mono - chore: upgrade TypeScript build tooling

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Chore — dependency upgrade of the non-breaking TypeScript build/execution tooling. No runtime or source changes.

Versions

• tsx ^4.22.4 → ^4.23.0
• tsdown ^0.22.2 → ^0.22.4

Versions are the exact "Latest" from pnpm outdated (gated by the workspace minimumReleaseAge); no majors.

Two members of the TypeScript/build group are intentionally excluded from this PR:

• typescript 6 → 7 — a breaking major; it gets its own (breaking) PR after breaking-change review.
• @types/node 25 → 26 — .nvmrc pins Node 24 while @types/node already sits at 25 and CI tests Node 22/24/26; this version-source mismatch needs a decision rather than a guess.

Tests

• pnpm build passes (tsdown is the bundler for every package)
• pnpm test passes — qified 132, nats 80, rabbitmq 114, redis 88, valkey 88, zeromq 8; 100% coverage maintained

🤖 Generated with Claude Code

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.23.0
	tsdown@​0.22.4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.22.4 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[gemini-code-assist]

Code Review

This pull request updates dependencies in package.json and pnpm-lock.yaml, bumping tsdown to version 0.22.4 and tsx to 4.23.0. In the lockfile, rolldown is updated to 1.1.5 and rolldown-plugin-dts is updated to 0.27.4. This update transitions the AST toolchain by replacing Babel-related packages with yuku-ast, yuku-codegen, and yuku-parser. I have no feedback to provide as there are no review comments and the dependency updates are standard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (5366cc5) to head (89e0fec).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #207   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           12        12           
  Lines         1659      1659           
  Branches       288       288           
=========================================
  Hits          1659      1659           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89e0fec872

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Raise the Node 24 floor for tsdown

With this upgrade, the lockfile resolves tsdown@0.22.4, whose package metadata now declares engines: {node: ^22.18.0 || >=24.11.0} in pnpm-lock.yaml, but the root package still advertises support for every Node >=24.0.0. Contributors or CI jobs running Node 24.0 through 24.10 can still satisfy the repo engine range but hit unsupported-engine failures in engine-strict installs or when invoking the build tool, so the repo engine should be tightened or the tsdown upgrade held back.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Hold tsdown until the release-age window expires

The workspace policy sets minimumReleaseAge: 10080 and minimumReleaseAgeStrict: true in pnpm-workspace.yaml:10-11, but this lockfile pins tsdown@0.22.4 while the npm package metadata currently reports that release as only a few hours old. That contradicts the repo's 7-day supply-chain gate and can force the next policy-enforced re-resolution to roll this upgrade back or require an explicit exception, so this version should wait until it ages in or be excluded deliberately.

Useful? React with 👍 / 👎.