chore(api): clear remaining small ESLint warnings and enforce their rules

[brandon-pereira]

What

Clears the last small batch of api ESLint warnings and promotes their rules to error.

Rule	Count	Resolution
@typescript-eslint/no-namespace	2	Merge the duplicate Express declare global namespace blocks; scoped disable (pattern is required)
@typescript-eslint/no-empty-object-type	1	Scoped disable on interface User extends UserDocument {} (required for Express User augmentation)
n/no-process-exit	5	Config override: rule off for the two process entry-point files

Why

These are all legitimate patterns the linter flags, not real issues:

• Express type augmentation (namespace Express { interface User … }) is the documented way to extend Express's types — interface merging is required, and a type alias / non-empty interface can't do it. I merged the two duplicate namespace Express blocks into one for tidiness and disabled the two rules on that single augmentation block with an explanatory comment.
• process.exit() in src/index.ts (startup failure, last-resort uncaughtException/unhandledRejection handlers) and src/tasks/index.ts (CLI task completion/failure) is the intended behavior. Rather than 5 inline disables, the rule is scoped off for just those two entry-point files — so it still guards against stray process.exit() elsewhere in the api.

Promoting all three to error turns these into guardrails: new violations outside the sanctioned spots now fail lint. This is the last of the small mechanical/one-off batches (follows #2903, #2911, #2912).

Verification

• yarn lint (api) — pass (0 errors; 3 rules now enforced as error)
• tsc --noEmit (api) — clean (Express augmentation still resolves after the merge)
• yarn knip — clean
• api --max-warnings lowered 311 → 302

Behavior is unchanged. Changeset included (@hyperdx/api patch).

[changeset-bot]

🦋 Changeset detected

Latest commit: f57b476

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/api	Patch
@hyperdx/app	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview	Aug 14, 2026 8:08pm
hyperdx-storybook	Ready	Preview	Aug 14, 2026 8:08pm

[github-actions]

🔴 Tier 4 — Critical

Touches authentication, tenancy data models, the public API or shipped database config — or substantially changes the query rendering engine, background tasks, the OTel pipeline, image build, or release CI.

Why this tier:

• Security-critical files (1) — auth or input validation, escalated at any size:
  • packages/api/src/middleware/auth.ts

Review process: Deep review from a domain expert. Synchronous walkthrough may be required.
SLA: Schedule synchronous review within 2 business days.

Stats

• Production files changed: 4
• Production lines changed: 33
• Critical-path lines changed: 6
• Branch: brandon/brandon-eslint-api-oneoffs
• Author: brandon-pereira

To override this classification, remove the review/tier-4 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[greptile-apps]

Greptile Summary

The PR converts the remaining API ESLint warnings into enforced rules while preserving narrowly documented exceptions for Express augmentation and process entry points.

• Merges the duplicate Express declaration-augmentation namespaces and adds scoped lint suppressions.
• Enforces namespace, empty-object-type, and process-exit rules as errors outside approved locations.
• Lowers the API warning ceiling and synchronizes the CI ratchet baseline.
• Adds an API patch changeset documenting the lint-policy update.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/api/eslint.config.mjs	Promotes three lint rules to errors and correctly scopes the process-exit exemption to the two intended entry points.
packages/api/src/middleware/auth.ts	Consolidates equivalent Express global augmentations while placing targeted suppressions on the namespace and empty interface declarations.
packages/api/package.json	Reduces the permitted warning count to reflect the warnings removed by this change.
scripts/ci/ratchet-baseline.json	Updates suppression and assertion counts to values that do not breach the ratchet checker.
.changeset/eslint-api-oneoffs.md	Accurately documents the lint enforcement changes as an API patch release.

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into brandon/brandon..." | Re-trigger Greptile}

[github-actions]

Deep Review

✅ No critical issues found.

This is a mechanical ESLint-hardening change: three api rules promoted to error, two duplicate Express declare global namespace blocks merged with scoped disables, n/no-process-exit scoped off for the two process entry points, --max-warnings lowered, and the CI ratchet baseline updated. Verified behavior-preserving and CI-safe.

Key verifications performed against the working tree:

• Ratchet baseline is consistent with actual counts. The diff lowers baselines for packages it does not modify (app/common-utils ts-ignore → 0, api as-any 95→94, api ts-ignore 4→0), which would fail CI only if any actual count exceeded its new baseline. Counted actuals match exactly: api as-any = 94, api eslint-disable = 31 (the 2 new auth.ts disables raise 29→31), and @ts-ignore = 0 across api, app, and common-utils. Every value sits at baseline, so scripts/ci/ratchet.mjs exits 0. The below-baseline reductions also only warn (non-fatal) by design, so they could not red CI regardless.
• auth.ts namespace merge is behavior-preserving. TypeScript declaration merging makes one namespace Express block identical to the prior two; both interface User extends UserDocument {} and interface Request augmentations are preserved, and each eslint-disable-next-line sits on the correct triggering line.
• n/no-process-exit promotion is safe. The flat-config override scoping the rule off is correctly relative to packages/api/ and matches src/index.ts / src/tasks/index.ts, the only files with real process.exit() calls. server.ts's single match is a comment (// triggers process.exit()), not a call, so promoting the rule to error does not break its lint.

🔵 P3 nitpicks (1)

• packages/api/eslint.config.mjs:117 — The file-level n/no-process-exit: off override silences the rule for the entire src/index.ts and src/tasks/index.ts files, so any future stray process.exit() added to those files also passes lint silently.
  • Fix: Optionally prefer per-call-site // eslint-disable-next-line n/no-process-exit comments to keep the guard tight to the sanctioned exit points; the file-scoped override is a reasonable trade-off for entry points if you accept the looser boundary.
  • _{maintainability}

---

Reviewers (3): correctness, maintainability, kieran-typescript.

Testing gaps: no test exercises scripts/ci/ratchet.mjs against this baseline, and the api lint step was not run in-review to confirm zero errors after the three rules became error (both verified manually instead).

Note: the project-standards reviewer did not return before synthesis; the findings above reflect the three completed reviewers plus independent ratchet/lint verification.

[github-actions]

E2E Test Results

✅ All tests passed • 295 passed • 1 skipped • 1098s

Status	Count
✅ Passed	295
❌ Failed	0
⚠️ Flaky	1
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →