build(deps-dev): upgrade every dependency to its latest safe version

.github/dependabot.yml

@@ -1,16 +1,23 @@
 version: 2
 updates:
-  # GitHub Actions across all workflows. Keeps the SHA pins from rotting — the
+  # GitHub Actions across all workflows. Keeps the SHA pins from rotting - the
   # Node 20 deprecation slipped into many repos precisely because nothing watched
   # these.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
       day: monday
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns: ["*"]
+        exclude-patterns: ["chhoumann/obsidian-plugin-workflows*"]
+      # Toolkit bumps change release behavior, so they get their own PR. One
+      # group keeps the three release stubs on the same toolkit commit.
+      release-toolkit:
+        patterns: ["chhoumann/obsidian-plugin-workflows*"]
     commit-message:
       prefix: ci
     labels:
@@ -24,6 +31,10 @@ updates:
       interval: weekly
       day: monday
     open-pull-requests-limit: 10
+    # Mirrors minimumReleaseAge in pnpm-workspace.yaml.
+    cooldown:
+      default-days: 7
+      exclude: ["obsidian-e2e"]
     groups:
       dev-dependencies:
         dependency-type: development
@@ -38,3 +49,26 @@ updates:
       include: scope
     labels:
       - dependencies
+
+  # Docs site (website/package.json + website/pnpm-lock.yaml).
+  - package-ecosystem: npm
+    directory: /website
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    # Mirrors minimumReleaseAge in website/pnpm-workspace.yaml.
+    cooldown:
+      default-days: 7
+    groups:
+      # One group, because Astro, Starlight and starlight-links-validator
+      # require each other's new versions and must move in one PR.
+      website:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    commit-message:
+      # Emits build(website): - nothing here ships in the plugin, so these
+      # bumps must not match the release policy's build(deps).
+      prefix: build(website)
+    labels:
+      - dependencies

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Harden Runner
-              uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
               with:
                   egress-policy: audit
             - name: Checkout
@@ -33,7 +33,7 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
             - name: Use Node.js 24
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
               with:
                   node-version: 24
                   check-latest: true
@@ -48,7 +48,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Harden Runner
-              uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
               with:
                   egress-policy: audit
             - name: Checkout
@@ -58,7 +58,7 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
             - name: Use Node.js 24
-              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
               with:
                   node-version: 24
                   check-latest: true

.github/workflows/codeql.yml

@@ -29,19 +29,19 @@ jobs:
                 language: [javascript-typescript, actions]
         steps:
             - name: Harden Runner
-              uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
               with:
                   egress-policy: audit
             - name: Checkout
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+              uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
               with:
                   languages: ${{ matrix.language }}
                   queries: security-extended
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+              uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
               with:
                   category: "/language:${{ matrix.language }}"

.github/workflows/dependency-review.yml

@@ -22,7 +22,7 @@ jobs:
             pull-requests: write
         steps:
             - name: Harden Runner
-              uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
               with:
                   egress-policy: audit
             - name: Checkout

.github/workflows/pr-title.yml

@@ -21,7 +21,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Harden Runner
-              uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+              uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
               with:
                   egress-policy: audit
             - name: Lint PR title

.github/workflows/release-prepare.yml

@@ -40,7 +40,7 @@ jobs:
         permissions:
             contents: write
             pull-requests: write
-        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-prepare.yml@v4
+        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-prepare.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4
         with:
             plugin-name: metaedit
             package-manager: pnpm

.github/workflows/release-trigger.yml

@@ -40,7 +40,7 @@ jobs:
             actions: write
             contents: write
             pull-requests: read
-        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-validate.yml@v4
+        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-validate.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4
         with:
             pr-number: ${{ github.event.pull_request.number || inputs.pr-number }}
             plugin-name: metaedit

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
             contents: write
             id-token: write
             pull-requests: read
-        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release.yml@v4
+        uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4
         with:
             release-pr: ${{ inputs.releasePr }}
             plugin-name: metaedit

.gitignore

@@ -14,7 +14,6 @@ main.js
 
 # obsidian
 data.json
-/coverage/
 
 # Obsidian E2E harness (isolated per-worktree vaults, instances, failure artifacts)
 .obsidian-e2e-vaults

AGENTS.md

@@ -37,11 +37,10 @@ hand-written, committed release asset.
   merge waiting for self-approval.
 
 ## Build, Test, and Development Commands
-- `pnpm run dev`: watch-mode Rollup build, regenerating `main.js` as you edit.
-- `pnpm run build`: production Rollup bundle (`main.js`).
+- `pnpm run dev`: watch-mode esbuild build, regenerating `main.js` as you edit.
+- `pnpm run build`: typecheck, then the production esbuild bundle (`main.js`).
 - `pnpm run lint`: ESLint over the TypeScript sources.
 - `pnpm run test`: Vitest unit suite (jsdom-free, `node` environment).
-- `pnpm run test:coverage`: unit suite with V8 coverage.
 - `pnpm run test:e2e`: build, then run the live Obsidian E2E suite (`tests/e2e/`).
 - `pnpm run obsidian:e2e -- <command>`: run an `obsidian` CLI command against an
   isolated, auto-provisioned worktree instance (see below).

MOBILE_FINDINGS.md

@@ -67,7 +67,7 @@ vault open in Obsidian, and supports restore.
 Command:
 
 ```bash
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py deploy --vault notes --confirm-real-vault
+uv run scripts/mobile/metaedit_ios.py deploy --vault notes --confirm-real-vault
 ```
 
 Snapshot:
@@ -99,7 +99,7 @@ Deploy result:
 Command:
 
 ```bash
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py eval --file scripts/mobile/probes/issue99_frontmatter.js
+uv run scripts/mobile/metaedit_ios.py eval --file scripts/mobile/probes/issue99_frontmatter.js
 ```
 
 Result: `ok: true`.
@@ -128,7 +128,7 @@ parsed properties or the note text.
 Command:
 
 ```bash
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py eval --timeout 180 --file scripts/mobile/probes/core_smoke.js
+uv run scripts/mobile/metaedit_ios.py eval --timeout 180 --file scripts/mobile/probes/core_smoke.js
 ```
 
 Result: `ok: true`.
@@ -158,8 +158,8 @@ during the test window.
 Commands:
 
 ```bash
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py eval '(()=>{console.clear(); return "cleared";})()'
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py logs --seconds 10
+uv run scripts/mobile/metaedit_ios.py eval '(()=>{console.clear(); return "cleared";})()'
+uv run scripts/mobile/metaedit_ios.py logs --seconds 10
 ```
 
 Fresh post-probe result: no console errors or uncaught errors streamed.
@@ -169,7 +169,7 @@ Fresh post-probe result: no console errors or uncaught errors streamed.
 Command:
 
 ```bash
-uv run --no-project --with pymobiledevice3 python scripts/mobile/metaedit_ios.py restore --backup ~/.metaedit-mobile-backups/metaedit/<device>/notes/20260628T160849Z
+uv run scripts/mobile/metaedit_ios.py restore --backup ~/.metaedit-mobile-backups/metaedit/<device>/notes/20260628T160849Z
 ```
 
 Restore result:
@@ -190,10 +190,10 @@ and an open disposable scratch Obsidian vault are available. Android deploy has
 no backup/restore path, so it requires an explicit scratch-vault confirmation:
 
 ```bash
-uv run --no-project --with websockets python scripts/mobile/metaedit_android.py diagnose
-uv run --no-project --with websockets python scripts/mobile/metaedit_android.py deploy --confirm-scratch-vault
-uv run --no-project --with websockets python scripts/mobile/metaedit_android.py eval --file scripts/mobile/probes/issue99_frontmatter.js
-uv run --no-project --with websockets python scripts/mobile/metaedit_android.py eval --file scripts/mobile/probes/core_smoke.js
+uv run scripts/mobile/metaedit_android.py diagnose
+uv run scripts/mobile/metaedit_android.py deploy --confirm-scratch-vault
+uv run scripts/mobile/metaedit_android.py eval --file scripts/mobile/probes/issue99_frontmatter.js
+uv run scripts/mobile/metaedit_android.py eval --file scripts/mobile/probes/core_smoke.js
 ```
 
 ## Conclusion

esbuild.config.mjs

@@ -1,10 +1,9 @@
 import {builtinModules} from "node:module";
 import {readFile} from "node:fs/promises";
-import {dirname, join, sep} from "node:path";
+import {dirname, join, relative, sep} from "node:path";
 import {fileURLToPath} from "node:url";
 import esbuild from "esbuild";
-import esbuildSvelte from "esbuild-svelte";
-import sveltePreprocess from "svelte-preprocess";
+import {compile} from "svelte/compiler";
 
 const isProduction = process.argv.includes("production");
 const projectSrcDir = `${join(dirname(fileURLToPath(import.meta.url)), "src")}${sep}`;
@@ -55,6 +54,51 @@ function stripDevCommandBlocks() {
 	};
 }
 
+function toEsbuildMessage({message, start, end}, file, source) {
+	if (!start || !end) return {text: message};
+	const lineText = source.split(/\r\n|\r|\n/)[start.line - 1];
+	const lineEnd = start.line === end.line ? end.column : lineText.length;
+	return {
+		text: message,
+		location: {file, line: start.line, column: start.column, length: lineEnd - start.column, lineText},
+	};
+}
+
+// Registered first so no other loader can hand esbuild a rune module's source.
+function rejectSvelteRuneModules() {
+	return {
+		name: "reject-svelte-rune-modules",
+		setup(build) {
+			build.onLoad({filter: /\.svelte\.[cm]?[jt]s$/}, (args) => ({
+				errors: [{text: `Svelte rune modules (.svelte.js/.svelte.ts) are not supported by this build: ${args.path}`}],
+			}));
+		},
+	};
+}
+
+function compileSvelte() {
+	return {
+		name: "compile-svelte",
+		setup(build) {
+			build.onLoad({filter: /\.svelte$/}, async (args) => {
+				const source = await readFile(args.path, "utf8");
+				try {
+					const {js, warnings} = compile(source, {
+						filename: relative(process.cwd(), args.path),
+						css: "injected",
+					});
+					return {
+						contents: `${js.code}\n//# sourceMappingURL=${js.map.toUrl()}`,
+						warnings: warnings.map((warning) => toEsbuildMessage(warning, args.path, source)),
+					};
+				} catch (error) {
+					return {errors: [toEsbuildMessage(error, args.path, source)]};
+				}
+			});
+		},
+	};
+}
+
 const options = {
 	entryPoints: ["src/main.ts"],
 	bundle: true,
@@ -72,11 +116,9 @@ const options = {
 	},
 	logLevel: "info",
 	plugins: [
+		rejectSvelteRuneModules(),
 		...(isProduction ? [stripDevCommandBlocks()] : []),
-		esbuildSvelte({
-			compilerOptions: {css: "injected"},
-			preprocess: sveltePreprocess(),
-		}),
+		compileSvelte(),
 	],
 };