@blumintinc/eslint-plugin-blumint 1.20.103 → 1.20.105

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.103',
+        version: '1.20.105',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-assert-safe-object-key.js

@@ -118,6 +118,36 @@ function isInsideMockFactory(node) {
     }
     return false;
 }
+/**
+ * Strips the wrappers that stand between a computed key and the value that
+ * actually names the property. `k as string`, `k satisfies string`, `<string>k`
+ * and `k!` erase at compile time, and `await k` resolves to the very same key,
+ * so every one of them leaves the run-time lookup untouched — including a lookup
+ * of `__proto__` or `constructor`. Reading the wrapper instead of what it holds
+ * classifies nothing and turns appending `as string` into a silent bypass of the
+ * guard, so the wrappers are peeled off before the key is judged.
+ *
+ * The peel repeats because the wrappers nest: `(x as any)!` is a non-null
+ * assertion over a type assertion.
+ */
+function unwrapKeyExpression(node) {
+    let current = node;
+    for (;;) {
+        switch (current.type) {
+            case utils_1.AST_NODE_TYPES.TSAsExpression:
+            case utils_1.AST_NODE_TYPES.TSSatisfiesExpression:
+            case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+            case utils_1.AST_NODE_TYPES.TSTypeAssertion:
+                current = current.expression;
+                break;
+            case utils_1.AST_NODE_TYPES.AwaitExpression:
+                current = current.argument;
+                break;
+            default:
+                return current;
+        }
+    }
+}
 /** Names that read as a positional sequence rather than a keyed record. */
 const ARRAY_LIKE_NAME = /^(array|arr|items|elements|list|collection|data)s?$/i;
 /**
@@ -186,18 +216,90 @@ function isNumericCall(node) {
         callee.object.name === 'Math');
 }
 /**
- * A `: number` annotation on a binding name. Only parameters and variable
- * declarators carry one, and a declarator is judged from its writes, so this
- * effectively identifies a numeric parameter.
+ * A `: number` annotation on a binding name. Parameters and variable
+ * declarators are the bindings that carry one, and TypeScript checks every
+ * value that reaches such a binding against it.
  */
 function isNumberAnnotated(node) {
     return (node.type === utils_1.AST_NODE_TYPES.Identifier &&
         node.typeAnnotation?.typeAnnotation.type === utils_1.AST_NODE_TYPES.TSNumberKeyword);
 }
+/** The types an assertion can launder any value through without complaint. */
+const LAUNDERING_ASSERTION_TYPES = new Set([
+    utils_1.AST_NODE_TYPES.TSAnyKeyword,
+    utils_1.AST_NODE_TYPES.TSUnknownKeyword,
+]);
+/**
+ * An assertion naming `number` over the value it wraps — `f() as number`,
+ * `f() satisfies number`, `<number>f()`. An assertion to anything other than
+ * the `number` keyword — `as any`, `as unknown`, `as string`, `as const`, a
+ * union, a generic — is not this claim at all.
+ *
+ * The claim is only worth trusting because TypeScript checks it: `f() as number`
+ * is rejected unless the operand's type overlaps `number`. A step through `any`
+ * or `unknown` removes exactly that check, which is what makes
+ * `userInput as unknown as number` the idiom for asserting anything at all — so
+ * a chain carrying one proves nothing, and a string laundered through it would
+ * re-open the `__proto__` key this rule exists to stop.
+ */
+function assertsNumberType(node) {
+    if ((node.type !== utils_1.AST_NODE_TYPES.TSAsExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSSatisfiesExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSTypeAssertion) ||
+        node.typeAnnotation.type !== utils_1.AST_NODE_TYPES.TSNumberKeyword) {
+        return false;
+    }
+    for (let inner = node.expression; inner.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSSatisfiesExpression ||
+        inner.type === utils_1.AST_NODE_TYPES.TSTypeAssertion; inner = inner.expression) {
+        if (LAUNDERING_ASSERTION_TYPES.has(inner.typeAnnotation.type)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Whether the write is the initializer of a declaration that declares itself
+ * numeric — either by annotating the binding name (`const k: number =
+ * rankOf(id)`, `(index: number = rankOf(id)) =>`) or by asserting the
+ * initializing value (`const k = rankOf(id) as number`). TypeScript rejects a
+ * non-numeric value under either spelling, so on a TypeScript source both are
+ * syntactic proof that the value is a number — the same trust a
+ * `(index: number) =>` parameter already earns. Without them an author whose
+ * index comes from a call has no compliant spelling at all, because the shape
+ * of a call proves nothing on its own.
+ *
+ * The proof covers the initializer alone. A later assignment is a separate
+ * statement and is where a value out of a `catch` binding or an `any`-typed
+ * source enters the binding, so every other write still has to prove itself by
+ * its own shape — including a `for (k of xs)` binding, whose write expression
+ * is the iterated value rather than an initializer.
+ */
+function initializesNumericDeclaration(writeExpr) {
+    const site = writeExpr.parent;
+    switch (site?.type) {
+        case utils_1.AST_NODE_TYPES.VariableDeclarator:
+            // A destructuring pattern takes the initializer apart before binding, so
+            // an assertion over the whole initializer describes the container rather
+            // than the element bound out of it: `const { a } = f() as number` says
+            // nothing about `a`.
+            return (site.id.type === utils_1.AST_NODE_TYPES.Identifier &&
+                (isNumberAnnotated(site.id) || assertsNumberType(writeExpr)));
+        // A parameter default is checked against the parameter's own annotation the
+        // same way a declarator's initializer is checked against its own. That
+        // annotation is also what admits the parameter as a numeric binding at all,
+        // so an assertion on the default decides nothing here.
+        case utils_1.AST_NODE_TYPES.AssignmentPattern:
+            return isNumberAnnotated(site.left);
+        default:
+            return false;
+    }
+}
 /**
  * Whether the definition can hold a number: a declarator (whose value is proven
- * by its writes) or a parameter annotated `: number`. Anything else — an
- * import, a function or class name, a catch binding — is not.
+ * by its declaration site and its writes) or a parameter annotated `: number`.
+ * Anything else — an import, a function or class name, a catch binding — is
+ * not.
  */
 function definesNumericBinding(def) {
     return (def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator ||
@@ -431,6 +533,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                 return createFixes(fixer, node, expressionText);
             },
         });
+        /**
+         * Reports a key whose written form may carry assertion or await wrappers.
+         *
+         * The report and the fix sit on the outermost written node, so the wrapper
+         * the author put there survives the rewrite: `m[assertSafe(k as string)]`
+         * rather than `m[assertSafe(k)]`, which would delete text the fixer does not
+         * own. `assertSafe` is identity-typed (`<T extends PropertyKey>(key: T): T`),
+         * so wrapping the asserted expression preserves the key's type, and wrapping
+         * an `await` keeps the validation on the resolved key rather than moving it
+         * onto the promise.
+         *
+         * A key written without a wrapper keeps the narrower argument the fix has
+         * always emitted: `String(id)` and `` `${id}` `` collapse to `id`, whose
+         * conversion assertSafe subsumes.
+         */
+        const reportWrittenKey = (written, unwrapped, innerText) => reportUseAssertSafe(written, written === unwrapped ? innerText : context.sourceCode.getText(written));
         /**
          * Returns true when the identifier was initialized directly from an
          * assertSafe(...) call, e.g. `const safeKey = assertSafe(rawKey)`.
@@ -463,34 +581,36 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
          * does not prove numeric keeps being reported.
          */
         const isStaticallyNumeric = (node, seen = new Set()) => {
-            switch (node.type) {
+            // An assertion or an await around an operand leaves its run-time value
+            // alone, so the proof reads through to what the wrapper holds. The
+            // annotation on the binding underneath is what proves the key numeric —
+            // an assertion asserts and proves nothing on its own.
+            const target = unwrapKeyExpression(node);
+            switch (target.type) {
                 case utils_1.AST_NODE_TYPES.Literal:
-                    return typeof node.value === 'number';
+                    return typeof target.value === 'number';
                 case utils_1.AST_NODE_TYPES.UpdateExpression:
                     return true;
                 case utils_1.AST_NODE_TYPES.UnaryExpression:
-                    return (node.operator === '-' ||
-                        node.operator === '+' ||
-                        node.operator === '~');
+                    return (target.operator === '-' ||
+                        target.operator === '+' ||
+                        target.operator === '~');
                 case utils_1.AST_NODE_TYPES.BinaryExpression:
-                    if (NUMERIC_BINARY_OPERATORS.has(node.operator)) {
+                    if (NUMERIC_BINARY_OPERATORS.has(target.operator)) {
                         return true;
                     }
-                    return (node.operator === '+' &&
-                        isStaticallyNumeric(node.left, seen) &&
-                        isStaticallyNumeric(node.right, seen));
+                    return (target.operator === '+' &&
+                        isStaticallyNumeric(target.left, seen) &&
+                        isStaticallyNumeric(target.right, seen));
                 case utils_1.AST_NODE_TYPES.CallExpression:
-                    return isNumericCall(node);
+                    return isNumericCall(target);
                 case utils_1.AST_NODE_TYPES.MemberExpression:
                     // `.length` is a number on arrays, typed arrays and strings alike.
-                    return (!node.computed &&
-                        node.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                        node.property.name === 'length');
-                case utils_1.AST_NODE_TYPES.TSAsExpression:
-                case utils_1.AST_NODE_TYPES.TSNonNullExpression:
-                    return isStaticallyNumeric(node.expression, seen);
+                    return (!target.computed &&
+                        target.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                        target.property.name === 'length');
                 case utils_1.AST_NODE_TYPES.Identifier:
-                    return isNumericIdentifier(node, seen);
+                    return isNumericIdentifier(target, seen);
                 default:
                     return false;
             }
@@ -523,6 +643,9 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                     NUMERIC_ASSIGNMENT_OPERATORS.has(assignment.operator)) {
                     return true;
                 }
+                if (initializesNumericDeclaration(writeExpr)) {
+                    return true;
+                }
                 return isStaticallyNumeric(writeExpr, nextSeen);
             });
             if (!staysNumeric) {
@@ -538,14 +661,15 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             // Handle computed property in object destructuring
             Property(node) {
                 if (node.computed && node.key) {
-                    const key = node.key;
+                    const written = node.key;
+                    const key = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (key.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         key.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         key.callee.name === 'String') {
                         const arg = key.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(key, argText);
+                        reportWrittenKey(written, key, argText);
                     }
                     // Check for template literals like `${id}`
                     if (key.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -555,21 +679,22 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         key.quasis[1].value.raw === '') {
                         const expr = key.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(key, exprText);
+                        reportWrittenKey(written, key, exprText);
                     }
                 }
             },
             // Handle binary expressions like 'key' in obj
             BinaryExpression(node) {
                 if (node.operator === 'in') {
-                    const left = node.left;
+                    const written = node.left;
+                    const left = unwrapKeyExpression(written);
                     // Check for String(id) pattern
                     if (left.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         left.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
                         left.callee.name === 'String') {
                         const arg = left.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(left, argText);
+                        reportWrittenKey(written, left, argText);
                     }
                     // Check for template literals like `${id}`
                     if (left.type === utils_1.AST_NODE_TYPES.TemplateLiteral &&
@@ -579,13 +704,17 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         left.quasis[1].value.raw === '') {
                         const expr = left.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(left, exprText);
+                        reportWrittenKey(written, left, exprText);
                     }
                 }
             },
             MemberExpression(node) {
                 if (node.computed) {
-                    const property = node.property;
+                    const written = node.property;
+                    // The written key may sit under assertion or await wrappers that erase
+                    // at run time; what they hold is what names the property, so that is
+                    // what the branches below classify.
+                    const property = unwrapKeyExpression(written);
                     // Skip if already using assertSafe
                     if (property.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         property.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
@@ -619,7 +748,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         property.callee.name === 'String') {
                         const arg = property.arguments[0];
                         const argText = context.sourceCode.getText(arg);
-                        reportUseAssertSafe(property, argText);
+                        reportWrittenKey(written, property, argText);
                         return;
                     }
                     // Check for template literals
@@ -640,7 +769,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                         }
                         const expr = property.expressions[0];
                         const exprText = context.sourceCode.getText(expr);
-                        reportUseAssertSafe(property, exprText);
+                        reportWrittenKey(written, property, exprText);
                         return;
                     }
                     // Check for direct variable usage (identifiers)
@@ -659,7 +788,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for binary expressions (like index + 1)
@@ -669,7 +798,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for boolean expressions and other literals
@@ -681,7 +810,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                     // Check for function calls (anything that isn't handled above)
@@ -694,7 +823,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                             return;
                         }
                         const propText = context.sourceCode.getText(property);
-                        reportUseAssertSafe(property, propText);
+                        reportWrittenKey(written, property, propText);
                         return;
                     }
                 }

package/lib/rules/enforce-dynamic-firebase-imports.d.ts

@@ -1,5 +1,5 @@
-import { TSESTree } from '@typescript-eslint/utils';
-declare const enforceFirebaseImports: import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleModule<"noDynamicImport", never[], {
+import { TSESLint, TSESTree } from '@typescript-eslint/utils';
+declare const enforceFirebaseImports: TSESLint.RuleModule<"noDynamicImport", never[], {} | {
     ImportDeclaration(node: TSESTree.ImportDeclaration): void;
 }>;
 export default enforceFirebaseImports;

package/lib/rules/enforce-dynamic-firebase-imports.js

@@ -1,6 +1,60 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@typescript-eslint/utils");
 const createRule_1 = require("../utils/createRule");
+const isFunctionNode = (node) => node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression ||
+    node.type === utils_1.AST_NODE_TYPES.FunctionDeclaration ||
+    node.type === utils_1.AST_NODE_TYPES.FunctionExpression;
+/**
+ * Walks outward from a reference to the innermost `async` function whose block
+ * body contains it.
+ *
+ * A reference sitting in a *synchronous* callback nested inside an async
+ * function still resolves once the declaration heads the async body, because
+ * the callback cannot run before the first statement of the body it is created
+ * in — so the walk continues past non-async functions rather than giving up.
+ *
+ * The containment check is against the body rather than the function: a
+ * reference in a parameter default or a signature type annotation is evaluated
+ * before the body runs, so a declaration at the top of the body would come too
+ * late for it.
+ */
+const enclosingAsyncBodyOf = (identifier) => {
+    let current = identifier.parent;
+    while (current) {
+        if (isFunctionNode(current) &&
+            current.async &&
+            current.body.type === utils_1.AST_NODE_TYPES.BlockStatement &&
+            identifier.range[0] >= current.body.range[0] &&
+            identifier.range[1] <= current.body.range[1]) {
+            return current;
+        }
+        current = current.parent;
+    }
+    return undefined;
+};
+const THIRD_PARTY_DIRECTORY = /(^|\/)node_modules(\/|$)/;
+// Anchored at the end of the path so multi-part suffixes such as
+// `useStartMatch.integration.test.ts` are recognized while production modules
+// that merely contain the word (`latest.tsx`, `contest.ts`, `testHelpers.ts`)
+// keep their enforcement.
+const TEST_FILE_SUFFIX = /\.(test|spec)\.[cm]?[jt]sx?$/;
+// Jest convention directories hold test-only modules regardless of file name.
+const TEST_FILE_DIRECTORY = /(^|\/)(__tests__|__mocks__)\//;
+/**
+ * The rule's rationale is bundle weight: a static import pulls Firebase into the
+ * initial client chunk. A suite, a Jest manual mock and a declaration file are
+ * never part of that chunk, so there is nothing to inflate and the rule has
+ * nothing to enforce there.
+ *
+ * The exemption is load-bearing rather than cosmetic because the rule is
+ * fixable: a suite's static binding is exactly what `jest.mock()` hoisting
+ * intercepts, and rewriting it emits a module-scope `await import(...)` that a
+ * CommonJS test transform cannot even parse (issue #1715).
+ */
+const isNeverBundled = (filename) => filename.endsWith('.d.ts') ||
+    TEST_FILE_SUFFIX.test(filename) ||
+    TEST_FILE_DIRECTORY.test(filename);
 const enforceFirebaseImports = (0, createRule_1.createRule)({
     name: 'enforce-dynamic-firebase-imports',
     meta: {
@@ -13,18 +67,26 @@ const enforceFirebaseImports = (0, createRule_1.createRule)({
         hasSuggestions: true,
         schema: [],
         messages: {
-            noDynamicImport: 'Static import from firebaseCloud path "{{importPath}}" eagerly bundles Firebase code into the initial client chunk, which inflates startup time and prevents lazy loading. Replace it with an awaited dynamic import so the code only loads when invoked (e.g., `const module = await import(\'{{importPath}}\')` or destructure the exports you need).',
+            noDynamicImport: 'Static import from firebaseCloud path "{{importPath}}" eagerly bundles Firebase code into the initial client chunk, which inflates startup time and prevents lazy loading. Load it at the call site instead, inside an async function body (e.g., `const { export } = await import(\'{{importPath}}\')`). Keep it out of module scope: a top-level `await import(...)` defers nothing and does not parse once the module is compiled to CommonJS.',
         },
     },
     defaultOptions: [],
     create(context) {
+        const sourceCode = context.getSourceCode();
+        // Normalize Windows backslash separators so the forward-slash directory
+        // checks match on every platform. Without this, `getFilename()` returns
+        // `C:\repo\src\hooks\__tests__\Foo.ts` on Windows and the exemption
+        // silently fails there.
+        const filename = (context.getFilename?.() ?? '').replace(/\\/g, '/');
+        // `<input>`/`<text>` are the synthetic names RuleTester uses when a case
+        // declares no filename. They match none of the exemptions below, so a
+        // snippet keeps its enforcement — unlike a path-gated rule, this one has no
+        // include list to fall outside of.
+        if (THIRD_PARTY_DIRECTORY.test(filename) || isNeverBundled(filename)) {
+            return {};
+        }
         return {
             ImportDeclaration(node) {
-                // Skip third-party files
-                const filename = context.getFilename?.();
-                if (filename && /(^|[\\/])node_modules([\\/]|$)/.test(filename)) {
-                    return;
-                }
                 // Skip type-only import declarations
                 if (node.importKind === 'type') {
                     return;
@@ -51,75 +113,152 @@ const enforceFirebaseImports = (0, createRule_1.createRule)({
                     ? spec.imported.name
                     : `${spec.imported.name} as ${spec.local.name}`)
                     .join(', ');
-                const buildReplacement = (options = {}) => {
-                    const statements = [];
-                    if (typeOnlySpecifiers.length > 0) {
-                        statements.push(`import type { ${buildTypeNames()} } from '${importPath}';`);
-                    }
+                const destructureEntry = (spec) => spec.imported.name === spec.local.name
+                    ? spec.local.name
+                    : `${spec.imported.name}: ${spec.local.name}`;
+                const buildValueStatements = () => {
                     if (namespaceSpecifier) {
                         const nsLocal = namespaceSpecifier.local.name;
-                        statements.push(`const ${nsLocal} = await import('${importPath}');`);
+                        const statements = [
+                            `const ${nsLocal} = await import('${importPath}');`,
+                        ];
                         if (defaultSpecifier) {
-                            const defLocal = defaultSpecifier.local.name;
-                            statements.push(`const ${defLocal} = ${nsLocal}.default;`);
+                            statements.push(`const ${defaultSpecifier.local.name} = ${nsLocal}.default;`);
                         }
-                        const destructureFromNamespace = [];
                         if (namedSpecifiers.length > 0) {
-                            const destructureParts = namedSpecifiers.map((spec) => {
-                                const imported = spec.imported.name;
-                                const local = spec.local.name;
-                                return imported === local ? imported : `${imported}: ${local}`;
-                            });
-                            destructureFromNamespace.push(...destructureParts);
+                            statements.push(`const { ${namedSpecifiers
+                                .map(destructureEntry)
+                                .join(', ')} } = ${nsLocal};`);
                         }
-                        if (destructureFromNamespace.length > 0) {
-                            statements.push(`const { ${destructureFromNamespace.join(', ')} } = ${nsLocal};`);
-                        }
-                        return statements.join(' ');
+                        return statements;
                     }
-                    const destructureParts = [];
-                    if (defaultSpecifier) {
-                        const defLocal = defaultSpecifier.local.name;
-                        destructureParts.push(`default: ${defLocal}`);
+                    const destructureParts = [
+                        ...(defaultSpecifier
+                            ? [`default: ${defaultSpecifier.local.name}`]
+                            : []),
+                        ...namedSpecifiers.map(destructureEntry),
+                    ];
+                    // A side-effect import binds nothing, so there is no declaration to
+                    // relocate — the awaited call would have to stay at module scope.
+                    return destructureParts.length > 0
+                        ? [
+                            `const { ${destructureParts.join(', ')} } = await import('${importPath}');`,
+                        ]
+                        : [];
+                };
+                /**
+                 * An `ImportDeclaration` only ever sits at module scope, so rewriting
+                 * it in place can only ever produce a module-scope `await import(...)`
+                 * — which defers nothing (the module still awaits it during
+                 * evaluation) and does not even parse once the file is compiled to
+                 * CommonJS, where top-level await does not exist (issue #1716).
+                 *
+                 * The rewrite is therefore only expressible when every value reference
+                 * lives in one async function body: the declaration can then head that
+                 * body, exactly the shape the codebase writes by hand. Anything else
+                 * is a per-call-site refactor the fixer declines rather than corrupts.
+                 */
+                const findRelocationTarget = () => {
+                    const valueLocalNames = new Set([
+                        defaultSpecifier?.local.name,
+                        namespaceSpecifier?.local.name,
+                        ...namedSpecifiers.map((spec) => spec.local.name),
+                    ].filter((name) => name !== undefined));
+                    const references = context
+                        .getDeclaredVariables(node)
+                        .filter((variable) => valueLocalNames.has(variable.name))
+                        .flatMap((variable) => variable.references);
+                    // Nothing reads the binding, so there is no call site to defer to.
+                    if (references.length === 0) {
+                        return undefined;
                     }
-                    if (namedSpecifiers.length > 0) {
-                        for (const spec of namedSpecifiers) {
-                            const imported = spec.imported.name;
-                            const local = spec.local.name;
-                            destructureParts.push(imported === local ? imported : `${imported}: ${local}`);
+                    let target;
+                    for (const reference of references) {
+                        const enclosing = enclosingAsyncBodyOf(reference.identifier);
+                        if (!enclosing || (target && target !== enclosing)) {
+                            return undefined;
                         }
+                        target = enclosing;
                     }
-                    if (destructureParts.length > 0) {
-                        statements.push(`const { ${destructureParts.join(', ')} } = await import('${importPath}');`);
-                        return statements.join(' ');
+                    return target;
+                };
+                const indentationAt = (line) => /^[ \t]*/.exec(sourceCode.lines[line - 1] ?? '')?.[0] ?? '';
+                /**
+                 * Consumes the import's own trailing whitespace, and its line break
+                 * when the import owns the line, so the removal strands neither a blank
+                 * line nor the indentation of whatever shared the line with it.
+                 * Anything that is not whitespace — a trailing comment, a statement —
+                 * is left untouched.
+                 */
+                const removalEnd = () => {
+                    const text = sourceCode.getText();
+                    let cursor = node.range[1];
+                    while (cursor < text.length &&
+                        (text[cursor] === ' ' || text[cursor] === '\t')) {
+                        cursor += 1;
+                    }
+                    if (text[cursor] === '\n') {
+                        return cursor + 1;
                     }
-                    if (node.specifiers.length === 0) {
-                        return options.allowSideEffectFix !== false
-                            ? `await import('${importPath}');`
-                            : null;
+                    if (text[cursor] === '\r' && text[cursor + 1] === '\n') {
+                        return cursor + 2;
+                    }
+                    return cursor;
+                };
+                const buildFix = (fixer) => {
+                    const target = findRelocationTarget();
+                    const statements = buildValueStatements();
+                    if (!target || statements.length === 0) {
+                        return null;
                     }
-                    return null;
+                    const body = target.body;
+                    // A directive stops being a directive the moment a declaration
+                    // precedes it, so `'use server'` on a server action would silently
+                    // become a discarded string expression. The declaration goes after
+                    // the whole prologue instead.
+                    const prologueLength = body.body.findIndex((statement) => statement.type !== utils_1.AST_NODE_TYPES.ExpressionStatement ||
+                        statement.expression.type !== utils_1.AST_NODE_TYPES.Literal ||
+                        typeof statement.expression.value !== 'string');
+                    const directives = body.body.slice(0, prologueLength === -1 ? body.body.length : prologueLength);
+                    const lastDirective = directives[directives.length - 1];
+                    const following = body.body[directives.length];
+                    const anchorLine = lastDirective
+                        ? lastDirective.loc.end.line
+                        : body.loc.start.line;
+                    const neighbour = following ?? lastDirective;
+                    // A body written on one line keeps its shape; a multi-line body gets
+                    // the declaration on its own line at the body's own indentation.
+                    const insertion = following && following.loc.start.line === anchorLine
+                        ? ` ${statements.join(' ')}`
+                        : statements
+                            .map((statement) => {
+                            const indent = neighbour
+                                ? indentationAt(neighbour.loc.start.line)
+                                : `${indentationAt(target.loc.start.line)}  `;
+                            return `\n${indent}${statement}`;
+                        })
+                            .join('');
+                    return [
+                        // Type-only specifiers are erased at compile time, so they stay
+                        // where they are instead of riding along into the function body.
+                        typeOnlySpecifiers.length > 0
+                            ? fixer.replaceText(node, `import type { ${buildTypeNames()} } from '${importPath}';`)
+                            : fixer.removeRange([node.range[0], removalEnd()]),
+                        lastDirective
+                            ? fixer.insertTextAfter(lastDirective, insertion)
+                            : fixer.insertTextAfterRange([body.range[0], body.range[0] + 1], insertion),
+                    ];
                 };
                 context.report({
                     node,
                     messageId: 'noDynamicImport',
                     data: { importPath },
-                    fix(fixer) {
-                        const replacement = buildReplacement();
-                        return replacement ? fixer.replaceText(node, replacement) : null;
-                    },
+                    fix: buildFix,
                     suggest: [
                         {
                             messageId: 'noDynamicImport',
                             data: { importPath },
-                            fix(fixer) {
-                                const replacement = buildReplacement({
-                                    allowSideEffectFix: true,
-                                });
-                                return replacement
-                                    ? fixer.replaceText(node, replacement)
-                                    : null;
-                            },
+                            fix: buildFix,
                         },
                     ],
                 });