build: unpin TypeScript 5.9.3 once the dts toolchain supports TS 7

Summary

TypeScript is pinned to an exact 5.9.3 in the pnpm-workspace.yaml catalog, and typescript is listed under updateConfig.ignoreDependencies so pnpm depupdate cannot move it. This is a deliberate hold, not a preference: the declaration build does not work under TypeScript 7 yet.

This issue tracks lifting that pin once the toolchain supports it.

Why it is pinned

TS 7 is the native (Go) port. The .d.ts build chain reaches into TypeScript compiler internals that the port changed:

• tsup@8.5.1 (latest) bundles rollup-plugin-dts@6.1.1. Even the newest rollup-plugin-dts@6.4.1 declares peerDependencies.typescript: "^4.5 || ^5.0 || ^6.0" — no 7.x.
• Under TS 7 the build fails with TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames').

tsdown (rolldown-based, supports typescript: ^5 || ^6 || ^7) was trialled as a replacement. JS output and the CLI binary worked, but declaration generation surfaced two blockers:

1. Error: tsgo did not generate dts file for packages/sdk/src/index.ts
2. Every build wrote ~116 stray .d.ts / .d.ts.map files into packages/rules/src/

Both trace to one root cause: tsconfig.base.json maps @cloudburn/sdk → ./packages/sdk/src/index.ts, so the declaration generator follows the alias into sdk sources instead of treating it as an external package. rootDir/outDir are then not honoured through the experimental TS 7 API. tsdown warns about this on every run:

WARN TypeScript 7.0 does not yet have a stable API and is experimental.
     Some options will be unavailable.

The hard part

The paths-to-source mapping looks load-bearing. rules needs sdk's types while sdk imports rules at runtime, so resolving via built dist/*.d.ts instead would require sdk to build before rules — the wrong order, and likely a build cycle.

Lifting the pin therefore is not just a toolchain bump. It needs a decision on how the three packages type-reference each other. Options not yet evaluated:

• Project references / composite builds
• isolatedDeclarations so declarations emit per package without cross-package type resolution
• Keeping paths for typecheck only, with a separate build-time tsconfig

How TypeScript drifted before (context)

Worth recording, because it hid for a long time:

1. pnpm depupdate (pnpm update --latest) rewrote the catalog to ^7.0.2. --latest ignores declared ranges, so an exact pin alone does not stop it.
2. minimumReleaseAge: 7 then refused to install the days-old TS 7, so the lockfile stayed on 5.9.3 — producing a contradictory lockfile entry: specifier: ^7.0.2 / version: 5.9.3.
3. pnpm install --frozen-lockfile never flagged it. It compares the manifest spec (catalog:) against the lockfile's recorded spec (catalog:) and does not check that the resolution satisfies the catalog spec. CI stayed green against a TypeScript the repo did not declare.

updateConfig.ignoreDependencies closes step 1. Steps 2–3 are unguarded for the other catalog entries.

Done when

• rolldown-plugin-dts (or an equivalent) supports TS 7 on a stable API
• Cross-package type resolution decided, so declaration generation does not descend into sibling sources
• packages/rules and packages/sdk emit index.d.ts + index.d.cts matching the published exports map
• No build artifacts written outside dist/
• pnpm verify green, and the built CLI runs (node dist/cli.js --version)
• typescript removed from updateConfig.ignoreDependencies and the catalog pin relaxed
• Comment in pnpm-workspace.yaml explaining the pin removed

Possible follow-up (separate scope)

A CI check that each catalog entry's recorded specifier is satisfied by its recorded version would have caught the original drift at the commit that introduced it. --frozen-lockfile does not do this.

Start by reading pnpm-workspace.yaml and tsconfig.base.json, then reproduce the TypeScript 7 declaration build with pnpm verify. Investigate the cross-package type resolution for packages/rules and packages/sdk; done means stable TS 7 support, correct declaration outputs, no artifacts outside dist/, a working CLI, and the pin removed.