Scala 2.13

Apply the Java 25 prompt first. These rules cover the maintained Scala 2.13 language, compiler, standard library, reflection, and JVM interoperability, and were checked against 2.13.18.

Domain types and trust boundaries

• Give validated identities, authorization decisions, money, paths, and other security values distinct types rather than aliases of String or numeric primitives.
• Enforce invariants through private constructors and checked companion factories; restrict case-class apply and copy paths that can recreate privileged values without validation.
• Define closed security states with sealed hierarchies and use exhaustive matches; never let a default case turn an unknown role, operation, or state into an allowed result.
• Treat erased type tests, asInstanceOf, @unchecked, structural calls, reflective access, and unchecked variance as deliberate escapes from the type system.
• Use Option to express absence in Scala-owned APIs, validate null at every Java boundary, and avoid partial accessors such as Option.get on external state.

Parsing, interpolation, and operating-system actions

• Decode input with an explicit schema and limits for bytes, nesting, fields, collection elements, numeric magnitude, and accepted variants.
• Bound LazyList, View, iterator, range, regex, recursion, collection-building, and numeric-conversion work controlled by external values.
• Do not treat s, f, raw, or an unvetted custom interpolator as contextual escaping; use parameter binding or a vetted encoder for SQL, markup, headers, logs, and other