@ttsc/lint 0.13.1 → 0.14.0-dev.20260528.1

package/linthost/rules_ts_no_unsafe_assignment.go

@@ -0,0 +1,102 @@
+// typescript/no-unsafe-assignment: assigning an `any`-typed value into
+// a concretely typed location erases the static guarantee the target
+// declaration carries. `const num: number = anyValue;` compiles, but
+// every later use of `num` operates on whatever `anyValue` actually
+// holds at runtime. typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-assignment/
+//
+// Type-aware. The rule visits two shapes:
+//
+//   - `VariableDeclaration` — the initializer of `let x: T = ...` or
+//     `const x: T = ...`. Without a typed target the assignment is
+//     trivially safe (the local becomes `any` too), so the rule
+//     requires an explicit type annotation OR a target that resolves
+//     to a non-`any` type.
+//   - `BinaryExpression` with `=` operator — a plain reassignment like
+//     `x = anyValue`. The LHS already has a static type from its
+//     declaration; the rule fires when the RHS is `any` and the LHS is
+//     not.
+//
+// As with the rest of the unsafe-* family `unknown` is intentionally
+// NOT flagged: it forces a narrowing assertion before the value can be
+// stored in a typed slot, which is the explicit ergonomic the upstream
+// rule pushes toward.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+)
+
+type noUnsafeAssignment struct{}
+
+func (noUnsafeAssignment) Name() string { return "typescript/no-unsafe-assignment" }
+func (noUnsafeAssignment) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeAssignment) Visits() []shimast.Kind {
+	return []shimast.Kind{
+		shimast.KindVariableDeclaration,
+		shimast.KindBinaryExpression,
+	}
+}
+func (noUnsafeAssignment) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	switch node.Kind {
+	case shimast.KindVariableDeclaration:
+		decl := node.AsVariableDeclaration()
+		if decl == nil || decl.Initializer == nil {
+			return
+		}
+		// Only flag when the target has an explicit type annotation —
+		// `const x = anyValue;` widens `x` to `any` too, which is the
+		// `no-explicit-any` family's concern, not this rule's.
+		if decl.Type == nil {
+			return
+		}
+		rhs := stripParens(decl.Initializer)
+		if rhs == nil {
+			return
+		}
+		rhsType := ctx.Checker.GetTypeAtLocation(rhs)
+		if !typeIsUnsafeAny(rhsType) {
+			return
+		}
+		lhsType := ctx.Checker.GetTypeFromTypeNode(decl.Type)
+		if typeIsUnsafeAny(lhsType) {
+			return
+		}
+		ctx.Report(node, noUnsafeAssignmentMessage)
+	case shimast.KindBinaryExpression:
+		bin := node.AsBinaryExpression()
+		if bin == nil || bin.OperatorToken == nil {
+			return
+		}
+		if bin.OperatorToken.Kind != shimast.KindEqualsToken {
+			return
+		}
+		if bin.Left == nil || bin.Right == nil {
+			return
+		}
+		rhs := stripParens(bin.Right)
+		if rhs == nil {
+			return
+		}
+		rhsType := ctx.Checker.GetTypeAtLocation(rhs)
+		if !typeIsUnsafeAny(rhsType) {
+			return
+		}
+		lhsType := ctx.Checker.GetTypeAtLocation(bin.Left)
+		if typeIsUnsafeAny(lhsType) {
+			return
+		}
+		ctx.Report(node, noUnsafeAssignmentMessage)
+	}
+}
+
+const noUnsafeAssignmentMessage = "Unsafe assignment of a value typed as `any` to a typed target. Narrow the value before storing it."
+
+func init() {
+	Register(noUnsafeAssignment{})
+}

package/linthost/rules_ts_no_unsafe_call.go

@@ -0,0 +1,82 @@
+// typescript/no-unsafe-call: invoking a value whose static type is
+// `any` discards every signature check the type system would otherwise
+// perform. The runtime call still happens, but the parameter list is
+// unchecked, the return type is `any`, and any downstream use of the
+// result silently spreads the `any` further. typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-call/
+//
+// Type-aware. The rule visits the three syntactic invocation shapes —
+// `f(...)`, `new F(...)`, and the tagged-template form `f` + ``"x"`` —
+// and reports when the callee resolves to a type whose flags include
+// `TypeFlagsAny`. `unknown` is intentionally not flagged: it requires a
+// narrowing assertion before the call, which is the explicit ergonomics
+// the upstream rule pushes toward. `never` is also skipped — a never
+// callee means the code is unreachable, which is a different rule's
+// concern.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+	shimchecker "github.com/microsoft/typescript-go/shim/checker"
+)
+
+type noUnsafeCall struct{}
+
+func (noUnsafeCall) Name() string { return "typescript/no-unsafe-call" }
+func (noUnsafeCall) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeCall) Visits() []shimast.Kind {
+	return []shimast.Kind{
+		shimast.KindCallExpression,
+		shimast.KindNewExpression,
+		shimast.KindTaggedTemplateExpression,
+	}
+}
+func (noUnsafeCall) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	var callee *shimast.Node
+	switch node.Kind {
+	case shimast.KindCallExpression:
+		if call := node.AsCallExpression(); call != nil {
+			callee = call.Expression
+		}
+	case shimast.KindNewExpression:
+		if ne := node.AsNewExpression(); ne != nil {
+			callee = ne.Expression
+		}
+	case shimast.KindTaggedTemplateExpression:
+		if tag := node.AsTaggedTemplateExpression(); tag != nil {
+			callee = tag.Tag
+		}
+	}
+	if callee == nil {
+		return
+	}
+	t := ctx.Checker.GetTypeAtLocation(callee)
+	if !typeIsUnsafeAny(t) {
+		return
+	}
+	ctx.Report(callee, noUnsafeCallMessage)
+}
+
+const noUnsafeCallMessage = "Unsafe call of a value typed as `any`. Narrow the callee to a concrete signature before invoking it."
+
+// typeIsUnsafeAny reports whether `t` carries the `any` flag — the only
+// shape these unsafe-* rules flag. `unknown` is intentionally NOT
+// included: it forces a narrowing assertion at the use site, which is
+// the safer ergonomic the upstream rules push toward. Returns false on
+// nil so an absent type silently bypasses the rule rather than firing
+// on every unanalysable expression.
+func typeIsUnsafeAny(t *shimchecker.Type) bool {
+	if t == nil {
+		return false
+	}
+	return t.Flags()&shimchecker.TypeFlagsAny != 0
+}
+
+func init() {
+	Register(noUnsafeCall{})
+}

package/linthost/rules_ts_no_unsafe_enum_comparison.go

@@ -0,0 +1,235 @@
+// typescript/no-unsafe-enum-comparison: `===` / `!==` (and the `==` /
+// `!=` cousins) silently accept any value that shares the widened
+// primitive of an enum member. A string enum value compared with a raw
+// string literal therefore matches whichever string happens to land in
+// the other operand, even when the literal is not declared on the enum
+// at all. The fix is to compare against one of the enum's own members
+// so a typo surfaces at compile time.
+// typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-enum-comparison/
+//
+// Type-aware. Without a Checker we cannot tell an enum-typed value
+// apart from a plain `string` / `number`, so Context.Checker == nil
+// short-circuits the visit the same way every other type-aware rule
+// in this package does.
+//
+// The matching algorithm mirrors typescript-eslint:
+//
+//   - one side must carry an enum type (TypeFlagsEnumLike — covers
+//     both the enum union and its literal members);
+//   - the other side must be the widened primitive (string-/number-/
+//     bigint-like) WITHOUT carrying the same enum;
+//   - `any`, `unknown`, `never`, and identical enums on both sides
+//     pass through.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+	shimchecker "github.com/microsoft/typescript-go/shim/checker"
+)
+
+type noUnsafeEnumComparison struct{}
+
+func (noUnsafeEnumComparison) Name() string { return "typescript/no-unsafe-enum-comparison" }
+func (noUnsafeEnumComparison) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeEnumComparison) Visits() []shimast.Kind {
+	return []shimast.Kind{shimast.KindBinaryExpression}
+}
+func (noUnsafeEnumComparison) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	bin := node.AsBinaryExpression()
+	if bin == nil || bin.OperatorToken == nil || bin.Left == nil || bin.Right == nil {
+		return
+	}
+	switch bin.OperatorToken.Kind {
+	case shimast.KindEqualsEqualsToken,
+		shimast.KindEqualsEqualsEqualsToken,
+		shimast.KindExclamationEqualsToken,
+		shimast.KindExclamationEqualsEqualsToken:
+	default:
+		return
+	}
+	left := ctx.Checker.GetTypeAtLocation(bin.Left)
+	right := ctx.Checker.GetTypeAtLocation(bin.Right)
+	if left == nil || right == nil {
+		return
+	}
+	if noUnsafeEnumComparisonMismatch(left, right) || noUnsafeEnumComparisonMismatch(right, left) {
+		ctx.Report(node, "Unsafe comparison between an enum-typed value and a plain primitive of the same widened type. Compare against one of the enum's own members so a typo surfaces at compile time.")
+	}
+}
+
+// noUnsafeEnumComparisonMismatch reports whether `enumSide` carries an
+// enum type and `otherSide` is the widened primitive without naming the
+// same enum. Both arms walk union constituents — a `Color | undefined`
+// still counts as the enum side, and the comparison `color === "red"`
+// is still unsafe even when `color` carries an extra nullish branch.
+func noUnsafeEnumComparisonMismatch(enumSide, otherSide *shimchecker.Type) bool {
+	if !noUnsafeEnumComparisonHasEnum(enumSide) {
+		return false
+	}
+	// `any` / `unknown` / `never` on the other side silently propagate
+	// from generic helpers — flagging them would explode false positives
+	// the same way `restrict-template-expressions` mitigates with its
+	// `allowAny` default.
+	if noUnsafeEnumComparisonIsLoose(otherSide) {
+		return false
+	}
+	// If the other side is provably the same enum (or one of its
+	// members), the comparison is the safe shape the rule recommends.
+	if noUnsafeEnumComparisonSharesEnum(enumSide, otherSide) {
+		return false
+	}
+	// The mismatch only fires when the non-enum side is the widened
+	// primitive that the enum widens to. A `Color === Status.Active`
+	// comparison (two unrelated enums of the same widened number) also
+	// trips this branch via the other call ordering.
+	if !noUnsafeEnumComparisonIsBareLiteralLike(otherSide) && !noUnsafeEnumComparisonHasEnum(otherSide) {
+		return false
+	}
+	return true
+}
+
+// noUnsafeEnumComparisonHasEnum reports whether t (or any constituent of
+// a union) carries an enum-like flag. `TypeFlagsEnumLike` covers both
+// the enum union type produced by `enum E { ... }` and the canonical
+// `TypeFlagsEnumLiteral`-tagged literal types for each member.
+func noUnsafeEnumComparisonHasEnum(t *shimchecker.Type) bool {
+	if t == nil {
+		return false
+	}
+	flags := t.Flags()
+	if flags&shimchecker.TypeFlagsEnumLike != 0 {
+		return true
+	}
+	if flags&(shimchecker.TypeFlagsUnion|shimchecker.TypeFlagsIntersection) != 0 {
+		for _, part := range t.Types() {
+			if noUnsafeEnumComparisonHasEnum(part) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// noUnsafeEnumComparisonIsLoose reports whether t propagates from a
+// generic helper without naming a concrete type — `any` / `unknown` /
+// `never`. The upstream rule keeps these silent so type-erasure paths
+// (`JSON.parse`, untyped APIs) don't light up everywhere.
+func noUnsafeEnumComparisonIsLoose(t *shimchecker.Type) bool {
+	if t == nil {
+		return true
+	}
+	return t.Flags()&(shimchecker.TypeFlagsAny|shimchecker.TypeFlagsUnknown|shimchecker.TypeFlagsNever) != 0
+}
+
+// noUnsafeEnumComparisonSharesEnum reports whether both sides refer to
+// the same enum declaration. The Checker canonicalizes enum literal
+// types per member, so identity follows the type's name symbol (or the
+// enum union's symbol) up the parent chain to the EnumDeclaration node
+// — comparing those addresses tells us whether `Color.Red` and
+// `Color.Blue` come from the same enum.
+func noUnsafeEnumComparisonSharesEnum(a, b *shimchecker.Type) bool {
+	aDecl := noUnsafeEnumComparisonEnumDeclaration(a)
+	bDecl := noUnsafeEnumComparisonEnumDeclaration(b)
+	if aDecl == nil || bDecl == nil {
+		return false
+	}
+	return aDecl == bDecl
+}
+
+// noUnsafeEnumComparisonEnumDeclaration returns the EnumDeclaration
+// node that t (or any constituent of a union) belongs to, or nil when
+// t is not an enum-flavored type. Both the enum union type and each
+// enum-literal member carry the enum's symbol via Type.Symbol; the
+// symbol's parent declaration is the EnumDeclaration we identify by.
+func noUnsafeEnumComparisonEnumDeclaration(t *shimchecker.Type) *shimast.Node {
+	if t == nil {
+		return nil
+	}
+	flags := t.Flags()
+	if flags&shimchecker.TypeFlagsEnumLike != 0 {
+		sym := t.Symbol()
+		if sym == nil {
+			return nil
+		}
+		for _, decl := range sym.Declarations {
+			if decl == nil {
+				continue
+			}
+			if decl.Kind == shimast.KindEnumDeclaration {
+				return decl
+			}
+			// Enum member literal types carry the member symbol; walk
+			// one level up to land on the surrounding EnumDeclaration.
+			if decl.Parent != nil && decl.Parent.Kind == shimast.KindEnumDeclaration {
+				return decl.Parent
+			}
+		}
+		return nil
+	}
+	if flags&(shimchecker.TypeFlagsUnion|shimchecker.TypeFlagsIntersection) != 0 {
+		var seen *shimast.Node
+		for _, part := range t.Types() {
+			decl := noUnsafeEnumComparisonEnumDeclaration(part)
+			if decl == nil {
+				continue
+			}
+			if seen == nil {
+				seen = decl
+				continue
+			}
+			if seen != decl {
+				return nil
+			}
+		}
+		return seen
+	}
+	return nil
+}
+
+// noUnsafeEnumComparisonIsBareLiteralLike reports whether t is a plain
+// primitive or primitive literal — the widened side of an enum
+// comparison. Unions are considered bare when every constituent is.
+// Pure `null` / `undefined` operands are exempt because they don't
+// share an enum's primitive widening — `color === null` is a real
+// nullability check, not a same-primitive mistake.
+func noUnsafeEnumComparisonIsBareLiteralLike(t *shimchecker.Type) bool {
+	if t == nil {
+		return false
+	}
+	flags := t.Flags()
+	if flags&shimchecker.TypeFlagsEnumLike != 0 {
+		return false
+	}
+	const primitiveMask = shimchecker.TypeFlagsStringLike |
+		shimchecker.TypeFlagsNumberLike |
+		shimchecker.TypeFlagsBigIntLike
+	if flags&primitiveMask != 0 {
+		return true
+	}
+	if flags&(shimchecker.TypeFlagsUnion|shimchecker.TypeFlagsIntersection) != 0 {
+		anyMatch := false
+		for _, part := range t.Types() {
+			if part == nil {
+				continue
+			}
+			if noUnsafeEnumComparisonHasEnum(part) {
+				return false
+			}
+			if noUnsafeEnumComparisonIsBareLiteralLike(part) {
+				anyMatch = true
+			}
+		}
+		return anyMatch
+	}
+	return false
+}
+
+func init() {
+	Register(noUnsafeEnumComparison{})
+}

package/linthost/rules_ts_no_unsafe_member_access.go

@@ -0,0 +1,58 @@
+// typescript/no-unsafe-member-access: reading a property off a value
+// whose static type is `any` silently yields another `any`, and the
+// next operation on that result is unchecked too. `x.foo.bar.baz` is
+// the cascade that lets a single `any` propagate through an entire
+// expression tree. typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-member-access/
+//
+// Type-aware. The rule visits dotted access (`x.foo`) and computed
+// access (`x[k]`) and reports when the receiver resolves to `any`. As
+// with the rest of the unsafe-* family `unknown` is intentionally NOT
+// flagged: it forces a narrowing assertion before the access, which is
+// the explicit ergonomic the upstream rule pushes toward.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+)
+
+type noUnsafeMemberAccess struct{}
+
+func (noUnsafeMemberAccess) Name() string { return "typescript/no-unsafe-member-access" }
+func (noUnsafeMemberAccess) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeMemberAccess) Visits() []shimast.Kind {
+	return []shimast.Kind{
+		shimast.KindPropertyAccessExpression,
+		shimast.KindElementAccessExpression,
+	}
+}
+func (noUnsafeMemberAccess) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	var receiver *shimast.Node
+	switch node.Kind {
+	case shimast.KindPropertyAccessExpression:
+		if access := node.AsPropertyAccessExpression(); access != nil {
+			receiver = access.Expression
+		}
+	case shimast.KindElementAccessExpression:
+		if access := node.AsElementAccessExpression(); access != nil {
+			receiver = access.Expression
+		}
+	}
+	if receiver == nil {
+		return
+	}
+	t := ctx.Checker.GetTypeAtLocation(receiver)
+	if !typeIsUnsafeAny(t) {
+		return
+	}
+	ctx.Report(node, "Unsafe member access on a value typed as `any`. Narrow the receiver to a concrete type before reading a property.")
+}
+
+func init() {
+	Register(noUnsafeMemberAccess{})
+}

package/linthost/rules_ts_no_unsafe_return.go

@@ -0,0 +1,126 @@
+// typescript/no-unsafe-return: a `return X;` whose expression carries
+// the `any` type from a function whose declared return shape is
+// concrete leaks `any` past the type boundary. Callers see the declared
+// shape, lose every downstream type check on the value, and the bug
+// that introduced the `any` migrates to whichever site reads the result.
+// typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-return/
+//
+// Type-aware. Without a Checker we cannot tell `any` apart from a
+// concrete shape, so Context.Checker == nil short-circuits the visit
+// the same way `no-floating-promises` and `restrict-plus-operands` do.
+//
+// The rule walks each `return` to its enclosing function-like
+// declaration, asks the Checker for that function's signature, and
+// compares the declared return type against the expression type:
+//
+//   - the expression must be `any`-typed (raw `any`, not `unknown`);
+//   - the declared return type must be concrete — `any`, `unknown`, and
+//     `void` are deliberately exempt because they advertise the same
+//     looseness at the boundary and a strict rejection would explode
+//     on every generic helper that propagates `unknown`.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+	shimchecker "github.com/microsoft/typescript-go/shim/checker"
+)
+
+type noUnsafeReturn struct{}
+
+func (noUnsafeReturn) Name() string { return "typescript/no-unsafe-return" }
+func (noUnsafeReturn) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeReturn) Visits() []shimast.Kind {
+	return []shimast.Kind{shimast.KindReturnStatement}
+}
+func (noUnsafeReturn) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	ret := node.AsReturnStatement()
+	if ret == nil || ret.Expression == nil {
+		return
+	}
+	fn := noUnsafeReturnEnclosingFunction(node)
+	if fn == nil {
+		return
+	}
+	sig := ctx.Checker.GetSignatureFromDeclaration(fn)
+	if sig == nil {
+		return
+	}
+	declared := ctx.Checker.GetReturnTypeOfSignature(sig)
+	if declared == nil {
+		return
+	}
+	if !noUnsafeReturnIsConcrete(declared) {
+		return
+	}
+	exprType := ctx.Checker.GetTypeAtLocation(ret.Expression)
+	if exprType == nil {
+		return
+	}
+	if !noUnsafeReturnIsAny(exprType) {
+		return
+	}
+	ctx.Report(ret.Expression, "Unsafe return of `any` value from function with a concrete declared return type. The `any` leaks past the type boundary and disables downstream type checks.")
+}
+
+// noUnsafeReturnEnclosingFunction walks up the parent chain to the
+// nearest function-like declaration that owns this `return`. Nested
+// functions establish their own return scope, so the walk stops at the
+// first function-like ancestor — mirroring the `consistent-return`
+// scope rule already established in this package.
+func noUnsafeReturnEnclosingFunction(node *shimast.Node) *shimast.Node {
+	for cur := node.Parent; cur != nil; cur = cur.Parent {
+		if isFunctionLikeKind(cur) {
+			return cur
+		}
+	}
+	return nil
+}
+
+// noUnsafeReturnIsConcrete reports whether the declared return type is
+// strict enough to be worth protecting. `any`, `unknown`, and `void`
+// are the three shapes that explicitly advertise looseness — the
+// upstream rule exempts them so generic helpers that propagate
+// `unknown` and side-effect functions that return `void` do not light
+// up everywhere. Unions are concrete only when every constituent is.
+func noUnsafeReturnIsConcrete(t *shimchecker.Type) bool {
+	if t == nil {
+		return false
+	}
+	flags := t.Flags()
+	if flags&(shimchecker.TypeFlagsAny|shimchecker.TypeFlagsUnknown|shimchecker.TypeFlagsVoid) != 0 {
+		return false
+	}
+	if flags&(shimchecker.TypeFlagsUnion|shimchecker.TypeFlagsIntersection) != 0 {
+		for _, part := range t.Types() {
+			if part == nil {
+				continue
+			}
+			if !noUnsafeReturnIsConcrete(part) {
+				return false
+			}
+		}
+		return true
+	}
+	return true
+}
+
+// noUnsafeReturnIsAny reports whether t is the raw `any` type. The
+// upstream rule treats `unknown` as a safe escape hatch — values
+// returned as `unknown` cannot be used without further narrowing, so
+// they don't leak silently — and only flags the lossy `any` case.
+func noUnsafeReturnIsAny(t *shimchecker.Type) bool {
+	if t == nil {
+		return false
+	}
+	return t.Flags()&shimchecker.TypeFlagsAny != 0
+}
+
+func init() {
+	Register(noUnsafeReturn{})
+}

package/linthost/rules_ts_no_unsafe_unary_minus.go

@@ -0,0 +1,81 @@
+// typescript/no-unsafe-unary-minus: the unary `-` operator coerces its
+// operand via `Number()` at runtime, so strings, booleans, and plain
+// objects silently produce `NaN`, `0`, `-1`, or `-NaN` instead of a
+// negated number. The rule restricts the operator to operands whose
+// static type is number-like or bigint-like — the two shapes where the
+// negation is a real arithmetic operation rather than a hidden
+// coercion. typescript-eslint:
+// https://typescript-eslint.io/rules/no-unsafe-unary-minus/
+//
+// Type-aware. Without a Checker the rule cannot tell `-x` on a number
+// apart from `-x` on a string, so Context.Checker == nil short-circuits
+// the visit the same way every other type-aware rule in this package
+// does. `any` / `unknown` / `never` pass through to match the upstream
+// `allowAny`-style defaults that keep generic helpers quiet.
+package linthost
+
+import (
+	shimast "github.com/microsoft/typescript-go/shim/ast"
+	shimchecker "github.com/microsoft/typescript-go/shim/checker"
+)
+
+type noUnsafeUnaryMinus struct{}
+
+func (noUnsafeUnaryMinus) Name() string { return "typescript/no-unsafe-unary-minus" }
+func (noUnsafeUnaryMinus) NeedsTypeChecker() bool {
+	return true
+}
+func (noUnsafeUnaryMinus) Visits() []shimast.Kind {
+	return []shimast.Kind{shimast.KindPrefixUnaryExpression}
+}
+func (noUnsafeUnaryMinus) Check(ctx *Context, node *shimast.Node) {
+	if ctx.Checker == nil {
+		return
+	}
+	expr := node.AsPrefixUnaryExpression()
+	if expr == nil || expr.Operator != shimast.KindMinusToken || expr.Operand == nil {
+		return
+	}
+	t := ctx.Checker.GetTypeAtLocation(expr.Operand)
+	if t == nil {
+		return
+	}
+	if noUnsafeUnaryMinusIsNumeric(t) {
+		return
+	}
+	ctx.Report(node, "Unary `-` requires a number-like or bigint-like operand. Other shapes are silently coerced via `Number(x)` and almost always indicate a bug.")
+}
+
+// noUnsafeUnaryMinusIsNumeric reports whether t is provably number-like
+// or bigint-like. `any` / `unknown` / `never` are treated as numeric to
+// keep the rule silent on generic helpers and untyped boundaries —
+// matching the upstream `allowAny` posture. Unions and intersections
+// must have every constituent numeric for the whole type to count.
+func noUnsafeUnaryMinusIsNumeric(t *shimchecker.Type) bool {
+	if t == nil {
+		return true
+	}
+	flags := t.Flags()
+	if flags&(shimchecker.TypeFlagsAny|shimchecker.TypeFlagsUnknown|shimchecker.TypeFlagsNever) != 0 {
+		return true
+	}
+	if flags&(shimchecker.TypeFlagsNumberLike|shimchecker.TypeFlagsBigIntLike) != 0 {
+		return true
+	}
+	if flags&(shimchecker.TypeFlagsUnion|shimchecker.TypeFlagsIntersection) != 0 {
+		for _, part := range t.Types() {
+			if part == nil {
+				continue
+			}
+			if !noUnsafeUnaryMinusIsNumeric(part) {
+				return false
+			}
+		}
+		return true
+	}
+	return false
+}
+
+func init() {
+	Register(noUnsafeUnaryMinus{})
+}