eslint-config-agent 3.0.4 → 3.1.0

package/package.json

@@ -1,21 +1,46 @@
 {
   "name": "eslint-config-agent",
-  "version": "3.0.4",
+  "version": "3.1.0",
   "description": "ESLint configuration package with TypeScript support",
   "main": "index.js",
+  "types": "./index.d.ts",
   "type": "module",
   "exports": {
-    ".": "./index.js",
-    "./ddd": "./exports/ddd.js"
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    },
+    "./ddd": {
+      "types": "./exports/ddd.d.ts",
+      "default": "./exports/ddd.js"
+    },
+    "./recommended": {
+      "types": "./exports/recommended.d.ts",
+      "default": "./exports/recommended.js"
+    },
+    "./recommended-incremental": {
+      "types": "./exports/recommended-incremental.d.ts",
+      "default": "./exports/recommended-incremental.js"
+    },
+    "./incremental": {
+      "types": "./exports/incremental.d.ts",
+      "default": "./exports/incremental.js"
+    },
+    "./to-warnings": {
+      "types": "./exports/to-warnings.d.ts",
+      "default": "./exports/to-warnings.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "index.js",
+    "index.d.ts",
     "README.md",
     "CHANGELOG.md",
     "configs/",
     "plugins/",
     "exports/",
-    "rules/**/index.js",
+    "rules/**/*.js",
     "!rules/**/examples/",
     "!rules/**/*.spec.js",
     "!rules/**/*.test.js"
@@ -23,6 +48,14 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "peerDependencies": {
+    "typescript": ">=4.8.4"
+  },
+  "peerDependenciesMeta": {
+    "typescript": {
+      "optional": true
+    }
+  },
   "scripts": {
     "lint": "eslint .",
     "lint:test": "eslint test/",
@@ -32,6 +65,12 @@
     "test:invalid": "eslint test/invalid.tsx test/long-function.tsx test/jsx-extension-test.js",
     "test:hooks": "eslint test/react-hooks-rules.tsx",
     "test:imports": "eslint test/import-export-rules.ts",
+    "test:recommended": "node scripts/test-recommended.js",
+    "test:recommended-incremental": "node scripts/test-recommended-incremental.js",
+    "test:exports": "node scripts/test-exports.js",
+    "test:pack": "node scripts/verify-pack.js",
+    "test:incremental": "node scripts/test-incremental.js",
+    "test:types": "tsc -p test/types/tsconfig.json",
     "test:edge": "eslint test/edge-cases.tsx",
     "test:performance": "eslint test/performance-test.tsx",
     "test:comprehensive": "node scripts/test-runner.js",
@@ -80,28 +119,16 @@
   "devDependencies": {
     "@commitlint/cli": "^20.5.3",
     "@commitlint/config-conventional": "^20.5.3",
-    "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.37.0",
     "@release-it/conventional-changelog": "^11.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.46.1",
-    "@typescript-eslint/parser": "^8.46.1",
     "@typescript-eslint/rule-tester": "^8.60.1",
     "cspell": "^9.8.0",
-    "eslint": "^9.37.0",
-    "eslint-plugin-class-export": "^1.0.1",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-n": "^17.23.1",
-    "eslint-plugin-preact": "^0.1.0",
-    "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "eslint-plugin-security": "^3.0.1",
     "husky": "^9.1.7",
     "knip": "^6.15.0",
     "lint-staged": "^16.4.0",
     "prettier": "^3.8.3",
     "release-it": "^20.2.0",
     "storybook": "^10.4.2",
-    "typescript-eslint": "^8.46.1"
+    "typescript": "^6.0.3"
   },
   "dependencies": {
     "@eslint/eslintrc": "^3.3.5",
@@ -127,6 +154,8 @@
     "eslint-plugin-single-export": "^1.1.2",
     "eslint-plugin-storybook": "^10.4.2",
     "eslint-plugin-switch-case": "^4.0.0",
+    "eslint-plugin-unicorn": "^65.0.1",
+    "eslint-plugin-unused-imports": "^4.4.1",
     "globals": "^17.6.0",
     "typescript-eslint": "^8.60.1"
   }

package/plugins/index.js

@@ -18,7 +18,10 @@ import errorPlugin from 'eslint-plugin-error'
 import defaultPlugin from 'eslint-plugin-default'
 import dddPlugin from 'eslint-plugin-ddd'
 import preactPlugin from 'eslint-plugin-preact'
+import unusedImportsPlugin from 'eslint-plugin-unused-imports'
+import unicornPlugin from 'eslint-plugin-unicorn'
 import { noDefaultClassExportRule } from '../rules/no-default-class-export/index.js'
+import { requireSpecFileTsxRule } from '../rules/require-spec-file-tsx/index.js'
 
 // Centralized plugin configuration
 export const plugins = {
@@ -35,9 +38,12 @@ export const plugins = {
   default: defaultPlugin,
   ddd: dddPlugin,
   preact: preactPlugin,
+  'unused-imports': unusedImportsPlugin,
+  unicorn: unicornPlugin,
   custom: {
     rules: {
       'no-default-class-export': noDefaultClassExportRule,
+      'require-spec-file-tsx': requireSpecFileTsxRule,
     },
   },
 }

package/rules/index.js

@@ -6,7 +6,7 @@
  */
 
 // Core rule configurations
-import noTrailingSpacesConfig from './no-trailing-spaces/index.js'
+import { noTrailingSpacesConfig } from './no-trailing-spaces/index.js'
 import {
   maxFunctionLinesWarning,
   maxFunctionLinesError,
@@ -17,7 +17,7 @@ import {
 } from './max-file-lines/index.js'
 
 // Custom restricted syntax rules
-import { noProcessEnvPropertiesConfig } from './no-process-env-properties/index.js'
+import { noProcessEnvironmentPropertiesConfig } from './no-process-env-properties/index.js'
 import { noTypeAssertionsConfig } from './no-type-assertions/index.js'
 import { noExportSpecifiersConfig } from './no-empty-exports/index.js'
 import { noDefaultClassExportRules } from './no-default-class-export/index.js'
@@ -42,7 +42,7 @@ const allRules = {
   maxFileLinesError,
 
   // Custom restricted syntax rules
-  noProcessEnvPropertiesConfig,
+  noProcessEnvironmentPropertiesConfig,
   noTypeAssertionsConfig,
   noExportSpecifiersConfig,
   noDefaultClassExportRules,
@@ -61,27 +61,25 @@ const allRules = {
 export default allRules
 
 // Named exports for backward compatibility
+
+export { noTrailingSpacesConfig } from './no-trailing-spaces/index.js'
 export {
-  // Core rule configurations
-  noTrailingSpacesConfig,
   maxFunctionLinesWarning,
   maxFunctionLinesError,
+} from './max-function-lines/index.js'
+export {
   maxFileLinesWarning,
   maxFileLinesError,
-
-  // Custom restricted syntax rules
-  noProcessEnvPropertiesConfig,
-  noTypeAssertionsConfig,
-  noExportSpecifiersConfig,
-  noDefaultClassExportRules,
-  noNullishCoalescingConfig,
-  switchStatementsReturnTypeConfigs,
-  switchCaseFunctionsReturnTypeConfigs,
-  switchCaseExplicitReturnConfigs,
-  noTrivialTypeAliasesConfigs,
-  noInlineUnionTypesConfigs,
-
-  // Plugin rule configurations
-  pluginRules,
-  typescriptEslintRules,
-}
+} from './max-file-lines/index.js'
+export { noProcessEnvironmentPropertiesConfig } from './no-process-env-properties/index.js'
+export { noTypeAssertionsConfig } from './no-type-assertions/index.js'
+export { noExportSpecifiersConfig } from './no-empty-exports/index.js'
+export { noDefaultClassExportRules } from './no-default-class-export/index.js'
+export { noNullishCoalescingConfig } from './nullish-coalescing/index.js'
+export { switchStatementsReturnTypeConfigs } from './switch-statements-return-type/index.js'
+export { switchCaseFunctionsReturnTypeConfigs } from './switch-case-functions-return-type/index.js'
+export { switchCaseExplicitReturnConfigs } from './switch-case-explicit-return/index.js'
+export { noTrivialTypeAliasesConfigs } from './no-trivial-type-aliases/index.js'
+export { noInlineUnionTypesConfigs } from './no-inline-union-types/index.js'
+export { pluginRules } from './plugin/index.js'
+export { typescriptEslintRules } from './plugin/typescript-eslint/index.js'

package/rules/no-inline-union-types/index.js

@@ -7,7 +7,9 @@
  * Examples:
  * - ❌ function foo(status: 'active' | 'inactive') {}
  * - ❌ interface User { role: 'admin' | 'user'; }
+ * - ❌ interface User { id: string | number; }
  * - ❌ class Config { mode: 'dev' | 'prod'; }
+ * - ❌ class Config { value: string | number; }
  * - ✅ type Status = 'active' | 'inactive'; function foo(status: Status) {}
  * - ✅ type Role = 'admin' | 'user'; interface User { role: Role; }
  * - ✅ type Mode = 'dev' | 'prod'; class Config { mode: Mode; }
@@ -20,20 +22,20 @@ const rule = 'error'
 const selectorGeneral =
   'TSTypeAnnotation > TSUnionType:not(PropertyDefinition > .typeAnnotation > .typeAnnotation):not(TSPropertySignature > .typeAnnotation > .typeAnnotation)'
 
-// Interface properties with literal unions
+// Interface properties with inline unions (literal or otherwise)
 const selectorInterfaceProperty =
-  'TSPropertySignature > TSTypeAnnotation > TSUnionType:has(TSLiteralType)'
+  'TSPropertySignature > TSTypeAnnotation > TSUnionType'
 
-// Class properties with literal unions
+// Class properties with inline unions (literal or otherwise)
 const selectorClassProperty =
-  'PropertyDefinition > TSTypeAnnotation > TSUnionType:has(TSLiteralType)'
+  'PropertyDefinition > TSTypeAnnotation > TSUnionType'
 
 const messageGeneral =
   'Use a named type declaration instead of inline union types.'
 const messageProperty =
-  'Interface properties with literal unions should use a named type declaration.'
+  'Interface properties with inline unions should use a named type declaration.'
 const messageClassProperty =
-  'Class properties with literal unions should use a named type declaration.'
+  'Class properties with inline unions should use a named type declaration.'
 
 /**
  * Export the complete rule configurations for no-restricted-syntax

package/rules/no-process-env-properties/index.js

@@ -23,14 +23,14 @@ const message =
 /**
  * Export the complete rule configuration for no-restricted-syntax
  * Can be used in ESLint config as part of no-restricted-syntax rules:
- * "no-restricted-syntax": ["error", ...otherRules, noProcessEnvPropertiesConfig]
+ * "no-restricted-syntax": ["error", ...otherRules, noProcessEnvironmentPropertiesConfig]
  */
-const noProcessEnvPropertiesConfig = {
+const noProcessEnvironmentPropertiesConfig = {
   selector,
   message,
 }
 
 // Consolidated exports
-export { rule, selector, message, noProcessEnvPropertiesConfig }
+export { rule, selector, message, noProcessEnvironmentPropertiesConfig }
 
-export default noProcessEnvPropertiesConfig
+export default noProcessEnvironmentPropertiesConfig

package/rules/no-record-literal-types/index.js

@@ -23,7 +23,7 @@
 const rule = 'error'
 
 // First selector: matches TSLiteralType descendants of first param (catches literals inside unions)
-const selectorNestedParams =
+const selectorNestedParameters =
   'TSTypeReference[typeName.name="Record"] > TSTypeParameterInstantiation > .params:first-child TSLiteralType'
 
 // Second selector: matches direct TSLiteralType as first param
@@ -38,7 +38,7 @@ const message =
  * Can be used in ESLint config as part of no-restricted-syntax rules
  */
 const noRecordLiteralTypesNestedConfig = {
-  selector: selectorNestedParams,
+  selector: selectorNestedParameters,
   message,
 }
 
@@ -58,7 +58,7 @@ const noRecordLiteralTypesConfigs = [
 // Consolidated exports
 export {
   rule,
-  selectorNestedParams,
+  selectorNestedParameters,
   selectorFirstChild,
   message,
   noRecordLiteralTypesNestedConfig,

package/rules/plugin/import/index.js

@@ -21,4 +21,45 @@ export const importRules = {
   'import/newline-after-import': 'off',
   'import/first': 'error',
   'import/prefer-default-export': 'off',
+  // Import hygiene: collapse duplicate import statements from the same module
+  // and forbid exporting mutable bindings (export let/var), which create
+  // shared mutable state across modules and are a common AI-generated footgun.
+  'import/no-duplicates': 'error',
+  'import/no-mutable-exports': 'error',
+  // Forbid circular import dependencies (A imports B imports A). Cycles cause
+  // order-dependent runtime bugs where a module reads a not-yet-initialized
+  // binding from its partner and silently sees `undefined`, defeat tree
+  // shaking, and are a reliable signal of tangled, hard-to-follow module
+  // boundaries. They are also a frequent AI-generated footgun, since an
+  // assistant editing one file cannot see the import graph it closes. Detect
+  // them statically. `maxDepth: Infinity` follows the full import graph so deep
+  // cycles are caught too; `ignoreExternal` skips traversal into node_modules
+  // for performance, since cycles inside dependencies are not the consumer's
+  // to fix.
+  'import/no-cycle': ['error', { maxDepth: Infinity, ignoreExternal: true }],
+  // A module importing itself is always a mistake (usually a copy-paste or a
+  // bad auto-import) and produces a degenerate cycle; flag it explicitly.
+  'import/no-self-import': 'error',
+  // Forbid empty named import blocks (`import {} from 'mod'`). An empty block
+  // is the residue of deleting the last named binding from an import: the
+  // statement now pulls in nothing yet still reads as if it imports names,
+  // which misleads readers and quietly keeps a dead dependency edge alive. A
+  // bare side-effect import (`import 'mod'`) — or removing the line — states
+  // the real intent. This is a frequent leftover from AI-assisted edits that
+  // rewrite an import list one binding at a time, putting it squarely in scope
+  // for this config's explicit-over-clever stance. The rule is auto-fixable.
+  'import/no-empty-named-blocks': 'error',
+  // Forbid redundant segments in relative import paths, e.g. `./foo/../bar`
+  // (really `./bar`), `./../sibling` (really `../sibling`) or `./././mod`
+  // (really `./mod`). These resolve to the same module but read as if they
+  // point somewhere else, forcing a reviewer to mentally collapse the path to
+  // know what is actually imported, and they hide accidental directory
+  // traversals introduced by a bad auto-import or a copy-paste from another
+  // folder — a frequent AI-assisted-edit footgun and squarely the
+  // explicit-over-clever ground this config covers. The rule is auto-fixable,
+  // so adopting projects get a one-shot `--fix`. `commonjs: true` extends the
+  // check to `require()` calls; `noUselessIndex` is left at its default (off)
+  // so explicit `/index` references stay allowed and only genuinely redundant
+  // `../`/`./` segments are flagged.
+  'import/no-useless-path-segments': ['error', { commonjs: true }],
 }

package/rules/plugin/index.js

@@ -1,6 +1,5 @@
 import { securityRules } from './security/index.js'
 import { importRules } from './import/index.js'
-import { jsxA11yRules } from './jsx-a11y/index.js'
 import { reactRules } from './react/index.js'
 import { nRules } from './n/index.js'
 import { classExportRules } from './class-export/index.js'
@@ -8,7 +7,6 @@ import { classExportRules } from './class-export/index.js'
 export const pluginRules = {
   ...securityRules,
   ...importRules,
-  ...jsxA11yRules,
   ...reactRules,
   ...nRules,
   ...classExportRules,

package/rules/plugin/n/index.js

@@ -1,5 +1,19 @@
-import { noProcessEnvConfig } from './no-process-env/index.js'
+import { noProcessEnvironmentConfig } from './no-process-env/index.js'
 
 export const nRules = {
-  'n/no-process-env': noProcessEnvConfig,
+  'n/no-process-env': noProcessEnvironmentConfig,
+  // Require the `node:` protocol prefix on every import of a Node.js built-in
+  // module (e.g. `import fs from 'node:fs'` instead of `import fs from 'fs'`).
+  // The bare form (`'fs'`, `'path'`, `'crypto'`) is ambiguous: without the
+  // protocol, a reader (and a bundler) must consult package.json to confirm
+  // that the name is not a userland npm package shadowing the built-in. The
+  // `node:` prefix is unambiguous at a glance, is supported since Node 14.18.0
+  // (the minimum already required by this package's `engines` field), and is
+  // the form the package itself uses in all its own scripts and custom rules
+  // (e.g. `import { existsSync } from 'node:fs'`). Shipping the rule in the
+  // shared set means consuming projects inherit the same convention
+  // automatically. The rule is auto-fixable (`eslint --fix`), so adoption is
+  // free. It fires only when a built-in module is actually imported — browser
+  // and React code that imports nothing from Node.js is unaffected.
+  'n/prefer-node-protocol': 'error',
 }

package/rules/plugin/n/no-process-env/index.js

@@ -13,11 +13,11 @@ const options = {}
 /**
  * Export the complete rule configuration
  * Can be used in ESLint config as:
- * "n/no-process-env": noProcessEnvConfig
+ * "n/no-process-env": noProcessEnvironmentConfig
  */
-const noProcessEnvConfig = [rule, options]
+const noProcessEnvironmentConfig = [rule, options]
 
 // Consolidated exports
-export { rule, options, noProcessEnvConfig }
+export { rule, options, noProcessEnvironmentConfig }
 
-export default noProcessEnvConfig
+export default noProcessEnvironmentConfig

package/rules/plugin/react/index.js

@@ -1,5 +1,19 @@
 export const reactRules = {
-  'react/self-closing-comp': 'off',
+  // Require self-closing tags for JSX components and HTML elements that have
+  // no children. `<Button></Button>` and `<div></div>` become `<Button />` and
+  // `<div />` respectively. An explicit open/close tag pair is meaningful only
+  // when it contains children; without children it is pure noise — it adds an
+  // extra close tag the reader has to scan past to confirm nothing is inside,
+  // and it is exactly the verbose form AI assistants emit when scaffolding
+  // components from a template. The single-tag form states "this element has
+  // no children" directly, which is the explicit, low-noise style this config
+  // favors throughout. The rule is auto-fixable, so `eslint --fix` collapses
+  // every violating element in one pass. `component: true` covers React
+  // components (`<MyComp></MyComp>`) and `html: true` covers intrinsic
+  // elements (`<div></div>`, `<span></span>`), so both surfaces stay
+  // consistent. `oss-il` already enforces this manually on top of the base
+  // config; promoting it here removes that copy-paste.
+  'react/self-closing-comp': ['error', { component: true, html: true }],
   'react/destructuring-assignment': 'off',
   'react/jsx-props-no-spreading': 'off',
   'react/button-has-type': 'off',
@@ -12,5 +26,139 @@ export const reactRules = {
   'react/require-default-props': 'off',
   'react/jsx-wrap-multilines': 'off',
   'react/jsx-closing-bracket-location': 'off',
-  'react/jsx-no-useless-fragment': 'off',
+  // Forbid fragments that wrap a single child: `<><MyComponent /></>` adds DOM
+  // overhead and a return-type mismatch (`React.ReactElement` vs `JSX.Element`)
+  // without buying anything. It is exactly the kind of dead-weight an AI
+  // assistant emits when scaffolding a component. `allowExpressions: false`
+  // also covers `<>{value}</>` — if you need a fragment solely for a JSX
+  // expression, wrap it in a parent instead. The rule is auto-fixable, so
+  // `eslint --fix` rewrites `<><X /></>` to `<X />` with zero manual work.
+  // oss-il already enables this by hand on top of the base config; promoting
+  // it here removes the per-repo copy-paste.
+  'react/jsx-no-useless-fragment': ['error', { allowExpressions: false }],
+  // Guard against React's "leaked render" bug: a short-circuit like
+  // `{count && <List />}` renders the literal `0` (or `NaN`) when the left
+  // operand is a falsy *non-boolean*, and `{name && <h1>{name}</h1>}` renders
+  // an empty string the same way. React only skips rendering for `false`,
+  // `null` and `undefined`, so any other falsy value leaks straight into the
+  // DOM as visible text. That is a real rendering bug the type checker cannot
+  // catch (the JSX is perfectly typed) and exactly the shortcut AI assistants
+  // emit when conditionally rendering a list or label. Unlike the stylistic
+  // react rules turned off above, this is a correctness check, so it is turned
+  // on. `validStrategies: ['ternary', 'coerce']` forces the unambiguous form —
+  // an explicit `cond ? <X /> : null` or a boolean coercion `!!cond && <X />`
+  // — instead of the bare `&&` that leaks. The rule is auto-fixable, so
+  // consumers can adopt it with `eslint --fix`.
+  'react/jsx-no-leaked-render': [
+    'error',
+    { validStrategies: ['ternary', 'coerce'] },
+  ],
+  // Forbid using an array index as a React `key` (`items.map((item, i) => <Row
+  // key={i} />)`). A key is React's identity for a list child across renders;
+  // when it is the position rather than something stable about the item, React
+  // maps the wrong previous element onto the wrong new one as soon as the list
+  // is reordered, filtered, or has an item inserted/removed at the front or
+  // middle. The visible result is a class of silent UI bugs that no type check
+  // can catch: text typed into one input jumps to another row, the wrong item
+  // animates, a checkbox's checked state sticks to the wrong record, and
+  // uncontrolled component state generally "smears" across siblings. The fix is
+  // to key by a stable, item-specific value (an id, a slug, a content hash),
+  // which states the intended identity explicitly. `key={index}` is exactly the
+  // shortcut an AI assistant reaches for when the item has no obvious id, so it
+  // is squarely in this config's bug-prevention, explicit-over-clever stance —
+  // the same correctness-not-style bar that turns on `jsx-no-leaked-render`
+  // above while leaving the cosmetic react rules off. Like the other react
+  // rules it only applies to `.jsx`/`.tsx` files, so non-React TypeScript
+  // packages are unaffected. This is why a downstream repo (`oss-il`) already
+  // re-adds it by hand on top of the base config.
+  'react/no-array-index-key': 'error',
+  // Forbid the `dangerouslySetInnerHTML` prop. Setting inner HTML directly from
+  // a string bypasses React's XSS defenses: any server-sourced or user-supplied
+  // content rendered this way can execute arbitrary scripts in the browser.
+  // `dangerouslySetInnerHTML` is intentionally verbose — its name is a warning —
+  // but AI assistants still reach for it when they need to inject a server HTML
+  // fragment or render a rich-text field, without thinking through whether the
+  // content is safe. The only legitimate uses (known-safe static markup, a
+  // sanitized string from a DOMPurify-style pass) should be reviewed explicitly;
+  // the rule forces that review by making every usage a lint error, which the
+  // engineer must suppress with an `eslint-disable` comment that makes the
+  // intentional decision visible in code review. The rule is not auto-fixable,
+  // so each suppression is a deliberate act.
+  'react/no-danger': 'error',
+  // Enforce the `[value, setValue]` naming convention for `useState` pairs.
+  // When `useState` is destructured with a setter that does not match
+  // `set<Capitalize(stateName)>` — e.g. `const [data, handleUpdate] = useState()`
+  // instead of `const [data, setData] = useState()` — the mismatch signals a
+  // naming mistake that often means the wrong setter was wired up: the right
+  // value is read but a misnamed variable is written on update, a class of
+  // silent state-management bug that type-checking cannot catch (both names are
+  // just `Dispatch<SetStateAction<T>>`). AI assistants introduce exactly this
+  // slip when stitching a component from multiple snippets — emitting
+  // `const [user, setCurrentUser] = useState()` or
+  // `const [loading, handleLoadingChange] = useState(false)`, each of which
+  // compiles fine but breaks the per-component naming contract that makes state
+  // variables identifiable at a glance. The rule is not auto-fixable because
+  // only the author knows whether the state name or the setter name is the
+  // intended canonical one. It fires only on `.tsx`/`.jsx` files, so pure
+  // TypeScript packages are unaffected.
+  'react/hook-use-state': 'error',
+  // Forbid a freshly-constructed value as the `value` of a Context Provider:
+  // `<Ctx.Provider value={{ user, setUser }}>` or `value={[state, dispatch]}`
+  // or `value={() => ...}`. The object/array/function literal is rebuilt on
+  // every render of the providing component, so its identity changes every time
+  // even when the data inside is unchanged. React compares context values by
+  // reference, so a new reference forces *every* consumer of that context to
+  // re-render — including ones that `React.memo`/`useMemo` were added precisely
+  // to protect. The result is a silent, whole-subtree performance bug: the app
+  // is correct but does far more work than it should, and the cause (an inline
+  // literal three components up) is invisible at the consumer. The fix states
+  // the intent explicitly — hoist the value into a `useMemo`/`useCallback` (or a
+  // stable ref) so the reference only changes when the data does. An inline
+  // `value={{ ... }}` is exactly the shortcut an AI assistant emits when wiring
+  // up a provider, so it sits on the same correctness/perf-not-style bar that
+  // turns on `jsx-no-leaked-render` and `no-array-index-key` above while leaving
+  // the cosmetic react rules off. Like the other react rules it only applies to
+  // `.jsx`/`.tsx` files, so non-React TypeScript packages are unaffected. This
+  // is why a downstream repo (`oss-il`) already re-adds it by hand on top of the
+  // base config.
+  'react/jsx-no-constructed-context-values': 'error',
+  // Forbid using an object type (`{}`, `[]`, or a function literal) as the
+  // default value for a prop in function-component destructuring:
+  //
+  //   function List({ items = [], onSelect = () => {} }) { ... }
+  //
+  // Each call to the component creates a fresh object/array/function literal
+  // for the default, so the reference changes on every render even when the
+  // prop is not actually provided. Any child that is `React.memo`-ed on that
+  // prop, or any `useEffect`/`useCallback`/`useMemo` that lists it as a
+  // dependency, will re-run unnecessarily — a silent performance bug the type
+  // checker cannot detect. The fix is to hoist the constant outside the
+  // component or memoize it:
+  //
+  //   const DEFAULT_ITEMS: string[] = []
+  //   function List({ items = DEFAULT_ITEMS }) { ... }
+  //
+  // This is exactly the shortcut an AI assistant reaches for when a prop is
+  // optional and the model doesn't want to add a module-level constant. The
+  // rule sits on the same correctness/perf-not-style bar as `jsx-no-leaked-
+  // render`, `no-array-index-key`, and `jsx-no-constructed-context-values`
+  // above — all of which catch silent reference-equality bugs that are
+  // invisible to the type checker. Like the other react rules this only fires
+  // on `.jsx`/`.tsx` files, so non-React TypeScript packages are unaffected.
+  'react/no-object-type-as-default-prop': 'error',
+  // Require a `key` prop on every element created inside an array/iterator
+  // (`.map()`, a spread of JSX literals, etc.). `key` is React's per-child
+  // identity across renders; without it React falls back to matching children
+  // by position, so as soon as the list is reordered, filtered, or gains/loses
+  // an item, state and DOM nodes "smear" onto the wrong element — text typed
+  // into one row's input jumps to another, the wrong checkbox stays checked,
+  // an animation plays on the wrong item. The JSX is perfectly typed either
+  // way, so this is a real rendering bug invisible to the type checker, and
+  // exactly the shortcut an AI assistant reaches for when it renders a list
+  // without pausing to think about identity. It sits on the same
+  // correctness-not-style bar as `no-array-index-key`, `jsx-no-leaked-render`,
+  // and `jsx-no-constructed-context-values` above. Like the other react rules
+  // it only applies to `.jsx`/`.tsx` files, so non-React TypeScript packages
+  // are unaffected.
+  'react/jsx-key': 'error',
 }