add(ci): run the Worker's type-check and assertions

A proposal, and deliberately the last commit: adding a gate to this repo's CI
is the maintainer's call, so drop this one and everything before it still
stands. The one line elsewhere that names the job — a sentence in CLAUDE.md —
is inside this commit for that reason.

mcp/ is a separate package with its own lockfile, so the build job never
touched it: the root `npm ci` doesn't install it, and both eslint.config.js and
.prettierignore exclude mcp/ deliberately. Its type-check had never run in CI at
all. A second job keeps a Worker failure reading distinctly from a site-build
failure. The build job is unchanged.

build:data is an explicit step: src/index.ts imports the generated, gitignored
src/data.json, so `tsc --noEmit` fails with TS2307 on a clean checkout. pretest
would regenerate it, but relying on that makes step order quietly load-bearing.

The runner is pinned to 22.15 rather than the build job's 22: ts-resolve-hook
.mjs needs node:module's registerHooks, added there. `22` resolves to something
newer today, so this only matters the day it doesn't — and the failure it
prevents is a link-time missing export with nothing to point at.

Not added to .githooks/pre-commit: that fires on every commit, almost none of
which touch mcp/, and it would need this package's separate dependency tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JFy2qPKK546AEFGixoxYoE

Author: hsw

.github/workflows/ci.yml

@@ -51,3 +51,44 @@ jobs:
           name: dist
           path: dist
           retention-days: 7
+
+  # The MCP Worker in mcp/ is a separate package with its own lockfile, so the
+  # job above never touches it: the root `npm ci` doesn't install it, and both
+  # eslint.config.js and .prettierignore exclude mcp/ deliberately. Its
+  # type-check had never run in CI either. A separate job so a Worker failure
+  # reads distinctly from a site-build failure.
+  mcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          # ts-resolve-hook.mjs needs registerHooks, added in 22.15. The `22`
+          # the job above uses would satisfy that today, but pinning the floor
+          # here keeps a runner rolling back from failing at link time with
+          # nothing to point at.
+          node-version: 22.15
+          cache: npm
+          cache-dependency-path: mcp/package-lock.json
+
+      - name: Install MCP dependencies
+        run: npm ci
+        working-directory: mcp
+
+      # src/data.json is generated rather than committed, and src/index.ts
+      # imports it — so tsc cannot resolve the module until the manifest
+      # exists. `npm test` regenerates it as well (pretest), but the
+      # type-check has no such hook and runs first.
+      - name: Build data manifest
+        run: npm run build:data
+        working-directory: mcp
+
+      - name: Type-check (tsc)
+        run: npm run typecheck
+        working-directory: mcp
+
+      - name: Test (node:assert)
+        run: npm test
+        working-directory: mcp

CLAUDE.md

@@ -116,7 +116,7 @@ npm run assets   # regenerate icons + OG image
 
 `predev` and `prebuild` run `scripts/generate-assets.mjs` automatically.
 
-The Worker in `mcp/` has its own scripts, run from there: `npm test`, `npm run typecheck`, `npm run dev` (wrangler on 31338). On a fresh clone run `npm run build:data` first — `src/data.json` is generated, so `typecheck` fails with `TS2307` without it; `pretest` covers `npm test`.
+The Worker in `mcp/` has its own scripts, run from there: `npm test`, `npm run typecheck`, `npm run dev` (wrangler on 31338). On a fresh clone run `npm run build:data` first — `src/data.json` is generated, so `typecheck` fails with `TS2307` without it; `pretest` covers `npm test`. CI's `mcp` job runs the three in that order.
 
 **Pre-commit gate.** A tracked git hook at `.githooks/pre-commit` runs `npm run lint` and `npm run format:check` on every `git commit`; `core.hooksPath` is pointed at `.githooks/` by the `prepare` script on `npm install` (no husky). The same two checks run in CI (`ci.yml`). Run them before committing so the hook passes; `prettier --write .` fixes formatting. Bypass only in a genuine emergency with `git commit --no-verify`. The Worker's assertions are deliberately **not** in the hook: `mcp/` has its own dependency tree that most contributors never install, and running them would rewrite the generated `mcp/src/data.json` on every unrelated commit. CI is the gate for that.