exadev-eslint-config 2.1.2 → 2.3.0

package/README.md

@@ -16,7 +16,7 @@ Consumers need `eslint >=10.0.0` and `typescript-eslint >=8.0.0` as required pee
 pnpm add -D @exadev/eslint-config typescript-eslint eslint
 ```
 
-The default export is the full, type-checked ruleset: typescript-eslint's `recommendedTypeChecked` + `stylisticTypeChecked` presets, `exadev/barrel-policy` at `mode: 'banned'` (see [Barrel policy](#barrel-policy)), `exadev/no-pointless-reassignment`, `linterOptions.noInlineConfig`, `@typescript-eslint/consistent-type-assertions` banning all type assertions, and `@typescript-eslint/ban-ts-comment` banning `@ts-expect-error` outright -- the last two relaxed in test files (see below). Spread it directly into `tseslint.config(...)`:
+The default export is the full, type-checked ruleset: typescript-eslint's `recommendedTypeChecked` + `stylisticTypeChecked` presets, `exadev/barrel-policy` at `mode: 'banned'` (see [Barrel policy](#barrel-policy)), `exadev/no-object-assign`, `exadev/no-mutable-union-array-param`, `exadev/no-enum-number-widening`, `exadev/no-pointless-reassignment`, `linterOptions.noInlineConfig`, `@typescript-eslint/consistent-type-assertions` banning all type assertions, `@typescript-eslint/no-non-null-assertion` banning the `!` operator (the same manual-override escape hatch as a type assertion, under a different spelling), `@typescript-eslint/ban-ts-comment` banning `@ts-expect-error` outright, and `@typescript-eslint/method-signature-style` set to `'property'` (method-shorthand signatures are checked bivariantly under `strictFunctionTypes`, which is unsound) -- the type-assertion and ts-comment rules are relaxed in test files (see below). Spread it directly into `tseslint.config(...)`:
 
 ```ts
 // eslint.config.ts
@@ -41,7 +41,7 @@ export default tseslint.config(
   { rules: { 'exadev/barrel-policy': ['error', { mode: 'single' }] } }, // this package keeps its barrel
 ```
 
-`recommendedTypeChecked` subsumes typescript-eslint's plain `recommended` outright (all 46 of its rules are a subset of `recommendedTypeChecked`'s 73), and its base config registers the `@typescript-eslint` plugin and sets `languageOptions.parser` itself. That is why **you must remove your own `...tseslint.configs.recommended`/`recommendedTypeChecked`/`stylisticTypeChecked` spreads** -- flat config rejects two different plugin object instances registered under the same namespace. You still supply `languageOptions.parserOptions.project`/`projectService` pointing at your own tsconfig(s).
+`recommendedTypeChecked` subsumes typescript-eslint's plain `recommended` outright (every rule in `recommended` is also present in `recommendedTypeChecked`), and its base config registers the `@typescript-eslint` plugin and sets `languageOptions.parser` itself. That is why **you must remove your own `...tseslint.configs.recommended`/`recommendedTypeChecked`/`stylisticTypeChecked` spreads** -- flat config rejects two different plugin object instances registered under the same namespace. You still supply `languageOptions.parserOptions.project`/`projectService` pointing at your own tsconfig(s).
 
 **Test files (`**/*.{test,spec}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}`) get two narrow relaxations of this package's own additions, and only those two.** `@ts-expect-error` reverts to `allow-with-description` (a compile-time-only assertion of a type failure is a legitimate test pattern; `@ts-ignore`/`@ts-nocheck` stay banned since `@ts-expect-error` is strictly better). `consistent-type-assertions` relaxes to `assertionStyle: 'as'` (the legacy `<Type>value` form stays banned everywhere). Nothing inherited from the presets is relaxed.
 
@@ -77,7 +77,7 @@ export default defineConfig([
   {
     files: ['**/*.ts'],
     plugins: { exadev: plugin },
-    extends: ['exadev/recommended'], // this plugin's own four rules, plus linterOptions.noInlineConfig -- no type-checked rules at all
+    extends: ['exadev/recommended'], // this plugin's own non-type-aware rules, plus linterOptions.noInlineConfig -- no type-checked rules at all
     // or: extends: ['exadev/barrel'], // just the barrel-discipline trio (no-non-barrel-index, no-non-barrel-reexport, no-side-effects-in-index)
   },
 ]);
@@ -112,6 +112,9 @@ export default tseslint.config(
 | `no-side-effects-in-index` | | A barrel file may contain only re-export statements -- nothing that could execute at import time. Self-scopes to any index file. |
 | `barrel-direct-siblings-only` | | A barrel may re-export only from a direct sibling (`./module`), never a nested path, parent, or bare package specifier (mode 3). |
 | `no-pointless-reassignment` | ✓ | `const foo = bar` where both sides are plain identifiers and the alias adds no transformation. Autofix rewrites every read to the original name and deletes the declaration (including its `export` keyword, when exported). Still reported but deliberately not auto-fixable where collapsing the alias would change meaning: an explicit type annotation (`const exhaustive: never = item` -- the annotation is the point), a read where the original name is shadowed, a read as a shorthand object property, more than one declarator in the statement, or a source that is written to anywhere. |
+| `no-object-assign` | ✓/suggestion | `Object.assign` does not check a source object's properties against the target's declared types, unlike object spread. A fresh object-literal target autofixes to `{ ...target, ...source }`; mutating an existing reassignable binding offers a suggestion only (changes the object's identity); a `const` binding or a non-statement call site gets a plain report with no fix. |
+| `no-mutable-union-array-param` | ✓ | A function parameter typed as an array of a union (`(string \| number)[]`) accepts a narrower caller array (`number[]`) by covariance; calling `push`/`unshift`/`splice`/`fill`/`copyWithin` on it can then insert a value the caller's own array was never declared to hold. Autofix marks the parameter `readonly`, turning the mutating call into a real compile error to resolve deliberately. Requires no type information. |
+| `no-enum-number-widening` | | A bare (non-literal) `number` is accepted anywhere a numeric enum is expected, without checking it is actually one of the enum's members -- only a numeric *literal* gets range-checked by `tsc`. No autofix: the only provably safe fix is a genuine runtime membership check against the enum's own values, which is a behavioural choice a mechanical fix cannot responsibly make. Requires type information -- only in the default (type-checked) export, not `plugin.configs.recommended`. |
 
 ## Barrel policy
 

package/dist/index.cjs

@@ -27,8 +27,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 let typescript_eslint = require("typescript-eslint");
 typescript_eslint = __toESM(typescript_eslint, 1);
 let node_path = require("node:path");
+let _typescript_eslint_utils = require("@typescript-eslint/utils");
+let typescript = require("typescript");
+typescript = __toESM(typescript, 1);
 //#region package.json
-var version = "2.1.2";
+var version = "2.3.0";
 //#endregion
 //#region src/rules/barrel-helpers.ts
 const INDEX_BASENAME$1 = /^index\.[cm]?[tj]sx?$/;
@@ -264,6 +267,51 @@ const barrelPolicy = {
 	}
 };
 //#endregion
+//#region src/rules/no-enum-number-widening.ts
+const noEnumNumberWidening = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`)({
+	name: "no-enum-number-widening",
+	meta: {
+		type: "problem",
+		docs: { description: "Disallow assigning a bare (non-literal) number where a numeric enum type is expected -- TypeScript accepts any number for a numeric enum slot, not just its own members, once the value is not a literal the compiler can range-check." },
+		schema: [],
+		messages: { widening: "A plain 'number' value is being used where the numeric enum '{{ enumName }}' is expected. TypeScript does not verify the value is actually one of the enum's members here -- narrow it to a known member first (e.g. a lookup/guard against the enum's own values), or accept a plain 'number' parameter instead of widening it implicitly." }
+	},
+	defaultOptions: [],
+	create(context) {
+		const services = _typescript_eslint_utils.ESLintUtils.getParserServices(context);
+		const checker = services.program.getTypeChecker();
+		function checkNode(expression) {
+			const tsNode = services.esTreeNodeToTSNodeMap.get(expression);
+			if (!typescript.isExpression(tsNode)) return;
+			const contextualType = checker.getContextualType(tsNode);
+			if (!contextualType || !(contextualType.flags & typescript.TypeFlags.EnumLike)) return;
+			const actualType = checker.getTypeAtLocation(tsNode);
+			if (actualType.flags & typescript.TypeFlags.EnumLike) return;
+			if (actualType.isLiteral()) return;
+			if (!(actualType.flags & typescript.TypeFlags.NumberLike)) return;
+			context.report({
+				node: expression,
+				messageId: "widening",
+				data: { enumName: checker.typeToString(contextualType) }
+			});
+		}
+		return {
+			VariableDeclarator(node) {
+				if (node.init) checkNode(node.init);
+			},
+			AssignmentExpression(node) {
+				checkNode(node.right);
+			},
+			ReturnStatement(node) {
+				if (node.argument) checkNode(node.argument);
+			},
+			CallExpression(node) {
+				for (const argument of node.arguments) if (argument.type !== _typescript_eslint_utils.AST_NODE_TYPES.SpreadElement) checkNode(argument);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/rules/no-index-files.ts
 const noIndexFiles = {
 	meta: {
@@ -282,6 +330,58 @@ const noIndexFiles = {
 	}
 };
 //#endregion
+//#region src/rules/no-mutable-union-array-param.ts
+const MUTATING_INSERT_METHODS = /* @__PURE__ */ new Set([
+	"push",
+	"unshift",
+	"splice",
+	"fill",
+	"copyWithin"
+]);
+const createRule$1 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+function isUnionArrayType(typeAnnotation) {
+	if (typeAnnotation.type === _typescript_eslint_utils.AST_NODE_TYPES.TSArrayType && typeAnnotation.elementType.type === _typescript_eslint_utils.AST_NODE_TYPES.TSUnionType) return typeAnnotation.elementType;
+	if (typeAnnotation.type === _typescript_eslint_utils.AST_NODE_TYPES.TSTypeReference && typeAnnotation.typeName.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && typeAnnotation.typeName.name === "Array" && typeAnnotation.typeArguments?.params.length === 1) {
+		const firstParam = typeAnnotation.typeArguments.params[0];
+		if (firstParam?.type === _typescript_eslint_utils.AST_NODE_TYPES.TSUnionType) return firstParam;
+	}
+}
+const noMutableUnionArrayParam = createRule$1({
+	name: "no-mutable-union-array-param",
+	meta: {
+		type: "problem",
+		fixable: "code",
+		docs: { description: "Disallow mutating-insertion calls on a union-element array parameter, which lets a caller pass a narrower array whose declared element type the call can silently violate." },
+		schema: [],
+		messages: { unsound: "'{{ method }}' inserts into a parameter typed as an array of a union -- a caller may have passed a narrower array (e.g. number[] where (string | number)[] is declared), and TypeScript's covariant array typing does not catch the resulting mismatch. Mark the parameter readonly to turn this into a real compile error, or narrow the parameter type." }
+	},
+	defaultOptions: [],
+	create(context) {
+		return { CallExpression(node) {
+			const { callee } = node;
+			if (callee.type !== _typescript_eslint_utils.AST_NODE_TYPES.MemberExpression || callee.computed || callee.object.type !== _typescript_eslint_utils.AST_NODE_TYPES.Identifier || callee.property.type !== _typescript_eslint_utils.AST_NODE_TYPES.Identifier || !MUTATING_INSERT_METHODS.has(callee.property.name)) return;
+			const parameterDefinition = (context.sourceCode.getScope(node).references.find((reference) => reference.identifier === callee.object)?.resolved)?.defs.find((definition) => definition.type === _typescript_eslint_utils.TSESLint.Scope.DefinitionType.Parameter);
+			if (!parameterDefinition) return;
+			const parameterNode = parameterDefinition.name;
+			if (parameterNode.type !== _typescript_eslint_utils.AST_NODE_TYPES.Identifier || !parameterNode.typeAnnotation) return;
+			if (!isUnionArrayType(parameterNode.typeAnnotation.typeAnnotation)) return;
+			context.report({
+				node,
+				messageId: "unsound",
+				data: { method: callee.property.name },
+				fix(fixer) {
+					const typeAnnotation = parameterNode.typeAnnotation;
+					if (!typeAnnotation) return null;
+					const annotated = typeAnnotation.typeAnnotation;
+					if (annotated.type === _typescript_eslint_utils.AST_NODE_TYPES.TSArrayType) return fixer.insertTextBefore(annotated, "readonly ");
+					if (annotated.type === _typescript_eslint_utils.AST_NODE_TYPES.TSTypeReference && annotated.typeName.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier) return fixer.replaceText(annotated.typeName, "ReadonlyArray");
+					return null;
+				}
+			});
+		} };
+	}
+});
+//#endregion
 //#region src/rules/no-non-barrel-index.ts
 const INDEX_BASENAME = /^index\.[cm]?[tj]s$/;
 const noNonBarrelIndex = {
@@ -371,6 +471,76 @@ const noNonBarrelReexport = {
 	}
 };
 //#endregion
+//#region src/rules/no-object-assign.ts
+const createRule = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+function resolveFrom$1(scope, name) {
+	for (let current = scope; current; current = current.upper) {
+		const found = current.set.get(name);
+		if (found) return found;
+	}
+}
+const noObjectAssign = createRule({
+	name: "no-object-assign",
+	meta: {
+		type: "problem",
+		fixable: "code",
+		hasSuggestions: true,
+		docs: { description: "Disallow Object.assign, whose own type declarations do not check a source object's properties against the target's declared types -- object spread does." },
+		schema: [],
+		messages: {
+			unsound: "Object.assign does not verify that a source object's properties are assignable to the target's declared types, so a type mismatch here passes silently where a direct property assignment would be rejected. Use object spread ({ ...target, ...source }) to build a correctly type-checked replacement instead.",
+			suggestSpreadReassign: "Replace with object spread and reassignment (changes the object reference -- anything else already holding this object will not see the update)."
+		}
+	},
+	defaultOptions: [],
+	create(context) {
+		return { CallExpression(node) {
+			const { callee } = node;
+			if (!(callee.type === _typescript_eslint_utils.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.object.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && callee.object.name === "Object" && callee.property.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && callee.property.name === "assign")) return;
+			const [target, ...sources] = node.arguments;
+			const sourcesAreSpreadable = sources.every((argument) => argument.type !== _typescript_eslint_utils.AST_NODE_TYPES.SpreadElement);
+			if (target?.type === _typescript_eslint_utils.AST_NODE_TYPES.ObjectExpression && sourcesAreSpreadable) {
+				const isBareStatement = node.parent.type === _typescript_eslint_utils.AST_NODE_TYPES.ExpressionStatement && node.parent.expression === node;
+				context.report({
+					node,
+					messageId: "unsound",
+					fix(fixer) {
+						const targetProps = target.properties.map((property) => context.sourceCode.getText(property));
+						const sourceSpreads = sources.map((argument) => `...${context.sourceCode.getText(argument)}`);
+						const objectLiteral = `{ ${[...targetProps, ...sourceSpreads].join(", ")} }`;
+						return fixer.replaceText(node, isBareStatement ? `(${objectLiteral})` : objectLiteral);
+					}
+				});
+				return;
+			}
+			if (target?.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && sourcesAreSpreadable && node.parent.type === _typescript_eslint_utils.AST_NODE_TYPES.ExpressionStatement && node.parent.expression === node) {
+				const targetName = target.name;
+				const variable = resolveFrom$1(context.sourceCode.getScope(node), targetName);
+				const isConst = (variable?.defs.find((candidate) => candidate.type === _typescript_eslint_utils.TSESLint.Scope.DefinitionType.Variable))?.parent.kind === "const";
+				const statement = node.parent;
+				if (variable && !isConst) {
+					context.report({
+						node,
+						messageId: "unsound",
+						suggest: [{
+							messageId: "suggestSpreadReassign",
+							fix(fixer) {
+								const sourceSpreads = sources.map((argument) => `...${context.sourceCode.getText(argument)}`);
+								return fixer.replaceText(statement, `${targetName} = { ...${targetName}, ${sourceSpreads.join(", ")} };`);
+							}
+						}]
+					});
+					return;
+				}
+			}
+			context.report({
+				node,
+				messageId: "unsound"
+			});
+		} };
+	}
+});
+//#endregion
 //#region src/rules/no-pointless-reassignment.ts
 function isIdentifierReference(reference) {
 	return reference.identifier.type === "Identifier";
@@ -395,9 +565,12 @@ const plugin = {
 	rules: {
 		"barrel-direct-siblings-only": barrelDirectSiblingsOnly,
 		"barrel-policy": barrelPolicy,
+		"no-enum-number-widening": noEnumNumberWidening,
 		"no-index-files": noIndexFiles,
+		"no-mutable-union-array-param": noMutableUnionArrayParam,
 		"no-non-barrel-index": noNonBarrelIndex,
 		"no-non-barrel-reexport": noNonBarrelReexport,
+		"no-object-assign": noObjectAssign,
 		"no-pointless-reassignment": {
 			meta: {
 				type: "problem",
@@ -477,6 +650,8 @@ const plugin = {
 				linterOptions: { noInlineConfig: true },
 				rules: {
 					"exadev/barrel-policy": ["error", { mode: "banned" }],
+					"exadev/no-mutable-union-array-param": "error",
+					"exadev/no-object-assign": "error",
 					"exadev/no-pointless-reassignment": "error"
 				}
 			};
@@ -500,9 +675,14 @@ const recommendedTypeChecked = [
 		linterOptions: { noInlineConfig: true },
 		rules: {
 			"exadev/barrel-policy": ["error", { mode: "banned" }],
+			"exadev/no-enum-number-widening": "error",
+			"exadev/no-mutable-union-array-param": "error",
+			"exadev/no-object-assign": "error",
 			"exadev/no-pointless-reassignment": "error",
 			"@typescript-eslint/consistent-type-assertions": ["error", { assertionStyle: "never" }],
-			"@typescript-eslint/ban-ts-comment": ["error", { "ts-expect-error": true }]
+			"@typescript-eslint/ban-ts-comment": ["error", { "ts-expect-error": true }],
+			"@typescript-eslint/method-signature-style": ["error", "property"],
+			"@typescript-eslint/no-non-null-assertion": "error"
 		}
 	},
 	{

package/dist/index.d.cts

@@ -1,10 +1,10 @@
-import { ESLint } from "eslint";
+import { TSESLint } from "@typescript-eslint/utils";
 //#region src/recommended-type-checked.d.ts
-type ConfigValue = NonNullable<ESLint.Plugin['configs']>[string];
+type ConfigValue = NonNullable<TSESLint.FlatConfig.Plugin['configs']>[string];
 type ConfigArrayValue = Extract<ConfigValue, unknown[]>;
 declare const recommendedTypeChecked: ConfigArrayValue;
 //#endregion
 //#region src/plugin.d.ts
-declare const plugin: ESLint.Plugin;
+declare const plugin: TSESLint.FlatConfig.Plugin;
 //#endregion
 export { recommendedTypeChecked as default, plugin };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { ESLint } from "eslint";
+import { TSESLint } from "@typescript-eslint/utils";
 //#region src/recommended-type-checked.d.ts
-type ConfigValue = NonNullable<ESLint.Plugin['configs']>[string];
+type ConfigValue = NonNullable<TSESLint.FlatConfig.Plugin['configs']>[string];
 type ConfigArrayValue = Extract<ConfigValue, unknown[]>;
 declare const recommendedTypeChecked: ConfigArrayValue;
 //#endregion
 //#region src/plugin.d.ts
-declare const plugin: ESLint.Plugin;
+declare const plugin: TSESLint.FlatConfig.Plugin;
 //#endregion
 export { recommendedTypeChecked as default, plugin };

package/dist/index.js

@@ -1,7 +1,9 @@
 import tseslint from "typescript-eslint";
 import { posix } from "node:path";
+import { AST_NODE_TYPES, ESLintUtils, TSESLint } from "@typescript-eslint/utils";
+import * as ts from "typescript";
 //#region package.json
-var version = "2.1.2";
+var version = "2.3.0";
 //#endregion
 //#region src/rules/barrel-helpers.ts
 const INDEX_BASENAME$1 = /^index\.[cm]?[tj]sx?$/;
@@ -237,6 +239,51 @@ const barrelPolicy = {
 	}
 };
 //#endregion
+//#region src/rules/no-enum-number-widening.ts
+const noEnumNumberWidening = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`)({
+	name: "no-enum-number-widening",
+	meta: {
+		type: "problem",
+		docs: { description: "Disallow assigning a bare (non-literal) number where a numeric enum type is expected -- TypeScript accepts any number for a numeric enum slot, not just its own members, once the value is not a literal the compiler can range-check." },
+		schema: [],
+		messages: { widening: "A plain 'number' value is being used where the numeric enum '{{ enumName }}' is expected. TypeScript does not verify the value is actually one of the enum's members here -- narrow it to a known member first (e.g. a lookup/guard against the enum's own values), or accept a plain 'number' parameter instead of widening it implicitly." }
+	},
+	defaultOptions: [],
+	create(context) {
+		const services = ESLintUtils.getParserServices(context);
+		const checker = services.program.getTypeChecker();
+		function checkNode(expression) {
+			const tsNode = services.esTreeNodeToTSNodeMap.get(expression);
+			if (!ts.isExpression(tsNode)) return;
+			const contextualType = checker.getContextualType(tsNode);
+			if (!contextualType || !(contextualType.flags & ts.TypeFlags.EnumLike)) return;
+			const actualType = checker.getTypeAtLocation(tsNode);
+			if (actualType.flags & ts.TypeFlags.EnumLike) return;
+			if (actualType.isLiteral()) return;
+			if (!(actualType.flags & ts.TypeFlags.NumberLike)) return;
+			context.report({
+				node: expression,
+				messageId: "widening",
+				data: { enumName: checker.typeToString(contextualType) }
+			});
+		}
+		return {
+			VariableDeclarator(node) {
+				if (node.init) checkNode(node.init);
+			},
+			AssignmentExpression(node) {
+				checkNode(node.right);
+			},
+			ReturnStatement(node) {
+				if (node.argument) checkNode(node.argument);
+			},
+			CallExpression(node) {
+				for (const argument of node.arguments) if (argument.type !== AST_NODE_TYPES.SpreadElement) checkNode(argument);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/rules/no-index-files.ts
 const noIndexFiles = {
 	meta: {
@@ -255,6 +302,58 @@ const noIndexFiles = {
 	}
 };
 //#endregion
+//#region src/rules/no-mutable-union-array-param.ts
+const MUTATING_INSERT_METHODS = /* @__PURE__ */ new Set([
+	"push",
+	"unshift",
+	"splice",
+	"fill",
+	"copyWithin"
+]);
+const createRule$1 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+function isUnionArrayType(typeAnnotation) {
+	if (typeAnnotation.type === AST_NODE_TYPES.TSArrayType && typeAnnotation.elementType.type === AST_NODE_TYPES.TSUnionType) return typeAnnotation.elementType;
+	if (typeAnnotation.type === AST_NODE_TYPES.TSTypeReference && typeAnnotation.typeName.type === AST_NODE_TYPES.Identifier && typeAnnotation.typeName.name === "Array" && typeAnnotation.typeArguments?.params.length === 1) {
+		const firstParam = typeAnnotation.typeArguments.params[0];
+		if (firstParam?.type === AST_NODE_TYPES.TSUnionType) return firstParam;
+	}
+}
+const noMutableUnionArrayParam = createRule$1({
+	name: "no-mutable-union-array-param",
+	meta: {
+		type: "problem",
+		fixable: "code",
+		docs: { description: "Disallow mutating-insertion calls on a union-element array parameter, which lets a caller pass a narrower array whose declared element type the call can silently violate." },
+		schema: [],
+		messages: { unsound: "'{{ method }}' inserts into a parameter typed as an array of a union -- a caller may have passed a narrower array (e.g. number[] where (string | number)[] is declared), and TypeScript's covariant array typing does not catch the resulting mismatch. Mark the parameter readonly to turn this into a real compile error, or narrow the parameter type." }
+	},
+	defaultOptions: [],
+	create(context) {
+		return { CallExpression(node) {
+			const { callee } = node;
+			if (callee.type !== AST_NODE_TYPES.MemberExpression || callee.computed || callee.object.type !== AST_NODE_TYPES.Identifier || callee.property.type !== AST_NODE_TYPES.Identifier || !MUTATING_INSERT_METHODS.has(callee.property.name)) return;
+			const parameterDefinition = (context.sourceCode.getScope(node).references.find((reference) => reference.identifier === callee.object)?.resolved)?.defs.find((definition) => definition.type === TSESLint.Scope.DefinitionType.Parameter);
+			if (!parameterDefinition) return;
+			const parameterNode = parameterDefinition.name;
+			if (parameterNode.type !== AST_NODE_TYPES.Identifier || !parameterNode.typeAnnotation) return;
+			if (!isUnionArrayType(parameterNode.typeAnnotation.typeAnnotation)) return;
+			context.report({
+				node,
+				messageId: "unsound",
+				data: { method: callee.property.name },
+				fix(fixer) {
+					const typeAnnotation = parameterNode.typeAnnotation;
+					if (!typeAnnotation) return null;
+					const annotated = typeAnnotation.typeAnnotation;
+					if (annotated.type === AST_NODE_TYPES.TSArrayType) return fixer.insertTextBefore(annotated, "readonly ");
+					if (annotated.type === AST_NODE_TYPES.TSTypeReference && annotated.typeName.type === AST_NODE_TYPES.Identifier) return fixer.replaceText(annotated.typeName, "ReadonlyArray");
+					return null;
+				}
+			});
+		} };
+	}
+});
+//#endregion
 //#region src/rules/no-non-barrel-index.ts
 const INDEX_BASENAME = /^index\.[cm]?[tj]s$/;
 const noNonBarrelIndex = {
@@ -344,6 +443,76 @@ const noNonBarrelReexport = {
 	}
 };
 //#endregion
+//#region src/rules/no-object-assign.ts
+const createRule = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+function resolveFrom$1(scope, name) {
+	for (let current = scope; current; current = current.upper) {
+		const found = current.set.get(name);
+		if (found) return found;
+	}
+}
+const noObjectAssign = createRule({
+	name: "no-object-assign",
+	meta: {
+		type: "problem",
+		fixable: "code",
+		hasSuggestions: true,
+		docs: { description: "Disallow Object.assign, whose own type declarations do not check a source object's properties against the target's declared types -- object spread does." },
+		schema: [],
+		messages: {
+			unsound: "Object.assign does not verify that a source object's properties are assignable to the target's declared types, so a type mismatch here passes silently where a direct property assignment would be rejected. Use object spread ({ ...target, ...source }) to build a correctly type-checked replacement instead.",
+			suggestSpreadReassign: "Replace with object spread and reassignment (changes the object reference -- anything else already holding this object will not see the update)."
+		}
+	},
+	defaultOptions: [],
+	create(context) {
+		return { CallExpression(node) {
+			const { callee } = node;
+			if (!(callee.type === AST_NODE_TYPES.MemberExpression && !callee.computed && callee.object.type === AST_NODE_TYPES.Identifier && callee.object.name === "Object" && callee.property.type === AST_NODE_TYPES.Identifier && callee.property.name === "assign")) return;
+			const [target, ...sources] = node.arguments;
+			const sourcesAreSpreadable = sources.every((argument) => argument.type !== AST_NODE_TYPES.SpreadElement);
+			if (target?.type === AST_NODE_TYPES.ObjectExpression && sourcesAreSpreadable) {
+				const isBareStatement = node.parent.type === AST_NODE_TYPES.ExpressionStatement && node.parent.expression === node;
+				context.report({
+					node,
+					messageId: "unsound",
+					fix(fixer) {
+						const targetProps = target.properties.map((property) => context.sourceCode.getText(property));
+						const sourceSpreads = sources.map((argument) => `...${context.sourceCode.getText(argument)}`);
+						const objectLiteral = `{ ${[...targetProps, ...sourceSpreads].join(", ")} }`;
+						return fixer.replaceText(node, isBareStatement ? `(${objectLiteral})` : objectLiteral);
+					}
+				});
+				return;
+			}
+			if (target?.type === AST_NODE_TYPES.Identifier && sourcesAreSpreadable && node.parent.type === AST_NODE_TYPES.ExpressionStatement && node.parent.expression === node) {
+				const targetName = target.name;
+				const variable = resolveFrom$1(context.sourceCode.getScope(node), targetName);
+				const isConst = (variable?.defs.find((candidate) => candidate.type === TSESLint.Scope.DefinitionType.Variable))?.parent.kind === "const";
+				const statement = node.parent;
+				if (variable && !isConst) {
+					context.report({
+						node,
+						messageId: "unsound",
+						suggest: [{
+							messageId: "suggestSpreadReassign",
+							fix(fixer) {
+								const sourceSpreads = sources.map((argument) => `...${context.sourceCode.getText(argument)}`);
+								return fixer.replaceText(statement, `${targetName} = { ...${targetName}, ${sourceSpreads.join(", ")} };`);
+							}
+						}]
+					});
+					return;
+				}
+			}
+			context.report({
+				node,
+				messageId: "unsound"
+			});
+		} };
+	}
+});
+//#endregion
 //#region src/rules/no-pointless-reassignment.ts
 function isIdentifierReference(reference) {
 	return reference.identifier.type === "Identifier";
@@ -368,9 +537,12 @@ const plugin = {
 	rules: {
 		"barrel-direct-siblings-only": barrelDirectSiblingsOnly,
 		"barrel-policy": barrelPolicy,
+		"no-enum-number-widening": noEnumNumberWidening,
 		"no-index-files": noIndexFiles,
+		"no-mutable-union-array-param": noMutableUnionArrayParam,
 		"no-non-barrel-index": noNonBarrelIndex,
 		"no-non-barrel-reexport": noNonBarrelReexport,
+		"no-object-assign": noObjectAssign,
 		"no-pointless-reassignment": {
 			meta: {
 				type: "problem",
@@ -450,6 +622,8 @@ const plugin = {
 				linterOptions: { noInlineConfig: true },
 				rules: {
 					"exadev/barrel-policy": ["error", { mode: "banned" }],
+					"exadev/no-mutable-union-array-param": "error",
+					"exadev/no-object-assign": "error",
 					"exadev/no-pointless-reassignment": "error"
 				}
 			};
@@ -473,9 +647,14 @@ const recommendedTypeChecked = [
 		linterOptions: { noInlineConfig: true },
 		rules: {
 			"exadev/barrel-policy": ["error", { mode: "banned" }],
+			"exadev/no-enum-number-widening": "error",
+			"exadev/no-mutable-union-array-param": "error",
+			"exadev/no-object-assign": "error",
 			"exadev/no-pointless-reassignment": "error",
 			"@typescript-eslint/consistent-type-assertions": ["error", { assertionStyle: "never" }],
-			"@typescript-eslint/ban-ts-comment": ["error", { "ts-expect-error": true }]
+			"@typescript-eslint/ban-ts-comment": ["error", { "ts-expect-error": true }],
+			"@typescript-eslint/method-signature-style": ["error", "property"],
+			"@typescript-eslint/no-non-null-assertion": "error"
 		}
 	},
 	{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "exadev-eslint-config",
-  "version": "2.1.2",
+  "version": "2.3.0",
   "description": "Shared custom ESLint rules and plugin for ExaDev projects",
   "type": "module",
   "sideEffects": false,
@@ -38,6 +38,7 @@
   },
   "peerDependencies": {
     "eslint": ">=10.0.0",
+    "typescript": ">=4.8.4",
     "typescript-eslint": ">=8.0.0"
   },
   "devDependencies": {
@@ -48,6 +49,7 @@
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/git": "^11.0.1",
     "@types/node": "^24.9.2",
+    "@typescript-eslint/rule-tester": "^8.67.0",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^10.8.0",
     "husky": "^9.1.7",
@@ -57,9 +59,12 @@
     "tsdown": "^0.22.13",
     "turbo": "^2.10.8",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.65.0",
+    "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.10"
   },
+  "dependencies": {
+    "@typescript-eslint/utils": "^8.67.0"
+  },
   "scripts": {
     "build": "turbo run _build",
     "_build": "tsdown",