chore: TypeScript 7.0.2; Bun 1.4.0 pins; dependabot bun (#17)

* chore(modem-stack): TypeScript 7.0.2; Bun 1.4.0 pins; dependabot bun

* ci(modem-stack): pin Bun 1.4.0

* chore(deps): use Bun Dependabot updates

* test(control): retain AST guards under TypeScript 7

* docs(modem-stack): document TypeScript 7 toolchain

* docs(control): update Bun runtime references

* chore: bump @ceralive/biome-config to published 2026.8.1

Author: andrescera

.bun-version

@@ -1 +1 @@
-1.3.14
+1.4.0

.github/dependabot.yml

@@ -1,6 +1,6 @@
 version: 2
 # Weekly, grouped, no auto-merge — per the CeraLive CI/CD standard.
-# github-actions (all workflows) + npm (the Bun workspace at the repo root).
+# github-actions (all workflows) + Bun (the workspace at the repo root).
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -10,14 +10,10 @@ updates:
       github-actions:
         patterns: ["*"]
 
-  - package-ecosystem: "npm"
+  - package-ecosystem: "bun"
     directory: "/"
     schedule:
       interval: "weekly"
     groups:
-      npm:
+      bun:
         patterns: ["*"]
-    # TypeScript 7 is explicitly out of scope; never propose a semver-major TS bump.
-    ignore:
-      - dependency-name: "typescript"
-        update-types: ["version-update:semver-major"]

.github/workflows/ci-bun.yml

@@ -40,7 +40,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       # Node 26 is the CeraLive CI baseline AND the runtime the standalone consumer
       # fixture asserts on: `scripts/verify-consumers.ts` refuses anything but 26.x, so

.github/workflows/release.yml

@@ -117,7 +117,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - uses: actions/setup-node@v7
         with:
@@ -260,7 +260,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.0
 
       - uses: actions/setup-node@v7
         with:

AGENTS.md

@@ -1283,10 +1283,17 @@ rationale, source cites, and the open gates are recorded in `docs/FM350-DECISION
 
 ## WORKSPACE / TOOLCHAIN
 
-- **Bun 1.3.14** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
+- **Bun 1.4.0** (`.bun-version`, `packageManager` in `package.json`). `control/` + `cli/`
   are Bun workspace members.
-- **Strict TypeScript** incl. `exactOptionalPropertyTypes` — a single repo-root
-  `tsconfig.json` covers both members (`bun run typecheck` → `tsc --noEmit`).
+- **Strict TypeScript 7.0.2** incl. `exactOptionalPropertyTypes` — the repo-root
+  `tsconfig.json` is the workspace checker (`bun run typecheck` → `tsc --noEmit`) for both
+  members. `control/tsconfig.json` extends it only to give editors the same types for the
+  package's AST guard tests. The root config's explicit `types` entry preserves Bun globals;
+  its DEV-ONLY `paths` map is resolved relative to that config and deliberately has no
+  `baseUrl`, which TypeScript 7 removed.
+- **AST guard compatibility:** `@typescript/typescript6` is a test-only compiler-API shim for
+  source-shape guards. TypeScript 7's native `tsc` remains the workspace checker and emitted
+  package compiler; the shim never reaches `control/dist` or the published tarball.
 - **Biome** via `@ceralive/biome-config` (repo-root `biome.json` extends it). `bun run lint`.
 - **Bun test** (`bun test`) discovers `*.test.ts` across both members.
 - **Node 26** for the standalone consumer fixtures (`control/fixtures/`). Point

README.md

@@ -49,8 +49,10 @@ modem-stack/
 └── POLICY.md       no-fork gate + upstream-contribution-first policy
 ```
 
-`control/` and `cli/` form a single **Bun** workspace (Bun 1.3.14, strict TypeScript,
+`control/` and `cli/` form a single **Bun** workspace (Bun 1.4.0, strict TypeScript 7.0.2,
 Biome via `@ceralive/biome-config`). `packaging/` is built in a bookworm container.
+The two AST-backed source-shape guard tests use the test-only TypeScript 6 compiler-API
+compatibility package; workspace typechecking and package emit remain TypeScript 7.
 
 ## Develop
 

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
 	"extends": ["@ceralive/biome-config"],
 	"files": {
 		"includes": ["**", "!**/node_modules", "!**/dist", "!**/test-results"]

bun.lock

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Cross-compile the bench CLI and the smoke harness for amd64 + arm64.
 #
-# Bun 1.3.14 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
+# Bun 1.4.0 cross-compiles with `--compile --target=bun-linux-<x64|arm64>` (verified:
 # the target flag downloads the matching bun runtime and emits a standalone ELF for that
 # architecture). Outputs land in cli/dist/ (gitignored).
 set -euo pipefail

cli/smoke/build-binaries.sh

@@ -16,7 +16,7 @@ tree; see [Shape gate](#shape-gate).
 npm install @ceralive/modem-control     # or: bun add @ceralive/modem-control
 ```
 
-ESM only (`"type": "module"`). Node 26 and Bun 1.3 are the runtimes the published
+ESM only (`"type": "module"`). Node 26 and Bun 1.4 are the runtimes the published
 tarball is exercised against on every CI run.
 
 ## Public entry points