@ethlete/eslint-plugin 1.0.0-next.17 → 1.0.0-next.19

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.0.0-next.19
+
+### Minor Changes
+
+- [#3055](https://github.com/ethlete-io/ethdk/pull/3055) [`2fcb8e3`](https://github.com/ethlete-io/ethdk/commit/2fcb8e3799169956571534b75fdc152acc983877) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add `require-form-submit` (a form handles its own submission, a submit control reaches a form) plus the opt-in `no-cdk-import` and `no-legacy-query-import`, which name each legacy symbol's successor in the message.
+
+## 1.0.0-next.18
+
+### Minor Changes
+
+- [`6a7e76b`](https://github.com/ethlete-io/ethdk/commit/6a7e76b3535412ac3eefdabc1aecb98c2f26552f) Thanks [@TomTomB](https://github.com/TomTomB)! - New rule `no-legacy-prepare-without-injector`: a legacy query `prepare()` called from a deferred callback
+  must pass an `injector`, with a fixer that adds the member and threads it.
+
 ## 1.0.0-next.17
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethlete/eslint-plugin",
-  "version": "1.0.0-next.17",
+  "version": "1.0.0-next.19",
   "license": "MIT",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/configs/recommended.js

@@ -247,6 +247,9 @@ const recommendedTs = {
     // Observable variables/properties must end with $
     'ethlete/require-dollar-suffix': 'error',
 
+    // Legacy query creator prepare() calls that run outside an injection context need an explicit injector
+    'ethlete/no-legacy-prepare-without-injector': 'error',
+
     // No .subscribe() inside a .pipe() callback
     'ethlete/no-subscribe-in-pipe': 'error',
 
@@ -419,6 +422,8 @@ const recommendedTemplate = {
     // (warn + suggestion-only: the rewrite is only safe when the input has a booleanAttribute transform,
     // which a template rule cannot verify)
     'ethlete/prefer-static-boolean-properties': 'warn',
+    // A form must handle its own submission, and a type="submit" control must reach a form
+    'ethlete/require-form-submit': 'error',
   },
 };
 

package/src/index.js

@@ -54,6 +54,10 @@ const noNativeHtmlInputName = require('./rules/no-native-html-input-name');
 const preferPresentTenseOutput = require('./rules/prefer-present-tense-output');
 const preferStaticBooleanProperties = require('./rules/prefer-static-boolean-properties');
 const noImpureTopLevelProvider = require('./rules/no-impure-top-level-provider');
+const noLegacyPrepareWithoutInjector = require('./rules/no-legacy-prepare-without-injector');
+const requireFormSubmit = require('./rules/require-form-submit');
+const noCdkImport = require('./rules/no-cdk-import');
+const noLegacyQueryImport = require('./rules/no-legacy-query-import');
 const { recommendedTs, recommendedTemplate, recommendedSpec } = require('./configs/recommended');
 
 /** @type {import('eslint').ESLint.Plugin} */
@@ -64,6 +68,7 @@ const plugin = {
   },
   rules: {
     'no-inject-chain': noInjectChain,
+    'no-legacy-prepare-without-injector': noLegacyPrepareWithoutInjector,
     'no-trivial-return-type': noTrivialReturnType,
     'no-subscribe-in-pipe': noSubscribeInPipe,
     'no-rxjs-in-effect': noRxjsInEffect,
@@ -116,6 +121,9 @@ const plugin = {
     'prefer-present-tense-output': preferPresentTenseOutput,
     'prefer-static-boolean-properties': preferStaticBooleanProperties,
     'no-impure-top-level-provider': noImpureTopLevelProvider,
+    'require-form-submit': requireFormSubmit,
+    'no-cdk-import': noCdkImport,
+    'no-legacy-query-import': noLegacyQueryImport,
   },
 };
 

package/src/rules/no-cdk-import.js

@@ -0,0 +1,154 @@
+// @ts-check
+'use strict';
+
+const { createRequire } = require('node:module');
+const path = require('node:path');
+const fs = require('node:fs');
+
+/**
+ * Disallows importing from `@ethlete/cdk`, the maintenance-mode predecessor of `@ethlete/components`,
+ * and names the successor of each imported symbol in the message.
+ *
+ *   import { ButtonComponent } from '@ethlete/cdk';
+ *   → `ButtonComponent` is legacy @ethlete/cdk. Use `ButtonComponent` from @ethlete/components
+ *     (https://…/components/button): a real button system - variant, size and color inputs plus
+ *     theming instead of CSS-only classes.
+ *
+ * The successors come from `migration-map.json`, which ships inside the `@ethlete/cdk` package - so
+ * the advice is always the installed version's, and this rule holds no copy of it. Without the map on
+ * disk the rule still reports, pointing at the migration guide instead of a specific symbol.
+ *
+ * Off by default: it is only useful once an app has decided to leave the cdk behind.
+ */
+
+const CDK_PACKAGE = '@ethlete/cdk';
+const MIGRATION_MAP = '@ethlete/cdk/migration-map.json';
+const DEFAULT_DOCS_BASE_URL = 'https://ethlete-sdk-docs.web.app';
+
+/** @type {Map<string, Record<string, { kind: string, to?: string, package?: string, docs?: string, note?: string }> | null>} */
+const mapCache = new Map();
+
+/**
+ * @param {string | undefined} mapPath
+ * @param {string} cwd
+ */
+const loadMigrationMap = (mapPath, cwd) => {
+  const cacheKey = mapPath ? path.resolve(cwd, mapPath) : MIGRATION_MAP;
+
+  if (mapCache.has(cacheKey)) return mapCache.get(cacheKey) ?? null;
+
+  let map;
+
+  try {
+    map = mapPath
+      ? JSON.parse(fs.readFileSync(cacheKey, 'utf8'))
+      : createRequire(path.join(cwd, 'noop.js'))(MIGRATION_MAP);
+  } catch {
+    map = null;
+  }
+
+  mapCache.set(cacheKey, map);
+
+  return map;
+};
+
+/** @param {any} specifier */
+const importedName = (specifier) => {
+  if (specifier.type !== 'ImportSpecifier') return null;
+
+  return specifier.imported.name ?? specifier.imported.value ?? null;
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noCdkImport = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description: 'Disallow importing from the maintenance-mode @ethlete/cdk; name the @ethlete/components successor.',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          /** Where to read the migration map from, when `@ethlete/cdk` is not resolvable from the linted project. */
+          migrationMapPath: { type: 'string' },
+          /** Base URL the migration map's doc paths are appended to. */
+          docsBaseUrl: { type: 'string' },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      successor: '`{{ name }}` is legacy {{ cdk }}. Use `{{ to }}` from {{ package }} instead ({{ docs }}).{{ note }}',
+      noSuccessor: '`{{ name }}` is legacy {{ cdk }} and has no successor{{ note }} - see {{ docs }}.',
+      unmapped: '`{{ name }}` is legacy {{ cdk }}. Move it to @ethlete/components - see {{ docs }}.',
+      module: 'Do not depend on the legacy {{ cdk }} - move to @ethlete/components, see {{ docs }}.',
+    },
+  },
+  create(context) {
+    const options = context.options[0] ?? {};
+    const docsBaseUrl = (options.docsBaseUrl ?? DEFAULT_DOCS_BASE_URL).replace(/\/$/, '');
+    const migrationDocs = `${docsBaseUrl}/cdk/migration`;
+    const map = loadMigrationMap(options.migrationMapPath, context.cwd);
+
+    /** @param {string} name */
+    const entryFor = (name) => map?.[name] ?? null;
+
+    return {
+      ImportDeclaration(node) {
+        const declaration = /** @type {any} */ (node);
+        const source = declaration.source.value;
+
+        if (typeof source !== 'string' || (source !== CDK_PACKAGE && !source.startsWith(`${CDK_PACKAGE}/`))) return;
+
+        const named = declaration.specifiers.filter(/** @param {any} s */ (s) => importedName(s));
+
+        if (!named.length) {
+          context.report({ node, messageId: 'module', data: { cdk: CDK_PACKAGE, docs: migrationDocs } });
+
+          return;
+        }
+
+        for (const specifier of named) {
+          const name = /** @type {string} */ (importedName(specifier));
+          const entry = entryFor(name);
+
+          if (!entry) {
+            context.report({
+              node: specifier,
+              messageId: 'unmapped',
+              data: { name, cdk: CDK_PACKAGE, docs: migrationDocs },
+            });
+
+            continue;
+          }
+
+          if (!entry.to) {
+            context.report({
+              node: specifier,
+              messageId: 'noSuccessor',
+              data: { name, cdk: CDK_PACKAGE, note: entry.note ? ` (${entry.note})` : '', docs: migrationDocs },
+            });
+
+            continue;
+          }
+
+          context.report({
+            node: specifier,
+            messageId: 'successor',
+            data: {
+              name,
+              cdk: CDK_PACKAGE,
+              to: entry.to,
+              package: entry.package ?? '@ethlete/components',
+              docs: entry.docs ? `${docsBaseUrl}${entry.docs}` : migrationDocs,
+              note: entry.note ? ` ${entry.note}.` : '',
+            },
+          });
+        }
+      },
+    };
+  },
+};
+
+module.exports = noCdkImport;

package/src/rules/no-legacy-prepare-without-injector.js

@@ -0,0 +1,493 @@
+// @ts-check
+'use strict';
+
+/**
+ * Requires an explicit `injector` on a legacy query creator's `prepare()` call whenever the call runs
+ * outside the injection context that created it.
+ *
+ * The v2 client needed no injection context, so migrated call sites are full of callbacks that prepare a
+ * query long after their component was built - a `computed()` at a class field, an `effect()` in a
+ * constructor, an RxJS operator. Those throw `ET950` at runtime, and only on the code path that runs the
+ * callback, which is how they reach production.
+ *
+ * BAD — the callback runs once the field initializer's context is long gone:
+ *   users = computed(() => legacyGetUsers.prepare({ queryParams: { page: this.page() } })); // ❌ ET950
+ *
+ * GOOD:
+ *   private injector = inject(Injector);
+ *   users = computed(() => legacyGetUsers.prepare({ queryParams: { page: this.page() }, injector: this.injector }));
+ *
+ * Left alone: calls that really do run inside a context - directly in a constructor or field initializer,
+ * inside `runInInjectionContext()`, inside the `queryComputed` family, in a synchronous array callback
+ * (`items.map(…)`) that runs before its caller returns, or in a function that calls `inject()` itself and
+ * therefore can only be called from a context.
+ */
+
+/** Helpers that run their callback inside an injection context. */
+const CONTEXT_PROVIDING_CALLEES = new Set([
+  'runInInjectionContext',
+  'queryComputed',
+  'queryComputedTillTruthy',
+  'queryArrayComputed',
+]);
+
+/**
+ * Array methods, which call back synchronously in the caller's own context. Matched only on a property
+ * access (`items.map(…)`) - the bare-identifier form is an RxJS operator, whose callback runs later.
+ */
+const TRANSPARENT_ARRAY_METHODS = new Set([
+  'map',
+  'flatMap',
+  'filter',
+  'forEach',
+  'find',
+  'findLast',
+  'findIndex',
+  'some',
+  'every',
+  'reduce',
+  'reduceRight',
+  'sort',
+  'flat',
+]);
+
+/**
+ * @param {any} node
+ * @returns {boolean}
+ */
+const isFunctionNode = (node) =>
+  !!node &&
+  (node.type === 'ArrowFunctionExpression' ||
+    node.type === 'FunctionExpression' ||
+    node.type === 'FunctionDeclaration');
+
+/**
+ * The call a function literal is being passed to, if it is an argument rather than a value.
+ * @param {any} node
+ */
+const getCallbackHost = (node) => {
+  const parent = node.parent;
+
+  if (!parent || parent.type !== 'CallExpression' || !parent.arguments.includes(node)) {
+    return null;
+  }
+
+  return parent;
+};
+
+/**
+ * @param {any} host
+ * @returns {boolean}
+ */
+const isContextProvidingHost = (host) => {
+  if (!host) {
+    return false;
+  }
+
+  if (host.callee.type === 'Identifier') {
+    return CONTEXT_PROVIDING_CALLEES.has(host.callee.name);
+  }
+
+  return (
+    host.callee.type === 'MemberExpression' &&
+    host.callee.property.type === 'Identifier' &&
+    host.callee.property.name === 'runInContext'
+  );
+};
+
+/**
+ * @param {any} host
+ * @returns {boolean}
+ */
+const isTransparentHost = (host) =>
+  !!host &&
+  host.callee.type === 'MemberExpression' &&
+  host.callee.property.type === 'Identifier' &&
+  TRANSPARENT_ARRAY_METHODS.has(host.callee.property.name);
+
+/**
+ * Whether the function's own body calls `inject()`. Such a function can only be called from an injection
+ * context, so anything inside it has one too.
+ * @param {any} fn
+ * @returns {boolean}
+ */
+const callsInject = (fn) => {
+  let found = false;
+
+  /** @param {any} node */
+  const visit = (node) => {
+    if (found || !node || typeof node.type !== 'string') {
+      return;
+    }
+
+    if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && node.callee.name.startsWith('inject')) {
+      found = true;
+
+      return;
+    }
+
+    if (node !== fn && isFunctionNode(node)) {
+      return;
+    }
+
+    for (const key of Object.keys(node)) {
+      if (key === 'parent') {
+        continue;
+      }
+
+      const value = node[key];
+
+      if (Array.isArray(value)) {
+        value.forEach(visit);
+      } else if (value && typeof value.type === 'string') {
+        visit(value);
+      }
+    }
+  };
+
+  visit(fn);
+
+  return found;
+};
+
+/**
+ * Whether the call needs an injector, decided by the **innermost** function boundary it sits behind - a
+ * callback defined in a constructor is not "in the constructor" by the time it runs.
+ * @param {any} node
+ * @returns {{ needsInjector: boolean; boundary: string }}
+ */
+const classifyCallSite = (node) => {
+  let current = node;
+
+  while (current) {
+    if (isFunctionNode(current)) {
+      const parent = current.parent;
+
+      if (parent?.type === 'MethodDefinition') {
+        return parent.kind === 'constructor'
+          ? { needsInjector: false, boundary: 'constructor' }
+          : { needsInjector: true, boundary: parent.kind === 'method' ? 'method' : `${parent.kind} accessor` };
+      }
+
+      const host = getCallbackHost(current);
+
+      if (isContextProvidingHost(host)) {
+        return { needsInjector: false, boundary: 'injection context' };
+      }
+
+      if (!isTransparentHost(host)) {
+        if (!host && callsInject(current)) {
+          return { needsInjector: false, boundary: 'function that injects' };
+        }
+
+        return {
+          needsInjector: true,
+          boundary: host?.callee.type === 'Identifier' ? `${host.callee.name}() callback` : 'callback',
+        };
+      }
+    }
+
+    if (current.type === 'PropertyDefinition') {
+      return { needsInjector: false, boundary: 'field initializer' };
+    }
+
+    current = current.parent;
+  }
+
+  return { needsInjector: true, boundary: 'call site' };
+};
+
+/**
+ * @param {any} node
+ * @returns {any}
+ */
+const findEnclosingClassBody = (node) => {
+  let current = node;
+
+  while (current) {
+    if (current.type === 'ClassBody') {
+      return current;
+    }
+
+    current = current.parent;
+  }
+
+  return null;
+};
+
+/**
+ * @param {any} node
+ * @returns {boolean}
+ */
+const isInjectInjectorCall = (node) =>
+  !!node &&
+  node.type === 'CallExpression' &&
+  node.callee.type === 'Identifier' &&
+  node.callee.name === 'inject' &&
+  node.arguments[0]?.type === 'Identifier' &&
+  node.arguments[0].name === 'Injector';
+
+/**
+ * @param {any} classBody
+ * @returns {string | null}
+ */
+const findInjectorMemberName = (classBody) => {
+  for (const member of classBody.body) {
+    if (
+      member.type === 'PropertyDefinition' &&
+      isInjectInjectorCall(member.value) &&
+      member.key.type === 'Identifier'
+    ) {
+      return member.key.name;
+    }
+  }
+
+  return null;
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noLegacyPrepareWithoutInjector = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Require an explicit injector on legacy query creator prepare() calls that run outside an injection context.',
+      recommended: true,
+    },
+    messages: {
+      missingInjector:
+        '{{creator}}.prepare() runs from a {{boundary}}, outside the injection context that created it, so it ' +
+        'needs an explicit injector - without one it throws ET950 the first time that code path runs. Capture an ' +
+        'injector where a context does exist and pass it: {{creator}}.prepare({ …, injector: this.injector }).',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          creatorPattern: { type: 'string' },
+        },
+        additionalProperties: false,
+      },
+    ],
+    fixable: 'code',
+  },
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const creatorPattern = new RegExp(context.options[0]?.creatorPattern ?? '^legacy');
+    /** Names known to be legacy creators: imported under the naming convention, or declared locally. */
+    const creatorNames = new Set();
+
+    /**
+     * @param {any} classBody
+     * @param {string} injectorName
+     */
+    const buildInjectorMemberFix = (classBody, injectorName) => {
+      const firstMember = classBody.body[0];
+      const indentation = ' '.repeat(firstMember ? firstMember.loc.start.column : 2);
+      const declaration = `private ${injectorName} = inject(Injector);`;
+
+      return firstMember
+        ? /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(firstMember, `${declaration}\n\n${indentation}`)
+        : /** @param {any} fixer */ (fixer) => fixer.replaceText(classBody, `{\n${indentation}${declaration}\n}`);
+    };
+
+    /**
+     * Adds the missing `inject` / `Injector` specifiers to an existing `@angular/core` import, or writes a
+     * new import. Returns `null` when the shape is one a fixer should not touch (a namespace import).
+     * @param {string[]} needed
+     */
+    const buildCoreImportFix = (needed) => {
+      const coreImport = /** @type {any} */ (
+        sourceCode.ast.body.find(
+          (node) =>
+            node.type === 'ImportDeclaration' &&
+            node.source.type === 'Literal' &&
+            node.source.value === '@angular/core',
+        )
+      );
+
+      if (!coreImport) {
+        const imports = sourceCode.ast.body.filter((node) => node.type === 'ImportDeclaration');
+        const lastImport = imports[imports.length - 1];
+        const text = `import { ${needed.join(', ')} } from '@angular/core';`;
+
+        return lastImport
+          ? /** @param {any} fixer */ (fixer) => fixer.insertTextAfter(lastImport, `\n${text}`)
+          : /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(sourceCode.ast.body[0], `${text}\n\n`);
+      }
+
+      const specifiers = coreImport.specifiers ?? [];
+
+      if (specifiers.some(/** @param {any} specifier */ (specifier) => specifier.type !== 'ImportSpecifier')) {
+        return null;
+      }
+
+      const existing = new Set(specifiers.map(/** @param {any} specifier */ (specifier) => specifier.imported.name));
+      const missing = needed.filter((name) => !existing.has(name));
+      const lastSpecifier = specifiers[specifiers.length - 1];
+
+      if (missing.length === 0 || !lastSpecifier) {
+        return null;
+      }
+
+      return /** @param {any} fixer */ (fixer) => fixer.insertTextAfter(lastSpecifier, `, ${missing.join(', ')}`);
+    };
+
+    /**
+     * @param {any} callNode
+     * @param {string} injectorReference
+     */
+    const buildArgumentFix = (callNode, injectorReference) => {
+      const argument = callNode.arguments[0];
+      const injectorProperty = `injector: ${injectorReference}`;
+
+      if (!argument) {
+        const closingParen = sourceCode.getLastToken(callNode);
+
+        return closingParen
+          ? /** @param {any} fixer */ (fixer) => fixer.insertTextBefore(closingParen, `{ ${injectorProperty} }`)
+          : null;
+      }
+
+      if (argument.type === 'ObjectExpression') {
+        const lastProperty = argument.properties[argument.properties.length - 1];
+
+        if (!lastProperty) {
+          return /** @param {any} fixer */ (fixer) => fixer.replaceText(argument, `{ ${injectorProperty} }`);
+        }
+
+        const isMultiline = argument.loc.start.line !== argument.loc.end.line;
+        const tokenAfter = sourceCode.getTokenAfter(lastProperty);
+        const hasTrailingComma = tokenAfter?.type === 'Punctuator' && tokenAfter.value === ',';
+        const indentation = isMultiline ? `\n${' '.repeat(lastProperty.loc.start.column)}` : ' ';
+
+        return /** @param {any} fixer */ (fixer) =>
+          fixer.insertTextAfter(
+            hasTrailingComma ? tokenAfter : lastProperty,
+            `${hasTrailingComma ? '' : ','}${indentation}${injectorProperty}${isMultiline ? ',' : ''}`,
+          );
+      }
+
+      // `prepare(args)` - spreading is the only way to keep whatever the variable holds.
+      if (argument.type === 'Identifier' || argument.type === 'MemberExpression') {
+        return /** @param {any} fixer */ (fixer) =>
+          fixer.replaceText(argument, `{ ...${sourceCode.getText(argument)}, ${injectorProperty} }`);
+      }
+
+      return null;
+    };
+
+    return {
+      // Collected up front rather than in an `ImportDeclaration` visitor: a class can sit above the
+      // `export const legacyX = createLegacyQueryCreator(…)` it uses.
+      Program(program) {
+        /** @param {any} node */
+        const visit = (node) => {
+          if (!node || typeof node.type !== 'string') {
+            return;
+          }
+
+          if (node.type === 'ImportDeclaration') {
+            node.specifiers.forEach(
+              /** @param {any} specifier */ (specifier) => {
+                if (specifier.type === 'ImportSpecifier' && creatorPattern.test(specifier.local.name)) {
+                  creatorNames.add(specifier.local.name);
+                }
+              },
+            );
+          }
+
+          if (
+            node.type === 'VariableDeclarator' &&
+            node.id.type === 'Identifier' &&
+            node.init?.type === 'CallExpression' &&
+            node.init.callee.type === 'Identifier' &&
+            node.init.callee.name === 'createLegacyQueryCreator'
+          ) {
+            creatorNames.add(node.id.name);
+          }
+
+          for (const key of Object.keys(node)) {
+            if (key === 'parent') {
+              continue;
+            }
+
+            const value = node[key];
+
+            if (Array.isArray(value)) {
+              value.forEach(visit);
+            } else if (value && typeof value.type === 'string') {
+              visit(value);
+            }
+          }
+        };
+
+        visit(program);
+      },
+      CallExpression(node) {
+        const callee = /** @type {any} */ (node.callee);
+
+        if (
+          callee.type !== 'MemberExpression' ||
+          callee.property.type !== 'Identifier' ||
+          callee.property.name !== 'prepare' ||
+          callee.object.type !== 'Identifier' ||
+          !creatorNames.has(callee.object.name)
+        ) {
+          return;
+        }
+
+        const firstArgument = /** @type {any} */ (node.arguments[0]);
+        const hasInjector =
+          firstArgument?.type === 'ObjectExpression' &&
+          firstArgument.properties.some(
+            /** @param {any} property */ (property) =>
+              property.type === 'Property' && property.key.type === 'Identifier' && property.key.name === 'injector',
+          );
+
+        if (hasInjector) {
+          return;
+        }
+
+        const { needsInjector, boundary } = classifyCallSite(node);
+
+        if (!needsInjector) {
+          return;
+        }
+
+        const classBody = findEnclosingClassBody(node);
+        const existingInjector = classBody ? findInjectorMemberName(classBody) : null;
+        const injectorName = existingInjector ?? 'injector';
+        const argumentFix = classBody ? buildArgumentFix(node, `this.${injectorName}`) : null;
+
+        context.report({
+          node,
+          messageId: 'missingInjector',
+          data: { creator: callee.object.name, boundary },
+          // Only the in-class shape is auto-fixed: a standalone function has no obvious injector to reach
+          // for, and inventing an `inject()` call there would move the failure rather than fix it.
+          fix:
+            classBody && argumentFix
+              ? (fixer) => {
+                  const fixes = [argumentFix(fixer)];
+
+                  if (!existingInjector) {
+                    fixes.push(buildInjectorMemberFix(classBody, injectorName)(fixer));
+
+                    const importFix = buildCoreImportFix(['inject', 'Injector']);
+
+                    if (importFix) {
+                      fixes.push(importFix(fixer));
+                    }
+                  }
+
+                  return fixes;
+                }
+              : null,
+        });
+      },
+    };
+  },
+};
+
+module.exports = noLegacyPrepareWithoutInjector;

package/src/rules/no-legacy-query-import.js

@@ -0,0 +1,136 @@
+// @ts-check
+'use strict';
+
+/**
+ * Disallows importing the legacy (v2) query system from `@ethlete/query`, and names the current-system
+ * API in the message.
+ *
+ *   import { V2QueryClient, filterSuccess } from '@ethlete/query';
+ *   → `V2QueryClient` is the legacy (v2) query system. Use `createQueryClient` instead (…/query/queries).
+ *   → `filterSuccess` … Use `query.response()` instead - the query is already signals (…/query/queries).
+ *
+ * Two things are matched: every `V2`/`AnyV2`-prefixed export - the prefix the library gives the legacy
+ * system's half of a colliding name - and the legacy APIs that never collided, which carry their
+ * successor from the migration guide. `createLegacyQueryCreator` is deliberately **not** matched: it is
+ * the sanctioned interop seam a migration leans on until its call sites are converted.
+ *
+ * Off by default, and deliberately not type-aware: it names successors rather than repeating the
+ * `@deprecated` tag every legacy export already carries. For the whole deprecated surface (including
+ * the types this rule leaves alone), enable `@typescript-eslint/no-deprecated` alongside it.
+ */
+
+const QUERY_PACKAGE = '@ethlete/query';
+const DEFAULT_DOCS_BASE_URL = 'https://ethlete-sdk-docs.web.app';
+
+/**
+ * The legacy APIs whose names never collided with the current system, and what the migration guide
+ * (`/query/legacy#migrating-to-the-current-system`) maps each one to.
+ *
+ * @type {Record<string, { to: string, docs: string }>}
+ */
+const LEGACY_SYMBOLS = {
+  def: { to: 'the type parameter of a current creator - `createGetQuery(client)<TArgs>(route)`', docs: '/query/http' },
+  BasicAuthProvider: { to: 'no equivalent - the current system authenticates through `createBearerAuthProvider`', docs: '/query/auth' }, // prettier-ignore
+  CustomHeaderAuthProvider: { to: '`headers` on `createQueryClient`, which re-reads a function form per request', docs: '/query/queries#the-query-client' }, // prettier-ignore
+  EntityStore: { to: 'nothing directly - caching dedupes by request, and shared state derives from signals', docs: '/query/caching' }, // prettier-ignore
+  InfinityQuery: { to: '`createPagedQueryStack`', docs: '/query/stacks#paged-queries' },
+  InfinityQueryDirective: { to: '`createPagedQueryStack`', docs: '/query/stacks#paged-queries' },
+  InfinityQueryTriggerDirective: { to: '`createPagedQueryStack`', docs: '/query/stacks#paged-queries' },
+  createInfinityQueryConfig: { to: '`createPagedQueryStack`', docs: '/query/stacks#paged-queries' },
+  QueryDirective: { to: "the query's own signals, read directly in the template", docs: '/query/migrating-from-v2#templates-read-signals-not-directives' }, // prettier-ignore
+  filterSuccess: { to: '`query.response()`, or `query.response.asObservable()` where a stream is needed', docs: '/query/queries#the-query-object' }, // prettier-ignore
+  filterFailure: { to: '`query.error()`, or `query.error.asObservable()` where a stream is needed', docs: '/query/queries#the-query-object' }, // prettier-ignore
+  switchQueryState: { to: "the query's own signals - each one is an `ObservableSignal`", docs: '/query/queries#the-query-object' }, // prettier-ignore
+  takeUntilResponse: { to: "the query's own signals - each one is an `ObservableSignal`", docs: '/query/queries#the-query-object' }, // prettier-ignore
+  toQuerySignal: { to: 'the query object itself - it is already signals', docs: '/query/queries#the-query-object' },
+  queryStateSignal: { to: 'the query object itself - it is already signals', docs: '/query/queries#the-query-object' }, // prettier-ignore
+  queryStateResponseSignal: { to: '`query.response()`', docs: '/query/queries#the-query-object' },
+  queryStateErrorSignal: { to: '`query.error()`', docs: '/query/queries#the-query-object' },
+  queryStateLoadingSignal: { to: '`query.loading()`', docs: '/query/queries#the-query-object' },
+  validateWithV2Query: { to: '`validateWithQuery`', docs: '/query/errors#validating-against-the-server-as-the-user-types' }, // prettier-ignore
+  provideQueryClientForDevtools: { to: '`provideQueryDevtools()` from `@ethlete/query-devtools`, which registers every client at once', docs: '/query-devtools/' }, // prettier-ignore
+};
+
+/** The current-system counterparts of the names the legacy system had to give up its half of. */
+const V2_SUCCESSORS = {
+  V2QueryClient: { to: '`createQueryClient`', docs: '/query/queries#the-query-client' },
+  V2QueryClientConfig: { to: 'the config of `createQueryClient`', docs: '/query/queries#the-query-client' },
+  V2QueryCreator: { to: '`createGetQuery` and its siblings', docs: '/query/http' },
+  AnyV2QueryCreator: { to: '`createGetQuery` and its siblings', docs: '/query/http' },
+  V2BearerAuthProvider: { to: '`createBearerAuthProvider` plus the secure creator templates', docs: '/query/auth' },
+};
+
+/** @param {any} specifier */
+const importedName = (specifier) => {
+  if (specifier.type !== 'ImportSpecifier') return null;
+
+  return specifier.imported.name ?? specifier.imported.value ?? null;
+};
+
+/** @param {string} name */
+const isV2Symbol = (name) => /^(V2|AnyV2)[A-Z]/.test(name);
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noLegacyQueryImport = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description: 'Disallow importing the legacy (v2) query system; name the current-system API instead.',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          /** Base URL the guide paths in the messages are appended to. */
+          docsBaseUrl: { type: 'string' },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      successor: '`{{ name }}` is the legacy (v2) query system. Use {{ to }} instead ({{ docs }}).',
+      legacySystem:
+        '`{{ name }}` is the legacy (v2) query system. Migrate to the current one - see {{ docs }}, and run `nx g @ethlete/query:migrate-to-query-v3` for the mechanical parts.',
+    },
+  },
+  create(context) {
+    const options = context.options[0] ?? {};
+    const docsBaseUrl = (options.docsBaseUrl ?? DEFAULT_DOCS_BASE_URL).replace(/\/$/, '');
+
+    return {
+      ImportDeclaration(node) {
+        const declaration = /** @type {any} */ (node);
+
+        if (declaration.source.value !== QUERY_PACKAGE) return;
+
+        for (const specifier of declaration.specifiers) {
+          const name = importedName(specifier);
+
+          if (!name) continue;
+
+          const successor = V2_SUCCESSORS[name] ?? LEGACY_SYMBOLS[name];
+
+          if (successor) {
+            context.report({
+              node: specifier,
+              messageId: 'successor',
+              data: { name, to: successor.to, docs: `${docsBaseUrl}${successor.docs}` },
+            });
+
+            continue;
+          }
+
+          if (!isV2Symbol(name)) continue;
+
+          context.report({
+            node: specifier,
+            messageId: 'legacySystem',
+            data: { name, docs: `${docsBaseUrl}/query/migrating-from-v2` },
+          });
+        }
+      },
+    };
+  },
+};
+
+module.exports = noLegacyQueryImport;

package/src/rules/require-form-submit.js

@@ -0,0 +1,92 @@
+// @ts-check
+'use strict';
+
+/**
+ * Checks the two ends of the same wire: that a `<form>` handles its own submission, and that a
+ * submit control reaches a form at all.
+ *
+ *   <form (ngSubmit)="save()">          ✔
+ *   <form>                              ✘ pressing Enter in a field does nothing, or reloads the page
+ *
+ *   <form …><button type="submit">      ✔
+ *   <button type="submit" form="edit">  ✔ associated by id, outside the form's subtree
+ *   <button type="submit">              ✘ submits nothing
+ *
+ * A form declaring native submission (`action`, `ngNoForm`, `method="dialog"`) is left alone - it is
+ * handled by the platform rather than by a handler.
+ */
+
+/** @param {any} node @param {string} name */
+const attribute = (node, name) => node.attributes?.find(/** @param {any} a */ (a) => a.name === name);
+
+/** @param {any} node @param {string} name */
+const hasBinding = (node, name) =>
+  node.inputs?.some(/** @param {any} i */ (i) => i.name === name) ||
+  node.attributes?.some(/** @param {any} a */ (a) => a.name === name);
+
+/** @param {any} node */
+const handlesSubmit = (node) =>
+  node.outputs?.some(/** @param {any} o */ (o) => o.name === 'submit' || o.name === 'ngSubmit');
+
+/** @param {any} node */
+const submitsNatively = (node) =>
+  hasBinding(node, 'action') || hasBinding(node, 'ngNoForm') || attribute(node, 'method')?.value === 'dialog';
+
+/** @param {any} node */
+const isSubmitControl = (node) =>
+  (node.name === 'button' || node.name === 'input') && attribute(node, 'type')?.value === 'submit';
+
+/** @type {import('eslint').Rule.RuleModule} */
+const requireFormSubmit = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description: 'Require a `<form>` to handle its own submission, and a submit control to reach a form.',
+    },
+    schema: [],
+    messages: {
+      missingSubmitHandler:
+        'This `<form>` handles no submission - pressing Enter in a field either does nothing or reloads the page. Bind `(ngSubmit)` (reactive forms) or `(submit)`, or use a plain element if this is not a form.',
+      submitOutsideForm:
+        'A `type="submit"` control outside a `<form>` submits nothing. Put it inside the form, or associate it with one by id: `form="the-form-id"`.',
+    },
+  },
+  create(context) {
+    const parserServices = /** @type {any} */ (context.sourceCode.parserServices);
+
+    if (!parserServices?.convertNodeSourceSpanToLoc) return {};
+
+    let formDepth = 0;
+
+    /** @param {any} node */
+    const report = (node, messageId) =>
+      context.report({
+        loc: parserServices.convertNodeSourceSpanToLoc(node.startSourceSpan ?? node.sourceSpan),
+        messageId,
+      });
+
+    return {
+      /** @param {any} node */
+      Element(node) {
+        if (node.name === 'form') {
+          formDepth++;
+
+          if (!handlesSubmit(node) && !submitsNatively(node)) report(node, 'missingSubmitHandler');
+
+          return;
+        }
+
+        if (formDepth > 0 || !isSubmitControl(node) || hasBinding(node, 'form')) return;
+
+        report(node, 'submitOutsideForm');
+      },
+
+      /** @param {any} node */
+      'Element:exit'(node) {
+        if (node.name === 'form') formDepth--;
+      },
+    };
+  },
+};
+
+module.exports = requireFormSubmit;