build(deps): align the shared-helpers pin so the graph names one commit

[ernysans]

What

Moves the pinned @fabricelements/shared-helpers commit from 8c17a299 (2026-06-17) to 31ef85e7 (2026-08-20) — a clean descendant, 22 ahead / 0 behind.

Scope is package.json + package-lock.json. Nothing else changed.

Why this commit, and not default-branch HEAD

The reason is dedupe, not freshness.

A set of pins is only coherent if it names one commit per package across the whole dependency graph. Pinning is a graph-level property, not a per-manifest one. When two hops name different commits of the same package they cannot dedupe, so npm is forced to install a second nested copy — and pinning two hops to different commits is strictly worse than leaving one unpinned, because unpinned would have deduped. 31ef85e7 is the commit already resolved elsewhere in the graph, and matching it is exactly what makes the copies collapse.

Default-branch HEAD was f85e67fd at 2026-08-22T23:31:28Z, 8 commits further on. It is deliberately not taken: moving past the commit the rest of the graph resolves would re-create the same divergence in the opposite direction and lose the dedupe this bump exists to obtain. Seven of those eight commits are documentation; the eighth (0c9d53a5) is a runtime authorization fix that is not reachable from this package (see below). The right order is for the rest of the graph to move first, then this pin follows to match.

Effect on this repository's tree

At the new pin, upstream declares firebase-admin and firebase-functions as peerDependencies rather than direct dependencies, and its sharp range moves ^0.34.5 → ^0.35.3.

Measured before and after on 2026-08-22:

	packages	advisories	sharp
before (8c17a299)	473	13 — 11 moderate, 2 high	0.34.5
after (31ef85e7)	451	10 — 10 moderate, 0 high	0.35.3

Both high-severity advisories are resolved. The remaining 10 are all moderate (@opentelemetry/core, uuid and their dependents); none is newly introduced here.

sharp: upgraded, and separately unreachable — not removed

Stating this precisely, because "gone" would be wrong on both counts:

1. It is still in the tree, at 0.35.3 — at/above the 0.35.0 libvips fix line. The advisory clears by version, not by removal.
2. It is independently unreachable from this package's code. The sole shared-helpers import is used only in type position (Account.Interface.links), so tsc elides it: no @fabricelements specifier appears in any emitted lib/*.js. Consumers executing lib/ never load shared-helpers, and therefore never load sharp.

Verification

Every claim below was measured, with positive controls, not asserted.

• Emitted-import probe — a loose grep for shared-helpers in lib/ first returned a false positive (a JSDoc comment). Sharpened to match module specifiers in import statements: no match for @fabricelements; the same-shape control against zod matched real emitted imports. Mechanism proven.
• lib/ drift — 0 lines after a full clear + rebuild, so the bump does not change emitted output. Probe positive-controlled by planting a change and confirming it reported, then restoring.
• Typecheck is not vacuous — asserting a number against User.InterfaceLinks.behance at the new pin fails with TS2322, so the upstream declaration genuinely resolves rather than degrading to any. The 22 commits of upstream change did not break any type this package depends on.

Gate exit codes (committed state, 2026-08-22T23:37Z)

gate	exit
npm ci	0
npm run build	0
git status --porcelain -uall -- lib/	0 lines
npm test	0 — 18 files, 919 tests passed
npm run typecheck	0
npm run lint	0
private-marker guard	0

Found, deliberately not fixed

• 0c9d53a5 upstream is a runtime authorization fix this pin does not include. Taking it now would break the dedupe that is the entire point of this change, and it is not on any execution path reachable from this package (type-only import, elided at compile time). It should land here once the rest of the graph moves to it.
• The lockfile resolves this dependency over git+ssh://, which requires every consumer and CI runner to hold a key. Pre-existing and unchanged by this PR; a public transport would be preferable, but switching it is out of scope here.
• 10 moderate advisories remain (@opentelemetry/core <2.8.0, uuid <11.1.1 and dependents). Left alone: nothing was overridden, pinned around, or silenced to make the audit quieter.

No overrides, no any, no @ts-ignore, no assertions added anywhere.