Spike: adopt the Dependabot bumps (blocked on typescript-eslint TS 7 support)

[EllAchE]

Summary

Draft, not for merge. This is the road not taken: main was unblocked by #196, which restored the five dependency ranges to the versions bun.lock already pinned. This branch took the other route — regenerate the lockfile and adopt the bumps — and is parked because one of the five is not adoptable yet.

Kept because the zod 4 work is reusable whenever the repo does move, and because the blocker is worth recording rather than rediscovering.

What is here

• app/api/v1/_lib/openapi.ts ported from zod 3's _def.typeName to zod 4's _zod.def.type. The subtle part is pipe direction: .transform() pipes the declared schema into a coercion, z.preprocess() pipes a coercion into the declared schema. The side that is not the transform is the one describing what a caller sends. Reading in unconditionally documented the limit/offset query params as an untyped {} — a silent 36-line hole in the published spec. openapi.test.ts:80 pins exactly that case.
• lib/services/notification-preferences.ts — enum-keyed z.record needs z.partialRecord in zod 4. This is a runtime behaviour change, not just a type error: without it the schema demands every notification category be present.
• z.record arity fixes in app/api/v1/_lib/schemas.ts, errorMap to error in lib/services/sponsors.ts, a narrowing helper in lib/mcp/server.ts, and declare module '*.css' in types/static-assets.d.ts for TS 7's side-effect import checking.

Generated contracts (docs/openapi.json, docs/mcp-tools.json) regenerate byte-identical under the ported walker.

What blocks it

typescript@^7.0.2 cannot be adopted on Bun today.

1. typescript-eslint throws at require time on TS >= 7 (node_modules/typescript-eslint/dist/index.js:45). No released version supports it — 8.67.0 is latest, tracking issue typescript-eslint#10940. bun run lint cannot run at all, so adopting TS 7 means losing the lint gate entirely.
2. Microsoft's documented workaround aliases typescript to the @typescript/typescript6 compat package. That package is a shim — module.exports = require("@typescript/old") — where @typescript/old is itself npm:typescript@^6. Bun dedupes that inner alias onto the root's own typescript alias, so the shim requires itself and exports nothing (require('typescript').versionMajorMinor is undefined). An overrides entry pinning @typescript/old does not break the cycle.

Reviving this branch means waiting for typescript-eslint TS 7 support. The other four bumps (zod 4, @types/node 26, eslint-config-next 16.3.1, @anthropic-ai/sdk 0.117.1) are adoptable on their own if someone wants to split them out.

Test plan

Against the full bump set, before the TS 7 blocker was hit:

• bun run typecheck
• bun run docs:openapi + bun run docs:mcp — byte-identical output
• bun run lint — cannot run, see above
• bun run test / bun run build — not run; branch is 20+ commits behind main

🤖 Generated with Claude Code