@blumintinc/eslint-plugin-blumint 1.20.52 → 1.20.53

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.52',
+        version: '1.20.53',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/parallelize-async-operations.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parallelizeAsyncOperations = void 0;
 const utils_1 = require("@typescript-eslint/utils");
 const createRule_1 = require("../utils/createRule");
+const ASTHelpers_1 = require("../utils/ASTHelpers");
 // Anchored at the end of the path so multi-part suffixes such as
 // `EventRegistry.integration.test.ts` are recognized while production modules
 // that merely contain the word (`testHelpers.ts`, `latest.ts`, `contest/Thing.ts`)
@@ -334,6 +335,145 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
             }
             return callee.object.name;
         }
+        /**
+         * Matches the `Promise` combinators that take an array of promises and
+         * return a single promise standing in for the whole group. Awaiting one of
+         * them does not consume the member promises: they stay reachable through
+         * whatever names fed the combinator, so a later await mentioning one of
+         * those names is reading a promise the aggregate already owns. Anchored so
+         * only the combinator itself matches, never a user helper whose name merely
+         * contains the word.
+         */
+        const PROMISE_AGGREGATOR_PATTERN = /^(all|allSettled|any|race)$/;
+        /**
+         * Node types that open a new function body. Traversals that ask "does
+         * evaluating this expression suspend the enclosing async function?" must
+         * stop here, because an `await` beyond this boundary belongs to the inner
+         * function and runs only when that function is called.
+         */
+        const FUNCTION_BOUNDARY_TYPES = new Set([
+            utils_1.AST_NODE_TYPES.FunctionDeclaration,
+            utils_1.AST_NODE_TYPES.FunctionExpression,
+            utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
+        ]);
+        /**
+         * Reports whether evaluating this expression suspends the enclosing async
+         * function -- i.e. whether it contains an `await` of its own.
+         *
+         * The traversal deliberately stops at every function boundary: the awaits in
+         * `Promise.all(items.map(async (item) => await store(item)))` belong to the
+         * callback, so the outer expression evaluates straight through to a promise
+         * without ever suspending, and hoisting it is safe.
+         */
+        function containsSuspendingAwait(node) {
+            if (isAwaitExpression(node)) {
+                return true;
+            }
+            if (FUNCTION_BOUNDARY_TYPES.has(node.type)) {
+                return false;
+            }
+            for (const key in node) {
+                if (key === 'parent' || key === 'range' || key === 'loc')
+                    continue;
+                const child = node[key];
+                if (!child || typeof child !== 'object')
+                    continue;
+                if (Array.isArray(child)) {
+                    for (const item of child) {
+                        if (item &&
+                            typeof item === 'object' &&
+                            'type' in item &&
+                            containsSuspendingAwait(item)) {
+                            return true;
+                        }
+                    }
+                }
+                else if ('type' in child && containsSuspendingAwait(child)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+        /**
+         * Follows an identifier back to the array literal a `const` binds to it.
+         *
+         * Only `const` qualifies. A `let`/`var` array can be reassigned between the
+         * declaration and the await, so its literal elements are not a sound
+         * description of what the aggregate actually received, and treating them as
+         * such would suppress reports on genuinely independent operations.
+         */
+        function resolveConstArrayLiteral(identifier) {
+            const variable = ASTHelpers_1.ASTHelpers.findVariableInScope(ASTHelpers_1.ASTHelpers.getScope(context, identifier), identifier.name);
+            if (!variable) {
+                return null;
+            }
+            for (const definition of variable.defs) {
+                const declarator = definition.node;
+                if (declarator.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+                    declarator.parent?.type === utils_1.AST_NODE_TYPES.VariableDeclaration &&
+                    declarator.parent.kind === 'const' &&
+                    declarator.init?.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+                    return declarator.init;
+                }
+            }
+            return null;
+        }
+        /**
+         * Expands an awaited promise aggregate (`await Promise.all(ops)`) to the
+         * names through which its member promises remain reachable afterwards: the
+         * array's own binding plus every element that is a bare identifier, or a
+         * spread of one.
+         *
+         * This is the aliasing channel the plain identifier-set comparison cannot
+         * see. In `await Promise.all(ops); await release({ results: [await
+         * dropped] })` the two awaits share no identifier at all -- one holds
+         * `Promise`/`all`/`ops`, the other `release`/`dropped` -- yet `dropped` is
+         * `ops[0]`, so the release genuinely cannot start before the drop settles.
+         * Elements that are freshly-constructed promises (`assign()`) are omitted
+         * because nothing binds them to a name, so no later await can reference
+         * them. (#1541)
+         */
+        function getAggregatedPromiseNames(awaitExpr) {
+            const names = new Set();
+            const argument = awaitExpr.argument.type === utils_1.AST_NODE_TYPES.ChainExpression
+                ? awaitExpr.argument.expression
+                : awaitExpr.argument;
+            if (argument.type !== utils_1.AST_NODE_TYPES.CallExpression) {
+                return names;
+            }
+            const callee = argument.callee;
+            if (callee.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+                callee.computed ||
+                callee.object.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                callee.object.name !== 'Promise' ||
+                callee.property.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                !PROMISE_AGGREGATOR_PATTERN.test(callee.property.name)) {
+                return names;
+            }
+            const [aggregated] = argument.arguments;
+            if (!aggregated) {
+                return names;
+            }
+            let elements = [];
+            if (aggregated.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+                elements = aggregated.elements;
+            }
+            else if (aggregated.type === utils_1.AST_NODE_TYPES.Identifier) {
+                names.add(aggregated.name);
+                elements = resolveConstArrayLiteral(aggregated)?.elements ?? [];
+            }
+            for (const element of elements) {
+                if (!element)
+                    continue;
+                const value = element.type === utils_1.AST_NODE_TYPES.SpreadElement
+                    ? element.argument
+                    : element;
+                if (value.type === utils_1.AST_NODE_TYPES.Identifier) {
+                    names.add(value.name);
+                }
+            }
+            return names;
+        }
         /**
          * Checks if there are dependencies between await expressions
          */
@@ -486,6 +626,51 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
                     }
                 }
             }
+            // 8. Aggregate-element aliasing barrier. `await Promise.all(ops)` does not
+            // consume the promises in `ops`; they stay reachable by name, so a later
+            // await that mentions one of them -- `await release({ results: [await
+            // dropped] })`, where `dropped` is `ops[0]` -- reads a value the aggregate
+            // is still producing. The two awaits share no identifier at all
+            // (`Promise`/`all`/`ops` versus `release`/`dropped`), so the direct set
+            // comparison above classifies them independent; expanding the aggregate to
+            // its element names restores the link. Promise.all-ing that pair would
+            // start the consumer concurrently with the very operation whose result it
+            // reads. (#1541)
+            for (let i = 1; i < awaitNodes.length; i++) {
+                const currentIds = allIdentifiers[i];
+                if (currentIds.size === 0)
+                    continue;
+                for (let j = 0; j < i; j++) {
+                    const priorExpr = getAwaitExpression(awaitNodes[j]);
+                    if (!priorExpr)
+                        continue;
+                    for (const aggregatedName of getAggregatedPromiseNames(priorExpr)) {
+                        if (currentIds.has(aggregatedName)) {
+                            return true;
+                        }
+                    }
+                }
+            }
+            // 9. Nested-await hoist barrier. The rewrite splices each awaited
+            // expression into a `Promise.all([...])` ARRAY LITERAL, and array elements
+            // evaluate left to right. An element that contains an `await` of its own
+            // suspends the enclosing function mid-literal -- after the earlier
+            // elements' promises have been constructed, but before `Promise.all` has
+            // been called to attach handlers to them. If one of those already-running
+            // promises rejects during the suspension, the function throws at the inner
+            // await and the rejected promise is orphaned into an `unhandledRejection`,
+            // which the Cloud Functions runtime answers by killing the instance, so
+            // the caller receives an opaque crash instead of the real error. A leading
+            // nested await is unsound in a quieter way: it suspends before the later
+            // elements are evaluated, so their operations never start early and the
+            // rewrite buys no parallelism while still reshaping the code. Keep any run
+            // containing such an expression sequential. (#1541)
+            for (const node of awaitNodes) {
+                const awaitExpr = getAwaitExpression(node);
+                if (awaitExpr && containsSuspendingAwait(awaitExpr.argument)) {
+                    return true;
+                }
+            }
             return false;
         }
         /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.52",
+  "version": "1.20.53",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",
@@ -73,6 +73,7 @@
     "@types/eslint": "8.37.0",
     "@types/jest": "29.5.14",
     "@types/node": "22.20.0",
+    "@types/semver": "7.5.8",
     "@typescript-eslint/eslint-plugin": "5.34.0",
     "@typescript-eslint/parser": "5.48.0",
     "chai": "4.5.0",
@@ -103,13 +104,14 @@
     "remark-lint": "9.1.1",
     "remark-preset-lint-recommended": "6.1.2",
     "semantic-release": "25.0.2",
+    "semver": "7.7.1",
     "ts-jest": "29.2.6",
     "ts-node": "10.9.1",
     "tsx": "4.19.4",
     "typescript": "5.0.3"
   },
   "peerDependencies": {
-    "eslint": ">=7"
+    "eslint": ">=7 <9"
   },
   "engines": {
     "node": ">=22.0.0"

package/release-manifest.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "1.20.53",
+    "date": "2026-08-01T00:55:57.763Z",
+    "rules": [
+      {
+        "name": "parallelize-async-operations",
+        "changeType": "fix",
+        "issues": [
+          1541
+        ],
+        "summary": "stop hoisting dependent and await-containing operations (closes #1541)"
+      }
+    ]
+  },
   {
     "version": "1.20.52",
     "date": "2026-07-31T19:23:46.059Z",