@blumintinc/eslint-plugin-blumint 1.21.6 → 1.21.7

package/lib/index.js

@@ -224,7 +224,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.21.6',
+        version: '1.21.7',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/global-const-style.js

@@ -305,6 +305,34 @@ const isWriteTarget = (node) => {
             return false;
     }
 };
+/**
+ * The composite literal a reference is STORED INTO — the object in
+ * `{ items: ITEMS }`, the array in `[ITEMS]` — or null for every other
+ * position.
+ *
+ * Storing a reference does not copy it: the same array stays reachable through
+ * the container, so `holder.items.push(3)` writes through to the binding
+ * exactly as a direct alias does, and freezing it raises the same TS2339. A
+ * `SpreadElement` is excluded because it genuinely builds a fresh value
+ * (`const COPY = [...ITEMS]`), and a computed key is excluded because it coerces
+ * the reference to a property name rather than retaining it.
+ */
+const storageContainerOf = (node) => {
+    const parent = node.parent;
+    if (!parent) {
+        return null;
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.Property &&
+        parent.value === node &&
+        parent.parent?.type === utils_1.AST_NODE_TYPES.ObjectExpression) {
+        return parent.parent;
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.ArrayExpression &&
+        parent.elements.some((element) => element === node)) {
+        return parent;
+    }
+    return null;
+};
 /**
  * The declarator a reference initializes IN WHOLE — `OTHER` in
  * `const OTHER = ITEMS` — or null for every other position. Such a declaration
@@ -319,19 +347,27 @@ const isWriteTarget = (node) => {
  * tolerated — staying silent is the cheap error here, emitting a fix that stops
  * the file compiling is not.
  *
- * A reference that is only PART of an initializer builds a fresh value rather
- * than aliasing this one (`const COPY = [...ITEMS]`), and a destructuring id
- * extracts a member rather than the whole, so neither is an alias here.
+ * A reference STORED INTO a composite literal is followed through that
+ * container, since storing does not copy — see `storageContainerOf`. A
+ * destructuring id extracts a member rather than the whole, so it is not an
+ * alias here.
  */
 const aliasDeclaratorOf = (identifier) => {
-    const value = outermostValueOf(identifier);
-    const declarator = value.parent;
-    if (declarator?.type !== utils_1.AST_NODE_TYPES.VariableDeclarator ||
-        declarator.init !== value ||
-        declarator.id.type !== utils_1.AST_NODE_TYPES.Identifier) {
-        return null;
+    // Ascends strictly, so reaching a node with no parent terminates the walk.
+    let value = outermostValueOf(identifier);
+    for (;;) {
+        const declarator = value.parent;
+        if (declarator?.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+            declarator.init === value &&
+            declarator.id.type === utils_1.AST_NODE_TYPES.Identifier) {
+            return declarator;
+        }
+        const container = storageContainerOf(value);
+        if (!container) {
+            return null;
+        }
+        value = outermostValueOf(container);
     }
-    return declarator;
 };
 /**
  * Whether the binding is written through anywhere in the file, under its own

package/lib/rules/no-try-catch-already-exists-in-transaction.js

@@ -68,6 +68,28 @@ function isFirestoreModuleSource(source) {
         return (productSegment === product || !!productSegment?.startsWith(`${product}-`));
     });
 }
+/**
+ * First segments that mark a path alias into the project's own tree rather than
+ * a published package. A scoped package's first segment is `@scope`, so a bare
+ * `@` can only be an alias.
+ */
+const FIRST_PARTY_SOURCE_ROOTS = new Set(['@', '~', 'src', 'app', 'lib']);
+/**
+ * Whether a specifier names a published package, which is the only thing that
+ * can REFUTE Firestore provenance.
+ *
+ * A relative or absolute path, or a path alias, resolves into first-party code
+ * this rule cannot follow, so such a source says nothing about which product
+ * the binding came from. Reading its failure to look like `firebase/firestore`
+ * as proof of a different product is what silenced the rule on every
+ * `import { db } from '../../config/firebaseAdmin'` re-export.
+ */
+function isBarePackageSource(source) {
+    if (source.startsWith('.') || source.startsWith('/') || source === '') {
+        return false;
+    }
+    return !FIRST_PARTY_SOURCE_ROOTS.has(moduleSegments(source)[0]);
+}
 /**
  * The module `name` is imported from, or null when the file declares the name
  * itself (a local helper, a parameter) or nothing declares it at all.
@@ -117,11 +139,13 @@ function provenanceIdentifier(callee) {
 /**
  * Whether a `runTransaction` call is the Firestore one this rule speaks about.
  *
- * The gate speaks only when it knows: a binding that resolves to an import is
- * judged by its module source, and anything else — a bare call, a parameter, a
- * local helper, a member call on an unresolvable receiver — keeps the rule's
- * posture of reporting, since a name with no traceable origin is far more often
- * Firestore (`db.runTransaction(...)`) than not.
+ * The gate speaks only when it knows: a binding that resolves to an import of a
+ * published package is judged by its module source, and anything else — a bare
+ * call, a parameter, a local helper, a member call on an unresolvable receiver,
+ * an import from the project's own tree — keeps the rule's posture of
+ * reporting, since a name with no traceable origin is far more often Firestore
+ * (`db.runTransaction(...)`) than not. Only a package specifier can refute
+ * Firestore; a first-party path merely fails to confirm it.
  */
 function isFirestoreTransactionCall(node, context) {
     if (!isRunTransactionCall(node)) {
@@ -132,7 +156,7 @@ function isFirestoreTransactionCall(node, context) {
         return true;
     }
     const source = importedSourceOf(ASTHelpers_1.ASTHelpers.getScope(context, node), carrier.name);
-    if (source === null) {
+    if (source === null || !isBarePackageSource(source)) {
         return true;
     }
     return isFirestoreModuleSource(source);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.21.6",
+  "version": "1.21.7",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "1.21.7",
+    "date": "2026-09-04T21:52:00.765Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2327
+        ],
+        "summary": "follow the binding into a container (closes #2327)"
+      },
+      {
+        "name": "no-try-catch-already-exists-in-transaction",
+        "changeType": "fix",
+        "issues": [
+          2326
+        ],
+        "summary": "report on first-party imports (closes #2326)"
+      }
+    ]
+  },
   {
     "version": "1.21.6",
     "date": "2026-09-04T20:52:21.747Z",