fix: address the code review findings

[dangreen]

Fixes the defects found by a review of the whole project. One commit, no behaviour left undocumented - every fix carries a regression test.

Variant selection - the implicit select was ANDed into an explicit one, so ?format=webp silently exported a jpg. The implicit defaults now apply only when nothing is selected; what the user does not pin is decided by the rule order, which the plugin and loader READMEs now state.

Dev server - variants were addressed by their bare file name, so a/logo.jpg and b/logo.jpg shared one url and served each other's bytes (and the cache thrashed between them). The dev url carries the manifest key now, while the storage stays flat: /@srcset/<key>/logo.jpg maps to <key>-logo.jpg.

Duplicate variants - widths at or above the source width resolved to one file and were encoded, stored and emitted twice, producing a duplicate srcMap key and two srcset candidates with one w descriptor. Deduplication now happens after resolution, keyed by the resolved identity, and a multiplier wins a collision so originMultiplier survives for the selection.

EXIF orientation - the pipeline dropped the orientation tag without rotating the pixels, so variants rendered rotated and every derived number was transposed. Sources are auto-oriented and the metadata reports the size a browser renders.

Other fixes - glob matchers normalize the path (rules never matched on Windows); the cli rejects unknown options instead of taking them for globs and stops on an output path collision; ?placeholder keeps the configured options; the loader's declarations no longer require webpack while it is an optional peer, and its development names keep converted siblings apart; an aborted dev request no longer leaks a file descriptor; the preact peer range matches what the source needs (verified against the published tarballs: root CSSProperties landed in 10.28).

Refactor - rule matching, fallthrough and deduplication were duplicated in the bundler integration and the cli; they live in SrcSetGenerator.generateAll now, together with SrcSetRule itself.

🤖 Generated with Claude Code

[coveralls]

Coverage Report for CI Build 32189116961

Coverage increased (+0.1%) to 91.609%

Details

• Coverage increased (+0.1%) from the base build.
• Patch coverage: 7 uncovered changes across 3 files (75 of 82 lines covered, 91.46%).
• 3 coverage regressions across 2 files.

Uncovered Changes

File	Changed	Covered	%
packages/cli/src/cli.ts	5	0	0.0%
packages/cli/src/run.ts	11	10	90.91%
packages/vite-plugin/src/dev.ts	12	11	91.67%
Total (13 files)	82	75	91.46%

Coverage Regressions

3 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
packages/loader/src/loader.ts	2	73.91%
packages/loader/src/template.ts	1	95.83%

---

Coverage Stats

Relevant Lines:	744
Covered Lines:	697
Line Coverage:	93.68%
Relevant Branches:	567
Covered Branches:	504
Branch Coverage:	88.89%
Branches in Coverage %:	Yes
Coverage Strength:	94924.87 hits per line

---

💛 - Coveralls