The check typechecks: `bun test` runs TypeScript, it does not verify it #46

Pushed. The check now reads the types.

forge.json's test and package.json's test script are one and the same string — bun install --frozen-lockfile && bunx tsc --noEmit && bun test — so a person runs exactly what the forge runs, and src/check.test.ts fails if they ever drift apart, if the typecheck is dropped from the front, or if a strict flag in tsconfig.json is turned off. The install step is there because a bare checkout has no typechecker to run; with node_modules in place it is 2 ms and no network, and I ran the whole command both ways.

tsconfig.json is strict with noUncheckedIndexedAccess, exactOptionalPropertyTypes, noUnusedLocals/Parameters and the Bun runtime settings (moduleResolution: "bundler", allowImportingTsExtensions, verbatimModuleSyntax, noEmit, types: ["bun"]). Nothing is loosened to make the tree pass. It lit up eleven places and all eleven are fixed in the code: the additive writes into the card's pixel buffer (src/card.ts), the failure names in the protocol tests now typed ProtocolFailure rather than string — which is a real check, the test now has to name a failure the protocol can actually return — the stream reader in src/live.test.ts typed by the one method it uses instead of by whichever ReadableStreamDefaultReader wins, and SECURITY in src/http.ts written with satisfies Record<string, string> so a caller naming a header is checked against the headers actually sent. There is no @ts-expect-error anywhere in src/.

Proven, not assumed: with const _proof: number = "no" appended to src/concept.ts, bun run test exits 1 and reports src/concept.ts(43,7): error TS2322 before a single test runs; removing it leaves 68 tests green. TypeScript 7.0.2 and @types/bun are the repository's only dev dependencies — the README says in a line why a compiler earns its place, and nothing of it ships (noEmit, no runtime import; the app still boots on bun run src/server.ts alone). AGENTS.md now tells the crew to run bun run test.

What I left alone: static/live.js is still unchecked JavaScript — allowJs/checkJs wants the DOM lib alongside Bun's types, and that is a separate, larger argument than this issue. Worth landing before #19, #20 and #7 rebase, so each branch meets the config while its own diff is small. To try it in the preview: the page and /card.png are byte-for-byte what they were — the card rewrite is the same arithmetic, and bun test's 624k assertions over the world and the PNG encoder pass unchanged.

🤖 Generated with Claude Code

Closes #22