@tollwyn/baukasten 2.0.1 → 3.0.0

package/README.md

@@ -12,6 +12,7 @@ A product is a SvelteKit 3 app with `@sveltejs/adapter-node` 6 and Svelte 5, tes
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
 npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
+npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
 npx --no-install baukasten-stubs
 # fill in what the product owns (below)
 npx --no-install baukasten-check
@@ -57,6 +58,8 @@ them: `baukasten.config.ts`, `src/app.css`, `src/lib/server/baukasten.ts` and
   previous version must run against the new schema). Every table that holds data of an account
   points at it with `REFERENCES baukasten.accounts (id) ON DELETE CASCADE`. It reads the tables of
   the baukasten only through its functions and never changes them.
+- `eslint.config.js`, `knip.config.ts`, `tsconfig.json` and the script `gate` of `package.json`, as
+  «The gate» below says.
 - `.env.example`, naming every variable without a value (`envExampleProblems` of `/testing`).
 - `playwright.config.ts` with `testDir: 'e2e'` and `TEST_DATABASE_URL`, a Postgres server on which the
   tests create their databases. It sets the variables the configuration of the product requires in
@@ -98,15 +101,79 @@ it. `muster/` shows all of it with Tailwind CSS 4, Skeleton and a font from font
   `src/app.css`, which Vite bundles (a small font inlined as `data:`, which the policy allows), and
   pictures in `static/` or the product's code. Nothing from another server: the policy refuses it.
 
+## The gate
+
+`npm run gate` is the gate of the product, which its workflow runs. What lints in it is the
+baukasten's, and `baukasten-check` holds it:
+
+- `eslint.config.js` spreads the config of `@tollwyn/baukasten/eslint` first and adds the product's
+  own rules on top:
+
+  ```js
+  import baukasten from '@tollwyn/baukasten/eslint';
+
+  export default [...baukasten];
+  ```
+
+  The config lints every file with types: the type-checked rules of typescript-eslint
+  (`recommendedTypeChecked`), Svelte's recommended rules for the components, and a reason after
+  `--` in every comment that turns a rule off, as in `@ts-expect-error`. A component, a universal
+  load function, hook or matcher and the service worker import nothing of `/server`, `/shopify` or
+  `/testing` but types. It sets no rule of formatting, so Prettier needs no config beside it. The
+  product's config turns no rule off, and never names `@typescript-eslint/no-floating-promises`,
+  `@typescript-eslint/no-misused-promises`, `@typescript-eslint/ban-ts-comment`,
+  `@eslint-community/eslint-comments/require-description` or `disableTypeChecked`: a promise nobody
+  awaits loses its error, `@ts-nocheck` and `@ts-ignore` take code out of the type check, and a rule
+  turned off without its reason hides why. Where a rule must stay off at one place, the comment
+  there says why. Imports of its own a product restricts with ESLint's `no-restricted-imports`:
+  `@typescript-eslint/no-restricted-imports` would replace the config's for the same files.
+
+- `knip.config.ts` spreads the preset of `@tollwyn/baukasten/knip`, which knows the routes, the
+  stubs, the connection test and what the baukasten loads, and adds what is the product's own:
+
+  ```ts
+  import baukasten from '@tollwyn/baukasten/knip';
+  import type { KnipConfig } from 'knip';
+
+  export default { ...baukasten } satisfies KnipConfig;
+  ```
+
+  It sets no `rules`, `include` or `exclude`, and no other configuration of knip lies beside it
+  (`knip.json` and the like, or `knip` in `package.json`): knip finds unused files, exports and
+  dependencies. The preset reads the configuration of Playwright without running it; what that
+  loads besides its tests (`globalSetup`, a `webServer`, a reporter of its own) the product adds to
+  `playwright.entry`.
+
+- The script `gate` runs `svelte-check --tsconfig ./tsconfig.json --fail-on-warnings` (without
+  `--tsconfig`, svelte-check reports nothing of the TypeScript files),
+  `eslint . --config eslint.config.js --max-warnings 0` (with `--config`, an `eslint.config.js` in a
+  folder below takes no files from it) and `knip`, each exactly so, after `svelte-kit sync`, which
+  writes the types all three read: in itself or in a script it runs with `npm run`, among commands
+  joined by `&&` and nothing else, since `;`, `||`, `|` or `&` could let a failure pass. The
+  `compilerOptions` that `vite.config.ts` passes to `sveltekit()` set no `warningFilter`:
+  svelte-check compiles with them and would not see the warnings it filters. One warning at its
+  place a `svelte-ignore` comment silences.
+
+- `tsconfig.json` sets `strict` and `noUncheckedIndexedAccess` to `true` in its own
+  `compilerOptions` and turns off no part of `strict`. Its `include` names `src`, `e2e` and the
+  TypeScript in the root (`*.ts`), and not the JavaScript in the root: the config lints that through
+  a project of its own, with the same options, and typescript-eslint refuses a file that is in both.
+
+ESLint, knip and the plugins the config imports are dev dependencies of the product, installed with
+the third command above, and `baukasten-check` holds their versions. They are neither dependencies
+nor peers of the baukasten: npm puts every dependency and every peer of a dependency into the image
+of the product, and these have no business there.
+
 ## The check and the connection test
 
 `baukasten-check` runs in the root of the product, before its gate, against the installed version:
 the stubs are there and unchanged, `deploy/auslieferung.json` names the webhook and the rights of
-the baukasten, SvelteKit and Svelte fit its peer ranges and adapter-node is version 6, `overrides`
-in `package.json` replaces nothing the baukasten depends on and its `imports` map `#lib/*`, no
-migration of the product names the schema `baukasten` beyond its references to
-`baukasten.accounts`, and the configuration and `SVELTEKIT_OPTIONS` are in place. Exit 0 when the
-product fits; else exit 1 with one line per problem.
+the baukasten, SvelteKit and Svelte fit its peer ranges, adapter-node is version 6 and ESLint, knip
+and the plugins of the config are in their versions, `overrides` in `package.json` replaces nothing
+the baukasten depends on and its `imports` map `#lib/*`, no migration of the product names the
+schema `baukasten` beyond its references to `baukasten.accounts`, the configuration and
+`SVELTEKIT_OPTIONS` are in place, and the gate is as above. Exit 0 when the product fits; else exit
+1 with one line per problem. It reads these files and runs none of them.
 
 `e2e/baukasten.spec.ts` runs the connection test in the gate of the product, against the built
 product with the doubles of Stripe and mail: sign-up with a referral tag, mail and confirmation,
@@ -138,6 +205,7 @@ connection test among them.
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
 npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
+npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
 npx --no-install baukasten-stubs shopify
 # fill in what the app owns (below)
 npx --no-install baukasten-check
@@ -197,6 +265,7 @@ missing, it writes the files the app owns as a starting point: `baukasten.config
   holds data of a store points at it with `REFERENCES baukasten.shops (domain) ON DELETE CASCADE`:
   so `shop/redact` deletes them with the store.
 - `.env.example` (`envExampleProblems` of `/testing`) and `playwright.config.ts`, as in a web app.
+- The gate, as a web app's («The gate»).
 - The image: as a web app's, with `shopify.app.toml` in its root as well.
 - `deploy/auslieferung.json`: version 2, `art: shopify`, `name`, `subdomain` (without `shopify` or
   `example`, which the review refuses in an address), the migration
@@ -264,6 +333,69 @@ the baukasten do:
   was reached from the logs, and tells the stores concerned by email without undue delay, as the
   privacy text promises.
 
+# From 2.x to 3.0
+
+3.0 holds the gate of a product: `baukasten-check` fails until the product lints with the config and
+the preset of the baukasten, and its entries export less (below). Its pages, mails, legal texts,
+variables, migrations and stubs stay as they were, and nothing changes when the product runs. A
+product on 2.x keeps running as it is; it takes 3.0 in one change, a web app and a Shopify app
+alike. A product on 1.x goes to 2.0 first («From 1.x to 2.0»).
+
+1. Two commands, with a version from 3.0.0 on:
+
+   ```sh
+   npm install --save-exact @tollwyn/baukasten@<version>
+   npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
+   ```
+
+2. `eslint.config.js` and `knip.config.ts` as «The gate» shows them, with the product's own rules and
+   entries on top. What the old config set that the baukasten's sets too goes: the block that
+   lints the JavaScript of the root with `disableTypeChecked`, and every rule it turned off. A
+   `knip.json` or `knip.jsonc` goes too, its entries and ignores into `knip.config.ts`, where the
+   preset does not already name them. The packages only the old configs imported go with them
+   (`eslint-config-prettier` and the like): knip names those it finds unused.
+3. The script `gate` runs `svelte-check --tsconfig ./tsconfig.json --fail-on-warnings`,
+   `eslint . --config eslint.config.js --max-warnings 0` and `knip`, `tsconfig.json` sets `strict`
+   and `noUncheckedIndexedAccess`, and its `include` names `src`, `e2e` and `*.ts`, and no
+   JavaScript of the root.
+4. Where the product imports a name the entries no longer export (below), the import goes, and
+   svelte-check names each. A type it takes from what uses it, like
+   `Parameters<NonNullable<ShopifyHooks['webhook']>>[1]` for the delivery of a webhook. For
+   `HYDRATED` it calls `waitForHydration`, for `WEBAPP_VARIABLES` and `SHOPIFY_VARIABLES` it takes
+   `BAUKASTEN_VARIABLES` or the standard variables; `LIMITS`, `StripeFailed` and `stripeSignature`
+   stay inside the baukasten, which applies the limits, logs a failure of Stripe and signs the
+   webhooks of its double itself.
+5. `npx --no-install baukasten-check`, then the gate of the product. What the stricter rules find,
+   the product fixes at its cause; where a rule must stay off at one place, the comment says why
+   after `--`.
+
+The entries export what a sample, this README, a stub or a product imports, the counterpart in
+`/server` or `/shopify` of such a name, and `ApiError`, which `kit.api.respond` turns into its
+answer. They no longer export:
+
+- `@tollwyn/baukasten`: `SHOPIFY_VARIABLES`, `WEBAPP_VARIABLES` and the types `Brand`, `Catalog`,
+  `CatalogProduct`, `Linked`, `NavigationLink`, `Product`, `ProductEnv`, `PurchasePrice`,
+  `ShopifyApp`, `ShopifyPlan`, `ShopifyPrivacy`, `ShopifyStandardVariable`, `StandardVariable`,
+  `SubscriptionPrice` and `Texts`.
+- `/server`: `LIMITS`, `StripeFailed` and the types `Account`, `ApiKey`, `CheckoutPage`, `Config`,
+  `Limits`, `MailConfig`, `NodeHandler`, `OpenApiDocument`, `Operator`, `Order`, `Pages`,
+  `ProductNumbers`, `Purchase`, `Register`, `Rule`, `Run`, `RunOptions`, `Stripe`, `Subscription`,
+  `SubscriptionChange` and `SubscriptionStatus`.
+- `/shopify`: `LIMITS` and the types `CustomerRequest`, `Delivery`, `Limits`, `NodeHandler`, `Plan`,
+  `Rule`, `Run`, `RunOptions`, `ShopifyConfig` and `ShopSession`.
+- `/testing`: `HYDRATED`, `stripeSignature` and the types `AppProcess`, `DoubleEndpoint`,
+  `DoublePrice`, `DoubleSession`, `DoubleShop`, `DoubleSubscription`, `PageLike` and
+  `ReceivedMail`.
+- `/ui`: the types of the data of its pages, `AccountData`, `AccountForm`, `ConfirmData`,
+  `ConfirmForm`, `ForgotForm`, `FrameData`, `LegalBlock`, `LegalData`, `LegalInline`, `LoginData`,
+  `LoginForm`, `LogoutData`, `ResetData`, `ResetForm`, `SignupData`, `SignupForm`, `VerifyData` and
+  `VerifyForm`.
+
+What changes in the package: the entries `/eslint` and `/knip`, and `baukasten-check` reads
+`eslint.config.js`, `knip.config.ts`, `tsconfig.json`, `vite.config.ts` for filtered warnings and
+the scripts of `package.json`, and wants ESLint 10, knip 6 and the plugins of the config in the
+versions it names.
+
 # From 1.x to 2.0
 
 2.0 moves the baukasten to SvelteKit 3 and adapter-node 6, and to version 23 of the SDK of Stripe.

package/dist/check.d.ts

@@ -12,8 +12,6 @@ export interface ProductFiles {
     /** The names in a folder, as the migration reads them; none where there is no folder. */
     names(folder: string): readonly string[];
 }
-/** The migration command of a Shopify app in its delivery manifest. */
-export declare const SHOPIFY_MIGRATION: string[];
 /** Whether `version` lies in the caret range `range` from 1.0.0 on; a pre-release lies in none. */
 export declare function fits(version: string, range: string): boolean;
 /** What keeps the product from fitting the installed baukasten; empty when it fits. */

package/dist/check.js

@@ -1,9 +1,16 @@
 import { z } from 'zod';
+import { GATE_SCRIPT, HELD_RULES, KNIP_COMMAND, LINT_COMMAND, LINT_PLUGINS, LINT_TOOLS, TYPECHECK_COMMAND } from './gate.js';
 import { KEY_RIGHTS, WEBHOOK_EVENTS, WEBHOOK_PATH } from './server/stripe.js';
 import { APP_TOML, appTomlProblems } from './shopify/toml.js';
 import { SHOPIFY_STUBS, STUBS } from './stubs.js';
 const ANGABE_PATH = 'deploy/auslieferung.json';
 const STUBS_COMMAND = 'npx --no-install baukasten-stubs';
+const ESLINT_CONFIG = 'eslint.config.js';
+const ESLINT_ENTRY = '@tollwyn/baukasten/eslint';
+const ESLINT_USE = `import baukasten from '${ESLINT_ENTRY}', then export default [...baukasten, …]`;
+const KNIP_CONFIG = 'knip.config.ts';
+const KNIP_ENTRY = '@tollwyn/baukasten/knip';
+const KNIP_USE = `import baukasten from '${KNIP_ENTRY}', then export default { ...baukasten, … }`;
 const ANGABE = z.looseObject({
     version: z.literal(2, 'must be 2, the version that names the art of the product'),
     art: z.literal('webapp', 'must be webapp'),
@@ -20,7 +27,7 @@ const ANGABE = z.looseObject({
     })
 });
 /** The migration command of a Shopify app in its delivery manifest. */
-export const SHOPIFY_MIGRATION = [
+const SHOPIFY_MIGRATION = [
     'node',
     'node_modules/@tollwyn/baukasten/dist/bin/migrate.js',
     'shopify'
@@ -36,17 +43,25 @@ const REFUSED_IN_ADDRESS = ['shopify', 'example'];
 const ART = z.looseObject({ art: z.literal('shopify') });
 const PACKAGE = z.looseObject({
     overrides: z.record(z.string(), z.unknown()).optional(),
-    imports: z.record(z.string(), z.unknown()).optional()
+    imports: z.record(z.string(), z.unknown()).optional(),
+    scripts: z.record(z.string(), z.string()).optional(),
+    knip: z.unknown().optional()
 });
 /** The alias the stubs import the product's src/lib by, as SvelteKit sets it up. */
 const LIB_IMPORT = { key: '#lib/*', target: './src/lib/*' };
 const PEER = z.looseObject({ version: z.string() });
 /**
- * What the product builds with, checked like a peer: adapter-node 5 cannot build SvelteKit 3, and the
- * handler the stub server.js wraps, with its event at shutdown, is that of one major. It is no peer,
- * since only the build needs it, and npm keeps a peer of a dependency in the image.
+ * What the product builds and lints with, checked like a peer: adapter-node 5 cannot build SvelteKit
+ * 3, and the handler the stub server.js wraps, with its event at shutdown, is that of one major; the
+ * config of /eslint and the preset of /knip are written for one major of each tool and plugin. None
+ * is a peer, since only the build and the gate need them, and npm keeps a peer of a dependency in the
+ * image.
  */
-const BUILT_WITH = { '@sveltejs/adapter-node': '^6.0.0' };
+const BUILT_WITH = {
+    '@sveltejs/adapter-node': '^6.0.0',
+    ...LINT_TOOLS,
+    ...LINT_PLUGINS
+};
 /**
  * A reference to an account of a web app or a shop of a Shopify app: the one way a migration of the
  * product names the schema baukasten.
@@ -217,7 +232,7 @@ function packageProblems(files, baukasten) {
     const parsed = json(text);
     const manifest = parsed.kind === 'json' ? PACKAGE.safeParse(parsed.value) : null;
     if (manifest === null || !manifest.success) {
-        return ['package.json is no JSON object, or its overrides or imports are no object'];
+        return ['package.json is no JSON object, or its overrides, imports or scripts are no object'];
     }
     const own = new Set([
         baukasten.name,
@@ -229,8 +244,135 @@ function packageProblems(files, baukasten) {
     if (manifest.data.imports?.[LIB_IMPORT.key] !== LIB_IMPORT.target) {
         problems.push(`package.json does not map imports "${LIB_IMPORT.key}" to "${LIB_IMPORT.target}", which the stubs import from`);
     }
+    if (manifest.data.knip !== undefined) {
+        problems.push(`package.json sets knip, which knip adds to ${KNIP_CONFIG}: move it into ${KNIP_CONFIG}`);
+    }
+    return [...problems, ...gateProblems(manifest.data.scripts ?? {})];
+}
+/** What `npm run gate` must run, read from the scripts, which the workflow of the product runs. */
+function gateProblems(scripts) {
+    const commands = gateCommands(scripts, GATE_SCRIPT, new Set());
+    return [LINT_COMMAND, KNIP_COMMAND, TYPECHECK_COMMAND]
+        .filter((command) => !commands.includes(command))
+        .map((command) => `npm run ${GATE_SCRIPT} does not run ${command}: the script ${GATE_SCRIPT} runs it, or a script it runs with npm run, among commands joined by && and nothing else`);
+}
+/** The script a command runs, where running it with npm is all the command does. */
+function scriptRun(command) {
+    return command === 'npm test' ? 'test' : /^npm run (\S+)$/.exec(command)?.[1];
+}
+/**
+ * The commands a script runs, in it and in the scripts it runs with npm, each with its words joined
+ * by one space. Only a script of commands joined by && counts: any other operator could let a failure
+ * pass, wherever it stands (`a && b || true` is `(a && b) || true`).
+ */
+function gateCommands(scripts, name, seen) {
+    const script = scripts[name];
+    if (script === undefined || seen.has(name) || /[;&|\n]/.test(script.replaceAll('&&', ''))) {
+        return [];
+    }
+    seen.add(name);
+    return script.split('&&').flatMap((part) => {
+        const command = part.trim().split(/\s+/).join(' ');
+        const run = scriptRun(command);
+        return run === undefined ? [command] : gateCommands(scripts, run, seen);
+    });
+}
+/** Strings as they are, comments gone: what JavaScript, TypeScript or tsconfig.json says. */
+const STRINGS_OR_COMMENTS = /'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|`(?:[^`\\]|\\.)*`|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+const withoutComments = (text) => text.replace(STRINGS_OR_COMMENTS, (match) => (match.startsWith('/') ? '' : match));
+/** Whether the code imports the default export of `entry` and spreads it whole, not a part of it. */
+function spreads(code, entry) {
+    const name = new RegExp(String.raw `\bimport\s+([\w$]+)\s+from\s*['"]${entry}['"]`).exec(code)?.[1];
+    return (name !== undefined &&
+        new RegExp(String.raw `\.\.\.\s*${name.replaceAll('$', '\\$')}\s*[,)\]}]`).test(code));
+}
+/** A rule turned off: the severity `'off'`, or `0` for a rule by its name in quotes. */
+const TURNED_OFF = /(['"])off\1|['"][^'"\n]+['"]\s*:\s*\[?\s*0\s*[,\]}]/;
+/**
+ * Read from the text of eslint.config.js only: it spreads the config of the baukasten, turns no rule
+ * off, and names neither a rule it holds, whose options could weaken it, nor the config of
+ * typescript-eslint that turns off the rules needing types.
+ */
+function eslintProblems(files) {
+    const text = files.read(ESLINT_CONFIG);
+    if (text === undefined)
+        return [`${ESLINT_CONFIG} is missing: ${ESLINT_USE}`];
+    const code = withoutComments(text);
+    const problems = spreads(code, ESLINT_ENTRY)
+        ? []
+        : [`${ESLINT_CONFIG} does not spread the config of ${ESLINT_ENTRY}: ${ESLINT_USE}`];
+    for (const rule of HELD_RULES.filter((r) => code.includes(r))) {
+        problems.push(`${ESLINT_CONFIG} names ${rule}, which the config of ${ESLINT_ENTRY} holds: a product adds rules on top and changes none of these`);
+    }
+    if (TURNED_OFF.test(code)) {
+        problems.push(`${ESLINT_CONFIG} turns a rule off: a product adds rules on top and turns none off; where one must stay off at a place, the comment there says why after --`);
+    }
+    if (/\bdisableTypeChecked\b/.test(code)) {
+        problems.push(`${ESLINT_CONFIG} names disableTypeChecked, which turns off the rules of ${ESLINT_ENTRY} that need types: its config gives every file types, the JavaScript in the root too`);
+    }
     return problems;
 }
+/** Where knip looks for its configuration before knip.config.ts, in its order. */
+const KNIP_FIRST = ['knip.json', 'knip.jsonc', '.knip.json', '.knip.jsonc', 'knip.ts', 'knip.js'];
+/** What turns off a kind of issue of knip in its configuration. */
+const KNIP_SWITCHES = ['rules', 'include', 'exclude'];
+/** Read from the text of knip.config.ts only, as from eslint.config.js. */
+function knipProblems(files) {
+    const text = files.read(KNIP_CONFIG);
+    const problems = [];
+    if (text === undefined) {
+        problems.push(`${KNIP_CONFIG} is missing: ${KNIP_USE}`);
+    }
+    else {
+        const code = withoutComments(text);
+        if (!spreads(code, KNIP_ENTRY)) {
+            problems.push(`${KNIP_CONFIG} does not spread the preset of ${KNIP_ENTRY}: ${KNIP_USE}`);
+        }
+        for (const key of KNIP_SWITCHES.filter((k) => new RegExp(String.raw `(?:^|[\s{,])['"]?${k}['"]?\s*:`).test(code))) {
+            problems.push(`${KNIP_CONFIG} sets ${key}, which switches off what the preset of ${KNIP_ENTRY} finds, unused files, exports and dependencies: remove it`);
+        }
+    }
+    for (const first of KNIP_FIRST.filter((f) => files.read(f) !== undefined)) {
+        problems.push(`${first} takes the place of ${KNIP_CONFIG} for knip: remove it`);
+    }
+    return problems;
+}
+const TSCONFIG = z.looseObject({ compilerOptions: z.record(z.string(), z.unknown()).optional() });
+/** What `strict` turns on, each of which a product could turn off again beside it. */
+const STRICT_FAMILY = [
+    'alwaysStrict',
+    'noImplicitAny',
+    'noImplicitThis',
+    'strictBindCallApply',
+    'strictBuiltinIteratorReturn',
+    'strictFunctionTypes',
+    'strictNullChecks',
+    'strictPropertyInitialization',
+    'useUnknownInCatchVariables'
+];
+/**
+ * Read from tsconfig.json itself, not from what it extends: the product sets both there, where its
+ * reader sees them.
+ */
+function tsconfigProblems(files) {
+    const text = files.read('tsconfig.json');
+    if (text === undefined)
+        return ['tsconfig.json is missing'];
+    // tsconfig.json may end an object or array with a comma, which JSON does not take.
+    const plain = withoutComments(text).replace(/"(?:[^"\\]|\\.)*"|,(?=\s*[}\]])/g, (match) => match === ',' ? '' : match);
+    const parsed = json(plain);
+    const tsconfig = parsed.kind === 'json' ? TSCONFIG.safeParse(parsed.value) : null;
+    if (tsconfig === null || !tsconfig.success) {
+        return ['tsconfig.json is no JSON object, or its compilerOptions are no object'];
+    }
+    const options = tsconfig.data.compilerOptions ?? {};
+    return [
+        ...['strict', 'noUncheckedIndexedAccess']
+            .filter((option) => options[option] !== true)
+            .map((option) => `tsconfig.json does not set compilerOptions.${option} to true`),
+        ...STRICT_FAMILY.filter((option) => options[option] === false).map((option) => `tsconfig.json sets compilerOptions.${option} to false, which strict turns on`)
+    ];
+}
 function migrationProblems(files, art) {
     // Like the migration: every entry read, a folder failing loudly, then the .sql files.
     return files
@@ -280,6 +422,19 @@ function configurationProblems(files, art) {
     }
     return problems;
 }
+/**
+ * svelte-check compiles the components with the compilerOptions the product passes to sveltekit() in
+ * vite.config.ts (SvelteKit 3 refuses a svelte.config.*), and a warningFilter among them hides the
+ * warnings of Svelte before --fail-on-warnings sees them.
+ */
+function svelteWarningProblems(files) {
+    const vite = files.read('vite.config.ts');
+    return vite !== undefined && /\bwarningFilter\b/.test(withoutComments(vite))
+        ? [
+            'vite.config.ts sets warningFilter, which hides warnings of Svelte from svelte-check --fail-on-warnings: fix what they say, or silence one at its place with a svelte-ignore comment'
+        ]
+        : [];
+}
 /** What keeps the product from fitting the installed baukasten; empty when it fits. */
 export function productProblems(files, baukasten) {
     const art = artOf(files);
@@ -289,6 +444,10 @@ export function productProblems(files, baukasten) {
         ...versionProblems(files, baukasten),
         ...packageProblems(files, baukasten),
         ...migrationProblems(files, art),
-        ...configurationProblems(files, art)
+        ...configurationProblems(files, art),
+        ...svelteWarningProblems(files),
+        ...eslintProblems(files),
+        ...knipProblems(files),
+        ...tsconfigProblems(files)
     ];
 }

package/dist/eslint.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("eslint/config").ConfigObject[];
+export default _default;

package/dist/eslint.js

@@ -0,0 +1,64 @@
+// The ESLint config of every product, which its eslint.config.js spreads first and adds its own rules
+// to (README, «The gate»). The plugins come from the dev dependencies of the product (gate.ts says
+// why); baukasten-check holds their versions.
+import js from '@eslint/js';
+import comments from '@eslint-community/eslint-plugin-eslint-comments/configs';
+import { defineConfig } from 'eslint/config';
+import svelte from 'eslint-plugin-svelte';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import { HELD_RULES } from './gate.js';
+/**
+ * What reaches the browser: the components, the load functions, hooks and matchers that run on both
+ * sides, and the service worker. A file of the server, a test or src/lib/server/ is none of them.
+ */
+const BROWSER_FILES = [
+    '**/*.svelte',
+    '**/*.svelte.{ts,js}',
+    'src/routes/**/+{page,layout}.{ts,js}',
+    'src/hooks.{ts,js}',
+    'src/hooks.client.{ts,js}',
+    'src/params/*.{ts,js}',
+    'src/service-worker.{ts,js}',
+    'src/service-worker/**'
+];
+/** The entries of the package for the server, which fail the client build (entries.test.ts). */
+const SERVER_ENTRIES = ['server', 'shopify', 'testing'].map((entry) => ({
+    name: `@tollwyn/baukasten/${entry}`,
+    message: 'it runs on the server only: import it in a +page.server.ts, +layout.server.ts, +server.ts, src/hooks.server.ts or src/lib/server/',
+    allowTypeImports: true
+}));
+export default defineConfig({ ignores: ['.svelte-kit/', 'build/', 'coverage/', 'test-results/', 'playwright-report/'] }, js.configs.recommended, tseslint.configs.recommendedTypeChecked, svelte.configs.recommended, comments.recommended, {
+    languageOptions: {
+        parserOptions: {
+            // The stub server.js and the configuration files in the root lie in no tsconfig: they get
+            // the options of the product's own, so that every rule, the product's too, has types.
+            projectService: {
+                allowDefaultProject: ['*.js', '*.mjs', '*.cjs'],
+                defaultProject: 'tsconfig.json'
+            },
+            extraFileExtensions: ['.svelte']
+        }
+    },
+    rules: Object.fromEntries(HELD_RULES.map((rule) => [rule, 'error']))
+}, 
+// A product runs at the root of its own host without a base path, so its links are plain paths and
+// need no resolve(); they carry the referral tag through useLink of /ui.
+{
+    files: ['**/*.svelte', '**/*.svelte.{ts,js}'],
+    languageOptions: {
+        parserOptions: { parser: tseslint.parser, svelteFeatures: { runes: true } }
+    },
+    rules: { 'svelte/no-navigation-without-resolve': 'off' }
+}, 
+// The globals no-undef knows: components run in the browser, and any other JavaScript, the stub
+// server.js and the configuration files among it, in Node or there. TypeScript knows those of its
+// own files, and typescript-eslint turns no-undef off for them.
+{ files: ['**/*.svelte'], languageOptions: { globals: globals.browser } }, {
+    files: ['**/*.{js,mjs,cjs}'],
+    languageOptions: { globals: { ...globals.node, ...globals.browser } }
+}, {
+    files: BROWSER_FILES,
+    ignores: ['**/*.test.ts', '**/*.spec.ts'],
+    rules: { '@typescript-eslint/no-restricted-imports': ['error', { paths: SERVER_ENTRIES }] }
+});

package/dist/gate.d.ts

@@ -0,0 +1,32 @@
+/** The script the workflow of the product runs as its gate. */
+export declare const GATE_SCRIPT = "gate";
+/**
+ * Lint, each warning failing it; a product writes it exactly so, with no flag that weakens it. With
+ * --config, ESLint looks for no config from the folder of each file, where one in a folder below
+ * would take the place of the product's.
+ */
+export declare const LINT_COMMAND = "eslint . --config eslint.config.js --max-warnings 0";
+/** knip with knip.config.ts, the only configuration it reads in a product. */
+export declare const KNIP_COMMAND = "knip";
+/**
+ * The type check, each warning failing it; without --tsconfig, svelte-check reports nothing of the
+ * TypeScript files.
+ */
+export declare const TYPECHECK_COMMAND = "svelte-check --tsconfig ./tsconfig.json --fail-on-warnings";
+/**
+ * Rules of the config of /eslint that a product's eslint.config.js never names, and so never turns
+ * off or weakens by an option: a promise nobody awaits loses its error, a disable without its reason
+ * hides why, and `@ts-nocheck` or `@ts-ignore` take a file or a line out of the type check.
+ */
+export declare const HELD_RULES: readonly ["@typescript-eslint/no-floating-promises", "@typescript-eslint/no-misused-promises", "@typescript-eslint/ban-ts-comment", "@eslint-community/eslint-comments/require-description"];
+/**
+ * What the config of /eslint imports, with the ranges it is written for. The product installs them
+ * as dev dependencies and resolves them for the package: as dependencies or peers of the package,
+ * npm would put them into the image of every product.
+ */
+export declare const LINT_PLUGINS: Readonly<Record<string, string>>;
+/**
+ * The tools the config of /eslint and the preset of /knip are written for, from the dev dependencies
+ * of the product, with their ranges.
+ */
+export declare const LINT_TOOLS: Readonly<Record<string, string>>;

package/dist/gate.js

@@ -0,0 +1,49 @@
+// What the baukasten holds of the gate of a product: the commands its `npm run gate` runs, the rules
+// of the config of /eslint a product never changes, and what the product lints with. Pure, so that
+// baukasten-check reads it without loading ESLint.
+/** The script the workflow of the product runs as its gate. */
+export const GATE_SCRIPT = 'gate';
+/**
+ * Lint, each warning failing it; a product writes it exactly so, with no flag that weakens it. With
+ * --config, ESLint looks for no config from the folder of each file, where one in a folder below
+ * would take the place of the product's.
+ */
+export const LINT_COMMAND = 'eslint . --config eslint.config.js --max-warnings 0';
+/** knip with knip.config.ts, the only configuration it reads in a product. */
+export const KNIP_COMMAND = 'knip';
+/**
+ * The type check, each warning failing it; without --tsconfig, svelte-check reports nothing of the
+ * TypeScript files.
+ */
+export const TYPECHECK_COMMAND = 'svelte-check --tsconfig ./tsconfig.json --fail-on-warnings';
+/**
+ * Rules of the config of /eslint that a product's eslint.config.js never names, and so never turns
+ * off or weakens by an option: a promise nobody awaits loses its error, a disable without its reason
+ * hides why, and `@ts-nocheck` or `@ts-ignore` take a file or a line out of the type check.
+ */
+export const HELD_RULES = [
+    '@typescript-eslint/no-floating-promises',
+    '@typescript-eslint/no-misused-promises',
+    '@typescript-eslint/ban-ts-comment',
+    '@eslint-community/eslint-comments/require-description'
+];
+/**
+ * What the config of /eslint imports, with the ranges it is written for. The product installs them
+ * as dev dependencies and resolves them for the package: as dependencies or peers of the package,
+ * npm would put them into the image of every product.
+ */
+export const LINT_PLUGINS = {
+    '@eslint/js': '^10.0.1',
+    '@eslint-community/eslint-plugin-eslint-comments': '^4.8.1',
+    'eslint-plugin-svelte': '^3.23.1',
+    globals: '^17.13.0',
+    'typescript-eslint': '^8.71.2'
+};
+/**
+ * The tools the config of /eslint and the preset of /knip are written for, from the dev dependencies
+ * of the product, with their ranges.
+ */
+export const LINT_TOOLS = {
+    eslint: '^10.12.0',
+    knip: '^6.41.0'
+};

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { z } from 'zod';
-export { defineProduct, LANGUAGES, type Brand, type Catalog, type CatalogProduct, type Language, type NavigationLink, type Product, type ProductEnv, type ProductLegal, type PurchasePrice, type SubscriptionPrice } from './product.js';
-export { defineShopifyApp, type ShopifyApp, type ShopifyPlan, type ShopifyPrivacy } from './shopify/app.js';
+export { defineProduct, LANGUAGES, type Language, type ProductLegal } from './product.js';
+export { defineShopifyApp } from './shopify/app.js';
 export { SHOPIFY_SVELTEKIT_OPTIONS } from './shopify/sveltekit.js';
 export { SVELTEKIT_OPTIONS } from './sveltekit.js';
-export { TEXTS, type Linked, type Texts } from './texts.js';
-export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, SHOPIFY_VARIABLES, STANDARD_VARIABLES, WEBAPP_VARIABLES, type ShopifyStandardVariable, type StandardVariable } from './variables.js';
+export { TEXTS } from './texts.js';
+export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, STANDARD_VARIABLES } from './variables.js';

package/dist/index.js

@@ -6,4 +6,4 @@ export { defineShopifyApp } from './shopify/app.js';
 export { SHOPIFY_SVELTEKIT_OPTIONS } from './shopify/sveltekit.js';
 export { SVELTEKIT_OPTIONS } from './sveltekit.js';
 export { TEXTS } from './texts.js';
-export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, SHOPIFY_VARIABLES, STANDARD_VARIABLES, WEBAPP_VARIABLES } from './variables.js';
+export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, STANDARD_VARIABLES } from './variables.js';

package/dist/knip.d.ts

@@ -0,0 +1,14 @@
+/** The part of the configuration of knip that the preset sets. */
+export interface KnipPreset {
+    entry: string[];
+    sveltekit: {
+        entry: string[];
+    };
+    playwright: {
+        config: string[];
+        entry: string[];
+    };
+    ignoreDependencies: string[];
+}
+declare const preset: KnipPreset;
+export default preset;

package/dist/knip.js

@@ -0,0 +1,25 @@
+// The knip preset of every product, which its knip.config.ts spreads and adds to (README, «The
+// gate»). knip finds the routes, the hooks of server and client and the matchers through its plugin
+// for SvelteKit, the stub server.js as the file Node starts, and the tests through Vitest; this names
+// what only the baukasten knows, and what the plugin misses.
+import { LINT_PLUGINS } from './gate.js';
+const preset = {
+    // The baukasten loads it, in the migration command and the connection test.
+    entry: ['baukasten.config.ts'],
+    // SvelteKit loads the universal hooks, which the plugin does not name. Here, not under entry, a
+    // product without them gets no hint that the pattern finds nothing; the plugin still reads
+    // vite.config.ts for the rest.
+    sveltekit: { entry: ['src/hooks.{js,ts}'] },
+    // Read, not run: the configuration of Playwright may need the test database to load. Its tests lie
+    // in e2e/, the connection test of the baukasten among them, as Playwright finds them there. What
+    // else the configuration loads (globalSetup, a webServer, a reporter of its own) the product adds
+    // here itself.
+    playwright: {
+        config: [],
+        entry: ['playwright.config.ts', 'e2e/**/*.@(spec|test).?(c|m)[jt]s?(x)']
+    },
+    // What the baukasten imports from the product: the plugins of its ESLint config, and the server of
+    // the SMTP double.
+    ignoreDependencies: [...Object.keys(LINT_PLUGINS), 'smtp-server']
+};
+export default preset;

package/dist/product.d.ts

@@ -9,7 +9,7 @@ export interface NavigationLink {
     label: string;
 }
 /** The grounds on which a product may process personal data, as the privacy policy names them. */
-export declare const LEGAL_BASES: readonly ["contract", "legitimateInterest"];
+declare const LEGAL_BASES: readonly ["contract", "legitimateInterest"];
 export type LegalBasis = (typeof LEGAL_BASES)[number];
 /**
  * What covers personal data that go to a recipient: a country with adequate protection (only
@@ -77,14 +77,14 @@ export interface ProductLegal {
     };
 }
 /** A price of a subscription: an amount in the smallest unit of the currency, per month or year. */
-export interface SubscriptionPrice {
+interface SubscriptionPrice {
     /** The price at Stripe has this lookup key; a new amount becomes a new price under the same key. */
     lookupKey: string;
     amount: number;
     interval: 'month' | 'year';
 }
 /** A price paid once, in the smallest unit of the currency. */
-export interface PurchasePrice {
+interface PurchasePrice {
     lookupKey: string;
     amount: number;
 }
@@ -159,3 +159,4 @@ export interface Brand {
 export declare function isProduct(value: unknown): value is Product;
 /** Declares the configuration of the product; anything wrong with it stops the product loudly. */
 export declare function defineProduct<const E extends ProductEnv>(product: Product<E>): Product<E>;
+export {};

package/dist/product.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { BAUKASTEN_VARIABLES } from './variables.js';
 export const LANGUAGES = ['en', 'de'];
 /** The grounds on which a product may process personal data, as the privacy policy names them. */
-export const LEGAL_BASES = ['contract', 'legitimateInterest'];
+const LEGAL_BASES = ['contract', 'legitimateInterest'];
 /**
  * What covers personal data that go to a recipient: a country with adequate protection (only
  * Switzerland, the EEA and the countries in Annex 1 of the Swiss Data Protection Ordinance, DSV), the

package/dist/server/adapter/migrate.d.ts

@@ -8,7 +8,7 @@ export interface MigrationSources {
     /** The folder of the product's migrations; a product without one has none. */
     product: string;
 }
-export type ByLayer = Record<Layer, string[]>;
+type ByLayer = Record<Layer, string[]>;
 /** What a run applied, and what the database had ahead of this version. */
 export interface MigrateResult {
     applied: ByLayer;
@@ -19,3 +19,4 @@ export declare function migrationSources(root: string, art: Art): MigrationSourc
 /** What the database still needs of this version and what forbids migrating it, for /health/deep. */
 export declare function migrationStatus(db: Queryable, sources: MigrationSources): Promise<MigrationStatus>;
 export declare function migrate(databaseUrl: string, sources: MigrationSources): Promise<MigrateResult>;
+export {};

package/dist/server/billing.d.ts

@@ -11,7 +11,7 @@ export declare class StripeFailed extends Error {
     constructor(kind: string, message: string, options?: ErrorOptions);
 }
 /** A subscription as the product gets it: its product and the lookup key of its price. */
-export interface Subscription {
+interface Subscription {
     id: string;
     status: SubscriptionStatus;
     product: string;
@@ -57,7 +57,7 @@ export type CheckoutPage = {
 } | {
     kind: 'subscribed';
 };
-export type Received = {
+type Received = {
     kind: 'invalid';
 } | {
     kind: 'applied';
@@ -92,3 +92,4 @@ export declare function createBilling(options: {
     /** The sentence by the box for the terms in Checkout, in Markdown, with their link. */
     termsMessage: (termsUrl: string) => string;
 }): Billing;
+export {};

package/dist/server/catalog.d.ts

@@ -1,5 +1,5 @@
 import type { Catalog } from '../product.js';
-import type { NewPrice, PortalConfiguration, StripeApi, StripePrice } from './ports.js';
+import type { NewPrice, StripeApi, StripePrice } from './ports.js';
 /** The name and the address of the product, which the customer portal shows. */
 export interface Shop {
     name: string;
@@ -43,12 +43,6 @@ export interface CatalogAction {
 export declare function pricesOf(catalog: Catalog): NewPrice[];
 /** Whether the price at Stripe charges what the catalog says. */
 export declare function priceFits(found: StripePrice, wanted: NewPrice): boolean;
-/**
- * The default configuration of the customer portal names the product and links its own pages: an
- * account copied from another one brings that one's along. `ids` holds the price at Stripe of each
- * lookup key that has one; null while a price the portal offers has none yet.
- */
-export declare function portalConfiguration(catalog: Catalog, shop: Shop, ids: ReadonlyMap<string, string>): PortalConfiguration | null;
 /**
  * Whether `found` holds every value of `wanted`. Lists hold the same items in any order: Stripe
  * need not keep the order it was given.

package/dist/server/catalog.js

@@ -44,7 +44,7 @@ export function priceFits(found, wanted) {
  * account copied from another one brings that one's along. `ids` holds the price at Stripe of each
  * lookup key that has one; null while a price the portal offers has none yet.
  */
-export function portalConfiguration(catalog, shop, ids) {
+function portalConfiguration(catalog, shop, ids) {
     const subscriptions = catalog.products.flatMap((product) => product.kind === 'subscription' ? [product] : []);
     const prices = subscriptions.reduce((count, product) => count + product.prices.length, 0);
     const allowed = [

package/dist/server/config.d.ts

@@ -18,7 +18,7 @@ export type Mail = {
 };
 /** The mode of Stripe, by the prefix of the key: test until the delivery service switches to live. */
 export type StripeMode = 'test' | 'live';
-export type Stripe = {
+type Stripe = {
     kind: 'stripe';
     secretKey: string;
     webhookSecret: string;

package/dist/server/core.d.ts

@@ -19,7 +19,7 @@ export interface CoreConfig {
     missing: readonly string[];
 }
 /** Pool, configuration, log, mail and limits of what runs, for the hooks of the product. */
-export interface CoreContext<C> {
+interface CoreContext<C> {
     config: C;
     db: Db;
     log: Log;
@@ -27,7 +27,7 @@ export interface CoreContext<C> {
     limits: Limits;
 }
 /** The hooks of the product the core calls; the art calls the others. */
-export interface CoreHooks<C> {
+interface CoreHooks<C> {
     checks?: Record<string, (context: CoreContext<C>) => Promise<void>>;
     start?: (context: CoreContext<C>) => Promise<void> | void;
     stop?: (context: CoreContext<C>) => Promise<void> | void;

package/dist/server/endpoints.d.ts

@@ -31,14 +31,6 @@ export declare function signupBody(m: Messages, terms: string): z.ZodObject<{
     acting_for_business: z.ZodLiteral<true>;
     via: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-/**
- * The body of a Checkout over the API: a price of the catalog by its lookup key, and a quantity,
- * which the price decides on (checkout below).
- */
-export declare function checkoutBody(m: Messages): z.ZodObject<{
-    price: z.ZodString;
-    quantity: z.ZodOptional<z.ZodUnknown>;
-}, z.core.$strip>;
 /** The answer of a path of the baukasten's API, or null for any other path. */
 export declare function serveApi(s: Services, event: RequestEvent): Promise<Response> | null;
 export {};

package/dist/server/endpoints.js

@@ -84,7 +84,7 @@ async function signup(s, event) {
  * The body of a Checkout over the API: a price of the catalog by its lookup key, and a quantity,
  * which the price decides on (checkout below).
  */
-export function checkoutBody(m) {
+function checkoutBody(m) {
     return z.object({ price: z.string(m.api.price), quantity: z.unknown().optional() }, m.api.notAnObject);
 }
 function invalid(m, path, message) {

package/dist/server/index.d.ts

@@ -1,18 +1,11 @@
-export type { Account, ApiKey } from './accounts.js';
 export { log } from './adapter/log.js';
 export { ApiError } from './api.js';
-export { StripeFailed, type CheckoutPage, type Order, type Purchase, type Subscription, type SubscriptionChange } from './billing.js';
-export type { Config, Mail as MailConfig, Operator, Register, Stripe } from './config.js';
 export { CheckFailed } from './health.js';
 export { baukasten, type Context, type Hooks, type Kit } from './hook.js';
-export { LIMITS, type Limits, type Rule } from './limits.js';
 export type { Log } from './log.js';
 export { MailFailed } from './mail.js';
-export type { OpenApiDocument } from './openapi.js';
-export type { Pages } from './pages.js';
-export type { Db, Mail, Mailer, Queryable, SubscriptionStatus } from './ports.js';
-export { periodic, type Run, type RunOptions } from './runs.js';
-export type { ProductNumbers } from './sales.js';
-export { start, type NodeHandler } from './start.js';
+export type { Db, Mail, Mailer, Queryable } from './ports.js';
+export { periodic } from './runs.js';
+export { start } from './start.js';
 export { KEY_RIGHTS, WEBHOOK_EVENTS, WEBHOOK_PATH } from './stripe.js';
 export { requireAccount, tooMany } from './web.js';

package/dist/server/index.js

@@ -1,9 +1,8 @@
+// The server entry of the baukasten; nothing here may reach the browser.
 export { log } from './adapter/log.js';
 export { ApiError } from './api.js';
-export { StripeFailed } from './billing.js';
 export { CheckFailed } from './health.js';
 export { baukasten } from './hook.js';
-export { LIMITS } from './limits.js';
 export { MailFailed } from './mail.js';
 export { periodic } from './runs.js';
 export { start } from './start.js';

package/dist/server/messages.d.ts

@@ -1,5 +1,5 @@
 import type { Language } from '../product.js';
-export interface MailText {
+interface MailText {
     subject: string;
     text: string;
 }

package/dist/server/pages.d.ts

@@ -1,13 +1,10 @@
 import { type RequestEvent } from '@sveltejs/kit';
-import type { Brand } from '../product.js';
 import type { AccountData, ConfirmData, FrameData, LegalData, LoginData, LogoutData, ResetData, SignupData, VerifyData } from '../ui/data.js';
 import { type Services } from './services.js';
 type LoadEvent = {
     locals: App.Locals;
     url: URL;
 };
-/** The marks of the product as the frame shows them: the picture of a shared link at its whole address. */
-export declare function frameBrand(brand: Brand | undefined, origin: string): FrameData['brand'];
 export type Pages = ReturnType<typeof createPages>;
 export declare function createPages(services: () => Services): {
     layout: {

package/dist/server/pages.js

@@ -9,7 +9,7 @@ import { sendLink, signUp } from './services.js';
 import { parseVia } from './via.js';
 import { clearSessionCookie, requireAccount, safeNext, SESSION_COOKIE, setSessionCookie, tooMany } from './web.js';
 /** The marks of the product as the frame shows them: the picture of a shared link at its whole address. */
-export function frameBrand(brand, origin) {
+function frameBrand(brand, origin) {
     if (brand === undefined)
         return null;
     return {

package/dist/server/ports.d.ts

@@ -47,7 +47,7 @@ export interface Mailer {
     check(): Promise<void>;
 }
 /** A product at Stripe as the catalog compares it. */
-export interface StripeProduct {
+interface StripeProduct {
     id: string;
     name: string;
     active: boolean;
@@ -127,7 +127,7 @@ export interface PortalConfiguration {
 }
 export type SubscriptionStatus = 'incomplete' | 'incomplete_expired' | 'trialing' | 'active' | 'past_due' | 'canceled' | 'unpaid' | 'paused';
 /** A subscription at Stripe with its one item. */
-export interface StripeSubscription {
+interface StripeSubscription {
     id: string;
     customerId: string;
     status: SubscriptionStatus;
@@ -278,3 +278,4 @@ export interface StripeApi {
         kind: 'invalid';
     };
 }
+export {};

package/dist/shopify/hook.d.ts

@@ -9,7 +9,7 @@ import { type ShopifyConfig } from './config.js';
 import { type Plan } from './shops.js';
 import { type WebhookHooks } from './webhooks.js';
 /** The shop of a request that got in. */
-export interface ShopSession {
+interface ShopSession {
     /** Its permanent domain, like example.myshopify.com. */
     domain: string;
     plan: Exclude<Plan, {
@@ -58,3 +58,4 @@ export interface ShopifyKit<E extends ProductEnv = ProductEnv> {
     admin(shop: string): AdminApi;
 }
 export declare function shopifyBaukasten<E extends ProductEnv>(app: ShopifyApp<E>, hooks?: ShopifyHooks<E>): ShopifyKit<E>;
+export {};

package/dist/shopify/index.d.ts

@@ -1,18 +1,13 @@
 import { type NodeHandler } from '../server/start.js';
 export { log } from '../server/adapter/log.js';
 export { CheckFailed } from '../server/health.js';
-export { LIMITS, type Limits, type Rule } from '../server/limits.js';
 export type { Log } from '../server/log.js';
 export { MailFailed } from '../server/mail.js';
 export type { Db, Mail, Mailer, Queryable } from '../server/ports.js';
-export { periodic, type Run, type RunOptions } from '../server/runs.js';
-export type { NodeHandler } from '../server/start.js';
+export { periodic } from '../server/runs.js';
 export { AdminRefused, ShopGone, type AdminApi } from './admin.js';
-export type { ShopifyConfig } from './config.js';
 export { SHOPIFY_API_VERSION, SHOPIFY_WEBHOOK_PATH } from './constants.js';
-export { shopifyBaukasten, type ShopifyContext, type ShopifyHooks, type ShopifyKit, type ShopSession } from './hook.js';
-export type { Plan } from './shops.js';
-export type { CustomerRequest, Delivery } from './webhooks.js';
+export { shopifyBaukasten, type ShopifyContext, type ShopifyHooks, type ShopifyKit } from './hook.js';
 /** The server of a Shopify app, called by its stub server.js with the handler of adapter-node. */
 export declare function start(load: () => Promise<{
     handler: NodeHandler;

package/dist/shopify/index.js

@@ -3,7 +3,6 @@ import { serve } from '../server/start.js';
 import { SHOPIFY_SECURITY_HEADERS } from './headers.js';
 export { log } from '../server/adapter/log.js';
 export { CheckFailed } from '../server/health.js';
-export { LIMITS } from '../server/limits.js';
 export { MailFailed } from '../server/mail.js';
 export { periodic } from '../server/runs.js';
 export { AdminRefused, ShopGone } from './admin.js';

package/dist/shopify/pages.d.ts

@@ -1,8 +1,6 @@
 import type { Language } from '../product.js';
 import type { LegalData } from '../ui/data.js';
 import type { ShopifyTexts } from './texts.js';
-/** Text into HTML, in an element or a quoted attribute. */
-export declare function escapeHtml(text: string): string;
 /** frame-ancestors for the admin of `shop`, or for none outside it. */
 export declare function frameAncestors(shop: string | null): string;
 /**

package/dist/shopify/pages.js

@@ -1,6 +1,6 @@
 import { APP_BRIDGE_URL, SHOPIFY_ADMIN, SHOPIFY_CDN, SHOPIFY_SCRIPTS } from './constants.js';
 /** Text into HTML, in an element or a quoted attribute. */
-export function escapeHtml(text) {
+function escapeHtml(text) {
     return text
         .replaceAll('&', '&')
         .replaceAll('<', '&lt;')

package/dist/shopify/ports.d.ts

@@ -11,7 +11,7 @@ export interface ShopTokens {
  * Why Shopify gave no tokens: `invalid` for an ID token or refresh token it no longer takes (the shop
  * must open the app again), `failed` for anything else, which a later try may get past.
  */
-export type TokenRefusal = {
+type TokenRefusal = {
     kind: 'invalid';
 } | {
     kind: 'failed';
@@ -75,3 +75,4 @@ export interface ShopifyApi {
     /** Whether the Partner API takes the token: a query without data of a shop, for /health/deep. */
     partnerCheck(): Promise<void>;
 }
+export {};

package/dist/shopify/shops.d.ts

@@ -3,10 +3,6 @@ import type { Db, Queryable } from '../server/ports.js';
 import type { ShopifyPlan } from './app.js';
 import type { ShopifyApi } from './ports.js';
 import { type SealKey } from './seal.js';
-/** A token is refreshed when it ends within this time, so that no request runs into its end. */
-export declare const REFRESH_BEFORE_MS: number;
-/** The plan of a shop is asked again after this time, and at once after the plan page. */
-export declare const PLAN_FRESH_MS: number;
 export type Plan = {
     kind: 'none';
 } | {
@@ -15,7 +11,7 @@ export type Plan = {
     /** Until when it runs as a trial; null without one. */
     trialEndsAt: Date | null;
 };
-export type Entry = {
+type Entry = {
     kind: 'in';
 }
 /** Shopify no longer takes the ID token: App Bridge fetches a new one. */
@@ -74,3 +70,4 @@ export declare function createShops(deps: {
     /** 12 random bytes for each sealed token. */
     nonce: () => Uint8Array;
 }): Shops;
+export {};

package/dist/shopify/shops.js

@@ -1,9 +1,9 @@
 import { scopesCover } from './scopes.js';
 import { open, seal } from './seal.js';
 /** A token is refreshed when it ends within this time, so that no request runs into its end. */
-export const REFRESH_BEFORE_MS = 5 * 60_000;
+const REFRESH_BEFORE_MS = 5 * 60_000;
 /** The plan of a shop is asked again after this time, and at once after the plan page. */
-export const PLAN_FRESH_MS = 10 * 60_000;
+const PLAN_FRESH_MS = 10 * 60_000;
 export function createShops(deps) {
     const { db, api, key, log, now } = deps;
     /** Where a token belongs: a sealed one opens only there. */

package/dist/testing/browser.d.ts

@@ -1,5 +1,3 @@
-/** What the frame sets once the page is hydrated. */
-export declare const HYDRATED = "html[data-hydrated]";
 /** What these helpers need of a page of Playwright. */
 export interface PageLike {
     goto(url: string): Promise<unknown>;

package/dist/testing/browser.js

@@ -1,5 +1,5 @@
 /** What the frame sets once the page is hydrated. */
-export const HYDRATED = 'html[data-hydrated]';
+const HYDRATED = 'html[data-hydrated]';
 /** Waits until the page is interactive: filled before, a field can lose what was typed. */
 export async function waitForHydration(page) {
     await page.waitForSelector(HYDRATED, { state: 'attached' });

package/dist/testing/index.d.ts

@@ -1,9 +1,9 @@
-export { freePort, spawnNode, startApp, type AppProcess, type LogLine, type RunningApp } from './app.js';
+export { freePort, spawnNode, startApp, type LogLine, type RunningApp } from './app.js';
 export { connectionTest } from './connection.js';
-export { HYDRATED, newCaller, open, waitForHydration, type PageLike } from './browser.js';
+export { newCaller, open, waitForHydration } from './browser.js';
 export { createTestDatabase, type TestDatabase } from './database.js';
 export { envExampleProblems } from './env-example.js';
 export { shopifyConnectionTest } from './shopify-connection.js';
-export { startShopify, type AdminAnswer, type DoubleShop, type ShopifyDouble } from './shopify.js';
-export { linkIn, startSmtp, type ReceivedMail, type SmtpDouble } from './smtp.js';
-export { startStripe, stripeSignature, type DoubleEndpoint, type DoublePrice, type DoubleSession, type DoubleSubscription, type StripeDouble } from './stripe.js';
+export { startShopify, type AdminAnswer, type ShopifyDouble } from './shopify.js';
+export { linkIn, startSmtp, type SmtpDouble } from './smtp.js';
+export { startStripe, type StripeDouble } from './stripe.js';

package/dist/testing/index.js

@@ -1,9 +1,9 @@
 export { freePort, spawnNode, startApp } from './app.js';
 export { connectionTest } from './connection.js';
-export { HYDRATED, newCaller, open, waitForHydration } from './browser.js';
+export { newCaller, open, waitForHydration } from './browser.js';
 export { createTestDatabase } from './database.js';
 export { envExampleProblems } from './env-example.js';
 export { shopifyConnectionTest } from './shopify-connection.js';
 export { startShopify } from './shopify.js';
 export { linkIn, startSmtp } from './smtp.js';
-export { startStripe, stripeSignature } from './stripe.js';
+export { startStripe } from './stripe.js';

package/dist/testing/shopify.d.ts

@@ -1,4 +1,4 @@
-export interface DoubleShop {
+interface DoubleShop {
     domain: string;
     /** gid://shopify/Shop/… */
     id: string;
@@ -69,3 +69,4 @@ export interface ShopifyDouble {
 export declare function startShopify(options: {
     scopes: string;
 }): Promise<ShopifyDouble>;
+export {};

package/dist/testing/smtp.d.ts

@@ -1,4 +1,4 @@
-export interface ReceivedMail {
+interface ReceivedMail {
     /** The recipients of the envelope, in small letters. */
     to: string[];
     /** The From header, decoded: name and address. */
@@ -26,8 +26,6 @@ export interface SmtpDouble {
     accept(to: string): void;
     stop(): Promise<void>;
 }
-/** Words like `=?UTF-8?Q?Gr=C3=BCezi?=` in a header; the space between two words goes with them. */
-export declare function decodeWords(value: string): string;
 /** The headers and the text of a plain-text message as SMTP carries it. */
 export declare function parseMessage(raw: Buffer): {
     headers: Map<string, string>;
@@ -36,3 +34,4 @@ export declare function parseMessage(raw: Buffer): {
 /** The first link in a text that starts with `prefix`. */
 export declare function linkIn(text: string, prefix: string): string;
 export declare function startSmtp(): Promise<SmtpDouble>;
+export {};

package/dist/testing/smtp.js

@@ -5,7 +5,7 @@
 // carries it.
 import { EventEmitter } from 'node:events';
 /** Words like `=?UTF-8?Q?Gr=C3=BCezi?=` in a header; the space between two words goes with them. */
-export function decodeWords(value) {
+function decodeWords(value) {
     return value
         .replace(/(=\?[^?]+\?[QqBb]\?[^?]*\?=)\s+(?==\?)/g, '$1')
         .replace(/=\?([^?]+)\?([QqBb])\?([^?]*)\?=/g, (_, charset, kind, text) => {

package/dist/testing/stripe.d.ts

@@ -1,11 +1,11 @@
 /** A value of the JSON the double answers. */
-export type Json = string | number | boolean | null | Json[] | {
+type Json = string | number | boolean | null | Json[] | {
     [key: string]: Json;
 };
 type JsonObject = {
     [key: string]: Json;
 };
-export interface DoublePrice {
+interface DoublePrice {
     id: string;
     object: 'price';
     product: string;
@@ -19,7 +19,7 @@ export interface DoublePrice {
         interval_count: number;
     } | null;
 }
-export interface DoubleSubscription {
+interface DoubleSubscription {
     id: string;
     object: 'subscription';
     customer: string;
@@ -35,7 +35,7 @@ export interface DoubleSubscription {
         }[];
     };
 }
-export interface DoubleSession {
+interface DoubleSession {
     id: string;
     object: 'checkout.session';
     mode: string;
@@ -59,7 +59,7 @@ export interface DoubleSession {
     /** The whole request, as the API got it. */
     request: JsonObject;
 }
-export interface DoubleEndpoint {
+interface DoubleEndpoint {
     id: string;
     object: 'webhook_endpoint';
     url: string;

package/dist/ui/Linked.svelte.d.ts

@@ -1,6 +1,6 @@
-import type { Linked } from '../texts.js';
+import type { Linked as LinkedText } from '../texts.js';
 type $$ComponentProps = {
-    text: Linked;
+    text: LinkedText;
     href: string;
 };
 declare const Linked: import("svelte").Component<$$ComponentProps, {}, "">;

package/dist/ui/index.d.ts

@@ -12,4 +12,3 @@ export { default as LogoutPage } from './LogoutPage.svelte';
 export { default as ResetPasswordPage } from './ResetPasswordPage.svelte';
 export { default as SignupPage } from './SignupPage.svelte';
 export { default as VerifyEmailPage } from './VerifyEmailPage.svelte';
-export type * from './data.js';

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@tollwyn/baukasten",
-	"version": "2.0.1",
-	"description": "What every product built on this kit shares: configuration, log and server, database with two-layer migrations, health, accounts with sessions and API keys, limits, mail, payment through Stripe, the numbers for sales, the frame and pages, the stubs that hang them into a product and the check of a product, and the tools to test one, its connection test among them; and for a Shopify app its installation with tokens, the frame of the admin, its webhooks, its plan through the Partner API and its privacy text.",
+	"version": "3.0.0",
+	"description": "What every product built on this kit shares: configuration, log and server, database with two-layer migrations, health, accounts with sessions and API keys, limits, mail, payment through Stripe, the numbers for sales, the frame and pages, the stubs that hang them into a product and the check of a product, the ESLint config and knip preset of its gate, and the tools to test one, its connection test among them; and for a Shopify app its installation with tokens, the frame of the admin, its webhooks, its plan through the Partner API and its privacy text.",
 	"license": "UNLICENSED",
 	"type": "module",
 	"engines": {
@@ -35,6 +35,14 @@
 			"types": "./dist/ui/index.d.ts",
 			"svelte": "./dist/ui/index.js",
 			"default": "./dist/ui/index.js"
+		},
+		"./eslint": {
+			"types": "./dist/eslint.d.ts",
+			"default": "./dist/eslint.js"
+		},
+		"./knip": {
+			"types": "./dist/knip.d.ts",
+			"default": "./dist/knip.js"
 		}
 	},
 	"bin": {
@@ -52,7 +60,7 @@
 		"test:db": "node ../scripts/test-db.mjs mit vitest run --config vitest.db.config.ts",
 		"test:e2e": "npm run muster && npm --prefix muster run test:e2e && npm --prefix muster-shopify run test:e2e",
 		"typecheck": "svelte-check --tsconfig ./tsconfig.json --fail-on-warnings && npm --prefix muster run check && npm --prefix muster-shopify run check",
-		"lint": "eslint . --max-warnings 0 && prettier --check . && npm --prefix muster run lint && npm --prefix muster-shopify run lint",
+		"lint": "eslint . --max-warnings 0 && knip && prettier --check . && npm --prefix muster run lint && npm --prefix muster-shopify run lint",
 		"check:version": "node scripts/npm-version.ts"
 	},
 	"peerDependencies": {
@@ -80,6 +88,7 @@
 		"eslint-config-prettier": "10.1.8",
 		"eslint-plugin-svelte": "3.23.1",
 		"globals": "17.13.0",
+		"knip": "6.41.0",
 		"prettier": "3.9.10",
 		"prettier-plugin-svelte": "4.1.1",
 		"smtp-server": "3.19.24",