# Code Review

> Review code changes against Grant Platform guardrails and layer conventions. Use when reviewing pull requests, staged changes, or when the user asks for a code review. Use when this capability is needed.

- Skill: `tomevault-io/code-review-34` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/code-review-34`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/code-review-34/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/code-review-34

---


# Code Review

Review changes against the project's layer boundaries, type conventions, and patterns.

## Review checklist

Copy and fill as you review:

```
Code Review:
- [ ] Layer boundaries
- [ ] Type reuse from @grantjs/schema
- [ ] Handler conventions
- [ ] Service conventions
- [ ] Repository conventions
- [ ] REST / OpenAPI sync
- [ ] Web patterns
- [ ] i18n
- [ ] Error handling
- [ ] Comments (no narrative blocks; behavior in docs/README)
```

## What to check

### Layer boundaries

- Handlers call **services only** — never repositories or DB directly.
- Services call **repositories only** — never DB directly.
- Repositories use only **domain-related schemas** from `@grantjs/database`.
- GraphQL resolvers and REST routes call **handlers only**.

### Type reuse

- All args, inputs, and return types should come from `@grantjs/schema` codegen (used fully, extended, or partial — e.g. `Omit<QueryXArgs, 'scope'>`).
- No manual redefinitions of types that exist in the generated schema.

### Handler conventions

- Extends `CacheHandler`.
- Queries scope IDs from cache; invalidates cache on mutations.
- Mutations wrapped in `ITransactionalConnection.withTransaction()` when atomic.
- Args follow pattern: `QueryXArgs & SelectedFields<X>`.

### Service conventions

- Extends `AuditService`; logs mutations via `logCreate/logUpdate/logSoftDelete/logHardDelete`.
- Validates input and output with zod schemas (`validateInput`, `validateOutput`).
- Args follow pattern: `Omit<QueryXArgs, 'scope'> & SelectedFields<X>`.
- Only accesses domain-related repositories.

### Repository conventions

- Extends `EntityRepository` or `PivotRepository`.
- Uses only domain-related schemas from `@grantjs/database`.
- `relations` config correctly maps joined entities.

### REST and OpenAPI

- Route, zod schema, and OpenAPI spec are **all in sync**.
- Routes use `validate()` middleware, `authorizeRestRoute()`, and `requireEmailVerificationRest()` where applicable.
- Mutation variables match `@grantjs/schema` types.

### Web patterns

- Hooks use generated operation documents from `@grantjs/schema`.
- Feature modules follow toolbar / viewer / pagination / dialog / skeleton structure.
- New UI primitives added via shadcn CLI (not manually).
- State stores are per-module and isolated.

### i18n

- All new user-facing text uses `next-intl` translation keys.
- Translation keys added to `apps/web/i18n/locales/`.

### Error handling

- Shared error types from `@/lib/errors`; no swallowed errors.
- Errors logged with cause/context.

## Feedback format

Use severity levels:

- **Critical** — Must fix: layer violation, missing validation, broken type contract.
- **Suggestion** — Should consider: inconsistency with existing patterns, missing audit log, missing i18n.
- **Nit** — Optional: naming, style, minor improvements.

---
> Source: [grant-js/grant](https://github.com/grant-js/grant) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 -->