SOTA JavaScript / TypeScript Engineering

Purpose

This skill encodes 2026 state-of-the-art for JS/TS so generated code is strict, secure, and fast by default — and so audits of existing code find the bug classes that actually bite: untyped boundaries, floating promises, XSS sinks, prototype pollution, supply-chain gaps, event-loop blocking, and leak-prone listeners. It has two operating modes; pick one explicitly at the start of a task.

Baseline assumptions (mid-2026): TypeScript ≥5.9 strict (6.0 = last JS-based compiler; 7.0 Go-native stable since July 2026, shipped as the regular typescript package — frameworks embedding the compiler API via Volar, e.g. Vue/Angular/Astro/Svelte, stay on 6.0 until a stable plugin API lands), ESM-first, Node LTS ≥22 (24 = active LTS; Node 26 ships Temporal by default), ES2024+ available, React 19.2-era with Server Components and React Compiler 1.0 where relevant, vitest 4 + flat-config ESLint (v9/v10).

BUILD mode (writing or modifying code)

1. Read the relevant rules files first (index below) for the area you're touching. Don't generate from memory what a rules file specifies.
2. Defaults unless the codebase dictates otherwise: strict tsconfig (rules/01), ESM, unknown over any, discriminated unions for state, zod/valibot parse at every untrusted boundary, ??/?. discipline, AbortController on cancellable ops, pino logging in services, Web APIs over deps.
3. Match the host codebase for style, framework, and structure — but do not replicate its security bugs or any-sprawl into new code. New code meets the bar even in old repos.
4. Boundary rule: every input from outside the type system (HTTP, env, JSON.parse, storage, postMessage, DB without typed client) is parsed with a schema before use. No as T on external data.
5. Finish the job: new code compiles under tsc --noEmit, passes lint, and ships with behavior-level tests (rules/07). Handle the error path of every async call — no floating promises.
6. When a requirement conflicts with a rule (e.g., legacy CJS, jest), follow the codebase and note the deviation; don't silently half-apply both.

AUDIT mode (reviewing existing code)

Scope first (frontend? Node service? library?), then read the matching rules files and run their audit checklists — each ends with grep/eslint hunt patterns. Validate findings: confirm attacker-controlled data actually reaches the sink, confirm the perf issue is on a hot path. No speculative findings.

Severity conventions:

• CRITICAL — remotely exploitable now: untrusted input reaching eval/innerHTML/exec/SQL, auth bypass, secrets exfiltratable via XSS.
• HIGH — exploitable with conditions, or guaranteed-corruption bug class: missing boundary validation, prototype-pollution-prone merge of request data, floating promises dropping errors, tokens in localStorage, unbounded request bodies, float money math, sync crypto blocking the loop.
• MEDIUM — weakened posture or latent defect: missing strict tsconfig flags, no graceful shutdown, missing CSP/timeouts, || vs ?? on falsy-valid values, index keys on mutable lists, unbounded caches, missing supply-chain controls.
• LOW — hygiene/debt: dead deps, hasOwnProperty, console.log in services, snapshot sprawl, missing memoization on profiled-hot paths.

Finding format:

[SEVERITY] Title (CWE-xxx if security)
File: path/to/file.ts:42
Issue: what is wrong, in one or two sentences
Evidence: the offending snippet
Impact: what an attacker/user/operator experiences
Fix: concrete change (code if short)

Order the report CRITICAL→LOW, deduplicate repeated patterns into one finding with a file list, and end with the top 3 systemic recommendations (e.g., "enable noUncheckedIndexedAccess", "adopt MSW", "add zod to route boundaries").

Rules index

For a full audit, read 01→07 in order; security-focused audits prioritize 05, 01, 03, 04.

Top 10 non-negotiables

1. strict: true + noUncheckedIndexedAccess in every tsconfig; no any, no @ts-ignore — unknown + narrowing, @ts-expect-error with reason.
2. Parse, don't cast, at boundaries: zod/valibot on every HTTP body/query, env var, JSON.parse, webhook, postMessage payload. Types inside, schemas at the edge.
3. No floating promises: every promise awaited or explicitly .catch-handled; @typescript-eslint/no-floating-promises as error. allSettled for independent work; bounded concurrency.
4. Discriminated unions for state, exhaustive switch with never default — no boolean-soup interfaces with optional data/error pairs.
5. === always; ??/?. over ||/&& for null-handling; immutable updates (toSorted, structuredClone, spread) on shared data.
6. Errors are Error subclasses with cause; never throw strings; never swallow with empty catch; Node policy = log fatally then exit on uncaught.
7. XSS sinks are forbidden by default: no innerHTML/dangerouslySetInnerHTML with non-constant input unless DOMPurify-sanitized at render; no eval family ever; CSP on HTML responses.
8. No secrets in localStorage; no shell interpolation: httpOnly cookies for tokens; execFile/spawn array-args, never exec with template strings; parameterized SQL.
9. Supply chain controlled: committed lockfile + npm ci, install scripts disabled/allowlisted, update cooldown, minimal deps — prefer platform built-ins (fetch, node:test, crypto.randomUUID).
10. AbortController + timeouts on all I/O; never block the event loop (>50ms CPU → worker; no *Sync in request paths); listeners and intervals always cleaned up.