class Analyzer::Javascript::Sveltekit

• Analyzer::Javascript::Sveltekit
• Analyzer::Javascript::JavascriptEngine
• Analyzer
• Reference
• Object

Overview

SvelteKit is a filesystem-routed framework. Routes live under src/routes/ and the URL is derived from the directory layout:

src/routes/+page.svelte → GET / src/routes/about/+page.svelte → GET /about src/routes/users/[id]/+page.svelte → GET /users/{id} src/routes/users/+server.ts → exports drive verbs src/routes/[...slug]/+page.svelte → GET /{slug} src/routes/(group)/foo/+page.svelte → GET /foo (group hidden)

Two file kinds matter:

• +page.svelte (and the .svx / .md variants) — HTML pages, always GET. +page.server.{js,ts} siblings don't add a separate route — they're load functions for the same URL.
• +server.{js,ts,mjs} — API endpoints. Each named verb export (export async function GET, export const POST = ...) registers a route. Falls back to GET / POST / PUT / DELETE / PATCH when no explicit verb is found, mirroring the Astro / Next.js heuristic.

Out of scope for this first cut: per-handler request-helper scanning (SvelteKit endpoints take { request, params, cookies, url } — accurate read tracking needs cross-call value flow), rest parameters with matchers ([id=integer]), and (group)-with-+layout.server.ts cookie-protected endpoints (the route still fires; auth tagging is the tagger's job).

Defined in:

Constant Summary

API_EXTENSIONS = [".ts", ".js", ".mjs"]

EXTENSIONS = PAGE_EXTENSIONS + API_EXTENSIONS

FALLBACK_API_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"]

HTTP_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]

PAGE_EXTENSIONS = [".svelte", ".svx", ".md"]

Instance Method Summary

• #analyze

Instance Method Detail