class

Analyzer::Javascript::Sveltekit

Inherits Analyzer::Javascript::JavascriptEngine < Analyzer < FileHelper < Reference < Object

SvelteKit is a filesystem-routed framework. Routes live under src/routes/ and the URL is derived from the directory layout:

src/routes/+page.svelte → GET / src/routes/about/+page.svelte → GET /about src/routes/users/[id]/+page.svelte → GET /users/{id} src/routes/users/+server.ts → exports drive verbs src/routes/[...slug]/+page.svelte → GET /{slug} src/routes/(group)/foo/+page.svelte → GET /foo (group hidden)

Two file kinds matter:

  • +page.svelte (and the .svx / .md variants) — HTML pages, always GET. +page.server.{js,ts} siblings don't add a separate route — they're load functions for the same URL.
  • +server.{js,ts,mjs} — API endpoints. Each named verb export (export async function GET, export const POST = ...) registers a route. Falls back to GET / POST / PUT / DELETE / PATCH when no explicit verb is found, mirroring the Astro / Next.js heuristic.

Out of scope for this first cut: per-handler request-helper scanning (SvelteKit endpoints take { request, params, cookies, url } — accurate read tracking needs cross-call value flow), rest parameters with matchers ([id=integer]), and (group)-with-+layout.server.ts cookie-protected endpoints (the route still fires; auth tagging is the tagger's job).

Constants

API_EXTENSIONS = [".ts", ".js", ".mjs"]
EXPORT_BRACE_RES = HTTP_METHODS.map do |m| {m, /export\s+\{\s*[^}]*\b#{m}\b[^}]*\}/} end.to_h
EXPORT_CONST_RES = HTTP_METHODS.map do |m| {m, /export\s+(?:const|let|var)\s+#{m}\b\s*(?::[^=]+)?=/} end.to_h
EXPORT_FUNCTION_RES = HTTP_METHODS.map do |m| {m, /export\s+(?:async\s+)?function\s+#{m}\b/} end.to_h

Compiled once per verb — interpolated regex literals would otherwise be rebuilt (full PCRE2 compile) for every method on every file.

EXTENSIONS = PAGE_EXTENSIONS + API_EXTENSIONS
FALLBACK_API_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"]
FORM_ACTIONS_DECL_RE = /export\s+(?:const|let|var|(?:async\s+)?function)\s+actions\b/
HTTP_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]
PAGE_EXTENSIONS = [".svelte", ".svx", ".md"]
PARAM_GROUP_RE = /\[+(?:\.{3})?(\w+)(?:=\w+)?\]+/

SvelteKit param group inside a route segment. Replaced in place so one segment can hold static text around it (foo-[id], @[user]) and so every form normalizes to {name}: [id] [id=int] [...rest] [[opt]] [[opt=int]] [[...rest]]

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source