External data is not cast directly into trusted types

typescript-arch-001

Intent

TypeScript types disappear at runtime, so external data must be validated before it is treated as trusted.

Applicability

Applies when the diff accepts HTTP bodies, queue payloads, environment config, or JSON from external systems.

What to inspect

as SomeType, angle-bracket casts, non-null assertions on external values, and visible runtime validation.

Pass criteria

External data is validated at runtime before being treated as a trusted type.

Fail criteria

The diff casts request, message, or config data directly into trusted types with no visible runtime validation.

Do not flag

Values already validated earlier in the same visible flow and narrow test fixtures.

Confidence guidance

HIGH when the unvalidated cast is direct. MEDIUM when validation may happen out of scope. LOW when data provenance is unclear.

Remediation

Validate first, then convert the validated payload into the trusted type.

Pass example

const parsed = OrderSchema.parse(req.body);

Fail example

const parsed = req.body as Order;