engineering-standards-javascriptlisted

# Engineering Standards: JavaScript and TypeScript Language-specific engineering standards for JavaScript and TypeScript, derived from the team's base standards. RFC 2119 keywords (MUST, SHOULD) carry their standard meanings. **REQUIRED BACKGROUND:** engineering-standards owns the general rules (PR readiness, size, test types and requirements, the mocking philosophy, deployment). Read it first. This skill adds only the JS/TS specifics and never restates the base. ## Validation and parsing: use Zod **Prefer Zod schemas for validation and parsing** over hand-written type guards, manual `if` checks, or casting with `as`. A schema is one source of truth: it validates at runtime and gives you the static type through `z.infer`, so the shape and the check can't drift. **Validate at the boundaries of the application.** Parse untrusted or untyped data the moment it enters the app, then work with typed values inside. Boundaries include: - HTTP request bodies, query params, route params, and headers. - Environment variables and config files. - Responses from external APIs and third-party services. - Message-queue and event payloads. - Anything typed `any` or `unknown`: `JSON.parse` output, untyped DB rows, files read off disk. Use `schema.parse(input)` when a bad value should throw and fail fast at the edge, or `schema.safeParse(input)` when you want to handle the error path yourself. Never cast across a boundary (`input as User`): `as` is a compile-time assertion with no runtime