@pyreon/lint 0.12.12 → 0.12.14

package/lib/cli.js

@@ -1,8 +1,15 @@
 #!/usr/bin/env node
 import { existsSync, readFileSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
+import path, { dirname, join, relative, resolve } from "node:path";
 import { Visitor, parseSync } from "oxc-parser";
 
+//#region \0rolldown/runtime.js
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
+	if (typeof require !== "undefined") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+});
+
+//#endregion
 //#region src/cache.ts
 /**
 * Simple in-memory cache for parsed ASTs keyed by file content hash.
@@ -249,7 +256,6 @@ const BROWSER_GLOBALS = new Set([
 	"localStorage",
 	"sessionStorage",
 	"indexedDB",
-	"fetch",
 	"XMLHttpRequest",
 	"WebSocket",
 	"requestAnimationFrame",
@@ -438,6 +444,44 @@ const toastA11y = {
 	}
 };
 
+//#endregion
+//#region src/utils/exempt-paths.ts
+function isPathExempt(ctx) {
+	const raw = ctx.getOptions().exemptPaths;
+	if (!Array.isArray(raw) || raw.length === 0) return false;
+	const filePath = ctx.getFilePath();
+	for (const entry of raw) if (typeof entry === "string" && entry.length > 0 && filePath.includes(entry)) return true;
+	return false;
+}
+
+//#endregion
+//#region src/utils/file-roles.ts
+/**
+* Universal file-path classifiers for lint rules.
+*
+* What belongs here:
+*   - Conventions that exist in every project the linter runs on
+*     (test files, example directories — the `*.test.*` convention
+*     is not Pyreon-specific).
+*
+* What does NOT belong here:
+*   - Monorepo-specific paths like `packages/core/runtime-dom/` —
+*     those are implementation knowledge of one particular codebase
+*     and have no meaning in a user's app. Exemptions for such paths
+*     belong in the consuming project's lint config via the
+*     `exemptPaths: string[]` rule option — see `utils/exempt-paths.ts`
+*     and the Pyreon monorepo's `.pyreonlintrc.json` at repo root for
+*     reference.
+*/
+/**
+* Matches files that are tests by convention. Universal — the
+* `*.test.*` / `*.spec.*` / `/tests/` / `/__tests__/` conventions
+* exist in every codebase this linter runs on, not just Pyreon.
+*/
+function isTestFile(filePath) {
+	return filePath.includes("/tests/") || filePath.includes("/test/") || filePath.includes("/__tests__/") || filePath.includes(".test.") || filePath.includes(".spec.");
+}
+
 //#endregion
 //#region src/rules/architecture/dev-guard-warnings.ts
 const devGuardWarnings = {
@@ -446,26 +490,122 @@ const devGuardWarnings = {
 		category: "architecture",
 		description: "Require console.warn/error calls to be wrapped in `if (__DEV__)` guards.",
 		severity: "error",
-		fixable: false
+		fixable: false,
+		schema: {
+			exemptPaths: "string[]",
+			devFlagNames: "string[]"
+		}
 	},
 	create(context) {
-		const filePath = context.getFilePath();
-		if (filePath.includes("/tests/") || filePath.includes("/test/") || filePath.includes("/examples/") || filePath.includes(".test.") || filePath.includes(".spec.")) return {};
+		if (isTestFile(context.getFilePath())) return {};
+		if (isPathExempt(context)) return {};
+		const userFlagNames = context.getOptions().devFlagNames;
+		const extraFlagNames = Array.isArray(userFlagNames) ? userFlagNames.filter((n) => typeof n === "string") : [];
+		const devFlagBoundConsts = /* @__PURE__ */ new Set();
+		function exprResolvesToDevFlag(expr) {
+			if (!expr) return false;
+			if (expr.type === "ChainExpression") return exprResolvesToDevFlag(expr.expression);
+			if (isDevFlag(expr)) return true;
+			if (expr.type === "BinaryExpression" && (expr.operator === "===" || expr.operator === "==")) return exprResolvesToDevFlag(expr.left) || exprResolvesToDevFlag(expr.right);
+			return false;
+		}
+		const DEV_FLAG_NAMES = new Set([
+			"__DEV__",
+			"IS_DEV",
+			"IS_DEVELOPMENT",
+			"isDev",
+			...extraFlagNames
+		]);
+		function isDevFlag(node) {
+			if (!node) return false;
+			if (node.type === "ChainExpression") return isDevFlag(node.expression);
+			if (node.type === "Identifier" && DEV_FLAG_NAMES.has(node.name)) return true;
+			if (node.type === "Identifier" && devFlagBoundConsts.has(node.name)) return true;
+			if (node.type === "MemberExpression" && node.property?.type === "Identifier" && node.property.name === "DEV") {
+				const obj = node.object;
+				if (obj?.type === "MemberExpression" && obj.property?.type === "Identifier" && obj.property.name === "env" && obj.object?.type === "MetaProperty") return true;
+			}
+			return false;
+		}
+		function containsDevGuard(test) {
+			if (!test) return false;
+			if (isDevFlag(test)) return true;
+			if (test.type === "LogicalExpression" && test.operator === "&&") return containsDevGuard(test.left) || containsDevGuard(test.right);
+			if (test.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==")) return isDevFlag(test.left) || isDevFlag(test.right);
+			return false;
+		}
+		function isEarlyReturnDevGuard(node) {
+			if (!node || node.type !== "IfStatement") return false;
+			const t = node.test;
+			const arg = t?.type === "UnaryExpression" && t.operator === "!" ? t.argument : null;
+			if (!arg) return false;
+			if (!isDevFlag(arg)) return false;
+			const c = node.consequent;
+			if (c?.type === "ReturnStatement") return true;
+			if (c?.type === "BlockStatement" && c.body.length === 1 && c.body[0]?.type === "ReturnStatement") return true;
+			return false;
+		}
 		let devGuardDepth = 0;
+		let catchDepth = 0;
+		const funcGuardStack = [];
+		function enterFunction(node) {
+			const body = node?.body;
+			const stmts = body?.type === "BlockStatement" ? body.body : null;
+			let guarded = 0;
+			if (stmts && stmts.length > 0 && isEarlyReturnDevGuard(stmts[0])) {
+				guarded = 1;
+				devGuardDepth++;
+			}
+			funcGuardStack.push(guarded);
+		}
+		function exitFunction() {
+			const g = funcGuardStack.pop() ?? 0;
+			if (g > 0) devGuardDepth -= g;
+		}
 		return {
+			VariableDeclaration(node) {
+				for (const decl of node.declarations ?? []) if (decl.id?.type === "Identifier" && exprResolvesToDevFlag(decl.init)) devFlagBoundConsts.add(decl.id.name);
+			},
+			FunctionDeclaration: enterFunction,
+			"FunctionDeclaration:exit": exitFunction,
+			FunctionExpression: enterFunction,
+			"FunctionExpression:exit": exitFunction,
+			ArrowFunctionExpression: enterFunction,
+			"ArrowFunctionExpression:exit": exitFunction,
 			IfStatement(node) {
-				if (node.test?.type === "Identifier" && node.test.name === "__DEV__") devGuardDepth++;
+				if (containsDevGuard(node.test)) devGuardDepth++;
 			},
 			"IfStatement:exit"(node) {
-				if (node.test?.type === "Identifier" && node.test.name === "__DEV__") devGuardDepth--;
+				if (containsDevGuard(node.test)) devGuardDepth--;
+			},
+			LogicalExpression(node) {
+				if (node.operator === "&&" && containsDevGuard(node.left)) devGuardDepth++;
+			},
+			"LogicalExpression:exit"(node) {
+				if (node.operator === "&&" && containsDevGuard(node.left)) devGuardDepth--;
+			},
+			ConditionalExpression(node) {
+				if (containsDevGuard(node.test)) devGuardDepth++;
+			},
+			"ConditionalExpression:exit"(node) {
+				if (containsDevGuard(node.test)) devGuardDepth--;
+			},
+			CatchClause() {
+				catchDepth++;
+			},
+			"CatchClause:exit"() {
+				catchDepth--;
 			},
 			CallExpression(node) {
 				if (devGuardDepth > 0) return;
 				const callee = node.callee;
-				if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === "console" && callee.property?.type === "Identifier" && (callee.property.name === "warn" || callee.property.name === "error")) context.report({
-					message: `\`console.${callee.property.name}()\` without \`__DEV__\` guard — dev warnings must be tree-shakeable in production. Wrap in \`if (__DEV__) { ... }\`.`,
-					span: getSpan(node)
-				});
+				if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === "console" && callee.property?.type === "Identifier" && (callee.property.name === "warn" || callee.property.name === "error")) {
+					if (callee.property.name === "error" && catchDepth > 0) return;
+					context.report({
+						message: `\`console.${callee.property.name}()\` without \`__DEV__\` guard — dev warnings must be tree-shakeable in production. Wrap in \`if (__DEV__) { ... }\` (or \`__DEV__ && ...\`). Production error logging in \`catch\` blocks is exempt for \`console.error\`.`,
+						span: getSpan(node)
+					});
+				}
 			}
 		};
 	}
@@ -502,7 +642,9 @@ const noCircularImport = {
 		fixable: false
 	},
 	create(context) {
-		const fileLayer = getFileLayer(context.getFilePath());
+		const filePath = context.getFilePath();
+		if (isTestFile(filePath)) return {};
+		const fileLayer = getFileLayer(filePath);
 		if (fileLayer === null) return {};
 		return { ImportDeclaration(node) {
 			const source = node.source?.value;
@@ -692,34 +834,19 @@ const noErrorWithoutPrefix = {
 * Does NOT delete the const declaration — that has to happen by hand because
 * the variable name and downstream usages may need updating in callers.
 *
-* **Server-package exception**: server-only files run in Node where `process`
-* is always defined, so the pattern is correct there. The rule skips files
-* matching `packages/zero/`, `packages/core/server/`, `packages/core/runtime-server/`,
-* `packages/tools/vite-plugin/`, and any file containing `/server/` in its
-* path. Add new server packages to `SERVER_PACKAGE_PATTERNS` below.
-*/
-/**
-* File-path patterns for server-only packages. Substring match against the
-* file path passed to the rule. Patterns intentionally do NOT start with `/`
-* so they match both absolute paths (`/Users/.../packages/zero/...`) and
-* relative paths (`packages/zero/...`) — different lint runners pass paths
-* differently.
+* **Server-only exemption**: projects configure `exemptPaths` per-file for
+* server-only code (Node environments where `process` is always defined and
+* the pattern is correct). Configure in `.pyreonlintrc.json`:
+*
+*     {
+*       "rules": {
+*         "pyreon/no-process-dev-gate": [
+*           "error",
+*           { "exemptPaths": ["packages/zero/", "packages/core/server/"] }
+*         ]
+*       }
+*     }
 */
-const SERVER_PACKAGE_PATTERNS = [
-	"packages/zero/",
-	"packages/core/server/",
-	"packages/core/runtime-server/",
-	"packages/tools/vite-plugin/",
-	"packages/tools/cli/",
-	"packages/tools/lint/",
-	"packages/tools/mcp/",
-	"packages/tools/storybook/",
-	"packages/tools/typescript/",
-	"scripts/"
-];
-function isServerOnlyFile(filePath) {
-	return SERVER_PACKAGE_PATTERNS.some((pat) => filePath.includes(pat));
-}
 const noProcessDevGate = {
 	meta: {
 		id: "pyreon/no-process-dev-gate",
@@ -729,9 +856,8 @@ const noProcessDevGate = {
 		fixable: true
 	},
 	create(context) {
-		const filePath = context.getFilePath();
-		if (filePath.includes("/tests/") || filePath.includes("/test/") || filePath.includes("/__tests__/") || filePath.includes(".test.") || filePath.includes(".spec.")) return {};
-		if (isServerOnlyFile(filePath)) return {};
+		if (isTestFile(context.getFilePath())) return {};
+		if (isPathExempt(context)) return {};
 		/**
 		* Match the broken pattern at the AST level. We're looking for any
 		* `LogicalExpression` whose two sides are:
@@ -788,6 +914,185 @@ const noProcessDevGate = {
 	}
 };
 
+//#endregion
+//#region src/rules/architecture/require-browser-smoke-test.ts
+/**
+* `pyreon/require-browser-smoke-test` — every browser-categorized package
+* must ship at least one `*.browser.test.{ts,tsx}` file under `src/`.
+*
+* Locks in the durability of the T1.1 browser smoke harness (PRs #224,
+* #227, #229, #231). Without this rule, any new browser-running package
+* can quietly ship without a real-browser smoke test and we drift back
+* to the world before T1.1 — where happy-dom silently masks
+* environment-divergence bugs (PR #197 mock-vnode metadata drop, PR
+* #200 `typeof process` dead code, the multi-word event delegation bug
+* fixed alongside PR #231).
+*
+* **What it checks**: when linting a package's `src/index.ts`, the rule
+* looks at the package directory for any file matching
+* `**\/*.browser.test.{ts,tsx}`. If none are found AND the package's
+* name appears in the browser-categorized list, the rule reports an
+* error on `src/index.ts`.
+*
+* **Why src/index.ts only**: the rule needs to fire exactly once per
+* package, not per file. `src/index.ts` is a stable per-package entry
+* point. Files inside the package are not browser-test files
+* themselves, so they get skipped via the path check.
+*
+* **Default browser packages list**: matches the categorization in
+* `.claude/rules/test-environment-parity.md`. Override via the
+* `additionalPackages` option to opt in new packages, or via
+* `exemptPaths` to opt out (e.g. for a brand-new package still under
+* construction).
+*
+* @example Configuration in `.pyreonlintrc.json`
+* ```json
+* {
+*   "rules": {
+*     "pyreon/require-browser-smoke-test": [
+*       "error",
+*       {
+*         "additionalPackages": ["@my-org/my-browser-pkg"],
+*         "exemptPaths": ["packages/experimental/"]
+*       }
+*     ]
+*   }
+* }
+* ```
+*
+* **Known limitation — file existence, not test quality.** The rule only
+* checks that at least one `*.browser.test.*` file exists under `src/`;
+* it cannot assess whether the test is meaningful. A package could ship
+* `sanity.browser.test.ts` with `expect(1).toBe(1)` and satisfy the
+* rule. That's accepted by design — the rule is a *gate* against
+* packages shipping with zero smoke coverage, not a quality check.
+* Review the actual test contents on PR. If drive-by one-liner tests
+* become a pattern, add a per-package coverage threshold or a
+* complementary rule that inspects test file contents.
+*/
+/**
+* Single source of truth for browser-categorized packages lives at
+* `.claude/rules/browser-packages.json`. Loading it lazily here means:
+*
+*   1. Updating the list never requires re-publishing `@pyreon/lint`.
+*   2. The script `scripts/check-browser-smoke.ts` + the human-readable
+*      `.claude/rules/test-environment-parity.md` share the same source,
+*      so they can't drift out of sync silently.
+*
+* The JSON is searched for by walking up from the linted file's directory
+* to the first ancestor containing `.claude/rules/browser-packages.json`.
+* If not found (rule running in a consumer repo that doesn't ship the
+* JSON), the rule falls back to an empty list — `additionalPackages`
+* becomes the only signal and the rule stays opt-in, not a footgun.
+*
+* Cached globally because the list is tiny and lint runs lint thousands
+* of files per invocation.
+*/
+let _cachedBrowserPackages = null;
+function loadBrowserPackages(fromFile) {
+	if (_cachedBrowserPackages) return _cachedBrowserPackages;
+	let dir = path.dirname(fromFile);
+	for (let i = 0; i < 30; i++) {
+		const candidate = path.join(dir, ".claude", "rules", "browser-packages.json");
+		if (existsSync(candidate)) {
+			try {
+				const fs = __require("node:fs");
+				const parsed = JSON.parse(fs.readFileSync(candidate, "utf8"));
+				if (Array.isArray(parsed.packages)) {
+					_cachedBrowserPackages = new Set(parsed.packages.filter((p) => typeof p === "string"));
+					return _cachedBrowserPackages;
+				}
+			} catch {}
+			break;
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	_cachedBrowserPackages = /* @__PURE__ */ new Set();
+	return _cachedBrowserPackages;
+}
+/**
+* Walk a directory looking for `*.browser.test.{ts,tsx}` files. Bails
+* on the first match — we only need to know `at least one exists`,
+* not enumerate them. Skips `node_modules`, `lib`, `dist`, and dot
+* directories so a package's own dependencies don't pollute the check.
+*/
+function hasBrowserTest(dir) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return false;
+	}
+	for (const name of entries) {
+		if (name.startsWith(".") || name === "node_modules" || name === "lib" || name === "dist") continue;
+		const full = path.join(dir, name);
+		let isDir = false;
+		try {
+			isDir = statSync(full).isDirectory();
+		} catch {
+			continue;
+		}
+		if (isDir) {
+			if (hasBrowserTest(full)) return true;
+			continue;
+		}
+		if (/\.browser\.test\.(?:ts|tsx)$/.test(name)) return true;
+	}
+	return false;
+}
+/**
+* Read the package.json `name` field for the directory containing the
+* given src/index.ts file. Returns null if not found.
+*/
+function readPackageName(srcIndexPath) {
+	const pkgPath = path.resolve(path.dirname(srcIndexPath), "..", "package.json");
+	if (!existsSync(pkgPath)) return null;
+	try {
+		const text = __require("node:fs").readFileSync(pkgPath, "utf8");
+		const parsed = JSON.parse(text);
+		return typeof parsed.name === "string" ? parsed.name : null;
+	} catch {
+		return null;
+	}
+}
+const requireBrowserSmokeTest = {
+	meta: {
+		id: "pyreon/require-browser-smoke-test",
+		category: "architecture",
+		description: "Every browser-categorized package must ship at least one `*.browser.test.{ts,tsx}` file under `src/`. Locks in the T1.1 browser smoke harness.",
+		severity: "error",
+		fixable: false,
+		schema: {
+			additionalPackages: "string[]",
+			exemptPaths: "string[]"
+		}
+	},
+	create(context) {
+		const filePath = context.getFilePath();
+		if (!filePath.endsWith("/src/index.ts") && !filePath.endsWith("/src/index.tsx")) return {};
+		if (isPathExempt(context)) return {};
+		const pkgName = readPackageName(filePath);
+		if (pkgName == null) return {};
+		const options = context.getOptions();
+		const additional = Array.isArray(options.additionalPackages) ? options.additionalPackages.filter((s) => typeof s === "string") : [];
+		const browserPackages = new Set(loadBrowserPackages(filePath));
+		for (const p of additional) browserPackages.add(p);
+		if (!browserPackages.has(pkgName)) return {};
+		if (hasBrowserTest(path.dirname(path.dirname(filePath)))) return {};
+		return { "Program:exit"(node) {
+			context.report({
+				message: `[Pyreon] Browser-categorized package "${pkgName}" has no \`*.browser.test.{ts,tsx}\` file. Add at least one real-browser smoke test under \`src/\` to catch environment-divergence bugs that happy-dom hides (typeof process dead code, real pointer events, computed styles, etc.). See .claude/rules/test-environment-parity.md for the recipe.`,
+				span: {
+					start: node.start ?? 0,
+					end: node.end ?? 0
+				}
+			});
+		} };
+	}
+};
+
 //#endregion
 //#region src/rules/form/no-submit-without-validation.ts
 const noSubmitWithoutValidation = {
@@ -799,6 +1104,7 @@ const noSubmitWithoutValidation = {
 		fixable: false
 	},
 	create(context) {
+		if (isTestFile(context.getFilePath())) return {};
 		return { CallExpression(node) {
 			if (!isCallTo(node, "useForm")) return;
 			const args = node.arguments;
@@ -834,6 +1140,7 @@ const noUnregisteredField = {
 		fixable: false
 	},
 	create(context) {
+		if (isTestFile(context.getFilePath())) return {};
 		const fieldDecls = /* @__PURE__ */ new Map();
 		const registeredNames = /* @__PURE__ */ new Set();
 		return {
@@ -899,9 +1206,11 @@ const noRawAddEventListener = {
 		category: "hooks",
 		description: "Suggest useEventListener() instead of raw .addEventListener() calls.",
 		severity: "info",
-		fixable: false
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
 	},
 	create(context) {
+		if (isPathExempt(context)) return {};
 		return { CallExpression(node) {
 			const callee = node.callee;
 			if (!callee || callee.type !== "MemberExpression") return;
@@ -914,6 +1223,41 @@ const noRawAddEventListener = {
 	}
 };
 
+//#endregion
+//#region src/utils/component-context.ts
+const COMPONENT_NAME = /^[A-Z]/;
+const HOOK_NAME$1 = /^use[A-Z]/;
+function isComponentOrHookName(name) {
+	if (!name) return false;
+	return COMPONENT_NAME.test(name) || HOOK_NAME$1.test(name);
+}
+function createComponentContextTracker() {
+	let depth = 0;
+	function declaratorIsComponentOrHook(node) {
+		if (node?.id?.type !== "Identifier") return false;
+		const init = node.init;
+		if (init?.type !== "ArrowFunctionExpression" && init?.type !== "FunctionExpression") return false;
+		return isComponentOrHookName(node.id.name);
+	}
+	return {
+		isInComponentOrHook: () => depth > 0,
+		callbacks: {
+			FunctionDeclaration(node) {
+				if (isComponentOrHookName(node.id?.name)) depth++;
+			},
+			"FunctionDeclaration:exit"(node) {
+				if (isComponentOrHookName(node.id?.name)) depth--;
+			},
+			VariableDeclarator(node) {
+				if (declaratorIsComponentOrHook(node)) depth++;
+			},
+			"VariableDeclarator:exit"(node) {
+				if (declaratorIsComponentOrHook(node)) depth--;
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/rules/hooks/no-raw-localstorage.ts
 const STORAGE_OBJECTS = new Set(["localStorage", "sessionStorage"]);
@@ -926,19 +1270,24 @@ const noRawLocalStorage = {
 	meta: {
 		id: "pyreon/no-raw-localstorage",
 		category: "hooks",
-		description: "Suggest useStorage() instead of raw localStorage/sessionStorage access.",
+		description: "Suggest useStorage() instead of raw localStorage/sessionStorage inside a component or hook.",
 		severity: "info",
 		fixable: false
 	},
 	create(context) {
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (!callee || callee.type !== "MemberExpression") return;
-			if (callee.object?.type === "Identifier" && STORAGE_OBJECTS.has(callee.object.name) && callee.property?.type === "Identifier" && STORAGE_METHODS.has(callee.property.name)) context.report({
-				message: `Raw \`${callee.object.name}.${callee.property.name}()\` — consider using \`useStorage()\` from \`@pyreon/storage\` for reactive, cross-tab synced storage.`,
-				span: getSpan(node)
-			});
-		} };
+		const ctx = createComponentContextTracker();
+		return {
+			...ctx.callbacks,
+			CallExpression(node) {
+				if (!ctx.isInComponentOrHook()) return;
+				const callee = node.callee;
+				if (!callee || callee.type !== "MemberExpression") return;
+				if (callee.object?.type === "Identifier" && STORAGE_OBJECTS.has(callee.object.name) && callee.property?.type === "Identifier" && STORAGE_METHODS.has(callee.property.name)) context.report({
+					message: `Raw \`${callee.object.name}.${callee.property.name}()\` — consider using \`useStorage()\` from \`@pyreon/storage\` for reactive, cross-tab synced storage.`,
+					span: getSpan(node)
+				});
+			}
+		};
 	}
 };
 
@@ -951,14 +1300,19 @@ const noRawSetInterval = {
 		category: "hooks",
 		description: "Suggest wrapping setInterval/setTimeout in onMount for automatic cleanup.",
 		severity: "info",
-		fixable: false
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
 	},
 	create(context) {
+		if (isPathExempt(context)) return {};
+		const ctx = createComponentContextTracker();
 		let mountDepth = 0;
 		return {
+			...ctx.callbacks,
 			CallExpression(node) {
 				if (isCallTo(node, "onMount")) mountDepth++;
 				if (mountDepth > 0) return;
+				if (!ctx.isInComponentOrHook()) return;
 				const callee = node.callee;
 				if (!callee || callee.type !== "Identifier") return;
 				if (TIMER_FNS.has(callee.name)) context.report({
@@ -1268,24 +1622,28 @@ const noPropsDestructure = {
 	},
 	create(context) {
 		let functionDepth = 0;
+		const callArgFns = /* @__PURE__ */ new WeakSet();
 		return {
+			CallExpression(node) {
+				for (const arg of node.arguments ?? []) if (arg?.type === "ArrowFunctionExpression" || arg?.type === "FunctionExpression" || arg?.type === "FunctionDeclaration") callArgFns.add(arg);
+			},
 			ArrowFunctionExpression(node) {
 				functionDepth++;
-				checkFunction(node, context, functionDepth);
+				checkFunction(node, context, functionDepth, callArgFns);
 			},
 			"ArrowFunctionExpression:exit"() {
 				functionDepth--;
 			},
 			FunctionDeclaration(node) {
 				functionDepth++;
-				checkFunction(node, context, functionDepth);
+				checkFunction(node, context, functionDepth, callArgFns);
 			},
 			"FunctionDeclaration:exit"() {
 				functionDepth--;
 			},
 			FunctionExpression(node) {
 				functionDepth++;
-				checkFunction(node, context, functionDepth);
+				checkFunction(node, context, functionDepth, callArgFns);
 			},
 			"FunctionExpression:exit"() {
 				functionDepth--;
@@ -1293,14 +1651,13 @@ const noPropsDestructure = {
 		};
 	}
 };
-function checkFunction(node, context, depth) {
+function checkFunction(node, context, depth, callArgFns) {
 	const params = node.params;
 	if (!params || params.length === 0) return;
 	const firstParam = params[0];
 	if (!isDestructuring(firstParam)) return;
 	if (depth > 1) return;
-	const parent = node.parent;
-	if (parent?.type === "CallExpression" && parent.arguments?.includes(node)) return;
+	if (callArgFns.has(node)) return;
 	const body = node.body;
 	if (!body) return;
 	if (containsJSXReturn(body)) {
@@ -1397,9 +1754,47 @@ const noDomInSetup = {
 	},
 	create(context) {
 		let safeDepth = 0;
+		function isSafeContextCall(node) {
+			return isCallTo(node, "onMount") || isCallTo(node, "onUnmount") || isCallTo(node, "onCleanup") || isCallTo(node, "effect") || isCallTo(node, "renderEffect") || isCallTo(node, "requestAnimationFrame");
+		}
+		function isNegatedTypeofDocument(test) {
+			if (!test) return false;
+			if (test.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==") && test.left?.type === "UnaryExpression" && test.left.operator === "typeof" && test.left.argument?.type === "Identifier" && (test.left.argument.name === "document" || test.left.argument.name === "window")) return true;
+			return false;
+		}
+		function isEarlyReturnDocumentGuard(stmt) {
+			if (!stmt || stmt.type !== "IfStatement") return false;
+			if (!isNegatedTypeofDocument(stmt.test)) return false;
+			const c = stmt.consequent;
+			const isTerminator = (s) => s?.type === "ReturnStatement" || s?.type === "ThrowStatement";
+			if (isTerminator(c)) return true;
+			if (c?.type === "BlockStatement" && c.body.length === 1 && isTerminator(c.body[0])) return true;
+			return false;
+		}
+		const earlyReturnStack = [];
+		function pushFunctionScope(node) {
+			const body = node?.body;
+			const stmts = body?.type === "BlockStatement" ? body.body : null;
+			let bumps = 0;
+			if (stmts && stmts.length > 0 && isEarlyReturnDocumentGuard(stmts[0])) {
+				bumps = 1;
+				safeDepth++;
+			}
+			earlyReturnStack.push(bumps);
+		}
+		function popFunctionScope() {
+			const bumps = earlyReturnStack.pop() ?? 0;
+			if (bumps > 0) safeDepth -= bumps;
+		}
 		return {
+			FunctionDeclaration: pushFunctionScope,
+			"FunctionDeclaration:exit": popFunctionScope,
+			FunctionExpression: pushFunctionScope,
+			"FunctionExpression:exit": popFunctionScope,
+			ArrowFunctionExpression: pushFunctionScope,
+			"ArrowFunctionExpression:exit": popFunctionScope,
 			CallExpression(node) {
-				if (isCallTo(node, "onMount") || isCallTo(node, "effect")) safeDepth++;
+				if (isSafeContextCall(node)) safeDepth++;
 				if (safeDepth > 0) return;
 				const callee = node.callee;
 				if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === "document" && callee.property?.type === "Identifier" && DOM_METHODS.has(callee.property.name)) context.report({
@@ -1408,7 +1803,7 @@ const noDomInSetup = {
 				});
 			},
 			"CallExpression:exit"(node) {
-				if (isCallTo(node, "onMount") || isCallTo(node, "effect")) safeDepth--;
+				if (isSafeContextCall(node)) safeDepth--;
 			}
 		};
 	}
@@ -1630,6 +2025,11 @@ const preferShowOverDisplay = {
 
 //#endregion
 //#region src/rules/reactivity/no-bare-signal-in-jsx.ts
+const SKIP_NAMES = new Set([
+	"render",
+	"h",
+	"cloneVNode"
+]);
 const SKIP_PREFIXES = /^(use|get|is|has|[A-Z])/;
 const noBareSignalInJsx = {
 	meta: {
@@ -1661,7 +2061,7 @@ const noBareSignalInJsx = {
 				const callee = expr.callee;
 				if (!callee || callee.type !== "Identifier") return;
 				const name = callee.name;
-				if (SKIP_PREFIXES.test(name)) return;
+				if (SKIP_NAMES.has(name) || SKIP_PREFIXES.test(name)) return;
 				const span = getSpan(node);
 				const fixed = `{() => ${context.getSourceText().slice(span.start, span.end).slice(1, -1)}}`;
 				context.report({
@@ -1962,9 +2362,11 @@ const noUnbatchedUpdates = {
 		category: "reactivity",
 		description: "Warn when 3+ .set() calls occur in the same function without batch().",
 		severity: "warn",
-		fixable: false
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
 	},
 	create(context) {
+		if (isPathExempt(context)) return {};
 		const scopeStack = [];
 		let batchDepth = 0;
 		function enterScope(node) {
@@ -2113,46 +2515,94 @@ const noImperativeNavigateInRender = {
 	},
 	create(context) {
 		let componentBodyDepth = 0;
-		let safeDepth = 0;
-		return {
+		let nestedFnDepth = 0;
+		const componentInits = /* @__PURE__ */ new WeakSet();
+		const dangerousBindings = [];
+		const nestedFnStack = [];
+		function isComponentFunctionDecl(node) {
+			return /^[A-Z]/.test(node.id?.name ?? "");
+		}
+		function enterNestedFn(node, bindingName) {
+			nestedFnDepth++;
+			nestedFnStack.push({
+				containsNavigate: false,
+				bindingName
+			});
+		}
+		function exitNestedFn() {
+			nestedFnDepth--;
+			const frame = nestedFnStack.pop();
+			if (!frame) return;
+			if (frame.containsNavigate && frame.bindingName && dangerousBindings.length > 0) dangerousBindings[dangerousBindings.length - 1].add(frame.bindingName);
+		}
+		function isNavigateCall(node) {
+			return isCallTo(node, "navigate") || isMemberCallTo(node, "router", "push");
+		}
+		const callbacks = {
 			FunctionDeclaration(node) {
-				const name = node.id?.name ?? "";
-				if (/^[A-Z]/.test(name)) componentBodyDepth++;
+				if (isComponentFunctionDecl(node)) {
+					componentBodyDepth++;
+					dangerousBindings.push(/* @__PURE__ */ new Set());
+				} else if (componentBodyDepth > 0) enterNestedFn(node, node.id?.type === "Identifier" ? node.id.name : null);
 			},
 			"FunctionDeclaration:exit"(node) {
-				const name = node.id?.name ?? "";
-				if (/^[A-Z]/.test(name)) componentBodyDepth--;
+				if (isComponentFunctionDecl(node)) {
+					componentBodyDepth--;
+					dangerousBindings.pop();
+				} else if (componentBodyDepth > 0) exitNestedFn();
 			},
 			VariableDeclarator(node) {
-				const name = node.id?.name ?? "";
-				if (/^[A-Z]/.test(name) && node.init?.type === "ArrowFunctionExpression") componentBodyDepth++;
+				if (/^[A-Z]/.test(node.id?.name ?? "") && (node.init?.type === "ArrowFunctionExpression" || node.init?.type === "FunctionExpression")) {
+					componentBodyDepth++;
+					dangerousBindings.push(/* @__PURE__ */ new Set());
+					componentInits.add(node.init);
+				}
 			},
 			"VariableDeclarator:exit"(node) {
-				const name = node.id?.name ?? "";
-				if (/^[A-Z]/.test(name) && node.init?.type === "ArrowFunctionExpression") componentBodyDepth--;
+				if (/^[A-Z]/.test(node.id?.name ?? "") && (node.init?.type === "ArrowFunctionExpression" || node.init?.type === "FunctionExpression")) {
+					componentBodyDepth--;
+					dangerousBindings.pop();
+				}
+			},
+			ArrowFunctionExpression(node) {
+				if (componentInits.has(node)) return;
+				if (componentBodyDepth > 0) enterNestedFn(node, bindingAssignmentNames.get(node) ?? null);
+			},
+			"ArrowFunctionExpression:exit"(node) {
+				if (componentInits.has(node)) return;
+				if (componentBodyDepth > 0) exitNestedFn();
+			},
+			FunctionExpression(node) {
+				if (componentInits.has(node)) return;
+				if (componentBodyDepth > 0) enterNestedFn(node, bindingAssignmentNames.get(node) ?? null);
+			},
+			"FunctionExpression:exit"(node) {
+				if (componentInits.has(node)) return;
+				if (componentBodyDepth > 0) exitNestedFn();
 			},
 			CallExpression(node) {
 				if (componentBodyDepth <= 0) return;
-				if (isSafeWrapperCall(node)) safeDepth++;
-				if (safeDepth > 0) return;
-				if (isCallTo(node, "navigate") || isMemberCallTo(node, "router", "push")) context.report({
-					message: "Imperative navigation at the top level of a component — this runs on every render and causes infinite loops. Move inside `onMount`, `effect`, or an event handler.",
+				if (isNavigateCall(node)) {
+					if (nestedFnDepth === 0) context.report({
+						message: "Imperative navigation at the top level of a component — this runs on every render and causes infinite loops. Move inside `onMount`, `effect`, or an event handler.",
+						span: getSpan(node)
+					});
+					else if (nestedFnStack.length > 0) nestedFnStack[nestedFnStack.length - 1].containsNavigate = true;
+					return;
+				}
+				if (nestedFnDepth === 0 && node.callee?.type === "Identifier" && dangerousBindings.length > 0 && dangerousBindings[dangerousBindings.length - 1].has(node.callee.name)) context.report({
+					message: "Synchronous call of a nested function that performs imperative navigation — this runs during render and causes infinite loops. Move the call inside `onMount`, `effect`, or an event handler.",
 					span: getSpan(node)
 				});
-			},
-			"CallExpression:exit"(node) {
-				if (componentBodyDepth <= 0) return;
-				if (isSafeWrapperCall(node)) safeDepth--;
 			}
 		};
+		const bindingAssignmentNames = /* @__PURE__ */ new WeakMap();
+		callbacks.VariableDeclaration = (node) => {
+			for (const decl of node.declarations ?? []) if (decl.id?.type === "Identifier" && (decl.init?.type === "ArrowFunctionExpression" || decl.init?.type === "FunctionExpression")) bindingAssignmentNames.set(decl.init, decl.id.name);
+		};
+		return callbacks;
 	}
 };
-function isSafeWrapperCall(node) {
-	const callee = node.callee;
-	if (!callee || callee.type !== "Identifier") return false;
-	const name = callee.name;
-	return name === "onMount" || name === "effect" || name === "onUnmount";
-}
 
 //#endregion
 //#region src/rules/router/no-missing-fallback.ts
@@ -2299,32 +2749,236 @@ const noWindowInSsr = {
 		category: "ssr",
 		description: "Disallow browser globals outside onMount/effect/typeof guards — they break SSR.",
 		severity: "error",
-		fixable: false
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
 	},
 	create(context) {
+		if (isPathExempt(context)) return {};
 		let safeDepth = 0;
 		let typeofGuardDepth = 0;
+		let inTypeofExpr = 0;
+		const skipPropertyNodes = /* @__PURE__ */ new WeakSet();
+		let inTsTypePos = 0;
+		const typeofBoundConsts = /* @__PURE__ */ new Set();
+		function isPositiveTypeofCheck(expr) {
+			if (!expr) return false;
+			if (expr.type === "BinaryExpression" && (expr.operator === "!==" || expr.operator === "!=") && expr.left?.type === "UnaryExpression" && expr.left.operator === "typeof") return true;
+			if (expr.type === "UnaryExpression" && expr.operator === "typeof") return true;
+			return false;
+		}
+		/** Used by VariableDeclaration to decide whether to bind a const. */
+		function isTypeofCheckForBinding(expr) {
+			if (!expr) return false;
+			if (expr.type === "BinaryExpression" && expr.left?.type === "UnaryExpression" && expr.left.operator === "typeof") return true;
+			if (expr.type === "UnaryExpression" && expr.operator === "typeof") return true;
+			if (expr.type === "LogicalExpression" && expr.operator === "&&") return isTypeofCheckForBinding(expr.left) || isTypeofCheckForBinding(expr.right);
+			if (expr.type === "ConditionalExpression") return isTypeofCheckForBinding(expr.test);
+			if (expr.type === "Identifier" && typeofBoundConsts.has(expr.name)) return true;
+			return false;
+		}
+		/**
+		* `if (test) { … }` — does the test indicate the body is the
+		* BROWSER-SAFE branch? Only positive forms qualify here. Negated
+		* forms (`typeof X === 'undefined'`, `!isBrowser`) are early-return
+		* guards handled separately.
+		*/
+		function testIsTypeofGuard(test) {
+			if (!test) return false;
+			if (isPositiveTypeofCheck(test)) return true;
+			if (test.type === "Identifier" && typeofBoundConsts.has(test.name)) return true;
+			if (test.type === "CallExpression" && test.callee?.type === "Identifier" && typeofGuardFunctions.has(test.callee.name)) return true;
+			if (test.type === "LogicalExpression" && test.operator === "&&") return testIsTypeofGuard(test.left) || testIsTypeofGuard(test.right);
+			return false;
+		}
+		const typeofGuardFunctions = new Set([
+			"isBrowser",
+			"isClient",
+			"isServer",
+			"isSSR"
+		]);
+		function bodyIsTypeofGuard(body) {
+			if (!body) return false;
+			if (body.type !== "BlockStatement") return isReturnedTypeofExpr(body);
+			const stmts = body.body ?? [];
+			if (stmts.length !== 1) return false;
+			const stmt = stmts[0];
+			if (stmt?.type !== "ReturnStatement") return false;
+			return isReturnedTypeofExpr(stmt.argument);
+		}
+		function isReturnedTypeofExpr(expr) {
+			if (!expr) return false;
+			if (isPositiveTypeofCheck(expr)) return true;
+			if (expr.type === "LogicalExpression" && expr.operator === "&&") return isReturnedTypeofExpr(expr.left) && isReturnedTypeofExpr(expr.right);
+			if (expr.type === "Identifier" && typeofBoundConsts.has(expr.name)) return true;
+			return false;
+		}
+		function isNegatedTypeofExpr(test) {
+			if (!test) return false;
+			if (test.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==") && test.left?.type === "UnaryExpression" && test.left.operator === "typeof") return true;
+			if (test.type === "UnaryExpression" && test.operator === "!" && test.argument?.type === "Identifier" && typeofBoundConsts.has(test.argument.name)) return true;
+			if (test.type === "UnaryExpression" && test.operator === "!" && test.argument?.type === "CallExpression" && test.argument.callee?.type === "Identifier" && typeofGuardFunctions.has(test.argument.callee.name)) return true;
+			if (test.type === "LogicalExpression" && test.operator === "||") return isNegatedTypeofExpr(test.left) && isNegatedTypeofExpr(test.right);
+			return false;
+		}
+		function isEarlyReturnTypeofGuard(stmt) {
+			if (!stmt || stmt.type !== "IfStatement") return false;
+			if (!isNegatedTypeofExpr(stmt.test)) return false;
+			const c = stmt.consequent;
+			const isTerminator = (s) => s?.type === "ReturnStatement" || s?.type === "ThrowStatement";
+			if (isTerminator(c)) return true;
+			if (c?.type === "BlockStatement" && c.body.length === 1 && isTerminator(c.body[0])) return true;
+			return false;
+		}
+		const earlyReturnStack = [];
+		const watchCallbackNodes = /* @__PURE__ */ new WeakSet();
+		const watchCallbackSafeDepthStack = [];
+		const shadowedNamesStack = [];
+		const importShadowedNames = /* @__PURE__ */ new Set();
+		function collectParamNames(params) {
+			const names = /* @__PURE__ */ new Set();
+			const walk = (p) => {
+				if (!p) return;
+				if (p.type === "Identifier" && BROWSER_GLOBALS.has(p.name)) names.add(p.name);
+				else if (p.type === "AssignmentPattern") walk(p.left);
+				else if (p.type === "RestElement") walk(p.argument);
+				else if (p.type === "ArrayPattern") for (const el of p.elements ?? []) walk(el);
+				else if (p.type === "ObjectPattern") for (const prop of p.properties ?? []) if (prop.type === "RestElement") walk(prop.argument);
+				else walk(prop.value);
+			};
+			for (const p of params ?? []) walk(p);
+			return names;
+		}
+		function isNameShadowed(name) {
+			for (let i = shadowedNamesStack.length - 1; i >= 0; i--) if (shadowedNamesStack[i].has(name)) return true;
+			return false;
+		}
+		function pushFunctionScope(node) {
+			earlyReturnStack.push(0);
+			shadowedNamesStack.push(node ? collectParamNames(node.params ?? []) : /* @__PURE__ */ new Set());
+			if (node && watchCallbackNodes.has(node)) {
+				safeDepth++;
+				watchCallbackSafeDepthStack.push(1);
+			} else watchCallbackSafeDepthStack.push(0);
+		}
+		function popFunctionScope() {
+			const bumps = earlyReturnStack.pop() ?? 0;
+			typeofGuardDepth -= bumps;
+			shadowedNamesStack.pop();
+			const watchBump = watchCallbackSafeDepthStack.pop() ?? 0;
+			if (watchBump > 0) safeDepth -= watchBump;
+		}
+		function noteEarlyReturnGuardVisit() {
+			typeofGuardDepth++;
+			if (earlyReturnStack.length > 0) earlyReturnStack[earlyReturnStack.length - 1]++;
+		}
 		return {
+			VariableDeclaration(node) {
+				for (const decl of node.declarations ?? []) {
+					if (decl.id?.type !== "Identifier") continue;
+					if (isTypeofCheckForBinding(decl.init)) typeofBoundConsts.add(decl.id.name);
+					if ((decl.init?.type === "ArrowFunctionExpression" || decl.init?.type === "FunctionExpression") && bodyIsTypeofGuard(decl.init.body)) typeofGuardFunctions.add(decl.id.name);
+				}
+			},
+			FunctionDeclaration(node) {
+				if (node.id?.type === "Identifier" && bodyIsTypeofGuard(node.body)) typeofGuardFunctions.add(node.id.name);
+				pushFunctionScope(node);
+			},
+			"FunctionDeclaration:exit": popFunctionScope,
+			FunctionExpression: pushFunctionScope,
+			"FunctionExpression:exit": popFunctionScope,
+			ArrowFunctionExpression: pushFunctionScope,
+			"ArrowFunctionExpression:exit": popFunctionScope,
 			CallExpression(node) {
-				if (isCallTo(node, "onMount") || isCallTo(node, "effect")) safeDepth++;
+				if (isCallTo(node, "onMount") || isCallTo(node, "onUnmount") || isCallTo(node, "onCleanup") || isCallTo(node, "effect") || isCallTo(node, "renderEffect") || isCallTo(node, "requestAnimationFrame")) {
+					safeDepth++;
+					return;
+				}
+				if (isCallTo(node, "watch")) {
+					const cb = node.arguments?.[1];
+					if (cb?.type === "ArrowFunctionExpression" || cb?.type === "FunctionExpression" || cb?.type === "FunctionDeclaration") watchCallbackNodes.add(cb);
+				}
 			},
 			"CallExpression:exit"(node) {
-				if (isCallTo(node, "onMount") || isCallTo(node, "effect")) safeDepth--;
+				if (isCallTo(node, "onMount") || isCallTo(node, "onUnmount") || isCallTo(node, "onCleanup") || isCallTo(node, "effect") || isCallTo(node, "renderEffect") || isCallTo(node, "requestAnimationFrame")) safeDepth--;
 			},
 			IfStatement(node) {
-				const test = node.test;
-				if (test?.type === "BinaryExpression" && test.left?.type === "UnaryExpression" && test.left.operator === "typeof") typeofGuardDepth++;
+				if (testIsTypeofGuard(node.test)) typeofGuardDepth++;
+				else if (isEarlyReturnTypeofGuard(node)) noteEarlyReturnGuardVisit();
 			},
 			"IfStatement:exit"(node) {
-				const test = node.test;
-				if (test?.type === "BinaryExpression" && test.left?.type === "UnaryExpression" && test.left.operator === "typeof") typeofGuardDepth--;
+				if (testIsTypeofGuard(node.test)) typeofGuardDepth--;
+			},
+			ConditionalExpression(node) {
+				if (testIsTypeofGuard(node.test)) typeofGuardDepth++;
+			},
+			"ConditionalExpression:exit"(node) {
+				if (testIsTypeofGuard(node.test)) typeofGuardDepth--;
+			},
+			UnaryExpression(node) {
+				if (node.operator === "typeof") inTypeofExpr++;
+			},
+			"UnaryExpression:exit"(node) {
+				if (node.operator === "typeof") inTypeofExpr--;
+			},
+			TSTypeAnnotation(_n) {
+				inTsTypePos++;
+			},
+			"TSTypeAnnotation:exit"(_n) {
+				inTsTypePos--;
+			},
+			TSTypeReference(_n) {
+				inTsTypePos++;
+			},
+			"TSTypeReference:exit"(_n) {
+				inTsTypePos--;
 			},
-			Identifier(node, parent) {
-				if (safeDepth > 0 || typeofGuardDepth > 0) return;
+			TSTypeAliasDeclaration(_n) {
+				inTsTypePos++;
+			},
+			"TSTypeAliasDeclaration:exit"(_n) {
+				inTsTypePos--;
+			},
+			TSInterfaceDeclaration(_n) {
+				inTsTypePos++;
+			},
+			"TSInterfaceDeclaration:exit"(_n) {
+				inTsTypePos--;
+			},
+			TSTypeParameter(_n) {
+				inTsTypePos++;
+			},
+			"TSTypeParameter:exit"(_n) {
+				inTsTypePos--;
+			},
+			MemberExpression(node) {
+				if (!node.computed && node.property?.type === "Identifier") skipPropertyNodes.add(node.property);
+			},
+			Property(node) {
+				if (!node.computed && node.key?.type === "Identifier") skipPropertyNodes.add(node.key);
+			},
+			ImportSpecifier(node) {
+				if (node.imported?.type === "Identifier") skipPropertyNodes.add(node.imported);
+				if (node.local?.type === "Identifier" && node.local !== node.imported) skipPropertyNodes.add(node.local);
+				if (node.local?.type === "Identifier" && BROWSER_GLOBALS.has(node.local.name)) importShadowedNames.add(node.local.name);
+			},
+			ImportDefaultSpecifier(node) {
+				if (node.local?.type === "Identifier") {
+					skipPropertyNodes.add(node.local);
+					if (BROWSER_GLOBALS.has(node.local.name)) importShadowedNames.add(node.local.name);
+				}
+			},
+			ImportNamespaceSpecifier(node) {
+				if (node.local?.type === "Identifier") {
+					skipPropertyNodes.add(node.local);
+					if (BROWSER_GLOBALS.has(node.local.name)) importShadowedNames.add(node.local.name);
+				}
+			},
+			Identifier(node) {
+				if (safeDepth > 0 || typeofGuardDepth > 0 || inTypeofExpr > 0 || inTsTypePos > 0) return;
+				if (skipPropertyNodes.has(node)) return;
 				if (!BROWSER_GLOBALS.has(node.name)) return;
-				if (parent?.type === "UnaryExpression" && parent.operator === "typeof") return;
-				if (parent?.type === "ImportSpecifier" || parent?.type === "ImportDefaultSpecifier" || parent?.type === "ImportNamespaceSpecifier") return;
-				if (parent?.type === "MemberExpression" && parent.property === node && !parent.computed) return;
+				if (isNameShadowed(node.name)) return;
+				if (importShadowedNames.has(node.name)) return;
 				context.report({
 					message: `Browser global \`${node.name}\` used outside \`onMount\`/\`effect\`/typeof guard — this will fail during SSR. Wrap in \`onMount(() => { ... })\`.`,
 					span: getSpan(node)
@@ -2392,6 +3046,7 @@ const noDuplicateStoreId = {
 		fixable: false
 	},
 	create(context) {
+		if (isTestFile(context.getFilePath())) return {};
 		const storeIds = /* @__PURE__ */ new Map();
 		return { CallExpression(node) {
 			if (!isCallTo(node, "defineStore")) return;
@@ -2417,25 +3072,30 @@ const noMutateStoreState = {
 	meta: {
 		id: "pyreon/no-mutate-store-state",
 		category: "store",
-		description: "Warn when directly calling .set() on store signals — use store actions instead.",
+		description: "Warn when calling .set() on store signals from a component or hook — use store actions instead.",
 		severity: "warn",
 		fixable: false
 	},
 	create(context) {
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (!callee || callee.type !== "MemberExpression") return;
-			if (callee.property?.type !== "Identifier" || callee.property.name !== "set") return;
-			const obj = callee.object;
-			if (!obj || obj.type !== "MemberExpression") return;
-			const outerObj = obj.object;
-			if (!outerObj || outerObj.type !== "Identifier") return;
-			const name = outerObj.name;
-			if (name.toLowerCase().includes("store")) context.report({
-				message: `Direct \`.set()\` on store state \`${name}\` — use store actions to mutate state for better traceability.`,
-				span: getSpan(node)
-			});
-		} };
+		const ctx = createComponentContextTracker();
+		return {
+			...ctx.callbacks,
+			CallExpression(node) {
+				if (!ctx.isInComponentOrHook()) return;
+				const callee = node.callee;
+				if (!callee || callee.type !== "MemberExpression") return;
+				if (callee.property?.type !== "Identifier" || callee.property.name !== "set") return;
+				const obj = callee.object;
+				if (!obj || obj.type !== "MemberExpression") return;
+				const outerObj = obj.object;
+				if (!outerObj || outerObj.type !== "Identifier") return;
+				const name = outerObj.name;
+				if (name.toLowerCase().includes("store")) context.report({
+					message: `Direct \`.set()\` on store state \`${name}\` — use store actions to mutate state for better traceability.`,
+					span: getSpan(node)
+				});
+			}
+		};
 	}
 };
 
@@ -2486,44 +3146,27 @@ const noDynamicStyled = {
 	meta: {
 		id: "pyreon/no-dynamic-styled",
 		category: "styling",
-		description: "Warn when styled() is called inside a function — it creates new CSS on every render.",
+		description: "Warn when styled() is called inside a component or hook — it creates new CSS on every render.",
 		severity: "warn",
 		fixable: false
 	},
 	create(context) {
-		let functionDepth = 0;
+		const ctx = createComponentContextTracker();
 		return {
-			FunctionDeclaration() {
-				functionDepth++;
-			},
-			"FunctionDeclaration:exit"() {
-				functionDepth--;
-			},
-			FunctionExpression() {
-				functionDepth++;
-			},
-			"FunctionExpression:exit"() {
-				functionDepth--;
-			},
-			ArrowFunctionExpression() {
-				functionDepth++;
-			},
-			"ArrowFunctionExpression:exit"() {
-				functionDepth--;
-			},
+			...ctx.callbacks,
 			CallExpression(node) {
-				if (functionDepth === 0) return;
+				if (!ctx.isInComponentOrHook()) return;
 				if (isCallTo(node, "styled")) context.report({
-					message: "`styled()` inside a function — this creates new CSS rules on every render. Move `styled()` to module scope.",
+					message: "`styled()` inside a component or hook — this creates new CSS rules on every render. Move `styled()` to module scope.",
 					span: getSpan(node)
 				});
 			},
 			TaggedTemplateExpression(node) {
-				if (functionDepth === 0) return;
+				if (!ctx.isInComponentOrHook()) return;
 				const tag = node.tag;
 				if (!tag) return;
 				if (tag.type === "CallExpression" && isCallTo(tag, "styled")) context.report({
-					message: "`styled()` tagged template inside a function — this creates new CSS rules on every render. Move to module scope.",
+					message: "`styled()` tagged template inside a component or hook — this creates new CSS rules on every render. Move to module scope.",
 					span: getSpan(node)
 				});
 			}
@@ -2556,6 +3199,7 @@ const noInlineStyleObject = {
 
 //#endregion
 //#region src/rules/styling/no-theme-outside-provider.ts
+const HOOK_NAME = /^use[A-Z]/;
 const noThemeOutsideProvider = {
 	meta: {
 		id: "pyreon/no-theme-outside-provider",
@@ -2566,22 +3210,47 @@ const noThemeOutsideProvider = {
 	},
 	create(context) {
 		let hasProviderImport = false;
+		let hookDepth = 0;
 		const themeCalls = [];
+		function declaratorIsHook(node) {
+			if (node?.id?.type !== "Identifier") return false;
+			const init = node.init;
+			if (init?.type !== "ArrowFunctionExpression" && init?.type !== "FunctionExpression") return false;
+			return HOOK_NAME.test(node.id.name);
+		}
 		return {
+			FunctionDeclaration(node) {
+				if (node.id?.name && HOOK_NAME.test(node.id.name)) hookDepth++;
+			},
+			"FunctionDeclaration:exit"(node) {
+				if (node.id?.name && HOOK_NAME.test(node.id.name)) hookDepth--;
+			},
+			VariableDeclarator(node) {
+				if (declaratorIsHook(node)) hookDepth++;
+			},
+			"VariableDeclarator:exit"(node) {
+				if (declaratorIsHook(node)) hookDepth--;
+			},
 			ImportDeclaration(node) {
 				const info = extractImportInfo(node);
 				if (!info) return;
 				if (info.specifiers.some((s) => s.imported === "PyreonUI" || s.imported === "ThemeProvider")) hasProviderImport = true;
 			},
 			CallExpression(node) {
-				if (isCallTo(node, "useTheme")) themeCalls.push({ span: getSpan(node) });
+				if (isCallTo(node, "useTheme")) themeCalls.push({
+					span: getSpan(node),
+					insideHook: hookDepth > 0
+				});
 			},
 			"Program:exit"() {
 				if (hasProviderImport) return;
-				for (const call of themeCalls) context.report({
-					message: "`useTheme()` without a `PyreonUI` or `ThemeProvider` import — the theme context may not be available.",
-					span: call.span
-				});
+				for (const call of themeCalls) {
+					if (call.insideHook) continue;
+					context.report({
+						message: "`useTheme()` without a `PyreonUI` or `ThemeProvider` import — the theme context may not be available.",
+						span: call.span
+					});
+				}
 			}
 		};
 	}
@@ -2660,6 +3329,7 @@ const allRules = [
 	devGuardWarnings,
 	noErrorWithoutPrefix,
 	noProcessDevGate,
+	requireBrowserSmokeTest,
 	noStoreOutsideProvider,
 	noMutateStoreState,
 	noDuplicateStoreId,
@@ -2690,11 +3360,17 @@ function buildRecommended() {
 	for (const rule of allRules) rules[rule.meta.id] = rule.meta.severity;
 	return { rules };
 }
+function severityOf(entry) {
+	return Array.isArray(entry) ? entry[0] : entry;
+}
 /** Build a config where every warn is promoted to error. */
 function buildStrict() {
 	const base = buildRecommended();
 	const rules = {};
-	for (const [id, sev] of Object.entries(base.rules)) rules[id] = sev === "warn" ? "error" : sev;
+	for (const [id, entry] of Object.entries(base.rules)) {
+		const sev = severityOf(entry);
+		rules[id] = sev === "warn" ? "error" : sev;
+	}
 	return { rules };
 }
 /** Build app config — recommended but disable library-only rules. */
@@ -2704,7 +3380,8 @@ function buildApp() {
 		"pyreon/dev-guard-warnings": "off",
 		"pyreon/no-error-without-prefix": "off",
 		"pyreon/no-circular-import": "off",
-		"pyreon/no-cross-layer-import": "off"
+		"pyreon/no-cross-layer-import": "off",
+		"pyreon/require-browser-smoke-test": "off"
 	} };
 }
 /** Build lib config — strict + all architecture rules as error. */
@@ -2715,7 +3392,8 @@ function buildLib() {
 		"pyreon/no-cross-layer-import": "error",
 		"pyreon/dev-guard-warnings": "error",
 		"pyreon/no-error-without-prefix": "error",
-		"pyreon/no-process-dev-gate": "error"
+		"pyreon/no-process-dev-gate": "error",
+		"pyreon/require-browser-smoke-test": "error"
 	} };
 }
 const presetBuilders = {
@@ -2773,8 +3451,46 @@ function hasJsExtension(filePath) {
 	return JS_EXTENSIONS.has(ext);
 }
 
+//#endregion
+//#region src/utils/validate-options.ts
+function validateRuleOptions(rule, options) {
+	const schema = rule.meta.schema;
+	const errors = [];
+	const warnings = [];
+	if (!schema) return {
+		errors,
+		warnings
+	};
+	for (const [key, value] of Object.entries(options)) {
+		const expected = schema[key];
+		if (expected === void 0) {
+			warnings.push(`[${rule.meta.id}] unknown option "${key}" — allowed options: ${Object.keys(schema).join(", ") || "(none)"}`);
+			continue;
+		}
+		if (!matchesType(value, expected)) errors.push(`[${rule.meta.id}] option "${key}" must be ${expected}, got ${describe(value)}`);
+	}
+	return {
+		errors,
+		warnings
+	};
+}
+function matchesType(value, type) {
+	switch (type) {
+		case "string": return typeof value === "string";
+		case "string[]": return Array.isArray(value) && value.every((x) => typeof x === "string");
+		case "number": return typeof value === "number" && Number.isFinite(value);
+		case "boolean": return typeof value === "boolean";
+	}
+}
+function describe(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return `Array<${[...new Set(value.map((x) => x === null ? "null" : typeof x))].join(" | ") || "empty"}>`;
+	return typeof value;
+}
+
 //#endregion
 //#region src/runner.ts
+const VALIDATION_CACHE = /* @__PURE__ */ new Map();
 function getExtension(filePath) {
 	const lastDot = filePath.lastIndexOf(".");
 	return lastDot === -1 ? "" : filePath.slice(lastDot);
@@ -2784,7 +3500,7 @@ function getLang(ext) {
 	if (ext === ".ts" || ext === ".mts") return "ts";
 	return "js";
 }
-function createRuleContext(rule, severity, diagnostics, lineIndex, sourceText, filePath) {
+function createRuleContext(rule, severity, options, diagnostics, lineIndex, sourceText, filePath) {
 	return {
 		report(partial) {
 			diagnostics.push({
@@ -2801,6 +3517,9 @@ function createRuleContext(rule, severity, diagnostics, lineIndex, sourceText, f
 		},
 		getFilePath() {
 			return filePath;
+		},
+		getOptions() {
+			return options;
 		}
 	};
 }
@@ -2830,7 +3549,7 @@ function mergeCallbacks(allCallbacks) {
 * for (const d of result.diagnostics) console.log(d.message)
 * ```
 */
-function lintFile(filePath, sourceText, rules, config, cache) {
+function lintFile(filePath, sourceText, rules, config, cache, configDiagnosticsSink) {
 	const ext = getExtension(filePath);
 	if (!JS_EXTENSIONS.has(ext)) return {
 		filePath,
@@ -2863,20 +3582,50 @@ function lintFile(filePath, sourceText, rules, config, cache) {
 	const diagnostics = [];
 	const allCallbacks = [];
 	for (const rule of rules) {
-		const severity = config.rules[rule.meta.id];
-		if (severity === void 0 || severity === "off") continue;
-		const ctx = createRuleContext(rule, severity, diagnostics, lineIndex, sourceText, filePath);
+		const entry = config.rules[rule.meta.id];
+		if (entry === void 0) continue;
+		const [severity, options] = Array.isArray(entry) ? [entry[0], entry[1] ?? {}] : [entry, {}];
+		if (severity === "off") continue;
+		const cacheKey = `${rule.meta.id}::${JSON.stringify(options)}`;
+		let cached = VALIDATION_CACHE.get(cacheKey);
+		if (!cached) {
+			const { errors, warnings } = validateRuleOptions(rule, options);
+			const configDiags = [];
+			for (const message of warnings) configDiags.push({
+				ruleId: rule.meta.id,
+				severity: "warn",
+				message
+			});
+			for (const message of errors) configDiags.push({
+				ruleId: rule.meta.id,
+				severity: "error",
+				message
+			});
+			cached = {
+				ok: errors.length === 0,
+				diagnostics: configDiags
+			};
+			VALIDATION_CACHE.set(cacheKey, cached);
+		}
+		if (cached.diagnostics.length > 0) if (configDiagnosticsSink) {
+			for (const d of cached.diagnostics) if (!configDiagnosticsSink.some((x) => x.ruleId === d.ruleId && x.message === d.message)) configDiagnosticsSink.push(d);
+		} else for (const d of cached.diagnostics) (d.severity === "error" ? console.error : console.warn)(`[pyreon-lint] ${d.message}`);
+		if (!cached.ok) continue;
+		const ctx = createRuleContext(rule, severity, options, diagnostics, lineIndex, sourceText, filePath);
 		allCallbacks.push(rule.create(ctx));
 	}
 	new Visitor(mergeCallbacks(allCallbacks)).visit(program);
 	const lines = sourceText.split("\n");
+	const SUPPRESS_RE = /^\/\/\s*pyreon-lint-(?:ignore|disable-next-line)(?:\s+(\S+))?\s*$/;
 	const filtered = diagnostics.filter((d) => {
 		const prevLineIdx = d.loc.line - 2;
 		if (prevLineIdx < 0) return true;
-		const prevLine = lines[prevLineIdx]?.trim();
-		if (!prevLine?.startsWith("// pyreon-lint-ignore")) return true;
-		const rest = prevLine.slice(21).trim();
-		return rest.length > 0 && rest !== d.ruleId;
+		const prevLine = lines[prevLineIdx]?.trim() ?? "";
+		const match = SUPPRESS_RE.exec(prevLine);
+		if (!match) return true;
+		const ruleId = match[1];
+		if (!ruleId) return false;
+		return ruleId !== d.ruleId;
 	});
 	filtered.sort((a, b) => a.span.start - b.span.start);
 	return {
@@ -2954,8 +3703,17 @@ function buildConfig(options) {
 	const cwd = resolve(".");
 	const fileConfig = options.config ? loadConfigFromPath(options.config) : loadConfig(cwd);
 	const config = getPreset(options.preset ?? fileConfig?.preset ?? "recommended");
-	if (fileConfig?.rules) for (const [id, severity] of Object.entries(fileConfig.rules)) config.rules[id] = severity;
+	if (fileConfig?.rules) for (const [id, entry] of Object.entries(fileConfig.rules)) config.rules[id] = entry;
 	if (options.ruleOverrides) for (const [id, severity] of Object.entries(options.ruleOverrides)) config.rules[id] = severity;
+	if (options.ruleOptionsOverrides) for (const [id, optionOverrides] of Object.entries(options.ruleOptionsOverrides)) {
+		const existing = config.rules[id];
+		const [currentSeverity, currentOptions] = Array.isArray(existing) ? [existing[0], existing[1] ?? {}] : [existing ?? "off", {}];
+		if (currentSeverity === "off") continue;
+		config.rules[id] = [currentSeverity, {
+			...currentOptions,
+			...optionOverrides
+		}];
+	}
 	return {
 		config,
 		include: fileConfig?.include,
@@ -3005,11 +3763,13 @@ function lint(options) {
 	const { config, include, exclude, isIgnored } = buildConfig(options);
 	const cache = new AstCache();
 	const files = gatherFiles(options.paths, isIgnored, include, exclude);
+	const configDiagnostics = [];
 	const results = {
 		files: [],
 		totalErrors: 0,
 		totalWarnings: 0,
-		totalInfos: 0
+		totalInfos: 0,
+		configDiagnostics
 	};
 	for (const filePath of files) {
 		let source;
@@ -3018,7 +3778,7 @@ function lint(options) {
 		} catch {
 			continue;
 		}
-		const fileResult = lintFile(filePath, source, allRules, config, cache);
+		const fileResult = lintFile(filePath, source, allRules, config, cache, configDiagnostics);
 		if (options.fix) applyFixesToFile(fileResult, source);
 		if (options.quiet) fileResult.diagnostics = fileResult.diagnostics.filter((d) => d.severity === "error");
 		countDiagnostics(fileResult, results);
@@ -3063,7 +3823,7 @@ function listRules() {
 * @module
 */
 const cache = new AstCache();
-const config = getPreset("recommended");
+let config = getPreset("recommended");
 function toLspDiagnostics(diagnostics) {
 	return diagnostics.map((d) => ({
 		range: {
@@ -3300,6 +4060,7 @@ function watchAndLint(options) {
 	const cache = new AstCache();
 	const config = getPreset(options.preset ?? "recommended");
 	applyOverrides(config, options.ruleOverrides);
+	applyOptionsOverrides(config, options.ruleOptionsOverrides);
 	const isIgnored = createIgnoreFilter(resolve("."), options.ignore);
 	const pending = /* @__PURE__ */ new Map();
 	console.log(`\x1b[2m[pyreon-lint] Watching for changes...\x1b[0m\n`);
@@ -3326,6 +4087,18 @@ function applyOverrides(config, overrides) {
 	if (!overrides) return;
 	for (const [id, severity] of Object.entries(overrides)) config.rules[id] = severity;
 }
+function applyOptionsOverrides(config, overrides) {
+	if (!overrides) return;
+	for (const [id, opts] of Object.entries(overrides)) {
+		const existing = config.rules[id];
+		const [severity, current] = Array.isArray(existing) ? [existing[0], existing[1] ?? {}] : [existing ?? "off", {}];
+		if (severity === "off") continue;
+		config.rules[id] = [severity, {
+			...current,
+			...opts
+		}];
+	}
+}
 function relintFile(filePath, config, cache, format) {
 	let source;
 	try {
@@ -3339,7 +4112,8 @@ function relintFile(filePath, config, cache, format) {
 		files: [fileResult],
 		totalErrors: 0,
 		totalWarnings: 0,
-		totalInfos: 0
+		totalInfos: 0,
+		configDiagnostics: []
 	};
 	for (const d of fileResult.diagnostics) if (d.severity === "error") result.totalErrors++;
 	else if (d.severity === "warn") result.totalWarnings++;
@@ -3361,7 +4135,8 @@ function printUsage() {
     --format <fmt>     Output: text (default), json, compact
     --quiet            Only show errors
     --list             List all available rules
-    --rule <id>=<sev>  Override rule severity
+    --rule <id>=<sev>          Override rule severity (e.g. --rule pyreon/no-window-in-ssr=off)
+    --rule-options <id>=<json> Override rule options (e.g. --rule-options pyreon/no-window-in-ssr='{"exemptPaths":["src/foundation/"]}')
     --config <path>    Config file path
     --ignore <path>    Ignore file path
     --watch            Watch mode — re-lint on file changes
@@ -3408,6 +4183,7 @@ function parseArgs(argv) {
 		configPath: void 0,
 		ignorePath: void 0,
 		ruleOverrides: {},
+		ruleOptionsOverrides: {},
 		paths: []
 	};
 	for (let i = 0; i < argv.length; i++) {
@@ -3444,6 +4220,10 @@ function parseValueFlag(arg, nextArg, result) {
 		parseRuleOverride(nextArg, result.ruleOverrides);
 		return 1;
 	}
+	if (arg === "--rule-options") {
+		parseRuleOptionsOverride(nextArg, result.ruleOptionsOverrides);
+		return 1;
+	}
 	if (arg) result.paths.push(arg);
 	return 0;
 }
@@ -3454,6 +4234,21 @@ function parseRuleOverride(val, overrides) {
 	const ruleId = val.slice(0, eqIdx);
 	overrides[ruleId] = val.slice(eqIdx + 1);
 }
+/** Exported for testing only. */
+function parseRuleOptionsOverride(val, overrides) {
+	if (!val) return;
+	const eqIdx = val.indexOf("=");
+	if (eqIdx === -1) return;
+	const ruleId = val.slice(0, eqIdx);
+	const json = val.slice(eqIdx + 1);
+	try {
+		const parsed = JSON.parse(json);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) overrides[ruleId] = parsed;
+		else console.error(`[pyreon-lint] --rule-options ${ruleId}: expected JSON object, got ${typeof parsed}`);
+	} catch (err) {
+		console.error(`[pyreon-lint] --rule-options ${ruleId}: invalid JSON — ${err.message}`);
+	}
+}
 function main() {
 	const args = parseArgs(process.argv.slice(2));
 	if (args.showHelp) {
@@ -3480,6 +4275,7 @@ function main() {
 			fix: args.fix,
 			quiet: args.quiet,
 			ruleOverrides: args.ruleOverrides,
+			ruleOptionsOverrides: args.ruleOptionsOverrides,
 			config: args.configPath,
 			ignore: args.ignorePath,
 			format: args.format
@@ -3492,6 +4288,7 @@ function main() {
 		fix: args.fix,
 		quiet: args.quiet,
 		ruleOverrides: args.ruleOverrides,
+		ruleOptionsOverrides: args.ruleOptionsOverrides,
 		config: args.configPath,
 		ignore: args.ignorePath
 	});
@@ -3503,7 +4300,8 @@ function main() {
 	}
 	if (result.totalErrors > 0) process.exit(1);
 }
-main();
+if (import.meta.main === true) main();
 
 //#endregion
+export { parseRuleOptionsOverride };
 //# sourceMappingURL=cli.js.map