Lint the full JS package in CI, not just src

[aram356]

Fixes #985.

Problem

The CI lint gate (npm run lint in format.yml) only covered src/**/*.{ts,tsx}, so eslint errors in test files, the Node build scripts, and config files were invisible: 280 of them had accumulated (npx eslint . on main), and new ones land unnoticed.

Fix

Widen the lint script to eslint . --max-warnings=0 and make the widened surface clean, with no rule exceptions:

• Tests: all 249 no-explicit-any violations are fixed with real types rather than suppressed. Window mocks are typed as Omit<Window, 'tsjs'> intersections with Partial<TsjsApi> from src/core/types; the prebid hoisted mock gets structural TestPbjs/TestAdUnit/TestBid types; many casts were simply unnecessary and are deleted (untyped vi.fn() already assigns to typeof fetch). One documented as unknown as double-cast remains, for a test that deliberately feeds malformed input. Side effect: repo-wide tsc --noEmit errors drop from 50 to 12, all remaining ones pre-existing in files this PR does not touch.
• Node scripts: declare ESM-safe Node globals (globals.nodeBuiltin) for *.mjs build scripts and Node-run test harnesses, so process/console/Buffer resolve but CommonJS-only names (__dirname, require) still fail no-undef.
• Unused args: honor the ^_ underscore convention in @typescript-eslint/no-unused-vars via a top-level rules block covering every linted file, not just *.ts(x).
• Warnings: --max-warnings=0 so rules landing at warn level cannot pass CI silently; this also fails on unused eslint-disable directives, keeping the remaining src/ directives honest.
• Mechanical fixes: import/order in five files, one prefer-const (mockPbjs declaration merged with its single assignment).

No workflow changes: format.yml already runs npm run lint; the script now covers the whole package.

Verification

• npx eslint . --max-warnings=0 exits 0
• npm run format clean
• npx vitest run: 488 passed, 0 failed (32 files)
• npx tsc --noEmit: no new errors vs main (50 -> 12)

[prk-Jr]

Summary

Widens the JS lint gate from src/** to the whole package and cleans the newly-covered surface. Behavior-neutral: no production src/ file is touched — every code edit is a comment removal, an import blank line, or the let→const restructure in the prebid mock. Verified locally: npx eslint . exits 0 (1.7s), and the dist ignore holds (dropped a deliberately-broken probe file into dist/, still exit 0). Approving; the findings below are all non-blocking.

Non-blocking

🤔 thinking

• Blanket no-explicit-any off for test/**: defensible at 249/280 and it matches the existing file convention, but it also covers shared helpers/fixtures where types are cheap, and new any in tests now lands with no signal. (eslint.config.js:53)
• .mjs gets a weaker gate than "full package" implies: project rules are scoped to **/*.ts(x), so the newly-covered build scripts only get js.configs.recommended + tseslint defaults. (eslint.config.js:46)

♻️ refactor

• The ^_ convention does not reach .mjs: the no-unused-vars options live in the **/*.ts block, but the rule is active with default options on .mjs. (eslint.config.js:38)

🌱 seedling

• lint has no --max-warnings=0: 0 warnings today, so no live gap — but any future 'warn'-level rule passes CI silently, which is the same class of hole this PR exists to close. (package.json:13)

📌 out of scope

• A second TypeScript package is still unlinted: crates/trusted-server-integration-tests/browser/ (Playwright specs, helpers/, global-setup.ts, playwright.config.ts) has no lint script and no format.yml job. If the intent of #985 is "no unlinted TS in CI", that is the remaining gap — worth a follow-up issue rather than scope creep here.

⛏ nitpick

• Stray blank lines where disable directives were removed: ten spots in test/integrations/gpt/ad_init.test.ts. Seven (1408, 1491, 1523, 1559, 1759, 1820, 1895) read fine as paragraph breaks; three inside two-line arrow bodies (1344, 1374, 1731) read oddly. Prettier will not collapse either.

👍 praise

• Forward-reference comment in the prebid mock: the let→const restructure could read as a TDZ hazard; the comment states exactly why it is not. (test/integrations/prebid/index.test.ts:25)
• Behavior-neutral diff: keeping the gate widening free of any production change makes "widen the gate, then clean the surface" easy to trust in review.

CI Status

All 19 checks pass on 959f4b9.

• cargo fmt / clippy: PASS
• rust tests (fastly, axum, cloudflare, spin, parity, CLI): PASS
• vitest: PASS
• format-typescript (eslint + prettier): PASS
• format-docs: PASS
• integration + browser integration tests: PASS

[prk-Jr]

🤔 thinking — No change requested; recording the tradeoff. Turning the rule fully off across test/** also covers shared helpers and fixtures where a real type is cheap, and it means new any in tests lands with no signal at all — not even a warning.

The narrower alternative would have been a file-level /* eslint-disable @typescript-eslint/no-explicit-any */ in the handful of GPT/prebid mock files that account for most of the 249. Given the count and that any is already the file convention here, the blanket approach seems like the right call for this PR.

[aram356]

Went with the narrower alternative in 7aef9a5. Measured first: 255 occurrences, 246 of them in six mock-heavy files — those get a file-level disable with a reason. The tail got real types instead: fetch stubs are as unknown as typeof fetch, registry uses as AdUnit via a type-only import, and config's 'info' as any cast was dropped entirely ('info' is already in the logLevel union). One scoped disable-next-line remains for gpt_bootstrap's AnyRecord alias. New test files now get full signal, and since ESLint 9 reports unused disable directives as warnings, --max-warnings=0 fails CI if any directive goes stale. Lint/format clean, 488 tests pass, no new tsc --noEmit errors vs baseline.

[aram356]

Superseded by 23ae86e: the per-file disables are gone too. All 247 test-tree anys are now really typed. The main mechanisms: Omit<Window, 'tsjs'> intersections with Partial<TsjsApi> for the window mocks (which was the actual fix for the intersection problem the old ad_init comment cited as the reason for any), structural TestPbjs/TestAdUnit types over the prebid hoisted mock, and deleting casts that turned out unnecessary (untyped vi.fn() already assigns to typeof fetch). One documented as unknown as double-cast survives, for a test that deliberately feeds malformed bids input. no-explicit-any now holds across the whole package with zero exceptions in test/. Verified: eslint/prettier clean, 488 tests pass, repo tsc --noEmit errors drop 50 -> 12 (all remaining pre-existing in untouched files).

[ChristianPavilonis]

Summary

Reviewed the lint-surface expansion against main. The change is low risk and behavior-neutral overall; all CI checks and clean-checkout JS validation pass. I found one medium-severity lint-environment gap, noted inline.