@joshuafolkken/kit 1.872.0

package/templates/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,428 @@
+name: Dependabot auto-merge
+
+on: pull_request
+
+# One run per pull request, and a superseded one is cancelled rather than left to finish. Both halves
+# of this workflow decide from the pull request as it stands — which files the diff touches, and who
+# pushed — while `gh pr merge --auto` is state that outlives the run that set it. A run that has been
+# overtaken is therefore deciding about a diff that no longer exists: it can arm auto-merge after a
+# newer run already withdrew it, on a diff that newer run found upstream-managed, and nothing runs
+# afterwards to undo that (joshuafolkken/kit#842). `github.ref` is the pull request's own merge ref,
+# so the group is per pull request and one bump never waits on another's run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  # Gated on who opened the pull request, not on who triggered this run. `github.actor` names the
+  # latter, so a push by anyone other than Dependabot — a maintainer rebasing the branch by hand, or
+  # amending the bump — skipped the whole job. That mattered once the job acquired something to undo:
+  # `gh pr merge --auto` is state on the pull request, so a run that never happens cannot withdraw an
+  # auto-merge an earlier run armed, and the bump merges itself the moment the checks go green
+  # (joshuafolkken/kit#838). The author is the stable fact about a Dependabot pull request; arming is
+  # what stays restricted to Dependabot's own events, on the step below.
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      # Whether the pull request touches a workflow some upstream package overwrites. Decided from
+      # the changed files because Dependabot's metadata cannot answer it: for the github-actions
+      # ecosystem it reports one `directory` for the whole repository and never names the workflow
+      # file it bumped.
+      #
+      # The answer is read off each file rather than looked up in a list of paths. A list can only
+      # describe what the package holding the list distributes, and this repository may receive
+      # workflows from more than one: kit writes `ci.yml`, and a package built on kit writes its own
+      # alongside it. Neither knows the other's set, and whichever `sync` ran last would decide a
+      # shared list — so the list drifts from the files it claims to describe and the merge/revert
+      # loop joshuafolkken/kit#836 closed reopens one tier down (joshuafolkken/kit#844). A stamp
+      # written by the package that overwrites the file cannot drift from it, and composes across any
+      # number of distribution tiers without the distributors having to agree on anything.
+      #
+      # It runs first because the decision below reads its output, and for no other reason. It used to
+      # run before the metadata step so that the withdrawal was reached even when that action failed
+      # the job (joshuafolkken/kit#838); containing that failure removed the constraint, so what order
+      # remains is data dependency alone (joshuafolkken/kit#845).
+      #
+      # Everything comes from the API, so no checkout is needed. `--paginate` is what makes the file
+      # list complete rather than the first page of a large diff, and the `select` narrows it to
+      # workflows inside `--jq` rather than through `grep`: the default shell is `bash -e` without
+      # `pipefail`, so a `gh` failure inside a pipeline would be masked by grep's status, and grep
+      # itself answers 1 for "no match" and 2 for "I could not look" — two readings this step must
+      # not conflate, since one of them means "merge it" (joshuafolkken/kit#844). An assignment
+      # carries the command's status, and `case` has no failure mode at all.
+      #
+      # Each file is read through the `contents_url` the same response supplies, rather than a URL
+      # built from the path here. GitHub has already encoded it, and it already points at this pull
+      # request's head — a path composed by hand would break on the first workflow whose name
+      # contains a space or a `#`, and every read failing means every bump is held back for good.
+      #
+      # The stamp is matched at the start of the file, not anywhere in it, because this workflow
+      # declares the token in its own `env` in order to match on it — a substring test would call
+      # every copy of this file managed for the wrong reason, and would say nothing about files that
+      # merely mention it.
+      #
+      # A file that cannot be read fails the step rather than answering. That covers a deletion, a
+      # rate-limited API, a network failure and a response that carried no URL to read alike: none of
+      # them is evidence that the consumer owns the file. Failing lands on the same safe side as
+      # answering "managed" would — the step publishes no output, and the reconciling step below reads
+      # that as this run having no entitlement to arm — and it lands there visibly. Answering
+      # instead would withdraw a previously armed auto-merge on a green job, with nothing to look at
+      # and no retry until the next push; this call runs once per changed workflow, so the case is not
+      # rare enough to leave silent.
+      #
+      # `gh`'s own stderr reaches the job log rather than being discarded, because the causes are not
+      # equally interesting and the step cannot tell them apart: a deletion is routine, a 403 means
+      # every bump in this repository is being held back for a reason someone has to fix.
+      # Only stdout is captured, so the message cannot be mistaken for file content.
+      - name: Check whether the pull request touches an upstream-managed workflow
+        id: managed
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+          MANAGED_MARKER: '# josh-managed-workflow:'
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          changed="$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate \
+            --jq '.[] | select(.filename | startswith(".github/workflows/"))
+                      | [.filename, .contents_url] | @tsv')"
+
+          has_managed=false
+
+          while IFS="$(printf '\t')" read -r file url; do
+            [ -n "$file$url" ] || continue
+
+            if [ -n "$url" ] &&
+              content="$(gh api "$url" -H 'Accept: application/vnd.github.raw')"; then
+              case "$content" in
+                "$MANAGED_MARKER"*)
+                  echo "$file is written by an upstream package — holding this bump back."
+                  has_managed=true
+                  break
+                  ;;
+              esac
+            else
+              echo "$file could not be read — refusing to decide." >&2
+              exit 1
+            fi
+          done <<<"$changed"
+
+          echo "has-upstream-managed=$has_managed" >>"$GITHUB_OUTPUT"
+
+      # `dependabot/fetch-metadata` is the one part of the decision that cannot be an expression: the
+      # ecosystem and the semver level come from an action, not from a context. It carries no gate at
+      # all any more, and `continue-on-error` is what makes that safe. The action fails outright when
+      # the branch's first commit is not Dependabot's — a maintainer who amended or rebased the bump —
+      # and a failed step used to take every step after it with it, which is why the withdrawal had to
+      # be placed before it and why it had to repeat the arming gate to avoid running at all
+      # (joshuafolkken/kit#838). Neither is needed once the failure is contained: the step publishes no
+      # outputs, the decision below reads them as empty, and an empty ecosystem cannot equal
+      # `github_actions`, so the run declines to arm — reached by the ordinary path rather than by a
+      # special case. It declines to arm rather than reconciling to "not armed": these outputs are
+      # absent from the entitlement half below, so an arm an earlier run made is left in place. See
+      # the reconciling step for why the two halves name different inputs (joshuafolkken/kit#845).
+      - name: Fetch Dependabot metadata
+        id: metadata
+        continue-on-error: true
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      # `gh pr merge --auto` is state that outlives the run that set it, and for four rounds this
+      # workflow managed that state with two steps whose conditions had to be exact complements of
+      # each other: one that armed, one that withdrew. Nothing enforced the complement — #840 made it
+      # hold by writing one as the literal negation of the other, which is a convention, not a
+      # structure. Every fix since #836 has been the same shape: a new axis, added to N conditions.
+      #
+      # So there is one step that changes the state now, and it takes both directions from what is
+      # declared below rather than from a gate of its own (joshuafolkken/kit#845).
+      #
+      # There are two declarations rather than one because there are genuinely two questions, and the
+      # old design's mistake was conflating them into a complement:
+      #
+      #   MAY_ARM          — is this *run* entitled to decide? Facts about the run: who pushed, and
+      #                      whether the diff holds a workflow an upstream package overwrites.
+      #   SHOULD_BE_ARMED  — does this *bump* qualify? MAY_ARM plus the ecosystem and the semver
+      #                      level, which are facts about the bump and do not change over a pull
+      #                      request's life.
+      #
+      # The second contains the first verbatim, and a kit unit test holds that containment — so they
+      # cannot drift into disagreeing the way two complements could.
+      #
+      # The distinction is what the withdrawal keys on, and it is load-bearing. On a run that is still
+      # entitled, a bump that simply does not qualify — an npm security advisory, a github-actions
+      # major — is left exactly as it is: if a maintainer read it and enabled auto-merge by hand, that
+      # is their decision and this workflow has no business undoing it. Withdrawing there would strand
+      # the pull request green, mergeable and unmerged, which is the state joshuafolkken/kit#834
+      # exists to prevent.
+      #
+      # What is withdrawn is an arm the *run* is not entitled to: a diff that grew an upstream-managed
+      # workflow (joshuafolkken/kit#838), a push by someone other than Dependabot, or an input that
+      # could not answer (joshuafolkken/kit#840). Those take back a hand-armed auto-merge too, and
+      # deliberately — a push nobody reviewed as part of the bump is exactly the case #840 closed, and
+      # who armed it earlier does not make the new commits reviewed. So a human is overridden when
+      # merging would be harmful, and only then; falling outside this workflow's policy is not.
+      #
+      # Both stay expressions rather than shell on purpose. Written here, GitHub's own engine
+      # evaluates them, and kit's tests evaluate the very same strings with that engine — a matrix
+      # over actor, managed, ecosystem and semver level proves which updates can reach the arming
+      # call. Moved into the script below they would still work, and every guard on them would decay
+      # from an evaluation into a substring match.
+      #
+      # A missing input makes the chains that name it false, and the two chains name different ones,
+      # which is the point rather than an oversight. A `managed` step that could not answer costs the
+      # run its entitlement, so an arm it finds is taken back. A metadata action that could not answer
+      # costs only qualification: the bump is not armed *now*, and an arm an earlier run made is left
+      # alone, because that run did verify the ecosystem and the semver level and neither changes over
+      # a pull request's life. Withdrawing there would strip a good arm every time the action has a
+      # bad day. So the safe side is per question, not per input — "do not arm on what I cannot
+      # verify", and "take back what this run is not entitled to".
+      #
+      # The two failures also announce themselves differently, which is why only one of them fails a
+      # step. A `managed` step that guessed would let an unreviewed bump merge, and nothing would say
+      # so — it has to be loud. A metadata action that cannot answer makes bumps stop merging, which
+      # announces itself by the pile of open pull requests; the log below names it as well, so a
+      # broken action is not mistaken for a queue of bumps that merely do not qualify.
+      #
+      # `!cancelled()` is what reaches this step after `managed` fails; a cancelled run is left alone
+      # because it changed nothing about the pull request and so has nothing to reconcile, and because
+      # the run that superseded it will decide from the current state anyway (joshuafolkken/kit#840).
+      #
+      # The two directions are not equally dangerous, and #846 will build on that. Failing to arm
+      # leaves the bump open for a human — an inconvenience. Failing to withdraw leaves an auto-merge
+      # armed on a diff nobody re-approved, and this workflow is not a required check, so a red run
+      # does not hold the merge back. That is why only the arming call carries `--match-head-commit`:
+      # it makes GitHub refuse the arm if the branch moved since this run decided (the mutation's
+      # `expectedHeadOid`), closing the window the concurrency group above only narrows
+      # (joshuafolkken/kit#842). Withdrawing from a stale view costs at most an auto-merge the next
+      # run re-arms, so it needs no such guard.
+      #
+      # The armed state is read before either branch because `--disable-auto` is an error, not a
+      # no-op, on a pull request that has none — and `--auto` on one already armed is a needless
+      # write. `autoMergeRequest` is null exactly when nothing is armed.
+      - name: Reconcile the pull request's auto-merge state
+        id: reconcile
+        if: '!cancelled()'
+        env:
+          MAY_ARM: >-
+            ${{ github.actor == 'dependabot[bot]'
+            && steps.managed.outputs.has-upstream-managed == 'false' }}
+          # Not part of either decision — it only lets the log below say which of the two reasons kept
+          # this run from arming. A metadata action that is broken rather than merely unsatisfied
+          # otherwise looks exactly like an npm advisory, and nothing else in the run says so.
+          METADATA_ANSWERED: >-
+            ${{ steps.metadata.outputs.package-ecosystem != '' }}
+          SHOULD_BE_ARMED: >-
+            ${{ github.actor == 'dependabot[bot]'
+            && steps.managed.outputs.has-upstream-managed == 'false'
+            && steps.metadata.outputs.package-ecosystem == 'github_actions'
+            && (steps.metadata.outputs.update-type == 'version-update:semver-patch'
+            || steps.metadata.outputs.update-type == 'version-update:semver-minor') }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          # How hard the withdrawal tries before giving up, and what it says when it does. The delay
+          # is a variable so the unit test that runs this script can set it to zero; the workflow's
+          # own value is the one a runner uses.
+          RETRY_ATTEMPTS: '3'
+          RETRY_BACKOFF_SECONDS: '5'
+          # Two notices, because the run does not always know which happened. The first is posted when
+          # it read an armed pull request and could not disarm it; the second when it could not even
+          # read the state, where claiming the auto-merge is still armed would be an assertion nobody
+          # verified.
+          WITHDRAW_FAILED_NOTICE: >-
+            Auto-merge is enabled on this pull request and this workflow could not withdraw it. This
+            workflow is not a required check, so nothing here holds the merge back — please disable
+            auto-merge before the checks go green.
+          # Prefixed to the notice so a later run can recognize its own and not repeat it. The head it
+          # was written for is part of it: a repeat within one degraded window says nothing new, but a
+          # failure after the branch moved is a fresh incident and has to be reported again.
+          NOTICE_MARKER: '<!-- josh-auto-merge-withdrawal-failed'
+          WITHDRAW_UNKNOWN_NOTICE: >-
+            This workflow could not read or change the auto-merge state of this pull request, so it
+            may still be armed. This workflow is not a required check, so nothing here holds the
+            merge back — please check before the checks go green.
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Used on the state read, which both directions depend on, and on the withdrawal. Not on the
+          # arming call: a run that does not arm leaves the bump open for a human, while a run that
+          # does not withdraw leaves an auto-merge armed on a diff nobody re-approved — and this
+          # workflow is not a required check, so its red run does not hold that merge back
+          # (joshuafolkken/kit#846).
+          # Refused rather than defaulted: the loop's only exit compares against these, and a value
+          # that is not a whole number makes that comparison error instead of ending it — the loop
+          # would then spin with a widening sleep until the job's own timeout.
+          # A leading zero is refused along with the rest: `$((08))` is an invalid octal literal, and
+          # the arithmetic below would error into a backoff of zero rather than the one declared.
+          case "$RETRY_ATTEMPTS:$RETRY_BACKOFF_SECONDS" in
+            '' | *[!0-9:]* | :* | *: | *:*:* | 0[0-9]* | *:0[0-9]*)
+              echo 'RETRY_ATTEMPTS and RETRY_BACKOFF_SECONDS must be whole numbers.' >&2
+              exit 1
+              ;;
+          esac
+
+          retry() {
+            local attempt=1
+
+            while ! "$@"; do
+              if [ "$attempt" -ge "$RETRY_ATTEMPTS" ]; then
+                return 1
+              fi
+
+              sleep "$((attempt * RETRY_BACKOFF_SECONDS))"
+              attempt=$((attempt + 1))
+            done
+          }
+
+          # The answer is checked, not just the exit status: a call that succeeded while returning
+          # something other than `true` or `false` has not told us the state, and accepting it would
+          # skip the retries and land on a decision made from nothing.
+          read_armed() {
+            armed="$(gh pr view "$PR_URL" --json autoMergeRequest --jq '.autoMergeRequest != null')" ||
+              return 1
+
+            case "$armed" in
+              true | false) return 0 ;;
+            esac
+
+            return 1
+          }
+
+          # `unknown` rather than a failed step: which way an unreadable state should fall depends on
+          # the direction, and the branches below decide that for themselves. Assigned here rather
+          # than before the read, because a failed command substitution leaves the variable empty
+          # rather than untouched — there is nothing to fall back to.
+          if ! retry read_armed; then
+            armed=unknown
+            echo 'Could not read the auto-merge state.' >&2
+          fi
+
+          if [ "$SHOULD_BE_ARMED" = 'true' ]; then
+            if [ "$armed" = 'true' ]; then
+              echo 'Auto-merge is already enabled — nothing to do.'
+              exit 0
+            fi
+
+            # Arming on a state nobody could read is the one move that cannot be taken back later, so
+            # an unreadable state refuses rather than guesses.
+            if [ "$armed" != 'false' ]; then
+              echo 'Refusing to arm auto-merge without knowing the current state.' >&2
+              exit 1
+            fi
+
+            gh pr merge --auto --merge --match-head-commit "$HEAD_SHA" "$PR_URL"
+            exit 0
+          fi
+
+          if [ "$MAY_ARM" = 'true' ]; then
+            if [ "$METADATA_ANSWERED" = 'true' ]; then
+              echo 'This bump does not qualify for auto-merge — leaving the pull request as it is.'
+            else
+              echo 'The metadata step did not answer, so nothing about this bump could be verified.' >&2
+              echo 'Leaving the pull request as it is. Bumps will not arm until that step works.' >&2
+            fi
+
+            exit 0
+          fi
+
+          # `unknown` falls through to the withdrawal, not past it. Skipping it would leave an armed
+          # auto-merge nobody re-approved, and "I could not tell" is not evidence that there is
+          # nothing to take back.
+          #
+          # It is not free. Most pull requests on this path were never armed, so the attempt usually
+          # fails, and the run then leaves a notice saying the state could not be established — on a
+          # pull request that was fine. During a partial outage, where reads fail but comments still
+          # work, that is one notice per open bump. The trade is deliberate: a spurious notice asks
+          # someone to check something that turns out to be fine, while the silence it buys would let
+          # a genuinely armed auto-merge merge an unreviewed diff with nothing to read anywhere. The
+          # notice for this case says the state is unknown rather than claiming it is armed, which is
+          # the most either the run or the reader actually knows.
+          if [ "$armed" = 'false' ]; then
+            echo 'Auto-merge is not enabled — nothing to withdraw.'
+            exit 0
+          fi
+
+          if retry gh pr merge --disable-auto "$PR_URL"; then
+            exit 0
+          fi
+
+          # A lost response looks exactly like a failure, and the retry after it then fails for the
+          # honest reason that there is nothing left to disable. One more read tells those apart
+          # before anyone is asked to act — and it is the same read that resolves the case where the
+          # state was never legible: a pull request that turns out not to be armed needs no notice.
+          established=$armed
+
+          if retry read_armed; then
+            if [ "$armed" = 'false' ]; then
+              echo 'Auto-merge is not enabled after all — nothing was left armed.'
+              exit 0
+            fi
+          else
+            # The read assigns before it fails, so a failed confirmation would otherwise downgrade a
+            # state this run had positively read into `unknown` — and the notice would then say less
+            # than the run actually knows.
+            armed=$established
+          fi
+
+          # The retries are what handle a transient failure; this is what keeps a lasting one from
+          # being silent. It is not retracted when a later run succeeds where this one did not: the
+          # notice asks the reader to check the auto-merge state, and finding it already withdrawn is
+          # the cheap end of that. Editing it would mean reading and rewriting someone else's comment
+          # thread on every successful run, for a case the re-read above already narrows.
+          #
+          # It does not stop the merge — nothing here can, short of a repository setting every
+          # consumer would have to change — but it puts the reason where the person looking at the
+          # merged pull request will find it.
+          notice="$WITHDRAW_FAILED_NOTICE"
+          outcome=armed
+          if [ "$armed" != 'true' ]; then
+            notice="$WITHDRAW_UNKNOWN_NOTICE"
+            outcome=unknown
+          fi
+
+          # One notice per outcome per head. Re-running the job after a blip is the case this exists
+          # for; a marker naming only the pull request would silence every incident after the first,
+          # and one naming only the head would silence a re-run that learned more — "confirmed armed
+          # and not disarmed" is worth saying even where "state unknown" already stands.
+          #
+          # The reverse is not worth saying, so an `armed` notice covers an `unknown` one: a later run
+          # that could not read the state adds nothing to a standing notice that read it.
+          #
+          # The lookup retries on the same terms as everything else here. It cannot help in the one
+          # case where the state read itself never succeeded, because that is the same call against
+          # the same API — a lasting read outage duplicates the notice on each re-run, and a duplicate
+          # comment is the better mistake when the alternative is silence.
+          marker="$NOTICE_MARKER $HEAD_SHA $outcome -->"
+          covering="$NOTICE_MARKER $HEAD_SHA armed -->"
+
+          read_posted() {
+            posted="$(gh pr view "$PR_URL" --json comments --jq '.comments[].body')"
+          }
+
+          notice_stands() {
+            retry read_posted && printf '%s' "$posted" | grep -qF -e "$marker" -e "$covering"
+          }
+
+          # Re-checked only after a post that failed: a lost response leaves the comment there, and
+          # the next attempt would otherwise duplicate it.
+          post_notice() {
+            gh pr comment "$PR_URL" --body "$marker $notice" && return 0
+
+            notice_stands
+          }
+
+          if notice_stands; then
+            echo 'A notice about this failure is already on this pull request.' >&2
+            exit 1
+          fi
+
+          # Retried like everything else on this path: this call runs during the same outage that just
+          # defeated the withdrawal, and dropping the notice on its first failure would leave an armed
+          # auto-merge with nothing on the pull request to read.
+          retry post_notice ||
+            echo 'Could not leave a comment about the failed withdrawal either.' >&2
+
+          exit 1

package/tsconfig/base.json

@@ -0,0 +1,50 @@
+{
+	"compilerOptions": {
+		"strict": true,
+		// tsx uses bundler-like resolution; "bundler" is the correct pairing for module:ESNext
+		"moduleResolution": "bundler",
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+
+		// Strictness
+		// Treat unused local variables as errors
+		"noUnusedLocals": true,
+		// Treat unused function parameters as errors
+		"noUnusedParameters": true,
+
+		// Disallow unused labels
+		"allowUnusedLabels": false,
+		// Disallow unreachable code
+		"allowUnreachableCode": false,
+
+		// Disallow fallthrough in switch statements
+		"noFallthroughCasesInSwitch": true,
+		// Require all code paths in a function to have an explicit return
+		"noImplicitReturns": true,
+
+		// Ensure each file can be safely transpiled independently (e.g. with Babel)
+		"isolatedModules": true,
+		// Require the override keyword when overriding methods
+		"noImplicitOverride": true,
+
+		// Strictly distinguish between optional properties and undefined
+		"exactOptionalPropertyTypes": true,
+		// Include undefined in index access results
+		"noUncheckedIndexedAccess": true,
+		// Disallow dot notation for index signature types
+		"noPropertyAccessFromIndexSignature": true,
+
+		// Preserve import/export syntax as-is and enforce explicit type-only imports
+		"verbatimModuleSyntax": true,
+		// Do not emit output files if type errors are present
+		"noEmitOnError": true,
+		// Use the ES2022 class fields spec
+		"useDefineForClassFields": true,
+
+		// Check side-effect-only imports (imports used only for types)
+		"noUncheckedSideEffectImports": true
+	}
+}

package/tsconfig.sonar.json

@@ -0,0 +1,34 @@
+{
+	"compilerOptions": {
+		"target": "ES2020",
+		"module": "ES2020",
+		"lib": ["ES2020", "DOM", "DOM.Iterable"],
+		"moduleResolution": "node",
+		"allowImportingTsExtensions": false,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"noUncheckedIndexedAccess": true,
+		"noImplicitOverride": true,
+		"noUnusedLocals": true,
+		"noUnusedParameters": true,
+		"exactOptionalPropertyTypes": true,
+		"noFallthroughCasesInSwitch": true,
+		"noImplicitReturns": true,
+		"noPropertyAccessFromIndexSignature": true,
+		"allowUnusedLabels": false,
+		"allowUnreachableCode": false,
+		"isolatedModules": true,
+		"paths": {
+			"$lib": ["./src/lib"],
+			"$lib/*": ["./src/lib/*"]
+		}
+	},
+	"include": ["src/**/*.js", "src/**/*.ts", "src/**/*.svelte", "scripts/**/*.ts"],
+	"exclude": ["node_modules", "build", ".svelte-kit"]
+}