TypeScript safety

Contents

• Procedure
• Where to read
• The traps that cost the most time
• Review checklist

Getting the compiler to catch bugs before they run, on TypeScript 6 and 7. TS 7.0 is the Go compiler, installed as plain typescript since July 2026. strict has been the default since 6.0, so the remaining gains come from the flags strict leaves off, from narrowing instead of casting, and from parsing data at the edges.

Types describe code, not data. Anything that enters the process (a response body, JSON.parse, storage, env vars) is unchecked until code checks it. An annotation on an any is a cast.

Every escape hatch turns off the check that would have caught the bug. No any in new code. Reach for unknown and narrow. A cast needs a runtime check next to it.

Source checks and dates: SOURCES.md.

Procedure

1. Read the project's tsconfig.json and the installed typescript version (npx tsc --version). On 5.x or 6.x with deprecation errors, start with upgrade-6-to-7.md.
2. Compare the config with the baseline in config.md. Turning on a flag in an old codebase can add hundreds of errors: count them with tsc --noEmit first, and fix by module.
3. Read the resource for the task in the table below.
4. Write the change. Prefer the first tool that works: narrowing, then a predicate, then a checked cast.
5. Run tsc --noEmit, and eslint if the project has typed linting. Report both results, and say which TS version ran.

A single error fix or a direct question gets a direct answer: the fix or the answer, and the tsc --noEmit result if you ran it. No formal report.

A review or audit reports findings as Must fix / Should fix / Leave, with the file, the line, and the flag or rule name. Never report a problem you did not see in the code.

• Must fix: a check is off and a wrong value can compile. An any leak, an unchecked as, a missing exhaustive check, an option TS 7 removed.
• Should fix: the code is right today but the types will not stop the next mistake. A missing brand, a const enum, mixed type and interface.
• Leave: a style the project already chose, or code the change does not touch.

data from outside ──> unknown ──> parse at the edge ──> precise types inside
                                  domain-types.md      narrowing.md, generics.md
                                                              |
  tsconfig flags catch the rest: config.md        types from types: type-level.md
                                                              |
  any / as / ! found? escape-hatches.md      lint what tsc cannot: linting.md

Where to read

The traps that cost the most time

Review checklist

• strict, noUncheckedIndexedAccess, exactOptionalPropertyTypes, and verbatimModuleSyntax are on, and target, module, and types are explicit
• No option or syntax removed in TS 7 remains
• Data from outside is unknown until parsed, once, at the edge
• No any in new code, including from Array.isArray, computed import(), and .catch() callbacks. Every as sits behind a runtime check. No @ts-ignore.
• catch variables are narrowed, and only Error values are thrown
• No const enum. New code uses as const objects over enums.
• States with different fields are discriminated unions, and switches over them are exhaustive
• A function type parameter appears at least twice. An inferred return counts. A type alias may use its parameter once.
• IDs and units that can be mixed up are branded
• typescript-eslint runs a type-checked config
• The report names the TS version and shows the tsc --noEmit result