@terpjs/spec 0.14.0 → 0.15.0

package/catalog/frontend/generated-client-only.json

@@ -1,26 +1,26 @@
-{
-  "id": "frontend/generated-client-only",
-  "surface": "frontend",
-  "title": "All network egress goes through the generated, typed client",
-  "intent": "Raw fetch / XMLHttpRequest / WebSocket / EventSource (and navigator.sendBeacon) bypass the app's single audited, typed egress path. One client means one place for auth, errors, and contract types. The refused globals and member calls are declared in restricted-surface.json (restrictedGlobals, restrictedMemberCalls).",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.restrictedGlobals",
-      "reported_as": "no-restricted-globals"
-    }
-  ],
-  "reference": "useTerpClient() + unwrap from @terp/react-core for request/response; useRealtimeChannel() from @terp/react-core for typed SSE/WebSocket subscriptions (one-use ticket minted through the generated client).",
-  "opt_out": "// terp-allow-generated-client-only: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "In the running bundle the sanctioned generated client is itself built on fetch, so egress-primitive use cannot be attributed to an app module from inside the app. One typed egress path is an authoring contract; network policy beyond it (CSP connect-src) is deployment configuration the framework does not own per module."
-  },
-  "restricted_surface": [
-    "restrictedGlobals",
-    "restrictedMemberCalls"
-  ],
-  "corpus": true
-}
+{
+  "id": "frontend/generated-client-only",
+  "surface": "frontend",
+  "title": "All network egress goes through the generated, typed client",
+  "intent": "Raw fetch / XMLHttpRequest / WebSocket / EventSource (and navigator.sendBeacon) bypass the app's single audited, typed egress path. One client means one place for auth, errors, and contract types. The refused globals and member calls are declared in restricted-surface.json (restrictedGlobals, restrictedMemberCalls).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictedGlobals",
+      "reported_as": "no-restricted-globals"
+    }
+  ],
+  "reference": "useTerpClient() + unwrap from @terp/react-core for request/response; useRealtimeChannel() from @terp/react-core for typed SSE/WebSocket subscriptions (one-use ticket minted through the generated client).",
+  "opt_out": "// terp-allow-generated-client-only: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "In the running bundle the sanctioned generated client is itself built on fetch, so egress-primitive use cannot be attributed to an app module from inside the app. One typed egress path is an authoring contract; network policy beyond it (CSP connect-src) is deployment configuration the framework does not own per module."
+  },
+  "restricted_surface": [
+    "restrictedGlobals",
+    "restrictedMemberCalls"
+  ],
+  "corpus": true
+}

package/catalog/frontend/layout-contract.json

@@ -1,26 +1,26 @@
-{
-  "id": "frontend/layout-contract",
-  "surface": "frontend",
-  "title": "An opted-in app's archetype body slots accept only the contract's components",
-  "intent": "With a checked-in layout contract, each page archetype's body slot is constrained to the contract's sanctioned components, so screens stay structurally consistent and the failure message tells an agent exactly how to build the screen. Paired with the fail-closed runtime check on the rendered slot.",
-  "layer": "static-bespoke",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/layout-contract",
-      "reported_as": "terp/layout-contract"
-    },
-    {
-      "kind": "runtime",
-      "tool": "@terp/react-core",
-      "ref": "verifySlotChildren"
-    }
-  ],
-  "opt_out": "// terp-allow-layout-contract: <reason>",
-  "reference": "frontend/layout-contract.json + the layoutContract bootstrap option (ADR 0079); verifySlotChildren in @terp/react-core is the runtime DOM check.",
-  "runtime": {
-    "applicability": "required"
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/layout-contract",
+  "surface": "frontend",
+  "title": "An opted-in app's archetype body slots accept only the contract's components",
+  "intent": "With a checked-in layout contract, each page archetype's body slot is constrained to the contract's sanctioned components, so screens stay structurally consistent and the failure message tells an agent exactly how to build the screen. Paired with the fail-closed runtime check on the rendered slot.",
+  "layer": "static-bespoke",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/layout-contract",
+      "reported_as": "terp/layout-contract"
+    },
+    {
+      "kind": "runtime",
+      "tool": "@terp/react-core",
+      "ref": "verifySlotChildren"
+    }
+  ],
+  "opt_out": "// terp-allow-layout-contract: <reason>",
+  "reference": "frontend/layout-contract.json + the layoutContract bootstrap option (ADR 0079); verifySlotChildren in @terp/react-core is the runtime DOM check.",
+  "runtime": {
+    "applicability": "required"
+  },
+  "corpus": true
+}

package/catalog/frontend/no-cross-module-imports.json

@@ -1,21 +1,21 @@
-{
-  "id": "frontend/no-cross-module-imports",
-  "surface": "frontend",
-  "title": "An app module never imports a sibling module",
-  "intent": "Modules couple only through the platform packages and their own files. A sibling import — static, dynamic import(), relative or via the app alias — creates hidden coupling that breaks module isolation and independent evolution.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/no-cross-module-imports",
-      "reported_as": "terp/no-cross-module-imports"
-    }
-  ],
-  "opt_out": "// terp-allow-no-cross-module-imports: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "Module independence is an import-graph property of the source tree; the bundler merges every module into one dependency graph, after which a cross-module edge is indistinguishable from composition."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/no-cross-module-imports",
+  "surface": "frontend",
+  "title": "An app module never imports a sibling module",
+  "intent": "Modules couple only through the platform packages and their own files. A sibling import — static, dynamic import(), relative or via the app alias — creates hidden coupling that breaks module isolation and independent evolution.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-cross-module-imports",
+      "reported_as": "terp/no-cross-module-imports"
+    }
+  ],
+  "opt_out": "// terp-allow-no-cross-module-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Module independence is an import-graph property of the source tree; the bundler merges every module into one dependency graph, after which a cross-module edge is indistinguishable from composition."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-deep-imports.json

@@ -1,25 +1,25 @@
-{
-  "id": "frontend/no-deep-imports",
-  "surface": "frontend",
-  "title": "App modules import platform packages from the root only",
-  "intent": "A deep import into a platform package's internals couples the app to files that are free to move; the package root is the published, stable surface. The refused path segments are declared in restricted-surface.json (deepImportPathSegments).",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.internalImportPatterns",
-      "reported_as": "no-restricted-imports"
-    }
-  ],
-  "reference": "@terp/*/src/* and @terp/*/dist/* imports are refused; import from the @terp/* package root.",
-  "opt_out": "// terp-allow-no-deep-imports: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "Package-boundary form: the bundler resolves and inlines whatever was imported, and the built artifact retains no distinction between a root import and a deep one."
-  },
-  "restricted_surface": [
-    "deepImportPathSegments"
-  ],
-  "corpus": true
-}
+{
+  "id": "frontend/no-deep-imports",
+  "surface": "frontend",
+  "title": "App modules import platform packages from the root only",
+  "intent": "A deep import into a platform package's internals couples the app to files that are free to move; the package root is the published, stable surface. The refused path segments are declared in restricted-surface.json (deepImportPathSegments).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.internalImportPatterns",
+      "reported_as": "no-restricted-imports"
+    }
+  ],
+  "reference": "@terp/*/src/* and @terp/*/dist/* imports are refused; import from the @terp/* package root.",
+  "opt_out": "// terp-allow-no-deep-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Package-boundary form: the bundler resolves and inlines whatever was imported, and the built artifact retains no distinction between a root import and a deep one."
+  },
+  "restricted_surface": [
+    "deepImportPathSegments"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-dom-html-injection.json

@@ -1,22 +1,22 @@
-{
-  "id": "frontend/no-dom-html-injection",
-  "surface": "frontend",
-  "title": "DOM HTML-injection sinks are refused in app modules",
-  "intent": "dangerouslySetInnerHTML, innerHTML/outerHTML assignment, insertAdjacentHTML and document.write inject markup that bypasses the framework's output escaping — the canonical XSS sink. Rich text renders through the stack's sanctioned rich-text component instead.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/no-dom-html-injection",
-      "reported_as": "terp/no-dom-html-injection"
-    }
-  ],
-  "reference": "The Markdown component from @terp/react-core for rich text.",
-  "opt_out": "// terp-allow-no-dom-html-injection: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The sinks are platform primitives on every element; React's default output escaping is the ambient constructive protection and the sanctioned Markdown component sanitises rich text. A runtime hook over every element's HTML mutation is not a seam react-core owns or could make sound -- vendored code legitimately uses the same primitives."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/no-dom-html-injection",
+  "surface": "frontend",
+  "title": "DOM HTML-injection sinks are refused in app modules",
+  "intent": "dangerouslySetInnerHTML, innerHTML/outerHTML assignment, insertAdjacentHTML and document.write inject markup that bypasses the framework's output escaping — the canonical XSS sink. Rich text renders through the stack's sanctioned rich-text component instead.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-dom-html-injection",
+      "reported_as": "terp/no-dom-html-injection"
+    }
+  ],
+  "reference": "The Markdown component from @terp/react-core for rich text.",
+  "opt_out": "// terp-allow-no-dom-html-injection: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The sinks are platform primitives on every element; React's default output escaping is the ambient constructive protection and the sanctioned Markdown component sanitises rich text. A runtime hook over every element's HTML mutation is not a seam react-core owns or could make sound -- vendored code legitimately uses the same primitives."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-eval.json

@@ -1,21 +1,21 @@
-{
-  "id": "frontend/no-eval",
-  "surface": "frontend",
-  "title": "eval() and new Function() are refused in app modules",
-  "intent": "Runtime code evaluation defeats every static guarantee the boundary provides and is a classic injection primitive. There is no sanctioned dynamic-code path in an app module.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/no-eval",
-      "reported_as": "terp/no-eval"
-    }
-  ],
-  "opt_out": "// terp-allow-no-eval: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The prohibition is on authoring dynamic-code primitives in app modules \u2014 a source-form fact. In the running bundle the primitive itself is a platform global the framework cannot remove, and legitimately vendored code may reference it, so a runtime hook cannot attribute authorship to an app module. Deployment-level CSP can harden the served app, but it is deployment configuration, not a control this framework owns per rule."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/no-eval",
+  "surface": "frontend",
+  "title": "eval() and new Function() are refused in app modules",
+  "intent": "Runtime code evaluation defeats every static guarantee the boundary provides and is a classic injection primitive. There is no sanctioned dynamic-code path in an app module.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-eval",
+      "reported_as": "terp/no-eval"
+    }
+  ],
+  "opt_out": "// terp-allow-no-eval: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The prohibition is on authoring dynamic-code primitives in app modules \u2014 a source-form fact. In the running bundle the primitive itself is a platform global the framework cannot remove, and legitimately vendored code may reference it, so a runtime hook cannot attribute authorship to an app module. Deployment-level CSP can harden the served app, but it is deployment configuration, not a control this framework owns per rule."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-inline-styling.json

@@ -1,25 +1,25 @@
-{
-  "id": "frontend/no-inline-styling",
-  "surface": "frontend",
-  "title": "style and className attributes are refused in app modules",
-  "intent": "A style or className attribute is a side channel into hand-authored CSS that drifts per screen; styling flows from the app's design tokens and sanctioned layout primitives only. The refused attributes are declared in restricted-surface.json (restrictedAttributes).",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.restrictedAttributes",
-      "reported_as": "no-restricted-syntax"
-    }
-  ],
-  "reference": "Layout via Stack, DetailList and the page archetypes from @terp/react-core; theming via the app's token source.",
-  "opt_out": "// terp-allow-no-inline-styling: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "style/className are authoring-surface attributes: the token pipeline itself emits inline styles and class names into the built DOM, so their presence at runtime is legitimate and unattributable to app authorship."
-  },
-  "restricted_surface": [
-    "restrictedAttributes"
-  ],
-  "corpus": true
-}
+{
+  "id": "frontend/no-inline-styling",
+  "surface": "frontend",
+  "title": "style and className attributes are refused in app modules",
+  "intent": "A style or className attribute is a side channel into hand-authored CSS that drifts per screen; styling flows from the app's design tokens and sanctioned layout primitives only. The refused attributes are declared in restricted-surface.json (restrictedAttributes).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictedAttributes",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Layout via Stack, DetailList and the page archetypes from @terp/react-core; theming via the app's token source.",
+  "opt_out": "// terp-allow-no-inline-styling: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "style/className are authoring-surface attributes: the token pipeline itself emits inline styles and class names into the built DOM, so their presence at runtime is legitimate and unattributable to app authorship."
+  },
+  "restricted_surface": [
+    "restrictedAttributes"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-style-imports.json

@@ -1,24 +1,24 @@
-{
-  "id": "frontend/no-style-imports",
-  "surface": "frontend",
-  "title": "Module-authored stylesheets are refused",
-  "intent": "Importing a stylesheet from an app module reintroduces per-screen CSS; theming flows from the app's token source only. The refused stylesheet extensions are declared in restricted-surface.json (styleImportExtensions).",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.styleImportPatterns",
-      "reported_as": "no-restricted-imports"
-    }
-  ],
-  "opt_out": "// terp-allow-no-style-imports: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "A stylesheet import is a build-graph edge; the bundler compiles it into the emitted CSS, after which module authorship does not exist."
-  },
-  "restricted_surface": [
-    "styleImportExtensions"
-  ],
-  "corpus": true
-}
+{
+  "id": "frontend/no-style-imports",
+  "surface": "frontend",
+  "title": "Module-authored stylesheets are refused",
+  "intent": "Importing a stylesheet from an app module reintroduces per-screen CSS; theming flows from the app's token source only. The refused stylesheet extensions are declared in restricted-surface.json (styleImportExtensions).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.styleImportPatterns",
+      "reported_as": "no-restricted-imports"
+    }
+  ],
+  "opt_out": "// terp-allow-no-style-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "A stylesheet import is a build-graph edge; the bundler compiles it into the emitted CSS, after which module authorship does not exist."
+  },
+  "restricted_surface": [
+    "styleImportExtensions"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-unsafe-href.json

@@ -1,21 +1,21 @@
-{
-  "id": "frontend/no-unsafe-href",
-  "surface": "frontend",
-  "title": "javascript: URLs are refused in app modules",
-  "intent": "A javascript: href executes script on click \u2014 an XSS vector that survives the framework's attribute escaping. Links carry http(s), mailto, tel or in-app router paths only.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/no-unsafe-href",
-      "reported_as": "terp/no-unsafe-href"
-    }
-  ],
-  "opt_out": "// terp-allow-no-unsafe-href: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The refusal is of authoring javascript: URLs in source. Data-driven links are the sanctioned components' own concern (the Markdown component strips unsafe protocols at render -- its control, not this rule's), and raw anchors are refused wholesale in app modules anyway."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/no-unsafe-href",
+  "surface": "frontend",
+  "title": "javascript: URLs are refused in app modules",
+  "intent": "A javascript: href executes script on click \u2014 an XSS vector that survives the framework's attribute escaping. Links carry http(s), mailto, tel or in-app router paths only.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-unsafe-href",
+      "reported_as": "terp/no-unsafe-href"
+    }
+  ],
+  "opt_out": "// terp-allow-no-unsafe-href: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The refusal is of authoring javascript: URLs in source. Data-driven links are the sanctioned components' own concern (the Markdown component strips unsafe protocols at render -- its control, not this rule's), and raw anchors are refused wholesale in app modules anyway."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-unsafe-target-blank.json

@@ -1,21 +1,21 @@
-{
-  "id": "frontend/no-unsafe-target-blank",
-  "surface": "frontend",
-  "title": "A static target=\"_blank\" link declares rel=\"noopener\"",
-  "intent": "Without rel=noopener the opened page holds a window.opener reference to the app \u2014 the reverse-tabnabbing primitive. The rule enforces the safe default on every statically-authored external link.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "terp/no-unsafe-target-blank",
-      "reported_as": "terp/no-unsafe-target-blank"
-    }
-  ],
-  "opt_out": "// terp-allow-no-unsafe-target-blank: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "An authored static target=_blank without rel is a source form; the residual risk it addresses is legacy-engine reverse-tabnabbing, fixable only where the anchor is written. Modern engines default to noopener behaviour, and raw anchors are refused wholesale in app modules regardless."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/no-unsafe-target-blank",
+  "surface": "frontend",
+  "title": "A static target=\"_blank\" link declares rel=\"noopener\"",
+  "intent": "Without rel=noopener the opened page holds a window.opener reference to the app \u2014 the reverse-tabnabbing primitive. The rule enforces the safe default on every statically-authored external link.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-unsafe-target-blank",
+      "reported_as": "terp/no-unsafe-target-blank"
+    }
+  ],
+  "opt_out": "// terp-allow-no-unsafe-target-blank: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "An authored static target=_blank without rel is a source form; the residual risk it addresses is legacy-engine reverse-tabnabbing, fixable only where the anchor is written. Modern engines default to noopener behaviour, and raw anchors are refused wholesale in app modules regardless."
+  },
+  "corpus": true
+}

package/catalog/frontend/router-links.json

@@ -1,22 +1,22 @@
-{
-  "id": "frontend/router-links",
-  "surface": "frontend",
-  "title": "In-app links go through the router, never a raw anchor",
-  "intent": "A raw <a href=\"/...\"> forces a full reload and skips the role-aware route guard; in-app navigation uses the stack's router-integrated link. External https:// anchors stay allowed.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.restrictInAppAnchors",
-      "reported_as": "no-restricted-syntax"
-    }
-  ],
-  "reference": "Link from @terp/react-core (router-integrated, role-aware).",
-  "opt_out": "// terp-allow-router-links: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "In the rendered DOM the router's own Link IS an anchor -- raw-anchor authorship is only visible in source, so no DOM check can distinguish a sanctioned link from a hand-written one."
-  },
-  "corpus": true
-}
+{
+  "id": "frontend/router-links",
+  "surface": "frontend",
+  "title": "In-app links go through the router, never a raw anchor",
+  "intent": "A raw <a href=\"/...\"> forces a full reload and skips the role-aware route guard; in-app navigation uses the stack's router-integrated link. External https:// anchors stay allowed.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictInAppAnchors",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Link from @terp/react-core (router-integrated, role-aware).",
+  "opt_out": "// terp-allow-router-links: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "In the rendered DOM the router's own Link IS an anchor -- raw-anchor authorship is only visible in source, so no DOM check can distinguish a sanctioned link from a hand-written one."
+  },
+  "corpus": true
+}

package/catalog/frontend/token-styled-elements.json

@@ -1,25 +1,25 @@
-{
-  "id": "frontend/token-styled-elements",
-  "surface": "frontend",
-  "title": "Raw interactive/structural HTML elements are refused in app modules",
-  "intent": "A raw <button>/<input>/<select>/<textarea>/<table>/<dialog>/<form> bypasses the app's sanctioned, token-styled primitive surface (accessible and theme-consistent by construction). The refused elements are declared in restricted-surface.json (restrictedElements); each has a sanctioned replacement in the stack's component surface, and the violation message names it.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
-      "ref": "BOUNDARY_SPEC.restrictedElements",
-      "reported_as": "no-restricted-syntax"
-    }
-  ],
-  "reference": "Button, Input, Select, Textarea, DataView, ConfirmDialog and Stack as=\"form\" from @terp/react-core (BOUNDARY_SPEC.restrictedElements maps each element to its replacement).",
-  "opt_out": "// terp-allow-token-styled-elements: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The sanctioned components themselves render the raw elements into the built DOM -- every button on screen is legitimate output of Button. Compilation erases which JSX authored a node, and third-party components legitimately render the same primitives, so a DOM scan cannot soundly attribute a raw element to app authorship (unlike the layout contract's slot check, which verifies the identity of sanctioned components at one owned seam)."
-  },
-  "restricted_surface": [
-    "restrictedElements"
-  ],
-  "corpus": true
-}
+{
+  "id": "frontend/token-styled-elements",
+  "surface": "frontend",
+  "title": "Raw interactive/structural HTML elements are refused in app modules",
+  "intent": "A raw <button>/<input>/<select>/<textarea>/<table>/<dialog>/<form> bypasses the app's sanctioned, token-styled primitive surface (accessible and theme-consistent by construction). The refused elements are declared in restricted-surface.json (restrictedElements); each has a sanctioned replacement in the stack's component surface, and the violation message names it.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictedElements",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Button, Input, Select, Textarea, DataView, ConfirmDialog and Stack as=\"form\" from @terp/react-core (BOUNDARY_SPEC.restrictedElements maps each element to its replacement).",
+  "opt_out": "// terp-allow-token-styled-elements: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The sanctioned components themselves render the raw elements into the built DOM -- every button on screen is legitimate output of Button. Compilation erases which JSX authored a node, and third-party components legitimately render the same primitives, so a DOM scan cannot soundly attribute a raw element to app authorship (unlike the layout contract's slot check, which verifies the identity of sanctioned components at one owned seam)."
+  },
+  "restricted_surface": [
+    "restrictedElements"
+  ],
+  "corpus": true
+}