TypeScript 7

Apply the JavaScript ES2026 baseline first. These rules cover TypeScript 7.0.x. The native compiler adopts 6.0's changed defaults, rejects removed options, and has no compiler API; review effective configuration when migrating from 5.x or 6.x.

Compiler checks

• Keep strict (7.0 default true) and every strict-family check on in production; an older config still setting false opts out.
• Before release, require a full-project type check with noCheck: false and checkJs for included JavaScript. An emit stage may use noCheck, but emitted files don't prove checking passed: the compiler emits despite type errors.
• Enable noUncheckedIndexedAccess, exactOptionalPropertyTypes, useUnknownInCatchVariables (narrow caught values before reading properties or exposing details), noImplicitOverride, noFallthroughCasesInSwitch, and noImplicitReturns.

Trust boundaries

• Type parsed JSON, request bodies, environment variables, storage values, and SDK responses as unknown at entry points; narrow them with runtime schemas or type guards checking every security-relevant property and rejecting unknown keys that could enable mass assignment, policy bypass, or version confusion.
• Never use type assertions, including doubles like value as unknown as TrustedType, to make untrusted data an authenticated identity, authorization decision, validated command, or other incompatible security type.
• Keep validated branded types distinct from raw strings for identifiers, URLs, paths, secrets, and tenant-scoped keys.
• Prohibit any at trust boundaries, containing