360 Secure SkillHub
360 安全技能中心

Typescript Strict

核心为六阶段TypeScript严格模式落地工作流:从基线评估、编译器标志增量启用,到边界类型定义、类型收窄、泛型规范,再到验证防护搭建。适用于启用TS严格模式、清理遗留any代码、修复类型可预判的运行时bug、开发精准类型的库。需输入TS版本、构建工具、项目现状,输出分阶段实施计划、代码优化方案及CI保障规则,逐步提升代码安全性且不阻塞交付。

clawkk
clawkk
热度 45.99
最近更新 2026-05-11 17:36:03
分类:开发依赖:纯提示词应用场景:调试排错 / 代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add typescript-strict
Metadata
name
typescript-strict
description
Deep TypeScript strictness workflow—incremental enablement, compiler flags, typing boundaries, narrowing, generics, utility types, and safe refactors. Use when adopting strict mode, reducing any, or hardening large TS codebases.

TypeScript Strict Mode (Deep Workflow)

Strictness is a gradient, not a single switch. The goal is fewer runtime surprises without blocking delivery—via incremental migration and clear typing boundaries at IO edges.

When to Offer This Workflow

Trigger conditions:

  • Enabling strict, strictNullChecks, noImplicitAny, or noUncheckedIndexedAccess
  • Legacy codebase full of any and @ts-ignore
  • Runtime bugs that types would have caught (undefined, wrong shapes)
  • Library authoring needing accurate .d.ts exports

Initial offer:

Use six stages: (1) baseline & goals, (2) compiler flags roadmap, (3) boundary typing, (4) narrowing & exhaustiveness, (5) generics & patterns, (6) verify & guardrails). Confirm TS version, build tool (tsc, esbuild, etc.), and monorepo layout.


Stage 1: Baseline & Goals

Goal: Know current pain and target strictness with metrics.

Actions

  • Capture tsc --noEmit error count and top files by errors
  • Identify critical packages vs leaf apps for sequencing
  • Define non-goals (e.g., “no perfect types for untyped third-party JSON this quarter”)

Exit condition: Baseline error count + priority directories.


Stage 2: Compiler Flags Roadmap

Goal: Enable flags incrementally—fix clusters, not the whole repo at once.

Typical order (adapt)

  1. strictNullChecks (often highest value)
  2. noImplicitAny on new files + ratchet old
  3. strictFunctionTypes, strictBindCallApply
  4. noUncheckedIndexedAccess (verbose—plan for undefined unions)
  5. exactOptionalPropertyTypes (sharp edges—later)

Techniques

  • // @ts-expect-error with ticket over blind @ts-ignore
  • Path-specific tsconfig extends for stricter packages
  • CI gate: no new any in changed lines (eslint @typescript-eslint/no-explicit-any)

Exit condition: Flag timeline with owners per package.


Stage 3: Boundary Typing (IO Edges)

Goal: Validate external data once; internal code trusts narrowed types.

Patterns

  • zod / io-ts / valibot for runtime parse at API boundary
  • satisfies for config objects—keeps literal types
  • Avoid casting from unknown without validation

APIs

  • Generated types from OpenAPI/graphql-codegen when possible
  • Branded types for IDs (type UserId = string & { __brand: 'UserId' }) to prevent mix-ups

Exit condition: New IO code has parse → typed pipeline documented.


Stage 4: Narrowing & Exhaustiveness

Goal: Control flow analysis works for you—discriminated unions, never checks.

Practices

  • Discriminated unions for states: { status: 'loading' } | { status: 'ok', data: T }
  • switch with assertNever(x) for compile-time exhaustiveness
  • Optional chaining vs explicit undefined handling—be consistent in module

Nullability

  • Prefer undefined vs null one convention per codebase section

Exit condition: Representative modules refactored with fewer optional footguns.


Stage 5: Generics & Patterns

Goal: Reuse without any soup—constraints and defaults.

Guidance

  • extends constraints; avoid unconstrained generics unless truly generic
  • Conditional types sparingly—readability over cleverness in app code
  • ReturnType / Parameters for inference glue
  • Avoid mutable array inference surprises—explicit element types when needed

Performance

  • Huge mapped types can slow tsc—split types or simplify

Exit condition: Style guide section for generics in shared libraries.


Stage 6: Verify & Guardrails

Goal: Strictness sticks—regressions caught in CI.

CI

  • tsc --noEmit required green for affected projects
  • Type-aware ESLint rules; pre-commit optional
  • dtslint or tsd for library typings tests when authoring packages

Refactor safety

  • Small PRs per module; runtime tests still required—types don’t replace tests

Final Review Checklist

  • Baseline metrics and roadmap for flags
  • IO boundaries validated with schemas or codegen
  • Discriminated unions / exhaustiveness for key state machines
  • Generics style documented for shared code
  • CI enforces typecheck on merge

Tips for Effective Guidance

  • Prefer unknown over any—forces narrowing at use site.
  • When user fights noUncheckedIndexedAccess, show helper getters or Record patterns.
  • Monorepo: align TypeScript version across packages—version skew causes phantom errors.

Handling Deviations

  • AllowJS mixed codebase: typed wrappers for critical paths first.
  • Third-party untyped libs: local d.ts or wrapper module with narrow exports.