@svelte-vitals/core 0.55.1 → 0.55.2

package/dist/{markdown-BOH3FPQl.js → markdown-DgHBAvYl.js}

@@ -1,5 +1,5 @@
-import { parse } from "svelte/compiler";
 import { aria, roles } from "aria-query";
+import { parse } from "svelte/compiler";
 //#region src/types.ts
 const defaultProject = {
 	hasRobotsTxt: false,
@@ -153,6 +153,19 @@ const seoTitlePresence = {
 };
 //#endregion
 //#region src/rules/seo/head-tag-rule.ts
+/** Open Graph keys are read from `property=`; `name="og:*"` is the common slip. */
+function ogMisspelled(key) {
+	return {
+		match: (t) => t.kind === "meta" && t.name === key && t.property === void 0,
+		label: `<meta name="${key}"> should be <meta property="${key}">`,
+		recommendation: `Open Graph reads ${key} from the property attribute: change name="${key}" to property="${key}".`,
+		fix: {
+			description: `Change name="${key}" to property="${key}" on the existing tag.`,
+			snippet: `<meta property="${key}" content="…" />`,
+			lang: "svelte"
+		}
+	};
+}
 function detect(head, match) {
 	const matches = head.tags.filter(match);
 	const rank = (t) => (t.value !== "absent" ? 2 : 0) + (t.presence === "own" ? 1 : 0);
@@ -180,7 +193,8 @@ function headTagRule(opts) {
 		async check(ctx) {
 			return (opts.appliesTo ? ctx.heads.filter(opts.appliesTo) : ctx.heads).map((head) => {
 				const detection = detect(head, opts.match);
-				const message = detection.presence === "none" ? `Missing ${opts.label}` : detection.value === "absent" ? `Empty ${opts.label}` : opts.label;
+				const misspelled = detection.presence === "none" && opts.misspelled && head.tags.some(opts.misspelled.match) ? opts.misspelled : void 0;
+				const message = misspelled ? misspelled.label : detection.presence === "none" ? `Missing ${opts.label}` : detection.value === "absent" ? `Empty ${opts.label}` : opts.label;
 				return {
 					id: opts.id,
 					category: "seo",
@@ -189,9 +203,9 @@ function headTagRule(opts) {
 					route: head.route,
 					location: head.file,
 					message,
-					recommendation: opts.recommendation,
+					recommendation: misspelled?.recommendation ?? opts.recommendation,
 					docsUrl,
-					...opts.fix ? { fix: { ...opts.fix } } : {}
+					...misspelled ? { fix: { ...misspelled.fix } } : opts.fix ? { fix: { ...opts.fix } } : {}
 				};
 			});
 		}
@@ -236,6 +250,7 @@ const seoOgImage = headTagRule({
 	title: "Open Graph image",
 	severity: "warning",
 	match: (t) => t.kind === "meta" && t.property === "og:image",
+	misspelled: ogMisspelled("og:image"),
 	label: "<meta property=\"og:image\">",
 	recommendation: "Add <meta property=\"og:image\">, or set openGraph.images on your meta component.",
 	rationale: "og:image is the preview thumbnail shown when the page is shared on social platforms; without it links render bare and get fewer clicks.",
@@ -252,6 +267,7 @@ const seoOgTitle = headTagRule({
 	title: "Open Graph title",
 	severity: "warning",
 	match: (t) => t.kind === "meta" && t.property === "og:title",
+	misspelled: ogMisspelled("og:title"),
 	label: "<meta property=\"og:title\">",
 	recommendation: "Add <meta property=\"og:title\">, or set openGraph.title on your meta component.",
 	rationale: "og:title controls the headline shown when the page is shared on social platforms, independent of the document <title>.",
@@ -510,7 +526,7 @@ const performanceResponsiveImage = imageRule({
 		snippet: "<img src=\"/hero.jpg\" srcset=\"/hero-800.jpg 800w, /hero-1600.jpg 1600w\" sizes=\"100vw\" width=\"1600\" height=\"900\" alt=\"…\" />",
 		lang: "svelte"
 	},
-	ok: (img) => img.hasSrcset
+	ok: (img) => img.hasSrcset || img.svg === true
 });
 //#endregion
 //#region src/rules/perf/link-rule.ts
@@ -1252,7 +1268,7 @@ const seoTwitterCard = headTagRule({
 	id: "seo/twitter-card",
 	title: "Twitter Card",
 	severity: "info",
-	match: (t) => t.kind === "meta" && t.name === "twitter:card",
+	match: (t) => t.kind === "meta" && (t.name === "twitter:card" || t.property === "twitter:card"),
 	label: "<meta name=\"twitter:card\">",
 	recommendation: "Add <meta name=\"twitter:card\" content=\"summary_large_image\"> so X/Twitter renders a rich card.",
 	rationale: "twitter:card selects how the page renders when shared on X/Twitter; without it the platform falls back to a basic link (Open Graph tags are used as fallbacks for the rest).",
@@ -1269,6 +1285,7 @@ const seoOgDescription = headTagRule({
 	title: "Open Graph description",
 	severity: "info",
 	match: (t) => t.kind === "meta" && t.property === "og:description",
+	misspelled: ogMisspelled("og:description"),
 	label: "<meta property=\"og:description\">",
 	recommendation: "Add <meta property=\"og:description\">, or set openGraph.description on your meta component.",
 	rationale: "og:description is the summary shown under the title in social previews; without it platforms guess or show nothing, lowering click-through. The Open Graph protocol lists it as an optional property.",
@@ -1285,6 +1302,7 @@ const seoOgUrl = headTagRule({
 	title: "Open Graph URL",
 	severity: "warning",
 	match: (t) => t.kind === "meta" && t.property === "og:url",
+	misspelled: ogMisspelled("og:url"),
 	label: "<meta property=\"og:url\">",
 	recommendation: "Add <meta property=\"og:url\"> with the canonical URL, or set openGraph.url on your meta component.",
 	rationale: "og:url tells social platforms the canonical address to attribute shares and likes to, consolidating engagement on one URL. The Open Graph protocol lists it as a required property.",
@@ -2084,6 +2102,223 @@ const seoHreflang = {
 	}
 };
 //#endregion
+//#region src/rules/a11y/aria-data.ts
+/**
+* ARIA names `aria-query@5.3.2` does not carry. It is not the clean ARIA 1.2 snapshot it looks
+* like — it holds 1.2's 48 attributes plus three 1.3 additions — so the gap is patched by name
+* rather than by version. Every entry here is defined in the ARIA 1.3 editor's draft, which is
+* what makes reporting it as an unknown name wrong — how far implementations have got is a
+* separate question this rule does not ask. Re-check this list whenever the aria-query dependency
+* moves.
+*/
+const ARIA_1_3_ROLES = /* @__PURE__ */ new Set([
+	"comment",
+	"image",
+	"sectionheader",
+	"sectionfooter",
+	"suggestion"
+]);
+const ARIA_1_3_ATTRIBUTES = /* @__PURE__ */ new Set(["aria-colindextext", "aria-rowindextext"]);
+/**
+* Roles whose `requiredProps` row in aria-query is stale. Neither ARIA 1.2 nor the 1.3 editor's
+* draft lists required states or properties for these — the 1.3 draft re-lists inherited
+* requirements where they apply (`menuitemradio` → `aria-checked`), so the absence is deliberate
+* rather than an inheritance the table left implicit. Without this, idiomatic APG listbox and
+* tree markup is flagged.
+*/
+const NO_REQUIRED_PROPS = /* @__PURE__ */ new Set(["option", "treeitem"]);
+function isKnownRole(role) {
+	return ARIA_1_3_ROLES.has(role) || roles.has(role);
+}
+function isAbstractRole(role) {
+	return roles.get(role)?.abstract === true;
+}
+/** A concrete (non-abstract) role is the one a user agent resolves a role token list to. */
+function isConcreteRole(role) {
+	return isKnownRole(role) && !isAbstractRole(role);
+}
+/**
+* The role a user agent applies: the first token naming a concrete role, or undefined when none
+* does. Shared so the role rules cannot disagree about what a fallback list means.
+*/
+function resolveRole(tokens) {
+	return tokens.find(isConcreteRole);
+}
+function isKnownAriaAttribute(name) {
+	return ARIA_1_3_ATTRIBUTES.has(name) || aria.has(name);
+}
+function requiredAriaProps(role) {
+	if (NO_REQUIRED_PROPS.has(role)) return [];
+	const def = roles.get(role);
+	return def ? Object.keys(def.requiredProps) : [];
+}
+function ariaValueKind(name) {
+	const def = aria.get(name);
+	if (!def) return void 0;
+	return {
+		type: def.type,
+		...def.values ? { values: def.values.map(String) } : {}
+	};
+}
+//#endregion
+//#region src/a11y.ts
+/**
+* Branch-aware occurrence fold (design "Control-flow semantics"): within a branch
+* occurrences sum, across the arms of one exclusive block the arm with the most
+* occurrences wins (tie → lowest branch index) and ITS occurrences are the group's
+* representatives — so a caller's count is always `list.length`, with a location per
+* representative. `{#each}`/`{#snippet}` occurrences render 0..N times and drop out.
+* The max is per key: there is no scalar total to maximize.
+*/
+function foldOccurrences(nodes) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const node of nodes) {
+		if (node.repeatable) continue;
+		const list = byKey.get(node.key);
+		if (list) list.push(node);
+		else byKey.set(node.key, [node]);
+	}
+	const folded = /* @__PURE__ */ new Map();
+	for (const [key, list] of byKey) folded.set(key, foldAt(list, 0));
+	return folded;
+}
+function foldAt(nodes, depth) {
+	const unconditional = [];
+	const groups = /* @__PURE__ */ new Map();
+	for (const node of nodes) {
+		const step = node.path[depth];
+		if (!step) {
+			unconditional.push(node);
+			continue;
+		}
+		let branches = groups.get(step.group);
+		if (!branches) groups.set(step.group, branches = /* @__PURE__ */ new Map());
+		const list = branches.get(step.branch);
+		if (list) list.push(node);
+		else branches.set(step.branch, [node]);
+	}
+	const representatives = [...unconditional];
+	for (const branches of groups.values()) {
+		let best = [];
+		let bestBranch = Number.POSITIVE_INFINITY;
+		for (const [branch, list] of branches) {
+			const arm = foldAt(list, depth + 1);
+			if (arm.length > best.length || arm.length === best.length && branch < bestBranch) {
+				best = arm;
+				bestBranch = branch;
+			}
+		}
+		representatives.push(...best);
+	}
+	return representatives;
+}
+/**
+* Decode a fragment identifier the way navigation does before matching an element id
+* (`href="#caf%C3%A9"` targets `id="café"`). Malformed escapes are kept verbatim —
+* the browser would also fail to decode them, so the raw text is the comparable form.
+*/
+function decodeFragmentId(fragment) {
+	try {
+		return decodeURIComponent(fragment);
+	} catch {
+		return fragment;
+	}
+}
+/** Whitespace-split tokens of a (possibly undefined) literal attribute value. */
+function splitTokens(value) {
+	return value ? value.trim().split(/\s+/).filter(Boolean) : [];
+}
+/** Explicit `role` values that map to the landmark kinds the route rules inspect. */
+const LANDMARK_ROLES = /* @__PURE__ */ new Set([
+	"main",
+	"banner",
+	"contentinfo",
+	"complementary"
+]);
+/** Sectioning content (HTML-AAM): a `<header>`/`<footer>` below one of these is not a landmark. */
+const SECTIONING_TAGS = /* @__PURE__ */ new Set([
+	"article",
+	"aside",
+	"main",
+	"nav",
+	"section"
+]);
+/**
+* Tags whose landmark-ness depends on sectioning ancestry. A provider that cannot see ancestry
+* (the per-file AST walk) uses this same set to mark the deferral (topLevel) — reading it from
+* here keeps the deferral set from drifting when the policy widens.
+*/
+const ANCESTRY_DEPENDENT_TAGS = /* @__PURE__ */ new Set(["header", "footer"]);
+/** Attributes that give an element the accessible name the `<aside>` landmark decision reads. */
+const NAMING_ATTRS$1 = ["aria-label", "aria-labelledby"];
+/**
+* HTML-AAM: an `<aside>` scoped to `body` or `main` is a `complementary` landmark; scoped to
+* sectioning content it is one only when it has an accessible name. `main` is deliberately absent
+* — it is a scope in which an `aside` *is* a landmark, unlike the sectioning set that decides
+* `<header>`/`<footer>`.
+*/
+const ASIDE_DEMOTING_TAGS = /* @__PURE__ */ new Set([
+	"article",
+	"aside",
+	"nav",
+	"section"
+]);
+/**
+* The landmark kind an element contributes ('main'|'banner'|'contentinfo'|'complementary'), or
+* undefined. The one home for the decision both providers apply — the source AST walk and the
+* rendered HTML walk each feed it their own tree's context. ARIA fallback role lists resolve to
+* the first token naming a concrete role (resolveRole).
+*/
+function resolveLandmark(input) {
+	const { tag, roleTokens, named, insideSectioning, insideAsideDemoting } = input;
+	if (roleTokens !== void 0) {
+		const role = resolveRole(roleTokens);
+		return role && LANDMARK_ROLES.has(role) ? role : void 0;
+	}
+	if (tag === "main") return "main";
+	if (tag !== void 0 && ANCESTRY_DEPENDENT_TAGS.has(tag)) return insideSectioning ? void 0 : tag === "header" ? "banner" : "contentinfo";
+	if (tag === "aside") return !insideAsideDemoting || named ? "complementary" : void 0;
+}
+/**
+* Attributes whose (whitespace-tokenized) values reference element ids: the ARIA id-reference and
+* id-reference-list properties, and HTML's own (`for`, `list`, `headers`, `form`, the popover and
+* command targets). `href="#…"` is handled separately — its value is a URL, not a token list.
+*/
+const IDREF_ATTRS = [
+	"for",
+	"list",
+	"headers",
+	"form",
+	"popovertarget",
+	"commandfor",
+	"aria-labelledby",
+	"aria-describedby",
+	"aria-controls",
+	"aria-activedescendant",
+	"aria-owns",
+	"aria-details",
+	"aria-errormessage",
+	"aria-flowto"
+];
+/**
+* Whether a decoded URL fragment is HTML's "top of the document" indicator: `#top` (ASCII
+* case-insensitive) scrolls to the top when no element has that id, so it is never a missing
+* reference. Compare AFTER percent-decoding — `#%74op` navigates identically to `#top`.
+*/
+function isTopFragment(id) {
+	return id.toLowerCase() === "top";
+}
+/**
+* A fragment with its text directive removed. Everything from the first `:~:` on is user-agent
+* instructions for finding text and names no element, while anything before it is still an
+* ordinary element fragment — `#section:~:text=hi` targets `id="section"`, `#:~:text=hi` targets
+* nothing. Returns an empty string when the fragment is a directive and nothing else.
+*/
+function stripTextDirective(fragment) {
+	const i = fragment.indexOf(":~:");
+	return i === -1 ? fragment : fragment.slice(0, i);
+}
+//#endregion
 //#region src/rules/seo/single-h1.ts
 const docsUrl$6 = docsUrlFor("seo/single-h1");
 const passRecommendation = "Use exactly one <h1> per page for its main topic; demote extra top-level headings to <h2>+.";
@@ -2098,10 +2333,24 @@ const multipleRecommendation = "A single, clear <h1> is the conventional signal
 * signal, but no official source documents a ranking penalty for several (2026-08-09 v1
 * rule-validity review, P2 #11) — so it's flagged as a style nit, not a defect. Exactly
 * one passes. A route whose headings were not collected (channel unset) emits nothing, as does
-* one whose `dynamicHeading` flag says an undeterminable `<svelte:element>` may be its <h1>. A
+* one whose `dynamicHeading` flag says a heading of undeterminable level may be its <h1>. A
 * global `rules: { 'seo/single-h1': <severity> }` override flattens both arms to one
 * severity (design, `applyRuleSeverities`).
 */
+/**
+* The <h1>s that can render together, in input order: the arms of one `{#if}`/`{#await}`/
+* `<svelte:boundary>` contribute only their largest arm. Separate blocks still sum, since both may be true.
+*/
+function renderableH1s(headings) {
+	const nodes = headings.filter((h) => h.level === 1).map((heading) => ({
+		key: "h1",
+		path: heading.path ?? [],
+		repeatable: false,
+		heading
+	}));
+	const kept = new Set([...foldOccurrences(nodes).values()].flat().map((n) => n.heading));
+	return headings.filter((h) => kept.has(h));
+}
 const seoSingleH1 = {
 	id: "seo/single-h1",
 	title: "Heading hierarchy",
@@ -2112,7 +2361,7 @@ const seoSingleH1 = {
 	async check(ctx) {
 		const out = [];
 		for (const route of ctx.headings ?? []) {
-			const h1 = [...route.headings, ...route.componentHeadings ?? []].filter((h) => h.level === 1);
+			const h1 = renderableH1s([...route.headings, ...route.componentHeadings ?? []]);
 			let problem;
 			let where = {};
 			if (h1.length === 0) {
@@ -2246,6 +2495,13 @@ const seoDuplicateDescription = uniquenessRule({
 	rationale: "Duplicate meta descriptions give search engines no per-page summary, so they are often ignored or rewritten."
 });
 //#endregion
+//#region src/headings.ts
+/** Two headings can never render together: different arms of one block. */
+function exclusiveHeadings(a, b) {
+	if (!a.path || !b.path) return false;
+	return a.path.some((s) => b.path.some((t) => s.group === t.group && s.branch !== t.branch));
+}
+//#endregion
 //#region src/rules/seo/heading-level-skip.ts
 const docsUrl$5 = docsUrlFor("seo/heading-level-skip");
 const recommendation$5 = "Increase heading levels one step at a time (do not jump, e.g. from <h2> straight to <h4>).";
@@ -2266,20 +2522,16 @@ const seoHeadingLevelSkip = {
 		const out = [];
 		for (const route of ctx.headings ?? []) {
 			if (route.headings.length === 0) continue;
-			let prev = route.headings[0].level;
 			let skip;
-			for (let i = 1; i < route.headings.length; i++) {
+			for (let i = 1; i < route.headings.length && !skip; i++) {
 				const h = route.headings[i];
-				if (h.level > prev + 1) {
-					skip = {
-						level: h.level,
-						prev,
-						line: h.line,
-						file: h.file
-					};
-					break;
-				}
-				prev = h.level;
+				const prev = route.headings.slice(0, i).reverse().find((p) => !exclusiveHeadings(p, h));
+				if (prev && h.level > prev.level + 1) skip = {
+					level: h.level,
+					prev: prev.level,
+					line: h.line,
+					file: h.file
+				};
 			}
 			out.push(skip ? {
 				id: "seo/heading-level-skip",
@@ -2409,11 +2661,94 @@ function kitModuleRule(opts) {
 	});
 }
 //#endregion
-//#region src/rules/seo/ssr-disabled.ts
-/** The root layout — disabling SSR there turns the whole app into an SPA. */
+//#region src/kit-module.ts
+/** The root layout — its page options cover the whole app. */
 const ROOT_LAYOUT_RE = /^src\/routes\/\+layout(\.server)?\.(ts|js)$/;
-/** `ssr` is a page option — it has no effect in `+server` endpoints or hooks files. */
+/** Files whose `ssr` export is a page option — it has no effect in `+server` endpoints or hooks files. */
 const PAGE_OPTION_FILE_RE = /\+(page|layout)(\.server)?\.(ts|js)$/;
+const appSsrCache = /* @__PURE__ */ new WeakMap();
+/**
+* Whether no page is ever server-rendered: the root layout exports `ssr = false` and no page-option
+* file might turn it back on. Universal loads and components then run only in the browser; server
+* files (`+page.server`, `+server`, hooks) still run on the server.
+*/
+function appSsrDisabled(kitModules) {
+	if (!kitModules) return false;
+	let hit = appSsrCache.get(kitModules);
+	if (hit === void 0) {
+		hit = kitModules.some((m) => m.ssrDisabled && ROOT_LAYOUT_RE.test(m.file)) && !kitModules.some((m) => PAGE_OPTION_FILE_RE.test(m.file) && (m.ssrEnabled || m.parseFailed));
+		appSsrCache.set(kitModules, hit);
+	}
+	return hit;
+}
+const ROUTES_DIR$1 = "src/routes";
+/** A `+page`/`+layout` file: its directory, kind, and the `@segment` layout reset (on `.svelte` names). */
+const ROUTE_FILE_RE = /^(src\/routes(?:\/.+)?)\/\+(page|layout)(?:@([^/]*))?(?:\.server)?\.(?:svelte|ts|js)$/;
+const parentDir = (dir) => dir === ROUTES_DIR$1 ? void 0 : dir.slice(0, dir.lastIndexOf("/"));
+/** The nearest ancestor-or-self directory a `@segment` reset names (`''` is the root). */
+function resetTarget(dir, segment) {
+	for (let d = dir; d !== void 0; d = parentDir(d)) if (segment === "" ? d === ROUTES_DIR$1 : d.slice(d.lastIndexOf("/") + 1) === segment) return d;
+}
+const routeSsrCache = /* @__PURE__ */ new WeakMap();
+/**
+* Per route directory, whether its page (`page:<dir>`) or layout (`layout:<dir>`) is never
+* server-rendered. A page takes the nearest `ssr` export along its own files and then its layout
+* chain, following `+page@x`/`+layout@x` resets as SvelteKit does; an export other than a literal
+* `false`, or an unparsed option file, counts as SSR on. A layout is off only when every page using
+* it is — and the root layout also needs its own `ssr = false`, since it wraps the 404 page.
+*/
+function routeSsrOff(scope) {
+	const kitModules = scope.kitModules ?? [];
+	let hit = routeSsrCache.get(scope);
+	if (hit) return hit;
+	const pages = /* @__PURE__ */ new Map();
+	const layouts = /* @__PURE__ */ new Map();
+	const files = [
+		...scope.sourceFiles ?? [],
+		...(scope.components ?? []).map((c) => c.file),
+		...kitModules.map((m) => m.file)
+	];
+	for (const file of files) {
+		const match = ROUTE_FILE_RE.exec(file);
+		if (!match) continue;
+		const map = match[2] === "page" ? pages : layouts;
+		if (match[3] !== void 0 || !map.has(match[1])) map.set(match[1], match[3]);
+	}
+	const option = /* @__PURE__ */ new Map();
+	for (const m of kitModules) {
+		const match = ROUTE_FILE_RE.exec(m.file);
+		if (!match) continue;
+		const key = `${match[2]}:${match[1]}`;
+		if (m.ssrEnabled || m.parseFailed) option.set(key, "on");
+		else if (m.ssrDisabled && !option.has(key)) option.set(key, "off");
+	}
+	hit = /* @__PURE__ */ new Map();
+	for (const [dir, reset] of pages) {
+		const chain = [];
+		for (let d = reset === void 0 ? dir : resetTarget(dir, reset); d !== void 0;) {
+			const layoutReset = layouts.get(d);
+			if (layouts.has(d)) chain.push(d);
+			d = layoutReset === void 0 ? parentDir(d) : resetTarget(parentDir(d), layoutReset);
+		}
+		const off = [`page:${dir}`, ...chain.map((l) => `layout:${l}`)].map((k) => option.get(k)).find(Boolean) === "off";
+		hit.set(`page:${dir}`, off);
+		for (const l of chain) hit.set(`layout:${l}`, (hit.get(`layout:${l}`) ?? true) && off);
+	}
+	if (option.get(`layout:${ROUTES_DIR$1}`) !== "off") hit.delete(`layout:${ROUTES_DIR$1}`);
+	routeSsrCache.set(scope, hit);
+	return hit;
+}
+/** Whether a `+page`/`+layout` file (module or component) belongs to a route that is never server-rendered. */
+function routeNeverSsr(file, scope) {
+	const match = ROUTE_FILE_RE.exec(file);
+	return !!match && routeSsrOff(scope).get(`${match[2]}:${match[1]}`) === true;
+}
+/** Whether a universal `+page`/`+layout` module never runs on the server — its own `ssr = false`, an app-wide one, or one its route inherits. */
+function universalNeverSsr(m, scope) {
+	return m.kind === "universal" && (m.ssrDisabled !== void 0 || appSsrDisabled(scope.kitModules) || routeNeverSsr(m.file, scope));
+}
+//#endregion
+//#region src/rules/seo/ssr-disabled.ts
 const seoSsrDisabled = kitModuleRule({
 	id: "seo/ssr-disabled",
 	title: "SSR disabled",
@@ -2755,9 +3090,19 @@ function messageFor(link) {
 	if (link.kind === "goto") return `goto('${link.path}') is root-relative — it navigates outside this project's kit.paths.base and 404s in production. Use goto(resolve('${link.path}')) with resolve from '$app/paths'.`;
 	return `redirect(…, '${link.path}') is root-relative — the Location header points outside this project's kit.paths.base and 404s in production. Use resolve('${link.path}') from '$app/paths'.`;
 }
+/**
+* A literal that already carries a statically known base is correct as written; only a dynamic
+* base (no `value`) leaves every root-relative literal suspect.
+*/
+function startsWithBase(path, base) {
+	if (base === void 0 || !path.startsWith(base)) return false;
+	if (/(^|\/)(\.|%2e){2}(\/|$)/i.test(path.split(/[?#]/)[0])) return false;
+	const next = path.charAt(base.length);
+	return next === "" || next === "/" || next === "?" || next === "#";
+}
 /** Emit one file's PASS/PENALIZED results — same shapes as componentRule/kitModuleRule. */
-function emitFile$1(out, file, links, suppressions) {
-	const bad = links.filter((l) => !(l.line > 0 && isSuppressed(suppressions, ID$8, l.line)));
+function emitFile$1(out, file, links, suppressions, base) {
+	const bad = links.filter((l) => !startsWithBase(l.path, base) && !(l.line > 0 && isSuppressed(suppressions, ID$8, l.line)));
 	if (bad.length === 0) {
 		out.push({
 			id: ID$8,
@@ -2802,16 +3147,17 @@ const correctnessBasePathNavigation = {
 	fix: { ...FIX$2 },
 	async check(ctx) {
 		if (!ctx.project.kitPathsBase) return [];
+		const base = ctx.project.kitPathsBase.value;
 		const out = [];
 		for (const c of ctx.components ?? []) {
 			const links = c.basePathLinks ?? [];
 			if (links.length === 0) continue;
-			emitFile$1(out, c.file, links, c.suppressions);
+			emitFile$1(out, c.file, links, c.suppressions, base);
 		}
 		for (const m of ctx.kitModules ?? []) {
 			const links = m.basePathLinks ?? [];
 			if (links.length === 0) continue;
-			emitFile$1(out, m.file, links, m.suppressions);
+			emitFile$1(out, m.file, links, m.suppressions, base);
 		}
 		return out;
 	}
@@ -2878,7 +3224,8 @@ const correctnessServerBrowserGlobal = {
 			})), c.suppressions);
 		}
 		for (const m of ctx.kitModules ?? []) {
-			const refs = m.browserGlobalRefs ?? [];
+			const neverSsr = universalNeverSsr(m, ctx);
+			const refs = (m.browserGlobalRefs ?? []).filter((r) => !(neverSsr && r.inHandler));
 			if (refs.length === 0) continue;
 			emitFile(out, m.file, refs.map((r) => ({
 				line: r.line,
@@ -2897,7 +3244,7 @@ const correctnessInstanceBrowserGlobal = componentRule({
 	label: "Server-safe component init",
 	recommendation: "Move browser-only code into onMount or $effect (they never run on the server), or guard it with browser from $app/environment (or a typeof check).",
 	rationale: "A component instance script runs on the server on every SSR render, where window/document/localStorage do not exist. Warning, not critical: a component rendered only behind a parent {#if browser} (or a client-only dynamic import) is a legitimate pattern that static analysis cannot prove cross-file.",
-	applies: (c) => (c.browserGlobalRefs ?? []).some((r) => r.context === "instance"),
+	applies: (c, _o, ctx) => (c.browserGlobalRefs ?? []).some((r) => r.context === "instance") && !appSsrDisabled(ctx.kitModules) && !routeNeverSsr(c.file, ctx),
 	bad: (c) => (c.browserGlobalRefs ?? []).filter((r) => r.context === "instance").map((r) => ({
 		line: r.line,
 		message: `${r.name} is accessed during component initialisation — during SSR this runs on the server, where ${r.name} is not defined`
@@ -2943,7 +3290,7 @@ const securityHandlerStateWrite = kitModuleRule({
 	label: "Load/handler purity",
 	recommendation: "Return the data from load (or the action) and pass it via page data instead of writing it to module state; per-user data belongs in cookies/locals plus a database. Caches and rate limiters keyed by non-personal data are the benign shape — if that describes this write, add an inline suppression.",
 	rationale: "SvelteKit's docs mark this NEVER-DO-THIS: the server is one long-lived process shared by every user, so module state written during a request is visible to ALL later requests.",
-	applies: (m) => m.importedStateWrites.length > 0 && !(m.kind === "universal" && m.ssrDisabled),
+	applies: (m, ctx) => m.importedStateWrites.length > 0 && !universalNeverSsr(m, ctx),
 	bad: (m) => m.importedStateWrites.map((w) => ({
 		line: w.line,
 		message: `a server-executed handler writes imported module state "${w.name}" — module state is shared across all requests on the server; if this holds per-request or per-user data, one user's data can leak to another. Caches and rate limiters keyed by non-personal data are the benign shape — verify which this is`
@@ -2958,7 +3305,7 @@ const securityServerModuleState = kitModuleRule({
 	label: "Server module state",
 	recommendation: "Do not keep request data in module scope on the server — authenticate with cookies/locals and persist per-user data in a database. For a deliberate process-wide cache, prefer a const container (e.g. a Map) or add an inline suppression.",
 	rationale: "Module scope on the server is one shared, long-lived instance (SvelteKit docs: \"Avoid shared state on the server\"): a value reassigned during one user's request is served to every other user, and it silently resets on every deploy or restart.",
-	applies: (m) => m.moduleStateReassignments.length > 0,
+	applies: (m, ctx) => m.moduleStateReassignments.length > 0 && !universalNeverSsr(m, ctx),
 	bad: (m) => m.moduleStateReassignments.map((r) => ({
 		line: r.line,
 		message: r.inHandler ? `module-scope variable "${r.name}" is reassigned from a request handler — its value is shared across all requests on the server` : `module-scope variable "${r.name}" is reassigned from a function — if it runs during a request, the value is shared across all requests on the server`
@@ -2977,7 +3324,7 @@ const securitySharedStateImport = kitModuleRule({
 	label: "Server state imports",
 	recommendation: "Keep module-scope $state out of server-executed code: return data from load and share it via page data or the context API. If the module is genuinely client-only, restructure so server files do not import it, or add an inline suppression.",
 	rationale: "A .svelte.ts module with module-scope $state is one shared instance on the server: mutated, it leaks data between users; read-only, every request sees the same boot-time value instead of per-user data.",
-	applies: (m) => m.runesModuleImports.length > 0 && !(m.kind === "universal" && m.ssrDisabled),
+	applies: (m, ctx) => m.runesModuleImports.length > 0 && !universalNeverSsr(m, ctx),
 	bad: (m, ctx) => {
 		const stateFiles = new Set((ctx.components ?? []).filter((c) => c.moduleStateDecls.length > 0).map((c) => c.file));
 		const writtenOutside = new Set(m.importedStateWritesOutsideHandlers.map((w) => w.name));
@@ -3258,7 +3605,8 @@ function rootObjectName(node) {
 * `then`/`catch` value/error bindings, and a fragment's own `{@const ...}` /
 * `{let ...}` / `{const ...}` declaration tags (attributed to the enclosing Fragment,
 * shadowing the whole fragment like a block's `let` — a write to one of these
-* template-locals, possible for `{let}`, is still not a write to the outer binding).
+* template-locals, possible for `{let}`, is still not a write to the outer binding), and an
+* element's or component's `let:` directive bindings.
 * Used by `walkScoped` so a write/mutation detector
 * doesn't misattribute a write to one of these locals as a write to an outer `$state`/prop
 * of the same name (issue #140 — originally a deliberately partial mitigation that left
@@ -3284,7 +3632,20 @@ function scopeIntroducedNames(node) {
 	else if (node.type === "AwaitBlock") {
 		if (node.value) addBoundNames(node.value, introduced);
 		if (node.error) addBoundNames(node.error, introduced);
-	} else if (node.type === "Fragment") {
+	} else if (Array.isArray(node.attributes) && node.fragment) for (const attr of node.attributes) {
+		if (attr?.type !== "LetDirective") continue;
+		const e = attr.expression;
+		const asPattern = {
+			ObjectExpression: "ObjectPattern",
+			ArrayExpression: "ArrayPattern"
+		}[e?.type];
+		if (e) addBoundNames(asPattern ? {
+			...e,
+			type: asPattern
+		} : e, introduced);
+		else introduced.add(attr.name);
+	}
+	else if (node.type === "Fragment") {
 		for (const child of node.nodes ?? []) if (child?.type === "ConstTag" || child?.type === "DeclarationTag") for (const d of child.declaration?.declarations ?? []) addBoundNames(d.id, introduced);
 	}
 	return introduced;
@@ -3340,11 +3701,21 @@ function walkEvalScope(node, visit, shadowed = /* @__PURE__ */ new Set(), bounda
 	const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
 	if (visit(node, scope)) return;
 	if (boundaries.has(node.type)) return;
+	const outer = introduced.size > 0 ? outerScopeKeys(node) : void 0;
 	for (const key of Object.keys(node)) {
 		if (WALK_IGNORED_KEYS.has(key)) continue;
-		walkEvalScope(node[key], visit, scope, boundaries);
+		if (!outer?.has(key)) walkEvalScope(node[key], visit, scope, boundaries);
+		else if (!Array.isArray(node[key])) walkEvalScope(node[key], visit, shadowed, boundaries);
+		else for (const child of node[key]) walkEvalScope(child, visit, child?.type === "LetDirective" ? scope : shadowed, boundaries);
 	}
 }
+/** Children of a binding construct that are evaluated before its bindings exist. */
+function outerScopeKeys(node) {
+	if (node.type === "EachBlock" || node.type === "AwaitBlock") return OUTER_SCOPE_KEYS;
+	if (Array.isArray(node.attributes) && node.fragment) return ATTRIBUTE_KEYS;
+}
+const OUTER_SCOPE_KEYS = /* @__PURE__ */ new Set(["expression"]);
+const ATTRIBUTE_KEYS = /* @__PURE__ */ new Set(["attributes"]);
 /**
 * Unwrap a top-level statement's `export`/`export default` wrapper to the declaration
 * (or expression) it wraps; a non-export statement is returned as-is. Used so pattern 2
@@ -3449,12 +3820,13 @@ function collectNamedImportAliases(program, moduleSource, names) {
 }
 const BROWSER_GUARD_NAMES = /* @__PURE__ */ new Set(["browser"]);
 /**
-* Local names of `browser` value-imported from '$app/environment' (alias-resolved) —
+* Local names of `browser` value-imported from '$app/environment' or its SvelteKit 3 name
+* '$app/env' (alias-resolved) —
 * the guard binding recognised by the browser-global scanner (correctness/server-browser-global, correctness/instance-browser-global).
 * Shared with the Kit-module parser.
 */
 function collectBrowserGuardImports(program) {
-	return collectNamedImportAliases(program, "$app/environment", BROWSER_GUARD_NAMES);
+	return /* @__PURE__ */ new Set([...collectNamedImportAliases(program, "$app/environment", BROWSER_GUARD_NAMES), ...collectNamedImportAliases(program, "$app/env", BROWSER_GUARD_NAMES)]);
 }
 /**
 * Names bound at the program's top level: every import's local name plus every
@@ -3490,10 +3862,12 @@ function guardTerminates(consequent) {
 /**
 * Whether a guard-clause test establishes a browser environment: it references the
 * `$app/environment` `browser` binding, or contains a
-* `typeof <tracked-global> === | !== 'undefined'` comparison (correctness/server-browser-global, correctness/instance-browser-global).
+* `typeof <tracked-global>` comparison against any type string (`'undefined'`, `'function'`, …)
+* (correctness/server-browser-global, correctness/instance-browser-global).
 * Over-matching here only widens the skip — a conservative miss, never a false positive.
 */
 function isBrowserGuardTest(test, guardBindings) {
+	if (test?.type === "LogicalExpression" && test.operator !== "&&") return isBrowserGuardTest(test.left, guardBindings) && isBrowserGuardTest(test.right, guardBindings);
 	let guarded = false;
 	walkEstree(test, (n) => {
 		if (n.type === "Identifier" && guardBindings.has(n.name)) guarded = true;
@@ -3505,8 +3879,9 @@ function isBrowserGuardTest(test, guardBindings) {
 		].includes(n.operator)) {
 			const sides = [n.left, n.right];
 			const hasTypeofGlobal = sides.some((s) => s?.type === "UnaryExpression" && s.operator === "typeof" && s.argument?.type === "Identifier" && BROWSER_GLOBALS.has(s.argument.name));
-			const hasUndefinedString = sides.some((s) => s?.type === "Literal" && s.value === "undefined");
-			if (hasTypeofGlobal && hasUndefinedString) guarded = true;
+			const type = sides.find((s) => s?.type === "Literal" && typeof s.value === "string")?.value;
+			const positive = n.operator === "===" || n.operator === "==";
+			if (hasTypeofGlobal && type !== void 0 && (type === "undefined" || positive)) guarded = true;
 		}
 	});
 	return guarded;
@@ -3564,7 +3939,7 @@ function collectBrowserGlobalRefs(program, source, extra) {
 		if (typeof n !== "object" || typeof n.type !== "string") return;
 		if (EVAL_SCOPE_BOUNDARIES.has(n.type)) return;
 		if ((n.type === "IfStatement" || n.type === "ConditionalExpression") && isBrowserGuardTest(n.test, guards)) return;
-		if (n.type === "LogicalExpression" && isBrowserGuardTest(n.left, guards)) return;
+		if (n.type === "LogicalExpression" && (n.operator === "&&" ? isBrowserGuardTest(n.left, guards) : n.left?.type === "UnaryExpression" && n.left.operator === "!" && isBrowserGuardTest(n.left.argument, guards))) return;
 		const introduced = scopeIntroducedNames(n);
 		const scope = introduced.size > 0 ? /* @__PURE__ */ new Set([...shadowed, ...introduced]) : shadowed;
 		switch (n.type) {
@@ -3776,6 +4151,16 @@ function findFalseOptOut(program, source, name) {
 	});
 	return hit;
 }
+/** Whether the module exports a binding named `name` in any form, re-exports and unresolved aliases included. */
+function exportsName(program, name) {
+	return (program.body ?? []).some((stmt) => {
+		if (stmt?.type !== "ExportNamedDeclaration" || stmt.exportKind === "type") return false;
+		const decl = stmt.declaration;
+		if (decl?.type === "VariableDeclaration") return decl.declarations?.some((d) => d?.id?.name === name);
+		if (decl) return decl.id?.name === name;
+		return (stmt.specifiers ?? []).some((s) => s?.exportKind !== "type" && (s?.exported?.name ?? s?.exported?.value) === name);
+	});
+}
 /**
 * The exported `load` function node (inline `export function load` / `export const
 * load = …`, `satisfies`/`as` unwrapped) or a same-file alias export. Cross-file
@@ -3805,7 +4190,15 @@ function collectAwaits(node, out = []) {
 	}
 	return out;
 }
+const MUTATING_METHODS = /* @__PURE__ */ new Set([
+	"push",
+	"unshift",
+	"splice",
+	"add",
+	"set"
+]);
 const REDIRECT_NAMES = /* @__PURE__ */ new Set(["redirect"]);
+const EXIT_NAMES = /* @__PURE__ */ new Set(["redirect", "error"]);
 /**
 * Root-relative `redirect(status, '/…')` targets (correctness/base-path-navigation). Argument 1
 * is the location (argument 0 is the status). Only a plain string literal counts, which
@@ -3825,6 +4218,74 @@ function collectRedirectCalls(node, locals, out = []) {
 	}
 	return out;
 }
+/** Whether `node` holds a `return` outside nested functions. */
+function containsReturn(node) {
+	if (Array.isArray(node)) return node.some(containsReturn);
+	if (!node || typeof node !== "object" || typeof node.type !== "string" || isFunctionNode(node)) return false;
+	if (node.type === "ReturnStatement") return true;
+	return Object.keys(node).some((key) => !WALK_IGNORED_KEYS.has(key) && containsReturn(node[key]));
+}
+/**
+* Whether the exported `load` redirects or errors on every call: every path through its body reaches a
+* `redirect(…)` / `error(…)` (thrown or not) before any `return` — through both arms of an `if`/`else`,
+* through a `try` whose `catch` redirects or rethrows, and through a call to a top-level function
+* of the same file that itself always redirects. A redirect under an `if` without an `else`, in a
+* loop, or in a function declared inside `load` does not count.
+*/
+function loadNeverRenders(program, locals) {
+	const load = locals.size > 0 ? findLoadFunction(program) : void 0;
+	if (!load?.body) return false;
+	const topLevel = collectTopLevelBindings(program);
+	const fnRedirects = (fn, seen, observed) => {
+		const shadow = /* @__PURE__ */ new Set();
+		for (const p of fn.params ?? []) addBoundNames(p, shadow);
+		const frame = {
+			seen: /* @__PURE__ */ new Set([...seen, fn]),
+			observed
+		};
+		return fn.body?.type === "BlockStatement" ? always(fn.body.body, shadow, void 0, frame) : isRedirect(fn.body, shadow, frame, observed);
+	};
+	const isRedirect = (expr, shadow, frame, returned = false) => {
+		let e = unwrapTs(expr);
+		const awaited = e?.type === "AwaitExpression";
+		if (awaited) e = unwrapTs(e.argument);
+		if (e?.type !== "CallExpression" || e.callee?.type !== "Identifier" || shadow.has(e.callee.name)) return false;
+		if (locals.has(e.callee.name)) return true;
+		const fn = topLevel.get(e.callee.name);
+		if (!isFunctionNode(fn) || fn.generator || frame.seen.has(fn) || fn.async && !awaited && !returned) return false;
+		return fnRedirects(fn, frame.seen, awaited || returned);
+	};
+	const within = (body, outer, param) => {
+		const own = /* @__PURE__ */ new Set();
+		addBoundNames(param, own);
+		for (const stmt of body ?? []) if (stmt?.type === "VariableDeclaration") for (const d of stmt.declarations ?? []) addBoundNames(d?.id, own);
+		else if ((stmt?.type === "FunctionDeclaration" || stmt?.type === "ClassDeclaration") && stmt.id) addBoundNames(stmt.id, own);
+		return own.size === 0 ? outer : /* @__PURE__ */ new Set([...outer, ...own]);
+	};
+	const redirects = (stmt, shadow, rethrow, frame) => {
+		if (stmt?.type === "ExpressionStatement") return isRedirect(stmt.expression, shadow, frame);
+		if (stmt?.type === "ThrowStatement" || stmt?.type === "ReturnStatement") {
+			if (isRedirect(stmt.argument, shadow, frame, stmt.type === "ReturnStatement" && frame.observed)) return true;
+			return stmt.type === "ThrowStatement" && stmt.argument?.type === "Identifier" && stmt.argument.name === rethrow;
+		}
+		if (stmt?.type === "BlockStatement") return always(stmt.body, shadow, rethrow, frame);
+		if (stmt?.type === "IfStatement") return !!stmt.alternate && redirects(stmt.consequent, shadow, rethrow, frame) && redirects(stmt.alternate, shadow, rethrow, frame);
+		if (stmt?.type === "TryStatement") {
+			const param = stmt.handler?.param?.type === "Identifier" ? stmt.handler.param.name : void 0;
+			return always(stmt.block?.body, shadow, void 0, frame) && (!stmt.handler || always(stmt.handler.body?.body, within([], shadow, stmt.handler.param), param, frame)) && !containsReturn(stmt.finalizer);
+		}
+		return false;
+	};
+	const always = (body, outer, rethrow, frame) => {
+		const shadow = within(body, outer);
+		for (const stmt of body ?? []) {
+			if (redirects(stmt, shadow, rethrow, frame)) return true;
+			if (containsReturn(stmt)) return false;
+		}
+		return false;
+	};
+	return fnRedirects(load, /* @__PURE__ */ new Set(), true);
+}
 /**
 * Whether `await`'s argument is a `parent()` / `<x>.parent()` call (Kit's parent-load
 * step, exempt from performance/load-waterfall and performance/sequential-awaits). Any `<expr>.parent()` member call matches — over-broad
@@ -3857,6 +4318,26 @@ function isBodyParseCall(arg) {
 	const callee = e.callee;
 	return callee?.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && BODY_METHODS.has(callee.property.name);
 }
+const WORK_STARTING = /* @__PURE__ */ new Set([
+	"CallExpression",
+	"NewExpression",
+	"ImportExpression",
+	"TaggedTemplateExpression"
+]);
+/** Whether an await argument starts work (a call, tagged template, `new`, or `import()`), as opposed to awaiting an existing promise. */
+function startsWork(arg) {
+	let e = unwrapTs(arg);
+	if (e?.type === "ChainExpression") e = e.expression;
+	return WORK_STARTING.has(e?.type);
+}
+/** Whether evaluating `node` may start work: a work-starting expression anywhere outside a nested function. */
+function containsWork(node) {
+	if (Array.isArray(node)) return node.some(containsWork);
+	if (!node || typeof node !== "object" || typeof node.type !== "string") return false;
+	if (isFunctionNode(node)) return false;
+	if (WORK_STARTING.has(node.type)) return true;
+	return Object.keys(node).some((key) => !WALK_IGNORED_KEYS.has(key) && containsWork(node[key]));
+}
 /**
 * Whether the expression references any tainted name. Threads nested-function
 * shadowing (`scopeIntroducedNames`) so a callback parameter that shadows a
@@ -3889,15 +4370,36 @@ function refsTainted(node, tainted) {
 	return hit;
 }
 /**
+* Awaits that only run when a tainted value says so — `a ?? await x`, `t ? await x : y` — and so
+* cannot start before the earlier await that decides them.
+*/
+function guardedAwaits(node, tainted, out = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(node)) {
+		for (const child of node) guardedAwaits(child, tainted, out);
+		return out;
+	}
+	if (!node || typeof node !== "object" || typeof node.type !== "string" || isFunctionNode(node)) return out;
+	if (node.type === "LogicalExpression" && refsTainted(node.left, tainted)) for (const a of collectAwaits(node.right)) out.add(a);
+	else if (node.type === "ConditionalExpression" && refsTainted(node.test, tainted)) for (const a of collectAwaits([node.consequent, node.alternate])) out.add(a);
+	for (const key of Object.keys(node)) {
+		if (WALK_IGNORED_KEYS.has(key)) continue;
+		guardedAwaits(node[key], tainted, out);
+	}
+	return out;
+}
+/**
 * performance/load-waterfall, performance/sequential-awaits — forward-taint analysis of the exported `load`'s straight-line
 * statements (direct `try` blocks inlined; `if`/loops/`switch` are not classified
 * but still propagate taint from their assignments; nested functions are never
 * entered). One await site per statement; a site whose awaits' argument subtrees
 * reference an earlier site's bindings (transitively, through intermediate consts
-* and assignments — member-expression targets taint their root object) is
-* dependent, anchored at the first dependent await; otherwise independent when a
-* prior site exists, unless every await merely resumes an already-created promise
-* (a bare identifier argument starts no request). `await parent()` and
+* and assignments — member-expression targets taint their root object), or that a
+* tainted `??`/`&&`/`||`/`?:` guard decides (`guardedAwaits`), is
+* dependent, anchored at the first dependent await — unless it starts no work and its
+* promise came straight from an await result (`await deferred.state` after
+* `await parent()`); otherwise independent when a prior site exists, unless every
+* await merely resumes an already-created promise (a bare identifier argument starts
+* no request). `await parent()` and
 * response-body reads are never sites, but their bindings taint. Lines are
 * returned in ORIGINAL-source coordinates (the −1 wrap shift is applied here).
 */
@@ -3911,12 +4413,27 @@ function collectLoadWaterfalls(program, wrapped) {
 	};
 	const line = (start) => Math.max(0, lineOf(wrapped, start) - 1);
 	const tainted = /* @__PURE__ */ new Set();
+	const syncTainted = /* @__PURE__ */ new Set();
 	let sawAwaitSite = false;
-	const taintAssignTarget = (left) => {
-		if (left?.type === "MemberExpression") {
-			const root = rootObjectName(left);
-			if (root) tainted.add(root);
-		} else addBoundNames(left, tainted);
+	const taintTarget = (target, rhs) => {
+		const awaited = collectAwaits(rhs).length > 0;
+		if (!awaited && !refsTainted(rhs, tainted)) return;
+		const names = /* @__PURE__ */ new Set();
+		if (target?.type === "MemberExpression") {
+			const root = rootObjectName(target);
+			if (root) names.add(root);
+		} else addBoundNames(target, names);
+		for (const name of names) {
+			tainted.add(name);
+			if (!awaited && (containsWork(rhs) || refsTainted(rhs, syncTainted))) syncTainted.add(name);
+		}
+	};
+	const taintMutation = (call) => {
+		const callee = unwrapTs(call?.callee);
+		if (call?.type !== "CallExpression" || callee?.type !== "MemberExpression" || callee.computed) return;
+		if (!MUTATING_METHODS.has(callee.property?.name) || !(call.arguments ?? []).some((a) => refsTainted(a, tainted))) return;
+		const root = rootObjectName(callee);
+		if (root) tainted.add(root);
 	};
 	const taintOnly = (node) => {
 		if (Array.isArray(node)) {
@@ -3925,10 +4442,14 @@ function collectLoadWaterfalls(program, wrapped) {
 		}
 		if (!node || typeof node !== "object" || typeof node.type !== "string") return;
 		if (isFunctionNode(node)) return;
-		if (node.type === "AssignmentExpression") {
-			if (collectAwaits(node.right).length > 0 || refsTainted(node.right, tainted)) taintAssignTarget(node.left);
+		if (node.type === "AssignmentExpression") taintTarget(node.left, node.right);
+		else if (node.type === "CallExpression") taintMutation(node);
+		else if ((node.type === "ForOfStatement" || node.type === "ForInStatement") && refsTainted(node.right, tainted)) {
+			const names = /* @__PURE__ */ new Set();
+			addBoundNames(node.left?.type === "VariableDeclaration" ? node.left.declarations?.[0]?.id : node.left, names);
+			for (const name of names) tainted.add(name);
 		} else if (node.type === "VariableDeclaration") {
-			for (const d of node.declarations ?? []) if (d?.id && d.init && (collectAwaits(d.init).length > 0 || refsTainted(d.init, tainted))) addBoundNames(d.id, tainted);
+			for (const d of node.declarations ?? []) if (d?.id && d.init) taintTarget(d.id, d.init);
 		}
 		for (const key of Object.keys(node)) {
 			if (WALK_IGNORED_KEYS.has(key)) continue;
@@ -3947,12 +4468,13 @@ function collectLoadWaterfalls(program, wrapped) {
 			if (stmt.type === "VariableDeclaration" || stmt.type === "ExpressionStatement" || stmt.type === "ReturnStatement") {
 				const sites = collectAwaits(stmt).filter((a) => !isParentCall(a.argument) && !isBodyParseCall(a.argument));
 				if (sites.length > 0) {
-					const dependent = sites.filter((a) => refsTainted(a.argument, tainted));
+					const guarded = guardedAwaits(stmt, tainted);
+					const dependent = sites.filter((a) => (guarded.has(a) || refsTainted(a.argument, tainted)) && (startsWork(a.argument) || refsTainted(a.argument, syncTainted)));
 					if (dependent.length > 0) {
 						const anchor = dependent.reduce((m, a) => a.start < m.start ? a : m);
 						dependentLines.push(line(anchor.start));
 					} else if (sawAwaitSite) {
-						const workSites = sites.filter((a) => unwrapTs(a.argument)?.type !== "Identifier");
+						const workSites = sites.filter((a) => startsWork(a.argument));
 						if (workSites.length > 0) {
 							const anchor = workSites.reduce((m, a) => a.start < m.start ? a : m);
 							independentLines.push(line(anchor.start));
@@ -3960,15 +4482,12 @@ function collectLoadWaterfalls(program, wrapped) {
 					}
 					sawAwaitSite = true;
 				}
-				if (stmt.type === "VariableDeclaration") for (const d of stmt.declarations ?? []) {
-					if (!d?.id || !d.init) continue;
-					if (collectAwaits(d.init).length > 0 || refsTainted(d.init, tainted)) addBoundNames(d.id, tainted);
-				}
-				else if (stmt.type === "ExpressionStatement") {
+				if (stmt.type === "VariableDeclaration") {
+					for (const d of stmt.declarations ?? []) if (d?.id && d.init) taintTarget(d.id, d.init);
+				} else if (stmt.type === "ExpressionStatement") {
 					const expr = unwrapTs(stmt.expression);
-					if (expr?.type === "AssignmentExpression") {
-						if (collectAwaits(expr.right).length > 0 || refsTainted(expr.right, tainted)) taintAssignTarget(expr.left);
-					}
+					if (expr?.type === "AssignmentExpression") taintTarget(expr.left, expr.right);
+					else taintMutation(expr);
 				}
 			} else taintOnly(stmt);
 		}
@@ -4005,23 +4524,19 @@ function walkKit(node, handlerFns, startupFns, visit, shadowed = /* @__PURE__ */
 	}
 }
 /**
-* Normalize a posix path, resolving `.` and `..` segments — string-only, no I/O.
-* Returns undefined when a `..` segment pops an empty stack, i.e. the path escapes
-* its root (e.g. `../../../../src/lib/server/db` from a shallow route file): the
-* real target lies outside the project tree we can see, so there is no
-* project-relative path to return at all.
+* Normalize a posix path, resolving `.` and `..` segments — string-only, no I/O. `..` segments
+* that climb above the root are kept as a leading `../` run (`../../plugins/x`).
 */
 function normalizePosix(path) {
 	const out = [];
 	for (const seg of path.split("/")) {
 		if (seg === "" || seg === ".") continue;
-		if (seg === "..") {
-			if (out.length === 0) return void 0;
-			out.pop();
-		} else out.push(seg);
+		if (seg === ".." && out.length > 0 && out[out.length - 1] !== "..") out.pop();
+		else out.push(seg);
 	}
 	return out.join("/");
 }
+const escapesRoot = (path) => path === ".." || path.startsWith("../");
 /**
 * What `resolveRepoLocalPath` assumes when no config was read: SvelteKit's own `$lib`, at the
 * default `src/lib`. This single entry is the whole of this analyzer's pre-alias behaviour.
@@ -4048,8 +4563,12 @@ function aliasMatches(entry, spec) {
 * be a project-local module: the caller's `aliases` list decides which non-relative
 * specifiers resolve, defaulting to `$lib` → `src/lib`; `./`/`../` resolve against the
 * importing file's directory; bare packages and other aliases are skipped (they can't
-* be resolved to a project-local path at all). Also undefined when a relative
-* specifier's `..` segments escape the project root (see `normalizePosix`), or when a
+* be resolved to a project-local path at all). A path above the project root (a leading `../`
+* run) resolves only inside a directory a `kit.alias` value itself names above the root
+* (`$plugins: '../../plugins'` in a monorepo app): the user's config says the app builds from
+* there, so it is read like `src/` — likewise inside a workspace package's directory an entry
+* names as its `root` — and anywhere else above the root is undefined, as nothing says the app
+* reaches it. Also undefined when a
 * matched alias's value is itself absolute (e.g. `/opt/shared/src`, or a posixified Windows
 * drive-letter path like `C:/shared/src`): an absolute target is outside the analyzed project by
 * definition, and without this check `normalizePosix` would quietly drop the leading empty
@@ -4058,7 +4577,7 @@ function aliasMatches(entry, spec) {
 * Exported from the package's public barrel because `architecture/private-scope-import`
 * and `architecture/route-component-import` (inside `packages/core`) both need resolution
 * that is not restricted to runes modules, unlike `resolveRunesModuleSpecifier` — and
-* because `resolveComponentPath` (`packages/cli/src/providers/source/resolve.ts`), which
+* because component resolution (`packages/cli/src/providers/source/resolve.ts`), which
 * drives transitive `<head>`/heading resolution, delegates its alias/`$lib`/relative
 * mapping here too, rather than duplicating it. This is the single site for every
 * repo-local specifier resolution in the repo.
@@ -4070,9 +4589,15 @@ function resolveRepoLocalPath(spec, importerFile, aliases = DEFAULT_KIT_ALIASES)
 		const entry = aliases.find((a) => aliasMatches(a, spec));
 		if (entry?.replacement == null) return void 0;
 		if (entry.replacement.startsWith("/") || /^[A-Za-z]:\//.test(entry.replacement)) return void 0;
-		path = entry.replacement + spec.slice(entry.find.length);
+		path = entry.replacement + spec.slice(entry.find.length) + (entry.suffix ?? "");
 	}
-	return normalizePosix(path);
+	const normalized = normalizePosix(path);
+	if (!escapesRoot(normalized)) return normalized;
+	return aliases.some((a) => {
+		const named = a.root ?? a.replacement;
+		const dir = named === null ? "" : normalizePosix(named);
+		return escapesRoot(dir) && (normalized === dir || normalized.startsWith(`${dir}/`));
+	}) ? normalized : void 0;
 }
 /**
 * Resolve an import specifier to a repo-relative `.svelte.ts`/`.svelte.js` path, or
@@ -4080,7 +4605,7 @@ function resolveRepoLocalPath(spec, importerFile, aliases = DEFAULT_KIT_ALIASES)
 * `aliases` (defaulting to `$lib` → `src/lib` when omitted), so a project's declared
 * `kit.alias`/`kit.files.lib` resolve here exactly as they do at rule time; `./`/`../`
 * resolve against the importing file's directory; bare packages, unmatched aliases, and
-* a relative specifier whose `..` segments escape the repo root are skipped. An
+* a path above the project root outside every `kit.alias` directory are skipped. An
 * extensionless `…/x.svelte` specifier canonicalises to `….svelte.ts` (security/shared-state-import also
 * tries the `.js` sibling when matching).
 */
@@ -4115,8 +4640,8 @@ function libServerRoot(aliases) {
 * an equivalent relative path, resolving to exactly that directory — importing the
 * index file rather than a named submodule) is exempt too. A specifier that
 * resolves to undefined — a bare package, an alias that can't map to a repo path, or
-* a relative specifier whose `..` segments escape the repo root (see
-* `normalizePosix`) — is conservatively NOT local state: we can't see that file, so
+* a relative specifier whose `..` segments escape the project root (outside every
+* `kit.alias` directory, see `resolveRepoLocalPath`) — is conservatively NOT local state: we can't see that file, so
 * we don't flag writes to it. Installed packages (drizzle, redis, @vercel/kv, …) are
 * excluded: `.set()`/`.update()` on those is persistence, not shared-module-state
 * mutation. When the `$lib` entry is opaque (`libServerRoot` returns undefined — an unreadable
@@ -4147,15 +4672,25 @@ const IN_MEMORY_CTORS = /* @__PURE__ */ new Set([
 	"WeakMap",
 	"WeakSet"
 ]);
-/** Whether an initializer positively identifies an in-memory container. */
+/**
+* Whether an initializer positively identifies an in-memory container. An object literal with a
+* spread is a composite of values this parse cannot see — typically a facade over clients and
+* imported modules (`{ ...prismaModels, ...handlers }`) — so it counts only when one of its own
+* properties is itself a container.
+*/
 function isInMemoryInit(init) {
 	if (!init) return false;
-	if (init.type === "ObjectExpression" || init.type === "ArrayExpression") return true;
+	if (init.type === "ArrayExpression") return true;
+	if (init.type === "ObjectExpression") {
+		const props = init.properties ?? [];
+		if (!props.some((p) => p?.type === "SpreadElement")) return true;
+		return props.some((p) => p?.type === "Property" && isInMemoryInit(p.value));
+	}
 	return init.type === "NewExpression" && init.callee?.type === "Identifier" && IN_MEMORY_CTORS.has(init.callee.name);
 }
 /**
 * The exported bindings of a module that are initialized to an in-memory container — an object
-* or array literal, or `new Map`/`Set`/`WeakMap`/`WeakSet`. Used to arbitrate a `.set()` call on
+* or array literal (a spread literal only as `isInMemoryInit` allows), or `new Map`/`Set`/`WeakMap`/`WeakSet`. Used to arbitrate a `.set()` call on
 * an import from under the `$lib` server root, where the call shape alone cannot separate a
 * hand-rolled store from a database client.
 *
@@ -4204,6 +4739,7 @@ function parseKitModuleFacts(source, filename, aliases) {
 	const line = (start) => Math.max(0, lineOf(wrapped, start) - 1);
 	const importedSpecifiers = /* @__PURE__ */ new Map();
 	const importedNames = /* @__PURE__ */ new Map();
+	const namespaceImports = /* @__PURE__ */ new Set();
 	for (const stmt of program.body ?? []) {
 		if (stmt?.type !== "ImportDeclaration" || stmt.importKind === "type") continue;
 		const spec = typeof stmt.source?.value === "string" ? stmt.source.value : "";
@@ -4212,6 +4748,7 @@ function parseKitModuleFacts(source, filename, aliases) {
 			if (s?.importKind === "type" || s?.local?.type !== "Identifier") continue;
 			names.push(s.local.name);
 			importedSpecifiers.set(s.local.name, spec);
+			if (s.type === "ImportNamespaceSpecifier") namespaceImports.add(s.local.name);
 			importedNames.set(s.local.name, s.type === "ImportSpecifier" && s.imported?.type === "Identifier" ? s.imported.name : s.local.name);
 		}
 		if (names.length === 0) continue;
@@ -4309,7 +4846,8 @@ function parseKitModuleFacts(source, filename, aliases) {
 			};
 		} else if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
 			const method = n.callee.property?.type === "Identifier" ? n.callee.property.name : void 0;
-			if (method === "set" || method === "update") {
+			const nsFunction = n.callee.object?.type === "Identifier" && namespaceImports.has(n.callee.object.name);
+			if ((method === "set" || method === "update") && !nsFunction) {
 				const r = importedRoot(n.callee.object);
 				const spec = r ? importedSpecifiers.get(r) : void 0;
 				if (r && spec !== void 0) {
@@ -4387,7 +4925,9 @@ function parseKitModuleFacts(source, filename, aliases) {
 		browserGlobalRefs: byLine(browserGlobalRefs),
 		basePathLinks: byLine(basePathLinks),
 		...ssrOptOut ? { ssrDisabled: { line: Math.max(0, ssrOptOut.line - 1) } } : {},
+		...!ssrOptOut && exportsName(program, "ssr") ? { ssrEnabled: true } : {},
 		...csrOptOut ? { csrDisabled: { line: Math.max(0, csrOptOut.line - 1) } } : {},
+		...loadNeverRenders(program, collectNamedImportAliases(program, "@sveltejs/kit", EXIT_NAMES)) ? { loadNeverRenders: true } : {},
 		...waterfalls.dependentLines.length > 0 || waterfalls.independentLines.length > 0 ? { loadWaterfalls: waterfalls } : {},
 		suppressions
 	};
@@ -5609,8 +6149,8 @@ function isRouteEntry(path) {
 /** The route entries this component imports, with the line each import sits on. */
 function routeEntryImports(c, ctx) {
 	const out = [];
-	for (const { source, line, type } of c.importSpans ?? []) {
-		if (type) continue;
+	for (const { source, line, type, named } of c.importSpans ?? []) {
+		if (type || named) continue;
 		const target = resolveRepoLocalPath(source, c.file, ctx.project.kitAliases);
 		if (target !== void 0 && isRouteEntry(target)) out.push({
 			line,
@@ -5956,223 +6496,6 @@ const performanceIframeLoading = componentRule({
 	}))
 });
 //#endregion
-//#region src/rules/a11y/aria-data.ts
-/**
-* ARIA names `aria-query@5.3.2` does not carry. It is not the clean ARIA 1.2 snapshot it looks
-* like — it holds 1.2's 48 attributes plus three 1.3 additions — so the gap is patched by name
-* rather than by version. Every entry here is defined in the ARIA 1.3 editor's draft, which is
-* what makes reporting it as an unknown name wrong — how far implementations have got is a
-* separate question this rule does not ask. Re-check this list whenever the aria-query dependency
-* moves.
-*/
-const ARIA_1_3_ROLES = /* @__PURE__ */ new Set([
-	"comment",
-	"image",
-	"sectionheader",
-	"sectionfooter",
-	"suggestion"
-]);
-const ARIA_1_3_ATTRIBUTES = /* @__PURE__ */ new Set(["aria-colindextext", "aria-rowindextext"]);
-/**
-* Roles whose `requiredProps` row in aria-query is stale. Neither ARIA 1.2 nor the 1.3 editor's
-* draft lists required states or properties for these — the 1.3 draft re-lists inherited
-* requirements where they apply (`menuitemradio` → `aria-checked`), so the absence is deliberate
-* rather than an inheritance the table left implicit. Without this, idiomatic APG listbox and
-* tree markup is flagged.
-*/
-const NO_REQUIRED_PROPS = /* @__PURE__ */ new Set(["option", "treeitem"]);
-function isKnownRole(role) {
-	return ARIA_1_3_ROLES.has(role) || roles.has(role);
-}
-function isAbstractRole(role) {
-	return roles.get(role)?.abstract === true;
-}
-/** A concrete (non-abstract) role is the one a user agent resolves a role token list to. */
-function isConcreteRole(role) {
-	return isKnownRole(role) && !isAbstractRole(role);
-}
-/**
-* The role a user agent applies: the first token naming a concrete role, or undefined when none
-* does. Shared so the role rules cannot disagree about what a fallback list means.
-*/
-function resolveRole(tokens) {
-	return tokens.find(isConcreteRole);
-}
-function isKnownAriaAttribute(name) {
-	return ARIA_1_3_ATTRIBUTES.has(name) || aria.has(name);
-}
-function requiredAriaProps(role) {
-	if (NO_REQUIRED_PROPS.has(role)) return [];
-	const def = roles.get(role);
-	return def ? Object.keys(def.requiredProps) : [];
-}
-function ariaValueKind(name) {
-	const def = aria.get(name);
-	if (!def) return void 0;
-	return {
-		type: def.type,
-		...def.values ? { values: def.values.map(String) } : {}
-	};
-}
-//#endregion
-//#region src/a11y.ts
-/**
-* Branch-aware occurrence fold (design "Control-flow semantics"): within a branch
-* occurrences sum, across the arms of one exclusive block the arm with the most
-* occurrences wins (tie → lowest branch index) and ITS occurrences are the group's
-* representatives — so a caller's count is always `list.length`, with a location per
-* representative. `{#each}`/`{#snippet}` occurrences render 0..N times and drop out.
-* The max is per key: there is no scalar total to maximize.
-*/
-function foldOccurrences(nodes) {
-	const byKey = /* @__PURE__ */ new Map();
-	for (const node of nodes) {
-		if (node.repeatable) continue;
-		const list = byKey.get(node.key);
-		if (list) list.push(node);
-		else byKey.set(node.key, [node]);
-	}
-	const folded = /* @__PURE__ */ new Map();
-	for (const [key, list] of byKey) folded.set(key, foldAt(list, 0));
-	return folded;
-}
-function foldAt(nodes, depth) {
-	const unconditional = [];
-	const groups = /* @__PURE__ */ new Map();
-	for (const node of nodes) {
-		const step = node.path[depth];
-		if (!step) {
-			unconditional.push(node);
-			continue;
-		}
-		let branches = groups.get(step.group);
-		if (!branches) groups.set(step.group, branches = /* @__PURE__ */ new Map());
-		const list = branches.get(step.branch);
-		if (list) list.push(node);
-		else branches.set(step.branch, [node]);
-	}
-	const representatives = [...unconditional];
-	for (const branches of groups.values()) {
-		let best = [];
-		let bestBranch = Number.POSITIVE_INFINITY;
-		for (const [branch, list] of branches) {
-			const arm = foldAt(list, depth + 1);
-			if (arm.length > best.length || arm.length === best.length && branch < bestBranch) {
-				best = arm;
-				bestBranch = branch;
-			}
-		}
-		representatives.push(...best);
-	}
-	return representatives;
-}
-/**
-* Decode a fragment identifier the way navigation does before matching an element id
-* (`href="#caf%C3%A9"` targets `id="café"`). Malformed escapes are kept verbatim —
-* the browser would also fail to decode them, so the raw text is the comparable form.
-*/
-function decodeFragmentId(fragment) {
-	try {
-		return decodeURIComponent(fragment);
-	} catch {
-		return fragment;
-	}
-}
-/** Whitespace-split tokens of a (possibly undefined) literal attribute value. */
-function splitTokens(value) {
-	return value ? value.trim().split(/\s+/).filter(Boolean) : [];
-}
-/** Explicit `role` values that map to the landmark kinds the route rules inspect. */
-const LANDMARK_ROLES = /* @__PURE__ */ new Set([
-	"main",
-	"banner",
-	"contentinfo",
-	"complementary"
-]);
-/** Sectioning content (HTML-AAM): a `<header>`/`<footer>` below one of these is not a landmark. */
-const SECTIONING_TAGS = /* @__PURE__ */ new Set([
-	"article",
-	"aside",
-	"main",
-	"nav",
-	"section"
-]);
-/**
-* Tags whose landmark-ness depends on sectioning ancestry. A provider that cannot see ancestry
-* (the per-file AST walk) uses this same set to mark the deferral (topLevel) — reading it from
-* here keeps the deferral set from drifting when the policy widens.
-*/
-const ANCESTRY_DEPENDENT_TAGS = /* @__PURE__ */ new Set(["header", "footer"]);
-/** Attributes that give an element the accessible name the `<aside>` landmark decision reads. */
-const NAMING_ATTRS$1 = ["aria-label", "aria-labelledby"];
-/**
-* HTML-AAM: an `<aside>` scoped to `body` or `main` is a `complementary` landmark; scoped to
-* sectioning content it is one only when it has an accessible name. `main` is deliberately absent
-* — it is a scope in which an `aside` *is* a landmark, unlike the sectioning set that decides
-* `<header>`/`<footer>`.
-*/
-const ASIDE_DEMOTING_TAGS = /* @__PURE__ */ new Set([
-	"article",
-	"aside",
-	"nav",
-	"section"
-]);
-/**
-* The landmark kind an element contributes ('main'|'banner'|'contentinfo'|'complementary'), or
-* undefined. The one home for the decision both providers apply — the source AST walk and the
-* rendered HTML walk each feed it their own tree's context. ARIA fallback role lists resolve to
-* the first token naming a concrete role (resolveRole).
-*/
-function resolveLandmark(input) {
-	const { tag, roleTokens, named, insideSectioning, insideAsideDemoting } = input;
-	if (roleTokens !== void 0) {
-		const role = resolveRole(roleTokens);
-		return role && LANDMARK_ROLES.has(role) ? role : void 0;
-	}
-	if (tag === "main") return "main";
-	if (tag !== void 0 && ANCESTRY_DEPENDENT_TAGS.has(tag)) return insideSectioning ? void 0 : tag === "header" ? "banner" : "contentinfo";
-	if (tag === "aside") return !insideAsideDemoting || named ? "complementary" : void 0;
-}
-/**
-* Attributes whose (whitespace-tokenized) values reference element ids: the ARIA id-reference and
-* id-reference-list properties, and HTML's own (`for`, `list`, `headers`, `form`, the popover and
-* command targets). `href="#…"` is handled separately — its value is a URL, not a token list.
-*/
-const IDREF_ATTRS = [
-	"for",
-	"list",
-	"headers",
-	"form",
-	"popovertarget",
-	"commandfor",
-	"aria-labelledby",
-	"aria-describedby",
-	"aria-controls",
-	"aria-activedescendant",
-	"aria-owns",
-	"aria-details",
-	"aria-errormessage",
-	"aria-flowto"
-];
-/**
-* Whether a decoded URL fragment is HTML's "top of the document" indicator: `#top` (ASCII
-* case-insensitive) scrolls to the top when no element has that id, so it is never a missing
-* reference. Compare AFTER percent-decoding — `#%74op` navigates identically to `#top`.
-*/
-function isTopFragment(id) {
-	return id.toLowerCase() === "top";
-}
-/**
-* A fragment with its text directive removed. Everything from the first `:~:` on is user-agent
-* instructions for finding text and names no element, while anything before it is still an
-* ordinary element fragment — `#section:~:text=hi` targets `id="section"`, `#:~:text=hi` targets
-* nothing. Returns an empty string when the fragment is a directive and nothing else.
-*/
-function stripTextDirective(fragment) {
-	const i = fragment.indexOf(":~:");
-	return i === -1 ? fragment : fragment.slice(0, i);
-}
-//#endregion
 //#region src/rules/a11y/invalid-role.ts
 const a11yInvalidRole = componentRule({
 	id: "a11y/invalid-role",
@@ -6872,7 +7195,7 @@ const ELEMENT_FACT_OVERRIDES = {
 };
 /**
 * The role(s) an `AriaElementFact` may have. Explicit first: a literal role's first concrete token
-* (`resolveRole`); an expression role, or a spread with no literal role, makes the role unknowable
+* (`resolveRole`); an expression role, or a spread or `use:` action with no literal role, makes the role unknowable
 * and yields `undefined`. Otherwise the element's implicit role — never one role but the set of
 * candidates the dataset's conditional outcomes leave open, since the selectors that decide between
 * them are not evaluated (design 2026-08-19-aria-role-table-rules, "Which role an element has").
@@ -6887,7 +7210,7 @@ function roleCandidates(e) {
 			namingProhibited: false
 		} : void 0;
 	}
-	if (e.hasSpread) return void 0;
+	if (e.hasSpread || e.hasAction) return void 0;
 	const el = Object.hasOwn(HTML_SPEC.elements, e.tag) ? HTML_SPEC.elements[e.tag] : void 0;
 	if (!el) return void 0;
 	const aria = (Object.hasOwn(ELEMENT_FACT_OVERRIDES, e.tag) ? ELEMENT_FACT_OVERRIDES[e.tag] : void 0) ?? el.aria;
@@ -7454,7 +7777,12 @@ function surplusRule(spec) {
 					first ??= reps[0];
 					for (let i = 1; i < reps.length; i++) {
 						surplus = true;
-						out.push(result(route.route, PENALIZED$1, reps[i], spec.message(key, i, reps.length, reps[0])));
+						const finding = result(route.route, PENALIZED$1, reps[i], spec.message(key, i, reps.length, reps[0]));
+						const recommendation = spec.recommendationFor?.(reps[i], reps[0]);
+						out.push(recommendation ? {
+							...finding,
+							recommendation
+						} : finding);
 					}
 				}
 				if (first && !surplus) out.push(result(route.route, PASS, {
@@ -7632,6 +7960,7 @@ const a11yIdDuplication = surplusRule({
 	recommendation: "Every id in a route should be unique.",
 	map: (route) => Object.entries(route.ids).sort(([, a], [, b]) => a[0].file.localeCompare(b[0].file) || a[0].line - b[0].line),
 	message: (id, _i, _n, first) => first.file === "src/app.html" ? `Duplicate id "${id}" — also defined by the src/app.html shell (line ${first.line})` : `Duplicate id "${id}"`,
+	recommendationFor: (rep, first) => first.file === "src/app.html" || first.line === 0 ? void 0 : rep.file === first.file && rep.line === first.line ? "This id is hardcoded in a component rendered more than once on this route. Generate it per instance with $props.id() (Svelte 5.20+): `const uid = $props.id();`, then `id=\"{uid}-name\"`." : "Rename one of them. Separate {#if} blocks are treated as able to render together; if these never render at the same time, make them branches of one {#if}…{:else}.",
 	passMessage: "No duplicate ids"
 });
 //#endregion
@@ -8299,4 +8628,4 @@ function formatMarkdownReport(results, config, meta) {
 	return lines.join("\n");
 }
 //#endregion
-export { SECTIONING_TAGS as $, formatFailedRuleWarning as $n, valueFromNodes as $t, a11yAbbrTitle as A, seoDescriptionLength as An, collectDerivedGuardBindings as At, a11yUseList as B, seoOgUrl as Bn, unwrapTs as Bt, a11yDisallowedElement as C, seoHeadingLevelSkip as Cn, summarize as Cr, parseKitModuleFacts as Ct, a11yDeprecatedElement as D, seoHreflang as Dn, defaultConfig as Dr, addBoundNames as Dt, a11yDeprecatedAttr as E, seoSingleH1 as En, CATEGORIES as Er, WALK_IGNORED_KEYS as Et, isInteractiveContainer as F, seoJsonLdRelativeUrl as Fn, matchLifecycleCall as Ft, a11yInvalidAriaValue as G, isPlainObject as Gn, attrText as Gt, a11yAccessibleName as H, seoTwitterCard as Hn, walkEvalScope as Ht, isInteractiveElement as I, seoJsonLdDeprecatedType as In, parseModuleProgram as It, a11yInvalidRole as J, validateRuleSetting as Jn, attrValueOf as Jt, a11yRequiredAriaProps as K, resolveRuleOptions as Kn, attrTextOf as Kt, literalTabindexValue as L, seoJsonLdValidity as Ln, rootObjectName as Lt, a11yNoAutofocus as M, seoJsonLdRequiredProps as Mn, collectProgramBindings as Mt, a11yNoAccesskey as N, seoJsonLdPlaceholder as Nn, collectSuppressions as Nt, HTML_SPEC as O, seoImageAlt as On, defaultProject as Or, collectBrowserGlobalRefs as Ot, a11yPositiveTabindex as P, seoJsonLdDateFormat as Pn, collectSvelteLifecycleImports as Pt, NAMING_ATTRS$1 as Q, compileOverrides as Qn, textFromNodes as Qt, a11yRequireDatetime as R, seoSitemapInRobots as Rn, scopeIntroducedNames as Rt, a11yPermittedContents as S, seoSsrDisabled as Sn, hasFailureAtOrAbove as Sr, parseInMemoryExports as St, a11yDisallowedAriaProps as T, seoDuplicateTitle as Tn, isPenalized as Tr, isRootRelativePath as Tt, a11yAriaHiddenFocus as U, seoIndexability as Un, walkScoped as Ut, a11yLabelHasControl as V, seoOgDescription as Vn, walkEstree as Vt, a11yInteractiveNesting as W, performancePreconnect as Wn, CHILD_NODE_KEYS as Wt, ASIDE_DEMOTING_TAGS as X, applyOverrides as Xn, lineOf as Xt, ANCESTRY_DEPENDENT_TAGS as Y, SEARCH_RESULT_RULES as Yn, findAttr as Yt, IDREF_ATTRS as Z, applyRuleSeverities as Zn, parseSvelte as Zt, a11yIdDuplication as _, correctnessUnmutatedState as _n, seoCanonicalUrl as _r, architectureReservedDirectoryNames as _t, formatJsonReport as a, securityJavascriptUrl as an, performanceLcpImage as ar, stripTextDirective as at, a11yDoctype as b, correctnessEachIndexKey as bn, classify as br, architecturePrivateScopeImport as bt, formatGithubReport as c, correctnessServerBrowserGlobal as cn, performanceResponsiveImage as cr, performanceStateRaw as ct, ruleMetaById as d, correctnessOrphanEffect as dn, seoHtmlLang as dr, performanceMinifyDisabled as dt, architecturePropCount as en, selectRules as er, decodeFragmentId as et, severityToSarifLevel as f, correctnessAutoplayMuted as fn, seoSitemapXml as fr, performanceNamespaceImport as ft, a11yNoMissingIdRef as g, correctnessPropMutation as gn, seoOgImage as gr, architectureReservedNamePlacement as gt, a11yUnverifiedIdRef as h, correctnessStalePropDerivation as hn, seoOgTitle as hr, architectureRouteComponentImport as ht, buildJsonReport as i, securityHandlerStateWrite as in, performanceRenderBlockingScript as ir, splitTokens as it, a11yNoDuplicateDt as j, seoTitleLength as jn, collectNamedImportAliases as jt, a11yPatternTitle as k, seoCharset as kn, defineConfig as kr, collectBrowserGuardImports as kt, SEVERITY_RANK as l, correctnessBasePathNavigation as ln, performanceImageLoadingHint as lr, performanceSequentialAwaits as lt, explainRule as m, correctnessNonreactiveBuiltinState as mn, seoJsonLd as mr, architectureDocLinkTarget as mt, mdEscape as n, securitySharedStateImport as nn, withFailedRulesOff as nr, isTopFragment as nt, computeHealth as o, securityRawHtml as on, performanceFontPreloadCrossorigin as or, resolveRole as ot, allRules as p, correctnessCheckableBindValue as pn, seoRobotsTxt as pr, performanceHeavyImport as pt, a11yUnknownAriaAttribute as q, shouldSkipRangeCheck as qn, attrValue as qt, terminalSafe as r, securityServerModuleState as rn, withIndexableOff as rr, resolveLandmark as rt, computeScore as s, correctnessInstanceBrowserGlobal as sn, performancePreloadMissingAs as sr, performanceIframeLoading as st, formatMarkdownReport as t, architectureComponentSize as tn, settingSeverity as tr, foldOccurrences as tt, messageText as u, correctnessOrphanLifecycle as un, performanceImageDimensions as ur, performanceLoadWaterfall as ut, a11yTopLevelLandmark as v, correctnessEffectAsOnMount as vn, seoDescriptionPresence as vr, architectureDirectoryNaming as vt, a11yDeprecatedAria as w, seoDuplicateDescription as wn, docsUrlFor as wr, resolveRepoLocalPath as wt, a11yRequiredElement as x, correctnessEachKey as xn, effectiveSeverity as xr, collectTopLevelBindings as xt, a11yDuplicateLandmark as y, correctnessEffectAsDerived as yn, seoTitlePresence as yr, architectureUnitEntryFile as yt, a11yPlaceholderLabelOption as z, seoViewport as zn, unwrapExport as zt };
+export { performanceMinifyDisabled as $, applyRuleSeverities as $n, correctnessOrphanLifecycle as $t, a11yAbbrTitle as A, seoImageAlt as An, defaultProject as Ar, walkEstree as At, a11yUseList as B, seoSitemapInRobots as Bn, parseSvelte as Bt, a11yDisallowedElement as C, foldOccurrences as Cn, effectiveSeverity as Cr, collectSvelteLifecycleImports as Ct, a11yDeprecatedElement as D, stripTextDirective as Dn, isPenalized as Dr, scopeIntroducedNames as Dt, a11yDeprecatedAttr as E, splitTokens as En, docsUrlFor as Er, rootObjectName as Et, isInteractiveContainer as F, seoJsonLdPlaceholder as Fn, attrTextOf as Ft, a11yInvalidAriaValue as G, seoIndexability as Gn, securitySharedStateImport as Gt, a11yAccessibleName as H, seoOgUrl as Hn, valueFromNodes as Ht, isInteractiveElement as I, seoJsonLdDateFormat as In, attrValue as It, a11yInvalidRole as J, resolveRuleOptions as Jn, securityJavascriptUrl as Jt, a11yRequiredAriaProps as K, performancePreconnect as Kn, securityServerModuleState as Kt, literalTabindexValue as L, seoJsonLdRelativeUrl as Ln, attrValueOf as Lt, a11yNoAutofocus as M, seoDescriptionLength as Mn, walkScoped as Mt, a11yNoAccesskey as N, seoTitleLength as Nn, CHILD_NODE_KEYS as Nt, HTML_SPEC as O, resolveRole as On, CATEGORIES as Or, unwrapExport as Ot, a11yPositiveTabindex as P, seoJsonLdRequiredProps as Pn, attrText as Pt, performanceLoadWaterfall as Q, applyOverrides as Qn, correctnessBasePathNavigation as Qt, a11yRequireDatetime as R, seoJsonLdDeprecatedType as Rn, findAttr as Rt, a11yPermittedContents as S, decodeFragmentId as Sn, classify as Sr, collectSuppressions as St, a11yDisallowedAriaProps as T, resolveLandmark as Tn, summarize as Tr, parseModuleProgram as Tt, a11yAriaHiddenFocus as U, seoOgDescription as Un, architecturePropCount as Ut, a11yLabelHasControl as V, seoViewport as Vn, textFromNodes as Vt, a11yInteractiveNesting as W, seoTwitterCard as Wn, architectureComponentSize as Wt, performanceStateRaw as X, validateRuleSetting as Xn, correctnessInstanceBrowserGlobal as Xt, performanceIframeLoading as Y, shouldSkipRangeCheck as Yn, securityRawHtml as Yt, performanceSequentialAwaits as Z, SEARCH_RESULT_RULES as Zn, correctnessServerBrowserGlobal as Zt, a11yIdDuplication as _, ANCESTRY_DEPENDENT_TAGS as _n, seoOgTitle as _r, collectBrowserGlobalRefs as _t, formatJsonReport as a, correctnessPropMutation as an, withIndexableOff as ar, architectureReservedDirectoryNames as at, a11yDoctype as b, NAMING_ATTRS$1 as bn, seoDescriptionPresence as br, collectNamedImportAliases as bt, formatGithubReport as c, correctnessEffectAsDerived as cn, performanceFontPreloadCrossorigin as cr, architecturePrivateScopeImport as ct, ruleMetaById as d, seoSsrDisabled as dn, performanceImageLoadingHint as dr, parseInMemoryExports as dt, correctnessOrphanEffect as en, compileOverrides as er, performanceNamespaceImport as et, severityToSarifLevel as f, routeNeverSsr as fn, performanceImageDimensions as fr, parseKitModuleFacts as ft, a11yNoMissingIdRef as g, seoSingleH1 as gn, seoJsonLd as gr, addBoundNames as gt, a11yUnverifiedIdRef as h, seoDuplicateTitle as hn, seoRobotsTxt as hr, WALK_IGNORED_KEYS as ht, buildJsonReport as i, correctnessStalePropDerivation as in, withFailedRulesOff as ir, architectureReservedNamePlacement as it, a11yNoDuplicateDt as j, seoCharset as jn, defineConfig as jr, walkEvalScope as jt, a11yPatternTitle as k, seoHreflang as kn, defaultConfig as kr, unwrapTs as kt, SEVERITY_RANK as l, correctnessEachIndexKey as ln, performancePreloadMissingAs as lr, DEFAULT_KIT_ALIASES as lt, explainRule as m, seoDuplicateDescription as mn, seoSitemapXml as mr, isRootRelativePath as mt, mdEscape as n, correctnessCheckableBindValue as nn, selectRules as nr, architectureDocLinkTarget as nt, computeHealth as o, correctnessUnmutatedState as on, performanceRenderBlockingScript as or, architectureDirectoryNaming as ot, allRules as p, seoHeadingLevelSkip as pn, seoHtmlLang as pr, resolveRepoLocalPath as pt, a11yUnknownAriaAttribute as q, isPlainObject as qn, securityHandlerStateWrite as qt, terminalSafe as r, correctnessNonreactiveBuiltinState as rn, settingSeverity as rr, architectureRouteComponentImport as rt, computeScore as s, correctnessEffectAsOnMount as sn, performanceLcpImage as sr, architectureUnitEntryFile as st, formatMarkdownReport as t, correctnessAutoplayMuted as tn, formatFailedRuleWarning as tr, performanceHeavyImport as tt, messageText as u, correctnessEachKey as un, performanceResponsiveImage as ur, collectTopLevelBindings as ut, a11yTopLevelLandmark as v, ASIDE_DEMOTING_TAGS as vn, seoOgImage as vr, collectBrowserGuardImports as vt, a11yDeprecatedAria as w, isTopFragment as wn, hasFailureAtOrAbove as wr, matchLifecycleCall as wt, a11yRequiredElement as x, SECTIONING_TAGS as xn, seoTitlePresence as xr, collectProgramBindings as xt, a11yDuplicateLandmark as y, IDREF_ATTRS as yn, seoCanonicalUrl as yr, collectDerivedGuardBindings as yt, a11yPlaceholderLabelOption as z, seoJsonLdValidity as zn, lineOf as zt };