@geoql/doctor-core 1.1.1 → 1.2.0

package/dist/index.js

@@ -1,5 +1,4 @@
-import { a as listRules, c as InvalidConfigError, i as RULE_REGISTRY, l as BUILT_IN_RECOMMENDED, o as ConfigCycleError, r as validateConfig, s as ConfigFileNotFoundError, t as loadDoctorConfig } from "./load-yXDi-5ti.js";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { access, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
@@ -11,9 +10,23 @@ import { glob } from "tinyglobby";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { babelParse, parse } from "@vue/compiler-sfc";
+import { loadConfig } from "c12";
+import { z } from "zod";
 import { promisify } from "node:util";
 import process$1 from "node:process";
 import pc from "picocolors";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/annotations.ts
 function escapeProperty(value) {
 	return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A").replace(/,/g, "%2C");
@@ -54,7 +67,7 @@ async function readDeps(packageJsonPath) {
 }
 //#endregion
 //#region src/build-quality/check-eslint-plugin-vue.ts
-const RULE_ID$20 = "vue-doctor/build-quality/eslint-plugin-vue-installed";
+const RULE_ID$23 = "vue-doctor/build-quality/eslint-plugin-vue-installed";
 const DOCS$3 = "https://eslint.vuejs.org/";
 async function checkEslintPluginVue(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
@@ -63,7 +76,7 @@ async function checkEslintPluginVue(projectInfo) {
 	if (deps === null) return [];
 	if (deps.devDependencies["eslint-plugin-vue"]) return [];
 	return [{
-		ruleId: RULE_ID$20,
+		ruleId: RULE_ID$23,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -74,7 +87,7 @@ async function checkEslintPluginVue(projectInfo) {
 }
 //#endregion
 //#region src/build-quality/check-no-vue-cli.ts
-const RULE_ID$19 = "vue-doctor/build-quality/no-vue-cli";
+const RULE_ID$22 = "vue-doctor/build-quality/no-vue-cli";
 const DOCS$2 = "https://cli.vuejs.org/migrations/migrate-from-v4.html";
 function isOffendingKey(key) {
 	return key === "@vue/cli-service" || key.startsWith("vue-cli-plugin-");
@@ -86,7 +99,7 @@ async function checkNoVueCli(projectInfo) {
 	const offenders = [];
 	for (const key of [...Object.keys(deps.dependencies), ...Object.keys(deps.devDependencies)]) if (isOffendingKey(key) && !offenders.includes(key)) offenders.push(key);
 	return offenders.map((key, index) => ({
-		ruleId: RULE_ID$19,
+		ruleId: RULE_ID$22,
 		file: projectInfo.packageJsonPath,
 		line: index + 1,
 		column: 1,
@@ -148,7 +161,7 @@ function stripJsonComments(input) {
 }
 //#endregion
 //#region src/build-quality/check-tsconfig-strict.ts
-const RULE_ID$18 = "vue-doctor/build-quality/tsconfig-strict-required";
+const RULE_ID$21 = "vue-doctor/build-quality/tsconfig-strict-required";
 const DOCS$1 = "https://www.typescriptlang.org/tsconfig#strict";
 async function checkTsconfigStrict(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
@@ -162,7 +175,7 @@ async function checkTsconfigStrict(projectInfo) {
 	}
 	if (parsed.compilerOptions?.strict === true) return [];
 	return [{
-		ruleId: RULE_ID$18,
+		ruleId: RULE_ID$21,
 		file: tsconfigPath,
 		line: 1,
 		column: 1,
@@ -173,7 +186,7 @@ async function checkTsconfigStrict(projectInfo) {
 }
 //#endregion
 //#region src/build-quality/check-vue-tsc.ts
-const RULE_ID$17 = "vue-doctor/build-quality/vue-tsc-in-devDeps";
+const RULE_ID$20 = "vue-doctor/build-quality/vue-tsc-in-devDeps";
 const DOCS = "https://github.com/vuejs/language-tools/tree/master/packages/tsc";
 async function checkVueTsc(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
@@ -182,7 +195,7 @@ async function checkVueTsc(projectInfo) {
 	if (deps === null) return [];
 	if (deps.devDependencies["vue-tsc"]) return [];
 	return [{
-		ruleId: RULE_ID$17,
+		ruleId: RULE_ID$20,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -542,14 +555,14 @@ async function listVueResolutions(packageJsonPath) {
 }
 //#endregion
 //#region src/deps/check-duplicate-vue.ts
-const RULE_ID$16 = "vue-doctor/deps/duplicate-vue-versions";
+const RULE_ID$19 = "vue-doctor/deps/duplicate-vue-versions";
 async function checkDuplicateVue(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
 	const versions = await listVueResolutions(projectInfo.packageJsonPath);
 	const uniqueVersions = [...new Set(versions)];
 	if (uniqueVersions.length <= 1) return [];
 	return [{
-		ruleId: RULE_ID$16,
+		ruleId: RULE_ID$19,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -561,7 +574,7 @@ async function checkDuplicateVue(projectInfo) {
 }
 //#endregion
 //#region src/deps/check-vue-major-current.ts
-const RULE_ID$15 = "vue-doctor/deps/vue-major-current";
+const RULE_ID$18 = "vue-doctor/deps/vue-major-current";
 const DOCTOR_BUNDLED_VUE_FLOOR_MAJOR = 3;
 const DOCTOR_BUNDLED_VUE_FLOOR_MINOR = 5;
 function parseMajorMinor$1(version) {
@@ -580,7 +593,7 @@ function checkVueMajorCurrent(projectInfo) {
 	if (parsed.major !== DOCTOR_BUNDLED_VUE_FLOOR_MAJOR) return [];
 	if (parsed.minor >= DOCTOR_BUNDLED_VUE_FLOOR_MINOR) return [];
 	return [{
-		ruleId: RULE_ID$15,
+		ruleId: RULE_ID$18,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -606,20 +619,20 @@ async function checkDeps(projectInfo) {
 }
 //#endregion
 //#region src/project-info/parse-nuxt-config.ts
-const CONFIG_FILES = [
+const CONFIG_FILES$1 = [
 	"nuxt.config.ts",
 	"nuxt.config.js",
 	"nuxt.config.mjs"
 ];
-async function readConfigSource(dir) {
-	for (const name of CONFIG_FILES) try {
+async function readConfigSource$1(dir) {
+	for (const name of CONFIG_FILES$1) try {
 		return await readFile(join(dir, name), "utf8");
 	} catch {
 		continue;
 	}
 	return null;
 }
-function* objectEntries(obj) {
+function* objectEntries$1(obj) {
 	for (const prop of obj.properties) {
 		if (prop.type !== "Property") continue;
 		const key = prop.key;
@@ -627,8 +640,8 @@ function* objectEntries(obj) {
 		yield [key.name, prop.value];
 	}
 }
-function findEntry(obj, name) {
-	for (const [key, value] of objectEntries(obj)) if (key === name) return value;
+function findEntry$1(obj, name) {
+	for (const [key, value] of objectEntries$1(obj)) if (key === name) return value;
 }
 function stringLiteral(node) {
 	return node.type === "Literal" && typeof node.value === "string" ? node.value : void 0;
@@ -640,7 +653,7 @@ function unwrapDefault(decl) {
 	if (callee.name !== "defineNuxtConfig") return null;
 	return decl.arguments[0] ?? null;
 }
-function extractConfigObject(source) {
+function extractConfigObject$1(source) {
 	const exported = parseSync("nuxt.config.ts", source, {
 		sourceType: "module",
 		lang: "ts"
@@ -652,12 +665,12 @@ function extractConfigObject(source) {
 }
 function readNitroPreset(value) {
 	if (value.type !== "ObjectExpression") return void 0;
-	const preset = findEntry(value, "preset");
+	const preset = findEntry$1(value, "preset");
 	return preset ? stringLiteral(preset) : void 0;
 }
 function readImportsAutoImport(value) {
 	if (value.type !== "ObjectExpression") return void 0;
-	const node = findEntry(value, "autoImport");
+	const node = findEntry$1(value, "autoImport");
 	if (node?.type === "Literal" && typeof node.value === "boolean") return node.value;
 }
 function readModules(value) {
@@ -675,20 +688,20 @@ function readCompatibility(value) {
 }
 function readHtmlLang(value) {
 	if (value.type !== "ObjectExpression") return void 0;
-	const head = findEntry(value, "head");
+	const head = findEntry$1(value, "head");
 	if (head?.type !== "ObjectExpression") return void 0;
-	const htmlAttrs = findEntry(head, "htmlAttrs");
+	const htmlAttrs = findEntry$1(head, "htmlAttrs");
 	if (htmlAttrs?.type !== "ObjectExpression") return void 0;
-	const lang = findEntry(htmlAttrs, "lang");
+	const lang = findEntry$1(htmlAttrs, "lang");
 	return lang ? stringLiteral(lang) : void 0;
 }
 async function parseNuxtConfig(dir) {
-	const source = await readConfigSource(dir);
+	const source = await readConfigSource$1(dir);
 	if (source === null) return null;
 	const info = {};
-	const config = extractConfigObject(source);
+	const config = extractConfigObject$1(source);
 	if (!config) return info;
-	for (const [key, value] of objectEntries(config)) if (key === "compatibilityVersion") {
+	for (const [key, value] of objectEntries$1(config)) if (key === "compatibilityVersion") {
 		const compat = readCompatibility(value);
 		if (compat !== void 0) info.compatibilityVersion = compat;
 	} else if (key === "compatibilityDate") {
@@ -712,12 +725,12 @@ async function parseNuxtConfig(dir) {
 }
 //#endregion
 //#region src/nuxt/post-checks/compatibility-date-set.ts
-const RULE_ID$14 = "nuxt-doctor/nitro/compatibilityDate-set";
+const RULE_ID$17 = "nuxt-doctor/nitro/compatibilityDate-set";
 function checkCompatibilityDateSet(projectInfo, nuxtConfig) {
 	if (projectInfo.packageJsonPath === null) return [];
 	if (nuxtConfig?.compatibilityDate !== void 0) return [];
 	return [{
-		ruleId: RULE_ID$14,
+		ruleId: RULE_ID$17,
 		file: projectInfo.nuxtConfigPath ?? projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -728,12 +741,12 @@ function checkCompatibilityDateSet(projectInfo, nuxtConfig) {
 }
 //#endregion
 //#region src/nuxt/post-checks/lang-on-html.ts
-const RULE_ID$13 = "nuxt-doctor/seo/lang-on-html";
+const RULE_ID$16 = "nuxt-doctor/seo/lang-on-html";
 function checkLangOnHtml(projectInfo, nuxtConfig) {
 	if (projectInfo.packageJsonPath === null) return [];
 	if (nuxtConfig?.htmlLang !== void 0) return [];
 	return [{
-		ruleId: RULE_ID$13,
+		ruleId: RULE_ID$16,
 		file: projectInfo.nuxtConfigPath ?? projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -744,7 +757,7 @@ function checkLangOnHtml(projectInfo, nuxtConfig) {
 }
 //#endregion
 //#region src/nuxt/post-checks/nitro-cloudflare-preset.ts
-const RULE_ID$12 = "nuxt-doctor/cloudflare/nitro-cloudflare-preset";
+const RULE_ID$15 = "nuxt-doctor/cloudflare/nitro-cloudflare-preset";
 const CLOUDFLARE_PRESETS = new Set([
 	"cloudflare-pages",
 	"cloudflare-module",
@@ -756,7 +769,7 @@ function checkNitroCloudflarePreset(projectInfo) {
 	if (projectInfo.nitroPreset === null) return [];
 	if (CLOUDFLARE_PRESETS.has(projectInfo.nitroPreset)) return [];
 	return [{
-		ruleId: RULE_ID$12,
+		ruleId: RULE_ID$15,
 		file: projectInfo.nuxtConfigPath ?? projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -767,7 +780,7 @@ function checkNitroCloudflarePreset(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/no-modules-incompatible-with-nuxt-4.ts
-const RULE_ID$11 = "nuxt-doctor/modules-deps/no-modules-incompatible-with-nuxt-4";
+const RULE_ID$14 = "nuxt-doctor/modules-deps/no-modules-incompatible-with-nuxt-4";
 const INCOMPATIBLE_MODULES = new Set([
 	"@nuxtjs/composition-api",
 	"@nuxt/bridge",
@@ -780,7 +793,7 @@ async function checkNoModulesIncompatibleWithNuxt4(projectInfo) {
 	const offenders = [];
 	for (const key of [...Object.keys(deps.dependencies), ...Object.keys(deps.devDependencies)]) if (INCOMPATIBLE_MODULES.has(key) && !offenders.includes(key)) offenders.push(key);
 	return offenders.map((name, index) => ({
-		ruleId: RULE_ID$11,
+		ruleId: RULE_ID$14,
 		file: projectInfo.packageJsonPath,
 		line: index + 1,
 		column: 1,
@@ -791,7 +804,7 @@ async function checkNoModulesIncompatibleWithNuxt4(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/no-node-only-modules.ts
-const RULE_ID$10 = "nuxt-doctor/cloudflare/no-node-only-modules";
+const RULE_ID$13 = "nuxt-doctor/cloudflare/no-node-only-modules";
 const NODE_ONLY_MODULES = new Set(["fs-extra", "sharp"]);
 async function checkNoNodeOnlyModules(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
@@ -801,7 +814,7 @@ async function checkNoNodeOnlyModules(projectInfo) {
 	const offenders = [];
 	for (const key of [...Object.keys(deps.dependencies), ...Object.keys(deps.devDependencies)]) if (NODE_ONLY_MODULES.has(key) && !offenders.includes(key)) offenders.push(key);
 	return offenders.map((name, index) => ({
-		ruleId: RULE_ID$10,
+		ruleId: RULE_ID$13,
 		file: projectInfo.packageJsonPath,
 		line: index + 1,
 		column: 1,
@@ -811,8 +824,97 @@ async function checkNoNodeOnlyModules(projectInfo) {
 	}));
 }
 //#endregion
+//#region src/nuxt/post-checks/no-secret-in-public-runtime-config.ts
+const RULE_ID$12 = "nuxt-doctor/security/no-secret-in-public-runtime-config";
+const SECRET_KEY = /secret|password|passwd|token|jwt|api[-_]?key|private[-_]?key|bearer|credential/i;
+const CONFIG_FILES = [
+	"nuxt.config.ts",
+	"nuxt.config.js",
+	"nuxt.config.mjs"
+];
+function offsetToPosition(source, offset) {
+	let line = 1;
+	let lineStart = 0;
+	for (let i = 0; i < offset; i++) if (source.charCodeAt(i) === 10) {
+		line++;
+		lineStart = i + 1;
+	}
+	return {
+		line,
+		column: offset - lineStart + 1
+	};
+}
+async function readConfigSource(dir) {
+	for (const name of CONFIG_FILES) try {
+		const file = join(dir, name);
+		return {
+			source: await readFile(file, "utf8"),
+			file
+		};
+	} catch {
+		continue;
+	}
+	return null;
+}
+function* objectEntries(obj) {
+	for (const prop of obj.properties) {
+		if (prop.type !== "Property") continue;
+		const key = prop.key;
+		if (key.type !== "Identifier") continue;
+		yield [
+			key.name,
+			prop.value,
+			key
+		];
+	}
+}
+function findEntry(obj, name) {
+	for (const [key, value] of objectEntries(obj)) if (key === name) return value;
+}
+function extractConfigObject(source) {
+	const exported = parseSync("nuxt.config.ts", source, {
+		sourceType: "module",
+		lang: "ts"
+	}).program.body.find((n) => n.type === "ExportDefaultDeclaration");
+	if (!exported) return null;
+	const decl = exported.declaration;
+	if (decl.type === "ObjectExpression") return decl;
+	if (decl.type !== "CallExpression") return null;
+	const callee = decl.callee;
+	if (callee.type !== "Identifier" || callee.name !== "defineNuxtConfig") return null;
+	const arg = decl.arguments[0];
+	return arg?.type === "ObjectExpression" ? arg : null;
+}
+async function checkNoSecretInPublicRuntimeConfig(projectInfo) {
+	if (projectInfo.packageJsonPath === null) return [];
+	const config = await readConfigSource(projectInfo.rootDirectory);
+	if (config === null) return [];
+	const root = extractConfigObject(config.source);
+	if (!root) return [];
+	const runtimeConfig = findEntry(root, "runtimeConfig");
+	if (runtimeConfig?.type !== "ObjectExpression") return [];
+	const publicBlock = findEntry(runtimeConfig, "public");
+	if (publicBlock?.type !== "ObjectExpression") return [];
+	const issues = [];
+	for (const [name, , keyNode] of objectEntries(publicBlock)) {
+		if (!SECRET_KEY.test(name)) continue;
+		const offset = keyNode.start;
+		const position = offsetToPosition(config.source, offset);
+		issues.push({
+			ruleId: RULE_ID$12,
+			file: config.file,
+			line: position.line,
+			column: position.column,
+			severity: "error",
+			message: `runtimeConfig.public.${name} is serialized to the client bundle, exposing the secret. Move it to the private root of runtimeConfig.`,
+			recommendation: `Move ${name} out of runtimeConfig.public to the top level of runtimeConfig so it stays server-only.`
+		});
+	}
+	return issues;
+}
+//#endregion
 //#region src/nuxt/post-checks/nuxt-major-current.ts
-const RULE_ID$9 = "nuxt-doctor/structure/nuxt-major-current";
+const RULE_ID$11 = "nuxt-doctor/structure/nuxt-major-current";
 const DOCTOR_BUNDLED_NUXT_FLOOR_MAJOR = 4;
 const DOCTOR_BUNDLED_NUXT_FLOOR_MINOR = 4;
 function parseMajorMinor(version) {
@@ -831,7 +933,7 @@ function checkNuxtMajorCurrent(projectInfo) {
 	if (parsed.major !== DOCTOR_BUNDLED_NUXT_FLOOR_MAJOR) return [];
 	if (parsed.minor >= DOCTOR_BUNDLED_NUXT_FLOOR_MINOR) return [];
 	return [{
-		ruleId: RULE_ID$9,
+		ruleId: RULE_ID$11,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -842,7 +944,7 @@ function checkNuxtMajorCurrent(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/og-image-via-satori.ts
-const RULE_ID$8 = "nuxt-doctor/cloudflare/og-image-via-satori";
+const RULE_ID$10 = "nuxt-doctor/cloudflare/og-image-via-satori";
 const OG_IMAGE_MODULES = ["@nuxtjs/og-image", "nuxt-og-image"];
 async function checkOgImageViaSatori(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
@@ -852,7 +954,7 @@ async function checkOgImageViaSatori(projectInfo) {
 	const installed = new Set([...Object.keys(deps.dependencies), ...Object.keys(deps.devDependencies)]);
 	if (OG_IMAGE_MODULES.some((name) => installed.has(name))) return [];
 	return [{
-		ruleId: RULE_ID$8,
+		ruleId: RULE_ID$10,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -863,13 +965,13 @@ async function checkOgImageViaSatori(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/preset-defined-for-deploy-target.ts
-const RULE_ID$7 = "nuxt-doctor/nitro/preset-defined-for-deploy-target";
+const RULE_ID$9 = "nuxt-doctor/nitro/preset-defined-for-deploy-target";
 function checkPresetDefinedForDeployTarget(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
 	if (!projectInfo.hasWranglerConfig) return [];
 	if (projectInfo.nitroPreset !== null) return [];
 	return [{
-		ruleId: RULE_ID$7,
+		ruleId: RULE_ID$9,
 		file: projectInfo.nuxtConfigPath ?? projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -880,7 +982,7 @@ function checkPresetDefinedForDeployTarget(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/recommended-modules-installed.ts
-const RULE_ID$6 = "nuxt-doctor/modules-deps/recommended-modules-installed";
+const RULE_ID$8 = "nuxt-doctor/modules-deps/recommended-modules-installed";
 const RECOMMENDED_GROUPS = [
 	{
 		label: "@nuxt/image",
@@ -901,7 +1003,7 @@ async function checkRecommendedModulesInstalled(projectInfo) {
 	if (deps === null) return [];
 	const installed = new Set([...Object.keys(deps.dependencies), ...Object.keys(deps.devDependencies)]);
 	return RECOMMENDED_GROUPS.filter((group) => !group.candidates.some((name) => installed.has(name))).map((group, index) => ({
-		ruleId: RULE_ID$6,
+		ruleId: RULE_ID$8,
 		file: projectInfo.packageJsonPath,
 		line: index + 1,
 		column: 1,
@@ -912,7 +1014,7 @@ async function checkRecommendedModulesInstalled(projectInfo) {
 }
 //#endregion
 //#region src/nuxt/post-checks/runtime-config-typed.ts
-const RULE_ID$5 = "nuxt-doctor/nitro/runtime-config-typed";
+const RULE_ID$7 = "nuxt-doctor/nitro/runtime-config-typed";
 async function hasRuntimeConfigAugmentation(dir) {
 	const entries = await readdir(dir);
 	for (const name of entries) {
@@ -926,7 +1028,7 @@ async function checkRuntimeConfigTyped(projectInfo, nuxtConfig) {
 	if (nuxtConfig?.hasRuntimeConfig !== true) return [];
 	if (await hasRuntimeConfigAugmentation(projectInfo.rootDirectory)) return [];
 	return [{
-		ruleId: RULE_ID$5,
+		ruleId: RULE_ID$7,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -937,12 +1039,12 @@ async function checkRuntimeConfigTyped(projectInfo, nuxtConfig) {
 }
 //#endregion
 //#region src/nuxt/post-checks/uses-app-directory.ts
-const RULE_ID$4 = "nuxt-doctor/structure/uses-app-directory";
+const RULE_ID$6 = "nuxt-doctor/structure/uses-app-directory";
 function checkUsesAppDirectory(projectInfo) {
 	if (projectInfo.packageJsonPath === null) return [];
 	if (projectInfo.hasAppDir) return [];
 	return [{
-		ruleId: RULE_ID$4,
+		ruleId: RULE_ID$6,
 		file: projectInfo.packageJsonPath,
 		line: 1,
 		column: 1,
@@ -968,7 +1070,8 @@ async function checkNuxtProject(projectInfo) {
 		Promise.resolve(checkLangOnHtml(projectInfo, nuxtConfig)),
 		Promise.resolve(checkNitroCloudflarePreset(projectInfo)),
 		checkOgImageViaSatori(projectInfo),
-		checkNoNodeOnlyModules(projectInfo)
+		checkNoNodeOnlyModules(projectInfo),
+		checkNoSecretInPublicRuntimeConfig(projectInfo)
 	])).flat().map((issue) => ({
 		file: issue.file,
 		line: issue.line,
@@ -1391,7 +1494,11 @@ const VUE_DEFAULT_RULES = {
 	"vue-doctor/no-imports-from-vue-when-auto-imported": "warn",
 	"vue-doctor/reactivity/watch-without-cleanup": "warn",
 	"vue-doctor/composition/prefer-script-setup-for-new-files": "warn",
-	"vue-doctor/composition/defineProps-typed": "warn"
+	"vue-doctor/composition/defineProps-typed": "warn",
+	"vue-doctor/security/no-inner-html": "error",
+	"vue-doctor/security/no-eval-like": "error",
+	"vue-doctor/security/no-auth-token-in-web-storage": "warn",
+	"vue-doctor/security/no-secrets-in-source": "warn"
 };
 const NUXT_PLUGIN_RULES = {
 	"nuxt-doctor/ai-slop/no-process-client-server": "error",
@@ -1403,7 +1510,8 @@ const NUXT_PLUGIN_RULES = {
 	"nuxt-doctor/server-routes/validate-body-with-h3-v2": "warn",
 	"nuxt-doctor/server-routes/createError-on-failure": "warn",
 	"nuxt-doctor/hydration/no-document-in-setup": "error",
-	"nuxt-doctor/hydration/clientOnly-for-browser-apis": "error"
+	"nuxt-doctor/hydration/clientOnly-for-browser-apis": "error",
+	"nuxt-doctor/security/no-user-input-in-fetch-url": "warn"
 };
 const VUE_OXLINT_RULE_IDS = new Set([
 	"vue/no-export-in-script-setup",
@@ -1439,7 +1547,11 @@ const VUE_OXLINT_RULE_IDS = new Set([
 	"vue-doctor/reactivity/prefer-readonly-for-injected",
 	"vue-doctor/composition/prefer-script-setup-for-new-files",
 	"vue-doctor/composition/defineProps-typed",
-	"vue-doctor/performance/prefer-defineAsyncComponent-on-route"
+	"vue-doctor/performance/prefer-defineAsyncComponent-on-route",
+	"vue-doctor/security/no-inner-html",
+	"vue-doctor/security/no-eval-like",
+	"vue-doctor/security/no-auth-token-in-web-storage",
+	"vue-doctor/security/no-secrets-in-source"
 ]);
 const NUXT_OXLINT_RULE_IDS = new Set(Object.keys(NUXT_PLUGIN_RULES));
 function oxlintRuleAllowlist(framework) {
@@ -1577,11 +1689,10 @@ function resolveOxlintBin(fromDir) {
 }
 //#endregion
 //#region src/oxlint/errors.ts
-const STDERR_TAIL_LIMIT = 2e3;
 var OxlintSpawnFailed = class extends Error {
 	name = "OxlintSpawnFailed";
 	constructor(exitCode, stderr) {
-		const tail = stderr.slice(-STDERR_TAIL_LIMIT);
+		const tail = stderr.slice(-2e3);
 		super(`oxlint subprocess exited with code ${exitCode}: ${tail}`);
 	}
 };
@@ -1792,9 +1903,9 @@ async function parseSfcDescriptor(absPath) {
 }
 //#endregion
 //#region src/sfc/rules/no-mixed-options-and-composition-api.ts
-const RULE_ID$3 = "vue-doctor/sfc/no-mixed-options-and-composition-api";
-const MESSAGE$3 = "Mixed Options API in a <script setup> SFC. Move data/methods/computed/watch/lifecycle into <script setup> Composition API; keep <script> only for options like name/inheritAttrs. See https://vuejs.org/api/sfc-script-setup.html#usage-alongside-normal-script";
-const RECOMMENDATION$3 = "Move this option into the <script setup> block using the Composition API, or keep <script> only for options-only config such as name or inheritAttrs.";
+const RULE_ID$5 = "vue-doctor/sfc/no-mixed-options-and-composition-api";
+const MESSAGE$5 = "Mixed Options API in a <script setup> SFC. Move data/methods/computed/watch/lifecycle into <script setup> Composition API; keep <script> only for options like name/inheritAttrs. See https://vuejs.org/api/sfc-script-setup.html#usage-alongside-normal-script";
+const RECOMMENDATION$5 = "Move this option into the <script setup> block using the Composition API, or keep <script> only for options-only config such as name or inheritAttrs.";
 const DISALLOWED = new Set([
 	"data",
 	"methods",
@@ -1861,7 +1972,7 @@ function locate(content, offset, startLine, startColumn) {
 		column
 	};
 }
-function check$9(ctx) {
+function check$19(ctx) {
 	const { script, scriptSetup } = ctx.descriptor;
 	if (!script || !scriptSetup) return { diagnostics: [] };
 	const lang = script.lang === "ts" ? "ts" : "js";
@@ -1881,11 +1992,11 @@ function check$9(ctx) {
 			file: ctx.file,
 			line,
 			column,
-			ruleId: RULE_ID$3,
+			ruleId: RULE_ID$5,
 			severity: "error",
-			message: MESSAGE$3,
+			message: MESSAGE$5,
 			source: "sfc",
-			recommendation: RECOMMENDATION$3
+			recommendation: RECOMMENDATION$5
 		});
 	}
 	return { diagnostics };
@@ -1941,10 +2052,10 @@ function walkElements(root, visit) {
 }
 //#endregion
 //#region src/sfc/rules/nuxt/no-mixed-app-and-root-layout.ts
-const RULE_ID$2 = "nuxt-doctor/ai-slop/no-mixed-app-and-root-layout";
-const MESSAGE$2 = "Layout file renders<NuxtLayout> inside itself. This creates a nested layout chain where the root layout renders itself as a slot. Use<slot /> directly and let the page content flow through.";
-const RECOMMENDATION$2 = "Replace <NuxtLayout> in this layout file with <slot />. The layout slot is already provided by the parent layout wrapper.";
-function check$8(ctx) {
+const RULE_ID$4 = "nuxt-doctor/ai-slop/no-mixed-app-and-root-layout";
+const MESSAGE$4 = "Layout file renders<NuxtLayout> inside itself. This creates a nested layout chain where the root layout renders itself as a slot. Use<slot /> directly and let the page content flow through.";
+const RECOMMENDATION$4 = "Replace <NuxtLayout> in this layout file with <slot />. The layout slot is already provided by the parent layout wrapper.";
+function check$18(ctx) {
 	if (!isNuxtLayoutFile(ctx.relativePath)) return { diagnostics: [] };
 	const { template } = ctx.descriptor;
 	if (!template || !template.ast) return { diagnostics: [] };
@@ -1964,18 +2075,18 @@ function check$8(ctx) {
 		column: node.loc.start.column,
 		endLine: node.loc.end.line,
 		endColumn: node.loc.end.column,
-		ruleId: RULE_ID$2,
+		ruleId: RULE_ID$4,
 		severity: "warn",
-		message: MESSAGE$2,
+		message: MESSAGE$4,
 		source: "sfc",
-		recommendation: RECOMMENDATION$2
+		recommendation: RECOMMENDATION$4
 	}] };
 }
 //#endregion
 //#region src/sfc/rules/nuxt/og-image-defined.ts
-const RULE_ID$1 = "nuxt-doctor/seo/og-image-defined";
-const MESSAGE$1 = "Page uses SEO meta but has no og:image property. Open Graph images improve social sharing previews. Add an og:image value or install @nuxtjs/og-image for automatic OG images.";
-const RECOMMENDATION$1 = "Add ogImage: \"/path/to/image.png\" to useSeoMeta / useHead, or install @nuxtjs/og-image.";
+const RULE_ID$3 = "nuxt-doctor/seo/og-image-defined";
+const MESSAGE$3 = "Page uses SEO meta but has no og:image property. Open Graph images improve social sharing previews. Add an og:image value or install @nuxtjs/og-image for automatic OG images.";
+const RECOMMENDATION$3 = "Add ogImage: \"/path/to/image.png\" to useSeoMeta / useHead, or install @nuxtjs/og-image.";
 function hasOgImageInCall(program) {
 	for (const stmt of program.body) {
 		if (stmt.type !== "ExpressionStatement") continue;
@@ -2007,7 +2118,7 @@ function hasOgImageDep(packageJsonPath) {
 		return false;
 	}
 }
-function check$7(ctx) {
+function check$17(ctx) {
 	if (!isNuxtPageFile(ctx.relativePath)) return { diagnostics: [] };
 	const { scriptSetup } = ctx.descriptor;
 	if (!scriptSetup) return { diagnostics: [] };
@@ -2024,18 +2135,18 @@ function check$7(ctx) {
 		file: ctx.file,
 		line,
 		column,
-		ruleId: RULE_ID$1,
+		ruleId: RULE_ID$3,
 		severity: "warn",
-		message: MESSAGE$1,
+		message: MESSAGE$3,
 		source: "sfc",
-		recommendation: RECOMMENDATION$1
+		recommendation: RECOMMENDATION$3
 	}] };
 }
 //#endregion
 //#region src/sfc/rules/nuxt/use-seo-meta-on-public-page.ts
-const RULE_ID = "nuxt-doctor/seo/useSeoMeta-on-public-page";
-const MESSAGE = "Public page component is missing SEO metadata. Add useSeoMeta, useHead, or definePageMeta with a title so search engines can index it properly.";
-const RECOMMENDATION = "Call useSeoMeta({ title: \"...\" }) in<script setup> to define page title and meta tags for search engines and social previews.";
+const RULE_ID$2 = "nuxt-doctor/seo/useSeoMeta-on-public-page";
+const MESSAGE$2 = "Public page component is missing SEO metadata. Add useSeoMeta, useHead, or definePageMeta with a title so search engines can index it properly.";
+const RECOMMENDATION$2 = "Call useSeoMeta({ title: \"...\" }) in<script setup> to define page title and meta tags for search engines and social previews.";
 function hasTitleInCall(program) {
 	for (const stmt of program.body) {
 		if (stmt.type !== "ExpressionStatement") continue;
@@ -2054,7 +2165,7 @@ function hasTitleInCall(program) {
 	}
 	return false;
 }
-function check$6(ctx) {
+function check$16(ctx) {
 	if (!isNuxtPageFile(ctx.relativePath)) return { diagnostics: [] };
 	const { scriptSetup } = ctx.descriptor;
 	if (!scriptSetup) return { diagnostics: [] };
@@ -2069,11 +2180,11 @@ function check$6(ctx) {
 		file: ctx.file,
 		line,
 		column,
-		ruleId: RULE_ID,
+		ruleId: RULE_ID$2,
 		severity: "warn",
-		message: MESSAGE,
+		message: MESSAGE$2,
 		source: "sfc",
-		recommendation: RECOMMENDATION
+		recommendation: RECOMMENDATION$2
 	}] };
 }
 //#endregion
@@ -2081,19 +2192,19 @@ function check$6(ctx) {
 const SFC_RULES = [
 	{
 		id: "vue-doctor/sfc/no-mixed-options-and-composition-api",
-		check: check$9
+		check: check$19
 	},
 	{
 		id: "nuxt-doctor/seo/useSeoMeta-on-public-page",
-		check: check$6
+		check: check$16
 	},
 	{
 		id: "nuxt-doctor/seo/og-image-defined",
-		check: check$7
+		check: check$17
 	},
 	{
 		id: "nuxt-doctor/ai-slop/no-mixed-app-and-root-layout",
-		check: check$8
+		check: check$18
 	}
 ];
 //#endregion
@@ -2324,13 +2435,13 @@ async function parseSfc(absPath) {
 }
 //#endregion
 //#region src/template/directive-helpers.ts
-const NODE_DIRECTIVE$3 = 7;
+const NODE_DIRECTIVE$4 = 7;
 function findDirective(el, name) {
-	for (const prop of el.props) if (prop.type === NODE_DIRECTIVE$3 && prop.name === name) return prop;
+	for (const prop of el.props) if (prop.type === NODE_DIRECTIVE$4 && prop.name === name) return prop;
 }
 function findBindAttr(el, attrName) {
 	for (const prop of el.props) {
-		if (prop.type !== NODE_DIRECTIVE$3) continue;
+		if (prop.type !== NODE_DIRECTIVE$4) continue;
 		const dir = prop;
 		if (dir.name !== "bind") continue;
 		if (dir.arg?.content === attrName) return dir;
@@ -2341,7 +2452,7 @@ function findStaticAttr(el, attrName) {
 }
 //#endregion
 //#region src/template/rules/v-for-has-key.ts
-function check$5(ctx) {
+function check$15(ctx) {
 	const diagnostics = [];
 	walkElements(ctx.template, (el) => {
 		if (!findDirective(el, "for")) return;
@@ -2363,7 +2474,7 @@ function check$5(ctx) {
 }
 //#endregion
 //#region src/template/rules/v-if-v-for-precedence.ts
-function check$4(ctx) {
+function check$14(ctx) {
 	const diagnostics = [];
 	walkElements(ctx.template, (el) => {
 		const vIf = findDirective(el, "if");
@@ -2405,7 +2516,7 @@ function findLargeArrayBindings(script) {
 	} catch {}
 	return bindings;
 }
-function check$3(ctx) {
+function check$13(ctx) {
 	const diagnostics = [];
 	const largeArrays = ctx.script && ctx.script.length > 0 ? findLargeArrayBindings(ctx.script) : /* @__PURE__ */ new Map();
 	walkElements(ctx.template, (el) => {
@@ -2433,12 +2544,12 @@ function check$3(ctx) {
 }
 //#endregion
 //#region src/template/rules/no-inline-object-prop-in-list.ts
-const NODE_DIRECTIVE$2 = 7;
+const NODE_DIRECTIVE$3 = 7;
 function checkElement$2(el, inVForSubtree, ctx, diagnostics) {
-	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE$2 && p.name === "for");
+	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE$3 && p.name === "for");
 	const effectiveInVFor = inVForSubtree || isVFor;
 	if (effectiveInVFor) for (const prop of el.props) {
-		if (prop.type !== NODE_DIRECTIVE$2) continue;
+		if (prop.type !== NODE_DIRECTIVE$3) continue;
 		const dir = prop;
 		if (dir.name !== "bind") continue;
 		const attrName = dir.arg?.content;
@@ -2460,7 +2571,7 @@ function checkElement$2(el, inVForSubtree, ctx, diagnostics) {
 	}
 	for (const child of el.children) if (child.type === 1) checkElement$2(child, effectiveInVFor, ctx, diagnostics);
 }
-function check$2(ctx) {
+function check$12(ctx) {
 	const diagnostics = [];
 	function walk(node, inVForSubtree) {
 		if (node.type === 1) checkElement$2(node, inVForSubtree, ctx, diagnostics);
@@ -2476,7 +2587,7 @@ function check$2(ctx) {
 //#region src/template/rules/no-computed-getter-in-template-loop.ts
 const NODE_ELEMENT$1 = 1;
 const NODE_INTERPOLATION = 5;
-const NODE_DIRECTIVE$1 = 7;
+const NODE_DIRECTIVE$2 = 7;
 function isValueDeref(node) {
 	if (node.type !== "MemberExpression" || node.computed === true) return false;
 	const { object, property } = node;
@@ -2503,11 +2614,11 @@ function pushDiagnostic(el, loc, ctx, diagnostics) {
 	});
 }
 function checkElement$1(el, inVForSubtree, ctx, diagnostics) {
-	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE$1 && p.name === "for");
+	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE$2 && p.name === "for");
 	const effectiveInVFor = inVForSubtree || isVFor;
 	if (effectiveInVFor) {
 		for (const prop of el.props) {
-			if (prop.type !== NODE_DIRECTIVE$1) continue;
+			if (prop.type !== NODE_DIRECTIVE$2) continue;
 			const dir = prop;
 			if (dir.name !== "bind") continue;
 			if (containsValueDeref(dir.exp?.ast)) pushDiagnostic(el, dir.loc, ctx, diagnostics);
@@ -2519,7 +2630,7 @@ function checkElement$1(el, inVForSubtree, ctx, diagnostics) {
 	}
 	for (const child of el.children) if (child.type === NODE_ELEMENT$1) checkElement$1(child, effectiveInVFor, ctx, diagnostics);
 }
-function check$1(ctx) {
+function check$11(ctx) {
 	const diagnostics = [];
 	function walk(node, inVForSubtree) {
 		if (node.type === NODE_ELEMENT$1) checkElement$1(node, inVForSubtree, ctx, diagnostics);
@@ -2534,15 +2645,15 @@ function check$1(ctx) {
 //#endregion
 //#region src/template/rules/avoid-deep-v-bind-spread-in-list.ts
 const NODE_ELEMENT = 1;
-const NODE_DIRECTIVE = 7;
+const NODE_DIRECTIVE$1 = 7;
 function isIdentifierSpread(dir) {
 	return dir.name === "bind" && dir.arg === void 0 && dir.exp?.ast === null;
 }
 function checkElement(el, inVForSubtree, ctx, diagnostics) {
-	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE && p.name === "for");
+	const isVFor = el.props.some((p) => p.type === NODE_DIRECTIVE$1 && p.name === "for");
 	const effectiveInVFor = inVForSubtree || isVFor;
 	if (effectiveInVFor) for (const prop of el.props) {
-		if (prop.type !== NODE_DIRECTIVE) continue;
+		if (prop.type !== NODE_DIRECTIVE$1) continue;
 		const dir = prop;
 		if (!isIdentifierSpread(dir)) continue;
 		diagnostics.push({
@@ -2560,7 +2671,7 @@ function checkElement(el, inVForSubtree, ctx, diagnostics) {
 	}
 	for (const child of el.children) if (child.type === NODE_ELEMENT) checkElement(child, effectiveInVFor, ctx, diagnostics);
 }
-function check(ctx) {
+function check$10(ctx) {
 	const diagnostics = [];
 	function walk(node, inVForSubtree) {
 		if (node.type === NODE_ELEMENT) checkElement(node, inVForSubtree, ctx, diagnostics);
@@ -2573,30 +2684,442 @@ function check(ctx) {
 	return { diagnostics };
 }
 //#endregion
+//#region src/template/rules/no-v-html.ts
+function check$9(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		const vHtml = findDirective(el, "html");
+		if (!vHtml) return;
+		diagnostics.push({
+			file: ctx.file,
+			line: vHtml.loc.start.line,
+			column: vHtml.loc.start.column,
+			endLine: vHtml.loc.end.line,
+			endColumn: vHtml.loc.end.column,
+			ruleId: "vue-doctor/security/no-v-html",
+			severity: "error",
+			message: `<${el.tag}> uses v-html, which renders raw HTML and bypasses Vue's escaping — the primary XSS sink in Vue apps.`,
+			source: "template",
+			recommendation: "Render text with {{ }} interpolation, or sanitize the HTML with DOMPurify in a computed before binding it."
+		});
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-target-blank-without-rel.ts
+function unquote$1(raw) {
+	const trimmed = raw.trim();
+	const first = trimmed.charAt(0);
+	if ((first === "\"" || first === "'") && trimmed.endsWith(first)) return trimmed.slice(1, -1);
+	return trimmed;
+}
+function attrValue(el, name) {
+	const staticAttr = findStaticAttr(el, name);
+	if (staticAttr) return {
+		value: staticAttr.value?.content ?? "",
+		loc: staticAttr.loc
+	};
+	const bound = findBindAttr(el, name);
+	if (bound?.exp && "content" in bound.exp) return {
+		value: unquote$1(bound.exp.content),
+		loc: bound.loc
+	};
+}
+function check$8(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		if (el.tag !== "a") return;
+		const target = attrValue(el, "target");
+		if (!target || target.value !== "_blank") return;
+		const rel = attrValue(el, "rel");
+		if (rel && rel.value.includes("noopener")) return;
+		diagnostics.push({
+			file: ctx.file,
+			line: target.loc.start.line,
+			column: target.loc.start.column,
+			endLine: target.loc.end.line,
+			endColumn: target.loc.end.column,
+			ruleId: "vue-doctor/security/no-target-blank-without-rel",
+			severity: "warn",
+			message: `<a target="_blank"> without rel="noopener noreferrer" exposes the opener window to reverse-tabnabbing.`,
+			source: "template",
+			recommendation: "Add rel=\"noopener noreferrer\" to anchors that open in a new tab."
+		});
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-javascript-uri.ts
+const NODE_ATTRIBUTE$1 = 6;
+const URI_SINKS = new Set([
+	"href",
+	"src",
+	"srcset",
+	"action",
+	"xlink:href",
+	"formaction",
+	"poster",
+	"data"
+]);
+const DANGEROUS_SCHEME = /^\s*(?:javascript:|vbscript:|data:text\/html)/i;
+function unquote(raw) {
+	const trimmed = raw.trim();
+	const first = trimmed.charAt(0);
+	if ((first === "\"" || first === "'" || first === "`") && trimmed.endsWith(first)) return trimmed.slice(1, -1);
+	return trimmed;
+}
+function resolveUriProp(prop) {
+	if (prop.type === NODE_ATTRIBUTE$1) {
+		const attr = prop;
+		if (attr.value === void 0) return void 0;
+		return {
+			name: attr.name,
+			value: attr.value.content,
+			loc: attr.loc
+		};
+	}
+	const dir = prop;
+	if (dir.name !== "bind") return void 0;
+	if (!dir.arg || !("content" in dir.arg)) return void 0;
+	if (!dir.exp || !("content" in dir.exp)) return void 0;
+	return {
+		name: dir.arg.content,
+		value: unquote(dir.exp.content),
+		loc: dir.loc
+	};
+}
+function check$7(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const prop of el.props) {
+			const resolved = resolveUriProp(prop);
+			if (!resolved) continue;
+			if (!URI_SINKS.has(resolved.name)) continue;
+			if (!DANGEROUS_SCHEME.test(resolved.value)) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: resolved.loc.start.line,
+				column: resolved.loc.start.column,
+				endLine: resolved.loc.end.line,
+				endColumn: resolved.loc.end.column,
+				ruleId: "vue-doctor/security/no-javascript-uri",
+				severity: "error",
+				message: `<${el.tag}> binds ${resolved.name} to a dangerous URI scheme (javascript:/vbscript:/data:text/html), which executes arbitrary code.`,
+				source: "template",
+				recommendation: "Use a safe http(s) or relative URL; never put a javascript:, vbscript:, or data:text/html value in a URL attribute."
+			});
+		}
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/class-attr-helpers.ts
+const NODE_ATTRIBUTE = 6;
+const NODE_DIRECTIVE = 7;
+/**
+* Collect the scannable text of every `class` source on an element: the static
+* `class="..."` value and any bound `:class` expression source. Bound
+* expressions are returned verbatim so a regex can match string-literal class
+* fragments inside ternaries, arrays, and objects without a full JS parse.
+*/
+function collectClassSources(el) {
+	const sources = [];
+	for (const prop of el.props) {
+		if (prop.type === NODE_ATTRIBUTE) {
+			const attr = prop;
+			if (attr.name === "class" && attr.value) sources.push({
+				text: attr.value.content,
+				loc: attr.loc
+			});
+		}
+		if (prop.type === NODE_DIRECTIVE) {
+			const dir = prop;
+			if (dir.name === "bind" && dir.arg && "content" in dir.arg && dir.arg.content === "class" && dir.exp && "content" in dir.exp) sources.push({
+				text: dir.exp.content,
+				loc: dir.loc
+			});
+		}
+	}
+	return sources;
+}
+/** Find a static `style="..."` attribute on an element, if present. */
+function findStaticStyle(el) {
+	for (const prop of el.props) if (prop.type === NODE_ATTRIBUTE && prop.name === "style") return prop;
+}
+//#endregion
+//#region src/template/rules/no-arbitrary-tailwind-values.ts
+const ARBITRARY_VALUE = /\[[^\]]+\]/;
+function check$6(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const source of collectClassSources(el)) {
+			if (!ARBITRARY_VALUE.test(source.text)) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: source.loc.start.line,
+				column: source.loc.start.column,
+				endLine: source.loc.end.line,
+				endColumn: source.loc.end.column,
+				ruleId: "vue-doctor/design/no-arbitrary-tailwind-values",
+				severity: "warn",
+				message: `<${el.tag}> uses a Tailwind arbitrary value (e.g. w-[412px]). Arbitrary values are design-system debt; repeated values should become @theme tokens.`,
+				source: "template",
+				recommendation: "Replace the arbitrary value with a design token defined in your @theme (e.g. w-container-lg)."
+			});
+		}
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-raw-hex-color.ts
+const HEX_COLOR = /#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})\b/;
+const RULE_ID$1 = "vue-doctor/design/no-raw-hex-color";
+const MESSAGE$1 = "Raw hex color bypasses the token system and breaks theming. Use a semantic color token instead.";
+const RECOMMENDATION$1 = "Replace the hex color with a design token (e.g. bg-danger / text-success) defined in your @theme.";
+function check$5(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const source of collectClassSources(el)) {
+			if (!HEX_COLOR.test(source.text)) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: source.loc.start.line,
+				column: source.loc.start.column,
+				endLine: source.loc.end.line,
+				endColumn: source.loc.end.column,
+				ruleId: RULE_ID$1,
+				severity: "warn",
+				message: `<${el.tag}> embeds a raw hex color in a class. ${MESSAGE$1}`,
+				source: "template",
+				recommendation: RECOMMENDATION$1
+			});
+		}
+		const style = findStaticStyle(el);
+		if (style?.value && HEX_COLOR.test(style.value.content)) diagnostics.push({
+			file: ctx.file,
+			line: style.loc.start.line,
+			column: style.loc.start.column,
+			endLine: style.loc.end.line,
+			endColumn: style.loc.end.column,
+			ruleId: RULE_ID$1,
+			severity: "warn",
+			message: `<${el.tag}> embeds a raw hex color in an inline style. ${MESSAGE$1}`,
+			source: "template",
+			recommendation: RECOMMENDATION$1
+		});
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-default-tailwind-palette.ts
+const DEFAULT_PALETTE = /(?:^|[\s:'"`])(?:bg|text|border|ring|shadow|from|via|to|accent|caret|fill|stroke|outline|decoration|divide|ring-offset|placeholder)-(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-\d{2,3}\b/;
+function check$4(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const source of collectClassSources(el)) {
+			if (!DEFAULT_PALETTE.test(source.text)) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: source.loc.start.line,
+				column: source.loc.start.column,
+				endLine: source.loc.end.line,
+				endColumn: source.loc.end.column,
+				ruleId: "vue-doctor/design/no-default-tailwind-palette",
+				severity: "warn",
+				message: `<${el.tag}> uses a default Tailwind palette utility (e.g. bg-blue-600). The default palette produces generic UI; map colors to brand tokens.`,
+				source: "template",
+				recommendation: "Map the color to a brand token (e.g. bg-primary-600) defined in your @theme instead of the default palette."
+			});
+		}
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-important-utility.ts
+const IMPORTANT_UTILITY = /(?:^|[\s:'"`])!-?[a-z][a-z0-9-]*/;
+function check$3(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const source of collectClassSources(el)) {
+			if (!IMPORTANT_UTILITY.test(source.text)) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: source.loc.start.line,
+				column: source.loc.start.column,
+				endLine: source.loc.end.line,
+				endColumn: source.loc.end.column,
+				ruleId: "vue-doctor/design/no-important-utility",
+				severity: "warn",
+				message: `<${el.tag}> uses a !important Tailwind utility (e.g. !bg-red-500). !important is a specificity escape hatch that makes maintenance harder.`,
+				source: "template",
+				recommendation: "Remove the ! prefix and resolve the specificity conflict at its source instead of forcing !important."
+			});
+		}
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-hardcoded-inline-style.ts
+const HARDCODED_VALUE = /\d+px\b|#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})\b/;
+function check$2(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		const style = findStaticStyle(el);
+		if (!style?.value) return;
+		if (!HARDCODED_VALUE.test(style.value.content)) return;
+		diagnostics.push({
+			file: ctx.file,
+			line: style.loc.start.line,
+			column: style.loc.start.column,
+			endLine: style.loc.end.line,
+			endColumn: style.loc.end.column,
+			ruleId: "vue-doctor/design/no-hardcoded-inline-style",
+			severity: "warn",
+			message: `<${el.tag}> uses an inline style with hardcoded px or hex values. Inline styles bypass tokens, hurt caching, and create drift.`,
+			source: "template",
+			recommendation: "Move the styling to token-based utility classes (e.g. w-60 text-neutral-700) instead of an inline style."
+		});
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-missing-alt.ts
+const IMAGE_TAGS = new Set([
+	"img",
+	"NuxtImg",
+	"nuxt-img"
+]);
+function check$1(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		if (!IMAGE_TAGS.has(el.tag)) return;
+		if (findStaticAttr(el, "alt") ?? findBindAttr(el, "alt")) return;
+		diagnostics.push({
+			file: ctx.file,
+			line: el.loc.start.line,
+			column: el.loc.start.column,
+			endLine: el.loc.end.line,
+			endColumn: el.loc.end.column,
+			ruleId: "vue-doctor/design/no-missing-alt",
+			severity: "warn",
+			message: `<${el.tag}> has no alt attribute. Screen readers and SEO depend on descriptive alt text.`,
+			source: "template",
+			recommendation: "Add an alt attribute describing the image, or alt=\"\" for purely decorative images."
+		});
+	});
+	return { diagnostics };
+}
+//#endregion
+//#region src/template/rules/no-absurd-z-index.ts
+const ABSURD_THRESHOLD = 1e3;
+const ARBITRARY_Z = /(?:^|[\s:'"`])-?z-\[(\d+)\]/;
+const INLINE_Z = /z-index\s*:\s*(\d+)/;
+const RULE_ID = "vue-doctor/design/no-absurd-z-index";
+const MESSAGE = "huge z-index values usually paper over layering bugs instead of fixing stacking context.";
+const RECOMMENDATION = "Use a small, tokenized z-index scale (e.g. z-modal) and fix the underlying stacking context.";
+function check(ctx) {
+	const diagnostics = [];
+	walkElements(ctx.template, (el) => {
+		for (const source of collectClassSources(el)) {
+			const match = ARBITRARY_Z.exec(source.text);
+			if (!match || Number(match[1]) < ABSURD_THRESHOLD) continue;
+			diagnostics.push({
+				file: ctx.file,
+				line: source.loc.start.line,
+				column: source.loc.start.column,
+				endLine: source.loc.end.line,
+				endColumn: source.loc.end.column,
+				ruleId: RULE_ID,
+				severity: "warn",
+				message: `<${el.tag}> uses an absurd z-index class (>= ${ABSURD_THRESHOLD}); ${MESSAGE}`,
+				source: "template",
+				recommendation: RECOMMENDATION
+			});
+		}
+		const style = findStaticStyle(el);
+		if (style?.value) {
+			const match = INLINE_Z.exec(style.value.content);
+			if (match && Number(match[1]) >= ABSURD_THRESHOLD) diagnostics.push({
+				file: ctx.file,
+				line: style.loc.start.line,
+				column: style.loc.start.column,
+				endLine: style.loc.end.line,
+				endColumn: style.loc.end.column,
+				ruleId: RULE_ID,
+				severity: "warn",
+				message: `<${el.tag}> uses an absurd inline z-index (>= ${ABSURD_THRESHOLD}); ${MESSAGE}`,
+				source: "template",
+				recommendation: RECOMMENDATION
+			});
+		}
+	});
+	return { diagnostics };
+}
+//#endregion
 //#region src/template/rules/index.ts
 const TEMPLATE_RULES = [
 	{
 		id: "vue-doctor/template/v-for-has-key",
-		check: check$5
+		check: check$15
 	},
 	{
 		id: "vue-doctor/template/v-if-v-for-precedence",
-		check: check$4
+		check: check$14
 	},
 	{
 		id: "vue-doctor/template/v-memo-on-large-list",
-		check: check$3
+		check: check$13
 	},
 	{
 		id: "vue-doctor/template/no-inline-object-prop-in-list",
-		check: check$2
+		check: check$12
 	},
 	{
 		id: "vue-doctor/template/no-computed-getter-in-template-loop",
-		check: check$1
+		check: check$11
 	},
 	{
 		id: "vue-doctor/template/avoid-deep-v-bind-spread-in-list",
+		check: check$10
+	},
+	{
+		id: "vue-doctor/security/no-v-html",
+		check: check$9
+	},
+	{
+		id: "vue-doctor/security/no-target-blank-without-rel",
+		check: check$8
+	},
+	{
+		id: "vue-doctor/security/no-javascript-uri",
+		check: check$7
+	},
+	{
+		id: "vue-doctor/design/no-arbitrary-tailwind-values",
+		check: check$6
+	},
+	{
+		id: "vue-doctor/design/no-raw-hex-color",
+		check: check$5
+	},
+	{
+		id: "vue-doctor/design/no-default-tailwind-palette",
+		check: check$4
+	},
+	{
+		id: "vue-doctor/design/no-important-utility",
+		check: check$3
+	},
+	{
+		id: "vue-doctor/design/no-hardcoded-inline-style",
+		check: check$2
+	},
+	{
+		id: "vue-doctor/design/no-missing-alt",
+		check: check$1
+	},
+	{
+		id: "vue-doctor/design/no-absurd-z-index",
 		check
 	}
 ];
@@ -2696,7 +3219,7 @@ async function audit(config = {}) {
 	if (config.deadCode !== false) {
 		const deadCodeStart = performance.now();
 		try {
-			const { loadDoctorConfig } = await import("./load-yXDi-5ti.js").then((n) => n.n);
+			const { loadDoctorConfig } = await Promise.resolve().then(() => load_exports);
 			deadCodeDiagnostics = dedupeDeadCodeAgainstLint(await checkDeadCode({
 				projectInfo: project,
 				doctorConfig: await loadDoctorConfig(rootDir),
@@ -2799,11 +3322,946 @@ async function audit(config = {}) {
 	};
 }
 //#endregion
+//#region src/config/built-in.ts
+const BUILT_IN_RECOMMENDED = {
+	include: [
+		"**/*.vue",
+		"**/*.ts",
+		"**/*.tsx",
+		"**/*.js",
+		"**/*.jsx"
+	],
+	exclude: [
+		"node_modules",
+		"dist",
+		".nuxt",
+		".output",
+		"coverage"
+	],
+	failOn: "error",
+	threshold: 0,
+	rules: {}
+};
+//#endregion
+//#region src/config/errors.ts
+var ConfigFileNotFoundError = class extends Error {
+	name = "ConfigFileNotFoundError";
+	constructor(path) {
+		super(`Config file not found: ${path}`);
+	}
+};
+var ConfigCycleError = class extends Error {
+	name = "ConfigCycleError";
+	constructor(chain) {
+		super(`Config extends cycle detected: ${chain.join(" -> ")}`);
+	}
+};
+var InvalidConfigError = class extends Error {
+	name = "InvalidConfigError";
+	issues;
+	constructor(message, issues = []) {
+		super(message);
+		this.issues = issues;
+	}
+};
+//#endregion
 //#region src/config/define-config.ts
 function defineConfig(config) {
 	return config;
 }
 //#endregion
+//#region src/rule-registry.ts
+const RULE_REGISTRY = [
+	{
+		id: "vue/no-export-in-script-setup",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/require-typed-ref",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-arrow-functions-in-watch",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-data-object-declaration",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-events-api",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-destroyed-lifecycle",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-model-definition",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-delete-set",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-deprecated-vue-config-keycodes",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-lifecycle-after-await",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-this-in-before-route-enter",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/return-in-computed-property",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/valid-define-emits",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/valid-define-props",
+		severity: "error",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-required-prop-with-default",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/prefer-import-from-vue",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-import-compiler-macros",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/no-multiple-slot-args",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/require-default-export",
+		severity: "warn",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: true
+	},
+	{
+		id: "vue/define-emits-declaration",
+		severity: "info",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: false
+	},
+	{
+		id: "vue/define-props-declaration",
+		severity: "info",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: false
+	},
+	{
+		id: "vue/define-props-destructuring",
+		severity: "info",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: false
+	},
+	{
+		id: "vue/max-props",
+		severity: "info",
+		category: "vue-builtin",
+		source: "oxlint-builtin",
+		recommended: false
+	},
+	{
+		id: "vue-doctor/no-em-dash-in-string",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/no-destructure-props-without-to-refs",
+		severity: "error",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/no-destructure-reactive-without-to-refs",
+		severity: "error",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/no-non-null-assertion-on-ref-value",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/no-imports-from-vue-when-auto-imported",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/reactivity/watch-without-cleanup",
+		severity: "warn",
+		category: "reactivity",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/reactivity/prefer-shallowRef-for-large-data",
+		severity: "info",
+		category: "reactivity",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "vue-doctor/reactivity/prefer-readonly-for-injected",
+		severity: "info",
+		category: "reactivity",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "vue-doctor/composition/prefer-script-setup-for-new-files",
+		severity: "warn",
+		category: "composition",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/composition/defineProps-typed",
+		severity: "warn",
+		category: "composition",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/performance/prefer-defineAsyncComponent-on-route",
+		severity: "info",
+		category: "performance",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "vue-doctor/template/v-for-has-key",
+		severity: "error",
+		category: "template",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/template/v-if-v-for-precedence",
+		severity: "error",
+		category: "template",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/template/v-memo-on-large-list",
+		severity: "warn",
+		category: "performance",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/template/no-inline-object-prop-in-list",
+		severity: "warn",
+		category: "performance",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/template/no-computed-getter-in-template-loop",
+		severity: "warn",
+		category: "template-perf",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/template/avoid-deep-v-bind-spread-in-list",
+		severity: "info",
+		category: "template-perf",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/sfc/no-mixed-options-and-composition-api",
+		severity: "warn",
+		category: "sfc",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/build-quality/tsconfig-strict-required",
+		severity: "warn",
+		category: "build-quality",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/build-quality/vue-tsc-in-devDeps",
+		severity: "warn",
+		category: "build-quality",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/build-quality/no-vue-cli",
+		severity: "warn",
+		category: "build-quality",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/build-quality/eslint-plugin-vue-installed",
+		severity: "info",
+		category: "build-quality",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/deps/duplicate-vue-versions",
+		severity: "error",
+		category: "deps",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/deps/vue-major-current",
+		severity: "info",
+		category: "deps",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "dead-code/unused-file",
+		severity: "warn",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/unused-export",
+		severity: "warn",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/unused-type-export",
+		severity: "info",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/unused-member",
+		severity: "info",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/unused-dependency",
+		severity: "warn",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/unlisted-dependency",
+		severity: "error",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "dead-code/duplicate-export",
+		severity: "warn",
+		category: "dead-code",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/structure/uses-app-directory",
+		severity: "warn",
+		category: "structure",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/structure/nuxt-major-current",
+		severity: "info",
+		category: "structure",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "nuxt-doctor/modules-deps/no-modules-incompatible-with-nuxt-4",
+		severity: "warn",
+		category: "modules-deps",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/modules-deps/recommended-modules-installed",
+		severity: "info",
+		category: "modules-deps",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "nuxt-doctor/nitro/compatibilityDate-set",
+		severity: "error",
+		category: "nitro",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/nitro/preset-defined-for-deploy-target",
+		severity: "warn",
+		category: "nitro",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/nitro/runtime-config-typed",
+		severity: "info",
+		category: "nitro",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "nuxt-doctor/seo/lang-on-html",
+		severity: "warn",
+		category: "seo",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/seo/useSeoMeta-on-public-page",
+		severity: "warn",
+		category: "seo",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/seo/og-image-defined",
+		severity: "warn",
+		category: "seo",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/cloudflare/nitro-cloudflare-preset",
+		severity: "warn",
+		category: "cloudflare",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/cloudflare/og-image-via-satori",
+		severity: "info",
+		category: "cloudflare",
+		source: "doctor",
+		recommended: false
+	},
+	{
+		id: "nuxt-doctor/cloudflare/no-node-only-modules",
+		severity: "warn",
+		category: "cloudflare",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/data-fetching/no-shared-key-across-pages",
+		severity: "warn",
+		category: "data-fetching",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/data-fetching/ssr-safe-onMounted-only-for-client",
+		severity: "warn",
+		category: "data-fetching",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/ai-slop/no-mixed-app-and-root-layout",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/ai-slop/no-process-client-server",
+		severity: "error",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/ai-slop/no-explicit-imports-of-auto-imported",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/ai-slop/no-useState-for-server-data",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/ai-slop/no-fetch-in-setup",
+		severity: "warn",
+		category: "ai-slop",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/data-fetching/useAsyncData-key-required-in-loop",
+		severity: "error",
+		category: "data-fetching",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/server-routes/defineEventHandler-typed",
+		severity: "warn",
+		category: "server-routes",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/server-routes/validate-body-with-h3-v2",
+		severity: "warn",
+		category: "server-routes",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/server-routes/createError-on-failure",
+		severity: "warn",
+		category: "server-routes",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/hydration/no-document-in-setup",
+		severity: "error",
+		category: "hydration",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/hydration/clientOnly-for-browser-apis",
+		severity: "error",
+		category: "hydration",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-v-html",
+		severity: "error",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-inner-html",
+		severity: "error",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-eval-like",
+		severity: "error",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-auth-token-in-web-storage",
+		severity: "warn",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-secrets-in-source",
+		severity: "warn",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-target-blank-without-rel",
+		severity: "warn",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/security/no-javascript-uri",
+		severity: "error",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/security/no-secret-in-public-runtime-config",
+		severity: "error",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "nuxt-doctor/security/no-user-input-in-fetch-url",
+		severity: "warn",
+		category: "security",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-arbitrary-tailwind-values",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-raw-hex-color",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-default-tailwind-palette",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-important-utility",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-hardcoded-inline-style",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-missing-alt",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	},
+	{
+		id: "vue-doctor/design/no-absurd-z-index",
+		severity: "warn",
+		category: "design",
+		source: "doctor",
+		recommended: true
+	}
+];
+function listRules(filter = {}) {
+	let rules = [...RULE_REGISTRY];
+	if (filter.preset === "recommended") rules = rules.filter((r) => r.recommended);
+	if (filter.category) rules = rules.filter((r) => r.category === filter.category);
+	if (filter.source) rules = rules.filter((r) => r.source === filter.source);
+	if (filter.severity) rules = rules.filter((r) => r.severity === filter.severity);
+	return rules.sort((a, b) => a.id.localeCompare(b.id));
+}
+//#endregion
+//#region src/config/presets.ts
+const PRESET_NAMES = [
+	"minimal",
+	"recommended",
+	"strict",
+	"all"
+];
+function isPresetName(value) {
+	return PRESET_NAMES.includes(value);
+}
+/**
+* Resolve a preset name to its base ruleId -> Severity map.
+*
+* - `minimal`     : errors only (warn/info turned off)
+* - `recommended` : errors + warns (info off) — same as today's default
+* - `strict`      : errors + warns + infos all on at registered severity
+* - `all`         : alias of `strict` for now; reserved to surface every
+*                   known ruleId regardless of preset opt-in policy
+*
+* The returned map is the BASE; downstream code merges user config
+* `rules:` on top, then CLI `--rule` overrides on top of that.
+*/
+function resolvePreset(name) {
+	const rules = {};
+	for (const rule of RULE_REGISTRY) if (name === "minimal") {
+		if (rule.severity === "error") rules[rule.id] = "error";
+	} else if (name === "recommended") {
+		if (rule.severity === "error" || rule.severity === "warn") rules[rule.id] = rule.severity;
+	} else rules[rule.id] = rule.severity;
+	return rules;
+}
+//#endregion
+//#region src/config/schema.ts
+/**
+* A rule severity level as accepted in user config. `off` disables a rule
+* (removing it from the resolved preset base); the other three mirror the
+* internal {@link import('../types.js').Severity} vocabulary.
+*/
+const LevelSchema = z.enum([
+	"error",
+	"warn",
+	"info",
+	"off"
+]);
+/**
+* The accepted shape of a single `rules` entry. Doctor config only ever takes
+* a bare severity string (no `[level, options]` tuple, no `{ level }` object) —
+* this matches the historical hand-rolled validator exactly.
+*/
+const RuleEntrySchema = LevelSchema;
+const ruleIds = RULE_REGISTRY.map((rule) => rule.id);
+/**
+* Dynamic `rules` object: every registered rule id is a known optional key, and
+* a `catchall` keeps unknown keys parseable so {@link DoctorUserConfigSchema}'s
+* `superRefine` can report them with a precise path. Building the object from
+* RULE_REGISTRY is what lets `z.toJSONSchema()` enumerate the known ids.
+*/
+const RulesSchema = z.object(Object.fromEntries(ruleIds.map((id) => [id, RuleEntrySchema.optional()]))).catchall(RuleEntrySchema.optional());
+/**
+* Scalar fields of the user config. `.loose()` preserves unknown top-level keys
+* (forward-compatibility, matching the old validator which ignored them) and is
+* required so a `$schema` editor hint round-trips untouched.
+*/
+const BaseUserConfigSchema = z.object({
+	$schema: z.string().optional(),
+	rootDir: z.string().optional(),
+	include: z.array(z.string()).optional(),
+	exclude: z.array(z.string()).optional(),
+	failOn: z.enum([
+		"error",
+		"warn",
+		"none"
+	]).optional(),
+	threshold: z.int().min(0).max(100).optional(),
+	preset: z.enum([
+		"minimal",
+		"recommended",
+		"strict",
+		"all"
+	], { error: "must be one of 'minimal', 'recommended', 'strict', 'all'" }).optional(),
+	extends: z.array(z.string()).optional(),
+	fixExcludes: z.array(z.string()).optional(),
+	rules: RulesSchema.optional()
+}).loose();
+/**
+* The single source of truth for doctor config validation. Wraps the base
+* object in a `superRefine` that rejects any unknown rule id with a
+* `rules.<id>` path, so a typo'd rule surfaces as an `InvalidConfigError`
+* rather than silently doing nothing.
+*/
+const DoctorUserConfigSchema = BaseUserConfigSchema.superRefine((value, ctx) => {
+	const rules = value.rules;
+	if (!rules) return;
+	const known = new Set(ruleIds);
+	for (const key of Object.keys(rules)) if (!known.has(key)) ctx.addIssue({
+		code: "custom",
+		path: ["rules", key],
+		message: `unknown rule id ${JSON.stringify(key)}`
+	});
+});
+/**
+* Generate the JSON Schema for the user config. Built from the base object
+* (not the refined wrapper) so `z.toJSONSchema` emits the full property set,
+* including every enumerated rule id. The result is what gets written to
+* `schema.json` and served from the docs site.
+*/
+function buildJsonSchema() {
+	return z.toJSONSchema(BaseUserConfigSchema);
+}
+//#endregion
+//#region src/config/validate.ts
+/**
+* Render a single zod issue into the historical hand-rolled message format
+* (`<path>: <message>`), so InvalidConfigError.message stays backward-compatible
+* with callers that assert on substrings like `threshold`, `failOn`, or
+* `rules.foo/bar`. A root-level issue (empty path) maps to the legacy
+* `config: must be an object` wording.
+*/
+function formatIssue(issue) {
+	if (issue.path.length === 0) return "config: must be an object";
+	return `${issue.path.map((segment) => String(segment)).join(".")}: ${issue.message}`;
+}
+/**
+* Validate a raw, untrusted config object against the zod schema — the single
+* source of truth. Throws {@link InvalidConfigError} (carrying the full zod
+* issue list) on the first failure, mirroring the legacy validator's
+* throw-on-first-error contract.
+*/
+function validateConfig(raw) {
+	const result = DoctorUserConfigSchema.safeParse(raw);
+	if (result.success) return;
+	const { issues } = result.error;
+	throw new InvalidConfigError(formatIssue(issues[0]), issues);
+}
+//#endregion
+//#region src/config/load.ts
+var load_exports = /* @__PURE__ */ __exportAll({ loadDoctorConfig: () => loadDoctorConfig });
+const SOURCE_MAP = {
+	ts: "ts",
+	mjs: "mjs",
+	js: "js",
+	json: "json",
+	jsonc: "jsonc"
+};
+async function loadDoctorConfig(rootDir, explicitPathOrOptions) {
+	const opts = typeof explicitPathOrOptions === "string" ? { explicitPath: explicitPathOrOptions } : explicitPathOrOptions ?? {};
+	const explicitPath = opts.explicitPath;
+	if (opts.presetOverride !== void 0 && !isPresetName(opts.presetOverride)) throw new InvalidConfigError(`preset: must be one of 'minimal', 'recommended', 'strict', 'all', got ${JSON.stringify(opts.presetOverride)}`);
+	if (explicitPath) {
+		if (!existsSync(resolve(rootDir, explicitPath))) throw new ConfigFileNotFoundError(explicitPath);
+	}
+	const chain = [];
+	const result = await loadConfig({
+		cwd: rootDir,
+		name: "doctor",
+		packageJson: "doctor",
+		rcFile: false,
+		globalRc: false,
+		...explicitPath ? { configFile: resolve(rootDir, explicitPath) } : {},
+		resolve(source, options) {
+			const base = options.cwd;
+			const key = resolve(base, source);
+			if (chain.includes(key)) throw new ConfigCycleError([...chain, key]);
+			chain.push(key);
+		}
+	});
+	const raw = result.config;
+	validateConfig(raw);
+	let source;
+	let configFile;
+	if (explicitPath) {
+		source = "flag";
+		configFile = resolve(rootDir, explicitPath);
+	} else if (result._configFile) {
+		source = SOURCE_MAP[extname(result._configFile).slice(1)];
+		configFile = result._configFile;
+	} else if (Object.keys(raw).length > 0) {
+		source = "package.json";
+		configFile = resolve(rootDir, "package.json");
+	} else {
+		source = "built-in";
+		configFile = void 0;
+	}
+	const presetName = opts.presetOverride ?? raw.preset ?? "recommended";
+	const presetRules = resolvePreset(presetName);
+	const userRules = {};
+	const userOff = /* @__PURE__ */ new Set();
+	if (raw.rules && typeof raw.rules === "object") for (const [key, value] of Object.entries(raw.rules)) if (value === "off") userOff.add(key);
+	else userRules[key] = value;
+	const mergedRules = {
+		...presetRules,
+		...userRules
+	};
+	for (const key of userOff) delete mergedRules[key];
+	return {
+		rootDir,
+		include: raw.include ?? BUILT_IN_RECOMMENDED.include,
+		exclude: raw.exclude ?? BUILT_IN_RECOMMENDED.exclude,
+		failOn: raw.failOn ?? BUILT_IN_RECOMMENDED.failOn,
+		threshold: raw.threshold ?? BUILT_IN_RECOMMENDED.threshold,
+		rules: mergedRules,
+		preset: presetName,
+		source,
+		configFile,
+		...raw.fixExcludes ? { fixExcludes: raw.fixExcludes } : {}
+	};
+}
+//#endregion
 //#region src/config/merge-cli-overrides.ts
 function mergeCliOverrides(resolved, cli) {
 	const rules = { ...resolved.rules };
@@ -3474,6 +4932,177 @@ function format(input, kind = "agent", options) {
 	return agentReport(input, options);
 }
 //#endregion
+//#region src/rule-prompt.ts
+function cliForRule(ruleId) {
+	return ruleId.startsWith("nuxt-doctor/") ? "@geoql/nuxt-doctor" : "@geoql/vue-doctor";
+}
+function presetLine(doc) {
+	return doc.recommended ? "This rule is part of the `recommended` preset, so it runs by default." : `This rule is off by default in \`recommended\`; enable it with \`--rule ${doc.id}:warn\` or in \`doctor.config.ts\`.`;
+}
+function article(word) {
+	return /^[aeiou]/i.test(word) ? "an" : "a";
+}
+function whyThisMatters(doc) {
+	const severityNote = doc.severity === "error" ? "It is an `error`-severity rule: a finding is a correctness, security, or hard-correctness defect that should block a clean audit." : doc.severity === "warn" ? "It is a `warn`-severity rule: a finding is a likely bug, performance trap, or AI-slop pattern worth fixing before shipping." : "It is an `info`-severity rule: a finding is an opt-in suggestion that nudges the code toward the idiomatic Vue 3 / Nuxt 4 pattern.";
+	return `\`${doc.id}\` is ${article(doc.severity)} ${doc.severity}-severity ${doc.category} rule from ${doc.source}. ${severityNote}\n\n${presetLine(doc)}`;
+}
+function howToFix(doc, cli) {
+	return [
+		`Open each file the audit flags for \`${doc.id}\` and edit the offending code in the working tree directly.`,
+		"",
+		`1. Read the canonical rule reference at ${doc.helpUri} for the full rationale and the idiomatic ${doc.category} pattern.`,
+		`2. Apply the smallest change that resolves the ${doc.category} concern without altering unrelated behavior — do not suppress the finding with an inline disable unless the rule is a genuine false positive for that line.`,
+		`3. Run \`npx ${cli} explain ${doc.id}\` for an inline summary of the severity, category, and help link while you work.`,
+		"",
+		"Fix by severity: resolve `error` findings first, then `warn`, then `info`."
+	].join("\n");
+}
+function howToValidate(doc, cli) {
+	return [
+		"Re-run the audit scoped to just this rule and confirm it reports zero findings:",
+		"",
+		"```bash",
+		`npx ${cli} --rule ${doc.id}:error --full`,
+		"```",
+		"",
+		`A clean run (no diagnostics for \`${doc.id}\`) means the fix is complete. If findings remain, repeat the "How to fix" steps on the still-flagged files.`
+	].join("\n");
+}
+/**
+* Render a self-contained "fix + validate" markdown recipe for a single rule.
+* Returns `null` for an unknown rule id. Pure: derives everything from the
+* rule's `RuleDoc` (id, severity, category, source, recommended, helpUri).
+*/
+function renderRulePrompt(ruleId) {
+	const doc = loadRuleDoc(ruleId);
+	if (!doc) return null;
+	const cli = cliForRule(doc.id);
+	return [
+		`# Fix: \`${doc.id}\``,
+		"",
+		`> **Rule** \`${doc.id}\` · **Severity** \`${doc.severity}\` · **Category** \`${doc.category}\` · **Source** \`${doc.source}\``,
+		"",
+		"## Why this matters",
+		"",
+		whyThisMatters(doc),
+		"",
+		"## How to fix",
+		"",
+		howToFix(doc, cli),
+		"",
+		"## How to validate",
+		"",
+		howToValidate(doc, cli),
+		"",
+		"## Reference",
+		"",
+		`Canonical rule documentation: ${doc.helpUri}`,
+		""
+	].join("\n");
+}
+/**
+* Render the canonical agent playbook: the scan → filter → triage → fix →
+* validate loop an AI agent follows when cleaning up doctor diagnostics. Pure
+* markdown; fetched on demand by the agent skill at runtime.
+*/
+function renderAgentPlaybook() {
+	return [
+		"# Doctor Agent Playbook",
+		"",
+		"You are an AI agent cleaning up `@geoql/doctor` findings in a Vue 3 / Nuxt 4",
+		"codebase. Doctor does not generate code — it critiques the code you just",
+		"wrote. Follow this loop exactly.",
+		"",
+		"## Guardrails",
+		"",
+		"- Edit the working tree directly to fix findings.",
+		"- **NEVER commit.** Leave staging and committing to the human.",
+		"- **NEVER open a pull request**, push a branch, or run any git write command.",
+		"- Never weaken a rule to make a finding disappear; fix the underlying code.",
+		"",
+		"## Pick the right CLI",
+		"",
+		"Use `npx @geoql/nuxt-doctor` for a Nuxt 4 project (it runs the Vue passes",
+		"too) and `npx @geoql/vue-doctor` for a standalone Vue 3 project. The flags",
+		`below are identical for both. Doctor ships ~${loadAllRuleDocs().length} rules across the vue,`,
+		"nuxt, and oxlint-builtin plugins.",
+		"",
+		"## The loop",
+		"",
+		"### 1. Scan",
+		"",
+		"Audit only what changed so you stay focused on your own edits:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor --diff      # findings in files changed vs HEAD",
+		"npx @geoql/vue-doctor --staged    # findings in staged files only",
+		"npx @geoql/vue-doctor --full      # complete scan (overrides --diff/--staged)",
+		"```",
+		"",
+		"For a quick health gate, read just the score:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor --score     # prints a single 0-100 integer",
+		"```",
+		"",
+		"### 2. Filter",
+		"",
+		"Get the machine-readable report and work from it:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor --diff --json",
+		"```",
+		"",
+		"Group the diagnostics by `ruleId`. Drop nothing — every finding is in scope",
+		"unless the human told you otherwise.",
+		"",
+		"### 3. Triage",
+		"",
+		"Order the work by severity: `error` first, then `warn`, then `info`. To",
+		"understand a single rule before touching code:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor explain <rule>     # severity, category, help link",
+		"npx @geoql/vue-doctor list-rules         # every registered rule (alias: rules)",
+		"```",
+		"",
+		"### 4. Fix",
+		"",
+		"For each rule with findings, fetch the canonical per-rule recipe and apply",
+		"it to every flagged file:",
+		"",
+		"```bash",
+		"curl --fail --silent --show-error \\",
+		"  https://docs.the-doctor.report/prompts/rules/<plugin>/<rule>.md",
+		"```",
+		"",
+		"For example, `vue-doctor/template/v-for-has-key` lives at",
+		"`/prompts/rules/vue-doctor/template/v-for-has-key.md`. Each recipe explains",
+		"why the rule matters, how to fix it, and how to validate the fix. Edit the",
+		"working tree directly — never an inline disable unless it is a true false",
+		"positive.",
+		"",
+		"### 5. Validate",
+		"",
+		"After fixing a rule, re-run the audit scoped to just that rule and confirm",
+		"zero findings:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor --rule <rule>:error --full",
+		"```",
+		"",
+		"Then re-run the full scan and confirm the score did not regress:",
+		"",
+		"```bash",
+		"npx @geoql/vue-doctor --full --score",
+		"```",
+		"",
+		"Repeat the loop until the score is clean. Hand the working tree back to the",
+		"human to review and commit.",
+		""
+	].join("\n");
+}
+//#endregion
 //#region src/audit-filter.ts
 /**
 * Filter `report.diagnostics` to a known set of allowed rule ids, then
@@ -3633,6 +5262,6 @@ async function pushFindings(opts) {
 	}
 }
 //#endregion
-export { BUILT_IN_RECOMMENDED, ConfigCycleError, ConfigFileNotFoundError, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, InvalidConfigError, OxlintOutputTooLarge, OxlintSpawnFailed, RULE_REGISTRY, agentReport, applyInlineDisables, audit, buildDoctorReport, buildPushPayload, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, filterReportByRules, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, pushFindings, renderDetectSummary, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, stripFindings, validateConfig };
+export { BUILT_IN_RECOMMENDED, ConfigCycleError, ConfigFileNotFoundError, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, DoctorUserConfigSchema, InvalidConfigError, LevelSchema, OxlintOutputTooLarge, OxlintSpawnFailed, RULE_REGISTRY, RuleEntrySchema, agentReport, applyInlineDisables, audit, buildDoctorReport, buildJsonSchema, buildPushPayload, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, filterReportByRules, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, pushFindings, renderAgentPlaybook, renderDetectSummary, renderRulePrompt, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, stripFindings, validateConfig };
 
 //# sourceMappingURL=index.js.map