@ethlete/eslint-plugin 1.0.0-next.24 → 1.0.0-next.25

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.0.0-next.25
+
+### Minor Changes
+
+- The `@angular-eslint/*` output rules moved from `recommendedTs` into a new `recommendedAngularTs` config, which `recommended` includes, so NestJS and other non-Angular projects can use `recommendedTs` without the `@angular-eslint` plugin.
+- `recommendedTs` now uses `ethlete/consistent-type-definitions` instead of `@typescript-eslint/consistent-type-definitions`, so `--fix` no longer turns an interface inside `declare module` or `declare global` (such as the theme-name registry the `@ethlete/core` generators emit) into a type alias that merges into nothing.
+- New `no-csp-unsafe` rule (error in `recommendedTs` and `recommendedTemplate`) flags style attributes, un-nonced `<script>`/`<style>` elements, `eval` and string timers that a strict CSP blocks.
+- `et update` turns the type aliases the old `consistent-type-definitions` fix left in `declare module` and `declare global` blocks back into interfaces, and renames the rule in `eslint-disable` directives.
+- `prefer-linked-signal` now also reports an `effect()` that only calls `.set()` behind an `if`/`else`.
+
+### Patch Changes
+
+- `ethlete/no-csp-unsafe` fixes a static template `style="…"` attribute. It rewrites `style="width: 40%; margin-top: 4px"` to `[style]="{ width: '40%', 'margin-top': '4px' }"`, which a strict CSP allows. A value with a quote, `url(`, `!important` or a comment stays a manual fix.
+
 ## 1.0.0-next.24
 
 ### Minor Changes

package/migrations.json

@@ -0,0 +1,12 @@
+{
+  "migrations": [
+    {
+      "name": "module-augmentation-interfaces",
+      "version": "1.0.0-next.25",
+      "kind": "auto",
+      "description": "Turn the type aliases the old consistent-type-definitions fix left in declare module / declare global blocks back into interfaces, and rename its eslint-disable directives to ethlete/consistent-type-definitions.",
+      "generator": "@ethlete/eslint-plugin:restore-module-augmentation-interfaces",
+      "docs": "/eslint/rules"
+    }
+  ]
+}

package/package.json

@@ -1,14 +1,24 @@
 {
   "name": "@ethlete/eslint-plugin",
-  "version": "1.0.0-next.24",
+  "version": "1.0.0-next.25",
   "license": "MIT",
   "type": "commonjs",
   "main": "./src/index.js",
   "peerDependencies": {
     "@angular-eslint/eslint-plugin-template": ">=21.0.0",
     "@angular/core": ">=21.0.0",
+    "@nx/devkit": ">=21.0.0",
     "@typescript-eslint/eslint-plugin": ">=8.0.0",
     "eslint": ">=9.0.0",
     "typescript": ">=5.9.0"
-  }
+  },
+  "peerDependenciesMeta": {
+    "@nx/devkit": {
+      "optional": true
+    }
+  },
+  "ethlete": {
+    "migrations": "./migrations.json"
+  },
+  "generators": "./src/generators/generators.json"
 }

package/src/configs/recommended.js

@@ -15,8 +15,8 @@ const recommendedTs = {
   rules: {
     // ── TypeScript ──────────────────────────────────────────────────────────
 
-    // No interface — use type
-    '@typescript-eslint/consistent-type-definitions': ['error', 'type'],
+    // No interface — use type (owned by ethlete/consistent-type-definitions)
+    '@typescript-eslint/consistent-type-definitions': 'off',
 
     // No any
     '@typescript-eslint/no-explicit-any': 'error',
@@ -248,6 +248,9 @@ const recommendedTs = {
     // No enum / const enum — use a const object with `as const` plus a derived union type
     'ethlete/no-enum': 'error',
 
+    // No interface — use type; an interface augmenting a module or the global scope is exempt
+    'ethlete/consistent-type-definitions': 'error',
+
     // No .subscribe() inside effect() or computed()
     'ethlete/no-rxjs-in-effect': 'error',
 
@@ -311,6 +314,10 @@ const recommendedTs = {
     // — use getCookie / setCookie / hasCookie / deleteCookie from '@ethlete/core' instead
     'ethlete/no-document-cookie': 'error',
 
+    // No code a strict CSP (no 'unsafe-inline' / 'unsafe-eval') blocks: style attributes,
+    // un-nonced <script>/<style> elements, eval / new Function / string timers
+    'ethlete/no-csp-unsafe': 'error',
+
     // Injected providers must be private by default, and protected only when
     // referenced from an Angular template or host binding.
     'ethlete/inject-member-accessibility': 'error',
@@ -350,14 +357,6 @@ const recommendedTs = {
     // Angular language service completions for the rest of the file
     'ethlete/no-template-literal-before-inline-template': 'error',
 
-    // ── Angular outputs ─────────────────────────────────────────────────────
-
-    // No on-prefixed outputs (onSelectDate → selectDate)
-    '@angular-eslint/no-output-on-prefix': 'error',
-
-    // No outputs named after native DOM events (change, click, etc.)
-    '@angular-eslint/no-output-native': 'error',
-
     // ── Angular components ──────────────────────────────────────────────────
 
     // Require ChangeDetectionStrategy.OnPush on Angular <= 21, where it is opt-in
@@ -402,6 +401,23 @@ const recommendedTs = {
   },
 };
 
+/**
+ * `@angular-eslint/*` rules for TypeScript files in Angular projects; the base config must register
+ * the `@angular-eslint` plugin.
+ *
+ * @type {import('eslint').Linter.Config}
+ */
+const recommendedAngularTs = {
+  files: ['**/*.ts'],
+  rules: {
+    // No on-prefixed outputs (onSelectDate → selectDate)
+    '@angular-eslint/no-output-on-prefix': 'error',
+
+    // No outputs named after native DOM events (change, click, etc.)
+    '@angular-eslint/no-output-native': 'error',
+  },
+};
+
 /**
  * Flat config entries for Angular HTML template files.
  * @type {import('eslint').Linter.Config}
@@ -419,6 +435,8 @@ const recommendedTemplate = {
     'ethlete/prefer-static-boolean-properties': 'warn',
     // A form must handle its own submission
     'ethlete/require-form-submit': 'error',
+    // No static style attribute or [attr.style] binding - a strict CSP blocks both
+    'ethlete/no-csp-unsafe': 'error',
   },
 };
 
@@ -432,6 +450,7 @@ const recommendedSpec = {
     '@typescript-eslint/no-non-null-assertion': 'off',
     'no-restricted-globals': 'off',
     'ethlete/no-async-await': 'off',
+    'ethlete/no-csp-unsafe': 'off',
     'ethlete/no-direct-dom-manipulation': 'off',
     'ethlete/no-document-cookie': 'off',
     'ethlete/no-dom-query': 'off',
@@ -444,4 +463,4 @@ const recommendedSpec = {
   },
 };
 
-module.exports = { recommendedTs, recommendedTemplate, recommendedSpec };
+module.exports = { recommendedTs, recommendedAngularTs, recommendedTemplate, recommendedSpec };

package/src/generators/generators.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json.schemastore.org/nx-generators",
+  "generators": {
+    "restore-module-augmentation-interfaces": {
+      "implementation": "./restore-module-augmentation-interfaces/migration",
+      "schema": "./restore-module-augmentation-interfaces/schema.json",
+      "description": "Turn type aliases in declare module / declare global blocks back into interfaces, and rename consistent-type-definitions eslint directives"
+    }
+  }
+}

package/src/generators/restore-module-augmentation-interfaces/migration.js

@@ -0,0 +1,50 @@
+// @ts-check
+'use strict';
+
+const { formatFiles, visitNotIgnoredFiles } = require('@nx/devkit');
+const { restoreModuleAugmentationInterfaces } = require('./restore-module-augmentation-interfaces');
+
+const SOURCE_FILE = /\.(?:[cm]?ts|tsx|[cm]?js|jsx)$/;
+
+/**
+ * @param {import('@nx/devkit').Tree} tree
+ * @param {{ skipFormat?: boolean }} schema
+ */
+const migrateModuleAugmentationInterfaces = async (tree, schema) => {
+  console.log('\n🔄 Restoring module augmentation interfaces...');
+
+  let filesChanged = 0;
+  let reviewCount = 0;
+
+  visitNotIgnoredFiles(tree, '', (filePath) => {
+    if (!SOURCE_FILE.test(filePath)) return;
+
+    const before = tree.read(filePath, 'utf-8');
+
+    if (!before) return;
+
+    const result = restoreModuleAugmentationInterfaces(filePath, before);
+
+    for (const entry of result.review) {
+      reviewCount++;
+      console.warn(
+        `   ⚠ ${filePath}:${entry.line}: type ${entry.name} in a module augmentation is not an object literal, so it was left alone. An augmentation only merges as an interface.`,
+      );
+    }
+
+    if (!result.changed) return;
+
+    tree.write(filePath, result.content);
+    filesChanged++;
+    console.log(`   ✓ ${filePath}`);
+  });
+
+  console.log(filesChanged === 0 ? '   Nothing to migrate.\n' : `\n✅ Migrated ${filesChanged} file(s).\n`);
+
+  if (reviewCount > 0) console.warn(`   Review ${reviewCount} type alias(es) in module augmentations manually.\n`);
+
+  if (!schema.skipFormat) await formatFiles(tree);
+};
+
+module.exports = migrateModuleAugmentationInterfaces;
+module.exports.default = migrateModuleAugmentationInterfaces;

package/src/generators/restore-module-augmentation-interfaces/restore-module-augmentation-interfaces.js

@@ -0,0 +1,103 @@
+// @ts-check
+'use strict';
+
+const ts = require('typescript');
+
+const OLD_RULE = '@typescript-eslint/consistent-type-definitions';
+const NEW_RULE = 'ethlete/consistent-type-definitions';
+
+const LINE_DIRECTIVE = /\/\/[ \t]*eslint-(?:disable|enable)(?:-next-line|-line)?\b[^\n]*/g;
+const BLOCK_DIRECTIVE = /\/\*[ \t]*eslint-(?:disable|enable)(?:-next-line|-line)?\b(?:(?!\*\/)[\s\S])*\*\//g;
+
+const AUGMENTATION = /\bdeclare\s+(?:module|global)\b/;
+
+const renameInDirective = (/** @type {string} */ directive) => directive.split(OLD_RULE).join(NEW_RULE);
+
+/** Renames `@typescript-eslint/consistent-type-definitions` in every eslint-disable/enable directive. */
+const renameDirectives = (/** @type {string} */ content) =>
+  content.replace(LINE_DIRECTIVE, renameInDirective).replace(BLOCK_DIRECTIVE, renameInDirective);
+
+const isAugmentation = (/** @type {ts.Statement} */ statement) =>
+  ts.isModuleDeclaration(statement) &&
+  (ts.isStringLiteral(statement.name) || (statement.flags & ts.NodeFlags.GlobalAugmentation) !== 0) &&
+  statement.body !== undefined &&
+  ts.isModuleBlock(statement.body);
+
+/**
+ * @param {readonly ts.Statement[]} statements
+ * @param {ts.TypeAliasDeclaration[]} found
+ */
+const collectAugmentationAliases = (statements, found) => {
+  for (const statement of statements) {
+    if (!isAugmentation(statement)) continue;
+
+    const body = /** @type {ts.ModuleBlock} */ (/** @type {ts.ModuleDeclaration} */ (statement).body);
+
+    for (const member of body.statements) {
+      if (ts.isTypeAliasDeclaration(member)) found.push(member);
+    }
+
+    collectAugmentationAliases(body.statements, found);
+  }
+
+  return found;
+};
+
+/**
+ * Turns every object-literal `type X = { … }` directly inside a `declare module '…'` or
+ * `declare global` block back into `interface X { … }`, and renames
+ * `@typescript-eslint/consistent-type-definitions` in eslint directives to
+ * `ethlete/consistent-type-definitions`. Aliases of any other shape are returned in `review`.
+ *
+ * @param {string} filePath
+ * @param {string} content
+ * @returns {{ content: string; changed: boolean; review: { name: string; line: number }[] }}
+ */
+const restoreModuleAugmentationInterfaces = (filePath, content) => {
+  if (!AUGMENTATION.test(content)) {
+    const renamed = renameDirectives(content);
+
+    return { content: renamed, changed: renamed !== content, review: [] };
+  }
+
+  const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+  const aliases = collectAugmentationAliases(sourceFile.statements, []);
+
+  /** @type {{ name: string; line: number }[]} */
+  const review = [];
+  /** @type {{ start: number; end: number; text: string }[]} */
+  const edits = [];
+
+  for (const alias of aliases) {
+    const name = alias.name.text;
+
+    if (!ts.isTypeLiteralNode(alias.type)) {
+      review.push({ name, line: sourceFile.getLineAndCharacterOfPosition(alias.getStart(sourceFile)).line + 1 });
+      continue;
+    }
+
+    const modifiers = (alias.modifiers ?? []).map((modifier) => `${modifier.getText(sourceFile)} `).join('');
+    const typeParameters = content
+      .slice(alias.name.end, alias.type.pos)
+      .replace(/\s*=\s*$/, '')
+      .trim();
+
+    edits.push({
+      start: alias.modifiers?.[0]?.getStart(sourceFile) ?? alias.getStart(sourceFile),
+      end: alias.end,
+      text: `${modifiers}interface ${name}${typeParameters} ${alias.type.getText(sourceFile)}`,
+    });
+  }
+
+  let next = content;
+
+  for (const edit of edits.sort((left, right) => right.start - left.start)) {
+    next = next.slice(0, edit.start) + edit.text + next.slice(edit.end);
+  }
+
+  next = renameDirectives(next);
+
+  return { content: next, changed: next !== content, review };
+};
+
+module.exports = { restoreModuleAugmentationInterfaces };

package/src/generators/restore-module-augmentation-interfaces/schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "$id": "restore-module-augmentation-interfaces",
+  "title": "Restore module augmentation interfaces",
+  "type": "object",
+  "properties": {
+    "skipFormat": {
+      "type": "boolean",
+      "description": "Skip formatting files after migration",
+      "default": false
+    }
+  },
+  "required": []
+}

package/src/index.js

@@ -30,6 +30,7 @@ const noLegacyAngularDecorators = require('./rules/no-legacy-angular-decorators'
 const noAngularSeoServices = require('./rules/no-angular-seo-services');
 const preferCloneEqual = require('./rules/prefer-clone-equal');
 const noDocumentCookie = require('./rules/no-document-cookie');
+const noCspUnsafe = require('./rules/no-csp-unsafe');
 const injectMemberAccessibility = require('./rules/inject-member-accessibility');
 const noRedundantInternal = require('./rules/no-redundant-internal');
 const templateMemberAccessibility = require('./rules/template-member-accessibility');
@@ -60,8 +61,9 @@ const noCdkImport = require('./rules/no-cdk-import');
 const noLegacyQueryImport = require('./rules/no-legacy-query-import');
 const noAsyncAwait = require('./rules/no-async-await');
 const noEnum = require('./rules/no-enum');
+const consistentTypeDefinitions = require('./rules/consistent-type-definitions');
 const takeUntilDestroyedLast = require('./rules/take-until-destroyed-last');
-const { recommendedTs, recommendedTemplate, recommendedSpec } = require('./configs/recommended');
+const { recommendedTs, recommendedAngularTs, recommendedTemplate, recommendedSpec } = require('./configs/recommended');
 const { version } = require('../package.json');
 
 /** @type {import('eslint').ESLint.Plugin} */
@@ -102,6 +104,7 @@ const plugin = {
     'no-angular-seo-services': noAngularSeoServices,
     'prefer-clone-equal': preferCloneEqual,
     'no-document-cookie': noDocumentCookie,
+    'no-csp-unsafe': noCspUnsafe,
     'inject-member-accessibility': injectMemberAccessibility,
     'no-redundant-internal': noRedundantInternal,
     'template-member-accessibility': templateMemberAccessibility,
@@ -131,6 +134,7 @@ const plugin = {
     'no-legacy-query-import': noLegacyQueryImport,
     'no-async-await': noAsyncAwait,
     'no-enum': noEnum,
+    'consistent-type-definitions': consistentTypeDefinitions,
   },
 };
 
@@ -150,6 +154,8 @@ const recommendedTemplateWithPlugin = {
 const configs = {
   /** TypeScript rules (merged into a files: ['**\/*.ts'] block) */
   recommendedTs: recommendedTsWithPlugin,
+  /** `@angular-eslint/*` rules for TypeScript files (files: ['**\/*.ts']) */
+  recommendedAngularTs,
   /** Angular template rules (merged into a files: ['**\/*.html'] block) */
   recommendedTemplate: recommendedTemplateWithPlugin,
   /** Relaxed rules for spec files (files: ['**\/*.spec.ts']) */
@@ -158,7 +164,7 @@ const configs = {
    * Both together as a flat array — the most common usage:
    *   export default [...baseConfig, ...ethlete.configs.recommended]
    */
-  recommended: [recommendedTsWithPlugin, recommendedTemplateWithPlugin, recommendedSpec],
+  recommended: [recommendedTsWithPlugin, recommendedAngularTs, recommendedTemplateWithPlugin, recommendedSpec],
 };
 
 const ethletePlugin = { ...plugin, configs };

package/src/rules/consistent-type-definitions.js

@@ -0,0 +1,60 @@
+// @ts-check
+'use strict';
+
+const { rules } = require('@typescript-eslint/eslint-plugin');
+
+const upstream = rules['consistent-type-definitions'];
+
+/**
+ * `@typescript-eslint/consistent-type-definitions` with `'type'`, except that an interface inside a
+ * `declare module`, `declare global` or `namespace` block is left alone.
+ *
+ * Only an interface merges into an existing declaration. The upstream fix turns
+ * `declare module '@ethlete/core' { interface EthleteColorThemeNameRegistry { … } }` into a type
+ * alias, which merges into nothing, and under `skipLibCheck` the registration disappears without an
+ * error.
+ *
+ * BAD:
+ *   interface User { name: string }
+ *
+ * GOOD:
+ *   type User = { name: string };
+ *
+ *   declare module '@ethlete/core' {
+ *     interface EthleteColorThemeNameRegistry { name: 'brand' }
+ *   }
+ */
+
+const isInsideModuleDeclaration = (sourceCode, node) =>
+  sourceCode.getAncestors(node).some((ancestor) => ancestor.type === 'TSModuleDeclaration');
+
+/** @type {import('eslint').Rule.RuleModule} */
+const consistentTypeDefinitions = {
+  meta: {
+    ...upstream.meta,
+    docs: {
+      description:
+        'Use `type` instead of `interface`, except for an interface that augments a module or the global scope.',
+      recommended: true,
+    },
+    schema: [],
+  },
+  create(context) {
+    const { sourceCode } = context;
+
+    const filteredContext = Object.create(context, {
+      options: { value: ['type'] },
+      report: {
+        value: (descriptor) => {
+          if ('node' in descriptor && isInsideModuleDeclaration(sourceCode, descriptor.node)) return;
+
+          context.report(descriptor);
+        },
+      },
+    });
+
+    return upstream.create(filteredContext);
+  },
+};
+
+module.exports = consistentTypeDefinitions;

package/src/rules/no-csp-unsafe.js

@@ -0,0 +1,362 @@
+// @ts-check
+'use strict';
+
+/**
+ * Disallows code that a strict Content Security Policy without `'unsafe-inline'` / `'unsafe-eval'`
+ * blocks at runtime:
+ *
+ *   script-src 'self' 'nonce-…'; style-src 'self' 'nonce-…'
+ *
+ * BAD:
+ *   el.setAttribute('style', 'color: red');          // inline style attribute
+ *   renderer.setAttribute(el, 'style', css);
+ *   const s = document.createElement('style');       // appended without a nonce
+ *   eval(code); new Function(code); setTimeout('tick()', 10);
+ *   `<div style="color: red">…</div>`                // HTML string parsed into the DOM
+ *   <div style="color: red"></div>                   // static template attribute
+ *   host: { style: 'display: block' }
+ *
+ * GOOD:
+ *   el.style.color = 'red';  el.style.setProperty('--x', '1');  [style.color]="c"
+ *   s.setAttribute('nonce', inject(CSP_NONCE));      // or s.nonce = …
+ *   a class or data attribute styled by a shipped stylesheet
+ *
+ * In an Angular template this rule runs on `.html` files and on inline templates extracted by
+ * `processInlineTemplates`; in TypeScript it skips a decorator's `template` string for that reason.
+ */
+
+const fs = require('node:fs');
+const { isGlobalReference } = require('./internals/import-resolution');
+
+const NONCED_ELEMENTS = new Set(['script', 'style']);
+const TIMER_FUNCTIONS = new Set(['setTimeout', 'setInterval']);
+const HTML_STYLE_ATTRIBUTE = /<[a-zA-Z][^<>]*\sstyle\s*=/;
+const UNFIXABLE_STYLE_VALUE = /['"\\]|\/\*|!important|url\(/i;
+const PLAIN_STYLE_PROPERTY = /^[a-zA-Z]+$/;
+const STYLE_PROPERTY = /^-{0,2}[a-zA-Z][\w-]*$/;
+const QUOTED_INLINE_TEMPLATE = /\btemplate\s*:\s*['"]/;
+
+/**
+ * Turns `a: b; c-d: e` into `{ a: 'b', 'c-d': 'e' }`, or returns null when the declarations cannot be
+ * rewritten without changing what they mean.
+ *
+ * @param {string} css
+ */
+const toStyleObjectLiteral = (css) => {
+  if (UNFIXABLE_STYLE_VALUE.test(css)) return null;
+
+  const entries = [];
+
+  for (const declaration of css.split(';')) {
+    if (!declaration.trim()) continue;
+
+    const colon = declaration.indexOf(':');
+
+    if (colon === -1) return null;
+
+    const property = declaration.slice(0, colon).trim();
+    const value = declaration
+      .slice(colon + 1)
+      .trim()
+      .replace(/\s+/g, ' ');
+
+    if (!STYLE_PROPERTY.test(property) || !value) return null;
+
+    entries.push(`${PLAIN_STYLE_PROPERTY.test(property) ? property : `'${property}'`}: '${value}'`);
+  }
+
+  return entries.length ? `{ ${entries.join(', ')} }` : null;
+};
+
+/** @param {any} node */
+const stringValue = (node) => (node?.type === 'Literal' && typeof node.value === 'string' ? node.value : null);
+
+/** @param {any} node */
+const propertyName = (node) => {
+  if (node?.type !== 'Property' || node.computed) return null;
+  if (node.key.type === 'Identifier') return node.key.name;
+
+  return stringValue(node.key);
+};
+
+/** @param {any} node */
+const calleeMemberName = (node) =>
+  node.callee.type === 'MemberExpression' && !node.callee.computed && node.callee.property.type === 'Identifier'
+    ? node.callee.property.name
+    : null;
+
+/** @param {any} node @param {string} name */
+const hasProperty = (node, name) =>
+  node?.type === 'ObjectExpression' && node.properties.some(/** @param {any} p */ (p) => propertyName(p) === name);
+
+/** @param {any} node */
+const isDecoratorTemplate = (node) => {
+  const property = node.parent;
+
+  if (propertyName(property) !== 'template' || property.value !== node) return false;
+
+  const call = property.parent?.parent;
+
+  return call?.type === 'CallExpression' && call.parent?.type === 'Decorator';
+};
+
+/** @param {any} node */
+const isHostMetadata = (node) => {
+  const property = node.parent;
+
+  if (propertyName(property) !== 'host' || property.value !== node) return false;
+
+  const call = property.parent?.parent;
+
+  return call?.type === 'CallExpression' && call.parent?.type === 'Decorator';
+};
+
+/** @param {any} node */
+const enclosingScopeNode = (node) => {
+  let current = node.parent;
+
+  while (current) {
+    if (
+      current.type === 'FunctionDeclaration' ||
+      current.type === 'FunctionExpression' ||
+      current.type === 'ArrowFunctionExpression' ||
+      current.type === 'Program'
+    ) {
+      return current;
+    }
+
+    current = current.parent;
+  }
+
+  return null;
+};
+
+/** @param {any} node */
+const boundTarget = (node) => {
+  const parent = node.parent;
+
+  if (parent?.type === 'VariableDeclarator' && parent.init === node && parent.id.type === 'Identifier')
+    return parent.id;
+  if (parent?.type === 'AssignmentExpression' && parent.right === node) return parent.left;
+
+  return null;
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noCspUnsafe = {
+  meta: {
+    type: 'problem',
+    fixable: 'code',
+    docs: {
+      description:
+        "Disallow code a strict Content Security Policy (no 'unsafe-inline', no 'unsafe-eval') blocks at runtime.",
+      recommended: true,
+    },
+    schema: [],
+    messages: {
+      styleAttribute:
+        "A `style` attribute is blocked by a CSP without 'unsafe-inline'. Set styles through CSSOM (`el.style.x = …`, `style.setProperty()`, a `[style.x]` binding) or use a class.",
+      htmlStyleAttribute:
+        "This HTML string sets a `style` attribute, which a CSP without 'unsafe-inline' blocks once it is parsed into the DOM. Use a class or a data attribute styled by a stylesheet.",
+      templateStyleAttribute:
+        "A static `style` attribute is blocked by a CSP without 'unsafe-inline'. Use `[style.x]` bindings or a class.",
+      missingNonce:
+        "A `<{{tag}}>` element created without a nonce is blocked by a CSP without 'unsafe-inline'. Set `nonce` from `inject(CSP_NONCE)` on it in the same function.",
+      dynamicCode: "`{{name}}` evaluates a string as code, which a CSP without 'unsafe-eval' blocks.",
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const parserServices = /** @type {any} */ (sourceCode.parserServices);
+
+    if (parserServices?.convertNodeSourceSpanToLoc) {
+      /** @param {any} span @param {string} messageId */
+      const reportSpan = (span, messageId) =>
+        context.report({ loc: parserServices.convertNodeSourceSpanToLoc(span), messageId });
+
+      let quotedInlineTemplate = /** @type {boolean | undefined} */ (undefined);
+
+      // The fix writes single quotes, which would end a quoted `template: '…'` string in the component.
+      const canFixTemplate = () => {
+        if (context.physicalFilename === context.filename || !context.physicalFilename.endsWith('.ts')) return true;
+
+        quotedInlineTemplate ??= QUOTED_INLINE_TEMPLATE.test(fs.readFileSync(context.physicalFilename, 'utf8'));
+
+        return !quotedInlineTemplate;
+      };
+
+      return {
+        /** @param {any} node */
+        Element(node) {
+          const hasStyleBinding = (node.inputs ?? []).some(
+            /** @param {any} input */ (input) => input.name === 'style' && String(input.keySpan) === 'style',
+          );
+
+          for (const attribute of node.attributes ?? []) {
+            if (attribute.name !== 'style') continue;
+
+            const literal = hasStyleBinding || !canFixTemplate() ? null : toStyleObjectLiteral(attribute.value);
+
+            context.report({
+              loc: parserServices.convertNodeSourceSpanToLoc(attribute.sourceSpan),
+              messageId: 'templateStyleAttribute',
+              fix: literal
+                ? (fixer) =>
+                    fixer.replaceTextRange(
+                      [attribute.sourceSpan.start.offset, attribute.sourceSpan.end.offset],
+                      `[style]="${literal}"`,
+                    )
+                : null,
+            });
+          }
+
+          for (const input of node.inputs ?? []) {
+            if (input.name === 'style' && String(input.keySpan) === 'attr.style') {
+              reportSpan(input.sourceSpan, 'styleAttribute');
+            }
+          }
+        },
+      };
+    }
+
+    /** @param {any} scope @param {string} target */
+    const setsNonce = (scope, target) => {
+      let found = false;
+
+      /** @param {any} node */
+      const matches = (node) => node && sourceCode.getText(node) === target;
+
+      /** @param {any} node */
+      const visit = (node) => {
+        if (found || !node || typeof node.type !== 'string') return;
+
+        if (
+          node.type === 'AssignmentExpression' &&
+          node.left.type === 'MemberExpression' &&
+          !node.left.computed &&
+          node.left.property.name === 'nonce' &&
+          matches(node.left.object)
+        ) {
+          found = true;
+          return;
+        }
+
+        if (node.type === 'CallExpression') {
+          const method = calleeMemberName(node);
+          const [first, second] = node.arguments;
+
+          if (
+            (method === 'setAttribute' && matches(node.callee.object) && stringValue(first) === 'nonce') ||
+            (method === 'setAttribute' && matches(first) && stringValue(second) === 'nonce') ||
+            ((method === 'setAttributes' || method === 'assign') && matches(first) && hasProperty(second, 'nonce'))
+          ) {
+            found = true;
+            return;
+          }
+        }
+
+        for (const key of sourceCode.visitorKeys[node.type] ?? []) {
+          const child = node[key];
+
+          if (Array.isArray(child)) child.forEach(visit);
+          else visit(child);
+        }
+      };
+
+      visit(scope);
+
+      return found;
+    };
+
+    /** @param {any} node @param {string} text */
+    const checkHtmlString = (node, text) => {
+      if (HTML_STYLE_ATTRIBUTE.test(text) && !isDecoratorTemplate(node)) {
+        context.report({ node, messageId: 'htmlStyleAttribute' });
+      }
+    };
+
+    return {
+      /** @param {any} node */
+      CallExpression(node) {
+        const method = calleeMemberName(node);
+        const [first, second] = node.arguments;
+
+        if (method === 'setAttribute') {
+          if (stringValue(first) === 'style' || (node.arguments.length >= 3 && stringValue(second) === 'style')) {
+            context.report({ node, messageId: 'styleAttribute' });
+          }
+
+          return;
+        }
+
+        if (method === 'setAttributes' && hasProperty(second, 'style')) {
+          context.report({ node, messageId: 'styleAttribute' });
+          return;
+        }
+
+        if (method === 'createElement') {
+          const tag = stringValue(first)?.toLowerCase();
+
+          if (!tag || !NONCED_ELEMENTS.has(tag)) return;
+
+          const target = boundTarget(node);
+          const scope = enclosingScopeNode(node);
+
+          if (!target || !scope || !setsNonce(scope, sourceCode.getText(target))) {
+            context.report({ node, messageId: 'missingNonce', data: { tag } });
+          }
+
+          return;
+        }
+
+        const callee = node.callee;
+        const name = callee.type === 'Identifier' ? callee.name : callee.type === 'MemberExpression' ? method : null;
+
+        if (!name) return;
+
+        if (callee.type === 'Identifier' && (name === 'eval' || name === 'Function')) {
+          if (isGlobalReference(sourceCode, callee)) context.report({ node, messageId: 'dynamicCode', data: { name } });
+
+          return;
+        }
+
+        if (TIMER_FUNCTIONS.has(name) && (stringValue(first) !== null || first?.type === 'TemplateLiteral')) {
+          if (callee.type === 'MemberExpression' || isGlobalReference(sourceCode, callee)) {
+            context.report({ node, messageId: 'dynamicCode', data: { name: `${name}(string)` } });
+          }
+        }
+      },
+      /** @param {any} node */
+      NewExpression(node) {
+        if (
+          node.callee.type === 'Identifier' &&
+          node.callee.name === 'Function' &&
+          isGlobalReference(sourceCode, node.callee)
+        ) {
+          context.report({ node, messageId: 'dynamicCode', data: { name: 'new Function' } });
+        }
+      },
+      /** @param {any} node */
+      ObjectExpression(node) {
+        if (!isHostMetadata(node)) return;
+
+        for (const property of node.properties) {
+          const key = propertyName(property);
+
+          if (key === 'style' || key === '[attr.style]')
+            context.report({ node: property, messageId: 'styleAttribute' });
+        }
+      },
+      /** @param {any} node */
+      Literal(node) {
+        if (typeof node.value === 'string') checkHtmlString(node, node.value);
+      },
+      /** @param {any} node */
+      TemplateLiteral(node) {
+        checkHtmlString(node, node.quasis.map(/** @param {any} q */ (q) => q.value.cooked ?? q.value.raw).join('x'));
+      },
+    };
+  },
+};
+
+module.exports = noCspUnsafe;

package/src/rules/prefer-linked-signal.js

@@ -24,27 +24,43 @@ const { isImportedAs } = require('./internals/import-resolution');
  * GOOD:
  *   selectedItem = linkedSignal(() => this.items()[0] ?? null);
  *
- * NOTE: Only flag when .set() is called directly inside an effect() callback.
- * Setting signals outside effects (in methods, event handlers, etc.) is fine.
+ * Also flagged when the write sits behind an `if`, as long as every branch only
+ * writes signals: `linkedSignal` keeps the previous value for the untaken branch.
  */
 
 /**
- * Returns true only when the `.set()` call node is a *pure derivation* inside
- * an effect() callback — meaning:
- *
- * 1. The IMMEDIATE enclosing function (the first function boundary walking up
- *    from the node) IS the first argument passed to `effect()`. This ensures
- *    that `.set()` calls nested inside `untracked(() => ...)` or other inner
- *    functions within the effect are NOT flagged — those are intentional
- *    write-back patterns, not derivations.
- *
- * 2. The `.set()` call is the SOLE expression in that callback:
- *    - Arrow with expression body: `effect(() => sig.set(x))`
- *    - Block body with a single ExpressionStatement: `effect(() => { sig.set(x); })`
+ * @param {any} node
+ * @returns {boolean}
+ */
+const isSetCall = (node) =>
+  node.type === 'CallExpression' &&
+  node.callee.type === 'MemberExpression' &&
+  node.callee.property.type === 'Identifier' &&
+  node.callee.property.name === 'set' &&
+  node.arguments.length === 1;
+
+/**
+ * A statement that does nothing but write signals: a lone `.set()`, a block holding one, or an
+ * `if`/`else` whose every branch is one.
  *
- *    Multi-statement blocks (even if they end with a `.set()`) indicate that the
- *    effect is performing side effects alongside the signal write, so they are
- *    not flagged either.
+ * @param {any} statement
+ * @returns {boolean}
+ */
+const isSetOnlyStatement = (statement) => {
+  if (!statement) return false;
+  if (statement.type === 'ExpressionStatement') return isSetCall(statement.expression);
+  if (statement.type === 'BlockStatement') return statement.body.length === 1 && isSetOnlyStatement(statement.body[0]);
+  if (statement.type === 'IfStatement') {
+    return (
+      isSetOnlyStatement(statement.consequent) && (!statement.alternate || isSetOnlyStatement(statement.alternate))
+    );
+  }
+  return false;
+};
+
+/**
+ * True when the `.set()` call sits directly in an `effect()` callback (not in a nested function such as
+ * `untracked(() => …)`) and that callback does nothing but write signals, optionally behind an `if`.
  *
  * @param {import('eslint').SourceCode} sourceCode
  * @param {import('eslint').Rule.Node} node The `.set()` CallExpression node
@@ -75,20 +91,10 @@ const isPureSetInDirectEffectCallback = (sourceCode, node) => {
     return false;
   }
 
-  // The .set() must be the sole expression — no surrounding statements.
-  // Case A: arrow with expression body — the body IS the .set() call.
-  if (immediateFunction.type === 'ArrowFunctionExpression' && immediateFunction.body === node) {
-    return true;
-  }
-
-  // Case B: block body with exactly one ExpressionStatement wrapping the .set() call.
   const body = immediateFunction.body;
-  return (
-    body.type === 'BlockStatement' &&
-    body.body.length === 1 &&
-    body.body[0].type === 'ExpressionStatement' &&
-    body.body[0].expression === node
-  );
+  if (body.type !== 'BlockStatement') return body === node;
+
+  return node.parent.type === 'ExpressionStatement' && body.body.length === 1 && isSetOnlyStatement(body.body[0]);
 };
 
 /** @type {import('eslint').Rule.RuleModule} */
@@ -108,15 +114,7 @@ const preferLinkedSignal = {
   create(context) {
     return {
       CallExpression(node) {
-        const { callee } = node;
-
-        if (
-          callee.type === 'MemberExpression' &&
-          callee.property.type === 'Identifier' &&
-          callee.property.name === 'set' &&
-          node.arguments.length === 1 &&
-          isPureSetInDirectEffectCallback(context.sourceCode, node)
-        ) {
+        if (isSetCall(node) && isPureSetInDirectEffectCallback(context.sourceCode, node)) {
           context.report({ node, messageId: 'preferLinkedSignal' });
         }
       },