[Upd4ting]

Why

This PR moves interface-auth onto the latest @antelopejs/tooling-configs release (0.5.0, still latest on npm on 2026-11-10) so that every check passes under it, not just the version number. It also needs to survive the next release, where tooling-configs#282 turns two warnings into sync --check failures. Task ANT-1771, split from ANT-1694.

What changes

• @antelopejs/tooling-configs goes from ^0.4.0 to ^0.5.0, with the lockfile updated.
• pnpm run sync rewrote the managed files .agents/setup, AGENTS.md and .agents/skills/verify-interface/SKILL.md.
• The 0.5.0 preset adds anti-slop(no-runtime-typeof), which flagged value instanceof Object in .agents/skills/verify-interface/calls.ts. The check now goes through an isJsonObject type guard over the interface's own JsonValue union, as the rule asks. No suppression was added.

The two #282 items

Both already hold on main, so this PR changes nothing for them:

• No tsconfig sets skipLibCheck. Only build passes --skipLibCheck, and typecheck (tsc --noEmit) checks the same root tsconfig.json program (perf(build): skip the lib check in build; typecheck keeps it #59).
• release runs pnpm run lint && pnpm run typecheck && pnpm run prepack && release-it.

Conflict with #61

There is none. #61 changes only .github/workflows/modules-update.yml, and this PR does not touch that file.

Proof

Before: main with the version bumped, before pnpm run sync and the lint fix. Node's MODULE_TYPELESS_PACKAGE_JSON warning is left out of the outputs.

pnpm run sync:check before:

> @antelopejs/interface-auth@0.2.0 sync:check /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> antelopejs-sync --check

Drift: .agents/setup; run antelopejs-sync
Drift: AGENTS.md; run antelopejs-sync
Drift: .agents/skills/verify-interface/SKILL.md; run antelopejs-sync
 ELIFECYCLE  Command failed with exit code 1.
exit 1

pnpm run checks before:

> @antelopejs/interface-auth@0.2.0 checks /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> antelopejs-checks

[lint]

> @antelopejs/interface-auth@0.2.0 lint /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> oxlint

.agents/skills/verify-interface/calls.ts:11:9: error anti-slop(no-runtime-typeof): `instanceof Object` is a `typeof` check in another form. Parse input at its I/O boundary, or move the check into a type guard such as `(value: unknown): value is Function`.
 ELIFECYCLE  Command failed with exit code 1.

[sync:check]

> @antelopejs/interface-auth@0.2.0 sync:check /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> antelopejs-sync --check

Drift: .agents/setup; run antelopejs-sync
Drift: AGENTS.md; run antelopejs-sync
Drift: .agents/skills/verify-interface/SKILL.md; run antelopejs-sync
 ELIFECYCLE  Command failed with exit code 1.
Checks: 8 passed, 2 failed.
 ELIFECYCLE  Command failed with exit code 1.
exit 1

pnpm run sync:check after:

> @antelopejs/interface-auth@0.2.0 sync:check /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> antelopejs-sync --check

Guardrails are in sync.
exit 0

pnpm run checks after:

> @antelopejs/interface-auth@0.2.0 checks /home/debian/.t3/worktrees/interface-auth/build-bump-tooling-configs
> antelopejs-checks

Checks: 10 passed, 0 failed.
exit 0

Verify layer (antelopejs-verify journey <run> --plan --jobs 4 at b4b80c4, base origin/main). The plan ran every feature, because package.json and pnpm-lock.yaml are shared files:

PASS smoke/every-function (1.5 s)
PASS smoke/minor-bump (1.7 s)
PASS cookies/sign-server-response (0.1 s)
PASS cookies/cookie-types (1.0 s)
PASS request-auth/default-source (0.1 s)
PASS request-auth/check-authentication (0.1 s)
PASS request-auth/auth-decorators (0.1 s)
PASS request-auth/request-types (0.9 s)
PASS tokens/sign-and-verify (0.1 s)
PASS tokens/token-types (0.9 s)

The every-function evidence includes the checks .:ValidateRaw returned the value verify.config.ts expects and .:internal.defaultAuthenticator returned the value verify.config.ts expects. Both values pass through the rewritten plain(). No verify failure is pre-existing.