One-Shot Beta: From Prompt to Delivery

Before any work begins, One-Shot checks if there's enough working memory (context) left in the session. If not, it refuses to run rather than deliver incomplete work.

Result: Fresh session. Context sufficient. Proceeding.

The skill walks the existing state as a first-time user. For a code task: what exists in the target directory? What would a developer expect from this module?

Result: Greenfield project — empty directory. Developer expects a clean, importable module with typed results. No existing code to inherit or break.

Maps what needs to be built, decomposes the task into ordered steps, identifies alternatives, and announces the plan.

Decision: Evaluated 3 approaches for result types — Result<T,E> discriminated union vs tuple vs Option monad. Chose discriminated union for TypeScript DX (autocomplete, narrowing via .ok).

Key choice: Functions accept unknown input (not string) — correct for a boundary validation library where you can't trust input types.

Complete implementation. No stubs, no TODOs, no placeholders.

safe-parse/
  package.json          — ESM, exports field, zero deps
  tsconfig.json         — strict, noUncheckedIndexedAccess
  src/
    types.ts            — Result<T,E>, ParseError, ok(), err()
    safe-parse-json.ts  — safeParseJSON<T>() + 1MB size limit
    safe-parse-number.ts— safeParseNumber() + bounds validation
    safe-parse-date.ts  — safeParseDate() + epoch range check
    index.ts            — barrel export

Unique features: readonly on all Result/ParseError fields. Structured ParseError with source, message, and input. 1MB JSON size limit (error stores length, not content). Date parser accepts Date instances and epoch numbers.

Comprehensive test suite: happy paths, edge cases, failure modes, and adversarial inputs.

✓ src/safe-parse-json.test.ts   (21 tests)  9ms
✓ src/safe-parse-number.test.ts (30 tests)  5ms
✓ src/safe-parse-date.test.ts   (24 tests) 13ms

Test suites: 3 passed, 3 total
Tests:      75 passed, 75 total

Adversarial inputs tested: __proto__ pollution, boolean/null/undefined/array/object inputs, BigInt, Date instances, NaN, Infinity, -0, empty strings, whitespace, epoch boundaries, ambiguous date formats.

Explicit security review against OWASP patterns relevant to a parsing library:

• Prototype pollution — JSON.parse doesn't pollute Object.prototype. Verified.
• ReDoS — no regex used anywhere. Clean.
• Size limit — 1MB cap on JSON input. Error stores length, not content.
• PII leakage — oversized input stored as length only in error messages.
• Number("") trap — verified that Number("") returns 0. Empty-string guard runs first.
• Epoch range — bounded by MIN/MAX_EPOCH_MS constants.

Verdict: No changes needed — hardening was built in from Phase 2.

JSDoc on every exported function. TypeScript definitions auto-generated via tsc --declaration. Clear parameter descriptions and return type documentation.

Full verification pass: tsc --noEmit (zero type errors) + full test suite re-run (75/75 pass). All exports traced through the barrel file. Cross-file consistency checked: types.ts ↔ all 3 parsers ↔ index.ts.

Final review: zero any types, zero dead code, zero unused imports, zero stubs or TODOs. All Result/ParseError fields readonly. Error messages specific and actionable. Consistent formatting across all files. Barrel export minimal and complete.