chore(deps): drop 10 dead dependencies

[alukach]

Drops dependencies that an over-engineering audit found declared in package.json but unreachable. Each line is verified by grepping the whole repo (src, scripts, cdk, deploy).

Removed (with replacement)

Dependency	Why it's dead
lodash, @types/lodash	No import anywhere in the repo
date-fns	No import anywhere
mystjs	No import anywhere
node-fetch	No import anywhere — global fetch is built in
handlebars, @types/handlebars	Only a commented-out usage remained
crypto (npm shim)	import * as crypto from "crypto" resolves to the node:crypto built-in (core modules win over node_modules); the npm shim never loaded
swagger-jsdoc	Its apis glob pointed at ./src/api/v1/** — a directory that does not exist (routes live under src/app/api/v1), so it only emitted the static skeleton
uuid	v4() replaced with the native crypto.randomUUID()

Code changes that go with the removals

• src/app/api/openapi/route.ts — replaced swaggerJSDoc(options) with the static object literal it was already producing. Schemas still come from zod-to-openapi; output is unchanged (paths was always {} because the glob matched nothing).
  • ⚠️ The dead glob is also a latent bug: if JSDoc @openapi route annotations were ever intended to populate paths, they never did. Flagging for a separate look — out of scope here.
• 4 files — import { v4 as uuidv4 } from "uuid" → import { randomUUID } from "crypto"; uuidv4() → randomUUID() (all server-side: account.ts, memberships.ts, two members/route.ts). Both produce RFC 4122 v4 UUIDs.
• Removed the stale // import Handlebars from "handlebars" comment.

lodash remains in the lockfile as a transitive dep of other packages — it's just no longer a direct dependency.

Verification

• npm run type-check — clean
• npm test — 334 passed / 39 suites

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-cooperative	Ready	Preview, Comment	Jun 19, 2026 5:41am

[claude]

Claude finished @alukach's task in 56s —— View job

---

✅ No blocking issues — safe to merge.

• uuid → crypto.randomUUID() (account.ts:122, memberships.ts:101, accounts/.../members/route.ts:96, products/.../members/route.ts:97): All four call sites are server-side only ("use server" actions or API route handlers), so no browser-compatibility concern. randomUUID() is RFC 4122 v4 — functionally identical to uuidv4().

• swagger-jsdoc removal (src/app/api/openapi/route.ts): The static literal is a faithful representation of what swaggerJSDoc was actually emitting (empty paths, schemas from zod-to-openapi). Clean.

• crypto npm shim: Correct analysis — Node's core module resolution gives node:crypto priority over the npm shim, so the shim was indeed never loaded.

• Pre-existing issue (not introduced here) — src/app/api/v1/accounts/[account_id]/members/route.ts:93: const success = false followed by if (success) { return ... } means a successful POST /accounts/{id}/members call falls through the try block and returns undefined (no response). This pre-dates the PR, but the team may want to address it separately. Fix this →