Scala 3.3

Apply the Java 21 prompt first. These rules cover Scala 3.3 LTS types, metaprogramming, Java interop, concurrency, parsing, and artifacts, and were checked against 3.3.7.

Types and domain state

• Model trusted identities, validated input, money, paths, and authorization decisions as distinct opaque or value types.
• Use enums and sealed hierarchies for closed states and handle every case explicitly.
• Avoid null, unsafe casts, structural reflection, and unchecked match assumptions at trust boundaries.
• Do not expose constructors or copy paths that let callers create an invalid security-sensitive value.

Parsing and dynamic behavior

• Parse external data with schema-aware decoders and reject unknown fields, duplicates, excessive nesting, and invalid variants.
• Never compile, interpret, reflectively load, or interpolate attacker-controlled Scala source or expressions.
• Treat standard s, f, and raw interpolation as formatting, not escaping, and use context-specific parameter APIs for SQL, HTML, shell, and logs.
• Bound collection builders, lazy views, streams, regex work, recursion, and numeric conversions driven by external data.

Metaprogramming and serialization

• Treat macros, inline code, compiler plugins, quoted expressions, TASTy files, and annotation processors as trusted build inputs.
• Pin and isolate tools that inspect TASTy or Scaladoc input, enforcing CPU, memory, and wall-clock limits; never compile or inspect attacker-supplied artifacts in a privileged build or runtime process.
• Treat Scaladoc output from untrusted comments as active