deps(web): move the wizard to SvelteKit 3

web/osv-scanner.toml

@@ -0,0 +1,6 @@
+# Advisories that OSV reports against the wizard's dependencies but that do
+# not apply to what it builds. Each says why.
+
+[[IgnoredVulns]]
+id = "GHSA-gcqx-w48m-w2h4"
+reason = "deepmerge, used only at build time by @sveltejs/vite-plugin-svelte to merge the project's own Svelte options (src/utils/options.js). Nothing from a user or a model reaches it, it is not in the wizard bundle, and no patched version exists."

web/package.json

@@ -13,20 +13,21 @@
 		"test:unit": "vitest",
 		"test": "npm run test:unit -- --run"
 	},
+	"imports": {
+		"#lib": "./src/lib/index.js",
+		"#lib/*": "./src/lib/*"
+	},
 	"devDependencies": {
 		"@fontsource/archivo": "^5.3.0",
 		"@fontsource/jetbrains-mono": "^5.3.0",
-		"@sveltejs/adapter-static": "^3.0.10",
-		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/adapter-static": "^4.0.1",
+		"@sveltejs/kit": "^3.1.1",
 		"@sveltejs/vite-plugin-svelte": "^7.1.2",
 		"@types/node": "^22.20.5",
 		"svelte": "^5.57.3",
 		"svelte-check": "^4.7.7",
 		"typescript": "^6.0.3",
 		"vite": "^8.3.5",
 		"vitest": "^5.0.5"
-	},
-	"overrides": {
-		"cookie": "^0.7.2"
 	}
 }

web/src/lib/ReportView.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import type { Document } from '$lib/api';
+	import type { Document } from '#lib/api.js';
 	import {
 		statusPill,
 		promotionLabel,
@@ -13,7 +13,7 @@
 		measurementSummary,
 		nodeClassFacts,
 		shortHash
-	} from '$lib/report';
+	} from '#lib/report.js';
 
 	// The engine's report, read-only. Section numbers follow the attestation
 	// template (docs/attestation-template.md), and the bounded statement's

web/src/lib/index.ts

@@ -1 +1 @@
-// place files you want to import through the `$lib` alias in this folder.
+// place files you want to import through the `#lib` subpath import (package.json `imports`) in this folder.

web/src/routes/+layout.svelte

@@ -1,12 +1,12 @@
 <script lang="ts">
 	import '../app.css';
-	import favicon from '$lib/assets/favicon.svg';
+	import favicon from '#lib/assets/favicon.svg';
 	import { onMount } from 'svelte';
 	import { page } from '$app/state';
-	import { health, feedStatus, type Health, type FeedStatus } from '$lib/api';
-	import { feedLine } from '$lib/console';
-	import { navSection } from '$lib/nav.svelte';
-	import Cairn from '$lib/Cairn.svelte';
+	import { health, feedStatus, type Health, type FeedStatus } from '#lib/api.js';
+	import { feedLine } from '#lib/console.js';
+	import { navSection } from '#lib/nav.svelte.js';
+	import Cairn from '#lib/Cairn.svelte';
 
 	let { children } = $props();
 	let engine = $state<Health | null>(null);

web/src/routes/+page.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { goto } from '$app/navigation';
-	import { health } from '$lib/api';
+	import { health } from '#lib/api.js';
 
 	// With a store, the console's home is the approved list; without one, the
 	// scan page, as before.

web/src/routes/activity/+page.svelte

@@ -1,8 +1,8 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { airlockLog, type AirlockEvent } from '$lib/api';
-	import Command from '$lib/Command.svelte';
-	import EventList from '$lib/EventList.svelte';
+	import { airlockLog, type AirlockEvent } from '#lib/api.js';
+	import Command from '#lib/Command.svelte';
+	import EventList from '#lib/EventList.svelte';
 
 	let events = $state<AirlockEvent[] | null>(null);
 	let error = $state('');

web/src/routes/approved/+page.svelte

@@ -1,9 +1,9 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { models, exportSnapshot, type Model } from '$lib/api';
-	import { stageLabel, stageTone, approvedSections, reasonBeyondLabel, acceptedLine } from '$lib/console';
-	import Command from '$lib/Command.svelte';
-	import When from '$lib/When.svelte';
+	import { models, exportSnapshot, type Model } from '#lib/api.js';
+	import { stageLabel, stageTone, approvedSections, reasonBeyondLabel, acceptedLine } from '#lib/console.js';
+	import Command from '#lib/Command.svelte';
+	import When from '#lib/When.svelte';
 
 	let list = $state<Model[] | null>(null);
 	let error = $state('');

web/src/routes/models/[id]/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { model, evidenceURL, type Model, type Document, type AirlockEvent } from '$lib/api';
+	import { model, evidenceURL, type Model, type Document, type AirlockEvent } from '#lib/api.js';
 	import {
 		stageLabel,
 		stageTone,
@@ -9,12 +9,12 @@
 		nextPurpose,
 		isApprovedList,
 		recheckLine
-	} from '$lib/console';
-	import { navSection } from '$lib/nav.svelte';
-	import ReportView from '$lib/ReportView.svelte';
-	import Command from '$lib/Command.svelte';
-	import EventList from '$lib/EventList.svelte';
-	import When from '$lib/When.svelte';
+	} from '#lib/console.js';
+	import { navSection } from '#lib/nav.svelte.js';
+	import ReportView from '#lib/ReportView.svelte';
+	import Command from '#lib/Command.svelte';
+	import EventList from '#lib/EventList.svelte';
+	import When from '#lib/When.svelte';
 
 	let m = $state<Model | null>(null);
 	let report = $state<Document | null>(null);

web/src/routes/pending/+page.svelte

@@ -1,8 +1,8 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { models, scanStaged, uploadAttestation, type Model } from '$lib/api';
-	import { stageLabel, stageTone, pendingHeading, reasonBeyondLabel, nextPurpose } from '$lib/console';
-	import Command from '$lib/Command.svelte';
+	import { models, scanStaged, uploadAttestation, type Model } from '#lib/api.js';
+	import { stageLabel, stageTone, pendingHeading, reasonBeyondLabel, nextPurpose } from '#lib/console.js';
+	import Command from '#lib/Command.svelte';
 
 	let list = $state<Model[] | null>(null);
 	let error = $state('');

web/src/routes/scan/+page.svelte

@@ -1,10 +1,10 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { scan, downloadReport, airlockLog, type AirlockEvent } from '$lib/api';
-	import { runScan, canDownload, type RunState } from '$lib/run';
-	import { availableLevels, selectable } from '$lib/report';
-	import ReportView from '$lib/ReportView.svelte';
-	import EventList from '$lib/EventList.svelte';
+	import { scan, downloadReport, airlockLog, type AirlockEvent } from '#lib/api.js';
+	import { runScan, canDownload, type RunState } from '#lib/run.js';
+	import { availableLevels, selectable } from '#lib/report.js';
+	import ReportView from '#lib/ReportView.svelte';
+	import EventList from '#lib/EventList.svelte';
 
 	let path = $state('');
 	let levelId = $state(selectable()?.id ?? '');

web/tsconfig.json

@@ -1,5 +1,6 @@
 {
-	"extends": "./.svelte-kit/tsconfig.json",
+	"extends": "$app/tsconfig",
+	"include": ["src", "*"],
 	"compilerOptions": {
 		"rewriteRelativeImportExtensions": true,
 		"allowJs": true,
@@ -12,9 +13,7 @@
 		"strict": true,
 		"moduleResolution": "bundler"
 	}
-	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
-	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
-	//
-	// To make changes to top-level options such as include and exclude, we recommend extending
-	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+	// SvelteKit 3's $app/tsconfig names no files, so include lists them. Path
+	// aliases are handled by https://svelte.dev/docs/kit/@sveltejs-kit-vite
+	// (the sveltekit() options in vite.config.ts).
 }

web/vite.config.ts

@@ -13,7 +13,12 @@ export default defineConfig({
 			// The wizard has no server-side logic, so it builds to static files
 			// that `socair serve` serves. The 200.html fallback answers any client
 			// route.
-			adapter: adapter({ fallback: '200.html' })
+			adapter: adapter({ fallback: '200.html' }),
+
+			// SvelteKit 3 polls for a new deployment every hour by default. The
+			// wizard ships inside the binary that serves it and never reads
+			// `updated`, so it does not poll.
+			version: { pollInterval: 0 }
 		})
 	],
 	// Dev mode: the wizard on :5173 talks to a local `socair serve` through