeKZkf0.js";
+import { _ as readCoreVersion, c as findUnknownRuleIds, g as isReporterName, i as run, l as knownRuleIds, v as readPackageVersion } from "./src-Oo1FLd1x.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { terminalSafe } from "@svelte-vitals/core/internal";

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { g as realIO, i as resolveLocale, m as consoleIO, n as runAnalyzeCliGunshi } from "./analyze-B1DhJ_wC.js";
+import { g as realIO, i as resolveLocale, m as consoleIO, n as runAnalyzeCliGunshi } from "./analyze-D5CKrnVf.js";
 import { terminalSafe } from "@svelte-vitals/core/internal";
 //#region src/cli.ts
 /**
@@ -17,35 +17,35 @@ async function runCli(argv, io = consoleIO, env = process.env) {
 	try {
 		const locale = resolveLocale(env);
 		if (argv[0] === "complete") {
-			const { runCompleteCliGunshi } = await import("./complete-B5MjMWIx.js");
+			const { runCompleteCliGunshi } = await import("./complete-DJIjQlEC.js");
 			return {
 				code: await runCompleteCliGunshi(argv, io),
 				exit: "natural"
 			};
 		}
 		if (argv[0] === "docs") {
-			const { runDocsCliGunshi } = await import("./docs-CS6y-jmw.js");
+			const { runDocsCliGunshi } = await import("./docs-CfxdUEEe.js");
 			return {
 				code: await runDocsCliGunshi(argv.slice(1), io, locale),
 				exit: "natural"
 			};
 		}
 		if (argv[0] === "explain") {
-			const { runExplainCliGunshi } = await import("./explain-2q_Uvl0L.js");
+			const { runExplainCliGunshi } = await import("./explain-D9Cc6k2G.js");
 			return {
 				code: await runExplainCliGunshi(argv.slice(1), io, locale),
 				exit: "natural"
 			};
 		}
 		if (argv[0] === "install") {
-			const { runInstallCliGunshi } = await import("./install-NaV82t9A.js").then((n) => n.n);
+			const { runInstallCliGunshi } = await import("./install-BIpFmwLJ.js").then((n) => n.n);
 			return {
 				code: await runInstallCliGunshi(argv.slice(1), io, locale),
 				exit: "immediate"
 			};
 		}
 		if (argv[0] === "ci") {
-			const { runCiCliGunshi } = await import("./ci-Cs-AbY0g.js");
+			const { runCiCliGunshi } = await import("./ci-CVMFzrRD.js");
 			return {
 				code: await runCiCliGunshi(argv.slice(1), {
 					...realIO(),

package/dist/{ci-Cs-AbY0g.js → ci-CVMFzrRD.js}

@@ -1,4 +1,4 @@
-import { a as guardArgs, c as stripUnknownFlags, g as realIO, l as suggestClosest, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-B1DhJ_wC.js";
+import { a as guardArgs, c as stripUnknownFlags, g as realIO, l as suggestClosest, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-D5CKrnVf.js";
 import { a as planWorkflowWrite, i as buildWorkflowYaml, n as ACTION_VERSION, r as WORKFLOW_PATH, t as ACTION_SHA } from "./action-pin.generated-BkwgIAMh.js";
 import { join } from "node:path";
 import { cli } from "gunshi/bone";

package/dist/{complete-B5MjMWIx.js → complete-DJIjQlEC.js}

@@ -1,9 +1,9 @@
-import { f as REPORTER_NAMES } from "./src-CNeKZkf0.js";
-import { d as FAIL_ON_VALUES, f as TREAT_DYNAMIC_AS_VALUES, m as consoleIO, t as ROOT_ARGS, u as CATEGORIES } from "./analyze-B1DhJ_wC.js";
-import { t as INSTALL_ARGS } from "./install-NaV82t9A.js";
-import { CI_ARGS, CI_UPGRADE_ARGS } from "./ci-Cs-AbY0g.js";
-import { DOCS_LIST_ARGS, DOCS_ROOT_ARGS, DOCS_SHOW_ARGS } from "./docs-CS6y-jmw.js";
-import { EXPLAIN_ARGS } from "./explain-2q_Uvl0L.js";
+import { h as REPORTER_NAMES } from "./src-Oo1FLd1x.js";
+import { d as FAIL_ON_VALUES, f as TREAT_DYNAMIC_AS_VALUES, m as consoleIO, t as ROOT_ARGS, u as CATEGORIES } from "./analyze-D5CKrnVf.js";
+import { t as INSTALL_ARGS } from "./install-BIpFmwLJ.js";
+import { CI_ARGS, CI_UPGRADE_ARGS } from "./ci-CVMFzrRD.js";
+import { DOCS_LIST_ARGS, DOCS_ROOT_ARGS, DOCS_SHOW_ARGS } from "./docs-CfxdUEEe.js";
+import { EXPLAIN_ARGS } from "./explain-D9Cc6k2G.js";
 import { cli } from "gunshi/bone";
 import { define } from "gunshi/definition";
 import { kebabnize } from "gunshi/utils";

package/dist/{docs-CS6y-jmw.js → docs-CfxdUEEe.js}

@@ -1,5 +1,5 @@
-import { l as knownRuleIds } from "./src-CNeKZkf0.js";
-import { a as guardArgs, c as stripUnknownFlags, l as suggestClosest, m as consoleIO, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-B1DhJ_wC.js";
+import { l as knownRuleIds } from "./src-Oo1FLd1x.js";
+import { a as guardArgs, c as stripUnknownFlags, l as suggestClosest, m as consoleIO, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-D5CKrnVf.js";
 import { docsUrlFor } from "@svelte-vitals/core/internal";
 import { cli } from "gunshi/bone";
 import { define } from "gunshi/definition";
@@ -34,7 +34,7 @@ const EMBEDDED_DOCS = [
 		name: "scoping",
 		title: "Scoping findings to a change",
 		description: "Use --diff, --staged, --baseline and the suppressions file so only what a change introduced is reported, instead of a legacy backlog.",
-		body: "# Scoping findings to a change\n\nAn existing project usually has a backlog nobody is about to fix. Scope the report rather than\ndisabling rules.\n\n## Scope by file\n\n- `--diff [ref]`: only findings in files changed versus `ref` (default `HEAD`).\n- `--staged`: only findings in staged files. The pre-commit gate.\n\n```bash\nsvelte-vitals . --diff --reporter agent   # after editing: what did I just break?\nsvelte-vitals . --staged                  # before committing\n```\n\nBoth work when the project is not at the git repo root.\n\n## Scope by finding (`--baseline <ref>`)\n\nReports only findings **not already present** at `ref`. Scopes by finding identity rather than by\nfile, so a pre-existing problem in a file you touched does not fail the gate. No default ref.\n\n```bash\nsvelte-vitals --diff origin/main --baseline origin/main --fail-on warning   # PR gate\n```\n\nIt checks `ref` out into a temporary worktree and subtracts those findings. On failure (no git,\nbad ref) it warns and reports everything rather than failing the run.\n\n## Accept a backlog once (`svelte-vitals-suppressions.json`)\n\n`--baseline` handles the transient case. For a persistent ramp, record today's findings once:\n\n```bash\nsvelte-vitals --update-suppressions\ngit add svelte-vitals-suppressions.json\n```\n\nThis analyzes the whole project (`--diff`/`--staged`/`--baseline` are ignored), writes every\npenalized finding, and exits `0` without a report.\n\nThe file then applies automatically on every run, after `--diff`/`--staged` and `--baseline`.\nFixing an accepted finding leaves a **stale** entry, reported on stderr but never failing the run.\n`--no-suppressions` ignores the file for one run.\n\nAn entry covers whatever its rule reports at that route and location, not just the message\nrecorded when written, so a different finding from the same rule at the same spot still matches\nand stays suppressed (and not stale).\n\nA malformed suppressions file is a hard error (exit `2`), not a silent skip.\n\n## Suppress one occurrence inline\n\nFor a single finding that is correct by design, put a `svelte-vitals-disable-next-line` comment on\nthe line directly above it:\n\n```html\n<!-- svelte-vitals-disable-next-line security/raw-html -->\n<div>{@html sanitized}</div>\n```\n\nInside `<script>`, use `// svelte-vitals-disable-next-line <rule-id>`. Omit the id to suppress every\nrule on the next line, or list several comma-separated.\n\nOnly findings the report anchors to a **line** can be reached this way, not the `<head>` metadata\nrules, which report what a route never set. A directive in a component silences that finding on\nevery route composing it; for one route, use the suppressions file or `overrides`.\n\n## Which one\n\n| Situation                              | Use                                      |\n| -------------------------------------- | ---------------------------------------- |\n| Checking an edit you just made         | `--diff`                                 |\n| One occurrence that is right as-is     | `svelte-vitals-disable-next-line`        |\n| Pre-commit hook                        | `--staged`                               |\n| PR gate against a base branch          | `--diff <base> --baseline <base>`        |\n| Adopting on a legacy project, for good | `--update-suppressions`, commit the file |\n\nMatching ignores line numbers in both `--baseline` and the suppressions file, so a second\nviolation of the same rule lower in the same file does not surface as new.\n\n## Related\n\n- `svelte-vitals docs show ci`: the generated PR gate already does the `--diff`/`--baseline` pairing\n- `svelte-vitals docs show config`: turning a rule off for good, when that is genuinely right"
+		body: "# Scoping findings to a change\n\nAn existing project usually has a backlog nobody is about to fix. Scope the report rather than\ndisabling rules.\n\n## Scope by file\n\n- `--diff [ref]`: only findings in files changed versus `ref` (default `HEAD`).\n- `--staged`: only findings in staged files. The pre-commit gate.\n\n```bash\nsvelte-vitals . --diff --reporter agent   # after editing: what did I just break?\nsvelte-vitals . --staged                  # before committing\n```\n\nBoth work when the project is not at the git repo root.\n\n## Scope by finding (`--baseline <ref>`)\n\nReports only findings **not already present** at `ref`. Scopes by finding identity rather than by\nfile, so a pre-existing problem in a file you touched does not fail the gate. No default ref.\n\n```bash\nsvelte-vitals --diff origin/main --baseline origin/main --fail-on warning   # PR gate\n```\n\nIt checks `ref` out into a temporary worktree and subtracts those findings. On failure (no git,\nbad ref) it warns and reports everything rather than failing the run.\n\n## Accept a backlog once (`svelte-vitals-suppressions.json`)\n\n`--baseline` handles the transient case. For a persistent ramp, record today's findings once:\n\n```bash\nsvelte-vitals --update-suppressions\ngit add svelte-vitals-suppressions.json\n```\n\nThis analyzes the whole project (`--diff`/`--staged`/`--baseline` are ignored), writes every\npenalized finding, and exits `0` without a report.\n\nThe file then applies automatically on every run, after `--diff`/`--staged` and `--baseline` —\nin `vite build` and the live dashboard too (source-scan entries only; route-level entries are\nskipped there, since rendered route findings anchor to the built HTML).\nFixing an accepted finding leaves a **stale** entry, reported on stderr but never failing the run.\n`--no-suppressions` ignores the file for one run.\n\nAn entry covers whatever its rule reports at that route and location, not just the message\nrecorded when written, so a different finding from the same rule at the same spot still matches\nand stays suppressed (and not stale).\n\nA malformed suppressions file is a hard error (exit `2`), not a silent skip.\n\n## Suppress one occurrence inline\n\nFor a single finding that is correct by design, put a `svelte-vitals-disable-next-line` comment on\nthe line directly above it:\n\n```html\n<!-- svelte-vitals-disable-next-line security/raw-html -->\n<div>{@html sanitized}</div>\n```\n\nInside `<script>`, use `// svelte-vitals-disable-next-line <rule-id>`. Omit the id to suppress every\nrule on the next line, or list several comma-separated.\n\nOnly findings the report anchors to a **line** can be reached this way, not the `<head>` metadata\nrules, which report what a route never set. A directive in a component silences that finding on\nevery route composing it; for one route, use the suppressions file or `overrides`.\n\n## Which one\n\n| Situation                              | Use                                      |\n| -------------------------------------- | ---------------------------------------- |\n| Checking an edit you just made         | `--diff`                                 |\n| One occurrence that is right as-is     | `svelte-vitals-disable-next-line`        |\n| Pre-commit hook                        | `--staged`                               |\n| PR gate against a base branch          | `--diff <base> --baseline <base>`        |\n| Adopting on a legacy project, for good | `--update-suppressions`, commit the file |\n\nMatching ignores line numbers in both `--baseline` and the suppressions file, so a second\nviolation of the same rule lower in the same file does not surface as new.\n\n## Related\n\n- `svelte-vitals docs show ci`: the generated PR gate already does the `--diff`/`--baseline` pairing\n- `svelte-vitals docs show config`: turning a rule off for good, when that is genuinely right"
 	}
 ];
 //#endregion

package/dist/{explain-2q_Uvl0L.js → explain-D9Cc6k2G.js}

@@ -1,5 +1,5 @@
-import { l as knownRuleIds } from "./src-CNeKZkf0.js";
-import { a as guardArgs, c as stripUnknownFlags, l as suggestClosest, m as consoleIO, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-B1DhJ_wC.js";
+import { l as knownRuleIds } from "./src-Oo1FLd1x.js";
+import { a as guardArgs, c as stripUnknownFlags, l as suggestClosest, m as consoleIO, o as splitAtTerminator, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-D5CKrnVf.js";
 import { CATEGORIES } from "@svelte-vitals/core";
 import { allRules, explainRule } from "@svelte-vitals/core/internal";
 import { cli } from "gunshi/bone";

package/dist/gunshi-registry.js

@@ -1,4 +1,4 @@
-import { t as ROOT_ARGS } from "./analyze-B1DhJ_wC.js";
-import { t as INSTALL_ARGS } from "./install-NaV82t9A.js";
+import { t as ROOT_ARGS } from "./analyze-D5CKrnVf.js";
+import { t as INSTALL_ARGS } from "./install-BIpFmwLJ.js";
 import { t as JA_ARG_DESCRIPTIONS } from "./ja-BDLP3KLG.js";
 export { INSTALL_ARGS, JA_ARG_DESCRIPTIONS, ROOT_ARGS };

package/dist/index.d.ts

@@ -159,6 +159,46 @@ export declare function ruleOptionsSpec(id: string): RuleOptionsSpec | undefined
  */
 export declare function registryTag(): string;
 //#endregion
+//#region src/suppressions.d.ts
+/**
+ * Persistent adoption ramp (design doc 2026-07-13-suppressions-file-design.md):
+ * accept every currently-penalized finding once (`--update-suppressions`), then
+ * gate only on findings that appear afterward. Unlike `--baseline <ref>` (a
+ * transient git-ref comparison), this file is committed and applied on every run.
+ */
+export declare const SUPPRESSIONS_FILE = "svelte-vitals-suppressions.json";
+interface SuppressionEntry {
+  id: string;
+  route?: string;
+  location?: string;
+}
+/**
+ * Reads `svelte-vitals-suppressions.json` from `cwd`. Returns `undefined` when
+ * the file doesn't exist. Throws when the file exists but is not valid JSON, its
+ * top-level shape isn't `{ version: 1, suppressions: [...] }`, or an entry is
+ * missing a string `id` — a silently-ignored typo would un-gate CI, so malformed
+ * files are a hard error (mapped to exit 2 by the caller). Unknown keys (both
+ * top-level and per-entry) are ignored for forward compatibility.
+ */
+export declare function loadSuppressions(cwd: string): SuppressionEntry[] | undefined;
+/**
+ * Removes penalized findings whose key matches a suppression entry. Passing
+ * seeds are never removed even if their key happens to match. Reports how many
+ * findings were suppressed and how many entries in `entries` matched nothing
+ * (stale — most likely fixed since the file was last written).
+ *
+ * `allResults` (defaults to `results`) is used only for the staleness tally, not
+ * for filtering: a caller that narrows `results` to a subset of files/findings
+ * (`--diff`/`--staged`/`--baseline`) can still pass the pre-scope, project-wide
+ * result set here so an entry whose finding survives elsewhere in the project
+ * isn't misreported as stale just because this run's scope excluded it.
+ */
+export declare function applySuppressions(results: Result[], entries: SuppressionEntry[], config: Config, allResults?: Result[]): {
+  results: Result[];
+  suppressed: number;
+  stale: number;
+};
+//#endregion
 //#region src/index.d.ts
 export interface RunOptions {
   cwd?: string;
@@ -378,4 +418,4 @@ export declare function applyScope(results: Result[], opts: ApplyScopeOptions):
  */
 export declare function run(opts?: RunOptions): Promise<number>;
 //#endregion
-export { type LoadedConfigFile, type ParseCache, defineConfig };
+export { type LoadedConfigFile, type ParseCache, type SuppressionEntry, defineConfig };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as spinnerEnabled, b as ProjectError, c as findUnknownRuleIds, d as ruleOptionsSpec, i as run, l as knownRuleIds, n as applyScope, o as CONFIG_FILENAMES, r as defineConfig, s as loadConfigFile, t as analyzeProject, u as registryTag, x as createNodeRuntime, y as routeMatcher } from "./src-CNeKZkf0.js";
-export { CONFIG_FILENAMES, ProjectError, analyzeProject, applyScope, createNodeRuntime, defineConfig, findUnknownRuleIds, knownRuleIds, loadConfigFile, registryTag, routeMatcher, ruleOptionsSpec, run, spinnerEnabled };
+import { C as ProjectError, S as routeMatcher, a as spinnerEnabled, c as findUnknownRuleIds, d as ruleOptionsSpec, f as SUPPRESSIONS_FILE, i as run, l as knownRuleIds, m as loadSuppressions, n as applyScope, o as CONFIG_FILENAMES, p as applySuppressions, r as defineConfig, s as loadConfigFile, t as analyzeProject, u as registryTag, w as createNodeRuntime } from "./src-Oo1FLd1x.js";
+export { CONFIG_FILENAMES, ProjectError, SUPPRESSIONS_FILE, analyzeProject, applyScope, applySuppressions, createNodeRuntime, defineConfig, findUnknownRuleIds, knownRuleIds, loadConfigFile, loadSuppressions, registryTag, routeMatcher, ruleOptionsSpec, run, spinnerEnabled };

package/dist/{install-NaV82t9A.js → install-BIpFmwLJ.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { _ as hasDep, g as discoverApps, h as readPackageVersion, o as CONFIG_FILENAMES, v as readPkg } from "./src-CNeKZkf0.js";
-import { a as guardArgs, c as stripUnknownFlags, g as realIO, h as clackPrompts, m as consoleIO, o as splitAtTerminator, p as toList, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-B1DhJ_wC.js";
+import { b as hasDep, o as CONFIG_FILENAMES, v as readPackageVersion, x as readPkg, y as discoverApps } from "./src-Oo1FLd1x.js";
+import { a as guardArgs, c as stripUnknownFlags, g as realIO, h as clackPrompts, m as consoleIO, o as splitAtTerminator, p as toList, r as localizedOptionsSection, s as stripAutoVersionLine } from "./analyze-D5CKrnVf.js";
 import { a as planWorkflowWrite, i as buildWorkflowYaml, n as ACTION_VERSION, r as WORKFLOW_PATH, t as ACTION_SHA } from "./action-pin.generated-BkwgIAMh.js";
 import { buildCursorRules, installHeader } from "./install/skill-content.js";
 import { join } from "node:path";

package/dist/{src-CNeKZkf0.js → src-Oo1FLd1x.js}

@@ -3154,4 +3154,4 @@ async function run(opts = {}) {
 	}
 }
 //#endregion
-export { hasDep as _, spinnerEnabled as a, ProjectError as b, findUnknownRuleIds as c, ruleOptionsSpec as d, REPORTER_NAMES as f, discoverApps as g, readPackageVersion as h, run as i, knownRuleIds as l, readCoreVersion as m, applyScope as n, CONFIG_FILENAMES as o, isReporterName as p, defineConfig$1 as r, loadConfigFile as s, analyzeProject as t, registryTag as u, readPkg as v, createNodeRuntime as x, routeMatcher as y };
+export { ProjectError as C, routeMatcher as S, readCoreVersion as _, spinnerEnabled as a, hasDep as b, findUnknownRuleIds as c, ruleOptionsSpec as d, SUPPRESSIONS_FILE as f, isReporterName as g, REPORTER_NAMES as h, run as i, knownRuleIds as l, loadSuppressions as m, applyScope as n, CONFIG_FILENAMES as o, applySuppressions as p, defineConfig$1 as r, loadConfigFile as s, analyzeProject as t, registryTag as u, readPackageVersion as v, createNodeRuntime as w, readPkg as x, discoverApps as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-vitals",
-  "version": "0.54.6",
+  "version": "0.54.7",
   "description": "A deterministic SvelteKit code-health scanner (SEO, performance, correctness, security, architecture, accessibility).",
   "type": "module",
   "license": "MIT",
@@ -43,13 +43,13 @@
     "dist"
   ],
   "dependencies": {
-    "@svelte-vitals/core": "0.54.6",
+    "@svelte-vitals/core": "0.54.7",
     "@clack/prompts": "^1.8.0",
     "@gunshi/plugin-completion": "0.37.2",
     "@gunshi/plugin-i18n": "0.37.2",
     "@gunshi/plugin-suggestion": "0.37.2",
     "gunshi": "0.37.2",
-    "magicast": "^0.5.4",
+    "magicast": "^0.5.5",
     "svelte": "^5.57.0"
   },
   "devDependencies": {