fix: pin typescript to 5.x so the SDK codegen runs again

[QuanticPotatoes]

Problem

pnpm run generate has failed on every Generate SDK dispatch since 2026-08-29 — 10 consecutive runs. The published SDK is therefore frozen at API spec 1.109.0 while production is at 1.114.0 (missing: GET /v2/e-invoicing/platform-choice, the PlatformTransferStatus / ReadMePlatformTransferDto / RegistrationStatus schemas, and changes to ReadMeDto, ReadMeEInvoicingDto, PushNotificationPreferencesDto).

TypeError: Cannot read properties of undefined (reading 'LineFeed')
  at @hey-api/openapi-ts/dist/init-*.mjs:4156
      newLine: ts.NewLineKind.LineFeed,

Cause

openapi-ts is built on the legacy TypeScript compiler API. TypeScript 7 (tsgo) exports nothing of it from the main entry:

$ node -p "Object.keys(require('typescript'))"
[ 'version', 'versionMajorMinor' ]

Everything moved behind typescript/unstable/*, so every ts.* read is undefined. The breakage landed with 0443560 (chore: pnpm 11, TypeScript 7, oxlint, 2026-08-27 12:12) — 4 h after the last green generate.

Two dead ends, measured, so nobody repeats them:

• Upgrading the generator does not help. 0.99.0 fails identically, one line further along, on ts.SyntaxKind. (Dependabot build(deps): bump @hey-api/openapi-ts from 0.97.3 to 0.99.0 in the production-dependencies group across 1 directory #29 is therefore not a fix for this.)
• Scoping the pin to the generator does not work. openapi-ts declares typescript as a peer (>=5.5.3 || >=6.0.0), which TS 7 satisfies numerically. Both overrides: '@hey-api/openapi-ts>typescript' and packageExtensions lose to the peer — the link still resolves to typescript@7.0.2.

Fix

Root typescript back to ^5.9.3. Nothing here needs TS 7: the bundle comes out of esbuild, and 5.9 covers tsc --noEmit and the declaration emit. tsgo can return once hey-api supports it.

Plus a codegen CI job. No job ran pnpm run generate, which is exactly why CI stayed green through ten failed dispatches — the repo's core function was broken and nothing said so. It now regenerates from the committed spec and fails on drift.

Two smaller items ride along:

• README — the Validation section claimed responses are validated by Zod. They are not: openapi-ts.config.ts sets responses: false deliberately, and the generated client holds 142 requestValidator calls and 0 responseValidator. Also adds abby.customerPortal, which was missing from the service list (9 documented for 10 exposed).
• .worktrees/ ignored by git and prettier — a local worktree put 15 untracked files into pnpm run format:check.

Verification

Gate	Result
generate from the committed 1.109.0 spec	src/client byte-identical — same output as the last green run
lint / format:check / typecheck	pass
build:only	pass (cjs + esm + types)
test	44/44
generate from the live 1.114.0 spec, then build + test	pass, 44/44

After merge

Publication will not restart on its own: the monorepo only dispatches on promote-to-prod when the spec hashes differ. Trigger Generate SDK manually (workflow_dispatch, bump minor) to get the 1.114.0 update PR and the release.

---

Note

Medium Risk
Pins the build/codegen toolchain and adds a gate on generated client output; no runtime SDK logic changes in the diff, but incorrect drift checks could block merges until src/client is regenerated.

Overview
Restores pnpm run generate by pinning TypeScript to ^5.9.3 (from 7.x), because @hey-api/openapi-ts still depends on the legacy compiler API that TS 7 no longer exposes from the main package.

Adds a codegen CI job that runs pnpm run generate against the committed OpenAPI spec and fails if src/client drifts, and wires that job into ci-success so broken codegen can’t stay green while release workflows fail.

README now documents request-only Zod validation (responses are typed but not runtime-validated) and lists abby.customerPortal. .worktrees/ is ignored for git and Prettier.

^{Reviewed by Cursor Bugbot for commit c93ca89. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##           master      #36   +/-   ##
=======================================
  Coverage   90.75%   90.75%           
=======================================
  Files           1        1           
  Lines         119      119           
  Branches       30       30           
=======================================
  Hits          108      108           
  Misses         11       11           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 44b4d6b. Configure here.}

[QuanticPotatoes]

ask-approval

[cursor]

Risk: medium. Approved after Cursor Bugbot and Cursor Security Agent completed successfully; the prior Bugbot finding is resolved. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}