@svelte-vitals/core 0.50.0 → 0.51.0

package/dist/internal.js

@@ -1,5 +1,2236 @@
-import { $ as architectureDocLinkTarget, $n as seoJsonLd, $t as correctnessEachIndexKey, A as a11yAbbrTitle, An as validateRuleOptions, At as parseSvelte, B as a11yAriaHiddenFocus, Bn as withFailedRulesOff, Bt as correctnessInstanceBrowserGlobal, C as a11yPermittedContents, Cn as performancePreconnect, Ct as CHILD_NODE_KEYS, D as a11yDeprecatedAttr, Dn as mapOption, Dt as attrValueOf, E as a11yDisallowedAriaProps, En as listOption, Et as attrValue, F as a11yRequireDatetime, Fn as formatFailedRuleWarning, Ft as securitySharedStateImport, G as a11yInvalidRole, Gn as linkRule, Gt as correctnessAutoplayMuted, H as a11yInvalidAriaValue, Hn as performanceLcpImage, Ht as correctnessBasePathNavigation, I as a11yPlaceholderLabelOption, In as overrideMatches, It as securityServerModuleState, J as performanceSequentialAwaits, Jn as performanceImageDimensions, Jt as correctnessStalePropDerivation, K as performanceIframeLoading, Kn as performanceResponsiveImage, Kt as correctnessCheckableBindValue, L as a11yUseList, Ln as selectRules, Lt as securityHandlerStateWrite, M as a11yNoAutofocus, Mn as applyOverrides, Mt as valueFromNodes, N as a11yNoAccesskey, Nn as applyRuleSeverities, Nt as architecturePropCount, O as a11yDeprecatedElement, On as resolveRuleOptions, Ot as findAttr, P as a11yPositiveTabindex, Pn as compileOverrides, Pt as architectureComponentSize, Q as performanceHeavyImport, Qn as seoRobotsTxt, Qt as correctnessEffectAsDerived, R as a11yLabelHasControl, Rn as settingOptions, Rt as securityJavascriptUrl, S as a11yRequiredElement, Sn as seoIndexability, St as stripTextDirective, T as a11yDeprecatedAria, Tn as isMentionedAnywhere, Tt as attrTextOf, U as a11yRequiredAriaProps, Un as performanceFontPreloadCrossorigin, Ut as correctnessOrphanLifecycle, V as a11yInteractiveNesting, Vn as performanceRenderBlockingScript, Vt as correctnessServerBrowserGlobal, W as a11yUnknownAriaAttribute, Wn as performancePreloadMissingAs, Wt as correctnessOrphanEffect, X as performanceMinifyDisabled, Xn as seoHtmlLang, Xt as correctnessUnmutatedState, Y as performanceLoadWaterfall, Yn as imageRule, Yt as correctnessPropMutation, Z as performanceNamespaceImport, Zn as seoSitemapXml, Zt as correctnessEffectAsOnMount, _ as a11yNoMissingIdRef, _n as seoSitemapInRobots, _t as LANDMARK_ROLES, a as formatJsonReport, an as seoSingleH1, ar as seoTitlePresence, at as architecturePrivateScopeImport, b as a11yDuplicateLandmark, bn as seoOgDescription, bt as isTopFragment, c as scoresByCategory, cn as seoCharset, cr as hasFailureAtOrAbove, ct as parseKitModuleFacts, d as messageText, dn as seoJsonLdRequiredProps, dr as isPenalized, dt as collectNamedImportAliases, en as correctnessEachKey, er as seoOgTitle, et as architectureRouteComponentImport, f as ruleMetaById, fn as seoJsonLdPlaceholder, ft as collectSuppressions, g as a11yUnverifiedIdRef, gn as seoJsonLdValidity, gt as IDREF_ATTRS, h as explainRule, hn as seoJsonLdDeprecatedType, ht as unwrapTs, i as buildJsonReport, in as seoDuplicateTitle, ir as headTagRule, it as architectureUnitEntryFile, j as a11yNoDuplicateDt, jn as validateRuleSetting, jt as textFromNodes, k as a11yPatternTitle, kn as shouldSkipRangeCheck, kt as lineOf, l as formatGithubReport, ln as seoDescriptionLength, lr as summarize, lt as resolveRepoLocalPath, m as allRules, mn as seoJsonLdRelativeUrl, mr as defaultProject, mt as parseModuleProgram, n as mdEscape, nn as seoHeadingLevelSkip, nr as seoCanonicalUrl, nt as architectureReservedDirectoryNames, o as computeHealth, on as seoHreflang, or as classify, ot as collectTopLevelBindings, p as severityToSarifLevel, pn as seoJsonLdDateFormat, pr as defaultConfig, pt as parseComponentFacts, q as performanceStateRaw, qn as performanceImageLoadingHint, qt as correctnessNonreactiveBuiltinState, r as terminalSafe, rn as seoDuplicateDescription, rr as seoDescriptionPresence, rt as architectureDirectoryNaming, s as computeScore, sn as seoImageAlt, sr as effectiveSeverity, st as parseInMemoryExports, t as formatMarkdownReport, tn as seoSsrDisabled, tr as seoOgImage, tt as architectureReservedNamePlacement, u as SEVERITY_RANK, un as seoTitleLength, ur as docsUrlFor, ut as resolveRunesModuleSpecifier, v as a11yIdDuplication, vn as seoViewport, vt as decodeFragmentId, w as a11yDisallowedElement, wn as intOption, wt as attrText, x as a11yDoctype, xn as seoTwitterCard, xt as splitTokens, y as a11yTopLevelLandmark, yn as seoOgUrl, yt as foldOccurrences, z as a11yAccessibleName, zn as settingSeverity, zt as securityRawHtml } from "./markdown-CEYpv4SU.js";
+import { $ as SECTIONING_TAGS, $n as settingSeverity, $t as valueFromNodes, A as a11yAbbrTitle, An as seoDescriptionLength, At as collectDerivedGuardBindings, B as a11yUseList, Bn as seoOgUrl, Bt as unwrapTs, C as a11yDisallowedElement, Cn as seoHeadingLevelSkip, Ct as parseKitModuleFacts, D as a11yDeprecatedElement, Dn as seoHreflang, Dt as addBoundNames, E as a11yDeprecatedAttr, En as seoSingleH1, Et as WALK_IGNORED_KEYS, F as isInteractiveContainer, Fn as seoJsonLdRelativeUrl, Ft as matchLifecycleCall, G as a11yInvalidAriaValue, Gn as resolveRuleOptions, Gt as attrText, H as a11yAccessibleName, Hn as seoTwitterCard, Ht as walkEvalScope, I as isInteractiveElement, In as seoJsonLdDeprecatedType, It as parseModuleProgram, J as a11yInvalidRole, Jn as applyOverrides, Jt as attrValueOf, K as a11yRequiredAriaProps, Kn as shouldSkipRangeCheck, Kt as attrTextOf, L as literalTabindexValue, Ln as seoJsonLdValidity, Lt as rootObjectName, M as a11yNoAutofocus, Mn as seoJsonLdRequiredProps, Mt as collectProgramBindings, N as a11yNoAccesskey, Nn as seoJsonLdPlaceholder, Nt as collectSuppressions, O as HTML_SPEC, On as seoImageAlt, Ot as collectBrowserGlobalRefs, P as a11yPositiveTabindex, Pn as seoJsonLdDateFormat, Pt as collectSvelteLifecycleImports, Q as NAMING_ATTRS, Qn as selectRules, Qt as textFromNodes, R as a11yRequireDatetime, Rn as seoSitemapInRobots, Rt as scopeIntroducedNames, S as a11yPermittedContents, Sn as seoSsrDisabled, Sr as isPenalized, St as parseInMemoryExports, T as a11yDisallowedAriaProps, Tn as seoDuplicateTitle, Tr as defaultProject, Tt as isRootRelativePath, U as a11yAriaHiddenFocus, Un as seoIndexability, Ut as walkScoped, V as a11yLabelHasControl, Vn as seoOgDescription, Vt as walkEstree, W as a11yInteractiveNesting, Wn as performancePreconnect, Wt as CHILD_NODE_KEYS, X as ASIDE_DEMOTING_TAGS, Xn as compileOverrides, Xt as lineOf, Y as ANCESTRY_DEPENDENT_TAGS, Yn as applyRuleSeverities, Yt as findAttr, Z as IDREF_ATTRS, Zn as formatFailedRuleWarning, Zt as parseSvelte, _ as a11yIdDuplication, _n as correctnessUnmutatedState, _r as classify, _t as architectureReservedDirectoryNames, a as formatJsonReport, an as securityJavascriptUrl, ar as performanceResponsiveImage, at as stripTextDirective, b as a11yDoctype, bn as correctnessEachIndexKey, br as summarize, bt as architecturePrivateScopeImport, c as formatGithubReport, cn as correctnessServerBrowserGlobal, cr as seoHtmlLang, ct as performanceStateRaw, d as ruleMetaById, dn as correctnessOrphanEffect, dr as seoJsonLd, dt as performanceMinifyDisabled, en as architecturePropCount, er as withFailedRulesOff, et as decodeFragmentId, f as severityToSarifLevel, fn as correctnessAutoplayMuted, fr as seoOgTitle, ft as performanceNamespaceImport, g as a11yNoMissingIdRef, gn as correctnessPropMutation, gr as seoTitlePresence, gt as architectureReservedNamePlacement, h as a11yUnverifiedIdRef, hn as correctnessStalePropDerivation, hr as seoDescriptionPresence, ht as architectureRouteComponentImport, i as buildJsonReport, in as securityHandlerStateWrite, ir as performancePreloadMissingAs, it as splitTokens, j as a11yNoDuplicateDt, jn as seoTitleLength, jt as collectNamedImportAliases, k as a11yPatternTitle, kn as seoCharset, kt as collectBrowserGuardImports, l as SEVERITY_RANK, ln as correctnessBasePathNavigation, lr as seoSitemapXml, lt as performanceSequentialAwaits, m as explainRule, mn as correctnessNonreactiveBuiltinState, mr as seoCanonicalUrl, mt as architectureDocLinkTarget, n as mdEscape, nn as securitySharedStateImport, nr as performanceLcpImage, nt as isTopFragment, o as computeHealth, on as securityRawHtml, or as performanceImageLoadingHint, ot as resolveRole, p as allRules, pn as correctnessCheckableBindValue, pr as seoOgImage, pt as performanceHeavyImport, q as a11yUnknownAriaAttribute, qn as validateRuleSetting, qt as attrValue, r as terminalSafe, rn as securityServerModuleState, rr as performanceFontPreloadCrossorigin, rt as resolveLandmark, s as computeScore, sn as correctnessInstanceBrowserGlobal, sr as performanceImageDimensions, st as performanceIframeLoading, t as formatMarkdownReport, tn as architectureComponentSize, tr as performanceRenderBlockingScript, tt as foldOccurrences, u as messageText, un as correctnessOrphanLifecycle, ur as seoRobotsTxt, ut as performanceLoadWaterfall, v as a11yTopLevelLandmark, vn as correctnessEffectAsOnMount, vr as effectiveSeverity, vt as architectureDirectoryNaming, w as a11yDeprecatedAria, wn as seoDuplicateDescription, wr as defaultConfig, wt as resolveRepoLocalPath, x as a11yRequiredElement, xn as correctnessEachKey, xr as docsUrlFor, xt as collectTopLevelBindings, y as a11yDuplicateLandmark, yn as correctnessEffectAsDerived, yr as hasFailureAtOrAbove, yt as architectureUnitEntryFile, z as a11yPlaceholderLabelOption, zn as seoViewport, zt as unwrapExport } from "./markdown-CD7sqanK.js";
+//#region src/head.ts
+const JS_MIME_TYPES = /* @__PURE__ */ new Set([
+	"application/ecmascript",
+	"application/javascript",
+	"application/x-ecmascript",
+	"application/x-javascript",
+	"text/ecmascript",
+	"text/javascript",
+	"text/javascript1.0",
+	"text/javascript1.1",
+	"text/javascript1.2",
+	"text/javascript1.3",
+	"text/javascript1.4",
+	"text/javascript1.5",
+	"text/jscript",
+	"text/livescript",
+	"text/x-ecmascript",
+	"text/x-javascript"
+]);
+/** HTML strips only ASCII whitespace from a `type` before matching — `trim()` would also strip
+*  U+00A0 etc. and misread a data block as a classic script. */
+const ASCII_WHITESPACE_EDGES = /^[\t\n\f\r ]+|[\t\n\f\r ]+$/g;
+/**
+* Whether a `type` attribute (undefined = absent) makes a `<script>` a classic,
+* render-blocking-capable script. Per the HTML spec, absent and the literal empty string are
+* classic; any other value is ASCII-whitespace-stripped and must match a JavaScript MIME type —
+* so a whitespace-only `type` is a data block, not a classic script.
+*/
+function isClassicScriptType(type) {
+	if (type === void 0 || type === "") return true;
+	return JS_MIME_TYPES.has(type.replace(ASCII_WHITESPACE_EDGES, "").toLowerCase());
+}
+//#endregion
+//#region src/component-parse.ts
+const KNOWN_TAGS = new Set(Object.keys(HTML_SPEC.elements).map((k) => k.replace(/^svg:/, "").toLowerCase()));
+/** Whether `expr` is a length-only list constructor: `Array(n)` / `new Array(n)` (single argument = length semantics) or `Array.from({ length: n }, …)`. */
+function isLengthOnlyArrayCall(expr) {
+	const e = unwrapTs(expr);
+	if (!e) return false;
+	if ((e.type === "CallExpression" || e.type === "NewExpression") && e.callee?.type === "Identifier" && e.callee.name === "Array") return (e.arguments?.length ?? 0) === 1;
+	if (e.type === "CallExpression" && e.callee?.type === "MemberExpression" && !e.callee.computed && e.callee.object?.type === "Identifier" && e.callee.object.name === "Array" && e.callee.property.type === "Identifier" && e.callee.property.name === "from" && e.arguments?.[0]?.type === "ObjectExpression") return (e.arguments[0].properties ?? []).some((p) => p?.type === "Property" && !p.computed && (p.key?.name === "length" || p.key?.value === "length"));
+	return false;
+}
+/**
+* Whether the each expression yields no item identity to key on: a constant
+* inline array literal (fixed length, never reorders), a length-only list
+* (`Array(n)`, `new Array(n)`, `[...Array(n)]`, `Array.from({ length: n })` —
+* placeholder/skeleton lists), or a spread array whose every element spreads a
+* length-only list. Such blocks are skipped entirely — neither each-key nor
+* each-index-key can give useful advice on them.
+*/
+function isIdentityFreeEach(node) {
+	const expr = unwrapTs(node.expression);
+	if (expr.type === "ArrayExpression" && Array.isArray(expr.elements)) return expr.elements.every((el) => el?.type !== "SpreadElement" || isLengthOnlyArrayCall(el.argument));
+	return isLengthOnlyArrayCall(expr);
+}
+/**
+* Whether `expr` is the index binding itself or a trivial coercion of it —
+* `i`, `String(i)`, `Number(i)`, `` `${i}` ``, `i.toString()`, `i + ''` — all
+* position-based identity. A template or concatenation with any literal text
+* (`` `row-${i}` ``, `i + '-row'`) or extra expressions is treated as composite
+* and NOT matched: composite keys may be a deliberate uniqueness workaround for
+* duplicate items.
+*/
+function isIndexExpression(expr, index) {
+	const e = unwrapTs(expr);
+	if (e.type === "Identifier") return e.name === index;
+	if (e.type === "CallExpression") {
+		const callee = e.callee;
+		if (callee.type === "Identifier" && (callee.name === "String" || callee.name === "Number") && e.arguments.length === 1) return isIndexExpression(e.arguments[0], index);
+		if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && callee.property.name === "toString" && e.arguments.length === 0) return isIndexExpression(callee.object, index);
+		return false;
+	}
+	if (e.type === "TemplateLiteral") {
+		const exprs = e.expressions;
+		if (exprs.length !== 1) return false;
+		if (e.quasis.some((q) => (q.value.cooked ?? q.value.raw) !== "")) return false;
+		return isIndexExpression(exprs[0], index);
+	}
+	if (e.type === "BinaryExpression" && e.operator === "+") {
+		const emptyString = (n) => n.type === "Literal" && n.value === "";
+		if (emptyString(e.left)) return isIndexExpression(e.right, index);
+		if (emptyString(e.right)) return isIndexExpression(e.left, index);
+	}
+	return false;
+}
+/**
+* Whether the block's key expression is its index binding or a trivial
+* stringification of it (`{#each items as item, i (i)}`, `(String(i))`,
+* `` (`${i}`) ``, `(i.toString())`) — position-based identity, the anti-pattern
+* Svelte's docs call out ("do not use the index as a key"). Composite keys that
+* merely CONTAIN the index add uniqueness and are never matched
+* (correctness/each-index-key).
+*/
+function isIndexKey(each) {
+	if (typeof each.index !== "string" || each.key == null) return false;
+	return isIndexExpression(each.key, each.index);
+}
+/** Recursively collect every `{#each}` block in the template (correctness/each-key). */
+function collectEachBlocks(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectEachBlocks(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "EachBlock" && node.context != null && !isIdentityFreeEach(node)) acc.push({
+		hasKey: node.key != null,
+		line: lineOf(source, node.start),
+		...isIndexKey(node) ? { indexKey: true } : {}
+	});
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectEachBlocks(node[key], source, acc);
+}
+/**
+* Whether a CallExpression *creates an effect*: `$effect(...)` or `$effect.pre(...)`.
+* Excludes the non-effect `$effect.*` readers (`$effect.tracking()`, `$effect.root()`),
+* which would otherwise be recorded as effects and seed spurious correctness/effect-as-derived pass units.
+*/
+function isEffectCall(node) {
+	const c = node?.callee;
+	if (c?.type === "Identifier") return c.name === "$effect";
+	if (c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$effect") return c.property?.type === "Identifier" && c.property.name === "pre";
+	return false;
+}
+/** Whether a CallExpression is `$effect.root(...)` — a legal standalone reactive scope (correctness/orphan-effect). */
+function isEffectRootCall(node) {
+	const c = node?.callee;
+	return c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$effect" && c.property?.type === "Identifier" && c.property.name === "root";
+}
+/**
+* Whether a CallExpression is a `$state` *declaration* form: `$state(...)`,
+* `$state.raw(...)`, or `$state.frozen(...)` — but NOT readers like
+* `$state.snapshot(...)`, which would otherwise pollute the state-name set (correctness/effect-as-derived).
+*/
+function isStateDeclaration(node) {
+	const c = node?.callee;
+	if (c?.type === "Identifier") return c.name === "$state";
+	if (c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$state") return c.property?.type === "Identifier" && (c.property.name === "raw" || c.property.name === "frozen");
+	return false;
+}
+/** True when a function's body does nothing but assign to `$state` identifiers (correctness/effect-as-derived). */
+function bodyOnlyAssignsState(fn, stateNames) {
+	const isStateAssign = (expr) => expr?.type === "AssignmentExpression" && expr.operator === "=" && expr.left?.type === "Identifier" && stateNames.has(expr.left.name);
+	const body = fn?.body;
+	if (!body) return false;
+	if (body.type !== "BlockStatement") return isStateAssign(body);
+	if (body.body.length === 0) return false;
+	return body.body.every((s) => s?.type === "ExpressionStatement" && isStateAssign(s.expression));
+}
+/** `$derived(...)` or `$derived.by(...)` declaration form. */
+function isDerivedDeclaration(node) {
+	const c = node?.callee;
+	if (c?.type === "Identifier") return c.name === "$derived";
+	if (c?.type === "MemberExpression" && c.object?.type === "Identifier" && c.object.name === "$derived") return c.property?.type === "Identifier" && c.property.name === "by";
+	return false;
+}
+function collectStateWrites(root, stateNames, acc, kinds) {
+	const record = (name, kind) => {
+		acc.add(name);
+		if (kinds) {
+			let set = kinds.get(name);
+			if (!set) kinds.set(name, set = /* @__PURE__ */ new Set());
+			set.add(kind);
+		}
+	};
+	walkScoped(root, (n, scope) => {
+		const shadowed = (name) => name === void 0 || scope.has(name);
+		if (n?.type === "AssignmentExpression") {
+			if (n.left?.type === "Identifier" && stateNames.has(n.left.name) && !shadowed(n.left.name)) record(n.left.name, "reassign");
+			else if (n.left?.type === "MemberExpression") {
+				const r = rootObjectName(n.left);
+				if (r && stateNames.has(r) && !shadowed(r)) record(r, "mutate");
+			} else if (n.left?.type === "ObjectPattern" || n.left?.type === "ArrayPattern") {
+				const bound = /* @__PURE__ */ new Set();
+				addBoundNames(n.left, bound);
+				for (const name of bound) if (stateNames.has(name) && !shadowed(name)) record(name, "reassign");
+			}
+		} else if (n?.type === "UpdateExpression") if (n.argument?.type === "Identifier") {
+			if (stateNames.has(n.argument.name) && !shadowed(n.argument.name)) record(n.argument.name, "reassign");
+		} else {
+			const r = rootObjectName(n.argument);
+			if (r && stateNames.has(r) && !shadowed(r)) record(r, "mutate");
+		}
+		else if (n?.type === "UnaryExpression" && n.operator === "delete") {
+			const r = rootObjectName(n.argument);
+			if (r && stateNames.has(r) && !shadowed(r)) record(r, "mutate");
+		} else if (n?.type === "CallExpression") {
+			if (n.callee?.type === "MemberExpression") {
+				const r = rootObjectName(n.callee);
+				if (r && stateNames.has(r) && !shadowed(r)) record(r, "mutate");
+			}
+			for (const a of n.arguments ?? []) {
+				const arg = a?.type === "SpreadElement" ? a.argument : a;
+				const r = rootObjectName(arg);
+				if (r && stateNames.has(r) && !shadowed(r)) record(r, "escape");
+			}
+		}
+	});
+}
+/** Function-shaped nodes whose bodies defer evaluation — prop reads inside them stay reactive (compiled to call-time reads). */
+function isDeferredBody(n) {
+	return n?.type === "FunctionDeclaration" || n?.type === "FunctionExpression" || n?.type === "ArrowFunctionExpression";
+}
+/** A plain `$state(...)` call — bare-Identifier callee, never `$state.raw`/`$state.frozen` (performance/state-raw candidates only; `isStateDeclaration` stays raw-inclusive for `stateNames`). */
+function isPlainStateCall(node) {
+	return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "$state";
+}
+/** Built-in classes with reactive drop-ins in svelte/reactivity — plain instances in $state are NOT deep-proxied, so their mutations are untracked (correctness/nonreactive-builtin-state). */
+const BUILTIN_STATE_TYPES = /* @__PURE__ */ new Set([
+	"Map",
+	"Set",
+	"Date",
+	"URL",
+	"URLSearchParams"
+]);
+/** Type-specific mutating methods. URL mutates via property writes and deep searchParams calls only. */
+const BUILTIN_MUTATIONS = {
+	Map: /* @__PURE__ */ new Set([
+		"set",
+		"delete",
+		"clear"
+	]),
+	Set: /* @__PURE__ */ new Set([
+		"add",
+		"delete",
+		"clear"
+	]),
+	Date: /* @__PURE__ */ new Set([
+		"setTime",
+		"setFullYear",
+		"setMonth",
+		"setDate",
+		"setHours",
+		"setMinutes",
+		"setSeconds",
+		"setMilliseconds",
+		"setYear",
+		"setUTCFullYear",
+		"setUTCMonth",
+		"setUTCDate",
+		"setUTCHours",
+		"setUTCMinutes",
+		"setUTCSeconds",
+		"setUTCMilliseconds"
+	]),
+	URL: /* @__PURE__ */ new Set(),
+	URLSearchParams: /* @__PURE__ */ new Set([
+		"append",
+		"set",
+		"delete",
+		"sort"
+	])
+};
+/**
+* Signals for correctness/nonreactive-builtin-state, per candidate binding
+* (name → constructor type): `mutated` collects type-specific mutations that
+* happen INSIDE a function body (a top-level init mutation runs before first
+* render and can never leave the UI stale); `reassigned` collects whole-binding
+* reassignments ANYWHERE (a fresh reassignment after mutation makes the code
+* work) — except the bare self-assignment `b = b`, a no-op under $state's
+* referential equality in Svelte 5, which must not exempt. Member writes
+* (assignment / update / `delete`) and deep member calls count as mutation
+* only for URL bindings (URL mutates via properties: `u.href = …`,
+* `u.searchParams.set(...)` — final method in the URLSearchParams set); the
+* other types count only direct calls from their own method table, so an
+* expando-property write on a Map never flags (SvelteMap would not track it
+* either). Deep reads (`get`, `has`, …) never count. Shadow-aware; class
+* bodies count as function depth.
+*/
+function collectBuiltinStateSignals(node, candidates, mutated, reassigned, shadowed = /* @__PURE__ */ new Set(), inFunction = false) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectBuiltinStateSignals(child, candidates, mutated, reassigned, shadowed, inFunction);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	const boundary = isDeferredBody(node) || node.type === "ClassDeclaration" || node.type === "ClassExpression";
+	const nextInFunction = inFunction || boundary;
+	const hit = (name) => typeof name === "string" && candidates.has(name) && !scope.has(name) ? name : void 0;
+	if (node.type === "AssignmentExpression") {
+		if (node.left?.type === "Identifier") {
+			const n = hit(node.left.name);
+			const isBareSelfAssign = node.right?.type === "Identifier" && node.right.name === n;
+			if (n && !isBareSelfAssign) reassigned.add(n);
+		} else if (node.left?.type === "ObjectPattern" || node.left?.type === "ArrayPattern") {
+			const bound = /* @__PURE__ */ new Set();
+			addBoundNames(node.left, bound);
+			for (const name of bound) {
+				const n = hit(name);
+				if (n) reassigned.add(n);
+			}
+		} else if (node.left?.type === "MemberExpression" && inFunction) {
+			const n = hit(rootObjectName(node.left));
+			if (n && candidates.get(n) === "URL") mutated.add(n);
+		}
+	} else if (node.type === "UpdateExpression" && node.argument?.type === "MemberExpression" && inFunction) {
+		const n = hit(rootObjectName(node.argument));
+		if (n && candidates.get(n) === "URL") mutated.add(n);
+	} else if (node.type === "UnaryExpression" && node.operator === "delete" && inFunction) {
+		const n = hit(rootObjectName(node.argument));
+		if (n && candidates.get(n) === "URL") mutated.add(n);
+	} else if (node.type === "CallExpression" && node.callee?.type === "MemberExpression" && !node.callee.computed && inFunction) {
+		const method = node.callee.property?.name;
+		if (typeof method === "string") {
+			if (node.callee.object?.type === "Identifier") {
+				const n = hit(node.callee.object.name);
+				if (n && BUILTIN_MUTATIONS[candidates.get(n)]?.has(method)) mutated.add(n);
+			} else if (node.callee.object?.type === "MemberExpression") {
+				const n = hit(rootObjectName(node.callee));
+				if (n && candidates.get(n) === "URL" && BUILTIN_MUTATIONS.URLSearchParams.has(method)) mutated.add(n);
+			}
+		}
+	}
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key)) continue;
+		collectBuiltinStateSignals(node[key], candidates, mutated, reassigned, scope, nextInFunction);
+	}
+}
+/**
+* Scan a binding pattern (a `VariableDeclarator.id`, or nested inside one) for
+* real references hiding inside it, while skipping the bound identifiers
+* themselves — a binding site is never a read. `const { a } = x` binds `a`,
+* no reference to anything; `const { a = obj } = x` reads `obj` (an
+* `AssignmentPattern`'s default-value RHS is a real expression position);
+* `const { [obj]: a } = x` reads `obj` as a computed key. Both cases hand off
+* to `collectAliasRefs` (normal expression-walk semantics) for the referenced
+* subtree; only the pattern shape itself (`ObjectPattern`/`ArrayPattern`/
+* `RestElement`/`AssignmentPattern` bound side) is walked specially here.
+*/
+function collectPatternAliasRefs(node, names, acc, scope, ownRhs) {
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	if (node.type === "Identifier") return;
+	if (node.type === "ObjectPattern") {
+		for (const prop of node.properties ?? []) if (prop?.type === "RestElement") collectPatternAliasRefs(prop.argument, names, acc, scope, ownRhs);
+		else if (prop?.type === "Property") {
+			if (prop.computed) collectAliasRefs(prop.key, names, acc, scope, ownRhs);
+			collectPatternAliasRefs(prop.value, names, acc, scope, ownRhs);
+		}
+		return;
+	}
+	if (node.type === "ArrayPattern") {
+		for (const el of node.elements ?? []) collectPatternAliasRefs(el, names, acc, scope, ownRhs);
+		return;
+	}
+	if (node.type === "AssignmentPattern") {
+		collectPatternAliasRefs(node.left, names, acc, scope, ownRhs);
+		collectAliasRefs(node.right, names, acc, scope, ownRhs);
+		return;
+	}
+	if (node.type === "RestElement") collectPatternAliasRefs(node.argument, names, acc, scope, ownRhs);
+}
+/**
+* Bare references to candidate names outside their own reassignments — aliasing
+* escapes (performance/state-raw condition 4). Nearest-enclosing-assignment
+* semantics: a reference is exempt only while the CLOSEST surrounding
+* AssignmentExpression assigns to that same candidate (`list = [...list, x]`
+* qualifies; `obj = (cache = obj)` does not). Skips the assignment LHS itself
+* and non-computed member properties/keys; shadow-aware. A `VariableDeclarator`
+* routes its `id` through `collectPatternAliasRefs` — bound names in the
+* pattern are never references, but destructuring defaults and computed keys
+* are — so the candidate's own `$state(literal)` declarator contains no
+* self-reference; `let b = $state([...list])` referencing ANOTHER candidate
+* still correctly counts as an alias escape of `list` via `init`. Walks
+* whatever subtree it is given — callers choose the roots.
+*/
+function collectAliasRefs(node, names, acc, shadowed = /* @__PURE__ */ new Set(), ownRhs = null) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectAliasRefs(child, names, acc, shadowed, ownRhs);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	if (node.type === "AssignmentExpression") {
+		const lhsIsCandidate = node.left?.type === "Identifier" && names.has(node.left.name) && !scope.has(node.left.name);
+		if (!lhsIsCandidate) collectAliasRefs(node.left, names, acc, scope, null);
+		collectAliasRefs(node.right, names, acc, scope, lhsIsCandidate ? node.left.name : null);
+		return;
+	}
+	if (node.type === "VariableDeclarator") {
+		collectPatternAliasRefs(node.id, names, acc, scope, ownRhs);
+		if (node.init) collectAliasRefs(node.init, names, acc, scope, ownRhs);
+		return;
+	}
+	if (node.type === "Identifier" && names.has(node.name) && !scope.has(node.name) && node.name !== ownRhs) {
+		acc.add(node.name);
+		return;
+	}
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key)) continue;
+		if (node.type === "MemberExpression" && key === "property" && !node.computed) continue;
+		if (node.type === "Property" && key === "key" && !node.computed) continue;
+		collectAliasRefs(node[key], names, acc, scope, ownRhs);
+	}
+}
+/**
+* Alias scan over the fragment: template READ positions are exempt, but function
+* bodies inside the template (inline handlers) are not — `onclick={() => (cache = obj)}`
+* escapes. Threads template shadowing (each contexts etc.) into the handler scan.
+*/
+function collectFragmentAliasRefs(node, names, acc, shadowed = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectFragmentAliasRefs(child, names, acc, shadowed);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	if (isDeferredBody(node)) {
+		const introduced = scopeIntroducedNames(node);
+		const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+		collectAliasRefs(node.body, names, acc, scope, null);
+		return;
+	}
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	if (Array.isArray(node.attributes)) collectFragmentAliasRefs(node.attributes, names, acc, scope);
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key) || key === "attributes") continue;
+		collectFragmentAliasRefs(node[key], names, acc, scope);
+	}
+}
+/**
+* Each-context taint (performance/state-raw condition 5): for `{#each candidate as item}`
+* or `{#each candidate.path as item}`, any mutate/escape of the context binding (or index)
+* inside the block — member writes, method calls, call arguments, `bind:`, component props —
+* disqualifies the candidate over the candidate or a member path of it
+* (`{#each obj.items as item}`): item-level edits stop being reactive under $state.raw.
+* Pure reassignments of the context name are ignored (they don't touch the list's contents).
+*/
+function collectEachContextTaint(node, names, acc, shadowed = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectEachContextTaint(child, names, acc, shadowed);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	if (node.type === "EachBlock") {
+		const expr = unwrapTs(node.expression);
+		const target = expr?.type === "Identifier" ? expr.name : expr?.type === "MemberExpression" ? rootObjectName(expr) : void 0;
+		if (target !== void 0 && names.has(target) && !shadowed.has(target)) {
+			const ctxNames = /* @__PURE__ */ new Set();
+			addBoundNames(node.context, ctxNames);
+			if (typeof node.index === "string") ctxNames.add(node.index);
+			if (ctxNames.size > 0) {
+				const union = /* @__PURE__ */ new Set();
+				const kinds = /* @__PURE__ */ new Map();
+				collectStateWrites(node.body, ctxNames, union, kinds);
+				collectTemplateEscapes(node.body, ctxNames, union, kinds);
+				if ([...union].some((n) => {
+					const k = kinds.get(n);
+					return !k || [...k].some((kind) => kind !== "reassign");
+				})) acc.add(target);
+			}
+		}
+	}
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key)) continue;
+		collectEachContextTaint(node[key], names, acc, scope);
+	}
+}
+/**
+* Whether `node` references any of `names` in an EAGER position: nested
+* function/arrow bodies (incl. object getters/methods, whose values are
+* FunctionExpressions) are skipped — the compiler defers those reads to call
+* time, so they stay reactive. Non-computed member properties and object keys
+* are not references. Shadow-aware via `scopeIntroducedNames`.
+*/
+function refsNamesEagerly(node, names, shadowed = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(node)) return node.some((c) => refsNamesEagerly(c, names, shadowed));
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return false;
+	if (isDeferredBody(node)) return false;
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	if (node.type === "Identifier" && names.has(node.name) && !scope.has(node.name)) return true;
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key)) continue;
+		if (node.type === "MemberExpression" && key === "property" && !node.computed) continue;
+		if (node.type === "Property" && key === "key" && !node.computed) continue;
+		if (refsNamesEagerly(node[key], names, scope)) return true;
+	}
+	return false;
+}
+/** Whether the subtree contains any call, construction, or await — used to keep stale-prop candidates to plain expressions (rune wrappers and helper/service calls are all excluded structurally). */
+function containsCallLike(node) {
+	let found = false;
+	walkEstree(node, (n) => {
+		if (n?.type === "CallExpression" || n?.type === "NewExpression" || n?.type === "AwaitExpression") found = true;
+	});
+	return found;
+}
+/**
+* Names from `names` referenced in the template fragment in an eager position:
+* expression tags, attribute/directive expressions, and block expressions count;
+* inline-handler function bodies do NOT (deferred reads never render), while
+* `{#snippet}` bodies DO (render content). Shadow-aware for template scopes
+* (each contexts + index, snippet parameters, await value/error).
+*/
+function collectFragmentRefs(node, names, acc, shadowed = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(node)) {
+		for (const c of node) collectFragmentRefs(c, names, acc, shadowed);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	if (isDeferredBody(node)) return;
+	const introduced = scopeIntroducedNames(node);
+	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
+	if (node.type === "Identifier" && names.has(node.name) && !scope.has(node.name)) acc.add(node.name);
+	if (node.type === "EachBlock" || node.type === "AwaitBlock") {
+		collectFragmentRefs(node.expression, names, acc, shadowed);
+		for (const key of Object.keys(node)) {
+			if (WALK_IGNORED_KEYS.has(key) || key === "expression") continue;
+			collectFragmentRefs(node[key], names, acc, scope);
+		}
+		return;
+	}
+	if (Array.isArray(node.attributes)) collectFragmentRefs(node.attributes, names, acc, scope);
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key) || key === "attributes") continue;
+		if (node.type === "MemberExpression" && key === "property" && !node.computed) continue;
+		if (node.type === "Property" && key === "key" && !node.computed) continue;
+		collectFragmentRefs(node[key], names, acc, scope);
+	}
+}
+/**
+* Stale prop derivations (correctness/stale-prop-derivation): top-level
+* const/let/var Identifier declarators whose CALL-FREE initializer references a
+* prop eagerly. Reassignment/escape and template-reference filtering happen at
+* the call site, where the fragment is available.
+*/
+function collectStalePropCandidates(program, propNames, source) {
+	const out = [];
+	for (const stmt of program.body ?? []) {
+		if (stmt?.type !== "VariableDeclaration") continue;
+		for (const d of stmt.declarations ?? []) {
+			if (d?.id?.type !== "Identifier" || !d.init) continue;
+			if (containsCallLike(d.init)) continue;
+			if (!refsNamesEagerly(d.init, propNames)) continue;
+			out.push({
+				name: d.id.name,
+				line: lineOf(source, d.start)
+			});
+		}
+	}
+	return out;
+}
+/**
+* Component-like nodes whose attributes are props passed INTO another component
+* (an escape), as opposed to `SvelteElement` (`<svelte:element this={...}>`), whose
+* attributes are DOM-attribute reads on a dynamically-named element — not an escape.
+*/
+const COMPONENT_LIKE_TYPES = /* @__PURE__ */ new Set([
+	"Component",
+	"SvelteComponent",
+	"SvelteSelf"
+]);
+/**
+* Add state names ESCAPED via the template (correctness/unmutated-state rules 5–6): a `bind:` on any
+* element, or passed as a prop to a component (static `<Foo>`, or dynamic
+* `<svelte:component>`/`<svelte:self>`). Slot children / DOM-attribute reads do
+* not escape. `CHILD_NODE_KEYS` omits `attributes`, so inspect them explicitly.
+* The optional `kinds` map records every hit as 'escape' for consumers that need
+* the classification (performance/state-raw); the `acc` union contract is unchanged.
+*/
+function collectTemplateEscapes(node, stateNames, acc, kinds) {
+	const record = (name) => {
+		acc.add(name);
+		if (kinds) {
+			let set = kinds.get(name);
+			if (!set) kinds.set(name, set = /* @__PURE__ */ new Set());
+			set.add("escape");
+		}
+	};
+	if (Array.isArray(node)) {
+		for (const c of node) collectTemplateEscapes(c, stateNames, acc, kinds);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	if (Array.isArray(node.attributes)) {
+		for (const attr of node.attributes) if (attr?.type === "BindDirective") {
+			const r = rootObjectName(attr.expression);
+			if (r && stateNames.has(r)) record(r);
+		} else if (COMPONENT_LIKE_TYPES.has(node.type)) walkEstree(attr, (m) => {
+			if (m?.type === "Identifier" && stateNames.has(m.name)) record(m.name);
+		});
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectTemplateEscapes(node[key], stateNames, acc, kinds);
+}
+/** Directive types verified against svelte 5 modern-AST output: `use:x={obj}` → `UseDirective`, `transition:x={obj}` → `TransitionDirective`, `animate:x={obj}` → `AnimateDirective`. */
+const DIRECTIVE_ESCAPE_TYPES = /* @__PURE__ */ new Set([
+	"UseDirective",
+	"TransitionDirective",
+	"AnimateDirective"
+]);
+/**
+* Directive expressions that hand a value to arbitrary code — `use:action={obj}`,
+* `transition:fn={obj}`, `animate:fn={obj}` — are reference handoffs, the same class
+* as a call argument. Serves `performance/state-raw` and `correctness/unmutated-state`
+* (the receiving code may mutate the proxy invisibly, so such state is neither
+* raw-able nor "unused"). The shared template-escape collector deliberately still
+* excludes directives so `correctness/stale-prop-derivation`'s disqualification set
+* is unchanged — a stale prop-derived value handed to an action is still worth flagging.
+*/
+function collectDirectiveEscapes(node, names, acc) {
+	if (Array.isArray(node)) {
+		for (const c of node) collectDirectiveEscapes(c, names, acc);
+		return;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return;
+	if (Array.isArray(node.attributes)) {
+		for (const attr of node.attributes) if (DIRECTIVE_ESCAPE_TYPES.has(attr?.type) && attr.expression) walkEstree(attr.expression, (m) => {
+			if (m?.type === "Identifier" && names.has(m.name)) acc.add(m.name);
+		});
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectDirectiveEscapes(node[key], names, acc);
+}
+const RUNE_NAMES = /* @__PURE__ */ new Set([
+	"$state",
+	"$derived",
+	"$effect",
+	"$props",
+	"$bindable",
+	"$inspect",
+	"$host"
+]);
+/**
+* Local names bound by any non-type-only import specifier (default, named, or namespace),
+* anywhere in a program (correctness/effect-as-onmount). An imported binding is opaque to this
+* analysis — it may be a runes-module state object, a `svelte/reactivity`/`svelte/reactivity/window`
+* constructor or live binding, or anything else carrying hidden reactivity — so member reads on
+* it are folded into `reactiveNames` rather than risk telling someone to replace a live effect
+* with `onMount`.
+*/
+function collectImportedLocalNames(program, acc) {
+	for (const stmt of program?.body ?? []) {
+		if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type") continue;
+		for (const s of stmt.specifiers ?? []) {
+			if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
+			acc.add(s.local.name);
+		}
+	}
+}
+/**
+* Local names declared with a `new …()` initializer (`const x = new Foo()`), anywhere in a
+* program (correctness/effect-as-onmount). A class instance is opaque the same way an import is —
+* it may carry `$state` fields — so it's folded into `reactiveNames` alongside imports.
+* Declarator-init only: `let x; x = new Foo();` is not seen (`VariableDeclarator.init` is unset,
+* and the later `AssignmentExpression` isn't a declarator at all) — a rarer style, left
+* undetected rather than adding an assignment-tracking pass for it.
+*/
+function collectNewExprLocalNames(program, acc) {
+	walkEstree(program, (n) => {
+		if (n.type !== "VariableDeclarator" || n.id?.type !== "Identifier" || !n.init) return;
+		if (unwrapTs(n.init).type === "NewExpression") acc.add(n.id.name);
+	});
+}
+/**
+* Whether an $effect callback body reads a reactive value (correctness/effect-as-onmount, conservative):
+* a reactive name (rune declarator, imported binding, or a local declared with a `new …()`
+* initializer — see `collectImportedLocalNames`/`collectNewExprLocalNames`), a `$`-prefixed
+* store subscription, or any bare-identifier call. Still blind to a reactive value reached only
+* through a plain function call's return value (`const c = createCounter()`) or a
+* prop-drilled/destructured member of one of the above — narrower than "any" reactive read,
+* deliberately: those shapes have no syntactic marker to key off, so treating them as reactive by
+* default would give up detection entirely rather than narrow it.
+*/
+function bodyReadsReactive(fn, reactiveNames) {
+	let reads = false;
+	const visit = (n) => {
+		if (reads || !n) return;
+		if (Array.isArray(n)) {
+			for (const c of n) visit(c);
+			return;
+		}
+		if (typeof n !== "object" || typeof n.type !== "string") return;
+		if (n.type === "Identifier") {
+			if (reactiveNames.has(n.name) || n.name.startsWith("$") && !RUNE_NAMES.has(n.name)) reads = true;
+			return;
+		}
+		if (n.type === "CallExpression" && n.callee?.type === "Identifier") {
+			reads = true;
+			return;
+		}
+		if (n.type === "MemberExpression") {
+			visit(n.object);
+			if (n.computed) visit(n.property);
+			return;
+		}
+		if (n.type === "Property") {
+			if (n.computed) visit(n.key);
+			visit(n.value);
+			return;
+		}
+		for (const key of Object.keys(n)) if (!WALK_IGNORED_KEYS.has(key)) visit(n[key]);
+	};
+	visit(fn.body);
+	return reads;
+}
+/** Empty effect callback body (`() => {}` or no body). */
+function bodyIsEmpty(fn) {
+	const body = fn?.body;
+	if (!body) return true;
+	if (body.type === "BlockStatement") return (body.body ?? []).length === 0;
+	return false;
+}
+/** Attributes whose value navigates/executes — a literal `javascript:` here is an XSS vector (security/javascript-url). */
+const URL_ATTRS = [
+	"href",
+	"src",
+	"action",
+	"formaction"
+];
+/** Native checkable input types where bind:value binds the wrong DOM property (correctness/checkable-bind-value). */
+const CHECKABLE_INPUT_TYPES = /* @__PURE__ */ new Set(["checkbox", "radio"]);
+/** Recursively collect Security facts: `{@html}` tags and literal `javascript:` URLs (security/raw-html, security/javascript-url). */
+function collectSecurityFacts(node, source, htmlTags, jsUrls) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectSecurityFacts(child, source, htmlTags, jsUrls);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "HtmlTag") htmlTags.push({ line: lineOf(source, node.start) });
+	if ((node.type === "RegularElement" || node.type === "SvelteElement") && Array.isArray(node.attributes)) for (const name of URL_ATTRS) {
+		const attr = findAttr(node.attributes, name);
+		if (!attr) continue;
+		const value = attrTextOf(attr);
+		if (value !== void 0 && /^\s*javascript:/i.test(value)) jsUrls.push({ line: lineOf(source, attr.start ?? node.start) });
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectSecurityFacts(node[key], source, htmlTags, jsUrls);
+}
+/**
+* `<input type="checkbox">` / `<input type="radio">` elements carrying a `bind:value`
+* directive (correctness/checkable-bind-value) — bind:value binds the DOM value property,
+* which checkbox/radio interaction never changes, so the bound state silently never updates.
+* Only `RegularElement` (a static `<input>`) is checked, so a dynamic tag via
+* `<svelte:element this="input" …>` is naturally skipped (it is a different node type). A
+* dynamic `type={expr}` makes `attrTextOf` return `undefined`, which is also skipped.
+*/
+function collectCheckableBindValues(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectCheckableBindValues(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "input" && Array.isArray(node.attributes)) {
+		const typeAttr = findAttr(node.attributes, "type");
+		const typeValue = typeAttr ? attrTextOf(typeAttr) : void 0;
+		if (typeValue && CHECKABLE_INPUT_TYPES.has(typeValue)) {
+			const bindValue = node.attributes.find((a) => a?.type === "BindDirective" && a.name === "value");
+			if (bindValue) acc.push({
+				kind: typeValue,
+				line: lineOf(source, bindValue.start ?? node.start)
+			});
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectCheckableBindValues(node[key], source, acc);
+}
+/** Classify a single Attribute's raw `value`: bare (`true`) is a literal `''`, a single Text
+*  node is its literal text, anything else (an ExpressionTag or a multi-part template) is dynamic. */
+function classifyAttrValue(value) {
+	if (value === true) return { literal: "" };
+	if (Array.isArray(value) && value.length === 1 && value[0]?.type === "Text") return { literal: String(value[0].data ?? "") };
+	return { expression: true };
+}
+/**
+* Every element, namespace-tracked: `inSvg` is set on `<svg>` and everything under it, and cleared
+* again under `<foreignObject>`; a component declaring `<svelte:options namespace="svg" />` starts
+* inside SVG, since a `<g>`-root partial has no `<svg>` of its own. `<svelte:element this="…">` is
+* skipped — the tag is dynamic, so neither its name nor its namespace is known — and its subtree
+* keeps the surrounding namespace. Compared lowercased throughout — the AST keeps source spelling,
+* HTML does not.
+*/
+const CHAIN_BREAKS = /* @__PURE__ */ new Set([
+	"Component",
+	"SvelteComponent",
+	"SvelteSelf",
+	"SvelteElement",
+	"SlotElement",
+	"RenderTag",
+	"HtmlTag",
+	"SnippetBlock",
+	"SvelteHead"
+]);
+const SILENT_BREAKS = /* @__PURE__ */ new Set(["SnippetBlock", "SvelteHead"]);
+function collectElements(node, source, acc, inSvg, parent) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectElements(child, source, acc, inSvg, parent);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	let next = inSvg;
+	let nextParent = parent;
+	if (typeof node.type === "string" && CHAIN_BREAKS.has(node.type)) {
+		if (parent !== void 0 && !SILENT_BREAKS.has(node.type)) acc[parent].unknownContent = true;
+		nextParent = void 0;
+	} else if (node.type === "RegularElement" && typeof node.name === "string" && Array.isArray(node.attributes)) {
+		const tag = node.name.toLowerCase();
+		const self = inSvg || tag === "svg";
+		const hasSpread = node.attributes.some((a) => a?.type === "SpreadAttribute");
+		acc.push({
+			tag,
+			line: lineOf(source, node.start),
+			attrs: node.attributes.filter((a) => a?.type === "Attribute" && typeof a.name === "string").map((a) => {
+				const cls = classifyAttrValue(a.value);
+				const value = "expression" in cls ? void 0 : cls.literal;
+				return {
+					name: String(a.name).toLowerCase(),
+					line: lineOf(source, a.start ?? node.start),
+					...value !== void 0 ? { value } : {}
+				};
+			}),
+			...self ? { inSvg: true } : {},
+			...parent !== void 0 ? { parent } : {},
+			...hasSpread ? { hasSpread: true } : {}
+		});
+		if (tag.includes("-") || !KNOWN_TAGS.has(tag)) {
+			if (parent !== void 0) acc[parent].unknownContent = true;
+			nextParent = void 0;
+		} else nextParent = acc.length - 1;
+		if (tag === "svg") next = true;
+		else if (tag === "foreignobject") next = false;
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectElements(node[key], source, acc, next, nextParent);
+}
+/**
+* Elements carrying a `role` and/or `aria-*` attribute(s) (a11y ARIA rules). Only
+* `RegularElement` is checked, so `<svelte:element this="div" role="…">` is out of static reach —
+* same convention as `collectCheckableBindValues`/`collectHrefLinks`.
+*/
+/** HTML-AAM: a `<select>` is a combobox unless `multiple` or a display `size` above 1 makes it a listbox. */
+function selectNativeRole(attributes) {
+	if (findAttr(attributes, "multiple") !== void 0) return "listbox";
+	const size = findAttr(attributes, "size");
+	if (size === void 0) return "combobox";
+	if (attrValueOf(size) !== "static") return void 0;
+	return Number(attrTextOf(size)) > 1 ? "listbox" : "combobox";
+}
+function collectAriaElements(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectAriaElements(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && Array.isArray(node.attributes)) {
+		const roleAttr = findAttr(node.attributes, "role");
+		const ariaAttrs = node.attributes.filter((a) => a?.type === "Attribute" && typeof a.name === "string" && a.name.toLowerCase().startsWith("aria-"));
+		if (roleAttr || ariaAttrs.length > 0) {
+			const tag = node.name.toLowerCase();
+			const inputType = tag === "input" ? attrText(node.attributes, "type") : void 0;
+			const hasList = tag === "input" && findAttr(node.attributes, "list") !== void 0;
+			const selectKind = tag === "select" ? selectNativeRole(node.attributes) : void 0;
+			const hasSpread = node.attributes.some((a) => a?.type === "SpreadAttribute");
+			acc.push({
+				tag,
+				line: lineOf(source, node.start),
+				...roleAttr ? { role: classifyAttrValue(roleAttr.value) } : {},
+				...inputType !== void 0 ? { inputType: inputType.toLowerCase() } : {},
+				...hasList ? { hasList: true } : {},
+				...selectKind ? { selectKind } : {},
+				...hasSpread ? { hasSpread: true } : {},
+				aria: ariaAttrs.map((a) => ({
+					name: String(a.name).toLowerCase(),
+					line: lineOf(source, a.start ?? node.start),
+					...classifyAttrValue(a.value)
+				}))
+			});
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectAriaElements(node[key], source, acc);
+}
+/** This element's `Attribute` nodes (directives/spreads excluded) as `isInteractiveElement`'s
+*  input shape. */
+function elementAttrs(attributes) {
+	return attributes.filter((a) => a?.type === "Attribute" && typeof a.name === "string").map((a) => ({
+		name: String(a.name).toLowerCase(),
+		...classifyAttrValue(a.value)
+	}));
+}
+/**
+* Interactive elements nested inside another interactive container (a11y/interactive-nesting).
+* Only `RegularElement` is checked, so `<svelte:element this="button">` is out of static reach
+* — same convention as `collectAriaElements`. `stack` tracks the enclosing containers
+* (`isInteractiveContainer`); any interactive element entering while it is non-empty records
+* one fact at the descendant's line, keyed to the nearest enclosing container.
+*/
+/** The literal role that made an element a container, for the finding's message. */
+function containerRoleOf(attrs) {
+	const role = attrs.find((a) => a.name === "role")?.literal;
+	return role ? resolveRole(splitTokens(role)) : void 0;
+}
+function collectInteractiveNestings(node, source, acc, stack) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectInteractiveNestings(child, source, acc, stack);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "SnippetBlock") {
+		for (const key of CHILD_NODE_KEYS) if (key in node) collectInteractiveNestings(node[key], source, acc, []);
+		return;
+	}
+	let opened = false;
+	if (node.type === "RegularElement" && Array.isArray(node.attributes)) {
+		const attrs = elementAttrs(node.attributes);
+		if (stack.length > 0 && isInteractiveElement(node.name, attrs)) {
+			const container = stack[stack.length - 1];
+			acc.push({
+				containerTag: container.tag,
+				...container.role ? { containerRole: container.role } : {},
+				descendantTag: node.name,
+				line: lineOf(source, node.start)
+			});
+		}
+		if (isInteractiveContainer(node.name, attrs)) {
+			const role = node.name === "button" || node.name === "a" ? void 0 : containerRoleOf(attrs);
+			stack.push({
+				tag: node.name,
+				...role ? { role } : {}
+			});
+			opened = true;
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectInteractiveNestings(node[key], source, acc, stack);
+	if (opened) stack.pop();
+}
+/** Tags on which a `disabled` attribute actually removes focusability (it does nothing on `<a>`). */
+const DISABLEABLE_TAGS = /* @__PURE__ */ new Set([
+	"button",
+	"input",
+	"select",
+	"textarea"
+]);
+/**
+* Keyboard-focusable elements hidden by a literal `aria-hidden="true"` (a11y/aria-hidden-focus).
+* Same conventions as `collectInteractiveNestings`: only `RegularElement`, snippet bodies walk
+* with a fresh stack (they render at their `{@render}` site), and an expression `aria-hidden`
+* is unknowable — a toggled `aria-hidden={...}` never opens a container. Exempt as not
+* focusable: a `tabindex` that is negative (the documented remediation) or an expression (it
+* may resolve to -1), a `disabled` form control, and anything at or under an `inert` or
+* `hidden` element — an inert subtree leaves the tab order and a hidden one does not render,
+* so both carry down the walk as `unfocusable`.
+*/
+function collectAriaHiddenFocusables(node, source, acc, stack, unfocusable = false) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectAriaHiddenFocusables(child, source, acc, stack, unfocusable);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "SnippetBlock") {
+		for (const key of CHILD_NODE_KEYS) if (key in node) collectAriaHiddenFocusables(node[key], source, acc, []);
+		return;
+	}
+	let opened = false;
+	if (node.type === "RegularElement" && Array.isArray(node.attributes)) {
+		const attrs = elementAttrs(node.attributes);
+		if (attrs.some((a) => a.name === "inert" || a.name === "hidden")) unfocusable = true;
+		const hiddenSelf = attrs.find((a) => a.name === "aria-hidden")?.literal?.trim().toLowerCase() === "true";
+		const tabindexAttr = attrs.find((a) => a.name === "tabindex");
+		const tabindex = literalTabindexValue(tabindexAttr?.literal);
+		const tabindexExempts = tabindexAttr !== void 0 && tabindexAttr.literal === void 0;
+		if (!unfocusable && !tabindexExempts && !(tabindex !== void 0 && tabindex < 0) && !(DISABLEABLE_TAGS.has(node.name) && attrs.some((a) => a.name === "disabled")) && isInteractiveElement(node.name, attrs) && (hiddenSelf || stack.length > 0)) acc.push({
+			tag: node.name,
+			...hiddenSelf ? {} : { containerTag: stack[stack.length - 1] },
+			line: lineOf(source, node.start)
+		});
+		if (hiddenSelf) {
+			stack.push(node.name);
+			opened = true;
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectAriaHiddenFocusables(node[key], source, acc, stack, unfocusable);
+	if (opened) stack.pop();
+}
+/** `aria-label`/`aria-labelledby`/`title` present on this element: a literal non-empty value,
+*  or any expression (its rendered value is unknowable, but its *presence* is enough to name
+*  the element — a11y/accessible-name treats an expression name source as present). */
+/** An attribute present with a non-blank literal, or with an expression whose value is unknowable
+*  and so must be assumed to carry one. */
+function hasNamingValue(attributes, name) {
+	const attr = findAttr(attributes, name);
+	if (!attr) return false;
+	const v = classifyAttrValue(attr.value);
+	return "expression" in v || v.literal !== void 0 && v.literal.trim().length > 0;
+}
+function hasNamingAttr(attributes) {
+	return [
+		"aria-label",
+		"aria-labelledby",
+		"title"
+	].some((name) => hasNamingValue(attributes, name));
+}
+/** A tag name with a hyphen is a custom element: it may be form-associated, and its shadow root may
+*  supply content, neither of which is visible here. Treated as unknowable by both a11y scanners. */
+function isCustomElement(node) {
+	return node.type === "RegularElement" && typeof node.name === "string" && node.name.includes("-");
+}
+function scanAccessibleNameSubtree(node, skip) {
+	if (Array.isArray(node)) {
+		const acc = {
+			named: false,
+			unknowable: false
+		};
+		for (const child of node) {
+			const r = scanAccessibleNameSubtree(child, skip);
+			acc.named ||= r.named;
+			acc.unknowable ||= r.unknowable;
+		}
+		return acc;
+	}
+	if (!node || typeof node !== "object") return {
+		named: false,
+		unknowable: false
+	};
+	if (skip !== void 0 && node === skip) return {
+		named: false,
+		unknowable: false
+	};
+	if (node.type === "SnippetBlock") return {
+		named: false,
+		unknowable: false
+	};
+	if (node.type === "Text") return {
+		named: String(node.data ?? "").trim().length > 0,
+		unknowable: false
+	};
+	if (node.type === "ExpressionTag" || node.type === "RenderTag" || node.type === "HtmlTag" || node.type === "SlotElement" || node.type === "SvelteFragment" || COMPONENT_LIKE_TYPES.has(node.type) || isCustomElement(node)) return {
+		named: false,
+		unknowable: true
+	};
+	if (node.type === "RegularElement" && node.name === "img" && Array.isArray(node.attributes)) {
+		if (hasNamingValue(node.attributes, "alt")) return {
+			named: true,
+			unknowable: false
+		};
+	}
+	const acc = {
+		named: false,
+		unknowable: false
+	};
+	for (const key of CHILD_NODE_KEYS) if (key in node) {
+		const r = scanAccessibleNameSubtree(node[key], skip);
+		acc.named ||= r.named;
+		acc.unknowable ||= r.unknowable;
+	}
+	return acc;
+}
+/** Which accessible-name target `node` is, or undefined if it isn't one (a11y/accessible-name).
+*  `a` needs a literal `href` (an expression href is unknowable whether the anchor even renders
+*  as a link, matching the `isInteractiveContainer` convention above); `input` needs a literal
+*  `type="image"`. */
+function accessibleNameTarget(node) {
+	if (node.name === "button") return "button";
+	if (node.name === "a") return attrText(node.attributes, "href") !== void 0 ? "a" : void 0;
+	if (node.name === "input") return attrText(node.attributes, "type")?.toLowerCase() === "image" ? "input" : void 0;
+}
+/** The first labelable descendant of a `<label>` — the only control an implicit association
+*  reaches, so a second control inside the same label is not named by it. */
+function firstLabelableDescendant(node) {
+	if (Array.isArray(node)) {
+		for (const child of node) {
+			const hit = firstLabelableDescendant(child);
+			if (hit) return hit;
+		}
+		return;
+	}
+	if (!node || typeof node !== "object") return void 0;
+	if (node.type === "SnippetBlock") return void 0;
+	if (node.type === "RegularElement" && isLabelableDescendant(node)) return node;
+	for (const key of CHILD_NODE_KEYS) if (key in node) {
+		const hit = firstLabelableDescendant(node[key]);
+		if (hit) return hit;
+	}
+}
+/**
+* What each `<label>` in the file names: the literal `for` it points at, and the one control it
+* encapsulates. HTML-AAM gives `button` and `input type="image"` this step ahead of their own
+* subtree, so a label that contributes a name — or content this analysis cannot read — takes the
+* element out of `a11y/accessible-name`'s reach. A label that is itself provably empty does not:
+* the control stays unnamed and is still reported.
+*/
+function collectLabelTargets(node, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectLabelTargets(child, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "label" && Array.isArray(node.attributes)) {
+		const wrapped = firstLabelableDescendant(node);
+		const scan = scanAccessibleNameSubtree(node, wrapped);
+		if (scan.named || scan.unknowable) {
+			const forId = attrText(node.attributes, "for");
+			if (forId !== void 0 && forId.trim().length > 0) acc.ids.add(forId.trim());
+			if (wrapped) acc.nodes.add(wrapped);
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectLabelTargets(node[key], acc);
+}
+/**
+* `button`/`a href`/`input type="image"` elements with no computable accessible name
+* (a11y/accessible-name). A spread attribute on the element itself makes its rendered
+* attributes unknowable, so the element is skipped entirely rather than risk a false positive.
+*
+* `labels` carries the two `<label>` name routes, which `<a>` does not have.
+*/
+function collectUnnamedInteractive(node, source, acc, labels) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectUnnamedInteractive(child, source, acc, labels);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && Array.isArray(node.attributes)) {
+		const target = accessibleNameTarget(node);
+		const hasSpread = node.attributes.some((a) => a?.type === "SpreadAttribute");
+		const id = attrText(node.attributes, "id");
+		const namedByLabel = target !== "a" && (labels.nodes.has(node) || id !== void 0 && labels.ids.has(id.trim()));
+		if (target && !hasSpread && !namedByLabel) if (target === "input") {
+			if (!hasNamingAttr(node.attributes) && !hasNamingValue(node.attributes, "alt")) acc.push({
+				tag: node.name,
+				line: lineOf(source, node.start)
+			});
+		} else {
+			const scan = scanAccessibleNameSubtree(node);
+			if (!hasNamingAttr(node.attributes) && !scan.named && !scan.unknowable) acc.push({
+				tag: node.name,
+				line: lineOf(source, node.start)
+			});
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectUnnamedInteractive(node[key], source, acc, labels);
+}
+/** Whether `node` is a labelable element that associates a `<label>` by wrapping it
+*  (a11y/label-has-control): `input` (unless its literal `type` is `hidden`), `select`,
+*  `textarea`, `button`, `meter`, `output`, `progress`. */
+const LABELABLE_TAGS = /* @__PURE__ */ new Set([
+	"input",
+	"select",
+	"textarea",
+	"button",
+	"meter",
+	"output",
+	"progress"
+]);
+function isLabelableDescendant(node) {
+	if (node.type !== "RegularElement" || !LABELABLE_TAGS.has(node.name)) return false;
+	if (node.name !== "input") return true;
+	return attrText(node.attributes ?? [], "type")?.toLowerCase() !== "hidden";
+}
+function scanLabelSubtree(node) {
+	if (Array.isArray(node)) {
+		const acc = {
+			hasControl: false,
+			unknowable: false
+		};
+		for (const child of node) {
+			const r = scanLabelSubtree(child);
+			acc.hasControl ||= r.hasControl;
+			acc.unknowable ||= r.unknowable;
+		}
+		return acc;
+	}
+	if (!node || typeof node !== "object") return {
+		hasControl: false,
+		unknowable: false
+	};
+	if (node.type === "SnippetBlock") return {
+		hasControl: false,
+		unknowable: false
+	};
+	if (node.type === "ExpressionTag" || node.type === "RenderTag" || node.type === "HtmlTag" || node.type === "SlotElement" || node.type === "SvelteFragment" || COMPONENT_LIKE_TYPES.has(node.type) || isCustomElement(node)) return {
+		hasControl: false,
+		unknowable: true
+	};
+	if (isLabelableDescendant(node)) return {
+		hasControl: true,
+		unknowable: false
+	};
+	const acc = {
+		hasControl: false,
+		unknowable: false
+	};
+	for (const key of CHILD_NODE_KEYS) if (key in node) {
+		const r = scanLabelSubtree(node[key]);
+		acc.hasControl ||= r.hasControl;
+		acc.unknowable ||= r.unknowable;
+	}
+	return acc;
+}
+/**
+* `<label>` elements with neither a `for` attribute (literal or expression — its presence is
+* enough) nor a wrapped labelable descendant (a11y/label-has-control). A spread attribute may
+* supply `for`, so it is treated the same as an explicit one.
+*/
+function collectUnassociatedLabels(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectUnassociatedLabels(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "label" && Array.isArray(node.attributes)) {
+		const hasFor = findAttr(node.attributes, "for") !== void 0;
+		const hasSpread = node.attributes.some((a) => a?.type === "SpreadAttribute");
+		if (!hasFor && !hasSpread) {
+			const scan = scanLabelSubtree(node);
+			if (!scan.hasControl && !scan.unknowable) acc.push({ line: lineOf(source, node.start) });
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectUnassociatedLabels(node[key], source, acc);
+}
+/** Requires trailing whitespace after the bullet char to avoid flagging `-webkit` prose or a
+*  signed number like `-1` (a11y/use-list). */
+const BULLET_TEXT_RE = /^[•・·\-*]\s/;
+/** Ancestries whose text is code, keystrokes or user input rather than prose, so a leading dash
+*  is a character in the content and not a bullet (a11y/use-list). */
+const VERBATIM_TEXT_TAGS = /* @__PURE__ */ new Set([
+	"pre",
+	"code",
+	"kbd",
+	"samp",
+	"textarea"
+]);
+/**
+* Text nodes whose trimmed content opens with a bullet character followed by whitespace,
+* outside any `li` ancestor — a plain-text bullet where a `<ul>`/`<ol>` would give assistive
+* technology a real list structure (a11y/use-list). A list is two or more items: a lone bullet
+* line (`<p>- note</p>`) is a dash, not a list, and WCAG H48 is about sequences. So bullet texts
+* count only in twos or more under one parent — either as sibling text nodes (`- one<br>- two`)
+* or as the opening text of sibling elements (`<p>• one</p><p>• two</p>`).
+*/
+function collectBulletTexts(node, source, acc, inert, afterExpression = false, reported = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(node)) {
+		let prevWasExpression = afterExpression;
+		let group = [];
+		const flush = () => {
+			if (group.length >= 2) for (const b of group) {
+				if (reported.has(b.text)) continue;
+				reported.add(b.text);
+				acc.push({
+					line: b.line,
+					char: b.char
+				});
+			}
+			group = [];
+		};
+		const bulletOf = (text, after) => {
+			if (!text || typeof text !== "object" || text.type !== "Text" || after) return void 0;
+			const trimmed = String(text.data ?? "").trim();
+			return BULLET_TEXT_RE.test(trimmed) ? {
+				line: lineOf(source, text.start),
+				char: trimmed[0],
+				text
+			} : void 0;
+		};
+		for (const child of node) {
+			if (!child || typeof child !== "object") continue;
+			if (child.type === "Text") {
+				const b = inert ? void 0 : bulletOf(child, prevWasExpression);
+				if (b) group.push(b);
+				else if (String(child.data ?? "").trim()) flush();
+			} else if (child.type === "Comment" || child.type === "RegularElement" && child.name === "br") {} else {
+				let item;
+				if (!inert && child.type === "RegularElement" && child.name !== "li" && !VERBATIM_TEXT_TAGS.has(child.name)) item = bulletOf((child.fragment?.nodes ?? []).find((n) => !(n?.type === "Text" && !String(n.data ?? "").trim()) && n?.type !== "Comment"), prevWasExpression);
+				if (item) group.push(item);
+				else flush();
+				collectBulletTexts(child, source, acc, inert, prevWasExpression, reported);
+			}
+			if (child.type !== "Comment") prevWasExpression = child.type === "ExpressionTag";
+		}
+		flush();
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "Text") return;
+	if (node.type === "SnippetBlock") return;
+	const nowInert = inert || node.type === "RegularElement" && (node.name === "li" || VERBATIM_TEXT_TAGS.has(node.name));
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectBulletTexts(node[key], source, acc, nowInert, false, reported);
+}
+/** Whether `<select attrs>` is subject to the placeholder-label-option requirement: `required`
+*  present (literal — a dynamic `required` makes presence unknowable), no `multiple` (literal
+*  or dynamic — either way this select is out of scope), and `size` absent or a literal ≤ 1
+*  (a dynamic `size` is unknowable, so treated the same as out of scope). */
+function selectNeedsPlaceholder(attributes) {
+	const requiredAttr = findAttr(attributes, "required");
+	if (!requiredAttr || attrValueOf(requiredAttr) === "dynamic") return false;
+	if (findAttr(attributes, "multiple")) return false;
+	const sizeAttr = findAttr(attributes, "size");
+	if (sizeAttr) {
+		if (attrValueOf(sizeAttr) === "dynamic") return false;
+		const size = Number(attrText(attributes, "size"));
+		if (!(Number.isFinite(size) && size <= 1)) return false;
+	}
+	return true;
+}
+/** First child of a `<select>`'s fragment that isn't purely a whitespace `Text` node or a
+*  `Comment` — what the browser treats as the element's first real content. */
+function firstSignificantChild(nodes) {
+	for (const child of nodes ?? []) {
+		if (!child) continue;
+		if (child.type === "Comment") continue;
+		if (child.type === "Text" && !String(child.data ?? "").trim()) continue;
+		return child;
+	}
+}
+/** Whether an `<option>` is a valid placeholder label option per the HTML spec: an empty
+*  `value` attribute, or no `value` attribute and no text content. A dynamic `value` or a
+*  dynamic text child makes the option's effective value unknowable, so it is treated the
+*  same as a valid placeholder — proving a violation is what this rule requires, not guessing one. */
+function isPlaceholderOption(option) {
+	const attributes = option.attributes ?? [];
+	if (findAttr(attributes, "value")) {
+		const literal = attrText(attributes, "value");
+		return literal === void 0 || literal === "";
+	}
+	return textFromNodes(option.fragment?.nodes ?? []) === void 0;
+}
+/**
+* `<select required>` (no `multiple`, display size absent or ≤ 1) whose first `option` element
+* child is not a placeholder label option (a11y/placeholder-label-option). The first significant
+* child not being a literal `option` — an `{#each}` block, a Component, an `{#if}`, etc. — makes
+* the select's first option unknowable, so it is skipped rather than risk a false positive; a
+* `<select>` with no content at all has no placeholder to find, so it is flagged. A spread
+* attribute on the `<select>` itself (may supply `multiple`/`size`) or on the first `option`
+* (may supply `value`) makes the relevant check unknowable, so it is skipped too.
+*/
+function collectSelectsMissingPlaceholder(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectSelectsMissingPlaceholder(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "select" && Array.isArray(node.attributes)) {
+		if (!node.attributes.some((a) => a?.type === "SpreadAttribute") && selectNeedsPlaceholder(node.attributes)) {
+			const first = firstSignificantChild(node.fragment?.nodes);
+			if (!first) acc.push({ line: lineOf(source, node.start) });
+			else if (first.type === "RegularElement" && first.name === "option") {
+				if (!(first.attributes ?? []).some((a) => a?.type === "SpreadAttribute") && !isPlaceholderOption(first)) acc.push({ line: lineOf(source, node.start) });
+			}
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectSelectsMissingPlaceholder(node[key], source, acc);
+}
+/** Machine-readable literal formats a `<time>` may use without a `datetime` attribute — a
+*  permissive subset of the HTML spec's valid time-string grammar (year/month/date, time,
+*  date-time, yearless date, duration). Anything else needs an explicit `datetime`. */
+/** The `<time>` content syntaxes the HTML spec permits without a `datetime` attribute. A year is
+*  four **or more** digits, and a duration has two spellings: the `PnYnMnD` form and the
+*  alternative `4h 18m 3s` form, which is what recipes and media lengths are written in. */
+const MACHINE_READABLE_TIME = [
+	/^\d{4,}(-\d{2}){0,2}$/,
+	/^\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/,
+	/^\d{4,}-\d{2}-\d{2}[T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?$/,
+	/^\d{2}-\d{2}$/,
+	/^\d{4,}-W\d{2}$/,
+	/^(Z|[+-]\d{2}:?\d{2})$/,
+	/^P(?=\d|T)[\d.,TYWDHMS]*$/i,
+	/^\d+(\.\d+)?\s*[wdhms](\s+\d+(\.\d+)?\s*[wdhms])*$/i
+];
+/**
+* `<time>` elements with no `datetime` attribute whose content is plain literal text that isn't
+* itself machine-readable (a11y/require-datetime). Any non-`Text` child — an `ExpressionTag`, a
+* Component, a block — makes the rendered text unknowable, so the element is skipped rather than
+* risk a false positive. A spread attribute may itself supply `datetime`, so it is skipped too.
+*/
+function collectTimesMissingDatetime(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectTimesMissingDatetime(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "time" && findAttr(node.attributes ?? [], "datetime") === void 0 && !(node.attributes ?? []).some((a) => a?.type === "SpreadAttribute")) {
+		const nodes = node.fragment?.nodes ?? [];
+		if (nodes.length > 0 && nodes.every((n) => n?.type === "Text")) {
+			const trimmed = nodes.map((n) => String(n.data ?? "")).join("").trim();
+			if (trimmed.length > 0 && !MACHINE_READABLE_TIME.some((re) => re.test(trimmed))) acc.push({
+				line: lineOf(source, node.start),
+				text: trimmed
+			});
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectTimesMissingDatetime(node[key], source, acc);
+}
+/**
+* Fully-static text content of a node list: concatenated `Text` data, looked through static
+* regular elements (`<dt><code>HTTP</code></dt>` names "HTTP"), with comments contributing
+* nothing. `undefined` when anything dynamic appears anywhere below — an expression, a
+* component, a block, `{@html}`/`{@render}`, `<svelte:element>`, a `<slot>`, or a custom
+* element (its shadow root may supply content) — because the rendered text is then unknowable.
+*/
+function staticTextOf(nodes) {
+	let out = "";
+	for (const n of nodes) {
+		if (!n || typeof n !== "object") continue;
+		if (n.type === "Comment") continue;
+		if (n.type === "Text") {
+			out += String(n.data ?? "");
+			continue;
+		}
+		if (n.type === "RegularElement" && typeof n.name === "string" && !n.name.includes("-")) {
+			const inner = staticTextOf(n.fragment?.nodes ?? []);
+			if (inner === void 0) return void 0;
+			out += inner;
+			continue;
+		}
+		return;
+	}
+	return out;
+}
+/**
+* Duplicate `<dt>` names within one `<dl>` (a11y/no-duplicate-dt). Candidates are `<dt>`
+* elements that are direct children of the `<dl>`, or direct children of a direct `<div>`
+* child (the spec's div-wrapped name-value groups); a dt under a logic block or component is
+* not a candidate — its multiplicity or rendered content is unknowable, and unknowable names
+* can only ever add duplicates, never fabricate one between two static non-duplicates. A
+* candidate's name is its fully-static text content (`staticTextOf` above — static phrasing
+* markup like `<dt><code>HTTP</code></dt>` is looked through, comments contribute nothing),
+* trimmed and whitespace-collapsed; an empty name is not a candidate (two empty dts are a
+* missing-content defect, not a duplicate name).
+* Comparison is case-sensitive — the spec leaves the equality undefined, so only certain
+* duplicates are reported. Namespace is tracked like `collectElements`: a `<dl>` inside
+* `<svg>` never renders as an HTML definition list, so it is skipped; `<foreignObject>`
+* children return to HTML. Nested `<dl>`s get their own scope for free — the walk recurses
+* and a nested dl's dts are never the outer dl's direct children.
+*/
+function collectDuplicateDts(node, source, acc, inSvg) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectDuplicateDts(child, source, acc, inSvg);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	let next = inSvg;
+	if (node.type === "RegularElement" && typeof node.name === "string") {
+		const tag = node.name.toLowerCase();
+		if (tag === "svg") next = true;
+		else if (tag === "foreignobject") next = false;
+		if (!inSvg && tag === "dl") {
+			const seen = /* @__PURE__ */ new Set();
+			const judge = (dt) => {
+				const raw = staticTextOf(dt.fragment?.nodes ?? []);
+				if (raw === void 0) return;
+				const name = raw.trim().replace(/\s+/g, " ");
+				if (!name) return;
+				if (seen.has(name)) acc.push({
+					line: lineOf(source, dt.start),
+					text: name
+				});
+				else seen.add(name);
+			};
+			for (const child of node.fragment?.nodes ?? []) {
+				if (child?.type !== "RegularElement" || typeof child.name !== "string") continue;
+				const childTag = child.name.toLowerCase();
+				if (childTag === "dt") judge(child);
+				else if (childTag === "div") {
+					for (const inner of child.fragment?.nodes ?? []) if (inner?.type === "RegularElement" && typeof inner.name === "string" && inner.name.toLowerCase() === "dt") judge(inner);
+				}
+			}
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectDuplicateDts(node[key], source, acc, next);
+}
+/**
+* `<video>` with a literal `autoplay` attribute and no `muted` in any form
+* (correctness/autoplay-muted). Presence is what autoplays, so any literal value counts
+* (`autoplay="false"` still autoplays); an expression value is unknowable and is skipped.
+* `muted` passes in every form — bare, `bind:muted`, a spread that could supply it, or
+* `muted={expr}`, whose value is deliberately not evaluated (issue #580 scopes the rule to
+* attribute presence). Only `RegularElement` is checked — `<svelte:element this="video">`
+* follows the same RegularElement-only convention as `collectCheckableBindValues`. Namespace
+* is tracked like `collectElements`: a `<video>` inside `<svg>` is an SVG-namespace element,
+* not an HTML video, so it is skipped; `<foreignObject>` children return to HTML.
+*/
+function collectVideosAutoplayNoMuted(node, source, acc, inSvg) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectVideosAutoplayNoMuted(child, source, acc, inSvg);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	let next = inSvg;
+	if (node.type === "RegularElement" && typeof node.name === "string") {
+		const tag = node.name.toLowerCase();
+		if (tag === "svg") next = true;
+		else if (tag === "foreignobject") next = false;
+		if (!inSvg && tag === "video" && Array.isArray(node.attributes)) {
+			const literalAutoplay = attrText(node.attributes, "autoplay") !== void 0;
+			const hasMuted = findAttr(node.attributes, "muted") !== void 0 || node.attributes.some((a) => a?.type === "BindDirective" && a.name === "muted" || a?.type === "SpreadAttribute");
+			if (literalAutoplay && !hasMuted) acc.push({ line: lineOf(source, node.start) });
+		}
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectVideosAutoplayNoMuted(node[key], source, acc, next);
+}
+/**
+* Root-relative `<a href="/…">` literals (correctness/base-path-navigation). Only
+* `RegularElement` anchors with a fully static href are considered, which is what makes the
+* correct forms self-excluding: `href="{base}/x"` and `href={resolve('/x')}` contain an
+* `ExpressionTag`, so `attrTextOf` returns undefined. `<svelte:element this="a">` is a
+* different node type and is out of static reach.
+*/
+function collectHrefLinks(node, source, acc) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectHrefLinks(child, source, acc);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	if (node.type === "RegularElement" && node.name === "a" && Array.isArray(node.attributes)) {
+		const attr = findAttr(node.attributes, "href");
+		const value = attr ? attrTextOf(attr) : void 0;
+		if (value !== void 0 && isRootRelativePath(value)) acc.push({
+			kind: "href",
+			path: value,
+			line: lineOf(source, attr?.start ?? node.start)
+		});
+	}
+	for (const key of CHILD_NODE_KEYS) if (key in node) collectHrefLinks(node[key], source, acc);
+}
+const GOTO_NAMES = /* @__PURE__ */ new Set(["goto"]);
+/**
+* Root-relative `goto('/…')` calls (correctness/base-path-navigation). Only a plain string
+* literal argument counts, which self-excludes the correct forms — `goto(resolve('/x'))` is a
+* CallExpression and ``goto(`${base}/x`)`` is a TemplateLiteral. `roots` are the nodes to walk
+* (the instance program plus the template fragment, so inline handlers are covered); `locals`
+* comes from the same program's imports.
+*/
+function collectGotoLinks(locals, roots, source, acc) {
+	if (locals.size === 0) return;
+	for (const root of roots) {
+		if (!root) continue;
+		walkEstree(root, (n) => {
+			if (n.type !== "CallExpression" || n.callee?.type !== "Identifier" || !locals.has(n.callee.name)) return;
+			const arg = n.arguments?.[0];
+			if (arg?.type !== "Literal" || typeof arg.value !== "string" || !isRootRelativePath(arg.value)) return;
+			acc.push({
+				kind: "goto",
+				path: arg.value,
+				line: lineOf(source, n.start)
+			});
+		});
+	}
+}
+/** Whether a CallExpression is a bare `$props()` call. */
+function isPropsCall(node) {
+	return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "$props";
+}
+/** Whether a CallExpression is a `$bindable(...)` call (a destructured prop's default value). */
+function isBindableCall(node) {
+	return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "$bindable";
+}
+/**
+* Local identifier names bound to a prop from `$props()`: plain and renamed destructured
+* names, and the `...rest` binding. `includeBindable` controls whether a prop initialized
+* with `$bindable(...)` is included — `false` excludes it (correctness/prop-mutation: mutating
+* a `$bindable` prop is the intended contract), `true` includes it (correctness/stale-prop-derivation:
+* a `$bindable` prop can still be derived-from-at-init just like any other prop). `let props
+* = $props()` (no destructuring) tracks `props` itself, since none of its fields can be
+* `$bindable` either. Returns an empty set when `$props()` appears more than once, or a
+* destructuring shape is ambiguous (nested pattern) — conservative, to avoid false positives
+* rather than chase every shape.
+*/
+function collectPropNames(program, includeBindable) {
+	const names = /* @__PURE__ */ new Set();
+	let seen = 0;
+	let ambiguous = false;
+	walkEstree(program, (n) => {
+		if (n.type !== "VariableDeclarator" || !n.init || !isPropsCall(unwrapTs(n.init))) return;
+		seen++;
+		if (n.id?.type === "Identifier") {
+			names.add(n.id.name);
+			return;
+		}
+		if (n.id?.type !== "ObjectPattern" || !Array.isArray(n.id.properties)) {
+			ambiguous = true;
+			return;
+		}
+		for (const p of n.id.properties) if (p?.type === "RestElement") addBoundNames(p.argument, names);
+		else if (p?.type === "Property") {
+			if (p.value?.type === "AssignmentPattern") {
+				if ((includeBindable || !isBindableCall(p.value.right)) && p.value.left?.type === "Identifier") names.add(p.value.left.name);
+			} else if (p.value?.type === "Identifier") names.add(p.value.name);
+		}
+	});
+	return ambiguous || seen > 1 ? /* @__PURE__ */ new Set() : names;
+}
+/**
+* Local identifier names bound to a prop via legacy `export let foo` / `export let foo = default`
+* (correctness/stale-prop-derivation, correctness/prop-mutation: the same two bugs exist under
+* legacy reactivity, just with a different fix). Top-level only, plain identifiers only — a
+* component can't mix legacy `export let` props with runes-mode `$props()` in the same file
+* (a Svelte compile error), so this and `collectPropNames`'s result are never both non-empty
+* for the same component.
+*/
+function collectLegacyPropNames(program) {
+	const names = /* @__PURE__ */ new Set();
+	for (const stmt of program.body ?? []) {
+		if (stmt?.type !== "ExportNamedDeclaration" || stmt.declaration?.type !== "VariableDeclaration") continue;
+		for (const d of stmt.declaration.declarations ?? []) if (d?.id?.type === "Identifier") names.add(d.id.name);
+	}
+	return names;
+}
+/** Mutating array/Set/Map methods — a call to one of these on a non-bindable prop mutates it (correctness/prop-mutation). */
+const MUTATING_METHODS = /* @__PURE__ */ new Set([
+	"push",
+	"pop",
+	"shift",
+	"unshift",
+	"splice",
+	"sort",
+	"reverse",
+	"copyWithin",
+	"fill",
+	"set",
+	"add",
+	"delete",
+	"clear"
+]);
+/**
+* Flag mutations of a non-`$bindable` prop (correctness/prop-mutation): a member-expression write
+* (`prop.x = …`, `prop.x += …`, `prop.x++`), `delete prop.x`, or a call to a mutating
+* method on the prop (`prop.push(...)`). Plain reassignment of the prop identifier
+* itself (`prop = 5`) is NOT flagged — Svelte's docs explicitly sanction temporary
+* reassignment for ephemeral state; only mutation is prohibited. Run over the instance
+* program AND the template fragment (inline handlers can mutate props in the template).
+* Scope-aware (issue #140): a local that shadows the prop's name is not flagged.
+*/
+function collectPropMutations(root, propNames, source, acc) {
+	if (propNames.size === 0) return;
+	walkScoped(root, (n, scope) => {
+		const flag = (r) => {
+			if (r && propNames.has(r) && !scope.has(r)) acc.push({
+				name: r,
+				line: lineOf(source, n.start)
+			});
+		};
+		if (n.type === "AssignmentExpression" && n.left?.type === "MemberExpression") flag(rootObjectName(n.left));
+		else if (n.type === "UpdateExpression" && n.argument?.type === "MemberExpression") flag(rootObjectName(n.argument));
+		else if (n.type === "UnaryExpression" && n.operator === "delete") flag(rootObjectName(n.argument));
+		else if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
+			const method = n.callee.property?.type === "Identifier" ? n.callee.property.name : void 0;
+			if (method && MUTATING_METHODS.has(method)) flag(rootObjectName(n.callee.object));
+		}
+	});
+}
+/** Named props destructured from `$props()`, or 0 when unknowable (architecture/prop-count). */
+function countProps(program) {
+	let count = 0;
+	let seen = 0;
+	let uncountable = false;
+	walkEstree(program, (n) => {
+		if (n.type !== "VariableDeclarator" || !n.init || !isPropsCall(unwrapTs(n.init))) return;
+		seen++;
+		const props = n.id?.type === "ObjectPattern" ? n.id.properties : void 0;
+		if (!Array.isArray(props)) {
+			uncountable = true;
+			return;
+		}
+		count = props.filter((p) => p?.type === "Property").length;
+	});
+	return uncountable || seen > 1 ? 0 : count;
+}
+/** Source line count, not over-counting a single trailing newline (architecture/component-size). */
+function countLines(source) {
+	if (source.length === 0) return 0;
+	return source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
+}
+/** Whether an import declaration contributes no runtime value binding — see `ComponentFacts.importSpans`. */
+function isTypeOnlyImport(n) {
+	if (n.importKind === "type") return true;
+	const specs = n.specifiers;
+	return Array.isArray(specs) && specs.length > 0 && specs.every((s) => s?.importKind === "type");
+}
+/** Module specifiers of every `import`, each with its source line (see `ComponentFacts.importSpans`). */
+function collectImportSources(program, source, acc) {
+	walkEstree(program, (n) => {
+		if (n.type === "ImportDeclaration" && typeof n.source?.value === "string") acc.push({
+			source: n.source.value,
+			line: lineOf(source, n.start),
+			...isTypeOnlyImport(n) ? { type: true } : {}
+		});
+	});
+}
+/** A specifier is "bare" (a node_modules package) when it is not relative/absolute/alias-local. */
+function isBareSpecifier(s) {
+	return !/^[./$#]/.test(s);
+}
+/** Value `import * as X from '<bare pkg>'` namespace imports (type-only excluded) — performance/namespace-import. */
+function collectNamespaceImports(program, source, acc) {
+	walkEstree(program, (n) => {
+		if (n.type !== "ImportDeclaration" || n.importKind === "type") return;
+		const spec = n.source?.value;
+		if (typeof spec !== "string" || !isBareSpecifier(spec)) return;
+		if (Array.isArray(n.specifiers) && n.specifiers.some((s) => s?.type === "ImportNamespaceSpecifier")) acc.push({
+			source: spec,
+			line: lineOf(source, n.start)
+		});
+	});
+}
+const MD_LINK = /\[[^\]]*\]\(([^)\s]+)\)/g;
+const SCRIPT_OPEN = /<script(?:\s[^>]*)?>/;
+const SCRIPT_CLOSE = /<\/script\s*>/;
+const STYLE_OPEN = /<style(?:\s[^>]*)?>/;
+const STYLE_CLOSE = /<\/style\s*>/;
+/**
+* Markdown links inside comments. A plain text scan, like `collectSuppressions` — a link in a comment is
+* not an AST node. `//` counts as a comment opener only at the start of a line, which is what keeps the
+* scan off the `//` in `https://`; a trailing `// [x](y)` is therefore missed, and measurement found no
+* such link, so the cost is a case that does not occur rather than one this rule needs.
+*
+* `<script>`/`<style>` blocks are tracked separately (open on the tag, close on the closing tag) because
+* neither comment form applies uniformly inside them: `<!--`/`-->` are markup syntax, not script/style
+* syntax, so a `<!--` inside a script string literal (e.g. a URL comparison) must not open a markup
+* comment; and a line-leading `//` is only a comment in a script, never in markup or style, where it is
+* either content or a syntax error. The tags themselves are read from the markup *outside* any comment, so
+* a commented-out block does not open one. `wholeFileIsScript` covers `.svelte.ts`/`.svelte.js` runes
+* modules, which have no `<script>` tag at all — the entire file is script.
+*/
+function collectCommentLinks(source, { wholeFileIsScript = false } = {}) {
+	const out = [];
+	let htmlOpen = false;
+	let block = wholeFileIsScript ? "script" : void 0;
+	source.split("\n").forEach((line, i) => {
+		let text = "";
+		if (block !== void 0) {
+			if (block === "script" && /^\s*\/\//.test(line)) text = line.replace(/^\s*\/\//, "");
+			if (!wholeFileIsScript && (block === "script" ? SCRIPT_CLOSE : STYLE_CLOSE).test(line)) block = void 0;
+		} else {
+			let plain = "";
+			let rest = line;
+			while (rest.length > 0) {
+				if (htmlOpen) {
+					const end = rest.indexOf("-->");
+					if (end === -1) {
+						text += rest;
+						break;
+					}
+					text += rest.slice(0, end);
+					htmlOpen = false;
+					rest = rest.slice(end + 3);
+					continue;
+				}
+				const start = rest.indexOf("<!--");
+				if (start === -1) {
+					plain += rest;
+					break;
+				}
+				plain += rest.slice(0, start);
+				htmlOpen = true;
+				rest = rest.slice(start + 4);
+			}
+			const opened = SCRIPT_OPEN.test(plain) ? "script" : STYLE_OPEN.test(plain) ? "style" : void 0;
+			if (opened !== void 0 && !(opened === "script" ? SCRIPT_CLOSE : STYLE_CLOSE).test(plain)) block = opened;
+		}
+		for (const m of text.matchAll(MD_LINK)) if (m[1] !== void 0) out.push({
+			url: m[1],
+			line: i + 1
+		});
+	});
+	return out;
+}
+/**
+* Calls matching `matcher` that run when `root` itself is evaluated (correctness/orphan-effect, correctness/orphan-lifecycle).
+* `skipSubtree` exempts a call's children — correctness/orphan-effect uses it for `$effect.root(...)`
+* callbacks, which are a legal standalone reactive scope. `initialShadowed` seeds the
+* shadow set threaded through `walkEvalScope` (correctness/orphan-lifecycle uses it to seed a
+* constructor's own parameters before scanning its body).
+*/
+function collectEvalScopeCalls(root, source, matcher, skipSubtree, initialShadowed) {
+	const out = [];
+	walkEvalScope(root, (n, shadowed) => {
+		if (n.type !== "CallExpression") return void 0;
+		if (skipSubtree?.(n)) return true;
+		const name = matcher(n, shadowed);
+		if (name) out.push({
+			name,
+			line: lineOf(source, n.start)
+		});
+	}, initialShadowed);
+	return out;
+}
+/**
+* Matcher-parameterised orphan-call collector (correctness/orphan-effect, correctness/orphan-lifecycle): (1) matching calls that
+* run at module evaluation time, (2) a module-scope `new` (direct top-level statements
+* only, export-unwrapped) of a same-file top-level class whose constructor directly
+* makes a matching call. See `collectOrphanEffects`'s doc comment for why pattern 2 is
+* restricted to top-level `ClassDeclaration`s and top-level `new` statements.
+*/
+function collectOrphanCalls(program, source, matcher, skipSubtree) {
+	const out = collectEvalScopeCalls(program, source, matcher, skipSubtree).map((c) => ({
+		...c,
+		kind: "top-level"
+	}));
+	const body = program.body ?? [];
+	const matchingClasses = /* @__PURE__ */ new Map();
+	for (const stmt of body) {
+		const decl = unwrapExport(stmt);
+		if (decl?.type !== "ClassDeclaration" || decl.id?.type !== "Identifier") continue;
+		const ctor = (decl.body?.body ?? []).find((m) => m?.type === "MethodDefinition" && m.kind === "constructor" && m.value?.body);
+		if (!ctor) continue;
+		const ctorShadow = /* @__PURE__ */ new Set();
+		for (const p of ctor.value.params ?? []) addBoundNames(p, ctorShadow);
+		const calls = collectEvalScopeCalls(ctor.value.body, source, matcher, skipSubtree, ctorShadow);
+		if (calls.length > 0) matchingClasses.set(decl.id.name, calls[0].name);
+	}
+	if (matchingClasses.size > 0) for (const stmt of body) {
+		const decl = unwrapExport(stmt);
+		if (!(decl?.type === "VariableDeclaration" || decl?.type === "ExpressionStatement" || stmt.type === "ExportDefaultDeclaration" && decl?.type !== "FunctionDeclaration" && decl?.type !== "ClassDeclaration")) continue;
+		walkEvalScope(decl, (n) => {
+			if (n.type === "NewExpression" && n.callee?.type === "Identifier" && matchingClasses.has(n.callee.name)) out.push({
+				name: matchingClasses.get(n.callee.name),
+				line: lineOf(source, n.start),
+				kind: "constructor-instantiated",
+				className: n.callee.name
+			});
+		});
+	}
+	return out.sort((a, b) => a.line - b.line);
+}
+/**
+* Orphan `$effect` facts for a module-context program (correctness/orphan-effect): (1) effects that run
+* at module evaluation time, (2) a module-scope `new` of a same-file class whose
+* constructor creates a bare effect. Conservative by construction — never crosses a
+* function boundary, so factory functions, IIFEs, and cross-file classes are not flagged.
+*
+* Pattern 2 (the class/`new` half) operates on DIRECT top-level statements only — it
+* never descends into blocks/if/for/try. A top-level `ClassDeclaration` name is a real
+* module-scope binding that an import can't legally share, so restricting collection to
+* `program.body` (unwrapping only `export`/`export default`) rules out two false-positive
+* vectors: a block-scoped class shadowing an imported name of the same name, and a class
+* expression's own name (`const A = class Store {…}`), which is only visible inside the
+* expression, never as a module-scope binding. This matches the design spec's own wording
+* for pattern 2: "flag top-level `new ClassName(...)` statements". Pattern 1 (top-level
+* `$effect`, including inside top-level blocks/if) is unaffected — see
+* `collectEvalScopeCalls` above. Generalised as `collectOrphanCalls` — correctness/orphan-lifecycle reuses
+* the same walk with a lifecycle-import matcher.
+*/
+function collectOrphanEffects(program, source) {
+	return collectOrphanCalls(program, source, (n) => isEffectCall(n) ? "$effect" : void 0, isEffectRootCall).map(({ line, kind, className }) => ({
+		line,
+		kind,
+		...className !== void 0 ? { className } : {}
+	}));
+}
+/** Orphan lifecycle-call facts for a module-context program (correctness/orphan-lifecycle). */
+function collectOrphanLifecycleCalls(program, source) {
+	const imports = collectSvelteLifecycleImports(program);
+	if (imports.locals.size === 0 && imports.namespaces.size === 0) return [];
+	return collectOrphanCalls(program, source, (n, shadowed) => {
+		const m = matchLifecycleCall(n, imports);
+		return m && !shadowed.has(m.local) ? m.canonical : void 0;
+	});
+}
+/** A Svelte runes module file — the whole file is one module-scope program (correctness/orphan-effect). */
+const MODULE_FILE_RE = /\.svelte\.(ts|js)$/;
+/**
+* Module-scope reactive-state declarations in a runes module (security/shared-state-import): a top-level
+* `let|const x = $state(...)` / `$state.raw(...)` declaration, and a module-scope
+* `new` (in a top-level variable declaration) of a same-file top-level class with a
+* `$state` field initializer — recorded under the instance binding's name at the
+* declaration line. Direct top-level statements only (export-unwrapped), mirroring
+* correctness/orphan-effect's pattern-2 conservatism.
+*/
+function collectModuleStateDecls(program, source) {
+	const out = [];
+	const body = program.body ?? [];
+	const statefulClasses = /* @__PURE__ */ new Set();
+	for (const stmt of body) {
+		const decl = unwrapExport(stmt);
+		if (decl?.type === "VariableDeclaration") {
+			for (const d of decl.declarations ?? []) if (d?.id?.type === "Identifier" && d.init && isStateDeclaration(unwrapTs(d.init))) out.push({
+				name: d.id.name,
+				line: lineOf(source, d.start)
+			});
+		} else if (decl?.type === "ClassDeclaration" && decl.id?.type === "Identifier") {
+			if ((decl.body?.body ?? []).some((m) => m?.type === "PropertyDefinition" && m.value && isStateDeclaration(unwrapTs(m.value)))) statefulClasses.add(decl.id.name);
+		}
+	}
+	if (statefulClasses.size > 0) for (const stmt of body) {
+		const decl = unwrapExport(stmt);
+		if (decl?.type !== "VariableDeclaration") continue;
+		for (const d of decl.declarations ?? []) if (d?.init?.type === "NewExpression" && d.init.callee?.type === "Identifier" && statefulClasses.has(d.init.callee.name)) out.push({
+			name: d.id?.type === "Identifier" ? d.id.name : d.init.callee.name,
+			line: lineOf(source, d.start)
+		});
+	}
+	return out.sort((a, b) => a.line - b.line);
+}
+/**
+* Facts for a `.svelte.ts`/`.svelte.js` runes module (correctness/orphan-effect, correctness/orphan-lifecycle, correctness/server-browser-global,
+* performance/heavy-import, performance/namespace-import, architecture/private-scope-import, architecture/route-component-import).
+* The whole file runs at import time, so only `orphanEffects`, `orphanLifecycleCalls`, `browserGlobalRefs`,
+* `moduleStateDecls`, `imports`/`importSpans`/`namespaceImports`, and `suppressions` are populated —
+* `loc` stays 0 so architecture/component-size skips module files (there is no component to size), and
+* the rest of the component-only facts stay empty. Uses `parseModuleProgram` to get the ESTree program
+* from the wrapped source; the 1-line wrap prefix is subtracted from every reported line.
+*/
+function parseModuleFacts(source, filename) {
+	const { program, wrapped } = parseModuleProgram(source, filename);
+	const shift = (line) => Math.max(0, line - 1);
+	const orphanEffects = program ? collectOrphanEffects(program, wrapped).map((f) => ({
+		...f,
+		line: shift(f.line)
+	})) : [];
+	const orphanLifecycleCalls = program ? collectOrphanLifecycleCalls(program, wrapped).map((f) => ({
+		...f,
+		line: shift(f.line)
+	})) : [];
+	const browserGlobalRefs = program ? collectBrowserGlobalRefs(program, wrapped).map((r) => ({
+		...r,
+		line: shift(r.line),
+		context: "module"
+	})) : [];
+	const moduleStateDecls = program ? collectModuleStateDecls(program, wrapped).map((d) => ({
+		...d,
+		line: shift(d.line)
+	})) : [];
+	const basePathLinks = [];
+	if (program) {
+		const locals = collectNamedImportAliases(program, "$app/navigation", GOTO_NAMES);
+		const raw = [];
+		collectGotoLinks(locals, [program], wrapped, raw);
+		for (const l of raw) basePathLinks.push({
+			...l,
+			line: shift(l.line)
+		});
+		basePathLinks.sort((a, b) => a.line - b.line);
+	}
+	const importSpans = [];
+	const namespaceImports = [];
+	if (program) {
+		const rawImportSpans = [];
+		collectImportSources(program, wrapped, rawImportSpans);
+		for (const s of rawImportSpans) importSpans.push({
+			...s,
+			line: shift(s.line)
+		});
+		const rawNamespaceImports = [];
+		collectNamespaceImports(program, wrapped, rawNamespaceImports);
+		for (const n of rawNamespaceImports) namespaceImports.push({
+			...n,
+			line: shift(n.line)
+		});
+	}
+	return {
+		eachBlocks: [],
+		effects: [],
+		htmlTags: [],
+		javascriptUrls: [],
+		loc: 0,
+		propCount: 0,
+		imports: importSpans.map((s) => s.source),
+		importSpans,
+		namespaceImports,
+		constableStates: [],
+		mutatedProps: [],
+		stalePropDerivations: [],
+		rawableStates: [],
+		nonreactiveBuiltinStates: [],
+		checkableBindValues: [],
+		basePathLinks,
+		suppressions: collectSuppressions(source),
+		commentLinks: collectCommentLinks(source, { wholeFileIsScript: true }),
+		orphanEffects,
+		orphanLifecycleCalls,
+		browserGlobalRefs,
+		moduleStateDecls
+	};
+}
+/**
+* Parse one source file's facts (CLI/static + vite build mode): a `.svelte` component's
+* reactivity/correctness + security + architecture facts, or a `.svelte.ts`/`.svelte.js`
+* runes module's orphan-$effect facts (correctness/orphan-effect).
+*/
+function parseComponentFacts(source, filename) {
+	if (MODULE_FILE_RE.test(filename)) return parseModuleFacts(source, filename);
+	const ast = parseSvelte(source, filename);
+	const eachBlocks = [];
+	collectEachBlocks(ast.fragment ?? ast, source, eachBlocks);
+	const htmlTags = [];
+	const javascriptUrls = [];
+	collectSecurityFacts(ast.fragment ?? ast, source, htmlTags, javascriptUrls);
+	const checkableBindValues = [];
+	collectCheckableBindValues(ast.fragment ?? ast, source, checkableBindValues);
+	const ariaElements = [];
+	collectAriaElements(ast.fragment ?? ast, source, ariaElements);
+	const elements = [];
+	collectElements(ast.fragment ?? ast, source, elements, ast.options?.namespace === "svg");
+	const interactiveNestings = [];
+	collectInteractiveNestings(ast.fragment ?? ast, source, interactiveNestings, []);
+	const ariaHiddenFocusables = [];
+	collectAriaHiddenFocusables(ast.fragment ?? ast, source, ariaHiddenFocusables, []);
+	const unnamedInteractive = [];
+	const labelTargets = {
+		ids: /* @__PURE__ */ new Set(),
+		nodes: /* @__PURE__ */ new Set()
+	};
+	collectLabelTargets(ast.fragment ?? ast, labelTargets);
+	collectUnnamedInteractive(ast.fragment ?? ast, source, unnamedInteractive, labelTargets);
+	const unassociatedLabels = [];
+	collectUnassociatedLabels(ast.fragment ?? ast, source, unassociatedLabels);
+	const bulletTexts = [];
+	collectBulletTexts(ast.fragment ?? ast, source, bulletTexts, false);
+	const selectsMissingPlaceholder = [];
+	collectSelectsMissingPlaceholder(ast.fragment ?? ast, source, selectsMissingPlaceholder);
+	const timesMissingDatetime = [];
+	collectTimesMissingDatetime(ast.fragment ?? ast, source, timesMissingDatetime);
+	const videosAutoplayNoMuted = [];
+	collectVideosAutoplayNoMuted(ast.fragment ?? ast, source, videosAutoplayNoMuted, ast.options?.namespace === "svg");
+	const duplicateDts = [];
+	collectDuplicateDts(ast.fragment ?? ast, source, duplicateDts, ast.options?.namespace === "svg");
+	const basePathLinks = [];
+	collectHrefLinks(ast.fragment ?? ast, source, basePathLinks);
+	const gotoPrograms = [ast.module?.content, ast.instance?.content].filter(Boolean);
+	const gotoLocals = /* @__PURE__ */ new Set();
+	for (const p of gotoPrograms) for (const n of collectNamedImportAliases(p, "$app/navigation", GOTO_NAMES)) gotoLocals.add(n);
+	collectGotoLinks(gotoLocals, [...gotoPrograms, ast.fragment], source, basePathLinks);
+	basePathLinks.sort((a, b) => a.line - b.line);
+	const loc = countLines(source);
+	const suppressions = collectSuppressions(source);
+	const moduleProgram = ast.module?.content;
+	const importSpans = [];
+	const namespaceImports = [];
+	if (moduleProgram) {
+		collectImportSources(moduleProgram, source, importSpans);
+		collectNamespaceImports(moduleProgram, source, namespaceImports);
+	}
+	const orphanEffects = moduleProgram ? collectOrphanEffects(moduleProgram, source) : [];
+	const orphanLifecycleCalls = moduleProgram ? collectOrphanLifecycleCalls(moduleProgram, source) : [];
+	const browserGlobalRefs = [];
+	if (moduleProgram) for (const r of collectBrowserGlobalRefs(moduleProgram, source)) browserGlobalRefs.push({
+		...r,
+		context: "module"
+	});
+	const effects = [];
+	const constableStates = [];
+	const mutatedProps = [];
+	const stalePropDerivations = [];
+	const rawableStates = [];
+	const nonreactiveBuiltinStates = [];
+	let propCount = 0;
+	const program = ast.instance?.content;
+	if (program) {
+		collectImportSources(program, source, importSpans);
+		collectNamespaceImports(program, source, namespaceImports);
+		propCount = countProps(program);
+		const legacyPropNames = collectLegacyPropNames(program);
+		const nonBindableProps = /* @__PURE__ */ new Set([...collectPropNames(program, false), ...legacyPropNames]);
+		const rawMutations = [];
+		collectPropMutations(program, nonBindableProps, source, rawMutations);
+		if (ast.fragment) collectPropMutations(ast.fragment, nonBindableProps, source, rawMutations);
+		for (const m of rawMutations) mutatedProps.push(legacyPropNames.has(m.name) ? {
+			...m,
+			legacy: true
+		} : m);
+		const allPropNames = /* @__PURE__ */ new Set([...collectPropNames(program, true), ...legacyPropNames]);
+		if (allPropNames.size > 0) {
+			const candidates = collectStalePropCandidates(program, allPropNames, source);
+			if (candidates.length > 0) {
+				const candidateNames = new Set(candidates.map((c) => c.name));
+				const disqualified = /* @__PURE__ */ new Set();
+				collectStateWrites(program, candidateNames, disqualified);
+				if (ast.fragment) {
+					collectStateWrites(ast.fragment, candidateNames, disqualified);
+					collectTemplateEscapes(ast.fragment, candidateNames, disqualified);
+				}
+				const referenced = /* @__PURE__ */ new Set();
+				if (ast.fragment) collectFragmentRefs(ast.fragment, candidateNames, referenced);
+				const isLegacy = legacyPropNames.size > 0;
+				for (const c of candidates) if (!disqualified.has(c.name) && referenced.has(c.name)) stalePropDerivations.push(isLegacy ? {
+					...c,
+					legacy: true
+				} : c);
+			}
+		}
+		const stateNames = /* @__PURE__ */ new Set();
+		const reactiveNames = /* @__PURE__ */ new Set();
+		collectImportedLocalNames(program, reactiveNames);
+		collectNewExprLocalNames(program, reactiveNames);
+		if (moduleProgram) {
+			collectImportedLocalNames(moduleProgram, reactiveNames);
+			collectNewExprLocalNames(moduleProgram, reactiveNames);
+		}
+		const stateDecls = [];
+		walkEstree(program, (n) => {
+			if (n.type !== "VariableDeclarator" || !n.init) return;
+			const init = unwrapTs(n.init);
+			if (isStateDeclaration(init) && n.id?.type === "Identifier") {
+				stateNames.add(n.id.name);
+				stateDecls.push({
+					name: n.id.name,
+					line: lineOf(source, n.start)
+				});
+			}
+			if (isStateDeclaration(init) || isDerivedDeclaration(init) || isPropsCall(init)) addBoundNames(n.id, reactiveNames);
+		});
+		walkEstree(program, (n) => {
+			if (n.type !== "CallExpression" || !isEffectCall(n)) return;
+			const fn = n.arguments?.[0];
+			const isFn = fn?.type === "ArrowFunctionExpression" || fn?.type === "FunctionExpression";
+			effects.push({
+				line: lineOf(source, n.start),
+				assignsOnlyState: isFn ? bodyOnlyAssignsState(fn, stateNames) : false,
+				mountOnly: isFn ? !bodyIsEmpty(fn) && !bodyReadsReactive(fn, reactiveNames) : false
+			});
+		});
+		const writtenOrEscaped = /* @__PURE__ */ new Set();
+		collectStateWrites(program, stateNames, writtenOrEscaped);
+		if (ast.fragment) {
+			collectStateWrites(ast.fragment, stateNames, writtenOrEscaped);
+			collectTemplateEscapes(ast.fragment, stateNames, writtenOrEscaped);
+			collectDirectiveEscapes(ast.fragment, stateNames, writtenOrEscaped);
+		}
+		for (const d of stateDecls) if (!writtenOrEscaped.has(d.name)) constableStates.push(d);
+		const rawableCandidates = [];
+		for (const stmt of program.body ?? []) {
+			if (stmt?.type !== "VariableDeclaration") continue;
+			for (const d of stmt.declarations ?? []) {
+				if (d?.id?.type !== "Identifier" || !d.init) continue;
+				const init = unwrapTs(d.init);
+				if (!isPlainStateCall(init)) continue;
+				const arg = unwrapTs(init.arguments?.[0]);
+				if (arg?.type === "ObjectExpression" || arg?.type === "ArrayExpression") rawableCandidates.push({
+					name: d.id.name,
+					line: lineOf(source, d.start)
+				});
+			}
+		}
+		if (rawableCandidates.length > 0) {
+			const candNames = new Set(rawableCandidates.map((c) => c.name));
+			const union = /* @__PURE__ */ new Set();
+			const kinds = /* @__PURE__ */ new Map();
+			collectStateWrites(program, candNames, union, kinds);
+			if (ast.fragment) {
+				collectStateWrites(ast.fragment, candNames, union, kinds);
+				collectTemplateEscapes(ast.fragment, candNames, union, kinds);
+			}
+			const aliasEscapes = /* @__PURE__ */ new Set();
+			collectAliasRefs(program, candNames, aliasEscapes);
+			const eachTaint = /* @__PURE__ */ new Set();
+			if (ast.fragment) {
+				collectFragmentAliasRefs(ast.fragment, candNames, aliasEscapes);
+				collectDirectiveEscapes(ast.fragment, candNames, aliasEscapes);
+				collectEachContextTaint(ast.fragment, candNames, eachTaint);
+			}
+			for (const c of rawableCandidates) {
+				const k = kinds.get(c.name);
+				const reassigned = k?.has("reassign") ?? false;
+				const dirty = k !== void 0 && [...k].some((kind) => kind !== "reassign") || aliasEscapes.has(c.name) || eachTaint.has(c.name);
+				if (reassigned && !dirty) rawableStates.push(c);
+			}
+		}
+		const builtinCandidates = /* @__PURE__ */ new Map();
+		for (const stmt of program.body ?? []) {
+			if (stmt?.type !== "VariableDeclaration") continue;
+			for (const d of stmt.declarations ?? []) {
+				if (d?.id?.type !== "Identifier" || !d.init) continue;
+				const init = unwrapTs(d.init);
+				if (!isPlainStateCall(init)) continue;
+				const arg = unwrapTs(init.arguments?.[0]);
+				if (arg?.type === "NewExpression" && arg.callee?.type === "Identifier" && BUILTIN_STATE_TYPES.has(arg.callee.name)) builtinCandidates.set(d.id.name, {
+					type: arg.callee.name,
+					line: lineOf(source, d.start)
+				});
+			}
+		}
+		if (builtinCandidates.size > 0) {
+			const types = new Map([...builtinCandidates].map(([n, meta]) => [n, meta.type]));
+			const mutatedBuiltins = /* @__PURE__ */ new Set();
+			const reassignedBuiltins = /* @__PURE__ */ new Set();
+			collectBuiltinStateSignals(program, types, mutatedBuiltins, reassignedBuiltins);
+			if (ast.fragment) collectBuiltinStateSignals(ast.fragment, types, mutatedBuiltins, reassignedBuiltins);
+			for (const [name, meta] of builtinCandidates) if (mutatedBuiltins.has(name) && !reassignedBuiltins.has(name)) nonreactiveBuiltinStates.push({
+				name,
+				type: meta.type,
+				line: meta.line
+			});
+		}
+		let moduleExtra;
+		if (moduleProgram) {
+			const moduleBrowserImports = collectBrowserGuardImports(moduleProgram);
+			moduleExtra = {
+				guards: /* @__PURE__ */ new Set([...moduleBrowserImports, ...collectDerivedGuardBindings(moduleProgram, moduleBrowserImports)]),
+				bound: collectProgramBindings(moduleProgram)
+			};
+		}
+		for (const r of collectBrowserGlobalRefs(program, source, moduleExtra)) browserGlobalRefs.push({
+			...r,
+			context: "instance"
+		});
+	}
+	const imports = importSpans.map((s) => s.source);
+	return {
+		eachBlocks,
+		effects,
+		htmlTags,
+		javascriptUrls,
+		loc,
+		propCount,
+		imports,
+		importSpans,
+		namespaceImports,
+		constableStates,
+		mutatedProps,
+		stalePropDerivations,
+		rawableStates,
+		nonreactiveBuiltinStates,
+		checkableBindValues,
+		basePathLinks,
+		orphanEffects,
+		orphanLifecycleCalls,
+		browserGlobalRefs,
+		moduleStateDecls: [],
+		suppressions,
+		commentLinks: collectCommentLinks(source),
+		ariaElements,
+		elements,
+		interactiveNestings,
+		ariaHiddenFocusables,
+		unnamedInteractive,
+		unassociatedLabels,
+		bulletTexts,
+		selectsMissingPlaceholder,
+		timesMissingDatetime,
+		videosAutoplayNoMuted,
+		duplicateDts
+	};
+}
+//#endregion
 //#region src/inline-directives.ts
+/**
+* Enter every fact-carrying file into a directive index — components, Kit modules, and the Vite
+* config when its minify flag was read. The one home for the union both pipelines apply, so a new
+* fact family that carries suppressions is wired into inline directives in a single place.
+*/
+function addFactsDirectives(index, facts) {
+	for (const c of facts.components ?? []) index.set(c.file, c.suppressions ?? []);
+	for (const m of facts.kitModules ?? []) index.set(m.file, m.suppressions ?? []);
+	const vc = facts.viteMinifyDisabled;
+	if (vc?.file) index.set(vc.file, vc.suppressions ?? []);
+}
 /** The directive silencing `r`, if one sits on its line and names its rule (or names nothing). */
 function directiveFor(index, r) {
 	const line = r.line;
@@ -21,6 +2252,7 @@ function directiveFor(index, r) {
 * rule's `passLabel` when it declares one, else its `title`.
 */
 function applyInlineDirectives(results, index, rules, config) {
+	if (index.size === 0) return [...results];
 	const labels = new Map(rules.map((r) => [r.id, r.passLabel ?? r.title]));
 	const kept = [];
 	/** rule+route → the first suppressed result, for the PASS this pair may need. */
@@ -73,6 +2305,11 @@ function unknownDirectiveIds(index, rules) {
 //#endregion
 //#region src/component.ts
 /**
+* Component-body facts for the Correctness category — the source-analysis boundary
+* (mirrors images.ts / headings.ts). Collected by the static (CLI) provider only;
+* the rendered provider can't see reactivity, so correctness rules no-op there.
+*/
+/**
 * Warnings for files a collector could not read or parse: the file contributes empty facts, so any
 * findings it would have produced are simply missing rather than reported as fixed. The two causes
 * are reported separately — an unreadable file is an environment problem (permissions, a descriptor
@@ -93,8 +2330,6 @@ function skippedFileWarnings(facts) {
 	if (unparsed.length > 0) out.push(`skipped ${unparsed.length} file(s) that could not be parsed: ${list(unparsed)}`, "findings for these files are unavailable until they parse.");
 	return out;
 }
-//#endregion
-//#region src/component-collect.ts
 /**
 * Fallback facts for a file that fails to read or parse (dev tooling must never
 * throw). This is the single source of truth for the empty-facts shape — add new
@@ -659,19 +2894,6 @@ const VITE_CONFIG_FILES = [
 ];
 /** SvelteKit's config resolution order (`@sveltejs/kit` checks js before ts). */
 const SVELTE_CONFIG_FILES = ["svelte.config.js", "svelte.config.ts"];
-//#endregion
-//#region src/runtime.ts
-/**
-* How many file reads may be in flight at once. Analysis reads every `.svelte` file in a project
-* in parallel, which on a large project opens more descriptors than the process is allowed: at
-* `ulimit -n 1024` — a common container default — a 1 681-route project raised `EMFILE`, and
-* because a failed read lands in the same `catch` as a malformed component, 682 files were dropped
-* and the run still reported a normal score. The cap is what keeps the analysis whole.
-*
-* 64 is chosen to sit well under the stock 256 on macOS while leaving descriptors for everything
-* else the process holds open. It is not a throughput knob: reads are a few percent of the work.
-*/
-const READ_CONCURRENCY = 64;
 /**
 * `readFile` with at most `limit` reads in flight. A plain counter plus a queue of waiters —
 * deliberately not a dependency, and pure enough to live in core.
@@ -727,6 +2949,26 @@ async function runRules(rules, ctx) {
 		failedRules
 	};
 }
+/**
+* Run rules and apply the correction sequence every pipeline owes its results: configured
+* severities, overrides, inline directives, then the failed-rule weight correction — a failed
+* rule examined nothing, so its weight must not stay in the Health denominator, and every
+* downstream consumer must score against the returned `scoringConfig` so they agree.
+* A caller with no directive sources passes an empty index, which makes the directive pass
+* identity; the severity and override passes are config-governed and run regardless.
+*/
+async function runAnalysis(rules, ctx, directives) {
+	const { results: raw, examined, failedRules } = await runRules(rules, ctx);
+	const results = applyInlineDirectives(applyOverrides(applyRuleSeverities(raw, ctx.config), ctx.config), directives, rules, ctx.config);
+	const failedRuleIds = failedRules.map((f) => f.id);
+	return {
+		results,
+		examined,
+		failedRules,
+		failedRuleIds,
+		scoringConfig: withFailedRulesOff(ctx.config, failedRuleIds)
+	};
+}
 //#endregion
 //#region src/reporter/palette.ts
 /** Default: no decoration (identity) — output is byte-identical to plain text. */
@@ -967,14 +3209,6 @@ function formatSarifReport(results, config, meta) {
 }
 //#endregion
 //#region src/reporter/app-shell.ts
-const BAND_COLOR = {
-	good: "#2FA968",
-	warn: "#E8A317",
-	poor: "#E5484D"
-};
-function scoreBand(score) {
-	return score >= 90 ? "good" : score >= 50 ? "warn" : "poor";
-}
 function escapeHtml(s) {
 	return s.replace(/[&<>"']/g, (c) => c === "&" ? "&amp;" : c === "<" ? "&lt;" : c === ">" ? "&gt;" : c === "\"" ? "&quot;" : "&#39;");
 }
@@ -1247,30 +3481,56 @@ const APP_SCRIPT = `
     return pre;
   }
 
+  // Analyzed-repo strings (title, location, recommendation, fix description, docs URL) flow
+  // into a prompt the user pastes into a coding agent — same threat model as
+  // reporter/sanitize.ts's mdEscape, re-implemented here in ES5 because APP_SCRIPT runs in
+  // the browser and cannot import build-time modules. Keep the two in sync.
+  function mdSafe(text) {
+    return String(text)
+      .replace(/\\r\\n|\\r|\\n/g, ' ')
+      .replace(/<[^>]+>/g, function (tag) {
+        var longest = 0;
+        var runs = tag.match(/\`+/g);
+        if (runs) for (var i = 0; i < runs.length; i++) if (runs[i].length > longest) longest = runs[i].length;
+        var fence = Array(longest + 2).join('\`');
+        var pad = tag.charAt(0) === '\`' || tag.charAt(tag.length - 1) === '\`' ? ' ' : '';
+        return fence + pad + tag + pad + fence;
+      })
+      .replace(/\\[([^\\]]*)\\]\\(([^)]*)\\)/g, '[$1]\\\\($2\\\\)');
+  }
+
+  function fenceFor(snippet) {
+    var longest = 0;
+    var runs = String(snippet).match(/\`+/g);
+    if (runs) for (var i = 0; i < runs.length; i++) if (runs[i].length > longest) longest = runs[i].length;
+    return Array(Math.max(3, longest + 1) + 1).join('\`');
+  }
+
   // Plain-text, copy-pasteable prompt for a single finding — same ingredients as the
   // agent reporter's per-finding block (rule id, location, recommendation, fix, docs),
   // reshaped for a standalone request rather than a whole-project remediation doc.
   function buildAiPrompt(issue, route) {
     var lines = ['Fix this svelte-vitals finding:', ''];
-    lines.push('- Rule: ' + issue.id + ' — ' + issue.title + ' (' + issue.severity + ')');
-    if (route) lines.push('- Route: ' + route);
+    lines.push('- Rule: ' + issue.id + ' — ' + mdSafe(issue.title) + ' (' + issue.severity + ')');
+    if (route) lines.push('- Route: ' + mdSafe(route));
     if (issue.location) {
-      lines.push('- Location: ' + issue.location + (issue.line !== undefined ? ':' + issue.line : ''));
+      lines.push('- Location: ' + mdSafe(issue.location) + (issue.line !== undefined ? ':' + issue.line : ''));
     }
-    if (issue.recommendation) lines.push('- Recommendation: ' + issue.recommendation);
+    if (issue.recommendation) lines.push('- Recommendation: ' + mdSafe(issue.recommendation));
     if (issue.fix) {
-      lines.push('- Fix: ' + issue.fix.description);
+      lines.push('- Fix: ' + mdSafe(issue.fix.description));
       if (issue.fix.snippet) {
-        lines.push('', '\`\`\`' + (issue.fix.lang || 'svelte'), issue.fix.snippet, '\`\`\`');
+        var fence = fenceFor(issue.fix.snippet);
+        lines.push('', fence + (issue.fix.lang || 'svelte'), issue.fix.snippet, fence);
       }
     }
-    if (issue.docsUrl) lines.push('- Docs: ' + issue.docsUrl);
+    if (issue.docsUrl) lines.push('- Docs: ' + mdSafe(issue.docsUrl));
     lines.push(
       '',
       'After fixing, re-run \`svelte-vitals --diff\` (or revisit this route) to confirm ' +
         issue.id +
         ' passes' +
-        (route ? ' for ' + route : '') +
+        (route ? ' for ' + mdSafe(route) : '') +
         '.'
     );
     return lines.join('\\n');
@@ -1707,4 +3967,4 @@ function formatHtmlReport(results, config, meta) {
 	return buildHtmlDocument(buildJsonReport(results, config, meta), meta);
 }
 //#endregion
-export { APP_SCRIPT, APP_STYLE, BAND_COLOR, CHILD_NODE_KEYS, IDREF_ATTRS, LANDMARK_ROLES, READ_CONCURRENCY, ROBOTS_SOURCE_PATHS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, a11yAbbrTitle, a11yAccessibleName, a11yAriaHiddenFocus, a11yDeprecatedAria, a11yDeprecatedAttr, a11yDeprecatedElement, a11yDisallowedAriaProps, a11yDisallowedElement, a11yDoctype, a11yDuplicateLandmark, a11yIdDuplication, a11yInteractiveNesting, a11yInvalidAriaValue, a11yInvalidRole, a11yLabelHasControl, a11yNoAccesskey, a11yNoAutofocus, a11yNoDuplicateDt, a11yNoMissingIdRef, a11yPatternTitle, a11yPermittedContents, a11yPlaceholderLabelOption, a11yPositiveTabindex, a11yRequireDatetime, a11yRequiredAriaProps, a11yRequiredElement, a11yTopLevelLandmark, a11yUnknownAriaAttribute, a11yUnverifiedIdRef, a11yUseList, allRules, applyInlineDirectives, applyOverrides, applyRuleSeverities, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, compileOverrides, computeHealth, computeScore, correctnessAutoplayMuted, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, decodeFragmentId, defaultConfig, defaultProject, docsUrlFor, effectiveSeverity, emptyComponentFacts, emptyKitModuleFacts, escapeHtml, explainRule, findAttr, findKitAliasesInSvelteConfig, findKitPathsBaseInSvelteConfig, findKitPathsBaseInViteConfig, findMinifyDisabled, foldOccurrences, formatAgentReport, formatConsoleReport, formatFailedRuleWarning, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, headTagRule, imageRule, intOption, isMentionedAnywhere, isPenalized, isTopFragment, lineOf, linkRule, listOption, mapOption, noColorPalette, overrideMatches, parseComponentFacts, parseKitModuleFacts, parseSvelte, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceIframeLoading, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveRepoLocalPath, resolveRuleOptions, resolveRunesModuleSpecifier, runRules, safeHref, scoreBand, scoreColor, scoresByCategory, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingOptions, settingSeverity, shouldSkipRangeCheck, skippedFileWarnings, splitTokens, stripTextDirective, summarize, terminalSafe, textFromNodes, unknownDirectiveIds, validateRuleOptions, validateRuleSetting, valueFromNodes, withFailedRulesOff, withReadLimit };
+export { ANCESTRY_DEPENDENT_TAGS, APP_SCRIPT, ASIDE_DEMOTING_TAGS, CHILD_NODE_KEYS, IDREF_ATTRS, NAMING_ATTRS, ROBOTS_SOURCE_PATHS, SECTIONING_TAGS, SITEMAP_SOURCE_PATHS, SVELTE_CONFIG_FILES, VITE_CONFIG_FILES, a11yAbbrTitle, a11yAccessibleName, a11yAriaHiddenFocus, a11yDeprecatedAria, a11yDeprecatedAttr, a11yDeprecatedElement, a11yDisallowedAriaProps, a11yDisallowedElement, a11yDoctype, a11yDuplicateLandmark, a11yIdDuplication, a11yInteractiveNesting, a11yInvalidAriaValue, a11yInvalidRole, a11yLabelHasControl, a11yNoAccesskey, a11yNoAutofocus, a11yNoDuplicateDt, a11yNoMissingIdRef, a11yPatternTitle, a11yPermittedContents, a11yPlaceholderLabelOption, a11yPositiveTabindex, a11yRequireDatetime, a11yRequiredAriaProps, a11yRequiredElement, a11yTopLevelLandmark, a11yUnknownAriaAttribute, a11yUnverifiedIdRef, a11yUseList, addFactsDirectives, allRules, architectureComponentSize, architectureDirectoryNaming, architectureDocLinkTarget, architecturePrivateScopeImport, architecturePropCount, architectureReservedDirectoryNames, architectureReservedNamePlacement, architectureRouteComponentImport, architectureUnitEntryFile, attrText, attrTextOf, attrValue, attrValueOf, buildHtmlDocument, buildJsonReport, classify, collectComponentFacts, collectKitModuleFacts, collectSourceFiles, collectSuppressions, compileOverrides, computeHealth, computeScore, correctnessAutoplayMuted, correctnessBasePathNavigation, correctnessCheckableBindValue, correctnessEachIndexKey, correctnessEachKey, correctnessEffectAsDerived, correctnessEffectAsOnMount, correctnessInstanceBrowserGlobal, correctnessNonreactiveBuiltinState, correctnessOrphanEffect, correctnessOrphanLifecycle, correctnessPropMutation, correctnessServerBrowserGlobal, correctnessStalePropDerivation, correctnessUnmutatedState, decodeFragmentId, defaultConfig, defaultProject, docsUrlFor, effectiveSeverity, escapeHtml, explainRule, findAttr, findMinifyDisabled, foldOccurrences, formatAgentReport, formatConsoleReport, formatFailedRuleWarning, formatGithubReport, formatHtmlReport, formatJsonReport, formatMarkdownReport, formatSarifReport, hasFailureAtOrAbove, isClassicScriptType, isPenalized, isTopFragment, lineOf, noColorPalette, parseComponentFacts, parseSvelte, performanceFontPreloadCrossorigin, performanceHeavyImport, performanceIframeLoading, performanceImageDimensions, performanceImageLoadingHint, performanceLcpImage, performanceLoadWaterfall, performanceMinifyDisabled, performanceNamespaceImport, performancePreconnect, performancePreloadMissingAs, performanceRenderBlockingScript, performanceResponsiveImage, performanceSequentialAwaits, performanceStateRaw, renderAppShell, resolveKitAliases, resolveKitPathsBase, resolveLandmark, resolveRepoLocalPath, resolveRuleOptions, runAnalysis, runRules, safeHref, scoreColor, securityHandlerStateWrite, securityJavascriptUrl, securityRawHtml, securityServerModuleState, securitySharedStateImport, selectRules, seoCanonicalUrl, seoCharset, seoDescriptionLength, seoDescriptionPresence, seoDuplicateDescription, seoDuplicateTitle, seoHeadingLevelSkip, seoHreflang, seoHtmlLang, seoImageAlt, seoIndexability, seoJsonLd, seoJsonLdDateFormat, seoJsonLdDeprecatedType, seoJsonLdPlaceholder, seoJsonLdRelativeUrl, seoJsonLdRequiredProps, seoJsonLdValidity, seoOgDescription, seoOgImage, seoOgTitle, seoOgUrl, seoRobotsTxt, seoSingleH1, seoSitemapInRobots, seoSitemapXml, seoSsrDisabled, seoTitleLength, seoTitlePresence, seoTwitterCard, seoViewport, settingSeverity, shouldSkipRangeCheck, skippedFileWarnings, splitTokens, stripTextDirective, summarize, terminalSafe, textFromNodes, unknownDirectiveIds, validateRuleSetting, valueFromNodes, withFailedRulesOff, withReadLimit };