Hook payloads typed
Why it matters
Untyped hook payloads — parameters typed as any, unknown, or Record<string, any> — eliminate compile-time safety from every plugin in the ecosystem. Plugin authors get no autocompletion, no error on typos in property names, and no signal when a host update renames a payload field. Breakage appears only at runtime, often in production. ISO 25010 maintainability.analysability scores fall sharply when the API surface cannot be understood without running code; typed payloads are the primary mechanism for making plugin APIs analysable.
Severity rationale
High because untyped hook payloads remove compile-time safety from the entire plugin ecosystem, causing payload-shape mismatches to surface only as runtime errors in plugin authors' production deployments.
Remediation
Define a typed map of all hook payloads and use generic registration to infer types at call sites. This converts payload shape errors from runtime crashes into compile-time failures, and provides IDE autocompletion to every plugin author.
interface HookPayloads {
'before:request': { request: Request; config: PluginConfig };
'after:response': { request: Request; response: Response; duration: number };
'on:error': { error: Error; request: Request; retryCount: number };
}
on<K extends keyof HookPayloads>(
hook: K,
handler: (payload: HookPayloads[K]) => void | Promise<void>
): void;
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Plugin / Extension Architecture Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modifiability — Modifiability — typed hook payloads surface breaking API changes at compile time
- iso-25010:2011 · maintainability.analysability — Analysability — typed payloads enable static analysis and IDE tooling
Taxons
History
- 2026-04-18·v1.0.0·Initial import from plugin-extension-architecture·automated