svelte-shaker 0.15.0 → 0.15.2

package/README.md

@@ -54,10 +54,10 @@ binary). `parser: 'svelte'` falls back to svelte/compiler if you ever need it
 
 ## Usage (Vite)
 
-Add the plugin **before** `svelte()`. It runs only in `vite build` — dev/HMR is
-a pass-through by design. Out of the box it runs the native **Rust (WASM)
-engine** and parses with **rsvelte**; both fall back cleanly (see
-[Options](#options)).
+Add the plugin **before** `svelte()`. By default it runs only in `vite build` —
+dev/HMR is a pass-through (opt into dev shaking with the `dev` option, see
+[Options](#options)). Out of the box it runs the native **Rust (WASM) engine**
+and parses with **rsvelte**; both fall back cleanly (see [Options](#options)).
 
 ```ts
 // vite.config.ts
@@ -103,6 +103,9 @@ shaker({
   // out (e.g. if you ever hit a bug in it).
   engine: 'auto', // 'auto' (default: Rust/WASM, else JS) | 'js' | 'rust'
   parser: 'rsvelte', // 'rsvelte' (default) | 'svelte' (fallback)
+
+  dev: false, // default off: dev is a pass-through. 'incremental' (re-parse only
+  // changed files) | 'coarse' (re-analyze everything) opts in; never monomorphizes
 });
 ```
 
@@ -150,6 +153,14 @@ options that do exist. A typo would otherwise be ignored — and a misspelled
   can't (a broken install), the plugin **throws** rather than silently falling
   back — so the same source always shakes the same on every machine. Reinstall
   dependencies, or set `parser: 'svelte'`.
+- **`dev`** — whether to shake in `vite dev` too. **Off** by default: dev is a
+  pass-through, which is always correct and keeps HMR simple. Opt in with
+  `dev: 'incremental'` — re-parses only the changed files and re-runs the
+  whole-program fixpoint over a long-lived incremental engine (the intended mode)
+  — or `dev: 'coarse'`, which re-analyzes the whole program on every change (the
+  slow but trivially-correct safety valve). Monomorphization is **never** applied
+  in dev; only the always-on passes (unused-prop fold / constant fold / value-set
+  narrowing) run.
 - **`preserve`** — keep a component's **prop interface** exactly as written, because
   something the shake can't see passes props to it. What is preserved is the props,
   **not** the file's presence in the bundle: this is unrelated to Rollup/Vite's
@@ -236,8 +247,9 @@ The whole point is to **never change observable behavior**.
   scope.
 - **Needs `.svelte` source** — libraries shipping compiled JS pass through
   unshaken; distribute via `svelte-package`.
-- **Build only** — whole-program analysis is incompatible with dev/HMR locality,
-  so dev is always a pass-through.
+- **Build-first** — whole-program analysis is incompatible with dev/HMR locality,
+  so dev is a pass-through by default; opt into incremental dev shaking with the
+  `dev` option.
 - **`entries` must cover the whole app** — the crawl starts there, and every
   `.svelte` file it finds is a call-site source. A call site outside those roots
   is invisible, so narrowing `entries` does not shake less, it shakes _wrongly_.

package/dist/analyze.js

@@ -1,7 +1,7 @@
-import { parseCached, parseSvelte, walk, } from './parse.js';
+import { parseCached, parseModuleProgram, walk, } from './parse.js';
 import { emptyPlan, } from './ir.js';
 import { computeDeadSpans, inSpans } from './dead.js';
-import { evaluate, setVar } from './eval.js';
+import { evaluate, setVar, unwrapTsAssertions } from './eval.js';
 const isSvelte = (source) => source.endsWith('.svelte');
 /** Floor for the fixpoint iteration bound (see {@link fixpointIterationBound}). */
 const MIN_FIXPOINT_ITERATIONS = 10;
@@ -856,6 +856,11 @@ function computeScriptConstEnv(ast, instance, moduleScript, propsDeclaration, wr
  * rune call — is evaluated verbatim, so a non-value rune simply falls to unknown.
  */
 function evalDeclaratorValue(init, env) {
+    // `const x = $state(0) as T` wraps the rune in a `TSAsExpression`; erase the
+    // (runtime-transparent) assertion first so the `$state`/`$state.raw` unwrap
+    // below and `evaluate` both see the real initializer, same as a parser that
+    // strips the assertion would.
+    init = unwrapTsAssertions(init) ?? undefined;
     if (isStateRuneCall(init)) {
         const arg = init?.arguments?.[0];
         if (arg == null)
@@ -1081,9 +1086,13 @@ function collectTemplateBindings(ast, instance, propsDeclaration) {
 function collectWrittenNames(node, out) {
     if (node.type === 'AssignmentExpression')
         addPatternNames(node.left, out);
-    else if (node.type === 'UpdateExpression' && node.argument?.type === 'Identifier') {
-        if (node.argument.name)
-            out.add(node.argument.name);
+    else if (node.type === 'UpdateExpression') {
+        // `x!++` keeps the `!` as a `TSNonNullExpression` around the target (only a
+        // bare `x = …` LHS is normalized to the identifier), so read through it or the
+        // write goes uncounted and the name is wrongly admitted as a constant.
+        const arg = unwrapTsAssertions(node.argument);
+        if (arg?.type === 'Identifier' && arg.name)
+            out.add(arg.name);
     }
 }
 /**
@@ -1091,6 +1100,11 @@ function collectWrittenNames(node, out) {
  * Handles bare identifiers, object/array destructuring, defaults and rest.
  */
 function addPatternNames(pattern, out) {
+    // A non-null-asserted assignment target keeps its `TSNonNullExpression` wrapper
+    // in every position but a bare `x = …` LHS — `x! += 1`, `[x!] = a`, `({k: x!} =
+    // o)` — so peel it here (the one choke point every pattern position recurses
+    // through) to count the write against the bare name.
+    pattern = unwrapTsAssertions(pattern) ?? undefined;
     if (!pattern)
         return;
     switch (pattern.type) {
@@ -1467,8 +1481,14 @@ function literalAttrValue(value) {
         const part = parts[0];
         if (part.type === 'Text')
             return { known: true, value: (part.data ?? part.raw ?? '') };
-        if (part.type === 'ExpressionTag' && part.expression?.type === 'Literal') {
-            return { known: true, value: part.expression.value };
+        if (part.type === 'ExpressionTag') {
+            // Recognize `prop={'x' as const}` as the literal it wraps, so the write is
+            // classified NON-dynamic identically to a parser that strips the assertion.
+            // Both paths already fold the value (via the expr fallback), but the
+            // `dynamic` flag itself must match — mono's `specializableShape` reads it.
+            const expr = unwrapTsAssertions(part.expression);
+            if (expr?.type === 'Literal')
+                return { known: true, value: expr.value };
         }
         return { known: false };
     }
@@ -1608,6 +1628,9 @@ function valueSetFor(decl, sites, ownerEnv) {
     return { values, dynamic, top };
 }
 function literalDefault(expr) {
+    // A default like `= 500 as const` reaches here as a `TSAsExpression`; the
+    // assertion erases at runtime, so read through it to the bare default value.
+    expr = unwrapTsAssertions(expr) ?? undefined;
     if (!expr)
         return { known: true, value: undefined }; // omitted default -> undefined
     if (expr.type === 'Literal')
@@ -1809,21 +1832,15 @@ function followLocalImport(body, localName) {
     return null;
 }
 /**
- * Parse a `.js`/`.ts` module's top-level body by reusing the Svelte parser via a
- * `<script module>` wrapper (the engine has no standalone JS parser).  `lang="ts"`
- * is required so TypeScript barrels parse — `export type { … }`, type-only
- * specifiers and annotations are the norm for a design-system's `index.ts`, and a
- * plain JS parse throws on them, leaving the whole library unfollowed.  Returns
- * `null` if it cannot be parsed — callers then leave the barrel unfollowed.
+ * Parse a `.js`/`.ts` barrel's top-level body via {@link parseModuleProgram}
+ * (the engine has no standalone JS parser; the shared helper wraps the source in
+ * a `<script module lang="ts">` so TypeScript barrels — `export type { … }`,
+ * type-only specifiers — parse, and neutralizes any `</script>` in the text so a
+ * valid module that merely mentions it still parses, issue #146).  Returns `null`
+ * if it cannot be parsed — callers then leave the barrel unfollowed.
  */
 function parseModuleBody(code, id) {
-    try {
-        const ast = parseSvelte(`<script module lang="ts">\n${code}\n</script>`, id);
-        return ast.module?.content?.body ?? null;
-    }
-    catch {
-        return null;
-    }
+    return parseModuleProgram(code, id)?.body ?? null;
 }
 /**
  * Derive the child's {@link ReachableInputs} from its `$props()` shape (docs

package/dist/escape-scan.js

@@ -7,7 +7,7 @@
 // ----------------------------------------------------------------------
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { parseSvelte, walk } from './parse.js';
+import { parseModuleProgram, walk } from './parse.js';
 import { compileDevOnly } from './dev-only.js';
 /**
  * The non-`.svelte` module extensions we scan for `.svelte` call sites (docs
@@ -58,25 +58,17 @@ function collectNonSvelteModules(dir, devOnly, out) {
  * Every module specifier a JS/TS module statically references: `import … from`,
  * `export … from` / `export *`, and a dynamic `import('…')` whose argument is a
  * STRING LITERAL.  A computed dynamic import (`import(expr)`) is unknowable here —
- * the `preserve` option (docs §4.2) is the sound fallback for it.  Parsed via the
- * Svelte parser's `<script module lang="ts">` wrapper (the same TS-capable parse
- * the engine's barrel-following uses).  Returns `null` when the module does NOT
- * parse — the wrapper handles TS but not JSX, and rejects some exotic syntax
- * (`.jsx`/`.tsx` bodies, bleeding-edge TS), and a parse failure hides any call site
- * inside, so the caller must surface it (a mounted component would go un-escaped);
- * `preserve` is the fix for that file.
+ * the `preserve` option (docs §4.2) is the sound fallback for it.  Parsed via
+ * {@link parseModuleProgram} (the same TS-capable parse the engine's
+ * barrel-following uses).  Returns `null` when the module does NOT parse — a JSX
+ * body or exotic/bleeding-edge TS the wrapper rejects — because a parse failure
+ * hides any call site inside, so the caller must surface it (a mounted component
+ * would go un-escaped); `preserve` is the fix for that file.
  */
 function moduleImportSpecifiers(code, id) {
-    let module;
-    try {
-        module = parseSvelte(`<script module lang="ts">\n${code}\n</script>`, id).module;
-    }
-    catch {
-        return null; // unparseable — the caller reports it (soundness hole, `preserve` fixes it)
-    }
-    const program = module?.content;
-    if (!program)
-        return []; // parsed, no module body — nothing to follow (not a failure)
+    const program = parseModuleProgram(code, id);
+    if (program === null)
+        return null; // unparseable — the caller reports it (`preserve` fixes it)
     const specs = [];
     const literalSource = (node) => node?.type === 'Literal' && typeof node.value === 'string' ? node.value : undefined;
     walk(program, null, {

package/dist/eval.d.ts

@@ -6,6 +6,21 @@ export type EvalResult = {
 } | {
     known: false;
 };
+/**
+ * Strip TypeScript assertion wrappers — `x as T` (`TSAsExpression`), `x!`
+ * (`TSNonNullExpression`), `x satisfies T` (`TSSatisfiesExpression`) — down to
+ * the runtime expression they wrap, recursing so `('a' as const)!` becomes `'a'`.
+ *
+ * These are compile-time-only type operators: they are erased before any code
+ * runs and do not touch the operand's value, so interpreting the operand IS
+ * interpreting the whole expression (docs/ARCHITECTURE.md §2.2 — the value the
+ * expression abstracts to is exactly the operand's). The engine runs on the
+ * `lang="ts"` source with types preserved (§6.3), so svelte/compiler hands it
+ * these nodes verbatim; a parser that erases them (rsvelte today) yields the bare
+ * operand instead. Unwrapping here folds both ASTs identically — the
+ * parser-neutrality contract every value-interpreting entry point relies on.
+ */
+export declare function unwrapTsAssertions(node: AnyNode | null | undefined): AnyNode | null | undefined;
 /**
  * A deliberately tiny, total constant evaluator over an ESTree expression,
  * given an environment of statically-known identifiers.  It never throws and

package/dist/eval.js

@@ -1,4 +1,27 @@
 const UNKNOWN = { known: false };
+/**
+ * Strip TypeScript assertion wrappers — `x as T` (`TSAsExpression`), `x!`
+ * (`TSNonNullExpression`), `x satisfies T` (`TSSatisfiesExpression`) — down to
+ * the runtime expression they wrap, recursing so `('a' as const)!` becomes `'a'`.
+ *
+ * These are compile-time-only type operators: they are erased before any code
+ * runs and do not touch the operand's value, so interpreting the operand IS
+ * interpreting the whole expression (docs/ARCHITECTURE.md §2.2 — the value the
+ * expression abstracts to is exactly the operand's). The engine runs on the
+ * `lang="ts"` source with types preserved (§6.3), so svelte/compiler hands it
+ * these nodes verbatim; a parser that erases them (rsvelte today) yields the bare
+ * operand instead. Unwrapping here folds both ASTs identically — the
+ * parser-neutrality contract every value-interpreting entry point relies on.
+ */
+export function unwrapTsAssertions(node) {
+    let current = node;
+    while (current?.type === 'TSAsExpression' ||
+        current?.type === 'TSNonNullExpression' ||
+        current?.type === 'TSSatisfiesExpression') {
+        current = current.expression;
+    }
+    return current;
+}
 /**
  * A deliberately tiny, total constant evaluator over an ESTree expression,
  * given an environment of statically-known identifiers.  It never throws and
@@ -9,6 +32,7 @@ const UNKNOWN = { known: false };
  * unknown on non-distributive ops), just without the interprocedural lattice.
  */
 export function evaluate(node, env) {
+    node = unwrapTsAssertions(node);
     if (!node)
         return UNKNOWN;
     switch (node.type) {
@@ -126,6 +150,7 @@ export function evaluateWithSets(node, constEnv, setEnv) {
 }
 /** Evaluate a boolean condition to a Kleene truth over the value sets. */
 function evalTri(node, constEnv, setEnv) {
+    node = unwrapTsAssertions(node);
     if (!node)
         return 'unknown';
     switch (node.type) {
@@ -193,8 +218,11 @@ function equalityTri(left, right, constEnv, setEnv, loose) {
  * set pass-through (analyze.ts) all decide it through this, so they stay in lockstep.
  */
 export function setVar(node, setEnv) {
-    if (node?.type === 'Identifier' && node.name && setEnv.has(node.name))
-        return setEnv.get(node.name);
+    // A `variant as const` / `variant!` reference is still a bare read of `variant`
+    // (the assertion erases at runtime), so it narrows like the identifier it wraps.
+    const bare = unwrapTsAssertions(node);
+    if (bare?.type === 'Identifier' && bare.name && setEnv.has(bare.name))
+        return setEnv.get(bare.name);
     return null;
 }
 /**

package/dist/parse.d.ts

@@ -81,6 +81,39 @@ export interface Root extends AnyNode {
     fragment: AnyNode;
 }
 export declare function parseSvelte(code: string, filename: string): Root;
+/**
+ * Parse a plain `.js`/`.ts` module (NOT a `.svelte` component) and return its
+ * top-level ESTree Program, or `null` if it does not parse.  The engine has no
+ * standalone JS parser, so we reuse the Svelte parser via a `<script module
+ * lang="ts">` wrapper: `lang="ts"` is what lets a TypeScript barrel — `export
+ * type { … }`, type-only specifiers, annotations, the norm for a design-system
+ * `index.ts` — parse where a plain-JS parse would throw.
+ *
+ * The Svelte parser ends a `<script>` at the first `</script…>` it finds in the
+ * RAW text (`read_until(/<\/script\s*>/)`), so a valid module whose text merely
+ * MENTIONS `</script>` — in a comment, string, regex or template literal, as an
+ * HTML sanitizer or a markdown pipeline routinely does — would close the wrapper
+ * early and fail to parse (issue #146).  We break every `</script` in the body
+ * before wrapping by inserting a space after the `<`.  In valid JS/TS `</script`
+ * only ever occurs inside a comment or a string/regex/template literal (it is
+ * never part of executable syntax), so this alters only inert text — with ONE
+ * exception a caller does read: a module SPECIFIER that itself contains
+ * `</script` (`import x from './a</script>b.js'`).  Rewriting it would silently
+ * change which file it resolves to, turning a parse failure into a partial one
+ * (a missed escape / an unfollowed export).  Rather than claim such a specifier
+ * cannot exist, we detect a rewritten one after parsing and fail the whole
+ * module (return `null`), the same loud degrade a parse failure gives — the
+ * specifier is absurd (`<`/`>` are invalid in real paths and package names), so
+ * this only trades one conservative outcome for another.  The inserted spaces
+ * shift byte offsets, but no caller reads spans off this AST — only specifier
+ * names and string values.
+ *
+ * Returns `null` on a genuine parse failure (a JSX body, exotic/bleeding-edge
+ * TS) or a specifier the neutralization would corrupt: a call site hidden inside
+ * then goes unfollowed, which each caller handles conservatively (escape scan
+ * reports the file as unscannable; barrel-following leaves the barrel unfollowed).
+ */
+export declare function parseModuleProgram(code: string, filename: string): AnyNode | null;
 /**
  * Content-keyed parse cache: a hit returns the IDENTICAL AST for unchanged
  * source, so the dev engine re-parses only the files that actually changed

package/dist/parse.js

@@ -3,6 +3,93 @@ import { walk as zfWalk } from 'zimmerframe';
 export function parseSvelte(code, filename) {
     return parse(code, { modern: true, filename });
 }
+/** Matches every `</script` in module text (any case), the sequence that would
+ * otherwise close the {@link parseModuleProgram} wrapper early. */
+const CLOSING_SCRIPT = /<\/script/gi;
+/** What `CLOSING_SCRIPT` is rewritten to: a space after the `<` breaks the
+ * `</script\s*>` the Svelte parser scans for, while staying a recognizable
+ * marker so a corrupted specifier can be detected afterwards. */
+const NEUTRALIZED_SCRIPT = '< /script';
+/**
+ * Parse a plain `.js`/`.ts` module (NOT a `.svelte` component) and return its
+ * top-level ESTree Program, or `null` if it does not parse.  The engine has no
+ * standalone JS parser, so we reuse the Svelte parser via a `<script module
+ * lang="ts">` wrapper: `lang="ts"` is what lets a TypeScript barrel — `export
+ * type { … }`, type-only specifiers, annotations, the norm for a design-system
+ * `index.ts` — parse where a plain-JS parse would throw.
+ *
+ * The Svelte parser ends a `<script>` at the first `</script…>` it finds in the
+ * RAW text (`read_until(/<\/script\s*>/)`), so a valid module whose text merely
+ * MENTIONS `</script>` — in a comment, string, regex or template literal, as an
+ * HTML sanitizer or a markdown pipeline routinely does — would close the wrapper
+ * early and fail to parse (issue #146).  We break every `</script` in the body
+ * before wrapping by inserting a space after the `<`.  In valid JS/TS `</script`
+ * only ever occurs inside a comment or a string/regex/template literal (it is
+ * never part of executable syntax), so this alters only inert text — with ONE
+ * exception a caller does read: a module SPECIFIER that itself contains
+ * `</script` (`import x from './a</script>b.js'`).  Rewriting it would silently
+ * change which file it resolves to, turning a parse failure into a partial one
+ * (a missed escape / an unfollowed export).  Rather than claim such a specifier
+ * cannot exist, we detect a rewritten one after parsing and fail the whole
+ * module (return `null`), the same loud degrade a parse failure gives — the
+ * specifier is absurd (`<`/`>` are invalid in real paths and package names), so
+ * this only trades one conservative outcome for another.  The inserted spaces
+ * shift byte offsets, but no caller reads spans off this AST — only specifier
+ * names and string values.
+ *
+ * Returns `null` on a genuine parse failure (a JSX body, exotic/bleeding-edge
+ * TS) or a specifier the neutralization would corrupt: a call site hidden inside
+ * then goes unfollowed, which each caller handles conservatively (escape scan
+ * reports the file as unscannable; barrel-following leaves the barrel unfollowed).
+ */
+export function parseModuleProgram(code, filename) {
+    const wrapped = `<script module lang="ts">\n${code.replace(CLOSING_SCRIPT, NEUTRALIZED_SCRIPT)}\n</script>`;
+    let program;
+    try {
+        program = parseSvelte(wrapped, filename).module?.content ?? null;
+    }
+    catch {
+        return null; // unparseable — the caller decides how to degrade (see above)
+    }
+    // A specifier that carried `</script` was rewritten by the neutralization and
+    // no longer names the real module; degrade loudly rather than resolve a lie.
+    if (program && hasNeutralizedSpecifier(program))
+        return null;
+    return program;
+}
+/** True when any static import/export/dynamic-`import()` specifier string in
+ * `program` contains the {@link NEUTRALIZED_SCRIPT} marker — i.e. the source
+ * originally held `</script` and was rewritten by {@link parseModuleProgram}, so
+ * it can no longer be trusted to resolve. */
+function hasNeutralizedSpecifier(program) {
+    let corrupted = false;
+    const check = (source) => {
+        if (source?.type === 'Literal' &&
+            typeof source.value === 'string' &&
+            source.value.includes(NEUTRALIZED_SCRIPT)) {
+            corrupted = true;
+        }
+    };
+    walk(program, null, {
+        ImportDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ExportNamedDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ExportAllDeclaration(node, { next }) {
+            check(node.source);
+            next();
+        },
+        ImportExpression(node, { next }) {
+            check(node.source);
+            next();
+        },
+    });
+    return corrupted;
+}
 export function parseCached(filename, code, cache, parse = parseSvelte) {
     if (!cache)
         return parse(code, filename);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-shaker",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Tree shaking for Svelte components",
   "keywords": [
     "dead-code-elimination",