@blumintinc/eslint-plugin-blumint 1.20.182 → 1.20.184

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.182',
+        version: '1.20.184',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-verb-noun-naming.js

@@ -3785,6 +3785,11 @@ const FUNCTION_LIKE_TYPES = new Set([
 /**
  * Visits every descendant of `node` that belongs to the same function scope.
  * Nested functions are handed to `visit` but not descended into.
+ *
+ * `node` itself is never handed to `visit`. A caller that passes a statement
+ * body loses nothing by that, but one that can pass an expression — an arrow's
+ * concise body is the expression, not a statement wrapping it — has to answer
+ * for the handed node on its own (#2169).
  */
 function forEachNodeInOwnScope(node, visit) {
     for (const key of Object.keys(node)) {
@@ -3882,15 +3887,29 @@ function rendersEveryReturn(node) {
     });
     return returned.length > 0 && returned.every(isRenderableValue);
 }
+/**
+ * Whether the function calls a React hook in its own scope.
+ *
+ * An arrow with a concise body has no statement wrapping the expression, so the
+ * hook call can be `node.body` itself rather than a descendant of it. Reading
+ * only descendants makes the exemption depend on how tersely the component is
+ * written: `() => useThing()` reports while `() => { return useThing(); }` and
+ * `() => wrap(useThing())` — strictly more code, identical meaning — do not
+ * (#2169). `rendersEveryReturn` carries the same concise-body arm.
+ */
 function callsReactHook(node) {
     let found = false;
-    forEachNodeInOwnScope(node.body, (child) => {
-        if (found || child.type !== utils_1.AST_NODE_TYPES.CallExpression) {
+    const recordHookCall = (candidate) => {
+        if (found || candidate.type !== utils_1.AST_NODE_TYPES.CallExpression) {
             return;
         }
-        const name = calleeName(child.callee);
+        const name = calleeName(candidate.callee);
         found = !!name && HOOK_CALL.test(name);
-    });
+    };
+    if (node.body.type !== utils_1.AST_NODE_TYPES.BlockStatement) {
+        recordHookCall(node.body);
+    }
+    forEachNodeInOwnScope(node.body, recordHookCall);
     return found;
 }
 /**
@@ -3915,6 +3934,43 @@ function isComponentReference(identifier) {
     }
     return false;
 }
+/**
+ * The declaration that owns a member's component evidence. A member spelled as
+ * a TypeScript overload set is one name declared several times: the type-only
+ * signatures carry no body and therefore no evidence of what the member
+ * renders, while the implementation carries all of it. Judging each declaration
+ * on its own reports a rename on the signature line of a component whose
+ * implementation line is exempt — for the same member, whose call sites the
+ * rename would break (#2168).
+ *
+ * Resolution is syntactic and same-file: the sibling of the same kind, key and
+ * staticness that declares a body. A signature with no implementation resolves
+ * to itself — an ambient declaration has nothing else to defer to, and answers
+ * on the evidence its own name and annotation carry.
+ */
+function componentEvidenceOwner(node) {
+    // A declaration that carries a body carries its own evidence and answers for
+    // itself, so only a signature ever looks past the member it is written on.
+    if (node.value.type !== utils_1.AST_NODE_TYPES.TSEmptyBodyFunctionExpression) {
+        return node;
+    }
+    if (node.computed || node.key.type !== utils_1.AST_NODE_TYPES.Identifier) {
+        return node;
+    }
+    const classBody = node.parent;
+    if (classBody?.type !== utils_1.AST_NODE_TYPES.ClassBody) {
+        return node;
+    }
+    const { name } = node.key;
+    const implementation = classBody.body.find((member) => member.type === utils_1.AST_NODE_TYPES.MethodDefinition &&
+        member.kind === node.kind &&
+        member.static === node.static &&
+        !member.computed &&
+        member.key.type === utils_1.AST_NODE_TYPES.Identifier &&
+        member.key.name === name &&
+        member.value.type !== utils_1.AST_NODE_TYPES.TSEmptyBodyFunctionExpression);
+    return implementation ?? node;
+}
 exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
     name: 'enforce-verb-noun-naming',
     meta: {
@@ -4075,7 +4131,12 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
                 return node.id.name;
             }
             if (node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression ||
-                node.type === utils_1.AST_NODE_TYPES.FunctionExpression) {
+                node.type === utils_1.AST_NODE_TYPES.FunctionExpression ||
+                // A type-only overload signature parses as an empty-bodied function
+                // expression. It holds its name on the member key exactly as the
+                // implementation beside it does, so the name-keyed component evidence
+                // has to reach it the same way (#2168).
+                node.type === utils_1.AST_NODE_TYPES.TSEmptyBodyFunctionExpression) {
                 const parent = node.parent;
                 if (parent?.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
                     parent.id.type === utils_1.AST_NODE_TYPES.Identifier) {
@@ -4089,6 +4150,16 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
                     parent.key.type === utils_1.AST_NODE_TYPES.Identifier) {
                     return parent.key.name;
                 }
+                // A method holds its name on the member key exactly as a field does.
+                // Without this arm a method's `FunctionExpression` is anonymous, and an
+                // anonymous function never reaches the PascalCase component evidence —
+                // leaving `Panel() { return <div />; }` judged by the weak
+                // props-and-JSX fallback alone, which a parameterless component fails.
+                if (parent?.type === utils_1.AST_NODE_TYPES.MethodDefinition &&
+                    !parent.computed &&
+                    parent.key.type === utils_1.AST_NODE_TYPES.Identifier) {
+                    return parent.key.name;
+                }
             }
             return '';
         }
@@ -4134,12 +4205,15 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
          * scope analysis, which records JSX element names as references.
          */
         function isUsedAsReactComponent(node, functionName) {
-            // A class field's name is a member, not a lexical binding, so a variable
+            // A class member's name is a member, not a lexical binding, so a variable
             // of the same name found in scope belongs to some other symbol entirely
-            // and says nothing about the field. `<this.Foo />` is a member expression
-            // and records no reference to resolve, so the field relies on the other
-            // component evidence.
-            if (node.parent?.type === utils_1.AST_NODE_TYPES.PropertyDefinition) {
+            // and says nothing about the member. `<this.Foo />` is a member expression
+            // and records no reference to resolve, so the member relies on the other
+            // component evidence. This holds for a method as much as for a field:
+            // resolving `Panel` lexically from inside a class would answer with an
+            // imported component of that name.
+            if (node.parent?.type === utils_1.AST_NODE_TYPES.PropertyDefinition ||
+                node.parent?.type === utils_1.AST_NODE_TYPES.MethodDefinition) {
                 return false;
             }
             const scope = ASTHelpers_1.ASTHelpers.getScope(context, node);
@@ -4152,11 +4226,20 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
         function isReactComponent(node) {
             if (node.type !== utils_1.AST_NODE_TYPES.FunctionDeclaration &&
                 node.type !== utils_1.AST_NODE_TYPES.ArrowFunctionExpression &&
-                node.type !== utils_1.AST_NODE_TYPES.FunctionExpression) {
+                node.type !== utils_1.AST_NODE_TYPES.FunctionExpression &&
+                // A type-only overload signature declares the same member as the
+                // implementation beside it, so the carve-out has to reach it (#2168).
+                node.type !== utils_1.AST_NODE_TYPES.TSEmptyBodyFunctionExpression) {
                 return false;
             }
+            // A signature declares no body, so every piece of evidence read out of
+            // one — what it renders, the hooks it calls — is unavailable rather than
+            // absent. What it renders is settled by the implementation instead.
+            const bodied = node.type === utils_1.AST_NODE_TYPES.TSEmptyBodyFunctionExpression
+                ? undefined
+                : node;
             const functionName = getFunctionName(node);
-            const returnsJsx = ASTHelpers_1.ASTHelpers.returnsJSX(node.body, context);
+            const returnsJsx = ASTHelpers_1.ASTHelpers.returnsJSX(bodied?.body, context);
             const hasProps = hasPropsParameter(node);
             const hasReactType = hasReactTypeAnnotation(node);
             const isUnmemoized = !!functionName && functionName.endsWith('Unmemoized');
@@ -4180,9 +4263,10 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
                 // demanding a rename that would break every JSX call site. A component
                 // is therefore also recognised by what it renders, by the hooks it calls,
                 // and by how the rest of the file uses it.
-                if (!isGeneratorFunction(node) &&
-                    (rendersEveryReturn(node) ||
-                        callsReactHook(node) ||
+                if (bodied &&
+                    !isGeneratorFunction(bodied) &&
+                    (rendersEveryReturn(bodied) ||
+                        callsReactHook(bodied) ||
                         isUsedAsReactComponent(node, functionName))) {
                     return true;
                 }
@@ -4281,6 +4365,20 @@ exports.enforceVerbNounNaming = (0, createRule_1.createRule)({
                 // Skip constructors since they are special class methods
                 if (node.kind === 'constructor')
                     return;
+                // A component is a noun by convention, and `Panel() { return <div />; }`
+                // is the same member as `Panel = () => <div />` with one token changed.
+                // The carve-out reaches every other spelling of a function, so a method
+                // that is a component answers to it too. A `set` accessor is an
+                // assignment target rather than a callable, so it can never be a
+                // component and is deliberately left to the naming demand.
+                //
+                // The whole overload set answers with one voice, so a type-only
+                // signature is judged by the implementation that gives the member its
+                // body rather than by the nothing it renders itself.
+                if (node.kind === 'method' &&
+                    isReactComponent(componentEvidenceOwner(node).value)) {
+                    return;
+                }
                 if (!isVerbPhrase(node.key.name)) {
                     context.report({
                         node: node.key,

package/lib/rules/no-entire-object-hook-deps.js

@@ -542,6 +542,103 @@ function callsCorrespondingSetter(hookBody, dependencyName) {
     }
     return visit(hookBody);
 }
+/**
+ * The single property a member expression reads, or null when the key is
+ * dynamic.
+ *
+ * A literal string key is the same read as the dotted spelling — `ref['current']`
+ * and `ref.current` reach the identical slot — so both answer with the name.
+ */
+function staticPropertyName(node) {
+    if (!node.computed) {
+        return node.property.type === utils_1.AST_NODE_TYPES.Identifier
+            ? node.property.name
+            : null;
+    }
+    return node.property.type === utils_1.AST_NODE_TYPES.Literal &&
+        typeof node.property.value === 'string'
+        ? node.property.value
+        : null;
+}
+/** The one property a React ref object carries. */
+const REF_PROPERTY = 'current';
+/**
+ * Whether every read of `objectName` inside the hook body goes through
+ * `.current` — the syntactic signature of a React ref object.
+ *
+ * why: a ref is the one dependency a hook is meant to list whole. React writes
+ * `ref.current` during commit, after the render that evaluated the dependency
+ * array, so narrowing `[ref]` to `[ref.current]` pins the value the renderer
+ * has not written yet and the hook never re-runs when it later does — the
+ * mount-time registration effect silently registers nothing. React's own
+ * `react-hooks/exhaustive-deps` rejects that narrowed array outright ("Mutable
+ * values like 'ref.current' aren't valid dependencies"), so emitting it puts
+ * two recommended rules in direct contradiction and `--fix` oscillates between
+ * them (#2170).
+ *
+ * The rule's motivation also lapses here: it warns that a sibling property
+ * changing re-runs the hook needlessly, and a ref object has no sibling
+ * property. Recognising the ref by its access shape rather than by its type
+ * covers a ref arriving through a prop type no program can resolve, which is
+ * the shape the `RuleTester` and every untyped consumer actually see.
+ *
+ * A chain rooted at `.current` (`ref.current.scrollTop`) counts as a ref read:
+ * every link past the first is reachable only once the commit has populated the
+ * ref, so narrowing there is the same defect one link deeper — and it would
+ * additionally throw when the array dereferences a null `current` on the first
+ * render.
+ */
+function readsObjectOnlyAsRef(hookBody, objectName) {
+    const visited = new Set();
+    let readsCurrent = false;
+    let readsAnythingElse = false;
+    function visit(node) {
+        if (!node || visited.has(node) || readsAnythingElse)
+            return;
+        visited.add(node);
+        if (node.type === utils_1.AST_NODE_TYPES.Identifier && node.name === objectName) {
+            // The wrappers that can sit between the identifier and the access it
+            // belongs to — `(ref as RefObject<T>).current`, `ref!.current`,
+            // `ref?.current` — are skipped so the read is attributed to its real
+            // context, exactly as the usage collector does.
+            let wrapperNode = node;
+            let effectiveParent = node.parent;
+            while (effectiveParent &&
+                (effectiveParent.type === utils_1.AST_NODE_TYPES.TSAsExpression ||
+                    effectiveParent.type === utils_1.AST_NODE_TYPES.TSTypeAssertion ||
+                    effectiveParent.type === utils_1.AST_NODE_TYPES.ChainExpression ||
+                    effectiveParent.type === utils_1.AST_NODE_TYPES.TSNonNullExpression)) {
+                wrapperNode = effectiveParent;
+                effectiveParent = effectiveParent.parent;
+            }
+            // `other.objectName` and `{ objectName: value }` name a different slot
+            // and a label respectively, so neither is a read of this dependency.
+            const isMemberProperty = effectiveParent?.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                effectiveParent.property === wrapperNode &&
+                !effectiveParent.computed;
+            const isPropertyKey = effectiveParent?.type === utils_1.AST_NODE_TYPES.Property &&
+                effectiveParent.key === wrapperNode &&
+                !effectiveParent.computed &&
+                !effectiveParent.shorthand;
+            if (!isMemberProperty && !isPropertyKey) {
+                if (effectiveParent?.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                    effectiveParent.object === wrapperNode &&
+                    staticPropertyName(effectiveParent) === REF_PROPERTY) {
+                    readsCurrent = true;
+                }
+                else {
+                    // Any other read — a second property, a bare reference handed to a
+                    // call, a spread — proves the value is not a ref, so the ordinary
+                    // narrowing applies.
+                    readsAnythingElse = true;
+                }
+            }
+        }
+        forEachChildNode(node, visit);
+    }
+    visit(hookBody);
+    return readsCurrent && !readsAnythingElse;
+}
 function getObjectUsagesInHook(hookBody, objectName, typeInfo, bodyIsDeferred = false) {
     const usages = new Map(); // Track usage and its position
     // why: derived dependency paths (first-optional intermediate, array base)
@@ -1266,6 +1363,12 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
                         // If we found specific field usages and the entire object is in deps
                         // Skip reporting if needsEntireObject is true (indicates spread operator usage)
                         else if (result.usages.size > 0 && !result.needsEntireObject) {
+                            // A ref object has no narrowing target: `[ref.current]` reads a
+                            // slot React fills after the render that evaluated the array, so
+                            // the whole ref is the correct dependency (#2170).
+                            if (readsObjectOnlyAsRef(callbackBody, objectName)) {
+                                return;
+                            }
                             const fields = Array.from(result.usages).join(', ');
                             context.report({
                                 node: element,

package/lib/rules/parallelize-async-operations.js

@@ -22,6 +22,299 @@ const TEST_FILE_DIRECTORY = /(^|\/)(__tests__|__mocks__)\//;
  * assertion against the interaction (issue #1395).
  */
 const isTestFile = (filename) => TEST_FILE_SUFFIX.test(filename) || TEST_FILE_DIRECTORY.test(filename);
+/**
+ * Module specifiers whose exports operate the filesystem.
+ *
+ * The `node:`-prefixed and bare spellings name the same built-in module, and
+ * `graceful-fs` is a drop-in wrapper over it, so a run mixing the spellings
+ * still touches ONE resource. Membership is by specifier rather than by callee
+ * name because the name alone proves nothing: a project's own `writeFile`
+ * helper shares the name while sharing no resource.
+ */
+const FS_MODULE_SOURCES = new Set([
+    'fs',
+    'node:fs',
+    'fs/promises',
+    'node:fs/promises',
+    'graceful-fs',
+]);
+/**
+ * Filesystem operations that only OBSERVE the filesystem.
+ *
+ * Two observations commute -- neither can change what the other returns -- so a
+ * run of them carries no ordering and stays parallelizable, which is where this
+ * rule's value lies for I/O-bound reads. Every other operation is treated as
+ * mutating.
+ *
+ * The set is an allowlist read fail-safe, so an operation it does not know
+ * counts as mutating. The failure directions are not symmetric: misreading a
+ * mutation as an observation races a write against its own precondition and
+ * ships a silent corruption, whereas misreading an observation as a mutation
+ * only declines a parallelization. An fs surface this list does not enumerate
+ * therefore keeps the barrier.
+ */
+const READ_ONLY_FS_OPERATIONS = new Set([
+    'readFile',
+    'readdir',
+    'stat',
+    'lstat',
+    'fstat',
+    'access',
+    'realpath',
+    'readlink',
+    'opendir',
+    'exists',
+]);
+/**
+ * The `*Sync` variant of an fs operation performs the same operation on the
+ * same resource, so it classifies identically to the asynchronous spelling and
+ * the suffix is dropped before the lookup. This keeps the allowlist to one
+ * entry per operation, which is what stops a `readFileSync` omission from
+ * quietly reclassifying a read as a mutation.
+ */
+const SYNC_OPERATION_SUFFIX = /Sync$/;
+function isReadOnlyFsOperation(operation) {
+    return READ_ONLY_FS_OPERATIONS.has(operation.replace(SYNC_OPERATION_SUFFIX, ''));
+}
+/**
+ * Strips the wrappers that carry no value of their own, so a shape test reaches
+ * the expression the source actually denotes.
+ *
+ * `a?.b` is wrapped in a ChainExpression, so a bare `MemberExpression` or
+ * `CallExpression` test sees the wrapper instead and answers no. Here that
+ * answer is the UNSAFE one -- an unrecognised `require` spelling yields no
+ * filesystem binding, which withdraws the ordering barrier rather than merely
+ * declining a parallelization -- so the optional spellings are unwrapped to the
+ * same node their non-optional spellings produce. `create` declares its own
+ * `unwrapExpression` for the same purpose; this one exists because binding
+ * collection runs at module scope, where that closure is out of reach.
+ */
+function unwrapWrappers(node) {
+    let current = node;
+    while (current.type === utils_1.AST_NODE_TYPES.ChainExpression ||
+        current.type === utils_1.AST_NODE_TYPES.TSNonNullExpression ||
+        current.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
+        current = current.expression;
+    }
+    return current;
+}
+/**
+ * The module specifier a `require(...)` call loads, when the call names it as a
+ * string literal.
+ *
+ * `require('fs').promises` is the same load one member deeper, so a member
+ * expression rooted at the call answers with the call's own specifier: the
+ * binding it produces still reaches the filesystem.
+ */
+function requiredModuleSource(node) {
+    if (!node) {
+        return null;
+    }
+    const unwrapped = unwrapWrappers(node);
+    if (unwrapped.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+        return requiredModuleSource(unwrapped.object);
+    }
+    if (unwrapped.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+        unwrapped.arguments.length !== 1) {
+        return null;
+    }
+    const callee = unwrapWrappers(unwrapped.callee);
+    if (callee.type !== utils_1.AST_NODE_TYPES.Identifier || callee.name !== 'require') {
+        return null;
+    }
+    const [specifier] = unwrapped.arguments;
+    return specifier.type === utils_1.AST_NODE_TYPES.Literal &&
+        typeof specifier.value === 'string'
+        ? specifier.value
+        : null;
+}
+/**
+ * Every variable the file declares, in every scope.
+ *
+ * A filesystem binding is not a property of the module scope: a function-scoped
+ * `const { writeFile } = require('node:fs/promises')` reaches the same
+ * filesystem as a top-level one, and scanning only `Program.body` finds no
+ * binding for it at all. (#2167)
+ */
+function allScopeVariables(scopeManager) {
+    const globalScope = scopeManager?.globalScope;
+    if (!globalScope) {
+        return [];
+    }
+    const variables = [];
+    const stack = [globalScope];
+    while (stack.length > 0) {
+        const scope = stack.pop();
+        variables.push(...scope.variables);
+        stack.push(...scope.childScopes);
+    }
+    return variables;
+}
+/**
+ * Walks a member chain down to the expression it is rooted at.
+ *
+ * `create` declares its own `getPathRoot` for the same purpose; this one exists
+ * because binding collection runs at module scope, where that closure is out of
+ * reach.
+ */
+function memberChainRoot(node) {
+    let root = unwrapWrappers(node);
+    while (root.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+        root = unwrapWrappers(root.object);
+    }
+    return root;
+}
+/**
+ * The operation a destructuring leaf reads out of the container it destructures
+ * (`const { promises: { writeFile } } = fs` -> `writeFile`), and null when the
+ * pattern binds the container itself.
+ *
+ * The leaf's IMMEDIATE property key is the answer at every depth, which is what
+ * lets a nested pattern need no case of its own: that key is the last member a
+ * member-expression spelling of the same access would have carried. Reading the
+ * OUTER pattern instead is what dropped `{ promises: { writeFile } }`. (#2167)
+ *
+ * A computed key names an operation the source does not state, so it falls back
+ * to the module-object answer, under which a bare callee classifies by its
+ * local spelling and takes the mutating default.
+ */
+function destructuredOperation(name) {
+    // `const { writeFile = fallback } = fsp` binds through an AssignmentPattern,
+    // which sits between the leaf and the property that names it.
+    const bound = name.parent?.type === utils_1.AST_NODE_TYPES.AssignmentPattern &&
+        name.parent.left === name
+        ? name.parent
+        : name;
+    const property = bound.parent;
+    if (property?.type !== utils_1.AST_NODE_TYPES.Property ||
+        property.value !== bound ||
+        property.computed) {
+        return null;
+    }
+    if (property.key.type === utils_1.AST_NODE_TYPES.Identifier) {
+        return property.key.name;
+    }
+    return property.key.type === utils_1.AST_NODE_TYPES.Literal &&
+        typeof property.key.value === 'string'
+        ? property.key.value
+        : null;
+}
+/**
+ * Resolves every binding in the file that reaches a filesystem module.
+ *
+ * Collection is a FIXPOINT rather than a single pass, because a binding's
+ * origin can be another binding: `const fs = require('fs')` followed by
+ * `const { rename, writeFile } = fs.promises` roots the second declarator at
+ * the first one rather than at a literal `require` call, so a pass that
+ * re-derives the origin from syntax alone finds no filesystem there. The
+ * spelling is what ESM leaves a consumer with (`import fs from 'node:fs'`),
+ * and losing it withdraws the ordering barrier -- the unsafe direction, since
+ * it fuses a write with the operation whose precondition that write is -- so
+ * the pass repeats until it classifies nothing further. (#2167)
+ */
+function collectFsBindings(scopeManager) {
+    const variables = allScopeVariables(scopeManager);
+    const bindings = new Map();
+    // Scope analysis resolves each use site to the variable it reads, which is
+    // what keeps an inner binding from inheriting an outer one's origin.
+    const variableOf = new Map();
+    for (const variable of variables) {
+        for (const reference of variable.references) {
+            variableOf.set(reference.identifier, variable);
+        }
+    }
+    const lookup = (identifier) => {
+        const variable = variableOf.get(identifier);
+        if (!variable || !bindings.has(variable)) {
+            return undefined;
+        }
+        return { operation: bindings.get(variable) ?? null };
+    };
+    const importedBinding = (definition) => {
+        if (definition.type !== utils_1.TSESLint.Scope.DefinitionType.ImportBinding) {
+            return undefined;
+        }
+        const { node } = definition;
+        if (node.type === utils_1.AST_NODE_TYPES.TSImportEqualsDeclaration) {
+            // `import fs = require('fs')` binds the module object through a
+            // declaration of its own rather than through a specifier.
+            const { moduleReference } = node;
+            const source = moduleReference.type === utils_1.AST_NODE_TYPES.TSExternalModuleReference &&
+                moduleReference.expression.type === utils_1.AST_NODE_TYPES.Literal &&
+                typeof moduleReference.expression.value === 'string'
+                ? moduleReference.expression.value
+                : null;
+            return source !== null && FS_MODULE_SOURCES.has(source)
+                ? { operation: null }
+                : undefined;
+        }
+        const declaration = definition.parent;
+        if (declaration?.type !== utils_1.AST_NODE_TYPES.ImportDeclaration ||
+            !FS_MODULE_SOURCES.has(declaration.source.value)) {
+            return undefined;
+        }
+        // A namespace or default specifier binds the module OBJECT, whose operation
+        // is named at the call site, so it records no exported name.
+        return {
+            operation: node.type === utils_1.AST_NODE_TYPES.ImportSpecifier
+                ? node.imported.name
+                : null,
+        };
+    };
+    const declaredBinding = (definition) => {
+        if (definition.type !== utils_1.TSESLint.Scope.DefinitionType.Variable) {
+            return undefined;
+        }
+        const { init, id } = definition.node;
+        if (!init) {
+            return undefined;
+        }
+        const source = requiredModuleSource(init);
+        if (source !== null && FS_MODULE_SOURCES.has(source)) {
+            return { operation: destructuredOperation(definition.name) };
+        }
+        const root = memberChainRoot(init);
+        if (root.type !== utils_1.AST_NODE_TYPES.Identifier) {
+            return undefined;
+        }
+        const rooted = lookup(root);
+        if (!rooted) {
+            return undefined;
+        }
+        // A bare alias (`const wf = writeFile`) denotes exactly what it aliases, so
+        // it carries that classification over rather than taking the module-object
+        // answer a member access leaves behind.
+        return unwrapWrappers(init) === root && definition.name === id
+            ? rooted
+            : { operation: destructuredOperation(definition.name) };
+    };
+    let classified = true;
+    while (classified) {
+        classified = false;
+        for (const variable of variables) {
+            if (bindings.has(variable)) {
+                continue;
+            }
+            for (const definition of variable.defs) {
+                const binding = importedBinding(definition) ?? declaredBinding(definition);
+                if (!binding) {
+                    continue;
+                }
+                bindings.set(variable, binding.operation);
+                classified = true;
+                break;
+            }
+        }
+    }
+    return lookup;
+}
+/**
+ * The promise combinators a call can be chained with without changing WHICH
+ * operation it performs. `writeFile(pending, data).catch(handle)` writes the
+ * same file the bare call does, so the chain is stripped before the callee is
+ * rooted. (#2167)
+ */
+const PROMISE_CHAIN_METHODS = new Set(['then', 'catch', 'finally']);
 /**
  * Matches prettier's own default. The autofix authors a whole statement a
  * formatter owns, so a layout it emits that prettier would not is rewritten on
@@ -202,6 +495,15 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
             return {};
         }
         const sourceCode = context.sourceCode;
+        // The file's filesystem bindings are a property of the file's scopes, not
+        // of any one run, so they are resolved once per file and reused by every
+        // candidate run the traversal reaches.
+        let fsBindings = null;
+        const getFsBindings = () => {
+            const resolved = fsBindings ?? collectFsBindings(sourceCode.scopeManager);
+            fsBindings = resolved;
+            return resolved;
+        };
         // The width the autofix lays the rewritten statement out against. It lives
         // in the consumer's formatter configuration, which no rule context carries,
         // so a project formatting at 100 or 120 states it here.
@@ -1356,6 +1658,81 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
             // every such write is by construction published to the outer scope.
             return { names, instancePaths: new Set(targets.instancePaths) };
         }
+        /**
+         * Strips the promise combinators a chained call is wrapped in, so the call
+         * UNDERNEATH is what gets classified.
+         *
+         * `await writeFile(pending, data).catch(handle)` performs exactly the write
+         * the bare spelling does. Rooting the outer callee walks to the inner CALL
+         * rather than to a binding, which names no filesystem operation at all and
+         * withdraws the ordering barrier -- the unsafe direction -- so the receiver
+         * of a `then`/`catch`/`finally` is unwrapped before the callee is rooted.
+         * (#2167)
+         */
+        function unwrapPromiseChain(node) {
+            let current = unwrapExpression(node);
+            while (current.type === utils_1.AST_NODE_TYPES.CallExpression) {
+                const callee = unwrapExpression(current.callee);
+                if (callee.type !== utils_1.AST_NODE_TYPES.MemberExpression) {
+                    break;
+                }
+                const { property } = callee;
+                const method = !callee.computed && property.type === utils_1.AST_NODE_TYPES.Identifier
+                    ? property.name
+                    : property.type === utils_1.AST_NODE_TYPES.Literal &&
+                        typeof property.value === 'string'
+                        ? property.value
+                        : null;
+                if (method === null || !PROMISE_CHAIN_METHODS.has(method)) {
+                    break;
+                }
+                current = unwrapExpression(callee.object);
+            }
+            return current;
+        }
+        /**
+         * Names the filesystem operation an await performs, or null when the await
+         * does not reach the filesystem through a binding this file declares.
+         *
+         * The classification keys on the ORIGIN of the callee's root binding rather
+         * than on the callee's spelling, so a project-local helper that happens to
+         * be called `writeFile` is not mistaken for the fs export of that name, and
+         * a renamed import (`writeFile as wf`) is not missed for lacking it.
+         *
+         * The operation is read off the LAST member of a member callee
+         * (`fs.promises.writeFile` -> `writeFile`), which is where the module object
+         * spells it, and off the imported name for a bare callee, which is where a
+         * named import spells it. A computed member whose key is not a literal names
+         * an operation the source does not state, so it yields the empty string and
+         * classifies as mutating, matching the fail-safe the allowlist is read with.
+         */
+        function getFsOperationName(awaitExpr) {
+            const argument = unwrapPromiseChain(awaitExpr.argument);
+            if (argument.type !== utils_1.AST_NODE_TYPES.CallExpression) {
+                return null;
+            }
+            const callee = unwrapExpression(argument.callee);
+            const root = getPathRoot(callee);
+            if (root.type !== utils_1.AST_NODE_TYPES.Identifier) {
+                return null;
+            }
+            const binding = getFsBindings()(root);
+            if (!binding) {
+                return null;
+            }
+            if (callee.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+                const { property } = callee;
+                if (!callee.computed && property.type === utils_1.AST_NODE_TYPES.Identifier) {
+                    return property.name;
+                }
+                if (property.type === utils_1.AST_NODE_TYPES.Literal &&
+                    typeof property.value === 'string') {
+                    return property.value;
+                }
+                return '';
+            }
+            return binding.operation ?? root.name;
+        }
         /**
          * Checks if there are dependencies between await expressions
          */
@@ -1744,6 +2121,53 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
                     }
                 }
             }
+            // 13. Shared external-resource ordering barrier (filesystem). Two awaits
+            // that operate the same filesystem are ordered by that resource, not by
+            // any JS value: `writeFile(pending, data)` then `rename(pending, path)`
+            // passes nothing from one call to the other, yet the second one's
+            // precondition is precisely the first one's side effect. Every barrier
+            // above reads bindings, receivers and slots -- the JS-level surface -- so
+            // a dependency carried entirely through an external resource is invisible
+            // to all of them, and the run reads as independent while being strictly
+            // ordered. Promise.all issues all of it in one tick, which either throws
+            // ENOENT or publishes a partial state, and WHICH of the two is a race, so
+            // the damage is timing-dependent rather than reproducible. (#2166)
+            //
+            // The barrier engages only when at least one operation MUTATES. Two
+            // observations of the filesystem commute -- neither can change what the
+            // other returns -- so `readFile(a)` then `readFile(b)` is a genuine
+            // latency mistake and keeps its report, which is where the rule earns
+            // most of its value on I/O-bound code. A mutation makes the ordering
+            // observable, and observable ordering is exactly what the rewrite
+            // destroys.
+            //
+            // A single fs await raises no ordering question: the resource has to be
+            // SHARED for the sequencing to exist, so a run mixing one fs call with
+            // unrelated network calls still parallelizes.
+            //
+            // Member-callee spellings (`fs.writeFile()`, `fs.promises.rename()`) are
+            // incidentally held by the shared-receiver barrier above, which keys on
+            // the receiver they have in common. They are classified here too because
+            // that coverage is a side effect of an unrelated question: it lapses the
+            // moment a file mixes spellings (`fs.writeFile()` then a named-import
+            // `rename()`), which shares the resource while sharing no receiver.
+            let fsAwaitCount = 0;
+            let mutatesFilesystem = false;
+            for (const node of awaitNodes) {
+                const awaitExpr = getAwaitExpression(node);
+                if (!awaitExpr)
+                    continue;
+                const operation = getFsOperationName(awaitExpr);
+                if (operation === null)
+                    continue;
+                fsAwaitCount++;
+                if (!isReadOnlyFsOperation(operation)) {
+                    mutatesFilesystem = true;
+                }
+            }
+            if (fsAwaitCount >= 2 && mutatesFilesystem) {
+                return true;
+            }
             return false;
         }
         /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.182",
+  "version": "1.20.184",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,57 @@
 [
+  {
+    "version": "1.20.184",
+    "date": "2026-08-27T22:07:43.784Z",
+    "rules": [
+      {
+        "name": "enforce-verb-noun-naming",
+        "changeType": "fix",
+        "issues": [
+          2168,
+          2169
+        ],
+        "summary": "reach the hook call a concise arrow body IS (closes #2169); defer an overload signature to its implementation (closes #2168)"
+      },
+      {
+        "name": "no-entire-object-hook-deps",
+        "changeType": "fix",
+        "issues": [
+          2170
+        ],
+        "summary": "keep a ref dependency whole (closes #2170)"
+      },
+      {
+        "name": "parallelize-async-operations",
+        "changeType": "fix",
+        "issues": [
+          2167
+        ],
+        "summary": "resolve fs bindings as a scope-aware fixpoint (closes #2167)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.183",
+    "date": "2026-08-27T17:21:40.008Z",
+    "rules": [
+      {
+        "name": "enforce-verb-noun-naming",
+        "changeType": "fix",
+        "issues": [
+          2165
+        ],
+        "summary": "reach the class-METHOD spelling with the React-component carve-out (closes #2165)"
+      },
+      {
+        "name": "parallelize-async-operations",
+        "changeType": "fix",
+        "issues": [
+          2166
+        ],
+        "summary": "barrier awaits that share the filesystem (closes #2166)"
+      }
+    ]
+  },
   {
     "version": "1.20.182",
     "date": "2026-08-27T12:12:45.593Z",