@blumintinc/eslint-plugin-blumint 1.20.127 → 1.20.129

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.127',
+        version: '1.20.129',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-assert-safe-object-key.js

@@ -129,6 +129,10 @@ function isInsideMockFactory(node) {
  *
  * The peel repeats because the wrappers nest: `(x as any)!` is a non-null
  * assertion over a type assertion.
+ *
+ * Everything peeled here erases before the code runs, which is why the peel is
+ * unconditional. An optional chain does not, so it is handled apart from these
+ * — see `unwrapOptionalChain`.
  */
 function unwrapKeyExpression(node) {
     let current = node;
@@ -148,6 +152,43 @@ function unwrapKeyExpression(node) {
         }
     }
 }
+/**
+ * Reads through an optional chain to the member access or call it holds.
+ * `source?.key` parses as a `ChainExpression` wrapping the member expression,
+ * so a classification that matches a bare `MemberExpression` — or a numeric
+ * proof that matches `.length` — sees the wrapper and recognizes nothing.
+ *
+ * Kept apart from `unwrapKeyExpression` rather than folded into it because the
+ * two make different claims. Those wrappers are gone before the code runs; `?.`
+ * survives and short-circuits, so it is read through only where the question is
+ * "what value names this property", never where the question is what the
+ * expression does. That value is what the chain evaluates to, `undefined`
+ * included — and the chain guards a nullish RECEIVER, not a hostile KEY:
+ * `"__proto__"` is a perfectly non-nullish string, so `store[req.body?.key]`
+ * reaches the prototype surface exactly as `store[req.body.key]` does.
+ */
+function unwrapOptionalChain(node) {
+    return node.type === utils_1.AST_NODE_TYPES.ChainExpression ? node.expression : node;
+}
+/**
+ * The key expression stripped of every wrapper standing between it and the
+ * value that names the property: the compile-time assertions and the `await`
+ * that `unwrapKeyExpression` peels, plus an optional chain.
+ *
+ * The peel repeats because the two kinds nest in either order — `source?.key as
+ * string` is an assertion over a chain, `(source as Raw)?.key` a chain over an
+ * assertion.
+ */
+function unwrapWrittenKey(node) {
+    let current = node;
+    for (;;) {
+        const peeled = unwrapOptionalChain(unwrapKeyExpression(current));
+        if (peeled === current) {
+            return current;
+        }
+        current = peeled;
+    }
+}
 /** Names that read as a positional sequence rather than a keyed record. */
 const ARRAY_LIKE_NAME = /^(array|arr|items|elements|list|collection|data)s?$/i;
 /**
@@ -534,7 +575,8 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             },
         });
         /**
-         * Reports a key whose written form may carry assertion or await wrappers.
+         * Reports a key whose written form may carry assertion or await wrappers or
+         * an optional chain.
          *
          * The report and the fix sit on the outermost written node, so the wrapper
          * the author put there survives the rewrite: `m[assertSafe(k as string)]`
@@ -542,7 +584,10 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
          * own. `assertSafe` is identity-typed (`<T extends PropertyKey>(key: T): T`),
          * so wrapping the asserted expression preserves the key's type, and wrapping
          * an `await` keeps the validation on the resolved key rather than moving it
-         * onto the promise.
+         * onto the promise. Wrapping the whole chain is what keeps the short-circuit
+         * intact: `m[assertSafe(source?.key)]` evaluates `source?.key` once, in the
+         * position the author wrote it, and hands assertSafe what it produces — the
+         * rewrite adds a validation, it does not move a dereference.
          *
          * A key written without a wrapper keeps the narrower argument the fix has
          * always emitted: `String(id)` and `` `${id}` `` collapse to `id`, whose
@@ -563,8 +608,11 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             if (!variable)
                 return false;
             return variable.defs.some((def) => {
-                const init = def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator
-                    ? def.node.init
+                // `assertSafe?.(rawKey)` produces the very same validated key as
+                // `assertSafe(rawKey)` — the chain guards only a nullish callee — so
+                // the exemption reads through it rather than re-reporting the binding.
+                const init = def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator && def.node.init
+                    ? unwrapOptionalChain(def.node.init)
                     : null;
                 return (!!init &&
                     init.type === utils_1.AST_NODE_TYPES.CallExpression &&
@@ -584,8 +632,11 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             // An assertion or an await around an operand leaves its run-time value
             // alone, so the proof reads through to what the wrapper holds. The
             // annotation on the binding underneath is what proves the key numeric —
-            // an assertion asserts and proves nothing on its own.
-            const target = unwrapKeyExpression(node);
+            // an assertion asserts and proves nothing on its own. An optional chain
+            // is read through as well: `xs?.length` is the same `.length` proof, and
+            // its short-circuit yields `undefined`, which stringifies to "undefined"
+            // and so still names no field of the prototype surface.
+            const target = unwrapWrittenKey(node);
             switch (target.type) {
                 case utils_1.AST_NODE_TYPES.Literal:
                     return typeof target.value === 'number';
@@ -662,7 +713,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             Property(node) {
                 if (node.computed && node.key) {
                     const written = node.key;
-                    const key = unwrapKeyExpression(written);
+                    const key = unwrapWrittenKey(written);
                     // Check for String(id) pattern
                     if (key.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         key.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
@@ -687,7 +738,7 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             BinaryExpression(node) {
                 if (node.operator === 'in') {
                     const written = node.left;
-                    const left = unwrapKeyExpression(written);
+                    const left = unwrapWrittenKey(written);
                     // Check for String(id) pattern
                     if (left.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         left.callee.type === utils_1.AST_NODE_TYPES.Identifier &&
@@ -712,9 +763,9 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
                 if (node.computed) {
                     const written = node.property;
                     // The written key may sit under assertion or await wrappers that erase
-                    // at run time; what they hold is what names the property, so that is
-                    // what the branches below classify.
-                    const property = unwrapKeyExpression(written);
+                    // at run time, or under an optional chain; what they hold is what
+                    // names the property, so that is what the branches below classify.
+                    const property = unwrapWrittenKey(written);
                     // Skip if already using assertSafe
                     if (property.type === utils_1.AST_NODE_TYPES.CallExpression &&
                         property.callee.type === utils_1.AST_NODE_TYPES.Identifier &&

package/lib/rules/enforce-querykey-ts.js

@@ -377,6 +377,16 @@ exports.enforceQueryKeyTs = (0, createRule_1.createRule)({
          * Check if a node represents a valid query key usage
          */
         function isValidQueryKeyUsage(node) {
+            // `config?.getQueryKey()` parses as a `ChainExpression` wrapping the call,
+            // a type this switch does not name — so the optional spelling alone fell
+            // through to `return false` and bypassed the carve-outs below, reporting a
+            // key the plain spelling is allowed to build (#1832). Optionality is
+            // orthogonal to what this function asks: the question is where the key
+            // comes from, and a short-circuit changes only whether the same source is
+            // evaluated, never which source it is.
+            if (node.type === utils_1.AST_NODE_TYPES.ChainExpression) {
+                return isValidQueryKeyUsage(node.expression);
+            }
             if (node.type === utils_1.AST_NODE_TYPES.Identifier) {
                 const importInfo = queryKeyImports.get(node.name);
                 if (importInfo && isQueryKeysSource(importInfo.source)) {

package/lib/rules/no-circular-references.js

@@ -37,6 +37,28 @@ exports.noCircularReferences = (0, createRule_1.createRule)({
                 ? current
                 : null;
         }
+        /**
+         * The expression a runtime-transparent wrapper stands in for.
+         *
+         * `a?.b` parses as a `ChainExpression` around the member read, and
+         * resolution has to see through it: the optional link records that the
+         * access short-circuits, not that it names something else. Whenever the
+         * receiver is non-nullish — and an object literal bound to a `const` always
+         * is — `cfg?.node` evaluates to exactly `cfg.node`, so it aliases the same
+         * object and belongs to the same cycle. Stopping at the wrapper drops the
+         * alias, and a real cycle goes unreported.
+         *
+         * Local rather than folded into `ASTHelpers.unwrapTSAssertions`, because
+         * that helper answers "which assertions restate this expression" for five
+         * other rules, and a chain is a different question for each of them.
+         */
+        function unwrapTransparent(node) {
+            let current = ASTHelpers_1.ASTHelpers.unwrapTSAssertions(node);
+            while (current.type === utils_1.AST_NODE_TYPES.ChainExpression) {
+                current = ASTHelpers_1.ASTHelpers.unwrapTSAssertions(current.expression);
+            }
+            return current;
+        }
         function isIdentifier(node) {
             return node.type === utils_1.AST_NODE_TYPES.Identifier;
         }
@@ -66,7 +88,7 @@ exports.noCircularReferences = (0, createRule_1.createRule)({
             return null;
         }
         function getReferencedObject(node, visitedVariables = new Set(), visitedNodes = new Set()) {
-            const current = ASTHelpers_1.ASTHelpers.unwrapTSAssertions(node);
+            const current = unwrapTransparent(node);
             if (visitedNodes.has(current))
                 return null;
             visitedNodes.add(current);
@@ -129,14 +151,19 @@ exports.noCircularReferences = (0, createRule_1.createRule)({
                         }
                     }
                     if (propValue) {
-                        const unwrappedValue = getUnwrappedObjectOrArray(propValue);
+                        // The stored value keeps whatever notation it was written with, so
+                        // the dispatch below asks its question of the expression that
+                        // notation stands for — `{ b: level1?.a }` reaches here as a
+                        // ChainExpression and would otherwise match no arm at all.
+                        const resolvedValue = unwrapTransparent(propValue);
+                        const unwrappedValue = getUnwrappedObjectOrArray(resolvedValue);
                         if (unwrappedValue)
                             return unwrappedValue;
-                        if (isIdentifier(propValue) ||
-                            propValue.type === utils_1.AST_NODE_TYPES.MemberExpression) {
-                            return getReferencedObject(propValue, visitedVariables, visitedNodes);
+                        if (isIdentifier(resolvedValue) ||
+                            resolvedValue.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                            return getReferencedObject(resolvedValue, visitedVariables, visitedNodes);
                         }
-                        if (isFunction(propValue) || isPrimitive(propValue)) {
+                        if (isFunction(resolvedValue) || isPrimitive(resolvedValue)) {
                             return null;
                         }
                     }

package/lib/rules/no-hungarian.js

@@ -113,6 +113,48 @@ const DOMAIN_NUMBER_HEAD_NOUNS = new Set([
     'channel',
     'badge',
 ]);
+// Domain head nouns that legitimately precede a "Symbol" suffix. In
+// <domain>Symbol the trailing "Symbol" is the HEAD NOUN of the domain concept —
+// the printed GLYPH that writes a currency/ticker/unit/element ("$", "BTC",
+// "kg", "Fe") — not the JS `symbol` primitive bolted onto the name. ISO 4217 and
+// CLDR literally call that glyph a *currency symbol*, and the value is a string,
+// so there is no type marker to strip: removing it yields a wrong name
+// (`currency` denotes the currency itself, not the character it is written
+// with). Same reasoning as the <entity>Number carve-out (#1277), applied to the
+// glyph sense of "symbol" (#1835).
+//
+// Nouns whose <noun>Symbol really does name a JS `symbol` — id, key, cache,
+// brand, tag, marker, meta, registry, slot, field, instance — are intentionally
+// ABSENT, so idSymbol / cacheSymbol / brandSymbol stay flagged, as do all
+// PREFIX uses (symbolKey, symbolValue). The carve-out is additionally vetoed
+// whenever the declaration syntactically proves a `symbol` value (see
+// isSymbolTypedDeclaration).
+const DOMAIN_SYMBOL_HEAD_NOUNS = new Set([
+    // Finance / markets: the glyph or ticker a traded thing is written with.
+    'currency',
+    'ticker',
+    'token',
+    'coin',
+    'asset',
+    'stock',
+    'share',
+    'market',
+    'commodity',
+    // Measurement and science: "kg", "°", "Fe".
+    'unit',
+    'degree',
+    'element',
+    'chemical',
+    // Typography / notation / character sets: printed operator, punctuation and
+    // phonetic glyphs.
+    'math',
+    'operator',
+    'punctuation',
+    'phonetic',
+    'musical',
+    'unicode',
+    'ascii',
+]);
 // Common built-in JavaScript prototype methods
 const BUILT_IN_METHODS = new Set([
     // String methods
@@ -343,6 +385,97 @@ function isDomainNumberCompound(name) {
     const lastSegment = segments[segments.length - 1];
     return (!!lastSegment && DOMAIN_NUMBER_HEAD_NOUNS.has(lastSegment.toLowerCase()));
 }
+// Is `name` a domain compound of the form <domain>Symbol, where the word
+// directly before the trailing "Symbol" names a thing that is WRITTEN with a
+// glyph (currencySymbol, tickerSymbol, unitSymbol)? Only the LAST head segment
+// is consulted, so prefixed and accessor variants generalize
+// (getCurrencySymbol, localizedCurrencySymbol pass) while names whose value is a
+// real JS symbol keep firing (idSymbol -> head segment "Id", not a glyph
+// domain).
+function isDomainSymbolCompound(name) {
+    if (!name.endsWith('Symbol')) {
+        return false;
+    }
+    const head = name.slice(0, -'Symbol'.length);
+    if (head.length === 0) {
+        return false;
+    }
+    const segments = splitCamelSegments(head);
+    const lastSegment = segments[segments.length - 1];
+    return (!!lastSegment && DOMAIN_SYMBOL_HEAD_NOUNS.has(lastSegment.toLowerCase()));
+}
+// Does a type annotation denote the JS `symbol` primitive (`symbol` or the
+// declaration-site form `unique symbol`)?
+function isSymbolTypeAnnotation(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === utils_1.AST_NODE_TYPES.TSSymbolKeyword) {
+        return true;
+    }
+    return (node.type === utils_1.AST_NODE_TYPES.TSTypeOperator &&
+        node.operator === 'unique' &&
+        node.typeAnnotation?.type === utils_1.AST_NODE_TYPES.TSSymbolKeyword);
+}
+// Is the initializer a call to the `Symbol` factory (Symbol('x'), Symbol.for)?
+function isSymbolFactoryCall(node) {
+    if (!node || node.type !== utils_1.AST_NODE_TYPES.CallExpression) {
+        return false;
+    }
+    const { callee } = node;
+    if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return callee.name === 'Symbol';
+    }
+    return (callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+        callee.object.type === utils_1.AST_NODE_TYPES.Identifier &&
+        callee.object.name === 'Symbol');
+}
+// Does the declaration site PROVE, syntactically, that the named value is a JS
+// `symbol`? Only an explicit `symbol`/`unique symbol` annotation or a `Symbol()`
+// factory initializer are conclusive without type information — an inferred
+// `string` (the currencySymbol getter returns `part.value`) is invisible here,
+// which is precisely why the glyph carve-out is keyed on the head noun rather
+// than on the type. When this holds, the trailing "Symbol" genuinely encodes the
+// value's type and the DOMAIN_SYMBOL_HEAD_NOUNS carve-out is vetoed, so
+// `const currencySymbol: symbol = Symbol('currency')` still reports.
+function isSymbolTypedDeclaration(node) {
+    if (isSymbolTypeAnnotation(node.typeAnnotation?.typeAnnotation)) {
+        return true;
+    }
+    const parent = node.parent;
+    if (!parent) {
+        return false;
+    }
+    switch (parent.type) {
+        case utils_1.AST_NODE_TYPES.VariableDeclarator: {
+            if (parent.id !== node) {
+                return false;
+            }
+            if (isSymbolFactoryCall(parent.init)) {
+                return true;
+            }
+            // A named accessor/factory arrow describes its RETURNED value, so an
+            // explicit `(): symbol` return type is the same proof.
+            const init = parent.init;
+            return (!!init &&
+                (init.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression ||
+                    init.type === utils_1.AST_NODE_TYPES.FunctionExpression) &&
+                isSymbolTypeAnnotation(init.returnType?.typeAnnotation));
+        }
+        case utils_1.AST_NODE_TYPES.PropertyDefinition:
+            return (parent.key === node &&
+                (isSymbolTypeAnnotation(parent.typeAnnotation?.typeAnnotation) ||
+                    isSymbolFactoryCall(parent.value)));
+        case utils_1.AST_NODE_TYPES.MethodDefinition:
+            return (parent.key === node &&
+                isSymbolTypeAnnotation(parent.value.returnType?.typeAnnotation));
+        case utils_1.AST_NODE_TYPES.FunctionDeclaration:
+            return (parent.id === node &&
+                isSymbolTypeAnnotation(parent.returnType?.typeAnnotation));
+        default:
+            return false;
+    }
+}
 // Rebuild a SCREAMING_SNAKE_CASE identifier's segments into a PascalCase compound
 // (["MATCH","NUMBER"] -> "MatchNumber") so the snake-case branch can reuse the
 // camelCase isDomainNumberCompound / DOMAIN_NUMBER_HEAD_NOUNS exemption verbatim,
@@ -377,7 +510,9 @@ exports.noHungarian = (0, createRule_1.createRule)({
         // Check if a variable name contains a type marker with proper word boundaries.
         // `isTypeName` is true for PascalCase type declarations (type aliases,
         // interfaces, classes), enabling the semantic-type-concept exemption.
-        function hasTypeMarker(variableName, isTypeName = false) {
+        // `isSymbolTyped` is true when the declaration syntactically proves a JS
+        // `symbol` value, which vetoes the <domain>Symbol glyph exemption.
+        function hasTypeMarker(variableName, isTypeName = false, isSymbolTyped = false) {
             // Type names whose type-word denotes a concept/relation (StringToNumber,
             // CapitalizedString, FuncKeys, PromiseOrValue) are not Hungarian — the word
             // is part of the type's meaning, like the allowed compound noun PhoneNumber.
@@ -475,6 +610,17 @@ exports.noHungarian = (0, createRule_1.createRule)({
                             isDomainNumberCompound(screamingSnakePartsToPascalCase(parts))) {
                             return false;
                         }
+                        // A trailing "..._SYMBOL" whose preceding head noun names a thing
+                        // written with a glyph (CURRENCY_SYMBOL, TICKER_SYMBOL) is a domain
+                        // compound, not a type tag — same carve-out as camelCase
+                        // currencySymbol (#1835), routed through the shared PascalCase
+                        // helper so the two casings cannot diverge (the #1294 asymmetry).
+                        if (normalizedMarker === 'symbol' &&
+                            index === lastIndex &&
+                            !isSymbolTyped &&
+                            isDomainSymbolCompound(screamingSnakePartsToPascalCase(parts))) {
+                            return false;
+                        }
                         return true;
                     });
                 });
@@ -536,6 +682,19 @@ exports.noHungarian = (0, createRule_1.createRule)({
                         isDomainNumberCompound(variableName)) {
                         return false;
                     }
+                    // A trailing "...Symbol" whose head noun names a thing WRITTEN with a
+                    // glyph (currencySymbol, tickerSymbol, unitSymbol) is a domain
+                    // compound: the suffix names WHAT the value is (the glyph OF a
+                    // currency — CLDR/ISO 4217 vocabulary), and the value is a string, so
+                    // there is no type to strip (#1835). Scoped to the full-word `Symbol`
+                    // marker in SUFFIX position only, and vetoed when the declaration
+                    // proves a real `symbol`, so idSymbol / cacheSymbol / symbolKey and
+                    // any annotated `: symbol` keep firing.
+                    if (normalizedMarker === 'symbol' &&
+                        !isSymbolTyped &&
+                        isDomainSymbolCompound(variableName)) {
+                        return false;
+                    }
                     return true;
                 }
                 // Full type-word markers (non-abbreviations: String, Number, Function,
@@ -611,7 +770,7 @@ exports.noHungarian = (0, createRule_1.createRule)({
             if (isExternalOrBuiltIn(node))
                 return;
             // Check for type markers
-            if (hasTypeMarker(name, isTypeName)) {
+            if (hasTypeMarker(name, isTypeName, isSymbolTypedDeclaration(node))) {
                 context.report({
                     node,
                     messageId: 'noHungarian',

package/lib/rules/no-misleading-boolean-prefixes.js

@@ -100,6 +100,13 @@ function isExpressionBooleanLike(expr) {
             return isExpressionBooleanLike(expr.expression);
         case utils_1.AST_NODE_TYPES.TSNonNullExpression:
             return isExpressionBooleanLike(expr.expression);
+        // `a?.b` wraps the access in a ChainExpression, which only records that the
+        // access short-circuits — the value still comes from the node beneath, as
+        // with the assertion wrappers above (#1829). Nothing here is a carve-out for
+        // optional chains: `arr?.length` is `number | undefined`, a worse instance
+        // of the misleading prefix than the `number` that `arr.length` reports.
+        case utils_1.AST_NODE_TYPES.ChainExpression:
+            return isExpressionBooleanLike(expr.expression);
         case utils_1.AST_NODE_TYPES.Literal:
             return typeof expr.value === 'boolean' ? true : 'non';
         case utils_1.AST_NODE_TYPES.TemplateLiteral:

package/lib/rules/no-passthrough-getters.js

@@ -36,6 +36,15 @@ const COMPLEX_EXPRESSION_TYPES = new Set([
     utils_1.AST_NODE_TYPES.ArrayExpression,
     utils_1.AST_NODE_TYPES.ObjectExpression,
 ]);
+/**
+ * How far a member reaches. An unannotated member is `public`, which is why the
+ * ranks are compared rather than the raw modifiers.
+ */
+const VISIBILITY_RANK = {
+    private: 0,
+    protected: 1,
+    public: 2,
+};
 exports.noPassthroughGetters = (0, createRule_1.createRule)({
     create(context) {
         const sourceCode = context.sourceCode;
@@ -85,6 +94,11 @@ exports.noPassthroughGetters = (0, createRule_1.createRule)({
                     }
                     // Check if the return statement is accessing a property from a constructor parameter
                     if (isConstructorParameterPropertyAccess(returnStatement.argument)) {
+                        // A getter that reaches further than the member it forwards is the
+                        // only read path its audience has
+                        if (widensVisibilityOfForwardedRoot(node, returnStatement.argument)) {
+                            return;
+                        }
                         const getterName = (0, getMethodName_1.getMethodName)(node, sourceCode, {
                             computedFallbackToText: false,
                         }) || 'getter';
@@ -102,6 +116,168 @@ exports.noPassthroughGetters = (0, createRule_1.createRule)({
                 }
             },
         };
+        /**
+         * Whether the getter is more visible than the member it forwards.
+         *
+         * The rule's remedy — read the constructor-injected object directly — is
+         * only expressible by callers that can see that object. When the getter
+         * reaches further than its root (`public get` over `private readonly
+         * props`, `protected get` over a base class's `private` field), the getter
+         * IS the encapsulation boundary rather than indirection over an accessible
+         * field, and no caller outside the root's audience has another read path.
+         * TypeScript flatly rejects `this.props.x` in a subclass of a class that
+         * declares `props` private, so for that audience the remedy does not exist.
+         *
+         * Equal visibility keeps reporting: a `private get` over a `private` field
+         * aliases state its only callers already reach, which is the indirection
+         * the rule targets.
+         */
+        function widensVisibilityOfForwardedRoot(node, argument) {
+            const root = forwardedRootOf(argument);
+            if (!root) {
+                return false;
+            }
+            const rootAccessibility = accessibilityOfRoot(node, root);
+            if (!rootAccessibility) {
+                return false;
+            }
+            const getterAccessibility = node.accessibility ?? 'public';
+            return (VISIBILITY_RANK[getterAccessibility] >
+                VISIBILITY_RANK[rootAccessibility]);
+        }
+        /**
+         * The member the getter ultimately reads off `this`, e.g. `props` for
+         * `this.props.metadata.ticker`. `#`-prefixed roots are reported separately
+         * because they carry no `accessibility` modifier while being maximally
+         * private.
+         */
+        function forwardedRootOf(argument) {
+            let current = argument;
+            while (current.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                if (current.object.type === utils_1.AST_NODE_TYPES.ThisExpression) {
+                    if (current.property.type === utils_1.AST_NODE_TYPES.PrivateIdentifier) {
+                        return { name: current.property.name, isEcmaPrivate: true };
+                    }
+                    if (!current.computed && current.property.type === 'Identifier') {
+                        return { name: current.property.name, isEcmaPrivate: false };
+                    }
+                    if (current.computed &&
+                        current.property.type === 'Literal' &&
+                        typeof current.property.value === 'string') {
+                        return { name: current.property.value, isEcmaPrivate: false };
+                    }
+                    return null;
+                }
+                current = current.object;
+            }
+            return null;
+        }
+        function accessibilityOfRoot(node, root) {
+            if (root.isEcmaPrivate) {
+                return 'private';
+            }
+            const declared = declaredAccessibilityIn(node.parent, root.name);
+            if (declared) {
+                return declared;
+            }
+            // A root declared by a base class is invisible to a syntactic lookup, and
+            // that is exactly where the widest gaps sit (a `public get` forwarding a
+            // base class's `protected` field).
+            return inheritedAccessibilityOf(node, root.name);
+        }
+        /**
+         * Accessibility of `name` as declared in the class body that owns `node`,
+         * covering constructor parameter properties, fields and accessors alike —
+         * a forwarded root is spelled any of the three in practice.
+         */
+        function declaredAccessibilityIn(classBody, name) {
+            if (!classBody || classBody.type !== utils_1.AST_NODE_TYPES.ClassBody) {
+                return null;
+            }
+            for (const member of classBody.body) {
+                if (member.type === utils_1.AST_NODE_TYPES.PropertyDefinition ||
+                    member.type === utils_1.AST_NODE_TYPES.TSAbstractPropertyDefinition) {
+                    if (member.key.type === utils_1.AST_NODE_TYPES.PrivateIdentifier &&
+                        member.key.name === name) {
+                        return 'private';
+                    }
+                    if (!member.computed &&
+                        member.key.type === utils_1.AST_NODE_TYPES.Identifier &&
+                        member.key.name === name) {
+                        return member.accessibility ?? 'public';
+                    }
+                    continue;
+                }
+                if (member.type !== utils_1.AST_NODE_TYPES.MethodDefinition &&
+                    member.type !== utils_1.AST_NODE_TYPES.TSAbstractMethodDefinition) {
+                    continue;
+                }
+                if (member.kind === 'constructor') {
+                    const parameterAccessibility = parameterPropertyAccessibility(member, name);
+                    if (parameterAccessibility) {
+                        return parameterAccessibility;
+                    }
+                    continue;
+                }
+                if (member.kind === 'get' &&
+                    !member.computed &&
+                    member.key.type === utils_1.AST_NODE_TYPES.Identifier &&
+                    member.key.name === name) {
+                    return member.accessibility ?? 'public';
+                }
+            }
+            return null;
+        }
+        function parameterPropertyAccessibility(constructorNode, name) {
+            for (const parameter of constructorNode.value.params) {
+                if (parameter.type !== utils_1.AST_NODE_TYPES.TSParameterProperty) {
+                    continue;
+                }
+                const { parameter: inner } = parameter;
+                const identifier = inner.type === utils_1.AST_NODE_TYPES.AssignmentPattern ? inner.left : inner;
+                if (identifier.type === utils_1.AST_NODE_TYPES.Identifier &&
+                    identifier.name === name) {
+                    // `constructor(readonly props: P)` declares a public member.
+                    return parameter.accessibility ?? 'public';
+                }
+            }
+            return null;
+        }
+        function inheritedAccessibilityOf(node, name) {
+            const parserServices = sourceCode.parserServices;
+            if (!parserServices ||
+                !parserServices.program ||
+                !parserServices.esTreeNodeToTSNodeMap) {
+                return null;
+            }
+            const tsNode = parserServices.esTreeNodeToTSNodeMap.get(node);
+            if (!tsNode ||
+                !tsNode.parent ||
+                !(ts.isClassDeclaration(tsNode.parent) ||
+                    ts.isClassExpression(tsNode.parent))) {
+                return null;
+            }
+            const checker = parserServices.program.getTypeChecker();
+            const classSymbol = checker.getTypeAtLocation(tsNode.parent).getSymbol();
+            if (!classSymbol) {
+                return null;
+            }
+            const property = checker
+                .getDeclaredTypeOfSymbol(classSymbol)
+                .getProperty(name);
+            const declaration = property?.valueDeclaration ?? property?.declarations?.[0];
+            if (!declaration) {
+                return null;
+            }
+            const flags = ts.getCombinedModifierFlags(declaration);
+            if (flags & ts.ModifierFlags.Private) {
+                return 'private';
+            }
+            if (flags & ts.ModifierFlags.Protected) {
+                return 'protected';
+            }
+            return 'public';
+        }
         /**
          * Check if the getter is required by an implemented interface or overrides a base class member
          */

package/lib/rules/no-uuidv4-base62-as-key.js

@@ -31,6 +31,25 @@ function isUuidv4Base62Module(source) {
     const basename = segments[segments.length - 1].replace(MODULE_EXTENSION, '');
     return basename === UUIDV4_BASE62_MODULE;
 }
+/**
+ * Reads through an optional chain to the member access or call it holds.
+ * `items?.map(...)` and `item?.key` each parse as a `ChainExpression` wrapping
+ * the node the rule matches on, so a test for a bare `CallExpression` or
+ * `MemberExpression` sees the wrapper and recognizes nothing — the producer is
+ * never tracked and the key it feeds is never judged.
+ *
+ * Reading through it does not weaken the verdict, because the optional link is
+ * orthogonal to the defect. On the branch where the receiver is nullish nothing
+ * renders, or the key evaluates to `undefined` — which is a worse React key than
+ * a fresh UUID, never an acceptable one. On the branch where it is defined the
+ * emitted keys are exactly the ones the plain spelling emits: minted by
+ * `uuidv4Base62()` inside render, so React cannot reconcile the list. The rule
+ * only reports — it rewrites nothing — so the advice it gives ("use a stable
+ * identifier from your data") stands unchanged under the short-circuit.
+ */
+function unwrapOptionalChain(node) {
+    return node.type === utils_1.AST_NODE_TYPES.ChainExpression ? node.expression : node;
+}
 exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
     name: 'no-uuidv4-base62-as-key',
     meta: {
@@ -96,9 +115,14 @@ exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
             return false;
         }
         // Helper to check if a function call contains uuidv4Base62() as an argument
-        function containsUuidV4Base62Call(node) {
-            if (!node)
+        function containsUuidV4Base62Call(candidate) {
+            if (!candidate)
                 return false;
+            // An optional call still evaluates its arguments on the branch that runs,
+            // so `formatKey?.(uuidv4Base62())` mints the same per-render UUID as
+            // `formatKey(uuidv4Base62())`. Descending through the chain keeps the
+            // recursion from stopping short of the arguments.
+            const node = unwrapOptionalChain(candidate);
             // Direct call
             if (isUuidV4Base62Call(node))
                 return true;
@@ -146,7 +170,7 @@ exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
                     attr.name.name === 'key' &&
                     attr.value &&
                     attr.value.type === utils_1.AST_NODE_TYPES.JSXExpressionContainer) {
-                    const { expression } = attr.value;
+                    const expression = unwrapOptionalChain(attr.value.expression);
                     // Direct uuidv4Base62() call in key
                     if (containsUuidV4Base62Call(expression)) {
                         reportViolation(jsxElement, expression);
@@ -204,13 +228,14 @@ exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
         function checkMapForUuidv4Base62Keys(node) {
             if (!node.init)
                 return false;
+            const init = unwrapOptionalChain(node.init);
             // Check for the pattern: items.map(item => ({ ...item, key: uuidv4Base62() }))
-            if (node.init.type === utils_1.AST_NODE_TYPES.CallExpression &&
-                node.init.callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
-                node.init.callee.property.type === utils_1.AST_NODE_TYPES.Identifier &&
-                node.init.callee.property.name === 'map') {
+            if (init.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                init.callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                init.callee.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                init.callee.property.name === 'map') {
                 // The first argument should be the map callback
-                const callback = node.init.arguments[0];
+                const callback = init.arguments[0];
                 if (!callback)
                     return false;
                 // Handle arrow functions and regular functions
@@ -293,12 +318,12 @@ exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
                 for (const declarator of node.declarations) {
                     if (declarator.id.type === utils_1.AST_NODE_TYPES.Identifier &&
                         declarator.id.name === 'itemKeys') {
-                        if (declarator.init &&
-                            declarator.init.type === utils_1.AST_NODE_TYPES.CallExpression &&
-                            declarator.init.callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
-                            declarator.init.callee.property.type ===
-                                utils_1.AST_NODE_TYPES.Identifier &&
-                            declarator.init.callee.property.name === 'map') {
+                        const init = declarator.init && unwrapOptionalChain(declarator.init);
+                        if (init &&
+                            init.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                            init.callee.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                            init.callee.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                            init.callee.property.name === 'map') {
                             // The test case pattern detected
                             variablesWithUuidv4Base62Keys.add('itemKeys');
                         }
@@ -356,18 +381,19 @@ exports.noUuidv4Base62AsKey = (0, createRule_1.createRule)({
                         if (returnExpr && returnExpr.type === utils_1.AST_NODE_TYPES.JSXElement) {
                             const attributes = returnExpr.openingElement.attributes;
                             for (const attr of attributes) {
-                                if (attr.type === utils_1.AST_NODE_TYPES.JSXAttribute &&
-                                    attr.name.type === utils_1.AST_NODE_TYPES.JSXIdentifier &&
-                                    attr.name.name === 'key' &&
-                                    attr.value &&
-                                    attr.value.type === utils_1.AST_NODE_TYPES.JSXExpressionContainer &&
-                                    attr.value.expression.type ===
-                                        utils_1.AST_NODE_TYPES.MemberExpression &&
-                                    attr.value.expression.property.type ===
-                                        utils_1.AST_NODE_TYPES.Identifier &&
-                                    attr.value.expression.property.name === 'key') {
+                                if (attr.type !== utils_1.AST_NODE_TYPES.JSXAttribute ||
+                                    attr.name.type !== utils_1.AST_NODE_TYPES.JSXIdentifier ||
+                                    attr.name.name !== 'key' ||
+                                    !attr.value ||
+                                    attr.value.type !== utils_1.AST_NODE_TYPES.JSXExpressionContainer) {
+                                    continue;
+                                }
+                                const keyExpression = unwrapOptionalChain(attr.value.expression);
+                                if (keyExpression.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                                    keyExpression.property.type === utils_1.AST_NODE_TYPES.Identifier &&
+                                    keyExpression.property.name === 'key') {
                                     // The test case - directly report this element
-                                    reportViolation(returnExpr, attr.value.expression);
+                                    reportViolation(returnExpr, keyExpression);
                                     break;
                                 }
                             }

package/lib/rules/prefer-global-router-state-key.js

@@ -53,6 +53,39 @@ function buildQueryKeysSpecifier(sourceFilePath, cwd) {
     }
     return ensureRelativeSpecifier(toPosixPath(relativePath));
 }
+/**
+ * The expression a key ultimately comes from, read through the wrappers that
+ * restate it without relocating it.
+ *
+ * A chain records that the access short-circuits and an assertion restates a
+ * type; neither changes WHERE the key comes from, which is the only question
+ * the report-site dispatch asks. That dispatch enumerates the node types it
+ * knows and stays silent on everything else, so a key passed directly as
+ * `config?.queryKey` or `config.queryKey as string` matched no arm and the
+ * unapproved source went unreported (#1836) — the silent mirror of the
+ * over-reporting #1833 removed from the key-source classifier.
+ *
+ * A `ConditionalExpression` is deliberately NOT resolved here: it holds two
+ * branches and therefore no single source, so there is nothing for this to
+ * return. Its literal-bearing shapes already report through
+ * `containsInvalidStringLiteral`, which judges the whole expression; the
+ * branch-by-branch verdict a ternary of unapproved sources would need is a
+ * separate policy, and one that would have to answer for the per-source
+ * parameter carve-out (#1394) that only the identifier arm applies. The same
+ * holds for a logical expression's operands.
+ */
+function unwrapTransparentKeySource(node) {
+    switch (node.type) {
+        case utils_1.AST_NODE_TYPES.ChainExpression:
+        case utils_1.AST_NODE_TYPES.TSAsExpression:
+        case utils_1.AST_NODE_TYPES.TSSatisfiesExpression:
+        case utils_1.AST_NODE_TYPES.TSTypeAssertion:
+        case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+            return unwrapTransparentKeySource(node.expression);
+        default:
+            return node;
+    }
+}
 /**
  * Rule to enforce the use of centralized router state key constants imported from
  * `src/util/routing/queryKeys.ts` instead of arbitrary string literals when calling
@@ -203,6 +236,20 @@ exports.preferGlobalRouterStateKey = (0, createRule_1.createRule)({
          * Check if a node represents a valid query key usage
          */
         function isValidQueryKeyUsage(node) {
+            // `config?.getQueryKey()` parses as a `ChainExpression` wrapping the call,
+            // a type this dispatch does not name — so the optional spelling alone fell
+            // past every arm below and reported a key source the plain spelling is
+            // allowed to build (#1833). Optionality is orthogonal to the question
+            // asked here: a short-circuit changes only whether the same source is
+            // evaluated, never which source it is. Resolving to the node underneath
+            // rather than accepting the wrapper keeps an unapproved source reported
+            // through the chain, which is what stops this from becoming a blanket
+            // escape hatch. The sibling `enforce-querykey-ts` carries the same arm
+            // (#1832), and both rules ship as `error`, so a source one blesses must
+            // not be the other's violation (#1714).
+            if (node.type === utils_1.AST_NODE_TYPES.ChainExpression) {
+                return isValidQueryKeyUsage(node.expression);
+            }
             if (node.type === utils_1.AST_NODE_TYPES.Identifier) {
                 // Check direct imports
                 const importInfo = queryKeyImports.get(node.name);
@@ -421,8 +468,15 @@ exports.preferGlobalRouterStateKey = (0, createRule_1.createRule)({
                                 prop.key.name === 'key');
                             if (keyProperty && keyProperty.value) {
                                 const keyValue = keyProperty.value;
-                                if (!isValidQueryKeyUsage(keyValue)) {
-                                    if (containsInvalidStringLiteral(keyValue)) {
+                                // Every question below is about the source, so each is asked of
+                                // the source rather than of the notation wrapping it. The
+                                // report still names `keyValue`: the whole key expression is
+                                // what an author replaces with the constant, and naming only
+                                // the part underneath an `as const` would prescribe an edit
+                                // that does not compile (TS1355).
+                                const keySource = unwrapTransparentKeySource(keyValue);
+                                if (!isValidQueryKeyUsage(keySource)) {
+                                    if (containsInvalidStringLiteral(keySource)) {
                                         context.report({
                                             node: keyValue,
                                             messageId: 'preferGlobalRouterStateKey',
@@ -430,7 +484,14 @@ exports.preferGlobalRouterStateKey = (0, createRule_1.createRule)({
                                                 keyValue: sourceCode.getText(keyValue),
                                             },
                                             fix(fixer) {
-                                                // Only a statically known key value can be auto-fixed.
+                                                // Only a statically known key value can be auto-fixed,
+                                                // and the value read is the one the key is WRITTEN as,
+                                                // wrapper included. A wrapper carries no static value,
+                                                // so a wrapped literal reports with no fix behind it:
+                                                // substituting the constant underneath the wrapper
+                                                // would leave `QUERY_KEY_X as const`, which TypeScript
+                                                // rejects outright (TS1355), and there is no rewrite
+                                                // that both keeps the assertion and names a constant.
                                                 const staticKey = staticKeyOf(keyValue);
                                                 if (staticKey) {
                                                     const suggestedConstant = generateAutoFix(staticKey.text);
@@ -573,17 +634,14 @@ exports.preferGlobalRouterStateKey = (0, createRule_1.createRule)({
                                             },
                                         });
                                     }
-                                    else if (keyValue.type === utils_1.AST_NODE_TYPES.Identifier &&
-                                        !isParameterBinding(keyValue)) {
-                                        context.report({
-                                            node: keyValue,
-                                            messageId: 'invalidQueryKeySource',
-                                            data: {
-                                                variableName: keyValue.name,
-                                            },
-                                        });
-                                    }
-                                    else if (keyValue.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                                    else if (
+                                    // A key with no literal in it reports only where it names
+                                    // one source the author can swap out. A parameter is not
+                                    // one: it holds a different value on every call, and the
+                                    // caller — not this file — chooses it (#1394).
+                                    (keySource.type === utils_1.AST_NODE_TYPES.Identifier &&
+                                        !isParameterBinding(keySource)) ||
+                                        keySource.type === utils_1.AST_NODE_TYPES.MemberExpression) {
                                         context.report({
                                             node: keyValue,
                                             messageId: 'invalidQueryKeySource',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.127",
+  "version": "1.20.129",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,81 @@
 [
+  {
+    "version": "1.20.129",
+    "date": "2026-08-07T06:47:26.731Z",
+    "rules": [
+      {
+        "name": "no-circular-references",
+        "changeType": "fix",
+        "issues": [
+          1838
+        ],
+        "summary": "resolve an alias through an optional chain (closes #1838)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.128",
+    "date": "2026-08-07T05:47:06.312Z",
+    "rules": [
+      {
+        "name": "enforce-assert-safe-object-key",
+        "changeType": "fix",
+        "issues": [
+          1830
+        ],
+        "summary": "read a written key through an optional chain (closes #1830)"
+      },
+      {
+        "name": "enforce-querykey-ts",
+        "changeType": "fix",
+        "issues": [
+          1832
+        ],
+        "summary": "resolve a key source through an optional chain (closes #1832)"
+      },
+      {
+        "name": "no-hungarian",
+        "changeType": "fix",
+        "issues": [
+          1835
+        ],
+        "summary": "treat Symbol as a domain glyph noun in suffix position (closes #1835)"
+      },
+      {
+        "name": "no-misleading-boolean-prefixes",
+        "changeType": "fix",
+        "issues": [
+          1829
+        ],
+        "summary": "classify a boolean-like expression through an optional chain (closes #1829)"
+      },
+      {
+        "name": "no-passthrough-getters",
+        "changeType": "fix",
+        "issues": [
+          1834
+        ],
+        "summary": "exempt a getter that widens visibility over its root (closes #1834)"
+      },
+      {
+        "name": "no-uuidv4-base62-as-key",
+        "changeType": "fix",
+        "issues": [
+          1831
+        ],
+        "summary": "see the key expression through an optional-chained receiver (closes #1831)"
+      },
+      {
+        "name": "prefer-global-router-state-key",
+        "changeType": "fix",
+        "issues": [
+          1833,
+          1836
+        ],
+        "summary": "resolve a directly-passed key through transparent wrappers (closes #1836); resolve a key source through an optional chain (closes #1833)"
+      }
+    ]
+  },
   {
     "version": "1.20.127",
     "date": "2026-08-07T02:31:31.437Z",