exadev-eslint-config 2.28.0 → 2.29.0

package/README.md

@@ -82,7 +82,6 @@ export default defineConfig(
 - **[`prefer-readonly`](https://typescript-eslint.io/rules/prefer-readonly/)**, **[`promise-function-async`](https://typescript-eslint.io/rules/promise-function-async/)**, **[`require-array-sort-compare`](https://typescript-eslint.io/rules/require-array-sort-compare/)** — plain presence, no extra config.
 - **[`strict-void-return`](https://typescript-eslint.io/rules/strict-void-return/)** — bans passing a value-returning function where a void-returning one is expected (e.g. `arr.forEach(x => otherArray.push(x))`).
   - *Why:* not yet in any typescript-eslint preset; this typechecks today only because of TS's own void-return contravariance leniency.
-- **[`switch-exhaustiveness-check`](https://typescript-eslint.io/rules/switch-exhaustiveness-check/)** — plain presence, no extra config.
 - **[`strict-boolean-expressions`](https://typescript-eslint.io/rules/strict-boolean-expressions/)** at the rule's own bare defaults.
   - *Why:* an unambiguous non-nullable truthy check stays allowed; an ambiguous nullable check does not.
 - **[`no-magic-numbers`](https://typescript-eslint.io/rules/no-magic-numbers/)** — tuned to exempt array indexes, enum members, readonly class properties, default parameter values, numeric literal types (e.g. `type Indent = 2 | 4`), and the handful of universally-idiomatic bare numbers (`-1`, `0`, `1`, `2`).
@@ -92,6 +91,11 @@ export default defineConfig(
   - *Why:* a deliberately loose backstop against a genuinely excessive number of REQUIRED parameters, distinct from `exadev/prefer-options-object-param` above, which already offers a real fix for the more common shape (a run of 2+ trailing OPTIONAL parameters) this rule structurally cannot see until the total count crosses its own threshold.
 - **[`no-warning-comments`](https://eslint.org/docs/latest/rules/no-warning-comments)** — bans any comment containing `Stryker disable`.
   - *Why:* that's Stryker's own mutation-testing suppression directive, invisible to `noInlineConfig` above since it isn't an eslint-disable comment.
+- **[`explicit-module-boundary-types`](https://typescript-eslint.io/rules/explicit-module-boundary-types/)**: an exported function or class member writes out its parameter and return types.
+  - *Why:* an inferred return type changes silently when the body does; `isolatedDeclarations` is the compiler-side alternative and is a tsconfig matter.
+- **[`switch-exhaustiveness-check`](https://typescript-eslint.io/rules/switch-exhaustiveness-check/)** set to `{ considerDefaultExhaustiveForUnions: false, requireDefaultForNonUnion: true }`.
+  - *Why:* a `default` branch cannot stand in for handling a newly added union member, and a switch over a non-union needs a `default` because the checker cannot prove its cases complete.
+- **Core robustness rules**: `eqeqeq`, `no-implicit-coercion`, `no-param-reassign`, `no-await-in-loop`, `require-atomic-updates`, `default-case-last`, `no-return-assign` and `max-depth`. See [Robustness rules](#robustness-rules).
 
 **Test files** (`**/*.{test,spec}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}`) get two narrow relaxations of this package's own additions, and only these two:
 
@@ -102,6 +106,30 @@ export default defineConfig(
 
 Nothing else inherited from the presets is relaxed.
 
+### Robustness rules
+
+Core ESLint rules that nothing in the typescript-eslint presets enables. All need no type information, so `plugin.configs.recommended` carries them as well, with the same settings except `no-implicit-coercion` (below).
+
+| Rule | Setting | Why |
+| --- | --- | --- |
+| [`eqeqeq`](https://eslint.org/docs/latest/rules/eqeqeq) | `always` | `== null` hides which of `null` and `undefined` the code means, so there is no `null` carve-out. |
+| [`no-implicit-coercion`](https://eslint.org/docs/latest/rules/no-implicit-coercion) | `{ boolean: false }` in the default export, defaults in `plugin.configs.recommended` | `!!value` is allowed where `strict-boolean-expressions` backs it, because that rule already rejects `!` on an operand whose truthiness is ambiguous (a nullable string or number). `plugin.configs.recommended` registers no typescript-eslint rules, so it keeps banning `!!`. `+value`, `'' + value` and similar stay banned in both. |
+| [`no-param-reassign`](https://eslint.org/docs/latest/rules/no-param-reassign) | `{ props: true }` | A parameter is the caller's value; assigning to it or to one of its properties is a hidden side effect. |
+| [`no-await-in-loop`](https://eslint.org/docs/latest/rules/no-await-in-loop) | on | Iterations that could run together run one after another. `for await` is allowed. |
+| [`require-atomic-updates`](https://eslint.org/docs/latest/rules/require-atomic-updates) | on | `total += await p` reads `total` before the `await` and writes it after, losing any update made in between. |
+| [`default-case-last`](https://eslint.org/docs/latest/rules/default-case-last) | on | A `default` that is not last hides the cases written after it. |
+| [`no-return-assign`](https://eslint.org/docs/latest/rules/no-return-assign) | `always` | Even a parenthesised assignment cannot be the returned value. |
+| [`max-depth`](https://eslint.org/docs/latest/rules/max-depth) | `{ max: 4 }` | The rule's own default, written out so a change to it cannot loosen the limit. |
+
+A loop that is sequential by design (migrations that must run in order, a rate-limited API) is exempted by a `files`-scoped override placed after the shared config, never by an inline disable comment, since `noInlineConfig` is on:
+
+```ts
+export default defineConfig(...exadevConfig(), {
+  files: ['src/migrations/**/*.ts'],
+  rules: { 'no-await-in-loop': 'off' },
+});
+```
+
 ## The lighter option: the `plugin` named export
 
 For a project that wants only this package's own rules without the full type-checked bundle, import the named `plugin` export and wire rules individually:
@@ -134,7 +162,7 @@ export default defineConfig([
   {
     files: ['**/*.ts'],
     plugins: { exadev: plugin },
-    extends: ['exadev/recommended'], // this plugin's own non-type-aware rules, plus linterOptions.noInlineConfig — no type-checked rules at all
+    extends: ['exadev/recommended'], // this plugin's own non-type-aware rules, the core robustness rules, plus linterOptions.noInlineConfig — no type-checked rules at all
     // or: extends: ['exadev/barrel'], // just the barrel-discipline trio (no-non-barrel-index, no-non-barrel-reexport, no-side-effects-in-index)
   },
 ]);
@@ -374,6 +402,7 @@ Bundled into `exadevConfig()`'s default output the same way React/Next.js auto-d
 | `non-vacuous-guard` | | **A guard test must show it can fail:** an unconditional lower bound on what it discovered, and its pattern checked against an input it must catch and one it must not. Wired by `testHygieneConfig`. See [Guard and conformance test hygiene](#guard-and-conformance-test-hygiene). |
 | `no-multiline-template-literal` | ✓ | **An untagged template literal whose value spans several lines should be an array of lines joined with `\n`.** Autofixes only when the rewrite provably yields the same string. See [Multi-line template literals](#multi-line-template-literals). |
 | `markdown-required-heading` | | **A Markdown document must contain each configured heading:** a `{ depth, text }` per required heading, matched on the text as it renders. A Markdown-language rule (`@eslint/markdown`). Wired by `markdownHeadingsConfig`. See [Required Markdown headings](#required-markdown-headings). |
+| `no-defensive-fallback` | | **An empty-literal fallback hides a value that should have been modelled as absent.** Reports `value ?? []`, `value || ''` and the logical-assignment forms for an empty array, object or string, `0`, `false` or `null`, and a `catch` clause or `.catch()` handler that discards the error and returns nothing or a fixed value. Opt-in, not part of `recommended` or the default export. Needs no type information. See [Defensive fallbacks](#defensive-fallbacks). |
 | `timeout-aborts-request` | | **A `Promise.race` timeout must abort the request it raced against,** not only settle the race: the timer callback calls `.abort()` on an `AbortController` created in the same function, the timer id is cleared in a `finally`, and a `catch` returns early on `controller.signal.aborted`. Opt-in, needs no type information. See [Timeout races](#timeout-races). |
 | `no-non-serialisable-server-prop` | | **A configured prop (default `component`) of a JSX element in a file without `"use client"` must be serialisable data.** A function or component reference cannot cross from a server component to a client component. Enabled by the Next.js preset. See [Server component boundary](#server-component-boundary). |
 | `no-external-member-jsx-tag` | | **A member tag (`<Lib.Icon>`) rooted at an import from a package, in a file without `"use client"`, is reported.** Statics a library attaches after export may not survive the server component boundary. Enabled by the Next.js preset. See [Server component boundary](#server-component-boundary). |
@@ -735,6 +764,35 @@ The rule is syntactic and reads one function. It cannot see that a helper the ra
 
 Off unless enabled (`'exadev/timeout-aborts-request': 'error'` with the plugin registered), and not in `recommended`, since a project chooses to adopt the shape.
 
+## Defensive fallbacks
+
+A fallback on a value that really can be absent turns the absence into a plausible answer, and the wrong result surfaces far from the cause. `@typescript-eslint/no-unnecessary-condition` reports only the fallbacks the types already prove unnecessary; `exadev/no-defensive-fallback` reports the ones they do not, by shape alone:
+
+- a `??` or `||` (or `??=` / `||=`) whose right operand is an empty array, empty object, empty string (`''`, `""` or an empty template), `0`, `0n`, `false` or `null`, including one behind `as`, `satisfies` or `<T>`;
+- a `catch` clause whose body is empty (a comment-only body included), or holds one `continue` or one `return` that gives back nothing or a fixed value: a literal, `undefined`, `void 0`, or an array or object built only from those;
+- a `.catch(handler)` or `.then(onFulfilled, handler)` whose rejection handler does the same, as an expression-bodied arrow or a function body.
+
+A catch that does anything else with the error (logs it, rethrows it, returns something computed from it) is not reported. The fix is to model absence as `T | undefined` and handle it where it is meaningful, or to let the failure reach the caller.
+
+It is opt-in: it is in neither `plugin.configs.recommended` nor the default export, because a configuration reader legitimately treats a missing optional field as empty, and that boundary differs per repository. `allow` lists the files where the fallback is at such a boundary, each with a `reason` (required, so the exemption explains itself where it is configured, since `noInlineConfig` leaves no comment to do so). `files` follows the [file glob dialect](#file-level-rules), so a glob without a `/` names a file at any depth.
+
+Two shapes are reported although they are sometimes right, and the fix for both is an `allow` entry. A predicate that turns a failure into `false` (`try { JSON.parse(text); return true; } catch { return false; }`) is reported as a catch that returns a fixed value. `.catch` is matched on any receiver, so a schema fallback such as Zod's `z.string().catch('')` is reported as a promise handler when it is written as a function returning a fixed value.
+
+```ts
+export default defineConfig(...exadevConfig(), {
+  files: ['src/**/*.ts'],
+  plugins: { exadev: plugin },
+  rules: {
+    'exadev/no-defensive-fallback': [
+      'error',
+      { allow: [{ files: ['src/config/**'], reason: 'optional settings default to empty at the parsing boundary' }] },
+    ],
+  },
+});
+```
+
+Overlap: core `no-empty` already reports a catch block with no statements and no comment; this rule also reports the comment-only block, which `no-empty` accepts.
+
 ## Workspace architecture
 
 Six rules (`no-uphill-dependency`, `no-dependency-cycle`, `package-name-mirrors-path`, `package-has-files`, `dev-dependency-only`, `required-scripts`) share one options object, `WorkspaceArchitectureOptions`, describing a pnpm workspace's own dependency-direction rules (which package is allowed to depend on which other, checked directly against every `package.json`'s declared `dependencies`) and the per-package requirements layered on the same groups. The last four rules are opt-in within it: each does nothing unless its own option is given. Off by default, since `groups` has no sensible default; enable it either through `exadevConfig({ workspaceArchitecture })` (the full bundle) or the standalone `workspaceArchitectureConfig(options)` export (for a consumer building its own config from the lighter `plugin` export, e.g. one that isn't using `exadevConfig()` at all):
@@ -1132,6 +1190,7 @@ pnpm build
 - [`src/create-config.ts`](src/create-config.ts) is config assembly's single source of truth.
   - `exadevConfig(options, ...userConfigs)` concatenates, in order: `buildGitignoreConfig`, `recommendedTypeChecked`, `jsdocAndTsdoc`, `jsonCanonicalConfig`, `stylisticCommentsConfig`, `buildReactConfig`, `buildNextjsConfig`, `buildPackageJsonKeyOrderConfig` (each tri-state builder fed its matching option), `buildWorkspaceArchitectureConfig` (only when `workspaceArchitecture` is given; there is no auto-detected default), `buildTurboConfig` (only when `turbo` is given, likewise), `buildImportPolicyConfig` (only when `importPolicies` is given, likewise), `buildPureModulesConfig` (only when `pureModules` is given, likewise), `buildTestHygieneConfig` (only when `testHygiene` is given, likewise), `buildMarkdownHeadingsConfig` (only when `markdownHeadings` is given, likewise), and any trailing user configs.
   - `defaultConfig` is `exadevConfig()` evaluated once, eagerly, at module load.
+- [`src/robustness-rules.ts`](src/robustness-rules.ts) holds `UNTYPED_ROBUSTNESS_RULES`, the core ESLint rules that need no type information, spread into both `plugin.configs.recommended` and the type-checked block so the two cannot drift apart.
 - [`src/stylistic-comments.ts`](src/stylistic-comments.ts) builds `stylisticCommentsConfig`: the hand-picked `@stylistic/eslint-plugin` rules plus this package's own `exadev/prefer-doc-comment`, in two blocks (one scoped to every JS/TS file, one scoped to JSX files only for the three JSX-specific rules). See [Stylistic comment, class-member and JSX rules](#stylistic-comment-class-member-and-jsx-rules).
 - [`src/index.ts`](src/index.ts) is the entry point, still a pure re-export barrel:
   ```ts

package/dist/index.cjs

@@ -184,7 +184,7 @@ function buildGitignoreConfig(options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "2.28.0";
+var version = "2.29.0";
 //#endregion
 //#region src/is-record.ts
 /**
@@ -320,6 +320,28 @@ function toPublicPlugin(built) {
 	return built;
 }
 //#endregion
+//#region src/robustness-rules.ts
+/**
+* Core ESLint robustness rules that need neither type information nor the typescript-eslint plugin, so both `plugin.configs.recommended` and the default export enable them with identical settings. `no-implicit-coercion` is deliberately absent: its best setting depends on whether `@typescript-eslint/strict-boolean-expressions` is also on, which only the default export can say.
+*
+* - `eqeqeq` is `always` with no `null` carve-out: `== null` hides which of `null` and `undefined` the code means.
+* - `no-param-reassign` with `props: true` covers assignment to a parameter's properties as well as the parameter itself; a parameter is the caller's value, not a local to rewrite.
+* - `no-await-in-loop` assumes iterations are independent. A loop that is sequential by design is exempted by a `files`-scoped override in the consumer's config (`noInlineConfig` rules out a disable comment), never by weakening the rule globally.
+* - `require-atomic-updates` catches a read-modify-write that spans an `await`, where another task can change the value in between.
+* - `default-case-last` keeps `default` from hiding the cases written after it.
+* - `no-return-assign` is `always`, so even a parenthesised assignment cannot be the returned value.
+* - `max-depth` is stated at the rule's own default of four nested blocks so a future change to that default cannot loosen it.
+*/
+const UNTYPED_ROBUSTNESS_RULES = {
+	"default-case-last": "error",
+	eqeqeq: ["error", "always"],
+	"max-depth": ["error", { max: 4 }],
+	"no-await-in-loop": "error",
+	"no-param-reassign": ["error", { props: true }],
+	"no-return-assign": ["error", "always"],
+	"require-atomic-updates": "error"
+};
+//#endregion
 //#region src/rules/barrel-helpers.ts
 /**
 * Reusable across rules: the basename an index file has, matching ts/tsx/js/jsx/mjs/mts/cjs/cts. Identical to no-non-barrel-index's own INDEX_BASENAME — deliberately duplicated as the single declared constant both modules import, rather than each rule re-deriving the regex.
@@ -1380,7 +1402,7 @@ function readSelector(value, optionName, context) {
 		...typeof namePattern === "string" && { namePattern }
 	};
 }
-const ALLOW_KEYS = [
+const ALLOW_KEYS$1 = [
 	"from",
 	"to",
 	"reason"
@@ -1388,7 +1410,7 @@ const ALLOW_KEYS = [
 function readAllow(value) {
 	const seen = /* @__PURE__ */ new Set();
 	return readArray$1(value, "allow").map((entry) => {
-		const fields = readEntry$1(entry, "allow", ALLOW_KEYS);
+		const fields = readEntry$1(entry, "allow", ALLOW_KEYS$1);
 		const from = readNonEmptyString$1(fields["from"], "allow", "\"from\"");
 		const to = readNonEmptyString$1(fields["to"], "allow", "\"to\"");
 		const reason = readNonEmptyString$1(fields["reason"], "allow", "\"reason\" (an exception must say why it exists)");
@@ -2225,18 +2247,18 @@ function createEntryScope(globs) {
 }
 //#endregion
 //#region src/rules/filename-pattern.ts
-const OPTION_NAME$12 = "exadev/filename-pattern";
+const OPTION_NAME$13 = "exadev/filename-pattern";
 /**
 * The placeholder in a `sibling` template that stands for the linted file's name without its final extension (`Button` for `Button.tsx`).
 */
 const SIBLING_NAME_PLACEHOLDER = "{name}";
 function readPattern(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "string" || value.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "pattern" to be a non-empty regular expression source.`);
+	if (typeof value !== "string" || value.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "pattern" to be a non-empty regular expression source.`);
 	try {
 		new RegExp(value, "u");
 	} catch (error) {
-		throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "pattern" to be a valid regular expression, but "${value}" is not: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "pattern" to be a valid regular expression, but "${value}" is not: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 	}
 	return {
 		source: value,
@@ -2246,32 +2268,32 @@ function readPattern(value) {
 const UNKNOWN_PLACEHOLDER = /\{(?!name\})[^{}]*\}/u;
 function readSiblings(value) {
 	if (value === void 0) return [];
-	const siblings = readRequiredStrings({ sibling: typeof value === "string" ? [value] : value }, "sibling", OPTION_NAME$12);
+	const siblings = readRequiredStrings({ sibling: typeof value === "string" ? [value] : value }, "sibling", OPTION_NAME$13);
 	const unknown = siblings.find((template) => UNKNOWN_PLACEHOLDER.test(template));
-	if (unknown !== void 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" has a "sibling" template "${unknown}" with a placeholder other than ${SIBLING_NAME_PLACEHOLDER}.`);
+	if (unknown !== void 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" has a "sibling" template "${unknown}" with a placeholder other than ${SIBLING_NAME_PLACEHOLDER}.`);
 	return siblings;
 }
 function readOverLines(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "overLines" to be a non-negative integer.`);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "overLines" to be a non-negative integer.`);
 	return value;
 }
 /**
 * Validates the rule's option list, compiling each entry. Throws naming the offending field, including a `pattern` that is not a valid regular expression.
 */
 function readFilenamePatternEntries(value) {
-	return readEntryRecords(value, OPTION_NAME$12).map((entry) => {
+	return readEntryRecords(value, OPTION_NAME$13).map((entry) => {
 		assertOnlyKeys(entry, [
 			"files",
 			"pattern",
 			"sibling",
 			"overLines"
-		], OPTION_NAME$12);
+		], OPTION_NAME$13);
 		const pattern = readPattern(entry["pattern"]);
 		const siblings = readSiblings(entry["sibling"]);
-		if (pattern === void 0 && siblings.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs every entry to have a "pattern" or a "sibling".`);
+		if (pattern === void 0 && siblings.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs every entry to have a "pattern" or a "sibling".`);
 		return {
-			inScope: createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$12}.files`)),
+			inScope: createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$13}.files`)),
 			pattern,
 			siblings,
 			overLines: readOverLines(entry["overLines"])
@@ -2408,7 +2430,7 @@ function stripNodePrefixFromPattern(pattern) {
 }
 //#endregion
 //#region src/rules/import-policy-options.ts
-const OPTION_NAME$11 = "importPolicies";
+const OPTION_NAME$12 = "importPolicies";
 const GLOB_CHARACTERS$1 = /[*?[\]{}]/u;
 const stringList$1 = {
 	type: "array",
@@ -2553,28 +2575,28 @@ function readExceptEdge(entry, name) {
 }
 function assertEdgeIsLive(edge, policy) {
 	const root = "/";
-	if (!createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)])(`${root}${edge.file}`, root)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" exception for "${edge.file}" names a file the policy's files do not select, so it can never apply.`);
+	if (!createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)])(`${root}${edge.file}`, root)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" exception for "${edge.file}" names a file the policy's files do not select, so it can never apply.`);
 	const file = `${root}${edge.file}`;
-	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
+	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
 }
 /**
 * Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
 */
 function readImportPolicies(value) {
-	return readEntryRecords(value, OPTION_NAME$11).map((entry) => {
+	return readEntryRecords(value, OPTION_NAME$12).map((entry) => {
 		assertOnlyKeys(entry, [
 			"files",
 			"ignores",
 			"deny",
 			"confine",
 			"exceptEdges"
-		], OPTION_NAME$11);
-		const files = readFileGlobs(entry["files"], `${OPTION_NAME$11}.files`);
-		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$11}.ignores`);
-		const deny = readOptionalList(entry, "deny", OPTION_NAME$11, readDeny);
-		const confine = readOptionalList(entry, "confine", OPTION_NAME$11, readConfine);
-		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$11, readExceptEdge);
-		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" needs every policy to have at least one "deny" or "confine" entry.`);
+		], OPTION_NAME$12);
+		const files = readFileGlobs(entry["files"], `${OPTION_NAME$12}.files`);
+		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$12}.ignores`);
+		const deny = readOptionalList(entry, "deny", OPTION_NAME$12, readDeny);
+		const confine = readOptionalList(entry, "confine", OPTION_NAME$12, readConfine);
+		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$12, readExceptEdge);
+		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs every policy to have at least one "deny" or "confine" entry.`);
 		const policy = {
 			files,
 			...ignores !== void 0 && { ignores },
@@ -2724,7 +2746,7 @@ const importPolicy = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) =>
 });
 //#endregion
 //#region src/rules/injected-test-hygiene.ts
-const OPTION_NAME$10 = "injected-test-hygiene";
+const OPTION_NAME$11 = "injected-test-hygiene";
 /**
 * The rule's option schema.
 */
@@ -2759,9 +2781,9 @@ function wildcardToRegExp(pattern) {
 * Validates the options and compiles the assertion names. Throws naming the rule for anything the schema lets through: options that are not an object, an unknown key, or an `assertFunctionNames` or `reportDisabled` of the wrong type.
 */
 function readInjectedTestHygieneOptions(value) {
-	const prefix = `@exadev/eslint-config: "${OPTION_NAME$10}"`;
+	const prefix = `@exadev/eslint-config: "${OPTION_NAME$11}"`;
 	if (!isRecord(value)) throw new Error(`${prefix} must be an object.`);
-	assertOnlyKeys(value, ["assertFunctionNames", "reportDisabled"], OPTION_NAME$10);
+	assertOnlyKeys(value, ["assertFunctionNames", "reportDisabled"], OPTION_NAME$11);
 	const { assertFunctionNames, reportDisabled } = value;
 	if (reportDisabled !== void 0 && typeof reportDisabled !== "boolean") throw new Error(`${prefix} needs "reportDisabled" to be a boolean when given.`);
 	if (assertFunctionNames !== void 0 && (!Array.isArray(assertFunctionNames) || assertFunctionNames.length === 0 || !assertFunctionNames.every((name) => typeof name === "string" && name.length > 0))) throw new Error(`${prefix} needs "assertFunctionNames" to be a non-empty array of non-empty strings when given.`);
@@ -2772,7 +2794,7 @@ function readInjectedTestHygieneOptions(value) {
 		reportDisabled: reportDisabled ?? true
 	};
 }
-const createRule$14 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+const createRule$15 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
 const API_KINDS = /* @__PURE__ */ new Map([
 	["describe", "describe"],
 	["suite", "describe"],
@@ -2838,8 +2860,8 @@ function isCalleeOfCall(node) {
 /**
 * Requires the test functions a conformance kit receives as parameters (`runConformance({ describe, it })`, or `run(t)` calling `t.it(...)`) to meet the hygiene `@vitest/eslint-plugin` asks of imported ones: no `.only`, no `.skip`, and an assertion in every test body. That plugin resolves a parameter named like a test function as a local binding and skips it, so its `expect-expect`, `no-disabled-tests` and `no-focused-tests` never fire inside such a kit. A test function is recognised as a parameter of the enclosing function named `describe`, `suite`, `it` or `test` (directly, or destructured under its own or a renamed local name), or as the `describe`, `suite`, `it` or `test` property of any parameter. The check is syntactic: a helper called from a test body counts as an assertion only when its name is listed in `assertFunctionNames`.
 */
-const injectedTestHygiene = createRule$14({
-	name: OPTION_NAME$10,
+const injectedTestHygiene = createRule$15({
+	name: OPTION_NAME$11,
 	meta: {
 		type: "problem",
 		docs: { description: "Require the test functions a kit receives as parameters to be free of .only and .skip and to assert, since @vitest/eslint-plugin cannot see them." },
@@ -3016,7 +3038,7 @@ const MUTATING_INSERT_METHODS$1 = /* @__PURE__ */ new Set([
 	"fill",
 	"copyWithin"
 ]);
-const createRule$13 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+const createRule$14 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
 function isArrayIsArrayCall(node) {
 	return node.type === _typescript_eslint_utils.AST_NODE_TYPES.CallExpression && node.callee.type === _typescript_eslint_utils.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && node.callee.object.name === "Array" && node.callee.property.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && node.callee.property.name === "isArray";
 }
@@ -3028,7 +3050,7 @@ function definitelyExits$2(statement) {
 	}
 	return false;
 }
-const noArrayIsArrayMutation = createRule$13({
+const noArrayIsArrayMutation = createRule$14({
 	name: "no-array-isarray-mutation",
 	meta: {
 		type: "problem",
@@ -3504,6 +3526,175 @@ const noControlFlow = {
 	}
 };
 //#endregion
+//#region src/rules/type-only-wrapper.ts
+function isTypeOnlyWrapper(node) {
+	return node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSAsExpression || node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSSatisfiesExpression || node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSTypeAssertion;
+}
+/**
+* The expression that `node` stands for at runtime once every enclosing type-only wrapper is removed.
+*/
+function unwrapTypeOnly(node) {
+	return isTypeOnlyWrapper(node) ? unwrapTypeOnly(node.expression) : node;
+}
+//#endregion
+//#region src/rules/no-defensive-fallback.ts
+const OPTION_NAME$10 = "exadev/no-defensive-fallback";
+const OPTION_KEYS = ["allow"];
+const ALLOW_KEYS = ["files", "reason"];
+const createRule$13 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+/**
+* Reads the `allow` option into one `FileScope` per entry. Each entry needs `files` (globs, relative to ESLint's working directory; a glob without a `/` names a file at any depth) and a `reason`, which is not used at lint time: it is required so every exemption explains itself where it is configured, as `noInlineConfig` leaves no comment to do so.
+*/
+function readAllowedScopes(options) {
+	if (!isRecord(options)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$10}" options must be an object.`);
+	assertOnlyKeys(options, OPTION_KEYS, OPTION_NAME$10);
+	const { allow } = options;
+	if (allow === void 0) return [];
+	return readEntryRecords(allow, `${OPTION_NAME$10} allow`).map((entry) => {
+		assertOnlyKeys(entry, ALLOW_KEYS, `${OPTION_NAME$10} allow entry`);
+		readRequiredString(entry, "reason", `${OPTION_NAME$10} allow entry`);
+		return createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$10} allow files`));
+	});
+}
+/**
+* Whether `node` is a literal for "nothing here": an empty array, empty object, empty string (quoted or an untagged template with no content), `0`, `0n`, `false` or `null`.
+*/
+function isEmptyLiteral(node) {
+	const target = unwrapTypeOnly(node);
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.ArrayExpression) return target.elements.length === 0;
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.ObjectExpression) return target.properties.length === 0;
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.TemplateLiteral) return target.expressions.length === 0 && target.quasis.every((quasi) => quasi.value.cooked === "");
+	return target.type === _typescript_eslint_utils.AST_NODE_TYPES.Literal && (target.raw === "null" || target.value === "" || target.value === 0 || target.value === BigInt(0) || target.value === false);
+}
+/**
+* Whether `node` is a fixed value known from the source alone, with no identifier but `undefined` and no call, so a function returning it cannot be reporting anything about the error it caught.
+*/
+function isConstantValue(node) {
+	const target = unwrapTypeOnly(node);
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.Literal) return true;
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier) return target.name === "undefined";
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.TemplateLiteral) return target.expressions.length === 0;
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.UnaryExpression) return (target.operator === "-" || target.operator === "+" || target.operator === "!" || target.operator === "void") && isConstantValue(target.argument);
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.ArrayExpression) return target.elements.every((element) => element === null || element.type !== _typescript_eslint_utils.AST_NODE_TYPES.SpreadElement && isConstantValue(element));
+	if (target.type === _typescript_eslint_utils.AST_NODE_TYPES.ObjectExpression) return target.properties.every((property) => property.type === _typescript_eslint_utils.AST_NODE_TYPES.Property && !property.computed && !property.method && isConstantValue(property.value));
+	return false;
+}
+/**
+* How a block that stands in for error handling ends without handling anything, or `undefined` when it does something else. A block is swallowing when it is empty (a comment-only block included) or holds exactly one `continue`, or one `return` that gives back nothing or a constant value.
+*/
+function swallowOutcome(body) {
+	const [only] = body;
+	if (only === void 0) return "does nothing";
+	if (only.type === _typescript_eslint_utils.AST_NODE_TYPES.ContinueStatement) return "skips to the next iteration";
+	if (only.type !== _typescript_eslint_utils.AST_NODE_TYPES.ReturnStatement) return void 0;
+	if (only.argument === null) return "returns nothing";
+	return isConstantValue(only.argument) ? "returns a fixed value" : void 0;
+}
+function isHandlerFunction(node) {
+	return node.type === _typescript_eslint_utils.AST_NODE_TYPES.ArrowFunctionExpression || node.type === _typescript_eslint_utils.AST_NODE_TYPES.FunctionExpression;
+}
+/**
+* How a function passed to `.catch(...)` swallows the rejection, or `undefined` when it does not. An arrow with an expression body swallows when that expression is a constant value.
+*/
+function rejectionHandlerOutcome(handler) {
+	if (handler.body.type === _typescript_eslint_utils.AST_NODE_TYPES.BlockStatement) return swallowOutcome(handler.body.body);
+	return isConstantValue(handler.body) ? "returns a fixed value" : void 0;
+}
+function isMethodCall(node, name) {
+	const { callee } = node;
+	return callee.type === _typescript_eslint_utils.AST_NODE_TYPES.MemberExpression && callee.property.type === _typescript_eslint_utils.AST_NODE_TYPES.Identifier && callee.property.name === name;
+}
+/**
+* The rejection handler of a promise call and what to call it in a report: the only argument of `.catch(handler)`, or the second of `.then(onFulfilled, handler)`. `undefined` for any other call, or when the argument list is not exactly that shape.
+*/
+function rejectionHandlerOf(node) {
+	const [first, second, ...rest] = node.arguments;
+	if (isMethodCall(node, "catch") && first !== void 0 && second === void 0) return {
+		handler: first,
+		construct: ".catch() handler"
+	};
+	if (isMethodCall(node, "then") && second !== void 0 && rest.length === 0) return {
+		handler: second,
+		construct: ".then() rejection handler"
+	};
+}
+const noDefensiveFallback = createRule$13({
+	name: "no-defensive-fallback",
+	meta: {
+		type: "suggestion",
+		docs: { description: "Disallow an empty-literal fallback after ?? or ||, and a catch that discards the error and returns nothing or a fixed value." },
+		schema: [{
+			type: "object",
+			properties: { allow: {
+				type: "array",
+				items: {
+					type: "object",
+					properties: {
+						files: entryFilesSchema,
+						reason: {
+							type: "string",
+							minLength: 1
+						}
+					},
+					required: ["files", "reason"],
+					additionalProperties: false
+				}
+			} },
+			additionalProperties: false
+		}],
+		messages: {
+			emptyFallback: "A fallback of `{{ fallback }}` after `{{ operator }}` turns a missing value into a plausible one, so the absence never reaches the code that could handle it. Model the value as `T | undefined` and handle the absence where it is meaningful, or list this file under \"allow\" with a reason.",
+			swallowedError: "This {{ construct }} discards the error and {{ outcome }}, so a failure becomes indistinguishable from success. Rethrow it, handle it, or let the caller see it, or list this file under \"allow\" with a reason."
+		},
+		defaultOptions: [{}]
+	},
+	create(context, [options]) {
+		if (readAllowedScopes(options).some((inScope) => inScope(context.filename, context.cwd))) return {};
+		function reportFallback(operator, right) {
+			if (isEmptyLiteral(right)) context.report({
+				node: right,
+				messageId: "emptyFallback",
+				data: {
+					operator,
+					fallback: context.sourceCode.getText(right)
+				}
+			});
+		}
+		return {
+			LogicalExpression(node) {
+				if (node.operator === "||" || node.operator === "??") reportFallback(node.operator, node.right);
+			},
+			AssignmentExpression(node) {
+				if (node.operator === "||=" || node.operator === "??=") reportFallback(node.operator, node.right);
+			},
+			CatchClause(node) {
+				const outcome = swallowOutcome(node.body.body);
+				if (outcome !== void 0) context.report({
+					node,
+					messageId: "swallowedError",
+					data: {
+						construct: "catch clause",
+						outcome
+					}
+				});
+			},
+			CallExpression(node) {
+				const rejection = rejectionHandlerOf(node);
+				if (rejection === void 0 || !isHandlerFunction(rejection.handler)) return;
+				const outcome = rejectionHandlerOutcome(rejection.handler);
+				if (outcome !== void 0) context.report({
+					node: rejection.handler,
+					messageId: "swallowedError",
+					data: {
+						construct: rejection.construct,
+						outcome
+					}
+				});
+			}
+		};
+	}
+});
+//#endregion
 //#region src/rules/no-dependency-cycle.ts
 /**
 * Reports a workspace dependency that can reach back to the declaring package: a cycle. This is NOT covered by no-uphill-dependency, and the distinction matters: that rule permits a same-rank (or, within a slice, a same-slice) dependency, so two packages at the same rank depending on each other passes it while still being a cycle. Turborepo does reject a cyclic task graph, but only once the whole graph is assembled, by which point a large refactor has already moved everything; reporting it at the manifest, where the edge is declared, names the two packages and the direction to reverse.
@@ -4677,7 +4868,7 @@ function renderLine(line) {
 function needsLiteralType(node) {
 	let child = node;
 	for (let parent = node.parent; parent !== void 0; child = parent, parent = parent.parent) {
-		if (parent.type === _typescript_eslint_utils.AST_NODE_TYPES.TSAsExpression || parent.type === _typescript_eslint_utils.AST_NODE_TYPES.TSSatisfiesExpression || parent.type === _typescript_eslint_utils.AST_NODE_TYPES.TSTypeAssertion) return true;
+		if (isTypeOnlyWrapper(parent)) return true;
 		if (parent.type === _typescript_eslint_utils.AST_NODE_TYPES.TSEnumMember) return parent.initializer === child;
 		if (parent.type === _typescript_eslint_utils.AST_NODE_TYPES.VariableDeclarator) return parent.init === child && parent.id.typeAnnotation !== void 0;
 		if (parent.type === _typescript_eslint_utils.AST_NODE_TYPES.PropertyDefinition) return parent.value === child && parent.typeAnnotation !== void 0;
@@ -4948,7 +5139,7 @@ function isSerialisableData(node) {
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.UnaryExpression) return true;
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.ArrayExpression) return node.elements.every((element) => element === null || element.type !== _typescript_eslint_utils.AST_NODE_TYPES.SpreadElement && isSerialisableData(element));
 	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.ObjectExpression) return node.properties.every((property) => property.type === _typescript_eslint_utils.AST_NODE_TYPES.Property && (!property.computed || isSerialisableData(property.key)) && isSerialisableData(property.value));
-	if (node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSAsExpression || node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSSatisfiesExpression || node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSNonNullExpression) return isSerialisableData(node.expression);
+	if (isTypeOnlyWrapper(node) || node.type === _typescript_eslint_utils.AST_NODE_TYPES.TSNonNullExpression) return isSerialisableData(node.expression);
 	return false;
 }
 const createRule$10 = _typescript_eslint_utils.ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
@@ -5335,7 +5526,7 @@ function isShorthandPropertyRead(sourceCode, identifier) {
 function isExportedAlias(declarationParentType, programBody, resolve, aliasVariable) {
 	if (declarationParentType === "ExportNamedDeclaration") return true;
 	return programBody.some((statement) => {
-		if (statement.type === "ExportNamedDeclaration" && statement.source == null) return (statement.specifiers ?? []).some((specifier) => specifier.local.type === "Identifier" && specifier.local.name !== void 0 && resolve(specifier.local.name) === aliasVariable);
+		if (statement.type === "ExportNamedDeclaration" && (statement.source === void 0 || statement.source === null)) return (statement.specifiers ?? []).some((specifier) => specifier.local.type === "Identifier" && specifier.local.name !== void 0 && resolve(specifier.local.name) === aliasVariable);
 		const target = statement.type === "ExportDefaultDeclaration" ? statement.declaration : void 0;
 		return target?.type === "Identifier" && target.name !== void 0 && resolve(target.name) === aliasVariable;
 	});
@@ -8509,6 +8700,7 @@ const plugin = {
 		"no-array-isarray-mutation": noArrayIsArrayMutation,
 		"no-boundaries-ignore": noBoundariesIgnore,
 		"no-control-flow": noControlFlow,
+		"no-defensive-fallback": noDefensiveFallback,
 		"no-dependency-cycle": no_dependency_cycle_default,
 		"no-enum-number-widening": noEnumNumberWidening,
 		"no-enum-reverse-lookup-widening": noEnumReverseLookupWidening,
@@ -8559,6 +8751,7 @@ const plugin = {
 				plugins: { exadev: plugin },
 				linterOptions: { noInlineConfig: true },
 				rules: {
+					...UNTYPED_ROBUSTNESS_RULES,
 					"exadev/barrel-policy": ["error", { mode: "banned" }],
 					"exadev/no-mutable-union-array-param": "error",
 					"exadev/no-object-assign": "error",
@@ -8566,7 +8759,8 @@ const plugin = {
 					"exadev/prefer-options-object-param": "error",
 					"exadev/prefer-readonly-array-param": "error",
 					"exadev/test-file-kind": "error",
-					"max-params": ["error", { max: 4 }]
+					"max-params": ["error", { max: 4 }],
+					"no-implicit-coercion": "error"
 				}
 			};
 		},
@@ -8992,6 +9186,7 @@ const recommendedTypeChecked = [
 		plugins: { exadev: plugin },
 		linterOptions: { noInlineConfig: true },
 		rules: {
+			...UNTYPED_ROBUSTNESS_RULES,
 			"exadev/barrel-policy": "error",
 			"exadev/no-array-isarray-mutation": "error",
 			"exadev/no-enum-number-widening": "error",
@@ -9034,7 +9229,12 @@ const recommendedTypeChecked = [
 			"@typescript-eslint/require-array-sort-compare": "error",
 			"@typescript-eslint/strict-boolean-expressions": "error",
 			"@typescript-eslint/strict-void-return": "error",
-			"@typescript-eslint/switch-exhaustiveness-check": "error",
+			"@typescript-eslint/explicit-module-boundary-types": "error",
+			"@typescript-eslint/switch-exhaustiveness-check": ["error", {
+				considerDefaultExhaustiveForUnions: false,
+				requireDefaultForNonUnion: true
+			}],
+			"no-implicit-coercion": ["error", { boolean: false }],
 			"max-lines": ["error", {
 				max: 800,
 				skipBlankLines: true,

package/dist/index.js

@@ -149,7 +149,7 @@ function buildGitignoreConfig(options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "2.28.0";
+var version = "2.29.0";
 //#endregion
 //#region src/is-record.ts
 /**
@@ -285,6 +285,28 @@ function toPublicPlugin(built) {
 	return built;
 }
 //#endregion
+//#region src/robustness-rules.ts
+/**
+* Core ESLint robustness rules that need neither type information nor the typescript-eslint plugin, so both `plugin.configs.recommended` and the default export enable them with identical settings. `no-implicit-coercion` is deliberately absent: its best setting depends on whether `@typescript-eslint/strict-boolean-expressions` is also on, which only the default export can say.
+*
+* - `eqeqeq` is `always` with no `null` carve-out: `== null` hides which of `null` and `undefined` the code means.
+* - `no-param-reassign` with `props: true` covers assignment to a parameter's properties as well as the parameter itself; a parameter is the caller's value, not a local to rewrite.
+* - `no-await-in-loop` assumes iterations are independent. A loop that is sequential by design is exempted by a `files`-scoped override in the consumer's config (`noInlineConfig` rules out a disable comment), never by weakening the rule globally.
+* - `require-atomic-updates` catches a read-modify-write that spans an `await`, where another task can change the value in between.
+* - `default-case-last` keeps `default` from hiding the cases written after it.
+* - `no-return-assign` is `always`, so even a parenthesised assignment cannot be the returned value.
+* - `max-depth` is stated at the rule's own default of four nested blocks so a future change to that default cannot loosen it.
+*/
+const UNTYPED_ROBUSTNESS_RULES = {
+	"default-case-last": "error",
+	eqeqeq: ["error", "always"],
+	"max-depth": ["error", { max: 4 }],
+	"no-await-in-loop": "error",
+	"no-param-reassign": ["error", { props: true }],
+	"no-return-assign": ["error", "always"],
+	"require-atomic-updates": "error"
+};
+//#endregion
 //#region src/rules/barrel-helpers.ts
 /**
 * Reusable across rules: the basename an index file has, matching ts/tsx/js/jsx/mjs/mts/cjs/cts. Identical to no-non-barrel-index's own INDEX_BASENAME — deliberately duplicated as the single declared constant both modules import, rather than each rule re-deriving the regex.
@@ -1345,7 +1367,7 @@ function readSelector(value, optionName, context) {
 		...typeof namePattern === "string" && { namePattern }
 	};
 }
-const ALLOW_KEYS = [
+const ALLOW_KEYS$1 = [
 	"from",
 	"to",
 	"reason"
@@ -1353,7 +1375,7 @@ const ALLOW_KEYS = [
 function readAllow(value) {
 	const seen = /* @__PURE__ */ new Set();
 	return readArray$1(value, "allow").map((entry) => {
-		const fields = readEntry$1(entry, "allow", ALLOW_KEYS);
+		const fields = readEntry$1(entry, "allow", ALLOW_KEYS$1);
 		const from = readNonEmptyString$1(fields["from"], "allow", "\"from\"");
 		const to = readNonEmptyString$1(fields["to"], "allow", "\"to\"");
 		const reason = readNonEmptyString$1(fields["reason"], "allow", "\"reason\" (an exception must say why it exists)");
@@ -2190,18 +2212,18 @@ function createEntryScope(globs) {
 }
 //#endregion
 //#region src/rules/filename-pattern.ts
-const OPTION_NAME$12 = "exadev/filename-pattern";
+const OPTION_NAME$13 = "exadev/filename-pattern";
 /**
 * The placeholder in a `sibling` template that stands for the linted file's name without its final extension (`Button` for `Button.tsx`).
 */
 const SIBLING_NAME_PLACEHOLDER = "{name}";
 function readPattern(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "string" || value.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "pattern" to be a non-empty regular expression source.`);
+	if (typeof value !== "string" || value.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "pattern" to be a non-empty regular expression source.`);
 	try {
 		new RegExp(value, "u");
 	} catch (error) {
-		throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "pattern" to be a valid regular expression, but "${value}" is not: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "pattern" to be a valid regular expression, but "${value}" is not: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 	}
 	return {
 		source: value,
@@ -2211,32 +2233,32 @@ function readPattern(value) {
 const UNKNOWN_PLACEHOLDER = /\{(?!name\})[^{}]*\}/u;
 function readSiblings(value) {
 	if (value === void 0) return [];
-	const siblings = readRequiredStrings({ sibling: typeof value === "string" ? [value] : value }, "sibling", OPTION_NAME$12);
+	const siblings = readRequiredStrings({ sibling: typeof value === "string" ? [value] : value }, "sibling", OPTION_NAME$13);
 	const unknown = siblings.find((template) => UNKNOWN_PLACEHOLDER.test(template));
-	if (unknown !== void 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" has a "sibling" template "${unknown}" with a placeholder other than ${SIBLING_NAME_PLACEHOLDER}.`);
+	if (unknown !== void 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" has a "sibling" template "${unknown}" with a placeholder other than ${SIBLING_NAME_PLACEHOLDER}.`);
 	return siblings;
 }
 function readOverLines(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs "overLines" to be a non-negative integer.`);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs "overLines" to be a non-negative integer.`);
 	return value;
 }
 /**
 * Validates the rule's option list, compiling each entry. Throws naming the offending field, including a `pattern` that is not a valid regular expression.
 */
 function readFilenamePatternEntries(value) {
-	return readEntryRecords(value, OPTION_NAME$12).map((entry) => {
+	return readEntryRecords(value, OPTION_NAME$13).map((entry) => {
 		assertOnlyKeys(entry, [
 			"files",
 			"pattern",
 			"sibling",
 			"overLines"
-		], OPTION_NAME$12);
+		], OPTION_NAME$13);
 		const pattern = readPattern(entry["pattern"]);
 		const siblings = readSiblings(entry["sibling"]);
-		if (pattern === void 0 && siblings.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs every entry to have a "pattern" or a "sibling".`);
+		if (pattern === void 0 && siblings.length === 0) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$13}" needs every entry to have a "pattern" or a "sibling".`);
 		return {
-			inScope: createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$12}.files`)),
+			inScope: createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$13}.files`)),
 			pattern,
 			siblings,
 			overLines: readOverLines(entry["overLines"])
@@ -2373,7 +2395,7 @@ function stripNodePrefixFromPattern(pattern) {
 }
 //#endregion
 //#region src/rules/import-policy-options.ts
-const OPTION_NAME$11 = "importPolicies";
+const OPTION_NAME$12 = "importPolicies";
 const GLOB_CHARACTERS$1 = /[*?[\]{}]/u;
 const stringList$1 = {
 	type: "array",
@@ -2518,28 +2540,28 @@ function readExceptEdge(entry, name) {
 }
 function assertEdgeIsLive(edge, policy) {
 	const root = "/";
-	if (!createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)])(`${root}${edge.file}`, root)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" exception for "${edge.file}" names a file the policy's files do not select, so it can never apply.`);
+	if (!createFileScope([...policy.files, ...(policy.ignores ?? []).map((glob) => `!${glob}`)])(`${root}${edge.file}`, root)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" exception for "${edge.file}" names a file the policy's files do not select, so it can never apply.`);
 	const file = `${root}${edge.file}`;
-	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
+	if (!((policy.deny ?? []).some((deny) => createSpecifierMatcher(deny.specifiers)(edge.specifier, file, root)) || (policy.confine ?? []).some((confine) => createSpecifierMatcher(confine.specifiers)(edge.specifier, file, root) && !createFileScope(confine.onlyIn)(file, root)))) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" exception "${edge.specifier}" in "${edge.file}" is not forbidden there by any deny entry or by any confine entry whose onlyIn excludes the file, so it can never apply.`);
 }
 /**
 * Validates and normalises an import-policy option value at runtime, for the rule and for `importPolicyConfig` alike. Beyond the schema it requires: at least one include glob in `files`; at least one of `deny` and `confine` per policy; no unknown key; and that every exception edge names a file the policy selects and a specifier one of its restrictions forbids in that file (a confine entry forbids nothing in the files of its `onlyIn`). The edge's `file` is stored in its normalised, forward-slash form. Throws naming the offending field.
 */
 function readImportPolicies(value) {
-	return readEntryRecords(value, OPTION_NAME$11).map((entry) => {
+	return readEntryRecords(value, OPTION_NAME$12).map((entry) => {
 		assertOnlyKeys(entry, [
 			"files",
 			"ignores",
 			"deny",
 			"confine",
 			"exceptEdges"
-		], OPTION_NAME$11);
-		const files = readFileGlobs(entry["files"], `${OPTION_NAME$11}.files`);
-		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$11}.ignores`);
-		const deny = readOptionalList(entry, "deny", OPTION_NAME$11, readDeny);
-		const confine = readOptionalList(entry, "confine", OPTION_NAME$11, readConfine);
-		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$11, readExceptEdge);
-		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$11}" needs every policy to have at least one "deny" or "confine" entry.`);
+		], OPTION_NAME$12);
+		const files = readFileGlobs(entry["files"], `${OPTION_NAME$12}.files`);
+		const ignores = entry["ignores"] === void 0 ? void 0 : readFileGlobs(entry["ignores"], `${OPTION_NAME$12}.ignores`);
+		const deny = readOptionalList(entry, "deny", OPTION_NAME$12, readDeny);
+		const confine = readOptionalList(entry, "confine", OPTION_NAME$12, readConfine);
+		const exceptEdges = readOptionalList(entry, "exceptEdges", OPTION_NAME$12, readExceptEdge);
+		if ((deny === void 0 || deny.length === 0) && (confine === void 0 || confine.length === 0)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$12}" needs every policy to have at least one "deny" or "confine" entry.`);
 		const policy = {
 			files,
 			...ignores !== void 0 && { ignores },
@@ -2689,7 +2711,7 @@ const importPolicy = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDe
 });
 //#endregion
 //#region src/rules/injected-test-hygiene.ts
-const OPTION_NAME$10 = "injected-test-hygiene";
+const OPTION_NAME$11 = "injected-test-hygiene";
 /**
 * The rule's option schema.
 */
@@ -2724,9 +2746,9 @@ function wildcardToRegExp(pattern) {
 * Validates the options and compiles the assertion names. Throws naming the rule for anything the schema lets through: options that are not an object, an unknown key, or an `assertFunctionNames` or `reportDisabled` of the wrong type.
 */
 function readInjectedTestHygieneOptions(value) {
-	const prefix = `@exadev/eslint-config: "${OPTION_NAME$10}"`;
+	const prefix = `@exadev/eslint-config: "${OPTION_NAME$11}"`;
 	if (!isRecord(value)) throw new Error(`${prefix} must be an object.`);
-	assertOnlyKeys(value, ["assertFunctionNames", "reportDisabled"], OPTION_NAME$10);
+	assertOnlyKeys(value, ["assertFunctionNames", "reportDisabled"], OPTION_NAME$11);
 	const { assertFunctionNames, reportDisabled } = value;
 	if (reportDisabled !== void 0 && typeof reportDisabled !== "boolean") throw new Error(`${prefix} needs "reportDisabled" to be a boolean when given.`);
 	if (assertFunctionNames !== void 0 && (!Array.isArray(assertFunctionNames) || assertFunctionNames.length === 0 || !assertFunctionNames.every((name) => typeof name === "string" && name.length > 0))) throw new Error(`${prefix} needs "assertFunctionNames" to be a non-empty array of non-empty strings when given.`);
@@ -2737,7 +2759,7 @@ function readInjectedTestHygieneOptions(value) {
 		reportDisabled: reportDisabled ?? true
 	};
 }
-const createRule$14 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+const createRule$15 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
 const API_KINDS = /* @__PURE__ */ new Map([
 	["describe", "describe"],
 	["suite", "describe"],
@@ -2803,8 +2825,8 @@ function isCalleeOfCall(node) {
 /**
 * Requires the test functions a conformance kit receives as parameters (`runConformance({ describe, it })`, or `run(t)` calling `t.it(...)`) to meet the hygiene `@vitest/eslint-plugin` asks of imported ones: no `.only`, no `.skip`, and an assertion in every test body. That plugin resolves a parameter named like a test function as a local binding and skips it, so its `expect-expect`, `no-disabled-tests` and `no-focused-tests` never fire inside such a kit. A test function is recognised as a parameter of the enclosing function named `describe`, `suite`, `it` or `test` (directly, or destructured under its own or a renamed local name), or as the `describe`, `suite`, `it` or `test` property of any parameter. The check is syntactic: a helper called from a test body counts as an assertion only when its name is listed in `assertFunctionNames`.
 */
-const injectedTestHygiene = createRule$14({
-	name: OPTION_NAME$10,
+const injectedTestHygiene = createRule$15({
+	name: OPTION_NAME$11,
 	meta: {
 		type: "problem",
 		docs: { description: "Require the test functions a kit receives as parameters to be free of .only and .skip and to assert, since @vitest/eslint-plugin cannot see them." },
@@ -2981,7 +3003,7 @@ const MUTATING_INSERT_METHODS$1 = /* @__PURE__ */ new Set([
 	"fill",
 	"copyWithin"
 ]);
-const createRule$13 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+const createRule$14 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
 function isArrayIsArrayCall(node) {
 	return node.type === AST_NODE_TYPES.CallExpression && node.callee.type === AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === AST_NODE_TYPES.Identifier && node.callee.object.name === "Array" && node.callee.property.type === AST_NODE_TYPES.Identifier && node.callee.property.name === "isArray";
 }
@@ -2993,7 +3015,7 @@ function definitelyExits$2(statement) {
 	}
 	return false;
 }
-const noArrayIsArrayMutation = createRule$13({
+const noArrayIsArrayMutation = createRule$14({
 	name: "no-array-isarray-mutation",
 	meta: {
 		type: "problem",
@@ -3469,6 +3491,175 @@ const noControlFlow = {
 	}
 };
 //#endregion
+//#region src/rules/type-only-wrapper.ts
+function isTypeOnlyWrapper(node) {
+	return node.type === AST_NODE_TYPES.TSAsExpression || node.type === AST_NODE_TYPES.TSSatisfiesExpression || node.type === AST_NODE_TYPES.TSTypeAssertion;
+}
+/**
+* The expression that `node` stands for at runtime once every enclosing type-only wrapper is removed.
+*/
+function unwrapTypeOnly(node) {
+	return isTypeOnlyWrapper(node) ? unwrapTypeOnly(node.expression) : node;
+}
+//#endregion
+//#region src/rules/no-defensive-fallback.ts
+const OPTION_NAME$10 = "exadev/no-defensive-fallback";
+const OPTION_KEYS = ["allow"];
+const ALLOW_KEYS = ["files", "reason"];
+const createRule$13 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
+/**
+* Reads the `allow` option into one `FileScope` per entry. Each entry needs `files` (globs, relative to ESLint's working directory; a glob without a `/` names a file at any depth) and a `reason`, which is not used at lint time: it is required so every exemption explains itself where it is configured, as `noInlineConfig` leaves no comment to do so.
+*/
+function readAllowedScopes(options) {
+	if (!isRecord(options)) throw new Error(`@exadev/eslint-config: "${OPTION_NAME$10}" options must be an object.`);
+	assertOnlyKeys(options, OPTION_KEYS, OPTION_NAME$10);
+	const { allow } = options;
+	if (allow === void 0) return [];
+	return readEntryRecords(allow, `${OPTION_NAME$10} allow`).map((entry) => {
+		assertOnlyKeys(entry, ALLOW_KEYS, `${OPTION_NAME$10} allow entry`);
+		readRequiredString(entry, "reason", `${OPTION_NAME$10} allow entry`);
+		return createEntryScope(readEntryFiles(entry["files"], `${OPTION_NAME$10} allow files`));
+	});
+}
+/**
+* Whether `node` is a literal for "nothing here": an empty array, empty object, empty string (quoted or an untagged template with no content), `0`, `0n`, `false` or `null`.
+*/
+function isEmptyLiteral(node) {
+	const target = unwrapTypeOnly(node);
+	if (target.type === AST_NODE_TYPES.ArrayExpression) return target.elements.length === 0;
+	if (target.type === AST_NODE_TYPES.ObjectExpression) return target.properties.length === 0;
+	if (target.type === AST_NODE_TYPES.TemplateLiteral) return target.expressions.length === 0 && target.quasis.every((quasi) => quasi.value.cooked === "");
+	return target.type === AST_NODE_TYPES.Literal && (target.raw === "null" || target.value === "" || target.value === 0 || target.value === BigInt(0) || target.value === false);
+}
+/**
+* Whether `node` is a fixed value known from the source alone, with no identifier but `undefined` and no call, so a function returning it cannot be reporting anything about the error it caught.
+*/
+function isConstantValue(node) {
+	const target = unwrapTypeOnly(node);
+	if (target.type === AST_NODE_TYPES.Literal) return true;
+	if (target.type === AST_NODE_TYPES.Identifier) return target.name === "undefined";
+	if (target.type === AST_NODE_TYPES.TemplateLiteral) return target.expressions.length === 0;
+	if (target.type === AST_NODE_TYPES.UnaryExpression) return (target.operator === "-" || target.operator === "+" || target.operator === "!" || target.operator === "void") && isConstantValue(target.argument);
+	if (target.type === AST_NODE_TYPES.ArrayExpression) return target.elements.every((element) => element === null || element.type !== AST_NODE_TYPES.SpreadElement && isConstantValue(element));
+	if (target.type === AST_NODE_TYPES.ObjectExpression) return target.properties.every((property) => property.type === AST_NODE_TYPES.Property && !property.computed && !property.method && isConstantValue(property.value));
+	return false;
+}
+/**
+* How a block that stands in for error handling ends without handling anything, or `undefined` when it does something else. A block is swallowing when it is empty (a comment-only block included) or holds exactly one `continue`, or one `return` that gives back nothing or a constant value.
+*/
+function swallowOutcome(body) {
+	const [only] = body;
+	if (only === void 0) return "does nothing";
+	if (only.type === AST_NODE_TYPES.ContinueStatement) return "skips to the next iteration";
+	if (only.type !== AST_NODE_TYPES.ReturnStatement) return void 0;
+	if (only.argument === null) return "returns nothing";
+	return isConstantValue(only.argument) ? "returns a fixed value" : void 0;
+}
+function isHandlerFunction(node) {
+	return node.type === AST_NODE_TYPES.ArrowFunctionExpression || node.type === AST_NODE_TYPES.FunctionExpression;
+}
+/**
+* How a function passed to `.catch(...)` swallows the rejection, or `undefined` when it does not. An arrow with an expression body swallows when that expression is a constant value.
+*/
+function rejectionHandlerOutcome(handler) {
+	if (handler.body.type === AST_NODE_TYPES.BlockStatement) return swallowOutcome(handler.body.body);
+	return isConstantValue(handler.body) ? "returns a fixed value" : void 0;
+}
+function isMethodCall(node, name) {
+	const { callee } = node;
+	return callee.type === AST_NODE_TYPES.MemberExpression && callee.property.type === AST_NODE_TYPES.Identifier && callee.property.name === name;
+}
+/**
+* The rejection handler of a promise call and what to call it in a report: the only argument of `.catch(handler)`, or the second of `.then(onFulfilled, handler)`. `undefined` for any other call, or when the argument list is not exactly that shape.
+*/
+function rejectionHandlerOf(node) {
+	const [first, second, ...rest] = node.arguments;
+	if (isMethodCall(node, "catch") && first !== void 0 && second === void 0) return {
+		handler: first,
+		construct: ".catch() handler"
+	};
+	if (isMethodCall(node, "then") && second !== void 0 && rest.length === 0) return {
+		handler: second,
+		construct: ".then() rejection handler"
+	};
+}
+const noDefensiveFallback = createRule$13({
+	name: "no-defensive-fallback",
+	meta: {
+		type: "suggestion",
+		docs: { description: "Disallow an empty-literal fallback after ?? or ||, and a catch that discards the error and returns nothing or a fixed value." },
+		schema: [{
+			type: "object",
+			properties: { allow: {
+				type: "array",
+				items: {
+					type: "object",
+					properties: {
+						files: entryFilesSchema,
+						reason: {
+							type: "string",
+							minLength: 1
+						}
+					},
+					required: ["files", "reason"],
+					additionalProperties: false
+				}
+			} },
+			additionalProperties: false
+		}],
+		messages: {
+			emptyFallback: "A fallback of `{{ fallback }}` after `{{ operator }}` turns a missing value into a plausible one, so the absence never reaches the code that could handle it. Model the value as `T | undefined` and handle the absence where it is meaningful, or list this file under \"allow\" with a reason.",
+			swallowedError: "This {{ construct }} discards the error and {{ outcome }}, so a failure becomes indistinguishable from success. Rethrow it, handle it, or let the caller see it, or list this file under \"allow\" with a reason."
+		},
+		defaultOptions: [{}]
+	},
+	create(context, [options]) {
+		if (readAllowedScopes(options).some((inScope) => inScope(context.filename, context.cwd))) return {};
+		function reportFallback(operator, right) {
+			if (isEmptyLiteral(right)) context.report({
+				node: right,
+				messageId: "emptyFallback",
+				data: {
+					operator,
+					fallback: context.sourceCode.getText(right)
+				}
+			});
+		}
+		return {
+			LogicalExpression(node) {
+				if (node.operator === "||" || node.operator === "??") reportFallback(node.operator, node.right);
+			},
+			AssignmentExpression(node) {
+				if (node.operator === "||=" || node.operator === "??=") reportFallback(node.operator, node.right);
+			},
+			CatchClause(node) {
+				const outcome = swallowOutcome(node.body.body);
+				if (outcome !== void 0) context.report({
+					node,
+					messageId: "swallowedError",
+					data: {
+						construct: "catch clause",
+						outcome
+					}
+				});
+			},
+			CallExpression(node) {
+				const rejection = rejectionHandlerOf(node);
+				if (rejection === void 0 || !isHandlerFunction(rejection.handler)) return;
+				const outcome = rejectionHandlerOutcome(rejection.handler);
+				if (outcome !== void 0) context.report({
+					node: rejection.handler,
+					messageId: "swallowedError",
+					data: {
+						construct: rejection.construct,
+						outcome
+					}
+				});
+			}
+		};
+	}
+});
+//#endregion
 //#region src/rules/no-dependency-cycle.ts
 /**
 * Reports a workspace dependency that can reach back to the declaring package: a cycle. This is NOT covered by no-uphill-dependency, and the distinction matters: that rule permits a same-rank (or, within a slice, a same-slice) dependency, so two packages at the same rank depending on each other passes it while still being a cycle. Turborepo does reject a cyclic task graph, but only once the whole graph is assembled, by which point a large refactor has already moved everything; reporting it at the manifest, where the edge is declared, names the two packages and the direction to reverse.
@@ -4642,7 +4833,7 @@ function renderLine(line) {
 function needsLiteralType(node) {
 	let child = node;
 	for (let parent = node.parent; parent !== void 0; child = parent, parent = parent.parent) {
-		if (parent.type === AST_NODE_TYPES.TSAsExpression || parent.type === AST_NODE_TYPES.TSSatisfiesExpression || parent.type === AST_NODE_TYPES.TSTypeAssertion) return true;
+		if (isTypeOnlyWrapper(parent)) return true;
 		if (parent.type === AST_NODE_TYPES.TSEnumMember) return parent.initializer === child;
 		if (parent.type === AST_NODE_TYPES.VariableDeclarator) return parent.init === child && parent.id.typeAnnotation !== void 0;
 		if (parent.type === AST_NODE_TYPES.PropertyDefinition) return parent.value === child && parent.typeAnnotation !== void 0;
@@ -4913,7 +5104,7 @@ function isSerialisableData(node) {
 	if (node.type === AST_NODE_TYPES.UnaryExpression) return true;
 	if (node.type === AST_NODE_TYPES.ArrayExpression) return node.elements.every((element) => element === null || element.type !== AST_NODE_TYPES.SpreadElement && isSerialisableData(element));
 	if (node.type === AST_NODE_TYPES.ObjectExpression) return node.properties.every((property) => property.type === AST_NODE_TYPES.Property && (!property.computed || isSerialisableData(property.key)) && isSerialisableData(property.value));
-	if (node.type === AST_NODE_TYPES.TSAsExpression || node.type === AST_NODE_TYPES.TSSatisfiesExpression || node.type === AST_NODE_TYPES.TSNonNullExpression) return isSerialisableData(node.expression);
+	if (isTypeOnlyWrapper(node) || node.type === AST_NODE_TYPES.TSNonNullExpression) return isSerialisableData(node.expression);
 	return false;
 }
 const createRule$10 = ESLintUtils.RuleCreator((name) => `https://github.com/ExaDev/eslint-config/blob/main/src/rules/${name}.ts`);
@@ -5300,7 +5491,7 @@ function isShorthandPropertyRead(sourceCode, identifier) {
 function isExportedAlias(declarationParentType, programBody, resolve, aliasVariable) {
 	if (declarationParentType === "ExportNamedDeclaration") return true;
 	return programBody.some((statement) => {
-		if (statement.type === "ExportNamedDeclaration" && statement.source == null) return (statement.specifiers ?? []).some((specifier) => specifier.local.type === "Identifier" && specifier.local.name !== void 0 && resolve(specifier.local.name) === aliasVariable);
+		if (statement.type === "ExportNamedDeclaration" && (statement.source === void 0 || statement.source === null)) return (statement.specifiers ?? []).some((specifier) => specifier.local.type === "Identifier" && specifier.local.name !== void 0 && resolve(specifier.local.name) === aliasVariable);
 		const target = statement.type === "ExportDefaultDeclaration" ? statement.declaration : void 0;
 		return target?.type === "Identifier" && target.name !== void 0 && resolve(target.name) === aliasVariable;
 	});
@@ -8474,6 +8665,7 @@ const plugin = {
 		"no-array-isarray-mutation": noArrayIsArrayMutation,
 		"no-boundaries-ignore": noBoundariesIgnore,
 		"no-control-flow": noControlFlow,
+		"no-defensive-fallback": noDefensiveFallback,
 		"no-dependency-cycle": no_dependency_cycle_default,
 		"no-enum-number-widening": noEnumNumberWidening,
 		"no-enum-reverse-lookup-widening": noEnumReverseLookupWidening,
@@ -8524,6 +8716,7 @@ const plugin = {
 				plugins: { exadev: plugin },
 				linterOptions: { noInlineConfig: true },
 				rules: {
+					...UNTYPED_ROBUSTNESS_RULES,
 					"exadev/barrel-policy": ["error", { mode: "banned" }],
 					"exadev/no-mutable-union-array-param": "error",
 					"exadev/no-object-assign": "error",
@@ -8531,7 +8724,8 @@ const plugin = {
 					"exadev/prefer-options-object-param": "error",
 					"exadev/prefer-readonly-array-param": "error",
 					"exadev/test-file-kind": "error",
-					"max-params": ["error", { max: 4 }]
+					"max-params": ["error", { max: 4 }],
+					"no-implicit-coercion": "error"
 				}
 			};
 		},
@@ -8957,6 +9151,7 @@ const recommendedTypeChecked = [
 		plugins: { exadev: plugin },
 		linterOptions: { noInlineConfig: true },
 		rules: {
+			...UNTYPED_ROBUSTNESS_RULES,
 			"exadev/barrel-policy": "error",
 			"exadev/no-array-isarray-mutation": "error",
 			"exadev/no-enum-number-widening": "error",
@@ -8999,7 +9194,12 @@ const recommendedTypeChecked = [
 			"@typescript-eslint/require-array-sort-compare": "error",
 			"@typescript-eslint/strict-boolean-expressions": "error",
 			"@typescript-eslint/strict-void-return": "error",
-			"@typescript-eslint/switch-exhaustiveness-check": "error",
+			"@typescript-eslint/explicit-module-boundary-types": "error",
+			"@typescript-eslint/switch-exhaustiveness-check": ["error", {
+				considerDefaultExhaustiveForUnions: false,
+				requireDefaultForNonUnion: true
+			}],
+			"no-implicit-coercion": ["error", { boolean: false }],
 			"max-lines": ["error", {
 				max: 800,
 				skipBlankLines: true,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "exadev-eslint-config",
   "description": "Shared custom ESLint rules and plugin for ExaDev projects",
-  "version": "2.28.0",
+  "version": "2.29.0",
   "dependencies": {
     "@eslint/js": "^10.0.1",
     "@microsoft/tsdoc": "0.17.0",