@svelte-vitals/core 0.15.0 → 0.18.0

package/dist/index.d.ts

@@ -54,8 +54,8 @@ interface Result {
     /** 1-based source line for element-level findings (e.g. a specific <img>). */
     line?: number;
 }
-type Scope = 'route' | 'project';
-type Category = 'seo' | 'performance';
+type Scope = 'route' | 'project' | 'component';
+type Category = 'seo' | 'performance' | 'correctness' | 'security' | 'architecture';
 /** How dynamic (`{data.title}`) values are treated by scoring (design §4, §12). */
 type TreatDynamicAs = 'pass' | 'warn' | 'fail';
 /** Per-rule override: disable, or change severity. */
@@ -198,6 +198,60 @@ interface ResolvedHeadings {
     headings: HeadingInfo[];
 }
 
+/**
+ * Component-body facts for the Correctness category — the source-analysis boundary
+ * (mirrors images.ts / headings.ts). Collected by the static (CLI) provider only;
+ * the rendered provider can't see reactivity, so correctness rules no-op there.
+ */
+/** An `{#each}` block in a component template. */
+interface EachBlockFact {
+    /** True when the block has a key, e.g. `{#each items as item (item.id)}`. */
+    hasKey: boolean;
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+}
+/** An `$effect(...)` / `$effect.pre(...)` call in a component's instance script. */
+interface EffectFact {
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+    /** True when the effect body only assigns to `$state` variables (the "use $derived" smell). */
+    assignsOnlyState: boolean;
+    /** True when this $effect has a NON-EMPTY body that reads no reactive value and makes no bare call — it never re-runs, so it should be onMount (CORRECT003). */
+    mountOnly: boolean;
+}
+/** A flagged source position in a component (e.g. an `{@html}` tag or a `javascript:` URL). */
+interface SourceSpan {
+    /** 1-based source line, or 0 if unknown. */
+    line: number;
+}
+/** Reactivity/correctness + security + architecture facts parsed from one `.svelte` component. */
+interface ComponentFacts {
+    /** Source file the component came from. */
+    file: string;
+    eachBlocks: EachBlockFact[];
+    effects: EffectFact[];
+    /** `{@html …}` occurrences — raw-HTML render surfaces (Security SEC001). */
+    htmlTags: SourceSpan[];
+    /** Element attributes with a literal `javascript:` URL (Security SEC002). */
+    javascriptUrls: SourceSpan[];
+    /** Source line count of the component file (Architecture ARCH001). */
+    loc: number;
+    /** Named props destructured from `$props()`; 0 when unknowable (rest / non-destructured) (Architecture ARCH002). */
+    propCount: number;
+    /** Module specifiers of every `import` in the instance + module scripts (Bundle PERF009). */
+    imports: string[];
+    /** Value `import * as X from '<bare pkg>'` namespace imports (type-only excluded) — Bundle PERF010. */
+    namespaceImports: {
+        source: string;
+        line: number;
+    }[];
+    /** `$state` declarations never written or escaped anywhere in the component — candidates for const (CORRECT004). */
+    constableStates: {
+        name: string;
+        line: number;
+    }[];
+}
+
 /**
  * Source-file locations that satisfy the project-scope rules, shared by every
  * mode so the static (CLI) and rendered (plugin) collectors never drift. This
@@ -215,6 +269,8 @@ interface RuleContext {
     images?: ResolvedImages[];
     /** Per-route page-body headings for SEO027 (absent in modes that don't collect them). */
     headings?: ResolvedHeadings[];
+    /** Per-file component-body facts for Correctness rules (static/CLI mode only). */
+    components?: ComponentFacts[];
     project: Project;
     config: Config;
 }
@@ -282,9 +338,9 @@ declare const perf004FontPreloadCrossorigin: Rule;
 
 /**
  * PERF005 — LCP image not lazy-loaded. Lazy-loading the largest contentful paint
- * image delays it. Static analysis approximates the LCP as the first <img> in
- * document order for the route; if that image is loading="lazy", flag it.
- * CLI/static only (the rendered provider does not collect <img>).
+ * image delays it. Analysis approximates the LCP as the first <img> in document
+ * order for the route; if that image is loading="lazy", flag it. Runs in both
+ * static (CLI) and rendered (vite) mode, since both providers collect <img>.
  */
 declare const perf005LcpImage: Rule;
 
@@ -330,8 +386,8 @@ declare const seo023DescriptionLength: Rule;
 declare const seo024Charset: Rule;
 
 /**
- * SEO025 — Image alt text. Reuses the <img> collection (CLI/static only; rendered
- * mode does not collect images, so the rule no-ops there, like PERF001/002).
+ * SEO025 — Image alt text. Reuses the <img> collection from both providers — the
+ * static (CLI) source parser and the rendered (vite) HTML parser — like PERF001/002.
  * Presence only: an explicit empty `alt=""` is a valid decorative-image signal and
  * passes; a spread `{...rest}` may supply alt, so it is not flagged.
  */
@@ -353,6 +409,33 @@ declare const seo026Hreflang: Rule;
  */
 declare const seo027Heading: Rule;
 
+declare const seo028TitleUnique: Rule;
+declare const seo029DescriptionUnique: Rule;
+
+/**
+ * SEO030 — Skipped heading level. Walking a route's body headings in document
+ * order, a level that jumps more than +1 over the previous heading (e.g. h2 → h4)
+ * breaks the outline. The first heading has no predecessor (missing/multiple
+ * <h1> stays SEO027's concern). A route with no headings emits nothing.
+ */
+declare const seo030HeadingOrder: Rule;
+
+declare const correct001EachKey: Rule;
+declare const correct002EffectDerived: Rule;
+declare const correct003EffectAsOnMount: Rule;
+
+declare const correct004UnmutatedState: Rule;
+
+declare const sec001Html: Rule;
+declare const sec002JavascriptUrl: Rule;
+
+declare const arch001ComponentSize: Rule;
+declare const arch002PropCount: Rule;
+
+declare const perf009HeavyImport: Rule;
+
+declare const perf010NamespaceImport: Rule;
+
 declare const allRules: Rule[];
 
 interface RuleInfo {
@@ -443,10 +526,26 @@ declare function summarize(results: Result[], config: Config): Summary;
 /** Whether the run should fail the build/CI per the minimum failing severity. */
 declare function hasFailureAtOrAbove(summary: Summary, min: Severity): boolean;
 
+/** String decorators for the console reporter. Injected so core stays pure/dep-free. */
+interface Palette {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    red: (s: string) => string;
+    yellow: (s: string) => string;
+    green: (s: string) => string;
+    cyan: (s: string) => string;
+}
+/** Default: no decoration (identity) — output is byte-identical to plain text. */
+declare const noColorPalette: Palette;
+/** Green ≥ 90, yellow ≥ 70, red otherwise — for a 0–100 score. */
+declare function scoreColor(p: Palette, score: number): (s: string) => string;
+
 interface ConsoleReportOptions {
     byRoute?: boolean;
     /** Mode label shown in the header (default 'static mode'). */
     mode?: string;
+    /** Color decorators; defaults to no color. */
+    palette?: Palette;
 }
 /**
  * Render results as a console report string (design §7). Pure: returns a string,
@@ -561,4 +660,4 @@ declare function selectRules(rules: Rule[], config: Config): Rule[];
 /** Apply per-rule severity overrides to results (design §6). */
 declare function applyRuleSeverities(results: Result[], config: Config): Result[];
 
-export { BAND_COLOR, type Category, type Classification, type Config, type ConsoleReportOptions, type Detection, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type Rule, type RuleContext, type RuleInfo, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type Summary, type TreatDynamicAs, type Value, allRules, applyRuleSeverities, buildHtmlDocument, buildJsonReport, classify, computeHealth, computeScore, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, escapeHtml, explainRule, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, linkRule, perf001ImageDimensions, perf002ImageLoading, perf003PreloadAs, perf004FontPreloadCrossorigin, perf005LcpImage, perf006ResponsiveImage, perf007RenderBlockingScript, perf008Preconnect, runRules, safeHref, scoreBand, scoresByCategory, selectRules, seo001Title, seo002Description, seo003Canonical, seo004OgImage, seo005OgTitle, seo006Robots, seo007Sitemap, seo008JsonLd, seo009HtmlLang, seo010Indexability, seo011TwitterCard, seo012OgDescription, seo013OgUrl, seo014Viewport, seo015SitemapInRobots, seo016JsonLdValidity, seo017DeprecatedType, seo018RelativeUrl, seo019DateFormat, seo020Placeholder, seo021RequiredProps, seo022TitleLength, seo023DescriptionLength, seo024Charset, seo025ImageAlt, seo026Hreflang, seo027Heading, summarize };
+export { BAND_COLOR, type Category, type Classification, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type Rule, type RuleContext, type RuleInfo, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type TreatDynamicAs, type Value, allRules, applyRuleSeverities, arch001ComponentSize, arch002PropCount, buildHtmlDocument, buildJsonReport, classify, computeHealth, computeScore, correct001EachKey, correct002EffectDerived, correct003EffectAsOnMount, correct004UnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, escapeHtml, explainRule, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, linkRule, noColorPalette, perf001ImageDimensions, perf002ImageLoading, perf003PreloadAs, perf004FontPreloadCrossorigin, perf005LcpImage, perf006ResponsiveImage, perf007RenderBlockingScript, perf008Preconnect, perf009HeavyImport, perf010NamespaceImport, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, sec001Html, sec002JavascriptUrl, selectRules, seo001Title, seo002Description, seo003Canonical, seo004OgImage, seo005OgTitle, seo006Robots, seo007Sitemap, seo008JsonLd, seo009HtmlLang, seo010Indexability, seo011TwitterCard, seo012OgDescription, seo013OgUrl, seo014Viewport, seo015SitemapInRobots, seo016JsonLdValidity, seo017DeprecatedType, seo018RelativeUrl, seo019DateFormat, seo020Placeholder, seo021RequiredProps, seo022TitleLength, seo023DescriptionLength, seo024Charset, seo025ImageAlt, seo026Hreflang, seo027Heading, seo028TitleUnique, seo029DescriptionUnique, seo030HeadingOrder, summarize };

package/dist/index.js

@@ -94,7 +94,7 @@ function detect(head, match) {
   return tag ? { presence: tag.presence, value: tag.value } : { presence: "none", value: "absent" };
 }
 function headTagRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -117,7 +117,7 @@ function headTagRule(opts) {
           location: head.file,
           message,
           recommendation: opts.recommendation,
-          docsUrl: docsUrl6,
+          docsUrl: docsUrl7,
           // Copy per finding: opts.fix is a rule-level template shared across all
           // results this rule emits; a fresh object keeps findings independent.
           ...opts.fix ? { fix: { ...opts.fix } } : {}
@@ -296,7 +296,7 @@ var seo009HtmlLang = {
 
 // src/rules/perf/image-rule.ts
 function imageRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   const category = opts.category ?? "performance";
   return {
     id: opts.id,
@@ -320,7 +320,7 @@ function imageRule(opts) {
             route: route.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           });
           continue;
         }
@@ -335,7 +335,7 @@ function imageRule(opts) {
             ...img.line > 0 ? { line: img.line } : {},
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -391,7 +391,7 @@ var perf006ResponsiveImage = imageRule({
 
 // src/rules/perf/link-rule.ts
 function linkRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -415,7 +415,7 @@ function linkRule(opts) {
             route: head.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           });
           continue;
         }
@@ -432,7 +432,7 @@ function linkRule(opts) {
             location: tag.file ?? head.file,
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -658,7 +658,7 @@ var seo010Indexability = {
   rationale: "A noindex directive removes the page from search results; an accidental noindex on a public route silently deindexes it.",
   fix: SEO010_FIX,
   async check(ctx) {
-    const docsUrl6 = docsUrlFor("SEO010");
+    const docsUrl7 = docsUrlFor("SEO010");
     const out = [];
     for (const head of ctx.heads) {
       const noindexed = head.tags.some((t) => t.kind === "meta" && t.name === "robots" && t.noindex === true);
@@ -673,7 +673,7 @@ var seo010Indexability = {
         location: head.file,
         message: "Route is noindex \u2014 verify this is intentional",
         recommendation: 'If this route should be indexed, remove noindex from its <meta name="robots">.',
-        docsUrl: docsUrl6,
+        docsUrl: docsUrl7,
         fix: { ...SEO010_FIX }
       });
     }
@@ -928,7 +928,7 @@ var seo016JsonLdValidity = {
     lang: "svelte"
   },
   async check(ctx) {
-    const docsUrl6 = docsUrlFor("SEO016");
+    const docsUrl7 = docsUrlFor("SEO016");
     const out = [];
     for (const head of ctx.heads) {
       for (const tag of jsonldTags(head)) {
@@ -947,7 +947,7 @@ var seo016JsonLdValidity = {
             location: head.file,
             message: problem,
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl6,
+            docsUrl: docsUrl7,
             fix: { ...seo016JsonLdValidity.fix }
           } : {
             id: "SEO016",
@@ -957,7 +957,7 @@ var seo016JsonLdValidity = {
             route: head.route,
             message: "JSON-LD validity",
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           }
         );
       }
@@ -966,7 +966,7 @@ var seo016JsonLdValidity = {
   }
 };
 function jsonldRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -994,7 +994,7 @@ function jsonldRule(opts) {
               location: head.file,
               message: problem,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl6,
+              docsUrl: docsUrl7,
               ...opts.fix ? { fix: { ...opts.fix } } : {}
             } : {
               id: opts.id,
@@ -1004,7 +1004,7 @@ function jsonldRule(opts) {
               route: head.route,
               message: opts.label,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl6
+              docsUrl: docsUrl7
             }
           );
         }
@@ -1095,15 +1095,18 @@ var seo021RequiredProps = jsonldRule({
 
 // src/rules/seo/text-metrics.ts
 var segmenter = typeof Intl !== "undefined" && typeof Intl.Segmenter === "function" ? new Intl.Segmenter() : void 0;
+function collapseWhitespace(s) {
+  return s.trim().replace(/\s+/g, " ");
+}
 function visibleLength(s) {
-  const collapsed = s.trim().replace(/\s+/g, " ");
+  const collapsed = collapseWhitespace(s);
   if (!segmenter) return [...collapsed].length;
   return [...segmenter.segment(collapsed)].length;
 }
 
 // src/rules/seo/seo022-023.ts
 function lengthRule(opts) {
-  const docsUrl6 = docsUrlFor(opts.id);
+  const docsUrl7 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -1130,7 +1133,7 @@ function lengthRule(opts) {
             location: tag.file ?? head.file,
             message: problem,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           } : {
             id: opts.id,
             category: "seo",
@@ -1139,7 +1142,7 @@ function lengthRule(opts) {
             route: head.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl6
+            docsUrl: docsUrl7
           }
         );
       }
@@ -1314,6 +1317,322 @@ var seo027Heading = {
   }
 };
 
+// src/rules/seo/seo028-029-uniqueness.ts
+function uniquenessRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: "seo",
+    severity: "warning",
+    scope: "route",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const entries = [];
+      const counts = /* @__PURE__ */ new Map();
+      for (const head of ctx.heads) {
+        const tag = head.tags.find(opts.match);
+        if (!tag || typeof tag.text !== "string") continue;
+        const text = collapseWhitespace(tag.text);
+        if (text.length === 0) continue;
+        entries.push({ route: head.route, file: tag.file ?? head.file, text });
+        counts.set(text, (counts.get(text) ?? 0) + 1);
+      }
+      return entries.map((e) => {
+        const n = counts.get(e.text) ?? 1;
+        return n > 1 ? {
+          id: opts.id,
+          category: "seo",
+          severity: "warning",
+          detection: PENALIZED,
+          route: e.route,
+          location: e.file,
+          message: `${opts.noun} is duplicated across ${n} routes`,
+          recommendation: opts.recommendation,
+          docsUrl: docsUrl7
+        } : {
+          id: opts.id,
+          category: "seo",
+          severity: "warning",
+          detection: PASS,
+          route: e.route,
+          message: opts.label,
+          recommendation: opts.recommendation,
+          docsUrl: docsUrl7
+        };
+      });
+    }
+  };
+}
+var seo028TitleUnique = uniquenessRule({
+  id: "SEO028",
+  title: "Duplicate title",
+  label: "Unique title",
+  noun: "Title",
+  match: (t) => t.kind === "title",
+  recommendation: "Give each route a unique <title> that describes that page specifically.",
+  rationale: "Duplicate titles across pages make them compete in search results and weaken each page\u2019s relevance signal."
+});
+var seo029DescriptionUnique = uniquenessRule({
+  id: "SEO029",
+  title: "Duplicate description",
+  label: "Unique description",
+  noun: "Description",
+  match: (t) => t.kind === "meta" && t.name === "description",
+  recommendation: "Write a unique meta description per route so each search snippet is page-specific.",
+  rationale: "Duplicate meta descriptions give search engines no per-page summary, so they are often ignored or rewritten."
+});
+
+// src/rules/seo/seo030-heading-order.ts
+var docsUrl6 = docsUrlFor("SEO030");
+var recommendation6 = "Increase heading levels one step at a time (do not jump, e.g. from <h2> straight to <h4>).";
+var seo030HeadingOrder = {
+  id: "SEO030",
+  title: "Heading order",
+  category: "seo",
+  severity: "info",
+  scope: "route",
+  rationale: "Skipping a heading level breaks the document outline that search engines and assistive tech rely on to understand page structure.",
+  async check(ctx) {
+    const out = [];
+    for (const route of ctx.headings ?? []) {
+      if (route.headings.length === 0) continue;
+      let prev = route.headings[0].level;
+      let skip;
+      for (let i = 1; i < route.headings.length; i++) {
+        const h = route.headings[i];
+        if (h.level > prev + 1) {
+          skip = { level: h.level, prev, line: h.line, file: h.file };
+          break;
+        }
+        prev = h.level;
+      }
+      out.push(
+        skip ? {
+          id: "SEO030",
+          category: "seo",
+          severity: "info",
+          detection: PENALIZED,
+          route: route.route,
+          location: skip.file,
+          ...skip.line > 0 ? { line: skip.line } : {},
+          message: `Heading level skipped (<h${skip.prev}> to <h${skip.level}>)`,
+          recommendation: recommendation6,
+          docsUrl: docsUrl6
+        } : {
+          id: "SEO030",
+          category: "seo",
+          severity: "info",
+          detection: PASS,
+          route: route.route,
+          message: "Heading order",
+          recommendation: recommendation6,
+          docsUrl: docsUrl6
+        }
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/component-rule.ts
+var PENALIZED2 = { presence: "none", value: "absent" };
+var PASS2 = { presence: "own", value: "static" };
+function componentRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  const severity = opts.severity ?? "warning";
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: opts.category,
+    severity,
+    scope: "component",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const out = [];
+      for (const c of ctx.components ?? []) {
+        if (!opts.applies(c)) continue;
+        const bad = opts.bad(c);
+        if (bad.length === 0) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PASS2,
+            route: c.file,
+            message: opts.label,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+          continue;
+        }
+        for (const b of bad) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PENALIZED2,
+            route: c.file,
+            location: c.file,
+            ...b.line > 0 ? { line: b.line } : {},
+            message: b.message,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/rules/correctness/correct001-002.ts
+var correct001EachKey = componentRule({
+  id: "CORRECT001",
+  title: "Keyed each block",
+  category: "correctness",
+  label: "Keyed {#each}",
+  recommendation: "Add a key to the {#each} block, e.g. {#each items as item (item.id)}.",
+  rationale: "An unkeyed {#each} destroys and recreates DOM nodes when the list reorders, losing element state/focus and wasting work; a key lets Svelte move nodes instead.",
+  applies: (c) => c.eachBlocks.length > 0,
+  bad: (c) => c.eachBlocks.filter((e) => !e.hasKey).map((e) => ({ line: e.line, message: "{#each} block has no key" }))
+});
+var correct002EffectDerived = componentRule({
+  id: "CORRECT002",
+  title: "Effect used to derive state",
+  category: "correctness",
+  label: "$effect usage",
+  recommendation: "Replace the state-syncing $effect with a derived value, e.g. let x = $derived(expr).",
+  rationale: 'An $effect whose body only assigns to $state is the "useEffect \u2192 $effect" anti-pattern: it reruns after render and can cause extra passes or loops. $derived expresses the same dependency declaratively.',
+  applies: (c) => c.effects.length > 0,
+  bad: (c) => c.effects.filter((e) => e.assignsOnlyState).map((e) => ({ line: e.line, message: "$effect only assigns state \u2014 use $derived instead" }))
+});
+var correct003EffectAsOnMount = componentRule({
+  id: "CORRECT003",
+  title: "Effect used as onMount",
+  category: "correctness",
+  label: "$effect usage",
+  recommendation: "Move mount-time side effects to onMount (import { onMount } from 'svelte'); reserve $effect for logic that reacts to $state/$derived/$props.",
+  rationale: "An $effect that reads no reactive value runs once after mount and never re-runs \u2014 it is an onMount in disguise, which obscures intent and misuses the reactivity system.",
+  applies: (c) => c.effects.length > 0,
+  bad: (c) => c.effects.filter((e) => e.mountOnly).map((e) => ({ line: e.line, message: "$effect reads no reactive value \u2014 use onMount instead" }))
+});
+
+// src/rules/correctness/correct004-unmutated-state.ts
+var correct004UnmutatedState = componentRule({
+  id: "CORRECT004",
+  title: "Unmutated $state",
+  category: "correctness",
+  severity: "info",
+  label: "$state usage",
+  recommendation: "If a value never changes, use const; if you only ever reassign it wholesale (never mutate its properties), use $state.raw to skip deep proxying.",
+  rationale: "A $state that is never mutated pays for reactivity (deep proxying, tracking) it never uses; const (or $state.raw) is clearer and cheaper.",
+  applies: (c) => c.constableStates.length > 0,
+  bad: (c) => c.constableStates.map((s) => ({
+    line: s.line,
+    message: `$state "${s.name}" is never mutated \u2014 use const (or $state.raw if you only reassign it)`
+  }))
+});
+
+// src/rules/security/sec001-002.ts
+var sec001Html = componentRule({
+  id: "SEC001",
+  title: "Raw HTML render",
+  category: "security",
+  label: "{@html} usage",
+  recommendation: "Sanitize the value before {@html} (e.g. DOMPurify), or render it as text/markup instead.",
+  rationale: "{@html} renders its value as unescaped HTML; if the value can contain user input and is not sanitized, it is a cross-site-scripting (XSS) vector.",
+  applies: (c) => c.htmlTags.length > 0,
+  bad: (c) => c.htmlTags.map((h) => ({ line: h.line, message: "{@html} renders unescaped HTML \u2014 ensure it is sanitized" }))
+});
+var sec002JavascriptUrl = componentRule({
+  id: "SEC002",
+  title: "javascript: URL",
+  category: "security",
+  label: "No javascript: URLs",
+  recommendation: "Use an event handler or a real URL instead of a javascript: URL.",
+  rationale: "A javascript: URL in href/src/action executes arbitrary script on activation \u2014 an XSS / unsafe-navigation vector that also breaks under a strict Content-Security-Policy.",
+  applies: (c) => c.javascriptUrls.length > 0,
+  bad: (c) => c.javascriptUrls.map((u) => ({ line: u.line, message: "javascript: URL in an attribute" }))
+});
+
+// src/rules/architecture/arch001-002.ts
+var MAX_LOC = 400;
+var MAX_PROPS = 10;
+var arch001ComponentSize = componentRule({
+  id: "ARCH001",
+  title: "Component size",
+  category: "architecture",
+  severity: "info",
+  label: "Component size",
+  recommendation: `Split components over ${MAX_LOC} lines into smaller, focused pieces.`,
+  rationale: "A very large component is hard to read, test, and reuse, and is a common sign that several responsibilities should be split out.",
+  applies: (c) => c.loc > 0,
+  // skip unanalyzable files (loc 0 = read/parse failure), don't PASS them
+  bad: (c) => c.loc > MAX_LOC ? [{ line: 1, message: `Component is ${c.loc} lines (over ${MAX_LOC})` }] : []
+});
+var arch002PropCount = componentRule({
+  id: "ARCH002",
+  title: "Prop count",
+  category: "architecture",
+  severity: "info",
+  label: "Prop count",
+  recommendation: `Group related props into an object, or split the component, when it takes more than ${MAX_PROPS} props.`,
+  rationale: "A component taking many props is usually doing too much; grouping or splitting keeps its API understandable.",
+  applies: (c) => c.propCount > 0,
+  // only components whose props we could count
+  bad: (c) => c.propCount > MAX_PROPS ? [{ line: 1, message: `Component takes ${c.propCount} props (over ${MAX_PROPS})` }] : []
+});
+
+// src/rules/performance/perf009-heavy-import.ts
+var HEAVY_PACKAGES = {
+  lodash: "import a submodule (lodash/debounce) or use lodash-es for tree-shaking",
+  moment: "use a lighter date library (date-fns or dayjs) \u2014 moment is large and not tree-shakeable"
+};
+var perf009HeavyImport = componentRule({
+  id: "PERF009",
+  title: "Heavy dependency import",
+  category: "performance",
+  severity: "info",
+  label: "No heavy imports",
+  recommendation: "Import a submodule or switch to a lighter, tree-shakeable alternative.",
+  rationale: "Importing a large, non-tree-shakeable package pulls its whole weight into the bundle even when only a fraction is used, slowing load.",
+  applies: (c) => c.imports.length > 0,
+  bad: (c) => {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const src of c.imports) {
+      if (!Object.hasOwn(HEAVY_PACKAGES, src) || seen.has(src)) continue;
+      seen.add(src);
+      out.push({ line: 0, message: `Heavy import "${src}" \u2014 ${HEAVY_PACKAGES[src]}` });
+    }
+    return out;
+  }
+});
+
+// src/rules/performance/perf010-namespace-import.ts
+var perf010NamespaceImport = componentRule({
+  id: "PERF010",
+  title: "Namespace import",
+  category: "performance",
+  severity: "info",
+  label: "No namespace imports",
+  recommendation: "Use named imports (import { x } from 'pkg') instead of import * as \u2014 a namespace import keeps the whole module in the bundle.",
+  rationale: "A namespace import (import * as X) forces the bundler to retain the entire module, so unused exports cannot be tree-shaken out.",
+  applies: (c) => c.namespaceImports.length > 0,
+  bad: (c) => {
+    const minLine = /* @__PURE__ */ new Map();
+    for (const ns of c.namespaceImports) {
+      const prev = minLine.get(ns.source);
+      if (prev === void 0 || ns.line < prev) minLine.set(ns.source, ns.line);
+    }
+    return [...minLine.entries()].sort((a, b) => a[1] - b[1]).map(([source, line]) => ({
+      line,
+      message: `Namespace import "* as \u2026 from '${source}'" \u2014 prefer named imports so the bundler can tree-shake`
+    }));
+  }
+});
+
 // src/rules/index.ts
 var allRules = [
   seo001Title,
@@ -1350,7 +1669,20 @@ var allRules = [
   perf005LcpImage,
   perf006ResponsiveImage,
   perf007RenderBlockingScript,
-  perf008Preconnect
+  perf008Preconnect,
+  seo028TitleUnique,
+  seo029DescriptionUnique,
+  seo030HeadingOrder,
+  correct001EachKey,
+  correct002EffectDerived,
+  correct003EffectAsOnMount,
+  correct004UnmutatedState,
+  sec001Html,
+  sec002JavascriptUrl,
+  arch001ComponentSize,
+  arch002PropCount,
+  perf009HeavyImport,
+  perf010NamespaceImport
 ];
 function explainRule(id) {
   const target = id.toUpperCase();
@@ -1477,6 +1809,21 @@ function computeHealth(results, config) {
   return { health, categories, weights };
 }
 
+// src/reporter/palette.ts
+var noColorPalette = {
+  bold: (s) => s,
+  dim: (s) => s,
+  red: (s) => s,
+  yellow: (s) => s,
+  green: (s) => s,
+  cyan: (s) => s
+};
+function scoreColor(p, score) {
+  if (score >= 90) return p.green;
+  if (score >= 70) return p.yellow;
+  return p.red;
+}
+
 // src/reporter/console.ts
 var RULE = "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500";
 var SEVERITY_TITLE = {
@@ -1486,66 +1833,79 @@ var SEVERITY_TITLE = {
 };
 var CATEGORY_LABEL = {
   seo: "SEO",
-  performance: "Performance"
+  performance: "Performance",
+  correctness: "Correctness",
+  security: "Security",
+  architecture: "Architecture"
 };
-var CATEGORY_ORDER = ["seo", "performance"];
-function scoreLine(label, { score, scoreModel }) {
+var CATEGORY_ORDER = ["seo", "performance", "correctness", "security", "architecture"];
+function scoreLine(p, label, { score, scoreModel }) {
   const parts = [`route avg ${scoreModel.routeAverage}`];
   if (scoreModel.sitePenalty > 0) parts.push(`site \u2212${scoreModel.sitePenalty}`);
   if (scoreModel.criticalCap !== null) parts.push(`capped at ${scoreModel.criticalCap}: critical present`);
-  return `${label} Score: ${score}/100   (${parts.join(" \xB7 ")})`;
+  return `${label} Score: ${scoreColor(p, score)(`${score}/100`)}   ${p.dim(`(${parts.join(" \xB7 ")})`)}`;
 }
-function byRouteTree(results, config) {
+function byRouteTree(p, results, config) {
   const routes = /* @__PURE__ */ new Map();
   for (const r of results) {
     if (r.route === void 0) continue;
     if (!routes.has(r.route)) routes.set(r.route, []);
     routes.get(r.route).push(r);
   }
-  const lines = ["By route", RULE];
+  const lines = [p.bold("By route"), p.dim(RULE)];
   for (const [route, rs] of [...routes.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
     const { score } = computeScore(rs, config, { applyCriticalCap: false });
-    lines.push(`${route.padEnd(28)} ${score}`);
+    lines.push(`${route.padEnd(28)} ${scoreColor(p, score)(`${score}`)}`);
     for (const r of rs.filter((x) => classify(x, config) === "fail")) {
-      lines.push(`    \u2717 ${r.id}  ${r.message}`);
+      lines.push(`    ${p.red("\u2717")} ${r.id}  ${r.message}`);
     }
   }
   lines.push("");
   return lines;
 }
 function formatConsoleReport(results, config, options = {}) {
+  const p = options.palette ?? noColorPalette;
   const summary = summarize(results, config);
   const { health, categories: byCat } = computeHealth(results, config);
   const present2 = CATEGORY_ORDER.filter((c) => byCat[c] !== void 0);
-  const header = [`Svelte Vitals  \xB7  ${options.mode ?? "static mode"}`, "", `Health: ${health}/100`];
+  const header = [
+    p.bold(`Svelte Vitals  \xB7  ${options.mode ?? "static mode"}`),
+    "",
+    `${p.bold("Health:")} ${scoreColor(p, health)(`${health}/100`)}`
+  ];
   for (const c of present2) {
-    header.push(scoreLine(CATEGORY_LABEL[c] ?? c, byCat[c]));
+    header.push(scoreLine(p, CATEGORY_LABEL[c] ?? c, byCat[c]));
   }
   const lines = [...header, ""];
+  const SEVERITY_COLOR = {
+    critical: (s) => p.red(p.bold(s)),
+    warning: (s) => p.yellow(p.bold(s)),
+    info: (s) => p.dim(s)
+  };
   const failures = results.filter((r) => classify(r, config) === "fail");
   for (const severity of ["critical", "warning", "info"]) {
     const bucket = failures.filter((r) => effectiveSeverity(r, config) === severity);
     if (bucket.length === 0) continue;
-    lines.push(`${SEVERITY_TITLE[severity]} (${bucket.length})`, RULE);
+    lines.push(SEVERITY_COLOR[severity](`${SEVERITY_TITLE[severity]} (${bucket.length})`), p.dim(RULE));
     for (const r of bucket) {
-      lines.push(`\u2717 ${r.id}  ${r.message}`);
-      if (r.route) lines.push(`            ${r.route}`);
-      if (r.location) lines.push(`            ${r.location}${r.line ? `:${r.line}` : ""}`);
+      lines.push(`${p.red("\u2717")} ${r.id}  ${r.message}`);
+      if (r.route) lines.push(p.dim(`            ${r.route}`));
+      if (r.location) lines.push(p.dim(`            ${r.location}${r.line ? `:${r.line}` : ""}`));
     }
     lines.push("");
   }
   const passed = results.filter((r) => classify(r, config) !== "fail");
   if (passed.length > 0) {
-    lines.push(`Passed (${passed.length})`, RULE);
+    lines.push(p.bold(`Passed (${passed.length})`), p.dim(RULE));
     for (const r of passed) {
-      const marker = classify(r, config) === "dynamic" ? "  \u21AF dynamic" : "";
+      const marker = classify(r, config) === "dynamic" ? p.cyan("  \u21AF dynamic") : "";
       const route = r.route ? `  ${r.route}` : "";
-      lines.push(`\u2713 ${r.id}  ${r.message}${marker}${route}`);
+      lines.push(`${p.green("\u2713")} ${r.id}  ${r.message}${marker}${route}`);
     }
     lines.push("");
   }
-  if (options.byRoute) lines.push(...byRouteTree(results, config));
-  if (summary.dynamic > 0) lines.push("\u21AF = set dynamically (verified at runtime).");
+  if (options.byRoute) lines.push(...byRouteTree(p, results, config));
+  if (summary.dynamic > 0) lines.push(p.dim("\u21AF = set dynamically (verified at runtime)."));
   return lines.join("\n").replace(/\n+$/, "\n");
 }
 
@@ -1936,11 +2296,17 @@ export {
   SITEMAP_SOURCE_PATHS,
   allRules,
   applyRuleSeverities,
+  arch001ComponentSize,
+  arch002PropCount,
   buildHtmlDocument,
   buildJsonReport,
   classify,
   computeHealth,
   computeScore,
+  correct001EachKey,
+  correct002EffectDerived,
+  correct003EffectAsOnMount,
+  correct004UnmutatedState,
   defaultConfig,
   defaultProject,
   defineConfig,
@@ -1959,6 +2325,7 @@ export {
   imageRule,
   isPenalized,
   linkRule,
+  noColorPalette,
   perf001ImageDimensions,
   perf002ImageLoading,
   perf003PreloadAs,
@@ -1967,10 +2334,15 @@ export {
   perf006ResponsiveImage,
   perf007RenderBlockingScript,
   perf008Preconnect,
+  perf009HeavyImport,
+  perf010NamespaceImport,
   runRules,
   safeHref,
   scoreBand,
+  scoreColor,
   scoresByCategory,
+  sec001Html,
+  sec002JavascriptUrl,
   selectRules,
   seo001Title,
   seo002Description,
@@ -1999,5 +2371,8 @@ export {
   seo025ImageAlt,
   seo026Hreflang,
   seo027Heading,
+  seo028TitleUnique,
+  seo029DescriptionUnique,
+  seo030HeadingOrder,
   summarize
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svelte-vitals/core",
-  "version": "0.15.0",
+  "version": "0.18.0",
   "description": "Shared, runtime-agnostic core for svelte-vitals (types, rule engine, scorer, reporter).",
   "type": "module",
   "license": "MIT",
@@ -21,7 +21,7 @@
   },
   "homepage": "https://github.com/oekazuma/svelte-vitals#readme",
   "engines": {
-    "node": ">=18"
+    "node": ">=18.20.8"
   },
   "sideEffects": false,
   "exports": {