fix: restore TypeScript 6 build and Zod 4 validation errors

[mldangelo-oai]

npm run build fails on main with TypeScript 6's deprecated moduleResolution: node; once that configuration is corrected, three uses of the removed Zod 4 .errors property fail type checking. At runtime those paths return HTTP 500 for invalid chat requests instead of the intended structured HTTP 400.

Use paired Node16 module/resolution settings (this package still emits CommonJS) and Zod's .issues property. Add 23 offline chat regression/contract tests, an npm test command, testing docs, and Node 20/22/24 build/test CI alongside the existing security checks. This is a prerequisite repair for validating dependency PR #62; dependency versions and its bot commits stay separate.

Validation:

• npm ci and npm test: 23/23 pass on Node 20.20.2, 22.23.2, and 24.21.0.
• The same regression suite against unchanged main source (compiled with the proposed module settings) reproduces eight HTTP 500-versus-400 failures; its other 15 cases pass.
• Compiled-server and ts-node development smoke checks pass on all three runtimes: health, invalid path/query/body, public chat, missing-auth rejection, OAuth client credentials, authorized chat, and JWKS. Chat uses a loopback mock provider and synthetic credentials.
• All ten domain/fish prompt mappings, configured/default model routing, message normalization, and upstream error propagation are covered; no prompt or authentication behavior is changed.

References: TypeScript module resolution, Zod 4 migration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T03:21:14.639273Z	6a414bc	Manual request
🔒 Security Review	✅ Completed 2026-09-16T03:20:03.423352Z	6a414bc	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[promptfoo-scanner]

👍 All Clear

Reviewed CI/test additions, minor TypeScript/Zod compatibility fixes in src/routes/chat.ts, and documentation updates. The PR does not change prompt construction, model routing, or agent capabilities, and introduces no new execution sinks. No LLM security issues were identified.

_{Minimum severity threshold: 🟡 Medium | To re-scan after changes, comment @promptfoo-scanner
Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6a414bc763

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 6a414bc763

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".