npm - @svelte-vitals/core - Versions diffs - 0.43.1 → 0.45.0 - Mend

@svelte-vitals/core 0.43.1 → 0.45.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md +12 -1
package/dist/chunk-BCJZO532.js +7250 -0
package/dist/index-DbUx4tlY.d.ts +1154 -0
package/dist/index.d.ts +1 -1953
package/dist/index.js +9 -8473
package/dist/internal.d.ts +867 -0
package/dist/internal.js +1732 -0
package/package.json +10 -5

package/dist/index.d.ts CHANGED Viewed

@@ -1,1953 +1 @@
-import { AST } from 'svelte/compiler';
-/**
- * Core type definitions shared across modes. This module is pure: no I/O, no
- * `node:` imports, no runtime-specific globals (design §8).
- */
-type Severity = 'critical' | 'warning' | 'info';
-/** Where a head tag is set, relative to the route being evaluated (design §4). */
-type Presence = 'own' | 'inherited' | 'none';
-/** How a tag's value is determined (design §4). */
-type Value = 'static' | 'dynamic' | 'absent';
-/**
- * Two-axis detection result. Kept independent so combinations such as
- * "inherited + dynamic" remain expressible (design §4).
- */
-interface Detection {
-    presence: Presence;
-    value: Value;
-}
-/**
- * One compiled SvelteKit alias entry, in the order Kit builds them (`get_config_aliases` in
- * `@sveltejs/kit/src/exports/vite/utils.js`): `$lib` first, then `kit.alias` in declaration
- * order. Resolution takes the FIRST matching entry, exactly as Vite's alias plugin does, so
- * **position is precedence** — the list is never sorted and a longer `find` never wins on
- * length alone.
- */
-interface KitAlias {
-    /** The alias key, with any trailing `/*` removed. */
-    find: string;
-    /**
-     * The project-relative target: posixified, with any trailing `/*` and any trailing slashes
-     * removed. `null` when the config's value is not a string literal — such an entry still
-     * matches (holding its position and its mode) but resolves to undefined, so a specifier we
-     * cannot resolve stays unresolved instead of falling through to a later entry.
-     */
-    replacement: string | null;
-    /**
-     * How `find` matches a specifier, mirroring Kit's three compiled entry shapes:
-     * - `prefix` — `spec === find` or `spec.startsWith(find + '/')`; a plain key.
-     * - `contents` — `spec.startsWith(find + '/')` only; from a `key/*` key, which Kit
-     *   documents as matching "the contents of a directory, not the directory itself".
-     * - `exact` — `spec === find` only; a plain key whose `key/*` form is ALSO declared, which
-     *   is how Kit stops the plain key from swallowing the nested specifiers.
-     */
-    match: 'prefix' | 'contents' | 'exact';
-}
-/** Project-wide facts precomputed by the runtime layer for project-scope rules (design §10). */
-interface Project {
-    hasRobotsTxt: boolean;
-    hasSitemap: boolean;
-    /** <html lang> from app.html: presence 'own' when the attribute exists ('none' otherwise); value 'static' if non-empty, 'absent' if empty. */
-    htmlLang: Detection;
-    /** Whether the static static/robots.txt references a sitemap (`Sitemap:` line). Undefined for a +server endpoint / absent / unreadable. */
-    robotsReferencesSitemap?: boolean;
-    /**
-     * Set when the Vite config disables minification for production builds (performance/minify-disabled).
-     * `file` is the config path relative to the analyzed root (posix, may start with `../`
-     * in monorepos); unset for inline programmatic configs. `line` is 1-based and set only
-     * when the literal `minify: false` was located in that file; unset when the value was
-     * resolved at build time (plugin/conditional config).
-     */
-    viteMinifyDisabled?: {
-        file?: string;
-        line?: number;
-    };
-    /**
-     * Set when the project configures a non-empty `kit.paths.base` — read from the `sveltekit()`
-     * Vite plugin config, else `svelte.config.{js,ts}` (correctness/base-path-navigation).
-     * `value` is the literal base when statically resolvable, unset when the config computes it
-     * (e.g. `dev ? '' : '/repo'`). `file` is the config path relative to the analyzed root (posix).
-     * Absent means the app is served at the root — the rule stays silent.
-     */
-    kitPathsBase?: {
-        value?: string;
-        file: string;
-    };
-    /**
-     * The project's compiled SvelteKit alias entries, in Kit's own order (`$lib` first), read from
-     * `svelte.config.{js,ts}`. Absent means no config was read — resolution then falls back to
-     * `$lib` → `src/lib`, which is what this analyzer assumed unconditionally before. A collected
-     * list is never empty: `$lib` is always prepended.
-     */
-    kitAliases?: KitAlias[];
-    /**
-     * Whether `src/app.html` opens with `<!doctype html>` (a11y/doctype). Set from the same read
-     * as `htmlLang`; absent when the file wasn't read (missing or unreadable) — the rule stays
-     * silent then, like `viteMinifyDisabled`'s absent convention.
-     */
-    appHtmlDoctype?: boolean;
-    /**
-     * Literal `id` attributes in `src/app.html`, from the same read as `htmlLang`. The shell is part
-     * of every rendered document, so its ids satisfy a route's id references (a11y/no-missing-id-ref);
-     * absent when the file wasn't read.
-     */
-    appHtmlIds?: string[];
-}
-declare const defaultProject: Project;
-/** A concrete, agent-actionable remediation for a finding (design §10, issue #18). */
-interface Fix {
-    /** One-line imperative instruction, e.g. 'Add a <meta name="description"> inside <svelte:head>.' */
-    description: string;
-    /** Concrete code to insert or a file's contents to create. */
-    snippet?: string;
-    /** Markdown fenced-code language for `snippet` (default 'svelte'). */
-    lang?: string;
-}
-/** A single rule finding for one route (or the whole project). */
-interface Result {
-    /** Rule id, e.g. 'seo/title-presence'. */
-    id: string;
-    severity: Severity;
-    detection: Detection;
-    /** Route path, e.g. '/blog/[slug]'. Omitted for project-scoped rules. */
-    route?: string;
-    /** Source location, e.g. 'src/routes/blog/[slug]/+page.svelte'. */
-    location?: string;
-    message: string;
-    recommendation?: string;
-    docsUrl?: string;
-    /** Agent-actionable remediation (issue #18). */
-    fix?: Fix;
-    /** Vitals category this finding belongs to (default 'seo' when absent). */
-    category?: Category;
-    /** 1-based source line for element-level findings (e.g. a specific <img>). */
-    line?: number;
-}
-type Scope = 'route' | 'project' | 'component';
-type Category = 'seo' | 'performance' | 'correctness' | 'security' | 'architecture' | 'a11y';
-/**
- * Every category, as a runtime list — for validating a user-supplied category
- * name and naming the known ones in the error. One definition so a category
- * added to `Category` can't be accepted by one validator and rejected by
- * another. Not an ordering: reporters keep their own display order.
- */
-declare const CATEGORIES: readonly Category[];
-/** How dynamic (`{data.title}`) values are treated by scoring (design §4, §12). */
-type TreatDynamicAs = 'pass' | 'warn' | 'fail';
-/** Resolved option values handed to a rule at check time. */
-type RuleOptions = Record<string, unknown>;
-/**
- * Object form of a rule setting. `severity` omitted keeps the rule's built-in
- * severity — the common case when only a threshold is being moved.
- * `{ severity: 'off', … }` disables the rule and any `options` beside it are
- * inert (equivalent to the bare `'off'` string, not an error).
- */
-interface RuleSettingObject {
-    severity?: Severity | 'off';
-    options?: RuleOptions;
-}
-/** Per-rule override: disable, change severity, and/or set options. */
-type RuleSetting = 'off' | Severity | RuleSettingObject;
-/**
- * Scoped rule override (design 2026-07-18), applied to results after analysis.
- * An entry matches a finding when any `route` glob matches its route id or any
- * `files` glob matches its source location; at least one of the two must be
- * set. Glob syntax: `*` matches within a segment, `**` across segments, a
- * trailing `/**` also matches the bare prefix, and all other characters
- * (including SvelteKit's `(`, `)`, `[`, `]`) are literal.
- */
-interface RuleOverride {
-    /**
-     * Route-id glob(s), e.g. '/admin/**'. Note route ids drop `(group)` segments
-     * (`src/routes/(app)/dashboard` reports as '/dashboard') — target a group
-     * via `files` instead.
-     */
-    route?: string | string[];
-    /** Source-path glob(s) matched against a finding's location, e.g. 'src/routes/(app)/**'. */
-    files?: string | string[];
-    /** Keys are rule ids ('seo/title-presence') or category names ('seo'). Rule id beats category within an entry. */
-    rules: Record<string, RuleSetting>;
-}
-interface Config {
-    treatDynamicAs: TreatDynamicAs;
-    /** Component names treated as meta sources of unknown content (design §11 layer 4). */
-    metaComponents: string[];
-    /** Per-rule overrides keyed by rule id (design §6). */
-    rules: Record<string, RuleSetting>;
-    /** Minimum severity that fails the run / CI (design §6). */
-    failOn: Severity;
-    /** Per-category weights for the combined Health score (default: equal, 1 each) (#10). */
-    weights?: Partial<Record<Category, number>>;
-    /** Route-/file-scoped rule overrides, applied to results after analysis (later entries win). */
-    overrides?: RuleOverride[];
-}
-declare const defaultConfig: Config;
-/** Merge user config over defaults. Identity helper for config files (design §6). */
-declare function defineConfig(config?: Partial<Config>): Config;
-/**
- * Runtime abstraction (design §8). Core defines only the interface; concrete
- * adapters (Node / Deno / Bun) live in the CLI package and are the only place
- * allowed to touch runtime-specific I/O APIs. Providers and rules use this
- * interface exclusively, which keeps them runtime-agnostic and lets tests inject
- * an in-memory implementation.
- */
-interface Runtime {
-    /** Read a UTF-8 text file. Rejects if the file does not exist. */
-    readFile(path: string): Promise<string>;
-    /** Whether a path exists. */
-    exists(path: string): Promise<boolean>;
-    /**
-     * Paths matching `pattern`, relative to `cwd`.
-     *
-     * **Dot files and dot directories are excluded**, and an adapter must keep it that way: the
-     * directory-shaped Architecture rules derive their directory set from these paths, and one of them
-     * enumerates a parent's children exhaustively, so a `.server/` appearing here would be reported as
-     * an undeclared name. Both shipped adapters pass `dot: false`.
-     *
-     * **Every returned path is a file, never a directory**, and an adapter must keep that true too:
-     * `architecture/reserved-directory-names`' unit test takes a directory's immediate children from
-     * this same inventory and asks whether one of them is a file named after the directory, so an
-     * adapter that let a directory through here would let a bare `Card/Card` satisfy that test as if it
-     * were an entry file. Both shipped adapters get this for free from their glob library's default,
-     * which returns files only unless asked to include directories.
-     */
-    glob(pattern: string, cwd: string): Promise<string[]>;
-    /** Join path segments without depending on `node:path`. */
-    join(...parts: string[]): string;
-}
-/**
- * A normalized head tag. The mode-independent boundary (design §8): the static
- * SourceHeadProvider (CLI, via the runtime-abstracted `HeadProvider` below) and
- * the rendered collector (`@svelte-vitals/vite`, build-time Node) both emit
- * these, so rules never need to know which mode produced them.
- */
-interface HeadTag {
-    kind: 'title' | 'meta' | 'link' | 'jsonld' | 'script';
-    /** <meta name="...">. */
-    name?: string;
-    /** <meta property="..."> (e.g. og:image). */
-    property?: string;
-    /** <link rel="...">. */
-    rel?: string;
-    /** <link as="..."> keyword (e.g. 'font') when statically literal; undefined when absent or dynamically bound. */
-    as?: string;
-    /** True when a <link> has an `as` attribute at all (literal or dynamic). Distinguishes "no as" from "dynamic as". */
-    hasAs?: boolean;
-    /** True when a <link> has a `crossorigin` attribute (presence only; value is irrelevant to the checks). */
-    hasCrossorigin?: boolean;
-    /** True when a <meta name="robots"> literal content contains `noindex`/`none`. Undefined when dynamic or absent. */
-    noindex?: boolean;
-    /** Literal `<script type="application/ld+json">` content, set only when the script is static. Undefined when dynamic. */
-    jsonld?: string;
-    /** Literal visible text of a static <title> or <meta name="description"> content, set only when static. Undefined when dynamic. */
-    text?: string;
-    /** Literal `hreflang` of a `<link rel="alternate">` (e.g. 'en', 'en-US', 'x-default'). Undefined when dynamic/absent. */
-    hreflang?: string;
-    /** Literal href (link) / src (script) URL when static — used for third-party origin analysis (performance/preconnect). */
-    href?: string;
-    /** True for a render-blocking `<script src>` in <head> (no defer/async/module) (performance/render-blocking-script). */
-    blocking?: boolean;
-    /** Where this tag was set relative to the route. Never 'none' (absence = no tag). */
-    presence: Exclude<Presence, 'none'>;
-    /** Whether the tag's value is static/dynamic/absent (design §4). */
-    value: Value;
-    /** Source file the tag came from (static mode only). */
-    file?: string;
-}
-/** Resolved effective head for a single route (design §8). */
-interface ResolvedHead {
-    /** Route path, e.g. '/blog/[slug]'. */
-    route: string;
-    /** Which provider produced this. */
-    source: 'static' | 'rendered';
-    /** Effective head tags after layout-chain composition. */
-    tags: HeadTag[];
-    /** Representative source file for the route (used for issue locations). */
-    file: string;
-}
-/**
- * Supplies ResolvedHead[] for a project through the runtime abstraction. The
- * static (CLI) mode implements this; rendered mode reads prerendered HTML at
- * build time and emits the same ResolvedHead[] without the runtime indirection.
- */
-interface HeadProvider {
-    mode: 'static' | 'rendered';
-    collect(rt: Runtime, cwd: string, config?: Config): Promise<ResolvedHead[]>;
-}
-/**
- * A normalized <img> occurrence — the mode-independent boundary for Performance
- * rules (mirrors head.ts). Attribute presence only: a dynamically-bound attribute
- * (width={w}) still counts as present, so dynamic values are never flagged.
- */
-interface ImageInfo {
-    hasWidth: boolean;
-    hasHeight: boolean;
-    hasLoading: boolean;
-    /** True when the <img> has an `alt` attribute at all (incl. empty `alt=""` decorative; seo/image-alt). */
-    hasAlt: boolean;
-    /** True when the <img> has a literal `loading="lazy"` (performance/lcp-image). Dynamic/spread → false. */
-    lazy: boolean;
-    /** True when the <img> has a `srcset` attribute (performance/responsive-image). */
-    hasSrcset: boolean;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-    /** Source file the <img> came from. */
-    file: string;
-}
-/** Resolved <img> elements for a single route (page + layout chain). */
-interface ResolvedImages {
-    route: string;
-    images: ImageInfo[];
-}
-/**
- * A normalized page-body heading occurrence — the mode-independent boundary for
- * the heading-hierarchy rule (mirrors images.ts). Both providers collect these
- * so seo/single-h1 never needs to know which mode produced them.
- */
-interface HeadingInfo {
-    /** Heading level 1–6 (the `n` in <hn>). */
-    level: number;
-    /** 1-based source line, or 0 if unknown (rendered mode does not track lines). */
-    line: number;
-    /** Source file the heading came from. */
-    file: string;
-}
-/** Resolved page-body headings for a single route (page + layout chain). */
-interface ResolvedHeadings {
-    route: string;
-    headings: HeadingInfo[];
-    /**
-     * Headings found in child components rendered (transitively) by this route's
-     * chain files — source mode only; absent in rendered mode. Kept separate from
-     * `headings` because their position in document order is unknown: safe for
-     * counting (seo/single-h1), unusable for outline order (seo/heading-level-skip).
-     */
-    componentHeadings?: HeadingInfo[];
-}
-/** One step of a template branch address: which exclusive block, and which arm of it. */
-interface BranchStep {
-    /** index of the {#if}/{#await} block among its file's blocks (document order) */
-    group: number;
-    /** branch index within the group (if: 0..n consequent→else; await: 0=pending,1=then,2=catch) */
-    branch: number;
-}
-/** Where a folded occurrence sits, for the finding location. */
-interface A11yOccurrenceInfo {
-    file: string;
-    line: number;
-}
-/**
- * Route-scoped a11y facts, the mode-independent boundary for the landmark/id rules
- * (mirrors headings.ts). Source mode composes the layout chain plus its resolved
- * components; rendered mode reads the prerendered document.
- */
-interface ResolvedA11y {
-    route: string;
-    /** representatives per landmark kind after the branch-aware fold ('main' | 'banner' | 'contentinfo' | 'complementary') */
-    landmarks: Record<string, A11yOccurrenceInfo[]>;
-    /** landmark occurrences nested inside another landmark after composition */
-    nestedLandmarks: {
-        kind: string;
-        within: string;
-        file: string;
-        line: number;
-    }[];
-    /** representatives per literal id */
-    ids: Record<string, A11yOccurrenceInfo[]>;
-    /** literal id references */
-    idRefs: {
-        id: string;
-        attr: string;
-        file: string;
-        line: number;
-    }[];
-    /** optimistic candidates: every literal id anywhere (all branches, each/snippet bodies, components, app.html) */
-    idCandidates: string[];
-    /** closed world holds: every component resolved, no depth truncation, no {@html}/spread, no dynamic id */
-    fullyResolved: boolean;
-}
-type Foldable = {
-    key: string;
-    path: BranchStep[];
-    repeatable: boolean;
-};
-/**
- * Branch-aware occurrence fold (design "Control-flow semantics"): within a branch
- * occurrences sum, across the arms of one exclusive block the arm with the most
- * occurrences wins (tie → lowest branch index) and ITS occurrences are the group's
- * representatives — so a caller's count is always `list.length`, with a location per
- * representative. `{#each}`/`{#snippet}` occurrences render 0..N times and drop out.
- * The max is per key: there is no scalar total to maximize.
- */
-declare function foldOccurrences<T extends Foldable>(nodes: T[]): Map<string, T[]>;
-/**
- * Decode a fragment identifier the way navigation does before matching an element id
- * (`href="#caf%C3%A9"` targets `id="café"`). Malformed escapes are kept verbatim —
- * the browser would also fail to decode them, so the raw text is the comparable form.
- */
-declare function decodeFragmentId(fragment: string): string;
-/** Whitespace-split tokens of a (possibly undefined) literal attribute value. */
-declare function splitTokens(value: string | undefined): string[];
-/** Explicit `role` values that map to the landmark kinds the route rules inspect. */
-declare const LANDMARK_ROLES: ReadonlySet<string>;
-/** Attributes whose (whitespace-tokenized) values reference element ids. */
-declare const IDREF_ATTRS: readonly string[];
-/**
- * Whether a decoded URL fragment is HTML's "top of the document" indicator: `#top` (ASCII
- * case-insensitive) scrolls to the top when no element has that id, so it is never a missing
- * reference. Compare AFTER percent-decoding — `#%74op` navigates identically to `#top`.
- */
-declare function isTopFragment(id: string): boolean;
-/**
- * Component-body facts for the Correctness category — the source-analysis boundary
- * (mirrors images.ts / headings.ts). Collected by the static (CLI) provider only;
- * the rendered provider can't see reactivity, so correctness rules no-op there.
- */
-/** An `{#each}` block in a component template. */
-interface EachBlockFact {
-    /** True when the block has a key, e.g. `{#each items as item (item.id)}`. */
-    hasKey: boolean;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-    /** Set when the block's key expression is its index binding or a trivial coercion of it — `(i)`, `(String(i))`, `(Number(i))`, `` (`${i}`) ``, `(i.toString())`, `(i + '')` — correctness/each-index-key. */
-    indexKey?: boolean;
-}
-/** An `$effect(...)` / `$effect.pre(...)` call in a component's instance script. */
-interface EffectFact {
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-    /** True when the effect body only assigns to `$state` variables (the "use $derived" smell). */
-    assignsOnlyState: boolean;
-    /** True when this $effect has a NON-EMPTY body that reads no reactive value and makes no bare call — it never re-runs, so it should be onMount (correctness/effect-as-onmount). */
-    mountOnly: boolean;
-}
-/** A `$effect` guaranteed to run outside component initialisation — it throws `effect_orphan` at runtime (correctness/orphan-effect). */
-interface OrphanEffectFact {
-    /** 1-based source line, or 0 if unknown. For 'constructor-instantiated', the module-scope `new` site. */
-    line: number;
-    /** 'top-level' = runs at module evaluation; 'constructor-instantiated' = module-scope `new` of a same-file class whose constructor creates a bare effect. */
-    kind: 'top-level' | 'constructor-instantiated';
-    /** Class name when kind is 'constructor-instantiated' (used in the finding message). */
-    className?: string;
-}
-/** A svelte lifecycle/context call guaranteed to run outside component initialisation — it throws `lifecycle_outside_component` at runtime (correctness/orphan-lifecycle). */
-interface OrphanLifecycleCallFact {
-    /** Canonical svelte export name (alias-resolved), e.g. 'onMount'. */
-    name: string;
-    /** 1-based source line, or 0 if unknown. For 'constructor-instantiated', the module-scope `new` site. */
-    line: number;
-    /** 'top-level' = runs at module evaluation; 'constructor-instantiated' = module-scope `new` of a same-file class whose constructor calls a tracked function. */
-    kind: 'top-level' | 'constructor-instantiated';
-    /** Class name when kind is 'constructor-instantiated' (used in the finding message). */
-    className?: string;
-}
-/** A browser-only global read in code that runs on the server — SSR crashes with "<name> is not defined" (correctness/server-browser-global, correctness/instance-browser-global). */
-interface BrowserGlobalRefFact {
-    /** The global's name, e.g. 'window'. */
-    name: string;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-    /** 'module' = module evaluation (script module / runes module — correctness/server-browser-global); 'instance' = component-init top level (runs on the server during SSR — correctness/instance-browser-global). */
-    context: 'module' | 'instance';
-}
-/** A flagged source position in a component (e.g. an `{@html}` tag or a `javascript:` URL). */
-interface SourceSpan {
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-}
-/** An inline `svelte-vitals-disable-next-line` directive found in the component's source (issue #92). */
-interface SuppressionDirective {
-    /** 1-based line the directive suppresses (the line immediately after the comment). */
-    line: number;
-    /** Rule ids suppressed on that line; undefined = suppress every rule on that line. */
-    ruleIds?: string[];
-}
-/** An `<input type="checkbox">` / `<input type="radio">` element carrying a `bind:value`
- *  directive — `bind:value` observes the DOM `value` property, which checkbox/radio
- *  interaction never changes, so the bound state silently never updates
- *  (correctness/checkable-bind-value). */
-interface CheckableBindValueFact {
-    /** Which checkable input type was flagged — selects the message wording. */
-    kind: 'checkbox' | 'radio';
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-}
-/** A root-relative navigation literal — broken when the app is served under `kit.paths.base`
- *  (correctness/base-path-navigation). Shared by the component and Kit-module channels. */
-interface BasePathLinkFact {
-    /** Which navigation surface it was written on — selects the message wording. */
-    kind: 'href' | 'goto' | 'redirect';
-    /** The literal path as written, e.g. '/about'. */
-    path: string;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-}
-/** An interactive element (e.g. `<button>`) found nested inside another interactive
- *  container (e.g. `<a href>`) (a11y/interactive-nesting). */
-interface InteractiveNestingFact {
-    containerTag: string;
-    descendantTag: string;
-    /** 1-based source line of the descendant, or 0 if unknown. */
-    line: number;
-}
-/** A `button`/`a href`/`input type="image"` with no computable accessible name (a11y/accessible-name). */
-interface UnnamedInteractiveFact {
-    tag: string;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-}
-/** An element carrying a `role` and/or `aria-*` attribute(s) (a11y ARIA rules). */
-interface AriaElementFact {
-    tag: string;
-    /** 1-based source line, or 0 if unknown. */
-    line: number;
-    /** literal role value; undefined = no role attr; { expression: true } = dynamic */
-    role?: {
-        literal?: string;
-        expression?: boolean;
-    };
-    /** every aria-* attribute on the element */
-    aria: {
-        name: string;
-        literal?: string;
-        expression?: boolean;
-        line: number;
-    }[];
-    /** literal `type` of an `<input>`, lowercased; undefined for non-inputs or a dynamic type */
-    inputType?: string;
-    /** Set when the element also carries a spread attribute — its full attribute set is
-     *  unknowable, so required-prop presence checks must treat it as satisfied (a11y/required-aria-props). */
-    hasSpread?: true;
-}
-/** Reactivity/correctness + security + architecture facts parsed from one `.svelte` component. */
-interface ComponentFacts {
-    /** Source file the component came from. */
-    file: string;
-    eachBlocks: EachBlockFact[];
-    effects: EffectFact[];
-    /** `{@html …}` occurrences — raw-HTML render surfaces (security/raw-html). */
-    htmlTags: SourceSpan[];
-    /** Element attributes with a literal `javascript:` URL (security/javascript-url). */
-    javascriptUrls: SourceSpan[];
-    /** Source line count of the component file (architecture/component-size). */
-    loc: number;
-    /** Named props destructured from `$props()`; 0 when unknowable (rest / non-destructured) (architecture/prop-count). */
-    propCount: number;
-    /** Module specifiers of every `import` in the instance + module scripts (performance/heavy-import). */
-    imports: string[];
-    /**
-     * Module specifiers of every `import`, each with its source line (performance/heavy-import,
-     * architecture/route-component-import). `type` marks a declaration that contributes **no runtime
-     * value binding** — either `import type …`, or one whose every specifier is inline-typed
-     * (`import { type A } from …`). A specifier-less side-effect import is not marked: it still loads
-     * the module. Optional, so existing external constructors of `ComponentFacts` are unaffected.
-     */
-    importSpans: {
-        source: string;
-        line: number;
-        type?: true;
-    }[];
-    /** Value `import * as X from '<bare pkg>'` namespace imports (type-only excluded) — performance/namespace-import. */
-    namespaceImports: {
-        source: string;
-        line: number;
-    }[];
-    /** `$state` declarations never written or escaped anywhere in the component — candidates for const (correctness/unmutated-state). */
-    constableStates: {
-        name: string;
-        line: number;
-    }[];
-    /** Mutations of a non-`$bindable` prop from `$props()`, or a legacy `export let` prop — member writes, `delete`, or a mutating method call (correctness/prop-mutation). `legacy` distinguishes which mode the prop was declared in (absent/false: `$props()`), since the fix differs — optional so existing external constructors of `ComponentFacts` are unaffected. */
-    mutatedProps: {
-        name: string;
-        line: number;
-        legacy?: boolean;
-    }[];
-    /** Top-level const/let bindings computed from a $props() or legacy `export let` prop without $derived (or `$:`), never reassigned or escaped, and referenced (eagerly) in the template — frozen at init (correctness/stale-prop-derivation). `legacy` distinguishes which mode the prop was declared in, since the fix differs — optional so existing external constructors of `ComponentFacts` are unaffected. */
-    stalePropDerivations: {
-        name: string;
-        line: number;
-        legacy?: boolean;
-    }[];
-    /** Object/array-literal $state bindings reassigned at least once but never mutated, escaped, aliased, or item-edited — $state.raw candidates (performance/state-raw). */
-    rawableStates: {
-        name: string;
-        line: number;
-    }[];
-    /** Plain built-in instances (Map/Set/Date/URL/URLSearchParams) in $state whose type-specific mutations were observed inside functions, with no exempting reassignment — untracked by reactivity (correctness/nonreactive-builtin-state). */
-    nonreactiveBuiltinStates: {
-        name: string;
-        type: string;
-        line: number;
-    }[];
-    /** `<input type="checkbox">` / `<input type="radio">` elements bound with `bind:value`
-     * instead of `bind:checked`/`bind:group` (correctness/checkable-bind-value). */
-    checkableBindValues: CheckableBindValueFact[];
-    /** Root-relative `<a href>` and `goto()` literals in this component (correctness/base-path-navigation). */
-    basePathLinks: BasePathLinkFact[];
-    /** `$effect` calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (correctness/orphan-effect). */
-    orphanEffects: OrphanEffectFact[];
-    /** Svelte lifecycle/context calls guaranteed to run outside component initialisation — module scope in `.svelte.ts`/`.svelte.js` or `<script module>` (correctness/orphan-lifecycle). */
-    orphanLifecycleCalls: OrphanLifecycleCallFact[];
-    /** Browser-global reads in server-executed positions of this file (correctness/server-browser-global, correctness/instance-browser-global). */
-    browserGlobalRefs: BrowserGlobalRefFact[];
-    /** Module-scope `$state` declarations in a `.svelte.ts`/`.svelte.js` runes module — on a server, one instance shared by every request (security/shared-state-import). Always empty for `.svelte` files. */
-    moduleStateDecls: {
-        name: string;
-        line: number;
-    }[];
-    /** Inline `svelte-vitals-disable-next-line` directives found in this file's source — component-rule escape hatch (issue #92). Optional: absent is equivalent to no directives, so existing external constructors of `ComponentFacts` are unaffected. */
-    suppressions?: SuppressionDirective[];
-    /** Markdown links `[label](url)` appearing inside a comment (architecture/doc-link-target). */
-    commentLinks: {
-        url: string;
-        line: number;
-    }[];
-    /** Elements carrying a role or any aria-* attribute (a11y ARIA rules). */
-    ariaElements?: AriaElementFact[];
-    /** Interactive elements nested inside another interactive container (a11y/interactive-nesting). */
-    interactiveNestings?: InteractiveNestingFact[];
-    /** `button`/`a href`/`input type="image"` elements with no computable accessible name (a11y/accessible-name). */
-    unnamedInteractive?: UnnamedInteractiveFact[];
-    /** `<label>` elements with neither a `for` attribute nor a wrapped labelable descendant (a11y/label-has-control). */
-    unassociatedLabels?: {
-        line: number;
-    }[];
-    /** Text nodes whose trimmed content opens with a bullet character followed by whitespace, outside any `li` (a11y/use-list). */
-    bulletTexts?: {
-        line: number;
-        char: string;
-    }[];
-    /** `<select required>` (no `multiple`, display size absent or ≤ 1) whose first `option` element
-     *  child is not a placeholder label option (a11y/placeholder-label-option). */
-    selectsMissingPlaceholder?: {
-        line: number;
-    }[];
-    /** `<time>` with no `datetime` attribute whose literal text content is not machine-readable (a11y/require-datetime). */
-    timesMissingDatetime?: {
-        line: number;
-        text: string;
-    }[];
-    /** Set when the file failed to read or parse and these facts are the empty fallback — the file was NOT analyzed. */
-    parseFailed?: true;
-}
-/** What the per-file parsers produce — `ComponentFacts` minus `file`, with `suppressions` always present. */
-type ParsedFacts = Omit<ComponentFacts, 'file' | 'suppressions'> & {
-    suppressions: SuppressionDirective[];
-};
-/**
- * Parse one source file's facts (CLI/static + vite build mode): a `.svelte` component's
- * reactivity/correctness + security + architecture facts, or a `.svelte.ts`/`.svelte.js`
- * runes module's orphan-$effect facts (correctness/orphan-effect).
- */
-declare function parseComponentFacts(source: string, filename: string): ParsedFacts;
-/**
- * Fallback facts for a file that fails to read or parse (dev tooling must never
- * throw). This is the single source of truth for the empty-facts shape — add new
- * `ComponentFacts` fields HERE so TypeScript catches every call site that still
- * needs updating.
- */
-declare function emptyComponentFacts(file: string): ComponentFacts;
-/**
- * Scan every `.svelte` component and `.svelte.ts`/`.svelte.js` runes module under `src/`
- * for Correctness/Security/Architecture/Bundle-Performance/Accessibility facts. Independent
- * of route resolution — covers `$lib` and non-route components too. A file that fails to
- * read or parse contributes empty facts instead of aborting the whole scan (dev tooling
- * must never throw).
- */
-declare function collectComponentFacts(rt: Runtime, cwd: string): Promise<ComponentFacts[]>;
-/**
- * Every file under `src/`, as project-relative paths, sorted. Paths only — nothing is
- * read, so this is the cheaper of the two passes over `src/` (the component collector
- * already walks the same tree and reads every `.svelte`).
- *
- * Directory-shaped rules derive their directory set from these paths' ancestor prefixes
- * rather than globbing a second time; see `architecture/unit-entry-file`. The list is
- * sorted so anything that picks "the first file under a directory" is deterministic.
- *
- * Two properties of the result the directory-shaped rules depend on: a directory containing no file
- * at any depth does not appear among these paths' ancestor prefixes and so does not exist as far as
- * those rules are concerned, and dot directories never appear at all (see `Runtime.glob`).
- */
-declare function collectSourceFiles(rt: Runtime, cwd: string): Promise<string[]>;
-/**
- * Facts parsed from one SvelteKit route/hooks file for the SSR shared-state rules
- * (the security kit-module rules). Collected by `collectKitModuleFacts` (static/CLI + vite build mode).
- */
-interface KitModuleFacts {
-    /** Repo-relative source file. */
-    file: string;
-    /** 'server' = runs only on the server (+*.server, +server, hooks.server); 'universal' = +page.ts/+layout.ts (still runs on the server during SSR). */
-    kind: 'server' | 'universal';
-    /** Module-scope let/var reassigned from inside a function (security/server-module-state). */
-    moduleStateReassignments: {
-        name: string;
-        line: number;
-        inHandler: boolean;
-    }[];
-    /** Writes to an imported binding from inside an exported handler (security/handler-state-write). */
-    importedStateWrites: {
-        name: string;
-        line: number;
-        via: 'assignment' | 'set-call';
-    }[];
-    /** Writes to an imported binding outside handlers — top level or helper functions (security/shared-state-import's write flavour). */
-    importedStateWritesOutsideHandlers: {
-        name: string;
-        line: number;
-    }[];
-    /**
-     * `.set()`/`.update()` in a handler on an import resolving under the `$lib` server root.
-     * The call shape alone cannot tell a persistence client (`db.set(…)`) from a hand-rolled
-     * in-memory store, so the decision needs the target module — which this pure parse cannot
-     * read. `collectKitModuleFacts` resolves each one and promotes the in-memory ones into
-     * `importedStateWrites`; a consumer that ignores this field sees the pre-arbitration
-     * behaviour, i.e. every one of these exempt.
-     */
-    pendingServerStoreWrites: {
-        name: string;
-        imported: string;
-        resolved: string;
-        line: number;
-    }[];
-    /** Value imports whose specifier resolves to a repo-local `.svelte.ts`/`.svelte.js` runes module (security/shared-state-import). */
-    runesModuleImports: {
-        source: string;
-        resolved: string;
-        names: string[];
-        line: number;
-    }[];
-    /** Svelte lifecycle/context calls that run outside component initialisation — top level, handler bodies, or the `init` hook (correctness/orphan-lifecycle). */
-    lifecycleCalls: {
-        name: string;
-        line: number;
-        inHandler: boolean;
-    }[];
-    /** Browser-global reads in server-executed positions — top level, handler bodies, the `init` hook (correctness/server-browser-global). Empty when the file itself exports `ssr = false`. */
-    browserGlobalRefs: {
-        name: string;
-        line: number;
-        inHandler: boolean;
-    }[];
-    /** Root-relative `redirect()` literals in this Kit module (correctness/base-path-navigation). */
-    basePathLinks: BasePathLinkFact[];
-    /** Set when this file disables SSR via `export const ssr = false` (inline or same-file alias export) — the declaration's line (seo/ssr-disabled). */
-    ssrDisabled?: {
-        line: number;
-    };
-    /** Set when this file disables client-side rendering via `export const csr = false` (inline or same-file alias export). With no client runtime, a universal load only runs during SSR — performance/load-waterfall's browser-waterfall premise doesn't hold. */
-    csrDisabled?: {
-        line: number;
-    };
-    /** Sequential-await analysis of the exported `load` function (performance/load-waterfall, performance/sequential-awaits): 1-based lines of await sites that depend on an earlier await's result, and of sites independent of all earlier awaits. Set only when at least one list is non-empty. */
-    loadWaterfalls?: {
-        dependentLines: number[];
-        independentLines: number[];
-    };
-    /** Inline `svelte-vitals-disable-next-line` directives in this file. */
-    suppressions: SuppressionDirective[];
-    /** Set when the file failed to read or parse and these facts are the empty fallback — the file was NOT analyzed. */
-    parseFailed?: true;
-}
-/**
- * Resolve an import specifier to a path relative to the analyzed project's root (the
- * cwd svelte-vitals runs from — not necessarily a repo root; in a monorepo the project
- * may live at e.g. `apps/web/`) against the importing file, or undefined when it cannot
- * be a project-local module: the caller's `aliases` list decides which non-relative
- * specifiers resolve, defaulting to `$lib` → `src/lib`; `./`/`../` resolve against the
- * importing file's directory; bare packages and other aliases are skipped (they can't
- * be resolved to a project-local path at all). Also undefined when a relative
- * specifier's `..` segments escape the project root (see `normalizePosix`), or when a
- * matched alias's value is itself absolute (e.g. `/opt/shared/src`, or a posixified Windows
- * drive-letter path like `C:/shared/src`): an absolute target is outside the analyzed project by
- * definition, and without this check `normalizePosix` would quietly drop the leading empty
- * segment and hand back a project-relative-LOOKING path that actually names a different file.
- *
- * Exported from the package's public barrel because `architecture/private-scope-import`
- * and `architecture/route-component-import` (inside `packages/core`) both need resolution
- * that is not restricted to runes modules, unlike `resolveRunesModuleSpecifier` — and
- * because `resolveComponentPath` (`packages/cli/src/providers/source/resolve.ts`), which
- * drives transitive `<head>`/heading resolution, delegates its alias/`$lib`/relative
- * mapping here too, rather than duplicating it. This is the single site for every
- * repo-local specifier resolution in the repo.
- */
-declare function resolveRepoLocalPath(spec: string, importerFile: string, aliases?: readonly KitAlias[]): string | undefined;
-/**
- * Resolve an import specifier to a repo-relative `.svelte.ts`/`.svelte.js` path, or
- * undefined when it cannot be a runes module: delegates to `resolveRepoLocalPath` with
- * `aliases` (defaulting to `$lib` → `src/lib` when omitted), so a project's declared
- * `kit.alias`/`kit.files.lib` resolve here exactly as they do at rule time; `./`/`../`
- * resolve against the importing file's directory; bare packages, unmatched aliases, and
- * a relative specifier whose `..` segments escape the repo root are skipped. An
- * extensionless `…/x.svelte` specifier canonicalises to `….svelte.ts` (security/shared-state-import also
- * tries the `.js` sibling when matching).
- */
-declare function resolveRunesModuleSpecifier(spec: string, importerFile: string, aliases?: readonly KitAlias[]): string | undefined;
-/**
- * Parse one SvelteKit route/hooks file's SSR shared-state facts (the security kit-module rules). Uses
- * the shared wrap parser (`parseModuleProgram`), so reported lines subtract the
- * 1-line wrap prefix; suppressions are scanned on the unwrapped source.
- */
-declare function parseKitModuleFacts(source: string, filename: string, aliases?: readonly KitAlias[]): Omit<KitModuleFacts, 'file' | 'kind'>;
-/** Fallback facts for a Kit file that fails to read or parse (dev tooling must never throw). */
-declare function emptyKitModuleFacts(file: string, kind: KitModuleFacts['kind']): KitModuleFacts;
-/**
- * Scan SvelteKit route/hooks files for SSR shared-state facts (the security kit-module rules): route
- * `+page`/`+layout` server and universal modules, `+server` endpoints, and
- * `src/hooks.server`. `src/lib/server/**` is deliberately NOT scanned — legitimate
- * module singletons (DB connections, clients) live there (design). A file that
- * fails to read or parse contributes empty facts instead of aborting the scan.
- *
- * `aliases` is the project's compiled alias list (`Project.kitAliases`); omitted,
- * specifiers resolve through `$lib` → `src/lib` only.
- */
-declare function collectKitModuleFacts(rt: Runtime, cwd: string, aliases?: readonly KitAlias[]): Promise<KitModuleFacts[]>;
-/**
- * The `build: { minify: false }` override, when present as a literal: returns the
- * `minify` property's 1-based line in the ORIGINAL source. Undefined for clean,
- * dynamic, or unparsable configs (never throws).
- */
-declare function findMinifyDisabled(source: string): {
-    line: number;
-} | undefined;
-/** What a Vite config says about SvelteKit's own configuration. */
-type ViteKitConfigResult =
-/** No `sveltekit()` call, or one with no argument — `svelte.config` still applies. */
-{
-    kind: 'no-plugin-config';
-}
-/** `sveltekit(<something we can't resolve>)` — the effective config is unknowable AND
- *  `svelte.config` is provably ignored, so the caller must stay quiet. */
- | {
-    kind: 'unresolvable';
-}
-/** `sveltekit({…})` resolved. `base` is unset when the config declares no non-empty base. */
- | {
-    kind: 'resolved';
-    base?: {
-        value?: string;
-    };
-};
-/** `kit.alias` and `kit.files.lib` as written, before Kit compiles them into ordered entries. */
-type RawKitAliases = {
-    /**
-     * `kit.alias` entries in declaration order, `value: null` where the config's value is not a
-     * string literal. **Undefined means the key set is unknowable** — a spread or a computed key
-     * puts an unknown key at a known position, and an unknown key could shadow anything after it,
-     * with no `find` to record that with. The caller then discards every user entry.
-     */
-    entries?: {
-        key: string;
-        value: string | null;
-    }[];
-    /**
-     * `kit.files.lib`, in three distinct states: **absent** (`undefined`) — there is no `lib`
-     * property, or `files` itself does not resolve to an object literal; a **literal** (the
-     * string) — `files.lib` is a string literal; **present but unreadable** (`null`) — the `lib`
-     * property exists but its value is not statically a string (e.g. a computed expression). The
-     * `null` state must not collapse into "absent": the caller cannot fall back to `src/lib`
-     * without risking a wrong answer, because the project may have moved `$lib` to something this
-     * parser simply couldn't read.
-     */
-    filesLib?: string | null;
-};
-/** `kit.alias` and `kit.files.lib` from a `svelte.config.{js,ts}` source. */
-declare function findKitAliasesInSvelteConfig(source: string): RawKitAliases;
-/**
- * The project's compiled alias list, following SvelteKit's config precedence: options passed to
- * the `sveltekit()` Vite plugin make `svelte.config` irrelevant (Kit logs "svelte.config.js is
- * ignored when options are passed via your Vite config"), so aliases are read from
- * `svelte.config` only when the Vite config carries no plugin config. Reading `kit.alias` out of
- * a plugin config is deliberately not done — that costs reach, not correctness, and such a
- * project keeps the resolver's default `$lib` behaviour. Undefined means "no config was read".
- */
-declare function resolveKitAliases(viteConfig: {
-    source: string;
-} | undefined, svelteConfig: {
-    source: string;
-} | undefined): KitAlias[] | undefined;
-/** `kit.paths.base` from a `svelte.config.{js,ts}` source. */
-declare function findKitPathsBaseInSvelteConfig(source: string): {
-    value?: string;
-} | undefined;
-/** SvelteKit config passed to the `sveltekit()` plugin in a Vite config source (since Kit 2.62). */
-declare function findKitPathsBaseInViteConfig(source: string): ViteKitConfigResult;
-/**
- * The project's effective `kit.paths.base`, following SvelteKit's precedence: the `sveltekit()`
- * plugin config when it carries one, otherwise `svelte.config`. `file` is the config the base
- * came from (as passed in by the caller). Undefined means "no base path" — the gate stays shut.
- */
-declare function resolveKitPathsBase(viteConfig: {
-    file: string;
-    source: string;
-} | undefined, svelteConfig: {
-    file: string;
-    source: string;
-} | undefined): {
-    value?: string;
-    file: string;
-} | undefined;
-/** A template fragment's child node relevant to value classification: literal text or a `{expr}`. */
-type TextOrExpr = AST.Text | AST.ExpressionTag;
-/**
- * All keys that can bear child nodes in a Svelte AST node.
- * Covers if/each/await blocks (pending/then/catch/fallback) as well as
- * the standard fragment, nodes, consequent, alternate, and body keys.
- */
-declare const CHILD_NODE_KEYS: string[];
-declare function valueFromNodes(nodes: TextOrExpr[]): Value;
-/** The literal text of a node list when fully static (no ExpressionTag), else undefined. */
-declare function textFromNodes(nodes: TextOrExpr[]): string | undefined;
-/** Static string of an attribute (e.g. name="description"), or undefined if dynamic/absent. */
-declare function attrText(attributes: AST.Attribute[], name: string): string | undefined;
-/** Value kind of an attribute's content (e.g. the `content` of a <meta>). */
-declare function attrValue(attributes: AST.Attribute[], name: string): Value;
-declare function lineOf(source: string, offset: unknown): number;
-declare function findAttr(attributes: AST.Attribute[], name: string): AST.Attribute | undefined;
-/** Value kind of a single attribute (e.g. a component prop). */
-declare function attrValueOf(attr: AST.Attribute): Value;
-/** Literal static text of a single attribute node (e.g. a component prop), or undefined if dynamic/absent. */
-declare function attrTextOf(attr: AST.Attribute): string | undefined;
-/**
- * Source-file locations that satisfy the project-scope rules, shared by every
- * mode so the static (CLI) and rendered (plugin) collectors never drift. This
- * module is pure data: no I/O, no `node:` imports (design §8).
- */
-/** Locations that satisfy the robots.txt project rule (seo/robots-txt). */
-declare const ROBOTS_SOURCE_PATHS: readonly ["static/robots.txt", "src/routes/robots.txt/+server.ts", "src/routes/robots.txt/+server.js"];
-/** Locations that satisfy the sitemap.xml project rule (seo/sitemap-xml). */
-declare const SITEMAP_SOURCE_PATHS: readonly ["static/sitemap.xml", "src/routes/sitemap.xml/+server.ts", "src/routes/sitemap.xml/+server.js"];
-/** Vite's own config resolution order — only the first existing file is the one Vite loads. */
-declare const VITE_CONFIG_FILES: readonly ["vite.config.js", "vite.config.mjs", "vite.config.ts", "vite.config.cjs", "vite.config.mts", "vite.config.cts"];
-/** SvelteKit's config resolution order (`@sveltejs/kit` checks js before ts). */
-declare const SVELTE_CONFIG_FILES: readonly ["svelte.config.js", "svelte.config.ts"];
-/** The severity a setting selects: `'off'`, an explicit severity, or undefined (leave the built-in). */
-declare function settingSeverity(setting: RuleSetting | undefined): Severity | 'off' | undefined;
-/** The options a setting carries, or undefined for the string forms. */
-declare function settingOptions(setting: RuleSetting | undefined): RuleOptions | undefined;
-/** Drop rules disabled via config (design §6). */
-declare function selectRules(rules: Rule[], config: Config): Rule[];
-/**
- * `config` with `failedRuleIds` (from `runRules`' `failedRules`) forced `'off'`: a rule that threw
- * examined nothing, so leaving it in the inventory would score it as if it had run clean, silently
- * inflating Health. Reuses the exact mechanism a `rules: { id: 'off' }` config entry already gets —
- * `selectRules`/`buildInventory` both drop an `'off'` id from the denominator — rather than adding a
- * second, parallel notion of "not counted" for callers to keep in sync.
- */
-declare function withFailedRulesOff(config: Config, failedRuleIds: readonly string[]): Config;
-/** One-line "rule failed and was skipped" warning; capped to the message's first line so a stack trace can't flood a terminal. */
-declare function formatFailedRuleWarning(f: {
-    id: string;
-    message: string;
-}): string;
-/** Apply per-rule severity overrides to results (design §6). */
-declare function applyRuleSeverities(results: Result[], config: Config): Result[];
-/** An override entry with its globs compiled once. Build with `compileOverrides`. */
-interface CompiledOverride {
-    routes: RegExp[];
-    files: RegExp[];
-    rules: Record<string, RuleSetting>;
-}
-/**
- * Compile every override entry's globs to RegExp, once. Callers that match many
- * targets (every component, every route) must hoist this out of their loop.
- */
-declare function compileOverrides(config: Config): CompiledOverride[];
-/**
- * Whether an override entry applies to a target. THE single definition of that
- * question — the result post-pass and in-run option resolution both call it.
- * Sharing this matcher is necessary but not sufficient for a severity override
- * and an option override to select the same files: each caller must also pass
- * the same `target` (route and, critically, `file`) the other path effectively
- * matches against. See Finding 1, docs/superpowers/specs/2026-07-26-rule-options-design.md.
- */
-declare function overrideMatches(o: CompiledOverride, target: {
-    route?: string;
-    file?: string;
-}): boolean;
-/**
- * Apply route-/file-scoped overrides to results (design 2026-07-18). An entry
- * matches when any `route` glob matches the finding's route id or any `files`
- * glob matches its location (OR). `'off'` removes a matched result entirely —
- * passing seeds included, so scoring and "checks passed" counts behave as if
- * the rule never ran there. A severity value rewrites the result's severity.
- * Entries are evaluated in order (later entries win); within one entry, a
- * rule-id key beats a category key only when it specifies a `severity` — an
- * options-only rule-id key (no `severity`) contributes its options but leaves
- * the category key's severity in force, rather than shadowing it (design
- * 2026-07-26, Finding 2 / second review Finding E).
- */
-declare function applyOverrides(results: Result[], config: Config): Result[];
-/**
- * Per-rule options: their declaration, resolution, and validation (design
- * 2026-07-26). Deliberately does not import `rule.ts` — `rule.ts` imports
- * `RuleOptionsSpec` from here, so taking `Rule` as a parameter would cycle.
- * Callers pass the id and the spec instead.
- */
-/**
- * One configurable option. `kind` decides the merge semantics, so no rule
- * writes merge code of its own: `integer` replaces, and the two collection
- * kinds ADD to the built-in default (never replace — see the design doc).
- */
-type RuleOptionSpec = {
-    kind: 'integer';
-    default: number;
-    min?: number;
-    max?: number;
-} | {
-    kind: 'string-list';
-    default: readonly string[];
-} | {
-    kind: 'string-map';
-    default: Readonly<Record<string, string>>;
-};
-/** A rule's configurable options, keyed by option name. */
-type RuleOptionsSpec = Record<string, RuleOptionSpec>;
-/**
- * Typed reads of a resolved options object. `RuleOptions` values are `unknown`
- * (the map is open-ended by design), so without these every rule would carry
- * its own `o.max as number` cast and the "resolution guarantees the declared
- * kind" invariant would live in a dozen places instead of one. `resolveRuleOptions`
- * always seeds every declared key from the spec default and validation rejects a
- * wrongly-typed value up front, so a mismatch here means a rule read a key it
- * never declared — the `fallback` keeps that a wrong number rather than a crash.
- */
-declare function intOption(options: RuleOptions, key: string, fallback?: number): number;
-/** As `intOption`, for a `string-list` option. */
-declare function listOption(options: RuleOptions, key: string): string[];
-/** As `intOption`, for a `string-map` option. */
-declare function mapOption(options: RuleOptions, key: string): Record<string, string>;
-/**
- * Whether any config layer so much as mentions `ruleId` — its `rules` entry, or any `overrides`
- * entry's.
- *
- * A rule that is inert until declared can return early on `false` instead of resolving options once
- * per target and discarding the result. That waste is not hypothetical: the three directory-shaped
- * Architecture rules resolve per directory, so an unconfigured project pays it for every directory
- * under `src/` three times over, on every dev-server save. Measured 2026-07-30 over a synthetic tree
- * of 1,523 directories: 5.4 ms per analysis, for rules that are off by default and therefore produce
- * nothing.
- *
- * Deliberately conservative. It asks only whether the rule is *mentioned*, not whether the mention
- * resolves to a non-empty value, so a `'off'` severity with no options still answers `true` and the
- * caller does its normal work. A cheaper-but-wrong version of this would make a rule skip work it
- * owed; this one can only ever fail to save time.
- */
-declare function isMentionedAnywhere(config: Config, ruleId: string): boolean;
-/**
- * Effective options for a rule at a target: built-in defaults, then
- * `config.rules[ruleId].options`, then every matching `config.overrides` entry
- * in order. Integers take the last value; lists and maps accumulate.
- *
- * `target` omitted skips overrides entirely (project-scoped rules). Callers
- * resolving many targets should hoist `compileOverrides(config)` and pass it as
- * `compiled` — otherwise every call recompiles the globs.
- */
-declare function resolveRuleOptions(ruleId: string, spec: RuleOptionsSpec | undefined, config: Config, target?: {
-    route?: string;
-    file?: string;
-}, compiled?: CompiledOverride[]): RuleOptions;
-/**
- * Problems with a user-supplied options object, as human-readable sentences
- * (empty = valid). Callers treat any result as fatal: a typo that silently
- * leaves the config inert is the failure this exists to prevent.
- *
- * `baseline`, when given, is the already-resolved value this `options` layer
- * is being merged onto — built-in defaults merged with any earlier layer(s)
- * (e.g. the global `config.rules[id].options`, when `options` is an
- * `overrides[]` entry). The min/max cross-check below compares against it
- * instead of the spec's own default, so a layer that only sets one side of a
- * range is checked against what it actually inherits (design 2026-07-26
- * review, Finding A). Omit it to check `options` against the spec defaults
- * alone, as when validating the global layer itself. A `baseline` that is
- * only partially resolved (missing `min` or `max`) is treated as "can't
- * determine that side" rather than silently comparing against `undefined` —
- * see the `typeof` guard below.
- *
- * `skipRangeCheck`, when true, skips the min/max cross-check entirely
- * regardless of `baseline`. A caller sets this when it statically cannot
- * rule out that some *other* config layer narrows the opposite side of the
- * range at the same target — see the CLI's and the Vite plugin's
- * `overrides[]` validation (design 2026-07-26 review, Finding A, third
- * pass).
- */
-declare function validateRuleOptions(ruleId: string, spec: RuleOptionsSpec | undefined, options: RuleOptions, baseline?: RuleOptions, skipRangeCheck?: boolean): string[];
-/**
- * Whether `validateRuleOptions` should skip the min/max cross-check for
- * `overrides[selfIndex].rules[key]` — the whole decision, so the CLI's
- * config-file loader and the Vite plugin can't drift apart on it (they held
- * line-for-line copies of it before).
- *
- * An entry that sets both sides, or neither, is judged against its baseline as
- * usual. An entry that sets only one side is skipped when some *other* entry
- * sets the opposite side, since the two may co-apply at a shared target and be
- * valid there — see `otherOverrideNarrowsOppositeSide` for why that is
- * conservative by necessity and what it lets through.
- */
-declare function shouldSkipRangeCheck(overrides: readonly unknown[], selfIndex: number, key: string, setting: unknown): boolean;
-/**
- * Problems with one user-supplied rule setting — the bare severity string or the
- * object form — as human-readable sentences prefixed with `label` (empty = valid).
- * THE single definition of what a setting may look like: the CLI's config-file
- * loader and the Vite plugin both funnel through it, so a config file and the
- * equivalent plugin option are accepted or rejected identically. Callers treat any
- * result as fatal, on the same reasoning as an unknown rule id — a typo that
- * silently leaves the config inert is the failure being prevented.
- *
- * `label` names the setting in the message (e.g. `rules.seo/title-length`,
- * `overrides[0].rules.architecture`); `ruleId` is the key options messages quote.
- * `allowOptions` is false for a category key: a category may carry a severity, but
- * options are rule-specific and meaningless there. `baseline` and `skipRangeCheck`
- * are passed through to `validateRuleOptions`.
- */
-declare function validateRuleSetting(label: string, ruleId: string, setting: unknown, spec: RuleOptionsSpec | undefined, opts: {
-    allowOptions: boolean;
-    baseline?: RuleOptions;
-    skipRangeCheck?: boolean;
-}): string[];
-/** Input given to every rule. Mode-independent: rules see only ResolvedHead[] (design §8, §10). */
-interface RuleContext {
-    heads: ResolvedHead[];
-    /** Per-route <img> elements for Performance rules (absent in modes that don't collect them). */
-    images?: ResolvedImages[];
-    /** Per-route page-body headings for seo/single-h1 (absent in modes that don't collect them). */
-    headings?: ResolvedHeadings[];
-    /** Per-route composed landmark/id occurrences for the route-scoped a11y rules (absent in modes that don't collect them). */
-    a11y?: ResolvedA11y[];
-    /** Per-file component-body facts for Correctness rules (static/CLI mode only). */
-    components?: ComponentFacts[];
-    /** Per-file SvelteKit route/hooks facts for the SSR shared-state rules (static/CLI + vite build mode only). */
-    kitModules?: KitModuleFacts[];
-    /**
-     * Every file under `src/`, as project-relative paths, for directory-shaped Architecture rules
-     * (static/CLI + vite build mode only). Sorted — see `collectSourceFiles`, which is what both
-     * adapters use to build it.
-     */
-    sourceFiles?: string[];
-    project: Project;
-    config: Config;
-    /**
-     * Report per-declaration counts of places this rule examined. The engine supplies it and keys the
-     * result by rule id; a rule that does not call it gets no entry, which is distinct from an entry of
-     * zeros. Absent in contexts a caller builds directly. Silent last-write-wins: calling it more than
-     * once keeps only the most recent map, with no merge and no error — call it once, with the complete
-     * counts, at the end of `check()`.
-     */
-    recordExamined?: (counts: Record<string, number>) => void;
-}
-interface Rule {
-    id: string;
-    title: string;
-    category: Category;
-    /** Default severity (overridable by config in later slices). */
-    severity: Severity;
-    /** 'route' = evaluated per route, 'project' = site-wide, 'component' = evaluated per source file (design §10, §12). */
-    scope: Scope;
-    /** Why this rule matters — one or two sentences, surfaced by `svelte-vitals explain` (issue #24). */
-    rationale: string;
-    /** Canonical remediation template, shared by findings and `svelte-vitals explain` (issue #24). */
-    fix?: Fix;
-    /** Configurable options for this rule; absent means the rule takes none. */
-    options?: RuleOptionsSpec;
-    /**
-     * Evaluate the resolved heads. A single rule may return one Result per route,
-     * so it always returns an array. Project-scoped rules return a single element.
-     */
-    check(ctx: RuleContext): Promise<Result[]>;
-}
-/** Documentation URL for a rule id. Single source so no per-rule URL can drift (issue #24). */
-declare function docsUrlFor(id: string): string;
-/**
- * Whether a detection should be penalized by scoring (design §12). Shared by the
- * future Scorer and by the Slice 0 reporter so pass/fail is decided in one place.
- *
- *   presence 'none'            → penalized (nothing set anywhere)
- *   value 'absent'             → penalized (tag present but empty)
- *   value 'dynamic'            → penalized when treatDynamicAs is not 'pass' (warn or fail)
- *   otherwise (static/inherited) → not penalized
- */
-declare function isPenalized(detection: Detection, treatDynamicAs: TreatDynamicAs): boolean;
-interface FailedRule {
-    id: string;
-    message: string;
-}
-/**
- * Run a set of rules against a shared context and collect their findings.
- * Rules are independent, so they run concurrently; results are flattened in
- * rule order for stable output. A rule that throws (sync or async) contributes
- * no results instead of taking the whole run down with it — dev tooling must
- * never throw — and is reported in `failedRules` instead.
- */
-declare function runRules(rules: Rule[], ctx: RuleContext): Promise<{
-    results: Result[];
-    examined: Record<string, Record<string, number>>;
-    failedRules: FailedRule[];
-}>;
-/**
- * seo/title-presence — every route should resolve a non-empty <title> (design §11).
- * A dynamic title (`{data.title}`) is the most common correct pattern and must
- * never be flagged as missing; it surfaces as value 'dynamic' (design §4).
- */
-declare const seoTitlePresence: Rule;
-declare const seoDescriptionPresence: Rule;
-declare const seoCanonicalUrl: Rule;
-declare const seoOgImage: Rule;
-declare const seoOgTitle: Rule;
-declare const seoJsonLd: Rule;
-declare const seoRobotsTxt: Rule;
-declare const seoSitemapXml: Rule;
-declare const seoHtmlLang: Rule;
-declare const performanceImageDimensions: Rule;
-declare const performanceImageLoadingHint: Rule;
-declare const performanceResponsiveImage: Rule;
-declare const performancePreloadMissingAs: Rule;
-declare const performanceFontPreloadCrossorigin: Rule;
-/**
- * performance/lcp-image — LCP image not lazy-loaded. Lazy-loading the largest contentful paint
- * image delays it. Analysis approximates the LCP as the first <img> in document
- * order for the route; if that image is loading="lazy", flag it. Runs in both
- * static (CLI) and rendered (vite) mode, since both providers collect <img>.
- */
-declare const performanceLcpImage: Rule;
-/**
- * performance/render-blocking-script — Render-blocking <script> in <head>. A <script src> without
- * defer/async/type=module blocks the parser. SvelteKit's own scripts are
- * module/deferred, so this catches hand-added blocking scripts — in app.html
- * (rendered mode) or in <svelte:head> (static mode). A head with no <script>
- * emits nothing (no signal), like the image rules.
- */
-declare const performanceRenderBlockingScript: Rule;
-/**
- * performance/preconnect — Preconnect for third-party origins. A resource from a well-known
- * third-party origin (e.g. Google Fonts) without a preconnect/dns-prefetch pays a
- * connection-setup round-trip. Opt-in by construction: only origins in the
- * allowlist are checked; routes referencing none emit nothing.
- */
-declare const performancePreconnect: Rule;
-declare const seoIndexability: Rule;
-declare const seoTwitterCard: Rule;
-declare const seoOgDescription: Rule;
-declare const seoOgUrl: Rule;
-declare const seoViewport: Rule;
-declare const seoSitemapInRobots: Rule;
-declare const seoJsonLdValidity: Rule;
-declare const seoJsonLdDeprecatedType: Rule;
-declare const seoJsonLdRelativeUrl: Rule;
-declare const seoJsonLdDateFormat: Rule;
-declare const seoJsonLdPlaceholder: Rule;
-declare const seoJsonLdRequiredProps: Rule;
-declare const seoTitleLength: Rule;
-declare const seoDescriptionLength: Rule;
-/**
- * seo/charset — Character encoding. The charset meta lives in `src/app.html`, so it is
- * only visible to rendered analysis (`appliesTo: rendered`), exactly like seo/viewport
- * (viewport). Static route analysis emits nothing instead of false-flagging it.
- */
-declare const seoCharset: Rule;
-/**
- * seo/image-alt — Image alt text. Reuses the <img> collection from both providers — the
- * static (CLI) source parser and the rendered (vite) HTML parser — like performance/image-dimensions, performance/image-loading-hint.
- * Presence only: an explicit empty `alt=""` is a valid decorative-image signal and
- * passes; a spread `{...rest}` may supply alt, so it is not flagged.
- */
-declare const seoImageAlt: Rule;
-/**
- * seo/hreflang — hreflang / x-default validity. Opt-in: a route with no
- * `<link rel="alternate" hreflang>` emits nothing (monolingual sites are never
- * flagged). When alternates exist, every code must be well-formed and a set of
- * two or more must declare an x-default. Works in both modes.
- */
-declare const seoHreflang: Rule;
-/**
- * seo/single-h1 — Heading hierarchy (single H1). Reads the per-route page-body headings
- * channel (collected by both providers), counting `headings` plus `componentHeadings`
- * (static mode only — headings found transitively in rendered child components) as one
- * combined list. Zero <h1> (no primary heading) is a `warning`: defensible, a page needs
- * a primary heading. Two or more is only `info`: a single <h1> is the conventional
- * signal, but no official source documents a ranking penalty for several (2026-08-09 v1
- * rule-validity review, P2 #11) — so it's flagged as a style nit, not a defect. Exactly
- * one passes. A route whose headings were not collected (channel unset) emits nothing. A
- * global `rules: { 'seo/single-h1': <severity> }` override flattens both arms to one
- * severity (design, `applyRuleSeverities`).
- */
-declare const seoSingleH1: Rule;
-declare const seoDuplicateTitle: Rule;
-declare const seoDuplicateDescription: Rule;
-/**
- * seo/heading-level-skip — Skipped heading level. Walking a route's body headings in
- * document order, a level that jumps more than +1 over the previous heading (e.g.
- * h2 → h4) breaks the outline. The first heading has no predecessor (missing/multiple
- * <h1> stays seo/single-h1's concern). A route with no headings emits nothing.
- */
-declare const seoHeadingLevelSkip: Rule;
-declare const seoSsrDisabled: Rule;
-declare const correctnessEachKey: Rule;
-declare const correctnessEachIndexKey: Rule;
-declare const correctnessEffectAsDerived: Rule;
-declare const correctnessEffectAsOnMount: Rule;
-declare const correctnessUnmutatedState: Rule;
-/**
- * correctness/prop-mutation — mutating a prop directly is a silent bug in both Svelte modes,
- * for different reasons: in runes mode, a non-$bindable prop mutation doesn't propagate to the
- * parent; in legacy mode (export let), Svelte's reactivity is assignment-based, so a mutating
- * method call (`.push(...)`, etc.) doesn't trigger an update at all without a following
- * reassignment. The two modes can't be mixed in one component, so a given finding is always
- * exactly one or the other — see `legacy` on `ComponentFacts.mutatedProps` (component-parse.ts).
- */
-declare const correctnessPropMutation: Rule;
-/**
- * correctness/stale-prop-derivation — a value computed from a prop without $derived (runes
- * mode) or $: (legacy mode) is evaluated once, at init, and silently stops tracking the
- * parent. Svelte's own guidance: treat props as though they will change. The two modes can't
- * be mixed in one component, so a given finding is always exactly one or the other — see
- * `legacy` on `ComponentFacts.stalePropDerivations` (component-parse.ts).
- */
-declare const correctnessStalePropDerivation: Rule;
-/**
- * correctness/nonreactive-builtin-state — $state's deep proxy covers plain
- * objects and arrays only. A plain Map/Set/Date/URL/URLSearchParams in $state
- * keeps working as data, but its mutations never reach effects, deriveds, or
- * the template: the UI silently stops updating. svelte/reactivity ships
- * drop-in reactive equivalents for exactly this.
- */
-declare const correctnessNonreactiveBuiltinState: Rule;
-/**
- * correctness/checkable-bind-value — bind:value binds the DOM value property. A
- * checkbox/radio's user interaction toggles checkedness, which bind:value never observes. A
- * checkbox throws bind_invalid_checkbox_value in dev (silently tracks value instead of
- * checkedness in prod); a radio throws nothing and its bound state silently never updates.
- * bind:checked (single checkbox) / bind:group (checkbox list, radio group) are the correct
- * bindings.
- */
-declare const correctnessCheckableBindValue: Rule;
-declare const correctnessOrphanEffect: Rule;
-/**
- * correctness/orphan-lifecycle — svelte lifecycle/context calls guaranteed to run outside component
- * initialisation: module scope in runes modules / `<script module>`, the constructor of
- * a module-scope-instantiated class, and Kit load/handler/`init` bodies. A custom check
- * because the facts live on BOTH the component channel and the Kit-module channel.
- */
-declare const correctnessOrphanLifecycle: Rule;
-/**
- * correctness/base-path-navigation — root-relative navigation literals in a project that sets
- * `kit.paths.base`. A custom check because it is gated on a PROJECT fact and its own facts live
- * on BOTH the component channel (`<a href>`, `goto()`) and the Kit-module channel (`redirect()`).
- * With no base path configured the rule emits nothing at all — the gate is the whole point.
- */
-declare const correctnessBasePathNavigation: Rule;
-/**
- * correctness/server-browser-global — browser globals read in server-executed MODULE code: module scope of
- * runes modules / `<script module>`, and Kit route/hooks files (top level, handler
- * bodies, the `init` hook). All of it runs on the server, where these globals do not
- * exist — SSR crashes with a ReferenceError. Instance-script reads are correctness/instance-browser-global's
- * (warning) territory. A custom check because the facts live on both channels.
- */
-declare const correctnessServerBrowserGlobal: Rule;
-declare const correctnessInstanceBrowserGlobal: Rule;
-declare const securityRawHtml: Rule;
-declare const securityJavascriptUrl: Rule;
-declare const securityHandlerStateWrite: Rule;
-declare const securityServerModuleState: Rule;
-declare const securitySharedStateImport: Rule;
-declare const architectureComponentSize: Rule;
-declare const architecturePropCount: Rule;
-/**
- * architecture/private-scope-import — a unit inside a declared private scope must not be
- * imported from outside that scope (design 2026-07-28). L3: the scopes are declared by the
- * project via the `scopes` option and never inferred, so the rule is inert until then.
- *
- * Findings are reported at the import site, not at the imported unit: `--diff` filters
- * results to the files that changed, and the author of the violation edited the importer.
- */
-declare const architecturePrivateScopeImport: Rule;
-/**
- * architecture/unit-entry-file — a directory declared to be a unit must contain a file named
- * after it (design 2026-07-28). L3: the declarations come from the project's own `units`,
- * `pascalCaseUnits` and `exclude` options and are never inferred, so the rule is inert until then.
- *
- * The directory set is every ancestor path prefix of every file, so a directory holding only
- * subdirectories is checked too. Violations report at a file inside the directory rather than at
- * the directory, because `filterToChangedFiles` keeps only locations git lists as changed.
- */
-declare const architectureUnitEntryFile: Rule;
-/**
- * architecture/directory-naming — a directory must be named in the casing its location declares
- * (design 2026-07-29). L3: the declarations come from the project's own `directories` and `exclude`
- * options and are never inferred, so the rule is inert until then.
- *
- * Violations report at a file inside the directory rather than at the directory, because
- * `filterToChangedFiles` keeps only locations git lists as changed and git never lists a directory.
- *
- * There are no pass results. `architecture/unit-entry-file` emits one per conforming unit and can
- * afford to, because it keys the pass on the unit's entry file — a `.svelte` path already present as
- * a score key. This rule's subject is the directory itself, with no such pre-existing key, and
- * `computeScore` seeds every distinct `route` at 100 and averages: a pass per directory would add
- * hundreds of 100s from one `'src/routes/**'` declaration and dilute every real finding.
- */
-declare const architectureDirectoryNaming: Rule;
-/**
- * architecture/reserved-directory-names — a directory's immediate subdirectories may only take names
- * the project declared for that position (design 2026-07-29, extended 2026-08-08 for lowercase units —
- * issue #386).
- *
- * The option maps differ in what their keys name. A `scopes` key names the parent directly. A
- * `unitScopes` key names a root, and the rule governs the children of whichever directories beneath
- * it are units whose name begins A–Z — the shape a glob cannot reach, because units nest to arbitrary
- * depth. An `anyCaseUnitScopes` key names a root the same way, but governs units of *either* case:
- * `isUnitDir`'s letter test — A–Z plus a same-stemmed entry file, whatever its extension — excludes a
- * lowercase unit, so without this map no generic unit-map declaration governed one's children (a
- * `scopes` key naming the parent directly could still reach one) — measured at 129 of 299 units (43%)
- * on a real tree. Neither map is named with the bare word "unit": the
- * sibling rule `architecture/reserved-name-placement` records why that word alone is ambiguous between
- * the two predicates once both exist.
- *
- * There are no pass results. `computeScore` seeds every distinct `route` at 100 and averages, and the
- * subject here is a directory with no pre-existing score key, so a pass per directory would add
- * hundreds of 100s from one broad declaration and dilute every real finding.
- */
-declare const architectureReservedDirectoryNames: Rule;
-/**
- * architecture/reserved-name-placement — a reserved directory name may appear only in the places
- * declared for it (design 2026-08-06). L3: inert until a placement is declared.
- *
- * The sibling `architecture/reserved-directory-names` says "at this position, only these names"; it
- * cannot say "this name, only at these positions", which for a name appearing in several kinds of
- * place is what a convention actually states.
- *
- * All three maps match the same directory — the reserved-name directory's parent — and differ only in
- * what else they require of it: nothing, that it is a capitalised unit, that it is a unit of either
- * case. A name's permitted positions are the UNION of its entries across the three, because a real
- * convention permits one name under a unit, under a grouping and under a route directory at once.
- *
- * There are no pass results, for the reason the sibling records: `computeScore` seeds every distinct
- * `route` at 100 and averages, and a directory has no pre-existing score key.
- */
-declare const architectureReservedNamePlacement: Rule;
-declare const architectureRouteComponentImport: Rule;
-declare const architectureDocLinkTarget: Rule;
-declare const performanceHeavyImport: Rule;
-declare const performanceNamespaceImport: Rule;
-/**
- * performance/minify-disabled — a `build.minify: false` left in vite.config ships unminified JS/CSS
- * to production. Project-scope: the fact is produced by the CLI's static parse
- * of vite.config.* (literal-only) or by the Vite plugin's resolved config
- * (exact). Emits a finding only when the fact is set — no pass result.
- */
-declare const performanceMinifyDisabled: Rule;
-/**
- * performance/load-waterfall — dependent await chains in universal loads. Server loads are exempt:
- * a dependent chain cannot be parallelized, and on the server there is no better
- * placement to suggest. csr = false files are exempt too — without a client
- * runtime the universal load only runs during SSR.
- */
-declare const performanceLoadWaterfall: Rule;
-/**
- * performance/sequential-awaits — independent sequential awaits in any load. Info severity: static
- * data flow cannot see side-effect ordering (e.g. a setup call an API relies
- * on), so the parallelize suggestion stays advisory.
- */
-declare const performanceSequentialAwaits: Rule;
-/**
- * performance/state-raw — deep $state proxies every property access; a binding
- * that is only ever reassigned never uses that machinery. Svelte's guidance:
- * large reassign-only objects (API responses, canonically) belong in $state.raw.
- * "Large" is not statically knowable, so a non-primitive literal initializer is
- * the proxy condition.
- */
-declare const performanceStateRaw: Rule;
-declare const a11yInvalidRole: Rule;
-declare const a11yUnknownAriaAttribute: Rule;
-declare const a11yRequiredAriaProps: Rule;
-declare const a11yInvalidAriaValue: Rule;
-declare const a11yInteractiveNesting: Rule;
-declare const a11yAccessibleName: Rule;
-declare const a11yLabelHasControl: Rule;
-declare const a11yUseList: Rule;
-declare const a11yPlaceholderLabelOption: Rule;
-declare const a11yRequireDatetime: Rule;
-declare const a11yDoctype: Rule;
-/**
- * a11y/duplicate-landmark — a composed route (layout chain + page) yields more than one
- * `main` / `banner` / `contentinfo` landmark. `ctx.a11y[].landmarks` already holds the
- * branch-aware-folded representatives, so this rule only counts them per kind, in the
- * fixed KINDS order (it decides emission order and the PASS anchor).
- */
-declare const a11yDuplicateLandmark: Rule;
-/**
- * a11y/top-level-landmark — a landmark (`main`/`banner`/`complementary`/`contentinfo`) that
- * composition places inside another landmark. `ctx.a11y[].nestedLandmarks` already carries one
- * entry per nested occurrence, so this rule only reports them.
- */
-declare const a11yTopLevelLandmark: Rule;
-/**
- * a11y/id-duplication — a literal id repeated within a composed route. `ctx.a11y[].ids`
- * already holds the branch-aware-folded representatives per id, so this rule only counts them.
- */
-declare const a11yIdDuplication: Rule;
-/**
- * a11y/no-missing-id-ref — a `for`/`aria-labelledby`/`aria-describedby`/`aria-controls`/
- * `aria-activedescendant`/same-page `href="#…"` referencing an `id` absent from the composed
- * route. Universal ("no element anywhere defines this id") needs a closed world, so this rule
- * runs only on routes `ctx.a11y[].fullyResolved` marks fully resolved — see the rule docs.
- */
-declare const a11yNoMissingIdRef: Rule;
-declare const allRules: Rule[];
-/** One configurable option of a rule, flattened for `svelte-vitals explain`'s output. */
-interface RuleOptionInfo {
-    name: string;
-    /** `integer` replaces the default; `string-list`/`string-map` are ADDED to it. */
-    kind: RuleOptionSpec['kind'];
-    default: number | readonly string[] | Readonly<Record<string, string>>;
-    min?: number;
-    max?: number;
-}
-interface RuleInfo {
-    id: string;
-    title: string;
-    category: Category;
-    severity: Severity;
-    rationale: string;
-    docsUrl: string;
-    fix?: Fix;
-    /**
-     * The rule's configurable options, omitted when it takes none. An agent that
-     * judges a finding to be a threshold disagreement rather than a defect needs
-     * to know the knob exists and what it is called before it can suggest one.
-     */
-    options?: RuleOptionInfo[];
-}
-/** Look up a rule's static metadata, as `svelte-vitals explain` renders it (issue #24). Rule ids are matched exactly (case-sensitive, e.g. "seo/ssr-disabled"). */
-declare function explainRule(id: string): RuleInfo | undefined;
-interface HeadTagRuleOptions {
-    id: string;
-    title: string;
-    severity: Severity;
-    /** Identifies the tag this rule looks for. */
-    match: (tag: HeadTag) => boolean;
-    /** Short human label, e.g. 'description'. */
-    label: string;
-    recommendation: string;
-    /** Why this rule matters — surfaced by `svelte-vitals explain` (issue #24). */
-    rationale: string;
-    /** Agent-actionable remediation attached to every finding (issue #18). */
-    fix?: Fix;
-    /**
-     * When set, only heads for which this returns true are evaluated; others emit
-     * nothing. Use for tags whose canonical location is invisible to a given mode
-     * (e.g. viewport lives in app.html → only checkable in rendered mode), so the
-     * rule stays silent instead of false-flagging "missing".
-     */
-    appliesTo?: (head: ResolvedHead) => boolean;
-}
-/** Build a route-scope rule asserting the presence of a single head tag (design §11). */
-declare function headTagRule(opts: HeadTagRuleOptions): Rule;
-interface ImageRuleOptions {
-    id: string;
-    title: string;
-    severity: Severity;
-    /** Vitals category (default 'performance'); seo/image-alt (alt text) reports under 'seo'. */
-    category?: Category;
-    /** Noun phrase for messages, e.g. '<img> width/height'. */
-    label: string;
-    recommendation: string;
-    rationale: string;
-    fix?: Fix;
-    /** Returns true when the image satisfies the rule (passes). */
-    ok: (img: ImageInfo) => boolean;
-}
-/** Build a route-scoped <img> rule that checks each image against `ok` (issue #10). */
-declare function imageRule(opts: ImageRuleOptions): Rule;
-interface LinkRuleOptions {
-    id: string;
-    title: string;
-    severity: Severity;
-    /** Noun phrase for messages, e.g. '`as` on a preloaded `<link>`'. */
-    label: string;
-    recommendation: string;
-    rationale: string;
-    fix?: Fix;
-    /** Which link tags this rule evaluates (e.g. rel === 'preload'). */
-    relevant: (tag: HeadTag) => boolean;
-    /** Returns true when a relevant link satisfies the rule (passes). */
-    ok: (tag: HeadTag) => boolean;
-}
-/** Build a route-scoped Performance rule that checks each relevant <link> in the effective head. */
-declare function linkRule(opts: LinkRuleOptions): Rule;
-interface Summary {
-    critical: number;
-    warning: number;
-    info: number;
-    /** Passed (not penalized), including dynamic. */
-    passed: number;
-    /** Subset of passed that resolved dynamically (↯). */
-    dynamic: number;
-}
-/** Classify a single result for display/scoring (design §7, §12). */
-type Classification = 'fail' | 'pass' | 'dynamic';
-declare function classify(result: Result, config: Config): Classification;
-/** A penalized dynamic finding is a warning under treatDynamicAs 'warn'; otherwise the rule's severity. */
-declare function effectiveSeverity(result: Result, config: Config): Severity;
-declare function summarize(results: Result[], config: Config): Summary;
-/** Whether the run should fail the build/CI per the minimum failing severity. */
-declare function hasFailureAtOrAbove(summary: Summary, min: Severity): boolean;
-/** String decorators for the console reporter. Injected so core stays pure/dep-free. */
-interface Palette {
-    bold: (s: string) => string;
-    dim: (s: string) => string;
-    red: (s: string) => string;
-    yellow: (s: string) => string;
-    green: (s: string) => string;
-    cyan: (s: string) => string;
-}
-/** Default: no decoration (identity) — output is byte-identical to plain text. */
-declare const noColorPalette: Palette;
-/** Green ≥ 90, yellow ≥ 70, red otherwise — for a 0–100 score. */
-declare function scoreColor(p: Palette, score: number): (s: string) => string;
-interface ConsoleReportOptions {
-    byRoute?: boolean;
-    /** Mode label shown in the header (default 'static mode'). */
-    mode?: string;
-    /** Color decorators; defaults to no color. */
-    palette?: Palette;
-    /** Show every failing/passed/route entry uncapped and ungrouped, exactly as before this option existed. Default false (capped, grouped by rule). */
-    verbose?: boolean;
-    /** Internal: set by the CLI when it has already animated the Health header itself — skips the brand/Health lines (category score lines still print). Default false. */
-    omitHeader?: boolean;
-}
-/**
- * Render results as a console report string (design §7). Pure: returns a string,
- * the caller is responsible for printing. Prepends a score header; when byRoute is
- * set, adds a per-route score tree.
- */
-declare function formatConsoleReport(results: Result[], config: Config, options?: ConsoleReportOptions): string;
-/**
- * Strip ANSI/OSC escape sequences and C0 control characters (except `\n`/`\t`) from a
- * string before it reaches a terminal. POSIX file/route names can contain almost any
- * byte, so a hostile repo can smuggle a terminal-title rewrite, cursor move, or other
- * escape-sequence trick into what looks like plain report text.
- *
- * Only OSC and CSI sequences are pattern-matched and removed whole (payload included) —
- * those cover title-bar writes and cursor/screen control, the two classes with a real
- * blast radius. Any other `ESC` byte (rarer single/two-byte forms like reset or
- * save-cursor) falls through to the final C0 sweep below, which drops the lone `ESC`
- * but — deliberately, not swallowing an adjacent legitimate character — leaves whatever
- * printable byte follows it as stray text.
- * ponytail: doesn't special-case every Fe escape form; broaden the CSI/OSC patterns if a
- * concrete non-CSI/OSC sequence turns out to matter.
- */
-declare function terminalSafe(text: string): string;
-interface ScoreModel {
-    routeAverage: number;
-    sitePenalty: number;
-    /** Headline cap value when it actually lowered the score, else null. */
-    criticalCap: number | null;
-}
-interface ScoreResult {
-    /** The score as displayed: `Math.floor(rawScore)`, so 100 means the deduction was exactly zero. */
-    score: number;
-    /**
-     * The same score before flooring, after `sitePenalty` and the cap, clamped to `[0, 100]`. Exposed so
-     * `computeHealth` can average unrounded values and floor once — averaging the displayed scores would
-     * compose two roundings and move Health by up to two points.
-     */
-    rawScore: number;
-    scoreModel: ScoreModel;
-    /** Keys this result set touched. */
-    keys: number;
-    /** Keys carrying at least one penalized finding. */
-    affectedKeys: number;
-}
-interface ScoreOptions {
-    applyCriticalCap?: boolean;
-    /** The rules that ran. Defaults to the selected registry; supplied by tests and custom rule sets. */
-    rules?: readonly Rule[];
-}
-/** Compute the headline score and its breakdown (design §12). */
-declare function computeScore(results: Result[], config: Config, options?: ScoreOptions): ScoreResult;
-/** Compute an independent score per category present in `results` (issue #10). */
-declare function scoresByCategory(results: Result[], config: Config, options?: ScoreOptions): Partial<Record<Category, ScoreResult>>;
-interface HealthResult {
-    /** Weighted overall score across present categories (0–100). */
-    health: number;
-    categories: Partial<Record<Category, ScoreResult>>;
-    /** Effective weight used per present category. */
-    weights: Partial<Record<Category, number>>;
-}
-/** Combined weighted Health score over the categories present in `results` (#10). */
-declare function computeHealth(results: Result[], config: Config): HealthResult;
-declare function issueOf(result: Result): {
-    fix?: Fix | undefined;
-    docsUrl?: string | undefined;
-    recommendation: string | undefined;
-    line?: number | undefined;
-    id: string;
-    category: Category;
-    title: string;
-    detection: Detection;
-    location: string | undefined;
-};
-type JsonIssue = ReturnType<typeof issueOf> & {
-    severity: ReturnType<typeof effectiveSeverity>;
-};
-/**
- * Per-rule counts. A rule present with `findings: 0` ran and reported nothing, and an absent rule was not
- * selected — but only when the caller supplied `ruleIds`. Without it the map is seeded from results alone,
- * so absence means "produced nothing" rather than "not selected".
- */
-interface RuleEvidence {
-    findings: number;
-    passed: number;
-}
-interface JsonReport {
-    version: string;
-    score: number;
-    weights: Partial<Record<Category, number>>;
-    categories: Record<string, {
-        score: number;
-        scoreModel: ScoreModel;
-        keys: number;
-        affectedKeys: number;
-    }>;
-    summary: Summary;
-    rules: Record<string, RuleEvidence>;
-    routes: Array<{
-        route: string;
-        score: number;
-        categories: Record<string, number>;
-        issues: JsonIssue[];
-    }>;
-    siteIssues: JsonIssue[];
-    /**
-     * Floored severity weight per `"<category>::<scope>"` pair. Reproduces a `routes[].categories` entry
-     * (`100 - 100 * failed / inventories[pair]`): a key is either a route id or a source file path, and
-     * those two key spaces never overlap, so a category's results on one key always draw on a single scope.
-     * It does not reproduce `routes[].score`: a route spanning more than one pair sums their *raw* weights
-     * and floors that sum once, so adding this map's already-floored entries and re-dividing can disagree.
-     */
-    inventories: Record<string, number>;
-    /**
-     * Per-rule, per-declaration counts of places examined. Unlike `rules`, this describes the analysis
-     * rather than the report: `--diff`, `--baseline` and suppressions do not narrow it. Three states: a
-     * rule that reports no counts has no entry; a rule that counts but whose configuration declares
-     * nothing has an empty entry; a declaration that judged nothing has an entry of `0`.
-     */
-    examined?: Record<string, Record<string, number>>;
-}
-/** Build the structured JSON report object (design §7). The shape the `json` reporter emits (issue #24). */
-declare function buildJsonReport(results: Result[], config: Config, meta: {
-    version: string;
-}, ruleIds?: readonly string[], examined?: Record<string, Record<string, number>>): JsonReport;
-/** Render results as the documented JSON report string (design §7). */
-declare function formatJsonReport(results: Result[], config: Config, meta: {
-    version: string;
-}, ruleIds?: readonly string[], examined?: Record<string, Record<string, number>>): string;
-/** Render failing findings as an agent-actionable Markdown remediation document (issue #18). */
-declare function formatAgentReport(results: Result[], config: Config): string;
-/** Render penalized findings as a SARIF 2.1.0 log string (issue #18, design slice 5). */
-declare function formatSarifReport(results: Result[], config: Config, meta: {
-    version: string;
-}): string;
-/**
- * Render penalized findings as GitHub Actions workflow commands (issue #18, design slice 5).
- * GitHub turns these into inline PR annotations and run-annotation entries. Returns '' when clean.
- */
-declare function formatGithubReport(results: Result[], config: Config): string;
-/**
- * Render a compact Markdown summary — Health score, per-category table, severity counts, and
- * a findings table — suitable for a GitHub Actions job summary or a sticky PR comment
- * (`svelte-vitals ci install`). Delegates all aggregation to `buildJsonReport` so the numbers
- * never drift from the JSON/console reporters.
- */
-declare function formatMarkdownReport(results: Result[], config: Config, meta: {
-    version: string;
-}): string;
-type Band = 'good' | 'warn' | 'poor';
-declare const BAND_COLOR: Record<Band, string>;
-declare function scoreBand(score: number): Band;
-declare function escapeHtml(s: string): string;
-/**
- * Return the URL only when it uses a safe http/https scheme, else null.
- * Guards a finding's `docsUrl` against `javascript:`/`data:` hrefs — escapeHtml
- * neutralizes attribute breakout but not a malicious scheme. Browsers strip
- * ASCII whitespace (tab/newline/CR) from a URL before resolving its scheme (so
- * `java\tscript:` runs as `javascript:`), so strip whitespace first; anything not
- * plainly http(s):// afterward is rejected. Pure string work — no `URL` global,
- * keeping core runtime-agnostic and lib-minimal.
- */
-declare function safeHref(url: string): string | null;
-/** Provenance of a route's findings: real rendered page vs. source-only analysis. */
-type RouteBadge = 'measured' | 'static';
-interface AppSnapshot {
-    report: JsonReport;
-    badges: Record<string, RouteBadge>;
-    analyzing: boolean;
-    /** Monotonically increasing; lets the client discard an out-of-order /data.json response. */
-    sequence: number;
-    /** Whether a dev server is behind this page (SSE updates, /data.json refetch, connection dot). */
-    live: boolean;
-    meta: {
-        version: string;
-        coreVersion?: string;
-    };
-}
-/**
- * Hand-authored CSS for the master/detail shell. Reuses the same design-token
- * names/values as the rest of the project, and adds a dark theme via
- * `:root[data-theme="dark"]` plus a `prefers-color-scheme` fallback for a
- * first-ever visit with no stored preference.
- */
-declare const APP_STYLE: string;
-/**
- * Hand-authored client script for the shell — no bundler, no framework. Parses the
- * AppSnapshot embedded by renderAppShell, then owns all rendering: sidebar
- * (search/sort/route list) and detail pane (Overview or a selected route). When the
- * snapshot says `live`, it additionally re-fetches /data.json on every SSE `update`
- * and on the EventSource's `open` event (covers the initial connection and every
- * auto-reconnect, since EventSource replays no missed events) — discarding any
- * response whose `sequence` isn't newer than what's already rendered.
- */
-declare const APP_SCRIPT: string;
-/** The shell HTML: empty sidebar/detail/topbar containers, the stylesheet, the
- * client script, and the snapshot embedded as JSON for the client's first paint. */
-declare function renderAppShell(snapshot: AppSnapshot): string;
-/**
- * Static (non-live) document over a prebuilt JsonReport — kept as the public name the
- * html reporter has always exported.
- */
-declare function buildHtmlDocument(report: JsonReport, meta: {
-    version: string;
-    coreVersion?: string;
-}): string;
-/** Render results as the self-contained HTML report (the CLI's `--reporter html`). */
-declare function formatHtmlReport(results: Result[], config: Config, meta: {
-    version: string;
-    coreVersion?: string;
-}): string;
-export { type A11yOccurrenceInfo, APP_SCRIPT, APP_STYLE, type AppSnapshot, BAND_COLOR, type BranchStep, CATEGORIES, CHILD_NODE_KEYS, type Category, type Classification, type CompiledOverride, type ComponentFacts, type Config, type ConsoleReportOptions, type Detection, type EachBlockFact, type EffectFact, type FailedRule, type Fix, type HeadProvider, type HeadTag, type HeadingInfo, type HealthResult, IDREF_ATTRS, type ImageInfo, type JsonReport, type KitAlias, type KitModuleFacts, LANDMARK_ROLES, type OrphanEffectFact, type Palette, type Presence, type Project, ROBOTS_SOURCE_PATHS, type RawKitAliases, type ResolvedA11y, type ResolvedHead, type ResolvedHeadings, type ResolvedImages, type Result, type RouteBadge, type Rule, type RuleContext, type RuleEvidence, type RuleInfo, type RuleOptionInfo, type RuleOptionSpec, type RuleOptions, type RuleOptionsSpec, type RuleOverride, type RuleSetting, type RuleSettingObject, type Runtime, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, type Scope, type ScoreModel, type ScoreOptions, type ScoreResult, type Severity, type SourceSpan, type Summary, type SuppressionDirective, type TreatDynamicAs, VITE_CONFIG_FILES, type Value, type ViteKitConfigResult, a11yAccessibleName, a11yDoctype, a11yDuplicateLandmark, a11yIdDuplication, a11yInteractiveNesting, a11yInvalidAriaValue, a11yInvalidRole, a11yLabelHasControl, a11yNoMissingIdRef, a11yPlaceholderLabelOption, a11yRequireDatetime, a11yRequiredAriaProps, a11yTopLevelLandmark, a11yUnknownAriaAttribute, a11yUseList, allRules, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, compileOverrides, computeHealth, computeScore, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, decodeFragmentId, defaultConfig, defaultProject, defineConfig, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, foldOccurrences, formatAgentReport, formatConsoleReport, formatFailedRuleWarning, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, isTopFragment, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRepoLocalPath, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, splitTokens, summarize, terminalSafe, textFromNodes, validateRuleOptions, validateRuleSetting, valueFromNodes, withFailedRulesOff };
+export { ap as CATEGORIES, e as Category, i as Config, aq as Detection, F as Fix, J as JsonReport, ar as Presence, d as Result, as as RuleEvidence, at as RuleOptions, au as RuleOverride, av as RuleSetting, aw as RuleSettingObject, ax as ScoreModel, f as Severity, ay as Summary, az as TreatDynamicAs, V as Value, aA as defineConfig, a0 as formatGithubReport, a2 as formatMarkdownReport, a3 as hasFailureAtOrAbove, ak as summarize } from './index-DbUx4tlY.js';