@blumintinc/eslint-plugin-blumint 1.20.105 → 1.20.107

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.105',
+        version: '1.20.107',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/consistent-callback-naming.d.ts

@@ -1,2 +1,3 @@
-declare const _default: import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleModule<"callbackPropPrefix" | "callbackFunctionPrefix", [], import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleListener>;
+import { TSESLint } from '@typescript-eslint/utils';
+declare const _default: TSESLint.RuleModule<"callbackPropPrefix" | "callbackFunctionPrefix", [], TSESLint.RuleListener>;
 export = _default;

package/lib/rules/consistent-callback-naming.js

@@ -39,6 +39,183 @@ const ts = __importStar(require("typescript"));
 function hasHandlePrefix(name) {
     return /^handle[A-Z]/.test(name);
 }
+function stripHandlePrefix(name) {
+    return name.slice(6).charAt(0).toLowerCase() + name.slice(7);
+}
+// Stripping the prefix can land the rename squarely on a keyword:
+// `handleDelete` -> `delete`, `handleNew` -> `new`, `handleReturn` -> `return`,
+// `handleTrue` -> `true`. None of those is a legal binding name, so a fix that
+// emits one turns a working file into a parse error — `const delete = fn` and
+// `const { delete } = api` are both SyntaxErrors (Bug #1719). The set covers the
+// ES reserved words, the strict-mode/module reserved words (the linted codebase
+// is entirely ES modules, where `await` and `implements` et al. are reserved
+// too) and the three keyword literals. The guard is applied at every emission
+// site, including member names where a keyword happens to be legal
+// (`class C { delete() {} }`): the rule cannot see whether that member is later
+// destructured into a binding, and a fixer that is safe only sometimes is not
+// safe.
+const RESERVED_WORDS = new Set([
+    'arguments',
+    'await',
+    'break',
+    'case',
+    'catch',
+    'class',
+    'const',
+    'continue',
+    'debugger',
+    'default',
+    'delete',
+    'do',
+    'else',
+    'enum',
+    'eval',
+    'export',
+    'extends',
+    'false',
+    'finally',
+    'for',
+    'function',
+    'if',
+    'implements',
+    'import',
+    'in',
+    'instanceof',
+    'interface',
+    'let',
+    'new',
+    'null',
+    'package',
+    'private',
+    'protected',
+    'public',
+    'return',
+    'static',
+    'super',
+    'switch',
+    'this',
+    'throw',
+    'true',
+    'try',
+    'typeof',
+    'var',
+    'void',
+    'while',
+    'with',
+    'yield',
+]);
+function isEmittableName(name) {
+    return name.length > 0 && !RESERVED_WORDS.has(name);
+}
+function isExportedDeclaration(node) {
+    let current = node;
+    while (current) {
+        if (current.type === utils_1.AST_NODE_TYPES.ExportNamedDeclaration ||
+            current.type === utils_1.AST_NODE_TYPES.ExportDefaultDeclaration) {
+            return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+// An object literal that is exported or returned is a value other modules read
+// by member name (`api.handleOpenThread`, `const { handleOpenThread } = useX()`).
+// Renaming a member of it edits one end of a contract whose readers live in
+// files a single-file fixer cannot even see, so the violation is reported
+// without a fix — the same reasoning that withholds the JSX prop rename.
+function isApiSurfaceValue(node) {
+    let child = node;
+    let current = node.parent;
+    while (current) {
+        switch (current.type) {
+            case utils_1.AST_NODE_TYPES.ExportNamedDeclaration:
+            case utils_1.AST_NODE_TYPES.ExportDefaultDeclaration:
+            case utils_1.AST_NODE_TYPES.ReturnStatement:
+                return true;
+            case utils_1.AST_NODE_TYPES.ArrowFunctionExpression:
+                // A concise body is a return with no `return` keyword.
+                return current.body === child;
+            case utils_1.AST_NODE_TYPES.BlockStatement:
+            case utils_1.AST_NODE_TYPES.ClassBody:
+            case utils_1.AST_NODE_TYPES.FunctionDeclaration:
+            case utils_1.AST_NODE_TYPES.FunctionExpression:
+            case utils_1.AST_NODE_TYPES.Program:
+                return false;
+            default:
+                child = current;
+                current = current.parent;
+        }
+    }
+    return false;
+}
+/** The member names already declared alongside `node`, keyed by identifier. */
+function siblingMemberNames(node) {
+    const names = new Set();
+    const record = (member) => {
+        const key = member.key;
+        if (!member.computed &&
+            key?.type === utils_1.AST_NODE_TYPES.Identifier) {
+            names.add(key.name);
+        }
+    };
+    if (node?.type === utils_1.AST_NODE_TYPES.ObjectExpression) {
+        node.properties.forEach(record);
+    }
+    else if (node?.type === utils_1.AST_NODE_TYPES.ClassBody) {
+        node.body.forEach(record);
+    }
+    return names;
+}
+/**
+ * Every member name the file reads by name — `obj.handleClick`,
+ * `obj['handleClick']`, `const { handleClick } = obj`.
+ *
+ * Renaming an object literal's key has to move every one of those reads with
+ * it, and a fixer scoped to the literal moves none of them: `const o = { click:
+ * fn }; o.handleClick()` type-checks as a missing property and throws at
+ * runtime. The presence of any reader therefore withholds the rewrite. The walk
+ * is over the whole program because a reader may appear anywhere, including
+ * before the literal.
+ */
+function collectMemberReads(program, visitorKeys) {
+    const names = new Set();
+    const stack = [program];
+    const push = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(push);
+        }
+        else if (value && typeof value === 'object' && 'type' in value) {
+            stack.push(value);
+        }
+    };
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (node.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+            if (!node.computed && node.property.type === utils_1.AST_NODE_TYPES.Identifier) {
+                names.add(node.property.name);
+            }
+            else if (node.property.type === utils_1.AST_NODE_TYPES.Literal &&
+                typeof node.property.value === 'string') {
+                names.add(node.property.value);
+            }
+        }
+        // Read directly off the pattern rather than through `parent`, which is not
+        // guaranteed to be assigned on nodes the traversal has not reached.
+        if (node.type === utils_1.AST_NODE_TYPES.ObjectPattern) {
+            for (const property of node.properties) {
+                if (property.type === utils_1.AST_NODE_TYPES.Property &&
+                    !property.computed &&
+                    property.key.type === utils_1.AST_NODE_TYPES.Identifier) {
+                    names.add(property.key.name);
+                }
+            }
+        }
+        for (const key of visitorKeys[node.type] ?? []) {
+            push(node[key]);
+        }
+    }
+    return names;
+}
 module.exports = (0, createRule_1.createRule)({
     name: 'consistent-callback-naming',
     meta: {
@@ -200,6 +377,101 @@ module.exports = (0, createRule_1.createRule)({
             // that includes a void-returning signature keeps the handler semantics.
             return signatures.every((signature) => !returnsVoidLike(checker.getReturnTypeOfSignature(signature)));
         }
+        // Built once per file, and only when an object literal member is actually a
+        // rename candidate.
+        let memberReads;
+        function isReadByName(name) {
+            const sourceCode = context.getSourceCode();
+            memberReads ??= collectMemberReads(sourceCode.ast, sourceCode.visitorKeys);
+            return memberReads.has(name);
+        }
+        /**
+         * The variable a pattern identifier binds. `getDeclaredVariables` is
+         * authoritative — it is asked of the declaring ancestor (the
+         * `VariableDeclaration`, the function owning a destructured parameter, the
+         * `CatchClause`) rather than reconstructed by crawling scopes by name,
+         * which cannot tell two same-named bindings apart.
+         */
+        function findPatternVariable(id) {
+            let current = id.parent;
+            while (current) {
+                const match = context
+                    .getDeclaredVariables(current)
+                    .find((variable) => variable.identifiers.includes(id));
+                if (match) {
+                    return match;
+                }
+                current = current.parent;
+            }
+            return undefined;
+        }
+        // Renaming a binding that leaves the module — `export const { a: handleX }`,
+        // or `export { handleX }` — breaks importers the fixer cannot edit.
+        function isExportedBinding(variable) {
+            const namedByExportSpecifier = (id) => id.parent?.type === utils_1.AST_NODE_TYPES.ExportSpecifier;
+            return (variable.references.some((ref) => namedByExportSpecifier(ref.identifier)) ||
+                variable.identifiers.some(namedByExportSpecifier) ||
+                variable.defs.some((def) => isExportedDeclaration(def.node)));
+        }
+        // A rename that collides with a name already visible where the binding (or
+        // any of its references) lives silently re-points those references at the
+        // other declaration.
+        function isNameTaken(variable, newName) {
+            let scope = variable.scope;
+            while (scope) {
+                if (scope.set.has(newName)) {
+                    return true;
+                }
+                scope = scope.upper;
+            }
+            return variable.scope.childScopes.some((child) => child.set.has(newName));
+        }
+        /**
+         * A `Property` inside an `ObjectPattern`. Its key names a property of the
+         * object being destructured — someone else's API (`const { handleDelete: fn }
+         * = useMessage('handleDelete')` reads Stream Chat's own member) — so
+         * rewriting the key changes WHICH property is read, strands every reader of
+         * the old name, and can emit a keyword that is not a legal binding
+         * (Bug #1719). The key is therefore never reported and never rewritten. The
+         * only name the file owns here is the local binding, so that is what the
+         * report targets when it too carries the prefix.
+         */
+        function reportDestructuredBinding(node) {
+            // A shorthand binding is a single token that is simultaneously the
+            // foreign property name and the local name: there is no name the file
+            // chose independently, and no in-place edit can change one without the
+            // other. Left alone entirely rather than reported with no remedy.
+            if (node.shorthand || node.value.type !== utils_1.AST_NODE_TYPES.Identifier) {
+                return;
+            }
+            const binding = node.value;
+            if (!hasHandlePrefix(binding.name)) {
+                return;
+            }
+            const newName = stripHandlePrefix(binding.name);
+            const variable = findPatternVariable(binding);
+            const canFix = isEmittableName(newName) &&
+                !!variable &&
+                !isExportedBinding(variable) &&
+                !isNameTaken(variable, newName);
+            context.report({
+                node: binding,
+                messageId: 'callbackFunctionPrefix',
+                data: { functionName: binding.name },
+                fix(fixer) {
+                    if (!canFix || !variable) {
+                        return null;
+                    }
+                    // Every occurrence in one edit: a rename that reaches the declaration
+                    // but not its readers is worse than no rename at all.
+                    const targets = new Set([binding]);
+                    for (const ref of variable.references) {
+                        targets.add(ref.identifier);
+                    }
+                    return [...targets].map((id) => fixer.replaceText(id, newName));
+                },
+            });
+        }
         return {
             // Check JSX attributes for callback props
             JSXAttribute(node) {
@@ -341,8 +613,12 @@ module.exports = (0, createRule_1.createRule)({
                         data: { functionName },
                         fix(fixer) {
                             // Remove 'handle' prefix and convert first character to lowercase
-                            const newName = functionName.slice(6).charAt(0).toLowerCase() +
-                                functionName.slice(7);
+                            const newName = stripHandlePrefix(functionName);
+                            // `const handleDelete = fn` would become `const delete = fn`,
+                            // which does not parse (Bug #1719).
+                            if (!isEmittableName(newName)) {
+                                return null;
+                            }
                             // Fix the declaration and all references
                             const fixes = [];
                             fixes.push(fixer.replaceText(node.id, newName));
@@ -358,30 +634,50 @@ module.exports = (0, createRule_1.createRule)({
             },
             // Check class methods and object methods
             'MethodDefinition, Property'(node) {
-                if (node.key.type === 'Identifier' &&
-                    node.key.name &&
-                    hasHandlePrefix(node.key.name)) {
-                    const name = node.key.name;
-                    // Skip autofixing for class parameters and getters
-                    if (node.type === 'MethodDefinition' && node.kind === 'get') {
-                        context.report({
-                            node: node.key,
-                            messageId: 'callbackFunctionPrefix',
-                            data: { functionName: name },
-                        });
-                        return;
-                    }
+                const key = node.key;
+                if (key.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                    !key.name ||
+                    !hasHandlePrefix(key.name)) {
+                    return;
+                }
+                const name = key.name;
+                // Skip autofixing for class parameters and getters
+                if (node.type === utils_1.AST_NODE_TYPES.MethodDefinition &&
+                    node.kind === 'get') {
                     context.report({
-                        node: node.key,
+                        node: key,
                         messageId: 'callbackFunctionPrefix',
                         data: { functionName: name },
-                        fix(fixer) {
-                            // Remove 'handle' prefix and convert first character to lowercase
-                            const newName = name.slice(6).charAt(0).toLowerCase() + name.slice(7);
-                            return fixer.replaceText(node.key, newName);
-                        },
                     });
+                    return;
+                }
+                const isProperty = node.type === utils_1.AST_NODE_TYPES.Property;
+                if (isProperty && node.parent?.type === utils_1.AST_NODE_TYPES.ObjectPattern) {
+                    reportDestructuredBinding(node);
+                    return;
                 }
+                const newName = stripHandlePrefix(name);
+                // A shorthand property's key and value are the same token, so replacing
+                // the key also replaces the value: `{ handleClick }` becomes
+                // `{ click }`, which both renames the member and re-points it at a
+                // binding that need not exist (Bug #1719).
+                const canFix = isEmittableName(newName) &&
+                    // A sibling already holding the target name turns the rename into a
+                    // duplicate member: `{ click: a, handleClick: b }` would collapse to
+                    // two `click` keys, silently discarding the first.
+                    !siblingMemberNames(node.parent).has(newName) &&
+                    !(isProperty && node.shorthand) &&
+                    !(isProperty &&
+                        node.parent &&
+                        (isApiSurfaceValue(node.parent) || isReadByName(name)));
+                context.report({
+                    node: key,
+                    messageId: 'callbackFunctionPrefix',
+                    data: { functionName: name },
+                    fix(fixer) {
+                        return canFix ? fixer.replaceText(key, newName) : null;
+                    },
+                });
             },
             // Check constructor parameters
             TSParameterProperty(node) {

package/lib/rules/no-entire-object-hook-deps.js

@@ -122,6 +122,53 @@ function isArrayOrPrimitive(checker, esTreeNode, nodeMap) {
         return false;
     }
 }
+/**
+ * Whether a member access reads a method — a function declared as a member of
+ * a class or interface, which lives on the prototype.
+ *
+ * why: such a reference is one shared value across every instance of the type
+ * (`new Set().has === new Set().has`, `f1.call === f2.call`). Narrowing a
+ * dependency from `set` to `set.has` therefore pins a constant: the hook never
+ * invalidates again and serves a stale value forever, so the whole object has
+ * to stay the dependency. This is the checker-driven generalisation of the
+ * `ARRAY_METHODS`/`STRING_METHODS` name lists, which recognise the identical
+ * hazard for two built-ins only; `Map`, `Set`, `Promise`, `Date`, `Intl.*` and
+ * every user-defined class come for free.
+ *
+ * The discriminator is how the member is *declared*, not merely "the type is
+ * callable". A function-valued data property (`{ getName?: () => string }`, or
+ * a class field holding an arrow function) is per-instance state: it genuinely
+ * changes when the object carrying it is rebuilt, so narrowing to it is correct
+ * and stays allowed.
+ *
+ * The question is asked of the symbol's flags rather than its declarations'
+ * `SyntaxKind`, because a rule must survive a version skew between the
+ * TypeScript this package resolves and the one the consumer's parser built the
+ * program with. `SyntaxKind` is renumbered whenever a kind is inserted —
+ * `MethodSignature` is 170 under 5.0 and 174 under 5.9 — so a `ts.isMethodX`
+ * guard imported here silently answers `false` for every node of a consumer on
+ * a different minor, making the carve-out a no-op in exactly the place it
+ * matters. `SymbolFlags` is an append-only bit set (`Method` has been 8192
+ * throughout), so the flag test holds across versions.
+ */
+function isMethodMember(checker, esTreeNode, nodeMap) {
+    try {
+        const tsNode = nodeMap.get(esTreeNode);
+        if (!tsNode)
+            return false;
+        // why: an unresolved member (an `any` receiver, a missing type) yields no
+        // symbol, so the check stays inert rather than guessing — matching the
+        // conservative stance `isArrayOrPrimitive` takes on Any/Unknown.
+        const symbol = checker.getSymbolAtLocation(tsNode);
+        if (!symbol)
+            return false;
+        return (symbol.flags & typescript_1.SymbolFlags.Method) !== 0;
+    }
+    catch (error) {
+        // A type-checker failure must not change what the rule reports.
+        return false;
+    }
+}
 function renderPathSegments(baseName, segments) {
     let path = baseName;
     for (const segment of segments) {
@@ -196,7 +243,7 @@ function callsCorrespondingSetter(hookBody, dependencyName) {
     }
     return visit(hookBody);
 }
-function getObjectUsagesInHook(hookBody, objectName) {
+function getObjectUsagesInHook(hookBody, objectName, typeInfo) {
     const usages = new Map(); // Track usage and its position
     // why: derived dependency paths (first-optional intermediate, array base)
     // must be re-rendered from structured links — string surgery on the
@@ -310,10 +357,17 @@ function getObjectUsagesInHook(hookBody, objectName) {
                 if (memberExpr.property.type !== utils_1.AST_NODE_TYPES.Identifier) {
                     return null;
                 }
-                // Check for array/string methods - these indicate usage of the entire array/string
-                if (memberExpr.property.name &&
+                // Check for a member that cannot serve as a narrowed dependency: a
+                // built-in array/string method by name, or — when type information is
+                // available — any method of a class or interface. Both denote usage of
+                // the entire receiver, because the member itself is a prototype-shared
+                // reference rather than per-instance state.
+                const isBuiltInWholeObjectMethod = !!memberExpr.property.name &&
                     (ARRAY_METHODS.has(memberExpr.property.name) ||
-                        STRING_METHODS.has(memberExpr.property.name))) {
+                        STRING_METHODS.has(memberExpr.property.name));
+                if (isBuiltInWholeObjectMethod ||
+                    (typeInfo !== undefined &&
+                        isMethodMember(typeInfo.checker, memberExpr, typeInfo.nodeMap))) {
                     const methodTarget = unwrapExpression(memberExpr.object);
                     if (methodTarget.type === utils_1.AST_NODE_TYPES.MemberExpression) {
                         // Method call on a property (e.g., userData.items.map(...) or
@@ -661,6 +715,22 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
             // In a real environment, we would want to enforce this
             // throw new Error('You have to enable the `project` setting in parser options to use this rule');
         }
+        // why: building the checker is the expensive half of a typed lint, so the
+        // handles are resolved once per file and shared by every type-driven check
+        // rather than re-fetched per dependency.
+        let typeInfo;
+        function getTypeInfo() {
+            if (!hasFullTypeChecking || !parserServices) {
+                return undefined;
+            }
+            if (!typeInfo) {
+                typeInfo = {
+                    checker: parserServices.program.getTypeChecker(),
+                    nodeMap: parserServices.esTreeNodeToTSNodeMap,
+                };
+            }
+            return typeInfo;
+        }
         const sourceCode = context.getSourceCode();
         // why: scanning every comment once per file rather than once per hook call
         // keeps the check off the hot path of files with many hooks.
@@ -736,16 +806,15 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
                     if (unwrappedElement.type === utils_1.AST_NODE_TYPES.Identifier) {
                         const objectName = unwrappedElement.name;
                         // Skip type checking if we don't have TypeScript services
-                        if (hasFullTypeChecking && parserServices) {
-                            const checker = parserServices.program.getTypeChecker();
-                            const nodeMap = parserServices.esTreeNodeToTSNodeMap;
+                        const dependencyTypeInfo = getTypeInfo();
+                        if (dependencyTypeInfo) {
                             // Skip if the dependency is an array or primitive type
-                            if (isArrayOrPrimitive(checker, unwrappedElement, nodeMap)) {
+                            if (isArrayOrPrimitive(dependencyTypeInfo.checker, unwrappedElement, dependencyTypeInfo.nodeMap)) {
                                 return;
                             }
                         }
                         // For testing without TypeScript services, we'll assume all identifiers are objects
-                        const result = getObjectUsagesInHook(callbackBody, objectName);
+                        const result = getObjectUsagesInHook(callbackBody, objectName, dependencyTypeInfo);
                         // If the object is not used at all, suggest removing it
                         if (result.notUsed) {
                             // why: deleting an entry from an array the author maintains by

package/lib/rules/parallelize-async-operations.js

@@ -474,6 +474,142 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
             }
             return names;
         }
+        /**
+         * Records the binding a single assignment target writes to.
+         *
+         * A member write records its ROOT object (`obj.a.b = 1` yields `obj`),
+         * because the state it mutates is reachable through that binding, and a
+         * later await naming the object observes the mutation. Optional chains and
+         * TS wrappers (`obj!.x = 1`) are unwrapped so the root is still found.
+         * Destructuring targets recurse to their leaf identifiers, since
+         * `({ a } = source)` and `[a] = source` write `a` just as `a = source.a`
+         * does.
+         */
+        function collectAssignmentTarget(target, targets) {
+            switch (target.type) {
+                case utils_1.AST_NODE_TYPES.Identifier:
+                    targets.push(target);
+                    break;
+                case utils_1.AST_NODE_TYPES.MemberExpression: {
+                    let root = target;
+                    for (;;) {
+                        if (root.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                            root = root.object;
+                        }
+                        else if (root.type === utils_1.AST_NODE_TYPES.ChainExpression ||
+                            root.type === utils_1.AST_NODE_TYPES.TSNonNullExpression ||
+                            root.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
+                            root = root.expression;
+                        }
+                        else {
+                            break;
+                        }
+                    }
+                    if (root.type === utils_1.AST_NODE_TYPES.Identifier) {
+                        targets.push(root);
+                    }
+                    break;
+                }
+                case utils_1.AST_NODE_TYPES.ObjectPattern:
+                    for (const property of target.properties) {
+                        if (property.type === utils_1.AST_NODE_TYPES.Property) {
+                            collectAssignmentTarget(property.value, targets);
+                        }
+                        else {
+                            collectAssignmentTarget(property.argument, targets);
+                        }
+                    }
+                    break;
+                case utils_1.AST_NODE_TYPES.ArrayPattern:
+                    for (const element of target.elements) {
+                        if (element) {
+                            collectAssignmentTarget(element, targets);
+                        }
+                    }
+                    break;
+                case utils_1.AST_NODE_TYPES.RestElement:
+                    collectAssignmentTarget(target.argument, targets);
+                    break;
+                case utils_1.AST_NODE_TYPES.AssignmentPattern:
+                    collectAssignmentTarget(target.left, targets);
+                    break;
+            }
+        }
+        /**
+         * Reports whether an assignment target resolves to a binding DECLARED
+         * inside the given expression.
+         *
+         * Such a binding is a fresh local: `async () => { let tmp; tmp = 1; }`
+         * publishes nothing to the enclosing scope, so a later await mentioning
+         * `tmp` is reading some other binding entirely. An unresolved name (an
+         * implicit global) counts as external, which keeps the barrier in place for
+         * the case the analysis cannot see.
+         */
+        function isDeclaredWithin(identifier, root) {
+            const variable = ASTHelpers_1.ASTHelpers.findVariableInScope(ASTHelpers_1.ASTHelpers.getScope(context, identifier), identifier.name);
+            if (!variable || variable.defs.length === 0) {
+                return false;
+            }
+            return variable.defs.every((definition) => definition.name.range[0] >= root.range[0] &&
+                definition.name.range[1] <= root.range[1]);
+        }
+        /**
+         * Collects the identifier names an awaited expression WRITES.
+         *
+         * The traversal deliberately crosses function boundaries, which is the
+         * opposite of what containsSuspendingAwait needs: the write that matters
+         * lives inside the callback handed to the awaited call. `await
+         * db.runTransaction(async (tx) => { mutator = new Mutator(tx); })` publishes
+         * `mutator` to the enclosing scope by the time it settles, so the callback
+         * body is part of what that statement does, not a separate deferred unit.
+         *
+         * A `VariableDeclarator` id is deliberately NOT a write: `const x = ...`
+         * inside a callback creates a fresh local binding rather than publishing a
+         * value to an outer one, so it cannot be what a later await reads.
+         */
+        function getAssignedNames(node) {
+            const targets = [];
+            const visit = (current) => {
+                if (current.type === utils_1.AST_NODE_TYPES.AssignmentExpression) {
+                    collectAssignmentTarget(current.left, targets);
+                }
+                else if (current.type === utils_1.AST_NODE_TYPES.UpdateExpression) {
+                    collectAssignmentTarget(current.argument, targets);
+                }
+                else if ((current.type === utils_1.AST_NODE_TYPES.ForOfStatement ||
+                    current.type === utils_1.AST_NODE_TYPES.ForInStatement) &&
+                    current.left.type !== utils_1.AST_NODE_TYPES.VariableDeclaration) {
+                    // `for (captured of items)` assigns an existing binding on every
+                    // iteration; only the declaration form introduces a fresh local.
+                    collectAssignmentTarget(current.left, targets);
+                }
+                for (const key in current) {
+                    if (key === 'parent' || key === 'range' || key === 'loc')
+                        continue;
+                    const child = current[key];
+                    if (!child || typeof child !== 'object')
+                        continue;
+                    if (Array.isArray(child)) {
+                        for (const item of child) {
+                            if (item && typeof item === 'object' && 'type' in item) {
+                                visit(item);
+                            }
+                        }
+                    }
+                    else if ('type' in child) {
+                        visit(child);
+                    }
+                }
+            };
+            visit(node);
+            const names = new Set();
+            for (const target of targets) {
+                if (!isDeclaredWithin(target, node)) {
+                    names.add(target.name);
+                }
+            }
+            return names;
+        }
         /**
          * Checks if there are dependencies between await expressions
          */
@@ -671,6 +807,37 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
                     return true;
                 }
             }
+            // 10. Closure-write barrier: read after write. An awaited call whose
+            // callback ASSIGNS an outer binding carries a data dependency that no
+            // value flowing out of the await expresses, so `variableNames` -- which
+            // holds only the names the run's own statements DECLARE -- cannot see it.
+            // `let mutator; await db.runTransaction(async (tx) => { mutator = new
+            // Mutator(tx); }); await mutator?.deleteIfEmptied();` is the shape. The
+            // rewrite is silently wrong rather than merely eager: array elements
+            // evaluate left to right at construction time, so the second element runs
+            // while `mutator` is still undefined -- the optional chain short-circuits
+            // and the operation NEVER happens, with no error to reveal it. Dropping
+            // the `?.` turns the same rewrite into a TypeError instead. Keyed on a
+            // write that a LATER await actually reads, so a callback whose effects
+            // nothing downstream observes still parallelizes. (#1723)
+            const assignedNames = awaitNodes.map((node) => {
+                const awaitExpr = getAwaitExpression(node);
+                return awaitExpr
+                    ? getAssignedNames(awaitExpr.argument)
+                    : new Set();
+            });
+            for (let i = 1; i < awaitNodes.length; i++) {
+                const currentIds = allIdentifiers[i];
+                if (currentIds.size === 0)
+                    continue;
+                for (let j = 0; j < i; j++) {
+                    for (const written of assignedNames[j]) {
+                        if (currentIds.has(written)) {
+                            return true;
+                        }
+                    }
+                }
+            }
             return false;
         }
         /**

package/lib/rules/parallelize-loop-awaits.js

@@ -291,18 +291,29 @@ exports.parallelizeLoopAwaits = (0, createRule_1.createRule)({
             return false;
         }
         /**
-         * Collects all variables declared INSIDE the loop body (at the direct
-         * body scope, not crossing nested function boundaries). These are
-         * iteration-local variables.
+         * Collects all variables declared INSIDE the loop body, including inside
+         * callbacks written there. These are iteration-local variables: nothing
+         * they hold outlives the iteration that created them.
+         *
+         * The walk crosses nested function boundaries because the write scan that
+         * consults this set crosses them too. A name both declared and assigned
+         * inside a callback (`async () => { let tmp; tmp = 1; }`) publishes nothing
+         * to the enclosing scope, so if the set stopped at the boundary the write
+         * would read as a cross-iteration dependency and silence the loop. (#1724)
          */
         function collectLoopLocalVars(body) {
             const localVars = new Set();
             function visit(node, isRoot) {
+                // A callback's parameters bind afresh on every invocation, so a write
+                // through one (`async (page) => { page.total = 1 }`) reaches whatever
+                // the caller handed that call rather than state the iterations share.
                 if (!isRoot &&
                     (node.type === utils_1.AST_NODE_TYPES.FunctionDeclaration ||
                         node.type === utils_1.AST_NODE_TYPES.FunctionExpression ||
                         node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression)) {
-                    return;
+                    for (const param of node.params) {
+                        collectBindingNames(param, localVars);
+                    }
                 }
                 if (node.type === utils_1.AST_NODE_TYPES.VariableDeclaration) {
                     for (const declarator of node.declarations) {
@@ -333,14 +344,70 @@ exports.parallelizeLoopAwaits = (0, createRule_1.createRule)({
             visit(body, true);
             return localVars;
         }
+        /**
+         * Collects the BINDINGS an assignment target writes through, returning
+         * false when the target's root is not a plain binding at all.
+         *
+         * A member write reaches the object its ROOT names: `box.value = 1` writes
+         * through `box`, and `value` is a field label that binds nothing — the same
+         * distinction drawn for a non-computed property key (#1688). Counting the
+         * label as a written name makes every member write look like a write to an
+         * outer binding, which is what hides a callback writing through its own
+         * parameter (`async (page) => { page.total = 1 }`).
+         *
+         * A root the analysis cannot name — `this.count += 1` reaches instance
+         * state every iteration shares — returns false, and the caller reads that
+         * as an outer write. The plugin prefers a missed report to a spurious one.
+         */
+        function collectAssignmentTargetNames(target, names) {
+            switch (target.type) {
+                case utils_1.AST_NODE_TYPES.Identifier:
+                    names.add(target.name);
+                    return true;
+                case utils_1.AST_NODE_TYPES.MemberExpression:
+                    return collectAssignmentTargetNames(target.object, names);
+                case utils_1.AST_NODE_TYPES.ChainExpression:
+                case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+                case utils_1.AST_NODE_TYPES.TSAsExpression:
+                    return collectAssignmentTargetNames(target.expression, names);
+                case utils_1.AST_NODE_TYPES.ObjectPattern: {
+                    let resolved = true;
+                    for (const property of target.properties) {
+                        const inner = property.type === utils_1.AST_NODE_TYPES.RestElement
+                            ? property.argument
+                            : property.value;
+                        if (!collectAssignmentTargetNames(inner, names))
+                            resolved = false;
+                    }
+                    return resolved;
+                }
+                case utils_1.AST_NODE_TYPES.ArrayPattern: {
+                    let resolved = true;
+                    for (const element of target.elements) {
+                        if (element && !collectAssignmentTargetNames(element, names)) {
+                            resolved = false;
+                        }
+                    }
+                    return resolved;
+                }
+                case utils_1.AST_NODE_TYPES.RestElement:
+                    return collectAssignmentTargetNames(target.argument, names);
+                case utils_1.AST_NODE_TYPES.AssignmentPattern:
+                    return collectAssignmentTargetNames(target.left, names);
+                default:
+                    return false;
+            }
+        }
         /**
          * Detects cross-iteration state patterns that require sequential
          * execution:
          *
          * 1. Accumulator: a variable declared OUTSIDE the loop body (i.e., not
-         *    in localVars) is ASSIGNED inside the loop body. Examples: `total +=
-         *    value`, `cursor = page.nextCursor`, `previousResult = result`. This
-         *    catches running totals, pagination cursors, and chained results.
+         *    in localVars) is ASSIGNED inside the loop body, whether directly or
+         *    from inside a callback the body hands to the awaited call. Examples:
+         *    `total += value`, `cursor = page.nextCursor`, `previousResult =
+         *    result`. This catches running totals, pagination cursors, and chained
+         *    results.
          *
          * 2. Direct cross-await dependency: a variable declared by an await
          *    inside the loop is then read as an argument to another await in the
@@ -348,28 +415,54 @@ exports.parallelizeLoopAwaits = (0, createRule_1.createRule)({
          */
         function hasSequentialDependency(body, loopLocalVars) {
             // Pattern 1: outer variable is written inside the loop body.
-            // Collect all assignment targets (left-hand sides of assignments and
-            // compound assignments) in the loop body.
+            // Collect every assignment target — the left-hand side of an assignment
+            // or compound assignment, and the operand of an increment in a callback.
             let foundOuterWrite = false;
-            function findOuterWrites(node, isRoot) {
+            /**
+             * Reports whether an assignment target reaches a binding the iterations
+             * share rather than one the iteration creates.
+             */
+            function writesOuterBinding(target) {
+                const names = new Set();
+                if (!collectAssignmentTargetNames(target, names))
+                    return true;
+                for (const name of names) {
+                    if (!loopLocalVars.has(name))
+                        return true;
+                }
+                return false;
+            }
+            function findOuterWrites(node, isRoot, inNestedFunction) {
                 if (foundOuterWrite)
                     return;
-                if (!isRoot &&
-                    (node.type === utils_1.AST_NODE_TYPES.FunctionDeclaration ||
-                        node.type === utils_1.AST_NODE_TYPES.FunctionExpression ||
-                        node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression)) {
+                // The walk deliberately enters callbacks. A write handed to the awaited
+                // call is the same data dependency as one written beside it:
+                // `await run(item, async (page) => { cursor = page.nextCursor })` has
+                // settled — and published `cursor` — by the time the iteration ends, so
+                // parallel iterations would race exactly as they would over
+                // `cursor = await run(item, cursor)`. (#1724)
+                const isNested = inNestedFunction ||
+                    (!isRoot &&
+                        (node.type === utils_1.AST_NODE_TYPES.FunctionDeclaration ||
+                            node.type === utils_1.AST_NODE_TYPES.FunctionExpression ||
+                            node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression));
+                if (node.type === utils_1.AST_NODE_TYPES.AssignmentExpression &&
+                    writesOuterBinding(node.left)) {
+                    foundOuterWrite = true;
                     return;
                 }
-                if (node.type === utils_1.AST_NODE_TYPES.AssignmentExpression) {
-                    // Collect identifiers on the left-hand side
-                    const lhsIds = new Set();
-                    collectIdentifiers(node.left, lhsIds, false);
-                    for (const id of lhsIds) {
-                        if (!loopLocalVars.has(id)) {
-                            foundOuterWrite = true;
-                            return;
-                        }
-                    }
+                // An increment counts only inside a callback. At the loop-body level it
+                // is the loop's own step counter — `while (i < n) { await f(items[i]);
+                // i++; }` walks the iteration space, and the `Promise.all(items.map(
+                // ...))` rewrite subsumes it — whereas a callback steps no iteration:
+                // `count++` there folds what the awaited work produced into a binding
+                // the whole loop shares, carrying the same dependency as the compound
+                // assignment it stands in for. (#1724)
+                if (isNested &&
+                    node.type === utils_1.AST_NODE_TYPES.UpdateExpression &&
+                    writesOuterBinding(node.argument)) {
+                    foundOuterWrite = true;
+                    return;
                 }
                 for (const key in node) {
                     if (key === 'parent' ||
@@ -382,17 +475,17 @@ exports.parallelizeLoopAwaits = (0, createRule_1.createRule)({
                         if (Array.isArray(child)) {
                             for (const item of child) {
                                 if (item && typeof item === 'object' && 'type' in item) {
-                                    findOuterWrites(item, false);
+                                    findOuterWrites(item, false, isNested);
                                 }
                             }
                         }
                         else if ('type' in child) {
-                            findOuterWrites(child, false);
+                            findOuterWrites(child, false, isNested);
                         }
                     }
                 }
             }
-            findOuterWrites(body, true);
+            findOuterWrites(body, true, false);
             if (foundOuterWrite)
                 return true;
             // Pattern 2: a variable declared by an await is used as arg to another await.

package/lib/rules/prefer-nullish-coalescing-boolean-props.d.ts

@@ -1 +1,2 @@
-export declare const preferNullishCoalescingBooleanProps: import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleModule<"preferNullishCoalescing", [], import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleListener>;
+import { TSESLint } from '@typescript-eslint/utils';
+export declare const preferNullishCoalescingBooleanProps: TSESLint.RuleModule<"preferNullishCoalescing", [], TSESLint.RuleListener>;

package/lib/rules/prefer-nullish-coalescing-boolean-props.js

@@ -489,6 +489,48 @@ function couldBeNullish(node, checker, parserServices) {
     // For other expressions, conservatively assume they could be nullish
     return true;
 }
+/**
+ * ECMAScript forbids `??` from sharing an expression with an unparenthesized
+ * `&&`/`||`. Source-level parentheses are not part of an ESTree node's range,
+ * so rewriting a whole LogicalExpression drops the parens around its operands —
+ * exactly the ones the operator swap makes mandatory. Re-adding them around any
+ * logical operand is unconditionally safe: the sub-expression was already
+ * evaluated as a unit, so redundant parens cannot change semantics.
+ */
+function parenthesizeLogical(text, operand) {
+    return operand.type === utils_1.AST_NODE_TYPES.LogicalExpression ? `(${text})` : text;
+}
+/**
+ * Detects parentheses that wrap the node itself. They live outside the node's
+ * range, so a `replaceText` of the node preserves them and the rewrite needs no
+ * parens of its own.
+ */
+function isParenthesized(node, sourceCode) {
+    const before = sourceCode.getTokenBefore(node);
+    const after = sourceCode.getTokenAfter(node);
+    return (!!before &&
+        !!after &&
+        before.type === utils_1.AST_TOKEN_TYPES.Punctuator &&
+        before.value === '(' &&
+        after.type === utils_1.AST_TOKEN_TYPES.Punctuator &&
+        after.value === ')');
+}
+/**
+ * A partially converted chain (`a ?? b || c`) is a syntax error just like an
+ * unparenthesized operand. Only one fix per overlapping range survives a pass,
+ * so converting one link of a `||` chain always leaves the sibling links
+ * untouched; parenthesizing the rewritten link keeps the emitted program
+ * parseable while later passes convert the remaining links.
+ */
+function needsSelfParens(node, sourceCode) {
+    const { parent } = node;
+    if (!parent ||
+        parent.type !== utils_1.AST_NODE_TYPES.LogicalExpression ||
+        parent.operator === '??') {
+        return false;
+    }
+    return !isParenthesized(node, sourceCode);
+}
 exports.preferNullishCoalescingBooleanProps = (0, createRule_1.createRule)({
     name: 'prefer-nullish-coalescing-boolean-props',
     meta: {
@@ -540,7 +582,10 @@ exports.preferNullishCoalescingBooleanProps = (0, createRule_1.createRule)({
                                 right: rightText,
                             },
                             fix(fixer) {
-                                return fixer.replaceText(node, `${leftText} ?? ${rightText}`);
+                                const replacement = `${parenthesizeLogical(leftText, node.left)} ?? ${parenthesizeLogical(rightText, node.right)}`;
+                                return fixer.replaceText(node, needsSelfParens(node, sourceCode)
+                                    ? `(${replacement})`
+                                    : replacement);
                             },
                         });
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.105",
+  "version": "1.20.107",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,56 @@
 [
+  {
+    "version": "1.20.107",
+    "date": "2026-08-05T05:11:58.347Z",
+    "rules": [
+      {
+        "name": "parallelize-async-operations",
+        "changeType": "fix",
+        "issues": [
+          1723
+        ],
+        "summary": "treat a callback's write to an outer binding as a dependency (closes #1723)"
+      },
+      {
+        "name": "parallelize-loop-awaits",
+        "changeType": "fix",
+        "issues": [
+          1724
+        ],
+        "summary": "see a callback's write to an outer binding (closes #1724)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.106",
+    "date": "2026-08-05T01:12:16.076Z",
+    "rules": [
+      {
+        "name": "consistent-callback-naming",
+        "changeType": "fix",
+        "issues": [
+          1719
+        ],
+        "summary": "stop renaming destructuring keys and reserved words (closes #1719)"
+      },
+      {
+        "name": "no-entire-object-hook-deps",
+        "changeType": "fix",
+        "issues": [
+          1721
+        ],
+        "summary": "keep the whole object when the member is a method (closes #1721)"
+      },
+      {
+        "name": "prefer-nullish-coalescing-boolean-props",
+        "changeType": "fix",
+        "issues": [
+          1720
+        ],
+        "summary": "keep the parens ?? requires (closes #1720)"
+      }
+    ]
+  },
   {
     "version": "1.20.105",
     "date": "2026-08-04T22:42:11.381Z",