fix(build): repair broken production build, red lint gate and SWR crash

[diegosouzapw]

npm run build and npm run lint are both red on release/v3.8.50. This restores them, and fixes a runtime crash found along the way.

Eight module-level defects from eight different PRs had accumulated. The common cause: the Build CI job is advisory, not blocking, so each one merged green and the next author inherited an already-broken tree.

Build — link-time failures (7 Turbopack errors)

File	Defect	From
src/shared/components/modelSelectModalHelpers.ts	A lost } left export const PROVIDER_TEST_CHUNK_SIZE inside isProviderModelHidden's body	#9011
open-sse/handlers/videoGeneration.ts	handleFalVideoGeneration imported twice from two modules	#9982 over #9969
src/app/api/v1/models/catalog.ts	Re-exported three symbols ./catalogCache no longer exports	#9199
open-sse/executors/tinycmsSigner.ts	new URL('wasm_signer_bg.wasm', import.meta.url) — no such file in the repo	#8736 / #10087
src/app/api/providers/[id]/models/conolDiscovery.ts	Imported getProviderOutboundGuard from outboundUrlGuard, which does not export it	#8974

Two of these needed a judgement call rather than a mechanical fix:

catalog.ts (#9199). #9199 landed after #8728 and deliberately replaced its injectable CatalogCachePolicy + CATALOG_STALE_WHILE_REVALIDATE_MS = POSITIVE_INFINITY with a fixed 30 s bound — an unbounded window let a refresh that kept failing pin an ancient catalog forever, and the PR carries production measurements (a 41 s catalog build, 163 of 164 dashboard heartbeats exceeding their 3 s probe). It updated catalogCache.ts but left the consumer and the #8728 test suite on the old contract. Fixed on the consumer side. Restoring the accessor would have reverted a deliberate performance fix while claiming to repair a build.

conolDiscovery.ts (#8974). outboundUrlGuard.ts carries an explicit note (#7682) that these helpers live in the sibling outboundUrlGuardPolicy.ts because they pull in featureFlags → the DB layer, and outboundUrlGuard.ts is loaded by the packaged CLI (omniroute setup-opencode) where no tsconfig.json resolves @/*. Fixed on the consumer side; a regression guard asserts the module stays free of @/-aliased imports.

open-sse/handlers/videoGeneration/falHandler.ts is deleted — superseded by mediaGeneration/fal.ts, with no remaining references (rg falHandler is empty).

Runtime — a crash the build could never catch

catalogCache.ts::scheduleBackgroundRefresh contained two dangling statements referencing inFlight and promise, neither declared in that scope:

inFlight = { version: lastSeenCatalogCacheVersion, promise };
promise.catch(() => {});

Every stale-while-revalidate read threw ReferenceError: promise is not defined. This is a runtime error, not a link error, so next build passes over it — it only surfaced because realigning the #8728 suite made a test exercise the path again.

Lint (14 errors → 0)

• tests/unit/db-adapters/driverFactory.test.ts (feat(cursor): proactively renews Cursor sessions and fixes manual refresh #9173) — a case was inserted between the preceding test's finally block and its });, leaving the file unparseable. 13 of the 14 lint errors were cascade from that. More seriously: a file that does not parse never runs, so the SQLite driver-cascade suite (26 tests, covering better-sqlite3 / node:sqlite / sql.js) has not executed since 2026-08-11. All 26 pass once it parses again — nothing was masking a real defect.
• providerModelsConfig.ts ([v3.8.50] Fix Z.ai web browser transport and model capabilities #8451) — imported an executor directly, crossing the G14 import boundary. Routed through a new open-sse/services/zaiWebCredentials.ts; extractZaiToken is pure credential parsing, so a thin service re-export is the right shape.
• tests/unit/combo/image-combo.test.ts (feat(images): add full combo strategy execution for image generation (#9239) #9499) — 11 @typescript-eslint/no-explicit-any violations, now typed.

Tests

tests/unit/production-build-module-integrity.test.ts is a new guard: one case per defect, each expressed as "this module must be importable / statically resolvable", plus behavioral assertions for the SWR crash and the #7682 boundary. tests/unit/model-catalog-cache-swr-8728.test.ts is realigned to the shipped contract — the behavior #8728 added (an expired-but-recent successful entry is served immediately while a refresh runs behind it) is still fully covered, and the suite now also asserts the removed accessor trio stays removed.

No assertion was weakened or deleted to reach green.

Validation

npm run build            exit 0   ← the gate this PR exists to restore
npm run lint             clean    ← was 14 errors
npm run typecheck:core   clean
node --test tests/unit/production-build-module-integrity.test.ts
              tests/unit/model-catalog-cache-swr-8728.test.ts
              tests/unit/db-adapters/driverFactory.test.ts       33/33 pass
node --test tests/unit/combo/image-combo.test.ts                  8/8 pass

Follow-up worth considering

Making the Build job blocking once this lands would stop the next round of this. Six link-time defects reaching a release branch undetected is the direct consequence of it being advisory. Not changed here — that is a CI policy decision.

Refs #9011 #9982 #9199 #8728 #8736 #10087 #8974 #9173 #8451 #9499