@blumintinc/eslint-plugin-blumint 1.21.10 → 1.21.12

package/lib/index.js

@@ -224,7 +224,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.21.10',
+        version: '1.21.12',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/global-const-style.js

@@ -350,9 +350,14 @@ const storageContainerOf = (node) => {
  * the file compiling is not.
  *
  * A reference STORED INTO a composite literal is followed through that
- * container, since storing does not copy — see `storageContainerOf`. A
- * destructuring id extracts a member rather than the whole, so it is not an
- * alias here.
+ * container, since storing does not copy — see `storageContainerOf`.
+ *
+ * A destructuring id is accepted in BOTH spellings. It does not name the whole
+ * value, but every binding it introduces is typed from that value, and a rest
+ * element is itself a fresh container the assertion narrows: `const [, ...rest]
+ * = ITEMS` gives `rest` the frozen element type, so `rest.push(4)` is TS2345
+ * for an input that compiled. Admitting only the object spelling gave the same
+ * construct opposite verdicts (#2336).
  */
 const aliasDeclaratorOf = (identifier) => {
     // Ascends strictly, so reaching a node with no parent terminates the walk.
@@ -362,7 +367,8 @@ const aliasDeclaratorOf = (identifier) => {
         if (declarator?.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
             declarator.init === value &&
             (declarator.id.type === utils_1.AST_NODE_TYPES.Identifier ||
-                declarator.id.type === utils_1.AST_NODE_TYPES.ObjectPattern)) {
+                declarator.id.type === utils_1.AST_NODE_TYPES.ObjectPattern ||
+                declarator.id.type === utils_1.AST_NODE_TYPES.ArrayPattern)) {
             return declarator;
         }
         const container = storageContainerOf(value);
@@ -573,6 +579,144 @@ const isInferenceSite = (identifier) => {
         value = outermostValueOf(container);
     }
 };
+/**
+ * Array methods that hand an ELEMENT of the receiver to a callback, mapped to
+ * the parameter position that element arrives in.
+ *
+ * The position is carried per method rather than assumed to be the first,
+ * because `reduce`/`reduceRight` pass the accumulator first and the element
+ * second: a walk keyed on the first parameter would enrol a binding typed from
+ * the seed value and miss the one typed from the constant (Issue #2338).
+ *
+ * Only the element parameter is enrolled. The index beside it is a `number`
+ * whatever the receiver holds, so nothing the assertion changes reaches it.
+ */
+const ELEMENT_PARAMETER_INDEX_BY_METHOD = new Map([
+    ['forEach', 0],
+    ['map', 0],
+    ['filter', 0],
+    ['find', 0],
+    ['findIndex', 0],
+    ['findLast', 0],
+    ['findLastIndex', 0],
+    ['some', 0],
+    ['every', 0],
+    ['flatMap', 0],
+    ['reduce', 1],
+    ['reduceRight', 1],
+]);
+/**
+ * The `Object.values(X)` / `Object.entries(X)` call this value feeds — a fresh
+ * array whose ELEMENTS are the constant's own property values, so freezing the
+ * constant retypes them exactly as it retypes an array's elements.
+ *
+ * It is not a copy in `copyExpressionOf`'s sense: the result has a different
+ * shape from the argument, so a write to the array itself says nothing about
+ * the constant. It is resolved here instead, where only the ITERATION question
+ * is asked and a decline still requires a write through the element binding.
+ *
+ * `Object.keys` is absent because its result is `string[]` whatever the
+ * argument's type, so the assertion cannot reach a binding taken from it.
+ */
+const elementProjectionCallOf = (node) => {
+    const parent = node.parent;
+    if (parent?.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+        parent.arguments[0] !== node) {
+        return null;
+    }
+    return isNamespacedCallee(parent.callee, 'Object', 'values') ||
+        isNamespacedCallee(parent.callee, 'Object', 'entries')
+        ? parent
+        : null;
+};
+/**
+ * The bindings a construct that ITERATES `iterable` introduces for its
+ * elements: the head of a `for…of` over it, or the parameter an array method
+ * hands each element to.
+ *
+ * A `for…of` head is accepted in all three binding spellings, on the same terms
+ * as `aliasDeclaratorOf` accepts all three declarator spellings — every name a
+ * pattern introduces is typed from the value it destructures. A head that is
+ * not a declaration assigns into a binding declared elsewhere, whose type the
+ * constant never gave it, so it introduces nothing to enrol. `for await` is the
+ * same node with `await` set and binds its element the same way, so the flag is
+ * not screened.
+ *
+ * A callback parameter is reached only through a function LITERAL: a callback
+ * passed by name is declared elsewhere, where its parameter carries whatever
+ * type that declaration gives it rather than one read off the constant.
+ */
+const elementBindingsOfIteration = (iterable, declaredVariablesOf) => {
+    // The member path is resolved first because the iterated expression is
+    // routinely a PROPERTY of the constant (`for (const x of CONFIG.list)`),
+    // which the alias walk refuses precisely because it arrives through a member
+    // access — the property is frozen with the object that holds it.
+    const path = accessPathOf(iterable);
+    const value = outermostValueOf(path ?? iterable);
+    const parent = value.parent;
+    if (!parent) {
+        return [];
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.ForOfStatement &&
+        parent.right === value &&
+        parent.left.type === utils_1.AST_NODE_TYPES.VariableDeclaration) {
+        return declaredVariablesOf(parent.left);
+    }
+    if (path === null) {
+        return [];
+    }
+    const method = accessedPropertyName(path);
+    const elementIndex = method === null ? undefined : ELEMENT_PARAMETER_INDEX_BY_METHOD.get(method);
+    if (elementIndex === undefined ||
+        parent.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+        parent.callee !== value) {
+        return [];
+    }
+    const callback = parent.arguments[0];
+    if (!callback || !isFunctionValue(callback)) {
+        return [];
+    }
+    const element = callback.params[elementIndex];
+    if (!element) {
+        return [];
+    }
+    // The scope manager answers for the WHOLE function — every parameter, and a
+    // function expression's own name — so the element parameter's bindings are
+    // picked out by the span they are declared in. Taking the function's list
+    // whole would enrol the accumulator of a `reduce`, which is typed from the
+    // seed value rather than from the constant.
+    return declaredVariablesOf(callback).filter((variable) => variable.defs.some((def) => def.name.range[0] >= element.range[0] &&
+        def.name.range[1] <= element.range[1]));
+};
+/**
+ * The bindings ITERATING this reference introduces, directly or through a value
+ * derived from it that keeps its element types.
+ *
+ * Such a binding is typed from the constant exactly as a destructured copy is —
+ * it carries the ELEMENT type rather than the whole value — so a write through
+ * it breaks on the assertion the same way a write through an alias does:
+ * `for (const item of ITEMS) { item.label = 'b'; }` is TS2540 once `ITEMS` is
+ * frozen, for an input that compiled (Issue #2338). Enrolling the binding is
+ * therefore the whole remedy; the walk's existing write, mutating-method and
+ * inference checks answer the question on it, which is what keeps a loop that
+ * only READS its element fixable.
+ *
+ * The derivations are followed because the receiver of the iteration is
+ * routinely one step removed from the constant (`[...ITEMS].forEach(…)`,
+ * `ITEMS.filter(Boolean).forEach(…)`, `Object.values(CONFIG).forEach(…)`): each
+ * builds a fresh OUTER value whose elements are still the frozen ones, so the
+ * element binding breaks identically. One derivation step is followed, matching
+ * the depth the alias walk already follows a copy to.
+ */
+const iterationBindingsOf = (identifier, declaredVariablesOf) => {
+    const value = outermostValueOf(identifier);
+    const iterables = [
+        value,
+        copyExpressionOf(value),
+        elementProjectionCallOf(value),
+    ];
+    return iterables.flatMap((iterable) => iterable ? elementBindingsOfIteration(iterable, declaredVariablesOf) : []);
+};
 /**
  * Whether anything in the file stops this binding taking `as const`, under its
  * own name or through an alias of it.
@@ -604,6 +748,14 @@ const isInferenceSite = (identifier) => {
  * the one value — and `visited` keeps a chain that leads back on itself, which
  * a redeclared `var` can build, from looping forever.
  *
+ * Iteration is followed on the same reasoning, keyed on the ELEMENT rather than
+ * the whole value: a `for…of` head and an iteration callback's parameter are
+ * second names for the constant's contents, so `for (const item of ITEMS) {
+ * item.label = 'b'; }` is TS2540 once `ITEMS` is frozen while `ITEMS`'s own
+ * references show nothing but a read (Issue #2338). Enrolling the binding is
+ * all it takes — the checks above then decide, so a loop that only reads its
+ * element keeps the assertion.
+ *
  * The declaring KEYWORD is deliberately not screened. `as const` types the
  * value `readonly`, and a binding takes its declared type from its initializer,
  * so `let other = ITEMS; other.push(3);` is the same TS2339 as the `const`
@@ -645,10 +797,14 @@ const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
                 : path === null
                     ? aliasDeclaratorOf(reference.identifier)
                     : null;
-            if (!declarator) {
-                continue;
-            }
-            for (const alias of declaredVariablesOf(declarator)) {
+            // A binding introduced by ITERATING the constant is enrolled beside the
+            // aliases: it names the constant's CONTENTS, which the assertion freezes
+            // with the constant itself — see `iterationBindingsOf`.
+            const derived = [
+                ...(declarator ? declaredVariablesOf(declarator) : []),
+                ...iterationBindingsOf(reference.identifier, declaredVariablesOf),
+            ];
+            for (const alias of derived) {
                 if (!visited.has(alias)) {
                     visited.add(alias);
                     pending.push(alias);

package/lib/rules/memo-nested-react-components.js

@@ -348,9 +348,10 @@ const isInsideFunction = (node) => {
 };
 const isPascalCaseName = (name) => /^[A-Z]/.test(name);
 /**
- * Prop names whose value a parent MOUNTS rather than calls. Kept identical to
- * the `JSXAttribute` visitor's own test so the two paths cannot disagree about
- * what a component-type prop is — the disagreement between them is #2334.
+ * Prop names whose value a parent MOUNTS rather than calls. The `JSXAttribute`
+ * visitor and the binding-side classifier both read it, so the two paths cannot
+ * disagree about what a component-type prop is — the disagreement between them
+ * is #2334, and the duplicated literal that would let it return is #2337.
  */
 const COMPONENT_PROP_SUFFIX = /(Wrapper|Component|Template|Header|Footer)$/;
 const isComponentPropName = (name) => isPascalCaseName(name) && COMPONENT_PROP_SUFFIX.test(name);
@@ -410,13 +411,16 @@ const consumptionOfReference = (identifier, reactImports) => {
  * fragment. Falling back to the name there keeps the rule's reach while letting
  * evidence override the guess wherever evidence exists.
  */
-const consumptionOfBinding = (node, context, reactImports) => {
-    const declarator = parentBeyondChain(node);
-    if (declarator?.type !== utils_1.AST_NODE_TYPES.VariableDeclarator) {
-        return 'unknown';
-    }
+const consumptionOfDeclaration = (declaration, id, context, reactImports) => {
+    // `getDeclaredVariables` on a FunctionDeclaration yields its PARAMETERS
+    // alongside the function name, and a parameter handed to a non-component prop
+    // votes `callback` for a binding it says nothing about. Keep only the
+    // variable this declaration's own id introduces.
+    const declared = context
+        .getDeclaredVariables(declaration)
+        .filter((variable) => variable.defs.some((def) => def.name === id));
     let sawCallback = false;
-    for (const variable of context.getDeclaredVariables(declarator)) {
+    for (const variable of declared) {
         for (const reference of variable.references) {
             const consumption = consumptionOfReference(reference.identifier, reactImports);
             // A single mounting use settles it: the identity churn happens there
@@ -431,6 +435,14 @@ const consumptionOfBinding = (node, context, reactImports) => {
     }
     return sawCallback ? 'callback' : 'unknown';
 };
+const consumptionOfBinding = (node, context, reactImports) => {
+    const declarator = parentBeyondChain(node);
+    if (declarator?.type !== utils_1.AST_NODE_TYPES.VariableDeclarator ||
+        declarator.id.type !== utils_1.AST_NODE_TYPES.Identifier) {
+        return 'unknown';
+    }
+    return consumptionOfDeclaration(declarator, declarator.id, context, reactImports);
+};
 /**
  * The values a container hands to its caller: object property values and array
  * elements. Mirrors `containedValues` in the paired `require-memo` rule (#1919),
@@ -841,8 +853,10 @@ See: https://react.dev/learn/your-first-component#nesting-and-organizing-compone
                     return;
                 if (node.id.type !== utils_1.AST_NODE_TYPES.Identifier)
                     return;
-                // Only check if name starts with uppercase (convention for components)
-                if (!isPascalCaseName(node.id.name))
+                const vdConsumption = consumptionOfDeclaration(node, node.id, context, reactImports);
+                if (vdConsumption === 'callback')
+                    return;
+                if (vdConsumption === 'unknown' && !isPascalCaseName(node.id.name))
                     return;
                 if (!isInsideFunction(node))
                     return;
@@ -866,7 +880,12 @@ See: https://react.dev/learn/your-first-component#nesting-and-organizing-compone
                 reportNestedComponentViolation(node, node.id.name, 'a render body');
             },
             FunctionDeclaration(node) {
-                if (!node.id || !isPascalCaseName(node.id.name))
+                if (!node.id)
+                    return;
+                const fdConsumption = consumptionOfDeclaration(node, node.id, context, reactImports);
+                if (fdConsumption === 'callback')
+                    return;
+                if (fdConsumption === 'unknown' && !isPascalCaseName(node.id.name))
                     return;
                 if (!isInsideFunction(node))
                     return;
@@ -883,12 +902,15 @@ See: https://react.dev/learn/your-first-component#nesting-and-organizing-compone
                 if (node.name.type !== utils_1.AST_NODE_TYPES.JSXIdentifier)
                     return;
                 const attrName = node.name.name;
-                // Check if it's a component-type prop. A non-PascalCase prop (e.g.
-                // renderHeader) is a render callback used with a render={...} prop, not
-                // a component—skip it, mirroring the binding-side carve-out above. The
-                // suffix alone is not enough: it matches the tail of renderHeader.
-                if (!isPascalCaseName(attrName) ||
-                    !/(Wrapper|Component|Template|Header|Footer)$/.test(attrName)) {
+                // A non-PascalCase prop (e.g. renderHeader) is a render callback used
+                // with a render={...} prop, not a component. The suffix alone is not
+                // enough: it matches the tail of renderHeader.
+                //
+                // Read through the shared helper rather than a second copy of the
+                // pattern, so the binding side and this one cannot answer differently
+                // about what a component-type prop is — the disagreement between the
+                // two paths is #2334, and a duplicated literal is what lets it return.
+                if (!isComponentPropName(attrName)) {
                     return;
                 }
                 if (!node.value ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.21.10",
+  "version": "1.21.12",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,40 @@
 [
+  {
+    "version": "1.21.12",
+    "date": "2026-09-05T18:30:20.453Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2338
+        ],
+        "summary": "withhold `as const` when a binding introduced by iterating the constant is written (closes #2338)"
+      }
+    ]
+  },
+  {
+    "version": "1.21.11",
+    "date": "2026-09-05T11:06:01.167Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2336
+        ],
+        "summary": "follow the array spelling of a destructured copy, and the rest element that needs no copy (closes #2336)"
+      },
+      {
+        "name": "memo-nested-react-components",
+        "changeType": "fix",
+        "issues": [
+          2335
+        ],
+        "summary": "decide by the use site in the two non-hook visitors too (closes #2335)"
+      }
+    ]
+  },
   {
     "version": "1.21.10",
     "date": "2026-09-05T09:28:38.523Z",