{
  // Typecheck for the standalone harnesses under `tests/`. The main tsconfig
  // cannot cover them: it pins `rootDir: "src"` and `include: ["src"]`, so
  // everything here is outside the build by construction — the `exclude`
  // entry for `tests` was belt-and-braces, not the cause.
  //
  // Why this exists: `tests/security/exfil-injection` calls into the real
  // network guard. Without a typecheck, a signature change in core leaves the
  // harness calling the old shape, it throws at runtime, and its catch turns
  // that into the "blocked" result — the security suite then reports a clean
  // run while measuring nothing.
  //
  // It began scoped to `tests/security`; the entries below widened it one
  // directory at a time, each with its reason. `tests/` as a whole is still not
  // included: files outside these entries (the `tests/model-fitness-*` tests,
  // for one) are checked by nothing.
  //
  // `include` names directories under `tests/`, not `src`: tsc pulls the
  // imported `src` files in as dependencies and checks them, so a wrong-arity
  // call into the guard is caught without re-checking all of src a second time.
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "noEmit": true,
    "rootDir": ".",
    "incremental": false
  },
  "include": ["tests/security", "tests/contract-env.test.ts",
    // The online evals. vitest leaves them out unless opted in (`scripts/vitest-online-opt-in.ts`)
    // and, opted in, runs them without a type check. A stub of the wrong shape then fails only at
    // run time, and where an eval swallows it, it changes what the eval measures without a symptom:
    // a `promptSecret` stub that resolved an object made `ask_secret` return nothing instead of its
    // cancel text (its switch has no default).
    "tests/online",
    // The pinned-fetch bridge, which adapts fetchPinned's transport back onto a
    // `globalThis.fetch` stub for the suites whose subject moved to the
    // connector surface. It calls into the network guard, so it has exactly the
    // property this project exists for: a signature change there must fail at
    // compile time rather than at runtime inside a catch.
    "tests/helpers",
    // The probe-freshness pair, so `probe-freshness.d.mts` binds SOMEWHERE. Before this,
    // `tests/eval` was in no tsc project and the declaration was checked by nothing at all.
    //
    // What this does and does not buy, stated because the first version of this comment
    // claimed the stronger thing: it pins the TESTS' CALL SITES against the declaration. It
    // does NOT verify the declaration against the module — `allowJs` is off, so tsc never
    // loads `probe-freshness.mjs`, and a ghost export or a wrong return type there still
    // compiles clean. The module-vs-declaration drift is caught by the runtime tests, not
    // by tsc.
    //
    // Only these two files, not the whole directory — the rest of `tests/eval` was never in
    // a project and dragging it in is a different job.
    "tests/eval/probe-freshness.test.ts",
    "tests/eval/probe-freshness-members.test.ts",
    // The suite's temp-root redirect, which `vitest.config.ts` loads as `globalSetup`. It was in
    // no tsc project at all: the main config pins `rootDir: "src"`, so a file under `scripts/`
    // cannot be added there, and the PR that introduced it said "typecheck clean" — true, and
    // covering everything except this file. A type error in it fails the whole suite at startup,
    // which is the worst place to find one. Its TEST stays out, per the rule that assertions in
    // `*.test.ts` are not typecheck surface.
    "scripts/test-run-tmpdir.ts"],
  "exclude": ["src/**/*.test.ts"]
}