eslint-config-typed 5.6.2 → 5.7.0

package/dist/plugins/ts-restrictions/rules/no-string-spread.d.mts

@@ -0,0 +1,32 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type Options = readonly [];
+type MessageIds = 'noStringSpread';
+/**
+ * Disallow spreading a `string` value with the spread operator `...`.
+ *
+ * ## Why
+ *
+ * Spreading a string iterates it into its individual characters, so
+ * `[...someString]` (or `f(...someString)`) evaluates to a `string[]` — the
+ * *exact same result type* as spreading an actual `string[]`. That makes an
+ * accidental string spread silent: neither the reader nor the type checker can
+ * tell `[...anArray]` from `[...aString]` by the result type alone, so a bug
+ * where an array was expected but a `string` slipped in goes unnoticed.
+ *
+ * ## Why not simply "allow array / object types only"
+ *
+ * The naive framing — "only permit `...` on arrays or objects" — would also
+ * reject perfectly idiomatic spreads of other iterables (`Set`, `Map`,
+ * `Map.prototype.keys()`, generators, `NodeList`, typed arrays, `arguments`,
+ * …), which have no equivalent silent hazard. And TypeScript *already* rejects
+ * spreading a non-iterable primitive such as `number` / `boolean` in an
+ * iterable position. The only case TypeScript accepts yet is genuinely
+ * error-prone is `string`, so that is exactly what this rule targets.
+ *
+ * If a character split is really intended, spell it out with
+ * `Array.from(str)` (identical to the spread, code-point aware) or
+ * `str.split('')`.
+ */
+export declare const noStringSpread: TSESLint.RuleModule<MessageIds, Options>;
+export {};
+//# sourceMappingURL=no-string-spread.d.mts.map

package/dist/plugins/ts-restrictions/rules/no-string-spread.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-string-spread.d.mts","sourceRoot":"","sources":["../../../../src/plugins/ts-restrictions/rules/no-string-spread.mts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGtE,KAAK,OAAO,GAAG,SAAS,EAAE,CAAC;AAE3B,KAAK,UAAU,GAAG,gBAAgB,CAAC;AAanC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAyE1D,CAAC"}

package/dist/plugins/ts-restrictions/rules/no-string-spread.mjs

@@ -0,0 +1,102 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+import * as ts from 'typescript';
+
+/**
+ * Deferred (non-concrete) type flags whose actual members are only known once
+ * the type is instantiated. They are reduced to their base constraint before
+ * checking whether they are string-like.
+ */
+const DEFERRED_TYPE_FLAGS = ts.TypeFlags.TypeParameter |
+    ts.TypeFlags.IndexedAccess |
+    ts.TypeFlags.Conditional |
+    ts.TypeFlags.Substitution;
+/**
+ * Disallow spreading a `string` value with the spread operator `...`.
+ *
+ * ## Why
+ *
+ * Spreading a string iterates it into its individual characters, so
+ * `[...someString]` (or `f(...someString)`) evaluates to a `string[]` — the
+ * *exact same result type* as spreading an actual `string[]`. That makes an
+ * accidental string spread silent: neither the reader nor the type checker can
+ * tell `[...anArray]` from `[...aString]` by the result type alone, so a bug
+ * where an array was expected but a `string` slipped in goes unnoticed.
+ *
+ * ## Why not simply "allow array / object types only"
+ *
+ * The naive framing — "only permit `...` on arrays or objects" — would also
+ * reject perfectly idiomatic spreads of other iterables (`Set`, `Map`,
+ * `Map.prototype.keys()`, generators, `NodeList`, typed arrays, `arguments`,
+ * …), which have no equivalent silent hazard. And TypeScript *already* rejects
+ * spreading a non-iterable primitive such as `number` / `boolean` in an
+ * iterable position. The only case TypeScript accepts yet is genuinely
+ * error-prone is `string`, so that is exactly what this rule targets.
+ *
+ * If a character split is really intended, spell it out with
+ * `Array.from(str)` (identical to the spread, code-point aware) or
+ * `str.split('')`.
+ */
+const noStringSpread = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow spreading a `string` (e.g. `[...str]`), which silently splits it into characters and yields a `string[]` indistinguishable from spreading an array',
+        },
+        schema: [],
+        messages: {
+            noStringSpread: 'Spreading a `string` splits it into individual characters and yields a `string[]` indistinguishable from spreading an array, so accidental string spreads go unnoticed. Spread an array or object instead; if a character split is intended, make it explicit with `Array.from(str)`.',
+        },
+    },
+    create: (context) => {
+        const parserServices = ESLintUtils.getParserServices(context);
+        const checker = parserServices.program.getTypeChecker();
+        /**
+         * Returns `true` if the given type could be spread as a string (it is
+         * string-like, or a union / intersection with a string-like constituent).
+         *
+         * - `any` / `unknown` are treated conservatively as *not* string-like:
+         *   they cannot be proven to be a string, and flagging them would fire on
+         *   every untyped spread.
+         * - Unions are flagged when *any* branch is string-like, because such a
+         *   branch reintroduces the silent char-split hazard.
+         * - Intersections are flagged when *any* constituent is string-like: a
+         *   branded string (`string & Brand`) is still a `string` at runtime.
+         * - A deferred type (type parameter, indexed access, conditional, …) is
+         *   reduced to its base constraint; one with no resolvable constraint is
+         *   left alone to avoid false positives on unconstrained generics.
+         */
+        // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+        const isStringLikeType = (type) => {
+            if ((type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) {
+                return false;
+            }
+            if (type.isUnion() || type.isIntersection()) {
+                return type.types.some(isStringLikeType);
+            }
+            if ((type.flags & DEFERRED_TYPE_FLAGS) !== 0) {
+                const constraint = checker.getBaseConstraintOfType(type);
+                return constraint !== undefined && isStringLikeType(constraint);
+            }
+            return (type.flags & ts.TypeFlags.StringLike) !== 0;
+        };
+        return {
+            // `SpreadElement` covers every value-spread position: array literals
+            // (`[...x]`), call / new arguments (`f(...x)`), and object literals
+            // (`{...x}`). Destructuring rest (`[a, ...rest]`, `{ ...rest }`) is a
+            // `RestElement` / `RestType` and is intentionally not matched.
+            SpreadElement: (node) => {
+                const argTsNode = parserServices.esTreeNodeToTSNodeMap.get(node.argument);
+                if (!isStringLikeType(checker.getTypeAtLocation(argTsNode)))
+                    return;
+                context.report({
+                    node,
+                    messageId: 'noStringSpread',
+                });
+            },
+        };
+    },
+    defaultOptions: [],
+};
+
+export { noStringSpread };
+//# sourceMappingURL=no-string-spread.mjs.map

package/dist/plugins/ts-restrictions/rules/no-string-spread.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-string-spread.mjs","sources":["../../../../src/plugins/ts-restrictions/rules/no-string-spread.mts"],"sourcesContent":[null],"names":[],"mappings":";;;AAOA;;;;AAIG;AACH,MAAM,mBAAmB,GACvB,EAAE,CAAC,SAAS,CAAC,aAAa;IAC1B,EAAE,CAAC,SAAS,CAAC,aAAa;IAC1B,EAAE,CAAC,SAAS,CAAC,WAAW;AACxB,IAAA,EAAE,CAAC,SAAS,CAAC,YAAY;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;AAyBG;AACI,MAAM,cAAc,GAA6C;AACtE,IAAA,IAAI,EAAE;AACJ,QAAA,IAAI,EAAE,SAAS;AACf,QAAA,IAAI,EAAE;AACJ,YAAA,WAAW,EACT,6JAA6J;AAChK,SAAA;AACD,QAAA,MAAM,EAAE,EAAE;AACV,QAAA,QAAQ,EAAE;AACR,YAAA,cAAc,EACZ,uRAAuR;AAC1R,SAAA;AACF,KAAA;AAED,IAAA,MAAM,EAAE,CAAC,OAAO,KAAI;QAClB,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAE7D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE;AAEvD;;;;;;;;;;;;;;AAcG;;AAEH,QAAA,MAAM,gBAAgB,GAAG,CAAC,IAAa,KAAa;YAClD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;AAClE,gBAAA,OAAO,KAAK;YACd;YAEA,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE;gBAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAC1C;YAEA,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,mBAAmB,MAAM,CAAC,EAAE;gBAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC;gBAExD,OAAO,UAAU,KAAK,SAAS,IAAI,gBAAgB,CAAC,UAAU,CAAC;YACjE;AAEA,YAAA,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,MAAM,CAAC;AACrD,QAAA,CAAC;QAED,OAAO;;;;;AAKL,YAAA,aAAa,EAAE,CAAC,IAAI,KAAI;AACtB,gBAAA,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAqB,CAAC,GAAG,CACxD,IAAI,CAAC,QAAQ,CACd;gBAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;oBAAE;gBAE7D,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;AACJ,oBAAA,SAAS,EAAE,gBAAgB;AAC5B,iBAAA,CAAC;YACJ,CAAC;SACF;IACH,CAAC;AACD,IAAA,cAAc,EAAE,EAAE;;;;;"}

package/dist/plugins/ts-restrictions/rules/rules.d.mts

@@ -14,6 +14,7 @@ export declare const tsRestrictionsRules: {
         }>;
     }>)[], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     readonly 'no-restricted-syntax': import("eslint").Rule.RuleModule;
+    readonly 'no-string-spread': import("@typescript-eslint/utils/ts-eslint").RuleModule<"noStringSpread", readonly [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     readonly 'no-unnecessary-array-from': import("@typescript-eslint/utils/ts-eslint").RuleModule<"unnecessaryArrayFrom", readonly [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     readonly 'no-unnecessary-coalesce-undefined': import("@typescript-eslint/utils/ts-eslint").RuleModule<"unnecessaryCoalesceUndefined", readonly [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     readonly 'prefer-non-mutating-array-method': import("@typescript-eslint/utils/ts-eslint").RuleModule<"preferNonMutatingMethod", readonly [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;

package/dist/plugins/ts-restrictions/rules/rules.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.mts","sourceRoot":"","sources":["../../../../src/plugins/ts-restrictions/rules/rules.mts"],"names":[],"mappings":"AAQA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;CAOU,CAAC"}
+{"version":3,"file":"rules.d.mts","sourceRoot":"","sources":["../../../../src/plugins/ts-restrictions/rules/rules.mts"],"names":[],"mappings":"AASA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;CAQU,CAAC"}

package/dist/plugins/ts-restrictions/rules/rules.mjs

@@ -1,6 +1,7 @@
 import { checkDestructuringCompleteness } from './check-destructuring-completeness.mjs';
 import { noRestrictedCastName } from './no-restricted-cast-name.mjs';
 import { noRestrictedSyntax } from './no-restricted-syntax.mjs';
+import { noStringSpread } from './no-string-spread.mjs';
 import { noUnnecessaryArrayFrom } from './no-unnecessary-array-from.mjs';
 import { noUnnecessaryCoalesceUndefined } from './no-unnecessary-coalesce-undefined.mjs';
 import { preferNonMutatingArrayMethod } from './prefer-non-mutating-array-method.mjs';
@@ -9,6 +10,7 @@ const tsRestrictionsRules = {
     'check-destructuring-completeness': checkDestructuringCompleteness,
     'no-restricted-cast-name': noRestrictedCastName,
     'no-restricted-syntax': noRestrictedSyntax,
+    'no-string-spread': noStringSpread,
     'no-unnecessary-array-from': noUnnecessaryArrayFrom,
     'no-unnecessary-coalesce-undefined': noUnnecessaryCoalesceUndefined,
     'prefer-non-mutating-array-method': preferNonMutatingArrayMethod,

package/dist/plugins/ts-restrictions/rules/rules.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rules.mjs","sources":["../../../../src/plugins/ts-restrictions/rules/rules.mts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AAQO,MAAM,mBAAmB,GAAG;AACjC,IAAA,kCAAkC,EAAE,8BAA8B;AAClE,IAAA,yBAAyB,EAAE,oBAAoB;AAC/C,IAAA,sBAAsB,EAAE,kBAAkB;AAC1C,IAAA,2BAA2B,EAAE,sBAAsB;AACnD,IAAA,mCAAmC,EAAE,8BAA8B;AACnE,IAAA,kCAAkC,EAAE,4BAA4B;;;;;"}
+{"version":3,"file":"rules.mjs","sources":["../../../../src/plugins/ts-restrictions/rules/rules.mts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;AASO,MAAM,mBAAmB,GAAG;AACjC,IAAA,kCAAkC,EAAE,8BAA8B;AAClE,IAAA,yBAAyB,EAAE,oBAAoB;AAC/C,IAAA,sBAAsB,EAAE,kBAAkB;AAC1C,IAAA,kBAAkB,EAAE,cAAc;AAClC,IAAA,2BAA2B,EAAE,sBAAsB;AACnD,IAAA,mCAAmC,EAAE,8BAA8B;AACnE,IAAA,kCAAkC,EAAE,4BAA4B;;;;;"}

package/dist/rules/eslint-ts-restrictions-rules.d.mts

@@ -1,6 +1,7 @@
 export declare const eslintTsRestrictionsRules: {
     readonly 'ts-restrictions/no-restricted-syntax': "off";
     readonly 'ts-restrictions/no-restricted-cast-name': "off";
+    readonly 'ts-restrictions/no-string-spread': "error";
     readonly 'ts-restrictions/no-unnecessary-array-from': "error";
     readonly 'ts-restrictions/no-unnecessary-coalesce-undefined': "error";
     readonly 'ts-restrictions/prefer-non-mutating-array-method': "error";

package/dist/rules/eslint-ts-restrictions-rules.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"eslint-ts-restrictions-rules.d.mts","sourceRoot":"","sources":["../../src/rules/eslint-ts-restrictions-rules.mts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB;;;;;;;CAQQ,CAAC"}
+{"version":3,"file":"eslint-ts-restrictions-rules.d.mts","sourceRoot":"","sources":["../../src/rules/eslint-ts-restrictions-rules.mts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB;;;;;;;;CASQ,CAAC"}

package/dist/rules/eslint-ts-restrictions-rules.mjs

@@ -3,6 +3,7 @@ import { withDefaultOption } from '../types/rule-severity-with-default-option.mj
 const eslintTsRestrictionsRules = {
     'ts-restrictions/no-restricted-syntax': 'off',
     'ts-restrictions/no-restricted-cast-name': 'off',
+    'ts-restrictions/no-string-spread': 'error',
     'ts-restrictions/no-unnecessary-array-from': 'error',
     'ts-restrictions/no-unnecessary-coalesce-undefined': 'error',
     'ts-restrictions/prefer-non-mutating-array-method': 'error',

package/dist/rules/eslint-ts-restrictions-rules.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"eslint-ts-restrictions-rules.mjs","sources":["../../src/rules/eslint-ts-restrictions-rules.mts"],"sourcesContent":[null],"names":[],"mappings":";;AAKO,MAAM,yBAAyB,GAAG;AACvC,IAAA,sCAAsC,EAAE,KAAK;AAC7C,IAAA,yCAAyC,EAAE,KAAK;AAChD,IAAA,2CAA2C,EAAE,OAAO;AACpD,IAAA,mDAAmD,EAAE,OAAO;AAC5D,IAAA,kDAAkD,EAAE,OAAO;AAC3D,IAAA,kDAAkD,EAChD,iBAAiB,CAAC,OAAO,CAAC;;;;;"}
+{"version":3,"file":"eslint-ts-restrictions-rules.mjs","sources":["../../src/rules/eslint-ts-restrictions-rules.mts"],"sourcesContent":[null],"names":[],"mappings":";;AAKO,MAAM,yBAAyB,GAAG;AACvC,IAAA,sCAAsC,EAAE,KAAK;AAC7C,IAAA,yCAAyC,EAAE,KAAK;AAChD,IAAA,kCAAkC,EAAE,OAAO;AAC3C,IAAA,2CAA2C,EAAE,OAAO;AACpD,IAAA,mDAAmD,EAAE,OAAO;AAC5D,IAAA,kDAAkD,EAAE,OAAO;AAC3D,IAAA,kDAAkD,EAChD,iBAAiB,CAAC,OAAO,CAAC;;;;;"}

package/dist/types/rules/eslint-ts-restrictions-rules.d.mts

@@ -204,6 +204,19 @@ declare namespace NoRestrictedSyntax {
     }>)[];
     type RuleEntry = 'off' | Linter.Severity | SpreadOptionsIfIsArray<readonly [Linter.StringSeverity, Options]>;
 }
+/**
+ * @description Disallow spreading a `string` (e.g. `[...str]`), which silently splits it into characters and yields a `string[]` indistinguishable from spreading an array
+ *
+ *  ```md
+ *  | key        | value   |
+ *  | :--------- | :------ |
+ *  | type       | problem |
+ *  | deprecated | false   |
+ *  ```
+ */
+declare namespace NoStringSpread {
+    type RuleEntry = Linter.StringSeverity;
+}
 /**
  * @description Disallow wrapping an array in `Array.from()` before a non-mutating array method (e.g. `Array.from(x).toSorted()`), since the method already returns a new array
  *
@@ -250,6 +263,7 @@ export type EslintTsRestrictionsRules = Readonly<{
     'ts-restrictions/check-destructuring-completeness': CheckDestructuringCompleteness.RuleEntry;
     'ts-restrictions/no-restricted-cast-name': NoRestrictedCastName.RuleEntry;
     'ts-restrictions/no-restricted-syntax': NoRestrictedSyntax.RuleEntry;
+    'ts-restrictions/no-string-spread': NoStringSpread.RuleEntry;
     'ts-restrictions/no-unnecessary-array-from': NoUnnecessaryArrayFrom.RuleEntry;
     'ts-restrictions/no-unnecessary-coalesce-undefined': NoUnnecessaryCoalesceUndefined.RuleEntry;
     'ts-restrictions/prefer-non-mutating-array-method': PreferNonMutatingArrayMethod.RuleEntry;

package/dist/types/rules/eslint-ts-restrictions-rules.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"eslint-ts-restrictions-rules.d.mts","sourceRoot":"","sources":["../../../src/types/rules/eslint-ts-restrictions-rules.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,KAAK,sBAAsB,CACzB,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IACjD,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,GAC/B,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GACzC,CAAC,CAAC;AAEN;;;;;;;;;GASG;AACH,kBAAU,8BAA8B,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAY,OAAO,GAAG,QAAQ,CAAC;QAC7B;;WAEG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC;;WAEG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IAEH,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;;GAUG;AACH,kBAAU,oBAAoB,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACH;;OAEG;IACH,KAAY,OAAO,GAAG,SAAS,CAC3B,MAAM,GACN,QAAQ,CAAC;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,QAAQ,CACd;YACE,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;SACd,GACD;YACE,IAAI,EAAE,UAAU,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;SACd,CACJ,CAAC;KACH,CAAC,CACL,EAAE,CAAC;IAEJ,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;;;GAWG;AACH,kBAAU,kBAAkB,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH;;OAEG;IACH,KAAY,OAAO,GAAG,SAAS,CAC3B,MAAM,GACN,QAAQ,CAAC;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CACL,EAAE,CAAC;IAEJ,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;;GAUG;AACH,kBAAU,sBAAsB,CAAC;IAC/B,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED;;;;;;;;;;GAUG;AACH,kBAAU,8BAA8B,CAAC;IACvC,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED;;;;;;;;;;GAUG;AACH,kBAAU,4BAA4B,CAAC;IACrC,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,kDAAkD,EAAE,8BAA8B,CAAC,SAAS,CAAC;IAC7F,yCAAyC,EAAE,oBAAoB,CAAC,SAAS,CAAC;IAC1E,sCAAsC,EAAE,kBAAkB,CAAC,SAAS,CAAC;IACrE,2CAA2C,EAAE,sBAAsB,CAAC,SAAS,CAAC;IAC9E,mDAAmD,EAAE,8BAA8B,CAAC,SAAS,CAAC;IAC9F,kDAAkD,EAAE,4BAA4B,CAAC,SAAS,CAAC;CAC5F,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,kDAAkD,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAC3F,yCAAyC,EAAE,oBAAoB,CAAC,OAAO,CAAC;IACxE,sCAAsC,EAAE,kBAAkB,CAAC,OAAO,CAAC;CACpE,CAAC,CAAC"}
+{"version":3,"file":"eslint-ts-restrictions-rules.d.mts","sourceRoot":"","sources":["../../../src/types/rules/eslint-ts-restrictions-rules.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,KAAK,sBAAsB,CACzB,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IACjD,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,GAC/B,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GACzC,CAAC,CAAC;AAEN;;;;;;;;;GASG;AACH,kBAAU,8BAA8B,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAY,OAAO,GAAG,QAAQ,CAAC;QAC7B;;WAEG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC;;WAEG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IAEH,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;;GAUG;AACH,kBAAU,oBAAoB,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACH;;OAEG;IACH,KAAY,OAAO,GAAG,SAAS,CAC3B,MAAM,GACN,QAAQ,CAAC;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,QAAQ,CACd;YACE,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;SACd,GACD;YACE,IAAI,EAAE,UAAU,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;SACd,CACJ,CAAC;KACH,CAAC,CACL,EAAE,CAAC;IAEJ,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;;;GAWG;AACH,kBAAU,kBAAkB,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH;;OAEG;IACH,KAAY,OAAO,GAAG,SAAS,CAC3B,MAAM,GACN,QAAQ,CAAC;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CACL,EAAE,CAAC;IAEJ,KAAY,SAAS,GACjB,KAAK,GACL,MAAM,CAAC,QAAQ,GACf,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;;;;;;;GASG;AACH,kBAAU,cAAc,CAAC;IACvB,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED;;;;;;;;;;GAUG;AACH,kBAAU,sBAAsB,CAAC;IAC/B,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED;;;;;;;;;;GAUG;AACH,kBAAU,8BAA8B,CAAC;IACvC,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED;;;;;;;;;;GAUG;AACH,kBAAU,4BAA4B,CAAC;IACrC,KAAY,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;CAC/C;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,kDAAkD,EAAE,8BAA8B,CAAC,SAAS,CAAC;IAC7F,yCAAyC,EAAE,oBAAoB,CAAC,SAAS,CAAC;IAC1E,sCAAsC,EAAE,kBAAkB,CAAC,SAAS,CAAC;IACrE,kCAAkC,EAAE,cAAc,CAAC,SAAS,CAAC;IAC7D,2CAA2C,EAAE,sBAAsB,CAAC,SAAS,CAAC;IAC9E,mDAAmD,EAAE,8BAA8B,CAAC,SAAS,CAAC;IAC9F,kDAAkD,EAAE,4BAA4B,CAAC,SAAS,CAAC;CAC5F,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,kDAAkD,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAC3F,yCAAyC,EAAE,oBAAoB,CAAC,OAAO,CAAC;IACxE,sCAAsC,EAAE,kBAAkB,CAAC,OAAO,CAAC;CACpE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-config-typed",
-  "version": "5.6.2",
+  "version": "5.7.0",
   "private": false,
   "keywords": [
     "typescript"

package/src/plugins/ts-restrictions/rules/no-string-spread.mts

@@ -0,0 +1,118 @@
+import { ESLintUtils, type TSESLint } from '@typescript-eslint/utils';
+import * as ts from 'typescript';
+
+type Options = readonly [];
+
+type MessageIds = 'noStringSpread';
+
+/**
+ * Deferred (non-concrete) type flags whose actual members are only known once
+ * the type is instantiated. They are reduced to their base constraint before
+ * checking whether they are string-like.
+ */
+const DEFERRED_TYPE_FLAGS =
+  ts.TypeFlags.TypeParameter |
+  ts.TypeFlags.IndexedAccess |
+  ts.TypeFlags.Conditional |
+  ts.TypeFlags.Substitution;
+
+/**
+ * Disallow spreading a `string` value with the spread operator `...`.
+ *
+ * ## Why
+ *
+ * Spreading a string iterates it into its individual characters, so
+ * `[...someString]` (or `f(...someString)`) evaluates to a `string[]` — the
+ * *exact same result type* as spreading an actual `string[]`. That makes an
+ * accidental string spread silent: neither the reader nor the type checker can
+ * tell `[...anArray]` from `[...aString]` by the result type alone, so a bug
+ * where an array was expected but a `string` slipped in goes unnoticed.
+ *
+ * ## Why not simply "allow array / object types only"
+ *
+ * The naive framing — "only permit `...` on arrays or objects" — would also
+ * reject perfectly idiomatic spreads of other iterables (`Set`, `Map`,
+ * `Map.prototype.keys()`, generators, `NodeList`, typed arrays, `arguments`,
+ * …), which have no equivalent silent hazard. And TypeScript *already* rejects
+ * spreading a non-iterable primitive such as `number` / `boolean` in an
+ * iterable position. The only case TypeScript accepts yet is genuinely
+ * error-prone is `string`, so that is exactly what this rule targets.
+ *
+ * If a character split is really intended, spell it out with
+ * `Array.from(str)` (identical to the spread, code-point aware) or
+ * `str.split('')`.
+ */
+export const noStringSpread: TSESLint.RuleModule<MessageIds, Options> = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow spreading a `string` (e.g. `[...str]`), which silently splits it into characters and yields a `string[]` indistinguishable from spreading an array',
+    },
+    schema: [],
+    messages: {
+      noStringSpread:
+        'Spreading a `string` splits it into individual characters and yields a `string[]` indistinguishable from spreading an array, so accidental string spreads go unnoticed. Spread an array or object instead; if a character split is intended, make it explicit with `Array.from(str)`.',
+    },
+  },
+
+  create: (context) => {
+    const parserServices = ESLintUtils.getParserServices(context);
+
+    const checker = parserServices.program.getTypeChecker();
+
+    /**
+     * Returns `true` if the given type could be spread as a string (it is
+     * string-like, or a union / intersection with a string-like constituent).
+     *
+     * - `any` / `unknown` are treated conservatively as *not* string-like:
+     *   they cannot be proven to be a string, and flagging them would fire on
+     *   every untyped spread.
+     * - Unions are flagged when *any* branch is string-like, because such a
+     *   branch reintroduces the silent char-split hazard.
+     * - Intersections are flagged when *any* constituent is string-like: a
+     *   branded string (`string & Brand`) is still a `string` at runtime.
+     * - A deferred type (type parameter, indexed access, conditional, …) is
+     *   reduced to its base constraint; one with no resolvable constraint is
+     *   left alone to avoid false positives on unconstrained generics.
+     */
+    // eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+    const isStringLikeType = (type: ts.Type): boolean => {
+      if ((type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) {
+        return false;
+      }
+
+      if (type.isUnion() || type.isIntersection()) {
+        return type.types.some(isStringLikeType);
+      }
+
+      if ((type.flags & DEFERRED_TYPE_FLAGS) !== 0) {
+        const constraint = checker.getBaseConstraintOfType(type);
+
+        return constraint !== undefined && isStringLikeType(constraint);
+      }
+
+      return (type.flags & ts.TypeFlags.StringLike) !== 0;
+    };
+
+    return {
+      // `SpreadElement` covers every value-spread position: array literals
+      // (`[...x]`), call / new arguments (`f(...x)`), and object literals
+      // (`{...x}`). Destructuring rest (`[a, ...rest]`, `{ ...rest }`) is a
+      // `RestElement` / `RestType` and is intentionally not matched.
+      SpreadElement: (node) => {
+        const argTsNode = parserServices.esTreeNodeToTSNodeMap.get(
+          node.argument,
+        );
+
+        if (!isStringLikeType(checker.getTypeAtLocation(argTsNode))) return;
+
+        context.report({
+          node,
+          messageId: 'noStringSpread',
+        });
+      },
+    };
+  },
+  defaultOptions: [],
+} as const;

package/src/plugins/ts-restrictions/rules/no-string-spread.test.mts

@@ -0,0 +1,175 @@
+import parser from '@typescript-eslint/parser';
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import dedent from 'dedent';
+import { noStringSpread } from './no-string-spread.mjs';
+
+const tester = new RuleTester({
+  languageOptions: {
+    parser,
+    parserOptions: {
+      ecmaVersion: 2020,
+      sourceType: 'module',
+      projectService: {
+        allowDefaultProject: ['*.ts*'],
+      },
+      tsconfigRootDir: `${import.meta.dirname}/../../../..`,
+    },
+  },
+});
+
+describe('no-string-spread', () => {
+  tester.run('no-string-spread', noStringSpread, {
+    valid: [
+      {
+        name: 'spreading an array into an array literal',
+        code: dedent`
+          declare const xs: readonly number[];
+          const ys = [...xs];
+        `,
+      },
+      {
+        name: 'spreading a tuple into an array literal',
+        code: dedent`
+          declare const xs: readonly [number, string];
+          const ys = [...xs];
+        `,
+      },
+      {
+        name: 'spreading an array into a function call',
+        code: dedent`
+          declare const xs: readonly number[];
+          const m = Math.max(...xs);
+        `,
+      },
+      {
+        name: 'spreading an object into an object literal',
+        code: dedent`
+          declare const obj: { readonly a: number; readonly b: number };
+          const clone = { ...obj };
+        `,
+      },
+      {
+        name: 'spreading a Set is a legitimate iterable spread',
+        code: dedent`
+          declare const s: ReadonlySet<number>;
+          const ys = [...s];
+        `,
+      },
+      {
+        name: 'spreading a Map is a legitimate iterable spread',
+        code: dedent`
+          declare const m: ReadonlyMap<string, number>;
+          const entries = [...m];
+        `,
+      },
+      {
+        name: 'spreading a generic iterable is not a string',
+        code: dedent`
+          declare const it: Iterable<number>;
+          const ys = [...it];
+        `,
+      },
+      {
+        name: 'any is treated conservatively and not flagged',
+        code: dedent`
+          declare const x: any;
+          const ys = [...x];
+        `,
+      },
+      {
+        name: 'array destructuring rest is not a value spread',
+        code: dedent`
+          declare const xs: readonly number[];
+          const [first, ...rest] = xs;
+        `,
+      },
+      {
+        name: 'object destructuring rest is not a value spread',
+        code: dedent`
+          declare const obj: { readonly a: number; readonly b: number };
+          const { a, ...others } = obj;
+        `,
+      },
+      {
+        name: 'spreading an array of strings is fine (not a string itself)',
+        code: dedent`
+          declare const xs: readonly string[];
+          const ys = [...xs];
+        `,
+      },
+      {
+        name: 'unconstrained generic is left alone',
+        code: dedent`
+          const f = <T>(xs: readonly T[]): readonly T[] => [...xs];
+        `,
+      },
+    ],
+    invalid: [
+      {
+        name: 'spreading a string into an array literal',
+        code: dedent`
+          declare const s: string;
+          const chars = [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a string into a function call',
+        code: dedent`
+          declare const s: string;
+          declare function f(...args: readonly string[]): void;
+          f(...s);
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a string into an object literal',
+        code: dedent`
+          declare const s: string;
+          const o = { ...s };
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a string literal type',
+        code: dedent`
+          declare const s: 'abc';
+          const chars = [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a template literal type',
+        code: dedent`
+          declare const s: \`id_\${string}\`;
+          const chars = [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a union that includes string is still flagged',
+        code: dedent`
+          declare const s: string | readonly string[];
+          const ys = [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a branded string (intersection) is flagged',
+        code: dedent`
+          type UserId = string & { readonly __brand: unique symbol };
+          declare const s: UserId;
+          const chars = [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+      {
+        name: 'spreading a generic constrained to string is flagged',
+        code: dedent`
+          const f = <T extends string>(s: T): readonly string[] => [...s];
+        `,
+        errors: [{ messageId: 'noStringSpread' }],
+      },
+    ],
+  });
+});

package/src/plugins/ts-restrictions/rules/rules.mts

@@ -2,6 +2,7 @@ import { type ESLintPlugin } from '../../../types/index.mjs';
 import { checkDestructuringCompleteness } from './check-destructuring-completeness.mjs';
 import { noRestrictedCastName } from './no-restricted-cast-name.mjs';
 import { noRestrictedSyntax } from './no-restricted-syntax.mjs';
+import { noStringSpread } from './no-string-spread.mjs';
 import { noUnnecessaryArrayFrom } from './no-unnecessary-array-from.mjs';
 import { noUnnecessaryCoalesceUndefined } from './no-unnecessary-coalesce-undefined.mjs';
 import { preferNonMutatingArrayMethod } from './prefer-non-mutating-array-method.mjs';
@@ -10,6 +11,7 @@ export const tsRestrictionsRules = {
   'check-destructuring-completeness': checkDestructuringCompleteness,
   'no-restricted-cast-name': noRestrictedCastName,
   'no-restricted-syntax': noRestrictedSyntax,
+  'no-string-spread': noStringSpread,
   'no-unnecessary-array-from': noUnnecessaryArrayFrom,
   'no-unnecessary-coalesce-undefined': noUnnecessaryCoalesceUndefined,
   'prefer-non-mutating-array-method': preferNonMutatingArrayMethod,

package/src/rules/eslint-ts-restrictions-rules.mts

@@ -6,6 +6,7 @@ import {
 export const eslintTsRestrictionsRules = {
   'ts-restrictions/no-restricted-syntax': 'off',
   'ts-restrictions/no-restricted-cast-name': 'off',
+  'ts-restrictions/no-string-spread': 'error',
   'ts-restrictions/no-unnecessary-array-from': 'error',
   'ts-restrictions/no-unnecessary-coalesce-undefined': 'error',
   'ts-restrictions/prefer-non-mutating-array-method': 'error',

package/src/types/rules/eslint-ts-restrictions-rules.mts

@@ -235,6 +235,20 @@ namespace NoRestrictedSyntax {
     | SpreadOptionsIfIsArray<readonly [Linter.StringSeverity, Options]>;
 }
 
+/**
+ * @description Disallow spreading a `string` (e.g. `[...str]`), which silently splits it into characters and yields a `string[]` indistinguishable from spreading an array
+ *
+ *  ```md
+ *  | key        | value   |
+ *  | :--------- | :------ |
+ *  | type       | problem |
+ *  | deprecated | false   |
+ *  ```
+ */
+namespace NoStringSpread {
+  export type RuleEntry = Linter.StringSeverity;
+}
+
 /**
  * @description Disallow wrapping an array in `Array.from()` before a non-mutating array method (e.g. `Array.from(x).toSorted()`), since the method already returns a new array
  *
@@ -284,6 +298,7 @@ export type EslintTsRestrictionsRules = Readonly<{
   'ts-restrictions/check-destructuring-completeness': CheckDestructuringCompleteness.RuleEntry;
   'ts-restrictions/no-restricted-cast-name': NoRestrictedCastName.RuleEntry;
   'ts-restrictions/no-restricted-syntax': NoRestrictedSyntax.RuleEntry;
+  'ts-restrictions/no-string-spread': NoStringSpread.RuleEntry;
   'ts-restrictions/no-unnecessary-array-from': NoUnnecessaryArrayFrom.RuleEntry;
   'ts-restrictions/no-unnecessary-coalesce-undefined': NoUnnecessaryCoalesceUndefined.RuleEntry;
   'ts-restrictions/prefer-non-mutating-array-method': PreferNonMutatingArrayMethod.RuleEntry;