feat: warn when using a .server. file or file inside a server directory without importing a server-only module

[dummdidumm]

#12529 was opened a while ago, and since then things have changed. We do check all files now, but we do not error on .server. files or files inside server directories if they're outside the cwd.

We decided we want to keep that logic. Things outside it (or inside node_modules) still will fail if they e.g. import $app/server or $app/env/private. We decided that this is the desired behavior - and it already is that way today. This PR therefore only adds additional validation to @sveltejs/package to hint at this, and thereby closes #12529

We said we may investigate creating an npm package which you can also use and establish it as somewhat of a standard across the Vite ecosystem, but that will happen separately.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 09c3b44:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/09c3b443d8313c76b85a24dbff44c89b1dddcf3d

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16266

[changeset-bot]

🦋 Changeset detected

Latest commit: 09c3b44

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/package	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[svelte-docs-bot]

Preview: https://svelte-dev-git-preview-kit-16266-svelte.vercel.app/

[Rich-Harris]

couldn't this be a Set?

Suggested change

	const is_server_only = name.includes('.server.') || /(^|\/)server\//.test(name);
	unprotected_server_only_files.set(name, is_server_only && !has_guard_import);
	if (!has_guard_import && (name.includes('.server.') || /(^|\/)server\//.test(name))) {
	unprotected_server_only_files.add(name);
	}

[Rich-Harris]

Should we account for transitive deps? You can imagine a scenario like this:

// src/server/api.js
import { db } from './db.js';

export function getThings() {
  return db.select().from(things);
}

// src/server/db.js';
import { DATABASE_URL } from '$app/env/private';
import { createClient } from 'database-library';

export const db = createClient(DATABASE_URL);

api.js is protected, but we can't determine that in isolation. A warning here would be annoying; I don't want to add a phantom import for no reason.

[Rich-Harris]

small suggestion but otherwise LGTM

[Rich-Harris]

/autofix