#49 fix: restore missing src/types/index.ts (measured: SDK bump does NOT fix the 145 drift errors)

The two-experiment numbers (measured, not guessed)

Baseline on origin/main (5899f5b), npm ci --include=dev && npm run type-check:
148 errors, split into ~145 SDK-API-surface-drift errors across src/commands/**/index.ts
and 3 TS2307: Cannot find module '../../types/index.js' errors.

Experiment: npm install --no-save @wave-av/sdk@2.1.3 --@wave-av:registry=https://registry.npmjs.org/
(the repo's scoped registry config points @wave-av at GitHub Packages, which 404s on this
package — had to force the public npm registry for the one-off install) then npm run type-check:
152 errors. A line-by-line diff of the two error lists shows the bump fixed zero of the
145 original SDK-drift errors and added 4 new ones (Cannot find module 'vitest' — the
reinstall perturbed vitest's ambient type resolution as a side effect). Net: strictly worse.

Decision (per the brief's own rule): the count did not drop, so the pin is NOT the cause. Did
not bump it. package.json and package-lock.json are untouched by this PR — no collision
with PR #47 which also touches package.json. The 145 SDK-drift errors need call-site fixes
against the currently-pinned 2.0.14 client surface, which is a much larger, separate pass (see
"What remains red" below) — not attempted here to keep this PR reviewable and avoid guessing at
35 files of unfamiliar SDK surface under time pressure.

Task 2 — the 3 missing-module errors (fixed)

src/types/index.ts does not exist on origin/main at all, but an unmerged commit
(382adee, branch origin/fix/remediation-af8a172e-5f3f12, was part of PR #19 which was closed
without merging) contains exactly this file. I read all three importing files
(src/lib/auth/device-flow.ts, src/lib/config/manager.ts, src/lib/output/index.ts) and
verified every field that commit's version of the file exports is actually used, and used
consistently, at every call site:

• DeviceAuthResponse / TokenResponse — every field device-flow.ts reads
  (verification_uri, user_code, verification_uri_complete, device_code, interval,
  expires_in, access_token, etc.) is present and correctly typed.
• WaveConfig — matches waveConfigSchema in src/lib/config/schema.ts field-for-field
  (version, currentProject, projects, defaults, telemetry).
• OutputFormat — matches the "table" | "json" | "yaml" union used throughout output/.

Recreated src/types/index.ts with this verified content rather than guessing or stubbing any.

Restoring WaveConfig as a real nominal type (instead of an implicit any from the unresolved
module) surfaced one genuine new error: src/commands/config/index.ts's getNestedValue /
setNestedValue helpers were typed as Record<string, unknown>, and a nominal WaveConfig
interface (no index signature) is not assignable to that. These two functions are intentionally
generic reflection utilities that walk arbitrary dot-separated config paths — they already
narrow with typeof/in checks internally — so I retyped their parameters as object and cast
only inside the function body where the reflective indexing actually happens. No any, no
@ts-ignore, no @ts-expect-error, no tsconfig.json changes.

Results (measured)

• npm run type-check: 148 → 142 errors. All 3 TS2307 errors gone. The 2 extra beyond
  "3 fixed" are cascading TS18046 'X' is of type 'unknown' errors that only existed because
  TS treated the import as any when the module couldn't resolve; fixing the module resolution
  fixed those for free. One new, genuine error appeared (the WaveConfig/Record assignability
  above) and was fixed in the same commit — net trace shows zero unaccounted regressions.
• npm run build (tsup): passes, exit 0, dist/index.js emitted (158.82 KB). This is the
  same "which is exactly why version 1.0.8 shipped printing 1.0.0" mechanism named in the brief:
  tsup transpiles without typechecking, so a source tree that fails tsc --noEmit by 142 errors
  still builds and can still be published — the red type-check is invisible to the release
  pipeline unless something gates on it explicitly.
• npm run test (vitest): passes, 4 test files / 11 tests, 8.12s.

What remains red, and why

142 errors remain, essentially all of the original ~145 SDK-API-surface-drift group, spread
across 35 files under src/commands/**/index.ts (zoom, podcast, drm, audience, signage, stream,
vault, studio, phone, notify, edge, search, distribution, creator, collab, voice, usb, slides,
sentiment, scene, prism, org, mesh, ghost, editor, desktop, connect, clips, chapters, captions,
analytics, ai, transcribe, qr, marketplace, fleet). Breakdown by error code: 119×TS2339
(property does not exist), 9×TS2551 (property does not exist, "did you mean X"), 8×TS2353
(unknown object-literal property), 3×TS2554 (arg count mismatch), 2×TS2345, 1×TS2561.

These are not left red out of avoidance — I checked whether they're a quick win. The
@wave-av/sdk@2.0.14 .d.ts surface is 8,628 lines across the package; TS's "did you mean X"
suggestions for the TS2551 cases (e.g. DistributionAPI.destinations → listDestinations,
PhoneAPI.conferences → getConference) are not confirmed 1:1 renames — several look like a
list-vs-single-item shape change (conferences plural vs getConference singular), which means
blind-applying the suggestion risks silently changing behavior rather than fixing a typo. Fixing
this class correctly requires reading each command's business logic against the actual SDK
method signatures file-by-file, which is a legitimately separate, larger pass — not something to
rush through here per the "never silence, only real fixes" instruction. Confirmed via
git status --porcelain that this PR touches exactly src/types/index.ts (new) and
src/commands/config/index.ts (2-line type fix) — nothing else.

Relation to the live 1.0.8-prints-1.0.0 defect

Confirms the brief's hypothesis directly: npm run build succeeds with 148 (now 142) red
type-check errors because tsup never runs tsc. Anything that silently drifted from the SDK's
real shape — including whatever produced the version-string defect — ships anyway. This PR does
not add a type-check gate to CI (out of scope / owned by PR #46 VER-001, which is the actual
fix for the version-surface defect and derives every version string from package.json); it
narrows the type-check red count so that gate, whenever it lands, has less legacy debt to clear.

Peer-PR collision check (done before editing)

Checked gh pr view --json files for all 4 open PRs before touching anything: #48 (release.yml
lint-step removal), #47 (package.json/package-lock.json/license files — LEGAL-001), #46
(src/cli.ts, src/cli.test.ts, src/commands/api/index.ts, src/lib/api-client.ts,
src/lib/version.ts — VER-001), #45 (release.yml — trusted publishing). None of those files
were in this PR's baseline error list (src/commands/api/index.ts has zero type-check errors)
and none overlap the two files this PR touches. package.json/package-lock.json are
untouched here since the measurement showed bumping the SDK pin is not the right move — no
collision with #47 either.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Low Risk
Type-only restoration and narrow signature tweaks to generic config helpers; no runtime behavior or auth/data-path changes.

Overview
Restores the missing src/types/index.ts module so imports in auth, config, and output resolve again. The file defines DeviceAuthResponse, TokenResponse, WaveConfig, and OutputFormat to match existing call sites and the config schema.

In src/commands/config/index.ts, getNestedValue / setNestedValue now take object instead of Record<string, unknown>, with reflective indexing cast inside the body, so a nominal WaveConfig can be passed without assignability errors.

^{Reviewed by Cursor Bugbot for commit 0406bfea094407d684a88a9e78951a6da84820a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by Sourcery

Restore the shared type definitions and align configuration helpers with the typed configuration model without attempting the separate SDK API migration.

Bug Fixes:

• Restore the missing shared type definitions for device authentication, tokens, configuration, and output formats.
• Resolve configuration helper typing so the restored nominal configuration type passes type checking.

Enhancements:

• Reduce strict type-check failures by eliminating unresolved type imports without changing the pinned SDK version.

Tests:

• Verify the project build and test suite continue to pass after restoring the types.