@blumintinc/eslint-plugin-blumint 1.20.103 → 1.20.104

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.103',
+        version: '1.20.104',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-assert-safe-object-key.js

@@ -118,6 +118,36 @@ function isInsideMockFactory(node) {
     }
     return false;
 }
+/**
+ * Strips the wrappers that stand between a computed key and the value that
+ * actually names the property. `k as string`, `k satisfies string`, `<string>k`
+ * and `k!` erase at compile time, and `await k` resolves to the very same key,
+ * so every one of them leaves the run-time lookup untouched — including a lookup
+ * of `__proto__` or `constructor`. Reading the wrapper instead of what it holds
+ * classifies nothing and turns appending `as string` into a silent bypass of the
+ * guard, so the wrappers are peeled off before the key is judged.
+ *
+ * The peel repeats because the wrappers nest: `(x as any)!` is a non-null
+ * assertion over a type assertion.
+ */
+function unwrapKeyExpression(node) {
+    let current = node;
+    for (;;) {
+        switch (current.type) {
+            case utils_1.AST_NODE_TYPES.TSAsExpression:
+            case utils_1.AST_NODE_TYPES.TSSatisfiesExpression:
+            case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+            case utils_1.AST_NODE_TYPES.TSTypeAssertion:
+                current = current.expression;
+                break;
+            case utils_1.AST_NODE_TYPES.AwaitExpression:
+                current = current.argument;
+                break;
+            default:
+                return current;
+        }
+    }
+}
 /** Names that read as a positional sequence rather than a keyed record. */
 const ARRAY_LIKE_NAME = /^(array|arr|items|elements|list|collection|data)s?$/i;
 /**
@@ -186,18 +216,90 @@ function isNumericCall(node) {
         callee.object.name === 'Math');
 }
 /**
- * A `: number` annotation on a binding name. Only parameters and variable
- * declarators carry one, and a declarator is judged from its writes, so this
- * effectively identifies a numeric parameter.
+ * A `: number` annotation on a binding name. Parameters and variable
+ * declarators are the bindings that carry one, and TypeScript checks every
+ * value that reaches such a binding against it.
  */
 function isNumberAnnotated(node) {
     return (node.type === utils_1.AST_NODE_TYPES.Identifier &&
         node.typeAnnotation?.typeAnnotation.type === utils_1.AST_NODE_TYPES.TSNumberKeyword);
 }
+/** The types an assertion can launder any value through without complaint. */
+const LAUNDERING_ASSERTION_TYPES = new Set([
+    utils_1.AST_NODE_TYPES.TSAnyKeyword,
+    utils_1.AST_NODE_TYPES.TSUnknownKeyword,
+]);
+/**
+ * An assertion naming `number` over the value it wraps — `f() as number`,
+ * `f() satisfies number`, `<number>f()`. An assertion to anything other than
+ * the `number` keyword — `as any`, `as unknown`, `as string`, `as const`, a
+ * union, a generic — is not this claim at all.
+ *
+ * The claim is only worth trusting because TypeScript checks it: `f() as number`
+ * is rejected unless the operand's type overlaps `number`. A step through `any`
+ * or `unknown` removes exactly that check, which is what makes
+ * `userInput as unknown as number` the idiom for asserting anything at all — so
+ * a chain carrying one proves nothing, and a string laundered through it would
+ * re-open the `__proto__` key this rule exists to stop.
+ */
+function assertsNumberType(node) {
+    if ((node.type !== utils_1.AST_NODE_TYPES.TSAsExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSSatisfiesExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSTypeAssertion) ||
+        node.typeAnnotation.type !== utils_1.AST_NODE_TYPES.TSNumberKeyword) {
+        return false;
+    }
+    for (let inner = node.expression; inner.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSSatisfiesExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSTypeAssertion; inner = inner.expression) {
+        if (LAUNDERING_ASSERTION_TYPES.has(inner.typeAnnotation.type)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Whether the write is the initializer of a declaration that declares itself
+ * numeric — either by annotating the binding name (`const k: number =
+ * rankOf(id)`, `(index: number = rankOf(id)) =>`) or by asserting the
+ * initializing value (`const k = rankOf(id) as number`). TypeScript rejects a
+ * non-numeric value under either spelling, so on a TypeScript source both are
+ * syntactic proof that the value is a number — the same trust a
+ * `(index: number) =>` parameter already earns. Without them an author whose
+ * index comes from a call has no compliant spelling at all, because the shape
+ * of a call proves nothing on its own.
+ *
+ * The proof covers the initializer alone. A later assignment is a separate
+ * statement and is where a value out of a `catch` binding or an `any`-typed
+ * source enters the binding, so every other write still has to prove itself by
+ * its own shape — including a `for (k of xs)` binding, whose write expression
+ * is the iterated value rather than an initializer.
+ */
+function initializesNumericDeclaration(writeExpr) {
+    const site = writeExpr.parent;
+    switch (site?.type) {
+        case utils_1.AST_NODE_TYPES.VariableDeclarator:
+            // A destructuring pattern takes the initializer apart before binding, so
+            // an assertion over the whole initializer describes the container rather
+            // than the element bound out of it: `const { a } = f() as number` says
+            // nothing about `a`.
+            return (site.id.type === utils_1.AST_NODE_TYPES.Identifier &&
+                (isNumberAnnotated(site.id) || assertsNumberType(writeExpr)));
+        // A parameter default is checked against the parameter's own annotation the
+        // same way a declarator's initializer is checked against its own. That
+        // annotation is also what admits the parameter as a numeric binding at all,
+        // so an assertion on the default decides nothing here.
+        case utils_1.AST_NODE_TYPES.AssignmentPattern:
+            return isNumberAnnotated(site.left);
+        default:
+            return false;
+    }
+}
 /**
  * Whether the definition can hold a number: a declarator (whose value is proven
- * by its writes) or a parameter annotated `: number`. Anything else — an
- * import, a function or class name, a catch binding — is not.
+ * by its declaration site and its writes) or a parameter annotated `: number`.
+ * Anything else — an import, a function or class name, a catch binding — is
+ * not.
  */
 function definesNumericBinding(def) {
     return (def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator ||
@@ -431,6 +533,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                 return createFixes(fixer, node, expressionText);
             },
         });
+        /**
+         * Reports a key whose written form may carry assertion or await wrappers.
+         *
+         * The report and the fix sit on the outermost written node, so the wrapper
+         * the author put there survives the rewrite: `m[assertSafe(k as string)]`
+         * rather than `m[assertSafe(k)]`, which would delete text the fixer does not
+         * own. `assertSafe` is identity-typed (`<T extends PropertyKey>(key: T): T`),
+         * so wrapping the asserted expression preserves the key's type, and wrapping
+         * an `await` keeps the validation on the resolved key rather than moving it
+         * onto the promise.
+         *
+         * A key written without a wrapper keeps the narrower argument the fix has
+         * always emitted: `String(id)` and `` `${id}` `` collapse to `id`, whose
+         * conversion assertSafe subsumes.
+         */
+        const reportWrittenKey = (written, unwrapped, innerText) => reportUseAssertSafe(written, written === unwrapped ? innerText : context.sourceCode.getText(written));
         /**
          * Returns true when the identifier was initialized directly from an
          * assertSafe(...) call, e.g. `const safeKey = assertSafe(rawKey)`.
@@ -463,34 +581,36 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
          * does not prove numeric keeps being reported.
          */
         const isStaticallyNumeric = (node, seen = new Set()) => {
-            switch (node.type) {
+            // An assertion or an await around an operand leaves its run-time value
+            // alone, so the proof reads through to what the wrapper holds. The
+            // annotation on the binding underneath is what proves the key numeric —
+            // an assertion asserts and proves nothing on its own.
+            const target = unwrapKeyExpression(node);
+            switch (target.type) {
                 case utils_1.AST_NODE_TYPES.Literal:
-                    return typeof node.value === 'number';
+                    return typeof target.value === 'number';
                 case utils_1.AST_NODE_TYPES.UpdateExpression:
                     return true;
                 case utils_1.AST_NODE_TYPES.UnaryExpression:
-                    return (node.operator === '-' ||
-                        node.operator === '+' ||
-                        node.operator === '~');
+                    return (target.operator === '-' ||
+                        target.operator === '+' ||
+                        target.operator === '~');
                 case utils_1.AST_NODE_TYPES.BinaryExpression:
-                    if (NUMERIC_BINARY_OPERATORS.has(node.operator)) {
+                    if (NUMERIC_BINARY_OPERATORS.has(target.operator)) {
                         return true;
                     }
-                    return (node.operator === '+' &&
-                        isStaticallyNumeric(node.left, seen) &&
-                        isStaticallyNumeric(node.right, seen));
+                    return (target.operator === '+' &&
+                        isStaticallyNumeric(target.left, seen) &&
+                        isStaticallyNumeric(target.right, seen));
                 case utils_1.AST_NODE_TYPES.CallExpression:
-                    return isNumericCall(node);
+                    return isNumericCall(target);
                 case utils_1.AST_NODE_TYPES.MemberExpression:
                     // `.length` is a number on arrays, typed arrays and strings alike.
-                    return (!node.computed &&
-                        node.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                        node.property.name === 'length');
-                case utils_1.AST_NODE_TYPES.TSAsExpression:
-                case utils_1.AST_NODE_TYPES.TSNonNullExpression:
-                    return isStaticallyNumeric(node.expression, seen);
+                    return (!target.computed &&
+                        target.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                        target.property.name === 'length');
                 case utils_1.AST_NODE_TYPES.Identifier:
-                    return isNumericIdentifier(node, seen);
+                    return isNumericIdentifier(target, seen);
                 default:
                     return false;
             }
@@ -523,6 +643,9 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                     NUMERIC_ASSIGNMENT_OPERATORS.has(assignment.operator)) {
                     return true;
                 }
+                if (initializesNumericDeclaration(writeExpr)) {
+                    return true;
+                }
                 return isStaticallyNumeric(writeExpr, nextSeen);
             });
             if (!staysNumeric) {
@@ -538,14 +661,15 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             // Handle computed property in object destructuring
             Property(node) {
                 if (node.computed && node.key) {
-                    const key = node.key;
+                    const written = node.key;
+                    const key = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (key.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         key.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         key.callee.name === 'String') {
                         const arg = key.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(key, argText);
+                        reportWrittenKey(written, key, argText);
                     }
                     // Check for template literals like `${id}`
                     if (key.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -555,21 +679,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         key.quasis[1].value.raw === '') {
                         const expr = key.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(key, exprText);
+                        reportWrittenKey(written, key, exprText);
                     }
                 }
             },
             // Handle binary expressions like 'key' in obj
             BinaryExpression(node) {
                 if (node.operator === 'in') {
-                    const left = node.left;
+                    const written = node.left;
+                    const left = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (left.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         left.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         left.callee.name === 'String') {
                         const arg = left.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(left, argText);
+                        reportWrittenKey(written, left, argText);
                     }
                     // Check for template literals like `${id}`
                     if (left.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -579,13 +704,17 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         left.quasis[1].value.raw === '') {
                         const expr = left.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(left, exprText);
+                        reportWrittenKey(written, left, exprText);
                     }
                 }
             },
             MemberExpression(node) {
                 if (node.computed) {
-                    const property = node.property;
+                    const written = node.property;
+                    // The written key may sit under assertion or await wrappers that erase
+                    // at run time; what they hold is what names the property, so that is
+                    // what the branches below classify.
+                    const property = unwrapKeyExpression(written);
                     // Skip if already using assertSafe
                     if (property.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         property.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
@@ -619,7 +748,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         property.callee.name === 'String') {
                         const arg = property.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(property, argText);
+                        reportWrittenKey(written, property, argText);
                         return;
                     }
                     // Check for template literals
@@ -640,7 +769,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         }
                         const expr = property.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(property, exprText);
+                        reportWrittenKey(written, property, exprText);
                         return;
                     }
                     // Check for direct variable usage (identifiers)
@@ -659,7 +788,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for binary expressions (like index + 1)
@@ -669,7 +798,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for boolean expressions and other literals
@@ -681,7 +810,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for function calls (anything that isn't handled above)
@@ -694,7 +823,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                 }

package/lib/rules/enforce-firestore-set-merge.js

@@ -9,6 +9,16 @@ const FIRESTORE_MODULES = new Set(['firebase/firestore', 'firebase-admin']);
 const UPDATE_DOC = 'updateDoc';
 const SET_DOC = 'setDoc';
 const MERGE_ARGUMENT = ', { merge: true }';
+const BATCH_MANAGER = 'batchManager';
+/**
+ * Realtime Database's batch manager is held under the same `batchManager` field
+ * name as the Firestore one, yet it exposes no `set` method at all — its
+ * positional `update(path, data)` is the only write path it has, and RTDB's
+ * update already merges shallowly. Rewriting one of its calls emits a method
+ * that does not exist (TS2339), so a receiver proven to be this class is out of
+ * the rule's scope entirely.
+ */
+const REALTIME_BATCH_MANAGER = 'RealtimeBatchManager';
 function isFirestoreDynamicImport(node) {
     if (node?.type !== utils_1.AST_NODE_TYPES.AwaitExpression) {
         return false;
@@ -67,6 +77,121 @@ function bindsFirestoreExport(variable, imported) {
     return (variable.defs.length > 0 &&
         variable.defs.every((def) => firestoreBindingOf(def)?.imported === imported));
 }
+/** The rightmost segment of a type name, so `realtimeDb.X` reads like a bare `X`. */
+function typeNameOf(node) {
+    if (node.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return node.name;
+    }
+    if (node.type === utils_1.AST_NODE_TYPES.TSQualifiedName) {
+        return typeNameOf(node.right);
+    }
+    return null;
+}
+/**
+ * Whether a type annotation names the Realtime Database batch manager. Wrappers
+ * that preserve the instance type — `Readonly<…>`, a union, an intersection —
+ * are looked through, because the field they annotate still holds the class.
+ */
+function isRealtimeType(node) {
+    if (!node) {
+        return false;
+    }
+    switch (node.type) {
+        case utils_1.AST_NODE_TYPES.TSTypeReference:
+            return (typeNameOf(node.typeName) === REALTIME_BATCH_MANAGER ||
+                (node.typeParameters?.params ?? []).some(isRealtimeType));
+        case utils_1.AST_NODE_TYPES.TSUnionType:
+        case utils_1.AST_NODE_TYPES.TSIntersectionType:
+            return node.types.some(isRealtimeType);
+        default:
+            return false;
+    }
+}
+function isRealtimeAnnotation(annotation) {
+    return isRealtimeType(annotation?.typeAnnotation);
+}
+/** Whether an initializer constructs the Realtime Database batch manager. */
+function isRealtimeInstance(node) {
+    if (node?.type !== utils_1.AST_NODE_TYPES.NewExpression) {
+        return false;
+    }
+    const { callee } = node;
+    if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return callee.name === REALTIME_BATCH_MANAGER;
+    }
+    return (callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+        !callee.computed &&
+        callee.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+        callee.property.name === REALTIME_BATCH_MANAGER);
+}
+/**
+ * Whether a parameter binds `name` to the Realtime batch manager. A parameter
+ * property declares the field outright; a plain constructor parameter of the
+ * same name is the evidence a subclass carries when it forwards the manager to a
+ * `super()` that stores it.
+ */
+function parameterBindsRealtime(param, name) {
+    const declared = param.type === utils_1.AST_NODE_TYPES.TSParameterProperty ? param.parameter : param;
+    const identifier = declared.type === utils_1.AST_NODE_TYPES.AssignmentPattern
+        ? declared.left
+        : declared;
+    const initializer = declared.type === utils_1.AST_NODE_TYPES.AssignmentPattern ? declared.right : null;
+    return (identifier.type === utils_1.AST_NODE_TYPES.Identifier &&
+        identifier.name === name &&
+        (isRealtimeAnnotation(identifier.typeAnnotation) ||
+            isRealtimeInstance(initializer)));
+}
+/** Whether a class member identifies `name` as the Realtime batch manager. */
+function memberBindsRealtime(member, name) {
+    if (member.type === utils_1.AST_NODE_TYPES.PropertyDefinition) {
+        return (!member.computed &&
+            member.key.type === utils_1.AST_NODE_TYPES.Identifier &&
+            member.key.name === name &&
+            (isRealtimeInstance(member.value) ||
+                isRealtimeAnnotation(member.typeAnnotation)));
+    }
+    return (member.type === utils_1.AST_NODE_TYPES.MethodDefinition &&
+        member.kind === 'constructor' &&
+        member.value.params.some((param) => parameterBindsRealtime(param, name)));
+}
+/** Strips assertions, which change a literal's type but not its value. */
+function unwrapAssertions(node) {
+    if (node.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+        node.type === utils_1.AST_NODE_TYPES.TSSatisfiesExpression ||
+        node.type === utils_1.AST_NODE_TYPES.TSTypeAssertion ||
+        node.type === utils_1.AST_NODE_TYPES.TSNonNullExpression) {
+        return unwrapAssertions(node.expression);
+    }
+    return node;
+}
+/**
+ * Whether an expression evaluates to a primitive value on its face. Firestore's
+ * update data is an object of field updates, so a primitive in the data
+ * position proves the call is not Firestore's — the only signal available where
+ * the receiver is inherited from another module.
+ */
+function isPrimitiveLiteral(node) {
+    if (!node) {
+        return false;
+    }
+    const expression = unwrapAssertions(node);
+    // A template literal evaluates to a string however it interpolates.
+    if (expression.type === utils_1.AST_NODE_TYPES.TemplateLiteral) {
+        return true;
+    }
+    if (expression.type === utils_1.AST_NODE_TYPES.UnaryExpression &&
+        (expression.operator === '-' || expression.operator === '+')) {
+        return isPrimitiveLiteral(expression.argument);
+    }
+    if (expression.type !== utils_1.AST_NODE_TYPES.Literal) {
+        return false;
+    }
+    const { value } = expression;
+    return (typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        typeof value === 'bigint');
+}
 exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
     name: 'enforce-firestore-set-merge',
     meta: {
@@ -97,6 +222,109 @@ exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
          */
         const isReportSuppressed = (0, disableDirectives_1.createSuppressionChecker)(context);
         let plannedSetDocBinding = false;
+        /**
+         * Top-level classes by name, so a field inherited from a superclass declared
+         * in the same file resolves to the declaration that carries its evidence.
+         */
+        let topLevelClasses = null;
+        function classBodiesByName() {
+            if (topLevelClasses) {
+                return topLevelClasses;
+            }
+            topLevelClasses = new Map();
+            for (const statement of sourceCode.ast.body) {
+                const declaration = statement.type === utils_1.AST_NODE_TYPES.ExportNamedDeclaration ||
+                    statement.type === utils_1.AST_NODE_TYPES.ExportDefaultDeclaration
+                    ? statement.declaration
+                    : statement;
+                if (declaration?.type === utils_1.AST_NODE_TYPES.ClassDeclaration &&
+                    declaration.id) {
+                    topLevelClasses.set(declaration.id.name, declaration.body);
+                    continue;
+                }
+                if (declaration?.type === utils_1.AST_NODE_TYPES.VariableDeclaration) {
+                    for (const declarator of declaration.declarations) {
+                        if (declarator.id.type === utils_1.AST_NODE_TYPES.Identifier &&
+                            declarator.init?.type === utils_1.AST_NODE_TYPES.ClassExpression) {
+                            topLevelClasses.set(declarator.id.name, declarator.init.body);
+                        }
+                    }
+                }
+            }
+            return topLevelClasses;
+        }
+        function enclosingClassBody(node) {
+            let current = node.parent;
+            while (current) {
+                if (current.type === utils_1.AST_NODE_TYPES.ClassBody) {
+                    return current;
+                }
+                current = current.parent;
+            }
+            return null;
+        }
+        /** Follows `extends` in-file, since a subclass inherits its field's type. */
+        function classBindsRealtime(body, name, seen) {
+            if (seen.has(body)) {
+                return false;
+            }
+            seen.add(body);
+            if (body.body.some((member) => memberBindsRealtime(member, name))) {
+                return true;
+            }
+            const declaration = body.parent;
+            const superClass = declaration?.type === utils_1.AST_NODE_TYPES.ClassDeclaration ||
+                declaration?.type === utils_1.AST_NODE_TYPES.ClassExpression
+                ? declaration.superClass
+                : null;
+            if (superClass?.type !== utils_1.AST_NODE_TYPES.Identifier) {
+                return false;
+            }
+            const superBody = classBodiesByName().get(superClass.name);
+            return superBody ? classBindsRealtime(superBody, name, seen) : false;
+        }
+        function identifierBindsRealtime(identifier) {
+            const scope = ASTHelpers_1.ASTHelpers.getScope(context, identifier);
+            const variable = ASTHelpers_1.ASTHelpers.findVariableInScope(scope, identifier.name);
+            return (variable?.defs ?? []).some((def) => {
+                const declaredName = def.name;
+                return ((declaredName.type === utils_1.AST_NODE_TYPES.Identifier &&
+                    isRealtimeAnnotation(declaredName.typeAnnotation)) ||
+                    (def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+                        isRealtimeInstance(def.node.init)));
+            });
+        }
+        /**
+         * Whether the file itself proves the receiver holds a RealtimeBatchManager:
+         * `this.batchManager` against the class (or an in-file superclass) that
+         * declares the field, and a plain identifier against its binding.
+         */
+        function receiverBindsRealtime(node, receiver) {
+            if (receiver.type === utils_1.AST_NODE_TYPES.Identifier) {
+                return identifierBindsRealtime(receiver);
+            }
+            if (receiver.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+                receiver.computed ||
+                receiver.property.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                receiver.object.type !== utils_1.AST_NODE_TYPES.ThisExpression) {
+                return false;
+            }
+            const body = enclosingClassBody(node);
+            return body
+                ? classBindsRealtime(body, receiver.property.name, new Set())
+                : false;
+        }
+        /**
+         * Either syntactic signal puts a `batchManager.update(…)` call outside the
+         * rule: the receiver resolves in-file to the Realtime Database manager, or
+         * the data argument is a primitive literal, which Firestore's object of
+         * field updates can never be. A call with no data argument has nothing in
+         * that position, so only the receiver can answer for it.
+         */
+        function isRealtimeBatchUpdate(node, receiver) {
+            return (isPrimitiveLiteral(node.arguments[1]) ||
+                receiverBindsRealtime(node, receiver));
+        }
         function isFirestoreUpdateCall(node) {
             // Check if it's a set() call with merge: true
             if (node.callee.type === utils_1.AST_NODE_TYPES.MemberExpression) {
@@ -119,11 +347,13 @@ exports.enforceFirestoreSetMerge = (0, createRule_1.createRule)({
                     // Only flag update() calls that are Firestore operations
                     if (property.name === 'update') {
                         const object = node.callee.object;
-                        // Check for BatchManager update calls
+                        // Check for BatchManager update calls. The Realtime Database
+                        // manager answers to the same field name without a `set` method, so
+                        // its calls are not Firestore operations at all.
                         if (object.type === utils_1.AST_NODE_TYPES.MemberExpression &&
                             object.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                            object.property.name === 'batchManager') {
-                            return true;
+                            object.property.name === BATCH_MANAGER) {
+                            return !isRealtimeBatchUpdate(node, object);
                         }
                         if (object.type === utils_1.AST_NODE_TYPES.CallExpression) {
                             // Check if it's a createHash().update() call

package/lib/rules/enforce-querykey-ts.js

@@ -21,6 +21,24 @@ const SRC_TIER_SEGMENT = '/src/';
  * the alias must still have its existing imports understood.
  */
 const ALIASED_QUERY_KEYS_MODULE = '@/util/routing/queryKeys';
+/**
+ * queryKeys.ts is also reachable through the constants barrel, which
+ * `prefer-global-router-state-key` accepts as an approved re-export
+ * (prefer-global-router-state-key.ts:139-143) and whose messages advertise it.
+ * Both rules police the same `useRouterState` key and both ship as `error` in
+ * the recommended config, so a source one of them blesses must not be the
+ * other's violation (#1714).
+ */
+const APPROVED_REEXPORT_SOURCES = new Set(['constants', 'constants/index']);
+/**
+ * Reduce a specifier to the module it names, dropping the roots that are all
+ * spellings of the same location: the `@/` and `src/` aliases, and any run of
+ * relative steps. Mirrors the sibling's normalization
+ * (prefer-global-router-state-key.ts:149-151) so `src/constants` and
+ * `../constants` are recognized as the same approved re-export that `constants`
+ * is.
+ */
+const normalizeSpecifier = (source) => source.replace(/^@\/|^src\//, '').replace(/^(\.\/|\.\.\/)+/, '');
 const toPosixPath = (filePath) => filePath.replace(/\\/g, '/');
 const ensureRelativeSpecifier = (specifier) => specifier.startsWith('.') ? specifier : `./${specifier}`;
 const isWindowsDrivePath = (filePath) => /^[A-Za-z]:[\\/]/.test(filePath);
@@ -91,7 +109,6 @@ exports.enforceQueryKeyTs = (0, createRule_1.createRule)({
             ALIASED_QUERY_KEYS_MODULE,
             QUERY_KEYS_MODULE,
         ]);
-        const allowedQueryKeyFactories = new Set(['makeQueryKey', 'getQueryKey']);
         const sourceCode = context.getSourceCode();
         /**
          * Reports are buffered until the whole file has been walked so the fixer can
@@ -128,6 +145,15 @@ exports.enforceQueryKeyTs = (0, createRule_1.createRule)({
                 source.endsWith(`/${QUERY_KEYS_SUFFIX}`)) {
                 return true;
             }
+            // The approved re-export and the root-relative spelling of the module
+            // itself are recognized under every alias of their root, which is what the
+            // sibling rule accepts; recognizing less makes its advertised remedy this
+            // rule's violation (#1714).
+            const normalized = normalizeSpecifier(source);
+            if (APPROVED_REEXPORT_SOURCES.has(normalized) ||
+                normalized === QUERY_KEYS_SUFFIX) {
+                return true;
+            }
             // A relative specifier can name the module without spelling out
             // `util/routing`: a sibling reaches it as `./queryKeys`, and a file two
             // directories below `src/util` as `../../routing/queryKeys`. Resolving
@@ -401,18 +427,14 @@ exports.enforceQueryKeyTs = (0, createRule_1.createRule)({
                 return (isValidQueryKeyUsage(node.consequent) &&
                     isValidQueryKeyUsage(node.alternate));
             }
-            // Allow function calls that might return query keys
+            // A call's return value is opaque to a syntactic check, so every call is
+            // allowed rather than guessed at — the position
+            // `prefer-global-router-state-key` takes and documents. Enumerating
+            // factory names instead reported whichever spelling the enumeration
+            // missed, including the `buildQueryKey` of the sibling's own documented
+            // remedy (#1714).
             if (node.type === utils_1.AST_NODE_TYPES.CallExpression) {
-                const callee = node.callee;
-                if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
-                    return allowedQueryKeyFactories.has(callee.name);
-                }
-                if (callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
-                    !callee.computed &&
-                    callee.property.type === utils_1.AST_NODE_TYPES.Identifier) {
-                    return allowedQueryKeyFactories.has(callee.property.name);
-                }
-                return false;
+                return true;
             }
             return false;
         }

package/lib/rules/use-latest-callback.js

@@ -312,6 +312,132 @@ const orphansLocalBinding = (root, deletedRanges) => [...variablesReferencedIn(r
     .filter((variable) => variable.defs.length > 0 && isFunctionLocal(variable))
     .some((variable) => variable.references.every((reference) => !reference.isRead() ||
     fallsInside(deletedRanges, reference.identifier.range)));
+/**
+ * A hook, by React's naming convention. The convention is the only general
+ * signal available in one file: a custom hook's body may live anywhere, so no
+ * list of hook names (`useFirestore`, `useDocSnapshot`, ...) can be complete.
+ */
+const HOOK_NAME = /^use[A-Z]/;
+/**
+ * The name the naming convention applies to. A member callee
+ * (`hooks.useThing(...)`) carries it on the property, which is what the author
+ * reads as the hook's name.
+ */
+const calleeNameOf = (call) => {
+    const { callee } = call;
+    if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return callee.name;
+    }
+    if (callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+        !callee.computed &&
+        callee.property.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return callee.property.name;
+    }
+    return null;
+};
+const isHookCall = (call) => {
+    const name = calleeNameOf(call);
+    return !!name && HOOK_NAME.test(name);
+};
+/** Wrappers a value passes through without its identity changing. */
+const TRANSPARENT_VALUE_WRAPPERS = new Set([
+    utils_1.AST_NODE_TYPES.TSAsExpression,
+    utils_1.AST_NODE_TYPES.TSSatisfiesExpression,
+    utils_1.AST_NODE_TYPES.TSNonNullExpression,
+    utils_1.AST_NODE_TYPES.TSTypeAssertion,
+]);
+/**
+ * Whether the value written at `node` reaches a hook in a position where the
+ * hook can compare it between renders: an element of a dependency array handed
+ * to a hook (`useEffect(effect, [handler])`), or a direct argument of one — a
+ * custom hook is free to list an argument in a dependency array of its own, and
+ * `useFirestore(handler, initial)` does exactly that.
+ *
+ * Positions that use the value without keying anything on its identity do not
+ * qualify: calling it, spelling it as a JSX prop, or handing it to a plain
+ * function all read through to the latest closure a stable wrapper holds, so
+ * nothing observes the frozen reference.
+ */
+const feedsHookDependency = (node) => {
+    let value = node;
+    let parent = value.parent;
+    while (parent) {
+        if (parent.type === utils_1.AST_NODE_TYPES.CallExpression) {
+            return (parent.arguments.some((argument) => argument === value) &&
+                isHookCall(parent));
+        }
+        // An array is followed out to whatever holds it, which is how an element of
+        // a dependency array is reached. Everything else — a JSX container, a
+        // property, a return, a function body — ends the walk, because the identity
+        // stops being an argument the hook itself receives.
+        if (parent.type !== utils_1.AST_NODE_TYPES.ArrayExpression &&
+            !TRANSPARENT_VALUE_WRAPPERS.has(parent.type)) {
+            return false;
+        }
+        value = parent;
+        parent = value.parent;
+    }
+    return false;
+};
+/**
+ * Whether the call's result changes identity between renders. An empty
+ * dependency array already pins it for the component's lifetime, so converting
+ * the call cannot change what any consumer observes. A missing array, or one
+ * spelled as a value this file cannot read, leaves a reference the author may
+ * be keying on.
+ */
+const identityCanChange = (call) => {
+    const dependencies = call.arguments[1];
+    if (!dependencies) {
+        return true;
+    }
+    if (dependencies.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+        return dependencies.elements.length > 0;
+    }
+    return true;
+};
+/** The declarator binding the call's result, seen through TS wrappers. */
+const declaratorOf = (call) => {
+    let value = call;
+    let parent = value.parent;
+    while (parent && TRANSPARENT_VALUE_WRAPPERS.has(parent.type)) {
+        value = parent;
+        parent = value.parent;
+    }
+    return parent &&
+        parent.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+        parent.init === value
+        ? parent
+        : null;
+};
+/**
+ * Whether the callback's identity is load-bearing: it changes between renders
+ * AND something in this file keys a hook on it.
+ *
+ * `useLatestCallback` returns a permanently stable reference, so a hook that
+ * compares the callback across renders stops seeing it change. An effect keyed
+ * on the callback then fires once, ever — the callers that deliberately rebuild
+ * a handler so a fetch re-runs lose their refresh (issue #1711). No compliant
+ * remedy exists for such a site: rewriting it as `useMemo` is converted back to
+ * `useCallback` by `prefer-usecallback-over-usememo-for-functions`, so the
+ * violation is not reported at all rather than reported without a fix.
+ *
+ * A callback whose identity is exposed some other way — returned from a custom
+ * hook, stored on an object — keeps reporting: the consumer is out of this
+ * file's sight, and reporting is the direction that preserves the rule.
+ */
+const identityIsLoadBearing = (context, call) => {
+    if (!identityCanChange(call)) {
+        return false;
+    }
+    const declarator = declaratorOf(call);
+    // An unbound call is consumed where it is written, so its own position in the
+    // tree answers the question the references would.
+    if (!declarator) {
+        return feedsHookDependency(call);
+    }
+    return ASTHelpers_1.ASTHelpers.getDeclaredVariables(context, declarator).some((variable) => variable.references.some((reference) => reference.isRead() && feedsHookDependency(reference.identifier)));
+};
 exports.useLatestCallback = (0, createRule_1.createRule)({
     name: 'use-latest-callback',
     meta: {
@@ -454,7 +580,10 @@ exports.useLatestCallback = (0, createRule_1.createRule)({
                             }
                         }
                     }
-                    if (!isJsxReturning) {
+                    // A callback another hook keys on is left alone entirely — see
+                    // identityIsLoadBearing for why the report itself is withheld rather
+                    // than just its fix.
+                    if (!isJsxReturning && !identityIsLoadBearing(context, node)) {
                         const currentCallbackName = node.callee.type === utils_1.AST_NODE_TYPES.Identifier
                             ? node.callee.name
                             : node.callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.103",
+  "version": "1.20.104",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,43 @@
 [
+  {
+    "version": "1.20.104",
+    "date": "2026-08-04T20:46:47.102Z",
+    "rules": [
+      {
+        "name": "enforce-assert-safe-object-key",
+        "changeType": "fix",
+        "issues": [
+          1712,
+          1713
+        ],
+        "summary": "honour the declaration site as a numeric proof (closes #1713); read computed keys through assertion and await wrappers (closes #1712)"
+      },
+      {
+        "name": "enforce-firestore-set-merge",
+        "changeType": "fix",
+        "issues": [
+          1710
+        ],
+        "summary": "exempt Realtime Database receivers from the batchManager name match (closes #1710)"
+      },
+      {
+        "name": "enforce-querykey-ts",
+        "changeType": "fix",
+        "issues": [
+          1714
+        ],
+        "summary": "accept the key shapes prefer-global-router-state-key blesses (closes #1714)"
+      },
+      {
+        "name": "use-latest-callback",
+        "changeType": "fix",
+        "issues": [
+          1711
+        ],
+        "summary": "exempt callbacks whose identity another hook keys on (closes #1711)"
+      }
+    ]
+  },
   {
     "version": "1.20.103",
     "date": "2026-08-04T18:19:46.054Z",