Imported from anantbhandarkar/CodeRiskKit (stacks/typescript/AGENTS.md). Install upstream with npx skills add anantbhandarkar/CodeRiskKit --skill typescript. Copyright stays with the author.

TypeScript Risk Review

Use this file when reviewing AI-generated TypeScript types, shared libraries, schemas, package APIs, compile-time guarantees, or strictness-related changes.

High-Risk Areas

• tsconfig.json with strict disabled or absent.
• Type assertions that hide runtime uncertainty.
• any, broad generics, weak overloads, and non-null assertions.
• Runtime data treated as trusted because TypeScript compiles.
• Discriminated unions without exhaustive handling.
• Public API type changes that break downstream callers.
• Schema/type drift between Zod, JSON Schema, OpenAPI, Prisma, GraphQL, or handwritten interfaces.
• Promise anti-patterns: floating promises, missing await, async Promise constructors, swallowed rejections.
• Unpinned or missing dependencies introduced to satisfy generated code.

Trust Rules

• Trust pure type refactors only after tsc --noEmit or the repo's typecheck passes.
• Do not trust a TypeScript project with strict mode disabled unless the existing project has an explicit reason.
• Do not trust type-only safety for external input. Require runtime validation.
• Do not trust generated declarations until at least one real call site compiles.
• Downgrade confidence when code works only through casts.

Review Checklist

1. Identify whether the change improves safety or only silences the compiler.
2. Inspect tsconfig.json for strict: true and related strictness settings.
3. Search for any, unknown as, as any, @ts-ignore, @ts-expect-error, and non-null assertions.
4. Check public exported types for compatibility and naming consistency.
5. Verify discriminated unions are exhaustive.
6. Confirm runtime validators match static types at boundaries.
7. Check promises for missing await, missing return, missing catch, async executors, and intentionally ignored promises without void.
8. Check package.json and lockfiles when dependencies changed.
9. Run typecheck and the narrowest relevant tests.

Boundary Rules

For data from APIs, databases, files, environment variables, queues, webhooks, local storage, or user input:

• Parse as unknown.
• Validate with an existing schema library or project pattern.
• Convert to a typed domain object only after validation.
• Report any unvalidated boundary as a risk.

Dependency Rules

• Flag "latest", "*", broad >=, or generated package names without lockfile evidence.
• Confirm the imported API exists in the installed package version.
• If code relies on a framework feature, verify the project version supports it.

Evidence To Report

• Typecheck command and result.
• Strict mode status.
• Casts or suppressions found.
• Promise handling risks found.
• Runtime boundary validators inspected.
• Dependency/version evidence.
• Public API compatibility concerns.