backend-standardslisted

# Backend standards Stack these apply to: Next.js App Router route handlers and server actions, the MongoDB Node driver, TypeScript, Zod. `code-style` applies here too and is not repeated: no comments, no em dashes, switch over if/else, guard clauses. This skill covers what is specific to the server. ## 1. Parse at the boundary Every input crossing into your code gets parsed by a Zod schema before anything reads it. Request bodies, query strings, route params, webhook payloads, environment variables, and third-party API responses. Parse, do not validate. The schema's output type is what the rest of the function uses, so an unparsed value is never in scope. ```ts ✗ export async function POST(request: Request) { const body = await request.json() await createInvite(body.email, body.role) } ✓ const CreateInvite = z.object({ email: z.string().email("Enter a valid email address"), role: z.enum(["admin", "member"]), }) export async function POST(request: Request) { const parsed = CreateInvite.safeParse(await request.json()) if (!parsed.success) return badRequest(parsed.error) await createInvite(parsed.data) } ``` Schemas live next to the handler when used once, in a shared module when the client also needs the type. Derive types with `z.infer`; never hand-write a type that duplicates a schema. Environment variables get parsed once at module load, in one file, and are imported from there. No bare `process.env.FOO` in business logic. ## 2. Auth before work, o