@svelte-vitals/core 0.24.0 → 0.26.0

package/dist/index.js

@@ -103,6 +103,7 @@ function collectEachBlocks(node, source, acc) {
     if (key in node) collectEachBlocks(node[key], source, acc);
   }
 }
+var WALK_IGNORED_KEYS = /* @__PURE__ */ new Set(["type", "start", "end", "loc", "range"]);
 function walkEstree(node, visit) {
   if (Array.isArray(node)) {
     for (const child of node) walkEstree(child, visit);
@@ -111,7 +112,7 @@ function walkEstree(node, visit) {
   if (!node || typeof node !== "object" || typeof node.type !== "string") return;
   visit(node);
   for (const key of Object.keys(node)) {
-    if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
+    if (WALK_IGNORED_KEYS.has(key)) continue;
     walkEstree(node[key], visit);
   }
 }
@@ -123,6 +124,10 @@ function isEffectCall(node) {
   }
   return false;
 }
+function isEffectRootCall(node) {
+  const c = node?.callee;
+  return c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$effect" && c.property?.type === "Identifier" && c.property.name === "root";
+}
 function isStateDeclaration(node) {
   const c = node?.callee;
   if (c?.type === "Identifier") return c.name === "$state";
@@ -207,7 +212,7 @@ function walkScoped(node, visit, shadowed = /* @__PURE__ */ new Set()) {
   const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
   visit(node, scope);
   for (const key of Object.keys(node)) {
-    if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
+    if (WALK_IGNORED_KEYS.has(key)) continue;
     walkScoped(node[key], visit, scope);
   }
 }
@@ -270,7 +275,6 @@ function collectTemplateEscapes(node, stateNames, acc) {
 var RUNE_NAMES = /* @__PURE__ */ new Set(["$state", "$derived", "$effect", "$props", "$bindable", "$inspect", "$host"]);
 function bodyReadsReactive(fn, reactiveNames) {
   let reads = false;
-  const IGNORED_KEYS = /* @__PURE__ */ new Set(["type", "start", "end", "loc", "range"]);
   const visit = (n) => {
     if (reads || !n) return;
     if (Array.isArray(n)) {
@@ -297,7 +301,7 @@ function bodyReadsReactive(fn, reactiveNames) {
       return;
     }
     for (const key of Object.keys(n)) {
-      if (!IGNORED_KEYS.has(key)) visit(n[key]);
+      if (!WALK_IGNORED_KEYS.has(key)) visit(n[key]);
     }
   };
   visit(fn.body);
@@ -452,7 +456,366 @@ function collectSuppressions(source) {
   });
   return out;
 }
+var EVAL_SCOPE_BOUNDARIES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression",
+  "ClassDeclaration",
+  "ClassExpression"
+]);
+function walkEvalScope(node, visit, shadowed = /* @__PURE__ */ new Set()) {
+  if (Array.isArray(node)) {
+    for (const child of node) walkEvalScope(child, visit, shadowed);
+    return;
+  }
+  if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+  const introduced = scopeIntroducedNames(node);
+  const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+  if (visit(node, scope)) return;
+  if (EVAL_SCOPE_BOUNDARIES.has(node.type)) return;
+  for (const key of Object.keys(node)) {
+    if (WALK_IGNORED_KEYS.has(key)) continue;
+    walkEvalScope(node[key], visit, scope);
+  }
+}
+function collectEvalScopeCalls(root, source, matcher, skipSubtree, initialShadowed) {
+  const out = [];
+  walkEvalScope(
+    root,
+    (n, shadowed) => {
+      if (n.type !== "CallExpression") return void 0;
+      if (skipSubtree?.(n)) return true;
+      const name = matcher(n, shadowed);
+      if (name) out.push({ name, line: lineOf(source, n.start) });
+      return void 0;
+    },
+    initialShadowed
+  );
+  return out;
+}
+function unwrapExport(stmt) {
+  if (stmt.type === "ExportNamedDeclaration") return stmt.declaration ?? stmt;
+  if (stmt.type === "ExportDefaultDeclaration") return stmt.declaration;
+  return stmt;
+}
+function collectOrphanCalls(program, source, matcher, skipSubtree) {
+  const out = collectEvalScopeCalls(program, source, matcher, skipSubtree).map((c) => ({ ...c, kind: "top-level" }));
+  const body = program.body ?? [];
+  const matchingClasses = /* @__PURE__ */ new Map();
+  for (const stmt of body) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "ClassDeclaration" || decl.id?.type !== "Identifier") continue;
+    const ctor = (decl.body?.body ?? []).find(
+      (m) => m?.type === "MethodDefinition" && m.kind === "constructor" && m.value?.body
+    );
+    if (!ctor) continue;
+    const ctorShadow = /* @__PURE__ */ new Set();
+    for (const p of ctor.value.params ?? []) addBoundNames(p, ctorShadow);
+    const calls = collectEvalScopeCalls(ctor.value.body, source, matcher, skipSubtree, ctorShadow);
+    if (calls.length > 0) matchingClasses.set(decl.id.name, calls[0].name);
+  }
+  if (matchingClasses.size > 0) {
+    for (const stmt of body) {
+      const decl = unwrapExport(stmt);
+      const isCandidate = decl?.type === "VariableDeclaration" || decl?.type === "ExpressionStatement" || stmt.type === "ExportDefaultDeclaration" && decl?.type !== "FunctionDeclaration" && decl?.type !== "ClassDeclaration";
+      if (!isCandidate) continue;
+      walkEvalScope(decl, (n) => {
+        if (n.type === "NewExpression" && n.callee?.type === "Identifier" && matchingClasses.has(n.callee.name)) {
+          out.push({
+            name: matchingClasses.get(n.callee.name),
+            line: lineOf(source, n.start),
+            kind: "constructor-instantiated",
+            className: n.callee.name
+          });
+        }
+        return void 0;
+      });
+    }
+  }
+  return out.sort((a, b) => a.line - b.line);
+}
+function collectOrphanEffects(program, source) {
+  return collectOrphanCalls(program, source, (n) => isEffectCall(n) ? "$effect" : void 0, isEffectRootCall).map(
+    ({ line, kind, className }) => ({ line, kind, ...className !== void 0 ? { className } : {} })
+  );
+}
+var LIFECYCLE_NAMES = /* @__PURE__ */ new Set([
+  "onMount",
+  "onDestroy",
+  "beforeUpdate",
+  "afterUpdate",
+  "createEventDispatcher",
+  "getContext",
+  "setContext",
+  "hasContext",
+  "getAllContexts"
+]);
+function collectSvelteLifecycleImports(program) {
+  const locals = /* @__PURE__ */ new Map();
+  const namespaces = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== "svelte") continue;
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && LIFECYCLE_NAMES.has(s.imported.name)) {
+        locals.set(s.local.name, s.imported.name);
+      } else if (s.type === "ImportNamespaceSpecifier") {
+        namespaces.add(s.local.name);
+      }
+    }
+  }
+  return { locals, namespaces };
+}
+function matchLifecycleCall(n, imports) {
+  const c = n?.callee;
+  if (c?.type === "Identifier") {
+    const canonical = imports.locals.get(c.name);
+    return canonical ? { canonical, local: c.name } : void 0;
+  }
+  if (c?.type === "MemberExpression" && !c.computed && c.object?.type === "Identifier" && imports.namespaces.has(c.object.name) && c.property?.type === "Identifier" && LIFECYCLE_NAMES.has(c.property.name)) {
+    return { canonical: c.property.name, local: c.object.name };
+  }
+  return void 0;
+}
+function collectOrphanLifecycleCalls(program, source) {
+  const imports = collectSvelteLifecycleImports(program);
+  if (imports.locals.size === 0 && imports.namespaces.size === 0) return [];
+  return collectOrphanCalls(program, source, (n, shadowed) => {
+    const m = matchLifecycleCall(n, imports);
+    return m && !shadowed.has(m.local) ? m.canonical : void 0;
+  });
+}
+var BROWSER_GLOBALS = /* @__PURE__ */ new Set([
+  "window",
+  "document",
+  "localStorage",
+  "sessionStorage",
+  "navigator",
+  "location",
+  "history",
+  "screen",
+  "matchMedia",
+  "requestAnimationFrame",
+  "cancelAnimationFrame",
+  "IntersectionObserver",
+  "ResizeObserver",
+  "MutationObserver",
+  "alert",
+  "confirm",
+  "prompt"
+]);
+function collectBrowserGuardImports(program) {
+  const out = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== "$app/environment")
+      continue;
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && s.imported.name === "browser") {
+        out.add(s.local.name);
+      }
+    }
+  }
+  return out;
+}
+function collectProgramBindings(program) {
+  const bound = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type === "ImportDeclaration") {
+      for (const s of stmt.specifiers ?? []) if (s?.local?.type === "Identifier") bound.add(s.local.name);
+      continue;
+    }
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) addBoundNames(d?.id, bound);
+    } else if ((decl?.type === "FunctionDeclaration" || decl?.type === "ClassDeclaration") && decl.id?.type === "Identifier") {
+      bound.add(decl.id.name);
+    }
+  }
+  return bound;
+}
+function guardTerminates(consequent) {
+  if (!consequent) return false;
+  if (consequent.type === "ReturnStatement" || consequent.type === "ThrowStatement") return true;
+  if (consequent.type === "BlockStatement") {
+    const last = (consequent.body ?? [])[consequent.body.length - 1];
+    return last?.type === "ReturnStatement" || last?.type === "ThrowStatement";
+  }
+  return false;
+}
+function isBrowserGuardTest(test, guardBindings) {
+  let guarded = false;
+  walkEstree(test, (n) => {
+    if (n.type === "Identifier" && guardBindings.has(n.name)) guarded = true;
+    if (n.type === "BinaryExpression" && ["===", "!==", "==", "!="].includes(n.operator)) {
+      const sides = [n.left, n.right];
+      const hasTypeofGlobal = sides.some(
+        (s) => s?.type === "UnaryExpression" && s.operator === "typeof" && s.argument?.type === "Identifier" && BROWSER_GLOBALS.has(s.argument.name)
+      );
+      const hasUndefinedString = sides.some((s) => s?.type === "Literal" && s.value === "undefined");
+      if (hasTypeofGlobal && hasUndefinedString) guarded = true;
+    }
+  });
+  return guarded;
+}
+function collectDerivedGuardBindings(program, guards) {
+  const derived = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "VariableDeclaration" || decl.kind !== "const" && decl.kind !== "let") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type === "Identifier" && d.init && isBrowserGuardTest(d.init, guards)) {
+        derived.add(d.id.name);
+      }
+    }
+  }
+  return derived;
+}
+function collectBrowserGlobalRefs(program, source, extra) {
+  const out = [];
+  const bound = /* @__PURE__ */ new Set([...collectProgramBindings(program), ...extra?.bound ?? []]);
+  const guards = /* @__PURE__ */ new Set([...collectBrowserGuardImports(program), ...extra?.guards ?? []]);
+  for (const name of collectDerivedGuardBindings(program, guards)) guards.add(name);
+  const visit = (n, shadowed) => {
+    if (!n) return;
+    if (Array.isArray(n)) {
+      for (const c of n) visit(c, shadowed);
+      return;
+    }
+    if (typeof n !== "object" || typeof n.type !== "string") return;
+    if (EVAL_SCOPE_BOUNDARIES.has(n.type)) return;
+    if ((n.type === "IfStatement" || n.type === "ConditionalExpression") && isBrowserGuardTest(n.test, guards)) return;
+    if (n.type === "LogicalExpression" && isBrowserGuardTest(n.left, guards)) return;
+    const introduced = scopeIntroducedNames(n);
+    const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+    switch (n.type) {
+      case "Identifier":
+        if (BROWSER_GLOBALS.has(n.name) && !bound.has(n.name) && !scope.has(n.name)) {
+          out.push({ name: n.name, line: lineOf(source, n.start) });
+        }
+        return;
+      case "UnaryExpression":
+        if (n.operator === "typeof" && n.argument?.type === "Identifier") return;
+        break;
+      case "MemberExpression":
+        visit(n.object, scope);
+        if (n.computed) visit(n.property, scope);
+        return;
+      case "Property":
+        if (n.computed) visit(n.key, scope);
+        visit(n.value, scope);
+        return;
+      case "VariableDeclarator":
+        visit(n.init, scope);
+        return;
+      case "LabeledStatement":
+        visit(n.body, scope);
+        return;
+      case "BreakStatement":
+      case "ContinueStatement":
+      case "ImportDeclaration":
+      case "ExportAllDeclaration":
+        return;
+      case "ExportNamedDeclaration":
+        if (!n.declaration) return;
+        break;
+      case "BlockStatement":
+      case "Program":
+        for (const stmt of n.body ?? []) {
+          visit(stmt, scope);
+          if (stmt?.type === "IfStatement" && isBrowserGuardTest(stmt.test, guards) && guardTerminates(stmt.consequent)) {
+            break;
+          }
+        }
+        return;
+      default:
+        if (n.type.startsWith("TS")) {
+          if (n.type === "TSAsExpression" || n.type === "TSSatisfiesExpression" || n.type === "TSNonNullExpression" || n.type === "TSInstantiationExpression") {
+            visit(n.expression, scope);
+          }
+          return;
+        }
+    }
+    for (const key of Object.keys(n)) {
+      if (WALK_IGNORED_KEYS.has(key)) continue;
+      visit(n[key], scope);
+    }
+  };
+  visit(program, /* @__PURE__ */ new Set());
+  return out;
+}
+var MODULE_FILE_RE = /\.svelte\.(ts|js)$/;
+function parseModuleProgram(source, filename) {
+  const neutralized = source.replace(/<\/script/gi, "<_script");
+  const wrapped = `<script lang="ts">
+${neutralized}
+</script>`;
+  const ast = parse(wrapped, { modern: true, filename });
+  return { program: ast.instance?.content, wrapped };
+}
+function collectModuleStateDecls(program, source) {
+  const out = [];
+  const body = program.body ?? [];
+  const statefulClasses = /* @__PURE__ */ new Set();
+  for (const stmt of body) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) {
+        if (d?.id?.type === "Identifier" && d.init && isStateDeclaration(d.init)) {
+          out.push({ name: d.id.name, line: lineOf(source, d.start) });
+        }
+      }
+    } else if (decl?.type === "ClassDeclaration" && decl.id?.type === "Identifier") {
+      const hasStateField = (decl.body?.body ?? []).some(
+        (m) => m?.type === "PropertyDefinition" && m.value && isStateDeclaration(m.value)
+      );
+      if (hasStateField) statefulClasses.add(decl.id.name);
+    }
+  }
+  if (statefulClasses.size > 0) {
+    for (const stmt of body) {
+      const decl = unwrapExport(stmt);
+      if (decl?.type !== "VariableDeclaration") continue;
+      for (const d of decl.declarations ?? []) {
+        if (d?.init?.type === "NewExpression" && d.init.callee?.type === "Identifier" && statefulClasses.has(d.init.callee.name)) {
+          out.push({
+            name: d.id?.type === "Identifier" ? d.id.name : d.init.callee.name,
+            line: lineOf(source, d.start)
+          });
+        }
+      }
+    }
+  }
+  return out.sort((a, b) => a.line - b.line);
+}
+function parseModuleFacts(source, filename) {
+  const { program, wrapped } = parseModuleProgram(source, filename);
+  const shift = (line) => Math.max(0, line - 1);
+  const orphanEffects = program ? collectOrphanEffects(program, wrapped).map((f) => ({ ...f, line: shift(f.line) })) : [];
+  const orphanLifecycleCalls = program ? collectOrphanLifecycleCalls(program, wrapped).map((f) => ({ ...f, line: shift(f.line) })) : [];
+  const browserGlobalRefs = program ? collectBrowserGlobalRefs(program, wrapped).map((r) => ({ ...r, line: shift(r.line), context: "module" })) : [];
+  const moduleStateDecls = program ? collectModuleStateDecls(program, wrapped).map((d) => ({ ...d, line: shift(d.line) })) : [];
+  return {
+    eachBlocks: [],
+    effects: [],
+    htmlTags: [],
+    javascriptUrls: [],
+    loc: 0,
+    propCount: 0,
+    imports: [],
+    importSpans: [],
+    namespaceImports: [],
+    constableStates: [],
+    mutatedProps: [],
+    suppressions: collectSuppressions(source),
+    orphanEffects,
+    orphanLifecycleCalls,
+    browserGlobalRefs,
+    moduleStateDecls
+  };
+}
 function parseComponentFacts(source, filename) {
+  if (MODULE_FILE_RE.test(filename)) return parseModuleFacts(source, filename);
   const ast = parse(source, { modern: true, filename });
   const eachBlocks = [];
   collectEachBlocks(ast.fragment ?? ast, source, eachBlocks);
@@ -461,11 +824,20 @@ function parseComponentFacts(source, filename) {
   collectSecurityFacts(ast.fragment ?? ast, source, htmlTags, javascriptUrls);
   const loc = countLines(source);
   const suppressions = collectSuppressions(source);
+  const moduleProgram = ast.module?.content;
   const importSpans = [];
   const namespaceImports = [];
-  if (ast.module?.content) {
-    collectImportSources(ast.module.content, source, importSpans);
-    collectNamespaceImports(ast.module.content, source, namespaceImports);
+  if (moduleProgram) {
+    collectImportSources(moduleProgram, source, importSpans);
+    collectNamespaceImports(moduleProgram, source, namespaceImports);
+  }
+  const orphanEffects = moduleProgram ? collectOrphanEffects(moduleProgram, source) : [];
+  const orphanLifecycleCalls = moduleProgram ? collectOrphanLifecycleCalls(moduleProgram, source) : [];
+  const browserGlobalRefs = [];
+  if (moduleProgram) {
+    for (const r of collectBrowserGlobalRefs(moduleProgram, source)) {
+      browserGlobalRefs.push({ ...r, context: "module" });
+    }
   }
   const effects = [];
   const constableStates = [];
@@ -510,6 +882,17 @@ function parseComponentFacts(source, filename) {
     for (const d of stateDecls) {
       if (!writtenOrEscaped.has(d.name)) constableStates.push(d);
     }
+    let moduleExtra;
+    if (moduleProgram) {
+      const moduleBrowserImports = collectBrowserGuardImports(moduleProgram);
+      moduleExtra = {
+        guards: /* @__PURE__ */ new Set([...moduleBrowserImports, ...collectDerivedGuardBindings(moduleProgram, moduleBrowserImports)]),
+        bound: collectProgramBindings(moduleProgram)
+      };
+    }
+    for (const r of collectBrowserGlobalRefs(program, source, moduleExtra)) {
+      browserGlobalRefs.push({ ...r, context: "instance" });
+    }
   }
   const imports = importSpans.map((s) => s.source);
   return {
@@ -524,6 +907,10 @@ function parseComponentFacts(source, filename) {
     namespaceImports,
     constableStates,
     mutatedProps,
+    orphanEffects,
+    orphanLifecycleCalls,
+    browserGlobalRefs,
+    moduleStateDecls: [],
     suppressions
   };
 }
@@ -543,11 +930,15 @@ function emptyComponentFacts(file) {
     namespaceImports: [],
     constableStates: [],
     mutatedProps: [],
+    orphanEffects: [],
+    orphanLifecycleCalls: [],
+    browserGlobalRefs: [],
+    moduleStateDecls: [],
     suppressions: []
   };
 }
 async function collectComponentFacts(rt, cwd) {
-  const files = await rt.glob("src/**/*.svelte", cwd);
+  const files = await rt.glob("src/**/*.svelte{,.ts,.js}", cwd);
   return Promise.all(
     files.sort().map(async (rel) => {
       try {
@@ -560,6 +951,386 @@ async function collectComponentFacts(rt, cwd) {
   );
 }
 
+// src/kit-module-parse.ts
+var HANDLER_NAMES = /* @__PURE__ */ new Set([
+  "load",
+  "handle",
+  "handleFetch",
+  "handleError",
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "fallback"
+]);
+function unwrapTs(expr) {
+  let cur = expr;
+  while (cur?.type === "TSSatisfiesExpression" || cur?.type === "TSAsExpression") cur = cur.expression;
+  return cur;
+}
+function isFunctionNode(n) {
+  return n?.type === "FunctionDeclaration" || n?.type === "FunctionExpression" || n?.type === "ArrowFunctionExpression";
+}
+function collectTopLevelBindings(program) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "FunctionDeclaration" && decl.id?.type === "Identifier") {
+      bindings.set(decl.id.name, decl);
+    } else if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) {
+        if (d?.id?.type === "Identifier" && d.init) bindings.set(d.id.name, unwrapTs(d.init));
+      }
+    }
+  }
+  return bindings;
+}
+function addActionsMembers(obj, handlers) {
+  for (const p of obj.properties ?? []) {
+    if (p?.type !== "Property") continue;
+    const v = unwrapTs(p.value);
+    if (isFunctionNode(v)) handlers.add(v);
+  }
+}
+function resolveAliasHandlerExports(program, bindings, handlers) {
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      const exportedName = s.exported.name;
+      const resolved = bindings.get(s.local.name);
+      if (HANDLER_NAMES.has(exportedName) && isFunctionNode(resolved)) {
+        handlers.add(resolved);
+      } else if (exportedName === "actions" && resolved?.type === "ObjectExpression") {
+        addActionsMembers(resolved, handlers);
+      }
+    }
+  }
+}
+function resolveAliasStartupExports(program, bindings, startup) {
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      if (s.exported.name !== "init") continue;
+      const resolved = bindings.get(s.local.name);
+      if (isFunctionNode(resolved)) startup.add(resolved);
+    }
+  }
+}
+function collectHandlerFunctions(program) {
+  const handlers = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.declaration) continue;
+    const decl = stmt.declaration;
+    if (decl.type === "FunctionDeclaration" && decl.id?.type === "Identifier" && HANDLER_NAMES.has(decl.id.name)) {
+      handlers.add(decl);
+      continue;
+    }
+    if (decl.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type !== "Identifier" || !d.init) continue;
+      const init = unwrapTs(d.init);
+      if (HANDLER_NAMES.has(d.id.name) && isFunctionNode(init)) {
+        handlers.add(init);
+      } else if (d.id.name === "actions" && init?.type === "ObjectExpression") {
+        addActionsMembers(init, handlers);
+      }
+    }
+  }
+  resolveAliasHandlerExports(program, collectTopLevelBindings(program), handlers);
+  return handlers;
+}
+function collectStartupFunctions(program) {
+  const startup = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.declaration) continue;
+    const decl = stmt.declaration;
+    if (decl.type === "FunctionDeclaration" && decl.id?.type === "Identifier" && decl.id.name === "init") {
+      startup.add(decl);
+      continue;
+    }
+    if (decl.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type !== "Identifier" || !d.init) continue;
+      const init = unwrapTs(d.init);
+      if (d.id.name === "init" && isFunctionNode(init)) startup.add(init);
+    }
+  }
+  resolveAliasStartupExports(program, collectTopLevelBindings(program), startup);
+  return startup;
+}
+function hasSsrFalseOptOut(program) {
+  const isFalse = (init) => {
+    const v = unwrapTs(init);
+    return v?.type === "Literal" && v.value === false;
+  };
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type === "Identifier" && d.id.name === "ssr" && d.init && isFalse(d.init)) {
+        if (stmt.type === "ExportNamedDeclaration") return true;
+      }
+    }
+  }
+  const bindings = collectTopLevelBindings(program);
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      if (s.exported.name !== "ssr") continue;
+      const resolved = bindings.get(s.local.name);
+      if (resolved?.type === "Literal" && resolved.value === false) return true;
+    }
+  }
+  return false;
+}
+function walkKit(node, handlerFns, startupFns, visit, shadowed = /* @__PURE__ */ new Set(), inFunction = false, inHandler = false, inStartup = false) {
+  if (Array.isArray(node)) {
+    for (const child of node) walkKit(child, handlerFns, startupFns, visit, shadowed, inFunction, inHandler, inStartup);
+    return;
+  }
+  if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+  const introduced = scopeIntroducedNames(node);
+  const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+  const isBoundary = isFunctionNode(node) || node.type === "ClassDeclaration" || node.type === "ClassExpression";
+  const nextInFunction = inFunction || isBoundary;
+  const nextInHandler = inHandler || handlerFns.has(node);
+  const nextInStartup = inStartup || startupFns.has(node);
+  visit(node, scope, inFunction, inHandler, inStartup);
+  for (const key of Object.keys(node)) {
+    if (WALK_IGNORED_KEYS.has(key)) continue;
+    walkKit(node[key], handlerFns, startupFns, visit, scope, nextInFunction, nextInHandler, nextInStartup);
+  }
+}
+function normalizePosix(path) {
+  const out = [];
+  for (const seg of path.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (out.length === 0) return void 0;
+      out.pop();
+    } else out.push(seg);
+  }
+  return out.join("/");
+}
+function resolveRepoLocalPath(spec, importerFile) {
+  let path;
+  if (spec.startsWith("$lib/")) path = `src/lib/${spec.slice("$lib/".length)}`;
+  else if (spec.startsWith("./") || spec.startsWith("../")) {
+    const dir = importerFile.split("/").slice(0, -1).join("/");
+    path = `${dir}/${spec}`;
+  } else return void 0;
+  return normalizePosix(path);
+}
+function resolveRunesModuleSpecifier(spec, importerFile) {
+  const path = resolveRepoLocalPath(spec, importerFile);
+  if (path === void 0) return void 0;
+  if (/\.svelte\.(ts|js)$/.test(path)) return path;
+  if (path.endsWith(".svelte")) return `${path}.ts`;
+  return void 0;
+}
+function isLocalStateSpecifier(spec, importerFile) {
+  const path = resolveRepoLocalPath(spec, importerFile);
+  if (path === void 0) return false;
+  return path !== "src/lib/server" && !path.startsWith("src/lib/server/");
+}
+function parseKitModuleFacts(source, filename) {
+  const suppressions = collectSuppressions(source);
+  const { program, wrapped } = parseModuleProgram(source, filename);
+  const moduleStateReassignments = [];
+  const importedStateWrites = [];
+  const importedStateWritesOutsideHandlers = [];
+  const runesModuleImports = [];
+  const lifecycleCalls = [];
+  const browserGlobalRefs = [];
+  if (!program) {
+    return {
+      moduleStateReassignments,
+      importedStateWrites,
+      importedStateWritesOutsideHandlers,
+      runesModuleImports,
+      lifecycleCalls,
+      browserGlobalRefs,
+      suppressions
+    };
+  }
+  const line = (start) => Math.max(0, lineOf(wrapped, start) - 1);
+  const importedSpecifiers = /* @__PURE__ */ new Map();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type") continue;
+    const spec = typeof stmt.source?.value === "string" ? stmt.source.value : "";
+    const names = [];
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      names.push(s.local.name);
+      importedSpecifiers.set(s.local.name, spec);
+    }
+    if (names.length === 0) continue;
+    const resolved = resolveRunesModuleSpecifier(spec, filename);
+    if (resolved) runesModuleImports.push({ source: spec, resolved, names, line: line(stmt.start) });
+  }
+  const moduleLets = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration" && (decl.kind === "let" || decl.kind === "var")) {
+      for (const d of decl.declarations ?? []) addBoundNames(d?.id, moduleLets);
+    }
+  }
+  const handlerFns = collectHandlerFunctions(program);
+  const startupFns = collectStartupFunctions(program);
+  const svelteImports = collectSvelteLifecycleImports(program);
+  if (!hasSsrFalseOptOut(program)) {
+    const shiftLine = (l) => Math.max(0, l - 1);
+    const browserImports = collectBrowserGuardImports(program);
+    const guards = /* @__PURE__ */ new Set([...browserImports, ...collectDerivedGuardBindings(program, browserImports)]);
+    const bound = collectProgramBindings(program);
+    for (const r of collectBrowserGlobalRefs(program, wrapped, { guards, bound })) {
+      browserGlobalRefs.push({ name: r.name, line: shiftLine(r.line), inHandler: false });
+    }
+    const scanFn = (fn, inHandler) => {
+      if (!fn?.body) return;
+      const params = /* @__PURE__ */ new Set();
+      for (const p of fn.params ?? []) addBoundNames(p, params);
+      for (const r of collectBrowserGlobalRefs(fn.body, wrapped, { guards, bound: /* @__PURE__ */ new Set([...bound, ...params]) })) {
+        browserGlobalRefs.push({ name: r.name, line: shiftLine(r.line), inHandler });
+      }
+    };
+    for (const fn of handlerFns) scanFn(fn, true);
+    for (const fn of startupFns) {
+      if (handlerFns.has(fn)) continue;
+      scanFn(fn, false);
+    }
+  }
+  walkKit(program, handlerFns, startupFns, (n, shadowed, inFunction, inHandler, inStartup) => {
+    if (inFunction && !inStartup) {
+      const flagLet = (name) => {
+        if (name && !shadowed.has(name) && moduleLets.has(name)) {
+          moduleStateReassignments.push({ name, line: line(n.start), inHandler });
+        }
+      };
+      if (n.type === "AssignmentExpression") {
+        if (n.left?.type === "Identifier") flagLet(n.left.name);
+        else if (n.left?.type === "ObjectPattern" || n.left?.type === "ArrayPattern") {
+          const bound = /* @__PURE__ */ new Set();
+          addBoundNames(n.left, bound);
+          for (const b of bound) flagLet(b);
+        }
+      } else if (n.type === "UpdateExpression" && n.argument?.type === "Identifier") {
+        flagLet(n.argument.name);
+      }
+    }
+    let write;
+    const importedRoot = (expr) => {
+      const r = rootObjectName(expr);
+      return r && !shadowed.has(r) && importedSpecifiers.has(r) ? r : void 0;
+    };
+    if (n.type === "AssignmentExpression" && n.left?.type === "MemberExpression") {
+      const r = importedRoot(n.left);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "UpdateExpression" && n.argument?.type === "MemberExpression") {
+      const r = importedRoot(n.argument);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "UnaryExpression" && n.operator === "delete") {
+      const r = importedRoot(n.argument);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
+      const method = n.callee.property?.type === "Identifier" ? n.callee.property.name : void 0;
+      if (method === "set" || method === "update") {
+        const r = importedRoot(n.callee.object);
+        if (r && isLocalStateSpecifier(importedSpecifiers.get(r), filename)) write = { name: r, via: "set-call" };
+      }
+    } else if (n.type === "AssignmentExpression" && (n.left?.type === "ObjectPattern" || n.left?.type === "ArrayPattern")) {
+      const scanPatternTargets = (pat) => {
+        if (!pat || write) return;
+        if (pat.type === "MemberExpression") {
+          const r = importedRoot(pat);
+          if (r) write = { name: r, via: "assignment" };
+        } else if (pat.type === "ObjectPattern") {
+          for (const p of pat.properties ?? []) {
+            if (p?.type === "Property") scanPatternTargets(p.value);
+            else if (p?.type === "RestElement") scanPatternTargets(p.argument);
+          }
+        } else if (pat.type === "ArrayPattern") {
+          for (const el of pat.elements ?? []) scanPatternTargets(el);
+        } else if (pat.type === "AssignmentPattern") {
+          scanPatternTargets(pat.left);
+        } else if (pat.type === "RestElement") {
+          scanPatternTargets(pat.argument);
+        }
+      };
+      scanPatternTargets(n.left);
+    }
+    if (write) {
+      if (inHandler) importedStateWrites.push({ ...write, line: line(n.start) });
+      else importedStateWritesOutsideHandlers.push({ name: write.name, line: line(n.start) });
+    }
+    if (n.type === "CallExpression" && (!inFunction || inHandler || inStartup)) {
+      const m = matchLifecycleCall(n, svelteImports);
+      if (m && !shadowed.has(m.local)) {
+        lifecycleCalls.push({ name: m.canonical, line: line(n.start), inHandler });
+      }
+    }
+  });
+  const byLine = (arr) => arr.sort((a, b) => a.line - b.line);
+  return {
+    moduleStateReassignments: byLine(moduleStateReassignments),
+    importedStateWrites: byLine(importedStateWrites),
+    importedStateWritesOutsideHandlers: byLine(importedStateWritesOutsideHandlers),
+    runesModuleImports: byLine(runesModuleImports),
+    lifecycleCalls: byLine(lifecycleCalls),
+    browserGlobalRefs: byLine(browserGlobalRefs),
+    suppressions
+  };
+}
+
+// src/kit-module-collect.ts
+function emptyKitModuleFacts(file, kind) {
+  return {
+    file,
+    kind,
+    moduleStateReassignments: [],
+    importedStateWrites: [],
+    importedStateWritesOutsideHandlers: [],
+    runesModuleImports: [],
+    lifecycleCalls: [],
+    browserGlobalRefs: [],
+    suppressions: []
+  };
+}
+function kindOf(file) {
+  const base = file.split("/").pop() ?? file;
+  return base.includes(".server.") || base.startsWith("+server.") ? "server" : "universal";
+}
+async function collectKitModuleFacts(rt, cwd) {
+  const patterns = [
+    "src/routes/**/+{page,layout}.server.{ts,js}",
+    "src/routes/**/+{page,layout}.{ts,js}",
+    "src/routes/**/+server.{ts,js}",
+    "src/hooks.server.{ts,js}"
+  ];
+  const lists = await Promise.all(patterns.map((p) => rt.glob(p, cwd)));
+  const files = [...new Set(lists.flat())];
+  return Promise.all(
+    files.sort().map(async (rel) => {
+      const kind = kindOf(rel);
+      try {
+        const source = await rt.readFile(rt.join(cwd, rel));
+        return { file: rel, kind, ...parseKitModuleFacts(source, rel) };
+      } catch {
+        return emptyKitModuleFacts(rel, kind);
+      }
+    })
+  );
+}
+
 // src/project-paths.ts
 var ROBOTS_SOURCE_PATHS = [
   "static/robots.txt",
@@ -2098,6 +2869,197 @@ var correct005PropMutation = componentRule({
   }))
 });
 
+// src/rules/correctness/correct006-orphan-effect.ts
+var correct006OrphanEffect = componentRule({
+  id: "CORRECT006",
+  title: "Orphan $effect",
+  category: "correctness",
+  severity: "critical",
+  label: "$effect context",
+  recommendation: "Wrap the effect in $effect.root (and own the returned cleanup), or restructure so the effect is created during component initialisation (e.g. call a setup method from a component).",
+  rationale: "An $effect created outside component initialisation throws effect_orphan at runtime \u2014 the compiler does not catch it, and it typically surfaces as a production 500.",
+  // `orphanEffects` is typed required, but a facts object built by an older/external
+  // constructor may omit it — default to empty rather than let `applies` throw and
+  // take the whole `runRules` Promise.all down with it.
+  applies: (c) => (c.orphanEffects ?? []).length > 0,
+  bad: (c) => (c.orphanEffects ?? []).map((o) => ({
+    line: o.line,
+    message: o.kind === "top-level" ? "$effect at module scope runs outside component initialisation \u2014 it throws effect_orphan at runtime" : `class "${o.className}" runs $effect in its constructor and is instantiated at module scope \u2014 it throws effect_orphan at runtime`
+  }))
+});
+
+// src/rules/correctness/correct007-orphan-lifecycle.ts
+var PENALIZED3 = { presence: "none", value: "absent" };
+var PASS3 = { presence: "own", value: "static" };
+var ID = "CORRECT007";
+var DOCS_URL = docsUrlFor(ID);
+var LABEL = "Lifecycle-call context";
+var RECOMMENDATION = "Call lifecycle/context functions during component initialisation (the top level of a component's <script>). In load, return the data and call setContext in a layout/page component; in shared modules, expose a setup function that components call during init.";
+var topLevelMessage = (name) => `${name}() runs at module evaluation, outside component initialisation \u2014 it throws lifecycle_outside_component at runtime`;
+function isSuppressed2(suppressions, line) {
+  return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID)));
+}
+function emitFile(out, file, issues, suppressions) {
+  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed2(suppressions, b.line)));
+  if (bad.length === 0) {
+    out.push({
+      id: ID,
+      category: "correctness",
+      severity: "critical",
+      detection: PASS3,
+      route: file,
+      message: LABEL,
+      recommendation: RECOMMENDATION,
+      docsUrl: DOCS_URL
+    });
+    return;
+  }
+  for (const b of bad) {
+    out.push({
+      id: ID,
+      category: "correctness",
+      severity: "critical",
+      detection: PENALIZED3,
+      route: file,
+      location: file,
+      ...b.line > 0 ? { line: b.line } : {},
+      message: b.message,
+      recommendation: RECOMMENDATION,
+      docsUrl: DOCS_URL
+    });
+  }
+}
+var correct007OrphanLifecycle = {
+  id: ID,
+  title: "Lifecycle call outside component initialisation",
+  category: "correctness",
+  severity: "critical",
+  scope: "component",
+  rationale: "Svelte lifecycle and context functions require an active component context; called at module scope, in a shared-state class constructor, or in a load/handler they throw lifecycle_outside_component at runtime \u2014 the compiler does not catch it, and it surfaces as a production crash.",
+  async check(ctx) {
+    const out = [];
+    for (const c of ctx.components ?? []) {
+      const calls = c.orphanLifecycleCalls ?? [];
+      if (calls.length === 0) continue;
+      emitFile(
+        out,
+        c.file,
+        calls.map((o) => ({
+          line: o.line,
+          message: o.kind === "top-level" ? topLevelMessage(o.name) : `class "${o.className}" calls ${o.name}() in its constructor and is instantiated at module scope \u2014 it throws lifecycle_outside_component at runtime`
+        })),
+        c.suppressions
+      );
+    }
+    for (const m of ctx.kitModules ?? []) {
+      const calls = m.lifecycleCalls ?? [];
+      if (calls.length === 0) continue;
+      emitFile(
+        out,
+        m.file,
+        calls.map((l) => ({
+          line: l.line,
+          message: l.inHandler ? `${l.name}() is called in a load/handler \u2014 it runs on every request, outside component initialisation, and throws lifecycle_outside_component at runtime` : `${l.name}() runs outside component initialisation (module evaluation or the init hook) \u2014 it throws lifecycle_outside_component at runtime`
+        })),
+        m.suppressions
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/correctness/correct008-browser-globals.ts
+var PENALIZED4 = { presence: "none", value: "absent" };
+var PASS4 = { presence: "own", value: "static" };
+var ID2 = "CORRECT008";
+var DOCS_URL2 = docsUrlFor(ID2);
+var LABEL2 = "Server-safe module code";
+var RECOMMENDATION2 = "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).";
+var moduleMessage = (name) => `${name} is accessed at module scope \u2014 it does not exist on the server, so importing this file crashes SSR with "${name} is not defined"`;
+function isSuppressed3(suppressions, line) {
+  return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID2)));
+}
+function emitFile2(out, file, issues, suppressions) {
+  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed3(suppressions, b.line)));
+  if (bad.length === 0) {
+    out.push({
+      id: ID2,
+      category: "correctness",
+      severity: "critical",
+      detection: PASS4,
+      route: file,
+      message: LABEL2,
+      recommendation: RECOMMENDATION2,
+      docsUrl: DOCS_URL2
+    });
+    return;
+  }
+  for (const b of bad) {
+    out.push({
+      id: ID2,
+      category: "correctness",
+      severity: "critical",
+      detection: PENALIZED4,
+      route: file,
+      location: file,
+      ...b.line > 0 ? { line: b.line } : {},
+      message: b.message,
+      recommendation: RECOMMENDATION2,
+      docsUrl: DOCS_URL2
+    });
+  }
+}
+var correct008BrowserGlobals = {
+  id: ID2,
+  title: "Browser global in server module code",
+  category: "correctness",
+  severity: "critical",
+  scope: "component",
+  rationale: "window, document, localStorage and friends do not exist on the server; a read in module scope or a load/handler crashes SSR with a ReferenceError \u2014 the compiler does not catch it, and it surfaces as a production 500.",
+  async check(ctx) {
+    const out = [];
+    for (const c of ctx.components ?? []) {
+      const refs = (c.browserGlobalRefs ?? []).filter((r) => r.context === "module");
+      if (refs.length === 0) continue;
+      emitFile2(
+        out,
+        c.file,
+        refs.map((r) => ({ line: r.line, message: moduleMessage(r.name) })),
+        c.suppressions
+      );
+    }
+    for (const m of ctx.kitModules ?? []) {
+      const refs = m.browserGlobalRefs ?? [];
+      if (refs.length === 0) continue;
+      emitFile2(
+        out,
+        m.file,
+        refs.map((r) => ({
+          line: r.line,
+          message: r.inHandler ? `${r.name} is accessed in a load/handler \u2014 it runs on the server during SSR, where ${r.name} is not defined` : moduleMessage(r.name)
+        })),
+        m.suppressions
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/correctness/correct009-instance-browser-globals.ts
+var correct009InstanceBrowserGlobals = componentRule({
+  id: "CORRECT009",
+  title: "Browser global during component initialisation",
+  category: "correctness",
+  label: "Server-safe component init",
+  recommendation: "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).",
+  rationale: "A component instance script runs on the server on every SSR render, where window/document/localStorage do not exist. Warning, not critical: a component rendered only behind a parent {#if browser} (or a client-only dynamic import) is a legitimate pattern that static analysis cannot prove cross-file.",
+  applies: (c) => (c.browserGlobalRefs ?? []).some((r) => r.context === "instance"),
+  bad: (c) => (c.browserGlobalRefs ?? []).filter((r) => r.context === "instance").map((r) => ({
+    line: r.line,
+    message: `${r.name} is accessed during component initialisation \u2014 during SSR this runs on the server, where ${r.name} is not defined`
+  }))
+});
+
 // src/rules/security/sec001-002.ts
 var sec001Html = componentRule({
   id: "SEC001",
@@ -2120,6 +3082,122 @@ var sec002JavascriptUrl = componentRule({
   bad: (c) => c.javascriptUrls.map((u) => ({ line: u.line, message: "javascript: URL in an attribute" }))
 });
 
+// src/rules/kit-module-rule.ts
+var PENALIZED5 = { presence: "none", value: "absent" };
+var PASS5 = { presence: "own", value: "static" };
+function isSuppressed4(m, ruleId, line) {
+  return (m.suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ruleId)));
+}
+function kitModuleRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  const severity = opts.severity ?? "warning";
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: opts.category,
+    severity,
+    scope: "component",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const out = [];
+      for (const m of ctx.kitModules ?? []) {
+        if (!opts.applies(m, ctx)) continue;
+        const bad = opts.bad(m, ctx).filter((b) => !(b.line > 0 && isSuppressed4(m, opts.id, b.line)));
+        if (bad.length === 0) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PASS5,
+            route: m.file,
+            message: opts.label,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+          continue;
+        }
+        for (const b of bad) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PENALIZED5,
+            route: m.file,
+            location: m.file,
+            ...b.line > 0 ? { line: b.line } : {},
+            message: b.message,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/rules/security/sec003-load-state-write.ts
+var sec003LoadStateWrite = kitModuleRule({
+  id: "SEC003",
+  title: "Handler writes imported state",
+  category: "security",
+  severity: "critical",
+  label: "Load/handler purity",
+  recommendation: "Return the data from load (or the action) and pass it via page data instead of writing it to module state; per-user data belongs in cookies/locals plus a database.",
+  rationale: "SvelteKit's docs mark this NEVER-DO-THIS: the server is one long-lived process shared by every user, so module state written during a request is visible to ALL later requests \u2014 one user's data can be served to another.",
+  applies: (m) => m.importedStateWrites.length > 0,
+  bad: (m) => m.importedStateWrites.map((w) => ({
+    line: w.line,
+    message: `a server-executed handler writes imported module state "${w.name}" \u2014 shared across all requests on the server, one user's data can leak to another`
+  }))
+});
+
+// src/rules/security/sec004-server-module-state.ts
+var sec004ServerModuleState = kitModuleRule({
+  id: "SEC004",
+  title: "Server module-scope state",
+  category: "security",
+  label: "Server module state",
+  recommendation: "Do not keep request data in module scope on the server \u2014 authenticate with cookies/locals and persist per-user data in a database. For a deliberate process-wide cache, prefer a const container (e.g. a Map) or add an inline suppression.",
+  rationale: `Module scope on the server is one shared, long-lived instance (SvelteKit docs: "Avoid shared state on the server"): a value reassigned during one user's request is served to every other user, and it silently resets on every deploy or restart.`,
+  applies: (m) => m.moduleStateReassignments.length > 0,
+  bad: (m) => m.moduleStateReassignments.map((r) => ({
+    line: r.line,
+    message: r.inHandler ? `module-scope variable "${r.name}" is reassigned from a request handler \u2014 its value is shared across all requests on the server` : `module-scope variable "${r.name}" is reassigned from a function \u2014 if it runs during a request, the value is shared across all requests on the server`
+  }))
+});
+
+// src/rules/security/sec005-shared-state-import.ts
+function extSibling(path) {
+  return path.endsWith(".svelte.ts") ? path.replace(/\.svelte\.ts$/, ".svelte.js") : path.replace(/\.svelte\.js$/, ".svelte.ts");
+}
+var sec005SharedStateImport = kitModuleRule({
+  id: "SEC005",
+  title: "Shared runes-state import on the server",
+  category: "security",
+  label: "Server state imports",
+  recommendation: "Keep module-scope $state out of server-executed code: return data from load and share it via page data or the context API. If the module is genuinely client-only, restructure so server files do not import it, or add an inline suppression.",
+  rationale: "A .svelte.ts module with module-scope $state is one shared instance on the server: mutated, it leaks data between users; read-only, every request sees the same boot-time value instead of per-user data.",
+  applies: (m) => m.runesModuleImports.length > 0,
+  bad: (m, ctx) => {
+    const stateFiles = new Set((ctx.components ?? []).filter((c) => c.moduleStateDecls.length > 0).map((c) => c.file));
+    const writtenOutside = new Set(m.importedStateWritesOutsideHandlers.map((w) => w.name));
+    const writtenInHandler = new Set(m.importedStateWrites.map((w) => w.name));
+    const out = [];
+    for (const imp of m.runesModuleImports) {
+      if (!stateFiles.has(imp.resolved) && !stateFiles.has(extSibling(imp.resolved))) continue;
+      const names = imp.names.filter((n) => !writtenInHandler.has(n));
+      if (names.length === 0) continue;
+      const mutates = names.some((n) => writtenOutside.has(n));
+      out.push({
+        line: imp.line,
+        message: mutates ? `server-executed code mutates shared module state from "${imp.source}" \u2014 on the server it is one instance shared by every request` : `"${imp.source}" holds module-scope $state \u2014 on the server it is shared by every request and keeps its boot-time value (a leak if it ever holds per-user data)`
+      });
+    }
+    return out;
+  }
+});
+
 // src/rules/architecture/arch001-002.ts
 var MAX_LOC = 400;
 var MAX_PROPS = 10;
@@ -2246,8 +3324,15 @@ var allRules = [
   correct003EffectAsOnMount,
   correct004UnmutatedState,
   correct005PropMutation,
+  correct006OrphanEffect,
+  correct007OrphanLifecycle,
+  correct008BrowserGlobals,
+  correct009InstanceBrowserGlobals,
   sec001Html,
   sec002JavascriptUrl,
+  sec003LoadStateWrite,
+  sec004ServerModuleState,
+  sec005SharedStateImport,
   arch001ComponentSize,
   arch002PropCount,
   perf009HeavyImport,
@@ -2793,200 +3878,693 @@ function formatMarkdownReport(results, config, meta) {
   return lines.join("\n");
 }
 
-// src/reporter/html.ts
-var BAND_COLOR = {
-  good: "#2FA968",
-  warn: "#E8A317",
-  poor: "#E5484D"
-};
-function scoreBand(score) {
-  return score >= 90 ? "good" : score >= 50 ? "warn" : "poor";
+// src/reporter/app-shell.ts
+function embedJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeHtml(s) {
-  return s.replace(
-    /[&<>"']/g,
-    (c) => c === "&" ? "&amp;" : c === "<" ? "&lt;" : c === ">" ? "&gt;" : c === '"' ? "&quot;" : "&#39;"
-  );
+function sanitizeDocsUrl(issue) {
+  if (issue.docsUrl === void 0) return issue;
+  if (safeHref(issue.docsUrl) !== null) return issue;
+  return { ...issue, docsUrl: void 0 };
 }
-function safeHref(url) {
-  const normalized = url.replace(/\s/g, "").toLowerCase();
-  return /^https?:\/\//.test(normalized) ? url : null;
+function sanitizeReport(report) {
+  return {
+    ...report,
+    routes: report.routes.map((route) => ({ ...route, issues: route.issues.map(sanitizeDocsUrl) })),
+    siteIssues: report.siteIssues.map(sanitizeDocsUrl)
+  };
 }
-var slug = (route) => "route-" + route.replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "").toLowerCase();
-var categoryLabel = (cat) => cat === "seo" ? "SEO" : cat.charAt(0).toUpperCase() + cat.slice(1);
-var SEVERITIES = ["critical", "warning", "info"];
-function renderFinding(issue) {
-  const sev = SEVERITIES.includes(issue.severity) ? issue.severity : "info";
-  const dyn = issue.detection.value === "dynamic" ? ' <span class="dyn" title="set dynamically (verified at runtime)">\u21AF</span>' : "";
-  const line = issue.line !== void 0 ? `:${issue.line}` : "";
-  const fix = issue.fix?.snippet !== void 0 ? `<div class="fix"><div class="label">fix</div><pre><code>${escapeHtml(issue.fix.snippet)}</code></pre></div>` : "";
-  const href = issue.docsUrl ? safeHref(issue.docsUrl) : null;
-  const docs = href ? `<a class="f-link" href="${escapeHtml(href)}">Learn more</a>` : "";
-  return `<article class="finding sev-${sev}" data-severity="${sev}" data-category="${escapeHtml(issue.category)}"><div class="f-head"><span class="ruleid">${escapeHtml(issue.id)}</span><span class="f-title">${escapeHtml(issue.title)}</span><span class="sev-tag ${sev}">${sev}</span></div>` + (issue.location ? `<p class="f-loc">${escapeHtml(issue.location)}${line}${dyn}</p>` : "") + (issue.recommendation ? `<p class="f-rec">${escapeHtml(issue.recommendation)}</p>` : "") + fix + docs + `</article>`;
-}
-function renderTopbar(report, meta) {
-  const findings = report.routes.reduce((n, r) => n + r.issues.length, 0) + report.siteIssues.length;
-  const core = meta.coreVersion ? `<span title="@svelte-vitals/core version">core v${escapeHtml(meta.coreVersion)}</span>` : "";
-  return `<header class="topbar"><div class="brand"><span class="bolt">\u21AF</span>svelte-<span class="v">vitals</span></div><div class="meta"><span>v${escapeHtml(meta.version)}</span>` + core + `<span>${report.routes.length} routes</span><span>${findings} findings</span></div></header>`;
-}
-function renderHero(report) {
-  const C = 2 * Math.PI * 58;
-  const offset = (C * (1 - report.score / 100)).toFixed(1);
-  const hb = scoreBand(report.score);
-  const s = report.summary;
-  const dynNote = s.dynamic > 0 ? `<span class="tally"><span class="dot dyn-dot">\u21AF</span>Dynamic <span class="n">${s.dynamic}</span></span>` : "";
-  const cats = Object.entries(report.categories).map(([cat, { score }]) => {
-    const b = scoreBand(score);
-    const weight = report.weights[cat];
-    const w = weight !== void 0 ? `<span class="w">weight ${weight}</span>` : "";
-    const name = categoryLabel(cat);
-    return `<div class="cat"><div class="top"><span class="name">${escapeHtml(name)} ${w}</span><span class="sc" style="color:${BAND_COLOR[b]}">${score}</span></div><div class="bar"><i style="width:${score}%;background:${BAND_COLOR[b]}"></i></div></div>`;
-  }).join("");
-  return `<section class="hero"><div class="gauge"><svg width="132" height="132" viewBox="0 0 132 132" aria-hidden="true"><circle cx="66" cy="66" r="58" fill="none" stroke="#e4e7ec" stroke-width="11"></circle><circle id="arc" cx="66" cy="66" r="58" fill="none" stroke="${BAND_COLOR[hb]}" stroke-width="11" stroke-linecap="round" stroke-dasharray="${C.toFixed(1)}" stroke-dashoffset="${offset}"></circle></svg><div class="num"><strong id="hnum">${report.score}</strong><span>Health</span></div></div><div class="readout"><div class="eyebrow">SvelteKit \xB7 SEO &amp; Performance</div><div class="tallies"><span class="tally"><span class="dot crit"></span>Critical <span class="n">${s.critical}</span></span><span class="tally"><span class="dot warn"></span>Warning <span class="n">${s.warning}</span></span><span class="tally"><span class="dot info"></span>Info <span class="n">${s.info}</span></span><span class="tally"><span class="dot pass"></span>Passed <span class="n">${s.passed}</span></span>` + dynNote + `</div><div class="cats">${cats}</div></div></section>`;
-}
-var ROUTE_BADGES = ["measured", "static"];
-function renderRoutes(report, routeBadges) {
-  if (report.routes.length === 0) return "";
-  const rows = report.routes.map((r) => {
-    const b = scoreBand(r.score);
-    const crit = r.issues.filter((i) => i.severity === "critical").length;
-    const warn = r.issues.filter((i) => i.severity === "warning").length;
-    const info = r.issues.filter((i) => i.severity === "info").length;
-    const parts = [];
-    if (crit) parts.push(`${crit} critical`);
-    if (warn) parts.push(`${warn} warning${warn > 1 ? "s" : ""}`);
-    if (info) parts.push(`${info} info`);
-    const sum = parts.length ? parts.join(" \xB7 ") : '<span class="none">no issues</span>';
-    const body = r.issues.length ? r.issues.map(renderFinding).join("") : '<p class="empty">No issues found on this route.</p>';
-    const rawBadge = routeBadges?.[r.route];
-    const badge = rawBadge && ROUTE_BADGES.includes(rawBadge) ? rawBadge : void 0;
-    const badgeHtml = badge ? ` <span class="badge badge-${badge}">${escapeHtml(badge)}</span>` : "";
-    return `<details class="route" id="${slug(r.route)}" data-score="${r.score}"${r.issues.length ? " open" : ""}><summary><span class="route-name"><span class="path">${escapeHtml(r.route)}</span>${badgeHtml}</span><span class="issue-sum">${sum}</span><span class="score-chip"><span class="ring" style="background:${BAND_COLOR[b]}"></span>${r.score}</span><span class="chev">\u203A</span></summary><div class="route-body">${body}</div></details>`;
-  }).join("");
-  return `<section class="section"><h2>Routes</h2><div class="routes">${rows}</div></section>`;
-}
-function renderSiteChecks(report) {
-  if (report.siteIssues.length === 0) return "";
-  const cards = report.siteIssues.map(renderFinding).join("");
-  return `<section class="section"><h2>Site checks</h2>${cards}</section>`;
-}
-function renderFilters(report) {
-  const chip = (filter, label, pressed = false) => `<button class="chip" type="button" aria-pressed="${pressed}" data-filter="${escapeHtml(filter)}">${escapeHtml(label)}</button>`;
-  const catChips = Object.keys(report.categories).map((cat) => chip(cat, categoryLabel(cat))).join("");
-  return `<div class="filters" role="group" aria-label="Filter findings">` + chip("all", "All", true) + chip("critical", "Critical") + chip("warning", "Warning") + chip("info", "Info") + catChips + `</div>`;
-}
-var STYLE = `
-:root{--ground: #f6f7f9;--panel: #fff;--ink: #0c1322;--muted: #5a6472;--faint: #8c95a3;--line: #e4e7ec;--line-strong: #d3d8e0;--accent: #ff3e00;--good: #2fa968;--warn: #e8a317;--poor: #e5484d;--code-bg: #0e1525;--code-ink: #e7ecf4;--radius: 12px;--mono: ui-monospace,"SF Mono","JetBrains Mono",Menlo,Consolas,monospace;--sans: system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif}
+var APP_STYLE = `
+:root{--ground:#f6f7f9;--panel:#fff;--ink:#0c1322;--muted:#5a6472;--faint:#8c95a3;--line:#e4e7ec;--line-strong:#d3d8e0;--accent:#ff3e00;--good:#2fa968;--warn:#e8a317;--poor:#e5484d;--code-bg:#0e1525;--code-ink:#e7ecf4;--active-bg:#0c1322;--active-ink:#fff;--mono:ui-monospace,"SF Mono","JetBrains Mono",Menlo,Consolas,monospace;--sans:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif}
+:root[data-theme="dark"]{--ground:#0b0e14;--panel:#12161f;--ink:#e7ecf4;--muted:#9aa4b2;--faint:#6b7484;--line:#232838;--line-strong:#2d3345;--code-bg:#05070c;--code-ink:#e7ecf4;--active-bg:#e7ecf4;--active-ink:#0b0e14}
+@media (prefers-color-scheme:dark){:root:not([data-theme="light"]){--ground:#0b0e14;--panel:#12161f;--ink:#e7ecf4;--muted:#9aa4b2;--faint:#6b7484;--line:#232838;--line-strong:#2d3345;--code-bg:#05070c;--code-ink:#e7ecf4;--active-bg:#e7ecf4;--active-ink:#0b0e14}}
 *{box-sizing:border-box}
-body{margin:0;background:var(--ground);color:var(--ink);font-family:var(--sans);line-height:1.5;-webkit-font-smoothing:antialiased}
-.wrap{max-width:960px;margin:0 auto;padding:0 20px 96px}
-.topbar{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;padding:18px 0 16px;border-bottom:1px solid var(--line)}
-.brand{display:flex;align-items:baseline;gap:8px;font-weight:700;font-size:18px;letter-spacing:-.02em}
-.brand .bolt{color:var(--accent);font-size:20px}.brand .v{color:var(--accent)}
-.meta{font-family:var(--mono);font-size:12.5px;color:var(--muted);display:flex;gap:14px;flex-wrap:wrap}
-.hero{display:grid;grid-template-columns:auto 1fr;gap:28px;align-items:center;padding:30px 0 24px}
-.gauge{position:relative;width:132px;height:132px}.gauge svg{transform:rotate(-90deg);display:block}
-.gauge .num{position:absolute;inset:0;display:flex;flex-direction:column;align-items:center;justify-content:center}
-.gauge .num strong{font-family:var(--mono);font-size:40px;font-weight:600;letter-spacing:-.03em;line-height:1;font-variant-numeric:tabular-nums}
-.gauge .num span{font-size:11px;text-transform:uppercase;letter-spacing:.14em;color:var(--muted);margin-top:6px}
-.readout{min-width:0}
-.eyebrow{font-size:11px;text-transform:uppercase;letter-spacing:.16em;color:var(--accent);font-weight:700}
-.eyebrow::before{content:"\u21AF "}
-.tallies{display:flex;gap:8px;flex-wrap:wrap;margin:16px 0 18px}
-.tally{display:inline-flex;align-items:center;gap:7px;font-size:13px;font-weight:600;background:var(--panel);border:1px solid var(--line);padding:5px 11px;border-radius:999px}
-.tally .dot{width:9px;height:9px;border-radius:50%}.tally .n{font-family:var(--mono);font-variant-numeric:tabular-nums}
-.dot.crit{background:var(--poor)}.dot.warn{background:var(--warn)}.dot.info{background:var(--faint)}.dot.pass{background:var(--good)}
-.dot.dyn-dot{background:transparent;color:var(--accent);font-weight:700;width:auto;height:auto}
-.cats{display:flex;gap:22px;flex-wrap:wrap}
-.cat{min-width:190px;flex:1}.cat .top{display:flex;align-items:baseline;justify-content:space-between;margin-bottom:6px}
-.cat .name{font-size:13px;font-weight:600}.cat .name .w{color:var(--faint);font-family:var(--mono);font-size:11px;font-weight:500;margin-left:6px}
-.cat .sc{font-family:var(--mono);font-weight:600;font-variant-numeric:tabular-nums}
-.bar{height:7px;border-radius:999px;background:var(--line);overflow:hidden}.bar>i{display:block;height:100%;border-radius:999px}
-.section{margin-top:40px}
-.section>h2{font-size:13px;text-transform:uppercase;letter-spacing:.12em;color:var(--muted);font-weight:700;margin:0 0 14px}
-.filters{display:flex;gap:8px;flex-wrap:wrap;margin-top:28px}
-.chip{font:inherit;font-size:12.5px;font-weight:600;cursor:pointer;background:var(--panel);border:1px solid var(--line-strong);color:var(--muted);padding:5px 12px;border-radius:999px}
-.chip:hover{border-color:var(--faint);color:var(--ink)}
-.chip[aria-pressed="true"]{background:var(--ink);border-color:var(--ink);color:#fff}
-.chip:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
-.routes{border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;background:var(--panel)}
-.route{border-top:1px solid var(--line)}.route:first-child{border-top:0}
-.route>summary{display:grid;grid-template-columns:1fr auto auto auto;gap:16px;align-items:center;padding:13px 16px;cursor:pointer;list-style:none}
-.route>summary::-webkit-details-marker{display:none}
-.route>summary:hover{background:#fbfcfd}
-.route-name{font-family:var(--mono);font-size:13.5px;min-width:0;display:flex;align-items:center;gap:8px}
-.route-name .path{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-.badge{font-family:var(--sans);font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;padding:2px 7px;border-radius:999px;flex-shrink:0}
-.badge-measured{background:rgba(47,169,104,.14);color:var(--good)}
-.badge-static{background:rgba(140,149,163,.18);color:var(--muted)}
-.issue-sum{font-size:12.5px;color:var(--muted);font-family:var(--mono);white-space:nowrap}.issue-sum .none{color:var(--good)}
-.score-chip{display:inline-flex;align-items:center;gap:7px;font-family:var(--mono);font-weight:600;font-variant-numeric:tabular-nums;font-size:14px}
-.score-chip .ring{width:10px;height:10px;border-radius:50%}
-.chev{color:var(--faint);font-family:var(--mono);transition:transform .15s ease}
-.route[open]>summary .chev{transform:rotate(90deg)}
-.route-body{padding:4px 16px 16px}.empty{color:var(--muted);font-size:13px;margin:6px 0}
-.finding{background:var(--panel);border:1px solid var(--line);border-left-width:3px;border-radius:10px;padding:16px 18px;margin:0 0 12px}
-.finding.sev-critical{border-left-color:var(--poor)}.finding.sev-warning{border-left-color:var(--warn)}.finding.sev-info{border-left-color:var(--faint)}
-.f-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
-.ruleid{font-family:var(--mono);font-size:12px;font-weight:600;background:#eef1f5;padding:2px 8px;border-radius:6px}
-.f-title{font-weight:650;font-size:15px}
-.sev-tag{margin-left:auto;font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}
-.sev-tag.critical{color:var(--poor)}.sev-tag.warning{color:var(--warn)}.sev-tag.info{color:var(--faint)}
-.f-loc{font-family:var(--mono);font-size:12.5px;color:var(--muted);margin:8px 0 0}.dyn{color:var(--accent);font-weight:700}
-.f-rec{font-size:14px;color:#2b3340;margin:10px 0 0}
-.fix{margin:12px 0 0;background:var(--code-bg);border-radius:8px;overflow:hidden}
-.fix .label{font-family:var(--mono);font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:#8da0bd;padding:8px 14px 0}
-.fix pre{margin:0;padding:8px 14px 14px;overflow-x:auto}
-.fix code{font-family:var(--mono);font-size:12.5px;color:var(--code-ink);line-height:1.65;white-space:pre}
-.f-link{display:inline-block;margin-top:12px;font-size:13px;font-weight:600;color:var(--accent);text-decoration:none}
-.f-link:hover{text-decoration:underline}.f-link::after{content:" \u2192"}
-.foot{margin-top:48px;padding-top:18px;border-top:1px solid var(--line);font-family:var(--mono);font-size:12px;color:var(--faint);display:flex;justify-content:space-between;flex-wrap:wrap;gap:8px}
-.foot a{color:var(--accent);text-decoration:none}
-@media (max-width:640px){.hero{grid-template-columns:1fr;justify-items:start}.route>summary{grid-template-columns:1fr auto}.chev{display:none}}
+html,body{margin:0;height:100%}
+body{background:var(--ground);color:var(--ink);font-family:var(--sans);line-height:1.5;-webkit-font-smoothing:antialiased}
+.dv-app{display:grid;grid-template-rows:auto 1fr;grid-template-columns:280px 1fr;grid-template-areas:"top top" "side main";height:100vh}
+.dv-topbar{grid-area:top;border-bottom:1px solid var(--line);background:var(--panel)}
+.dv-topbar-inner{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;padding:12px 20px}
+.dv-brand{display:flex;align-items:center;background:none;border:none;padding:0;cursor:pointer;border-radius:6px}
+.dv-brand svg{height:28px;width:auto;display:block}
+.dv-brand:focus-visible{outline:2px solid var(--accent);outline-offset:4px}
+.dv-meta{font-family:var(--mono);font-size:12px;color:var(--muted);display:flex;gap:12px;flex-wrap:wrap}
+.dv-status{display:flex;align-items:center;gap:10px}
+.dv-analyzing{font-size:12px;color:var(--accent);font-weight:600}
+.dv-conn{width:8px;height:8px;border-radius:50%;background:var(--faint);display:inline-block}
+.dv-conn-connected{background:var(--good)}
+.dv-conn-reconnecting{background:var(--warn)}
+.dv-menu-toggle{display:none;border:1px solid var(--line-strong);background:var(--panel);color:var(--ink);border-radius:8px;width:28px;height:28px;cursor:pointer}
+.dv-theme-toggle{border:1px solid var(--line-strong);background:var(--panel);color:var(--ink);border-radius:999px;width:28px;height:28px;cursor:pointer}
+.dv-theme-toggle:focus-visible,.dv-menu-toggle:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.dv-sidebar{grid-area:side;border-right:1px solid var(--line);background:var(--panel);overflow-y:auto}
+.dv-sidebar-inner{display:flex;flex-direction:column;gap:10px;padding:14px}
+.dv-search{font:inherit;font-size:13px;padding:7px 10px;border:1px solid var(--line-strong);border-radius:8px;background:var(--ground);color:var(--ink)}
+.dv-sort{font:inherit;font-size:12.5px;padding:6px 8px;border:1px solid var(--line-strong);border-radius:8px;background:var(--ground);color:var(--ink)}
+.dv-nav{display:flex;flex-direction:column;gap:2px}
+.dv-nav-item{display:flex;flex-direction:column;gap:4px;padding:8px 10px;border-radius:8px;cursor:pointer}
+.dv-nav-item:hover{background:var(--ground)}
+.dv-nav-item.active{background:var(--active-bg);color:var(--active-ink)}
+.dv-nav-item:focus-visible{outline:2px solid var(--accent);outline-offset:-2px}
+.dv-nav-label{font-family:var(--mono);font-size:13px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dv-nav-meta{display:flex;align-items:center;gap:8px;font-size:11.5px;color:var(--muted)}
+.dv-nav-item.active .dv-nav-meta{color:inherit}
+.dv-nav-score{font-family:var(--mono);font-weight:700}
+.dv-badge{font-size:9.5px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;padding:1px 6px;border-radius:999px}
+.dv-badge-measured{background:rgba(47,169,104,.16);color:var(--good)}
+.dv-badge-static{background:rgba(140,149,163,.2);color:var(--muted)}
+.dv-detail{grid-area:main;overflow-y:auto;padding:24px 28px 80px}
+.dv-gauge{position:relative;width:132px;height:132px;margin-bottom:20px}
+.dv-gauge svg{position:absolute;inset:0;transform:rotate(-90deg)}
+.dv-gauge-track{stroke:var(--line)}
+.dv-gauge-num{position:absolute;inset:0;display:flex;flex-direction:column;align-items:center;justify-content:center}
+.dv-gauge-num strong{font-family:var(--mono);font-size:36px;font-weight:600}
+.dv-gauge-num span{font-size:10px;text-transform:uppercase;letter-spacing:.14em;color:var(--muted)}
+.dv-cats{display:flex;gap:22px;flex-wrap:wrap;margin-bottom:20px}
+.dv-cat{min-width:180px;flex:1}
+.dv-cat-top{display:flex;justify-content:space-between;font-size:13px;margin-bottom:6px}
+.dv-bar{height:7px;border-radius:999px;background:var(--line);overflow:hidden}
+.dv-bar>i{display:block;height:100%;border-radius:999px}
+.dv-filters{display:flex;gap:8px;flex-wrap:wrap;margin:16px 0}
+.dv-chip{font:inherit;font-size:12.5px;font-weight:600;cursor:pointer;background:var(--panel);border:1px solid var(--line-strong);color:var(--muted);padding:5px 12px;border-radius:999px}
+.dv-chip[aria-pressed="true"]{background:var(--active-bg);border-color:var(--active-bg);color:var(--active-ink)}
+.dv-chip:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.dv-section h2{font-size:12px;text-transform:uppercase;letter-spacing:.12em;color:var(--muted);margin:24px 0 12px}
+.dv-detail-header{display:flex;align-items:center;gap:12px;margin-bottom:14px;flex-wrap:wrap}
+.dv-route-path{font-family:var(--mono);font-size:16px;font-weight:600}
+.dv-score-chip{font-family:var(--mono);font-weight:700}
+.dv-finding{background:var(--panel);border:1px solid var(--line);border-left-width:3px;border-radius:10px;padding:16px 18px;margin:0 0 12px}
+.dv-finding-critical{border-left-color:var(--poor)}
+.dv-finding-warning{border-left-color:var(--warn)}
+.dv-finding-info{border-left-color:var(--faint)}
+.dv-f-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.dv-ruleid{font-family:var(--mono);font-size:12px;font-weight:600;background:var(--ground);padding:2px 8px;border-radius:6px}
+.dv-f-title{font-weight:650;font-size:15px}
+.dv-sev-tag{margin-left:auto;font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}
+.dv-sev-critical{color:var(--poor)}
+.dv-sev-warning{color:var(--warn)}
+.dv-sev-info{color:var(--faint)}
+.dv-f-route{display:block;font:inherit;font-family:var(--mono);font-size:12.5px;font-weight:600;color:var(--accent);background:none;border:none;padding:0;margin:8px 0 0;cursor:pointer;text-align:left}
+.dv-f-route:hover{text-decoration:underline}
+.dv-f-route:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.dv-f-loc{font-family:var(--mono);font-size:12.5px;color:var(--muted);margin:8px 0 0}
+.dv-f-rec{font-size:14px;margin:10px 0 0}
+.dv-fix{margin:12px 0 0;background:var(--code-bg);border-radius:8px;overflow:hidden}
+.dv-fix-label{font-family:var(--mono);font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:#8da0bd;padding:8px 14px 0}
+.dv-fix pre{margin:0;padding:8px 14px 14px;overflow-x:auto}
+.dv-fix code{font-family:var(--mono);font-size:12.5px;color:var(--code-ink);line-height:1.65;white-space:pre}
+.tok-kw{color:#ff7ab8}
+.tok-str{color:#9ece6a}
+.tok-num{color:#ff9e64}
+.tok-cm{color:#6b7280;font-style:italic}
+.tok-id{color:var(--code-ink)}
+.tok-pn{color:#8da0bd}
+.dv-f-link{display:inline-block;margin-top:12px;font-size:13px;font-weight:600;color:var(--accent);text-decoration:none}
+.dv-f-link:hover{text-decoration:underline}
+.dv-ai-prompt{margin-top:12px;border:1px solid var(--line);border-radius:8px;overflow:hidden}
+.dv-ai-prompt>summary{cursor:pointer;list-style:none;padding:8px 12px;font-size:12px;font-weight:600;color:var(--muted);display:flex;align-items:center;gap:6px;user-select:none}
+.dv-ai-prompt>summary::-webkit-details-marker{display:none}
+.dv-ai-prompt>summary::before{content:"\u25B8";display:inline-block;transition:transform .15s ease}
+.dv-ai-prompt[open]>summary::before{transform:rotate(90deg)}
+.dv-ai-prompt-body{padding:0 12px 12px;display:flex;flex-direction:column;gap:8px}
+.dv-ai-prompt-pre{margin:0;padding:10px 12px;background:var(--code-bg);color:var(--code-ink);border-radius:8px;font-family:var(--mono);font-size:12px;line-height:1.6;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow-y:auto}
+.dv-ai-copy-btn{align-self:flex-start;font:inherit;font-size:12px;font-weight:600;cursor:pointer;background:var(--panel);border:1px solid var(--line-strong);color:var(--ink);padding:5px 12px;border-radius:999px}
+.dv-ai-copy-btn:hover{border-color:var(--faint)}
+.dv-ai-copy-btn:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.dv-empty{color:var(--muted);font-size:13px}
+@media (max-width:640px){.dv-app{grid-template-columns:1fr;grid-template-areas:"top" "main"}.dv-menu-toggle{display:inline-flex}.dv-sidebar{position:fixed;inset:0 20% 0 0;transform:translateX(-100%);transition:transform .2s ease;z-index:10}.dv-sidebar.open{transform:translateX(0)}}
 @media (prefers-reduced-motion:reduce){*{transition:none!important}}
 `;
-var SCRIPT = `
+var APP_SCRIPT = `
 (function(){
-  var arc=document.getElementById('arc'),num=document.getElementById('hnum');
-  if(arc&&num){
-    var C=2*Math.PI*58,score=parseInt(num.textContent,10)||0;
-    var reduce=window.matchMedia('(prefers-reduced-motion: reduce)').matches;
-    if(!reduce){
-      arc.style.transition='stroke-dashoffset 1.1s cubic-bezier(.22,.61,.36,1)';
-      arc.style.strokeDashoffset=C.toFixed(1);
-      var start=null;
-      requestAnimationFrame(function step(t){
-        if(start===null)start=t;
-        var p=Math.min((t-start)/1100,1);
-        num.textContent=Math.round(score*(p<1?1-Math.pow(1-p,3):1));
-        if(p<1)requestAnimationFrame(step);
+  var BAND_COLOR = { good: '#2fa968', warn: '#e8a317', poor: '#e5484d' };
+  function scoreBand(score) { return score >= 90 ? 'good' : score >= 50 ? 'warn' : 'poor'; }
+
+  // Same mark as the docs site's hero wordmark (docs/public/wordmark.svg) \u2014 an inline
+  // copy, not an <img src>, since the dashboard is a single self-contained HTML response
+  // with no other static assets to serve alongside it. Fixed brand colors (not CSS custom
+  // properties), matching the docs usage: the wordmark reads the same in both themes.
+  var WORDMARK_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 380 56" role="img" aria-labelledby="dv-wordmark-title"><title id="dv-wordmark-title">svelte-vitals</title><defs><clipPath id="dv-wordmark-clip"><rect x="2" y="2" width="52" height="52" rx="14"/></clipPath></defs><rect x="2" y="2" width="52" height="52" rx="14" fill="#FF3E00"/><polyline clip-path="url(#dv-wordmark-clip)" points="4,28 15,28 17.5,23.5 20,28 23,28 26,7 29,49 32,28 35,28 37,24.5 39.5,28 52,28" fill="none" stroke="#fff" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/><text x="70" y="38" font-family="ui-sans-serif, system-ui, -apple-system, \\'Segoe UI\\', Roboto, sans-serif" font-size="30" font-weight="700" fill="#FF3E00">svelte-vitals</text></svg>';
+
+  function h(tag, attrs, kids) {
+    var n = document.createElement(tag);
+    if (attrs) {
+      for (var k in attrs) {
+        if (!Object.prototype.hasOwnProperty.call(attrs, k)) continue;
+        var v = attrs[k];
+        if (v === undefined || v === null || v === false) continue;
+        if (k === 'class') n.className = v;
+        else if (k === 'text') n.textContent = v;
+        else if (k.indexOf('on') === 0 && typeof v === 'function') n.addEventListener(k.slice(2), v);
+        else n.setAttribute(k, v === true ? '' : String(v));
+      }
+    }
+    (kids || []).forEach(function (c) {
+      if (c === undefined || c === null || c === false) return;
+      n.appendChild(typeof c === 'string' ? document.createTextNode(c) : c);
+    });
+    return n;
+  }
+  function clear(n) { while (n.firstChild) n.removeChild(n.firstChild); }
+  function mount(id, node) { var el = document.getElementById(id); clear(el); el.appendChild(node); }
+
+  var HL_KEYWORDS = ['import','export','from','const','let','var','function','return','if','else','for','while','class','new','await','async','default','type','interface','extends','implements','this','typeof','instanceof','of','in','true','false','null','undefined'];
+  var HL_LANGS = { js: 1, javascript: 1, ts: 1, typescript: 1, svelte: 1, html: 1, css: 1 };
+
+  function highlightTokens(code) {
+    var tokens = [];
+    var i = 0;
+    var n = code.length;
+    var reIdent = /[A-Za-z_$][A-Za-z0-9_$]*/y;
+    var reNum = /\\d+(\\.\\d+)?/y;
+    while (i < n) {
+      var ch = code[i];
+      if (ch === '/' && code[i + 1] === '/') {
+        var end = code.indexOf('\\n', i);
+        if (end === -1) end = n;
+        tokens.push({ text: code.slice(i, end), cls: 'cm' });
+        i = end;
+        continue;
+      }
+      if (ch === '/' && code[i + 1] === '*') {
+        var end2 = code.indexOf('*/', i + 2);
+        end2 = end2 === -1 ? n : end2 + 2;
+        tokens.push({ text: code.slice(i, end2), cls: 'cm' });
+        i = end2;
+        continue;
+      }
+      if (ch === '"' || ch === "'" || ch === '\`') {
+        var quote = ch;
+        var j = i + 1;
+        while (j < n && code[j] !== quote) {
+          if (code[j] === '\\\\') j++;
+          j++;
+        }
+        j = Math.min(j + 1, n);
+        tokens.push({ text: code.slice(i, j), cls: 'str' });
+        i = j;
+        continue;
+      }
+      reIdent.lastIndex = i;
+      var mIdent = reIdent.exec(code);
+      if (mIdent && mIdent.index === i) {
+        var word = mIdent[0];
+        tokens.push({ text: word, cls: HL_KEYWORDS.indexOf(word) !== -1 ? 'kw' : 'id' });
+        i += word.length;
+        continue;
+      }
+      reNum.lastIndex = i;
+      var mNum = reNum.exec(code);
+      if (mNum && mNum.index === i) {
+        tokens.push({ text: mNum[0], cls: 'num' });
+        i += mNum[0].length;
+        continue;
+      }
+      tokens.push({ text: ch, cls: 'pn' });
+      i += 1;
+    }
+    return tokens;
+  }
+
+  function renderFixSnippet(fix) {
+    var pre = h('pre', null, []);
+    var code = h('code', null, []);
+    var lang = (fix.lang || 'svelte').toLowerCase();
+    if (HL_LANGS[lang]) {
+      highlightTokens(fix.snippet).forEach(function (t) {
+        code.appendChild(h('span', { class: 'tok-' + t.cls, text: t.text }, []));
       });
-      requestAnimationFrame(function(){arc.style.strokeDashoffset=(C*(1-score/100)).toFixed(1);});
+    } else {
+      code.textContent = fix.snippet;
+    }
+    pre.appendChild(code);
+    return pre;
+  }
+
+  // Plain-text, copy-pasteable prompt for a single finding \u2014 same ingredients as the
+  // agent reporter's per-finding block (rule id, location, recommendation, fix, docs),
+  // reshaped for a standalone request rather than a whole-project remediation doc.
+  function buildAiPrompt(issue, route) {
+    var lines = ['Fix this svelte-vitals finding:', ''];
+    lines.push('- Rule: ' + issue.id + ' \u2014 ' + issue.title + ' (' + issue.severity + ')');
+    if (route) lines.push('- Route: ' + route);
+    if (issue.location) {
+      lines.push('- Location: ' + issue.location + (issue.line !== undefined ? ':' + issue.line : ''));
+    }
+    if (issue.recommendation) lines.push('- Recommendation: ' + issue.recommendation);
+    if (issue.fix) {
+      lines.push('- Fix: ' + issue.fix.description);
+      if (issue.fix.snippet) {
+        lines.push('', '\`\`\`' + (issue.fix.lang || 'svelte'), issue.fix.snippet, '\`\`\`');
+      }
+    }
+    if (issue.docsUrl) lines.push('- Docs: ' + issue.docsUrl);
+    lines.push(
+      '',
+      'After fixing, re-run \`svelte-vitals --diff\` (or revisit this route) to confirm ' +
+        issue.id +
+        ' passes' +
+        (route ? ' for ' + route : '') +
+        '.'
+    );
+    return lines.join('\\n');
+  }
+
+  function copyToClipboard(text, btn) {
+    var original = 'Copy';
+    function reset(label) {
+      btn.textContent = label;
+      setTimeout(function () { btn.textContent = original; }, 1500);
     }
+    function done() { reset('Copied!'); }
+    function fail() { reset('Copy failed'); }
+    function fallbackCopy() {
+      var ta = document.createElement('textarea');
+      ta.value = text;
+      ta.setAttribute('readonly', '');
+      ta.style.position = 'fixed';
+      ta.style.opacity = '0';
+      document.body.appendChild(ta);
+      ta.select();
+      var ok = false;
+      try { ok = document.execCommand('copy'); } catch (e) {}
+      document.body.removeChild(ta);
+      return ok;
+    }
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      navigator.clipboard.writeText(text).then(done, function () { fallbackCopy() ? done() : fail(); });
+    } else {
+      fallbackCopy() ? done() : fail();
+    }
+  }
+
+  function renderAiPrompt(issue, route) {
+    var text = buildAiPrompt(issue, route);
+    var btn = h('button', { type: 'button', class: 'dv-ai-copy-btn', text: 'Copy' }, []);
+    btn.addEventListener('click', function () { copyToClipboard(text, btn); });
+    return h('details', { class: 'dv-ai-prompt' }, [
+      h('summary', { text: 'AI Prompt' }, []),
+      h('div', { class: 'dv-ai-prompt-body' }, [
+        h('pre', { class: 'dv-ai-prompt-pre', text: text }, []),
+        btn
+      ])
+    ]);
   }
-  var chips=document.querySelectorAll('.chip'),findings=document.querySelectorAll('.finding');
-  function apply(f){
-    findings.forEach(function(el){
-      var ok=f==='all'||el.getAttribute('data-severity')===f||el.getAttribute('data-category')===f;
-      el.style.display=ok?'':'none';
+
+  var state = {
+    snapshot: null,
+    selected: 'overview',
+    search: '',
+    sort: 'score-asc',
+    filter: 'all',
+    theme: initialTheme(),
+    connection: 'connecting',
+    routeBySlug: {}
+  };
+
+  function initialTheme() {
+    try {
+      var stored = localStorage.getItem('svelte-vitals-theme');
+      if (stored === 'dark' || stored === 'light') return stored;
+    } catch (e) {}
+    return window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
+  function applyTheme() { document.documentElement.setAttribute('data-theme', state.theme); }
+  function toggleTheme() {
+    state.theme = state.theme === 'dark' ? 'light' : 'dark';
+    try { localStorage.setItem('svelte-vitals-theme', state.theme); } catch (e) {}
+    applyTheme();
+    renderTopbar();
+  }
+  function toggleSidebar() {
+    var sb = document.getElementById('dv-sidebar');
+    if (sb) sb.classList.toggle('open');
+  }
+
+  function brandEl() {
+    var el = h('button', { type: 'button', class: 'dv-brand', 'aria-label': 'Go to Overview', onclick: function () { selectItem('overview'); } }, []);
+    el.innerHTML = WORDMARK_SVG;
+    return el;
+  }
+
+  function renderTopbar() {
+    var s = state.snapshot;
+    var findings = s.report.routes.reduce(function (n, r) { return n + r.issues.length; }, 0) + s.report.siteIssues.length;
+    var kids = [
+      h('button', { type: 'button', class: 'dv-menu-toggle', 'aria-label': 'Toggle route list', onclick: toggleSidebar, text: '\u2261' }, []),
+      brandEl(),
+      h('div', { class: 'dv-meta' }, [
+        h('span', { text: 'v' + s.meta.version }, []),
+        s.meta.coreVersion ? h('span', { title: '@svelte-vitals/core version', text: 'core v' + s.meta.coreVersion }, []) : null,
+        h('span', { text: s.report.routes.length + ' routes' }, []),
+        h('span', { text: findings + ' findings' }, [])
+      ].filter(Boolean)),
+      h('div', { class: 'dv-status' }, [
+        s.live && s.analyzing ? h('span', { class: 'dv-analyzing', text: 'Analyzing\u2026' }, []) : null,
+        s.live ? h('span', { class: 'dv-conn dv-conn-' + state.connection, title: state.connection }, []) : null,
+        h('button', { type: 'button', class: 'dv-theme-toggle', 'aria-label': 'Toggle dark mode', onclick: toggleTheme, text: state.theme === 'dark' ? '\u2600' : '\u263E' }, [])
+      ].filter(Boolean))
+    ];
+    mount('dv-topbar', h('div', { class: 'dv-topbar-inner' }, kids));
+  }
+
+  function slugify(route) {
+    return 'route-' + route.replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-|-$/g, '').toLowerCase();
+  }
+
+  function matchesSearch(route, q) {
+    if (!q) return true;
+    q = q.toLowerCase();
+    if (route.route.toLowerCase().indexOf(q) !== -1) return true;
+    return route.issues.some(function (iss) {
+      return (iss.id + ' ' + iss.title + ' ' + (iss.location || '')).toLowerCase().indexOf(q) !== -1;
     });
   }
-  chips.forEach(function(c){
-    c.addEventListener('click',function(){
-      chips.forEach(function(o){o.setAttribute('aria-pressed','false');});
-      c.setAttribute('aria-pressed','true');
-      apply(c.getAttribute('data-filter')||'all');
+
+  function sortedRoutes() {
+    var s = state.snapshot;
+    var q = state.search.trim();
+    var list = s.report.routes.filter(function (r) { return matchesSearch(r, q); }).slice();
+    var sort = state.sort;
+    if (sort === 'score-asc') list.sort(function (a, b) { return a.score - b.score; });
+    else if (sort === 'score-desc') list.sort(function (a, b) { return b.score - a.score; });
+    else if (sort === 'alpha') list.sort(function (a, b) { return a.route.localeCompare(b.route); });
+    else if (sort === 'most-findings') list.sort(function (a, b) { return b.issues.length - a.issues.length; });
+    return list;
+  }
+
+  function renderNavItem(label, key, route, active) {
+    var kids = [h('span', { class: 'dv-nav-label', text: label }, [])];
+    if (route) {
+      var band = scoreBand(route.score);
+      var crit = route.issues.filter(function (i) { return i.severity === 'critical'; }).length;
+      var warn = route.issues.filter(function (i) { return i.severity === 'warning'; }).length;
+      var info = route.issues.filter(function (i) { return i.severity === 'info'; }).length;
+      var summary = [];
+      if (crit) summary.push(crit + ' critical');
+      if (warn) summary.push(warn + ' warning' + (warn > 1 ? 's' : ''));
+      if (info) summary.push(info + ' info');
+      var badge = state.snapshot.badges[route.route];
+      kids.push(h('span', { class: 'dv-nav-meta' }, [
+        badge ? h('span', { class: 'dv-badge dv-badge-' + badge, text: badge }, []) : null,
+        h('span', { class: 'dv-nav-score', style: 'color:' + BAND_COLOR[band], text: String(route.score) }, []),
+        h('span', { class: 'dv-nav-sum', text: summary.length ? summary.join(' \xB7 ') : 'no issues' }, [])
+      ].filter(Boolean)));
+    }
+    return h('div', {
+      class: 'dv-nav-item' + (active ? ' active' : ''),
+      role: 'option',
+      'aria-selected': active ? 'true' : 'false',
+      tabindex: '0',
+      onclick: function () { selectItem(key); },
+      onkeydown: function (e) { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); selectItem(key); } }
+    }, kids);
+  }
+
+  function selectItem(key) {
+    state.selected = key;
+    location.hash = key === 'overview' ? 'overview' : 'route/' + slugify(key);
+    var sb = document.getElementById('dv-sidebar');
+    if (sb) sb.classList.remove('open');
+    renderSidebar();
+    renderDetail();
+  }
+
+  function renderSidebar() {
+    var s = state.snapshot;
+    state.routeBySlug = {};
+
+    // mount() clears and rebuilds the whole sidebar, including the <input> itself, so
+    // a naive re-render on every keystroke drops focus and cursor position \u2014 capture
+    // them before rebuilding and restore them on the freshly-created input afterward.
+    var prevSearch = document.querySelector('.dv-search');
+    var hadFocus = !!prevSearch && document.activeElement === prevSearch;
+    var selStart = hadFocus ? prevSearch.selectionStart : null;
+    var selEnd = hadFocus ? prevSearch.selectionEnd : null;
+
+    var searchInput = h('input', {
+      type: 'search',
+      class: 'dv-search',
+      placeholder: 'Search routes or rules\u2026',
+      value: state.search,
+      oninput: function (e) { state.search = e.target.value; renderSidebar(); }
+    }, []);
+
+    var sortSelect = h('select', { class: 'dv-sort', 'aria-label': 'Sort routes', onchange: function (e) { state.sort = e.target.value; renderSidebar(); } }, [
+      h('option', { value: 'score-asc', selected: state.sort === 'score-asc' || undefined, text: 'Score (worst first)' }, []),
+      h('option', { value: 'score-desc', selected: state.sort === 'score-desc' || undefined, text: 'Score (best first)' }, []),
+      h('option', { value: 'alpha', selected: state.sort === 'alpha' || undefined, text: 'Alphabetical' }, []),
+      h('option', { value: 'most-findings', selected: state.sort === 'most-findings' || undefined, text: 'Most findings' }, [])
+    ]);
+
+    var items = [renderNavItem('Overview', 'overview', null, state.selected === 'overview')];
+    sortedRoutes().forEach(function (r) {
+      var slug = slugify(r.route);
+      state.routeBySlug[slug] = r.route;
+      items.push(renderNavItem(r.route, r.route, r, state.selected === r.route));
     });
-  });
+
+    var nav = h('div', { class: 'dv-nav', role: 'listbox', 'aria-label': 'Routes' }, items);
+    mount('dv-sidebar', h('div', { class: 'dv-sidebar-inner' }, [searchInput, sortSelect, nav]));
+
+    if (hadFocus) {
+      searchInput.focus();
+      if (selStart !== null && searchInput.setSelectionRange) {
+        searchInput.setSelectionRange(selStart, selEnd);
+      }
+    }
+  }
+
+  function renderFilterChips(categories) {
+    var chip = function (filter, label) {
+      return h('button', {
+        type: 'button', class: 'dv-chip', 'aria-pressed': state.filter === filter ? 'true' : 'false',
+        onclick: function () { state.filter = filter; renderDetail(); },
+        text: label
+      }, []);
+    };
+    var catChips = Object.keys(categories).map(function (cat) {
+      var name = cat === 'seo' ? 'SEO' : cat.charAt(0).toUpperCase() + cat.slice(1);
+      return chip(cat, name);
+    });
+    return h('div', { class: 'dv-filters', role: 'group', 'aria-label': 'Filter findings' },
+      [chip('all', 'All'), chip('critical', 'Critical'), chip('warning', 'Warning'), chip('info', 'Info')].concat(catChips));
+  }
+
+  function passesFilter(issue) {
+    var f = state.filter;
+    return f === 'all' || issue.severity === f || issue.category === f;
+  }
+
+  var SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+
+  function renderFinding(issue, route, promptRoute) {
+    var kids = [
+      h('div', { class: 'dv-f-head' }, [
+        h('span', { class: 'dv-ruleid', text: issue.id }, []),
+        h('span', { class: 'dv-f-title', text: issue.title }, []),
+        h('span', { class: 'dv-sev-tag dv-sev-' + issue.severity, text: issue.severity }, [])
+      ])
+    ];
+    if (route) {
+      kids.push(h('button', { type: 'button', class: 'dv-f-route', onclick: function () { selectItem(route); }, text: route }, []));
+    }
+    if (issue.location) {
+      kids.push(h('p', { class: 'dv-f-loc', text: issue.location + (issue.line !== undefined ? ':' + issue.line : '') }, []));
+    }
+    if (issue.recommendation) {
+      kids.push(h('p', { class: 'dv-f-rec', text: issue.recommendation }, []));
+    }
+    if (issue.fix && issue.fix.snippet) {
+      kids.push(h('div', { class: 'dv-fix' }, [h('div', { class: 'dv-fix-label', text: 'fix' }, []), renderFixSnippet(issue.fix)]));
+    }
+    if (issue.docsUrl) {
+      kids.push(h('a', { class: 'dv-f-link', href: issue.docsUrl, text: 'Learn more' }, []));
+    }
+    kids.push(renderAiPrompt(issue, promptRoute !== undefined ? promptRoute : route));
+    return h('article', { class: 'dv-finding dv-finding-' + issue.severity }, kids);
+  }
+
+  function renderGauge(score) {
+    var band = scoreBand(score);
+    var svgNs = 'http://www.w3.org/2000/svg';
+    var C = 2 * Math.PI * 58;
+    var offset = (C * (1 - score / 100)).toFixed(1);
+    var svg = document.createElementNS(svgNs, 'svg');
+    svg.setAttribute('width', '132');
+    svg.setAttribute('height', '132');
+    svg.setAttribute('viewBox', '0 0 132 132');
+    var bg = document.createElementNS(svgNs, 'circle');
+    bg.setAttribute('cx', '66'); bg.setAttribute('cy', '66'); bg.setAttribute('r', '58');
+    bg.setAttribute('fill', 'none'); bg.setAttribute('class', 'dv-gauge-track'); bg.setAttribute('stroke-width', '11');
+    var arc = document.createElementNS(svgNs, 'circle');
+    arc.setAttribute('cx', '66'); arc.setAttribute('cy', '66'); arc.setAttribute('r', '58');
+    arc.setAttribute('fill', 'none'); arc.setAttribute('stroke', BAND_COLOR[band]); arc.setAttribute('stroke-width', '11');
+    arc.setAttribute('stroke-linecap', 'round');
+    arc.setAttribute('stroke-dasharray', C.toFixed(1));
+    arc.setAttribute('stroke-dashoffset', offset);
+    svg.appendChild(bg);
+    svg.appendChild(arc);
+    var wrap = h('div', { class: 'dv-gauge' }, [h('div', { class: 'dv-gauge-num' }, [h('strong', { text: String(score) }, []), h('span', { text: 'Health' }, [])])]);
+    wrap.insertBefore(svg, wrap.firstChild);
+    return wrap;
+  }
+
+  function renderOverview(s) {
+    var gauge = renderGauge(s.report.score);
+    var cats = Object.keys(s.report.categories).map(function (cat) {
+      var c = s.report.categories[cat];
+      var band = scoreBand(c.score);
+      var weight = s.report.weights[cat];
+      var name = cat === 'seo' ? 'SEO' : cat.charAt(0).toUpperCase() + cat.slice(1);
+      return h('div', { class: 'dv-cat' }, [
+        h('div', { class: 'dv-cat-top' }, [
+          h('span', { text: name + (weight !== undefined ? ' (weight ' + weight + ')' : '') }, []),
+          h('span', { style: 'color:' + BAND_COLOR[band], text: String(c.score) }, [])
+        ]),
+        h('div', { class: 'dv-bar' }, [h('i', { style: 'width:' + c.score + '%;background:' + BAND_COLOR[band] }, [])])
+      ]);
+    });
+    var chips = renderFilterChips(s.report.categories);
+    var totalCount = s.report.routes.reduce(function (n, r) { return n + r.issues.length; }, 0) + s.report.siteIssues.length;
+    var entries = [];
+    s.report.routes.forEach(function (r) {
+      r.issues.forEach(function (issue) { entries.push({ issue: issue, route: r.route }); });
+    });
+    s.report.siteIssues.forEach(function (issue) { entries.push({ issue: issue, route: null }); });
+    entries = entries.filter(function (e) { return passesFilter(e.issue); });
+    entries.sort(function (a, b) {
+      var sd = SEVERITY_ORDER[a.issue.severity] - SEVERITY_ORDER[b.issue.severity];
+      if (sd !== 0) return sd;
+      return (a.route || '').localeCompare(b.route || '');
+    });
+    var body = entries.length
+      ? entries.map(function (e) { return renderFinding(e.issue, e.route); })
+      : [h('p', { class: 'dv-empty', text: totalCount ? 'No issues match the current filter.' : 'No issues found \u2014 nice work!' }, [])];
+    var findings = h('section', { class: 'dv-section' }, [h('h2', { text: 'Findings' }, [])].concat(body));
+    return h('div', { class: 'dv-overview' }, [gauge, h('div', { class: 'dv-cats' }, cats), chips, findings].filter(Boolean));
+  }
+
+  function renderRouteDetail(route) {
+    var badge = state.snapshot.badges[route.route];
+    var band = scoreBand(route.score);
+    var header = h('div', { class: 'dv-detail-header' }, [
+      h('span', { class: 'dv-route-path', text: route.route }, []),
+      badge ? h('span', { class: 'dv-badge dv-badge-' + badge, text: badge }, []) : null,
+      h('span', { class: 'dv-score-chip', style: 'color:' + BAND_COLOR[band], text: String(route.score) }, [])
+    ].filter(Boolean));
+    var chips = renderFilterChips(state.snapshot.report.categories);
+    var findings = route.issues.filter(passesFilter);
+    var body = findings.length
+      ? findings.map(function (issue) { return renderFinding(issue, undefined, route.route); })
+      : [h('p', { class: 'dv-empty', text: 'No issues match the current filter.' }, [])];
+    return h('div', { class: 'dv-route-detail' }, [header, chips].concat(body));
+  }
+
+  function renderDetail() {
+    var s = state.snapshot;
+    if (state.selected === 'overview') {
+      mount('dv-detail', renderOverview(s));
+      return;
+    }
+    var route = s.report.routes.filter(function (r) { return r.route === state.selected; })[0];
+    if (!route) {
+      state.selected = 'overview';
+      mount('dv-detail', renderOverview(s));
+      return;
+    }
+    mount('dv-detail', renderRouteDetail(route));
+  }
+
+  function renderAll() {
+    renderTopbar();
+    renderSidebar();
+    renderDetail();
+  }
+
+  function restoreSelectionFromHash() {
+    var raw = location.hash.replace(/^#/, '');
+    if (!raw || raw === 'overview') { state.selected = 'overview'; return; }
+    var m = /^route\\/(.+)$/.exec(raw);
+    if (m && state.routeBySlug[m[1]]) state.selected = state.routeBySlug[m[1]];
+  }
+
+  function fetchSnapshot() {
+    fetch('/__svelte-vitals/data.json').then(function (r) { return r.json(); }).then(function (data) {
+      if (state.snapshot && data.sequence <= state.snapshot.sequence) return;
+      state.snapshot = data;
+      renderAll();
+    }).catch(function () {});
+  }
+
+  function boot() {
+    var raw = document.getElementById('svelte-vitals-data');
+    state.snapshot = JSON.parse(raw.textContent);
+    applyTheme();
+    renderSidebar(); // populates routeBySlug before the hash can be trusted
+    restoreSelectionFromHash();
+    renderAll();
+
+    window.addEventListener('hashchange', function () {
+      restoreSelectionFromHash();
+      renderSidebar();
+      renderDetail();
+    });
+
+    // Static export (the CLI's --reporter html): no dev server behind the page, so no
+    // SSE connection, no /data.json refetch, no connection indicator.
+    if (state.snapshot.live && typeof EventSource !== 'undefined') {
+      var es = new EventSource('/__svelte-vitals/events');
+      es.addEventListener('open', function () { state.connection = 'connected'; renderTopbar(); fetchSnapshot(); });
+      es.addEventListener('update', fetchSnapshot);
+      es.addEventListener('error', function () { state.connection = 'reconnecting'; renderTopbar(); });
+    }
+  }
+
+  boot();
 })();
 `;
+function renderAppShell(snapshot) {
+  const safe = { ...snapshot, report: sanitizeReport(snapshot.report) };
+  const title = snapshot.live ? "svelte-vitals dashboard" : "svelte-vitals report";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title><style>${APP_STYLE}</style></head><body><div class="dv-app" id="dv-app"><header class="dv-topbar" id="dv-topbar"></header><nav class="dv-sidebar" id="dv-sidebar"></nav><main class="dv-detail" id="dv-detail"></main></div><script type="application/json" id="svelte-vitals-data">${embedJson(safe)}</script><script>${APP_SCRIPT}</script></body></html>`;
+}
 function buildHtmlDocument(report, meta, opts) {
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>svelte-vitals report</title><style>${STYLE}</style></head><body><div class="wrap">` + renderTopbar(report, meta) + renderHero(report) + renderFilters(report) + renderRoutes(report, opts?.routeBadges) + renderSiteChecks(report) + `<footer class="foot"><span>Generated by svelte-vitals \xB7 static analysis, no browser</span><span>oekazuma.github.io/svelte-vitals</span></footer></div><script>${SCRIPT}</script></body></html>`;
+  const badges = Object.fromEntries(
+    Object.entries(opts?.routeBadges ?? {}).filter(([, b]) => b === "measured" || b === "static")
+  );
+  return renderAppShell({
+    report,
+    badges,
+    analyzing: false,
+    sequence: 0,
+    live: false,
+    meta
+  });
 }
 function formatHtmlReport(results, config, meta) {
   return buildHtmlDocument(buildJsonReport(results, config, meta), meta);
 }
 
+// src/reporter/html.ts
+var BAND_COLOR = {
+  good: "#2FA968",
+  warn: "#E8A317",
+  poor: "#E5484D"
+};
+function scoreBand(score) {
+  return score >= 90 ? "good" : score >= 50 ? "warn" : "poor";
+}
+function escapeHtml(s) {
+  return s.replace(
+    /[&<>"']/g,
+    (c) => c === "&" ? "&amp;" : c === "<" ? "&lt;" : c === ">" ? "&gt;" : c === '"' ? "&quot;" : "&#39;"
+  );
+}
+function safeHref(url) {
+  const normalized = url.replace(/\s/g, "").toLowerCase();
+  return /^https?:\/\//.test(normalized) ? url : null;
+}
+
 // src/config-apply.ts
 function selectRules(rules, config) {
   return rules.filter((rule) => config.rules[rule.id] !== "off");
@@ -2998,6 +4576,8 @@ function applyRuleSeverities(results, config) {
   });
 }
 export {
+  APP_SCRIPT,
+  APP_STYLE,
   BAND_COLOR,
   CHILD_NODE_KEYS,
   ROBOTS_SOURCE_PATHS,
@@ -3014,6 +4594,7 @@ export {
   buildJsonReport,
   classify,
   collectComponentFacts,
+  collectKitModuleFacts,
   computeHealth,
   computeScore,
   correct001EachKey,
@@ -3021,12 +4602,17 @@ export {
   correct003EffectAsOnMount,
   correct004UnmutatedState,
   correct005PropMutation,
+  correct006OrphanEffect,
+  correct007OrphanLifecycle,
+  correct008BrowserGlobals,
+  correct009InstanceBrowserGlobals,
   defaultConfig,
   defaultProject,
   defineConfig,
   docsUrlFor,
   effectiveSeverity,
   emptyComponentFacts,
+  emptyKitModuleFacts,
   escapeHtml,
   explainRule,
   findAttr,
@@ -3045,6 +4631,7 @@ export {
   linkRule,
   noColorPalette,
   parseComponentFacts,
+  parseKitModuleFacts,
   perf001ImageDimensions,
   perf002ImageLoading,
   perf003PreloadAs,
@@ -3055,6 +4642,8 @@ export {
   perf008Preconnect,
   perf009HeavyImport,
   perf010NamespaceImport,
+  renderAppShell,
+  resolveRunesModuleSpecifier,
   runRules,
   safeHref,
   scoreBand,
@@ -3062,6 +4651,9 @@ export {
   scoresByCategory,
   sec001Html,
   sec002JavascriptUrl,
+  sec003LoadStateWrite,
+  sec004ServerModuleState,
+  sec005SharedStateImport,
   selectRules,
   seo001Title,
   seo002Description,