@blumintinc/eslint-plugin-blumint 1.21.6 → 1.21.8

package/lib/index.js

@@ -224,7 +224,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.21.6',
+        version: '1.21.8',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/global-const-style.js

@@ -305,6 +305,34 @@ const isWriteTarget = (node) => {
             return false;
     }
 };
+/**
+ * The composite literal a reference is STORED INTO — the object in
+ * `{ items: ITEMS }`, the array in `[ITEMS]` — or null for every other
+ * position.
+ *
+ * Storing a reference does not copy it: the same array stays reachable through
+ * the container, so `holder.items.push(3)` writes through to the binding
+ * exactly as a direct alias does, and freezing it raises the same TS2339. A
+ * `SpreadElement` is excluded because it genuinely builds a fresh value
+ * (`const COPY = [...ITEMS]`), and a computed key is excluded because it coerces
+ * the reference to a property name rather than retaining it.
+ */
+const storageContainerOf = (node) => {
+    const parent = node.parent;
+    if (!parent) {
+        return null;
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.Property &&
+        parent.value === node &&
+        parent.parent?.type === utils_1.AST_NODE_TYPES.ObjectExpression) {
+        return parent.parent;
+    }
+    if (parent.type === utils_1.AST_NODE_TYPES.ArrayExpression &&
+        parent.elements.some((element) => element === node)) {
+        return parent;
+    }
+    return null;
+};
 /**
  * The declarator a reference initializes IN WHOLE — `OTHER` in
  * `const OTHER = ITEMS` — or null for every other position. Such a declaration
@@ -319,24 +347,112 @@ const isWriteTarget = (node) => {
  * tolerated — staying silent is the cheap error here, emitting a fix that stops
  * the file compiling is not.
  *
- * A reference that is only PART of an initializer builds a fresh value rather
- * than aliasing this one (`const COPY = [...ITEMS]`), and a destructuring id
- * extracts a member rather than the whole, so neither is an alias here.
+ * A reference STORED INTO a composite literal is followed through that
+ * container, since storing does not copy — see `storageContainerOf`. A
+ * destructuring id extracts a member rather than the whole, so it is not an
+ * alias here.
  */
 const aliasDeclaratorOf = (identifier) => {
-    const value = outermostValueOf(identifier);
-    const declarator = value.parent;
-    if (declarator?.type !== utils_1.AST_NODE_TYPES.VariableDeclarator ||
-        declarator.init !== value ||
-        declarator.id.type !== utils_1.AST_NODE_TYPES.Identifier) {
-        return null;
+    // Ascends strictly, so reaching a node with no parent terminates the walk.
+    let value = outermostValueOf(identifier);
+    for (;;) {
+        const declarator = value.parent;
+        if (declarator?.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+            declarator.init === value &&
+            declarator.id.type === utils_1.AST_NODE_TYPES.Identifier) {
+            return declarator;
+        }
+        const container = storageContainerOf(value);
+        if (!container) {
+            return null;
+        }
+        value = outermostValueOf(container);
     }
-    return declarator;
 };
+/** Pattern nodes a parameter's binding can be nested inside. */
+const PATTERN_CONTAINERS = new Set([
+    utils_1.AST_NODE_TYPES.AssignmentPattern,
+    utils_1.AST_NODE_TYPES.Property,
+    utils_1.AST_NODE_TYPES.ObjectPattern,
+    utils_1.AST_NODE_TYPES.ArrayPattern,
+    utils_1.AST_NODE_TYPES.RestElement,
+]);
+const FUNCTION_TYPES = new Set([
+    utils_1.AST_NODE_TYPES.FunctionDeclaration,
+    utils_1.AST_NODE_TYPES.FunctionExpression,
+    utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
+    utils_1.AST_NODE_TYPES.TSDeclareFunction,
+]);
 /**
- * Whether the binding is written through anywhere in the file, under its own
- * name or through an alias of it. Answered from the scope manager's reference
- * list rather than a textual search for the name, so a same-named binding in
+ * Whether a default value is what a PARAMETER's type is inferred FROM.
+ *
+ * Answered false in the two cases where freezing the default cannot change a
+ * signature: the parameter carries a type annotation, so its type is declared
+ * rather than inferred — looked for up the whole pattern, since a destructured
+ * parameter carries it on the pattern (`({ distance = DEFAULT }: Props)`) and
+ * a plain one on its binding (`(model: ModelName = DEFAULT)`) — or the default
+ * belongs to a destructuring declaration rather than a parameter list, which
+ * declares no signature at all.
+ */
+const isInferredParameterDefault = (pattern) => {
+    let current = pattern;
+    for (;;) {
+        if (current.typeAnnotation) {
+            return false;
+        }
+        const parent = current.parent;
+        if (!parent) {
+            return false;
+        }
+        if (FUNCTION_TYPES.has(parent.type)) {
+            return parent.params.includes(current);
+        }
+        if (!PATTERN_CONTAINERS.has(parent.type)) {
+            return false;
+        }
+        current = parent;
+    }
+};
+/**
+ * Whether a reference sits where TypeScript INFERS a type from it — the value
+ * of a default parameter, reached directly or through a composite literal it
+ * is stored into.
+ *
+ * `as const` does not only freeze: it makes the literal type NON-WIDENING, and
+ * an inference site that widened `'ready'` to `string` then keeps the literal.
+ * A parameter defaulted from the constant therefore narrows to that one value,
+ * and every call passing a different one stops compiling (TS2345) for an input
+ * that compiled. The mutation walk cannot see this: nothing is written, the
+ * signature is simply inferred from a value the assertion changes.
+ */
+const isInferenceSite = (identifier) => {
+    let value = outermostValueOf(identifier);
+    for (;;) {
+        const parent = value.parent;
+        if (parent?.type === utils_1.AST_NODE_TYPES.AssignmentPattern &&
+            parent.right === value) {
+            return isInferredParameterDefault(parent.left);
+        }
+        const container = storageContainerOf(value);
+        if (!container) {
+            return false;
+        }
+        value = outermostValueOf(container);
+    }
+};
+/**
+ * Whether anything in the file stops this binding taking `as const`, under its
+ * own name or through an alias of it.
+ *
+ * Two things disqualify it, because `as const` does two things. It freezes the
+ * value, so a WRITE — through the binding (`X.push(1)`), or to a binding that
+ * aliases it (`other = X`) — becomes TS2339/TS2540. And it makes the literal
+ * type NON-WIDENING, so an INFERENCE site that read the widened type keeps the
+ * literal instead, which rewrites a signature the assertion was never asked to
+ * touch.
+ *
+ * Answered from the scope manager's reference list rather than a textual
+ * search for the name, so a same-named binding in
  * another scope (`const arr` shadowed inside a callback) contributes nothing,
  * and a same-named method on an unrelated receiver (`other.push(1)`) is never
  * even visited.
@@ -358,13 +474,24 @@ const aliasDeclaratorOf = (identifier) => {
  * check keyed on `const` would leave the `let` spelling breaking builds under
  * `--fix`.
  */
-const isBindingMutated = (variable, declaredVariablesOf) => {
+const blocksAsConstAssertion = (variable, declaredVariablesOf) => {
     // Grown in place and walked by index: an alias found mid-walk is appended and
     // reached by the same loop, so the traversal needs no recursion of its own.
     const pending = [variable];
     const visited = new Set(pending);
     for (let index = 0; index < pending.length; index += 1) {
         for (const reference of pending[index].references) {
+            // Reassigning an alias is as disqualifying as writing through one. A
+            // binding that takes its type from the constant narrows to the frozen
+            // literal, so `let stage = DEFAULT; stage = 'live';` becomes TS2322 for
+            // an input that compiled. `init` excludes the declaration's own write,
+            // which is how the alias was established rather than a change to it.
+            if (reference.isWrite() && !reference.init) {
+                return true;
+            }
+            if (isInferenceSite(reference.identifier)) {
+                return true;
+            }
             const path = accessPathOf(reference.identifier);
             if (path !== null) {
                 if (isMutatingMethodCall(path) || isWriteTarget(path)) {
@@ -801,7 +928,7 @@ exports.default = (0, createRule_1.createRule)({
                                 .getDeclaredVariables(declaration)
                                 .find((variable) => variable.name === name);
                             return (!declaredVariable ||
-                                !isBindingMutated(declaredVariable, declaredVariablesOf));
+                                !blocksAsConstAssertion(declaredVariable, declaredVariablesOf));
                         };
                         if (shouldHaveAsConst(init)) {
                             context.report({

package/lib/rules/no-try-catch-already-exists-in-transaction.js

@@ -68,6 +68,28 @@ function isFirestoreModuleSource(source) {
         return (productSegment === product || !!productSegment?.startsWith(`${product}-`));
     });
 }
+/**
+ * First segments that mark a path alias into the project's own tree rather than
+ * a published package. A scoped package's first segment is `@scope`, so a bare
+ * `@` can only be an alias.
+ */
+const FIRST_PARTY_SOURCE_ROOTS = new Set(['@', '~', 'src', 'app', 'lib']);
+/**
+ * Whether a specifier names a published package, which is the only thing that
+ * can REFUTE Firestore provenance.
+ *
+ * A relative or absolute path, or a path alias, resolves into first-party code
+ * this rule cannot follow, so such a source says nothing about which product
+ * the binding came from. Reading its failure to look like `firebase/firestore`
+ * as proof of a different product is what silenced the rule on every
+ * `import { db } from '../../config/firebaseAdmin'` re-export.
+ */
+function isBarePackageSource(source) {
+    if (source.startsWith('.') || source.startsWith('/') || source === '') {
+        return false;
+    }
+    return !FIRST_PARTY_SOURCE_ROOTS.has(moduleSegments(source)[0]);
+}
 /**
  * The module `name` is imported from, or null when the file declares the name
  * itself (a local helper, a parameter) or nothing declares it at all.
@@ -117,11 +139,13 @@ function provenanceIdentifier(callee) {
 /**
  * Whether a `runTransaction` call is the Firestore one this rule speaks about.
  *
- * The gate speaks only when it knows: a binding that resolves to an import is
- * judged by its module source, and anything else — a bare call, a parameter, a
- * local helper, a member call on an unresolvable receiver — keeps the rule's
- * posture of reporting, since a name with no traceable origin is far more often
- * Firestore (`db.runTransaction(...)`) than not.
+ * The gate speaks only when it knows: a binding that resolves to an import of a
+ * published package is judged by its module source, and anything else — a bare
+ * call, a parameter, a local helper, a member call on an unresolvable receiver,
+ * an import from the project's own tree — keeps the rule's posture of
+ * reporting, since a name with no traceable origin is far more often Firestore
+ * (`db.runTransaction(...)`) than not. Only a package specifier can refute
+ * Firestore; a first-party path merely fails to confirm it.
  */
 function isFirestoreTransactionCall(node, context) {
     if (!isRunTransactionCall(node)) {
@@ -132,7 +156,7 @@ function isFirestoreTransactionCall(node, context) {
         return true;
     }
     const source = importedSourceOf(ASTHelpers_1.ASTHelpers.getScope(context, node), carrier.name);
-    if (source === null) {
+    if (source === null || !isBarePackageSource(source)) {
         return true;
     }
     return isFirestoreModuleSource(source);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.21.6",
+  "version": "1.21.8",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,40 @@
 [
+  {
+    "version": "1.21.8",
+    "date": "2026-09-05T03:15:57.605Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2329
+        ],
+        "summary": "withhold the assertion where a type is inferred from the constant (closes #2329)"
+      }
+    ]
+  },
+  {
+    "version": "1.21.7",
+    "date": "2026-09-04T21:52:00.765Z",
+    "rules": [
+      {
+        "name": "global-const-style",
+        "changeType": "fix",
+        "issues": [
+          2327
+        ],
+        "summary": "follow the binding into a container (closes #2327)"
+      },
+      {
+        "name": "no-try-catch-already-exists-in-transaction",
+        "changeType": "fix",
+        "issues": [
+          2326
+        ],
+        "summary": "report on first-party imports (closes #2326)"
+      }
+    ]
+  },
   {
     "version": "1.21.6",
     "date": "2026-09-04T20:52:21.747Z",