review-vue-tslisted

# Review Vue / TypeScript Correctness and security review for front-end code. Two things make this different from reviewing a backend: everything in the bundle is public, and the type system creates a false sense of safety that `any` quietly punctures. The checklist runs whether or not the toolchain is installed. ## Procedure Follow `../../references/procedure.md`. Probe, scope, run what exists, walk the checklist by hand, score per `../../references/rubric.md`, emit both artifacts. ## Capability probe ```bash command -v tsc command -v eslint command -v bun command -v knip ``` | Tool | Invocation | If absent | |---|---|---| | `tsc --noEmit` | `bunx tsc --noEmit` (or `tsc --noEmit` when installed globally) | `bun add -d typescript` | | `eslint` | `bunx eslint <files>` | `bun add -d eslint` plus a config the project actually uses | | `bun audit` | `bun audit` — needs a `bun.lock` in scope | `bun install` first, or note that the project does not use bun | | `knip` | `bunx knip` | `bun add -d knip` | Several missing at once? The suite ships `review-tools.sh`, which probes and installs the whole toolchain in one pass. **Name it in `## Checks skipped` and leave running it to the user** — a review reports, it does not install. Prefer `bun`/`bunx` over `npm`/`npx` throughout. `tsc` on a Vue project only sees `<script>` blocks if the project is set up with `vue-tsc`; if `tsc` cannot resolve `.vue` imports, that is a crash for the `.vue` files and a result for the `.ts` files —