@appthreat/atom-parsetools 1.5.0 → 1.7.0

package/README.md

@@ -1,12 +1,16 @@
-# Introduction
+# atom-parsetools
 
 This package hosts a collection of parsing tools that complement the `@appthreat/atom` project. These tools offer parsing and analysis-related functionalities such as generating AST and semantics information in JSON format. The full list of tools and bin commands exposed by this package is below:
 
-- astgen - Generates AST for JavaScript and TypeScript projects in JSON format
+- astgen - Generates AST for JavaScript, TypeScript, Vue and Svelte projects in JSON format
 - phpastgen - Generates AST for PHP projects using `php-parse` command from `nikic/php-parser`
 - rbastgen - Generates AST for Ruby projects using AppThreat's [`ruby_ast_gen`](https://github.com/AppThreat/ruby_ast_gen) gem (2.0.1)
 - scalasem - Generates a custom semantics slice for Scala Projects by utilising scalac command.
 
+## Documentation
+
+The full documentation lives at [https://appthreat.github.io/atom-parsetools/](https://appthreat.github.io/atom-parsetools/): per-tool guides, the output format specification, environment variable reference, packaging notes, and ten hands-on tutorials. The pages are rendered from the [`docs`](docs/) directory of this repository.
+
 ## Runtime support
 
 These tools run on both [Node.js](https://nodejs.org) (>= 22, required by `@babel/parser` 8) and [Bun](https://bun.sh). All commands and the accompanying regression test-suite are exercised under both runtimes in CI, so the commands below can be invoked with either `node` or `bun` interchangeably (for example `bun astgen.js -i .`).
@@ -29,52 +33,37 @@ Options:
   -h             Show help                                             [boolean]
 ```
 
-#### Environment variables
+Each source file becomes an AST JSON document plus a `.typemap` of inferred types keyed by node offsets. Test files and `node_modules` are excluded by default; the [astgen guide](docs/ASTGEN.md) covers every option and env variable (`ASTGEN_TYPE_WORKERS`, `ASTGEN_INCLUDE_TEST_FILES`, and friends).
 
-| Variable                              | Default   | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| ------------------------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ASTGEN_TYPE_WORKERS`                 | `1` (off) | Number of worker threads for the TypeScript type-generation phase, or `auto` to derive it from the available CPUs. The TypeScript checker is single-threaded, so parallelism comes from sharding files across workers, each building its own program. **Opt-in:** sharding changes TypeScript's internal type-id ordering, which reorders the members of a small number of inferred union types (e.g. `A \| B` → `B \| A`; semantically identical). Leave unset for byte-identical output; set it (e.g. `auto` or `8`) to trade that cosmetic reordering for a large speedup on big projects. |
-| `ASTGEN_INCLUDE_TEST_FILES`           | `false`   | When `true`, do not exclude test files (`*.poku.js`, `*.test.*`, `*.spec.*`, `*.e2e.*`, `__tests__/`, `__mocks__/`) from AST and type generation. They are excluded by default because they are typically the heaviest, lowest-value inputs for type generation.                                                                                                                                                                                                                                                                                                                              |
-| `ASTGEN_CONCURRENCY`                  | `10`      | Chunk size for the in-thread file loop (bounds peak memory between `gc()` passes).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `ASTGEN_INCLUDE_NODE_MODULES_BUNDLES` | `false`   | When `true`, also parse bundled entrypoints inside `node_modules` (files matching `*.(bundle\|dist\|index\|min\|app).(js\|cjs\|mjs)`). Off by default; `node_modules` is otherwise skipped entirely.                                                                                                                                                                                                                                                                                                                                                                                          |
-| `ASTGEN_IGNORE_DIRS`                  | unset     | Comma/space-separated list of directories to ignore. As a side effect, when it is set and does **not** contain `node_modules`, the `node_modules` bundle entrypoints above are included (equivalent to `ASTGEN_INCLUDE_NODE_MODULES_BUNDLES=true`).                                                                                                                                                                                                                                                                                                                                           |
+`.vue` and `.svelte` single-file components are flattened into the same Babel shape as any other file: script statements at the top level of the `Program`, and the template as standard JSX nodes. Svelte components are segmented with `svelte/compiler` and every offset is an absolute byte position into the component source, so consumers that slice the original file for `code` fields get the real text back. Control flow maps onto its JSX equivalent — `{#if}` to a `ConditionalExpression`, `{#each}` to `.map()` with an arrow closure, `{#await}` to `.then()` — which means no framework-specific node types are emitted. See the [astgen guide](docs/ASTGEN.md) for the full mapping and the list of accepted losses.
 
 ### phpastgen
 
 ```text
 node phpastgen.js --help
 
-Usage: phpastgen [operations] file1.php [file2.php ...]
-   or: phpastgen [operations] "<?php code"
-Turn PHP source code into an abstract syntax tree.
-
-Operations is a list of the following options (--dump by default):
-
-    -d, --dump              Dump nodes using NodeDumper
-    -p, --pretty-print      Pretty print file using PrettyPrinter\Standard
-    -j, --json-dump         Print json_encode() result
-        --var-dump          var_dump() nodes (for exact structure)
-    -N, --resolve-names     Resolve names using NodeVisitor\NameResolver
-    -c, --with-column-info  Show column numbers for errors (if available)
-    -P, --with-positions    Show positions in node dumps
-    -r, --with-recovery     Use parsing with error recovery
-    -h, --help              Display this page
+Usage: phpastgen [options] [-- <legacy php-parse args>]
 
+Options:
+  -i, --input <path>          input file or directory (batch mode)
+  -o, --output <dir>          output directory (default: '.ast')
+  -e, --exclude <regex>       exclusion regex (default: '^(tests?|vendor|Tests?)')
+  -l, --log <level>           debug | info | warn | error (default: info)
+  -d, --debug                 same as --log debug
+      --target-version <x.y>  pin PHP grammar (alias: --parser-target)
+      --max-depth <n>         depth cap before truncation (default: 250)
+      --threads <n>           worker processes for directory runs (default: 10)
+      --fail-on-error         exit non-zero if any file failed
+      --parser-info           print parser/runtime capability report and exit 0
+      --version               print generator version and exit 0
+      --help                  print usage
 ```
 
-### rbastgen
+The PHP parser (nikic/php-parser 5.8.0, grammars 8.0 to 8.5) is vendored under `plugins/`, so only a PHP runtime on the machine is required. Batch runs write one JSON per file plus `phpastgen_manifest.jsonl` and, on failure, `phpastgen_diagnostics.jsonl`. Details in the [phpastgen guide](docs/PHPASTGEN.md).
 
-Requires Ruby 3.4.x or 4.0.x on the `PATH`, or `ATOM_RUBY_HOME` pointing at an install. The gem and
-its pure-Ruby dependencies are bundled under `plugins/rubyastgen`, so nothing needs to be
-gem-installed, and one build of this package runs under every supported Ruby: the bundle is exposed
-to the interpreter through `GEM_PATH` rather than through bundler's standalone loader, which
-resolved its paths from the ABI of the Ruby that built it.
+### rbastgen
 
-`prism` and `racc` are deliberately **not** bundled. Both carry C extensions, which are built per
-ABI and per platform, and both are default gems in every supported Ruby, so the runtime's own copies
-are used. One consequence is visible: the newest grammar available follows the interpreter's prism,
-so Ruby 3.4 tops out lower than Ruby 4.0 (grammar 3.5 versus 4.1 at the time of writing). Installing
-a newer `prism` gem on the machine raises it, since the caller's `GEM_PATH` is preserved.
+Requires Ruby 3.4.x or 4.0.x on the `PATH`, or `ATOM_RUBY_HOME` pointing at an install. The gem and its pure-Ruby dependencies are bundled under `plugins/rubyastgen`, so nothing needs to be gem-installed, and one build of this package runs under every supported Ruby: the bundle is exposed to the interpreter through `GEM_PATH` rather than through bundler's standalone loader, which resolved its paths from the ABI of the Ruby that built it.
 
 ```text
 node rbastgen.js --help
@@ -95,58 +84,7 @@ Usage:
       --help               Print usage
 ```
 
-Problems with individual files are reported and skipped, never fatal; only usage errors (a missing
-`-i`, an unusable `--exclude` regex, an invalid `--parser-target`) exit non-zero. Note that
-`rbastgen` does not propagate the generator's exit status, so `--fail-on-error` is reported in the
-log but the wrapper still exits 0 — call the gem directly if a CI job needs to fail on a parse
-error.
-
-#### What the bundled generator emits (ruby_ast_gen 2.0.1)
-
-- **Parsing is decoupled from the running Ruby.** When `prism` is available the newest grammar its
-  translation layer supports is used, so a 3.4 runtime parses Ruby 4.0/4.1 syntax. `--parser-target
-x.y` pins a grammar instead (down to 1.8 through the `parser` gem), and a file that fails under
-  the selected grammar is retried once with the newest one. Every JSON file records the backend
-  that produced it in `parser_backend`, alongside `generator_version` and `ruby_version`.
-- **Ruby DSL files are discovered, not just `.rb`.** `Rakefile`, `Gemfile`, `Capfile`,
-  `Vagrantfile`, `Fastfile` and friends are matched by basename, plus the `.gemspec`, `.rake`,
-  `.ru`, `.rbi`, `.thor`, `.jbuilder`, `.axlsx` and `.rabl` extensions. Vendor and tool
-  directories (`.git`, `.bundle`, `.venv`, …) are skipped.
-- **Non-UTF-8 sources survive.** `# coding:` magic comments are honoured and undecodable bytes are
-  scrubbed rather than dropping the file, marked with `encoding_scrubbed: true`.
-- **Deeply nested source is truncated, not dropped**, with `truncated: true` on the boundary node
-  and a `truncated_nodes` count at the top level (`--max-depth`).
-- **Semantic metadata for consumers**: a `magic_comments` array (Sorbet `typed:` levels,
-  `frozen_string_literal`, …), `call_operator`/`has_parentheses` on calls, `percent_array` and
-  regexp `options`, heredoc body offsets, and `has_sig: true` on a `def` preceded by a Sorbet `sig`
-  block.
-- **Two side-records per run, written inside the output directory**, both ending in `.jsonl` so a
-  consumer globbing `*.json` for ASTs never mistakes them for one:
-  `ruby_ast_gen_manifest.jsonl` (one object: input/output, backend, counts of parsed, failed,
-  skipped, excluded and truncated files, threads, max depth) and
-  `ruby_ast_gen_diagnostics.jsonl` (one object per failed file with message, line, column), the
-  latter written only when something failed and removed when a later run is clean.
-
-To check which backend a machine will use:
-
-```shell
-rbastgen --parser-info
-```
-
-`Parser gem` and `Prism gem` name the versions actually loaded — the vendored `parser` and the
-runtime's `prism` — so they are the quickest way to tell which copy of each library a machine is
-parsing with. They read `unavailable` only when a library genuinely is not loaded.
-
-#### Environment variables
-
-| Variable                          | Default                | Purpose                                                                                                                                      |
-| --------------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ATOM_RUBY_HOME`                  | unset                  | Ruby install directory to use when a suitable `ruby` is not on the `PATH`; its `bin` is prepended to `PATH` for the child process.           |
-| `RUBY_CMD`                        | `ruby`                 | Ruby interpreter to invoke. Set this (or `ATOM_RUBY_HOME`) when the detected version is not 3.4.x/4.0.x.                                     |
-| `RUBY_ASTGEN_BIN`                 | bundled `ruby_ast_gen` | The generator script to run. Point it at a checkout's `exe/ruby_ast_gen` to test an unreleased `ruby_ast_gen` without touching this package. |
-| `ATOM_CWD`                        | `process.cwd()`        | Working directory for the generator, which is what relative `-i`/`-o` paths resolve against.                                                 |
-| `ATOM_TIMEOUT` / `ASTGEN_TIMEOUT` | unset (no timeout)     | Milliseconds before the generator process is killed. `ATOM_TIMEOUT` wins; a non-numeric value is ignored. Also honoured by `scalasem`.       |
-| `GEM_PATH`                        | unset                  | Preserved and appended to the vendored bundle, so gems installed on the machine (a newer `prism`, for instance) stay reachable.              |
+Problems with individual files are reported and skipped, never fatal; only usage errors (a missing `-i`, an unusable `--exclude` regex, an invalid `--parser-target`) exit non-zero. Note that `rbastgen` does not propagate the generator's exit status, so `--fail-on-error` is reported in the log but the wrapper still exits 0; call the gem directly if a CI job needs to fail on a parse error. Discovery covers Ruby DSL files (`Gemfile`, `Rakefile`, `.gemspec`, `.rake`, and more), and each run writes `ruby_ast_gen_manifest.jsonl` and, on failure, `ruby_ast_gen_diagnostics.jsonl`. Details in the [rbastgen guide](docs/RBASTGEN.md).
 
 ### scalasem
 
@@ -160,29 +98,20 @@ Example:
 scalasem $(pwd) slices.json
 ```
 
+Compiles the project with sbt or mill if no `.tasty` files exist, then extracts literals, used types, and Play framework tags into a semantic slice. The [scalasem guide](docs/SCALASEM.md) covers the pipeline.
+
 ## Testing
 
-`npm test` covers the JavaScript/TypeScript side and needs nothing but Node. The Ruby workflow tests
-run the `rbastgen` command end to end against `test-fixtures/projects/ruby-parsing`, so they need a
-built plugin bundle and a supported Ruby, and they skip themselves cleanly when either is missing:
+`npm test` covers the JavaScript/TypeScript side and needs nothing but Node. The Ruby and PHP workflows need their runtimes and a built plugin bundle, and they skip themselves cleanly when either is missing:
 
 ```shell
 bash build.sh --ruby-only
 npm run test:ruby
 ```
 
-`ci/verify-packed-tarball.sh` is the release check: it packs the tarball, installs it into a scratch
-project and parses the fixture with the installed copy, asserting along the way that the Ruby bundle
-is present and free of compiled extensions. CI runs it, and it runs the same way locally.
-
-They assert what a consumer depends on rather than that the command ran: which files are discovered
-(including `Gemfile` and `Rakefile`, matched by basename), that `has_sig`, `magic_comments`,
-`percent_array` and regexp `options` are emitted, that the manifest's counts reconcile, that a
-failed file lands in the diagnostics record while the run still exits 0, that a clean run leaves no
-stale record behind, and that the bundle contains no compiled extension. CI runs them under both
-Ruby 3.4 and Ruby 4.0 against a bundle built with 3.4, and separately installs the packed tarball
-and parses with that, which is the check that catches a bundle usable only on the Ruby that built
-it.
+`ci/verify-packed-tarball.sh` is the release check: it packs the tarball, installs it into a scratch project and parses the fixture with the installed copy, asserting along the way that the Ruby bundle is present and free of compiled extensions. CI runs it, and it runs the same way locally.
+
+They assert what a consumer depends on rather than that the command ran: which files are discovered (including `Gemfile` and `Rakefile`, matched by basename), that `has_sig`, `magic_comments`, `percent_array` and regexp `options` are emitted, that the manifest's counts reconcile, that a failed file lands in the diagnostics record while the run still exits 0, that a clean run leaves no stale record behind, and that the bundle contains no compiled extension. CI runs them under both Ruby 3.4 and Ruby 4.0 against a bundle built with 3.4, and separately installs the packed tarball and parses with that, which is the check that catches a bundle usable only on the Ruby that built it. The [testing guide](docs/TESTING.md) maps the suites.
 
 ## License
 

package/astgen.js

@@ -24,12 +24,16 @@ import {
   rmSync
 } from "fs";
 import { getAllFiles } from "@appthreat/atom-common";
+import { parseSvelteFile, parseSvelteScriptBuffer } from "./svelteAst.js";
 
 // Printed by `astgen --version`. Downstream frontends (e.g. chen's jssrc2cpg)
 // fold this into their parse-cache fingerprint, so it MUST be bumped whenever
 // the emitted AST/type shape changes — otherwise stale cached parses from an
-// older astgen are silently reused. Bumped for the Babel 8 AST-shape change.
-const ASTGEN_VERSION = "4.1.0";
+// older astgen are silently reused. Bumped to 4.3.0 for Vue directive
+// expression values: `v-html="x"` / `:prop="x"` / `@event="x"` attribute
+// values in `.vue` templates now emit JSX expression containers (real
+// expression ASTs) instead of string literals.
+const ASTGEN_VERSION = "4.3.0";
 
 const HELP_TEXT = `Options:
   -i, --src      Source directory                                 [default: "."]
@@ -466,15 +470,42 @@ const getAllSrcJSAndTSFiles = (src) => {
  * Convert a single JS/TS file to AST
  */
 const fileToJsAst = (file, projectType, tsInstance) => {
-  if (file.endsWith(".vue") || file.endsWith(".svelte")) {
+  if (file.endsWith(".vue")) {
     return toVueAst(file, tsInstance);
   }
+  if (file.endsWith(".svelte")) {
+    return toSvelteAst(file);
+  }
   if (file.endsWith(".ejs")) {
     return toEjsAst(file);
   }
   return codeToJsAst(file, readFileSync(file, "utf-8"), projectType);
 };
 
+/**
+ * Convert a single Svelte file to AST. Svelte's own compiler segments the
+ * single-file component; the Babel options are built here and passed in, so
+ * every Svelte sub-parse shares the exact configuration used for regular
+ * JS/TS files. If `svelte/compiler` rejects the whole file (a genuinely
+ * broken template), the script blocks are still parsed over a
+ * position-preserving masked buffer - absolute offsets, so line numbers stay
+ * correct - and the failure is recorded on the emitted AST's `errors` array.
+ */
+const toSvelteAst = (file) => {
+  const code = readFileSync(file, "utf-8");
+  const options = makeBabelOptions(babelParserOptions, file);
+  try {
+    return parseSvelteFile(file, code, options);
+  } catch (err) {
+    console.error(
+      `Svelte parse failed for ${file}, falling back to script-only parsing:`,
+      err?.message
+    );
+    const { source: maskedSource } = createVirtualTypeSource(code);
+    return parseSvelteScriptBuffer(file, code, maskedSource, options, err?.message);
+  }
+};
+
 /**
  * Convert a single JS/TS code snippet to AST
  */
@@ -590,8 +621,168 @@ declare module "vue" {
 }
 `;
 
+// Ambient declarations for the Svelte 5 runes and the most common `svelte` /
+// `svelte/store` imports, so the TypeScript checker sees real declarations
+// when it type-checks a virtual `.svelte.ts` source. This is a pragmatic
+// starting set rather than a mirror of svelte's own types; grow it when a
+// fixture needs more.
+const SVELTE_RUNE_SHIMS = `
+declare function $state<T>(initial?: T): T;
+declare namespace $state { function raw<T>(initial?: T): T; function snapshot<T>(v: T): T; }
+declare function $derived<T>(expression: T): T;
+declare namespace $derived { function by<T>(fn: () => T): T; }
+declare function $effect(fn: () => void | (() => void)): void;
+declare namespace $effect {
+  function pre(fn: () => void | (() => void)): void;
+  function tracking(): boolean;
+  function root(fn: () => void | (() => void)): () => void;
+  function pending(): number;
+}
+declare function $props<T = any>(): T;
+declare namespace $props { function id(): string; }
+declare function $bindable<T>(fallback?: T): T;
+declare function $inspect<T extends any[]>(...values: T): { with: (fn: (...args: any[]) => void) => void };
+declare function $host<T = HTMLElement>(): T;
+
+declare module "svelte" {
+  export function onMount(fn: () => void | (() => void)): void;
+  export function onDestroy(fn: () => void): void;
+  export function tick(): Promise<void>;
+  export function untrack<T>(fn: () => T): T;
+  export function getContext<T>(key: any): T;
+  export function setContext<T>(key: any, value: T): T;
+  export function hasContext(key: any): boolean;
+  export function createEventDispatcher<T = any>(): (type: string, detail?: any) => void;
+  export function mount(component: any, options: any): any;
+  export function unmount(component: any): Promise<void>;
+  export type Component<P = any> = (...args: any[]) => any;
+  export type Snippet<P extends any[] = any[]> = (...args: P) => any;
+}
+declare module "svelte/store" {
+  export type Readable<T> = { subscribe(run: (value: T) => void): () => void };
+  export type Writable<T> = Readable<T> & { set(value: T): void; update(fn: (value: T) => T): void };
+  export function writable<T>(value?: T): Writable<T>;
+  export function readable<T>(value?: T): Readable<T>;
+  export function derived<T>(stores: any, fn: any, initial?: T): Readable<T>;
+  export function get<T>(store: Readable<T>): T;
+}
+`;
+
 const maskNonNewlineChars = (value) => value.replace(/[^\r\n]/g, " ");
 
+// Vue directive attributes - `v-html="expr"`, `:prop="expr"`, `@event="expr"`
+// - carry a JavaScript expression in a quoted string. Babel parses that value
+// as a StringLiteral, which severs the data flow from the script binding into
+// the template: `v-html="rawContent"` has no reference to the `rawContent`
+// binding, so no source-to-sink path can ever be found for the most
+// security-relevant Vue shape. Replacing the value's quotes with braces turns
+// it into a JSX expression container - `v-html={rawContent}` - which parses to
+// a real expression AST. The swap is length-preserving (`"x"` -> `{x}`), so
+// every offset in the emitted AST still maps onto the original file.
+//
+// Only values that parse as an expression are converted, and `v-for`/`v-slot`
+// directives are skipped by name before the parse is even attempted:
+// `v-for="item in items"` DOES parse (`in` is a relational operator), but the
+// resulting expression is meaningless for analysis and would synthesise a read
+// of the loop variable `item` that the script never declares - a spurious
+// reference. Those directives keep their string value.
+//
+// Scoped between the root `<template>` block's opening tag and the last
+// `</template>` that lies OUTSIDE any `<script>` block: a script string could
+// legitimately contain the literal text `</template>`, and rewriting inside
+// `<script>` would change script semantics while still parsing - a silent
+// corruption. That still narrows, not eliminates, the risk - a `</template>`
+// inside a template-side attribute value could in principle swallow markup up
+// to a later close - which is why the whole-file candidates remain as
+// fallbacks for any file the converted candidate fails to parse.
+const VUE_DIRECTIVE_ATTR_REGEX =
+  /(\sv-[\w.:-]+|\s[:@.][\w.:-]*)=("(?:[^"\\\r\n]|\\.)*"|'(?:[^'\\\r\n]|\\.)*')/g;
+const VUE_TEMPLATE_OPEN_REGEX = /<template\b[^>]*>/i;
+const VUE_TEMPLATE_CLOSE = "</template>";
+
+// `v-for` and `v-slot` (incl. `v-slot:name`) values are not plain expressions.
+const VUE_NON_EXPRESSION_DIRECTIVES = /^v-(for|slot)\b/i;
+
+const DIRECTIVE_VALUE_PARSE_OPTIONS = {
+  sourceType: "unambiguous",
+  allowImportExportEverywhere: true,
+  allowAwaitOutsideFunction: true,
+  allowReturnOutsideFunction: true,
+  allowSuperOutsideMethod: true,
+  allowUndeclaredExports: true,
+  errorRecovery: false,
+  plugins: babelSyntaxPlugins
+};
+
+// Ranges of the file covered by `<script ...>...</script>` blocks, so the
+// template-region search can ignore `</template>` text that only appears
+// inside a script string.
+const vueScriptRanges = (code) => {
+  const ranges = [];
+  let scriptMatch;
+  vueScriptTagRegex.lastIndex = 0;
+  while ((scriptMatch = vueScriptTagRegex.exec(code)) !== null) {
+    ranges.push([scriptMatch.index, scriptMatch.index + scriptMatch[0].length]);
+  }
+  return ranges;
+};
+
+const vueDirectiveValueToExpression = (code) => {
+  const templateOpen = code.match(VUE_TEMPLATE_OPEN_REGEX);
+  if (!templateOpen) {
+    return { code, changed: false };
+  }
+  const templateStart = templateOpen.index + templateOpen[0].length;
+  const scriptRanges = vueScriptRanges(code);
+  const inScript = (index) =>
+    scriptRanges.some(([start, end]) => index >= start && index < end);
+  let templateEnd = -1;
+  let searchFrom = templateStart;
+  let closeIndex;
+  while (
+    (closeIndex = code.toLowerCase().indexOf(VUE_TEMPLATE_CLOSE, searchFrom)) !==
+    -1
+  ) {
+    if (!inScript(closeIndex)) {
+      templateEnd = closeIndex;
+    }
+    searchFrom = closeIndex + 1;
+  }
+  if (templateEnd < templateStart) {
+    return { code, changed: false };
+  }
+
+  let changed = false;
+  const convert = (templateSlice) =>
+    templateSlice.replace(
+      VUE_DIRECTIVE_ATTR_REGEX,
+      (match, namePart, quoted) => {
+        if (VUE_NON_EXPRESSION_DIRECTIVES.test(namePart.trim())) {
+          return match;
+        }
+        const inner = quoted.slice(1, -1);
+        // An empty value, or a `{{` opening (Vue ignores interpolations in
+        // attribute values), is left alone.
+        if (!inner.trim() || inner.includes("{{")) {
+          return match;
+        }
+        try {
+          parse(`(${inner})`, DIRECTIVE_VALUE_PARSE_OPTIONS);
+        } catch {
+          return match;
+        }
+        changed = true;
+        return `${namePart}={${inner}}`;
+      }
+    );
+
+  const converted =
+    code.slice(0, templateStart) +
+    convert(code.slice(templateStart, templateEnd)) +
+    code.slice(templateEnd);
+  return { code: converted, changed };
+};
+
 const cleanVueCodeForParsing = (code, { includeScripts = true } = {}) => {
   let cleanedCode = code
     .replace(vueCommentRegex, (match) => maskNonNewlineChars(match))
@@ -653,7 +844,32 @@ const buildVueParseCandidates = (code) => {
     ? `${scriptOnlyCandidate}\n${templateOnlyCandidate}`
     : templateOnlyCandidate;
 
+  // Directive-expression candidates first: same masking, but `v-html="x"`
+  // style values are expression containers, so template expressions keep
+  // their references. The plain candidates below remain as fallbacks for the
+  // (checked-per-attribute, but defensive) case of a converted file not
+  // parsing as a whole.
+  const directiveCandidates = (() => {
+    const { code: directiveCode, changed } = vueDirectiveValueToExpression(
+      code
+    );
+    if (!changed) {
+      return [];
+    }
+    const directiveFull = cleanVueCodeForParsing(directiveCode, {
+      includeScripts: true
+    });
+    const directiveTemplateOnly = cleanVueCodeForParsing(directiveCode, {
+      includeScripts: false
+    });
+    return [
+      { name: "directive-full", code: directiveFull },
+      { name: "directive-template-only", code: directiveTemplateOnly }
+    ];
+  })();
+
   const candidates = [
+    ...directiveCandidates,
     { name: "full", code: fullCandidate },
     { name: "combined", code: combinedCandidate },
     { name: "template-only", code: templateOnlyCandidate },
@@ -686,7 +902,14 @@ const parseVueAstWithFallback = (file, code) => {
   throw lastError || new Error(`Unable to parse Vue file: ${file}`);
 };
 
-const createVueVirtualTypeSource = (code) => {
+/**
+ * Build the virtual type source for a single-file component (`.vue` or
+ * `.svelte`): the file masked to spaces/newlines with only the `<script>`
+ * contents left verbatim. Positions are preserved exactly, so type offsets
+ * map back onto the original file. Works for both frameworks because it is
+ * driven purely by the `<script>...</script>` regex.
+ */
+const createVirtualTypeSource = (code) => {
   const output = maskNonNewlineChars(code).split("");
   let hasScriptContent = false;
   let scriptMatch;
@@ -708,13 +931,22 @@ const createVueVirtualTypeSource = (code) => {
   };
 };
 
-const collectVueTypesWithVirtualProgram = (file, virtualSource) => {
-  const tempDir = mkdtempSync(join(tmpdir(), "atom-parsetools-vue-"));
+/**
+ * Type-check the virtual source with a throwaway program: the virtual file
+ * plus the framework's shim declarations, both under a temp directory.
+ */
+const collectTypesWithVirtualProgram = (
+  file,
+  virtualSource,
+  shimFileName,
+  shimSource
+) => {
+  const tempDir = mkdtempSync(join(tmpdir(), "atom-parsetools-sfc-"));
   const virtualFile = join(tempDir, `${basename(file)}.ts`);
-  const shimFile = join(tempDir, "vue-shims.d.ts");
+  const shimFile = join(tempDir, shimFileName);
   try {
     writeFileSync(virtualFile, virtualSource, "utf8");
-    writeFileSync(shimFile, VUE_COMPILER_MACRO_SHIMS, "utf8");
+    writeFileSync(shimFile, shimSource, "utf8");
     const virtualTs = createTsc([virtualFile, shimFile], tempDir);
     const sourceFile = virtualTs?.program?.getSourceFile(virtualFile);
     if (!virtualTs || !sourceFile) {
@@ -728,7 +960,24 @@ const collectVueTypesWithVirtualProgram = (file, virtualSource) => {
   }
 };
 
-const collectVueSeenTypes = (file, code, tsInstance) => {
+/**
+ * Collect types for a single-file component. The project program is tried
+ * first: a `.vue`/`.svelte` path is normally absent from it, but a tsconfig
+ * that maps the extension can make it resolvable, and that mapping is more
+ * accurate than the virtual source. Otherwise fall back to type-checking the
+ * position-preserving virtual source against the framework's shims.
+ *
+ * `.vue` and `.svelte` differ only in which shim declarations the checker
+ * needs, so both go through here rather than through near-identical copies
+ * that would drift apart.
+ */
+const collectSfcSeenTypes = (
+  file,
+  code,
+  tsInstance,
+  shimFileName,
+  shimSource
+) => {
   let seenTypes;
   if (tsInstance?.program) {
     try {
@@ -742,15 +991,38 @@ const collectVueSeenTypes = (file, code, tsInstance) => {
   }
 
   if (!seenTypes || seenTypes.size === 0) {
-    const virtualSource = createVueVirtualTypeSource(code);
+    const virtualSource = createVirtualTypeSource(code);
     if (virtualSource.hasScriptContent) {
-      seenTypes = collectVueTypesWithVirtualProgram(file, virtualSource.source);
+      seenTypes = collectTypesWithVirtualProgram(
+        file,
+        virtualSource.source,
+        shimFileName,
+        shimSource
+      );
     }
   }
 
   return seenTypes;
 };
 
+const collectVueSeenTypes = (file, code, tsInstance) =>
+  collectSfcSeenTypes(
+    file,
+    code,
+    tsInstance,
+    "vue-shims.d.ts",
+    VUE_COMPILER_MACRO_SHIMS
+  );
+
+const collectSvelteSeenTypes = (file, code, tsInstance) =>
+  collectSfcSeenTypes(
+    file,
+    code,
+    tsInstance,
+    "svelte-shims.d.ts",
+    SVELTE_RUNE_SHIMS
+  );
+
 const TSC_FLAGS =
   tsc.TypeFormatFlags.NoTruncation |
   tsc.TypeFormatFlags.InTypeAlias |
@@ -778,6 +1050,10 @@ const collectSeenTypesForFile = (file, ts, options) => {
     return collectVueSeenTypes(file, readFileSync(file, "utf-8"), ts);
   }
 
+  if (file.endsWith(".svelte")) {
+    return collectSvelteSeenTypes(file, readFileSync(file, "utf-8"), ts);
+  }
+
   if (!ts?.program) {
     return undefined;
   }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@appthreat/atom-parsetools",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Parsing tools that complement the @appthreat/atom project.",
   "main": "./index.js",
   "type": "module",
   "scripts": {
     "pretty": "prettier --write *.js --trailing-comma=none",
-    "test": "node test-fixtures/astgen-type-regression.js && node test-fixtures/astgen-json-regression.js && node test-fixtures/astgen-vue-regression.js && node test-fixtures/astgen-shape-snapshot.js && node test-fixtures/evaluate-astgen.js",
+    "test": "node test-fixtures/astgen-type-regression.js && node test-fixtures/astgen-json-regression.js && node test-fixtures/astgen-vue-regression.js && node test-fixtures/astgen-svelte-regression.js && node test-fixtures/astgen-shape-snapshot.js && node test-fixtures/evaluate-astgen.js",
     "test:evaluate": "node test-fixtures/evaluate-astgen.js",
     "test:ruby": "node test-fixtures/rbastgen-regression.js",
     "test:php": "node test-fixtures/phpastgen-cli.js && node test-fixtures/phpastgen-parser-info.js && node test-fixtures/phpastgen-discovery.js && node test-fixtures/phpastgen-provenance.js && node test-fixtures/phpastgen-framework-facts.js && node test-fixtures/phpastgen-legacy-regression.js && node test-fixtures/phpastgen-concurrency.js && node test-fixtures/phpastgen-regression.js && node test-fixtures/phpastgen-contract-snapshot.js && npm run test:php:pbt",
@@ -19,13 +19,15 @@
     "test:shape:update": "UPDATE_SHAPE_SNAPSHOT=1 node test-fixtures/astgen-shape-snapshot.js",
     "test:json": "node test-fixtures/astgen-json-regression.js",
     "test:fixtures": "node test-fixtures/test-suite.js",
-    "test:vue": "node test-fixtures/astgen-vue-regression.js"
+    "test:vue": "node test-fixtures/astgen-vue-regression.js",
+    "test:svelte": "node test-fixtures/astgen-svelte-regression.js"
   },
   "dependencies": {
     "@appthreat/atom-common": "^1.1.0",
     "@babel/parser": "^8.0.4",
     "@typescript/typescript6": "^6.0.2",
-    "hermes-parser": "^0.37.0"
+    "hermes-parser": "^0.37.0",
+    "svelte": "5.57.0"
   },
   "bin": {
     "astgen": "astgen.js",

package/plugins/composer/installed.php

@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => '__root__',
-        'pretty_version' => 'v1.5.0',
-        'version' => '1.5.0.0',
-        'reference' => '21c39993dc05f74643f5047de71f4bb65f0ead4a',
+        'pretty_version' => 'v1.7.0',
+        'version' => '1.7.0.0',
+        'reference' => '26f7c3eeab1661fdf7ee1a5a7b40f0fd034235eb',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -11,9 +11,9 @@
     ),
     'versions' => array(
         '__root__' => array(
-            'pretty_version' => 'v1.5.0',
-            'version' => '1.5.0.0',
-            'reference' => '21c39993dc05f74643f5047de71f4bb65f0ead4a',
+            'pretty_version' => 'v1.7.0',
+            'version' => '1.7.0.0',
+            'reference' => '26f7c3eeab1661fdf7ee1a5a7b40f0fd034235eb',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),