fix: repair corrupted package.json to restore a buildable main

[daemon-blockint-tech]

Context — main is currently red and unbuildable

main's package.json contains invalid JSON. A Dependabot "bump 11 packages" (fb59e7c) landed on main while PR #9 was open. When main was merged back into the PR branch (5e3de79), git's line-based auto-merge stacked both versions of the adjacent uuid/zod dependency lines:

    "uuid": "^11.1.1",
    "zod": "^3.25.76"      ← missing comma
    "uuid": "^14.0.1",     ← duplicate key
    "zod": "^4.4.3"        ← duplicate key

Newer local npm (10.9+), tsx, and vitest tolerate this, so it slipped through — but the CI runner's npm 10.8.2 parses strictly and fails every npm ci with EUSAGE, reporting it (misleadingly) as a missing lockfile. This is why CI has been red on main since PR #9 merged.

The fix

Repair the dependencies block to valid JSON and reconcile the bump into an internally consistent, buildable set:

• uuid → ^14.0.1 (Dependabot's latest; ≥ the advisory fix). The security overrides entry is rewritten to "uuid": "$uuid" so it tracks the root spec and can never conflict with the direct dependency (it still dedupes jayson's vulnerable nested uuid).
• zod pinned to ^3.25.76 (the other conflicted key) for @langchain compatibility.
• typescript ^5.7.2, eslint ^9.17.0, @eslint/js ^9.17.0 — pinned back from the bump's ^7 / ^10, which violate typescript-eslint@8's peer ranges (typescript <6.1.0, eslint ^8||^9) and could never resolve under npm ci (confirmed: ERESOLVE). The remaining Dependabot bumps (@langchain/langgraph, @supabase/supabase-js, dotenv, neo4j-driver, @types/node, pg, …) are kept.
• Regenerated package-lock.json.

Verification

package.json      valid JSON ✓
npm ci (npm 10.8.2, exact runner version)  ✓   ← reproduced the failure, now passes
npm ci (npm 11)   ✓
typecheck ✓ · lint ✓ · test ✓ (7 files, 51 tests) · build ✓
npm audit         8 → 3 (residual = unfixable bigint-buffer; see SECURITY.md)

I reproduced the exact CI failure in a clean tree with npm 10.8.2 before and after the fix.

Follow-up

A separate change implementing the MPP-based credits/billing system will follow. If you'd prefer, the single fix commit here can be merged on its own to green main first.

🤖 Generated with Claude Code

https://claude.ai/code/session_017ZB4NjNJZ6zWTqypbSiihy

---

Generated by Claude Code