360 Secure SkillHub
360 安全技能中心

typescript-best-practices

用于阅读或编辑 .ts/.tsx 文件时,提供判别联合、品牌类型、边界校验、类型守卫、穷尽检查和结构化日志等规则,强调用 schema 与总函数式类型减少 as 断言和运行时错误。

cursor
热度 0.00
最近更新 2026-10-18 16:52:41
分类:开发依赖:纯提示词应用场景:代码生成 / 代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add cursor/plugins/typescript-best-practices
Metadata
name
typescript-best-practices
description
TypeScript best practices. Use when reading or editing any .ts or .tsx file.
paths
["**/*.ts","**/*.tsx"]
disable-model-invocation
true

TypeScript best practices

Apply the type-system-discipline principle skill first.

Rule Summary
Discriminated unions Model variants with a kind literal discriminant so impossible states can't be represented. No optional-field bags.
Branded types Brand primitives with & { readonly __brand: "X" } so they can't be mixed up. Validate once at the boundary. A brand comes from a verifying type guard (input is AgentId), never from as.
Constructive modeling Build the shape so the illegal value can't be constructed. [T, ...T[]] for non-empty, [T, T][] for even length, start plus duration for a range. Not a runtime guard, not a wish for refinement types.
Simplest total type Keep T[] while every operation on it stays total. Strengthen to NonEmpty<T> only where the loose type forces !, a cast, or a "should never happen" throw.
unknown over any External data is unknown.
Schemas before guards Before hand-writing a property-by-property type guard, use the repository's runtime schema library and infer the type from the schema, such as z.infer.
No as casts Every as is a runtime crash waiting. Cast only after validation.
Narrowing hierarchy Discriminant switch > in operator > typeof/instanceof > user-defined type guard > as.
Type guards Must verify the claim. A lying guard is worse than as because the bug hides behind a name that says it's safe. Name them isX or hasX.
Exhaustiveness Inline const _exhaustive: never = x; in default arms so the compiler errors when a new variant is added.
satisfies over as Validates the value without widening literal types.
Boundary validation Parse where data crosses in, into a named domain type. Record<string, unknown> (however spelled) stops at that parse. Trust types inside. See the boundary-discipline principle skill.
Schema-derived types Reach for Pick/Omit/Parameters/ReturnType/Awaited/typeof before declaring a new interface.
Object args Pass objects, not positional, so argument order is self-documenting. Skip on hot paths (per-frame render, tokenizers, parsers).
Real tests Don't mock what you can run. Prefer the framework's real test primitives with leak/disposable checks, and verify UI in a running build. Mock only what you can't run locally.
Structured telemetry Prefer structured logger diagnostics with enough context to debug from an id. No console.log in shipped code.

Examples: references/patterns.md.