@terpjs/eslint-boundaries 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/eslint-boundaries",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "Terp frontend boundary rules (as data) + the ESLint adapter: no cross-module imports, no package internals, design-token-only styling (no style/className/module stylesheets), token-styled components for raw HTML tags, router-only in-app links, generated-client-only, and browser XSS/navigation sink bans. Strict-only (no modes); governed opt-outs via terp-allow markers + the escape-hatch budget ratchet (terp-boundaries-budget).",
   "main": "./src/index.js",
@@ -25,9 +25,9 @@
     "typescript-eslint": "^8.20.0"
   },
   "devDependencies": {
-    "@terp/spec": "github:AITT-NL/terp-spec#v0.14.0",
-    "eslint": "^9.18.0",
-    "vitest": "^3.0.0"
+    "@terpjs/spec": "0.18.0",
+    "eslint": "^10.8.0",
+    "vitest": "^4.1.9"
   },
   "license": "Apache-2.0",
   "repository": {

package/src/corpus-harness.js

@@ -4,7 +4,7 @@
  *
  * Shared by the certification test (corpus.test.js) and the scorecard emitter
  * (scorecard.js), so the two can never apply different corpus semantics. The spec
- * is resolved as a declared dependency (@terp/spec, ADR 0082) by the CALLER —
+ * is resolved as a declared dependency (@terpjs/spec, ADR 0082) by the CALLER —
  * this module takes paths, never resolves the spec itself.
  */
 

package/src/corpus.test.js

@@ -22,10 +22,9 @@ import { describe, expect, it } from "vitest";
 
 import { lintCaseFindings } from "./corpus-harness.js";
 
-// The spec is a declared dependency (@terp/spec, ADR 0082), never a repo-relative path —
-// inside the monorepo it resolves to the workspace member; after a repo split, to the pin.
+// The spec is a declared dependency (@terpjs/spec, ADR 0082), never a repo-relative path.
 const SPEC_ROOT = path.dirname(
-  createRequire(import.meta.url).resolve("@terp/spec/package.json"),
+  createRequire(import.meta.url).resolve("@terpjs/spec/package.json"),
 );
 const CATALOG = path.join(SPEC_ROOT, "catalog", "frontend");
 const CORPUS = path.join(SPEC_ROOT, "corpus", "frontend");

package/src/findings.js

@@ -7,7 +7,7 @@
  * check `terp-boundaries-budget` runs) in one command, and publishes one **findings
  * envelope** on stdout:
  *
- *   { "terp_findings": 1, "tool": "@terp/eslint-boundaries",
+ *   { "terp_findings": 1, "tool": "@terpjs/eslint-boundaries",
  *     "rules": ["frontend/<rule>", …],          // every catalog rule this run evaluated
  *     "not_applicable": ["frontend/<rule>", …], // opt-in rules this app has not enabled
  *     "findings": [{ rule, path, line, message }, …],   // spec findings.schema.json shape
@@ -128,7 +128,7 @@ export function renderEnvelope(results, cwd = process.cwd(), options = {}) {
   return {
     envelope: {
       terp_findings: 1,
-      tool: "@terp/eslint-boundaries",
+      tool: "@terpjs/eslint-boundaries",
       rules: catalogRuleIds().filter((id) => !notApplicable.includes(id)),
       not_applicable: notApplicable,
       findings,

package/src/findings.test.js

@@ -16,7 +16,7 @@ import { SPEC_VERSION } from "./spec.js";
 // stack-neutral catalog ids, humans keep stderr, and the exit code stays the verdict.
 
 const SPEC_ROOT = path.dirname(
-  createRequire(import.meta.url).resolve("@terp/spec/package.json"),
+  createRequire(import.meta.url).resolve("@terpjs/spec/package.json"),
 );
 const FINDINGS_BIN = fileURLToPath(new URL("./findings.js", import.meta.url));
 
@@ -71,7 +71,7 @@ describe("renderEnvelope", () => {
       layoutContract: true,
     });
     expect(envelope.terp_findings).toBe(1);
-    expect(envelope.tool).toBe("@terp/eslint-boundaries");
+    expect(envelope.tool).toBe("@terpjs/eslint-boundaries");
     expect(envelope.rules).toEqual(catalogRuleIds());
     expect(envelope.not_applicable).toEqual([]);
     const rules = envelope.findings.map((finding) => finding.rule);
@@ -252,11 +252,11 @@ describe("the check report (--format check-report, app-check-report.schema.json)
     const report = asCheckReport(envelope);
     expect(report.terp_check_report).toBe(1);
     // The certified spec version rides every report. Shape only here — the
-    // equality lock against the pinned @terp/spec lives in the framework gate
+    // equality lock against the pinned @terpjs/spec lives in the framework gate
     // (test_check_json.py), because certification runs THIS suite against
     // candidate spec releases whose version is allowed to be newer.
     expect(report.spec_version).toMatch(/^\d+\.\d+\.\d+$/);
-    expect(report.checker.tool).toBe("@terp/eslint-boundaries");
+    expect(report.checker.tool).toBe("@terpjs/eslint-boundaries");
     expect(report.checker.version).toMatch(/^\d+\.\d+\.\d+$/);
     expect(report.ok).toBe(false);
     expect(report.rules).toEqual(catalogRuleIds());

package/src/index.test.js

@@ -187,7 +187,7 @@ describe("terpBoundaries", () => {
   });
 
   it("flags a deep import into a package's internals", async () => {
-    const code = 'import x from "@terp/react-core/src/secret";\nexport const W = () => null;';
+    const code = 'import x from "@terpjs/react-core/src/secret";\nexport const W = () => null;';
     expect(await lint(code)).toContain("no-restricted-imports");
   });
 

package/src/scorecard.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Emit the Terp Standard conformance scorecard for `@terp/eslint-boundaries`
+ * Emit the Terp Standard conformance scorecard for `@terpjs/eslint-boundaries`
  * (the frontend checker).
  *
  * The scorecard (`scorecard.schema.json` in the spec) turns "certified against
@@ -9,7 +9,7 @@
  * residuals the adapter relies on (held to a subset of the spec's recorded
  * `corpus/RESIDUALS.json`). A consumer re-runs the corpus and reproduces it.
  *
- * A certification-context tool, not an app tool: it needs `@terp/spec` (a dev
+ * A certification-context tool, not an app tool: it needs `@terpjs/spec` (a dev
  * dependency of the platform repo) and runs the SAME harness the corpus test
  * uses (./corpus-harness.js), so the scorecard can never disagree with the
  * suite. Self-validates and refuses to write an invalid or failing scorecard
@@ -31,12 +31,12 @@ const require = createRequire(import.meta.url);
 const RULE_ID_RE = /^(backend\/[a-z0-9_]+|frontend\/[a-z0-9-]+)$/;
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 
-/** The @terp/spec root — resolved lazily so importing this module never requires it. */
+/** The @terpjs/spec root — resolved lazily so importing this module never requires it. */
 function specRoot() {
-  return path.dirname(require.resolve("@terp/spec/package.json"));
+  return path.dirname(require.resolve("@terpjs/spec/package.json"));
 }
 
-/** Build the @terp/eslint-boundaries scorecard over the frontend corpus. */
+/** Build the @terpjs/eslint-boundaries scorecard over the frontend corpus. */
 export async function buildScorecard() {
   const root = specRoot();
   const catalogDir = path.join(root, "catalog", "frontend");
@@ -70,7 +70,7 @@ export async function buildScorecard() {
   }
   return {
     spec_version: fs.readFileSync(path.join(root, "VERSION"), "utf8").trim(),
-    checker: { tool: "@terp/eslint-boundaries", version: packageVersion },
+    checker: { tool: "@terpjs/eslint-boundaries", version: packageVersion },
     rules,
   };
 }

package/src/scorecard.test.js

@@ -15,10 +15,10 @@ import { describe, expect, it } from "vitest";
 import { buildScorecard, validateScorecard } from "./scorecard.js";
 
 const SPEC_ROOT = path.dirname(
-  createRequire(import.meta.url).resolve("@terp/spec/package.json"),
+  createRequire(import.meta.url).resolve("@terpjs/spec/package.json"),
 );
 
-describe("the @terp/eslint-boundaries scorecard", () => {
+describe("the @terpjs/eslint-boundaries scorecard", () => {
   it("claims the whole corpus-covered catalog, green, schema-shaped", async () => {
     const scorecard = await buildScorecard();
     expect(validateScorecard(scorecard)).toEqual([]);
@@ -34,7 +34,7 @@ describe("the @terp/eslint-boundaries scorecard", () => {
     expect(scorecard.spec_version).toBe(
       fs.readFileSync(path.join(SPEC_ROOT, "VERSION"), "utf8").trim(),
     );
-    expect(scorecard.checker.tool).toBe("@terp/eslint-boundaries");
+    expect(scorecard.checker.tool).toBe("@terpjs/eslint-boundaries");
     const itemProperties = Object.keys(schema.properties.rules.items.properties);
     for (const claim of scorecard.rules) {
       expect(claim.pass).toBe(true);

package/src/spec.js

@@ -9,13 +9,13 @@
 /**
  * The Terp Standard version this adapter is certified against — the `spec_version` a
  * check report (`app-check-report.schema.json`) carries. A constant rather than a runtime
- * `@terp/spec` read: the spec data package is a dev/certification dependency of the platform
+ * `@terpjs/spec` read: the spec data package is a dev/certification dependency of the platform
  * repo, not of a generated app, and the version is a property of the toolchain build. Held
  * equal to the pinned spec release by the framework gate (test_check_json.py — deliberately
  * NOT by this package's own suite, which certification runs against candidate spec releases
  * whose version is allowed to be newer).
  */
-export const SPEC_VERSION = "0.14.0";
+export const SPEC_VERSION = "0.18.0";
 
 export const BOUNDARY_SPEC = {
   /** App module files the boundary + frontend security defaults apply to. */
@@ -45,7 +45,7 @@ export const BOUNDARY_SPEC = {
    */
   restrictInAppAnchors: true,
   /** Package internals an app module must not deep-import (import from the package root). */
-  internalImportPatterns: ["@terp/*/src/*", "@terp/*/dist/*"],
+  internalImportPatterns: ["@terpjs/*/src/*", "@terpjs/*/dist/*"],
   /** Module-authored stylesheets are refused — theming flows from the app's token source. */
   styleImportPatterns: [
     "*.css",

package/src/surface.test.js

@@ -22,9 +22,9 @@ import { describe, expect, it } from "vitest";
 
 import terpBoundaries, { BOUNDARY_SPEC, catalogRuleId } from "./index.js";
 
-// The spec is a declared dependency (@terp/spec, ADR 0082), never a repo-relative path.
+// The spec is a declared dependency (@terpjs/spec, ADR 0082), never a repo-relative path.
 const SPEC_ROOT = path.dirname(
-  createRequire(import.meta.url).resolve("@terp/spec/package.json"),
+  createRequire(import.meta.url).resolve("@terpjs/spec/package.json"),
 );
 const SURFACE = JSON.parse(
   fs.readFileSync(path.join(SPEC_ROOT, "restricted-surface.json"), "utf8"),
@@ -70,7 +70,7 @@ describe("structural parity: BOUNDARY_SPEC realises exactly the declared surface
 
   it("every declared deep-import segment is refused by the import patterns", () => {
     for (const segment of SURFACE.deepImportPathSegments) {
-      expect(BOUNDARY_SPEC.internalImportPatterns).toContain(`@terp/*/${segment}/*`);
+      expect(BOUNDARY_SPEC.internalImportPatterns).toContain(`@terpjs/*/${segment}/*`);
     }
     expect(BOUNDARY_SPEC.internalImportPatterns).toHaveLength(
       SURFACE.deepImportPathSegments.length,
@@ -123,7 +123,7 @@ describe("behavioural parity: each declared primitive is refused with the right
   for (const segment of SURFACE.deepImportPathSegments) {
     it(`deep import via /${segment}/ -> frontend/no-deep-imports`, async () => {
       expect(
-        await lintModuleSource(`import { x } from "@terp/react-core/${segment}/internal";\n`),
+        await lintModuleSource(`import { x } from "@terpjs/react-core/${segment}/internal";\n`),
       ).toContain("frontend/no-deep-imports");
     });
   }
@@ -148,7 +148,7 @@ const VIOLATION_SNIPPETS = {
   "frontend/no-inline-styling": 'export const W = () => <div className="x" />;',
   "frontend/router-links": 'export const W = () => <a href="/notes">go</a>;',
   "frontend/generated-client-only": 'export const ping = () => fetch("/healthz");',
-  "frontend/no-deep-imports": 'import { x } from "@terp/react-core/src/internal";',
+  "frontend/no-deep-imports": 'import { x } from "@terpjs/react-core/src/internal";',
   "frontend/no-style-imports": 'import "./widget.css";',
   "frontend/no-cross-module-imports": 'import { x } from "../other/thing";',
   "frontend/no-dom-html-injection": "export const W = (el, html) => { el.innerHTML = html; };",