@blumintinc/eslint-plugin-blumint 1.21.14 → 1.21.15

package/lib/index.js

@@ -224,7 +224,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.21.14',
+        version: '1.21.15',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-empty-object-check.js

@@ -1404,6 +1404,68 @@ exports.enforceEmptyObjectCheck = (0, createRule_1.createRule)({
             }
             return false;
         }
+        /**
+         * The type the binding behind this value DECLARES, if it declares one.
+         *
+         * Parameters and variables are the two declarations that annotate the
+         * value a guard tests; an import is answered ahead of this by
+         * `tracesToImport`. The annotation has to sit on the BINDING: the one on
+         * `const { config }: Props = load()` describes the container, and reading
+         * it as a verdict on a single property would need exactly the resolution
+         * that failed, so a destructured binding keeps the naming heuristic.
+         */
+        function declaredTypeOf(identifier) {
+            const variable = variableFor(identifier);
+            if (!variable) {
+                return null;
+            }
+            for (const def of variable.defs) {
+                if (def.type !== 'Parameter' && def.type !== 'Variable') {
+                    continue;
+                }
+                if (def.name.typeAnnotation) {
+                    return def.name.typeAnnotation.typeAnnotation;
+                }
+            }
+            return null;
+        }
+        /**
+         * Whether a declared type declares NOTHING.
+         *
+         * An explicit `any` is the checker reporting what the source told it, not
+         * a resolution failure, so it leaves the value in the same position as an
+         * unannotated one and the naming heuristic keeps answering. `unknown` is
+         * excluded from this reading on purpose: `Object.keys` rejects an
+         * `unknown` operand, so the fix the heuristic would attach there does not
+         * typecheck.
+         */
+        function declaresNothing(node) {
+            if (node.type === utils_1.AST_NODE_TYPES.TSUnionType) {
+                return node.types.some(declaresNothing);
+            }
+            return node.type === utils_1.AST_NODE_TYPES.TSAnyKeyword;
+        }
+        /**
+         * Whether a declared type the checker could not resolve nonetheless
+         * SPELLS an index-signature dictionary.
+         *
+         * `Record<K, V>` is an index signature whichever way `K` and `V` resolve,
+         * so the value is a plain data map rather than a class instance and
+         * `Object.keys` measures its emptiness correctly. Reading that from the
+         * source keeps the verdict a complete program gives — `object` — reachable
+         * without one, which is why a union answers yes as soon as one member
+         * spells it, mirroring `isObjectLikeType`. A reference the source does not
+         * pin this way, `Readonly<NextResponse>` among them, carries no such
+         * guarantee.
+         */
+        function spellsDictionary(node) {
+            if (node.type === utils_1.AST_NODE_TYPES.TSUnionType) {
+                return node.types.some(spellsDictionary);
+            }
+            return (node.type === utils_1.AST_NODE_TYPES.TSTypeReference &&
+                node.typeName.type === utils_1.AST_NODE_TYPES.Identifier &&
+                node.typeName.name === 'Record');
+        }
         function isLikelyObject(identifier) {
             if (checker && parserServices?.esTreeNodeToTSNodeMap) {
                 try {
@@ -1424,13 +1486,39 @@ exports.enforceEmptyObjectCheck = (0, createRule_1.createRule)({
                      * absence of evidence became evidence the value can be `{}`.
                      *
                      * The heuristic is still the right answer for a value with no
-                     * declaration to resolve — removing it outright silences 52 of this
-                     * rule's own 92 fixtures — so only the unresolved-IMPORT case is
-                     * carved out (#2252).
+                     * declaration to resolve — removing it outright silences 56 of this
+                     * rule's own 108 fixtures — so the fall-through is carved out only
+                     * where evidence EXISTS and went unread: a value from an unresolved
+                     * IMPORT (#2252), and a binding that DECLARES a type the checker
+                     * could not resolve (#2344). An unresolvable annotation means the
+                     * checker could not look, not that the value is loosely typed:
+                     * `response: Readonly<NextResponse>` read off its name alone
+                     * reported a class instance, whose state lives behind prototype
+                     * accessors, so the prescribed `Object.keys` clause holds for every
+                     * valid value and inverts the guard it was meant to harden.
+                     *
+                     * The carve-out costs reach, and the cost is measured rather than
+                     * assumed: across the consumer's 14,059 tracked sources it drops 8
+                     * reports, and re-running each under a real `ts.Program` — the
+                     * verdict this arm exists to preserve — agrees with 6 of them. The
+                     * remaining 2 annotate an all-optional imported type
+                     * (`Record<string, string[]>` behind a local alias, and an
+                     * `algoliasearch-helper` parameter bag), which a resolved program
+                     * calls `object` and reports. Nothing at the annotation site
+                     * separates those from `Readonly<NextResponse>`: both are bare
+                     * references into a module this program did not load, so recovering
+                     * them needs the cross-file resolution whose absence defines this
+                     * branch. Two silent true positives is the accepted price of six
+                     * guard inversions, because a fix that rewrites correct code costs
+                     * more than one the rule declines to make.
                      */
                     if (tracesToImport(identifier)) {
                         return false;
                     }
+                    const declared = declaredTypeOf(identifier);
+                    if (declared && !declaresNothing(declared)) {
+                        return spellsDictionary(declared);
+                    }
                 }
                 catch {
                     // TypeScript parser services can throw when AST-to-TS node mapping fails; fall back to naming heuristic so linting does not crash.

package/lib/rules/enforce-memoize-async.js

@@ -423,6 +423,168 @@ function transactionParticipantsOf(body) {
     }
     return participants;
 }
+/**
+ * Node types that own the statements written inside them. A walk bounded by
+ * them answers about what the method DOES rather than about what it merely
+ * defines: a `try`/`finally` written inside a callback is that callback's
+ * acquire/release pair, and a field written inside one is written on whatever
+ * schedule the callback runs on. The decorator caches the method's own promise,
+ * so only the method's own steps bear on whether caching is safe.
+ */
+const OWN_STEP_BOUNDARIES = new Set([
+    utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
+    utils_1.AST_NODE_TYPES.FunctionDeclaration,
+    utils_1.AST_NODE_TYPES.FunctionExpression,
+]);
+/**
+ * Every node the enclosing function executes as its own step, `root` included.
+ * Descent stops at a nested function, which `subtreeOf` enters.
+ */
+function* ownSubtreeOf(root) {
+    yield root;
+    for (const [key, value] of Object.entries(root)) {
+        if (NON_TRAVERSABLE_KEYS.has(key)) {
+            continue;
+        }
+        const children = Array.isArray(value) ? value : [value];
+        for (const child of children) {
+            if (ASTHelpers_1.ASTHelpers.isNode(child) && !OWN_STEP_BOUNDARIES.has(child.type)) {
+                yield* ownSubtreeOf(child);
+            }
+        }
+    }
+}
+/**
+ * Whether the block performs a call as a step of the function that owns it.
+ * A call written inside a function the block only DEFINES — `finally { const
+ * undo = () => release(t); }` — performs nothing, so the bounded walk is what
+ * separates a release from a closure that could perform one elsewhere.
+ */
+function performsCall(block) {
+    for (const node of ownSubtreeOf(block)) {
+        if (node.type === utils_1.AST_NODE_TYPES.CallExpression) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Whether the method owns an acquire/release pair: a `try` among its own steps
+ * whose `finalizer` calls something.
+ *
+ * A `finally` that calls something exists to undo an effect the `try`
+ * performed. What such a method hands back describes one attempt — a grant held
+ * while a queue ticket was outstanding, a read taken while a lock was held —
+ * rather than a fact that stays true once the release has run.
+ *
+ * An empty `finalizer` releases nothing, and one that only writes a local
+ * (`finally { done = true; }`) records that the attempt finished instead of
+ * undoing it, so neither costs the method its report.
+ */
+function releasesInOwnFinalizer(fn) {
+    for (const node of ownSubtreeOf(fn.body)) {
+        if (node.type === utils_1.AST_NODE_TYPES.TryStatement &&
+            node.finalizer &&
+            performsCall(node.finalizer)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * The expression under the wrappers that stand between a value and the access
+ * path it evaluates. `await this.pending`, `this.pending!`, `this.pending as
+ * Ready` and `this?.pending` all read the same field, and a discriminator blind
+ * to one of those spellings would answer "hands back something else" about a
+ * method that hands back exactly what it wrote.
+ */
+function withoutValueWrappers(node) {
+    switch (node.type) {
+        case utils_1.AST_NODE_TYPES.AwaitExpression:
+            return withoutValueWrappers(node.argument);
+        case utils_1.AST_NODE_TYPES.ChainExpression:
+        case utils_1.AST_NODE_TYPES.TSAsExpression:
+        case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+        case utils_1.AST_NODE_TYPES.TSSatisfiesExpression:
+        case utils_1.AST_NODE_TYPES.TSTypeAssertion:
+            return withoutValueWrappers(node.expression);
+        default:
+            return node;
+    }
+}
+/**
+ * The instance field an expression is rooted at: `cached` for `this.cached`,
+ * for `this.cached.value` and for `this.cache[id]` alike.
+ *
+ * Both sides of the discriminator below read the ROOT, so an element write
+ * (`this.cache[id] = …`) and the read that answers it (`return this.cache[id]`)
+ * meet on the same name. A computed root (`this[key]`) names no field
+ * statically and answers nothing, which leaves the method reporting.
+ */
+function rootThisField(node) {
+    const expression = withoutValueWrappers(node);
+    if (expression.type !== utils_1.AST_NODE_TYPES.MemberExpression) {
+        return undefined;
+    }
+    const object = withoutValueWrappers(expression.object);
+    if (object.type !== utils_1.AST_NODE_TYPES.ThisExpression) {
+        return rootThisField(object);
+    }
+    return !expression.computed &&
+        expression.property.type === utils_1.AST_NODE_TYPES.Identifier
+        ? expression.property.name
+        : undefined;
+}
+/**
+ * Whether the expression reads a field the method wrote. Depth and nesting are
+ * immaterial — `this.cached ?? EMPTY` and `() => this.cached` hand the written
+ * state back as plainly as a bare `this.cached` does — because the question is
+ * whether the result carries that state at all, not how it is spelled.
+ */
+function readsWrittenField(node, fields) {
+    for (const descendant of subtreeOf(node)) {
+        const field = rootThisField(descendant);
+        if (field !== undefined && fields.has(field)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Whether the method writes an instance field and hands back a result that
+ * reads none of the fields it wrote.
+ *
+ * Such a method reports on an effect: its result says what THIS call did, so
+ * the next call has to be free to do it again. Writing a field and returning it
+ * is the opposite shape — a hand-rolled cache, which is the very thing
+ * `@Memoize()` replaces — and the field read is what separates the two. A
+ * single returned read is enough, because a method with one cache-hit path
+ * hands back state on that path however many effects its other paths report.
+ *
+ * A method with no value-returning `return` is left alone. Its result is void
+ * by inference rather than by declaration, and #1548 fenced inferred void out
+ * of this rule deliberately: an unannotated body carries no declaration of
+ * intent to honour.
+ */
+function writesFieldItDoesNotReturn(fn) {
+    const written = new Set();
+    const results = [];
+    for (const node of ownSubtreeOf(fn.body)) {
+        if (node.type === utils_1.AST_NODE_TYPES.AssignmentExpression) {
+            const field = rootThisField(node.left);
+            if (field !== undefined) {
+                written.add(field);
+            }
+        }
+        else if (node.type === utils_1.AST_NODE_TYPES.ReturnStatement && node.argument) {
+            results.push(node.argument);
+        }
+    }
+    if (written.size === 0 || results.length === 0) {
+        return false;
+    }
+    return !results.some((result) => readsWrittenField(result, written));
+}
 /** The statically known name of a method, for matching call sites against it. */
 function methodName(node) {
     if (node.computed) {
@@ -664,6 +826,37 @@ exports.enforceMemoizeAsync = (0, createRule_1.createRule)({
                 if (participatesInTransaction(node, node.value)) {
                     return;
                 }
+                // A `finally` that calls something exists to undo an effect the `try`
+                // performed: the method takes a resource, works while it holds it, and
+                // gives it back on the way out. What it hands back describes that one
+                // attempt, not a fact that stays true afterwards. Cached, the
+                // acquire/release pair runs once per instance and every later caller
+                // receives a value computed while a resource the `finally` has since
+                // released was still held — the hazard the resource-handle exemption
+                // above names, seen from the side where the method releases the handle
+                // itself, so nothing of it reaches the return type for a signature-keyed
+                // gate to read. The failure is silent and arrives only under
+                // concurrency, so the fixer would apply it unattended under `--fix`,
+                // and both report and fix are withheld.
+                if (releasesInOwnFinalizer(node.value)) {
+                    return;
+                }
+                // A method that writes an instance field and hands back a result
+                // reading none of the fields it wrote reports on an effect: the result
+                // says what THIS call did — "I reclaimed the slot" — and the next call
+                // has to be free to do it again. Cached, the write happens once per
+                // instance while every later caller reads the first call's verdict
+                // about work that call alone performed, and a caller passing a freshly
+                // built argument object instead accumulates one dead entry per call.
+                //
+                // The read is the discriminator, and it is deliberately the whole test:
+                // a method that writes a field and returns it is a hand-rolled cache,
+                // which is the shape `@Memoize()` exists to replace, so it keeps both
+                // report and fix. Carving out every write to `this` would silence that
+                // shape along with these.
+                if (writesFieldItDoesNotReturn(node.value)) {
+                    return;
+                }
                 const { aliases: memoizeAliases, namespaces: memoizeNamespaces } = memoizeImports();
                 const hasMemoizeImport = memoizeAliases.size > 0 || memoizeNamespaces.size > 0;
                 // Check if method already has @Memoize or @Memoize() decorator

package/lib/rules/global-const-style.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const utils_1 = require("@typescript-eslint/utils");
+const ASTHelpers_1 = require("../utils/ASTHelpers");
 const createRule_1 = require("../utils/createRule");
 const isUpperSnakeCase = (str) => /^[A-Z][A-Z0-9_]*$/.test(str);
 /**
@@ -458,14 +459,123 @@ const isStructuredCloneCallee = (callee) => {
     const value = outermostValueOf(callee);
     return (value.type === utils_1.AST_NODE_TYPES.Identifier && value.name === 'structuredClone');
 };
+const FUNCTION_TYPES = new Set([
+    utils_1.AST_NODE_TYPES.FunctionDeclaration,
+    utils_1.AST_NODE_TYPES.FunctionExpression,
+    utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
+    utils_1.AST_NODE_TYPES.TSDeclareFunction,
+]);
+/**
+ * The identifier an ACCESS PATH is rooted at — `x` for `x`, `x.n`, `x.a[0]`,
+ * `x?.n` and `x!.n` alike — or the expression itself when it is not an access
+ * path at all. Descends through the wrappers `outermostValueOf` climbs out of,
+ * so the root cannot depend on which type syntax annotates a step of the path.
+ */
+const accessPathRootOf = (node) => {
+    let current = unwrapValueWrappers(node);
+    for (;;) {
+        if (current.type === utils_1.AST_NODE_TYPES.ChainExpression) {
+            current = unwrapValueWrappers(current.expression);
+            continue;
+        }
+        if (current.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+            current = unwrapValueWrappers(current.object);
+            continue;
+        }
+        return current;
+    }
+};
+/**
+ * Every value a function hands back: its expression body, or the argument of
+ * each `return` in its block.
+ *
+ * Descent stops at a nested function, whose `return` answers for THAT function
+ * rather than this one — the same boundary `ASTHelpers.hasReturnStatement`
+ * keeps, for the same reason.
+ */
+const returnedValuesOf = (callback) => {
+    if (callback.body.type !== utils_1.AST_NODE_TYPES.BlockStatement) {
+        return [callback.body];
+    }
+    const returned = [];
+    const visit = (node) => {
+        if (FUNCTION_TYPES.has(node.type)) {
+            return;
+        }
+        if (node.type === utils_1.AST_NODE_TYPES.ReturnStatement) {
+            if (node.argument) {
+                returned.push(node.argument);
+            }
+            return;
+        }
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'parent') {
+                continue;
+            }
+            for (const child of Array.isArray(value) ? value : [value]) {
+                if (ASTHelpers_1.ASTHelpers.isNode(child)) {
+                    visit(child);
+                }
+            }
+        }
+    };
+    visit(callback.body);
+    return returned;
+};
+/**
+ * Whether a callback hands back the value it is given at `elementIndex`, or an
+ * access path rooted at it.
+ *
+ * This is what decides whether a `map`-shaped call keeps the receiver's element
+ * type. `(x) => x.n` over a frozen `[{ n: 1 }]` yields `1[]` rather than
+ * `number[]`, so `ns.push(3)` is TS2345 for an input that compiled — and that
+ * mapper is the commonest one written, not the no-op spelling the exclusion was
+ * justified against (Issue #2342). A callback that COMPUTES (`(x) => x * 2`,
+ * `() => Math.random()`) widens, carries nothing of the constant into its
+ * result, and keeps its report.
+ *
+ * The parameter is matched by NAME within the callback's own body, the single
+ * span this question is asked over, because a derivation resolver is handed a
+ * node and no scope. A name a nested function rebinds is unreachable — descent
+ * stops at every function boundary — so the worst a shadow can do is withhold
+ * the assertion from a call that would have kept it, the cheap error of the two.
+ *
+ * ANY returned value rooted at the element is enough. Branches returning
+ * different things widen their union, so the assertion may then reach nothing
+ * and the withhold costs a report; demanding EVERY branch would instead ship a
+ * `--fix` that stops the file compiling.
+ */
+const returnsHandedElement = (callback, elementIndex) => {
+    if (!callback || !isFunctionValue(callback)) {
+        return false;
+    }
+    const parameter = callback.params[elementIndex];
+    if (!parameter || parameter.type !== utils_1.AST_NODE_TYPES.Identifier) {
+        return false;
+    }
+    return returnedValuesOf(callback).some((value) => {
+        const root = accessPathRootOf(value);
+        return (root.type === utils_1.AST_NODE_TYPES.Identifier && root.name === parameter.name);
+    });
+};
+/**
+ * The position the receiver's element arrives in for `Array.from`'s mapper.
+ *
+ * Named because the mapper is the SECOND argument while its element is the
+ * first parameter, so two different zeroes and ones sit beside each other here.
+ */
+const ARRAY_FROM_MAPPER_ELEMENT_INDEX = 0;
 /**
  * Whether a call COPIES the argument at `index` while keeping its type.
  *
  * `Array.from(X)` and `structuredClone(X)` both hand back a fresh, mutable
  * value whose element or property types are the argument's — so freezing the
- * argument narrows the copy exactly as a spread does. `Array.from(X, fn)` is
- * excluded for the same reason `map` is: a mapper retypes the result, so
- * nothing of the constant's type survives into it.
+ * argument narrows the copy exactly as a spread does.
+ *
+ * `Array.from(X, fn)` is decided per CALL for the reason `map` is: a mapper
+ * that hands back the element or a property of it keeps the frozen type, so
+ * `Array.from(ITEMS, (x) => x.n)` is TS2345 on a later `push` for an input that
+ * compiled, while a mapper that COMPUTES widens and carries nothing.
  */
 const isCopyingCall = (call, index) => {
     if (isObjectAssignCallee(call.callee)) {
@@ -478,16 +588,26 @@ const isCopyingCall = (call, index) => {
         return true;
     }
     if (isNamespacedCallee(call.callee, 'Array', 'from')) {
-        return call.arguments.length === 1;
+        return (call.arguments.length === 1 ||
+            returnsHandedElement(call.arguments[1], ARRAY_FROM_MAPPER_ELEMENT_INDEX));
     }
     return false;
 };
 /**
- * Array methods whose result keeps the receiver's ELEMENT type. `map` is
- * absent because its result is typed from the CALLBACK, so the constant's type
- * reaches it only for a callback that returns its argument unchanged — a no-op
- * `map`. Admitting it would withhold the assertion from every derived array
- * anything is computed from, to cover a spelling nobody writes.
+ * The copying array methods whose result is typed from a CALLBACK, mapped to
+ * the position the receiver's element arrives in.
+ *
+ * They are carried apart from `TYPE_PRESERVING_COPY_METHODS` because the
+ * question they raise is answered per CALL rather than per method — see
+ * `returnsHandedElement`.
+ */
+const CALLBACK_TYPED_COPY_METHODS = new Map([['map', 0]]);
+/**
+ * Array methods whose result keeps the receiver's ELEMENT type WHATEVER the
+ * call spells: nothing they are passed can retype what they hand back.
+ *
+ * `map` is carried separately rather than absent — see
+ * `CALLBACK_TYPED_COPY_METHODS`.
  */
 const TYPE_PRESERVING_COPY_METHODS = new Set([
     'concat',
@@ -538,15 +658,66 @@ const copyExpressionOf = (node) => {
         const callee = outermostValueOf(parent);
         // A method REFERENCE (`const take = ITEMS.concat;`) builds nothing, so the
         // copy only exists once the method is actually called.
-        if (method !== null &&
-            TYPE_PRESERVING_COPY_METHODS.has(method) &&
-            callee.parent?.type === utils_1.AST_NODE_TYPES.CallExpression &&
-            callee.parent.callee === callee) {
+        if (method === null ||
+            callee.parent?.type !== utils_1.AST_NODE_TYPES.CallExpression ||
+            callee.parent.callee !== callee) {
+            return null;
+        }
+        if (TYPE_PRESERVING_COPY_METHODS.has(method)) {
             return callee.parent;
         }
+        const elementIndex = CALLBACK_TYPED_COPY_METHODS.get(method);
+        return elementIndex !== undefined &&
+            returnsHandedElement(callee.parent.arguments[0], elementIndex)
+            ? callee.parent
+            : null;
     }
     return null;
 };
+/**
+ * Array methods whose result is an ELEMENT of the receiver rather than a fresh
+ * array over it.
+ *
+ * `as const` freezes in depth, so the element they hand back carries the
+ * assertion exactly as one reached by index does: `const first = ITEMS.at(0)!;
+ * first.n = 2;` is TS2540 once `ITEMS` is frozen, for an input that compiled
+ * (Issue #2341). They belong with the element family rather than with
+ * `TYPE_PRESERVING_COPY_METHODS`, whose members hand back a container.
+ */
+const ELEMENT_RETURNING_METHODS = new Set(['at', 'find', 'findLast']);
+/**
+ * The folds whose result is an element of the receiver, in the SEEDLESS
+ * spelling alone.
+ *
+ * `ITEMS.reduce((a, b) => b)` is typed `T` because the overload without an
+ * initial value takes the first element as the seed. Given a seed the result is
+ * typed from THAT value, which the constant need not have given —
+ * `NUMS.reduce((sum, n) => sum + n, 0)` is `number` however `NUMS` is frozen —
+ * so enrolling the seeded spelling would withhold the assertion for a break
+ * that cannot happen.
+ */
+const ELEMENT_FOLD_METHODS = new Set(['reduce', 'reduceRight']);
+/** The call that hands back an ELEMENT of this value — see the two sets above. */
+const elementExpressionOf = (node) => {
+    const parent = node.parent;
+    if (parent?.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+        parent.object !== node) {
+        return null;
+    }
+    const method = accessedPropertyName(parent);
+    if (method === null) {
+        return null;
+    }
+    const callee = outermostValueOf(parent);
+    const call = callee.parent;
+    if (call?.type !== utils_1.AST_NODE_TYPES.CallExpression || call.callee !== callee) {
+        return null;
+    }
+    return ELEMENT_RETURNING_METHODS.has(method) ||
+        (ELEMENT_FOLD_METHODS.has(method) && call.arguments.length === 1)
+        ? call
+        : null;
+};
 /** Pattern nodes a parameter's binding can be nested inside. */
 const PATTERN_CONTAINERS = new Set([
     utils_1.AST_NODE_TYPES.AssignmentPattern,
@@ -559,12 +730,6 @@ const PATTERN_CONTAINERS = new Set([
     // constructor's params and `constructor(public stage = DEFAULT)` narrows.
     utils_1.AST_NODE_TYPES.TSParameterProperty,
 ]);
-const FUNCTION_TYPES = new Set([
-    utils_1.AST_NODE_TYPES.FunctionDeclaration,
-    utils_1.AST_NODE_TYPES.FunctionExpression,
-    utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
-    utils_1.AST_NODE_TYPES.TSDeclareFunction,
-]);
 /**
  * Whether a default value is what a PARAMETER's type is inferred FROM.
  *
@@ -752,6 +917,38 @@ const elementProjectionCallOf = (node) => {
         ? parent
         : null;
 };
+/**
+ * Constructors that build a collection out of the argument's ELEMENTS.
+ *
+ * `new Set(ITEMS)` holds the constant's own contents, so iterating it hands out
+ * the frozen elements and `for (const item of new Set(ITEMS)) { item.n = 2; }`
+ * is TS2540 for an input that compiled (Issue #2340).
+ *
+ * The construction is not a copy in `copyExpressionOf`'s sense — the result has
+ * a different shape from the argument, so a write to the collection says
+ * nothing about the constant — which is why it is resolved here, where only the
+ * ITERATION question is asked. `WeakSet`/`WeakMap` are absent because they are
+ * not iterable, so no binding can be taken from one.
+ */
+const ELEMENT_PRESERVING_COLLECTION_NAMES = new Set(['Set', 'Map']);
+/** Whether an expression CONSTRUCTS one of those collections. */
+const isElementPreservingCollection = (node) => {
+    const value = unwrapValueWrappers(node);
+    if (value.type !== utils_1.AST_NODE_TYPES.NewExpression) {
+        return false;
+    }
+    const callee = unwrapValueWrappers(value.callee);
+    return (callee.type === utils_1.AST_NODE_TYPES.Identifier &&
+        ELEMENT_PRESERVING_COLLECTION_NAMES.has(callee.name));
+};
+const elementCollectionOf = (node) => {
+    const parent = node.parent;
+    return parent?.type === utils_1.AST_NODE_TYPES.NewExpression &&
+        parent.arguments[0] === node &&
+        isElementPreservingCollection(parent)
+        ? parent
+        : null;
+};
 /**
  * Array methods whose result ITERATES the receiver's own elements.
  *
@@ -764,11 +961,29 @@ const elementProjectionCallOf = (node) => {
  * is frozen, for an input that compiled (Issue #2340). `entries` yields
  * `[index, element]` pairs, which carry the element exactly as `values` does.
  *
- * `keys` is absent for the reason `Object.keys` is: its result is a number
- * whatever the receiver holds, so the assertion cannot reach a binding taken
- * from it.
+ * `keys` is absent for an ARRAY receiver, for the reason `Object.keys` is: it
+ * yields INDICES, numbers whatever the receiver holds, which the assertion
+ * cannot reach.
  */
 const ELEMENT_ITERATOR_METHODS = new Set(['values', 'entries']);
+/**
+ * The same methods for a Set/Map receiver, where `keys` joins them.
+ *
+ * `Set.prototype.keys` is an alias for `values`, and a `Map`'s hands back the
+ * frozen key of each entry, so `for (const item of new Set(ITEMS).keys()) {
+ * item.n = 2; }` is TS2540 once `ITEMS` is frozen, for an input that compiled
+ * — while the `for…of` and `forEach` spellings over the same `new Set(ITEMS)`
+ * already decline (Issue #2341). One set per receiver, because a single set
+ * would decide the two receivers by the same name and be wrong for one of them.
+ *
+ * The receiver is read syntactically: the collection this iterator is reached
+ * through is the `new Set(ITEMS)` expression the derivation walk just resolved.
+ */
+const COLLECTION_ELEMENT_ITERATOR_METHODS = new Set([
+    'values',
+    'entries',
+    'keys',
+]);
 const iteratorProjectionCallOf = (node) => {
     const parent = node.parent;
     if (parent?.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
@@ -776,7 +991,10 @@ const iteratorProjectionCallOf = (node) => {
         return null;
     }
     const method = accessedPropertyName(parent);
-    if (method === null || !ELEMENT_ITERATOR_METHODS.has(method)) {
+    const iteratorMethods = isElementPreservingCollection(node)
+        ? COLLECTION_ELEMENT_ITERATOR_METHODS
+        : ELEMENT_ITERATOR_METHODS;
+    if (method === null || !iteratorMethods.has(method)) {
         return null;
     }
     // A method REFERENCE (`const walk = ITEMS.values;`) iterates nothing, so the
@@ -788,32 +1006,6 @@ const iteratorProjectionCallOf = (node) => {
         ? callee.parent
         : null;
 };
-/**
- * Constructors that build a collection out of the argument's ELEMENTS.
- *
- * `new Set(ITEMS)` holds the constant's own contents, so iterating it hands out
- * the frozen elements and `for (const item of new Set(ITEMS)) { item.n = 2; }`
- * is TS2540 for an input that compiled (Issue #2340).
- *
- * The construction is not a copy in `copyExpressionOf`'s sense — the result has
- * a different shape from the argument, so a write to the collection says
- * nothing about the constant — which is why it is resolved here, where only the
- * ITERATION question is asked. `WeakSet`/`WeakMap` are absent because they are
- * not iterable, so no binding can be taken from one.
- */
-const ELEMENT_PRESERVING_COLLECTION_NAMES = new Set(['Set', 'Map']);
-const elementCollectionOf = (node) => {
-    const parent = node.parent;
-    if (parent?.type !== utils_1.AST_NODE_TYPES.NewExpression ||
-        parent.arguments[0] !== node) {
-        return null;
-    }
-    const callee = unwrapValueWrappers(parent.callee);
-    return callee.type === utils_1.AST_NODE_TYPES.Identifier &&
-        ELEMENT_PRESERVING_COLLECTION_NAMES.has(callee.name)
-        ? parent
-        : null;
-};
 /**
  * The expressions a reference denotes a FROZEN value through: the reference
  * itself and every property access rooted at it — `CONFIG`, `CONFIG.list`,
@@ -840,6 +1032,192 @@ const accessPathsRootedAt = (identifier) => {
         current = outermostValueOf(parent);
     }
 };
+/**
+ * Whether `as const` reaches INTO this value, or stops at the property that
+ * holds it.
+ *
+ * The assertion retypes the literal it is written on: nested array and object
+ * literals become `readonly`, and primitive literals narrow to their literal
+ * type. A value the literal merely refers to keeps whatever type it already
+ * had, and an explicit `as T` cast is exactly such a value — so
+ * `{ items: [] as string[] } as const` freezes the `items` PROPERTY while
+ * leaving the array it holds a mutable `string[]`.
+ *
+ * Only the cast is screened, because it is the one spelling that PROVES the
+ * assertion cannot deepen. Anything else answers true, so an unrecognized value
+ * is still enrolled and the walk keeps declining — the direction that withholds
+ * an assertion rather than breaking a build (Issue #2341).
+ */
+const assertionDeepensInto = (node) => {
+    if (node.type !== utils_1.AST_NODE_TYPES.TSAsExpression &&
+        node.type !== utils_1.AST_NODE_TYPES.TSTypeAssertion) {
+        return true;
+    }
+    return (node.typeAnnotation.type === utils_1.AST_NODE_TYPES.TSTypeReference &&
+        node.typeAnnotation.typeName.type === utils_1.AST_NODE_TYPES.Identifier &&
+        node.typeAnnotation.typeName.name === 'const');
+};
+/**
+ * The value a single access step reads out of a literal, or `undefined` when
+ * the step cannot be resolved statically.
+ *
+ * A spread makes an object literal's own properties an incomplete account of
+ * what it holds, so a miss under one is unresolved rather than absent.
+ */
+const literalValueAtKey = (value, key) => {
+    if (value.type === utils_1.AST_NODE_TYPES.ObjectExpression) {
+        if (typeof key !== 'string') {
+            return undefined;
+        }
+        let resolved;
+        for (const property of value.properties) {
+            if (property.type === utils_1.AST_NODE_TYPES.SpreadElement) {
+                return undefined;
+            }
+            const propertyKey = property.key;
+            const keyName = !property.computed && propertyKey.type === utils_1.AST_NODE_TYPES.Identifier
+                ? propertyKey.name
+                : propertyKey.type === utils_1.AST_NODE_TYPES.Literal &&
+                    typeof propertyKey.value === 'string'
+                    ? propertyKey.value
+                    : null;
+            // The LAST matching key wins, as it does at runtime.
+            if (keyName === key) {
+                resolved = property.value;
+            }
+        }
+        return resolved;
+    }
+    if (value.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+        if (typeof key !== 'number') {
+            return undefined;
+        }
+        const element = value.elements[key];
+        return element === null ||
+            element === undefined ||
+            element.type === utils_1.AST_NODE_TYPES.SpreadElement
+            ? undefined
+            : element;
+    }
+    return undefined;
+};
+/**
+ * The value a single MEMBER ACCESS step reads out of a literal, or `undefined`
+ * when the step cannot be resolved statically.
+ *
+ * Delegates to `literalValueAtKey` so a property reached by a member access and
+ * the same property reached by a destructuring pattern cannot be read on
+ * different terms — the divergence between those two spellings is what this
+ * screen exists to close (Issue #2341).
+ */
+const literalValueAtStep = (value, step) => {
+    const name = accessedPropertyName(step);
+    if (name !== null) {
+        return literalValueAtKey(value, name);
+    }
+    return step.computed &&
+        step.property.type === utils_1.AST_NODE_TYPES.Literal &&
+        typeof step.property.value === 'number'
+        ? literalValueAtKey(value, step.property.value)
+        : undefined;
+};
+/**
+ * The names a destructuring pattern binds to values `as const` does NOT reach.
+ *
+ * A pattern binds a property WITHOUT writing a member access, so the step
+ * screen in `frozenAccessPathsRootedAt` never sees `const { items } = CONFIG`
+ * — it only sees `CONFIG.items`. Reading the pattern against the same literal
+ * keeps the two spellings of one extraction on identical terms. They must
+ * agree: `prefer-destructuring-no-class` rewrites the first into the second
+ * under `--fix`, so a screen applied to one spelling alone lets a sibling fixer
+ * flip this rule's verdict on unchanged semantics (Issue #2341).
+ *
+ * A `RestElement` is left enrolled because it gathers whatever the pattern did
+ * not name, which no single literal value answers for.
+ */
+const collectUnfrozenPatternNames = (id, value, unfrozen) => {
+    if (value === undefined) {
+        return;
+    }
+    if (id.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
+        collectUnfrozenPatternNames(id.left, value, unfrozen);
+        return;
+    }
+    if (id.type === utils_1.AST_NODE_TYPES.Identifier) {
+        if (!assertionDeepensInto(value)) {
+            unfrozen.add(id.name);
+        }
+        return;
+    }
+    const literal = unwrapValueWrappers(value);
+    if (id.type === utils_1.AST_NODE_TYPES.ObjectPattern) {
+        for (const property of id.properties) {
+            if (property.type !== utils_1.AST_NODE_TYPES.Property) {
+                continue;
+            }
+            const key = property.key;
+            const name = !property.computed && key.type === utils_1.AST_NODE_TYPES.Identifier
+                ? key.name
+                : key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string'
+                    ? key.value
+                    : null;
+            if (name === null) {
+                continue;
+            }
+            collectUnfrozenPatternNames(property.value, literalValueAtKey(literal, name), unfrozen);
+        }
+        return;
+    }
+    if (id.type === utils_1.AST_NODE_TYPES.ArrayPattern) {
+        id.elements.forEach((element, index) => {
+            if (!element || element.type === utils_1.AST_NODE_TYPES.RestElement) {
+                return;
+            }
+            collectUnfrozenPatternNames(element, literalValueAtKey(literal, index), unfrozen);
+        });
+    }
+};
+/**
+ * The access paths rooted at a reference that the assertion actually FREEZES,
+ * read against the literal the constant is declared from.
+ *
+ * The climb stops before the first step whose value `as const` cannot deepen
+ * into, because neither that value nor anything reached through it carries the
+ * assertion — a binding taken from it is no second name for frozen contents and
+ * enrolling it would withhold the assertion for a break that cannot happen.
+ *
+ * Without a literal to read, every step answers unresolved and the result is
+ * the whole path, which is what `accessPathsRootedAt` returns on its own.
+ */
+const frozenAccessPathsRootedAt = (identifier, frozenValue) => {
+    const paths = [];
+    let current = outermostValueOf(identifier);
+    let value = frozenValue
+        ? unwrapValueWrappers(frozenValue)
+        : undefined;
+    for (;;) {
+        paths.push({ node: current, literal: value });
+        const parent = current.parent;
+        if (!parent ||
+            parent.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+            parent.object !== current) {
+            return paths;
+        }
+        if (value !== undefined) {
+            const stepValue = literalValueAtStep(value, parent);
+            if (stepValue === undefined) {
+                value = undefined;
+            }
+            else if (!assertionDeepensInto(stepValue)) {
+                return paths;
+            }
+            else {
+                value = unwrapValueWrappers(stepValue);
+            }
+        }
+        current = outermostValueOf(parent);
+    }
+};
 /**
  * Every way a value derived from this one keeps the constant's ELEMENT types:
  * a copy of it, the `Object.values`/`Object.entries` array over it, the
@@ -853,6 +1231,46 @@ const DERIVATION_RESOLVERS = [
     iteratorProjectionCallOf,
     elementCollectionOf,
 ];
+/**
+ * The derivations that carry the constant's frozen type into a value a BINDING
+ * can be initialized from: a copy of it and an element taken out of it.
+ *
+ * The three iteration resolvers are absent because each hands back a value of a
+ * DIFFERENT SHAPE whose container is fresh and mutable — `Object.values(CONFIG)`
+ * and `new Set(ITEMS)` are arrays and sets nothing frozen was written to, so a
+ * write to the container itself is no readonly violation. Only their ELEMENTS
+ * carry the assertion, which is the question the iteration walk asks.
+ */
+const ALIAS_DERIVATION_RESOLVERS = [copyExpressionOf, elementExpressionOf];
+/**
+ * Every expression that denotes a value typed from this reference: the
+ * reference and each step of the access path rooted at it, then — transitively
+ * — whatever `resolvers` derive from any of them.
+ *
+ * Grown in place and walked by index, so a derivation OF a derivation is
+ * reached by the same loop without recursion of its own. Every resolver returns
+ * an ANCESTOR of the node it is given, so the walk strictly ascends and
+ * terminates; `visited` keeps a node two resolvers agree on from being expanded
+ * twice.
+ */
+const derivedValueExpressionsOf = (identifier, resolvers, frozenValue) => {
+    const pending = frozenAccessPathsRootedAt(identifier, frozenValue);
+    const visited = new Set(pending.map(({ node }) => node));
+    for (let index = 0; index < pending.length; index += 1) {
+        for (const resolveDerivation of resolvers) {
+            const derived = resolveDerivation(pending[index].node);
+            if (!derived || visited.has(derived)) {
+                continue;
+            }
+            visited.add(derived);
+            // A copy or an element call hands back a value with no literal of its
+            // own, so nothing downstream of one is screened — the direction that
+            // keeps enrolling rather than withholding the assertion.
+            pending.push({ node: derived, literal: undefined });
+        }
+    }
+    return pending;
+};
 const enrolFully = (variables) => variables.map((variable) => ({
     variable,
     breaksOnAnyMutatingMethod: true,
@@ -918,9 +1336,9 @@ const parameterBindingsOf = (callback, positions, declaredVariablesOf) => {
  */
 const bindingsOfIterationOver = (iterable, declaredVariablesOf, iteratesConstantValue) => {
     // The member path is resolved first because the iterated expression is
-    // routinely a PROPERTY of the constant (`for (const x of CONFIG.list)`),
-    // which the alias walk refuses precisely because it arrives through a member
-    // access — the property is frozen with the object that holds it.
+    // routinely a PROPERTY of the constant (`for (const x of CONFIG.list)`): the
+    // property is frozen with the object that holds it, so iterating it hands the
+    // body the constant's own frozen contents.
     const path = accessPathOf(iterable);
     const value = outermostValueOf(path ?? iterable);
     const parent = value.parent;
@@ -1026,23 +1444,16 @@ const iterationBindingsOf = (identifier, declaredVariablesOf) => {
     const bindings = [
         ...bindingsOfIterationOver(value, declaredVariablesOf, true),
     ];
-    // Grown in place and walked by index, so a derivation OF a derivation is
-    // reached by the same loop without recursion of its own. Every resolver
-    // returns an ancestor of the node it is given, so the walk strictly ascends
-    // and terminates; `visited` keeps a node two resolvers agree on from being
-    // expanded twice.
-    const pending = accessPathsRootedAt(value);
-    const visited = new Set(pending);
-    for (let index = 0; index < pending.length; index += 1) {
-        for (const resolveDerivation of DERIVATION_RESOLVERS) {
-            const derived = resolveDerivation(pending[index]);
-            if (!derived || visited.has(derived)) {
-                continue;
-            }
-            visited.add(derived);
-            pending.push(derived);
-            bindings.push(...bindingsOfIterationOver(derived, declaredVariablesOf, false));
+    // The constant's own value and access path are iterated by the call above,
+    // which resolves the path itself; every DERIVED value is iterated on the
+    // narrower terms — it hands a callback a fresh outer value rather than the
+    // constant.
+    const ownValues = new Set(accessPathsRootedAt(value));
+    for (const { node: derived } of derivedValueExpressionsOf(value, DERIVATION_RESOLVERS)) {
+        if (ownValues.has(derived)) {
+            continue;
         }
+        bindings.push(...bindingsOfIterationOver(derived, declaredVariablesOf, false));
     }
     return bindings;
 };
@@ -1097,10 +1508,20 @@ const iterationBindingsOf = (identifier, declaredVariablesOf) => {
  * `--fix`.
  */
 const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
+    // The literal the constant is declared from, so an access path through it can
+    // be screened against what `as const` actually freezes. Only the constant's
+    // own declarator carries one: an ALIAS is initialized from a path into that
+    // same literal, and resolving through it would need the path carried too, so
+    // an alias is left unresolved and every step of it stays enrolled.
+    const declaredValue = variable.defs.find((def) => def.node.type === utils_1.AST_NODE_TYPES.VariableDeclarator)?.node;
+    const frozenValue = declaredValue?.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+        declaredValue.init
+        ? declaredValue.init
+        : undefined;
     // Grown in place and walked by index: an alias found mid-walk is appended and
     // reached by the same loop, so the traversal needs no recursion of its own.
     const pending = [
-        { variable, breaksOnAnyMutatingMethod: true },
+        { variable, breaksOnAnyMutatingMethod: true, frozenValue },
     ];
     const visited = new Set([variable]);
     /**
@@ -1128,7 +1549,7 @@ const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
         return false;
     };
     for (let index = 0; index < pending.length; index += 1) {
-        const { variable: enrolled, breaksOnAnyMutatingMethod } = pending[index];
+        const { variable: enrolled, breaksOnAnyMutatingMethod, frozenValue: enrolledValue, } = pending[index];
         for (const reference of enrolled.references) {
             // Reassigning an alias is as disqualifying as writing through one. A
             // binding that takes its type from the constant narrows to the frozen
@@ -1158,23 +1579,43 @@ const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
                     introducesForeignElement(path, isEnrolledReference))) {
                 return true;
             }
-            // A copy carries the constant's frozen type into a second binding, so it
-            // is enrolled on the same terms as an alias — but it is reached through a
-            // member access (`ITEMS.concat()`), which the alias walk deliberately
-            // refuses, so it is resolved before that refusal applies.
-            const copy = copyExpressionOf(outermostValueOf(reference.identifier));
-            const declarator = copy
-                ? aliasDeclaratorOf(copy)
-                : path === null
-                    ? aliasDeclaratorOf(reference.identifier)
-                    : null;
+            // A binding is initialized from any expression that denotes the
+            // constant's frozen contents, not from the reference alone. A PROPERTY or
+            // ELEMENT of the constant carries the assertion exactly as the constant
+            // does, so `const list = CONFIG.list; list.push(3);` is the same TS2339
+            // the rule already declines for when the identical call is written
+            // directly — only the extracted spelling escaped it, while the
+            // DESTRUCTURED spelling of the same extraction was enrolled all along
+            // (Issue #2341). A copy taken of the constant or of any step of that path
+            // (`ITEMS.concat()`, `[...CONFIG.a.b]`) carries the frozen TYPE into a
+            // fresh value on the same terms.
+            const aliases = derivedValueExpressionsOf(reference.identifier, ALIAS_DERIVATION_RESOLVERS, enrolledValue).flatMap(({ node, literal }) => {
+                const declarator = aliasDeclaratorOf(node);
+                if (!declarator) {
+                    return [];
+                }
+                const variables = declaredVariablesOf(declarator);
+                // The pattern screen applies only where the declarator destructures
+                // THIS value directly. Reached through a storage container
+                // (`const HOLDER = { ITEMS }`), the pattern names the container's own
+                // properties, which this literal does not answer for.
+                if (literal === undefined ||
+                    declarator.init !== outermostValueOf(node)) {
+                    return variables;
+                }
+                const unfrozen = new Set();
+                collectUnfrozenPatternNames(declarator.id, literal, unfrozen);
+                return unfrozen.size === 0
+                    ? variables
+                    : variables.filter((variable) => !unfrozen.has(variable.name));
+            });
             // A binding introduced by ITERATING the constant is enrolled beside the
             // aliases: it names the constant's CONTENTS, which the assertion freezes
             // with the constant itself — see `iterationBindingsOf`. An alias is
             // enrolled on the constant's own terms, because it denotes the constant's
             // value and so carries its readonly-ness whole.
             const derived = [
-                ...enrolFully(declarator ? declaredVariablesOf(declarator) : []),
+                ...enrolFully(aliases),
                 ...iterationBindingsOf(reference.identifier, declaredVariablesOf),
             ];
             for (const alias of derived) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.21.14",
+  "version": "1.21.15",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,35 @@
 [
+  {
+    "version": "1.21.15",
+    "date": "2026-09-06T18:24:58.623Z",
+    "rules": [
+      {
+        "name": "enforce-empty-object-check",
+        "changeType": "fix",
+        "issues": [
+          2344
+        ],
+        "summary": "keep a declared type's verdict when the checker cannot resolve it (closes #2344)"
+      },
+      {
+        "name": "enforce-memoize-async",
+        "changeType": "fix",
+        "issues": [
+          2343
+        ],
+        "summary": "withhold from methods that release what they acquired and from methods reporting an effect (closes #2343)"
+      },
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2341,
+          2342
+        ],
+        "summary": "enrol bindings extracted by member access and by a type-preserving map (closes #2341, closes #2342)"
+      }
+    ]
+  },
   {
     "version": "1.21.14",
     "date": "2026-09-06T01:53:58.858Z",