@tollwyn/baukasten 1.3.3 → 2.0.0

package/README.md

@@ -7,11 +7,11 @@ A product builds its core and nothing of this.
 
 ## Set up a product
 
-A product is a SvelteKit 2 app with `@sveltejs/adapter-node` 5 and Svelte 5, tested with Playwright.
+A product is a SvelteKit 3 app with `@sveltejs/adapter-node` 6 and Svelte 5, tested with Playwright.
 
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
-npm install --save-dev @sveltejs/adapter-node@5 @playwright/test smtp-server
+npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
 npx --no-install baukasten-stubs
 # fill in what the product owns (below)
 npx --no-install baukasten-check
@@ -42,9 +42,17 @@ them: `baukasten.config.ts`, `src/app.css`, `src/lib/server/baukasten.ts` and
 - `src/lib/server/handle.ts`: its own handle, after the baukasten's.
 - Its own pages. Their links to other pages go through `useLink` of `/ui`, else the referral tag
   `?via=` is lost on the way to the sign-up.
+- `package.json`, whose `imports` map `"#lib/*"` to `"./src/lib/*"`, as `npx sv create` sets it
+  up: the stubs import `src/lib/server/` through it.
 - `vite.config.ts`, passing the options of the baukasten to SvelteKit:
   `sveltekit({ ...SVELTEKIT_OPTIONS, adapter: adapter() })`, with `SVELTEKIT_OPTIONS` from
-  `@tollwyn/baukasten`. No page is prerendered.
+  `@tollwyn/baukasten`. No page is prerendered, and there is no `paths.origin`, which would build
+  one origin into the image.
+- Its addresses, from `PUBLIC_ORIGIN` (`config.publicOrigin` of `kit.context()`), never from
+  `event.url`: adapter-node takes the origin of a request from its `host` header, with https, and
+  only `PUBLIC_ORIGIN` is the product's own.
+- The redirect to Checkout: the address `kit.billing.checkout` gives is Stripe's, so the product
+  passes `{ external: true }` to `redirect`.
 - `migrations/`: its tables in the schema `public`, plain SQL, forward-only and expanding (the
   previous version must run against the new schema). Every table that holds data of an account
   points at it with `REFERENCES baukasten.accounts (id) ON DELETE CASCADE`. It reads the tables of
@@ -94,11 +102,11 @@ it. `muster/` shows all of it with Tailwind CSS 4, Skeleton and a font from font
 
 `baukasten-check` runs in the root of the product, before its gate, against the installed version:
 the stubs are there and unchanged, `deploy/auslieferung.json` names the webhook and the rights of
-the baukasten, SvelteKit and Svelte fit its peer ranges and adapter-node is version 5, `overrides`
-in `package.json` replaces nothing the baukasten depends on, no migration of the product names the
-schema `baukasten` beyond its references to `baukasten.accounts`, and the configuration and
-`SVELTEKIT_OPTIONS` are in place. Exit 0 when the product fits; else exit 1 with one line per
-problem.
+the baukasten, SvelteKit and Svelte fit its peer ranges and adapter-node is version 6, `overrides`
+in `package.json` replaces nothing the baukasten depends on and its `imports` map `#lib/*`, no
+migration of the product names the schema `baukasten` beyond its references to
+`baukasten.accounts`, and the configuration and `SVELTEKIT_OPTIONS` are in place. Exit 0 when the
+product fits; else exit 1 with one line per problem.
 
 `e2e/baukasten.spec.ts` runs the connection test in the gate of the product, against the built
 product with the doubles of Stripe and mail: sign-up with a referral tag, mail and confirmation,
@@ -111,8 +119,8 @@ with `npx playwright test -g "the connection of the baukasten"`.
 
 A Shopify app built on this kit is a public app in the Shopify App Store, embedded in the admin of
 each store that installs it. Shopify installs it (managed installation) and bills it (Shopify App
-Pricing); the merchant never signs up or pays anywhere else. It is a SvelteKit 2 app with
-`@sveltejs/adapter-node` 5 and Svelte 5, tested with Playwright, like a web app, and on the same
+Pricing); the merchant never signs up or pays anywhere else. It is a SvelteKit 3 app with
+`@sveltejs/adapter-node` 6 and Svelte 5, tested with Playwright, like a web app, and on the same
 server; the accounts, Stripe and the legal pages of a web app are not part of it.
 
 What the baukasten brings for it: the installation with the token exchange and expiring offline
@@ -129,7 +137,7 @@ connection test among them.
 
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
-npm install --save-dev @sveltejs/adapter-node@5 @playwright/test smtp-server
+npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
 npx --no-install baukasten-stubs shopify
 # fill in what the app owns (below)
 npx --no-install baukasten-check
@@ -183,7 +191,8 @@ missing, it writes the files the app owns as a starting point: `baukasten.config
 - Runs: `periodic` with the work mark, as in a web app; a run asks the Admin API of a store with
   `kit.admin(domain)` and skips a store that is gone.
 - `vite.config.ts`: `sveltekit({ ...SHOPIFY_SVELTEKIT_OPTIONS, adapter: adapter() })`, with
-  `SHOPIFY_SVELTEKIT_OPTIONS` from `@tollwyn/baukasten`. No page is prerendered.
+  `SHOPIFY_SVELTEKIT_OPTIONS` from `@tollwyn/baukasten`. No page is prerendered. The `imports` of
+  `package.json` and the addresses from `PUBLIC_ORIGIN` as in a web app.
 - `migrations/`: its tables in the schema `public`, forward-only and expanding. Every table that
   holds data of a store points at it with `REFERENCES baukasten.shops (domain) ON DELETE CASCADE`:
   so `shop/redact` deletes them with the store.
@@ -254,3 +263,55 @@ the baukasten do:
 - Loss and incidents: on a breach the operator stops the app through the delivery service, finds what
   was reached from the logs, and tells the stores concerned by email without undue delay, as the
   privacy text promises.
+
+# From 1.x to 2.0
+
+2.0 moves the baukasten to SvelteKit 3 and adapter-node 6, and to version 23 of the SDK of Stripe.
+Its pages, mails, legal texts, variables and migrations stay as they were: a product needs no new
+variable, and its database stays as it is. A product on 1.x keeps running as it is; it takes 2.0 in
+one change, a web app and a Shopify app alike:
+
+1. `npm install --save-exact @tollwyn/baukasten@<version>`, a version from 2.0.0 on, and
+   `npm install --save-dev @sveltejs/kit@3 @sveltejs/adapter-node@6`, with what SvelteKit 3 needs:
+   Vite 8, `@sveltejs/vite-plugin-svelte` 7, TypeScript 6 and Svelte from 5.57.1 on.
+2. The product's own code after the guide of SvelteKit,
+   https://svelte.dev/docs/kit/migrating-to-sveltekit-3 (`npx sv migrate sveltekit-3` does much of
+   it). What a product of the baukasten meets there:
+   - `$lib` becomes `#lib`, imported with the extension of the module (`#lib/texts.js`), and
+     `package.json` maps `"#lib/*": "./src/lib/*"` in `imports`.
+   - `tsconfig.json` extends `$app/tsconfig` and names its own `include`; a `types` of its own names
+     `$app/types` as well.
+   - `$app/environment` becomes `$app/env`, and `$app/stores` is gone (`$app/state`).
+   - The types of the hooks, `Handle` among them, come from `@sveltejs/kit/hooks`.
+   - `redirect` to another origin takes `{ external: true }`: the redirect to the address of
+     `kit.billing.checkout` too.
+   - `error(status, message)` takes the message as a string, further fields as a third argument.
+3. `npx --no-install baukasten-stubs` writes the stubs of 2.0, `npx --no-install baukasten-stubs
+   shopify` those of a Shopify app. The product's own `src/lib/server/handle.ts` takes `Handle`
+   from `@sveltejs/kit/hooks`.
+4. An override of `cookie` goes, where the product has one: SvelteKit 3 brings `cookie` 2, which
+   GHSA-pxg6-pf52-xh8x does not reach.
+5. `npx --no-install baukasten-check`, then the gate of the product.
+
+What changes when it runs:
+
+- adapter-node 6 reads no `ORIGIN`, and the server of the baukasten sets none: adapter-node takes
+  the origin of a request from its `host` header, with https. `PUBLIC_ORIGIN` stays the origin of
+  every address the baukasten makes and the one its check of unsafe requests compares with; the
+  product makes its own addresses from it, not from `event.url`, which says https on a local server
+  over http too.
+- The `handleError` of the baukasten gets every error now, those of `error()` too: it leaves them as
+  they are, and logs the others as before.
+- An enhanced form answers with the status of `fail()`, and one that posts to another page goes
+  there, as without JavaScript.
+- adapter-node 6 bundles the baukasten into `build/`, as a library of Svelte, and its dependencies
+  with it. The image still carries the production `node_modules`: `server.js` and the migration
+  load the baukasten from there.
+- adapter-node 6 serves the files of the build only, and only to `GET` and `HEAD`.
+- Stripe answers the baukasten in its API version `2026-09-30.endive`; the payload of a webhook
+  keeps the version of its endpoint, as before.
+
+What changes in the package: `@sveltejs/kit` is a peer from 3.1.0 on, and `baukasten-check` wants
+adapter-node 6 and the `imports` of `#lib`. `init`, `handle` and `handleError` of `Kit` and
+`ShopifyKit` take the types of SvelteKit 3. `SVELTEKIT_OPTIONS` and `SHOPIFY_SVELTEKIT_OPTIONS` hold
+the same options as before, typed against `Config` of `@sveltejs/kit/vite`.

package/dist/check.js

@@ -34,14 +34,19 @@ const SHOPIFY_ANGABE = z.looseObject({
 /** Words the review of the App Store refuses in an address of an app. */
 const REFUSED_IN_ADDRESS = ['shopify', 'example'];
 const ART = z.looseObject({ art: z.literal('shopify') });
-const PACKAGE = z.looseObject({ overrides: z.record(z.string(), z.unknown()).optional() });
+const PACKAGE = z.looseObject({
+    overrides: z.record(z.string(), z.unknown()).optional(),
+    imports: z.record(z.string(), z.unknown()).optional()
+});
+/** The alias the stubs import the product's src/lib by, as SvelteKit sets it up. */
+const LIB_IMPORT = { key: '#lib/*', target: './src/lib/*' };
 const PEER = z.looseObject({ version: z.string() });
 /**
- * What the product builds with, checked like a peer: adapter-node 6 no longer reads ORIGIN, which the
- * server of the baukasten sets from PUBLIC_ORIGIN. It is no peer, since only the build needs it, and
- * npm keeps a peer of a dependency in the image.
+ * What the product builds with, checked like a peer: adapter-node 5 cannot build SvelteKit 3, and the
+ * handler the stub server.js wraps, with its event at shutdown, is that of one major. It is no peer,
+ * since only the build needs it, and npm keeps a peer of a dependency in the image.
  */
-const BUILT_WITH = { '@sveltejs/adapter-node': '^5.0.0' };
+const BUILT_WITH = { '@sveltejs/adapter-node': '^6.0.0' };
 /**
  * A reference to an account of a web app or a shop of a Shopify app: the one way a migration of the
  * product names the schema baukasten.
@@ -212,7 +217,7 @@ function packageProblems(files, baukasten) {
     const parsed = json(text);
     const manifest = parsed.kind === 'json' ? PACKAGE.safeParse(parsed.value) : null;
     if (manifest === null || !manifest.success) {
-        return ['package.json is no JSON object, or its overrides are no object'];
+        return ['package.json is no JSON object, or its overrides or imports are no object'];
     }
     const own = new Set([
         baukasten.name,
@@ -220,7 +225,11 @@ function packageProblems(files, baukasten) {
         ...Object.keys(baukasten.peerDependencies)
     ]);
     const names = [...new Set(overridden(manifest.data.overrides))].filter((name) => own.has(name));
-    return names.map((name) => `package.json overrides ${name}, which the baukasten brings itself; remove it`);
+    const problems = names.map((name) => `package.json overrides ${name}, which the baukasten brings itself; remove it`);
+    if (manifest.data.imports?.[LIB_IMPORT.key] !== LIB_IMPORT.target) {
+        problems.push(`package.json does not map imports "${LIB_IMPORT.key}" to "${LIB_IMPORT.target}", which the stubs import from`);
+    }
+    return problems;
 }
 function migrationProblems(files, art) {
     // Like the migration: every entry read, a folder failing loudly, then the .sql files.

package/dist/server/core.d.ts

@@ -1,4 +1,5 @@
-import type { Handle, HandleServerError, RequestEvent, ServerInit } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Handle, HandleServerError, ServerInit } from '@sveltejs/kit/hooks';
 import type { Language } from '../product.js';
 import { type Art } from './adapter/migrate.js';
 import { type Mail } from './config.js';
@@ -68,7 +69,7 @@ export interface CoreSpec<C extends CoreConfig, S> {
 export interface Core<C, S> {
     /**
      * The `init` of the hooks. SvelteKit runs it in `vite build` too, to prerender pages, with
-     * `building` of `$app/environment` set: then it reads nothing and opens nothing, since the image is
+     * `building` of `$app/env` set: then it reads nothing and opens nothing, since the image is
      * built without a single variable.
      */
     init: (building: boolean) => ServerInit;

package/dist/server/core.js

@@ -152,17 +152,26 @@ export function serverCore(spec) {
             });
         }
     };
-    const handleError = ({ error, event, status, message }) => {
-        // An unknown path is already in the request log.
-        if (status === 404)
-            return { message };
-        (status >= 500 ? log.error : log.warn)('request failed', {
-            method: event.request.method,
-            path: event.url.pathname,
-            status,
-            error
-        });
-        return { message: status >= 500 ? 'Internal Error' : message };
+    // SvelteKit passes every error here; what a page shows of it stays SvelteKit's: the message of
+    // error(), its own safe message, or "Internal Error".
+    const handleError = (caught) => {
+        const request = { method: caught.event.request.method, path: caught.event.url.pathname };
+        switch (caught.kind) {
+            // The product raised it with error(), and its page says it.
+            case 'app':
+                return;
+            case 'framework':
+            case 'validation': {
+                const { status } = caught.error;
+                // An unknown path is already in the request log.
+                if (status !== 404)
+                    log.warn('request failed', { ...request, status, error: caught.error });
+                return;
+            }
+            case 'unknown':
+                log.error('request failed', { ...request, status: 500, error: caught.error });
+                return;
+        }
     };
     return { init, handle, handleError, running };
 }

package/dist/server/hook.d.ts

@@ -1,4 +1,5 @@
-import type { Handle, HandleServerError, RequestEvent, ServerInit } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Handle, HandleServerError, ServerInit } from '@sveltejs/kit/hooks';
 import type { z } from 'zod';
 import type { Product, ProductEnv } from '../product.js';
 import { type Account } from './accounts.js';
@@ -55,7 +56,7 @@ export interface Hooks<E extends ProductEnv = ProductEnv> {
 export interface Kit<E extends ProductEnv = ProductEnv> {
     /**
      * The `init` of the hooks. SvelteKit runs it in `vite build` too, to prerender pages, with
-     * `building` of `$app/environment` set: then it reads nothing and opens nothing, since the image is
+     * `building` of `$app/env` set: then it reads nothing and opens nothing, since the image is
      * built without a single variable.
      */
     init(building: boolean): ServerInit;
@@ -85,7 +86,8 @@ export interface Kit<E extends ProductEnv = ProductEnv> {
     billing: {
         /**
          * A Checkout page for a price of the catalog, by its lookup key: a subscription, or a purchase.
-         * An account with a running subscription gets none; the customer portal changes it.
+         * An account with a running subscription gets none; the customer portal changes it. Its
+         * address is Stripe's: `redirect` takes it with `{ external: true }`.
          */
         checkout(account: Account, order: Order): Promise<CheckoutPage>;
         /** The customer portal of the account, which leads back to the path `back`. */

package/dist/server/pages.js

@@ -471,7 +471,8 @@ export function createPages(services) {
                     const account = requireAccount(event);
                     if (!(await s.billing.hasCustomer(account.id)))
                         redirect(303, '/account');
-                    redirect(303, await s.billing.portal(account, '/account'));
+                    // The address of the portal comes from Stripe.
+                    redirect(303, await s.billing.portal(account, '/account'), { external: true });
                 },
                 delete: async (event) => {
                     const s = services();

package/dist/server/start.js

@@ -23,12 +23,6 @@ export async function serve(load, headers) {
         log.error('unhandled rejection', { error });
         void exitAfterLog(1);
     });
-    // adapter-node reads ORIGIN while it loads. An invalid PUBLIC_ORIGIN stays for the configuration,
-    // which names it with every other problem in one line.
-    const publicOrigin = process.env.PUBLIC_ORIGIN?.trim();
-    if (publicOrigin !== undefined && URL.canParse(publicOrigin)) {
-        process.env.ORIGIN = new URL(publicOrigin).origin;
-    }
     let handler;
     try {
         // Loading runs `init`, which reads the configuration and starts the product.

package/dist/shopify/adapter/shopify.js

@@ -38,7 +38,9 @@ const GRAPHQL = z.object({
 const SHOP_INFO = z.object({
     shop: z.object({
         id: z.string().startsWith('gid://shopify/Shop/'),
-        email: z.string(),
+        // The mail about the data of a customer goes here, and the mailer would send it to every
+        // address it reads out of a list.
+        email: z.email(),
         plan: z.object({ partnerDevelopment: z.boolean() })
     }),
     currentAppInstallation: z.object({
@@ -200,8 +202,11 @@ export function shopifyApi(config, options) {
                     throw new ShopifyFailed(`the Admin API refused: ${answer.errors.map((error) => error.code ?? error.message).join(', ')}`);
                 case 'data': {
                     const info = SHOP_INFO.safeParse(answer.data);
-                    if (!info.success)
-                        throw new ShopifyFailed('the shop came in an unknown form');
+                    if (!info.success) {
+                        // The fields name what did not hold; their values stay out of the log.
+                        const fields = info.error.issues.map((issue) => issue.path.join('.') || 'the answer');
+                        throw new ShopifyFailed(`the shop came in an unknown form: ${fields.join(', ')}`);
+                    }
                     return {
                         shopId: info.data.shop.id,
                         appId: info.data.currentAppInstallation.app.id,

package/dist/shopify/hook.d.ts

@@ -1,4 +1,4 @@
-import type { Handle, HandleServerError, ServerInit } from '@sveltejs/kit';
+import type { Handle, HandleServerError, ServerInit } from '@sveltejs/kit/hooks';
 import type { ProductEnv } from '../product.js';
 import type { Limits } from '../server/limits.js';
 import type { Log } from '../server/log.js';
@@ -40,7 +40,7 @@ export interface ShopifyHooks<E extends ProductEnv = ProductEnv> extends Webhook
 export interface ShopifyKit<E extends ProductEnv = ProductEnv> {
     /**
      * The `init` of the hooks. SvelteKit runs it in `vite build` too, with `building` of
-     * `$app/environment` set: then it reads nothing and opens nothing.
+     * `$app/env` set: then it reads nothing and opens nothing.
      */
     init(building: boolean): ServerInit;
     handle: Handle;

package/dist/stubs.js

@@ -1,6 +1,4 @@
 import { APP_BRIDGE_URL, COMPLIANCE_TOPICS, POLARIS_URL, SHOPIFY_API_VERSION, SHOPIFY_AUTH_PATH, SHOPIFY_WEBHOOK_PATH } from './shopify/constants.js';
-/** The alias of src/lib in the product: written out in an import here, svelte-package would resolve it. */
-const LIB = '$lib';
 const PAGES = [
     {
         route: 'account',
@@ -63,7 +61,7 @@ const PAGES = [
     }
 ];
 function serverPart(page) {
-    return `import { kit } from '${LIB}/server/baukasten';
+    return `import { kit } from '#lib/server/baukasten.js';
 
 export const { ${page.server.join(', ')} } = kit.pages.${page.pages};
 `;
@@ -98,16 +96,16 @@ await start(() => import('./build/handler.js'));
 </html>
 `,
     'src/hooks.server.ts': `// The hooks of a product: the baukasten first, then the product's own handle.
-import { building } from '$app/environment';
+import { building } from '$app/env';
 import { sequence } from '@sveltejs/kit/hooks';
-import { kit } from '${LIB}/server/baukasten';
-import { handle as own } from '${LIB}/server/handle';
+import { kit } from '#lib/server/baukasten.js';
+import { handle as own } from '#lib/server/handle.js';
 
 export const init = kit.init(building);
 export const handle = sequence(kit.handle, own);
 export const handleError = kit.handleError;
 `,
-    'src/routes/+layout.server.ts': `import { kit } from '${LIB}/server/baukasten';
+    'src/routes/+layout.server.ts': `import { kit } from '#lib/server/baukasten.js';
 
 export const { load } = kit.pages.layout;
 `,
@@ -179,7 +177,7 @@ import product from '../../../baukasten.config';
 export const kit = baukasten(product);
 `,
     'src/lib/server/handle.ts': `// The product's own handle, after that of the baukasten (src/hooks.server.ts).
-import type { Handle } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
 
 export const handle: Handle = ({ event, resolve }) => resolve(event);
 `
@@ -208,10 +206,10 @@ await start(() => import('./build/handler.js'));
 </html>
 `,
     'src/hooks.server.ts': `// The hooks of a Shopify app: the baukasten first, then the app's own handle.
-import { building } from '$app/environment';
+import { building } from '$app/env';
 import { sequence } from '@sveltejs/kit/hooks';
-import { kit } from '${LIB}/server/baukasten';
-import { handle as own } from '${LIB}/server/handle';
+import { kit } from '#lib/server/baukasten.js';
+import { handle as own } from '#lib/server/handle.js';
 
 export const init = kit.init(building);
 export const handle = sequence(kit.handle, own);
@@ -280,7 +278,7 @@ import app from '../../../baukasten.config';
 export const kit = shopifyBaukasten(app);
 `,
     'src/lib/server/handle.ts': `// The app's own handle, after that of the baukasten (src/hooks.server.ts).
-import type { Handle } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
 
 export const handle: Handle = ({ event, resolve }) => resolve(event);
 `

package/dist/testing/stripe.js

@@ -164,7 +164,7 @@ export async function startStripe(options = {}) {
             const payload = JSON.stringify({
                 id: sendOptions.id ?? next('evt'),
                 object: 'event',
-                api_version: '2026-08-26.dahlia',
+                api_version: '2026-09-30.endive',
                 created: Math.floor(Date.now() / 1_000),
                 livemode: false,
                 type,

package/dist/variables.d.ts

@@ -16,10 +16,7 @@ export type ShopifyStandardVariable = (typeof SHOPIFY_STANDARD_VARIABLES)[number
  * without, its .env.example may name them, and none takes one for its own.
  */
 export declare const RETIRED_VARIABLES: readonly ["HOSTING_LOCATION"];
-/**
- * Every variable the baukasten reads in a web app. NODE_ENV comes from the image, and the server sets
- * ORIGIN from PUBLIC_ORIGIN.
- */
+/** Every variable the baukasten reads in a web app. NODE_ENV comes from the image. */
 export declare const WEBAPP_VARIABLES: readonly ["PUBLIC_ORIGIN", "PORT", "DATABASE_URL", "SMTP_HOST", "SMTP_PORT", "MAIL_FROM", "MAIL_FROM_NAME", "OPERATOR_NAME", "OPERATOR_ADDRESS", "OPERATOR_REGISTER", "OPERATOR_VAT", "OPERATOR_JURISDICTION", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "VERTRIEB_TOKEN", "LOG_LEVEL", "TEST_DATABASE_URL", "STRIPE_API_BASE"];
 export declare const SHOPIFY_VARIABLES: readonly ["PUBLIC_ORIGIN", "PORT", "DATABASE_URL", "SMTP_HOST", "SMTP_PORT", "MAIL_FROM", "MAIL_FROM_NAME", "OPERATOR_NAME", "OPERATOR_ADDRESS", "VERTRIEB_TOKEN", "SHOPIFY_API_SECRET", "SHOPIFY_TOKEN_KEY", "SHOPIFY_PARTNER_TOKEN", "SHOPIFY_PARTNER_ORG", "LOG_LEVEL", "TEST_DATABASE_URL", "SHOPIFY_API_BASE", "SHOPIFY_CLIENT_ID"];
 /**

package/dist/variables.js

@@ -45,10 +45,7 @@ export const SHOPIFY_STANDARD_VARIABLES = [
  * without, its .env.example may name them, and none takes one for its own.
  */
 export const RETIRED_VARIABLES = ['HOSTING_LOCATION'];
-/**
- * Every variable the baukasten reads in a web app. NODE_ENV comes from the image, and the server sets
- * ORIGIN from PUBLIC_ORIGIN.
- */
+/** Every variable the baukasten reads in a web app. NODE_ENV comes from the image. */
 export const WEBAPP_VARIABLES = [
     ...STANDARD_VARIABLES,
     'LOG_LEVEL',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tollwyn/baukasten",
-	"version": "1.3.3",
+	"version": "2.0.0",
 	"description": "What every product built on this kit shares: configuration, log and server, database with two-layer migrations, health, accounts with sessions and API keys, limits, mail, payment through Stripe, the numbers for sales, the frame and pages, the stubs that hang them into a product and the check of a product, and the tools to test one, its connection test among them; and for a Shopify app its installation with tokens, the frame of the admin, its webhooks, its plan through the Partner API and its privacy text.",
 	"license": "UNLICENSED",
 	"type": "module",
@@ -56,22 +56,22 @@
 		"check:version": "node scripts/npm-version.ts"
 	},
 	"peerDependencies": {
-		"@sveltejs/kit": "^2.70.0",
-		"svelte": "^5.57.0"
+		"@sveltejs/kit": "^3.1.0",
+		"svelte": "^5.57.1"
 	},
 	"dependencies": {
-		"nodemailer": "10.1.1",
+		"nodemailer": "10.1.4",
 		"pg": "8.23.1",
 		"smol-toml": "1.9.1",
-		"stripe": "22.6.2",
+		"stripe": "23.0.0",
 		"zod": "4.6.7"
 	},
 	"devDependencies": {
 		"@eslint-community/eslint-plugin-eslint-comments": "4.8.1",
 		"@eslint/js": "10.0.1",
-		"@playwright/test": "1.64.0",
-		"@sveltejs/kit": "2.70.3",
-		"@sveltejs/package": "2.5.8",
+		"@playwright/test": "1.64.1",
+		"@sveltejs/kit": "3.1.0",
+		"@sveltejs/package": "3.0.1",
 		"@sveltejs/vite-plugin-svelte": "7.3.1",
 		"@types/node": "24.19.2",
 		"@types/pg": "8.23.1",
@@ -82,15 +82,12 @@
 		"globals": "17.13.0",
 		"prettier": "3.9.10",
 		"prettier-plugin-svelte": "4.1.1",
-		"smtp-server": "3.19.22",
+		"smtp-server": "3.19.24",
 		"svelte": "5.57.2",
 		"svelte-check": "4.7.6",
 		"typescript": "6.0.3",
 		"typescript-eslint": "8.71.2",
 		"vite": "8.3.4",
 		"vitest": "5.0.4"
-	},
-	"overrides": {
-		"cookie": "0.7.0"
 	}
 }