@ethlete/eslint-plugin 1.0.0-next.16 → 1.0.0-next.18

package/CHANGELOG.md

@@ -1,20 +1,36 @@
 # Changelog
 
+## 1.0.0-next.18
+
+### Minor Changes
+
+- [`6a7e76b`](https://github.com/ethlete-io/ethdk/commit/6a7e76b3535412ac3eefdabc1aecb98c2f26552f) Thanks [@TomTomB](https://github.com/TomTomB)! - New rule `no-legacy-prepare-without-injector`: a legacy query `prepare()` called from a deferred callback
+  must pass an `injector`, with a fixer that adds the member and threads it.
+
+## 1.0.0-next.17
+
+### Minor Changes
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`ae18442`](https://github.com/ethlete-io/ethdk/commit/ae18442bcbeaf0bc1b023812f4e507169db56c88) Thanks [@github-actions](https://github.com/apps/github-actions)! - New rule `no-impure-top-level-provider`: bans destructuring a factory call at module scope, and - with
+  `{ requirePureAnnotation: true }`, for publishable library source - requires `/* @__PURE__ */` on
+  module-scope calls. Both shapes are undroppable, so one of them puts everything the call touches into
+  every consumer's bundle. Fixable.
+
 ## 1.0.0-next.16
 
 ### Minor Changes
 
 - [#3037](https://github.com/ethlete-io/ethdk/pull/3037) [`19469c2`](https://github.com/ethlete-io/ethdk/commit/19469c21903217e05b974ac69773f222e63ae4e1) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add `no-effect-cleanup-return`: flags a cleanup function returned from `effect()` /
-  `afterRenderEffect()`, which Angular ignores — so the teardown silently never runs. Auto-fixes the
+  `afterRenderEffect()`, which Angular ignores - so the teardown silently never runs. Auto-fixes the
   mechanical case to the `onCleanup` parameter; otherwise points at `inject(DestroyRef).onDestroy()`.
 
 - [#3037](https://github.com/ethlete-io/ethdk/pull/3037) [`3151b7a`](https://github.com/ethlete-io/ethdk/commit/3151b7a253d14e38e22e20d67bf0191f141c144e) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add `ethlete/no-template-literal-before-inline-template`, and restructure the files it flagged.
 
-  The Angular VS Code extension decides **client-side** whether the cursor sits inside an inline `template:` before it forwards completion, hover, go-to-definition or signature-help to the language server. That check (`isNotTypescriptOrSupportedDecoratorField`) walks the file with a bare `ts.createScanner()` loop, which cannot re-scan `}` as `TemplateMiddle`/`TemplateTail` — that needs the parser's `reScanTemplateToken()`. So the first template literal containing a `${…}` substitution desynchronises both the token stream and the brace counter, the scanner never recognises `template` `:` again, and every template request below it is dropped. The language server answers those requests correctly; the editor just never asks, so the template silently has no IntelliSense at all.
+  The Angular VS Code extension decides **client-side** whether the cursor sits inside an inline `template:` before it forwards completion, hover, go-to-definition or signature-help to the language server. That check (`isNotTypescriptOrSupportedDecoratorField`) walks the file with a bare `ts.createScanner()` loop, which cannot re-scan `}` as `TemplateMiddle`/`TemplateTail` - that needs the parser's `reScanTemplateToken()`. So the first template literal containing a `${…}` substitution desynchronises both the token stream and the brace counter, the scanner never recognises `template` `:` again, and every template request below it is dropped. The language server answers those requests correctly; the editor just never asks, so the template silently has no IntelliSense at all.
 
-  The new rule reproduces that scanner verbatim, so it reports exactly the templates the extension would abandon — no heuristic. Twenty inline templates across `components`, `cdk` and the playground were affected, all of them behind a fixture or helper that happened to use an interpolated template literal. Story fixtures moved into sibling `*-storybook.data.ts` files; spec fixtures and in-class helpers that must stay above their component (because a later `@Component` references the class in `imports`) were rewritten without the interpolation.
+  The new rule reproduces that scanner verbatim, so it reports exactly the templates the extension would abandon - no heuristic. Twenty inline templates across `components`, `cdk` and the playground were affected, all of them behind a fixture or helper that happened to use an interpolated template literal. Story fixtures moved into sibling `*-storybook.data.ts` files; spec fixtures and in-class helpers that must stay above their component (because a later `@Component` references the class in `imports`) were rewritten without the interpolation.
 
-  No public API changed — the `components` and `cdk` bumps are story/spec restructuring plus moving `signalVisibilityChangeClasses` below `RichFilterHostComponent` in the same module.
+  No public API changed - the `components` and `cdk` bumps are story/spec restructuring plus moving `signalVisibilityChangeClasses` below `RichFilterHostComponent` in the same module.
 
 ## 1.0.0-next.15
 
@@ -28,13 +44,13 @@
 
 - [`423b30b`](https://github.com/ethlete-io/ethdk/commit/423b30ba4f368d7cee8c464ebd89b5df20d3934c) Thanks [@TomTomB](https://github.com/TomTomB)! - The `static` class member ban now excepts `ngTemplateContextGuard`, which Angular's template type checker requires to be static.
 
-- [`7ca77d4`](https://github.com/ethlete-io/ethdk/commit/7ca77d4a9e1dd3abad7237227c62643159719b74) Thanks [@TomTomB](https://github.com/TomTomB)! - `no-trivial-return-type`: self-referencing (recursive) functions keep their return type annotation — TypeScript cannot infer a return type that depends on itself (TS7023), so the fixer no longer strips it there.
+- [`7ca77d4`](https://github.com/ethlete-io/ethdk/commit/7ca77d4a9e1dd3abad7237227c62643159719b74) Thanks [@TomTomB](https://github.com/TomTomB)! - `no-trivial-return-type`: self-referencing (recursive) functions keep their return type annotation - TypeScript cannot infer a return type that depends on itself (TS7023), so the fixer no longer strips it there.
 
 ## 1.0.0-next.13
 
 ### Minor Changes
 
-- [#3022](https://github.com/ethlete-io/ethdk/pull/3022) [`5a43c83`](https://github.com/ethlete-io/ethdk/commit/5a43c8347a98a815562d1bb0f59bc0db1d765262) Thanks [@github-actions](https://github.com/apps/github-actions)! - Recommended config: the `@Injectable` ban now also flags Angular 22's `@Service` decorator — use `createProvider` / `createRootProvider` from `@ethlete/core` instead.
+- [#3022](https://github.com/ethlete-io/ethdk/pull/3022) [`5a43c83`](https://github.com/ethlete-io/ethdk/commit/5a43c8347a98a815562d1bb0f59bc0db1d765262) Thanks [@github-actions](https://github.com/apps/github-actions)! - Recommended config: the `@Injectable` ban now also flags Angular 22's `@Service` decorator - use `createProvider` / `createRootProvider` from `@ethlete/core` instead.
 
 - [#3022](https://github.com/ethlete-io/ethdk/pull/3022) [`9be3738`](https://github.com/ethlete-io/ethdk/commit/9be3738e18ef1837841c79131127fa42406a3e92) Thanks [@github-actions](https://github.com/apps/github-actions)! - New template rule `ethlete/prefer-static-boolean-properties` (in `recommendedTemplate` as `warn`): flags property bindings of static booleans like `[isReadonly]="true"` and suggests the static-attribute form (`isReadonly` / `isReadonly="false"`). Suggestion-only, since the rewrite is only safe for inputs with a `booleanAttribute` transform.
 
@@ -43,8 +59,8 @@
 ### Minor Changes
 
 - [`44adcac`](https://github.com/ethlete-io/ethdk/commit/44adcac94d7e0f56742e02901221c6e04da7df47) Thanks [@TomTomB](https://github.com/TomTomB)! - Add two component I/O naming rules:
-  - `no-native-html-input-name` (error) — flags an `input()`/`model()` named after a global HTML attribute (`title`, `id`, `hidden`, `role`, `tabindex`, …), which collides with the attribute the host element carries natively.
-  - `prefer-present-tense-output` (warn) — nudges `output()` names toward the present tense like native DOM events (`playerSelect`, not `playerSelected`).
+  - `no-native-html-input-name` (error) - flags an `input()`/`model()` named after a global HTML attribute (`title`, `id`, `hidden`, `role`, `tabindex`, …), which collides with the attribute the host element carries natively.
+  - `prefer-present-tense-output` (warn) - nudges `output()` names toward the present tense like native DOM events (`playerSelect`, not `playerSelected`).
 
   The `on`-prefix case is already covered by `@angular-eslint/no-output-on-prefix`, so no rule is added for it.
 
@@ -52,7 +68,7 @@
 
 ### Major Changes
 
-- [#3016](https://github.com/ethlete-io/ethdk/pull/3016) [`396bdfb`](https://github.com/ethlete-io/ethdk/commit/396bdfb50dc51d2de0156dd7b7cc0ae3b21dfe9b) Thanks [@github-actions](https://github.com/apps/github-actions)! - Remove the `no-public-property` rule. It contradicted `template-member-accessibility`, which requires an explicit `public` modifier on surface members — the explicit-public style is the intended one. The rule was never part of the `recommended` config; if you enabled `ethlete/no-public-property` manually, drop it from your ESLint config.
+- [#3016](https://github.com/ethlete-io/ethdk/pull/3016) [`396bdfb`](https://github.com/ethlete-io/ethdk/commit/396bdfb50dc51d2de0156dd7b7cc0ae3b21dfe9b) Thanks [@github-actions](https://github.com/apps/github-actions)! - Remove the `no-public-property` rule. It contradicted `template-member-accessibility`, which requires an explicit `public` modifier on surface members - the explicit-public style is the intended one. The rule was never part of the `recommended` config; if you enabled `ethlete/no-public-property` manually, drop it from your ESLint config.
 
 ## 0.1.0-next.10
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethlete/eslint-plugin",
-  "version": "1.0.0-next.16",
+  "version": "1.0.0-next.18",
   "license": "MIT",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/configs/recommended.js

@@ -170,12 +170,12 @@ const recommendedTs = {
         message:
           'No legacy Angular lifecycle hooks. Use afterNextRender, inject(DestroyRef).onDestroy, or constructor-based effects instead.',
       },
-      // No @Injectable / @Service — use createRootProvider / createProvider from @ethlete/core
+      // No @Injectable / @Service — use defineRootProvider / defineProvider from @ethlete/core
       {
         selector:
           'Decorator[expression.callee.name=/^(Injectable|Service)$/], Decorator[expression.name=/^(Injectable|Service)$/]',
         message:
-          'No @Injectable / @Service services. Use createRootProvider / createProvider from @ethlete/core instead.',
+          'No @Injectable / @Service services. Use defineRootProvider / defineProvider from @ethlete/core instead.',
       },
       // No route guards — handle access control inside the component itself
       {
@@ -247,6 +247,9 @@ const recommendedTs = {
     // Observable variables/properties must end with $
     'ethlete/require-dollar-suffix': 'error',
 
+    // Legacy query creator prepare() calls that run outside an injection context need an explicit injector
+    'ethlete/no-legacy-prepare-without-injector': 'error',
+
     // No .subscribe() inside a .pipe() callback
     'ethlete/no-subscribe-in-pipe': 'error',
 
@@ -295,6 +298,8 @@ const recommendedTs = {
     // No empty blank lines between import declarations
     'ethlete/no-empty-newlines-between-imports': 'error',
 
+    'ethlete/no-impure-top-level-provider': 'error',
+
     // No legacy Angular decorators — use signal-based APIs (input, output, viewChild, etc.)
     // and host: {} bindings (instead of @HostBinding / @HostListener)
     'ethlete/no-legacy-angular-decorators': 'error',

package/src/index.js

@@ -53,6 +53,8 @@ const noTypedInjectedElementRef = require('./rules/no-typed-injected-element-ref
 const noNativeHtmlInputName = require('./rules/no-native-html-input-name');
 const preferPresentTenseOutput = require('./rules/prefer-present-tense-output');
 const preferStaticBooleanProperties = require('./rules/prefer-static-boolean-properties');
+const noImpureTopLevelProvider = require('./rules/no-impure-top-level-provider');
+const noLegacyPrepareWithoutInjector = require('./rules/no-legacy-prepare-without-injector');
 const { recommendedTs, recommendedTemplate, recommendedSpec } = require('./configs/recommended');
 
 /** @type {import('eslint').ESLint.Plugin} */
@@ -63,6 +65,7 @@ const plugin = {
   },
   rules: {
     'no-inject-chain': noInjectChain,
+    'no-legacy-prepare-without-injector': noLegacyPrepareWithoutInjector,
     'no-trivial-return-type': noTrivialReturnType,
     'no-subscribe-in-pipe': noSubscribeInPipe,
     'no-rxjs-in-effect': noRxjsInEffect,
@@ -114,6 +117,7 @@ const plugin = {
     'no-native-html-input-name': noNativeHtmlInputName,
     'prefer-present-tense-output': preferPresentTenseOutput,
     'prefer-static-boolean-properties': preferStaticBooleanProperties,
+    'no-impure-top-level-provider': noImpureTopLevelProvider,
   },
 };
 

package/src/rules/no-impure-top-level-provider.js

@@ -0,0 +1,129 @@
+// @ts-check
+'use strict';
+
+const PURE_ANNOTATION = /^\s*[#@]__PURE__\s*$/;
+
+/**
+ * Angular's own app build already pure-annotates these at module scope
+ * (`pure-toplevel-functions`'s `sideEffectFreeConstructors`), so requiring it in source is noise.
+ */
+const AUTO_ANNOTATED_CONSTRUCTORS = new Set(['InjectionToken']);
+
+/** Nothing inside a function body runs on import, so it needs no annotation. */
+const NOT_EVALUATED_ON_IMPORT = new Set(['ArrowFunctionExpression', 'FunctionExpression', 'ClassExpression']);
+
+const isModuleScope = (declarator) => {
+  const declaration = declarator.parent;
+  const container = declaration?.parent;
+
+  if (container?.type === 'Program') return true;
+
+  return container?.type === 'ExportNamedDeclaration' && container.parent?.type === 'Program';
+};
+
+const hasPureAnnotation = (sourceCode, node) =>
+  sourceCode.getCommentsBefore(node).some((comment) => comment.type === 'Block' && PURE_ANNOTATION.test(comment.value));
+
+/** `f()`, `ns.f()` and `new X()` are nameable; an IIFE is not, and is left alone. */
+const calleeName = (node) => {
+  const callee = node.callee;
+
+  if (callee.type === 'Identifier') return callee.name;
+  if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') return callee.property.name;
+
+  return null;
+};
+
+/** Every call/`new` in an initializer that really is evaluated when the module is imported. */
+const collectImportTimeCalls = (root) => {
+  const found = [];
+
+  const visit = (node) => {
+    if (!node || typeof node.type !== 'string' || NOT_EVALUATED_ON_IMPORT.has(node.type)) return;
+
+    if (node.type === 'CallExpression' || node.type === 'NewExpression') found.push(node);
+
+    for (const key of Object.keys(node)) {
+      if (key === 'parent') continue;
+
+      const child = node[key];
+
+      if (Array.isArray(child)) child.forEach(visit);
+      else if (child && typeof child === 'object') visit(child);
+    }
+  };
+
+  visit(root);
+
+  return found;
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noImpureTopLevelProvider = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow module-scope destructuring of a factory call, and require a pure annotation on module-scope calls in library source.',
+    },
+    fixable: 'code',
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          requirePureAnnotation: {
+            type: 'boolean',
+            description:
+              'Also require `@__PURE__` on every call evaluated at module scope. Turn this on in publishable library source; it is pointless in application code, where every statement is retained anyway.',
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      noDestructuring:
+        'Do not destructure a factory call at module scope. Destructuring invokes the iterator protocol, so no bundler can drop the statement — everything the factory closes over ships to every consumer. Assign the result to one `const` and name each binding with its own annotated extractor (`toProvideFn` / `toInjectFn` / `toToken`).',
+      missingPure:
+        'This module-scope call to `{{name}}` needs a `/* @__PURE__ */` annotation, or the whole declaration is retained in every consumer bundle — one unannotated call anywhere in an initializer (including inside an argument or an object literal) is enough. If the call is genuinely not side-effect free at import time, move it inside a function instead of annotating it: library code must not do work on import.',
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const requirePureAnnotation = context.options[0]?.requirePureAnnotation === true;
+
+    return {
+      VariableDeclarator(node) {
+        if (!isModuleScope(node) || !node.init) return;
+
+        const initializer = node.init.type === 'TSAsExpression' ? node.init.expression : node.init;
+
+        if (
+          initializer.type === 'CallExpression' &&
+          (node.id.type === 'ArrayPattern' || node.id.type === 'ObjectPattern')
+        ) {
+          context.report({ node, messageId: 'noDestructuring' });
+
+          return;
+        }
+
+        if (!requirePureAnnotation || node.id.type !== 'Identifier') return;
+
+        for (const call of collectImportTimeCalls(initializer)) {
+          const name = calleeName(call);
+
+          if (name === null || hasPureAnnotation(sourceCode, call)) continue;
+          if (call.type === 'NewExpression' && AUTO_ANNOTATED_CONSTRUCTORS.has(name)) continue;
+
+          context.report({
+            node: call,
+            messageId: 'missingPure',
+            data: { name },
+            fix: (fixer) => fixer.insertTextBefore(call, '/* @__PURE__ */ '),
+          });
+        }
+      },
+    };
+  },
+};
+
+module.exports = noImpureTopLevelProvider;

package/src/rules/no-legacy-prepare-without-injector.js

@@ -0,0 +1,493 @@
+// @ts-check
+'use strict';
+
+/**
+ * Requires an explicit `injector` on a legacy query creator's `prepare()` call whenever the call runs
+ * outside the injection context that created it.
+ *
+ * The v2 client needed no injection context, so migrated call sites are full of callbacks that prepare a
+ * query long after their component was built - a `computed()` at a class field, an `effect()` in a
+ * constructor, an RxJS operator. Those throw `ET950` at runtime, and only on the code path that runs the
+ * callback, which is how they reach production.
+ *
+ * BAD — the callback runs once the field initializer's context is long gone:
+ *   users = computed(() => legacyGetUsers.prepare({ queryParams: { page: this.page() } })); // ❌ ET950
+ *
+ * GOOD:
+ *   private injector = inject(Injector);
+ *   users = computed(() => legacyGetUsers.prepare({ queryParams: { page: this.page() }, injector: this.injector }));
+ *
+ * Left alone: calls that really do run inside a context - directly in a constructor or field initializer,
+ * inside `runInInjectionContext()`, inside the `queryComputed` family, in a synchronous array callback
+ * (`items.map(…)`) that runs before its caller returns, or in a function that calls `inject()` itself and
+ * therefore can only be called from a context.
+ */
+
+/** Helpers that run their callback inside an injection context. */
+const CONTEXT_PROVIDING_CALLEES = new Set([
+  'runInInjectionContext',
+  'queryComputed',
+  'queryComputedTillTruthy',
+  'queryArrayComputed',
+]);
+
+/**
+ * Array methods, which call back synchronously in the caller's own context. Matched only on a property
+ * access (`items.map(…)`) - the bare-identifier form is an RxJS operator, whose callback runs later.
+ */
+const TRANSPARENT_ARRAY_METHODS = new Set([
+  'map',
+  'flatMap',
+  'filter',
+  'forEach',
+  'find',
+  'findLast',
+  'findIndex',
+  'some',
+  'every',
+  'reduce',
+  'reduceRight',
+  'sort',
+  'flat',
+]);
+
+/**
+ * @param {any} node
+ * @returns {boolean}
+ */
+const isFunctionNode = (node) =>
+  !!node &&
+  (node.type === 'ArrowFunctionExpression' ||
+    node.type === 'FunctionExpression' ||
+    node.type === 'FunctionDeclaration');
+
+/**
+ * The call a function literal is being passed to, if it is an argument rather than a value.
+ * @param {any} node
+ */
+const getCallbackHost = (node) => {
+  const parent = node.parent;
+
+  if (!parent || parent.type !== 'CallExpression' || !parent.arguments.includes(node)) {
+    return null;
+  }
+
+  return parent;
+};
+
+/**
+ * @param {any} host
+ * @returns {boolean}
+ */
+const isContextProvidingHost = (host) => {
+  if (!host) {
+    return false;
+  }
+
+  if (host.callee.type === 'Identifier') {
+    return CONTEXT_PROVIDING_CALLEES.has(host.callee.name);
+  }
+
+  return (
+    host.callee.type === 'MemberExpression' &&
+    host.callee.property.type === 'Identifier' &&
+    host.callee.property.name === 'runInContext'
+  );
+};
+
+/**
+ * @param {any} host
+ * @returns {boolean}
+ */
+const isTransparentHost = (host) =>
+  !!host &&
+  host.callee.type === 'MemberExpression' &&
+  host.callee.property.type === 'Identifier' &&
+  TRANSPARENT_ARRAY_METHODS.has(host.callee.property.name);
+
+/**
+ * Whether the function's own body calls `inject()`. Such a function can only be called from an injection
+ * context, so anything inside it has one too.
+ * @param {any} fn
+ * @returns {boolean}
+ */
+const callsInject = (fn) => {
+  let found = false;
+
+  /** @param {any} node */
+  const visit = (node) => {
+    if (found || !node || typeof node.type !== 'string') {
+      return;
+    }
+
+    if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && node.callee.name.startsWith('inject')) {
+      found = true;
+
+      return;
+    }
+
+    if (node !== fn && isFunctionNode(node)) {
+      return;
+    }
+
+    for (const key of Object.keys(node)) {
+      if (key === 'parent') {
+        continue;
+      }
+
+      const value = node[key];
+
+      if (Array.isArray(value)) {
+        value.forEach(visit);
+      } else if (value && typeof value.type === 'string') {
+        visit(value);
+      }
+    }
+  };
+
+  visit(fn);
+
+  return found;
+};
+
+/**
+ * Whether the call needs an injector, decided by the **innermost** function boundary it sits behind - a
+ * callback defined in a constructor is not "in the constructor" by the time it runs.
+ * @param {any} node
+ * @returns {{ needsInjector: boolean; boundary: string }}
+ */
+const classifyCallSite = (node) => {
+  let current = node;
+
+  while (current) {
+    if (isFunctionNode(current)) {
+      const parent = current.parent;
+
+      if (parent?.type === 'MethodDefinition') {
+        return parent.kind === 'constructor'
+          ? { needsInjector: false, boundary: 'constructor' }
+          : { needsInjector: true, boundary: parent.kind === 'method' ? 'method' : `${parent.kind} accessor` };
+      }
+
+      const host = getCallbackHost(current);
+
+      if (isContextProvidingHost(host)) {
+        return { needsInjector: false, boundary: 'injection context' };
+      }
+
+      if (!isTransparentHost(host)) {
+        if (!host && callsInject(current)) {
+          return { needsInjector: false, boundary: 'function that injects' };
+        }
+
+        return {
+          needsInjector: true,
+          boundary: host?.callee.type === 'Identifier' ? `${host.callee.name}() callback` : 'callback',
+        };
+      }
+    }
+
+    if (current.type === 'PropertyDefinition') {
+      return { needsInjector: false, boundary: 'field initializer' };
+    }
+
+    current = current.parent;
+  }
+
+  return { needsInjector: true, boundary: 'call site' };
+};
+
+/**
+ * @param {any} node
+ * @returns {any}
+ */
+const findEnclosingClassBody = (node) => {
+  let current = node;
+
+  while (current) {
+    if (current.type === 'ClassBody') {
+      return current;
+    }
+
+    current = current.parent;
+  }
+
+  return null;
+};
+
+/**
+ * @param {any} node
+ * @returns {boolean}
+ */
+const isInjectInjectorCall = (node) =>
+  !!node &&
+  node.type === 'CallExpression' &&
+  node.callee.type === 'Identifier' &&
+  node.callee.name === 'inject' &&
+  node.arguments[0]?.type === 'Identifier' &&
+  node.arguments[0].name === 'Injector';
+
+/**
+ * @param {any} classBody
+ * @returns {string | null}
+ */
+const findInjectorMemberName = (classBody) => {
+  for (const member of classBody.body) {
+    if (
+      member.type === 'PropertyDefinition' &&
+      isInjectInjectorCall(member.value) &&
+      member.key.type === 'Identifier'
+    ) {
+      return member.key.name;
+    }
+  }
+
+  return null;
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noLegacyPrepareWithoutInjector = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Require an explicit injector on legacy query creator prepare() calls that run outside an injection context.',
+      recommended: true,
+    },
+    messages: {
+      missingInjector:
+        '{{creator}}.prepare() runs from a {{boundary}}, outside the injection context that created it, so it ' +
+        'needs an explicit injector - without one it throws ET950 the first time that code path runs. Capture an ' +
+        'injector where a context does exist and pass it: {{creator}}.prepare({ …, injector: this.injector }).',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          creatorPattern: { type: 'string' },
+        },
+        additionalProperties: false,
+      },
+    ],
+    fixable: 'code',
+  },
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const creatorPattern = new RegExp(context.options[0]?.creatorPattern ?? '^legacy');
+    /** Names known to be legacy creators: imported under the naming convention, or declared locally. */
+    const creatorNames = new Set();
+
+    /**
+     * @param {any} classBody
+     * @param {string} injectorName
+     */
+    const buildInjectorMemberFix = (classBody, injectorName) => {
+      const firstMember = classBody.body[0];
+      const indentation = ' '.repeat(firstMember ? firstMember.loc.start.column : 2);
+      const declaration = `private ${injectorName} = inject(Injector);`;
+
+      return firstMember
+        ? /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(firstMember, `${declaration}\n\n${indentation}`)
+        : /** @param {any} fixer */ (fixer) => fixer.replaceText(classBody, `{\n${indentation}${declaration}\n}`);
+    };
+
+    /**
+     * Adds the missing `inject` / `Injector` specifiers to an existing `@angular/core` import, or writes a
+     * new import. Returns `null` when the shape is one a fixer should not touch (a namespace import).
+     * @param {string[]} needed
+     */
+    const buildCoreImportFix = (needed) => {
+      const coreImport = /** @type {any} */ (
+        sourceCode.ast.body.find(
+          (node) =>
+            node.type === 'ImportDeclaration' &&
+            node.source.type === 'Literal' &&
+            node.source.value === '@angular/core',
+        )
+      );
+
+      if (!coreImport) {
+        const imports = sourceCode.ast.body.filter((node) => node.type === 'ImportDeclaration');
+        const lastImport = imports[imports.length - 1];
+        const text = `import { ${needed.join(', ')} } from '@angular/core';`;
+
+        return lastImport
+          ? /** @param {any} fixer */ (fixer) => fixer.insertTextAfter(lastImport, `\n${text}`)
+          : /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(sourceCode.ast.body[0], `${text}\n\n`);
+      }
+
+      const specifiers = coreImport.specifiers ?? [];
+
+      if (specifiers.some(/** @param {any} specifier */ (specifier) => specifier.type !== 'ImportSpecifier')) {
+        return null;
+      }
+
+      const existing = new Set(specifiers.map(/** @param {any} specifier */ (specifier) => specifier.imported.name));
+      const missing = needed.filter((name) => !existing.has(name));
+      const lastSpecifier = specifiers[specifiers.length - 1];
+
+      if (missing.length === 0 || !lastSpecifier) {
+        return null;
+      }
+
+      return /** @param {any} fixer */ (fixer) => fixer.insertTextAfter(lastSpecifier, `, ${missing.join(', ')}`);
+    };
+
+    /**
+     * @param {any} callNode
+     * @param {string} injectorReference
+     */
+    const buildArgumentFix = (callNode, injectorReference) => {
+      const argument = callNode.arguments[0];
+      const injectorProperty = `injector: ${injectorReference}`;
+
+      if (!argument) {
+        const closingParen = sourceCode.getLastToken(callNode);
+
+        return closingParen
+          ? /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(closingParen, `{ ${injectorProperty} }`)
+          : null;
+      }
+
+      if (argument.type === 'ObjectExpression') {
+        const lastProperty = argument.properties[argument.properties.length - 1];
+
+        if (!lastProperty) {
+          return /** @param {any} fixer */ (fixer) => fixer.replaceText(argument, `{ ${injectorProperty} }`);
+        }
+
+        const isMultiline = argument.loc.start.line !== argument.loc.end.line;
+        const tokenAfter = sourceCode.getTokenAfter(lastProperty);
+        const hasTrailingComma = tokenAfter?.type === 'Punctuator' && tokenAfter.value === ',';
+        const indentation = isMultiline ? `\n${' '.repeat(lastProperty.loc.start.column)}` : ' ';
+
+        return /** @param {any} fixer */ (fixer) =>
+          fixer.insertTextAfter(
+            hasTrailingComma ? tokenAfter : lastProperty,
+            `${hasTrailingComma ? '' : ','}${indentation}${injectorProperty}${isMultiline ? ',' : ''}`,
+          );
+      }
+
+      // `prepare(args)` - spreading is the only way to keep whatever the variable holds.
+      if (argument.type === 'Identifier' || argument.type === 'MemberExpression') {
+        return /** @param {any} fixer */ (fixer) =>
+          fixer.replaceText(argument, `{ ...${sourceCode.getText(argument)}, ${injectorProperty} }`);
+      }
+
+      return null;
+    };
+
+    return {
+      // Collected up front rather than in an `ImportDeclaration` visitor: a class can sit above the
+      // `export const legacyX = createLegacyQueryCreator(…)` it uses.
+      Program(program) {
+        /** @param {any} node */
+        const visit = (node) => {
+          if (!node || typeof node.type !== 'string') {
+            return;
+          }
+
+          if (node.type === 'ImportDeclaration') {
+            node.specifiers.forEach(
+              /** @param {any} specifier */ (specifier) => {
+                if (specifier.type === 'ImportSpecifier' && creatorPattern.test(specifier.local.name)) {
+                  creatorNames.add(specifier.local.name);
+                }
+              },
+            );
+          }
+
+          if (
+            node.type === 'VariableDeclarator' &&
+            node.id.type === 'Identifier' &&
+            node.init?.type === 'CallExpression' &&
+            node.init.callee.type === 'Identifier' &&
+            node.init.callee.name === 'createLegacyQueryCreator'
+          ) {
+            creatorNames.add(node.id.name);
+          }
+
+          for (const key of Object.keys(node)) {
+            if (key === 'parent') {
+              continue;
+            }
+
+            const value = node[key];
+
+            if (Array.isArray(value)) {
+              value.forEach(visit);
+            } else if (value && typeof value.type === 'string') {
+              visit(value);
+            }
+          }
+        };
+
+        visit(program);
+      },
+      CallExpression(node) {
+        const callee = /** @type {any} */ (node.callee);
+
+        if (
+          callee.type !== 'MemberExpression' ||
+          callee.property.type !== 'Identifier' ||
+          callee.property.name !== 'prepare' ||
+          callee.object.type !== 'Identifier' ||
+          !creatorNames.has(callee.object.name)
+        ) {
+          return;
+        }
+
+        const firstArgument = /** @type {any} */ (node.arguments[0]);
+        const hasInjector =
+          firstArgument?.type === 'ObjectExpression' &&
+          firstArgument.properties.some(
+            /** @param {any} property */ (property) =>
+              property.type === 'Property' && property.key.type === 'Identifier' && property.key.name === 'injector',
+          );
+
+        if (hasInjector) {
+          return;
+        }
+
+        const { needsInjector, boundary } = classifyCallSite(node);
+
+        if (!needsInjector) {
+          return;
+        }
+
+        const classBody = findEnclosingClassBody(node);
+        const existingInjector = classBody ? findInjectorMemberName(classBody) : null;
+        const injectorName = existingInjector ?? 'injector';
+        const argumentFix = classBody ? buildArgumentFix(node, `this.${injectorName}`) : null;
+
+        context.report({
+          node,
+          messageId: 'missingInjector',
+          data: { creator: callee.object.name, boundary },
+          // Only the in-class shape is auto-fixed: a standalone function has no obvious injector to reach
+          // for, and inventing an `inject()` call there would move the failure rather than fix it.
+          fix:
+            classBody && argumentFix
+              ? (fixer) => {
+                  const fixes = [argumentFix(fixer)];
+
+                  if (!existingInjector) {
+                    fixes.push(buildInjectorMemberFix(classBody, injectorName)(fixer));
+
+                    const importFix = buildCoreImportFix(['inject', 'Injector']);
+
+                    if (importFix) {
+                      fixes.push(importFix(fixer));
+                    }
+                  }
+
+                  return fixes;
+                }
+              : null,
+        });
+      },
+    };
+  },
+};
+
+module.exports = noLegacyPrepareWithoutInjector;