TypeScript 6.0

Apply the JavaScript ES2026 baseline first. These rules cover TypeScript 6.0, which precedes the native 7.0 compiler; treat each deprecation it reports as work to finish, not noise.

Compiler checks

• Keep strict (6.0 default true) and every strict-family check on in production; an inherited "strict": false opts out.
• Fail CI if noCheck or --noCheck is set, since it reports only critical parse and emit errors; reject @ts-nocheck in security-sensitive files.
• Require successful type checking before release: tsc --noEmit for transpiled or type-stripped builds, noEmitOnError when tsc emits production code, and checkJs for included JavaScript.
• Enable noUncheckedIndexedAccess, exactOptionalPropertyTypes, useUnknownInCatchVariables (narrow caught values before reading properties or exposing details), noImplicitOverride, noFallthroughCasesInSwitch, and noImplicitReturns.

Trust boundaries

• Type parsed JSON, request bodies, environment variables, storage values, and SDK responses as unknown at entry points; narrow them with runtime schemas or type guards checking every security-relevant property and rejecting unknown keys that could enable mass assignment, policy bypass, or version confusion.
• Never use type assertions, including doubles like value as unknown as TrustedType, to make untrusted data an authenticated identity, authorization decision, validated command, or other incompatible security type; keep validated branded types distinct from raw strings for identifiers, URLs, paths, secrets, and tenant-scoped keys.
• Prohibit