Migrate the dependency build policy to allowBuilds and update pnpm/action-setup to v6 for pnpm 12 support. Record pnpm's native executables in the environment lockfile without changing application dependency resolutions.

Update vulnerable runtime, development, and example dependencies. Pin the secure Redocly 1.x release, constrain vulnerable transitive resolutions, and keep test/export tooling compatible with the patched graph.

Adapt PR #2774 to the secured pnpm 12 branch. Widen the TypeScript peer
range to ^5.x || ^6.x and use 6.0.3 through the shared catalog, preserving
other package versions, security resolutions, and pnpm/action-setup v6.

Resolve read/write markers consistently in the helpers package and the
generator's inline helpers. Rebuild readonly collection methods from resolved
elements while preserving own properties, fixed indices, and literal length.
Keep the historical mutable-tuple projection and lazy recursive-array behavior;
avoid introducing tuple reconstruction, normalization, or depth-limit machinery.
Preserve required numeric literal properties without retaining the broad index.
Cover constrained generic arrays and objects, array interfaces, marked metadata,
iteration, forbidden pushes, recursive JSON, and mutable/readonly recursive unary,
optional, and rest tuples.
Apply the existing never-element rule to excluded readonly collection elements.
Keep an any fast path to reduce compiler work in generic clients.
Keep callable signatures intact, including Date and RegExp methods. Document
and test that callable arguments, returns, and attached properties stay opaque.

Add compile-time and actual generated-output regressions under both immutable
settings. Use exact callable assertions and negative argument/result checks;
verify they reject deliberate any and widened-signature mutations. Limit the
compiler test to ECMAScript libraries and exclude test sources from packages.
Inline the generated readonly-data mapping so it cannot collide with a schema's
root type export, with a regression for prefix-free root type generation.

Use Headers.forEach across compiler versions, remove deprecated compiler
options, fix the nested test rootDir, and correct the release note's explanation
of the pre-existing mapped-type bug. Scope tested TS6 peer exceptions to the
existing unbuild and rollup-plugin-dts versions.

Run static lint once in CI and package builds, typechecks, tests, and framework
example checks on the Node 22/24 and TypeScript 5/6 matrix. The helper type suite
runs once per matrix job through pnpm test. Pin E2E to Ubuntu 24.04 / Node 24
with bounded browser installation and execution.

Validation: all four compiler/Node combinations pass package builds, typechecks,
774 tests, helper assertions, generated example checks, and package exports.
Static lint, Vue/Svelte/Next/documentation builds, and all three browser E2E
projects pass. Frozen install, package contents, and changeset checks pass;
audit reports zero advisories and bundle size remains below the 7.5 kB limit.

Based on #2774
Co-authored-by: benjamineckstein <13351939+benjamineckstein@users.noreply.github.com>

Translate exact required-only allOf members through the existing required-property flow while preserving unsafe, annotated, polymorphic, and transformed schemas.

Fixes #1474

Related to #1520 and #2570

(cherry picked from commit f032c8e)

Apply typed required-only constraints to the completed transformed intersection while preserving callback replacements and legacy WithRequired behavior.

(cherry picked from commit f82b194)

Consolidate helper generation and reduce duplicated tests while preserving transform support and collision-safe output.

(cherry picked from commit 89e7c70)

Replace the generator's TypeScript compiler API with source-string builders
so applications can install TypeScript 7 without a peer dependency conflict
or a runtime failure at ts.factory. Generation also works without TypeScript
installed. Keep TypeScript as a workspace development dependency for builds
and semantic tests, rather than requiring a second compiler in consumers.

Adapt upstream PR #2868 (26f4233) onto this
fork's TypeScript 6 and required-only allOf improvements. This includes fixes
and regression coverage beyond the upstream string-template implementation.

Generator implementation

- Migrate the schema transforms, document assembly, and supporting utilities
  from AST nodes to TypeScript source fragments. Centralize declarations,
  properties, index signatures, tuples, arrays, enums, unions, intersections,
  literals, references, and comments in the existing ts helper module.
- Preserve established indentation and literal escaping where applicable.
  Keep expression fragments distinct from already-indented declaration and
  property lines through the builders' documented conventions.
- Retain deferred assembly of the operations interface so operations can be
  discovered incrementally without changing its position among footer types.
- Use context-sensitive parentheses for arrays and composed types, including
  readonly/keyof/typeof operands, functions, constructors, and conditionals.
  Skip quoted strings, nested templates, and comments when inspecting types.
  Recognize LF, CR, CRLF, U+2028, and U+2029 line-comment boundaries.
- Deduplicate generated helpers by their canonical declaration strings.
  An enum value or comment mentioning a helper name must not suppress the
  actual WithRequired, ReadonlyArray, or FlattenedDeepRequired declaration.
- Write fixed helper declarations as multiline templates rather than long
  strings containing escaped newlines, preserving their emitted bytes.

Preserve this fork's semantics

- Carry the full generated Readable/Writable implementation into the string
  emitter: the any fast path, recursive marker resolution, opaque callables,
  readonly collection methods and iterators, required numeric properties,
  extra data properties, and tuple length/position preservation.
- Keep callable arguments, results, and attached properties opaque while
  retaining visibility filtering on noncallable Date/RegExp data properties.
  Preserve the existing mutable-tuple projection and readonly never behavior.
- Keep the readonly-data mapping inline in generated helpers so a schema
  root named ReadonlyArrayData cannot collide with an implementation alias.
  The separate helpers package's existing implementation remains unchanged.
- Port required-only allOf handling without discarding known-key discovery,
  conservative safety gates, discriminator behavior, or callback occurrence
  tracking. Do not probe or replay user callbacks to infer their behavior.
- Implement named and collision-safe inline WithRequiredObject forms from
  the same string body, preserving object constraints, readonly properties,
  exact optional semantics, and rejection of nonobject/callable inputs.
- Inline the object-constraint helper when injected source, generated names,
  or arbitrary footer declarations make its fixed name unsafe. Keep existing
  conservative handling when property hooks can rename keys or deprecated
  fields are excluded; do not expand unrelated allOf behavior.

Correct generation regressions

- Render an array's element type once, then add its outer array dimension.
  Do not infer array/tuple structure from an emitted string's prefix/suffix.
  This preserves arrays of unions, tuple items, constant arrays, custom array
  types, and nested arrayLength elements independently of composition order.
- Emit readonly (readonly number[])[] for nested immutable arrays rather
  than invalid readonly readonly number[][]. Preserve parentheses around
  other low-precedence element types and rest-array operands as needed.
- Escape backticks, backslashes, and interpolation delimiters in generated
  path template literals. Match escaped parameter placeholders after escaping
  the URL so unusual parameter names still become typed interpolations.
- Flatten multiline enum descriptions into a single line comment, and omit
  redundant single-member union/intersection wrappers.
- Recognize nonempty braced root types independently of inline formatting
  and surrounding comments. Retain inner literal/template text, distinguish
  comment-only empty bodies, and reject outer unions/intersections/conditionals
  instead of turning them into invalid interface members.
- When postTransform is configured, emit nonempty object-shaped $defs roots
  as aliases, including when the hook leaves the root unchanged. This permits
  mapped root types without adding a TypeScript grammar classifier. Keep the
  existing fallback for empty, nonbraced, and composed roots.

Public API migration (major)

- openapiTS() returns Promise<string>, containing the generated body with a
  trailing newline, instead of Promise<ts.Node[]>.
- transform returns a type string or { schema: string, questionToken };
  postTransform receives and returns type strings.
- transformProperty receives and returns the structured object
  { name, optional, readonly, type, comment?, indent }. Initialize readonly
  from the schema/options and honor the returned value for both ordinary
  properties and $defs properties. Keep name, optionality, type, and JSDoc
  customization available without requiring callers to parse a property line.
- Provide tsComment() for indented JSDoc. GlobalContext.injectFooter now holds
  source declarations or deferred OperationsDeclaration instances.
- Replace AST-only helpers such as stringToAST(), tsModifiers(), and
  QUESTION_TOKEN with source builders. Existing AST callbacks must migrate;
  changing the application's compiler version alone is not that migration.
- Retain astToString() as a source-fragment joiner/trailing-newline helper.
  Reject AST inputs and the removed printer-options argument explicitly
  instead of accepting obsolete formatting options and silently ignoring them.
- Emit injected source without parsing and reprinting it through TypeScript.
  Document this behavior, the callback migration, and the $defs alias policy.

Packaging, documentation, and CI

- Remove the generator's TypeScript peer dependency. Published runtime code
  and declarations contain no TypeScript compiler imports.
- Correct CommonJS declarations to match the existing runtime namespace with
  default and named exports. Disable unbuild's declaration-only export-equals
  rewrite for this package through its supported declaration-options hook;
  keep the actual CommonJS runtime export shape unchanged.
- Publish @types/js-yaml and json-schema-to-ts because Redocly's public
  declarations reference them. Update the lockfile so strict consumers do
  not need undeclared dependencies or skipLibCheck to typecheck the API.
- Update English, Japanese, and Chinese Node API documentation, installation
  examples, contributor guidance, and the major changeset.
- Add an isolated packed-consumer test using the actual CLI, ESM and CommonJS
  APIs, all three hooks, public declarations, and generated type assertions.
  Reuse the existing helpers assertion suite against the packed helpers and
  both generated mutable/immutable helper implementations, including negative
  assertions for accidental widening or lost visibility/readonly constraints.
- Cover required-only allOf separately from property-hook customization,
  respecting the fork's existing safety gate. Include commented mapped-root
  output in the packed compiler checks as well as the focused unit tests.
- Keep network-dependent consumer installs separate from the normal unit
  suite. Run them outside workspace module resolution, with install scripts
  disabled and compiler-free resolution checked explicitly. Assert that
  packed artifacts exclude tests/scripts; exclude consumer fixture sources
  from the generator's ordinary tsconfig until they are generated in isolation.
- Add two consumer CI jobs, one each for Node 22 and 24. Each builds once and
  checks TypeScript 5.9.3, 6.0.3, 7.0.2, and no installed compiler in separate
  consumer projects. Retain all eight combinations without eight repeated
  workspace installs/builds, alongside the existing TS5/TS6 workspace matrix.

Validation and scope

- Final uncached workspace suite on Node 24 / TypeScript 6: 865 passing tests
  (377 generator, 451 fetch, 37 React Query), plus helper type assertions,
  example compilation, builds, and package export checks.
- Generator suite on TypeScript 5.9.3: 377 passing tests on both Node 22.23.2
  and Node 24.19.0. Generator, example, and helper typechecks pass on both.
- All eight final packed-consumer combinations pass on Node 22.23.2 and
  24.19.0, including TypeScript 7.0.2 strict declarations and compiler-free
  CLI/API generation. Package lint/typechecks, documentation build, and
  git diff --check pass; existing Biome configuration warnings remain.
- Framework typechecks for Vue, SvelteKit, and Next.js, plus the nonstrict
  fetch typecheck, passed during integration. Browser end-to-end tests were
  not rerun as part of this generator adaptation.
- Three independent review rounds covered correctness, maintainability,
  minimality, packaging, and repository conventions. Keep the established
  allOf safeguards and deferred operations representation; avoid a general
  type parser, footer registry, or unrelated historical arrayLength changes.
- Consumer compatibility does not imply running all workspace build tools
  under TS7: workspace development continues to use the classic TS5/TS6 API.

Upstream: #2868
Context: #2841
Fork TS6 work: 219be04

Co-authored-by: im10furry <im10furry@users.noreply.github.com>

Backport upstream PR #2869 to darkbasic, based on bce6225
and 324b102. The upstream job was hanging
inside playwright install --with-deps before reaching the browser tests.
Our existing timeouts bound that failure but do not remove its cause.

Run test-e2e in the official Playwright v1.59.1-noble image, matching the
@playwright/test version in the root package.json. The image includes all
three browsers and their system dependencies, so remove the installation
step. Use --ipc=host as recommended for Chromium in containers.

Set HOME=/root only on the test step so Firefox sees a home directory
owned by the root user running the browser. GitHub's container-job home
can be owned by another user. pnpm/action-setup exports absolute PATH and
PNPM_HOME values, which remain valid across this test-step home change.

Adapt the upstream patch to the fork with minimal configuration changes:

- Keep Ubuntu 24.04, Node 24, pnpm 12.3.4, and pnpm/action-setup v6. Node 24 is
  also the major used by the official image; no downgrade is needed.
- Keep the existing 20-minute job and 10-minute browser-test timeouts.
- Forward PLAYWRIGHT_BROWSERS_PATH only to test-e2e through its Turbo
  passThroughEnv setting instead of exposing it to every task globally.
  Turbo already forwards HOME and the package-manager environment.
- Correct the version-sync comment to point at the root package manifest.
- Group @playwright/test and mcr.microsoft.com/playwright updates in the
  existing Renovate configuration. Both are extracted by standard
  managers; no custom version-discovery job or parser is needed. This
  groups available updates without changing the existing automerge rule.

Validation:
- actionlint 1.7.7 passes for .github/workflows/ci.yml.
- turbo.json and renovate.json pass their published JSON schemas.
- Reproduced the setup in the official image using Node 24.19.0 and the
  actual pnpm/action-setup v6 action, with run_install=true and CI=true.
  Installation ran with HOME=/github/home owned by pwuser; the test step
  used HOME=/root while retaining the action's exported PATH/PNPM_HOME.
- Confirmed pnpm 12.3.4 and Turbo 2.9.14, and verified via Turbo's dry run
  that the browser path is passed only to E2E tasks, not build tasks.
- pnpm run test-e2e --force passes all three Chromium/Firefox/WebKit
  tests in 2.1 seconds. All five Turbo tasks pass with zero cached tasks.
  No playwright install command was run during this reproduction.
- Independent correctness and maintainability reviews found no blockers.

This changes only CI and build orchestration, so no package release or
changeset is needed. The hosted GitHub workflow has not been triggered
for this local backport.

Backport-of: #2869
Co-authored-by: im10furry <im10furry@users.noreply.github.com>

Fix enumValues making WithRequiredObject reuse depend on the order of
unrelated schemas. With a no-op transform and an enum before a required-only
allOf composition, shouldInlineWithRequiredObject treated the enum values
constant and its FlattenedDeepRequired/ReadonlyArray helpers as possible
name collisions. It expanded the conditional helper inline. Moving the
enum after the composition instead emitted and reused the named helper.
Both orderings now emit one shared helper with the same required-property
semantics.

Recognize complete built-in footer helper declarations by exact equality.
Track schema-generated enum-value strings in a private WeakMap keyed by
the footer array, and exempt only those exact strings from the collision
check. The tracking belongs at the schema transformer call site because
public string builders accept arbitrary source in their type arguments.
This keeps the existing footer and context representations and adds no
runtime TypeScript compiler dependency or source parser.

Retain conservative inlining for arbitrary injected source, unrecognized
footer strings, generated enum mode, and unprefixed root aliases. Appending
a conflicting declaration to a built-in helper or generated-looking enum
constant does not make that source safe. Existing helper deduplication
continues to require the exact WithRequiredObject declaration.

Add a public API regression for both schema orderings. Each case checks
one helper declaration, two named references, generated enum values, and
compiled positive/negative assertions for requiredness and property types.
Include helper-name and escaped-name text inside enum values to verify
that literal contents do not introduce a declaration collision.

Extend footer collision tests with enum-value and built-in-helper suffixes
and a public array builder whose type source introduces a conflicting
alias. Preserve coverage for direct and escaped identifiers, public inject
aliases/imports, generated enums, and unprefixed root types. Add a patch
changeset describing the ordering fix.

Validation on Node 24.19.0:
- The supplied built-package reproduction now prints true for both orders.
- All 382 generator tests in 30 files pass, along with example compilation,
  package builds, and package export checks.
- Package lint and typechecks pass; existing Biome configuration notices
  remain unchanged.
- Generated output for both orderings compiles with positive and negative
  assertions under TypeScript 5.9.3, 6.0.3, and 7.0.2, with strict checking
  and skipLibCheck=false.
- An isolated packed consumer with no TypeScript installed passes CLI,
  ESM, CommonJS, and all three hook checks.
- Three independent final reviews covering correctness, maintainability,
  minimality, repository standards, and coverage found no remaining issues.
  The correctness reviewer also exercised 12 built-package cases across
  both orderings, including modified tracked entries and real collisions.