Coding Standards & Best Practices

Universal coding standards applicable across all projects.

When to use

• Starting a new project or module
• Reviewing code for quality and maintainability
• Refactoring existing code to follow conventions
• Enforcing naming, formatting, or structural consistency
• Setting up linting, formatting, or type-checking rules
• Onboarding new contributors to coding conventions

When NOT to use:

• Python code — python-patterns owns PEP 8, type hints, and Pythonic idioms
• Go code — golang-patterns owns Go conventions
• WordPress theme PHP — skyyrose-wp-platform owns phpcs, escaping/nonce rules, and the .min build
• Repo-wide policy (STOP-AND-SHOW, deploy gates, git discipline) — that lives in CLAUDE.md, not here

Inputs

Required before applying any standard:

• The target files, read this session. Never grade or refactor code you have not opened — apply standards to what the file actually contains, not what you assume it contains.
• The owning workspace's lint/type config. This repo has two separate TS workspaces:
  • frontend/ — Next.js dashboard: npm run lint (eslint .), npm run type-check (tsc --noEmit)
  • repo root — npm run lint (eslint src/**/*.{ts,tsx,js,jsx}), npm run type-check (tsc --project config/typescript/tsconfig.json --noEmit)
• Installed dependencies for that workspace. If node_modules/.bin/eslint is absent there, the gate cannot execute — stop and install first. Do not proceed on an unrunnable gate and report it clean (fail-open, bug-230).

If any input is absent: stop and name what's missing. Never proceed with a guessed config or an unread file.

Procedure

1. Read the code you are about to write against or review (Read/Grep) — quote file:line for every finding.
2. Identify the owning workspace (frontend/ vs root src/) so the right ESLint/tsc config judges the code. Never mix frontend/node_modules with root.
3. Apply the standards in this file in order: naming → immutability → error handling → type safety → structure → tests.
4. Grep the diff for banned patterns before running tools: : any, direct mutation of shared state (obj.key =, .push(), empty catch blocks, magic numbers.
5. Run the owning workspace's lint and type-check (see Verification). Fix the cause of each finding — never silence it with eslint-disable or @ts-ignore to get green.
6. Report findings with file:line and severity. Violations in code you did not touch are flagged, not fixed unasked (surgical-changes rule).

Verification

Run the owning workspace's own gates — these are the real scripts in this repo's package.json files [repo]:

cd frontend && npm run lint          # frontend workspace: eslint .
cd frontend && npm run type-check    # frontend workspace: tsc --noEmit
npm run lint                         # root workspace: eslint src/**/*.{ts,tsx,js,jsx}
npm run type-check                   # root workspace: tsc --project config/typescript/tsconfig.json --noEmit
grep -n ": any" <changed .ts/.tsx files>   # diff-scoped hard gate, blocking even when eslint exits 0

• PASS (lint): exits 0. Observed 2026-07-29: cd frontend && npm run lint exits 0 in this worktree — existing no-explicit-any / no-unused-vars findings are warning-severity, so exit 0 does NOT mean zero violations. [repro]
• PASS (type-check): exits 0 with no diagnostics. [test]
• PASS (diff grep): zero matches on lines you added. [repo]
• A gate that dies (missing binary, config error, OOM) is an artifact, not a pass — fix the environment and re-run; never read an errored run as clean (bug-230).

Worked example

Real invocation in this repo, 2026-07-29 — grepping a workspace lib against the Type Safety standard:

grep -rn ": any" frontend/lib/vercel --include="*.ts" | head -5

Observed output:

frontend/lib/vercel/deployment-manager.ts:26:  aliasError?: any
frontend/lib/vercel/deployment-manager.ts:34:    info?: any
frontend/lib/vercel/deployment-manager.ts:93:    const body: any = {
frontend/lib/vercel/deployment-manager.ts:177:    const body: any = {
frontend/lib/vercel/deployment-manager.ts:208:    const params: any = { ...options }

Five violations of the Type Safety standard (any in API payload shapes) [repro]. The same day, cd frontend && npm run lint exited 0 while reporting @typescript-eslint/no-explicit-any across 41+ files — the rule is warning-severity in this config, which is exactly why the diff-scoped grep is the blocking check for new code. The correct fix is a typed interface for the Vercel deployment payloads, not an eslint-disable.

Failure modes

Failure	What it looks like	Rule
Silencing instead of fixing	eslint-disable-next-line, @ts-ignore, as any added to get green	Same defect as weakening a test to pass it — fix the cause
Warning-severity lulling	lint exits 0, so "zero violations" gets claimed	Exit 0 ≠ clean (observed above) — grep the diff for banned patterns
Gate dies, read as pass	eslint crashes on a missing binary/config and the empty output is treated as clean	Fail-open (bug-230, ×6) — a gate that dies is not a gate that passed
Wrong workspace	root ESLint config judging frontend/ code, or mixed node_modules trees	Two separate workspaces — never mix (CLAUDE.md §5)
Standards applied to unread code	findings without file:line, refactors of assumed content	If you haven't read it, you don't know it
Cross-language leakage	these TS/React rules applied to Python or theme PHP	Route to python-patterns / skyyrose-wp-platform instead

Code Quality Principles

1. Readability First

• Code is read more than written
• Clear variable and function names
• Self-documenting code preferred over comments
• Consistent formatting

2. KISS (Keep It Simple, Stupid)

• Simplest solution that works
• Avoid over-engineering
• No premature optimization
• Easy to understand > clever code

3. DRY (Don't Repeat Yourself)

• Extract common logic into functions
• Create reusable components
• Share utilities across modules
• Avoid copy-paste programming

4. YAGNI (You Aren't Gonna Need It)

• Don't build features before they're needed
• Avoid speculative generality
• Add complexity only when required
• Start simple, refactor when needed

TypeScript/JavaScript Standards

Variable Naming

// ✅ GOOD: Descriptive names
const marketSearchQuery = 'election'
const isUserAuthenticated = true
const totalRevenue = 1000

// ❌ BAD: Unclear names
const q = 'election'
const flag = true
const x = 1000

Function Naming

// ✅ GOOD: Verb-noun pattern
async function fetchMarketData(marketId: string) { }
function calculateSimilarity(a: number[], b: number[]) { }
function isValidEmail(email: string): boolean { }

// ❌ BAD: Unclear or noun-only
async function market(id: string) { }
function similarity(a, b) { }
function email(e) { }

Immutability Pattern (CRITICAL)

// ✅ ALWAYS use spread operator
const updatedUser = {
  ...user,
  name: 'New Name'
}

const updatedArray = [...items, newItem]

// ❌ NEVER mutate directly
user.name = 'New Name'  // BAD
items.push(newItem)     // BAD

Error Handling

// ✅ GOOD: Comprehensive error handling
async function fetchData(url: string) {
  try {
    const response = await fetch(url)

    if (!response.ok) {
      throw new Error(`HTTP ${response.status}: ${response.statusText}`)
    }

    return await response.json()
  } catch (error) {
    console.error('Fetch failed:', error)
    throw new Error('Failed to fetch data')
  }
}

// ❌ BAD: No error handling
async function fetchData(url) {
  const response = await fetch(url)
  return response.json()
}

Async/Await Best Practices

// ✅ GOOD: Parallel execution when possible
const [users, markets, stats] = await Promise.all([
  fetchUsers(),
  fetchMarkets(),
  fetchStats()
])

// ❌ BAD: Sequential when unnecessary
const users = await fetchUsers()
const markets = await fetchMarkets()
const stats = await fetchStats()

Type Safety

// ✅ GOOD: Proper types
interface Market {
  id: string
  name: string
  status: 'active' | 'resolved' | 'closed'
  created_at: Date
}

function getMarket(id: string): Promise<Market> {
  // Implementation
}

// ❌ BAD: Using 'any'
function getMarket(id: any): Promise<any> {
  // Implementation
}

React Best Practices

Component Structure

// ✅ GOOD: Functional component with types
interface ButtonProps {
  children: React.ReactNode
  onClick: () => void
  disabled?: boolean
  variant?: 'primary' | 'secondary'
}

export function Button({
  children,
  onClick,
  disabled = false,
  variant = 'primary'
}: ButtonProps) {
  return (
    <button
      onClick={onClick}
      disabled={disabled}
      className={`btn btn-${variant}`}
    >
      {children}
    </button>
  )
}

// ❌ BAD: No types, unclear structure
export function Button(props) {
  return <button onClick={props.onClick}>{props.children}</button>
}

Custom Hooks

// ✅ GOOD: Reusable custom hook
export function useDebounce<T>(value: T, delay: number): T {
  const [debouncedValue, setDebouncedValue] = useState<T>(value)

  useEffect(() => {
    const handler = setTimeout(() => {
      setDebouncedValue(value)
    }, delay)

    return () => clearTimeout(handler)
  }, [value, delay])

  return debouncedValue
}

// Usage
const debouncedQuery = useDebounce(searchQuery, 500)

State Management

// ✅ GOOD: Proper state updates
const [count, setCount] = useState(0)

// Functional update for state based on previous state
setCount(prev => prev + 1)

// ❌ BAD: Direct state reference
setCount(count + 1)  // Can be stale in async scenarios

Conditional Rendering

// ✅ GOOD: Clear conditional rendering
{isLoading && <Spinner />}
{error && <ErrorMessage error={error} />}
{data && <DataDisplay data={data} />}

// ❌ BAD: Ternary hell
{isLoading ? <Spinner /> : error ? <ErrorMessage error={error} /> : data ? <DataDisplay data={data} /> : null}

API Design Standards

REST API Conventions

GET    /api/markets              # List all markets
GET    /api/markets/:id          # Get specific market
POST   /api/markets              # Create new market
PUT    /api/markets/:id          # Update market (full)
PATCH  /api/markets/:id          # Update market (partial)
DELETE /api/markets/:id          # Delete market

# Query parameters for filtering
GET /api/markets?status=active&limit=10&offset=0

Response Format

// ✅ GOOD: Consistent response structure
interface ApiResponse<T> {
  success: boolean
  data?: T
  error?: string
  meta?: {
    total: number
    page: number
    limit: number
  }
}

// Success response
return NextResponse.json({
  success: true,
  data: markets,
  meta: { total: 100, page: 1, limit: 10 }
})

// Error response
return NextResponse.json({
  success: false,
  error: 'Invalid request'
}, { status: 400 })

Input Validation

import { z } from 'zod'

// ✅ GOOD: Schema validation
const CreateMarketSchema = z.object({
  name: z.string().min(1).max(200),
  description: z.string().min(1).max(2000),
  endDate: z.string().datetime(),
  categories: z.array(z.string()).min(1)
})

export async function POST(request: Request) {
  const body = await request.json()

  try {
    const validated = CreateMarketSchema.parse(body)
    // Proceed with validated data
  } catch (error) {
    if (error instanceof z.ZodError) {
      return NextResponse.json({
        success: false,
        error: 'Validation failed',
        details: error.errors
      }, { status: 400 })
    }
  }
}

File Organization

Project Structure

src/
├── app/                    # Next.js App Router
│   ├── api/               # API routes
│   ├── markets/           # Market pages
│   └── (auth)/           # Auth pages (route groups)
├── components/            # React components
│   ├── ui/               # Generic UI components
│   ├── forms/            # Form components
│   └── layouts/          # Layout components
├── hooks/                # Custom React hooks
├── lib/                  # Utilities and configs
│   ├── api/             # API clients
│   ├── utils/           # Helper functions
│   └── constants/       # Constants
├── types/                # TypeScript types
└── styles/              # Global styles

File Naming

components/Button.tsx          # PascalCase for components
hooks/useAuth.ts              # camelCase with 'use' prefix
lib/formatDate.ts             # camelCase for utilities
types/market.types.ts         # camelCase with .types suffix

Comments & Documentation

When to Comment

// ✅ GOOD: Explain WHY, not WHAT
// Use exponential backoff to avoid overwhelming the API during outages
const delay = Math.min(1000 * Math.pow(2, retryCount), 30000)

// Deliberately using mutation here for performance with large arrays
items.push(newItem)

// ❌ BAD: Stating the obvious
// Increment counter by 1
count++

// Set name to user's name
name = user.name

JSDoc for Public APIs

/**
 * Searches markets using semantic similarity.
 *
 * @param query - Natural language search query
 * @param limit - Maximum number of results (default: 10)
 * @returns Array of markets sorted by similarity score
 * @throws {Error} If OpenAI API fails or Redis unavailable
 *
 * @example
 * ```typescript
 * const results = await searchMarkets('election', 5)
 * console.log(results[0].name) // "Trump vs Biden"
 * ```
 */
export async function searchMarkets(
  query: string,
  limit: number = 10
): Promise<Market[]> {
  // Implementation
}

Performance Best Practices

Memoization

import { useMemo, useCallback } from 'react'

// ✅ GOOD: Memoize expensive computations
const sortedMarkets = useMemo(() => {
  return markets.sort((a, b) => b.volume - a.volume)
}, [markets])

// ✅ GOOD: Memoize callbacks
const handleSearch = useCallback((query: string) => {
  setSearchQuery(query)
}, [])

Lazy Loading

import { lazy, Suspense } from 'react'

// ✅ GOOD: Lazy load heavy components
const HeavyChart = lazy(() => import('./HeavyChart'))

export function Dashboard() {
  return (
    <Suspense fallback={<Spinner />}>
      <HeavyChart />
    </Suspense>
  )
}

Database Queries

// ✅ GOOD: Select only needed columns
const { data } = await supabase
  .from('markets')
  .select('id, name, status')
  .limit(10)

// ❌ BAD: Select everything
const { data } = await supabase
  .from('markets')
  .select('*')

Testing Standards

Test Structure (AAA Pattern)

test('calculates similarity correctly', () => {
  // Arrange
  const vector1 = [1, 0, 0]
  const vector2 = [0, 1, 0]

  // Act
  const similarity = calculateCosineSimilarity(vector1, vector2)

  // Assert
  expect(similarity).toBe(0)
})

Test Naming

// ✅ GOOD: Descriptive test names
test('returns empty array when no markets match query', () => { })
test('throws error when OpenAI API key is missing', () => { })
test('falls back to substring search when Redis unavailable', () => { })

// ❌ BAD: Vague test names
test('works', () => { })
test('test search', () => { })

Code Smell Detection

Watch for these anti-patterns:

1. Long Functions

// ❌ BAD: Function > 50 lines
function processMarketData() {
  // 100 lines of code
}

// ✅ GOOD: Split into smaller functions
function processMarketData() {
  const validated = validateData()
  const transformed = transformData(validated)
  return saveData(transformed)
}

2. Deep Nesting

// ❌ BAD: 5+ levels of nesting
if (user) {
  if (user.isAdmin) {
    if (market) {
      if (market.isActive) {
        if (hasPermission) {
          // Do something
        }
      }
    }
  }
}

// ✅ GOOD: Early returns
if (!user) return
if (!user.isAdmin) return
if (!market) return
if (!market.isActive) return
if (!hasPermission) return

// Do something

3. Magic Numbers

// ❌ BAD: Unexplained numbers
if (retryCount > 3) { }
setTimeout(callback, 500)

// ✅ GOOD: Named constants
const MAX_RETRIES = 3
const DEBOUNCE_DELAY_MS = 500

if (retryCount > MAX_RETRIES) { }
setTimeout(callback, DEBOUNCE_DELAY_MS)

Remember: Code quality is not negotiable. Clear, maintainable code enables rapid development and confident refactoring.