@svelte-vitals/core 0.25.0 → 0.27.0

package/dist/index.js

@@ -103,6 +103,7 @@ function collectEachBlocks(node, source, acc) {
     if (key in node) collectEachBlocks(node[key], source, acc);
   }
 }
+var WALK_IGNORED_KEYS = /* @__PURE__ */ new Set(["type", "start", "end", "loc", "range"]);
 function walkEstree(node, visit) {
   if (Array.isArray(node)) {
     for (const child of node) walkEstree(child, visit);
@@ -111,7 +112,7 @@ function walkEstree(node, visit) {
   if (!node || typeof node !== "object" || typeof node.type !== "string") return;
   visit(node);
   for (const key of Object.keys(node)) {
-    if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
+    if (WALK_IGNORED_KEYS.has(key)) continue;
     walkEstree(node[key], visit);
   }
 }
@@ -123,6 +124,10 @@ function isEffectCall(node) {
   }
   return false;
 }
+function isEffectRootCall(node) {
+  const c = node?.callee;
+  return c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$effect" && c.property?.type === "Identifier" && c.property.name === "root";
+}
 function isStateDeclaration(node) {
   const c = node?.callee;
   if (c?.type === "Identifier") return c.name === "$state";
@@ -207,7 +212,7 @@ function walkScoped(node, visit, shadowed = /* @__PURE__ */ new Set()) {
   const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
   visit(node, scope);
   for (const key of Object.keys(node)) {
-    if (key === "type" || key === "start" || key === "end" || key === "loc" || key === "range") continue;
+    if (WALK_IGNORED_KEYS.has(key)) continue;
     walkScoped(node[key], visit, scope);
   }
 }
@@ -270,7 +275,6 @@ function collectTemplateEscapes(node, stateNames, acc) {
 var RUNE_NAMES = /* @__PURE__ */ new Set(["$state", "$derived", "$effect", "$props", "$bindable", "$inspect", "$host"]);
 function bodyReadsReactive(fn, reactiveNames) {
   let reads = false;
-  const IGNORED_KEYS = /* @__PURE__ */ new Set(["type", "start", "end", "loc", "range"]);
   const visit = (n) => {
     if (reads || !n) return;
     if (Array.isArray(n)) {
@@ -297,7 +301,7 @@ function bodyReadsReactive(fn, reactiveNames) {
       return;
     }
     for (const key of Object.keys(n)) {
-      if (!IGNORED_KEYS.has(key)) visit(n[key]);
+      if (!WALK_IGNORED_KEYS.has(key)) visit(n[key]);
     }
   };
   visit(fn.body);
@@ -452,7 +456,366 @@ function collectSuppressions(source) {
   });
   return out;
 }
+var EVAL_SCOPE_BOUNDARIES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression",
+  "ClassDeclaration",
+  "ClassExpression"
+]);
+function walkEvalScope(node, visit, shadowed = /* @__PURE__ */ new Set()) {
+  if (Array.isArray(node)) {
+    for (const child of node) walkEvalScope(child, visit, shadowed);
+    return;
+  }
+  if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+  const introduced = scopeIntroducedNames(node);
+  const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+  if (visit(node, scope)) return;
+  if (EVAL_SCOPE_BOUNDARIES.has(node.type)) return;
+  for (const key of Object.keys(node)) {
+    if (WALK_IGNORED_KEYS.has(key)) continue;
+    walkEvalScope(node[key], visit, scope);
+  }
+}
+function collectEvalScopeCalls(root, source, matcher, skipSubtree, initialShadowed) {
+  const out = [];
+  walkEvalScope(
+    root,
+    (n, shadowed) => {
+      if (n.type !== "CallExpression") return void 0;
+      if (skipSubtree?.(n)) return true;
+      const name = matcher(n, shadowed);
+      if (name) out.push({ name, line: lineOf(source, n.start) });
+      return void 0;
+    },
+    initialShadowed
+  );
+  return out;
+}
+function unwrapExport(stmt) {
+  if (stmt.type === "ExportNamedDeclaration") return stmt.declaration ?? stmt;
+  if (stmt.type === "ExportDefaultDeclaration") return stmt.declaration;
+  return stmt;
+}
+function collectOrphanCalls(program, source, matcher, skipSubtree) {
+  const out = collectEvalScopeCalls(program, source, matcher, skipSubtree).map((c) => ({ ...c, kind: "top-level" }));
+  const body = program.body ?? [];
+  const matchingClasses = /* @__PURE__ */ new Map();
+  for (const stmt of body) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "ClassDeclaration" || decl.id?.type !== "Identifier") continue;
+    const ctor = (decl.body?.body ?? []).find(
+      (m) => m?.type === "MethodDefinition" && m.kind === "constructor" && m.value?.body
+    );
+    if (!ctor) continue;
+    const ctorShadow = /* @__PURE__ */ new Set();
+    for (const p of ctor.value.params ?? []) addBoundNames(p, ctorShadow);
+    const calls = collectEvalScopeCalls(ctor.value.body, source, matcher, skipSubtree, ctorShadow);
+    if (calls.length > 0) matchingClasses.set(decl.id.name, calls[0].name);
+  }
+  if (matchingClasses.size > 0) {
+    for (const stmt of body) {
+      const decl = unwrapExport(stmt);
+      const isCandidate = decl?.type === "VariableDeclaration" || decl?.type === "ExpressionStatement" || stmt.type === "ExportDefaultDeclaration" && decl?.type !== "FunctionDeclaration" && decl?.type !== "ClassDeclaration";
+      if (!isCandidate) continue;
+      walkEvalScope(decl, (n) => {
+        if (n.type === "NewExpression" && n.callee?.type === "Identifier" && matchingClasses.has(n.callee.name)) {
+          out.push({
+            name: matchingClasses.get(n.callee.name),
+            line: lineOf(source, n.start),
+            kind: "constructor-instantiated",
+            className: n.callee.name
+          });
+        }
+        return void 0;
+      });
+    }
+  }
+  return out.sort((a, b) => a.line - b.line);
+}
+function collectOrphanEffects(program, source) {
+  return collectOrphanCalls(program, source, (n) => isEffectCall(n) ? "$effect" : void 0, isEffectRootCall).map(
+    ({ line, kind, className }) => ({ line, kind, ...className !== void 0 ? { className } : {} })
+  );
+}
+var LIFECYCLE_NAMES = /* @__PURE__ */ new Set([
+  "onMount",
+  "onDestroy",
+  "beforeUpdate",
+  "afterUpdate",
+  "createEventDispatcher",
+  "getContext",
+  "setContext",
+  "hasContext",
+  "getAllContexts"
+]);
+function collectSvelteLifecycleImports(program) {
+  const locals = /* @__PURE__ */ new Map();
+  const namespaces = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== "svelte") continue;
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && LIFECYCLE_NAMES.has(s.imported.name)) {
+        locals.set(s.local.name, s.imported.name);
+      } else if (s.type === "ImportNamespaceSpecifier") {
+        namespaces.add(s.local.name);
+      }
+    }
+  }
+  return { locals, namespaces };
+}
+function matchLifecycleCall(n, imports) {
+  const c = n?.callee;
+  if (c?.type === "Identifier") {
+    const canonical = imports.locals.get(c.name);
+    return canonical ? { canonical, local: c.name } : void 0;
+  }
+  if (c?.type === "MemberExpression" && !c.computed && c.object?.type === "Identifier" && imports.namespaces.has(c.object.name) && c.property?.type === "Identifier" && LIFECYCLE_NAMES.has(c.property.name)) {
+    return { canonical: c.property.name, local: c.object.name };
+  }
+  return void 0;
+}
+function collectOrphanLifecycleCalls(program, source) {
+  const imports = collectSvelteLifecycleImports(program);
+  if (imports.locals.size === 0 && imports.namespaces.size === 0) return [];
+  return collectOrphanCalls(program, source, (n, shadowed) => {
+    const m = matchLifecycleCall(n, imports);
+    return m && !shadowed.has(m.local) ? m.canonical : void 0;
+  });
+}
+var BROWSER_GLOBALS = /* @__PURE__ */ new Set([
+  "window",
+  "document",
+  "localStorage",
+  "sessionStorage",
+  "navigator",
+  "location",
+  "history",
+  "screen",
+  "matchMedia",
+  "requestAnimationFrame",
+  "cancelAnimationFrame",
+  "IntersectionObserver",
+  "ResizeObserver",
+  "MutationObserver",
+  "alert",
+  "confirm",
+  "prompt"
+]);
+function collectBrowserGuardImports(program) {
+  const out = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== "$app/environment")
+      continue;
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && s.imported.name === "browser") {
+        out.add(s.local.name);
+      }
+    }
+  }
+  return out;
+}
+function collectProgramBindings(program) {
+  const bound = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type === "ImportDeclaration") {
+      for (const s of stmt.specifiers ?? []) if (s?.local?.type === "Identifier") bound.add(s.local.name);
+      continue;
+    }
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) addBoundNames(d?.id, bound);
+    } else if ((decl?.type === "FunctionDeclaration" || decl?.type === "ClassDeclaration") && decl.id?.type === "Identifier") {
+      bound.add(decl.id.name);
+    }
+  }
+  return bound;
+}
+function guardTerminates(consequent) {
+  if (!consequent) return false;
+  if (consequent.type === "ReturnStatement" || consequent.type === "ThrowStatement") return true;
+  if (consequent.type === "BlockStatement") {
+    const last = (consequent.body ?? [])[consequent.body.length - 1];
+    return last?.type === "ReturnStatement" || last?.type === "ThrowStatement";
+  }
+  return false;
+}
+function isBrowserGuardTest(test, guardBindings) {
+  let guarded = false;
+  walkEstree(test, (n) => {
+    if (n.type === "Identifier" && guardBindings.has(n.name)) guarded = true;
+    if (n.type === "BinaryExpression" && ["===", "!==", "==", "!="].includes(n.operator)) {
+      const sides = [n.left, n.right];
+      const hasTypeofGlobal = sides.some(
+        (s) => s?.type === "UnaryExpression" && s.operator === "typeof" && s.argument?.type === "Identifier" && BROWSER_GLOBALS.has(s.argument.name)
+      );
+      const hasUndefinedString = sides.some((s) => s?.type === "Literal" && s.value === "undefined");
+      if (hasTypeofGlobal && hasUndefinedString) guarded = true;
+    }
+  });
+  return guarded;
+}
+function collectDerivedGuardBindings(program, guards) {
+  const derived = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "VariableDeclaration" || decl.kind !== "const" && decl.kind !== "let") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type === "Identifier" && d.init && isBrowserGuardTest(d.init, guards)) {
+        derived.add(d.id.name);
+      }
+    }
+  }
+  return derived;
+}
+function collectBrowserGlobalRefs(program, source, extra) {
+  const out = [];
+  const bound = /* @__PURE__ */ new Set([...collectProgramBindings(program), ...extra?.bound ?? []]);
+  const guards = /* @__PURE__ */ new Set([...collectBrowserGuardImports(program), ...extra?.guards ?? []]);
+  for (const name of collectDerivedGuardBindings(program, guards)) guards.add(name);
+  const visit = (n, shadowed) => {
+    if (!n) return;
+    if (Array.isArray(n)) {
+      for (const c of n) visit(c, shadowed);
+      return;
+    }
+    if (typeof n !== "object" || typeof n.type !== "string") return;
+    if (EVAL_SCOPE_BOUNDARIES.has(n.type)) return;
+    if ((n.type === "IfStatement" || n.type === "ConditionalExpression") && isBrowserGuardTest(n.test, guards)) return;
+    if (n.type === "LogicalExpression" && isBrowserGuardTest(n.left, guards)) return;
+    const introduced = scopeIntroducedNames(n);
+    const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+    switch (n.type) {
+      case "Identifier":
+        if (BROWSER_GLOBALS.has(n.name) && !bound.has(n.name) && !scope.has(n.name)) {
+          out.push({ name: n.name, line: lineOf(source, n.start) });
+        }
+        return;
+      case "UnaryExpression":
+        if (n.operator === "typeof" && n.argument?.type === "Identifier") return;
+        break;
+      case "MemberExpression":
+        visit(n.object, scope);
+        if (n.computed) visit(n.property, scope);
+        return;
+      case "Property":
+        if (n.computed) visit(n.key, scope);
+        visit(n.value, scope);
+        return;
+      case "VariableDeclarator":
+        visit(n.init, scope);
+        return;
+      case "LabeledStatement":
+        visit(n.body, scope);
+        return;
+      case "BreakStatement":
+      case "ContinueStatement":
+      case "ImportDeclaration":
+      case "ExportAllDeclaration":
+        return;
+      case "ExportNamedDeclaration":
+        if (!n.declaration) return;
+        break;
+      case "BlockStatement":
+      case "Program":
+        for (const stmt of n.body ?? []) {
+          visit(stmt, scope);
+          if (stmt?.type === "IfStatement" && isBrowserGuardTest(stmt.test, guards) && guardTerminates(stmt.consequent)) {
+            break;
+          }
+        }
+        return;
+      default:
+        if (n.type.startsWith("TS")) {
+          if (n.type === "TSAsExpression" || n.type === "TSSatisfiesExpression" || n.type === "TSNonNullExpression" || n.type === "TSInstantiationExpression") {
+            visit(n.expression, scope);
+          }
+          return;
+        }
+    }
+    for (const key of Object.keys(n)) {
+      if (WALK_IGNORED_KEYS.has(key)) continue;
+      visit(n[key], scope);
+    }
+  };
+  visit(program, /* @__PURE__ */ new Set());
+  return out;
+}
+var MODULE_FILE_RE = /\.svelte\.(ts|js)$/;
+function parseModuleProgram(source, filename) {
+  const neutralized = source.replace(/<\/script/gi, "<_script");
+  const wrapped = `<script lang="ts">
+${neutralized}
+</script>`;
+  const ast = parse(wrapped, { modern: true, filename });
+  return { program: ast.instance?.content, wrapped };
+}
+function collectModuleStateDecls(program, source) {
+  const out = [];
+  const body = program.body ?? [];
+  const statefulClasses = /* @__PURE__ */ new Set();
+  for (const stmt of body) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) {
+        if (d?.id?.type === "Identifier" && d.init && isStateDeclaration(d.init)) {
+          out.push({ name: d.id.name, line: lineOf(source, d.start) });
+        }
+      }
+    } else if (decl?.type === "ClassDeclaration" && decl.id?.type === "Identifier") {
+      const hasStateField = (decl.body?.body ?? []).some(
+        (m) => m?.type === "PropertyDefinition" && m.value && isStateDeclaration(m.value)
+      );
+      if (hasStateField) statefulClasses.add(decl.id.name);
+    }
+  }
+  if (statefulClasses.size > 0) {
+    for (const stmt of body) {
+      const decl = unwrapExport(stmt);
+      if (decl?.type !== "VariableDeclaration") continue;
+      for (const d of decl.declarations ?? []) {
+        if (d?.init?.type === "NewExpression" && d.init.callee?.type === "Identifier" && statefulClasses.has(d.init.callee.name)) {
+          out.push({
+            name: d.id?.type === "Identifier" ? d.id.name : d.init.callee.name,
+            line: lineOf(source, d.start)
+          });
+        }
+      }
+    }
+  }
+  return out.sort((a, b) => a.line - b.line);
+}
+function parseModuleFacts(source, filename) {
+  const { program, wrapped } = parseModuleProgram(source, filename);
+  const shift = (line) => Math.max(0, line - 1);
+  const orphanEffects = program ? collectOrphanEffects(program, wrapped).map((f) => ({ ...f, line: shift(f.line) })) : [];
+  const orphanLifecycleCalls = program ? collectOrphanLifecycleCalls(program, wrapped).map((f) => ({ ...f, line: shift(f.line) })) : [];
+  const browserGlobalRefs = program ? collectBrowserGlobalRefs(program, wrapped).map((r) => ({ ...r, line: shift(r.line), context: "module" })) : [];
+  const moduleStateDecls = program ? collectModuleStateDecls(program, wrapped).map((d) => ({ ...d, line: shift(d.line) })) : [];
+  return {
+    eachBlocks: [],
+    effects: [],
+    htmlTags: [],
+    javascriptUrls: [],
+    loc: 0,
+    propCount: 0,
+    imports: [],
+    importSpans: [],
+    namespaceImports: [],
+    constableStates: [],
+    mutatedProps: [],
+    suppressions: collectSuppressions(source),
+    orphanEffects,
+    orphanLifecycleCalls,
+    browserGlobalRefs,
+    moduleStateDecls
+  };
+}
 function parseComponentFacts(source, filename) {
+  if (MODULE_FILE_RE.test(filename)) return parseModuleFacts(source, filename);
   const ast = parse(source, { modern: true, filename });
   const eachBlocks = [];
   collectEachBlocks(ast.fragment ?? ast, source, eachBlocks);
@@ -461,11 +824,20 @@ function parseComponentFacts(source, filename) {
   collectSecurityFacts(ast.fragment ?? ast, source, htmlTags, javascriptUrls);
   const loc = countLines(source);
   const suppressions = collectSuppressions(source);
+  const moduleProgram = ast.module?.content;
   const importSpans = [];
   const namespaceImports = [];
-  if (ast.module?.content) {
-    collectImportSources(ast.module.content, source, importSpans);
-    collectNamespaceImports(ast.module.content, source, namespaceImports);
+  if (moduleProgram) {
+    collectImportSources(moduleProgram, source, importSpans);
+    collectNamespaceImports(moduleProgram, source, namespaceImports);
+  }
+  const orphanEffects = moduleProgram ? collectOrphanEffects(moduleProgram, source) : [];
+  const orphanLifecycleCalls = moduleProgram ? collectOrphanLifecycleCalls(moduleProgram, source) : [];
+  const browserGlobalRefs = [];
+  if (moduleProgram) {
+    for (const r of collectBrowserGlobalRefs(moduleProgram, source)) {
+      browserGlobalRefs.push({ ...r, context: "module" });
+    }
   }
   const effects = [];
   const constableStates = [];
@@ -510,6 +882,17 @@ function parseComponentFacts(source, filename) {
     for (const d of stateDecls) {
       if (!writtenOrEscaped.has(d.name)) constableStates.push(d);
     }
+    let moduleExtra;
+    if (moduleProgram) {
+      const moduleBrowserImports = collectBrowserGuardImports(moduleProgram);
+      moduleExtra = {
+        guards: /* @__PURE__ */ new Set([...moduleBrowserImports, ...collectDerivedGuardBindings(moduleProgram, moduleBrowserImports)]),
+        bound: collectProgramBindings(moduleProgram)
+      };
+    }
+    for (const r of collectBrowserGlobalRefs(program, source, moduleExtra)) {
+      browserGlobalRefs.push({ ...r, context: "instance" });
+    }
   }
   const imports = importSpans.map((s) => s.source);
   return {
@@ -524,6 +907,10 @@ function parseComponentFacts(source, filename) {
     namespaceImports,
     constableStates,
     mutatedProps,
+    orphanEffects,
+    orphanLifecycleCalls,
+    browserGlobalRefs,
+    moduleStateDecls: [],
     suppressions
   };
 }
@@ -543,11 +930,15 @@ function emptyComponentFacts(file) {
     namespaceImports: [],
     constableStates: [],
     mutatedProps: [],
+    orphanEffects: [],
+    orphanLifecycleCalls: [],
+    browserGlobalRefs: [],
+    moduleStateDecls: [],
     suppressions: []
   };
 }
 async function collectComponentFacts(rt, cwd) {
-  const files = await rt.glob("src/**/*.svelte", cwd);
+  const files = await rt.glob("src/**/*.svelte{,.ts,.js}", cwd);
   return Promise.all(
     files.sort().map(async (rel) => {
       try {
@@ -560,6 +951,386 @@ async function collectComponentFacts(rt, cwd) {
   );
 }
 
+// src/kit-module-parse.ts
+var HANDLER_NAMES = /* @__PURE__ */ new Set([
+  "load",
+  "handle",
+  "handleFetch",
+  "handleError",
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "fallback"
+]);
+function unwrapTs(expr) {
+  let cur = expr;
+  while (cur?.type === "TSSatisfiesExpression" || cur?.type === "TSAsExpression") cur = cur.expression;
+  return cur;
+}
+function isFunctionNode(n) {
+  return n?.type === "FunctionDeclaration" || n?.type === "FunctionExpression" || n?.type === "ArrowFunctionExpression";
+}
+function collectTopLevelBindings(program) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "FunctionDeclaration" && decl.id?.type === "Identifier") {
+      bindings.set(decl.id.name, decl);
+    } else if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations ?? []) {
+        if (d?.id?.type === "Identifier" && d.init) bindings.set(d.id.name, unwrapTs(d.init));
+      }
+    }
+  }
+  return bindings;
+}
+function addActionsMembers(obj, handlers) {
+  for (const p of obj.properties ?? []) {
+    if (p?.type !== "Property") continue;
+    const v = unwrapTs(p.value);
+    if (isFunctionNode(v)) handlers.add(v);
+  }
+}
+function resolveAliasHandlerExports(program, bindings, handlers) {
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      const exportedName = s.exported.name;
+      const resolved = bindings.get(s.local.name);
+      if (HANDLER_NAMES.has(exportedName) && isFunctionNode(resolved)) {
+        handlers.add(resolved);
+      } else if (exportedName === "actions" && resolved?.type === "ObjectExpression") {
+        addActionsMembers(resolved, handlers);
+      }
+    }
+  }
+}
+function resolveAliasStartupExports(program, bindings, startup) {
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      if (s.exported.name !== "init") continue;
+      const resolved = bindings.get(s.local.name);
+      if (isFunctionNode(resolved)) startup.add(resolved);
+    }
+  }
+}
+function collectHandlerFunctions(program) {
+  const handlers = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.declaration) continue;
+    const decl = stmt.declaration;
+    if (decl.type === "FunctionDeclaration" && decl.id?.type === "Identifier" && HANDLER_NAMES.has(decl.id.name)) {
+      handlers.add(decl);
+      continue;
+    }
+    if (decl.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type !== "Identifier" || !d.init) continue;
+      const init = unwrapTs(d.init);
+      if (HANDLER_NAMES.has(d.id.name) && isFunctionNode(init)) {
+        handlers.add(init);
+      } else if (d.id.name === "actions" && init?.type === "ObjectExpression") {
+        addActionsMembers(init, handlers);
+      }
+    }
+  }
+  resolveAliasHandlerExports(program, collectTopLevelBindings(program), handlers);
+  return handlers;
+}
+function collectStartupFunctions(program) {
+  const startup = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.declaration) continue;
+    const decl = stmt.declaration;
+    if (decl.type === "FunctionDeclaration" && decl.id?.type === "Identifier" && decl.id.name === "init") {
+      startup.add(decl);
+      continue;
+    }
+    if (decl.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type !== "Identifier" || !d.init) continue;
+      const init = unwrapTs(d.init);
+      if (d.id.name === "init" && isFunctionNode(init)) startup.add(init);
+    }
+  }
+  resolveAliasStartupExports(program, collectTopLevelBindings(program), startup);
+  return startup;
+}
+function hasSsrFalseOptOut(program) {
+  const isFalse = (init) => {
+    const v = unwrapTs(init);
+    return v?.type === "Literal" && v.value === false;
+  };
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations ?? []) {
+      if (d?.id?.type === "Identifier" && d.id.name === "ssr" && d.init && isFalse(d.init)) {
+        if (stmt.type === "ExportNamedDeclaration") return true;
+      }
+    }
+  }
+  const bindings = collectTopLevelBindings(program);
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ExportNamedDeclaration" || !stmt.specifiers || stmt.source || stmt.exportKind === "type")
+      continue;
+    for (const s of stmt.specifiers) {
+      if (s?.exportKind === "type" || s?.exported?.type !== "Identifier" || s?.local?.type !== "Identifier") continue;
+      if (s.exported.name !== "ssr") continue;
+      const resolved = bindings.get(s.local.name);
+      if (resolved?.type === "Literal" && resolved.value === false) return true;
+    }
+  }
+  return false;
+}
+function walkKit(node, handlerFns, startupFns, visit, shadowed = /* @__PURE__ */ new Set(), inFunction = false, inHandler = false, inStartup = false) {
+  if (Array.isArray(node)) {
+    for (const child of node) walkKit(child, handlerFns, startupFns, visit, shadowed, inFunction, inHandler, inStartup);
+    return;
+  }
+  if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+  const introduced = scopeIntroducedNames(node);
+  const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+  const isBoundary = isFunctionNode(node) || node.type === "ClassDeclaration" || node.type === "ClassExpression";
+  const nextInFunction = inFunction || isBoundary;
+  const nextInHandler = inHandler || handlerFns.has(node);
+  const nextInStartup = inStartup || startupFns.has(node);
+  visit(node, scope, inFunction, inHandler, inStartup);
+  for (const key of Object.keys(node)) {
+    if (WALK_IGNORED_KEYS.has(key)) continue;
+    walkKit(node[key], handlerFns, startupFns, visit, scope, nextInFunction, nextInHandler, nextInStartup);
+  }
+}
+function normalizePosix(path) {
+  const out = [];
+  for (const seg of path.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (out.length === 0) return void 0;
+      out.pop();
+    } else out.push(seg);
+  }
+  return out.join("/");
+}
+function resolveRepoLocalPath(spec, importerFile) {
+  let path;
+  if (spec.startsWith("$lib/")) path = `src/lib/${spec.slice("$lib/".length)}`;
+  else if (spec.startsWith("./") || spec.startsWith("../")) {
+    const dir = importerFile.split("/").slice(0, -1).join("/");
+    path = `${dir}/${spec}`;
+  } else return void 0;
+  return normalizePosix(path);
+}
+function resolveRunesModuleSpecifier(spec, importerFile) {
+  const path = resolveRepoLocalPath(spec, importerFile);
+  if (path === void 0) return void 0;
+  if (/\.svelte\.(ts|js)$/.test(path)) return path;
+  if (path.endsWith(".svelte")) return `${path}.ts`;
+  return void 0;
+}
+function isLocalStateSpecifier(spec, importerFile) {
+  const path = resolveRepoLocalPath(spec, importerFile);
+  if (path === void 0) return false;
+  return path !== "src/lib/server" && !path.startsWith("src/lib/server/");
+}
+function parseKitModuleFacts(source, filename) {
+  const suppressions = collectSuppressions(source);
+  const { program, wrapped } = parseModuleProgram(source, filename);
+  const moduleStateReassignments = [];
+  const importedStateWrites = [];
+  const importedStateWritesOutsideHandlers = [];
+  const runesModuleImports = [];
+  const lifecycleCalls = [];
+  const browserGlobalRefs = [];
+  if (!program) {
+    return {
+      moduleStateReassignments,
+      importedStateWrites,
+      importedStateWritesOutsideHandlers,
+      runesModuleImports,
+      lifecycleCalls,
+      browserGlobalRefs,
+      suppressions
+    };
+  }
+  const line = (start) => Math.max(0, lineOf(wrapped, start) - 1);
+  const importedSpecifiers = /* @__PURE__ */ new Map();
+  for (const stmt of program.body ?? []) {
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type") continue;
+    const spec = typeof stmt.source?.value === "string" ? stmt.source.value : "";
+    const names = [];
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+      names.push(s.local.name);
+      importedSpecifiers.set(s.local.name, spec);
+    }
+    if (names.length === 0) continue;
+    const resolved = resolveRunesModuleSpecifier(spec, filename);
+    if (resolved) runesModuleImports.push({ source: spec, resolved, names, line: line(stmt.start) });
+  }
+  const moduleLets = /* @__PURE__ */ new Set();
+  for (const stmt of program.body ?? []) {
+    const decl = unwrapExport(stmt);
+    if (decl?.type === "VariableDeclaration" && (decl.kind === "let" || decl.kind === "var")) {
+      for (const d of decl.declarations ?? []) addBoundNames(d?.id, moduleLets);
+    }
+  }
+  const handlerFns = collectHandlerFunctions(program);
+  const startupFns = collectStartupFunctions(program);
+  const svelteImports = collectSvelteLifecycleImports(program);
+  if (!hasSsrFalseOptOut(program)) {
+    const shiftLine = (l) => Math.max(0, l - 1);
+    const browserImports = collectBrowserGuardImports(program);
+    const guards = /* @__PURE__ */ new Set([...browserImports, ...collectDerivedGuardBindings(program, browserImports)]);
+    const bound = collectProgramBindings(program);
+    for (const r of collectBrowserGlobalRefs(program, wrapped, { guards, bound })) {
+      browserGlobalRefs.push({ name: r.name, line: shiftLine(r.line), inHandler: false });
+    }
+    const scanFn = (fn, inHandler) => {
+      if (!fn?.body) return;
+      const params = /* @__PURE__ */ new Set();
+      for (const p of fn.params ?? []) addBoundNames(p, params);
+      for (const r of collectBrowserGlobalRefs(fn.body, wrapped, { guards, bound: /* @__PURE__ */ new Set([...bound, ...params]) })) {
+        browserGlobalRefs.push({ name: r.name, line: shiftLine(r.line), inHandler });
+      }
+    };
+    for (const fn of handlerFns) scanFn(fn, true);
+    for (const fn of startupFns) {
+      if (handlerFns.has(fn)) continue;
+      scanFn(fn, false);
+    }
+  }
+  walkKit(program, handlerFns, startupFns, (n, shadowed, inFunction, inHandler, inStartup) => {
+    if (inFunction && !inStartup) {
+      const flagLet = (name) => {
+        if (name && !shadowed.has(name) && moduleLets.has(name)) {
+          moduleStateReassignments.push({ name, line: line(n.start), inHandler });
+        }
+      };
+      if (n.type === "AssignmentExpression") {
+        if (n.left?.type === "Identifier") flagLet(n.left.name);
+        else if (n.left?.type === "ObjectPattern" || n.left?.type === "ArrayPattern") {
+          const bound = /* @__PURE__ */ new Set();
+          addBoundNames(n.left, bound);
+          for (const b of bound) flagLet(b);
+        }
+      } else if (n.type === "UpdateExpression" && n.argument?.type === "Identifier") {
+        flagLet(n.argument.name);
+      }
+    }
+    let write;
+    const importedRoot = (expr) => {
+      const r = rootObjectName(expr);
+      return r && !shadowed.has(r) && importedSpecifiers.has(r) ? r : void 0;
+    };
+    if (n.type === "AssignmentExpression" && n.left?.type === "MemberExpression") {
+      const r = importedRoot(n.left);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "UpdateExpression" && n.argument?.type === "MemberExpression") {
+      const r = importedRoot(n.argument);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "UnaryExpression" && n.operator === "delete") {
+      const r = importedRoot(n.argument);
+      if (r) write = { name: r, via: "assignment" };
+    } else if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
+      const method = n.callee.property?.type === "Identifier" ? n.callee.property.name : void 0;
+      if (method === "set" || method === "update") {
+        const r = importedRoot(n.callee.object);
+        if (r && isLocalStateSpecifier(importedSpecifiers.get(r), filename)) write = { name: r, via: "set-call" };
+      }
+    } else if (n.type === "AssignmentExpression" && (n.left?.type === "ObjectPattern" || n.left?.type === "ArrayPattern")) {
+      const scanPatternTargets = (pat) => {
+        if (!pat || write) return;
+        if (pat.type === "MemberExpression") {
+          const r = importedRoot(pat);
+          if (r) write = { name: r, via: "assignment" };
+        } else if (pat.type === "ObjectPattern") {
+          for (const p of pat.properties ?? []) {
+            if (p?.type === "Property") scanPatternTargets(p.value);
+            else if (p?.type === "RestElement") scanPatternTargets(p.argument);
+          }
+        } else if (pat.type === "ArrayPattern") {
+          for (const el of pat.elements ?? []) scanPatternTargets(el);
+        } else if (pat.type === "AssignmentPattern") {
+          scanPatternTargets(pat.left);
+        } else if (pat.type === "RestElement") {
+          scanPatternTargets(pat.argument);
+        }
+      };
+      scanPatternTargets(n.left);
+    }
+    if (write) {
+      if (inHandler) importedStateWrites.push({ ...write, line: line(n.start) });
+      else importedStateWritesOutsideHandlers.push({ name: write.name, line: line(n.start) });
+    }
+    if (n.type === "CallExpression" && (!inFunction || inHandler || inStartup)) {
+      const m = matchLifecycleCall(n, svelteImports);
+      if (m && !shadowed.has(m.local)) {
+        lifecycleCalls.push({ name: m.canonical, line: line(n.start), inHandler });
+      }
+    }
+  });
+  const byLine = (arr) => arr.sort((a, b) => a.line - b.line);
+  return {
+    moduleStateReassignments: byLine(moduleStateReassignments),
+    importedStateWrites: byLine(importedStateWrites),
+    importedStateWritesOutsideHandlers: byLine(importedStateWritesOutsideHandlers),
+    runesModuleImports: byLine(runesModuleImports),
+    lifecycleCalls: byLine(lifecycleCalls),
+    browserGlobalRefs: byLine(browserGlobalRefs),
+    suppressions
+  };
+}
+
+// src/kit-module-collect.ts
+function emptyKitModuleFacts(file, kind) {
+  return {
+    file,
+    kind,
+    moduleStateReassignments: [],
+    importedStateWrites: [],
+    importedStateWritesOutsideHandlers: [],
+    runesModuleImports: [],
+    lifecycleCalls: [],
+    browserGlobalRefs: [],
+    suppressions: []
+  };
+}
+function kindOf(file) {
+  const base = file.split("/").pop() ?? file;
+  return base.includes(".server.") || base.startsWith("+server.") ? "server" : "universal";
+}
+async function collectKitModuleFacts(rt, cwd) {
+  const patterns = [
+    "src/routes/**/+{page,layout}.server.{ts,js}",
+    "src/routes/**/+{page,layout}.{ts,js}",
+    "src/routes/**/+server.{ts,js}",
+    "src/hooks.server.{ts,js}"
+  ];
+  const lists = await Promise.all(patterns.map((p) => rt.glob(p, cwd)));
+  const files = [...new Set(lists.flat())];
+  return Promise.all(
+    files.sort().map(async (rel) => {
+      const kind = kindOf(rel);
+      try {
+        const source = await rt.readFile(rt.join(cwd, rel));
+        return { file: rel, kind, ...parseKitModuleFacts(source, rel) };
+      } catch {
+        return emptyKitModuleFacts(rel, kind);
+      }
+    })
+  );
+}
+
 // src/project-paths.ts
 var ROBOTS_SOURCE_PATHS = [
   "static/robots.txt",
@@ -2098,6 +2869,197 @@ var correct005PropMutation = componentRule({
   }))
 });
 
+// src/rules/correctness/correct006-orphan-effect.ts
+var correct006OrphanEffect = componentRule({
+  id: "CORRECT006",
+  title: "Orphan $effect",
+  category: "correctness",
+  severity: "critical",
+  label: "$effect context",
+  recommendation: "Wrap the effect in $effect.root (and own the returned cleanup), or restructure so the effect is created during component initialisation (e.g. call a setup method from a component).",
+  rationale: "An $effect created outside component initialisation throws effect_orphan at runtime \u2014 the compiler does not catch it, and it typically surfaces as a production 500.",
+  // `orphanEffects` is typed required, but a facts object built by an older/external
+  // constructor may omit it — default to empty rather than let `applies` throw and
+  // take the whole `runRules` Promise.all down with it.
+  applies: (c) => (c.orphanEffects ?? []).length > 0,
+  bad: (c) => (c.orphanEffects ?? []).map((o) => ({
+    line: o.line,
+    message: o.kind === "top-level" ? "$effect at module scope runs outside component initialisation \u2014 it throws effect_orphan at runtime" : `class "${o.className}" runs $effect in its constructor and is instantiated at module scope \u2014 it throws effect_orphan at runtime`
+  }))
+});
+
+// src/rules/correctness/correct007-orphan-lifecycle.ts
+var PENALIZED3 = { presence: "none", value: "absent" };
+var PASS3 = { presence: "own", value: "static" };
+var ID = "CORRECT007";
+var DOCS_URL = docsUrlFor(ID);
+var LABEL = "Lifecycle-call context";
+var RECOMMENDATION = "Call lifecycle/context functions during component initialisation (the top level of a component's <script>). In load, return the data and call setContext in a layout/page component; in shared modules, expose a setup function that components call during init.";
+var topLevelMessage = (name) => `${name}() runs at module evaluation, outside component initialisation \u2014 it throws lifecycle_outside_component at runtime`;
+function isSuppressed2(suppressions, line) {
+  return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID)));
+}
+function emitFile(out, file, issues, suppressions) {
+  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed2(suppressions, b.line)));
+  if (bad.length === 0) {
+    out.push({
+      id: ID,
+      category: "correctness",
+      severity: "critical",
+      detection: PASS3,
+      route: file,
+      message: LABEL,
+      recommendation: RECOMMENDATION,
+      docsUrl: DOCS_URL
+    });
+    return;
+  }
+  for (const b of bad) {
+    out.push({
+      id: ID,
+      category: "correctness",
+      severity: "critical",
+      detection: PENALIZED3,
+      route: file,
+      location: file,
+      ...b.line > 0 ? { line: b.line } : {},
+      message: b.message,
+      recommendation: RECOMMENDATION,
+      docsUrl: DOCS_URL
+    });
+  }
+}
+var correct007OrphanLifecycle = {
+  id: ID,
+  title: "Lifecycle call outside component initialisation",
+  category: "correctness",
+  severity: "critical",
+  scope: "component",
+  rationale: "Svelte lifecycle and context functions require an active component context; called at module scope, in a shared-state class constructor, or in a load/handler they throw lifecycle_outside_component at runtime \u2014 the compiler does not catch it, and it surfaces as a production crash.",
+  async check(ctx) {
+    const out = [];
+    for (const c of ctx.components ?? []) {
+      const calls = c.orphanLifecycleCalls ?? [];
+      if (calls.length === 0) continue;
+      emitFile(
+        out,
+        c.file,
+        calls.map((o) => ({
+          line: o.line,
+          message: o.kind === "top-level" ? topLevelMessage(o.name) : `class "${o.className}" calls ${o.name}() in its constructor and is instantiated at module scope \u2014 it throws lifecycle_outside_component at runtime`
+        })),
+        c.suppressions
+      );
+    }
+    for (const m of ctx.kitModules ?? []) {
+      const calls = m.lifecycleCalls ?? [];
+      if (calls.length === 0) continue;
+      emitFile(
+        out,
+        m.file,
+        calls.map((l) => ({
+          line: l.line,
+          message: l.inHandler ? `${l.name}() is called in a load/handler \u2014 it runs on every request, outside component initialisation, and throws lifecycle_outside_component at runtime` : `${l.name}() runs outside component initialisation (module evaluation or the init hook) \u2014 it throws lifecycle_outside_component at runtime`
+        })),
+        m.suppressions
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/correctness/correct008-browser-globals.ts
+var PENALIZED4 = { presence: "none", value: "absent" };
+var PASS4 = { presence: "own", value: "static" };
+var ID2 = "CORRECT008";
+var DOCS_URL2 = docsUrlFor(ID2);
+var LABEL2 = "Server-safe module code";
+var RECOMMENDATION2 = "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).";
+var moduleMessage = (name) => `${name} is accessed at module scope \u2014 it does not exist on the server, so importing this file crashes SSR with "${name} is not defined"`;
+function isSuppressed3(suppressions, line) {
+  return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID2)));
+}
+function emitFile2(out, file, issues, suppressions) {
+  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed3(suppressions, b.line)));
+  if (bad.length === 0) {
+    out.push({
+      id: ID2,
+      category: "correctness",
+      severity: "critical",
+      detection: PASS4,
+      route: file,
+      message: LABEL2,
+      recommendation: RECOMMENDATION2,
+      docsUrl: DOCS_URL2
+    });
+    return;
+  }
+  for (const b of bad) {
+    out.push({
+      id: ID2,
+      category: "correctness",
+      severity: "critical",
+      detection: PENALIZED4,
+      route: file,
+      location: file,
+      ...b.line > 0 ? { line: b.line } : {},
+      message: b.message,
+      recommendation: RECOMMENDATION2,
+      docsUrl: DOCS_URL2
+    });
+  }
+}
+var correct008BrowserGlobals = {
+  id: ID2,
+  title: "Browser global in server module code",
+  category: "correctness",
+  severity: "critical",
+  scope: "component",
+  rationale: "window, document, localStorage and friends do not exist on the server; a read in module scope or a load/handler crashes SSR with a ReferenceError \u2014 the compiler does not catch it, and it surfaces as a production 500.",
+  async check(ctx) {
+    const out = [];
+    for (const c of ctx.components ?? []) {
+      const refs = (c.browserGlobalRefs ?? []).filter((r) => r.context === "module");
+      if (refs.length === 0) continue;
+      emitFile2(
+        out,
+        c.file,
+        refs.map((r) => ({ line: r.line, message: moduleMessage(r.name) })),
+        c.suppressions
+      );
+    }
+    for (const m of ctx.kitModules ?? []) {
+      const refs = m.browserGlobalRefs ?? [];
+      if (refs.length === 0) continue;
+      emitFile2(
+        out,
+        m.file,
+        refs.map((r) => ({
+          line: r.line,
+          message: r.inHandler ? `${r.name} is accessed in a load/handler \u2014 it runs on the server during SSR, where ${r.name} is not defined` : moduleMessage(r.name)
+        })),
+        m.suppressions
+      );
+    }
+    return out;
+  }
+};
+
+// src/rules/correctness/correct009-instance-browser-globals.ts
+var correct009InstanceBrowserGlobals = componentRule({
+  id: "CORRECT009",
+  title: "Browser global during component initialisation",
+  category: "correctness",
+  label: "Server-safe component init",
+  recommendation: "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).",
+  rationale: "A component instance script runs on the server on every SSR render, where window/document/localStorage do not exist. Warning, not critical: a component rendered only behind a parent {#if browser} (or a client-only dynamic import) is a legitimate pattern that static analysis cannot prove cross-file.",
+  applies: (c) => (c.browserGlobalRefs ?? []).some((r) => r.context === "instance"),
+  bad: (c) => (c.browserGlobalRefs ?? []).filter((r) => r.context === "instance").map((r) => ({
+    line: r.line,
+    message: `${r.name} is accessed during component initialisation \u2014 during SSR this runs on the server, where ${r.name} is not defined`
+  }))
+});
+
 // src/rules/security/sec001-002.ts
 var sec001Html = componentRule({
   id: "SEC001",
@@ -2120,6 +3082,122 @@ var sec002JavascriptUrl = componentRule({
   bad: (c) => c.javascriptUrls.map((u) => ({ line: u.line, message: "javascript: URL in an attribute" }))
 });
 
+// src/rules/kit-module-rule.ts
+var PENALIZED5 = { presence: "none", value: "absent" };
+var PASS5 = { presence: "own", value: "static" };
+function isSuppressed4(m, ruleId, line) {
+  return (m.suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ruleId)));
+}
+function kitModuleRule(opts) {
+  const docsUrl7 = docsUrlFor(opts.id);
+  const severity = opts.severity ?? "warning";
+  return {
+    id: opts.id,
+    title: opts.title,
+    category: opts.category,
+    severity,
+    scope: "component",
+    rationale: opts.rationale,
+    async check(ctx) {
+      const out = [];
+      for (const m of ctx.kitModules ?? []) {
+        if (!opts.applies(m, ctx)) continue;
+        const bad = opts.bad(m, ctx).filter((b) => !(b.line > 0 && isSuppressed4(m, opts.id, b.line)));
+        if (bad.length === 0) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PASS5,
+            route: m.file,
+            message: opts.label,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+          continue;
+        }
+        for (const b of bad) {
+          out.push({
+            id: opts.id,
+            category: opts.category,
+            severity,
+            detection: PENALIZED5,
+            route: m.file,
+            location: m.file,
+            ...b.line > 0 ? { line: b.line } : {},
+            message: b.message,
+            recommendation: opts.recommendation,
+            docsUrl: docsUrl7
+          });
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/rules/security/sec003-load-state-write.ts
+var sec003LoadStateWrite = kitModuleRule({
+  id: "SEC003",
+  title: "Handler writes imported state",
+  category: "security",
+  severity: "critical",
+  label: "Load/handler purity",
+  recommendation: "Return the data from load (or the action) and pass it via page data instead of writing it to module state; per-user data belongs in cookies/locals plus a database.",
+  rationale: "SvelteKit's docs mark this NEVER-DO-THIS: the server is one long-lived process shared by every user, so module state written during a request is visible to ALL later requests \u2014 one user's data can be served to another.",
+  applies: (m) => m.importedStateWrites.length > 0,
+  bad: (m) => m.importedStateWrites.map((w) => ({
+    line: w.line,
+    message: `a server-executed handler writes imported module state "${w.name}" \u2014 shared across all requests on the server, one user's data can leak to another`
+  }))
+});
+
+// src/rules/security/sec004-server-module-state.ts
+var sec004ServerModuleState = kitModuleRule({
+  id: "SEC004",
+  title: "Server module-scope state",
+  category: "security",
+  label: "Server module state",
+  recommendation: "Do not keep request data in module scope on the server \u2014 authenticate with cookies/locals and persist per-user data in a database. For a deliberate process-wide cache, prefer a const container (e.g. a Map) or add an inline suppression.",
+  rationale: `Module scope on the server is one shared, long-lived instance (SvelteKit docs: "Avoid shared state on the server"): a value reassigned during one user's request is served to every other user, and it silently resets on every deploy or restart.`,
+  applies: (m) => m.moduleStateReassignments.length > 0,
+  bad: (m) => m.moduleStateReassignments.map((r) => ({
+    line: r.line,
+    message: r.inHandler ? `module-scope variable "${r.name}" is reassigned from a request handler \u2014 its value is shared across all requests on the server` : `module-scope variable "${r.name}" is reassigned from a function \u2014 if it runs during a request, the value is shared across all requests on the server`
+  }))
+});
+
+// src/rules/security/sec005-shared-state-import.ts
+function extSibling(path) {
+  return path.endsWith(".svelte.ts") ? path.replace(/\.svelte\.ts$/, ".svelte.js") : path.replace(/\.svelte\.js$/, ".svelte.ts");
+}
+var sec005SharedStateImport = kitModuleRule({
+  id: "SEC005",
+  title: "Shared runes-state import on the server",
+  category: "security",
+  label: "Server state imports",
+  recommendation: "Keep module-scope $state out of server-executed code: return data from load and share it via page data or the context API. If the module is genuinely client-only, restructure so server files do not import it, or add an inline suppression.",
+  rationale: "A .svelte.ts module with module-scope $state is one shared instance on the server: mutated, it leaks data between users; read-only, every request sees the same boot-time value instead of per-user data.",
+  applies: (m) => m.runesModuleImports.length > 0,
+  bad: (m, ctx) => {
+    const stateFiles = new Set((ctx.components ?? []).filter((c) => c.moduleStateDecls.length > 0).map((c) => c.file));
+    const writtenOutside = new Set(m.importedStateWritesOutsideHandlers.map((w) => w.name));
+    const writtenInHandler = new Set(m.importedStateWrites.map((w) => w.name));
+    const out = [];
+    for (const imp of m.runesModuleImports) {
+      if (!stateFiles.has(imp.resolved) && !stateFiles.has(extSibling(imp.resolved))) continue;
+      const names = imp.names.filter((n) => !writtenInHandler.has(n));
+      if (names.length === 0) continue;
+      const mutates = names.some((n) => writtenOutside.has(n));
+      out.push({
+        line: imp.line,
+        message: mutates ? `server-executed code mutates shared module state from "${imp.source}" \u2014 on the server it is one instance shared by every request` : `"${imp.source}" holds module-scope $state \u2014 on the server it is shared by every request and keeps its boot-time value (a leak if it ever holds per-user data)`
+      });
+    }
+    return out;
+  }
+});
+
 // src/rules/architecture/arch001-002.ts
 var MAX_LOC = 400;
 var MAX_PROPS = 10;
@@ -2246,8 +3324,15 @@ var allRules = [
   correct003EffectAsOnMount,
   correct004UnmutatedState,
   correct005PropMutation,
+  correct006OrphanEffect,
+  correct007OrphanLifecycle,
+  correct008BrowserGlobals,
+  correct009InstanceBrowserGlobals,
   sec001Html,
   sec002JavascriptUrl,
+  sec003LoadStateWrite,
+  sec004ServerModuleState,
+  sec005SharedStateImport,
   arch001ComponentSize,
   arch002PropCount,
   perf009HeavyImport,
@@ -2789,6 +3874,10 @@ function formatMarkdownReport(results, config, meta) {
       lines.push("");
       lines.push(`\u2026and ${findings.length - MAX_FINDINGS} more (run \`npx svelte-vitals\` locally for the full report)`);
     }
+    lines.push("");
+    lines.push(
+      "_Expected findings (e.g. routes behind auth)? See [Excluding routes or rules](https://oekazuma.github.io/svelte-vitals/guides/ci/#excluding-routes-or-rules)._"
+    );
   }
   return lines.join("\n");
 }
@@ -3490,6 +4579,38 @@ function applyRuleSeverities(results, config) {
     return setting && setting !== "off" ? { ...result, severity: setting } : result;
   });
 }
+function routeGlobToRegExp(pattern) {
+  const body = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").split("\0").join(".*");
+  const source = body.endsWith("/.*") ? `${body.slice(0, -3)}(/.*)?` : body;
+  return new RegExp(`^${source}$`);
+}
+function toPatterns(globs) {
+  if (globs === void 0) return [];
+  return (Array.isArray(globs) ? globs : [globs]).map(routeGlobToRegExp);
+}
+function applyOverrides(results, config) {
+  const overrides = config.overrides;
+  if (!overrides || overrides.length === 0) return results;
+  const compiled = overrides.map((o) => ({
+    routes: toPatterns(o.route),
+    files: toPatterns(o.files),
+    rules: o.rules
+  }));
+  const out = [];
+  for (const result of results) {
+    const { route, location } = result;
+    let setting;
+    for (const o of compiled) {
+      const matched = route !== void 0 && o.routes.some((p) => p.test(route)) || location !== void 0 && o.files.some((p) => p.test(location));
+      if (!matched) continue;
+      const s = o.rules[result.id] ?? o.rules[result.category ?? "seo"];
+      if (s !== void 0) setting = s;
+    }
+    if (setting === void 0) out.push(result);
+    else if (setting !== "off") out.push({ ...result, severity: setting });
+  }
+  return out;
+}
 export {
   APP_SCRIPT,
   APP_STYLE,
@@ -3498,6 +4619,7 @@ export {
   ROBOTS_SOURCE_PATHS,
   SITEMAP_SOURCE_PATHS,
   allRules,
+  applyOverrides,
   applyRuleSeverities,
   arch001ComponentSize,
   arch002PropCount,
@@ -3509,6 +4631,7 @@ export {
   buildJsonReport,
   classify,
   collectComponentFacts,
+  collectKitModuleFacts,
   computeHealth,
   computeScore,
   correct001EachKey,
@@ -3516,12 +4639,17 @@ export {
   correct003EffectAsOnMount,
   correct004UnmutatedState,
   correct005PropMutation,
+  correct006OrphanEffect,
+  correct007OrphanLifecycle,
+  correct008BrowserGlobals,
+  correct009InstanceBrowserGlobals,
   defaultConfig,
   defaultProject,
   defineConfig,
   docsUrlFor,
   effectiveSeverity,
   emptyComponentFacts,
+  emptyKitModuleFacts,
   escapeHtml,
   explainRule,
   findAttr,
@@ -3540,6 +4668,7 @@ export {
   linkRule,
   noColorPalette,
   parseComponentFacts,
+  parseKitModuleFacts,
   perf001ImageDimensions,
   perf002ImageLoading,
   perf003PreloadAs,
@@ -3551,6 +4680,7 @@ export {
   perf009HeavyImport,
   perf010NamespaceImport,
   renderAppShell,
+  resolveRunesModuleSpecifier,
   runRules,
   safeHref,
   scoreBand,
@@ -3558,6 +4688,9 @@ export {
   scoresByCategory,
   sec001Html,
   sec002JavascriptUrl,
+  sec003LoadStateWrite,
+  sec004ServerModuleState,
+  sec005SharedStateImport,
   selectRules,
   seo001Title,
   seo002Description,