chore: TypeScript 7.0.2; Bun 1.4.0 pins; dependabot bun

.bun-version

@@ -1 +1 @@
-1.3.14
+1.4.0

.github/dependabot.yml

@@ -1,6 +1,6 @@
 version: 2
 # Weekly, grouped, no auto-merge — per the CeraLive CI/CD standard.
-# github-actions (all workflows) + npm (the Bun workspace at the repo root).
+# github-actions (all workflows) + Bun (the workspace at the repo root).
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -10,14 +10,10 @@ updates:
       github-actions:
         patterns: ["*"]
 
-  - package-ecosystem: "npm"
+  - package-ecosystem: "bun"
     directory: "/"
     schedule:
       interval: "weekly"
     groups:
-      npm:
+      bun:
         patterns: ["*"]
-    # TypeScript 7 is explicitly out of scope; never propose a semver-major TS bump.
-    ignore:
-      - dependency-name: "typescript"
-        update-types: ["version-update:semver-major"]

.github/workflows/ci-bun.yml

@@ -40,7 +40,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       # Node 26 is the CeraLive CI baseline AND the runtime the standalone consumer
       # fixture asserts on: `scripts/verify-consumers.ts` refuses anything but 26.x, so

.github/workflows/release.yml

@@ -117,7 +117,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - uses: actions/setup-node@v7
         with:
@@ -260,7 +260,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - uses: actions/setup-node@v7
         with:

AGENTS.md

@@ -1283,10 +1283,17 @@ rationale, source cites, and the open gates are recorded in `docs/FM350-DECISION
 
 ## WORKSPACE / TOOLCHAIN
 
-- **Bun 1.3.14** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
+- **Bun 1.4.0** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
   are Bun workspace members.
-- **Strict TypeScript** incl. `exactOptionalPropertyTypes` — a single repo-root
-  `tsconfig.json` covers both members (`bun run typecheck` → `tsc --noEmit`).
+- **Strict TypeScript 7.0.2** incl. `exactOptionalPropertyTypes` — the repo-root
+  `tsconfig.json` is the workspace checker (`bun run typecheck` → `tsc --noEmit`) for both
+  members. `control/tsconfig.json` extends it only to give editors the same types for the
+  package's AST guard tests. The root config's explicit `types` entry preserves Bun globals;
+  its DEV-ONLY `paths` map is resolved relative to that config and deliberately has no
+  `baseUrl`, which TypeScript 7 removed.
+- **AST guard compatibility:** `@typescript/typescript6` is a test-only compiler-API shim for
+  source-shape guards. TypeScript 7's native `tsc` remains the workspace checker and emitted
+  package compiler; the shim never reaches `control/dist` or the published tarball.
 - **Biome** via `@ceralive/biome-config` (repo-root `biome.json` extends it). `bun run lint`.
 - **Bun test** (`bun test`) discovers `*.test.ts` across both members.
 - **Node 26** for the standalone consumer fixtures (`control/fixtures/`). Point

README.md

@@ -49,8 +49,10 @@ modem-stack/
 └── POLICY.md       no-fork gate + upstream-contribution-first policy
 ```
 
-`control/` and `cli/` form a single **Bun** workspace (Bun 1.3.14, strict TypeScript,
+`control/` and `cli/` form a single **Bun** workspace (Bun 1.4.0, strict TypeScript 7.0.2,
 Biome via `@ceralive/biome-config`). `packaging/` is built in a bookworm container.
+The two AST-backed source-shape guard tests use the test-only TypeScript 6 compiler-API
+compatibility package; workspace typechecking and package emit remain TypeScript 7.
 
 ## Develop
 

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
 	"extends": ["@ceralive/biome-config"],
 	"files": {
 		"includes": ["**", "!**/node_modules", "!**/dist", "!**/test-results"]

cli/smoke/build-binaries.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Cross-compile the bench CLI and the smoke harness for amd64 + arm64.
 #
-# Bun 1.3.14 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
+# Bun 1.4.0 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
 # the target flag downloads the matching bun runtime and emits a standalone ELF for that
 # architecture). Outputs land in cli/dist/ (gitignored).
 set -euo pipefail

control/README.md

@@ -16,7 +16,7 @@ tree; see [Shape gate](#shape-gate).
 npm install @ceralive/modem-control     # or: bun add @ceralive/modem-control
 ```
 
-ESM only (`"type": "module"`). Node 26 and Bun 1.3 are the runtimes the published
+ESM only (`"type": "module"`). Node 26 and Bun 1.4 are the runtimes the published
 tarball is exercised against on every CI run.
 
 ## Public entry points

control/src/ports/forbidden-surface.test.ts

@@ -18,7 +18,7 @@
 import { expect, test } from 'bun:test';
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
-import * as ts from 'typescript';
+import * as ts from '@typescript/typescript6';
 
 const portsDir = import.meta.dir;
 

control/src/ports/location-fence.test.ts

@@ -9,7 +9,7 @@
 import { expect, test } from 'bun:test';
 import { readdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import * as ts from 'typescript';
+import * as ts from '@typescript/typescript6';
 import { MODEM_LOCATION_IFACE } from '../backend/constants';
 import { LOCATION_IFACE } from '../capability/detect';
 

control/src/transport/README.md

@@ -9,7 +9,7 @@ directly on this shape.
 ## Why this library
 
 `@httptoolkit/dbus-native` is a pure-JavaScript D-Bus client (no libdbus / native
-addon), which is the deciding factor: it imports and runs under **Bun 1.3.14** with
+addon), which is the deciding factor: it imports and runs under **Bun 1.4.0** with
 **EXTERNAL** auth on a session bus — session-verified during A2.4, and pinned exactly at
 `0.1.5`. A native-addon client (anything binding libdbus) is a portability and
 cross-compile liability for the arm64 + amd64 device image; a pure-JS client is not.

control/tsconfig.json

@@ -0,0 +1,4 @@
+{
+	"extends": "../tsconfig.json",
+	"include": ["src", "scripts", "test-support"]
+}

package.json

@@ -5,7 +5,7 @@
 	"type": "module",
 	"description": "Cellular modem control for CeraLive — @ceralive/modem-control library, bench CLI, and ModemManager-stack .deb packaging (Phase A, standalone).",
 	"license": "AGPL-3.0",
-	"packageManager": "bun@1.3.14",
+	"packageManager": "bun@1.4.0",
 	"workspaces": [
 		"control",
 		"cli"
@@ -18,9 +18,10 @@
 		"test": "bun test"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.5.8",
-		"@ceralive/biome-config": "2026.8.0",
-		"@types/bun": "1.3.14",
-		"typescript": "^5"
+		"@biomejs/biome": "2.5.9",
+		"@ceralive/biome-config": "2026.8.1",
+		"@types/bun": "1.4.0",
+		"@typescript/typescript6": "6.0.2",
+		"typescript": "^7.0.2"
 	}
 }