@blumintinc/eslint-plugin-blumint 1.20.102 → 1.20.104

package/README.md

@@ -256,7 +256,7 @@ full closed loop is documented in agora's `.claude/skills/eslint-autonomy/SKILL.
 | [prevent-children-clobber](docs/rules/prevent-children-clobber.md)                                           | Prevent JSX spreads from silently discarding props.children                                                                                                                                                                                                                                                                                                                                      | ✅  |    |    |    |    |
 | [react-memoize-literals](docs/rules/react-memoize-literals.md)                                               | Detect object, array, and function literals created in React components or hooks that create new references every render. Prefer memoized values (useMemo/useCallback) or module-level constants to keep referential stability.                                                                                                                                                                  | ✅  |    |    | 💡 |    |
 | [react-usememo-should-be-component](docs/rules/react-usememo-should-be-component.md)                         | Enforce that useMemo hooks explicitly returning JSX should be abstracted into separate React components                                                                                                                                                                                                                                                                                          | ✅  |    |    |    |    |
-| [require-dynamic-firebase-imports](docs/rules/require-dynamic-firebase-imports.md)                           | Enforce dynamic imports for Firebase dependencies                                                                                                                                                                                                                                                                                                                                                | ✅  |    | 🔧 |    |    |
+| [require-dynamic-firebase-imports](docs/rules/require-dynamic-firebase-imports.md)                           | Enforce dynamic imports for Firebase dependencies                                                                                                                                                                                                                                                                                                                                                | ✅  |    |    |    |    |
 | [require-hooks-default-params](docs/rules/require-hooks-default-params.md)                                   | Enforce React hooks with optional parameters to default to an empty object                                                                                                                                                                                                                                                                                                                       | ✅  |    | 🔧 |    |    |
 | [require-https-error](docs/rules/require-https-error.md)                                                     | Enforce using proprietary HttpsError instead of throw new Error or firebase-admin HttpsError in functions/src                                                                                                                                                                                                                                                                                    | ✅  |    |    |    |    |
 | [require-https-error-cause](docs/rules/require-https-error-cause.md)                                         | Ensure HttpsError calls inside catch blocks pass the caught error as the fourth "cause" argument to preserve stack traces for monitoring.                                                                                                                                                                                                                                                        | ✅  |    |    |    |    |

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.102',
+        version: '1.20.104',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-assert-safe-object-key.js

@@ -118,6 +118,36 @@ function isInsideMockFactory(node) {
     }
     return false;
 }
+/**
+ * Strips the wrappers that stand between a computed key and the value that
+ * actually names the property. `k as string`, `k satisfies string`, `<string>k`
+ * and `k!` erase at compile time, and `await k` resolves to the very same key,
+ * so every one of them leaves the run-time lookup untouched — including a lookup
+ * of `__proto__` or `constructor`. Reading the wrapper instead of what it holds
+ * classifies nothing and turns appending `as string` into a silent bypass of the
+ * guard, so the wrappers are peeled off before the key is judged.
+ *
+ * The peel repeats because the wrappers nest: `(x as any)!` is a non-null
+ * assertion over a type assertion.
+ */
+function unwrapKeyExpression(node) {
+    let current = node;
+    for (;;) {
+        switch (current.type) {
+            case utils_1.AST_NODE_TYPES.TSAsExpression:
+            case utils_1.AST_NODE_TYPES.TSSatisfiesExpression:
+            case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+            case utils_1.AST_NODE_TYPES.TSTypeAssertion:
+                current = current.expression;
+                break;
+            case utils_1.AST_NODE_TYPES.AwaitExpression:
+                current = current.argument;
+                break;
+            default:
+                return current;
+        }
+    }
+}
 /** Names that read as a positional sequence rather than a keyed record. */
 const ARRAY_LIKE_NAME = /^(array|arr|items|elements|list|collection|data)s?$/i;
 /**
@@ -186,18 +216,90 @@ function isNumericCall(node) {
         callee.object.name === 'Math');
 }
 /**
- * A `: number` annotation on a binding name. Only parameters and variable
- * declarators carry one, and a declarator is judged from its writes, so this
- * effectively identifies a numeric parameter.
+ * A `: number` annotation on a binding name. Parameters and variable
+ * declarators are the bindings that carry one, and TypeScript checks every
+ * value that reaches such a binding against it.
  */
 function isNumberAnnotated(node) {
     return (node.type === utils_1.AST_NODE_TYPES.Identifier &&
         node.typeAnnotation?.typeAnnotation.type === utils_1.AST_NODE_TYPES.TSNumberKeyword);
 }
+/** The types an assertion can launder any value through without complaint. */
+const LAUNDERING_ASSERTION_TYPES = new Set([
+    utils_1.AST_NODE_TYPES.TSAnyKeyword,
+    utils_1.AST_NODE_TYPES.TSUnknownKeyword,
+]);
+/**
+ * An assertion naming `number` over the value it wraps — `f() as number`,
+ * `f() satisfies number`, `<number>f()`. An assertion to anything other than
+ * the `number` keyword — `as any`, `as unknown`, `as string`, `as const`, a
+ * union, a generic — is not this claim at all.
+ *
+ * The claim is only worth trusting because TypeScript checks it: `f() as number`
+ * is rejected unless the operand's type overlaps `number`. A step through `any`
+ * or `unknown` removes exactly that check, which is what makes
+ * `userInput as unknown as number` the idiom for asserting anything at all — so
+ * a chain carrying one proves nothing, and a string laundered through it would
+ * re-open the `__proto__` key this rule exists to stop.
+ */
+function assertsNumberType(node) {
+    if ((node.type !== utils_1.AST_NODE_TYPES.TSAsExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSSatisfiesExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSTypeAssertion) ||
+        node.typeAnnotation.type !== utils_1.AST_NODE_TYPES.TSNumberKeyword) {
+        return false;
+    }
+    for (let inner = node.expression; inner.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSSatisfiesExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSTypeAssertion; inner = inner.expression) {
+        if (LAUNDERING_ASSERTION_TYPES.has(inner.typeAnnotation.type)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Whether the write is the initializer of a declaration that declares itself
+ * numeric — either by annotating the binding name (`const k: number =
+ * rankOf(id)`, `(index: number = rankOf(id)) =>`) or by asserting the
+ * initializing value (`const k = rankOf(id) as number`). TypeScript rejects a
+ * non-numeric value under either spelling, so on a TypeScript source both are
+ * syntactic proof that the value is a number — the same trust a
+ * `(index: number) =>` parameter already earns. Without them an author whose
+ * index comes from a call has no compliant spelling at all, because the shape
+ * of a call proves nothing on its own.
+ *
+ * The proof covers the initializer alone. A later assignment is a separate
+ * statement and is where a value out of a `catch` binding or an `any`-typed
+ * source enters the binding, so every other write still has to prove itself by
+ * its own shape — including a `for (k of xs)` binding, whose write expression
+ * is the iterated value rather than an initializer.
+ */
+function initializesNumericDeclaration(writeExpr) {
+    const site = writeExpr.parent;
+    switch (site?.type) {
+        case utils_1.AST_NODE_TYPES.VariableDeclarator:
+            // A destructuring pattern takes the initializer apart before binding, so
+            // an assertion over the whole initializer describes the container rather
+            // than the element bound out of it: `const { a } = f() as number` says
+            // nothing about `a`.
+            return (site.id.type === utils_1.AST_NODE_TYPES.Identifier &&
+                (isNumberAnnotated(site.id) || assertsNumberType(writeExpr)));
+        // A parameter default is checked against the parameter's own annotation the
+        // same way a declarator's initializer is checked against its own. That
+        // annotation is also what admits the parameter as a numeric binding at all,
+        // so an assertion on the default decides nothing here.
+        case utils_1.AST_NODE_TYPES.AssignmentPattern:
+            return isNumberAnnotated(site.left);
+        default:
+            return false;
+    }
+}
 /**
  * Whether the definition can hold a number: a declarator (whose value is proven
- * by its writes) or a parameter annotated `: number`. Anything else — an
- * import, a function or class name, a catch binding — is not.
+ * by its declaration site and its writes) or a parameter annotated `: number`.
+ * Anything else — an import, a function or class name, a catch binding — is
+ * not.
  */
 function definesNumericBinding(def) {
     return (def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator ||
@@ -431,6 +533,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                 return createFixes(fixer, node, expressionText);
             },
         });
+        /**
+         * Reports a key whose written form may carry assertion or await wrappers.
+         *
+         * The report and the fix sit on the outermost written node, so the wrapper
+         * the author put there survives the rewrite: `m[assertSafe(k as string)]`
+         * rather than `m[assertSafe(k)]`, which would delete text the fixer does not
+         * own. `assertSafe` is identity-typed (`<T extends PropertyKey>(key: T): T`),
+         * so wrapping the asserted expression preserves the key's type, and wrapping
+         * an `await` keeps the validation on the resolved key rather than moving it
+         * onto the promise.
+         *
+         * A key written without a wrapper keeps the narrower argument the fix has
+         * always emitted: `String(id)` and `` `${id}` `` collapse to `id`, whose
+         * conversion assertSafe subsumes.
+         */
+        const reportWrittenKey = (written, unwrapped, innerText) => reportUseAssertSafe(written, written === unwrapped ? innerText : context.sourceCode.getText(written));
         /**
          * Returns true when the identifier was initialized directly from an
          * assertSafe(...) call, e.g. `const safeKey = assertSafe(rawKey)`.
@@ -463,34 +581,36 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
          * does not prove numeric keeps being reported.
          */
         const isStaticallyNumeric = (node, seen = new Set()) => {
-            switch (node.type) {
+            // An assertion or an await around an operand leaves its run-time value
+            // alone, so the proof reads through to what the wrapper holds. The
+            // annotation on the binding underneath is what proves the key numeric —
+            // an assertion asserts and proves nothing on its own.
+            const target = unwrapKeyExpression(node);
+            switch (target.type) {
                 case utils_1.AST_NODE_TYPES.Literal:
-                    return typeof node.value === 'number';
+                    return typeof target.value === 'number';
                 case utils_1.AST_NODE_TYPES.UpdateExpression:
                     return true;
                 case utils_1.AST_NODE_TYPES.UnaryExpression:
-                    return (node.operator === '-' ||
-                        node.operator === '+' ||
-                        node.operator === '~');
+                    return (target.operator === '-' ||
+                        target.operator === '+' ||
+                        target.operator === '~');
                 case utils_1.AST_NODE_TYPES.BinaryExpression:
-                    if (NUMERIC_BINARY_OPERATORS.has(node.operator)) {
+                    if (NUMERIC_BINARY_OPERATORS.has(target.operator)) {
                         return true;
                     }
-                    return (node.operator === '+' &&
-                        isStaticallyNumeric(node.left, seen) &&
-                        isStaticallyNumeric(node.right, seen));
+                    return (target.operator === '+' &&
+                        isStaticallyNumeric(target.left, seen) &&
+                        isStaticallyNumeric(target.right, seen));
                 case utils_1.AST_NODE_TYPES.CallExpression:
-                    return isNumericCall(node);
+                    return isNumericCall(target);
                 case utils_1.AST_NODE_TYPES.MemberExpression:
                     // `.length` is a number on arrays, typed arrays and strings alike.
-                    return (!node.computed &&
-                        node.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                        node.property.name === 'length');
-                case utils_1.AST_NODE_TYPES.TSAsExpression:
-                case utils_1.AST_NODE_TYPES.TSNonNullExpression:
-                    return isStaticallyNumeric(node.expression, seen);
+                    return (!target.computed &&
+                        target.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                        target.property.name === 'length');
                 case utils_1.AST_NODE_TYPES.Identifier:
-                    return isNumericIdentifier(node, seen);
+                    return isNumericIdentifier(target, seen);
                 default:
                     return false;
             }
@@ -523,6 +643,9 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                     NUMERIC_ASSIGNMENT_OPERATORS.has(assignment.operator)) {
                     return true;
                 }
+                if (initializesNumericDeclaration(writeExpr)) {
+                    return true;
+                }
                 return isStaticallyNumeric(writeExpr, nextSeen);
             });
             if (!staysNumeric) {
@@ -538,14 +661,15 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             // Handle computed property in object destructuring
             Property(node) {
                 if (node.computed && node.key) {
-                    const key = node.key;
+                    const written = node.key;
+                    const key = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (key.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         key.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         key.callee.name === 'String') {
                         const arg = key.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(key, argText);
+                        reportWrittenKey(written, key, argText);
                     }
                     // Check for template literals like `${id}`
                     if (key.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -555,21 +679,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         key.quasis[1].value.raw === '') {
                         const expr = key.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(key, exprText);
+                        reportWrittenKey(written, key, exprText);
                     }
                 }
             },
             // Handle binary expressions like 'key' in obj
             BinaryExpression(node) {
                 if (node.operator === 'in') {
-                    const left = node.left;
+                    const written = node.left;
+                    const left = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (left.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         left.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         left.callee.name === 'String') {
                         const arg = left.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(left, argText);
+                        reportWrittenKey(written, left, argText);
                     }
                     // Check for template literals like `${id}`
                     if (left.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -579,13 +704,17 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         left.quasis[1].value.raw === '') {
                         const expr = left.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(left, exprText);
+                        reportWrittenKey(written, left, exprText);
                     }
                 }
             },
             MemberExpression(node) {
                 if (node.computed) {
-                    const property = node.property;
+                    const written = node.property;
+                    // The written key may sit under assertion or await wrappers that erase
+                    // at run time; what they hold is what names the property, so that is
+                    // what the branches below classify.
+                    const property = unwrapKeyExpression(written);
                     // Skip if already using assertSafe
                     if (property.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         property.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
@@ -619,7 +748,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         property.callee.name === 'String') {
                         const arg = property.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(property, argText);
+                        reportWrittenKey(written, property, argText);
                         return;
                     }
                     // Check for template literals
@@ -640,7 +769,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         }
                         const expr = property.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(property, exprText);
+                        reportWrittenKey(written, property, exprText);
                         return;
                     }
                     // Check for direct variable usage (identifiers)
@@ -659,7 +788,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for binary expressions (like index + 1)
@@ -669,7 +798,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for boolean expressions and other literals
@@ -681,7 +810,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for function calls (anything that isn't handled above)
@@ -694,7 +823,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                 }

package/lib/rules/enforce-firestore-set-merge.js

@@ -9,6 +9,16 @@ const FIRESTORE_MODULES = new Set(['firebase/firestore', 'firebase-admin']);
 const UPDATE_DOC = 'updateDoc';
 const SET_DOC = 'setDoc';
 const MERGE_ARGUMENT = ', { merge: true }';
+const BATCH_MANAGER = 'batchManager';
+/**
+ * Realtime Database's batch manager is held under the same `batchManager` field
+ * name as the Firestore one, yet it exposes no `set` method at all — its
+ * positional `update(path, data)` is the only write path it has, and RTDB's
+ * update already merges shallowly. Rewriting one of its calls emits a method
+ * that does not exist (TS2339), so a receiver proven to be this class is out of
+ * the rule's scope entirely.
+ */
+const REALTIME_BATCH_MANAGER = 'RealtimeBatchManager';
 function isFirestoreDynamicImport(node) {
     if (node?.type !== utils_1.AST_NODE_TYPES.AwaitExpression) {
         return false;
@@ -67,6 +77,121 @@ function bindsFirestoreExport(variable, imported) {
     return (variable.defs.length > 0 &&
         variable.defs.every((def) => firestoreBindingOf(def)?.imported === imported));
 }
+/** The rightmost segment of a type name, so `realtimeDb.X` reads like a bare `X`. */
+function typeNameOf(node) {
+    if (node.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return node.name;
+    }
+    if (node.type === utils_1.AST_NODE_TYPES.TSQualifiedName) {
+        return typeNameOf(node.right);
+    }
+    return null;
+}
+/**
+ * Whether a type annotation names the Realtime Database batch manager. Wrappers
+ * that preserve the instance type — `Readonly<…>`, a union, an intersection —
+ * are looked through, because the field they annotate still holds the class.
+ */
+function isRealtimeType(node) {
+    if (!node) {
+        return false;
+    }
+    switch (node.type) {
+        case utils_1.AST_NODE_TYPES.TSTypeReference:
+            return (typeNameOf(node.typeName) === REALTIME_BATCH_MANAGER ||
+                (node.typeParameters?.params ?? []).some(isRealtimeType));
+        case utils_1.AST_NODE_TYPES.TSUnionType:
+        case utils_1.AST_NODE_TYPES.TSIntersectionType:
+            return node.types.some(isRealtimeType);
+        default:
+            return false;
+    }
+}
+function isRealtimeAnnotation(annotation) {
+    return isRealtimeType(annotation?.typeAnnotation);
+}
+/** Whether an initializer constructs the Realtime Database batch manager. */
+function isRealtimeInstance(node) {
+    if (node?.type !== utils_1.AST_NODE_TYPES.NewExpression) {
+        return false;
+    }
+    const { callee } = node;
+    if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return callee.name === REALTIME_BATCH_MANAGER;
+    }
+    return (callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+        !callee.computed &&
+        callee.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+        callee.property.name === REALTIME_BATCH_MANAGER);
+}
+/**
+ * Whether a parameter binds `name` to the Realtime batch manager. A parameter
+ * property declares the field outright; a plain constructor parameter of the
+ * same name is the evidence a subclass carries when it forwards the manager to a
+ * `super()` that stores it.
+ */
+function parameterBindsRealtime(param, name) {
+    const declared = param.type === utils_1.AST_NODE_TYPES.TSParameterProperty ? param.parameter : param;
+    const identifier = declared.type === utils_1.AST_NODE_TYPES.AssignmentPattern
+        ? declared.left
+        : declared;
+    const initializer = declared.type === utils_1.AST_NODE_TYPES.AssignmentPattern ? declared.right : null;
+    return (identifier.type === utils_1.AST_NODE_TYPES.Identifier &&
+        identifier.name === name &&
+        (isRealtimeAnnotation(identifier.typeAnnotation) ||
+            isRealtimeInstance(initializer)));
+}
+/** Whether a class member identifies `name` as the Realtime batch manager. */
+function memberBindsRealtime(member, name) {
+    if (member.type === utils_1.AST_NODE_TYPES.PropertyDefinition) {
+        return (!member.computed &&
+            member.key.type === utils_1.AST_NODE_TYPES.Identifier &&
+            member.key.name === name &&
+            (isRealtimeInstance(member.value) ||
+                isRealtimeAnnotation(member.typeAnnotation)));
+    }
+    return (member.type === utils_1.AST_NODE_TYPES.MethodDefinition &&
+        member.kind === 'constructor' &&
+        member.value.params.some((param) => parameterBindsRealtime(param, name)));
+}
+/** Strips assertions, which change a literal's type but not its value. */
+function unwrapAssertions(node) {
+    if (node.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+        node.type === utils_1.AST_NODE_TYPES.TSSatisfiesExpression ||
+        node.type === utils_1.AST_NODE_TYPES.TSTypeAssertion ||
+        node.type === utils_1.AST_NODE_TYPES.TSNonNullExpression) {
+        return unwrapAssertions(node.expression);
+    }
+    return node;
+}
+/**
+ * Whether an expression evaluates to a primitive value on its face. Firestore's
+ * update data is an object of field updates, so a primitive in the data
+ * position proves the call is not Firestore's — the only signal available where
+ * the receiver is inherited from another module.
+ */
+function isPrimitiveLiteral(node) {
+    if (!node) {
+        return false;
+    }
+    const expression = unwrapAssertions(node);
+    // A template literal evaluates to a string however it interpolates.
+    if (expression.type === utils_1.AST_NODE_TYPES.TemplateLiteral) {
+        return true;
+    }
+    if (expression.type === utils_1.AST_NODE_TYPES.UnaryExpression &&
+        (expression.operator === '-' || expression.operator === '+')) {
+        return isPrimitiveLiteral(expression.argument);
+    }
+    if (expression.type !== utils_1.AST_NODE_TYPES.Literal) {
+        return false;
+    }
+    const { value } = expression;
+    return (typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        typeof value === 'bigint');
+}
 exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
     name: 'enforce-firestore-set-merge',
     meta: {
@@ -97,6 +222,109 @@ exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
          */
         const isReportSuppressed = (0, disableDirectives_1.createSuppressionChecker)(context);
         let plannedSetDocBinding = false;
+        /**
+         * Top-level classes by name, so a field inherited from a superclass declared
+         * in the same file resolves to the declaration that carries its evidence.
+         */
+        let topLevelClasses = null;
+        function classBodiesByName() {
+            if (topLevelClasses) {
+                return topLevelClasses;
+            }
+            topLevelClasses = new Map();
+            for (const statement of sourceCode.ast.body) {
+                const declaration = statement.type === utils_1.AST_NODE_TYPES.ExportNamedDeclaration ||
+                    statement.type === utils_1.AST_NODE_TYPES.ExportDefaultDeclaration
+                    ? statement.declaration
+                    : statement;
+                if (declaration?.type === utils_1.AST_NODE_TYPES.ClassDeclaration &&
+                    declaration.id) {
+                    topLevelClasses.set(declaration.id.name, declaration.body);
+                    continue;
+                }
+                if (declaration?.type === utils_1.AST_NODE_TYPES.VariableDeclaration) {
+                    for (const declarator of declaration.declarations) {
+                        if (declarator.id.type === utils_1.AST_NODE_TYPES.Identifier &&
+                            declarator.init?.type === utils_1.AST_NODE_TYPES.ClassExpression) {
+                            topLevelClasses.set(declarator.id.name, declarator.init.body);
+                        }
+                    }
+                }
+            }
+            return topLevelClasses;
+        }
+        function enclosingClassBody(node) {
+            let current = node.parent;
+            while (current) {
+                if (current.type === utils_1.AST_NODE_TYPES.ClassBody) {
+                    return current;
+                }
+                current = current.parent;
+            }
+            return null;
+        }
+        /** Follows `extends` in-file, since a subclass inherits its field's type. */
+        function classBindsRealtime(body, name, seen) {
+            if (seen.has(body)) {
+                return false;
+            }
+            seen.add(body);
+            if (body.body.some((member) => memberBindsRealtime(member, name))) {
+                return true;
+            }
+            const declaration = body.parent;
+            const superClass = declaration?.type === utils_1.AST_NODE_TYPES.ClassDeclaration ||
+                declaration?.type === utils_1.AST_NODE_TYPES.ClassExpression
+                ? declaration.superClass
+                : null;
+            if (superClass?.type !== utils_1.AST_NODE_TYPES.Identifier) {
+                return false;
+            }
+            const superBody = classBodiesByName().get(superClass.name);
+            return superBody ? classBindsRealtime(superBody, name, seen) : false;
+        }
+        function identifierBindsRealtime(identifier) {
+            const scope = ASTHelpers_1.ASTHelpers.getScope(context, identifier);
+            const variable = ASTHelpers_1.ASTHelpers.findVariableInScope(scope, identifier.name);
+            return (variable?.defs ?? []).some((def) => {
+                const declaredName = def.name;
+                return ((declaredName.type === utils_1.AST_NODE_TYPES.Identifier &&
+                    isRealtimeAnnotation(declaredName.typeAnnotation)) ||
+                    (def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+                        isRealtimeInstance(def.node.init)));
+            });
+        }
+        /**
+         * Whether the file itself proves the receiver holds a RealtimeBatchManager:
+         * `this.batchManager` against the class (or an in-file superclass) that
+         * declares the field, and a plain identifier against its binding.
+         */
+        function receiverBindsRealtime(node, receiver) {
+            if (receiver.type === utils_1.AST_NODE_TYPES.Identifier) {
+                return identifierBindsRealtime(receiver);
+            }
+            if (receiver.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+                receiver.computed ||
+                receiver.property.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                receiver.object.type !== utils_1.AST_NODE_TYPES.ThisExpression) {
+                return false;
+            }
+            const body = enclosingClassBody(node);
+            return body
+                ? classBindsRealtime(body, receiver.property.name, new Set())
+                : false;
+        }
+        /**
+         * Either syntactic signal puts a `batchManager.update(…)` call outside the
+         * rule: the receiver resolves in-file to the Realtime Database manager, or
+         * the data argument is a primitive literal, which Firestore's object of
+         * field updates can never be. A call with no data argument has nothing in
+         * that position, so only the receiver can answer for it.
+         */
+        function isRealtimeBatchUpdate(node, receiver) {
+            return (isPrimitiveLiteral(node.arguments[1]) ||
+                receiverBindsRealtime(node, receiver));
+        }
         function isFirestoreUpdateCall(node) {
             // Check if it's a set() call with merge: true
             if (node.callee.type === utils_1.AST_NODE_TYPES.MemberExpression) {
@@ -119,11 +347,13 @@ exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
                     // Only flag update() calls that are Firestore operations
                     if (property.name === 'update') {
                         const object = node.callee.object;
-                        // Check for BatchManager update calls
+                        // Check for BatchManager update calls. The Realtime Database
+                        // manager answers to the same field name without a `set` method, so
+                        // its calls are not Firestore operations at all.
                         if (object.type === utils_1.AST_NODE_TYPES.MemberExpression &&
                             object.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                            object.property.name === 'batchManager') {
-                            return true;
+                            object.property.name === BATCH_MANAGER) {
+                            return !isRealtimeBatchUpdate(node, object);
                         }
                         if (object.type === utils_1.AST_NODE_TYPES.CallExpression) {
                             // Check if it's a createHash().update() call