chore(lint): align the ESLint and TypeScript lint toolchain

Transplanted-From: 5bf7793 (remediation pack 2026-07-20)

Author: cryptoxdog

eslint.config.js

@@ -1,7 +1,27 @@
 import eslint from '@eslint/js';
 import tseslint from 'typescript-eslint';
+
 export default tseslint.config(
-  { ignores: ['dist/**', 'node_modules/**'] },
+  { ignores: ['dist/**', 'node_modules/**', 'artifacts/**', 'coverage/**'] },
   eslint.configs.recommended,
   ...tseslint.configs.recommended,
+  {
+    files: ['src/**/*.ts'],
+    rules: {
+      '@typescript-eslint/consistent-type-imports': ['error', { prefer: 'type-imports' }],
+      '@typescript-eslint/no-explicit-any': 'warn',
+    },
+  },
+  {
+    files: ['src/**/*.ts'],
+    ignores: ['src/index.ts', 'src/providers/**'],
+    rules: {
+      'no-restricted-imports': ['error', {
+        patterns: [{
+          group: ['**/providers/*', '**/providers/**'],
+          message: 'Provider clients are an I/O boundary. Route production execution through src/index.ts.',
+        }],
+      }],
+    },
+  },
 );

package.json

@@ -37,9 +37,9 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^20.19.43",
-    "eslint": "^9.0.0",
+    "eslint": "^10.7.0",
     "typescript": "^5.5.0",
     "typescript-eslint": "^8.64.0",
     "vitest": "^4.1.10"

tests/eslint-boundary.test.ts

@@ -0,0 +1,16 @@
+import { ESLint } from 'eslint';
+import { describe, expect, it } from 'vitest';
+
+describe('ESLint provider boundary', () => {
+  it('rejects a production provider bypass', async () => {
+    const eslint = new ESLint({ cwd: process.cwd() });
+    const [result] = await eslint.lintText("import { OpenRouterClient } from './providers/openrouter.js';\nvoid OpenRouterClient;\n", { filePath: 'src/boundary-probe.ts' });
+    expect(result.messages.some(message => message.ruleId === 'no-restricted-imports' && message.severity === 2)).toBe(true);
+  });
+
+  it('allows the composition root to import providers', async () => {
+    const eslint = new ESLint({ cwd: process.cwd() });
+    const [result] = await eslint.lintText("import { OpenRouterClient } from './providers/openrouter.js';\nvoid OpenRouterClient;\n", { filePath: 'src/index.ts' });
+    expect(result.messages.some(message => message.ruleId === 'no-restricted-imports')).toBe(false);
+  });
+});