npm - @svelte-vitals/core - Versions diffs - 0.26.0 → 0.28.0 - Mend

@svelte-vitals/core 0.26.0 → 0.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -1,3 +1,5 @@
+import { AST } from 'svelte/compiler';
 /**
  * Core type definitions shared across modes. This module is pure: no I/O, no
  * `node:` imports, no runtime-specific globals (design §8).
@@ -23,6 +25,17 @@ interface Project {
     htmlLang: Detection;
     /** Whether the static static/robots.txt references a sitemap (`Sitemap:` line). Undefined for a +server endpoint / absent / unreadable. */
     robotsReferencesSitemap?: boolean;
+    /**
+     * Set when the Vite config disables minification for production builds (performance/minify-disabled).
+     * `file` is the config path relative to the analyzed root (posix, may start with `../`
+     * in monorepos); unset for inline programmatic configs. `line` is 1-based and set only
+     * when the literal `minify: false` was located in that file; unset when the value was
+     * resolved at build time (plugin/conditional config).
+     */
+    viteMinifyDisabled?: {
+        file?: string;
+        line?: number;
+    };
 }
 declare const defaultProject: Project;
 /** A concrete, agent-actionable remediation for a finding (design §10, issue #18). */
@@ -36,7 +49,7 @@ interface Fix {
 }
 /** A single rule finding for one route (or the whole project). */
 interface Result {
-    /** Rule id, e.g. 'SEO001'. */
+    /** Rule id, e.g. 'seo/title-presence'. */
     id: string;
     severity: Severity;
     detection: Detection;
@@ -60,6 +73,26 @@ type Category = 'seo' | 'performance' | 'correctness' | 'security' | 'architectu
 type TreatDynamicAs = 'pass' | 'warn' | 'fail';
 /** Per-rule override: disable, or change severity. */
 type RuleSetting = 'off' | Severity;
+/**
+ * Scoped rule override (design 2026-07-18), applied to results after analysis.
+ * An entry matches a finding when any `route` glob matches its route id or any
+ * `files` glob matches its source location; at least one of the two must be
+ * set. Glob syntax: `*` matches within a segment, `**` across segments, a
+ * trailing `/**` also matches the bare prefix, and all other characters
+ * (including SvelteKit's `(`, `)`, `[`, `]`) are literal.
+ */
+interface RuleOverride {
+    /**
+     * Route-id glob(s), e.g. '/admin/**'. Note route ids drop `(group)` segments
+     * (`src/routes/(app)/dashboard` reports as '/dashboard') — target a group
+     * via `files` instead.
+     */
+    route?: string | string[];
+    /** Source-path glob(s) matched against a finding's location, e.g. 'src/routes/(app)/**'. */
+    files?: string | string[];
+    /** Keys are rule ids ('seo/title-presence') or category names ('seo'). Rule id beats category within an entry. */
+    rules: Record<string, RuleSetting>;
+}
 interface Config {
     treatDynamicAs: TreatDynamicAs;
     /** Component names treated as meta sources of unknown content (design §11 layer 4). */
@@ -70,6 +103,8 @@ interface Config {
     failOn: Severity;
     /** Per-category weights for the combined Health score (default: equal, 1 each) (#10). */
     weights?: Partial<Record<Category, number>>;
+    /** Route-/file-scoped rule overrides, applied to results after analysis (later entries win). */
+    overrides?: RuleOverride[];
 }
 declare const defaultConfig: Config;
 /** Merge user config over defaults. Identity helper for config files (design §6). */
@@ -121,9 +156,9 @@ interface HeadTag {
     text?: string;
     /** Literal `hreflang` of a `<link rel="alternate">` (e.g. 'en', 'en-US', 'x-default'). Undefined when dynamic/absent. */
     hreflang?: string;
-    /** Literal href (link) / src (script) URL when static — used for third-party origin analysis (PERF008). */
+    /** Literal href (link) / src (script) URL when static — used for third-party origin analysis (performance/preconnect). */
     href?: string;
-    /** True for a render-blocking `<script src>` in <head> (no defer/async/module) (PERF007). */
+    /** True for a render-blocking `<script src>` in <head> (no defer/async/module) (performance/render-blocking-script). */
     blocking?: boolean;
     /** Where this tag was set relative to the route. Never 'none' (absence = no tag). */
     presence: Exclude<Presence, 'none'>;
@@ -162,11 +197,11 @@ interface ImageInfo {
     hasWidth: boolean;
     hasHeight: boolean;
     hasLoading: boolean;
-    /** True when the <img> has an `alt` attribute at all (incl. empty `alt=""` decorative; SEO025). */
+    /** True when the <img> has an `alt` attribute at all (incl. empty `alt=""` decorative; seo/image-alt). */
     hasAlt: boolean;
-    /** True when the <img> has a literal `loading="lazy"` (PERF005). Dynamic/spread → false. */
+    /** True when the <img> has a literal `loading="lazy"` (performance/lcp-image). Dynamic/spread → false. */
     lazy: boolean;
-    /** True when the <img> has a `srcset` attribute (PERF006). */
+    /** True when the <img> has a `srcset` attribute (performance/responsive-image). */
     hasSrcset: boolean;
     /** 1-based source line, or 0 if unknown. */
     line: number;
@@ -182,7 +217,7 @@ interface ResolvedImages {
 /**
  * A normalized page-body heading occurrence — the mode-independent boundary for
  * the heading-hierarchy rule (mirrors images.ts). Both providers collect these
- * so SEO027 never needs to know which mode produced them.
+ * so seo/single-h1 never needs to know which mode produced them.
  */
 interface HeadingInfo {
     /** Heading level 1–6 (the `n` in <hn>). */
@@ -209,6 +244,8 @@ interface EachBlockFact {
     hasKey: boolean;
     /** 1-based source line, or 0 if unknown. */
     line: number;
+    /** Set when the block's key expression is its index binding or a trivial coercion of it — `(i)`, `(String(i))`, `(Number(i))`, `` (`${i}`) ``, `(i.toString())`, `(i + '')` — correctness/each-index-key. */
+    indexKey?: boolean;
 }
 /** An `$effect(...)` / `$effect.pre(...)` call in a component's instance script. */
 interface EffectFact {
@@ -216,10 +253,10 @@ interface EffectFact {
     line: number;
     /** True when the effect body only assigns to `$state` variables (the "use $derived" smell). */
     assignsOnlyState: boolean;
-    /** True when this $effect has a NON-EMPTY body that reads no reactive value and makes no bare call — it never re-runs, so it should be onMount (CORRECT003). */
+    /** True when this $effect has a NON-EMPTY body that reads no reactive value and makes no bare call — it never re-runs, so it should be onMount (correctness/effect-as-onmount). */
     mountOnly: boolean;
 }
-/** A `$effect` guaranteed to run outside component initialisation — it throws `effect_orphan` at runtime (CORRECT006). */
+/** A `$effect` guaranteed to run outside component initialisation — it throws `effect_orphan` at runtime (correctness/orphan-effect). */
 interface OrphanEffectFact {
     /** 1-based source line, or 0 if unknown. For 'constructor-instantiated', the module-scope `new` site. */
     line: number;
@@ -228,7 +265,7 @@ interface OrphanEffectFact {
     /** Class name when kind is 'constructor-instantiated' (used in the finding message). */
     className?: string;
 }
-/** A svelte lifecycle/context call guaranteed to run outside component initialisation — it throws `lifecycle_outside_component` at runtime (CORRECT007). */
+/** A svelte lifecycle/context call guaranteed to run outside component initialisation — it throws `lifecycle_outside_component` at runtime (correctness/orphan-lifecycle). */
 interface OrphanLifecycleCallFact {
     /** Canonical svelte export name (alias-resolved), e.g. 'onMount'. */
     name: string;
@@ -239,13 +276,13 @@ interface OrphanLifecycleCallFact {
     /** Class name when kind is 'constructor-instantiated' (used in the finding message). */
     className?: string;
 }
-/** A browser-only global read in code that runs on the server — SSR crashes with "<name> is not defined" (CORRECT008/009). */
+/** A browser-only global read in code that runs on the server — SSR crashes with "<name> is not defined" (correctness/server-browser-global, correctness/instance-browser-global). */
 interface BrowserGlobalRefFact {
     /** The global's name, e.g. 'window'. */
     name: string;
     /** 1-based source line, or 0 if unknown. */
     line: number;
-    /** 'module' = module evaluation (script module / runes module — CORRECT008); 'instance' = component-init top level (runs on the server during SSR — CORRECT009). */
+    /** 'module' = module evaluation (script module / runes module — correctness/server-browser-global); 'instance' = component-init top level (runs on the server during SSR — correctness/instance-browser-global). */
     context: 'module' | 'instance';
 }
 /** A flagged source position in a component (e.g. an `{@html}` tag or a `javascript:` URL). */
@@ -266,43 +303,53 @@ interface ComponentFacts {
     file: string;
     eachBlocks: EachBlockFact[];
     effects: EffectFact[];
-    /** `{@html …}` occurrences — raw-HTML render surfaces (Security SEC001). */
+    /** `{@html …}` occurrences — raw-HTML render surfaces (security/raw-html). */
     htmlTags: SourceSpan[];
-    /** Element attributes with a literal `javascript:` URL (Security SEC002). */
+    /** Element attributes with a literal `javascript:` URL (security/javascript-url). */
     javascriptUrls: SourceSpan[];
-    /** Source line count of the component file (Architecture ARCH001). */
+    /** Source line count of the component file (architecture/component-size). */
     loc: number;
-    /** Named props destructured from `$props()`; 0 when unknowable (rest / non-destructured) (Architecture ARCH002). */
+    /** Named props destructured from `$props()`; 0 when unknowable (rest / non-destructured) (architecture/prop-count). */
     propCount: number;
-    /** Module specifiers of every `import` in the instance + module scripts (Bundle PERF009). */
+    /** Module specifiers of every `import` in the instance + module scripts (performance/heavy-import). */
     imports: string[];
-    /** Module specifiers of every `import`, each with its source line (Bundle PERF009). */
+    /** Module specifiers of every `import`, each with its source line (performance/heavy-import). */
     importSpans: {
         source: string;
         line: number;
     }[];
-    /** Value `import * as X from '<bare pkg>'` namespace imports (type-only excluded) — Bundle PERF010. */
+    /** Value `import * as X from '<bare pkg>'` namespace imports (type-only excluded) — performance/namespace-import. */
     namespaceImports: {
         source: string;
         line: number;
     }[];
-    /** `$state` declarations never written or escaped anywhere in the component — candidates for const (CORRECT004). */
+    /** `$state` declarations never written or escaped anywhere in the component — candidates for const (correctness/unmutated-state). */
     constableStates: {
         name: string;
         line: number;
     }[];
-    /** Mutations of a non-`$bindable` prop from `$props()` — member writes, `delete`, or a mutating method call (CORRECT005). */
+    /** Mutations of a non-`$bindable` prop from `$props()` — member writes, `delete`, or a mutating method call (correctness/prop-mutation). */
     mutatedProps: {
         name: string;
         line: number;
     }[];
-    /** `$effect` calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (CORRECT006). */
+    /** Top-level const/let bindings computed from a $props() prop without $derived, never reassigned or escaped, and referenced (eagerly) in the template — frozen at init (correctness/stale-prop-derivation). */
+    stalePropDerivations: {
+        name: string;
+        line: number;
+    }[];
+    /** Object/array-literal $state bindings reassigned at least once but never mutated, escaped, aliased, or item-edited — $state.raw candidates (performance/state-raw). */
+    rawableStates: {
+        name: string;
+        line: number;
+    }[];
+    /** `$effect` calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (correctness/orphan-effect). */
     orphanEffects: OrphanEffectFact[];
-    /** Svelte lifecycle/context calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (CORRECT007). */
+    /** Svelte lifecycle/context calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (correctness/orphan-lifecycle). */
     orphanLifecycleCalls: OrphanLifecycleCallFact[];
-    /** Browser-global reads in server-executed positions of this file (CORRECT008/009). */
+    /** Browser-global reads in server-executed positions of this file (correctness/server-browser-global, correctness/instance-browser-global). */
     browserGlobalRefs: BrowserGlobalRefFact[];
-    /** Module-scope `$state` declarations in a `.svelte.ts`/`.svelte.js` runes module — on a server, one instance shared by every request (SEC005). Always empty for `.svelte` files. */
+    /** Module-scope `$state` declarations in a `.svelte.ts`/`.svelte.js` runes module — on a server, one instance shared by every request (security/shared-state-import). Always empty for `.svelte` files. */
     moduleStateDecls: {
         name: string;
         line: number;
@@ -318,7 +365,7 @@ type ParsedFacts = Omit<ComponentFacts, 'file' | 'suppressions'> & {
 /**
  * Parse one source file's facts (CLI/static + vite build mode): a `.svelte` component's
  * reactivity/correctness + security + architecture facts, or a `.svelte.ts`/`.svelte.js`
- * runes module's orphan-$effect facts (CORRECT006).
+ * runes module's orphan-$effect facts (correctness/orphan-effect).
  */
 declare function parseComponentFacts(source: string, filename: string): ParsedFacts;
@@ -340,49 +387,62 @@ declare function collectComponentFacts(rt: Runtime, cwd: string): Promise<Compon
 /**
  * Facts parsed from one SvelteKit route/hooks file for the SSR shared-state rules
- * (SEC003–005). Collected by `collectKitModuleFacts` (static/CLI + vite build mode).
+ * (the security kit-module rules). Collected by `collectKitModuleFacts` (static/CLI + vite build mode).
  */
 interface KitModuleFacts {
     /** Repo-relative source file. */
     file: string;
     /** 'server' = runs only on the server (+*.server, +server, hooks.server); 'universal' = +page.ts/+layout.ts (still runs on the server during SSR). */
     kind: 'server' | 'universal';
-    /** Module-scope let/var reassigned from inside a function (SEC004). */
+    /** Module-scope let/var reassigned from inside a function (security/server-module-state). */
     moduleStateReassignments: {
         name: string;
         line: number;
         inHandler: boolean;
     }[];
-    /** Writes to an imported binding from inside an exported handler (SEC003). */
+    /** Writes to an imported binding from inside an exported handler (security/handler-state-write). */
     importedStateWrites: {
         name: string;
         line: number;
         via: 'assignment' | 'set-call';
     }[];
-    /** Writes to an imported binding outside handlers — top level or helper functions (SEC005's write flavour). */
+    /** Writes to an imported binding outside handlers — top level or helper functions (security/shared-state-import's write flavour). */
     importedStateWritesOutsideHandlers: {
         name: string;
         line: number;
     }[];
-    /** Value imports whose specifier resolves to a repo-local `.svelte.ts`/`.svelte.js` runes module (SEC005). */
+    /** Value imports whose specifier resolves to a repo-local `.svelte.ts`/`.svelte.js` runes module (security/shared-state-import). */
     runesModuleImports: {
         source: string;
         resolved: string;
         names: string[];
         line: number;
     }[];
-    /** Svelte lifecycle/context calls that run outside component initialisation — top level, handler bodies, or the `init` hook (CORRECT007). */
+    /** Svelte lifecycle/context calls that run outside component initialisation — top level, handler bodies, or the `init` hook (correctness/orphan-lifecycle). */
     lifecycleCalls: {
         name: string;
         line: number;
         inHandler: boolean;
     }[];
-    /** Browser-global reads in server-executed positions — top level, handler bodies, the `init` hook (CORRECT008). Empty when the file itself exports `ssr = false`. */
+    /** Browser-global reads in server-executed positions — top level, handler bodies, the `init` hook (correctness/server-browser-global). Empty when the file itself exports `ssr = false`. */
     browserGlobalRefs: {
         name: string;
         line: number;
         inHandler: boolean;
     }[];
+    /** Set when this file disables SSR via `export const ssr = false` (inline or same-file alias export) — the declaration's line (seo/ssr-disabled). */
+    ssrDisabled?: {
+        line: number;
+    };
+    /** Set when this file disables client-side rendering via `export const csr = false` (inline or same-file alias export). With no client runtime, a universal load only runs during SSR — performance/load-waterfall's browser-waterfall premise doesn't hold. */
+    csrDisabled?: {
+        line: number;
+    };
+    /** Sequential-await analysis of the exported `load` function (performance/load-waterfall, performance/sequential-awaits): 1-based lines of await sites that depend on an earlier await's result, and of sites independent of all earlier awaits. Set only when at least one list is non-empty. */
+    loadWaterfalls?: {
+        dependentLines: number[];
+        independentLines: number[];
+    };
     /** Inline `svelte-vitals-disable-next-line` directives in this file. */
     suppressions: SuppressionDirective[];
 }
@@ -392,12 +452,12 @@ interface KitModuleFacts {
  * undefined when it cannot be a runes module: `$lib/` maps to `src/lib/`, `./`/`../`
  * resolve against the importing file's directory; bare packages, other aliases, and
  * a relative specifier whose `..` segments escape the repo root are skipped. An
- * extensionless `…/x.svelte` specifier canonicalises to `….svelte.ts` (SEC005 also
+ * extensionless `…/x.svelte` specifier canonicalises to `….svelte.ts` (security/shared-state-import also
  * tries the `.js` sibling when matching).
  */
 declare function resolveRunesModuleSpecifier(spec: string, importerFile: string): string | undefined;
 /**
- * Parse one SvelteKit route/hooks file's SSR shared-state facts (SEC003–005). Uses
+ * Parse one SvelteKit route/hooks file's SSR shared-state facts (the security kit-module rules). Uses
  * the shared wrap parser (`parseModuleProgram`), so reported lines subtract the
  * 1-line wrap prefix; suppressions are scanned on the unwrapped source.
  */
@@ -406,7 +466,7 @@ declare function parseKitModuleFacts(source: string, filename: string): Omit<Kit
 /** Fallback facts for a Kit file that fails to read or parse (dev tooling must never throw). */
 declare function emptyKitModuleFacts(file: string, kind: KitModuleFacts['kind']): KitModuleFacts;
 /**
- * Scan SvelteKit route/hooks files for SSR shared-state facts (SEC003–005): route
+ * Scan SvelteKit route/hooks files for SSR shared-state facts (the security kit-module rules): route
  * `+page`/`+layout` server and universal modules, `+server` endpoints, and
  * `src/hooks.server`. `src/lib/server/**` is deliberately NOT scanned — legitimate
  * module singletons (DB connections, clients) live there (design). A file that
@@ -414,7 +474,17 @@ declare function emptyKitModuleFacts(file: string, kind: KitModuleFacts['kind'])
  */
 declare function collectKitModuleFacts(rt: Runtime, cwd: string): Promise<KitModuleFacts[]>;
-type Node = any;
+/**
+ * The `build: { minify: false }` override, when present as a literal: returns the
+ * `minify` property's 1-based line in the ORIGINAL source. Undefined for clean,
+ * dynamic, or unparsable configs (never throws).
+ */
+declare function findMinifyDisabled(source: string): {
+    line: number;
+} | undefined;
+/** A template fragment's child node relevant to value classification: literal text or a `{expr}`. */
+type TextOrExpr = AST.Text | AST.ExpressionTag;
 /**
  * All keys that can bear child nodes in a Svelte AST node.
  * Covers if/each/await blocks (pending/then/catch/fallback) as well as
@@ -428,28 +498,28 @@ declare const CHILD_NODE_KEYS: string[];
  *   - non-whitespace Text only   → 'static'
  *   - empty / whitespace only    → 'absent'
  */
-declare function valueFromNodes(nodes: Node[]): Value;
+declare function valueFromNodes(nodes: TextOrExpr[]): Value;
 /** The literal text of a node list when fully static (no ExpressionTag), else undefined. */
-declare function textFromNodes(nodes: Node[]): string | undefined;
+declare function textFromNodes(nodes: TextOrExpr[]): string | undefined;
 /** Static string of an attribute (e.g. name="description"), or undefined if dynamic/absent. */
-declare function attrText(attributes: Node[], name: string): string | undefined;
+declare function attrText(attributes: AST.Attribute[], name: string): string | undefined;
 /** Value kind of an attribute's content (e.g. the `content` of a <meta>). */
-declare function attrValue(attributes: Node[], name: string): Value;
+declare function attrValue(attributes: AST.Attribute[], name: string): Value;
 declare function lineOf(source: string, offset: unknown): number;
-declare function findAttr(attributes: Node[], name: string): Node | undefined;
+declare function findAttr(attributes: AST.Attribute[], name: string): AST.Attribute | undefined;
 /** Value kind of a single attribute (e.g. a component prop). */
-declare function attrValueOf(attr: Node): Value;
+declare function attrValueOf(attr: AST.Attribute): Value;
 /** Literal static text of a single attribute node (e.g. a component prop), or undefined if dynamic/absent. */
-declare function attrTextOf(attr: Node): string | undefined;
+declare function attrTextOf(attr: AST.Attribute): string | undefined;
 /**
  * Source-file locations that satisfy the project-scope rules, shared by every
  * mode so the static (CLI) and rendered (plugin) collectors never drift. This
  * module is pure data: no I/O, no `node:` imports (design §8).
  */
-/** Locations that satisfy the robots.txt project rule (SEO006). */
+/** Locations that satisfy the robots.txt project rule (seo/robots-txt). */
 declare const ROBOTS_SOURCE_PATHS: readonly ["static/robots.txt", "src/routes/robots.txt/+server.ts", "src/routes/robots.txt/+server.js"];
-/** Locations that satisfy the sitemap.xml project rule (SEO007). */
+/** Locations that satisfy the sitemap.xml project rule (seo/sitemap-xml). */
 declare const SITEMAP_SOURCE_PATHS: readonly ["static/sitemap.xml", "src/routes/sitemap.xml/+server.ts", "src/routes/sitemap.xml/+server.js"];
 /** Input given to every rule. Mode-independent: rules see only ResolvedHead[] (design §8, §10). */
@@ -457,7 +527,7 @@ interface RuleContext {
     heads: ResolvedHead[];
     /** Per-route <img> elements for Performance rules (absent in modes that don't collect them). */
     images?: ResolvedImages[];
-    /** Per-route page-body headings for SEO027 (absent in modes that don't collect them). */
+    /** Per-route page-body headings for seo/single-h1 (absent in modes that don't collect them). */
     headings?: ResolvedHeadings[];
     /** Per-file component-body facts for Correctness rules (static/CLI mode only). */
     components?: ComponentFacts[];
@@ -505,157 +575,225 @@ declare function isPenalized(detection: Detection, treatDynamicAs: TreatDynamicA
 declare function runRules(rules: Rule[], ctx: RuleContext): Promise<Result[]>;
 /**
- * SEO001 — every route should resolve a non-empty <title> (design §11).
+ * seo/title-presence — every route should resolve a non-empty <title> (design §11).
  * A dynamic title (`{data.title}`) is the most common correct pattern and must
  * never be flagged as missing; it surfaces as value 'dynamic' (design §4).
  */
-declare const seo001Title: Rule;
+declare const seoTitlePresence: Rule;
+declare const seoDescriptionPresence: Rule;
+declare const seoCanonicalUrl: Rule;
-declare const seo002Description: Rule;
-declare const seo003Canonical: Rule;
-declare const seo004OgImage: Rule;
-declare const seo005OgTitle: Rule;
-declare const seo008JsonLd: Rule;
+declare const seoOgImage: Rule;
-declare const seo006Robots: Rule;
-declare const seo007Sitemap: Rule;
-declare const seo009HtmlLang: Rule;
+declare const seoOgTitle: Rule;
-declare const perf001ImageDimensions: Rule;
-declare const perf002ImageLoading: Rule;
-declare const perf006ResponsiveImage: Rule;
+declare const seoJsonLd: Rule;
-declare const perf003PreloadAs: Rule;
-declare const perf004FontPreloadCrossorigin: Rule;
+declare const seoRobotsTxt: Rule;
+declare const seoSitemapXml: Rule;
+declare const seoHtmlLang: Rule;
+declare const performanceImageDimensions: Rule;
+declare const performanceImageLoadingHint: Rule;
+declare const performanceResponsiveImage: Rule;
+declare const performancePreloadMissingAs: Rule;
+declare const performanceFontPreloadCrossorigin: Rule;
 /**
- * PERF005 — LCP image not lazy-loaded. Lazy-loading the largest contentful paint
+ * performance/lcp-image — LCP image not lazy-loaded. Lazy-loading the largest contentful paint
  * image delays it. Analysis approximates the LCP as the first <img> in document
  * order for the route; if that image is loading="lazy", flag it. Runs in both
  * static (CLI) and rendered (vite) mode, since both providers collect <img>.
  */
-declare const perf005LcpImage: Rule;
+declare const performanceLcpImage: Rule;
 /**
- * PERF007 — Render-blocking <script> in <head>. A <script src> without
+ * performance/render-blocking-script — Render-blocking <script> in <head>. A <script src> without
  * defer/async/type=module blocks the parser. SvelteKit's own scripts are
  * module/deferred, so this catches hand-added blocking scripts — in app.html
  * (rendered mode) or in <svelte:head> (static mode). A head with no <script>
  * emits nothing (no signal), like the image rules.
  */
-declare const perf007RenderBlockingScript: Rule;
+declare const performanceRenderBlockingScript: Rule;
 /**
- * PERF008 — Preconnect for third-party origins. A resource from a well-known
+ * performance/preconnect — Preconnect for third-party origins. A resource from a well-known
  * third-party origin (e.g. Google Fonts) without a preconnect/dns-prefetch pays a
  * connection-setup round-trip. Opt-in by construction: only origins in the
  * allowlist are checked; routes referencing none emit nothing.
  */
-declare const perf008Preconnect: Rule;
+declare const performancePreconnect: Rule;
+declare const seoIndexability: Rule;
-declare const seo010Indexability: Rule;
-declare const seo011TwitterCard: Rule;
-declare const seo012OgDescription: Rule;
-declare const seo013OgUrl: Rule;
-declare const seo014Viewport: Rule;
-declare const seo015SitemapInRobots: Rule;
+declare const seoTwitterCard: Rule;
-declare const seo016JsonLdValidity: Rule;
-declare const seo017DeprecatedType: Rule;
-declare const seo018RelativeUrl: Rule;
-declare const seo019DateFormat: Rule;
-declare const seo020Placeholder: Rule;
-declare const seo021RequiredProps: Rule;
+declare const seoOgDescription: Rule;
-declare const seo022TitleLength: Rule;
-declare const seo023DescriptionLength: Rule;
+declare const seoOgUrl: Rule;
+declare const seoViewport: Rule;
+declare const seoSitemapInRobots: Rule;
+declare const seoJsonLdValidity: Rule;
+declare const seoJsonLdDeprecatedType: Rule;
+declare const seoJsonLdRelativeUrl: Rule;
+declare const seoJsonLdDateFormat: Rule;
+declare const seoJsonLdPlaceholder: Rule;
+declare const seoJsonLdRequiredProps: Rule;
+declare const seoTitleLength: Rule;
+declare const seoDescriptionLength: Rule;
 /**
- * SEO024 — Character encoding. The charset meta lives in `src/app.html`, so it is
- * only visible to rendered analysis (`appliesTo: rendered`), exactly like SEO014
+ * seo/charset — Character encoding. The charset meta lives in `src/app.html`, so it is
+ * only visible to rendered analysis (`appliesTo: rendered`), exactly like seo/viewport
  * (viewport). Static route analysis emits nothing instead of false-flagging it.
  */
-declare const seo024Charset: Rule;
+declare const seoCharset: Rule;
 /**
- * SEO025 — Image alt text. Reuses the <img> collection from both providers — the
- * static (CLI) source parser and the rendered (vite) HTML parser — like PERF001/002.
+ * seo/image-alt — Image alt text. Reuses the <img> collection from both providers — the
+ * static (CLI) source parser and the rendered (vite) HTML parser — like performance/image-dimensions, performance/image-loading-hint.
  * Presence only: an explicit empty `alt=""` is a valid decorative-image signal and
  * passes; a spread `{...rest}` may supply alt, so it is not flagged.
  */
-declare const seo025ImageAlt: Rule;
+declare const seoImageAlt: Rule;
 /**
- * SEO026 — hreflang / x-default validity. Opt-in: a route with no
+ * seo/hreflang — hreflang / x-default validity. Opt-in: a route with no
  * `<link rel="alternate" hreflang>` emits nothing (monolingual sites are never
  * flagged). When alternates exist, every code must be well-formed and a set of
  * two or more must declare an x-default. Works in both modes.
  */
-declare const seo026Hreflang: Rule;
+declare const seoHreflang: Rule;
 /**
- * SEO027 — Heading hierarchy (single H1). Reads the per-route page-body headings
+ * seo/single-h1 — Heading hierarchy (single H1). Reads the per-route page-body headings
  * channel (collected by both providers). Zero <h1> (no primary heading) and two
  * or more (diluted topic) are both flagged; exactly one passes. A route whose
  * headings were not collected (channel unset) emits nothing.
  */
-declare const seo027Heading: Rule;
+declare const seoSingleH1: Rule;
+declare const seoDuplicateTitle: Rule;
-declare const seo028TitleUnique: Rule;
-declare const seo029DescriptionUnique: Rule;
+declare const seoDuplicateDescription: Rule;
 /**
- * SEO030 — Skipped heading level. Walking a route's body headings in document
- * order, a level that jumps more than +1 over the previous heading (e.g. h2 → h4)
- * breaks the outline. The first heading has no predecessor (missing/multiple
- * <h1> stays SEO027's concern). A route with no headings emits nothing.
+ * seo/heading-level-skip — Skipped heading level. Walking a route's body headings in
+ * document order, a level that jumps more than +1 over the previous heading (e.g.
+ * h2 → h4) breaks the outline. The first heading has no predecessor (missing/multiple
+ * <h1> stays seo/single-h1's concern). A route with no headings emits nothing.
  */
-declare const seo030HeadingOrder: Rule;
+declare const seoHeadingLevelSkip: Rule;
+declare const seoSsrDisabled: Rule;
+declare const correctnessEachKey: Rule;
-declare const correct001EachKey: Rule;
-declare const correct002EffectDerived: Rule;
-declare const correct003EffectAsOnMount: Rule;
+declare const correctnessEachIndexKey: Rule;
-declare const correct004UnmutatedState: Rule;
+declare const correctnessEffectAsDerived: Rule;
-declare const correct005PropMutation: Rule;
+declare const correctnessEffectAsOnMount: Rule;
+declare const correctnessUnmutatedState: Rule;
+declare const correctnessPropMutation: Rule;
+/**
+ * correctness/stale-prop-derivation — a value computed from a prop without
+ * $derived is evaluated once, at init, and silently stops tracking the parent.
+ * Svelte's own guidance: treat props as though they will change.
+ */
+declare const correctnessStalePropDerivation: Rule;
-declare const correct006OrphanEffect: Rule;
+declare const correctnessOrphanEffect: Rule;
 /**
- * CORRECT007 — svelte lifecycle/context calls guaranteed to run outside component
+ * correctness/orphan-lifecycle — svelte lifecycle/context calls guaranteed to run outside component
  * initialisation: module scope in runes modules / `<script module>`, the constructor of
  * a module-scope-instantiated class, and Kit load/handler/`init` bodies. A custom check
  * because the facts live on BOTH the component channel and the Kit-module channel.
  */
-declare const correct007OrphanLifecycle: Rule;
+declare const correctnessOrphanLifecycle: Rule;
 /**
- * CORRECT008 — browser globals read in server-executed MODULE code: module scope of
+ * correctness/server-browser-global — browser globals read in server-executed MODULE code: module scope of
  * runes modules / `<script module>`, and Kit route/hooks files (top level, handler
  * bodies, the `init` hook). All of it runs on the server, where these globals do not
- * exist — SSR crashes with a ReferenceError. Instance-script reads are CORRECT009's
+ * exist — SSR crashes with a ReferenceError. Instance-script reads are correctness/instance-browser-global's
  * (warning) territory. A custom check because the facts live on both channels.
  */
-declare const correct008BrowserGlobals: Rule;
+declare const correctnessServerBrowserGlobal: Rule;
+declare const correctnessInstanceBrowserGlobal: Rule;
+declare const securityRawHtml: Rule;
-declare const correct009InstanceBrowserGlobals: Rule;
+declare const securityJavascriptUrl: Rule;
-declare const sec001Html: Rule;
-declare const sec002JavascriptUrl: Rule;
+declare const securityHandlerStateWrite: Rule;
-declare const sec003LoadStateWrite: Rule;
+declare const securityServerModuleState: Rule;
-declare const sec004ServerModuleState: Rule;
+declare const securitySharedStateImport: Rule;
-declare const sec005SharedStateImport: Rule;
+declare const architectureComponentSize: Rule;
-declare const arch001ComponentSize: Rule;
-declare const arch002PropCount: Rule;
+declare const architecturePropCount: Rule;
-declare const perf009HeavyImport: Rule;
+declare const performanceHeavyImport: Rule;
-declare const perf010NamespaceImport: Rule;
+declare const performanceNamespaceImport: Rule;
+/**
+ * performance/minify-disabled — a `build.minify: false` left in vite.config ships unminified JS/CSS
+ * to production. Project-scope: the fact is produced by the CLI's static parse
+ * of vite.config.* (literal-only) or by the Vite plugin's resolved config
+ * (exact). Emits a finding only when the fact is set — no pass result.
+ */
+declare const performanceMinifyDisabled: Rule;
+/**
+ * performance/load-waterfall — dependent await chains in universal loads. Server loads are exempt:
+ * a dependent chain cannot be parallelized, and on the server there is no better
+ * placement to suggest. csr = false files are exempt too — without a client
+ * runtime the universal load only runs during SSR.
+ */
+declare const performanceLoadWaterfall: Rule;
+/**
+ * performance/sequential-awaits — independent sequential awaits in any load. Info severity: static
+ * data flow cannot see side-effect ordering (e.g. a setup call an API relies
+ * on), so the parallelize suggestion stays advisory.
+ */
+declare const performanceSequentialAwaits: Rule;
+/**
+ * performance/state-raw — deep $state proxies every property access; a binding
+ * that is only ever reassigned never uses that machinery. Svelte's guidance:
+ * large reassign-only objects (API responses, canonically) belong in $state.raw.
+ * "Large" is not statically knowable, so a non-primitive literal initializer is
+ * the proxy condition.
+ */
+declare const performanceStateRaw: Rule;
 declare const allRules: Rule[];
@@ -668,7 +806,7 @@ interface RuleInfo {
     docsUrl: string;
     fix?: Fix;
 }
-/** Look up a rule's static metadata for the MCP explain_rule tool (issue #24). Rule ids are matched case-insensitively. */
+/** Look up a rule's static metadata for the MCP explain_rule tool (issue #24). Rule ids are matched exactly (case-sensitive, e.g. "seo/ssr-disabled"). */
 declare function explainRule(id: string): RuleInfo | undefined;
 interface HeadTagRuleOptions {
@@ -699,7 +837,7 @@ interface ImageRuleOptions {
     id: string;
     title: string;
     severity: Severity;
-    /** Vitals category (default 'performance'); SEO025 (alt text) reports under 'seo'. */
+    /** Vitals category (default 'performance'); seo/image-alt (alt text) reports under 'seo'. */
     category?: Category;
     /** Noun phrase for messages, e.g. '<img> width/height'. */
     label: string;
@@ -939,5 +1077,15 @@ declare function safeHref(url: string): string | null;
 declare function selectRules(rules: Rule[], config: Config): Rule[];
 /** Apply per-rule severity overrides to results (design §6). */
 declare function applyRuleSeverities(results: Result[], config: Config): Result[];
+/**
+ * Apply route-/file-scoped overrides to results (design 2026-07-18). An entry
+ * matches when any `route` glob matches the finding's route id or any `files`
+ * glob matches its location (OR). `'off'` removes a matched result entirely —
+ * passing seeds included, so scoring and "checks passed" counts behave as if
+ * the rule never ran there. A severity value rewrites the result's severity.
+ * Entries are evaluated in order (later entries win); within one entry a
+ * rule-id key beats a category key.
+ */
+declare function applyOverrides(results: Result[], config: Config): Result[];
-export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CHILD_NODE_KEYS, type Category, type Classification, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleInfo, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, type Value, allRules, applyRuleSeverities, arch001ComponentSize, arch002PropCount, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, computeHealth, computeScore, correct001EachKey, correct002EffectDerived, correct003EffectAsOnMount, correct004UnmutatedState, correct005PropMutation, correct006OrphanEffect, correct007OrphanLifecycle, correct008BrowserGlobals, correct009InstanceBrowserGlobals, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, lineOf, linkRule, noColorPalette, parseComponentFacts, parseKitModuleFacts, perf001ImageDimensions, perf002ImageLoading, perf003PreloadAs, perf004FontPreloadCrossorigin, perf005LcpImage, perf006ResponsiveImage, perf007RenderBlockingScript, perf008Preconnect, perf009HeavyImport, perf010NamespaceImport, renderAppShell, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, sec001Html, sec002JavascriptUrl, sec003LoadStateWrite, sec004ServerModuleState, sec005SharedStateImport, selectRules, seo001Title, seo002Description, seo003Canonical, seo004OgImage, seo005OgTitle, seo006Robots, seo007Sitemap, seo008JsonLd, seo009HtmlLang, seo010Indexability, seo011TwitterCard, seo012OgDescription, seo013OgUrl, seo014Viewport, seo015SitemapInRobots, seo016JsonLdValidity, seo017DeprecatedType, seo018RelativeUrl, seo019DateFormat, seo020Placeholder, seo021RequiredProps, seo022TitleLength, seo023DescriptionLength, seo024Charset, seo025ImageAlt, seo026Hreflang, seo027Heading, seo028TitleUnique, seo029DescriptionUnique, seo030HeadingOrder, summarize, textFromNodes, valueFromNodes };
+export { APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, CHILD_NODE_KEYS, type Category, type Classification, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, type ImageInfo, type JsonReport, type KitModuleFacts, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleInfo, type RuleOverride, type RuleSetting, type Runtime, SITEMAP_SOURCE_PATHS, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, type Value, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architecturePropCount, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, computeHealth, computeScore, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findMinifyDisabled, formatAgentReport, formatConsoleReport, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, isPenalized, lineOf, linkRule, noColorPalette, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, summarize, textFromNodes, valueFromNodes };