Dependency risk tracking: Elysia 2.0.0-beta pin + vendored shims

[zakius]

Tracking issue for accepted-but-fragile dependency choices (shims are intended and working well — this is about keeping them that way):

• elysia: 2.0.0-beta.4 pinned; the central error hook (server-app.ts) depends on beta internals, and at least one beta validation bug is already worked around manually (login.ts:29: Codec .Decode() transforms not run on bodies). Revisit when 2.0 stabilizes.
• vendor/fast-xml-parser-shim and vendor/linkedom-shim replace upstream via file: + overrides, plus a patchfile for article-extractor. A minor upstream bump reaching for an unimplemented shim API fails only at runtime — add shim-fidelity tests (or CI that exercises feed-parser/readability against the shims) and re-verify on every bump of dependents.

[zakius]

Status pass, 2026-09-08:

Shim half: done. vendor/__tests__/shim-fidelity.test.ts is the bump alarm this asked for — it walks each dependent's own source for the names it imports from fast-xml-parser/linkedom and fails when the shim doesn't implement one, and it checks the real package hasn't landed nested under the dependent. vendor/fast-xml-parser-shim/__tests__/ adds 13 behaviour tests on top. Both run in test:unit.

Elysia half: still open, and the pin has moved. The body says 2.0.0-beta.4; package.json is now 2.0.0-beta.14, which is the current next tag (latest is 1.4.30). So there is nothing to revisit yet — leaving this open as the tracker for when 2.0 stabilizes and the login.ts Codec workaround can be retested.