class Analyzer::Javascript::Sveltekit

• Analyzer::Javascript::Sveltekit
• Analyzer::Javascript::JavascriptEngine
• Analyzer
• Reference
• Object

Overview

SvelteKit is a filesystem-routed framework. Routes live under src/routes/ and the URL is derived from the directory layout:

src/routes/+page.svelte → GET / src/routes/about/+page.svelte → GET /about src/routes/users/[id]/+page.svelte → GET /users/{id} src/routes/users/+server.ts → exports drive verbs src/routes/[...slug]/+page.svelte → GET /{slug} src/routes/(group)/foo/+page.svelte → GET /foo (group hidden)

Two file kinds matter:

• +page.svelte (and the .svx / .md variants) — HTML pages, always GET. +page.server.{js,ts} siblings don't add a separate route — they're load functions for the same URL.
• +server.{js,ts,mjs} — API endpoints. Each named verb export (export async function GET, export const POST = ...) registers a route. Falls back to GET / POST / PUT / DELETE / PATCH when no explicit verb is found, mirroring the Astro / Next.js heuristic.

Out of scope for this first cut: per-handler request-helper scanning (SvelteKit endpoints take { request, params, cookies, url } — accurate read tracking needs cross-call value flow), rest parameters with matchers ([id=integer]), and (group)-with-+layout.server.ts cookie-protected endpoints (the route still fires; auth tagging is the tagger's job).

Defined in:

Constant Summary

API_EXTENSIONS = [".ts", ".js", ".mjs"]

EXPORT_BRACE_RES = HTTP_METHODS.map do |m| {m, /export\s+\{\s*[^}]*\b#{m}\b[^}]*\}/} end.to_h

EXPORT_CONST_RES = HTTP_METHODS.map do |m| {m, /export\s+(?:const|let|var)\s+#{m}\b\s*(?::[^=]+)?=/} end.to_h

EXPORT_FUNCTION_RES = HTTP_METHODS.map do |m| {m, /export\s+(?:async\s+)?function\s+#{m}\b/} end.to_h

Compiled once per verb — interpolated regex literals would otherwise be rebuilt (full PCRE2 compile) for every method on every file.

EXTENSIONS = PAGE_EXTENSIONS + API_EXTENSIONS

FALLBACK_API_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"]

FORM_ACTIONS_DECL_RE = /export\s+(?:const|let|var|(?:async\s+)?function)\s+actions\b/

HTTP_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]

PAGE_EXTENSIONS = [".svelte", ".svx", ".md"]

PARAM_GROUP_RE = /\[+(?:\.{3})?(\w+)(?:=\w+)?\]+/

SvelteKit param group inside a route segment. Replaced in place so one segment can hold static text around it (foo-[id], @[user]) and so every form normalizes to {name}: [id] [id=int] [...rest] [[opt]] [[opt=int]] [[...rest]]

Instance Method Summary

• #analyze

Instance Method Detail