deps: TypeScript 6.0 for the server, the SDK and the LangChain handler

[irparent]

What this changes

TypeScript 6.0.3 for the server, the SDK and the LangChain handler, in one change. The dashboard and the website are already on TypeScript 6.

Where	Update	Covers
root	typescript 5.9.3 → 6.0.3	#822
packages/sdk/	typescript 5.9.3 → 6.0.3	#828
packages/langchain/	typescript 5.9.3 → 6.0.3

Closes #58. The root's lint, typescript-eslint 8.71, now admits TypeScript >=4.8.4 <6.1.0, so 6.0 is in range. .github/dependabot.yml keeps the root below 6.1 until it admits more.

TypeScript 6 deprecates moduleResolution: "Node10", and TypeScript 7 removes it. The CommonJS builds of the SDK and the LangChain handler used it, so they now use "Bundler". The ES module builds already used NodeNext and are unchanged.

Each lockfile was regenerated on Linux (node:24, --package-lock-only). TypeScript is a build-time dependency only, so nothing a user installs changes.

Checks

What ships is unchanged. Every package was built twice, with TypeScript 5.9.3 from main and with 6.0.3 from this branch, and the outputs compared file by file. The JavaScript and the type declarations are identical byte for byte:

Package	Files compared	Files that differ
Server (tsc -p tsconfig.build.json)	471	0
SDK (ES modules and CommonJS)	25	0
LangChain handler (ES modules and CommonJS)	13	0

The tests pass on TypeScript 6. Every check below ran in a worktree with these lockfiles freshly installed:

• Root: the truthbase was captured on this branch, and 4,772 of 4,772 tests pass with none skipped. claims:generate reports no change.
• Root static checks: lint, typecheck, typecheck:tests, proof:typecheck and proof:judge:typecheck pass.
• Claims, schema, proof and version checks: all exit 0, run unpiped, including proof --check with --invariants and with --transcripts.
• SDK and LangChain handler:
  • The build and typecheck pass, run in the same order as CI, against a server built from this branch.
  • The SDK's 47 tests and the handler's 17 pass.
  • A packed tarball installed into a clean project loads through both import and require.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
website	Ignored		Oct 4, 2026 11:37am UTC

[github-actions]

Iris gate — 1 of 2 tripped --fail-on detector_veto

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Verdict	Basis	Rules, classes or missing inputs	Evidence
debdcfa0b4a65fddf570d5b39d80fbd5	failed	detector_veto + risk_over_loss	no_pii, pii_leak, credential_leak	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
detector_veto	2
clean	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

[github-actions]

Iris gate — 1 stored, nothing tripped --fail-on any

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
clean	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}