TypeScript 5.9

Apply the JavaScript ES2026 baseline first. These rules cover TypeScript 5.9.

Compiler checks

• Enable strict with every strict-family check in production; fail CI if noCheck or --noCheck is set, since it reports only critical parse and emit errors.
• Gate deployment on a successful type check of all production sources, with noEmitOnError (default false) when tsc emits release files and checkJs for included JavaScript.
• Enable noUncheckedIndexedAccess, exactOptionalPropertyTypes, useUnknownInCatchVariables (narrow caught values before reading properties or exposing details), noImplicitOverride, noFallthroughCasesInSwitch, and noImplicitReturns.

Trust boundaries

• Type parsed JSON, request bodies, environment variables, storage values, and SDK responses as unknown at entry points; narrow them with runtime schemas or type guards checking every security-relevant property and rejecting unknown keys that could enable mass assignment, policy bypass, or version confusion.
• Never use type assertions, including doubles like value as unknown as TrustedType, to make untrusted data an authenticated identity, authorization decision, validated command, or other incompatible security type; keep validated branded types distinct from raw strings for identifiers, URLs, paths, secrets, and tenant-scoped keys.
• Prohibit any at trust boundaries, containing unavoidable any in a small reviewed adapter; avoid non-null assertions on request, configuration, lookup, or async values.
• Never suppress errors with @ts-ignore or file-level @ts-nocheck;