@blumintinc/eslint-plugin-blumint 1.20.147 → 1.20.149

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.147',
+        version: '1.20.149',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/class-methods-read-top-to-bottom.js

@@ -8,14 +8,72 @@ const ASTHelpers_1 = require("../utils/ASTHelpers");
 // derive names from the same function: any disagreement makes the two arrays
 // differ in length and silently skips the whole class body.
 const getMemberName = ClassGraphBuilder_1.classMemberNameOf;
+/**
+ * The class members each member reads once its own body executes, keyed by
+ * member name. A method (or accessor) contributes its whole body; a field
+ * holding a function contributes that function's body, since `this.f()` runs it
+ * with the instance bound.
+ *
+ * An initializer that invokes such a member runs that body during
+ * construction, which makes those reads exactly as eager as the initializer's
+ * own — the syntactic eager-read scan stops at the call and cannot see them.
+ */
+function readsWhenInvokedOf(node, className) {
+    const readsByMember = new Map();
+    for (const member of node.body) {
+        const name = getMemberName(member);
+        if (name === null) {
+            continue;
+        }
+        // The constructor is unreachable from an initializer — field initializers
+        // run inside it — so its body constrains nothing.
+        if (member.type === 'MethodDefinition' && member.kind !== 'constructor') {
+            readsByMember.set(name, ASTHelpers_1.ASTHelpers.classMemberNamesReferenced(member, className));
+            continue;
+        }
+        if (member.type === 'PropertyDefinition' &&
+            (member.value?.type === 'ArrowFunctionExpression' ||
+                member.value?.type === 'FunctionExpression')) {
+            // The function's body is passed rather than the function itself, because
+            // a `function` expression called as `this.f()` binds `this` to the
+            // instance even though the node type otherwise rebinds it.
+            readsByMember.set(name, ASTHelpers_1.ASTHelpers.classMemberNamesReferenced(member.value.body, className));
+        }
+    }
+    return readsByMember;
+}
+/**
+ * Every member name an initializer reads during construction, following each
+ * invoked member into what its own body reads until the set stops growing.
+ *
+ * The closure is deliberately blind to whether a named member is called or
+ * merely referenced: treating a bare reference as an invocation only adds
+ * constraints, and an extra constraint costs a declined reorder while a missing
+ * one ships a class that throws at construction.
+ */
+function eagerReadClosureOf(initializer, className, readsWhenInvoked) {
+    const reached = new Set();
+    const pending = ASTHelpers_1.ASTHelpers.classMemberNamesReadEagerly(initializer, className);
+    while (pending.length > 0) {
+        const name = pending.pop();
+        if (reached.has(name)) {
+            continue;
+        }
+        reached.add(name);
+        pending.push(...(readsWhenInvoked.get(name) || []));
+    }
+    return [...reached];
+}
 /**
  * Whether the proposed order still declares every field above the initializer
  * that reads it. Only field-to-field reads constrain the layout: methods (and
  * private methods) are installed before any initializer runs, so relocating one
- * is unobservable.
+ * is unobservable — but a field read reached THROUGH such a method still
+ * constrains it, because the call happens while the initializer runs.
  */
 function initializerReadsPrecedeDeclarations(node, sortedOrder, graph, className) {
     const positionOf = new Map(sortedOrder.map((name, index) => [name, index]));
+    const readsWhenInvoked = readsWhenInvokedOf(node, className);
     return node.body.every((member) => {
         if (member.type !== 'PropertyDefinition' || !member.value) {
             return true;
@@ -23,13 +81,24 @@ function initializerReadsPrecedeDeclarations(node, sortedOrder, graph, className
         const reader = getMemberName(member);
         const readerPosition = reader === null ? undefined : positionOf.get(reader);
         if (readerPosition === undefined) {
-            return true;
+            // An initializer the sorted order cannot place is one whose reads cannot
+            // be compared against it, so no order can be certified safe.
+            return false;
         }
-        return ASTHelpers_1.ASTHelpers.classMemberNamesReadEagerly(member.value, className)
-            .filter((name) => graph[name]?.type === 'property' && name !== reader)
+        return eagerReadClosureOf(member.value, className, readsWhenInvoked)
+            .filter((name) => name !== reader)
             .every((name) => {
+            const target = graph[name];
+            // A read the sort cannot place — inherited, mixed in, or a constructor
+            // parameter property — leaves the layout uncertifiable.
+            if (!target) {
+                return false;
+            }
+            if (target.type !== 'property') {
+                return true;
+            }
             const readPosition = positionOf.get(name);
-            return readPosition === undefined || readPosition < readerPosition;
+            return readPosition !== undefined && readPosition < readerPosition;
         });
     });
 }

package/lib/rules/enforce-early-destructuring.js

@@ -691,6 +691,140 @@ function hasPriorConditionalGuard(node, baseName, visitorKeys) {
         Boolean(statement.test) &&
         testContainsObjectMember(statement.test, baseName, visitorKeys));
 }
+/**
+ * Statement forms that can skip the declaration nested beneath them, so a
+ * declaration inside one is not reached on every pass through the callback.
+ * `finally` is folded in with the rest of `try`: the distinction costs a branch
+ * and buys back a shape nobody writes.
+ */
+const CONDITIONAL_CONTAINERS = new Set([
+    utils_1.AST_NODE_TYPES.IfStatement,
+    utils_1.AST_NODE_TYPES.TryStatement,
+    utils_1.AST_NODE_TYPES.SwitchStatement,
+    utils_1.AST_NODE_TYPES.SwitchCase,
+    utils_1.AST_NODE_TYPES.ForStatement,
+    utils_1.AST_NODE_TYPES.ForInStatement,
+    utils_1.AST_NODE_TYPES.ForOfStatement,
+    utils_1.AST_NODE_TYPES.WhileStatement,
+    utils_1.AST_NODE_TYPES.DoWhileStatement,
+]);
+/**
+ * Whether the pattern binds anything below its own root. Only the root gets the
+ * synthesized `?? {}` rescue; a nested pattern is re-emitted verbatim because a
+ * synthesized `= {}` under it would be checked against every binding beneath it
+ * (see formatPropertyText). So a nested pattern dereferences an intermediate
+ * that nothing in the hoisted text guards.
+ */
+function patternBindsBeneathRoot(pattern) {
+    const stack = [...pattern.properties];
+    while (stack.length) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        if (current.type === utils_1.AST_NODE_TYPES.ObjectPattern ||
+            current.type === utils_1.AST_NODE_TYPES.ArrayPattern) {
+            return true;
+        }
+        if (current.type === utils_1.AST_NODE_TYPES.Property) {
+            stack.push(current.value);
+            continue;
+        }
+        if (current.type === utils_1.AST_NODE_TYPES.RestElement) {
+            stack.push(current.argument);
+            continue;
+        }
+        // A default's right-hand side is an expression, never a binding site, so
+        // only the left of an assignment pattern can hide a further pattern.
+        if (current.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
+            stack.push(current.left);
+        }
+    }
+    return false;
+}
+function containsTerminatingStatement(node, visitorKeys) {
+    const stack = [node];
+    while (stack.length) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        // A `return` belonging to a nested function exits that function, not the
+        // block the declaration sits in, so it guards nothing here.
+        if (current !== node && isAnyFunctionLikeNode(current)) {
+            continue;
+        }
+        if (current.type === utils_1.AST_NODE_TYPES.ReturnStatement ||
+            current.type === utils_1.AST_NODE_TYPES.ThrowStatement ||
+            current.type === utils_1.AST_NODE_TYPES.BreakStatement ||
+            current.type === utils_1.AST_NODE_TYPES.ContinueStatement) {
+            return true;
+        }
+        const keys = visitorKeys[current.type] ?? [];
+        for (const key of keys) {
+            const value = current[key];
+            if (Array.isArray(value)) {
+                for (const child of value) {
+                    if (child && typeof child === 'object') {
+                        stack.push(child);
+                    }
+                }
+            }
+            else if (value && typeof value === 'object') {
+                stack.push(value);
+            }
+        }
+    }
+    return false;
+}
+function isEarlyExitGuard(statement, visitorKeys) {
+    return (statement.type === utils_1.AST_NODE_TYPES.IfStatement &&
+        containsTerminatingStatement(statement, visitorKeys));
+}
+/**
+ * Whether some conditional between the declaration and the callback body decides
+ * that the declaration runs at all — either a container that can skip it, or an
+ * earlier sibling that can leave the block before reaching it.
+ *
+ * Only the span up to the callback matters: the hoist lands immediately before
+ * the statement holding the hook call, so it keeps every conditional wrapping
+ * the hook itself and escapes exactly the ones inside the callback.
+ */
+function isConditionallyReached(node, callback, visitorKeys) {
+    let current = node;
+    while (current !== callback.body) {
+        const parent = current.parent;
+        if (!parent)
+            return false;
+        if (CONDITIONAL_CONTAINERS.has(parent.type)) {
+            return true;
+        }
+        if (parent.type === utils_1.AST_NODE_TYPES.BlockStatement) {
+            const index = parent.body.indexOf(current);
+            if (index > 0 &&
+                parent.body
+                    .slice(0, index)
+                    .some((statement) => isEarlyExitGuard(statement, visitorKeys))) {
+                return true;
+            }
+        }
+        current = parent;
+    }
+    return false;
+}
+/**
+ * A nested destructure whose execution a guard controls stays put, whatever the
+ * guard tests. `hasPriorConditionalGuard` and `isTypeNarrowingContext` recognise
+ * only a guard naming the destructured object, which misses the ubiquitous
+ * `if (ready)` / `if (!isLoaded) return;` / `try` spellings that license the
+ * dereference without mentioning it. Hoisting past one of those evaluates the
+ * nested pattern on every render, where `?? {}` covers the root and leaves the
+ * intermediate to throw.
+ *
+ * The flat case keeps hoisting: there the `?? {}` rescue is the whole pattern.
+ */
+function isGuardedNestedDestructure(declaration, pattern, callback, visitorKeys) {
+    return (patternBindsBeneathRoot(pattern) &&
+        isConditionallyReached(declaration, callback, visitorKeys));
+}
 function isIdentifierReference(node) {
     const parent = node.parent;
     if (!parent)
@@ -747,7 +881,8 @@ function buildDestructuringGroups(callback, depTextSet, visitorKeys, sourceCode)
                         continue;
                     const baseName = getBaseIdentifier(declarator.init);
                     if (hasPriorConditionalGuard(current, baseName, visitorKeys) ||
-                        isTypeNarrowingContext(current, baseName, visitorKeys)) {
+                        isTypeNarrowingContext(current, baseName, visitorKeys) ||
+                        isGuardedNestedDestructure(current, declarator.id, callback, visitorKeys)) {
                         continue;
                     }
                     const existingGroup = groups.get(depKey);

package/lib/rules/no-array-length-in-deps.js

@@ -5,6 +5,7 @@ const utils_1 = require("@typescript-eslint/utils");
 const createRule_1 = require("../utils/createRule");
 const ASTHelpers_1 = require("../utils/ASTHelpers");
 const disableDirectives_1 = require("../utils/disableDirectives");
+const hungarianNaming_1 = require("../utils/hungarianNaming");
 const importInsertion_1 = require("../utils/importInsertion");
 // React hooks to check
 const HOOK_NAMES = new Set(['useEffect', 'useCallback', 'useMemo']);
@@ -62,10 +63,45 @@ function getLastPropertyName(expr) {
     }
     return null;
 }
+/**
+ * The name used when the base contributes nothing spellable. Free of any type
+ * marker by construction, and the concept the memo actually stands for — the
+ * hash of the dependency's CONTENT, which is what depending on `.length`
+ * failed to track.
+ */
+const BASE_FREE_HASH_NAME = 'contentHash';
+function capitalize(name) {
+    return name.charAt(0).toUpperCase() + name.slice(1);
+}
+/**
+ * Names for the memo binding, in descending order of how much of the base they
+ * keep. `no-hungarian` ships as an error and is NOT fixable, so a name it
+ * rejects turns this fixer's work into a manual rename in a file that was clean
+ * beforehand (#1997) — every candidate is therefore checked against the same
+ * predicate that rule applies, and the first acceptable one wins.
+ *
+ * Which candidate that is follows from what `no-hungarian` rejects:
+ *
+ * - `<base>Hash` reads as the domain concept for almost every base and is the
+ *   preferred spelling.
+ * - A single-letter `b`/`i` base makes `bHash`/`iHash` look like a Hungarian
+ *   type prefix (b=boolean, i=integer) glued to a capital. `hashOf<Base>` says
+ *   the same thing with the base out of the leading position.
+ * - A base that IS a type word or its abbreviation (`obj`, `arr`, `str`,
+ *   `array`, `number`, ...) taints every name that carries it as a segment, so
+ *   no base-preserving candidate can succeed. Dropping the type-coded base is
+ *   exactly the rename `no-hungarian` asks for.
+ */
+function baseDerivedNames(base) {
+    return [`${base}Hash`, `hashOf${capitalize(base)}`];
+}
 function generateUniqueName(base, taken) {
-    const candidate = `${base}Hash`;
+    const candidate = baseDerivedNames(base).find((name) => !(0, hungarianNaming_1.encodesTypeMarker)(name)) ??
+        BASE_FREE_HASH_NAME;
     if (!taken.has(candidate))
         return candidate;
+    // A numeric suffix disambiguates without reopening the naming question: it
+    // adds no word boundary, so it cannot turn an accepted name into a marker.
     let i = 2;
     while (taken.has(`${candidate}${i}`)) {
         i++;
@@ -126,6 +162,96 @@ function findInsertionPoint(node) {
     }
     return null;
 }
+/**
+ * Whether an optional link sits at or below `expr` on its member/call spine,
+ * making everything further right in the chain unreachable when that link is
+ * nullish. `a?.b.run(x)` short-circuits at `a?.b`, so the optional flag the
+ * check needs is not the outer call's own.
+ */
+function hasOptionalLink(expr) {
+    let current = expr;
+    while (current) {
+        switch (current.type) {
+            case utils_1.AST_NODE_TYPES.MemberExpression:
+                if (current.optional)
+                    return true;
+                current = current.object;
+                break;
+            case utils_1.AST_NODE_TYPES.CallExpression:
+                if (current.optional)
+                    return true;
+                current = current.callee;
+                break;
+            case utils_1.AST_NODE_TYPES.ChainExpression:
+            case utils_1.AST_NODE_TYPES.TSNonNullExpression:
+                current = current.expression;
+                break;
+            default:
+                return false;
+        }
+    }
+    return false;
+}
+/**
+ * Whether `child` sits in a position of `parent` that control flow may skip.
+ * Positions evaluated regardless of the branch taken — an `if` test, a `&&`
+ * left operand, a `switch` discriminant, a `do` body, an optional chain's
+ * object spine — are excluded, since hoisting above them preserves evaluation.
+ */
+function isSkippableBranch(child, parent) {
+    switch (parent.type) {
+        case utils_1.AST_NODE_TYPES.IfStatement:
+        case utils_1.AST_NODE_TYPES.ConditionalExpression:
+            return parent.consequent === child || parent.alternate === child;
+        case utils_1.AST_NODE_TYPES.LogicalExpression:
+            return parent.right === child;
+        case utils_1.AST_NODE_TYPES.SwitchStatement:
+            return parent.discriminant !== child;
+        // A case's test and body are both reached only once the switch selects it.
+        case utils_1.AST_NODE_TYPES.SwitchCase:
+            return true;
+        // A loop body may run zero times; a `do` body always runs once, so it is
+        // not listed here.
+        case utils_1.AST_NODE_TYPES.WhileStatement:
+        case utils_1.AST_NODE_TYPES.ForStatement:
+        case utils_1.AST_NODE_TYPES.ForInStatement:
+        case utils_1.AST_NODE_TYPES.ForOfStatement:
+            return parent.body === child;
+        // Arguments and computed keys of an optional chain go unevaluated when the
+        // chain short-circuits, so they guard their subtree exactly as an `if` does.
+        case utils_1.AST_NODE_TYPES.MemberExpression:
+            return parent.object !== child && hasOptionalLink(parent);
+        case utils_1.AST_NODE_TYPES.CallExpression:
+            return parent.callee !== child && hasOptionalLink(parent);
+        default:
+            return false;
+    }
+}
+/**
+ * Whether the climb from the hook call to the insertion statement escapes a
+ * position that control flow may skip. A guard that wraps the hook without a
+ * block of its own gives the climb no in-branch statement position, so the memo
+ * lands above the guard while its dependency array `[<base>]` dereferences the
+ * guarded value on every render — turning code that does not throw into code
+ * that does. The dereference was safe only because of the surrounding
+ * narrowing, which the hoisted position no longer enjoys, so the fix is
+ * withheld and the report stands alone. A braced guard needs no bail: the
+ * insertion block is then the guarded block itself.
+ */
+function crossesConditionalGuard(node, insertion) {
+    let current = node;
+    while (current !== insertion.statement) {
+        const parent = current.parent;
+        // An insertion statement absent from the hook's ancestor chain contradicts
+        // how it was derived; decline rather than guess at the geometry.
+        if (!parent)
+            return true;
+        if (isSkippableBranch(current, parent))
+            return true;
+        current = parent;
+    }
+    return false;
+}
 /**
  * Collects the identifiers a hoisted `stableHash(<base>)` expression would
  * read: the root object of the member chain plus any computed keys. Property
@@ -496,6 +622,8 @@ exports.noArrayLengthInDeps = (0, createRule_1.createRule)({
                         const insertion = findInsertionPoint(node);
                         if (!insertion)
                             return null;
+                        if (crossesConditionalGuard(node, insertion))
+                            return null;
                         for (const { member } of lengthDeps) {
                             if (!isBaseSafeToHoist(context, getBaseExpression(member), insertion)) {
                                 return null;

package/lib/rules/no-entire-object-hook-deps.js

@@ -11,6 +11,16 @@ const HOOK_NAMES = new Set(['useEffect', 'useCallback', 'useMemo']);
  * — see `callsCorrespondingSetter`.
  */
 const EFFECT_HOOK_NAMES = new Set(['useEffect']);
+/**
+ * Hooks that do not run their callback: they hand it back as a value, so the
+ * body executes only if — and when — the consumer invokes it.
+ *
+ * why: the dependency array is evaluated on every render, while such a body may
+ * never run at all, or run only once the data it reads has arrived. A path the
+ * body dereferences is therefore not licensed to appear in the array; see
+ * `collectGuardedPaths`.
+ */
+const DEFERRED_BODY_HOOK_NAMES = new Set(['useCallback']);
 function isHookCall(node) {
     const callee = node.callee;
     return (callee.type === utils_1.AST_NODE_TYPES.Identifier && HOOK_NAMES.has(callee.name));
@@ -20,6 +30,11 @@ function isEffectHookCall(node) {
     return (callee.type === utils_1.AST_NODE_TYPES.Identifier &&
         EFFECT_HOOK_NAMES.has(callee.name));
 }
+function isDeferredBodyHookCall(node) {
+    const callee = node.callee;
+    return (callee.type === utils_1.AST_NODE_TYPES.Identifier &&
+        DEFERRED_BODY_HOOK_NAMES.has(callee.name));
+}
 /**
  * The rule whose suppression marks a dependency array as hand-maintained.
  */
@@ -236,8 +251,8 @@ function isCallCallee(node) {
         parent.callee === current);
 }
 /**
- * Renders `node`'s access path when the chain is rooted at `objectName`, or
- * null when it is rooted elsewhere or holds a link with no stable rendering.
+ * The links of `node`'s access path when the chain is rooted at `objectName`,
+ * or null when it is rooted elsewhere or holds a link with no stable rendering.
  *
  * why: guard collection asks a different question than `buildAccessPath` —
  * "which value did this condition establish something about?" rather than
@@ -245,7 +260,7 @@ function isCallCallee(node) {
  * function's narrowing policy (method carve-outs, whole-object escalation) nor
  * its side effects on the usage set.
  */
-function renderMemberPathIfRootedAt(node, objectName) {
+function memberPathSegmentsIfRootedAt(node, objectName) {
     const segments = [];
     let current = node;
     while (current.type === utils_1.AST_NODE_TYPES.MemberExpression) {
@@ -284,7 +299,28 @@ function renderMemberPathIfRootedAt(node, objectName) {
         base.name !== objectName) {
         return null;
     }
-    return renderPathSegments(objectName, segments);
+    return segments;
+}
+function renderMemberPathIfRootedAt(node, objectName) {
+    const segments = memberPathSegmentsIfRootedAt(node, objectName);
+    return segments ? renderPathSegments(objectName, segments) : null;
+}
+/**
+ * How many links of `segments` a dependency array may evaluate on a render that
+ * never reaches the position the path was read in.
+ *
+ * why: the array already dereferences the dependency object, so its first link
+ * is as safe as the entry it replaces. Every further link dereferences a value
+ * whose existence only the skipped position established, unless it is spelled
+ * `?.` — an optional link short-circuits instead of throwing and so extends the
+ * prefix.
+ */
+function eagerlyReachableLength(segments) {
+    let length = 1;
+    while (length < segments.length && segments[length].optional) {
+        length += 1;
+    }
+    return length;
 }
 /**
  * Every path of `objectName` whose dereferenceability the hook body establishes
@@ -297,14 +333,23 @@ function renderMemberPathIfRootedAt(node, objectName) {
  * unconditional `TypeError`. The paths collected here mark where a path must
  * stop; see `safePrefixOf`.
  *
+ * A condition is not the only licence a body can hold. A `try`/`catch` swallows
+ * the very `TypeError` a deep dereference raises, and a body that runs later —
+ * an inner callback, the function a `useCallback` hands back — may not run at
+ * all on the render whose array is being evaluated. Neither licence travels
+ * into the array, so both stop a path exactly as a condition does.
+ *
  * The collection is deliberately over-broad — it accepts any member path
  * appearing anywhere in a condition, not only one that provably governs the
  * access. Over-collecting costs a coarser dependency (the memo recomputes more
  * often than strictly needed); under-collecting is the crash.
+ *
+ * `bodyIsDeferred` says the hook itself never runs the body it was handed.
  */
-function collectGuardedPaths(hookBody, objectName) {
+function collectGuardedPaths(hookBody, objectName, bodyIsDeferred) {
     const guarded = new Set();
     const visited = new Set();
+    const deferredVisited = new Set();
     function markConditionPaths(node) {
         if (!node)
             return;
@@ -324,6 +369,35 @@ function collectGuardedPaths(hookBody, objectName) {
         }
         forEachChildNode(node, markConditionPaths);
     }
+    /**
+     * Records where every path read inside a position the array cannot reach —
+     * a protected `try` block, a body that runs later — has to stop.
+     *
+     * Unlike a condition, such a position licenses the whole dereference chain
+     * rather than one link of it, so the stopping point is derived from the path
+     * itself: everything the array can evaluate on its own is kept, and the first
+     * link that would have to trust the skipped code ends it.
+     */
+    function markDeferredPaths(node) {
+        if (!node || deferredVisited.has(node))
+            return;
+        deferredVisited.add(node);
+        if (node.type === utils_1.AST_NODE_TYPES.MemberExpression) {
+            const segments = memberPathSegmentsIfRootedAt(node, objectName);
+            if (segments) {
+                const reachable = eagerlyReachableLength(segments);
+                if (reachable < segments.length) {
+                    guarded.add(renderPathSegments(objectName, segments.slice(0, reachable)));
+                }
+                // A computed key can still hold a read of its own.
+                if (node.computed) {
+                    markDeferredPaths(node.property);
+                }
+                return;
+            }
+        }
+        forEachChildNode(node, markDeferredPaths);
+    }
     function walk(node) {
         if (!node || visited.has(node))
             return;
@@ -367,8 +441,33 @@ function collectGuardedPaths(hookBody, objectName) {
                 markConditionPaths(asserted);
             }
         }
+        else if (node.type === utils_1.AST_NODE_TYPES.TryStatement) {
+            // A `catch` is a licence to dereference: the author writes the deep
+            // access knowing the TypeError it can raise is swallowed. The array
+            // evaluates the same access outside the `try`, where the throw is
+            // uncaught, so the path stops before the link the `catch` covers.
+            //
+            // The handler is what makes the difference: a `try`/`finally` with no
+            // handler re-raises, so its block reads like ordinary code. The handler's
+            // own body is deferred instead — it runs only if something threw.
+            if (node.handler) {
+                markDeferredPaths(node.block);
+                markDeferredPaths(node.handler.body);
+            }
+        }
+        else if (node.type === utils_1.AST_NODE_TYPES.ArrowFunctionExpression ||
+            node.type === utils_1.AST_NODE_TYPES.FunctionExpression ||
+            node.type === utils_1.AST_NODE_TYPES.FunctionDeclaration) {
+            // An inner callback runs on someone else's schedule — an event, a
+            // resolved promise, an iteration over an array that may be empty — so a
+            // path it reads says nothing about the render evaluating the array.
+            markDeferredPaths(node.body);
+        }
         forEachChildNode(node, walk);
     }
+    if (bodyIsDeferred) {
+        markDeferredPaths(hookBody);
+    }
     walk(hookBody);
     return guarded;
 }
@@ -421,14 +520,14 @@ function callsCorrespondingSetter(hookBody, dependencyName) {
     }
     return visit(hookBody);
 }
-function getObjectUsagesInHook(hookBody, objectName, typeInfo) {
+function getObjectUsagesInHook(hookBody, objectName, typeInfo, bodyIsDeferred = false) {
     const usages = new Map(); // Track usage and its position
     // why: derived dependency paths (first-optional intermediate, array base)
     // must be re-rendered from structured links — string surgery on the
     // rendered path cannot place `?.` markers correctly.
     const pathSegments = new Map();
     const visited = new Set();
-    const guardedPaths = collectGuardedPaths(hookBody, objectName);
+    const guardedPaths = collectGuardedPaths(hookBody, objectName, bodyIsDeferred);
     let needsEntireObject = false;
     let isUsed = false;
     /**
@@ -1060,6 +1159,7 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
                 }
                 const callbackBody = callbackArg.body;
                 const isEffect = isEffectHookCall(node);
+                const bodyIsDeferred = isDeferredBodyHookCall(node);
                 const manuallyManagedDeps = hasManuallyManagedDeps(node);
                 // Check each dependency in the array
                 depsArg.elements.forEach((element) => {
@@ -1077,7 +1177,7 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
                             }
                         }
                         // For testing without TypeScript services, we'll assume all identifiers are objects
-                        const result = getObjectUsagesInHook(callbackBody, objectName, dependencyTypeInfo);
+                        const result = getObjectUsagesInHook(callbackBody, objectName, dependencyTypeInfo, bodyIsDeferred);
                         // If the object is not used at all, suggest removing it
                         if (result.notUsed) {
                             // why: deleting an entry from an array the author maintains by