JITSU-158: explicit typing + unsafe-any lint gate on config exports

webapps/console/eslint.config.mjs

@@ -49,6 +49,25 @@ const eslintConfig = defineConfig([
       "no-restricted-properties": "off",
     },
   },
+  // Type-aware unsafe-`any` rules on the admin API surface. The config export
+  // endpoints feed bulker/rotor/syncctl directly; an implicit `any` here is how
+  // the 2026-07-30 blank-options incident compiled (JITSU-158) — a
+  // destructuring typo on a Prisma result the checker had silently collapsed
+  // to `any`. These rules make any such collapse a lint failure instead.
+  {
+    files: ["pages/api/admin/**/*.ts"],
+    languageOptions: {
+      parserOptions: {
+        project: "./tsconfig.json",
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      "@typescript-eslint/no-unsafe-assignment": "error",
+      "@typescript-eslint/no-unsafe-member-access": "error",
+      "@typescript-eslint/no-unsafe-argument": "error",
+    },
+  },
 ]);
 
 export default eslintConfig;

webapps/console/lib/schema/destinations.tsx

@@ -264,8 +264,8 @@ export function getCoreDestinationType(typeId: string): DestinationType {
   return destinationType;
 }
 
-export function getCoreDestinationTypeNonStrict(typeId: string): DestinationType | undefined {
-  return coreDestinationsMap[typeId];
+export function getCoreDestinationTypeNonStrict(typeId: string | undefined): DestinationType | undefined {
+  return typeId ? coreDestinationsMap[typeId] : undefined;
 }
 
 export const ClickhouseCredentials = z.object({

webapps/console/pages/api/admin/become.ts

@@ -1,3 +1,7 @@
+/* eslint-disable @typescript-eslint/no-unsafe-assignment --
+ * Pre-existing implicit-`any` debt, exempted when the unsafe-any gate was
+ * introduced for pages/api/admin (JITSU-158 action item 3). Fix the `any`
+ * flows in this file, then remove this header - do not add new ones. */
 import { createRoute } from "../../../lib/api";
 import { z } from "zod";
 import { assertDefined, assertTrue, requireDefined } from "juava";

webapps/console/pages/api/admin/catalog-refresh.ts

@@ -1,3 +1,7 @@
+/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument --
+ * Pre-existing implicit-`any` debt, exempted when the unsafe-any gate was
+ * introduced for pages/api/admin (JITSU-158 action item 3). Fix the `any`
+ * flows in this file, then remove this header - do not add new ones. */
 import { createRoute, verifyAdmin } from "../../../lib/api";
 import { db } from "../../../lib/server/db";
 import { rpc } from "juava";

webapps/console/pages/api/admin/domains-report.ts

@@ -1,3 +1,7 @@
+/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument --
+ * Pre-existing implicit-`any` debt, exempted when the unsafe-any gate was
+ * introduced for pages/api/admin (JITSU-158 action item 3). Fix the `any`
+ * flows in this file, then remove this header - do not add new ones. */
 import { createRoute } from "../../../lib/api";
 import { db } from "../../../lib/server/db";
 import { assertDefined, assertTrue } from "juava";

webapps/console/pages/api/admin/events-log-trim.ts

@@ -1,3 +1,7 @@
+/* eslint-disable @typescript-eslint/no-unsafe-member-access --
+ * Pre-existing implicit-`any` debt, exempted when the unsafe-any gate was
+ * introduced for pages/api/admin (JITSU-158 action item 3). Fix the `any`
+ * flows in this file, then remove this header - do not add new ones. */
 import { createRoute, getUser, verifyAdmin } from "../../../lib/api";
 import { stopwatch, getClickhouseConfig } from "juava";
 import { clickhouse } from "../../../lib/server/clickhouse";