@blumintinc/eslint-plugin-blumint 1.21.11 → 1.21.13

package/lib/index.js

@@ -224,7 +224,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.21.11',
+        version: '1.21.13',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/global-const-style.js

@@ -579,6 +579,216 @@ const isInferenceSite = (identifier) => {
         value = outermostValueOf(container);
     }
 };
+/**
+ * Array methods that hand an ELEMENT of the receiver to a callback, mapped to
+ * the parameter position that element arrives in.
+ *
+ * The position is carried per method rather than assumed to be the first,
+ * because `reduce`/`reduceRight` pass the accumulator first and the element
+ * second: a walk keyed on the first parameter would enrol a binding typed from
+ * the seed value and miss the one typed from the constant (Issue #2338).
+ *
+ * The INDEX parameter is absent from every map here, and from nothing else:
+ * it is a `number` whatever the receiver holds, so nothing the assertion
+ * changes reaches it. The parameter AFTER the index is a different matter —
+ * see `ARRAY_PARAMETER_INDEX_BY_METHOD`.
+ */
+const ELEMENT_PARAMETER_INDEX_BY_METHOD = new Map([
+    ['forEach', 0],
+    ['map', 0],
+    ['filter', 0],
+    ['find', 0],
+    ['findIndex', 0],
+    ['findLast', 0],
+    ['findLastIndex', 0],
+    ['some', 0],
+    ['every', 0],
+    ['flatMap', 0],
+    ['reduce', 1],
+    ['reduceRight', 1],
+]);
+/**
+ * The same methods, mapped to the position the RECEIVER ARRAY arrives in.
+ *
+ * That parameter is a second name for the iterated value itself, so a mutating
+ * call through it writes to the constant:
+ * `ITEMS.forEach((item, index, arr) => { arr.push(2); })` is TS2339 once
+ * `ITEMS` is frozen, for an input that compiled — the identical call written
+ * directly as `ITEMS.push(2)` is one the rule already declines for, so only the
+ * handed-node spelling escapes it (Issue #2339).
+ *
+ * The position is carried apart from the element's because the two are enrolled
+ * on different terms rather than because they differ by one: an element keeps
+ * the constant's type through every derivation the iteration walk follows,
+ * while the receiver is the constant only when the iteration reads the
+ * constant's own value or member path — see `iterationBindingsOf`.
+ * `reduce`/`reduceRight` push it to fourth, having spent the first position on
+ * the accumulator.
+ *
+ * `flatMap` is listed even though its lib signature declares the parameter
+ * `T[]` where every sibling declares it `readonly T[]` — measured against
+ * `lib.es2020`, so a mutating METHOD through it survives the assertion. Its
+ * ELEMENTS are frozen regardless, so `arr[0].n = 2` inside a `flatMap` callback
+ * is TS2540 for an input that compiled, and the walk's write check reaches it
+ * only once the parameter is enrolled.
+ */
+const ARRAY_PARAMETER_INDEX_BY_METHOD = new Map([
+    ['forEach', 2],
+    ['map', 2],
+    ['filter', 2],
+    ['find', 2],
+    ['findIndex', 2],
+    ['findLast', 2],
+    ['findLastIndex', 2],
+    ['some', 2],
+    ['every', 2],
+    ['flatMap', 2],
+    ['reduce', 3],
+    ['reduceRight', 3],
+]);
+/**
+ * The `Object.values(X)` / `Object.entries(X)` call this value feeds — a fresh
+ * array whose ELEMENTS are the constant's own property values, so freezing the
+ * constant retypes them exactly as it retypes an array's elements.
+ *
+ * It is not a copy in `copyExpressionOf`'s sense: the result has a different
+ * shape from the argument, so a write to the array itself says nothing about
+ * the constant. It is resolved here instead, where only the ITERATION question
+ * is asked and a decline still requires a write through the element binding.
+ *
+ * `Object.keys` is absent because its result is `string[]` whatever the
+ * argument's type, so the assertion cannot reach a binding taken from it.
+ */
+const elementProjectionCallOf = (node) => {
+    const parent = node.parent;
+    if (parent?.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+        parent.arguments[0] !== node) {
+        return null;
+    }
+    return isNamespacedCallee(parent.callee, 'Object', 'values') ||
+        isNamespacedCallee(parent.callee, 'Object', 'entries')
+        ? parent
+        : null;
+};
+/**
+ * The bindings a construct that ITERATES `iterable` introduces: the head of a
+ * `for…of` over it, the parameter an array method hands each element to, and —
+ * when the iterated expression is the constant itself — the parameter that
+ * method hands the RECEIVER ARRAY to.
+ *
+ * A `for…of` head is accepted in all three binding spellings, on the same terms
+ * as `aliasDeclaratorOf` accepts all three declarator spellings — every name a
+ * pattern introduces is typed from the value it destructures. A head that is
+ * not a declaration assigns into a binding declared elsewhere, whose type the
+ * constant never gave it, so it introduces nothing to enrol. `for await` is the
+ * same node with `await` set and binds its element the same way, so the flag is
+ * not screened.
+ *
+ * A callback parameter is reached only through a function LITERAL: a callback
+ * passed by name is declared elsewhere, where its parameter carries whatever
+ * type that declaration gives it rather than one read off the constant.
+ *
+ * `iteratesConstantValue` says whether `iterable` is the constant's own value
+ * or member path rather than something derived from it. It gates the receiver
+ * ARRAY parameter alone: the element parameter is typed from the constant
+ * either way, while the array parameter names the constant only in the first
+ * case — see `iterationBindingsOf`.
+ */
+const bindingsOfIterationOver = (iterable, declaredVariablesOf, iteratesConstantValue) => {
+    // The member path is resolved first because the iterated expression is
+    // routinely a PROPERTY of the constant (`for (const x of CONFIG.list)`),
+    // which the alias walk refuses precisely because it arrives through a member
+    // access — the property is frozen with the object that holds it.
+    const path = accessPathOf(iterable);
+    const value = outermostValueOf(path ?? iterable);
+    const parent = value.parent;
+    if (!parent) {
+        return [];
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.ForOfStatement &&
+        parent.right === value &&
+        parent.left.type === utils_1.AST_NODE_TYPES.VariableDeclaration) {
+        return declaredVariablesOf(parent.left);
+    }
+    if (path === null) {
+        return [];
+    }
+    const method = accessedPropertyName(path);
+    if (method === null) {
+        return [];
+    }
+    const elementIndex = ELEMENT_PARAMETER_INDEX_BY_METHOD.get(method);
+    if (elementIndex === undefined ||
+        parent.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+        parent.callee !== value) {
+        return [];
+    }
+    const callback = parent.arguments[0];
+    if (!callback || !isFunctionValue(callback)) {
+        return [];
+    }
+    const arrayIndex = iteratesConstantValue
+        ? ARRAY_PARAMETER_INDEX_BY_METHOD.get(method)
+        : undefined;
+    // A callback routinely declares fewer parameters than the method passes, so
+    // each position is taken only where the signature actually spells it.
+    const enrolled = [
+        callback.params[elementIndex],
+        arrayIndex === undefined ? undefined : callback.params[arrayIndex],
+    ].filter((param) => param !== undefined);
+    if (enrolled.length === 0) {
+        return [];
+    }
+    // The scope manager answers for the WHOLE function — every parameter, and a
+    // function expression's own name — so the enrolled parameters' bindings are
+    // picked out by the spans they are declared in. Taking the function's list
+    // whole would enrol the accumulator of a `reduce`, typed from the seed value
+    // rather than from the constant, and the index, which the assertion cannot
+    // reach.
+    return declaredVariablesOf(callback).filter((variable) => variable.defs.some((def) => enrolled.some((param) => def.name.range[0] >= param.range[0] &&
+        def.name.range[1] <= param.range[1])));
+};
+/**
+ * The bindings ITERATING this reference introduces, directly or through a value
+ * derived from it that keeps its element types.
+ *
+ * Such a binding is typed from the constant exactly as a destructured copy is —
+ * it carries the ELEMENT type, or for the receiver parameter the whole value —
+ * so a write through it breaks on the assertion as a write through an alias
+ * does:
+ * `for (const item of ITEMS) { item.label = 'b'; }` is TS2540 once `ITEMS` is
+ * frozen, for an input that compiled (Issue #2338). Enrolling the binding is
+ * therefore the whole remedy; the walk's existing write, mutating-method and
+ * inference checks answer the question on it, which is what keeps a loop that
+ * only READS its element fixable.
+ *
+ * The derivations are followed because the receiver of the iteration is
+ * routinely one step removed from the constant (`[...ITEMS].forEach(…)`,
+ * `ITEMS.filter(Boolean).forEach(…)`, `Object.values(CONFIG).forEach(…)`): each
+ * builds a fresh OUTER value whose elements are still the frozen ones, so the
+ * element binding breaks identically. One derivation step is followed, matching
+ * the depth the alias walk already follows a copy to.
+ *
+ * The receiver ARRAY parameter is enrolled for the constant's own value or
+ * member path ALONE, which is the one iterable of the three that hands the
+ * callback the constant itself. A derivation hands it the fresh outer value it
+ * built, and mutating that is no readonly violation:
+ * `[...ITEMS].forEach((item, index, arr) => { arr.push(3); })` does break after
+ * the fix, but as TS2345 — the spread narrows the element type, so `3` is not
+ * assignable — which belongs to the literal-narrowing family filed as #2330 and
+ * needs the type checker. Enrolling it here would withhold the assertion for a
+ * reason this arm cannot justify, so it is an over-decline (Issue #2339).
+ */
+const iterationBindingsOf = (identifier, declaredVariablesOf) => {
+    const value = outermostValueOf(identifier);
+    const derivations = [copyExpressionOf(value), elementProjectionCallOf(value)];
+    return [
+        ...bindingsOfIterationOver(value, declaredVariablesOf, true),
+        ...derivations.flatMap((iterable) => iterable
+            ? bindingsOfIterationOver(iterable, declaredVariablesOf, false)
+            : []),
+    ];
+};
 /**
  * Whether anything in the file stops this binding taking `as const`, under its
  * own name or through an alias of it.
@@ -610,6 +820,17 @@ const isInferenceSite = (identifier) => {
  * the one value — and `visited` keeps a chain that leads back on itself, which
  * a redeclared `var` can build, from looping forever.
  *
+ * Iteration is followed on the same reasoning, keyed on what the construct
+ * HANDS its body: a `for…of` head and an iteration callback's element parameter
+ * are second names for the constant's contents, so `for (const item of ITEMS) {
+ * item.label = 'b'; }` is TS2540 once `ITEMS` is frozen while `ITEMS`'s own
+ * references show nothing but a read (Issue #2338); the parameter after the
+ * index is a second name for the constant ITSELF, so `arr.push(2)` inside the
+ * callback is the TS2339 the rule already declines for when the same call is
+ * written directly (Issue #2339). Enrolling the binding is all it takes — the
+ * checks above then decide, so a callback that only reads what it is handed
+ * keeps the assertion.
+ *
  * The declaring KEYWORD is deliberately not screened. `as const` types the
  * value `readonly`, and a binding takes its declared type from its initializer,
  * so `let other = ITEMS; other.push(3);` is the same TS2339 as the `const`
@@ -651,10 +872,14 @@ const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
                 : path === null
                     ? aliasDeclaratorOf(reference.identifier)
                     : null;
-            if (!declarator) {
-                continue;
-            }
-            for (const alias of declaredVariablesOf(declarator)) {
+            // A binding introduced by ITERATING the constant is enrolled beside the
+            // aliases: it names the constant's CONTENTS, which the assertion freezes
+            // with the constant itself — see `iterationBindingsOf`.
+            const derived = [
+                ...(declarator ? declaredVariablesOf(declarator) : []),
+                ...iterationBindingsOf(reference.identifier, declaredVariablesOf),
+            ];
+            for (const alias of derived) {
                 if (!visited.has(alias)) {
                     visited.add(alias);
                     pending.push(alias);

package/lib/rules/memo-nested-react-components.js

@@ -348,9 +348,10 @@ const isInsideFunction = (node) => {
 };
 const isPascalCaseName = (name) => /^[A-Z]/.test(name);
 /**
- * Prop names whose value a parent MOUNTS rather than calls. Kept identical to
- * the `JSXAttribute` visitor's own test so the two paths cannot disagree about
- * what a component-type prop is — the disagreement between them is #2334.
+ * Prop names whose value a parent MOUNTS rather than calls. The `JSXAttribute`
+ * visitor and the binding-side classifier both read it, so the two paths cannot
+ * disagree about what a component-type prop is — the disagreement between them
+ * is #2334, and the duplicated literal that would let it return is #2337.
  */
 const COMPONENT_PROP_SUFFIX = /(Wrapper|Component|Template|Header|Footer)$/;
 const isComponentPropName = (name) => isPascalCaseName(name) && COMPONENT_PROP_SUFFIX.test(name);
@@ -901,12 +902,15 @@ See: https://react.dev/learn/your-first-component#nesting-and-organizing-compone
                 if (node.name.type !== utils_1.AST_NODE_TYPES.JSXIdentifier)
                     return;
                 const attrName = node.name.name;
-                // Check if it's a component-type prop. A non-PascalCase prop (e.g.
-                // renderHeader) is a render callback used with a render={...} prop, not
-                // a component—skip it, mirroring the binding-side carve-out above. The
-                // suffix alone is not enough: it matches the tail of renderHeader.
-                if (!isPascalCaseName(attrName) ||
-                    !/(Wrapper|Component|Template|Header|Footer)$/.test(attrName)) {
+                // A non-PascalCase prop (e.g. renderHeader) is a render callback used
+                // with a render={...} prop, not a component. The suffix alone is not
+                // enough: it matches the tail of renderHeader.
+                //
+                // Read through the shared helper rather than a second copy of the
+                // pattern, so the binding side and this one cannot answer differently
+                // about what a component-type prop is — the disagreement between the
+                // two paths is #2334, and a duplicated literal is what lets it return.
+                if (!isComponentPropName(attrName)) {
                     return;
                 }
                 if (!node.value ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.21.11",
+  "version": "1.21.13",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,32 @@
 [
+  {
+    "version": "1.21.13",
+    "date": "2026-09-05T22:39:56.997Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2339
+        ],
+        "summary": "enrol the receiver array parameter of an iteration over the constant (closes #2339)"
+      }
+    ]
+  },
+  {
+    "version": "1.21.12",
+    "date": "2026-09-05T18:30:20.453Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2338
+        ],
+        "summary": "withhold `as const` when a binding introduced by iterating the constant is written (closes #2338)"
+      }
+    ]
+  },
   {
     "version": "1.21.11",
     "date": "2026-09-05T11:06:01.167Z",