@tollwyn/baukasten 2.0.1 → 3.0.1

package/README.md

@@ -12,6 +12,7 @@ A product is a SvelteKit 3 app with `@sveltejs/adapter-node` 6 and Svelte 5, tes
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
 npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
+npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
 npx --no-install baukasten-stubs
 # fill in what the product owns (below)
 npx --no-install baukasten-check
@@ -57,6 +58,8 @@ them: `baukasten.config.ts`, `src/app.css`, `src/lib/server/baukasten.ts` and
   previous version must run against the new schema). Every table that holds data of an account
   points at it with `REFERENCES baukasten.accounts (id) ON DELETE CASCADE`. It reads the tables of
   the baukasten only through its functions and never changes them.
+- `eslint.config.js`, `knip.config.ts`, `tsconfig.json` and the script `gate` of `package.json`, as
+  «The gate» below says.
 - `.env.example`, naming every variable without a value (`envExampleProblems` of `/testing`).
 - `playwright.config.ts` with `testDir: 'e2e'` and `TEST_DATABASE_URL`, a Postgres server on which the
   tests create their databases. It sets the variables the configuration of the product requires in
@@ -98,15 +101,79 @@ it. `muster/` shows all of it with Tailwind CSS 4, Skeleton and a font from font
   `src/app.css`, which Vite bundles (a small font inlined as `data:`, which the policy allows), and
   pictures in `static/` or the product's code. Nothing from another server: the policy refuses it.
 
+## The gate
+
+`npm run gate` is the gate of the product, which its workflow runs. What lints in it is the
+baukasten's, and `baukasten-check` holds it:
+
+- `eslint.config.js` spreads the config of `@tollwyn/baukasten/eslint` first and adds the product's
+  own rules on top:
+
+  ```js
+  import baukasten from '@tollwyn/baukasten/eslint';
+
+  export default [...baukasten];
+  ```
+
+  The config lints every file with types: the type-checked rules of typescript-eslint
+  (`recommendedTypeChecked`), Svelte's recommended rules for the components, and a reason after
+  `--` in every comment that turns a rule off, as in `@ts-expect-error`. A component, a universal
+  load function, hook or matcher and the service worker import nothing of `/server`, `/shopify` or
+  `/testing` but types. It sets no rule of formatting, so Prettier needs no config beside it. The
+  product's config turns no rule off, and never names `@typescript-eslint/no-floating-promises`,
+  `@typescript-eslint/no-misused-promises`, `@typescript-eslint/ban-ts-comment`,
+  `@eslint-community/eslint-comments/require-description` or `disableTypeChecked`: a promise nobody
+  awaits loses its error, `@ts-nocheck` and `@ts-ignore` take code out of the type check, and a rule
+  turned off without its reason hides why. Where a rule must stay off at one place, the comment
+  there says why. Imports of its own a product restricts with ESLint's `no-restricted-imports`:
+  `@typescript-eslint/no-restricted-imports` would replace the config's for the same files.
+
+- `knip.config.ts` spreads the preset of `@tollwyn/baukasten/knip`, which knows the routes, the
+  stubs, the connection test and what the baukasten loads, and adds what is the product's own:
+
+  ```ts
+  import baukasten from '@tollwyn/baukasten/knip';
+  import type { KnipConfig } from 'knip';
+
+  export default { ...baukasten } satisfies KnipConfig;
+  ```
+
+  It sets no `rules`, `include` or `exclude`, and no other configuration of knip lies beside it
+  (`knip.json` and the like, or `knip` in `package.json`): knip finds unused files, exports and
+  dependencies. The preset reads the configuration of Playwright without running it; what that
+  loads besides its tests (`globalSetup`, a `webServer`, a reporter of its own) the product adds to
+  `playwright.entry`.
+
+- The script `gate` runs `svelte-check --tsconfig ./tsconfig.json --fail-on-warnings` (without
+  `--tsconfig`, svelte-check reports nothing of the TypeScript files),
+  `eslint . --config eslint.config.js --max-warnings 0` (with `--config`, an `eslint.config.js` in a
+  folder below takes no files from it) and `knip`, each exactly so, after `svelte-kit sync`, which
+  writes the types all three read: in itself or in a script it runs with `npm run`, among commands
+  joined by `&&` and nothing else, since `;`, `||`, `|` or `&` could let a failure pass. The
+  `compilerOptions` that `vite.config.ts` passes to `sveltekit()` set no `warningFilter`:
+  svelte-check compiles with them and would not see the warnings it filters. One warning at its
+  place a `svelte-ignore` comment silences.
+
+- `tsconfig.json` sets `strict` and `noUncheckedIndexedAccess` to `true` in its own
+  `compilerOptions` and turns off no part of `strict`. Its `include` names `src`, `e2e` and the
+  TypeScript in the root (`*.ts`), and not the JavaScript in the root: the config lints that through
+  a project of its own, with the same options, and typescript-eslint refuses a file that is in both.
+
+ESLint, knip and the plugins the config imports are dev dependencies of the product, installed with
+the third command above, and `baukasten-check` holds their versions. They are neither dependencies
+nor peers of the baukasten: npm puts every dependency and every peer of a dependency into the image
+of the product, and these have no business there.
+
 ## The check and the connection test
 
 `baukasten-check` runs in the root of the product, before its gate, against the installed version:
 the stubs are there and unchanged, `deploy/auslieferung.json` names the webhook and the rights of
-the baukasten, SvelteKit and Svelte fit its peer ranges and adapter-node is version 6, `overrides`
-in `package.json` replaces nothing the baukasten depends on and its `imports` map `#lib/*`, no
-migration of the product names the schema `baukasten` beyond its references to
-`baukasten.accounts`, and the configuration and `SVELTEKIT_OPTIONS` are in place. Exit 0 when the
-product fits; else exit 1 with one line per problem.
+the baukasten, SvelteKit and Svelte fit its peer ranges, adapter-node is version 6 and ESLint, knip
+and the plugins of the config are in their versions, `overrides` in `package.json` replaces nothing
+the baukasten depends on and its `imports` map `#lib/*`, no migration of the product names the
+schema `baukasten` beyond its references to `baukasten.accounts`, the configuration and
+`SVELTEKIT_OPTIONS` are in place, and the gate is as above. Exit 0 when the product fits; else exit
+1 with one line per problem. It reads these files and runs none of them.
 
 `e2e/baukasten.spec.ts` runs the connection test in the gate of the product, against the built
 product with the doubles of Stripe and mail: sign-up with a referral tag, mail and confirmation,
@@ -138,6 +205,7 @@ connection test among them.
 ```sh
 npm install --save-exact @tollwyn/baukasten@<version>
 npm install --save-dev @sveltejs/adapter-node@6 @playwright/test smtp-server
+npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
 npx --no-install baukasten-stubs shopify
 # fill in what the app owns (below)
 npx --no-install baukasten-check
@@ -197,6 +265,7 @@ missing, it writes the files the app owns as a starting point: `baukasten.config
   holds data of a store points at it with `REFERENCES baukasten.shops (domain) ON DELETE CASCADE`:
   so `shop/redact` deletes them with the store.
 - `.env.example` (`envExampleProblems` of `/testing`) and `playwright.config.ts`, as in a web app.
+- The gate, as a web app's («The gate»).
 - The image: as a web app's, with `shopify.app.toml` in its root as well.
 - `deploy/auslieferung.json`: version 2, `art: shopify`, `name`, `subdomain` (without `shopify` or
   `example`, which the review refuses in an address), the migration
@@ -264,6 +333,69 @@ the baukasten do:
   was reached from the logs, and tells the stores concerned by email without undue delay, as the
   privacy text promises.
 
+# From 2.x to 3.0
+
+3.0 holds the gate of a product: `baukasten-check` fails until the product lints with the config and
+the preset of the baukasten, and its entries export less (below). Its pages, mails, legal texts,
+variables, migrations and stubs stay as they were, and nothing changes when the product runs. A
+product on 2.x keeps running as it is; it takes 3.0 in one change, a web app and a Shopify app
+alike. A product on 1.x goes to 2.0 first («From 1.x to 2.0»).
+
+1. Two commands, with a version from 3.0.0 on:
+
+   ```sh
+   npm install --save-exact @tollwyn/baukasten@<version>
+   npm install --save-dev eslint@10 knip@6 typescript-eslint@8 eslint-plugin-svelte@3 @eslint-community/eslint-plugin-eslint-comments@4 @eslint/js@10 globals@17
+   ```
+
+2. `eslint.config.js` and `knip.config.ts` as «The gate» shows them, with the product's own rules and
+   entries on top. What the old config set that the baukasten's sets too goes: the block that
+   lints the JavaScript of the root with `disableTypeChecked`, and every rule it turned off. A
+   `knip.json` or `knip.jsonc` goes too, its entries and ignores into `knip.config.ts`, where the
+   preset does not already name them. The packages only the old configs imported go with them
+   (`eslint-config-prettier` and the like): knip names those it finds unused.
+3. The script `gate` runs `svelte-check --tsconfig ./tsconfig.json --fail-on-warnings`,
+   `eslint . --config eslint.config.js --max-warnings 0` and `knip`, `tsconfig.json` sets `strict`
+   and `noUncheckedIndexedAccess`, and its `include` names `src`, `e2e` and `*.ts`, and no
+   JavaScript of the root.
+4. Where the product imports a name the entries no longer export (below), the import goes, and
+   svelte-check names each. A type it takes from what uses it, like
+   `Parameters<NonNullable<ShopifyHooks['webhook']>>[1]` for the delivery of a webhook. For
+   `HYDRATED` it calls `waitForHydration`, for `WEBAPP_VARIABLES` and `SHOPIFY_VARIABLES` it takes
+   `BAUKASTEN_VARIABLES` or the standard variables; `LIMITS`, `StripeFailed` and `stripeSignature`
+   stay inside the baukasten, which applies the limits, logs a failure of Stripe and signs the
+   webhooks of its double itself.
+5. `npx --no-install baukasten-check`, then the gate of the product. What the stricter rules find,
+   the product fixes at its cause; where a rule must stay off at one place, the comment says why
+   after `--`.
+
+The entries export what a sample, this README, a stub or a product imports, the counterpart in
+`/server` or `/shopify` of such a name, and `ApiError`, which `kit.api.respond` turns into its
+answer. They no longer export:
+
+- `@tollwyn/baukasten`: `SHOPIFY_VARIABLES`, `WEBAPP_VARIABLES` and the types `Brand`, `Catalog`,
+  `CatalogProduct`, `Linked`, `NavigationLink`, `Product`, `ProductEnv`, `PurchasePrice`,
+  `ShopifyApp`, `ShopifyPlan`, `ShopifyPrivacy`, `ShopifyStandardVariable`, `StandardVariable`,
+  `SubscriptionPrice` and `Texts`.
+- `/server`: `LIMITS`, `StripeFailed` and the types `Account`, `ApiKey`, `CheckoutPage`, `Config`,
+  `Limits`, `MailConfig`, `NodeHandler`, `OpenApiDocument`, `Operator`, `Order`, `Pages`,
+  `ProductNumbers`, `Purchase`, `Register`, `Rule`, `Run`, `RunOptions`, `Stripe`, `Subscription`,
+  `SubscriptionChange` and `SubscriptionStatus`.
+- `/shopify`: `LIMITS` and the types `CustomerRequest`, `Delivery`, `Limits`, `NodeHandler`, `Plan`,
+  `Rule`, `Run`, `RunOptions`, `ShopifyConfig` and `ShopSession`.
+- `/testing`: `HYDRATED`, `stripeSignature` and the types `AppProcess`, `DoubleEndpoint`,
+  `DoublePrice`, `DoubleSession`, `DoubleShop`, `DoubleSubscription`, `PageLike` and
+  `ReceivedMail`.
+- `/ui`: the types of the data of its pages, `AccountData`, `AccountForm`, `ConfirmData`,
+  `ConfirmForm`, `ForgotForm`, `FrameData`, `LegalBlock`, `LegalData`, `LegalInline`, `LoginData`,
+  `LoginForm`, `LogoutData`, `ResetData`, `ResetForm`, `SignupData`, `SignupForm`, `VerifyData` and
+  `VerifyForm`.
+
+What changes in the package: the entries `/eslint` and `/knip`, and `baukasten-check` reads
+`eslint.config.js`, `knip.config.ts`, `tsconfig.json`, `vite.config.ts` for filtered warnings and
+the scripts of `package.json`, and wants ESLint 10, knip 6 and the plugins of the config in the
+versions it names.
+
 # From 1.x to 2.0
 
 2.0 moves the baukasten to SvelteKit 3 and adapter-node 6, and to version 23 of the SDK of Stripe.

package/dist/check.d.ts

@@ -12,8 +12,6 @@ export interface ProductFiles {
     /** The names in a folder, as the migration reads them; none where there is no folder. */
     names(folder: string): readonly string[];
 }
-/** The migration command of a Shopify app in its delivery manifest. */
-export declare const SHOPIFY_MIGRATION: string[];
 /** Whether `version` lies in the caret range `range` from 1.0.0 on; a pre-release lies in none. */
 export declare function fits(version: string, range: string): boolean;
 /** What keeps the product from fitting the installed baukasten; empty when it fits. */

package/dist/check.js

@@ -1,9 +1,16 @@
 import { z } from 'zod';
+import { GATE_SCRIPT, HELD_RULES, KNIP_COMMAND, LINT_COMMAND, LINT_PLUGINS, LINT_TOOLS, TYPECHECK_COMMAND } from './gate.js';
 import { KEY_RIGHTS, WEBHOOK_EVENTS, WEBHOOK_PATH } from './server/stripe.js';
 import { APP_TOML, appTomlProblems } from './shopify/toml.js';
 import { SHOPIFY_STUBS, STUBS } from './stubs.js';
 const ANGABE_PATH = 'deploy/auslieferung.json';
 const STUBS_COMMAND = 'npx --no-install baukasten-stubs';
+const ESLINT_CONFIG = 'eslint.config.js';
+const ESLINT_ENTRY = '@tollwyn/baukasten/eslint';
+const ESLINT_USE = `import baukasten from '${ESLINT_ENTRY}', then export default [...baukasten, …]`;
+const KNIP_CONFIG = 'knip.config.ts';
+const KNIP_ENTRY = '@tollwyn/baukasten/knip';
+const KNIP_USE = `import baukasten from '${KNIP_ENTRY}', then export default { ...baukasten, … }`;
 const ANGABE = z.looseObject({
     version: z.literal(2, 'must be 2, the version that names the art of the product'),
     art: z.literal('webapp', 'must be webapp'),
@@ -20,7 +27,7 @@ const ANGABE = z.looseObject({
     })
 });
 /** The migration command of a Shopify app in its delivery manifest. */
-export const SHOPIFY_MIGRATION = [
+const SHOPIFY_MIGRATION = [
     'node',
     'node_modules/@tollwyn/baukasten/dist/bin/migrate.js',
     'shopify'
@@ -36,17 +43,25 @@ const REFUSED_IN_ADDRESS = ['shopify', 'example'];
 const ART = z.looseObject({ art: z.literal('shopify') });
 const PACKAGE = z.looseObject({
     overrides: z.record(z.string(), z.unknown()).optional(),
-    imports: z.record(z.string(), z.unknown()).optional()
+    imports: z.record(z.string(), z.unknown()).optional(),
+    scripts: z.record(z.string(), z.string()).optional(),
+    knip: z.unknown().optional()
 });
 /** The alias the stubs import the product's src/lib by, as SvelteKit sets it up. */
 const LIB_IMPORT = { key: '#lib/*', target: './src/lib/*' };
 const PEER = z.looseObject({ version: z.string() });
 /**
- * What the product builds with, checked like a peer: adapter-node 5 cannot build SvelteKit 3, and the
- * handler the stub server.js wraps, with its event at shutdown, is that of one major. It is no peer,
- * since only the build needs it, and npm keeps a peer of a dependency in the image.
+ * What the product builds and lints with, checked like a peer: adapter-node 5 cannot build SvelteKit
+ * 3, and the handler the stub server.js wraps, with its event at shutdown, is that of one major; the
+ * config of /eslint and the preset of /knip are written for one major of each tool and plugin. None
+ * is a peer, since only the build and the gate need them, and npm keeps a peer of a dependency in the
+ * image.
  */
-const BUILT_WITH = { '@sveltejs/adapter-node': '^6.0.0' };
+const BUILT_WITH = {
+    '@sveltejs/adapter-node': '^6.0.0',
+    ...LINT_TOOLS,
+    ...LINT_PLUGINS
+};
 /**
  * A reference to an account of a web app or a shop of a Shopify app: the one way a migration of the
  * product names the schema baukasten.
@@ -217,7 +232,7 @@ function packageProblems(files, baukasten) {
     const parsed = json(text);
     const manifest = parsed.kind === 'json' ? PACKAGE.safeParse(parsed.value) : null;
     if (manifest === null || !manifest.success) {
-        return ['package.json is no JSON object, or its overrides or imports are no object'];
+        return ['package.json is no JSON object, or its overrides, imports or scripts are no object'];
     }
     const own = new Set([
         baukasten.name,
@@ -229,8 +244,135 @@ function packageProblems(files, baukasten) {
     if (manifest.data.imports?.[LIB_IMPORT.key] !== LIB_IMPORT.target) {
         problems.push(`package.json does not map imports "${LIB_IMPORT.key}" to "${LIB_IMPORT.target}", which the stubs import from`);
     }
+    if (manifest.data.knip !== undefined) {
+        problems.push(`package.json sets knip, which knip adds to ${KNIP_CONFIG}: move it into ${KNIP_CONFIG}`);
+    }
+    return [...problems, ...gateProblems(manifest.data.scripts ?? {})];
+}
+/** What `npm run gate` must run, read from the scripts, which the workflow of the product runs. */
+function gateProblems(scripts) {
+    const commands = gateCommands(scripts, GATE_SCRIPT, new Set());
+    return [LINT_COMMAND, KNIP_COMMAND, TYPECHECK_COMMAND]
+        .filter((command) => !commands.includes(command))
+        .map((command) => `npm run ${GATE_SCRIPT} does not run ${command}: the script ${GATE_SCRIPT} runs it, or a script it runs with npm run, among commands joined by && and nothing else`);
+}
+/** The script a command runs, where running it with npm is all the command does. */
+function scriptRun(command) {
+    return command === 'npm test' ? 'test' : /^npm run (\S+)$/.exec(command)?.[1];
+}
+/**
+ * The commands a script runs, in it and in the scripts it runs with npm, each with its words joined
+ * by one space. Only a script of commands joined by && counts: any other operator could let a failure
+ * pass, wherever it stands (`a && b || true` is `(a && b) || true`).
+ */
+function gateCommands(scripts, name, seen) {
+    const script = scripts[name];
+    if (script === undefined || seen.has(name) || /[;&|\n]/.test(script.replaceAll('&&', ''))) {
+        return [];
+    }
+    seen.add(name);
+    return script.split('&&').flatMap((part) => {
+        const command = part.trim().split(/\s+/).join(' ');
+        const run = scriptRun(command);
+        return run === undefined ? [command] : gateCommands(scripts, run, seen);
+    });
+}
+/** Strings as they are, comments gone: what JavaScript, TypeScript or tsconfig.json says. */
+const STRINGS_OR_COMMENTS = /'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|`(?:[^`\\]|\\.)*`|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+const withoutComments = (text) => text.replace(STRINGS_OR_COMMENTS, (match) => (match.startsWith('/') ? '' : match));
+/** Whether the code imports the default export of `entry` and spreads it whole, not a part of it. */
+function spreads(code, entry) {
+    const name = new RegExp(String.raw `\bimport\s+([\w$]+)\s+from\s*['"]${entry}['"]`).exec(code)?.[1];
+    return (name !== undefined &&
+        new RegExp(String.raw `\.\.\.\s*${name.replaceAll('$', '\\$')}\s*[,)\]}]`).test(code));
+}
+/** A rule turned off: the severity `'off'`, or `0` for a rule by its name in quotes. */
+const TURNED_OFF = /(['"])off\1|['"][^'"\n]+['"]\s*:\s*\[?\s*0\s*[,\]}]/;
+/**
+ * Read from the text of eslint.config.js only: it spreads the config of the baukasten, turns no rule
+ * off, and names neither a rule it holds, whose options could weaken it, nor the config of
+ * typescript-eslint that turns off the rules needing types.
+ */
+function eslintProblems(files) {
+    const text = files.read(ESLINT_CONFIG);
+    if (text === undefined)
+        return [`${ESLINT_CONFIG} is missing: ${ESLINT_USE}`];
+    const code = withoutComments(text);
+    const problems = spreads(code, ESLINT_ENTRY)
+        ? []
+        : [`${ESLINT_CONFIG} does not spread the config of ${ESLINT_ENTRY}: ${ESLINT_USE}`];
+    for (const rule of HELD_RULES.filter((r) => code.includes(r))) {
+        problems.push(`${ESLINT_CONFIG} names ${rule}, which the config of ${ESLINT_ENTRY} holds: a product adds rules on top and changes none of these`);
+    }
+    if (TURNED_OFF.test(code)) {
+        problems.push(`${ESLINT_CONFIG} turns a rule off: a product adds rules on top and turns none off; where one must stay off at a place, the comment there says why after --`);
+    }
+    if (/\bdisableTypeChecked\b/.test(code)) {
+        problems.push(`${ESLINT_CONFIG} names disableTypeChecked, which turns off the rules of ${ESLINT_ENTRY} that need types: its config gives every file types, the JavaScript in the root too`);
+    }
     return problems;
 }
+/** Where knip looks for its configuration before knip.config.ts, in its order. */
+const KNIP_FIRST = ['knip.json', 'knip.jsonc', '.knip.json', '.knip.jsonc', 'knip.ts', 'knip.js'];
+/** What turns off a kind of issue of knip in its configuration. */
+const KNIP_SWITCHES = ['rules', 'include', 'exclude'];
+/** Read from the text of knip.config.ts only, as from eslint.config.js. */
+function knipProblems(files) {
+    const text = files.read(KNIP_CONFIG);
+    const problems = [];
+    if (text === undefined) {
+        problems.push(`${KNIP_CONFIG} is missing: ${KNIP_USE}`);
+    }
+    else {
+        const code = withoutComments(text);
+        if (!spreads(code, KNIP_ENTRY)) {
+            problems.push(`${KNIP_CONFIG} does not spread the preset of ${KNIP_ENTRY}: ${KNIP_USE}`);
+        }
+        for (const key of KNIP_SWITCHES.filter((k) => new RegExp(String.raw `(?:^|[\s{,])['"]?${k}['"]?\s*:`).test(code))) {
+            problems.push(`${KNIP_CONFIG} sets ${key}, which switches off what the preset of ${KNIP_ENTRY} finds, unused files, exports and dependencies: remove it`);
+        }
+    }
+    for (const first of KNIP_FIRST.filter((f) => files.read(f) !== undefined)) {
+        problems.push(`${first} takes the place of ${KNIP_CONFIG} for knip: remove it`);
+    }
+    return problems;
+}
+const TSCONFIG = z.looseObject({ compilerOptions: z.record(z.string(), z.unknown()).optional() });
+/** What `strict` turns on, each of which a product could turn off again beside it. */
+const STRICT_FAMILY = [
+    'alwaysStrict',
+    'noImplicitAny',
+    'noImplicitThis',
+    'strictBindCallApply',
+    'strictBuiltinIteratorReturn',
+    'strictFunctionTypes',
+    'strictNullChecks',
+    'strictPropertyInitialization',
+    'useUnknownInCatchVariables'
+];
+/**
+ * Read from tsconfig.json itself, not from what it extends: the product sets both there, where its
+ * reader sees them.
+ */
+function tsconfigProblems(files) {
+    const text = files.read('tsconfig.json');
+    if (text === undefined)
+        return ['tsconfig.json is missing'];
+    // tsconfig.json may end an object or array with a comma, which JSON does not take.
+    const plain = withoutComments(text).replace(/"(?:[^"\\]|\\.)*"|,(?=\s*[}\]])/g, (match) => match === ',' ? '' : match);
+    const parsed = json(plain);
+    const tsconfig = parsed.kind === 'json' ? TSCONFIG.safeParse(parsed.value) : null;
+    if (tsconfig === null || !tsconfig.success) {
+        return ['tsconfig.json is no JSON object, or its compilerOptions are no object'];
+    }
+    const options = tsconfig.data.compilerOptions ?? {};
+    return [
+        ...['strict', 'noUncheckedIndexedAccess']
+            .filter((option) => options[option] !== true)
+            .map((option) => `tsconfig.json does not set compilerOptions.${option} to true`),
+        ...STRICT_FAMILY.filter((option) => options[option] === false).map((option) => `tsconfig.json sets compilerOptions.${option} to false, which strict turns on`)
+    ];
+}
 function migrationProblems(files, art) {
     // Like the migration: every entry read, a folder failing loudly, then the .sql files.
     return files
@@ -280,6 +422,19 @@ function configurationProblems(files, art) {
     }
     return problems;
 }
+/**
+ * svelte-check compiles the components with the compilerOptions the product passes to sveltekit() in
+ * vite.config.ts (SvelteKit 3 refuses a svelte.config.*), and a warningFilter among them hides the
+ * warnings of Svelte before --fail-on-warnings sees them.
+ */
+function svelteWarningProblems(files) {
+    const vite = files.read('vite.config.ts');
+    return vite !== undefined && /\bwarningFilter\b/.test(withoutComments(vite))
+        ? [
+            'vite.config.ts sets warningFilter, which hides warnings of Svelte from svelte-check --fail-on-warnings: fix what they say, or silence one at its place with a svelte-ignore comment'
+        ]
+        : [];
+}
 /** What keeps the product from fitting the installed baukasten; empty when it fits. */
 export function productProblems(files, baukasten) {
     const art = artOf(files);
@@ -289,6 +444,10 @@ export function productProblems(files, baukasten) {
         ...versionProblems(files, baukasten),
         ...packageProblems(files, baukasten),
         ...migrationProblems(files, art),
-        ...configurationProblems(files, art)
+        ...configurationProblems(files, art),
+        ...svelteWarningProblems(files),
+        ...eslintProblems(files),
+        ...knipProblems(files),
+        ...tsconfigProblems(files)
     ];
 }

package/dist/eslint.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("eslint/config").ConfigObject[];
+export default _default;

package/dist/eslint.js

@@ -0,0 +1,64 @@
+// The ESLint config of every product, which its eslint.config.js spreads first and adds its own rules
+// to (README, «The gate»). The plugins come from the dev dependencies of the product (gate.ts says
+// why); baukasten-check holds their versions.
+import js from '@eslint/js';
+import comments from '@eslint-community/eslint-plugin-eslint-comments/configs';
+import { defineConfig } from 'eslint/config';
+import svelte from 'eslint-plugin-svelte';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import { HELD_RULES } from './gate.js';
+/**
+ * What reaches the browser: the components, the load functions, hooks and matchers that run on both
+ * sides, and the service worker. A file of the server, a test or src/lib/server/ is none of them.
+ */
+const BROWSER_FILES = [
+    '**/*.svelte',
+    '**/*.svelte.{ts,js}',
+    'src/routes/**/+{page,layout}.{ts,js}',
+    'src/hooks.{ts,js}',
+    'src/hooks.client.{ts,js}',
+    'src/params/*.{ts,js}',
+    'src/service-worker.{ts,js}',
+    'src/service-worker/**'
+];
+/** The entries of the package for the server, which fail the client build (entries.test.ts). */
+const SERVER_ENTRIES = ['server', 'shopify', 'testing'].map((entry) => ({
+    name: `@tollwyn/baukasten/${entry}`,
+    message: 'it runs on the server only: import it in a +page.server.ts, +layout.server.ts, +server.ts, src/hooks.server.ts or src/lib/server/',
+    allowTypeImports: true
+}));
+export default defineConfig({ ignores: ['.svelte-kit/', 'build/', 'coverage/', 'test-results/', 'playwright-report/'] }, js.configs.recommended, tseslint.configs.recommendedTypeChecked, svelte.configs.recommended, comments.recommended, {
+    languageOptions: {
+        parserOptions: {
+            // The stub server.js and the configuration files in the root lie in no tsconfig: they get
+            // the options of the product's own, so that every rule, the product's too, has types.
+            projectService: {
+                allowDefaultProject: ['*.js', '*.mjs', '*.cjs'],
+                defaultProject: 'tsconfig.json'
+            },
+            extraFileExtensions: ['.svelte']
+        }
+    },
+    rules: Object.fromEntries(HELD_RULES.map((rule) => [rule, 'error']))
+}, 
+// A product runs at the root of its own host without a base path, so its links are plain paths and
+// need no resolve(); they carry the referral tag through useLink of /ui.
+{
+    files: ['**/*.svelte', '**/*.svelte.{ts,js}'],
+    languageOptions: {
+        parserOptions: { parser: tseslint.parser, svelteFeatures: { runes: true } }
+    },
+    rules: { 'svelte/no-navigation-without-resolve': 'off' }
+}, 
+// The globals no-undef knows: components run in the browser, and any other JavaScript, the stub
+// server.js and the configuration files among it, in Node or there. TypeScript knows those of its
+// own files, and typescript-eslint turns no-undef off for them.
+{ files: ['**/*.svelte'], languageOptions: { globals: globals.browser } }, {
+    files: ['**/*.{js,mjs,cjs}'],
+    languageOptions: { globals: { ...globals.node, ...globals.browser } }
+}, {
+    files: BROWSER_FILES,
+    ignores: ['**/*.test.ts', '**/*.spec.ts'],
+    rules: { '@typescript-eslint/no-restricted-imports': ['error', { paths: SERVER_ENTRIES }] }
+});

package/dist/gate.d.ts

@@ -0,0 +1,32 @@
+/** The script the workflow of the product runs as its gate. */
+export declare const GATE_SCRIPT = "gate";
+/**
+ * Lint, each warning failing it; a product writes it exactly so, with no flag that weakens it. With
+ * --config, ESLint looks for no config from the folder of each file, where one in a folder below
+ * would take the place of the product's.
+ */
+export declare const LINT_COMMAND = "eslint . --config eslint.config.js --max-warnings 0";
+/** knip with knip.config.ts, the only configuration it reads in a product. */
+export declare const KNIP_COMMAND = "knip";
+/**
+ * The type check, each warning failing it; without --tsconfig, svelte-check reports nothing of the
+ * TypeScript files.
+ */
+export declare const TYPECHECK_COMMAND = "svelte-check --tsconfig ./tsconfig.json --fail-on-warnings";
+/**
+ * Rules of the config of /eslint that a product's eslint.config.js never names, and so never turns
+ * off or weakens by an option: a promise nobody awaits loses its error, a disable without its reason
+ * hides why, and `@ts-nocheck` or `@ts-ignore` take a file or a line out of the type check.
+ */
+export declare const HELD_RULES: readonly ["@typescript-eslint/no-floating-promises", "@typescript-eslint/no-misused-promises", "@typescript-eslint/ban-ts-comment", "@eslint-community/eslint-comments/require-description"];
+/**
+ * What the config of /eslint imports, with the ranges it is written for. The product installs them
+ * as dev dependencies and resolves them for the package: as dependencies or peers of the package,
+ * npm would put them into the image of every product.
+ */
+export declare const LINT_PLUGINS: Readonly<Record<string, string>>;
+/**
+ * The tools the config of /eslint and the preset of /knip are written for, from the dev dependencies
+ * of the product, with their ranges.
+ */
+export declare const LINT_TOOLS: Readonly<Record<string, string>>;

package/dist/gate.js

@@ -0,0 +1,49 @@
+// What the baukasten holds of the gate of a product: the commands its `npm run gate` runs, the rules
+// of the config of /eslint a product never changes, and what the product lints with. Pure, so that
+// baukasten-check reads it without loading ESLint.
+/** The script the workflow of the product runs as its gate. */
+export const GATE_SCRIPT = 'gate';
+/**
+ * Lint, each warning failing it; a product writes it exactly so, with no flag that weakens it. With
+ * --config, ESLint looks for no config from the folder of each file, where one in a folder below
+ * would take the place of the product's.
+ */
+export const LINT_COMMAND = 'eslint . --config eslint.config.js --max-warnings 0';
+/** knip with knip.config.ts, the only configuration it reads in a product. */
+export const KNIP_COMMAND = 'knip';
+/**
+ * The type check, each warning failing it; without --tsconfig, svelte-check reports nothing of the
+ * TypeScript files.
+ */
+export const TYPECHECK_COMMAND = 'svelte-check --tsconfig ./tsconfig.json --fail-on-warnings';
+/**
+ * Rules of the config of /eslint that a product's eslint.config.js never names, and so never turns
+ * off or weakens by an option: a promise nobody awaits loses its error, a disable without its reason
+ * hides why, and `@ts-nocheck` or `@ts-ignore` take a file or a line out of the type check.
+ */
+export const HELD_RULES = [
+    '@typescript-eslint/no-floating-promises',
+    '@typescript-eslint/no-misused-promises',
+    '@typescript-eslint/ban-ts-comment',
+    '@eslint-community/eslint-comments/require-description'
+];
+/**
+ * What the config of /eslint imports, with the ranges it is written for. The product installs them
+ * as dev dependencies and resolves them for the package: as dependencies or peers of the package,
+ * npm would put them into the image of every product.
+ */
+export const LINT_PLUGINS = {
+    '@eslint/js': '^10.0.1',
+    '@eslint-community/eslint-plugin-eslint-comments': '^4.8.1',
+    'eslint-plugin-svelte': '^3.23.1',
+    globals: '^17.13.0',
+    'typescript-eslint': '^8.71.2'
+};
+/**
+ * The tools the config of /eslint and the preset of /knip are written for, from the dev dependencies
+ * of the product, with their ranges.
+ */
+export const LINT_TOOLS = {
+    eslint: '^10.12.0',
+    knip: '^6.41.0'
+};

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { z } from 'zod';
-export { defineProduct, LANGUAGES, type Brand, type Catalog, type CatalogProduct, type Language, type NavigationLink, type Product, type ProductEnv, type ProductLegal, type PurchasePrice, type SubscriptionPrice } from './product.js';
-export { defineShopifyApp, type ShopifyApp, type ShopifyPlan, type ShopifyPrivacy } from './shopify/app.js';
+export { defineProduct, LANGUAGES, type Language, type ProductLegal } from './product.js';
+export { defineShopifyApp } from './shopify/app.js';
 export { SHOPIFY_SVELTEKIT_OPTIONS } from './shopify/sveltekit.js';
 export { SVELTEKIT_OPTIONS } from './sveltekit.js';
-export { TEXTS, type Linked, type Texts } from './texts.js';
-export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, SHOPIFY_VARIABLES, STANDARD_VARIABLES, WEBAPP_VARIABLES, type ShopifyStandardVariable, type StandardVariable } from './variables.js';
+export { TEXTS } from './texts.js';
+export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, STANDARD_VARIABLES } from './variables.js';

package/dist/index.js

@@ -6,4 +6,4 @@ export { defineShopifyApp } from './shopify/app.js';
 export { SHOPIFY_SVELTEKIT_OPTIONS } from './shopify/sveltekit.js';
 export { SVELTEKIT_OPTIONS } from './sveltekit.js';
 export { TEXTS } from './texts.js';
-export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, SHOPIFY_VARIABLES, STANDARD_VARIABLES, WEBAPP_VARIABLES } from './variables.js';
+export { BAUKASTEN_VARIABLES, SHOPIFY_STANDARD_VARIABLES, STANDARD_VARIABLES } from './variables.js';

package/dist/knip.d.ts

@@ -0,0 +1,14 @@
+/** The part of the configuration of knip that the preset sets. */
+export interface KnipPreset {
+    entry: string[];
+    sveltekit: {
+        entry: string[];
+    };
+    playwright: {
+        config: string[];
+        entry: string[];
+    };
+    ignoreDependencies: string[];
+}
+declare const preset: KnipPreset;
+export default preset;

package/dist/knip.js

@@ -0,0 +1,25 @@
+// The knip preset of every product, which its knip.config.ts spreads and adds to (README, «The
+// gate»). knip finds the routes, the hooks of server and client and the matchers through its plugin
+// for SvelteKit, the stub server.js as the file Node starts, and the tests through Vitest; this names
+// what only the baukasten knows, and what the plugin misses.
+import { LINT_PLUGINS } from './gate.js';
+const preset = {
+    // The baukasten loads it, in the migration command and the connection test.
+    entry: ['baukasten.config.ts'],
+    // SvelteKit loads the universal hooks, which the plugin does not name. Here, not under entry, a
+    // product without them gets no hint that the pattern finds nothing; the plugin still reads
+    // vite.config.ts for the rest.
+    sveltekit: { entry: ['src/hooks.{js,ts}'] },
+    // Read, not run: the configuration of Playwright may need the test database to load. Its tests lie
+    // in e2e/, the connection test of the baukasten among them, as Playwright finds them there. What
+    // else the configuration loads (globalSetup, a webServer, a reporter of its own) the product adds
+    // here itself.
+    playwright: {
+        config: [],
+        entry: ['playwright.config.ts', 'e2e/**/*.@(spec|test).?(c|m)[jt]s?(x)']
+    },
+    // What the baukasten imports from the product: the plugins of its ESLint config, and the server of
+    // the SMTP double.
+    ignoreDependencies: [...Object.keys(LINT_PLUGINS), 'smtp-server']
+};
+export default preset;