@svelte-vitals/core 0.29.0 → 0.30.0

package/dist/index.js

@@ -4,6 +4,7 @@ var defaultProject = {
   hasSitemap: false,
   htmlLang: { presence: "none", value: "absent" }
 };
+var CATEGORIES = ["seo", "performance", "correctness", "security", "architecture"];
 var defaultConfig = {
   treatDynamicAs: "pass",
   metaComponents: [],
@@ -17,6 +18,11 @@ function defineConfig(config = {}) {
 // src/component-parse.ts
 import { parse } from "svelte/compiler";
 
+// src/base-path.ts
+function isRootRelativePath(value) {
+  return value.startsWith("/") && !value.startsWith("//");
+}
+
 // src/svelte-ast.ts
 var CHILD_NODE_KEYS = [
   "fragment",
@@ -264,6 +270,12 @@ function scopeIntroducedNames(node) {
   } else if (node.type === "AwaitBlock") {
     if (node.value) addBoundNames(node.value, introduced);
     if (node.error) addBoundNames(node.error, introduced);
+  } else if (node.type === "Fragment") {
+    for (const child of node.nodes ?? []) {
+      if (child?.type === "ConstTag" || child?.type === "DeclarationTag") {
+        for (const d of child.declaration?.declarations ?? []) addBoundNames(d.id, introduced);
+      }
+    }
   }
   return introduced;
 }
@@ -671,6 +683,7 @@ function bodyIsEmpty(fn) {
   return false;
 }
 var URL_ATTRS = ["href", "src", "action", "formaction"];
+var CHECKABLE_INPUT_TYPES = /* @__PURE__ */ new Set(["checkbox", "radio"]);
 function collectSecurityFacts(node, source, htmlTags, jsUrls) {
   if (Array.isArray(node)) {
     for (const child of node) collectSecurityFacts(child, source, htmlTags, jsUrls);
@@ -692,6 +705,59 @@ function collectSecurityFacts(node, source, htmlTags, jsUrls) {
     if (key in node) collectSecurityFacts(node[key], source, htmlTags, jsUrls);
   }
 }
+function collectCheckableBindValues(node, source, acc) {
+  if (Array.isArray(node)) {
+    for (const child of node) collectCheckableBindValues(child, source, acc);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+  if (node.type === "RegularElement" && node.name === "input" && Array.isArray(node.attributes)) {
+    const typeAttr = findAttr(node.attributes, "type");
+    const typeValue = typeAttr ? attrTextOf(typeAttr) : void 0;
+    if (typeValue && CHECKABLE_INPUT_TYPES.has(typeValue)) {
+      const bindValue = node.attributes.find((a) => a?.type === "BindDirective" && a.name === "value");
+      if (bindValue) {
+        acc.push({
+          kind: typeValue,
+          line: lineOf(source, bindValue.start ?? node.start)
+        });
+      }
+    }
+  }
+  for (const key of CHILD_NODE_KEYS) {
+    if (key in node) collectCheckableBindValues(node[key], source, acc);
+  }
+}
+function collectHrefLinks(node, source, acc) {
+  if (Array.isArray(node)) {
+    for (const child of node) collectHrefLinks(child, source, acc);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+  if (node.type === "RegularElement" && node.name === "a" && Array.isArray(node.attributes)) {
+    const attr = findAttr(node.attributes, "href");
+    const value = attr ? attrTextOf(attr) : void 0;
+    if (value !== void 0 && isRootRelativePath(value)) {
+      acc.push({ kind: "href", path: value, line: lineOf(source, attr?.start ?? node.start) });
+    }
+  }
+  for (const key of CHILD_NODE_KEYS) {
+    if (key in node) collectHrefLinks(node[key], source, acc);
+  }
+}
+var GOTO_NAMES = /* @__PURE__ */ new Set(["goto"]);
+function collectGotoLinks(locals, roots, source, acc) {
+  if (locals.size === 0) return;
+  for (const root of roots) {
+    if (!root) continue;
+    walkEstree(root, (n) => {
+      if (n.type !== "CallExpression" || n.callee?.type !== "Identifier" || !locals.has(n.callee.name)) return;
+      const arg = n.arguments?.[0];
+      if (arg?.type !== "Literal" || typeof arg.value !== "string" || !isRootRelativePath(arg.value)) return;
+      acc.push({ kind: "goto", path: arg.value, line: lineOf(source, n.start) });
+    });
+  }
+}
 function isPropsCall(node) {
   return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "$props";
 }
@@ -977,20 +1043,25 @@ var BROWSER_GLOBALS = /* @__PURE__ */ new Set([
   "confirm",
   "prompt"
 ]);
-function collectBrowserGuardImports(program) {
+function collectNamedImportAliases(program, moduleSource, names) {
   const out = /* @__PURE__ */ new Set();
   for (const stmt of program.body ?? []) {
-    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== "$app/environment")
+    if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type" || stmt.source?.value !== moduleSource) {
       continue;
+    }
     for (const s of stmt.specifiers ?? []) {
       if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
-      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && s.imported.name === "browser") {
+      if (s.type === "ImportSpecifier" && s.imported?.type === "Identifier" && names.has(s.imported.name)) {
         out.add(s.local.name);
       }
     }
   }
   return out;
 }
+var BROWSER_GUARD_NAMES = /* @__PURE__ */ new Set(["browser"]);
+function collectBrowserGuardImports(program) {
+  return collectNamedImportAliases(program, "$app/environment", BROWSER_GUARD_NAMES);
+}
 function collectProgramBindings(program) {
   const bound = /* @__PURE__ */ new Set();
   for (const stmt of program.body ?? []) {
@@ -1168,6 +1239,14 @@ function parseModuleFacts(source, filename) {
   const orphanLifecycleCalls = program ? collectOrphanLifecycleCalls(program, wrapped).map((f) => ({ ...f, line: shift(f.line) })) : [];
   const browserGlobalRefs = program ? collectBrowserGlobalRefs(program, wrapped).map((r) => ({ ...r, line: shift(r.line), context: "module" })) : [];
   const moduleStateDecls = program ? collectModuleStateDecls(program, wrapped).map((d) => ({ ...d, line: shift(d.line) })) : [];
+  const basePathLinks = [];
+  if (program) {
+    const locals = collectNamedImportAliases(program, "$app/navigation", GOTO_NAMES);
+    const raw = [];
+    collectGotoLinks(locals, [program], wrapped, raw);
+    for (const l of raw) basePathLinks.push({ ...l, line: shift(l.line) });
+    basePathLinks.sort((a, b) => a.line - b.line);
+  }
   return {
     eachBlocks: [],
     effects: [],
@@ -1183,6 +1262,8 @@ function parseModuleFacts(source, filename) {
     stalePropDerivations: [],
     rawableStates: [],
     nonreactiveBuiltinStates: [],
+    checkableBindValues: [],
+    basePathLinks,
     suppressions: collectSuppressions(source),
     orphanEffects,
     orphanLifecycleCalls,
@@ -1198,6 +1279,18 @@ function parseComponentFacts(source, filename) {
   const htmlTags = [];
   const javascriptUrls = [];
   collectSecurityFacts(ast.fragment ?? ast, source, htmlTags, javascriptUrls);
+  const checkableBindValues = [];
+  collectCheckableBindValues(ast.fragment ?? ast, source, checkableBindValues);
+  const basePathLinks = [];
+  collectHrefLinks(ast.fragment ?? ast, source, basePathLinks);
+  const gotoPrograms = [ast.module?.content, ast.instance?.content].filter(Boolean);
+  const gotoLocals = /* @__PURE__ */ new Set();
+  for (const p of gotoPrograms)
+    for (const n of collectNamedImportAliases(p, "$app/navigation", GOTO_NAMES)) {
+      gotoLocals.add(n);
+    }
+  collectGotoLinks(gotoLocals, [...gotoPrograms, ast.fragment], source, basePathLinks);
+  basePathLinks.sort((a, b) => a.line - b.line);
   const loc = countLines(source);
   const suppressions = collectSuppressions(source);
   const moduleProgram = ast.module?.content;
@@ -1372,6 +1465,8 @@ function parseComponentFacts(source, filename) {
     stalePropDerivations,
     rawableStates,
     nonreactiveBuiltinStates,
+    checkableBindValues,
+    basePathLinks,
     orphanEffects,
     orphanLifecycleCalls,
     browserGlobalRefs,
@@ -1398,6 +1493,8 @@ function emptyComponentFacts(file) {
     stalePropDerivations: [],
     rawableStates: [],
     nonreactiveBuiltinStates: [],
+    checkableBindValues: [],
+    basePathLinks: [],
     orphanEffects: [],
     orphanLifecycleCalls: [],
     browserGlobalRefs: [],
@@ -1534,6 +1631,22 @@ function collectAwaits(node, out = []) {
   }
   return out;
 }
+var REDIRECT_NAMES = /* @__PURE__ */ new Set(["redirect"]);
+function collectRedirectCalls(node, locals, out = []) {
+  if (Array.isArray(node)) {
+    for (const child of node) collectRedirectCalls(child, locals, out);
+    return out;
+  }
+  if (!node || typeof node !== "object" || typeof node.type !== "string") return out;
+  if (node.type === "CallExpression" && node.callee?.type === "Identifier" && locals.has(node.callee.name)) {
+    out.push(node);
+  }
+  for (const key of Object.keys(node)) {
+    if (WALK_IGNORED_KEYS.has(key)) continue;
+    collectRedirectCalls(node[key], locals, out);
+  }
+  return out;
+}
 function isParentCall(arg) {
   const e = unwrapTs(arg);
   if (e?.type !== "CallExpression") return false;
@@ -1721,6 +1834,7 @@ function parseKitModuleFacts(source, filename) {
       runesModuleImports,
       lifecycleCalls,
       browserGlobalRefs,
+      basePathLinks: [],
       suppressions
     };
   }
@@ -1845,6 +1959,15 @@ function parseKitModuleFacts(source, filename) {
     }
   });
   const byLine = (arr) => arr.sort((a, b) => a.line - b.line);
+  const basePathLinks = [];
+  const redirectLocals = collectNamedImportAliases(program, "@sveltejs/kit", REDIRECT_NAMES);
+  if (redirectLocals.size > 0) {
+    for (const call of collectRedirectCalls(program, redirectLocals)) {
+      const arg = call.arguments?.[1];
+      if (arg?.type !== "Literal" || typeof arg.value !== "string" || !isRootRelativePath(arg.value)) continue;
+      basePathLinks.push({ kind: "redirect", path: arg.value, line: line(call.start) });
+    }
+  }
   return {
     moduleStateReassignments: byLine(moduleStateReassignments),
     importedStateWrites: byLine(importedStateWrites),
@@ -1852,6 +1975,7 @@ function parseKitModuleFacts(source, filename) {
     runesModuleImports: byLine(runesModuleImports),
     lifecycleCalls: byLine(lifecycleCalls),
     browserGlobalRefs: byLine(browserGlobalRefs),
+    basePathLinks: byLine(basePathLinks),
     ...ssrOptOut ? { ssrDisabled: { line: Math.max(0, ssrOptOut.line - 1) } } : {},
     ...csrOptOut ? { csrDisabled: { line: Math.max(0, csrOptOut.line - 1) } } : {},
     ...waterfalls.dependentLines.length > 0 || waterfalls.independentLines.length > 0 ? { loadWaterfalls: waterfalls } : {},
@@ -1870,6 +1994,7 @@ function emptyKitModuleFacts(file, kind) {
     runesModuleImports: [],
     lifecycleCalls: [],
     browserGlobalRefs: [],
+    basePathLinks: [],
     suppressions: []
   };
 }
@@ -1899,7 +2024,7 @@ async function collectKitModuleFacts(rt, cwd) {
   );
 }
 
-// src/vite-config-parse.ts
+// src/config-object.ts
 function propOf(obj, name) {
   let found;
   for (const p of obj.properties) {
@@ -1954,6 +2079,8 @@ function resolveConfigObject(program) {
   if (!exported) return void 0;
   return unwrapToObjectExpression(exported, collectTopLevelBindings(program));
 }
+
+// src/vite-config-parse.ts
 function findMinifyDisabled(source) {
   let program;
   let wrapped;
@@ -1974,6 +2101,79 @@ function findMinifyDisabled(source) {
   return { line: Math.max(0, lineOf(wrapped, minify.start) - 1) };
 }
 
+// src/svelte-config-parse.ts
+function basePathOf(kitConfig, bindings) {
+  const paths = propOf(kitConfig, "paths");
+  const pathsObj = paths ? unwrapToObjectExpression(paths.value, bindings) : void 0;
+  if (!pathsObj) return void 0;
+  const base = propOf(pathsObj, "base");
+  if (!base) return void 0;
+  const value = unwrapTs(base.value);
+  if (value.type === "Literal") {
+    return typeof value.value === "string" && value.value !== "" ? { value: value.value } : void 0;
+  }
+  return {};
+}
+function programOf(source, filename) {
+  try {
+    return parseModuleProgram(source, filename).program ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findKitPathsBaseInSvelteConfig(source) {
+  const program = programOf(source, "svelte.config.js");
+  if (!program) return void 0;
+  const config = resolveConfigObject(program);
+  if (!config) return void 0;
+  const bindings = collectTopLevelBindings(program);
+  const kit = propOf(config, "kit");
+  const kitObj = kit ? unwrapToObjectExpression(kit.value, bindings) : void 0;
+  return kitObj ? basePathOf(kitObj, bindings) : void 0;
+}
+function sveltekitLocalNames(program) {
+  const out = collectNamedImportAliases(program, "@sveltejs/kit/vite", /* @__PURE__ */ new Set(["sveltekit"]));
+  if (out.size === 0) out.add("sveltekit");
+  return out;
+}
+function findKitPathsBaseInViteConfig(source) {
+  const none = { kind: "no-plugin-config" };
+  const program = programOf(source, "vite.config.ts");
+  if (!program) return none;
+  const config = resolveConfigObject(program);
+  if (!config) return none;
+  const bindings = collectTopLevelBindings(program);
+  const plugins = propOf(config, "plugins");
+  const pluginsValue = plugins ? unwrapTs(plugins.value) : void 0;
+  if (pluginsValue?.type !== "ArrayExpression") return none;
+  const locals = sveltekitLocalNames(program);
+  for (const el of pluginsValue.elements) {
+    if (!el || el.type === "SpreadElement") continue;
+    const call = unwrapTs(el);
+    if (call.type !== "CallExpression") continue;
+    if (call.callee.type !== "Identifier" || !locals.has(call.callee.name)) continue;
+    const arg = call.arguments[0];
+    if (arg === void 0) return none;
+    const kitConfig = unwrapToObjectExpression(arg, bindings);
+    if (!kitConfig) return { kind: "unresolvable" };
+    const base = basePathOf(kitConfig, bindings);
+    return base ? { kind: "resolved", base } : { kind: "resolved" };
+  }
+  return none;
+}
+function resolveKitPathsBase(viteConfig, svelteConfig) {
+  if (viteConfig) {
+    const result = findKitPathsBaseInViteConfig(viteConfig.source);
+    if (result.kind === "unresolvable") return void 0;
+    if (result.kind === "resolved") {
+      return result.base ? { ...result.base, file: viteConfig.file } : void 0;
+    }
+  }
+  if (!svelteConfig) return void 0;
+  const base = findKitPathsBaseInSvelteConfig(svelteConfig.source);
+  return base ? { ...base, file: svelteConfig.file } : void 0;
+}
+
 // src/project-paths.ts
 var ROBOTS_SOURCE_PATHS = [
   "static/robots.txt",
@@ -1985,6 +2185,15 @@ var SITEMAP_SOURCE_PATHS = [
   "src/routes/sitemap.xml/+server.ts",
   "src/routes/sitemap.xml/+server.js"
 ];
+var VITE_CONFIG_FILES = [
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.ts",
+  "vite.config.cjs",
+  "vite.config.mts",
+  "vite.config.cts"
+];
+var SVELTE_CONFIG_FILES = ["svelte.config.js", "svelte.config.ts"];
 
 // src/rule.ts
 function docsUrlFor(id) {
@@ -2054,7 +2263,7 @@ function detect(head, match) {
   return tag ? { presence: tag.presence, value: tag.value } : { presence: "none", value: "absent" };
 }
 function headTagRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -2077,7 +2286,7 @@ function headTagRule(opts) {
           location: head.file,
           message,
           recommendation: opts.recommendation,
-          docsUrl: docsUrl7,
+          docsUrl: docsUrl8,
           // Copy per finding: opts.fix is a rule-level template shared across all
           // results this rule emits; a fresh object keeps findings independent.
           ...opts.fix ? { fix: { ...opts.fix } } : {}
@@ -2270,7 +2479,7 @@ var seoHtmlLang = {
 
 // src/rules/perf/image-rule.ts
 function imageRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   const category = opts.category ?? "performance";
   return {
     id: opts.id,
@@ -2294,7 +2503,7 @@ function imageRule(opts) {
             route: route.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            docsUrl: docsUrl8
           });
           continue;
         }
@@ -2309,7 +2518,7 @@ function imageRule(opts) {
             ...img.line > 0 ? { line: img.line } : {},
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7,
+            docsUrl: docsUrl8,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -2369,7 +2578,7 @@ var performanceResponsiveImage = imageRule({
 
 // src/rules/perf/link-rule.ts
 function linkRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -2393,7 +2602,7 @@ function linkRule(opts) {
             route: head.route,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            docsUrl: docsUrl8
           });
           continue;
         }
@@ -2410,7 +2619,7 @@ function linkRule(opts) {
             location: tag.file ?? head.file,
             message: `Missing ${opts.label}`,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7,
+            docsUrl: docsUrl8,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -2557,10 +2766,197 @@ var performanceRenderBlockingScript = {
   }
 };
 
+// src/config-apply.ts
+function settingSeverity(setting) {
+  if (setting === void 0) return void 0;
+  if (typeof setting === "string") return setting;
+  return setting.severity;
+}
+function settingOptions(setting) {
+  return setting !== void 0 && typeof setting !== "string" ? setting.options : void 0;
+}
+function selectRules(rules, config) {
+  return rules.filter((rule) => settingSeverity(config.rules[rule.id]) !== "off");
+}
+function applyRuleSeverities(results, config) {
+  return results.map((result) => {
+    const severity = settingSeverity(config.rules[result.id]);
+    return severity !== void 0 && severity !== "off" ? { ...result, severity } : result;
+  });
+}
+function routeGlobToRegExp(pattern) {
+  const body = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").split("\0").join(".*");
+  const source = body.endsWith("/.*") ? `${body.slice(0, -3)}(/.*)?` : body;
+  return new RegExp(`^${source}$`);
+}
+function toPatterns(globs) {
+  if (globs === void 0) return [];
+  return (Array.isArray(globs) ? globs : [globs]).map(routeGlobToRegExp);
+}
+function compileOverrides(config) {
+  return (config.overrides ?? []).map((o) => ({
+    routes: toPatterns(o.route),
+    files: toPatterns(o.files),
+    rules: o.rules
+  }));
+}
+function overrideMatches(o, target) {
+  const { route, file } = target;
+  return route !== void 0 && o.routes.some((p) => p.test(route)) || file !== void 0 && o.files.some((p) => p.test(file));
+}
+function applyOverrides(results, config) {
+  const compiled = compileOverrides(config);
+  if (compiled.length === 0) return results;
+  const out = [];
+  for (const result of results) {
+    let severity;
+    for (const o of compiled) {
+      if (!overrideMatches(o, { route: result.route, file: result.location })) continue;
+      const sev = settingSeverity(o.rules[result.id]) ?? settingSeverity(o.rules[result.category ?? "seo"]);
+      if (sev !== void 0) severity = sev;
+    }
+    if (severity === void 0) out.push(result);
+    else if (severity !== "off") out.push({ ...result, severity });
+  }
+  return out;
+}
+
+// src/rule-options.ts
+var RULE_SETTING_VALUES = ["off", "critical", "warning", "info"];
+function defaultsOf(spec) {
+  const out = {};
+  for (const [key, s] of Object.entries(spec)) {
+    out[key] = s.kind === "integer" ? s.default : s.kind === "string-list" ? [...s.default] : { ...s.default };
+  }
+  return out;
+}
+function intOption(options, key, fallback = 0) {
+  const v = options[key];
+  return typeof v === "number" ? v : fallback;
+}
+function listOption(options, key) {
+  const v = options[key];
+  return Array.isArray(v) ? v : [];
+}
+function mapOption(options, key) {
+  const v = options[key];
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+}
+function resolveRuleOptions(ruleId, spec, config, target, compiled) {
+  if (!spec) return {};
+  const out = defaultsOf(spec);
+  const layers = [settingOptions(config.rules[ruleId])];
+  if (target) {
+    for (const o of compiled ?? compileOverrides(config)) {
+      if (overrideMatches(o, target)) layers.push(settingOptions(o.rules[ruleId]));
+    }
+  }
+  for (const layer of layers) {
+    if (!layer) continue;
+    for (const [key, value] of Object.entries(layer)) {
+      const s = spec[key];
+      if (!s) continue;
+      if (s.kind === "integer") out[key] = value;
+      else if (s.kind === "string-list") out[key] = [...out[key], ...value];
+      else out[key] = { ...out[key], ...value };
+    }
+  }
+  return out;
+}
+function validateRuleOptions(ruleId, spec, options, baseline, skipRangeCheck) {
+  if (!spec) return Object.keys(options).length === 0 ? [] : [`${ruleId} takes no options.`];
+  const errors = [];
+  const badKeys = /* @__PURE__ */ new Set();
+  const isNonEmptyString = (v) => typeof v === "string" && v.length > 0;
+  for (const [key, value] of Object.entries(options)) {
+    const s = spec[key];
+    if (!s) {
+      errors.push(`${ruleId}: unknown option '${key}'. Known options: ${Object.keys(spec).join(", ")}.`);
+      continue;
+    }
+    if (s.kind === "integer") {
+      if (typeof value !== "number" || !Number.isInteger(value)) {
+        errors.push(`${ruleId}.${key} must be an integer.`);
+        badKeys.add(key);
+      } else if (s.min !== void 0 && value < s.min) {
+        errors.push(`${ruleId}.${key} must be >= ${s.min}.`);
+        badKeys.add(key);
+      } else if (s.max !== void 0 && value > s.max) {
+        errors.push(`${ruleId}.${key} must be <= ${s.max}.`);
+        badKeys.add(key);
+      }
+    } else if (s.kind === "string-list") {
+      if (!Array.isArray(value) || !value.every(isNonEmptyString)) {
+        errors.push(`${ruleId}.${key} must be an array of non-empty strings.`);
+      }
+    } else if (typeof value !== "object" || value === null || Array.isArray(value) || !Object.values(value).every(isNonEmptyString)) {
+      errors.push(`${ruleId}.${key} must be an object of string \u2192 non-empty string.`);
+    }
+  }
+  const minSpec = spec.min;
+  const maxSpec = spec.max;
+  if (minSpec?.kind === "integer" && maxSpec?.kind === "integer" && !badKeys.has("min") && !badKeys.has("max") && !skipRangeCheck) {
+    const base = baseline ?? defaultsOf(spec);
+    const minVal = "min" in options ? options.min : base.min;
+    const maxVal = "max" in options ? options.max : base.max;
+    if (typeof minVal === "number" && typeof maxVal === "number" && minVal > maxVal) {
+      errors.push(`${ruleId}: min (${minVal}) must be <= max (${maxVal}).`);
+    }
+  }
+  return errors;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function otherOverrideNarrowsOppositeSide(overrides, selfIndex, key, side) {
+  return overrides.some((entry, i) => {
+    if (i === selfIndex || !isPlainObject(entry) || !isPlainObject(entry.rules)) return false;
+    const setting = entry.rules[key];
+    return isPlainObject(setting) && isPlainObject(setting.options) && side in setting.options;
+  });
+}
+function shouldSkipRangeCheck(overrides, selfIndex, key, setting) {
+  if (!isPlainObject(setting) || !isPlainObject(setting.options)) return false;
+  const setsMin = "min" in setting.options;
+  const setsMax = "max" in setting.options;
+  if (setsMin === setsMax) return false;
+  return otherOverrideNarrowsOppositeSide(overrides, selfIndex, key, setsMin ? "max" : "min");
+}
+function validateRuleSetting(label, ruleId, setting, spec, opts) {
+  const expected = RULE_SETTING_VALUES.join("|");
+  if (typeof setting === "string") {
+    return RULE_SETTING_VALUES.includes(setting) ? [] : [`${label}: invalid setting '${setting}'; expected ${expected}.`];
+  }
+  if (!isPlainObject(setting)) {
+    return [`${label}: must be ${expected} or an object with 'severity' and/or 'options'.`];
+  }
+  const errors = [];
+  const unknownKeys = Object.keys(setting).filter((k) => k !== "severity" && k !== "options");
+  if (unknownKeys.length > 0) {
+    errors.push(`${label}: unknown key(s) ${unknownKeys.join(", ")}; expected severity, options.`);
+  }
+  if (setting.severity !== void 0 && !RULE_SETTING_VALUES.includes(setting.severity)) {
+    errors.push(`${label}.severity: invalid setting '${String(setting.severity)}'; expected ${expected}.`);
+  }
+  if (setting.options === void 0) return errors;
+  if (!opts.allowOptions) {
+    errors.push(`${label}: options are not allowed on a category key.`);
+    return errors;
+  }
+  if (!isPlainObject(setting.options)) {
+    errors.push(`${label}.options: must be an object.`);
+    return errors;
+  }
+  const optionErrors = validateRuleOptions(ruleId, spec, setting.options, opts.baseline, opts.skipRangeCheck);
+  if (optionErrors.length > 0) errors.push(`${label}: ${optionErrors.join(" ")}`);
+  return errors;
+}
+
 // src/rules/perf/preconnect.ts
 var docsUrl3 = docsUrlFor("performance/preconnect");
 var recommendation3 = 'Add <link rel="preconnect"> (or dns-prefetch) for the third-party origin so the connection is set up early.';
 var THIRD_PARTY_ORIGINS = /* @__PURE__ */ new Set(["fonts.googleapis.com", "fonts.gstatic.com"]);
+var OPTIONS = { origins: { kind: "string-list", default: [...THIRD_PARTY_ORIGINS] } };
 function hostOf(href) {
   const m = /^(?:https?:)?\/\/([^/?#]+)/i.exec(href);
   return m ? m[1].toLowerCase() : void 0;
@@ -2577,17 +2973,30 @@ var performancePreconnect = {
     snippet: '<link rel="preconnect" href="https://fonts.googleapis.com" />',
     lang: "html"
   },
+  options: OPTIONS,
   async check(ctx) {
     const out = [];
+    const compiled = compileOverrides(ctx.config);
     for (const head of ctx.heads) {
       const referenced = /* @__PURE__ */ new Map();
       const covered = /* @__PURE__ */ new Set();
       for (const tag of head.tags) {
         if (tag.kind !== "link" && tag.kind !== "script" || typeof tag.href !== "string") continue;
         const host = hostOf(tag.href);
-        if (!host || !THIRD_PARTY_ORIGINS.has(host)) continue;
-        if (tag.kind === "link" && (tag.rel === "preconnect" || tag.rel === "dns-prefetch")) covered.add(host);
-        else if (!referenced.has(host)) referenced.set(host, tag.file);
+        if (!host) continue;
+        if (tag.kind === "link" && (tag.rel === "preconnect" || tag.rel === "dns-prefetch")) {
+          covered.add(host);
+          continue;
+        }
+        const o = resolveRuleOptions(
+          "performance/preconnect",
+          OPTIONS,
+          ctx.config,
+          { route: head.route, file: tag.file ?? head.file },
+          compiled
+        );
+        if (!listOption(o, "origins").includes(host)) continue;
+        if (!referenced.has(host)) referenced.set(host, tag.file);
       }
       if (referenced.size === 0) continue;
       const missing = [...referenced].filter(([host]) => !covered.has(host));
@@ -2638,7 +3047,7 @@ var seoIndexability = {
   rationale: "A noindex directive removes the page from search results; an accidental noindex on a public route silently deindexes it.",
   fix: FIX5,
   async check(ctx) {
-    const docsUrl7 = docsUrlFor("seo/indexability");
+    const docsUrl8 = docsUrlFor("seo/indexability");
     const out = [];
     for (const head of ctx.heads) {
       const noindexed = head.tags.some((t) => t.kind === "meta" && t.name === "robots" && t.noindex === true);
@@ -2653,7 +3062,7 @@ var seoIndexability = {
         location: head.file,
         message: "Route is noindex \u2014 verify this is intentional",
         recommendation: 'If this route should be indexed, remove noindex from its <meta name="robots">.',
-        docsUrl: docsUrl7,
+        docsUrl: docsUrl8,
         fix: { ...FIX5 }
       });
     }
@@ -2904,7 +3313,7 @@ function jsonldTags(head) {
   return head.tags.filter((t) => t.kind === "jsonld" && typeof t.jsonld === "string");
 }
 function jsonldRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -2932,7 +3341,7 @@ function jsonldRule(opts) {
               location: head.file,
               message: problem,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl7,
+              docsUrl: docsUrl8,
               ...opts.fix ? { fix: { ...opts.fix } } : {}
             } : {
               id: opts.id,
@@ -2942,7 +3351,7 @@ function jsonldRule(opts) {
               route: head.route,
               message: opts.label,
               recommendation: opts.recommendation,
-              docsUrl: docsUrl7
+              docsUrl: docsUrl8
             }
           );
         }
@@ -2966,7 +3375,7 @@ var seoJsonLdValidity = {
     lang: "svelte"
   },
   async check(ctx) {
-    const docsUrl7 = docsUrlFor("seo/json-ld-validity");
+    const docsUrl8 = docsUrlFor("seo/json-ld-validity");
     const out = [];
     for (const head of ctx.heads) {
       for (const tag of jsonldTags(head)) {
@@ -2985,7 +3394,7 @@ var seoJsonLdValidity = {
             location: head.file,
             message: problem,
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl7,
+            docsUrl: docsUrl8,
             fix: { ...seoJsonLdValidity.fix }
           } : {
             id: "seo/json-ld-validity",
@@ -2995,7 +3404,7 @@ var seoJsonLdValidity = {
             route: head.route,
             message: "JSON-LD validity",
             recommendation: "Make the JSON-LD valid JSON with both @context and @type.",
-            docsUrl: docsUrl7
+            docsUrl: docsUrl8
           }
         );
       }
@@ -3106,7 +3515,11 @@ function visibleLength(s) {
 
 // src/rules/seo/length-rule.ts
 function lengthRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
+  const spec = {
+    min: { kind: "integer", default: opts.min, min: 0 },
+    max: { kind: "integer", default: opts.max, min: 1 }
+  };
   return {
     id: opts.id,
     title: opts.title,
@@ -3114,15 +3527,22 @@ function lengthRule(opts) {
     severity: "info",
     scope: "route",
     rationale: opts.rationale,
+    options: spec,
     async check(ctx) {
       const out = [];
+      const compiled = compileOverrides(ctx.config);
       for (const head of ctx.heads) {
         const tag = head.tags.find(opts.match);
         if (!tag || typeof tag.text !== "string") continue;
+        const location = tag.file ?? head.file;
+        const o = resolveRuleOptions(opts.id, spec, ctx.config, { route: head.route, file: location }, compiled);
+        const min = intOption(o, "min", opts.min);
+        const max = intOption(o, "max", opts.max);
+        const recommendation8 = typeof opts.recommendation === "function" ? opts.recommendation(o) : opts.recommendation;
         const len = visibleLength(tag.text);
         let problem;
-        if (len < opts.min) problem = `${opts.noun} is too short (${len} chars; aim for ${opts.min}\u2013${opts.max})`;
-        else if (len > opts.max) problem = `${opts.noun} is too long (${len} chars; aim for ${opts.min}\u2013${opts.max})`;
+        if (len < min) problem = `${opts.noun} is too short (${len} chars; aim for ${min}\u2013${max})`;
+        else if (len > max) problem = `${opts.noun} is too long (${len} chars; aim for ${min}\u2013${max})`;
         out.push(
           problem ? {
             id: opts.id,
@@ -3130,10 +3550,10 @@ function lengthRule(opts) {
             severity: "info",
             detection: PENALIZED,
             route: head.route,
-            location: tag.file ?? head.file,
+            location,
             message: problem,
-            recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            recommendation: recommendation8,
+            docsUrl: docsUrl8
           } : {
             id: opts.id,
             category: "seo",
@@ -3141,8 +3561,8 @@ function lengthRule(opts) {
             detection: PASS,
             route: head.route,
             message: opts.label,
-            recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            recommendation: recommendation8,
+            docsUrl: docsUrl8
           }
         );
       }
@@ -3152,28 +3572,32 @@ function lengthRule(opts) {
 }
 
 // src/rules/seo/title-length.ts
+var MIN = 30;
+var MAX = 60;
 var seoTitleLength = lengthRule({
   id: "seo/title-length",
   title: "Title length",
   label: "Title length",
   noun: "Title",
   match: (t) => t.kind === "title",
-  min: 30,
-  max: 60,
-  recommendation: "Aim for a title of 30\u201360 characters so it is not truncated in search results.",
+  min: MIN,
+  max: MAX,
+  recommendation: (o) => `Aim for a title of ${intOption(o, "min", MIN)}\u2013${intOption(o, "max", MAX)} characters so it is not truncated in search results.`,
   rationale: "A title that is too short wastes the strongest on-page signal; one that is too long is truncated in the SERP."
 });
 
 // src/rules/seo/description-length.ts
+var MIN2 = 70;
+var MAX2 = 160;
 var seoDescriptionLength = lengthRule({
   id: "seo/description-length",
   title: "Description length",
   label: "Description length",
   noun: "Description",
   match: (t) => t.kind === "meta" && t.name === "description",
-  min: 70,
-  max: 160,
-  recommendation: "Aim for a meta description of 70\u2013160 characters so it is not truncated in search results.",
+  min: MIN2,
+  max: MAX2,
+  recommendation: (o) => `Aim for a meta description of ${intOption(o, "min", MIN2)}\u2013${intOption(o, "max", MAX2)} characters so it is not truncated in search results.`,
   rationale: "A description that is too short under-uses the SERP snippet; one that is too long is truncated by search engines."
 });
 
@@ -3323,7 +3747,7 @@ var seoSingleH1 = {
 
 // src/rules/seo/uniqueness-rule.ts
 function uniquenessRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   return {
     id: opts.id,
     title: opts.title,
@@ -3353,7 +3777,7 @@ function uniquenessRule(opts) {
           location: e.file,
           message: `${opts.noun} is duplicated across ${n} routes`,
           recommendation: opts.recommendation,
-          docsUrl: docsUrl7
+          docsUrl: docsUrl8
         } : {
           id: opts.id,
           category: "seo",
@@ -3362,7 +3786,7 @@ function uniquenessRule(opts) {
           route: e.route,
           message: opts.label,
           recommendation: opts.recommendation,
-          docsUrl: docsUrl7
+          docsUrl: docsUrl8
         };
       });
     }
@@ -3450,7 +3874,7 @@ function isSuppressed(m, ruleId, line) {
   return (m.suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ruleId)));
 }
 function kitModuleRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   const severity = opts.severity ?? "warning";
   return {
     id: opts.id,
@@ -3474,7 +3898,7 @@ function kitModuleRule(opts) {
             route: m.file,
             message: opts.label,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            docsUrl: docsUrl8
           });
           continue;
         }
@@ -3489,7 +3913,7 @@ function kitModuleRule(opts) {
             ...b.line > 0 ? { line: b.line } : {},
             message: b.message,
             recommendation: opts.recommendation,
-            docsUrl: docsUrl7,
+            docsUrl: docsUrl8,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -3525,7 +3949,7 @@ function isSuppressed2(c, ruleId, line) {
   return (c.suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ruleId)));
 }
 function componentRule(opts) {
-  const docsUrl7 = docsUrlFor(opts.id);
+  const docsUrl8 = docsUrlFor(opts.id);
   const severity = opts.severity ?? "warning";
   return {
     id: opts.id,
@@ -3535,11 +3959,15 @@ function componentRule(opts) {
     scope: "component",
     rationale: opts.rationale,
     ...opts.fix ? { fix: opts.fix } : {},
+    ...opts.options ? { options: opts.options } : {},
     async check(ctx) {
       const out = [];
+      const compiled = compileOverrides(ctx.config);
       for (const c of ctx.components ?? []) {
-        if (!opts.applies(c)) continue;
-        const bad = opts.bad(c).filter((b) => !(b.line > 0 && isSuppressed2(c, opts.id, b.line)));
+        const o = resolveRuleOptions(opts.id, opts.options, ctx.config, { route: c.file, file: c.file }, compiled);
+        const recommendation8 = typeof opts.recommendation === "function" ? opts.recommendation(o) : opts.recommendation;
+        if (!opts.applies(c, o)) continue;
+        const bad = opts.bad(c, o).filter((b) => !(b.line > 0 && isSuppressed2(c, opts.id, b.line)));
         if (bad.length === 0) {
           out.push({
             id: opts.id,
@@ -3548,8 +3976,8 @@ function componentRule(opts) {
             detection: PASS3,
             route: c.file,
             message: opts.label,
-            recommendation: opts.recommendation,
-            docsUrl: docsUrl7
+            recommendation: recommendation8,
+            docsUrl: docsUrl8
           });
           continue;
         }
@@ -3563,8 +3991,8 @@ function componentRule(opts) {
             location: c.file,
             ...b.line > 0 ? { line: b.line } : {},
             message: b.message,
-            recommendation: opts.recommendation,
-            docsUrl: docsUrl7,
+            recommendation: recommendation8,
+            docsUrl: docsUrl8,
             ...opts.fix ? { fix: { ...opts.fix } } : {}
           });
         }
@@ -3694,6 +4122,25 @@ var correctnessNonreactiveBuiltinState = componentRule({
   }))
 });
 
+// src/rules/correctness/checkable-bind-value.ts
+var correctnessCheckableBindValue = componentRule({
+  id: "correctness/checkable-bind-value",
+  title: "bind:value on a checkable input",
+  category: "correctness",
+  severity: "warning",
+  label: "bind:checked / bind:group on checkable inputs",
+  recommendation: "Replace bind:value with bind:checked (single checkbox) or bind:group (checkbox list / radio group).",
+  rationale: "bind:value binds the DOM value property. A checkbox/radio's user interaction toggles checkedness, which bind:value never observes \u2014 the bound state is frozen at its initial value. Svelte's checked/grouped bindings (bind:checked, bind:group) are built for exactly this.",
+  fix: {
+    description: "For a single checkbox, replace bind:value={x} with bind:checked={x} (x becomes a boolean). For a checkbox list or radio group, replace bind:value={x} with bind:group={x} on every input sharing the group, keeping each input's static value attribute to identify the option."
+  },
+  applies: (c) => c.checkableBindValues.length > 0,
+  bad: (c) => c.checkableBindValues.map((v) => ({
+    line: v.line,
+    message: v.kind === "checkbox" ? "bind:value on a checkbox does not track its checked state \u2014 the bound value silently never updates when the user toggles it. Use bind:checked (single checkbox) or bind:group (checkbox list) instead." : "bind:value on a radio input does not track which option is selected \u2014 the bound value silently never updates when the user picks one. Use bind:group with a shared group variable across the radio inputs instead."
+  }))
+});
+
 // src/rules/correctness/orphan-effect.ts
 var correctnessOrphanEffect = componentRule({
   id: "correctness/orphan-effect",
@@ -3793,24 +4240,35 @@ var correctnessOrphanLifecycle = {
   }
 };
 
-// src/rules/correctness/server-browser-global.ts
+// src/rules/correctness/base-path-navigation.ts
 var PENALIZED5 = { presence: "none", value: "absent" };
 var PASS5 = { presence: "own", value: "static" };
-var ID2 = "correctness/server-browser-global";
+var ID2 = "correctness/base-path-navigation";
 var DOCS_URL2 = docsUrlFor(ID2);
-var LABEL2 = "Server-safe module code";
-var RECOMMENDATION2 = "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).";
-var moduleMessage = (name) => `${name} is accessed at module scope \u2014 it does not exist on the server, so importing this file crashes SSR with "${name} is not defined"`;
+var LABEL2 = "Base-path-aware navigation";
+var RECOMMENDATION2 = "Wrap root-relative paths in resolve() from '$app/paths' so they resolve against kit.paths.base.";
+var FIX7 = {
+  description: "Import { resolve } from '$app/paths' and wrap the path: href={resolve('/about')}, goto(resolve('/about')), redirect(303, resolve('/login'))."
+};
+function messageFor2(link) {
+  if (link.kind === "href") {
+    return `<a href="${link.path}"> is root-relative \u2014 under this project's kit.paths.base it points at the domain root, outside the app, and 404s in production. Use resolve('${link.path}') from '$app/paths'.`;
+  }
+  if (link.kind === "goto") {
+    return `goto('${link.path}') is root-relative \u2014 it navigates outside this project's kit.paths.base and 404s in production. Use goto(resolve('${link.path}')) with resolve from '$app/paths'.`;
+  }
+  return `redirect(\u2026, '${link.path}') is root-relative \u2014 the Location header points outside this project's kit.paths.base and 404s in production. Use resolve('${link.path}') from '$app/paths'.`;
+}
 function isSuppressed4(suppressions, line) {
   return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID2)));
 }
-function emitFile2(out, file, issues, suppressions) {
-  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed4(suppressions, b.line)));
+function emitFile2(out, file, links, suppressions) {
+  const bad = links.filter((l) => !(l.line > 0 && isSuppressed4(suppressions, l.line)));
   if (bad.length === 0) {
     out.push({
       id: ID2,
       category: "correctness",
-      severity: "critical",
+      severity: "warning",
       detection: PASS5,
       route: file,
       message: LABEL2,
@@ -3819,23 +4277,90 @@ function emitFile2(out, file, issues, suppressions) {
     });
     return;
   }
-  for (const b of bad) {
+  for (const l of bad) {
     out.push({
       id: ID2,
       category: "correctness",
-      severity: "critical",
+      severity: "warning",
       detection: PENALIZED5,
       route: file,
       location: file,
+      ...l.line > 0 ? { line: l.line } : {},
+      message: messageFor2(l),
+      recommendation: RECOMMENDATION2,
+      docsUrl: DOCS_URL2,
+      fix: { ...FIX7 }
+    });
+  }
+}
+var correctnessBasePathNavigation = {
+  id: ID2,
+  title: "Root-relative navigation under a base path",
+  category: "correctness",
+  severity: "warning",
+  scope: "component",
+  rationale: "A root-relative literal resolves against the domain root, not kit.paths.base, so navigation lands outside an app served from a sub-path. The break only appears once the app is deployed under its base \u2014 locally base is usually empty, so every such link works.",
+  fix: { ...FIX7 },
+  async check(ctx) {
+    if (!ctx.project.kitPathsBase) return [];
+    const out = [];
+    for (const c of ctx.components ?? []) {
+      const links = c.basePathLinks ?? [];
+      if (links.length === 0) continue;
+      emitFile2(out, c.file, links, c.suppressions);
+    }
+    for (const m of ctx.kitModules ?? []) {
+      const links = m.basePathLinks ?? [];
+      if (links.length === 0) continue;
+      emitFile2(out, m.file, links, m.suppressions);
+    }
+    return out;
+  }
+};
+
+// src/rules/correctness/server-browser-global.ts
+var PENALIZED6 = { presence: "none", value: "absent" };
+var PASS6 = { presence: "own", value: "static" };
+var ID3 = "correctness/server-browser-global";
+var DOCS_URL3 = docsUrlFor(ID3);
+var LABEL3 = "Server-safe module code";
+var RECOMMENDATION3 = "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).";
+var moduleMessage = (name) => `${name} is accessed at module scope \u2014 it does not exist on the server, so importing this file crashes SSR with "${name} is not defined"`;
+function isSuppressed5(suppressions, line) {
+  return (suppressions ?? []).some((s) => s.line === line && (!s.ruleIds || s.ruleIds.includes(ID3)));
+}
+function emitFile3(out, file, issues, suppressions) {
+  const bad = issues.filter((b) => !(b.line > 0 && isSuppressed5(suppressions, b.line)));
+  if (bad.length === 0) {
+    out.push({
+      id: ID3,
+      category: "correctness",
+      severity: "critical",
+      detection: PASS6,
+      route: file,
+      message: LABEL3,
+      recommendation: RECOMMENDATION3,
+      docsUrl: DOCS_URL3
+    });
+    return;
+  }
+  for (const b of bad) {
+    out.push({
+      id: ID3,
+      category: "correctness",
+      severity: "critical",
+      detection: PENALIZED6,
+      route: file,
+      location: file,
       ...b.line > 0 ? { line: b.line } : {},
       message: b.message,
-      recommendation: RECOMMENDATION2,
-      docsUrl: DOCS_URL2
+      recommendation: RECOMMENDATION3,
+      docsUrl: DOCS_URL3
     });
   }
 }
 var correctnessServerBrowserGlobal = {
-  id: ID2,
+  id: ID3,
   title: "Browser global in server module code",
   category: "correctness",
   severity: "critical",
@@ -3846,7 +4371,7 @@ var correctnessServerBrowserGlobal = {
     for (const c of ctx.components ?? []) {
       const refs = (c.browserGlobalRefs ?? []).filter((r) => r.context === "module");
       if (refs.length === 0) continue;
-      emitFile2(
+      emitFile3(
         out,
         c.file,
         refs.map((r) => ({ line: r.line, message: moduleMessage(r.name) })),
@@ -3856,7 +4381,7 @@ var correctnessServerBrowserGlobal = {
     for (const m of ctx.kitModules ?? []) {
       const refs = m.browserGlobalRefs ?? [];
       if (refs.length === 0) continue;
-      emitFile2(
+      emitFile3(
         out,
         m.file,
         refs.map((r) => ({
@@ -3972,35 +4497,151 @@ var securitySharedStateImport = kitModuleRule({
 });
 
 // src/rules/architecture/component-size.ts
-var MAX_LOC = 400;
+var MAX_LOC = 200;
 var architectureComponentSize = componentRule({
   id: "architecture/component-size",
   title: "Component size",
   category: "architecture",
   severity: "info",
   label: "Component size",
-  recommendation: `Split components over ${MAX_LOC} lines into smaller, focused pieces.`,
+  options: { max: { kind: "integer", default: MAX_LOC, min: 1 } },
+  recommendation: (o) => `Split components over ${intOption(o, "max", MAX_LOC)} lines into smaller, focused pieces.`,
   rationale: "A very large component is hard to read, test, and reuse, and is a common sign that several responsibilities should be split out.",
   applies: (c) => c.loc > 0,
   // skip unanalyzable files (loc 0 = read/parse failure), don't PASS them
-  bad: (c) => c.loc > MAX_LOC ? [{ line: 1, message: `Component is ${c.loc} lines (over ${MAX_LOC})` }] : []
+  bad: (c, o) => {
+    const max = intOption(o, "max", MAX_LOC);
+    return c.loc > max ? [{ line: 1, message: `Component is ${c.loc} lines (over ${max})` }] : [];
+  }
 });
 
 // src/rules/architecture/prop-count.ts
-var MAX_PROPS = 10;
+var MAX_PROPS = 6;
 var architecturePropCount = componentRule({
   id: "architecture/prop-count",
   title: "Prop count",
   category: "architecture",
   severity: "info",
   label: "Prop count",
-  recommendation: `Group related props into an object, or split the component, when it takes more than ${MAX_PROPS} props.`,
+  options: { max: { kind: "integer", default: MAX_PROPS, min: 1 } },
+  recommendation: (o) => `Group related props into an object, or split the component, when it takes more than ${intOption(o, "max", MAX_PROPS)} props.`,
   rationale: "A component taking many props is usually doing too much; grouping or splitting keeps its API understandable.",
   applies: (c) => c.propCount > 0,
   // only components whose props we could count
-  bad: (c) => c.propCount > MAX_PROPS ? [{ line: 1, message: `Component takes ${c.propCount} props (over ${MAX_PROPS})` }] : []
+  bad: (c, o) => {
+    const max = intOption(o, "max", MAX_PROPS);
+    return c.propCount > max ? [{ line: 1, message: `Component takes ${c.propCount} props (over ${max})` }] : [];
+  }
 });
 
+// src/rules/architecture/private-scope-import.ts
+var docsUrl7 = docsUrlFor("architecture/private-scope-import");
+var recommendation7 = "Move the unit to the directory shared by all of its importers, or import it only from inside its own scope.";
+var OPTIONS2 = { scopes: { kind: "string-list", default: [] } };
+function ancestorDirs(file) {
+  const segments = file.split("/");
+  const out = [];
+  for (let i = segments.length - 1; i > 0; i--) out.push(segments.slice(0, i).join("/"));
+  return out;
+}
+function privateScopeOf(target, patterns) {
+  for (const dir of ancestorDirs(target)) {
+    if (!patterns.some((p) => p.test(dir))) continue;
+    const cut = dir.lastIndexOf("/");
+    return cut === -1 ? "" : dir.slice(0, cut);
+  }
+  return void 0;
+}
+function isInside(file, boundary) {
+  return boundary === "" || file.startsWith(`${boundary}/`);
+}
+var architecturePrivateScopeImport = {
+  id: "architecture/private-scope-import",
+  title: "Private-scope import",
+  category: "architecture",
+  severity: "info",
+  scope: "component",
+  rationale: "A unit placed inside a private directory is written for one owner; importing it from elsewhere couples two parts of the tree that were meant to move independently, and the unit belongs higher up instead.",
+  fix: {
+    description: "Move this unit out of its private scope, to the directory shared by all of its importers, and update this import."
+  },
+  options: OPTIONS2,
+  async check(ctx) {
+    const out = [];
+    const compiled = compileOverrides(ctx.config);
+    const patternCache = /* @__PURE__ */ new Map();
+    const compileScopes = (scopes) => {
+      const key = JSON.stringify(scopes);
+      let patterns = patternCache.get(key);
+      if (patterns === void 0) {
+        patterns = scopes.map((scope) => {
+          const marker = scope.endsWith("/**") ? scope.slice(0, -3) : scope;
+          return routeGlobToRegExp(marker);
+        });
+        patternCache.set(key, patterns);
+      }
+      return patterns;
+    };
+    for (const c of ctx.components ?? []) {
+      const o = resolveRuleOptions(
+        "architecture/private-scope-import",
+        OPTIONS2,
+        ctx.config,
+        { route: c.file, file: c.file },
+        compiled
+      );
+      const scopes = listOption(o, "scopes");
+      if (scopes.length === 0) continue;
+      const patterns = compileScopes(scopes);
+      const spans = c.importSpans ?? c.imports.map((source) => ({ source, line: 0 }));
+      let sawScopedImport = false;
+      const violations = [];
+      for (const { source, line } of spans) {
+        const target = resolveRepoLocalPath(source, c.file);
+        if (target === void 0) continue;
+        const boundary = privateScopeOf(target, patterns);
+        if (boundary === void 0) continue;
+        sawScopedImport = true;
+        if (isInside(c.file, boundary)) continue;
+        violations.push({ line, message: `${target} is private to ${boundary}` });
+      }
+      if (!sawScopedImport) continue;
+      const visible = violations.filter(
+        (v) => !(v.line > 0 && isSuppressed2(c, "architecture/private-scope-import", v.line))
+      );
+      if (visible.length === 0) {
+        out.push({
+          id: "architecture/private-scope-import",
+          category: "architecture",
+          severity: "info",
+          detection: { presence: "own", value: "static" },
+          route: c.file,
+          message: "No private-scope imports",
+          recommendation: recommendation7,
+          docsUrl: docsUrl7
+        });
+        continue;
+      }
+      for (const v of visible) {
+        out.push({
+          id: "architecture/private-scope-import",
+          category: "architecture",
+          severity: "info",
+          detection: { presence: "none", value: "absent" },
+          route: c.file,
+          location: c.file,
+          ...v.line > 0 ? { line: v.line } : {},
+          message: v.message,
+          recommendation: recommendation7,
+          docsUrl: docsUrl7,
+          fix: { ...architecturePrivateScopeImport.fix }
+        });
+      }
+    }
+    return out;
+  }
+};
+
 // src/rules/perf/heavy-import.ts
 var HEAVY_PACKAGES = {
   lodash: "import a submodule (lodash/debounce) or use lodash-es for tree-shaking",
@@ -4014,18 +4655,20 @@ var performanceHeavyImport = componentRule({
   label: "No heavy imports",
   recommendation: "Import a submodule or switch to a lighter, tree-shakeable alternative.",
   rationale: "Importing a large, non-tree-shakeable package pulls its whole weight into the bundle even when only a fraction is used, slowing load.",
+  options: { packages: { kind: "string-map", default: HEAVY_PACKAGES } },
   // ComponentFacts is a public @svelte-vitals/core export — an external caller compiled
   // against an older version may still construct one without importSpans. Fall back to the
   // line-less `imports` (line: 0, the pre-fix behavior) instead of crashing on `undefined`.
   applies: (c) => (c.importSpans ?? c.imports).length > 0,
-  bad: (c) => {
+  bad: (c, o) => {
+    const packages = mapOption(o, "packages");
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     const spans = c.importSpans ?? c.imports.map((source) => ({ source, line: 0 }));
     for (const { source: src, line } of spans) {
-      if (!Object.hasOwn(HEAVY_PACKAGES, src) || seen.has(src)) continue;
+      if (!Object.hasOwn(packages, src) || seen.has(src)) continue;
       seen.add(src);
-      out.push({ line, message: `Heavy import "${src}" \u2014 ${HEAVY_PACKAGES[src]}` });
+      out.push({ line, message: `Heavy import "${src}" \u2014 ${packages[src]}` });
     }
     return out;
   }
@@ -4055,13 +4698,13 @@ var performanceNamespaceImport = componentRule({
 });
 
 // src/rules/perf/minify-disabled.ts
-var PENALIZED6 = { presence: "none", value: "absent" };
+var PENALIZED7 = { presence: "none", value: "absent" };
 var MINIFY_DISABLED_FIX = {
   description: "Remove the minify: false override from vite.config (Vite minifies with esbuild by default), or scope it to non-production builds.",
   snippet: "export default defineConfig({\n  build: {\n    minify: 'esbuild'\n  }\n});",
   lang: "ts"
 };
-var RECOMMENDATION3 = "Remove build.minify: false from vite.config, or scope it to non-production builds if it is intentional.";
+var RECOMMENDATION4 = "Remove build.minify: false from vite.config, or scope it to non-production builds if it is intentional.";
 var performanceMinifyDisabled = {
   id: "performance/minify-disabled",
   title: "Minification disabled",
@@ -4079,11 +4722,11 @@ var performanceMinifyDisabled = {
         id: "performance/minify-disabled",
         category: "performance",
         severity: "warning",
-        detection: PENALIZED6,
+        detection: PENALIZED7,
         ...hit.file !== void 0 ? { location: hit.file } : {},
         ...hit.line !== void 0 ? { line: hit.line } : {},
         message: "JS/CSS minification is disabled (build.minify: false) \u2014 production bundles ship unminified and several times larger." + provenance,
-        recommendation: RECOMMENDATION3,
+        recommendation: RECOMMENDATION4,
         docsUrl: docsUrlFor("performance/minify-disabled"),
         fix: { ...MINIFY_DISABLED_FIX }
       }
@@ -4197,8 +4840,10 @@ var allRules = [
   correctnessPropMutation,
   correctnessStalePropDerivation,
   correctnessNonreactiveBuiltinState,
+  correctnessCheckableBindValue,
   correctnessOrphanEffect,
   correctnessOrphanLifecycle,
+  correctnessBasePathNavigation,
   correctnessServerBrowserGlobal,
   correctnessInstanceBrowserGlobal,
   securityRawHtml,
@@ -4208,6 +4853,7 @@ var allRules = [
   securitySharedStateImport,
   architectureComponentSize,
   architecturePropCount,
+  architecturePrivateScopeImport,
   performanceHeavyImport,
   performanceNamespaceImport,
   performanceMinifyDisabled,
@@ -4215,6 +4861,15 @@ var allRules = [
   performanceSequentialAwaits,
   performanceStateRaw
 ];
+function optionInfos(spec) {
+  return Object.entries(spec).map(([name, s]) => ({
+    name,
+    kind: s.kind,
+    default: s.default,
+    ...s.kind === "integer" && s.min !== void 0 ? { min: s.min } : {},
+    ...s.kind === "integer" && s.max !== void 0 ? { max: s.max } : {}
+  }));
+}
 function explainRule(id) {
   const rule = allRules.find((r) => r.id === id);
   if (!rule) return void 0;
@@ -4225,7 +4880,8 @@ function explainRule(id) {
     severity: rule.severity,
     rationale: rule.rationale,
     docsUrl: docsUrlFor(rule.id),
-    ...rule.fix ? { fix: rule.fix } : {}
+    ...rule.fix ? { fix: rule.fix } : {},
+    ...rule.options ? { options: optionInfos(rule.options) } : {}
   };
 }
 
@@ -5444,60 +6100,21 @@ function safeHref(url) {
   const normalized = url.replace(/\s/g, "").toLowerCase();
   return /^https?:\/\//.test(normalized) ? url : null;
 }
-
-// src/config-apply.ts
-function selectRules(rules, config) {
-  return rules.filter((rule) => config.rules[rule.id] !== "off");
-}
-function applyRuleSeverities(results, config) {
-  return results.map((result) => {
-    const setting = config.rules[result.id];
-    return setting && setting !== "off" ? { ...result, severity: setting } : result;
-  });
-}
-function routeGlobToRegExp(pattern) {
-  const body = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").split("\0").join(".*");
-  const source = body.endsWith("/.*") ? `${body.slice(0, -3)}(/.*)?` : body;
-  return new RegExp(`^${source}$`);
-}
-function toPatterns(globs) {
-  if (globs === void 0) return [];
-  return (Array.isArray(globs) ? globs : [globs]).map(routeGlobToRegExp);
-}
-function applyOverrides(results, config) {
-  const overrides = config.overrides;
-  if (!overrides || overrides.length === 0) return results;
-  const compiled = overrides.map((o) => ({
-    routes: toPatterns(o.route),
-    files: toPatterns(o.files),
-    rules: o.rules
-  }));
-  const out = [];
-  for (const result of results) {
-    const { route, location } = result;
-    let setting;
-    for (const o of compiled) {
-      const matched = route !== void 0 && o.routes.some((p) => p.test(route)) || location !== void 0 && o.files.some((p) => p.test(location));
-      if (!matched) continue;
-      const s = o.rules[result.id] ?? o.rules[result.category ?? "seo"];
-      if (s !== void 0) setting = s;
-    }
-    if (setting === void 0) out.push(result);
-    else if (setting !== "off") out.push({ ...result, severity: setting });
-  }
-  return out;
-}
 export {
   APP_SCRIPT,
   APP_STYLE,
   BAND_COLOR,
+  CATEGORIES,
   CHILD_NODE_KEYS,
   ROBOTS_SOURCE_PATHS,
   SITEMAP_SOURCE_PATHS,
+  SVELTE_CONFIG_FILES,
+  VITE_CONFIG_FILES,
   allRules,
   applyOverrides,
   applyRuleSeverities,
   architectureComponentSize,
+  architecturePrivateScopeImport,
   architecturePropCount,
   attrText,
   attrTextOf,
@@ -5508,8 +6125,11 @@ export {
   classify,
   collectComponentFacts,
   collectKitModuleFacts,
+  compileOverrides,
   computeHealth,
   computeScore,
+  correctnessBasePathNavigation,
+  correctnessCheckableBindValue,
   correctnessEachIndexKey,
   correctnessEachKey,
   correctnessEffectAsDerived,
@@ -5532,6 +6152,8 @@ export {
   escapeHtml,
   explainRule,
   findAttr,
+  findKitPathsBaseInSvelteConfig,
+  findKitPathsBaseInViteConfig,
   findMinifyDisabled,
   formatAgentReport,
   formatConsoleReport,
@@ -5543,10 +6165,14 @@ export {
   hasFailureAtOrAbove,
   headTagRule,
   imageRule,
+  intOption,
   isPenalized,
   lineOf,
   linkRule,
+  listOption,
+  mapOption,
   noColorPalette,
+  overrideMatches,
   parseComponentFacts,
   parseKitModuleFacts,
   performanceFontPreloadCrossorigin,
@@ -5564,6 +6190,8 @@ export {
   performanceSequentialAwaits,
   performanceStateRaw,
   renderAppShell,
+  resolveKitPathsBase,
+  resolveRuleOptions,
   resolveRunesModuleSpecifier,
   runRules,
   safeHref,
@@ -5607,7 +6235,12 @@ export {
   seoTitlePresence,
   seoTwitterCard,
   seoViewport,
+  settingOptions,
+  settingSeverity,
+  shouldSkipRangeCheck,
   summarize,
   textFromNodes,
+  validateRuleOptions,
+  validateRuleSetting,
   valueFromNodes
 };