fix: unblock the admin build on TypeScript 7

develop has been red since #8132 bumped typescript to ^7.0.2: every PR
fails at "Build admin ui" with

  TypeError: Cannot read properties of undefined
    (reading 'createKeywordTypeNode')

openapi-typescript builds its output with the TypeScript *compiler API*
(ts.factory, ts.SyntaxKind, the printer). TypeScript 7 is the native
port and its main export is only ./lib/version.cjs -- that API is not
there at all. Its declared peer range is `typescript: ^5.x` and 7.13.0
is the newest release, so there is nothing to upgrade to yet.

Rather than hold the whole workspace back on TypeScript 6, isolate the
one tool that can't move. openapi-typescript takes `typescript` as a
PEER dependency, so pnpm satisfies it from whichever package depends on
it -- while admin both depended on openapi-typescript and declared
typescript ^7.0.2, the peer always resolved to 7. Neither `overrides`
(openapi-typescript>typescript) nor `packageExtensions` changes that;
both were tried and pnpm still linked the _typescript@7.0.2 variant.

So move openapi-typescript into a private build-time workspace package,
admin/tools/openapi-codegen, whose only TypeScript is 6.x. The peer then
resolves to a version with a working compiler API, and admin keeps
typescript ^7.0.2 like every other workspace. gen-api.mjs invokes the
tool through that package.

The codegen only runs at build time to emit admin/src/api/schema.d.ts,
and that output is plain text which tsc 7 consumes normally -- the
regenerated file is byte-identical to the committed one.

Verified: all four workspaces report tsc 7.0.2 and typecheck clean,
admin gen:api + full build pass, `pnpm install --frozen-lockfile` is
consistent, backend suite 1621 passing / 0 failing.

The package README records how to delete it once openapi-typescript
supports the native compiler.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

admin/package.json

@@ -37,7 +37,6 @@
     "i18next": "^26.3.6",
     "i18next-browser-languagedetector": "^8.2.1",
     "lucide-react": "^1.31.0",
-    "openapi-typescript": "^7.13.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-hook-form": "^7.85.0",

admin/scripts/gen-api.mjs

@@ -37,9 +37,14 @@ try {
     process.exit(dump.status ?? 1);
   }
 
+  // Run openapi-typescript out of @etherpad/openapi-codegen rather than from
+  // admin. It needs the TypeScript compiler API, which TypeScript 7 (the
+  // native port) does not expose; that package is where its TypeScript is
+  // pinned to a version that still has one. See its README.
   const gen = spawnSync(
     'pnpm',
-    ['exec', 'openapi-typescript', specPath, '-o', outFile],
+    ['--filter', '@etherpad/openapi-codegen', 'exec',
+      'openapi-typescript', specPath, '-o', outFile],
     spawnOpts,
   );
   if (gen.status !== 0) {

admin/tools/openapi-codegen/README.md

@@ -0,0 +1,31 @@
+# @etherpad/openapi-codegen
+
+Private, build-time-only package. It exists purely to pin the TypeScript that
+`openapi-typescript` runs against.
+
+`openapi-typescript` builds its output using the TypeScript **compiler API**
+(`ts.factory`, `ts.SyntaxKind`, the printer). TypeScript 7 is the native port,
+and its main export is only `./lib/version.cjs` — the compiler API isn't there
+at all, so the codegen dies with:
+
+```
+TypeError: Cannot read properties of undefined (reading 'createKeywordTypeNode')
+```
+
+Its declared peer range is `typescript: ^5.x`, and 7.13.0 is the newest
+release, so there is nothing to upgrade to yet.
+
+Pinning it from the workspace root doesn't work: `openapi-typescript` takes
+`typescript` as a *peer* dependency, so pnpm satisfies it from whichever
+package depends on it. While `admin` both depended on `openapi-typescript`
+and declared `typescript: ^7.0.2`, the peer always resolved to 7 — neither
+`overrides` nor `packageExtensions` overrides that. Giving the tool its own
+package, whose only TypeScript is 6.x, is what makes the peer resolve to a
+version with a working compiler API.
+
+The tool only runs at build time to emit `admin/src/api/schema.d.ts`, and that
+output is plain text which `tsc` 7 then consumes normally. Nothing here ships.
+
+**Delete this package** once `openapi-typescript` supports the native compiler:
+move `openapi-typescript` back into `admin`'s devDependencies and point
+`admin/scripts/gen-api.mjs` at it directly.

admin/tools/openapi-codegen/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@etherpad/openapi-codegen",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Build-time wrapper that runs openapi-typescript against a TypeScript it can actually use. See README.md.",
+  "devDependencies": {
+    "openapi-typescript": "^7.13.0",
+    "typescript": "^6.0.3"
+  }
+}

pnpm-lock.yaml

@@ -4,6 +4,9 @@ packages:
   - bin
   - doc
   - ui
+  # Build-time only: pins the TypeScript that openapi-typescript runs
+  # against, which cannot be TypeScript 7. See its README.
+  - admin/tools/openapi-codegen
 allowBuilds:
   '@scarf/scarf': set this to true or false
   esbuild: set this to true or false