@svelte-vitals/core 0.15.0 → 0.16.0

package/dist/index.d.ts

@@ -54,8 +54,8 @@ interface Result {
     /** 1-based source line for element-level findings (e.g. a specific <img>). */
     line?: number;
 }
-type Scope = 'route' | 'project';
-type Category = 'seo' | 'performance';
+type Scope = 'route' | 'project' | 'component';
+type Category = 'seo' | 'performance' | 'correctness' | 'security';
 /** How dynamic (`{data.title}`) values are treated by scoring (design §4, §12). */
 type TreatDynamicAs = 'pass' | 'warn' | 'fail';
 /** Per-rule override: disable, or change severity. */
@@ -198,6 +198,42 @@ interface ResolvedHeadings {
     headings: HeadingInfo[];
 }
 
+/**
+ * Component-body facts for the Correctness category — the source-analysis boundary
+ * (mirrors images.ts / headings.ts). Collected by the static (CLI) provider only;
+ * the rendered provider can't see reactivity, so correctness rules no-op there.
+ */
+/** An `{#each}` block in a component template. */
+interface EachBlockFact {
+    /** True when the block has a key, e.g. `{#each items as item (item.id)}`. */
+    hasKey: boolean;
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+}
+/** An `$effect(...)` / `$effect.pre(...)` call in a component's instance script. */
+interface EffectFact {
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+    /** True when the effect body only assigns to `$state` variables (the "use $derived" smell). */
+    assignsOnlyState: boolean;
+}
+/** A flagged source position in a component (e.g. an `{@html}` tag or a `javascript:` URL). */
+interface SourceSpan {
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+}
+/** Reactivity/correctness + security facts parsed from one `.svelte` component. */
+interface ComponentFacts {
+    /** Source file the component came from. */
+    file: string;
+    eachBlocks: EachBlockFact[];
+    effects: EffectFact[];
+    /** `{@html …}` occurrences — raw-HTML render surfaces (Security SEC001). */
+    htmlTags: SourceSpan[];
+    /** Element attributes with a literal `javascript:` URL (Security SEC002). */
+    javascriptUrls: SourceSpan[];
+}
+
 /**
  * Source-file locations that satisfy the project-scope rules, shared by every
  * mode so the static (CLI) and rendered (plugin) collectors never drift. This
@@ -215,6 +251,8 @@ interface RuleContext {
     images?: ResolvedImages[];
     /** Per-route page-body headings for SEO027 (absent in modes that don't collect them). */
     headings?: ResolvedHeadings[];
+    /** Per-file component-body facts for Correctness rules (static/CLI mode only). */
+    components?: ComponentFacts[];
     project: Project;
     config: Config;
 }
@@ -282,9 +320,9 @@ declare const perf004FontPreloadCrossorigin: Rule;
 
 /**
  * PERF005 — LCP image not lazy-loaded. Lazy-loading the largest contentful paint
- * image delays it. Static analysis approximates the LCP as the first <img> in
- * document order for the route; if that image is loading="lazy", flag it.
- * CLI/static only (the rendered provider does not collect <img>).
+ * image delays it. Analysis approximates the LCP as the first <img> in document
+ * order for the route; if that image is loading="lazy", flag it. Runs in both
+ * static (CLI) and rendered (vite) mode, since both providers collect <img>.
  */
 declare const perf005LcpImage: Rule;
 
@@ -330,8 +368,8 @@ declare const seo023DescriptionLength: Rule;
 declare const seo024Charset: Rule;
 
 /**
- * SEO025 — Image alt text. Reuses the <img> collection (CLI/static only; rendered
- * mode does not collect images, so the rule no-ops there, like PERF001/002).
+ * SEO025 — Image alt text. Reuses the <img> collection from both providers — the
+ * static (CLI) source parser and the rendered (vite) HTML parser — like PERF001/002.
  * Presence only: an explicit empty `alt=""` is a valid decorative-image signal and
  * passes; a spread `{...rest}` may supply alt, so it is not flagged.
  */
@@ -353,6 +391,23 @@ declare const seo026Hreflang: Rule;
  */
 declare const seo027Heading: Rule;
 
+declare const seo028TitleUnique: Rule;
+declare const seo029DescriptionUnique: Rule;
+
+/**
+ * SEO030 — Skipped heading level. Walking a route's body headings in document
+ * order, a level that jumps more than +1 over the previous heading (e.g. h2 → h4)
+ * breaks the outline. The first heading has no predecessor (missing/multiple
+ * <h1> stays SEO027's concern). A route with no headings emits nothing.
+ */
+declare const seo030HeadingOrder: Rule;
+
+declare const correct001EachKey: Rule;
+declare const correct002EffectDerived: Rule;
+
+declare const sec001Html: Rule;
+declare const sec002JavascriptUrl: Rule;
+
 declare const allRules: Rule[];
 
 interface RuleInfo {
@@ -561,4 +616,4 @@ declare function selectRules(rules: Rule[], config: Config): Rule[];
 /** Apply per-rule severity overrides to results (design §6). */
 declare function applyRuleSeverities(results: Result[], config: Config): Result[];
 
-export { BAND_COLOR, type Category, type Classification, type Config, type ConsoleReportOptions, type Detection, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type Rule, type RuleContext, type RuleInfo, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type Summary, type TreatDynamicAs, type Value, allRules, applyRuleSeverities, buildHtmlDocument, buildJsonReport, classify, computeHealth, computeScore, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, escapeHtml, explainRule, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, linkRule, perf001ImageDimensions, perf002ImageLoading, perf003PreloadAs, perf004FontPreloadCrossorigin, perf005LcpImage, perf006ResponsiveImage, perf007RenderBlockingScript, perf008Preconnect, runRules, safeHref, scoreBand, scoresByCategory, selectRules, seo001Title, seo002Description, seo003Canonical, seo004OgImage, seo005OgTitle, seo006Robots, seo007Sitemap, seo008JsonLd, seo009HtmlLang, seo010Indexability, seo011TwitterCard, seo012OgDescription, seo013OgUrl, seo014Viewport, seo015SitemapInRobots, seo016JsonLdValidity, seo017DeprecatedType, seo018RelativeUrl, seo019DateFormat, seo020Placeholder, seo021RequiredProps, seo022TitleLength, seo023DescriptionLength, seo024Charset, seo025ImageAlt, seo026Hreflang, seo027Heading, summarize };
+export { BAND_COLOR, type Category, type Classification, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type Rule, type RuleContext, type RuleInfo, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type TreatDynamicAs, type Value, allRules, applyRuleSeverities, buildHtmlDocument, buildJsonReport, classify, computeHealth, computeScore, correct001EachKey, correct002EffectDerived, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, escapeHtml, explainRule, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, linkRule, perf001ImageDimensions, perf002ImageLoading, perf003PreloadAs, perf004FontPreloadCrossorigin, perf005LcpImage, perf006ResponsiveImage, perf007RenderBlockingScript, perf008Preconnect, runRules, safeHref, scoreBand, scoresByCategory, sec001Html, sec002JavascriptUrl, selectRules, seo001Title, seo002Description, seo003Canonical, seo004OgImage, seo005OgTitle, seo006Robots, seo007Sitemap, seo008JsonLd, seo009HtmlLang, seo010Indexability, seo011TwitterCard, seo012OgDescription, seo013OgUrl, seo014Viewport, seo015SitemapInRobots, seo016JsonLdValidity, seo017DeprecatedType, seo018RelativeUrl, seo019DateFormat, seo020Placeholder, seo021RequiredProps, seo022TitleLength, seo023DescriptionLength, seo024Charset, seo025ImageAlt, seo026Hreflang, seo027Heading, seo028TitleUnique, seo029DescriptionUnique, seo030HeadingOrder, summarize };

package/dist/index.js

@@ -94,7 +94,7 @@ function detect(head, match) {
   return tag ? { presence: tag.presence, value: tag.value } : { presence: "none", value: "absent" };
 }
 function headTagRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -117,7 +117,7 @@ function headTagRule(opts) {
           location: head.file,
           message,
           recommendation: opts.recommendation,
-          docsUrl: docsUrl6,
+          docsUrl: docsUrl7,
           // Copy per finding: opts.fix is a rule-level template shared across all
           // results this rule emits; a fresh object keeps findings independent.
           ...opts.fix ? { fix: { ...opts.fix } } : {}
@@ -296,7 +296,7 @@ var seo009HtmlLang = {
 
 // src/rules/perf/image-rule.ts
 function imageRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   const category = opts.category ?? "performance";
   return {
     id: opts.id,
@@ -320,7 +320,7 @@ function imageRule(opts) {
             route: route.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           });
           continue;
         }
@@ -335,7 +335,7 @@ function imageRule(opts) {
             ...img.line > 0 ? { line: img.line } : {},
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -391,7 +391,7 @@ var perf006ResponsiveImage = imageRule({
 
 // src/rules/perf/link-rule.ts
 function linkRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -415,7 +415,7 @@ function linkRule(opts) {
             route: head.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           });
           continue;
         }
@@ -432,7 +432,7 @@ function linkRule(opts) {
             location: tag.file ?? head.file,
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -658,7 +658,7 @@ var seo010Indexability = {
   rationale: "A noindex directive removes the page from search results; an accidental noindex on a public route silently deindexes it.",
   fix: SEO010_FIX,
   async check(ctx) {
-    const docsUrl6 = docsUrlFor("SEO010");
+    const docsUrl7 = docsUrlFor("SEO010");
     const out = [];
     for (const head of ctx.heads) {
       const noindexed = head.tags.some((t) => t.kind === "meta" && t.name === "robots" && t.noindex === true);
@@ -673,7 +673,7 @@ var seo010Indexability = {
         location: head.file,
         message: "Route is noindex \u2014 verify this is intentional",
         recommendation: 'If this route should be indexed, remove noindex from its <meta name="robots">.',
-        docsUrl: docsUrl6,
+        docsUrl: docsUrl7,
         fix: { ...SEO010_FIX }
       });
     }
@@ -928,7 +928,7 @@ var seo016JsonLdValidity = {
     lang: "svelte"
   },
   async check(ctx) {
-    const docsUrl6 = docsUrlFor("SEO016");
+    const docsUrl7 = docsUrlFor("SEO016");
     const out = [];
     for (const head of ctx.heads) {
       for (const tag of jsonldTags(head)) {
@@ -947,7 +947,7 @@ var seo016JsonLdValidity = {
             location: head.file,
             message: problem,
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             fix: { ...seo016JsonLdValidity.fix }
           } : {
             id: "SEO016",
@@ -957,7 +957,7 @@ var seo016JsonLdValidity = {
             route: head.route,
             message: "JSON-LD validity",
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           }
         );
       }
@@ -966,7 +966,7 @@ var seo016JsonLdValidity = {
   }
 };
 function jsonldRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -994,7 +994,7 @@ function jsonldRule(opts) {
               location: head.file,
               message: problem,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl6,
+              docsUrl: docsUrl7,
               ...opts.fix ? { fix: { ...opts.fix } } : {}
             } : {
               id: opts.id,
@@ -1004,7 +1004,7 @@ function jsonldRule(opts) {
               route: head.route,
               message: opts.label,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl6
+              docsUrl: docsUrl7
             }
           );
         }
@@ -1095,15 +1095,18 @@ var seo021RequiredProps = jsonldRule({
 
 // src/rules/seo/text-metrics.ts
 var segmenter = typeof Intl !== "undefined" && typeof Intl.Segmenter === "function" ? new Intl.Segmenter() : void 0;
+function collapseWhitespace(s) {
+  return s.trim().replace(/\s+/g, " ");
+}
 function visibleLength(s) {
-  const collapsed = s.trim().replace(/\s+/g, " ");
+  const collapsed = collapseWhitespace(s);
   if (!segmenter) return [...collapsed].length;
   return [...segmenter.segment(collapsed)].length;
 }
 
 // src/rules/seo/seo022-023.ts
 function lengthRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -1130,7 +1133,7 @@ function lengthRule(opts) {
             location: tag.file ?? head.file,
             message: problem,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           } : {
             id: opts.id,
             category: "seo",
@@ -1139,7 +1142,7 @@ function lengthRule(opts) {
             route: head.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           }
         );
       }
@@ -1314,6 +1317,219 @@ var seo027Heading = {
   }
 };
 
+// src/rules/seo/seo028-029-uniqueness.ts
+function uniquenessRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: "seo",
+    severity: "warning",
+    scope: "route",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const entries = [];
+      const counts = /* @__PURE__ */ new Map();
+      for (const head of ctx.heads) {
+        const tag = head.tags.find(opts.match);
+        if (!tag || typeof tag.text !== "string") continue;
+        const text = collapseWhitespace(tag.text);
+        if (text.length === 0) continue;
+        entries.push({ route: head.route, file: tag.file ?? head.file, text });
+        counts.set(text, (counts.get(text) ?? 0) + 1);
+      }
+      return entries.map((e) => {
+        const n = counts.get(e.text) ?? 1;
+        return n > 1 ? {
+          id: opts.id,
+          category: "seo",
+          severity: "warning",
+          detection: PENALIZED,
+          route: e.route,
+          location: e.file,
+          message: `${opts.noun} is duplicated across ${n} routes`,
+          recommendation: opts.recommendation,
+          docsUrl: docsUrl7
+        } : {
+          id: opts.id,
+          category: "seo",
+          severity: "warning",
+          detection: PASS,
+          route: e.route,
+          message: opts.label,
+          recommendation: opts.recommendation,
+          docsUrl: docsUrl7
+        };
+      });
+    }
+  };
+}
+var seo028TitleUnique = uniquenessRule({
+  id: "SEO028",
+  title: "Duplicate title",
+  label: "Unique title",
+  noun: "Title",
+  match: (t) => t.kind === "title",
+  recommendation: "Give each route a unique <title> that describes that page specifically.",
+  rationale: "Duplicate titles across pages make them compete in search results and weaken each page\u2019s relevance signal."
+});
+var seo029DescriptionUnique = uniquenessRule({
+  id: "SEO029",
+  title: "Duplicate description",
+  label: "Unique description",
+  noun: "Description",
+  match: (t) => t.kind === "meta" && t.name === "description",
+  recommendation: "Write a unique meta description per route so each search snippet is page-specific.",
+  rationale: "Duplicate meta descriptions give search engines no per-page summary, so they are often ignored or rewritten."
+});
+
+// src/rules/seo/seo030-heading-order.ts
+var docsUrl6 = docsUrlFor("SEO030");
+var recommendation6 = "Increase heading levels one step at a time (do not jump, e.g. from <h2> straight to <h4>).";
+var seo030HeadingOrder = {
+  id: "SEO030",
+  title: "Heading order",
+  category: "seo",
+  severity: "info",
+  scope: "route",
+  rationale: "Skipping a heading level breaks the document outline that search engines and assistive tech rely on to understand page structure.",
+  async check(ctx) {
+    const out = [];
+    for (const route of ctx.headings ?? []) {
+      if (route.headings.length === 0) continue;
+      let prev = route.headings[0].level;
+      let skip;
+      for (let i = 1; i < route.headings.length; i++) {
+        const h = route.headings[i];
+        if (h.level > prev + 1) {
+          skip = { level: h.level, prev, line: h.line, file: h.file };
+          break;
+        }
+        prev = h.level;
+      }
+      out.push(
+        skip ? {
+          id: "SEO030",
+          category: "seo",
+          severity: "info",
+          detection: PENALIZED,
+          route: route.route,
+          location: skip.file,
+          ...skip.line > 0 ? { line: skip.line } : {},
+          message: `Heading level skipped (<h${skip.prev}> to <h${skip.level}>)`,
+          recommendation: recommendation6,
+          docsUrl: docsUrl6
+        } : {
+          id: "SEO030",
+          category: "seo",
+          severity: "info",
+          detection: PASS,
+          route: route.route,
+          message: "Heading order",
+          recommendation: recommendation6,
+          docsUrl: docsUrl6
+        }
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/component-rule.ts
+var PENALIZED2 = { presence: "none", value: "absent" };
+var PASS2 = { presence: "own", value: "static" };
+function componentRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  const severity = opts.severity ?? "warning";
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: opts.category,
+    severity,
+    scope: "component",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const out = [];
+      for (const c of ctx.components ?? []) {
+        if (!opts.applies(c)) continue;
+        const bad = opts.bad(c);
+        if (bad.length === 0) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PASS2,
+            route: c.file,
+            message: opts.label,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+          continue;
+        }
+        for (const b of bad) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PENALIZED2,
+            route: c.file,
+            location: c.file,
+            ...b.line > 0 ? { line: b.line } : {},
+            message: b.message,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/rules/correctness/correct001-002.ts
+var correct001EachKey = componentRule({
+  id: "CORRECT001",
+  title: "Keyed each block",
+  category: "correctness",
+  label: "Keyed {#each}",
+  recommendation: "Add a key to the {#each} block, e.g. {#each items as item (item.id)}.",
+  rationale: "An unkeyed {#each} destroys and recreates DOM nodes when the list reorders, losing element state/focus and wasting work; a key lets Svelte move nodes instead.",
+  applies: (c) => c.eachBlocks.length > 0,
+  bad: (c) => c.eachBlocks.filter((e) => !e.hasKey).map((e) => ({ line: e.line, message: "{#each} block has no key" }))
+});
+var correct002EffectDerived = componentRule({
+  id: "CORRECT002",
+  title: "Effect used to derive state",
+  category: "correctness",
+  label: "$effect usage",
+  recommendation: "Replace the state-syncing $effect with a derived value, e.g. let x = $derived(expr).",
+  rationale: 'An $effect whose body only assigns to $state is the "useEffect \u2192 $effect" anti-pattern: it reruns after render and can cause extra passes or loops. $derived expresses the same dependency declaratively.',
+  applies: (c) => c.effects.length > 0,
+  bad: (c) => c.effects.filter((e) => e.assignsOnlyState).map((e) => ({ line: e.line, message: "$effect only assigns state \u2014 use $derived instead" }))
+});
+
+// src/rules/security/sec001-002.ts
+var sec001Html = componentRule({
+  id: "SEC001",
+  title: "Raw HTML render",
+  category: "security",
+  label: "{@html} usage",
+  recommendation: "Sanitize the value before {@html} (e.g. DOMPurify), or render it as text/markup instead.",
+  rationale: "{@html} renders its value as unescaped HTML; if the value can contain user input and is not sanitized, it is a cross-site-scripting (XSS) vector.",
+  applies: (c) => c.htmlTags.length > 0,
+  bad: (c) => c.htmlTags.map((h) => ({ line: h.line, message: "{@html} renders unescaped HTML \u2014 ensure it is sanitized" }))
+});
+var sec002JavascriptUrl = componentRule({
+  id: "SEC002",
+  title: "javascript: URL",
+  category: "security",
+  label: "No javascript: URLs",
+  recommendation: "Use an event handler or a real URL instead of a javascript: URL.",
+  rationale: "A javascript: URL in href/src/action executes arbitrary script on activation \u2014 an XSS / unsafe-navigation vector that also breaks under a strict Content-Security-Policy.",
+  applies: (c) => c.javascriptUrls.length > 0,
+  bad: (c) => c.javascriptUrls.map((u) => ({ line: u.line, message: "javascript: URL in an attribute" }))
+});
+
 // src/rules/index.ts
 var allRules = [
   seo001Title,
@@ -1350,7 +1566,14 @@ var allRules = [
   perf005LcpImage,
   perf006ResponsiveImage,
   perf007RenderBlockingScript,
-  perf008Preconnect
+  perf008Preconnect,
+  seo028TitleUnique,
+  seo029DescriptionUnique,
+  seo030HeadingOrder,
+  correct001EachKey,
+  correct002EffectDerived,
+  sec001Html,
+  sec002JavascriptUrl
 ];
 function explainRule(id) {
   const target = id.toUpperCase();
@@ -1486,9 +1709,11 @@ var SEVERITY_TITLE = {
 };
 var CATEGORY_LABEL = {
   seo: "SEO",
-  performance: "Performance"
+  performance: "Performance",
+  correctness: "Correctness",
+  security: "Security"
 };
-var CATEGORY_ORDER = ["seo", "performance"];
+var CATEGORY_ORDER = ["seo", "performance", "correctness", "security"];
 function scoreLine(label, { score, scoreModel }) {
   const parts = [`route avg ${scoreModel.routeAverage}`];
   if (scoreModel.sitePenalty > 0) parts.push(`site \u2212${scoreModel.sitePenalty}`);
@@ -1941,6 +2166,8 @@ export {
   classify,
   computeHealth,
   computeScore,
+  correct001EachKey,
+  correct002EffectDerived,
   defaultConfig,
   defaultProject,
   defineConfig,
@@ -1971,6 +2198,8 @@ export {
   safeHref,
   scoreBand,
   scoresByCategory,
+  sec001Html,
+  sec002JavascriptUrl,
   selectRules,
   seo001Title,
   seo002Description,
@@ -1999,5 +2228,8 @@ export {
   seo025ImageAlt,
   seo026Hreflang,
   seo027Heading,
+  seo028TitleUnique,
+  seo029DescriptionUnique,
+  seo030HeadingOrder,
   summarize
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svelte-vitals/core",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Shared, runtime-agnostic core for svelte-vitals (types, rule engine, scorer, reporter).",
   "type": "module",
   "license": "MIT",