[artidezi-etke-cc]

Adapts #30 at a5302a7e46d1f5e69b1f5521c68984d4e14b6803.

Adopt TypeScript 7.0.2 with Microsoft’s documented side-by-side aliases: native TypeScript 7 supplies tsc, while the TypeScript 6 compatibility package supplies the API required by typescript-eslint. Regenerate the missing lock update and document the arrangement. Composer validation/audit, PHP image build, PHPStan, PHP/Twig style checks, frontend lint/type checking/build and npm audit passed; browser runtime dependencies and target changes are preserved.

Agent-assessed risk: Medium. This major compiler transition introduces native platform binaries and a dual-version tooling arrangement, verified on the Linux assessment image but not other developer platforms.

Evidence (11 items)

• Local check: git diff 08e00965bc7c375eb71b62727ee5c96171d0c5be...refs/artidezi/inputs/source-pr; git merge-base 08e00965bc7c375eb71b62727ee5c96171d0c5be refs/artidezi/inputs/source-pr — Merge base is the recorded target base. The source changes only typescript 6.0.3 to 7.0.2 in package.json, without a lockfile update. Replacement commit is based on the recorded target and changes only frontend manifests and development documentation.
• Documentation: source — Microsoft explains that TypeScript 7.0 has no JavaScript compiler API and recommends aliasing typescript to @​typescript/typescript6 and @​typescript/native to typescript 7 for tools including typescript-eslint.
• Local check: npm ci --ignore-scripts --no-audit --no-fund (isolated copy of source manifests) — Failed with EUSAGE because package.json and lockfile are out of sync; also reported typescript-eslint peer range >=4.8.4 <6.1.0. This diagnostic used host Node 22/npm 9 and also warned about the existing Select2 Node >=24 requirement; final verification used the repository Node container instead.
• Local check: npm view @​typescript/typescript6 versions --json; npm view typescript@​7.0.2 version bin optionalDependencies --json — Confirmed compatibility package 6.0.2 is available (6.0.3 is not), and TypeScript 7.0.2 supplies tsc and platform binaries. The compatibility package locks its backing TypeScript API at 6.0.3.
• Local check: npm install --package-lock-only --ignore-scripts --no-audit --no-fund --strict-peer-deps (repository Node image, writable /tmp npm cache) — Passed and regenerated lockfile with supported peers. Browser/runtime dependency versions are unchanged. Initial attempt required setting a writable npm cache for the container user.
• Local check: ./bin/composer install --no-interaction --prefer-dist; docker compose -f compose.yml build php — Passed; PHP image build reused cached layers. First Compose attempt failed on absent label files; creating empty ignored var/nagios-labels and var/nginx-labels allowed build and isolated checks. No deployment environment files were read and no monitoring services were started.
• Local check: ./bin/composer validate --strict; ./bin/composer audit --locked — Both passed; composer.json valid, no security advisories found.
• Local check: just php-analyze php-format-check twig-format-check — Passed: PHPStan no errors, PHP CS Fixer 0 of 146 files require fixes, Twig lint 38 files with no warnings/errors. PHP runtime 8.5.12; checks used isolated --no-deps containers.
• Local check: just js-analyze js-build — Passed with repository Node image and fresh npm ci image layer: ESLint, tsc --noEmit and esbuild asset build. Generated assets remain ignored. Existing ESLint deprecation and esbuild install-script policy warnings were emitted; build succeeded.
• Local check: ./bin/node /bin/sh -c 'cd /app/src && npm audit && npm ls --prefix /app typescript @​typescript/native @​typescript/old && tsc --version && node -p "require(\"typescript\").version" && readlink /app/node_modules/.bin/tsc' — Passed: zero vulnerabilities, npm dependency tree has no peer errors, tsc version 7.0.2 points to @​typescript/native/bin/tsc, require("typescript").version is 6.0.3.
• Local check: git diff --check; git status --short — Passed; working tree clean after commit. Browser behavior, other native binary platforms and live monitoring were not exercised; no browser runtime, MongoDB, PHP runtime or Nagios configuration changes were made.

Human review and merge are required.