typescript-review

Files (16)

• SKILL.md
• ai-code-smells.md · rules/
• code-hygiene.md · rules/
• control-flow.md · rules/
• error-handling.md · rules/
• frontend-backend-layering.md · rules/
• functions.md · rules/
• playwright-e2e.md · rules/
• react-components.md · rules/
• react-hooks.md · rules/
• security.md · rules/
• testing.md · rules/
• types.md · rules/
• variables.md · rules/
• zod-validation.md · rules/
• zustand-stores.md · rules/

SKILL.md (first lines)

# TypeScript & React Review Rules

Generic, cross-project TS/React rules. Read only the rule file(s) matching
the current task — do not load all of them.

## Routing table

| Task touches...                                               | Read                              |
| ------------------------------------------------------------- | --------------------------------- |
| Types, `any`, `as`, generics, branded, discriminated unions   | `rules/types.md`                  |
| Early returns, switch exhaustiveness, narrow-then-act         | `rules/control-flow.md`           |
| Arrow functions, object args, defaults, return types          | `rules/functions.md`              |
| `const`/`let`, module-level constants, naming                 | `rules/variables.md`              |
| Try/catch, Result pattern, `asError`, error codes, logging    | `rules/error-handling.md`         |
| Zod schemas, parse vs safeParse, discriminator, refinement    | `rules/zod-validation.md`         |
| React hooks — deps, stale closures, AbortController, cleanup  | `rules/react-hooks.md`            |
| React components — props, dialogs, mutations, routing, a11y   | `rules/react-components.md`       |
| Zustand (or similar) stores — atomic updates, cleanup         | `rules/zustand-stores.md`         |
| **Test methodology** (8-layer model, mocking policy, PRD↔mirror, scenarios-first, CI tiering, isolation, 18 rules) | invoke **`rails:test-strategy`** |
| TS/React testing tooling (Vitest vi.mock vs MSW, @testing-library/react + user-event, TanStack Query fresh client, Zod test payloads) | `rules/testing.md`                |
| Playwright e2e — state-based waits, isolation, selectors      | `rules/playwright-e2e.md`         |
| Imports, dead code, speculative exports, PR discipline        | `rules/code-hygiene.md`           |
| AI-assisted code (speculative defaults, three-state null)     | `rules/ai-code-smells.md`         |
| FE doing server-domain work (classify, synthesise, transform) | `rules/frontend-backend-layering.md` |
| **PR-time security audit** (secrets / authn+authz / input validation + output encoding / dep vuln + supply chain / audit log) | invoke **`rails:security-review`** |
| **Design-phase threat modeling** (STRIDE against feature attack surface) | invoke **`rails:threat-model`** |
| TS/React security tooling (no secrets in localStorage; XSS / dangerouslySetInnerHTML; CSP; cookie flags HttpOnly+Secure+SameSite; CSRF tokens; open-redirect validation; postMessage origin checks; iframe sandbox; SRI; error-tracker filters) | `rules/security.md` |

## When multiple topics apply

Pick the dominant one. Don't load everything.

## Project-specific overlays

Project-specific rules (framework idioms, design-system components,
shared internal utilities) belong in a separate per-repo guideline file.
Load that in addition to these generic rules when working in that repo.

## Source of truth

The `rules/` files are the canonical reference.

From vancourse/apex, MIT.

More from vancourse/apex