Parse, Do Not Validate

function isValidEmail(s: string): boolean {
  return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(s) && s.length <= 254
}

function handleInvite(body: any) {
  if (!isValidEmail(body.email)) return badRequest('email')
  sendInvite(body.email, body.name)          // both are `string`; swap them, it compiles
}

function sendInvite(email: string, name: string) {
  // was `email` checked? cannot tell. so either trust it, or check again
  // with whatever rule this file happens to import
}

declare const brand: unique symbol
export type Email = string & { readonly [brand]: 'Email' }

export const Email = {
  parse(u: unknown): Result<Email, 'invalid_email'> {          // the ONLY constructor
    if (typeof u !== 'string' || u.length > 254) return err('invalid_email')
    const s = u.trim().toLowerCase()                            // normalisation, once
    return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(s) ? ok(s as Email) : err('invalid_email')
  },
}

function handleInvite(body: unknown) {
  const cmd = InviteCommand.parse(body)                         // -> { email: Email, name: DisplayName }
  if (!cmd.ok) return badRequest(cmd.error)
  sendInvite(cmd.value.email, cmd.value.name)                   // swapping them is a type error
}

function sendInvite(email: Email, name: DisplayName) {
  // the parameter type IS the proof. nothing to re-check, nothing to trust.
}

The first version cannot answer "has this been checked?" anywhere below handleInvite, so the rule gets duplicated with drift or skipped silently — and because both parameters are string, transposing them is undetectable. The second makes the check a precondition of *obtaining the value at all*: there is exactly one construction site, so normalisation happens once, the rule exists once, and a swapped argument list stops compiling. The cost is real and specific: as Email inside parse is an unchecked cast, so the entire guarantee rests on that being the only one in the codebase.

1. 1
   HTTP request body

   Arrives as bytes, becomes unknown after JSON.parse.

   fails by JSON.parse(b) as CreateUser — a cast, not a check. Nothing ran (Transport Validation).

2. 2
   Database read

   Returns driver-typed values: NUMERIC as a string, TIMESTAMPTZ as a Date, JSONB as any.

   fails by Assuming a column matches the domain type because a migration once said so. Schema drift is silent.

3. 3
   Cache hit

   Deserialised JSON with no class, no prototype, no brand.

   fails by Trusting cached shape across a deploy that changed the type (Cache-Aside).

4. 4
   Queue payload

   A message enqueued by a possibly older version of the producer.

   fails by Assuming the producer is at the same version. During a rolling deploy it is not (Rolling Deployments).

5. 5
   External API response

   JSON from a system you do not control or version.

   fails by Trusting the documented shape. Re-parse it exactly like user input (The Trust Boundary).

6. 6
   Config / environment

   Strings, always. PORT is "3000", DEBUG is "false" which is truthy.

   fails by Coercing at use rather than parsing once at boot (Validate at Startup, Fail Loudly).

The rule that falls out: parse at every boundary, cast at none. A codebase can be audited for this by grepping for casts to domain types — and the count should be one per type, inside its constructor.