eslint-plugin-sfmc 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jörn Berkefeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# eslint-plugin-sfmc
+
+Unified ESLint plugin for **Salesforce Marketing Cloud** — linting rules for both **AMPscript** and **Server-Side JavaScript (SSJS)**.
+
+## Installation
+
+```bash
+npm install eslint-plugin-sfmc --save-dev
+```
+
+Requires ESLint 9+ (flat config).
+
+## Quick Start
+
+```js
+// eslint.config.js
+import sfmc from 'eslint-plugin-sfmc';
+
+export default [
+    // Lint standalone .ampscript/.amp and .ssjs files
+    ...sfmc.configs.recommended,
+
+    // Lint AMPscript + SSJS embedded in .html files
+    ...sfmc.configs.embedded,
+];
+```
+
+## Configs
+
+| Config                     | Files                        | What it does                                              |
+| -------------------------- | ---------------------------- | --------------------------------------------------------- |
+| `sfmc.configs.ampscript`   | `**/*.ampscript`, `**/*.amp` | AMPscript rules only (recommended severity)               |
+| `sfmc.configs.ssjs`        | `**/*.ssjs`                  | SSJS rules only (recommended severity)                    |
+| `sfmc.configs.recommended` | Both of the above            | All rules at recommended severity for standalone files    |
+| `sfmc.configs.embedded`    | `**/*.html`                  | Combined processor extracts both languages from HTML      |
+| `sfmc.configs.strict`      | All of the above + HTML      | All rules at `error` severity for standalone and embedded |
+
+`recommended`, `embedded`, and `strict` are arrays — spread them with `...`.
+
+## AMPscript Rules (`amp-*`)
+
+| Rule                                    | Default | Description                                         |
+| --------------------------------------- | ------- | --------------------------------------------------- |
+| [`sfmc/amp-no-unknown-function`](docs/rules/amp/no-unknown-function.md)          | `error` | Disallow calls to unknown AMPscript functions       |
+| [`sfmc/amp-function-arity`](docs/rules/amp/function-arity.md)               | `error` | Enforce correct argument counts                     |
+| [`sfmc/amp-set-requires-target`](docs/rules/amp/set-requires-target.md)          | `error` | Require `set` to have a target variable             |
+| [`sfmc/amp-no-smart-quotes`](docs/rules/amp/no-smart-quotes.md)              | `error` | Disallow smart/curly quotes in strings              |
+| [`sfmc/amp-no-var-redeclaration`](docs/rules/amp/no-var-redeclaration.md)         | `warn`  | Disallow re-declaring a variable with `var`         |
+| [`sfmc/amp-no-empty-block`](docs/rules/amp/no-empty-block.md)               | `warn`  | Disallow empty `%%[ ]%%` blocks                     |
+| [`sfmc/amp-no-loop-counter-assign`](docs/rules/amp/no-loop-counter-assign.md)       | `warn`  | Disallow assigning to the `for` loop counter        |
+| [`sfmc/amp-no-inline-statement`](docs/rules/amp/no-inline-statement.md)          | `warn`  | Disallow statements inside inline expressions       |
+| [`sfmc/amp-no-deprecated-function`](docs/rules/amp/no-deprecated-function.md)       | `warn`  | Flag deprecated functions and suggest replacements  |
+| [`sfmc/amp-naming-convention`](docs/rules/amp/naming-convention.md)            | `warn`  | Enforce variable naming convention                  |
+| [`sfmc/amp-no-empty-then`](docs/rules/amp/no-empty-then.md)                | `warn`  | Disallow IF with empty THEN branch                  |
+| [`sfmc/amp-require-rowcount-check`](docs/rules/amp/require-rowcount-check.md)       | `warn`  | Require RowCount check before FOR on LookupRows     |
+| [`sfmc/amp-no-html-comment`](docs/rules/amp/no-html-comment.md)                | `warn`  | Disallow HTML comments inside AMPscript blocks      |
+| [`sfmc/amp-no-js-line-comment`](docs/rules/amp/no-js-line-comment.md)            | `warn`  | Disallow JS-style `//` line comments in AMPscript   |
+| [`sfmc/amp-no-nested-script-tag`](docs/rules/amp/no-nested-script-tag.md)         | `error` | Disallow `<script>` tags nested inside AMPscript script tags |
+| [`sfmc/amp-no-nested-ampscript-delimiter`](docs/rules/amp/no-nested-ampscript-delimiter.md) | `error` | Disallow AMPscript delimiters nested inside AMPscript blocks |
+| [`sfmc/amp-prefer-attribute-value`](docs/rules/amp/prefer-attribute-value.md)       | off     | Prefer `AttributeValue()` over bare personalization |
+| [`sfmc/amp-require-variable-declaration`](docs/rules/amp/require-variable-declaration.md) | off     | Require `var` before `set`                          |
+| [`sfmc/amp-no-email-excluded-function`](docs/rules/amp/no-email-excluded-function.md)   | off     | Flag functions unavailable in email context         |
+
+## SSJS Rules (`ssjs-*`)
+
+| Rule                                     | Default | Description                                          |
+| ---------------------------------------- | ------- | ---------------------------------------------------- |
+| [`sfmc/ssjs-require-platform-load`](docs/rules/ssjs/require-platform-load.md)        | `error` | Require `Platform.Load("core")` before Core usage    |
+| [`sfmc/ssjs-no-unsupported-syntax`](docs/rules/ssjs/no-unsupported-syntax.md)        | `error` | Flag ES6+ syntax not supported by SFMC               |
+| [`sfmc/ssjs-no-unknown-platform-function`](docs/rules/ssjs/no-unknown-platform-function.md) | `error` | Disallow unknown `Platform.Function.*` methods       |
+| [`sfmc/ssjs-platform-function-arity`](docs/rules/ssjs/platform-function-arity.md)      | `error` | Enforce correct arity for `Platform.Function.*`      |
+| [`sfmc/ssjs-no-unknown-http-method`](docs/rules/ssjs/no-unknown-http-method.md)       | `error` | Disallow unknown `HTTP.*` methods                    |
+| [`sfmc/ssjs-no-unknown-platform-variable`](docs/rules/ssjs/no-unknown-platform-variable.md) | `error` | Disallow unknown `Platform.Variable.*` methods       |
+| [`sfmc/ssjs-no-unknown-platform-response`](docs/rules/ssjs/no-unknown-platform-response.md) | `error` | Disallow unknown `Platform.Response.*` methods       |
+| [`sfmc/ssjs-no-unknown-platform-request`](docs/rules/ssjs/no-unknown-platform-request.md)  | `error` | Disallow unknown `Platform.Request.*` methods        |
+| [`sfmc/ssjs-require-platform-load-order`](docs/rules/ssjs/require-platform-load-order.md)  | `error` | Require `Platform.Load()` before Core usage in order |
+| [`sfmc/ssjs-no-hardcoded-credentials`](docs/rules/ssjs/no-hardcoded-credentials.md)     | `error` | Flag hardcoded keys in encryption calls              |
+| [`sfmc/ssjs-no-unknown-platform-client-browser`](docs/rules/ssjs/no-unknown-platform-client-browser.md) | `error` | Disallow unknown `Platform.ClientBrowser.*` methods  |
+| [`sfmc/ssjs-no-unknown-core-method`](docs/rules/ssjs/no-unknown-core-method.md)       | `warn`  | Disallow unknown methods on Core library objects     |
+| [`sfmc/ssjs-no-unknown-wsproxy-method`](docs/rules/ssjs/no-unknown-wsproxy-method.md)    | `warn`  | Disallow unknown WSProxy methods                     |
+| [`sfmc/ssjs-cache-loop-length`](docs/rules/ssjs/cache-loop-length.md)            | `warn`  | Require caching `.length` in for-loops               |
+| [`sfmc/ssjs-require-hasownproperty`](docs/rules/ssjs/require-hasownproperty.md)       | `warn`  | Require `hasOwnProperty` guard in for-in loops       |
+| [`sfmc/ssjs-prefer-platform-load-version`](docs/rules/ssjs/prefer-platform-load-version.md) | `warn`  | Enforce a minimum `Platform.Load` version string     |
+| [`sfmc/ssjs-no-unavailable-method`](docs/rules/ssjs/no-unavailable-method.md)        | `warn`  | Flag Array/String methods unavailable or broken in SFMC's ES3 engine |
+| [`sfmc/ssjs-prefer-parsejson-safe-arg`](docs/rules/ssjs/prefer-parsejson-safe-arg.md)    | `warn`  | Require string coercion on `ParseJSON` argument      |
+| [`sfmc/ssjs-no-switch-default`](docs/rules/ssjs/no-switch-default.md)            | `warn`  | Disallow `default` clause in `switch` statements     |
+| [`sfmc/ssjs-no-treatascontent-injection`](docs/rules/ssjs/no-treatascontent-injection.md)  | `warn`  | Flag dynamic string concatenation in `TreatAsContent` calls |
+
+## Processors
+
+| Processor        | Purpose                                                       |
+| ---------------- | ------------------------------------------------------------- |
+| `sfmc/ampscript` | Extract `%%[ ]%%`, `%%= =%%`, `<script language="ampscript">` |
+| `sfmc/ssjs`      | Extract `<script runat="server">` (non-ampscript)             |
+| `sfmc/sfmc`      | Combined: extracts both AMPscript and SSJS from HTML          |
+
+
+## License
+
+MIT

package/docs/rules/amp/function-arity.md

@@ -0,0 +1,53 @@
+# `sfmc/amp-function-arity`
+
+> Enforce correct argument counts for known AMPscript functions.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+AMPscript functions have fixed required and optional argument counts documented in the Salesforce catalog. Calling a function with too few arguments causes a runtime error. Calling it with too many can silently truncate or fail. This rule validates every call against the known min/max argument counts.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%[
+  /* Lookup requires at least 4 arguments */
+  var @val
+  set @val = Lookup("MyDE", "Value")
+
+  /* Format accepts at most 3 arguments */
+  set @val = Format(@num, "0.00", "en-US", "extra")
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  var @val
+  set @val = Lookup("MyDE", "Value", "Key", @key)
+  set @val = Format(@num, "0.00", "en-US")
+]%%
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-function-arity': 'off' }
+```

package/docs/rules/amp/naming-convention.md

@@ -0,0 +1,76 @@
+# `sfmc/amp-naming-convention`
+
+> Enforce a consistent naming convention for `@variable` names.
+
+| | |
+|---|---|
+| **Type** | `suggestion` |
+| **Default severity** | `off` by default; `warn` when explicitly enabled |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+AMPscript variable names are case-insensitive at runtime, but inconsistent casing (`@myVar` vs `@MyVar` vs `@MYVAR` for the same variable) causes confusion during code reviews and maintenance. Enforcing a single convention across a codebase makes intent clearer and reduces the risk of typos that create an unintended second variable reference.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"off"` |
+| `format` | `"camelCase"` \| `"PascalCase"` | `"camelCase"` |
+
+### Under `"camelCase"` (default)
+
+**Not allowed:**
+
+```ampscript
+%%[
+  var @FirstName
+  var @LAST_NAME
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  var @firstName
+  var @lastName
+]%%
+```
+
+### Under `"PascalCase"`
+
+**Not allowed:**
+
+```ampscript
+%%[
+  var @firstName
+  var @last_name
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  var @FirstName
+  var @LastName
+]%%
+```
+
+## Configuration Example
+
+```js
+// eslint.config.js
+rules: {
+  'sfmc/amp-naming-convention': ['warn', { format: 'PascalCase' }]
+}
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-naming-convention': 'off' }
+```

package/docs/rules/amp/no-deprecated-function.md

@@ -0,0 +1,78 @@
+# `sfmc/amp-no-deprecated-function`
+
+> Flag deprecated AMPscript functions and suggest their modern replacements.
+
+| | |
+|---|---|
+| **Type** | `suggestion` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | **Auto-fix** for 1:1 replacements; **Suggestion** for ambiguous replacements |
+
+## Why This Rule Exists
+
+Salesforce has deprecated several AMPscript functions in favour of newer equivalents. The old functions (e.g. `InsertDE`, `UpdateDE`, `DeleteDE`, `LookupValue`) remain functional for backward compatibility but may be removed in a future platform update. `ContentArea` is a Classic-only function with no equivalent in Content Builder — callers must choose between `ContentBlockByKey` or `ContentBlockByName` depending on their setup.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%[
+  var @rows
+  set @rows = LookupValue("MyDE", "Email", "SubKey", @key)
+
+  var @html
+  set @html = ContentArea(42)
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  var @rows
+  set @rows = Lookup("MyDE", "Email", "SubKey", @key)
+
+  /* Choose one depending on your setup: */
+  var @html
+  set @html = ContentBlockByKey("my-block-key")
+  /* or */
+  set @html = ContentBlockByName("My Block Name")
+]%%
+```
+
+## Fix
+
+This rule provides two types of fix depending on the deprecated function:
+
+**Auto-fix** (for 1:1 replacements such as `InsertDE → InsertData`, `LookupValue → Lookup`, etc.). Applied by:
+
+- `eslint --fix` on the command line (because `meta.type` is `"suggestion"`, you can also target it specifically with `--fix-type suggestion`)
+- **Fix this issue** / **Fix all auto-fixable problems** in VS Code (requires the [ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint))
+- On save via `editor.codeActionsOnSave: { "source.fixAll.eslint": "explicit" }`
+
+What the auto-fix does: replaces only the function name token, leaving all arguments intact.
+
+---
+
+**Suggestion** (for `ContentArea`, which maps to either `ContentBlockByKey` or `ContentBlockByName`). Applied by:
+
+- Click the **lightbulb** / press `Ctrl+.` on the flagged code in VS Code (requires the ESLint extension)
+- `eslint --fix` does **not** apply suggestions (`--fix-type suggestion` filters fixable rules by rule category, it does **not** apply `hasSuggestions` suggestions)
+
+What the suggestion does: offers two separate options — replace `ContentArea` with `ContentBlockByKey` or with `ContentBlockByName`.
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-deprecated-function': 'off' }
+```

package/docs/rules/amp/no-email-excluded-function.md

@@ -0,0 +1,69 @@
+# `sfmc/amp-no-email-excluded-function`
+
+> Disallow AMPscript functions that are not available in the email execution context.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `off` by default |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+Several AMPscript functions — including `InsertData`, `UpdateData`, `DeleteData`, `UpsertData`, `Redirect`, `HTTPGet`, and others — are only available in CloudPage and landing-page contexts. Calling them inside an email causes a runtime error, silently fails, or aborts the send. This rule flags those calls when the file is identified as an email template.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"off"` |
+| `context` | `"email"` \| `"cloudpage"` \| `"auto"` | `"email"` |
+
+### Under `"email"` (default)
+
+Flags every call to an email-excluded function regardless of the filename.
+
+**Not allowed:**
+
+```ampscript
+%%[
+  InsertData("MyDE", "Email", @email)
+  Redirect("https://example.com")
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  InsertDE("MyDE", "Email", @email)
+]%%
+```
+
+> Note: `InsertDE` is itself deprecated — see [`amp-no-deprecated-function`](no-deprecated-function.md).
+
+### Under `"cloudpage"`
+
+Disables all checks. Use this setting for files that are exclusively used as CloudPages.
+
+### Under `"auto"`
+
+Skips checking for files whose name or path contains `cloudpage` or `landing`, or whose extension is `.html`. Otherwise behaves like `"email"`.
+
+## Configuration Example
+
+```js
+// eslint.config.js
+rules: {
+  'sfmc/amp-no-email-excluded-function': ['warn', { context: 'auto' }]
+}
+```
+
+## When to Disable
+
+This rule is off by default because many projects contain both email and CloudPage AMPscript. Enable it with `"context": "auto"` for mixed-use projects, or with `"context": "email"` for email-only repositories.
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-email-excluded-function': 'off' }
+```

package/docs/rules/amp/no-empty-block.md

@@ -0,0 +1,59 @@
+# `sfmc/amp-no-empty-block`
+
+> Disallow empty AMPscript blocks that produce no output or side effects.
+
+| | |
+|---|---|
+| **Type** | `suggestion` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | **Suggestion** (manual, via VS Code lightbulb) |
+
+## Why This Rule Exists
+
+An empty `%%[ ]%%` block (one that contains no statements other than comments) does nothing. Such blocks are typically leftovers from deleted code or copy-paste errors. While harmless at runtime, they add noise to templates and can cause confusion during maintenance.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%[
+]%%
+
+%%[
+  /* TODO: add logic here */
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  var @name
+  set @name = "Alice"
+]%%
+```
+
+## Fix
+
+This rule provides a **suggestion** (not applied automatically). To apply it:
+
+- Click the **lightbulb** / press `Ctrl+.` on the flagged code in VS Code (requires the [ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint))
+- `eslint --fix` does **not** apply suggestions (`--fix-type suggestion` filters fixable rules by rule category, it does **not** apply `hasSuggestions` suggestions)
+
+What the suggestion does: removes the entire `%%[ ]%%` block from the source.
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-empty-block': 'off' }
+```

package/docs/rules/amp/no-empty-then.md

@@ -0,0 +1,62 @@
+# `sfmc/amp-no-empty-then`
+
+> Disallow `IF` statements with an empty `THEN` branch.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+An `IF condition THEN … ELSE … ENDIF` where the `THEN` branch is empty is almost always a logic error. The most common cause is an inverted condition — the developer wrote the consequent code in the `ELSE` branch and left `THEN` empty, or accidentally deleted the `THEN` body during editing. The code either does nothing when the condition is true, or produces the wrong output.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%[
+  if @isActive == 1 then
+  else
+    set @msg = "Inactive"
+  endif
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  if @isActive == 1 then
+    set @msg = "Active"
+  else
+    set @msg = "Inactive"
+  endif
+]%%
+```
+
+```ampscript
+%%[
+  /* Empty THEN with no ELSE is still flagged — use a positive condition instead */
+  if @isActive != 1 then
+    set @msg = "Inactive"
+  endif
+]%%
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-empty-then': 'off' }
+```

package/docs/rules/amp/no-html-comment.md

@@ -0,0 +1,67 @@
+# `sfmc/amp-no-html-comment`
+
+> Disallow HTML comment syntax (`<!-- ... -->`) inside AMPscript regions.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `warn` in `recommended`, `error` in `strict` |
+| **Fixable** | **Auto-fix** (`eslint --fix`) |
+
+## Why This Rule Exists
+
+AMPscript has no HTML comment syntax. HTML comments (`<!-- -->`) inside AMPscript blocks are silently ignored by the SFMC compiler, but they break language servers, formatters (Prettier), and ESLint — including causing crashes in ESLint's `spaced-comment` rule.
+
+Two common variants are caught:
+
+- `<!--/* comment */-->` — an AMPscript `/* */` block comment unnecessarily wrapped in HTML comment markers.
+- `<!-- comment -->` — a plain HTML comment used where an AMPscript comment should be.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%[
+  <!--/* OPCO specific Language */-->
+  set @Opco = AttributeValue("OwningEntity__c")
+]%%
+```
+
+```ampscript
+%%[
+  <!-- some section header -->
+  set @x = 1
+]%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  /* OPCO specific Language */
+  set @Opco = AttributeValue("OwningEntity__c")
+]%%
+```
+
+## Fix
+
+This rule provides an **auto-fix**:
+
+- `<!--/* ... */-->` → `/* ... */` (HTML wrapper is stripped, inner block comment is kept as-is)
+- `<!-- ... -->` → `/* ... */` (entire construct is replaced with an AMPscript block comment)
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-html-comment': 'off' }
+```

package/docs/rules/amp/no-inline-statement.md

@@ -0,0 +1,51 @@
+# `sfmc/amp-no-inline-statement`
+
+> Disallow control-flow statements inside inline expressions (`%%=…=%%`).
+
+| | |
+|---|---|
+| **Type** | `suggestion` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+Inline expressions (`%%=…=%%`) are designed to output a single value. Placing `IF`, `FOR`, `SET`, or `VAR` statements inside them is not supported by the AMPscript parser and causes a parse or runtime error. These constructs belong in block AMPscript (`%%[…]%%`).
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```ampscript
+%%=IF(@x == 1) THEN "yes" ELSE "no" ENDIF=%%
+
+%%=SET @name = "Alice"=%%
+```
+
+**Allowed:**
+
+```ampscript
+%%[
+  if @x == 1 then
+    set @out = "yes"
+  else
+    set @out = "no"
+  endif
+]%%
+%%=v(@out)=%%
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/amp-no-inline-statement': 'off' }
+```