@blumintinc/eslint-plugin-blumint 1.20.178 → 1.20.180

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.178',
+        version: '1.20.180',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-assert-safe-object-key.js

@@ -1316,7 +1316,8 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
         const reportWrittenKey = (written) => reportUseAssertSafe(written, context.sourceCode.getText(written));
         /**
          * Returns true when the identifier was initialized directly from an
-         * assertSafe(...) call, e.g. `const safeKey = assertSafe(rawKey)`.
+         * assertSafe(...) call, e.g. `const safeKey = assertSafe(rawKey)`, with any
+         * wrappers that erase before the code runs read through.
          * Only direct, single-step initializers count — transitive aliases
          * (const b = a) are not followed so they continue to be flagged.
          * findVariableInScope returns the nearest binding, so an inner variable
@@ -1328,11 +1329,20 @@ exports.enforceAssertSafeObjectKey = (0, createRule_1.createRule)({
             if (!variable)
                 return false;
             return variable.defs.some((def) => {
-                // `assertSafe?.(rawKey)` produces the very same validated key as
-                // `assertSafe(rawKey)` — the chain guards only a nullish callee — so
-                // the exemption reads through it rather than re-reporting the binding.
+                // The initializer is read through the same peel the index site uses, so
+                // the two arms agree about one expression: `assertSafe(rawKey) as
+                // TokenEncoded` binds the very key `assertSafe(rawKey)` does, the
+                // assertion having erased before the code runs, and `assertSafe?.(...)`
+                // is the same validated key again since the chain guards only a nullish
+                // callee. Demanding a bare call instead rejected the shape this rule's
+                // own remedy produces in typed code, where `Object.keys` widens to
+                // `string` and the record is keyed by a branded type (#2152).
+                //
+                // That peel includes `await`. assertSafe is synchronous, so awaiting it
+                // resolves to the very value it validated — the same reason the index
+                // arm has always exempted `m[await assertSafe(k)]`.
                 const init = def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator && def.node.init
-                    ? unwrapOptionalChain(def.node.init)
+                    ? unwrapWrittenKey(def.node.init)
                     : null;
                 return (!!init &&
                     init.type === utils_1.AST_NODE_TYPES.CallExpression &&

package/lib/rules/enforce-firestore-set-merge.js

@@ -156,12 +156,25 @@ function isRealtimeType(node) {
 function isRealtimeAnnotation(annotation) {
     return isRealtimeType(annotation?.typeAnnotation);
 }
-/** Whether an initializer constructs the Realtime Database batch manager. */
+/**
+ * Whether an initializer constructs the Realtime Database batch manager.
+ *
+ * The wrappers TypeScript writes around a value — `as T`, `satisfies T`, `!`,
+ * `<T>` — restate the expression's TYPE; none of them changes which class is
+ * constructed, so the construction underneath one is what the carve-out reads.
+ * {@link isRealtimeType} already looks through the type-level wrappers, and
+ * keying this arm on a bare `NewExpression` drifted the two apart: a field
+ * initialized `new RealtimeBatchManager() as RealtimeBatchManager` fell through
+ * to the Firestore arm and was told to call `set(…, { merge: true })` on a
+ * manager that has no `set` method at all, which no spelling of the code
+ * satisfies (#2150).
+ */
 function isRealtimeInstance(node) {
-    if (node?.type !== utils_1.AST_NODE_TYPES.NewExpression) {
+    const constructed = node ? unwrapAssertions(node) : null;
+    if (constructed?.type !== utils_1.AST_NODE_TYPES.NewExpression) {
         return false;
     }
-    const { callee } = node;
+    const { callee } = constructed;
     if (callee.type === utils_1.AST_NODE_TYPES.Identifier) {
         return callee.name === REALTIME_BATCH_MANAGER;
     }

package/lib/rules/enforce-id-capitalization.js

@@ -46,11 +46,42 @@ exports.enforceIdCapitalization = (0, createRule_1.createRule)({
         // A single identifier token — no whitespace, no punctuation. Prose is a
         // phrase, so anything matching this is a name rather than displayed text.
         const IDENTIFIER_TOKEN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+        // Every value spelled as a string-literal TYPE in this file. A value
+        // literal with the same spelling is pinned by that type, so capitalizing
+        // the value on its own contradicts it (TS2322) while the type itself is
+        // code the rule must leave alone — there is no half of the pair that can
+        // be rewritten safely, so neither is. Membership is exact: a type
+        // `'id'` pins the literal `'id'`, not the prose `'Please enter your id.'`.
+        const literalTypeValues = new Set();
+        // A `TSLiteralType` can be written after the value it pins, so the verdict
+        // is only complete once the whole file has been walked. Candidates are
+        // therefore collected during traversal and reported at `Program:exit`.
+        const candidates = [];
+        /**
+         * A string literal that spells a TYPE is code, never displayed prose. It
+         * names a property (`Match['id']`), a discriminant, or a member of a
+         * literal union, so capitalizing it renames something the program refers
+         * to by that exact spelling and the fixed file stops compiling — an
+         * indexed-access key rewritten to `Match['ID']` is a TS2339 (#2153).
+         *
+         * The question is asked about the type position itself rather than by
+         * listing parent node types: every literal in a type is wrapped in a
+         * `TSLiteralType`, so one check covers indexed-access keys, mapped-type
+         * `as` clauses, tuple members, generic defaults and conditional-type
+         * branches at once. Enumerating parents instead leaves each spelling that
+         * is not on the list unguarded, which is how this defect shipped.
+         */
+        function isTypePositionLiteral(node) {
+            return !!node.parent && node.parent.type === utils_1.AST_NODE_TYPES.TSLiteralType;
+        }
         /**
          * Check if a node is in a context that should be excluded from the rule
          * (e.g., parameter names, property names, type definitions)
          */
         function isExcludedContext(node) {
+            if (isTypePositionLiteral(node)) {
+                return true;
+            }
             // Check if the node is a property of an object pattern (destructuring)
             if (node.parent &&
                 (node.parent.type === utils_1.AST_NODE_TYPES.Property ||
@@ -240,30 +271,51 @@ exports.enforceIdCapitalization = (0, createRule_1.createRule)({
                 const fixedText = value.replace(idRegex, (_match, prefix, suffix) => {
                     return `${prefix}ID${suffix}`;
                 });
-                context.report({
-                    node,
-                    messageId: 'enforceIdCapitalization',
-                    fix: (fixer) => {
-                        // JSX text carries no delimiters, so its own text is the content.
-                        if (node.type === utils_1.AST_NODE_TYPES.JSXText) {
-                            return fixer.replaceText(node, fixedText);
-                        }
-                        if (node.type === utils_1.AST_NODE_TYPES.Literal) {
-                            const replacement = fixStringLiteral(node, fixedText);
-                            return replacement === null
-                                ? null
-                                : fixer.replaceText(node, replacement);
-                        }
-                        // Any other node kind (a TemplateElement, say) is a fragment of a
-                        // larger construct whose delimiters and `${}` expressions live
-                        // outside this node; rebuilding it from the parsed value would
-                        // destroy them, so report without a fix.
-                        return null;
-                    },
-                });
+                candidates.push({ node, fixedText });
             }
         }
+        /**
+         * A value literal whose exact spelling is also written as a type in this
+         * file is a token that type names, not prose: `const kind: 'id' = 'id'`
+         * only compiles while both halves agree, and the type half is off limits.
+         */
+        function isPinnedByLiteralType(node) {
+            return (node.type === utils_1.AST_NODE_TYPES.Literal &&
+                typeof node.value === 'string' &&
+                literalTypeValues.has(node.value));
+        }
+        function reportCandidate(node, fixedText) {
+            context.report({
+                node,
+                messageId: 'enforceIdCapitalization',
+                fix: (fixer) => {
+                    // JSX text carries no delimiters, so its own text is the content.
+                    if (node.type === utils_1.AST_NODE_TYPES.JSXText) {
+                        return fixer.replaceText(node, fixedText);
+                    }
+                    if (node.type === utils_1.AST_NODE_TYPES.Literal) {
+                        const replacement = fixStringLiteral(node, fixedText);
+                        return replacement === null
+                            ? null
+                            : fixer.replaceText(node, replacement);
+                    }
+                    // Any other node kind (a TemplateElement, say) is a fragment of a
+                    // larger construct whose delimiters and `${}` expressions live
+                    // outside this node; rebuilding it from the parsed value would
+                    // destroy them, so report without a fix.
+                    return null;
+                },
+            });
+        }
         return {
+            // Record the spellings the file's types claim before any verdict is
+            // emitted; a value literal matching one of them cannot be rewritten.
+            TSLiteralType(node) {
+                if (node.literal.type === utils_1.AST_NODE_TYPES.Literal &&
+                    typeof node.literal.value === 'string') {
+                    literalTypeValues.add(node.literal.value);
+                }
+            },
             // Check string literals
             Literal(node) {
                 if (typeof node.value === 'string') {
@@ -274,6 +326,16 @@ exports.enforceIdCapitalization = (0, createRule_1.createRule)({
             JSXText(node) {
                 checkForIdInString(node, node.value);
             },
+            'Program:exit'() {
+                for (const { node, fixedText } of candidates) {
+                    // JSX text is rendered, so no type can pin it — the check is scoped
+                    // to literals, whose spelling a type can name.
+                    if (isPinnedByLiteralType(node)) {
+                        continue;
+                    }
+                    reportCandidate(node, fixedText);
+                }
+            },
             // We don't need a separate handler for CallExpression since we already handle Literals
             // The Literal handler will catch the string arguments in t("user.profile.id")
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.178",
+  "version": "1.20.180",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,40 @@
 [
+  {
+    "version": "1.20.180",
+    "date": "2026-08-27T01:52:25.340Z",
+    "rules": [
+      {
+        "name": "enforce-assert-safe-object-key",
+        "changeType": "fix",
+        "issues": [
+          2152
+        ],
+        "summary": "read the validated binding through the shared peel (closes #2152)"
+      },
+      {
+        "name": "enforce-id-capitalization",
+        "changeType": "fix",
+        "issues": [
+          2153
+        ],
+        "summary": "leave string literals that spell a type alone (closes #2153)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.179",
+    "date": "2026-08-26T23:40:36.587Z",
+    "rules": [
+      {
+        "name": "enforce-firestore-set-merge",
+        "changeType": "fix",
+        "issues": [
+          2150
+        ],
+        "summary": "unwrap assertions in the RealtimeDB carve-out (closes #2150)"
+      }
+    ]
+  },
   {
     "version": "1.20.178",
     "date": "2026-08-26T22:11:53.342Z",