Signal Forms validators

Angular v21 Signal Forms rule functions mirroring the Reactive Forms validators, plus an async hibpPassword() rule. Lives in the @angular-helpers/security/signal-forms sub-entry. Both paradigms delegate to the same shared core helpers, guaranteeing behavioural parity for the same input.

TypeScriptexample.ts
import { Signal Forms validators } from '@angular-helpers/security/signal-forms'

# Methods

MethodSignatureReturnsDescription
strongPasswordstrongPassword(path, options?): voidvoidSync rule — returns { kind: 'weakPassword', message } when entropy score is below minScore (default 2).
safeHtmlsafeHtml(path, options?): voidvoidSync rule — returns { kind: 'unsafeHtml', message } when sanitization alters the input. No-op on SSR.
safeUrlsafeUrl(path, options?): voidvoidSync rule — returns { kind: 'unsafeUrl', message } for malformed URLs or blocked schemes.
noScriptInjectionnoScriptInjection(path, options?): voidvoidSync rule — returns { kind: 'scriptInjection', message }.
noSqlInjectionHintsnoSqlInjectionHints(path, options?): voidvoidSync rule — returns { kind: 'sqlInjectionHint', message }.
hibpPasswordhibpPassword(path, options?): voidvoidAsync rule using validateAsync. Debounces changes (default 300ms), injects HibpService, returns { kind: 'leakedPassword', message, count } on match. Fails open on network errors.
LCP N/A
CLS N/A
INP N/A