Type-aware oxlint and stricter tsgo, without the casts

.oxlintrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "unicorn", "oxc", "import", "promise"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "error"
+  },
+  "options": {
+    "typeAware": true
+  },
+  "ignorePatterns": ["node_modules", "scripts"]
+}

package.json

@@ -26,6 +26,7 @@
   "devDependencies": {
     "@types/bun": "^1.2.0",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",
-    "oxlint": "^1.73.0"
+    "oxlint": "^1.73.0",
+    "oxlint-tsgolint": "^7.0.2001"
   }
 }

src/guard.ts

@@ -0,0 +1,11 @@
+export function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+export function asString(v: unknown, fallback = ""): string {
+  return typeof v === "string" ? v : fallback;
+}
+
+export function parseJson(text: string): unknown {
+  return JSON.parse(text);
+}

src/ledger/attention.ts

@@ -5,6 +5,7 @@
 // is flagged to the mind's own judgment rather than trusted to the ear's closure call forever.
 import type { Database } from "bun:sqlite";
 import type { Clock } from "./clock";
+import { many, one } from "./db";
 
 export interface AttentionItem {
   id: string;
@@ -60,16 +61,27 @@ export function reopenAttentionItem(db: Database, identityId: string, id: string
 }
 
 export function openItems(db: Database, identityId: string, limit = 50): AttentionItem[] {
-  const rows = db
-    .query("SELECT id, identity_id, venue_id, thread_root_id, ask_ts, what, opened_at FROM attention_items WHERE identity_id = ? AND closed_at IS NULL ORDER BY opened_at LIMIT ?")
-    .all(identityId, limit) as { id: string; identity_id: string; venue_id: string; thread_root_id: string | null; ask_ts: string | null; what: string; opened_at: string }[];
+  const rows = many<{
+    id: string;
+    identity_id: string;
+    venue_id: string;
+    thread_root_id: string | null;
+    ask_ts: string | null;
+    what: string;
+    opened_at: string;
+  }>(
+    db,
+    "SELECT id, identity_id, venue_id, thread_root_id, ask_ts, what, opened_at FROM attention_items WHERE identity_id = ? AND closed_at IS NULL ORDER BY opened_at LIMIT ?",
+    identityId,
+    limit,
+  );
   return rows.map((r) => ({ id: r.id, identityId: r.identity_id, venueId: r.venue_id, threadRootId: r.thread_root_id, askTs: r.ask_ts, what: r.what, openedAt: r.opened_at }));
 }
 
 // --- the ear's own watermark (never the mind's resident_cursor) ---
 
 export function earCursor(db: Database, identityId: string): number {
-  return (db.query("SELECT judged_rowid FROM ear_cursor WHERE identity_id = ?").get(identityId) as { judged_rowid: number } | null)?.judged_rowid ?? 0;
+  return one<{ judged_rowid: number }>(db, "SELECT judged_rowid FROM ear_cursor WHERE identity_id = ?", identityId)?.judged_rowid ?? 0;
 }
 
 export function advanceEarCursor(db: Database, identityId: string, judgedRowid: number): void {

src/ledger/audit.ts

@@ -1,6 +1,8 @@
 // SPEC §4.1.12 — the append-only audit log. One shared writer so every module logs through the
 // same choke point (the table itself also enforces append-only via triggers, SPEC schema v1).
 import type { Database } from "bun:sqlite";
+import { many } from "./db";
+import { isRecord, parseJson } from "../guard";
 
 export type AuditKind =
   | "event_received"
@@ -35,18 +37,18 @@ export interface AuditRecord {
 }
 
 export interface AuditQueryFilter {
-  sinceIso?: string;
-  untilIso?: string;
-  kind?: AuditKind;
-  taskId?: string; // matches a `taskId` field embedded in the record's payload, if present
+  sinceIso?: string | undefined;
+  untilIso?: string | undefined;
+  kind?: AuditKind | undefined;
+  taskId?: string | undefined; // matches a `taskId` field embedded in the record's payload, if present
 }
 
 // SPEC §15: "queryable by the operator, at minimum: by identity, by task, by time range, by kind"
 // — and per §15, an identity's own audit-query tool is scoped to that identity, same as every
 // other ledger query in this codebase (§7.1).
 export function queryAudit(db: Database, identityId: string, filter: AuditQueryFilter = {}): AuditRecord[] {
   const clauses = ["identity_id = ?"];
-  const params: unknown[] = [identityId];
+  const params: string[] = [identityId];
   if (filter.sinceIso) {
     clauses.push("at >= ?");
     params.push(filter.sinceIso);
@@ -59,10 +61,14 @@ export function queryAudit(db: Database, identityId: string, filter: AuditQueryF
     clauses.push("kind = ?");
     params.push(filter.kind);
   }
-  const rows = db
-    .query(`SELECT id, at, identity_id, kind, payload FROM audit WHERE ${clauses.join(" AND ")} ORDER BY at, id`)
-    .all(...(params as [])) as { id: number; at: string; identity_id: string; kind: AuditKind; payload: string }[];
+  const rows = many<{ id: number; at: string; identity_id: string; kind: AuditKind; payload: string }>(
+    db,
+    `SELECT id, at, identity_id, kind, payload FROM audit WHERE ${clauses.join(" AND ")} ORDER BY at, id`,
+    ...params,
+  );
 
-  const records = rows.map((r) => ({ id: r.id, at: r.at, identityId: r.identity_id, kind: r.kind, payload: JSON.parse(r.payload) as unknown }));
-  return filter.taskId ? records.filter((r) => (r.payload as { taskId?: string }).taskId === filter.taskId) : records;
+  const records = rows.map((r) => ({ id: r.id, at: r.at, identityId: r.identity_id, kind: r.kind, payload: parseJson(r.payload) }));
+  return filter.taskId
+    ? records.filter((r) => isRecord(r.payload) && r.payload.taskId === filter.taskId)
+    : records;
 }