svelte-shaker 0.15.0 → 0.15.1

package/README.md

@@ -54,10 +54,10 @@ binary). `parser: 'svelte'` falls back to svelte/compiler if you ever need it
 
 ## Usage (Vite)
 
-Add the plugin **before** `svelte()`. It runs only in `vite build` — dev/HMR is
-a pass-through by design. Out of the box it runs the native **Rust (WASM)
-engine** and parses with **rsvelte**; both fall back cleanly (see
-[Options](#options)).
+Add the plugin **before** `svelte()`. By default it runs only in `vite build` —
+dev/HMR is a pass-through (opt into dev shaking with the `dev` option, see
+[Options](#options)). Out of the box it runs the native **Rust (WASM) engine**
+and parses with **rsvelte**; both fall back cleanly (see [Options](#options)).
 
 ```ts
 // vite.config.ts
@@ -103,6 +103,9 @@ shaker({
   // out (e.g. if you ever hit a bug in it).
   engine: 'auto', // 'auto' (default: Rust/WASM, else JS) | 'js' | 'rust'
   parser: 'rsvelte', // 'rsvelte' (default) | 'svelte' (fallback)
+
+  dev: false, // default off: dev is a pass-through. 'incremental' (re-parse only
+  // changed files) | 'coarse' (re-analyze everything) opts in; never monomorphizes
 });
 ```
 
@@ -150,6 +153,14 @@ options that do exist. A typo would otherwise be ignored — and a misspelled
   can't (a broken install), the plugin **throws** rather than silently falling
   back — so the same source always shakes the same on every machine. Reinstall
   dependencies, or set `parser: 'svelte'`.
+- **`dev`** — whether to shake in `vite dev` too. **Off** by default: dev is a
+  pass-through, which is always correct and keeps HMR simple. Opt in with
+  `dev: 'incremental'` — re-parses only the changed files and re-runs the
+  whole-program fixpoint over a long-lived incremental engine (the intended mode)
+  — or `dev: 'coarse'`, which re-analyzes the whole program on every change (the
+  slow but trivially-correct safety valve). Monomorphization is **never** applied
+  in dev; only the always-on passes (unused-prop fold / constant fold / value-set
+  narrowing) run.
 - **`preserve`** — keep a component's **prop interface** exactly as written, because
   something the shake can't see passes props to it. What is preserved is the props,
   **not** the file's presence in the bundle: this is unrelated to Rollup/Vite's
@@ -236,8 +247,9 @@ The whole point is to **never change observable behavior**.
   scope.
 - **Needs `.svelte` source** — libraries shipping compiled JS pass through
   unshaken; distribute via `svelte-package`.
-- **Build only** — whole-program analysis is incompatible with dev/HMR locality,
-  so dev is always a pass-through.
+- **Build-first** — whole-program analysis is incompatible with dev/HMR locality,
+  so dev is a pass-through by default; opt into incremental dev shaking with the
+  `dev` option.
 - **`entries` must cover the whole app** — the crawl starts there, and every
   `.svelte` file it finds is a call-site source. A call site outside those roots
   is invisible, so narrowing `entries` does not shake less, it shakes _wrongly_.

package/dist/analyze.js

@@ -1,4 +1,4 @@
-import { parseCached, parseSvelte, walk, } from './parse.js';
+import { parseCached, parseModuleProgram, walk, } from './parse.js';
 import { emptyPlan, } from './ir.js';
 import { computeDeadSpans, inSpans } from './dead.js';
 import { evaluate, setVar } from './eval.js';
@@ -1809,21 +1809,15 @@ function followLocalImport(body, localName) {
     return null;
 }
 /**
- * Parse a `.js`/`.ts` module's top-level body by reusing the Svelte parser via a
- * `<script module>` wrapper (the engine has no standalone JS parser).  `lang="ts"`
- * is required so TypeScript barrels parse — `export type { … }`, type-only
- * specifiers and annotations are the norm for a design-system's `index.ts`, and a
- * plain JS parse throws on them, leaving the whole library unfollowed.  Returns
- * `null` if it cannot be parsed — callers then leave the barrel unfollowed.
+ * Parse a `.js`/`.ts` barrel's top-level body via {@link parseModuleProgram}
+ * (the engine has no standalone JS parser; the shared helper wraps the source in
+ * a `<script module lang="ts">` so TypeScript barrels — `export type { … }`,
+ * type-only specifiers — parse, and neutralizes any `</script>` in the text so a
+ * valid module that merely mentions it still parses, issue #146).  Returns `null`
+ * if it cannot be parsed — callers then leave the barrel unfollowed.
  */
 function parseModuleBody(code, id) {
-    try {
-        const ast = parseSvelte(`<script module lang="ts">\n${code}\n</script>`, id);
-        return ast.module?.content?.body ?? null;
-    }
-    catch {
-        return null;
-    }
+    return parseModuleProgram(code, id)?.body ?? null;
 }
 /**
  * Derive the child's {@link ReachableInputs} from its `$props()` shape (docs

package/dist/escape-scan.js

@@ -7,7 +7,7 @@
 // ----------------------------------------------------------------------
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { parseSvelte, walk } from './parse.js';
+import { parseModuleProgram, walk } from './parse.js';
 import { compileDevOnly } from './dev-only.js';
 /**
  * The non-`.svelte` module extensions we scan for `.svelte` call sites (docs
@@ -58,25 +58,17 @@ function collectNonSvelteModules(dir, devOnly, out) {
  * Every module specifier a JS/TS module statically references: `import … from`,
  * `export … from` / `export *`, and a dynamic `import('…')` whose argument is a
  * STRING LITERAL.  A computed dynamic import (`import(expr)`) is unknowable here —
- * the `preserve` option (docs §4.2) is the sound fallback for it.  Parsed via the
- * Svelte parser's `<script module lang="ts">` wrapper (the same TS-capable parse
- * the engine's barrel-following uses).  Returns `null` when the module does NOT
- * parse — the wrapper handles TS but not JSX, and rejects some exotic syntax
- * (`.jsx`/`.tsx` bodies, bleeding-edge TS), and a parse failure hides any call site
- * inside, so the caller must surface it (a mounted component would go un-escaped);
- * `preserve` is the fix for that file.
+ * the `preserve` option (docs §4.2) is the sound fallback for it.  Parsed via
+ * {@link parseModuleProgram} (the same TS-capable parse the engine's
+ * barrel-following uses).  Returns `null` when the module does NOT parse — a JSX
+ * body or exotic/bleeding-edge TS the wrapper rejects — because a parse failure
+ * hides any call site inside, so the caller must surface it (a mounted component
+ * would go un-escaped); `preserve` is the fix for that file.
  */
 function moduleImportSpecifiers(code, id) {
-    let module;
-    try {
-        module = parseSvelte(`<script module lang="ts">\n${code}\n</script>`, id).module;
-    }
-    catch {
-        return null; // unparseable — the caller reports it (soundness hole, `preserve` fixes it)
-    }
-    const program = module?.content;
-    if (!program)
-        return []; // parsed, no module body — nothing to follow (not a failure)
+    const program = parseModuleProgram(code, id);
+    if (program === null)
+        return null; // unparseable — the caller reports it (`preserve` fixes it)
     const specs = [];
     const literalSource = (node) => node?.type === 'Literal' && typeof node.value === 'string' ? node.value : undefined;
     walk(program, null, {

package/dist/parse.d.ts

@@ -81,6 +81,39 @@ export interface Root extends AnyNode {
     fragment: AnyNode;
 }
 export declare function parseSvelte(code: string, filename: string): Root;
+/**
+ * Parse a plain `.js`/`.ts` module (NOT a `.svelte` component) and return its
+ * top-level ESTree Program, or `null` if it does not parse.  The engine has no
+ * standalone JS parser, so we reuse the Svelte parser via a `<script module
+ * lang="ts">` wrapper: `lang="ts"` is what lets a TypeScript barrel — `export
+ * type { … }`, type-only specifiers, annotations, the norm for a design-system
+ * `index.ts` — parse where a plain-JS parse would throw.
+ *
+ * The Svelte parser ends a `<script>` at the first `</script…>` it finds in the
+ * RAW text (`read_until(/<\/script\s*>/)`), so a valid module whose text merely
+ * MENTIONS `</script>` — in a comment, string, regex or template literal, as an
+ * HTML sanitizer or a markdown pipeline routinely does — would close the wrapper
+ * early and fail to parse (issue #146).  We break every `</script` in the body
+ * before wrapping by inserting a space after the `<`.  In valid JS/TS `</script`
+ * only ever occurs inside a comment or a string/regex/template literal (it is
+ * never part of executable syntax), so this alters only inert text — with ONE
+ * exception a caller does read: a module SPECIFIER that itself contains
+ * `</script` (`import x from './a</script>b.js'`).  Rewriting it would silently
+ * change which file it resolves to, turning a parse failure into a partial one
+ * (a missed escape / an unfollowed export).  Rather than claim such a specifier
+ * cannot exist, we detect a rewritten one after parsing and fail the whole
+ * module (return `null`), the same loud degrade a parse failure gives — the
+ * specifier is absurd (`<`/`>` are invalid in real paths and package names), so
+ * this only trades one conservative outcome for another.  The inserted spaces
+ * shift byte offsets, but no caller reads spans off this AST — only specifier
+ * names and string values.
+ *
+ * Returns `null` on a genuine parse failure (a JSX body, exotic/bleeding-edge
+ * TS) or a specifier the neutralization would corrupt: a call site hidden inside
+ * then goes unfollowed, which each caller handles conservatively (escape scan
+ * reports the file as unscannable; barrel-following leaves the barrel unfollowed).
+ */
+export declare function parseModuleProgram(code: string, filename: string): AnyNode | null;
 /**
  * Content-keyed parse cache: a hit returns the IDENTICAL AST for unchanged
  * source, so the dev engine re-parses only the files that actually changed

package/dist/parse.js

@@ -3,6 +3,93 @@ import { walk as zfWalk } from 'zimmerframe';
 export function parseSvelte(code, filename) {
     return parse(code, { modern: true, filename });
 }
+/** Matches every `</script` in module text (any case), the sequence that would
+ * otherwise close the {@link parseModuleProgram} wrapper early. */
+const CLOSING_SCRIPT = /<\/script/gi;
+/** What `CLOSING_SCRIPT` is rewritten to: a space after the `<` breaks the
+ * `</script\s*>` the Svelte parser scans for, while staying a recognizable
+ * marker so a corrupted specifier can be detected afterwards. */
+const NEUTRALIZED_SCRIPT = '< /script';
+/**
+ * Parse a plain `.js`/`.ts` module (NOT a `.svelte` component) and return its
+ * top-level ESTree Program, or `null` if it does not parse.  The engine has no
+ * standalone JS parser, so we reuse the Svelte parser via a `<script module
+ * lang="ts">` wrapper: `lang="ts"` is what lets a TypeScript barrel — `export
+ * type { … }`, type-only specifiers, annotations, the norm for a design-system
+ * `index.ts` — parse where a plain-JS parse would throw.
+ *
+ * The Svelte parser ends a `<script>` at the first `</script…>` it finds in the
+ * RAW text (`read_until(/<\/script\s*>/)`), so a valid module whose text merely
+ * MENTIONS `</script>` — in a comment, string, regex or template literal, as an
+ * HTML sanitizer or a markdown pipeline routinely does — would close the wrapper
+ * early and fail to parse (issue #146).  We break every `</script` in the body
+ * before wrapping by inserting a space after the `<`.  In valid JS/TS `</script`
+ * only ever occurs inside a comment or a string/regex/template literal (it is
+ * never part of executable syntax), so this alters only inert text — with ONE
+ * exception a caller does read: a module SPECIFIER that itself contains
+ * `</script` (`import x from './a</script>b.js'`).  Rewriting it would silently
+ * change which file it resolves to, turning a parse failure into a partial one
+ * (a missed escape / an unfollowed export).  Rather than claim such a specifier
+ * cannot exist, we detect a rewritten one after parsing and fail the whole
+ * module (return `null`), the same loud degrade a parse failure gives — the
+ * specifier is absurd (`<`/`>` are invalid in real paths and package names), so
+ * this only trades one conservative outcome for another.  The inserted spaces
+ * shift byte offsets, but no caller reads spans off this AST — only specifier
+ * names and string values.
+ *
+ * Returns `null` on a genuine parse failure (a JSX body, exotic/bleeding-edge
+ * TS) or a specifier the neutralization would corrupt: a call site hidden inside
+ * then goes unfollowed, which each caller handles conservatively (escape scan
+ * reports the file as unscannable; barrel-following leaves the barrel unfollowed).
+ */
+export function parseModuleProgram(code, filename) {
+    const wrapped = `<script module lang="ts">\n${code.replace(CLOSING_SCRIPT, NEUTRALIZED_SCRIPT)}\n</script>`;
+    let program;
+    try {
+        program = parseSvelte(wrapped, filename).module?.content ?? null;
+    }
+    catch {
+        return null; // unparseable — the caller decides how to degrade (see above)
+    }
+    // A specifier that carried `</script` was rewritten by the neutralization and
+    // no longer names the real module; degrade loudly rather than resolve a lie.
+    if (program && hasNeutralizedSpecifier(program))
+        return null;
+    return program;
+}
+/** True when any static import/export/dynamic-`import()` specifier string in
+ * `program` contains the {@link NEUTRALIZED_SCRIPT} marker — i.e. the source
+ * originally held `</script` and was rewritten by {@link parseModuleProgram}, so
+ * it can no longer be trusted to resolve. */
+function hasNeutralizedSpecifier(program) {
+    let corrupted = false;
+    const check = (source) => {
+        if (source?.type === 'Literal' &&
+            typeof source.value === 'string' &&
+            source.value.includes(NEUTRALIZED_SCRIPT)) {
+            corrupted = true;
+        }
+    };
+    walk(program, null, {
+        ImportDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ExportNamedDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ExportAllDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ImportExpression(node, { next }) {
+            check(node.source);
+            next();
+        },
+    });
+    return corrupted;
+}
 export function parseCached(filename, code, cache, parse = parseSvelte) {
     if (!cache)
         return parse(code, filename);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-shaker",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Tree shaking for Svelte components",
   "keywords": [
     "dead-code-elimination",