[AndyTechnologies]

Summary

• PR 1/3: scaffold Svelte 5 + Vite (build-only), port 76-case graph-model oracle a TypeScript strict, extender resolveUiAsset con fallback /ui/*, traversal guard, content-type completo, y reescribir suites estáticas + e2e SSE para el contrato español 5 vistas.
• Pre-requisito para Unit 2 (stores/SSE/views/editor, PR 2) y Unit 3 (binary smoke + gates, PR 3).

Changes

• Phase 1 (toolchain): scaffold src/ui-svelte (Svelte 5 + Vite, build:ui → dist/ui hashed), vitest config, tsconfig, strict TS, NO dev server (build-only).
• Phase 2 (port + serving + tests): src/ui-svelte/lib/graph-model.ts (76 tests 1:1, 144 expects byte-identical), src/server.ts resolveUiAsset sanitización por segmento (reject .., leading-dot, backslash, vacío, absoluto) → null sin fallback, contentTypeFor (8 types + octet-stream), fallback /ui/* → index.html que nunca intercepta /api/*, exclusion marker en src/ui/app.js; static-spa.test.ts (20 tests), e2e-smoke.test.ts contra dist/ui compilado.

Testing

• bun test src/dashboard — 116 pass (40 static-spa + 76 e2e-smoke)
• bun test src/ui-svelte — 79 pass (graph-model + purity)
• bun run typecheck clean
• bun run lint clean
• bun run build:ui emite dist/ui con assets hasheados
• e2e harness boots, sirve UI_DIR=dist/ui con 200s y traversal 404

Chain Context

Field	Value
Chain	svelte-ui
Tracker	svelte-ui-tracker (branch, sin PR — merge final al completar la cadena)
Position	1 of 3
Base	svelte-ui-tracker
Depends on	None
Follow-up	PR 2 → svelte-ui/pr1 (Unit 2: stores/SSE/views/editor)
Review budget	2484 / 400 — size:exception req. (scaffold oracle port 1:1, serving, suites rewrites)
Starts at	6c4bae5 (master)
Ends with	SPA Svelte 5 compilable, graph-model port byte-identical, serving ext con fallback+traversal+content-type, 195 tests verdes

Chain Overview

master
 └── svelte-ui-tracker (merge final)
      └── 📍 PR 1 (este: toolchain + port + serving + tests)
           └── PR 2 (Unit 2: stores/SSE/views/editor)
                └── PR 3 (Unit 3: bundle ≤ 100 KB + binary smoke + gates)

Scope

• Includes: Scaffold Svelte 5/Vite, graph-model TS port 76 cases, resolveUiAsset sanitización + content-type + fallback /ui/*, static-spa + e2e-smoke rewrites.
• Excludes: Stores, SSE service, vistas, editor, undo/redo, executions, models panel (Unit 2); bundles ≤100 KB gzip, --asset embed + MAJOR-3 binary smoke, tsc/eslint gate final (Unit 3).

Autonomy

• CI esperado que pase (solo typecheck + lint + build + tests, sin deploy)
• PR tiene un scope entregable único (Unit 1 completo)
• Puede revertirse sin cambios no relacionados (rama svelte-ui/pr1 separada)
• Tests, build, lint cubren esta unidad

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​25.0.1
	@​sveltejs/​vite-plugin-svelte@​5.1.1
	vite@​6.4.3
	svelte@​5.57.0
	@​testing-library/​jest-dom@​6.10.0
	@​testing-library/​svelte@​5.4.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@25.0.1 → npm/data-urls@5.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@5.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@25.0.1 → npm/rrweb-cssom@0.7.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.7.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@25.0.1 → npm/rrweb-cssom@0.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[AndyTechnologies]

Closed without merge: this svelte-ui chain (pr1→pr2→pr3→tracker) was an earlier UI iteration superseded by PR #30 (WeaveLLM 0.1.0 full rewrite, merged as squash). Its work is already absorbed into master via the rewrite; merging it now would reintroduce the legacy UI over the new Astro 7 surface.