@terpjs/spec 0.15.0 → 0.17.0

package/README.md

@@ -138,7 +138,7 @@ The standalone suite enforces the split
 | `title` | One-line statement of the invariant. |
 | `intent` | Why the rule exists — the drift or threat it prevents. |
 | `layer` | Cheapest faithful verification for a *new* stack: see below. |
-| `enforcement` | How the reference implementation enforces it (first entry: the `build-time` check). A `runtime` entry names the fail-closed runtime control pairing with it (the two-layer discipline a Level 3 stack must reproduce for the rules that require it); a `black-box` entry names the `@terp/conformance` probe title. For frontend rules, `reported_as` is the ESLint rule id violations surface as — several catalog rules share one core rule id, so the adapter publishes a `catalogRuleId()` mapping and findings are attributed through it. |
+| `enforcement` | How the reference implementation enforces it (first entry: the `build-time` check). A `runtime` entry names the fail-closed runtime control pairing with it (the two-layer discipline a Level 3 stack must reproduce for the rules that require it); a `black-box` entry names the `@terpjs/conformance` probe title. For frontend rules, `reported_as` is the ESLint rule id violations surface as — several catalog rules share one core rule id, so the adapter publishes a `catalogRuleId()` mapping and findings are attributed through it. |
 | `runtime` | **Mandatory.** The rule's runtime-applicability classification (`required` / `not-applicable` / `deferred`) plus a `rationale` (mandatory for exemptions) and, for `deferred`, a `tracking` reference naming where the deferral is tracked — see “Runtime applicability” below. |
 | `restricted_surface` | Frontend prohibition rules only: the `restricted-surface.json` keys the rule realises — the structural citation the spec suite resolves (every key must be claimed by some rule; a prose mention in `intent` must agree with the field). |
 | `opt_out` | The *reference realisation* of the abstract escape-hatch contract (see below). |
@@ -159,7 +159,7 @@ The standalone suite enforces the split
 
 The classification is a judgment about *porting cost*, not a limit on the
 reference implementation — today every rule is enforced by `terp.arch` or
-`@terp/eslint-boundaries` regardless of layer.
+`@terpjs/eslint-boundaries` regardless of layer.
 
 ### Runtime applicability (the two-layer discipline, per rule)
 
@@ -222,7 +222,7 @@ consumers acting on findings without re-reading the catalog), and a
 can be tracked across line-shifting edits). Attribution is always to the
 stack-neutral catalog id — the reference ESLint adapter, whose core rule ids
 are shared between several catalog rules, publishes this mapping as
-`catalogRuleId()` in `@terp/eslint-boundaries`.
+`catalogRuleId()` in `@terpjs/eslint-boundaries`.
 
 ## Check-report format
 
@@ -380,7 +380,7 @@ rule can ship with its gap explicit and reviewed.
 ## Conformance levels
 
 - **Level 1 — black-box:** the app passes the runnable conformance suite
-  (`@terp/conformance`) for the capabilities it claims, including the
+  (`@terpjs/conformance`) for the capabilities it claims, including the
   `standard:` probes the `black-box` catalog entries name.
 - **Level 2 — static rule pack:** additionally, a checker validated against
   this corpus enforces the `static-portable` rules for the app's language(s),
@@ -388,8 +388,8 @@ rule can ship with its gap explicit and reviewed.
 - **Level 3 — full harness:** additionally, the `static-bespoke` rules, the
   paired `runtime` controls of every rule whose `runtime.applicability` is
   `required`, and the governed escape-hatch budget ratchet are enforced (today:
-  the `terp.arch` + `@terp/eslint-boundaries` reference harness on top of
-  `terp.core` / `@terp/react-core`).
+  the `terp.arch` + `@terpjs/eslint-boundaries` reference harness on top of
+  `terp.core` / `@terpjs/react-core`).
 
 ## Growing the spec
 

package/VERSION

@@ -1 +1 @@
-0.15.0
+0.17.0

package/catalog/backend/list_routes_paginate.json

@@ -12,7 +12,7 @@
     },
     {
       "kind": "black-box",
-      "tool": "@terp/conformance",
+      "tool": "@terpjs/conformance",
       "ref": "standard: list routes return a capped Page envelope"
     },
     {
@@ -25,7 +25,7 @@
   "opt_out": "# arch-allow-list-routes-paginate: <reason>",
   "runtime": {
     "applicability": "required",
-    "rationale": "At boot, the route scan on the composition seam (the same seam as _validate_router_response_models) walks every composed route \u2014 decorator, imperative add_api_route, and nested included routers alike \u2014 and raises a BootError naming this rule and the route when a route declares a bare list[...] / Sequence[...] response_model instead of Page[T]. PaginationDep's fail-closed skip/limit caps and the @terp/conformance Page-envelope probe remain in place on top of this in-app refusal."
+    "rationale": "At boot, the route scan on the composition seam (the same seam as _validate_router_response_models) walks every composed route \u2014 decorator, imperative add_api_route, and nested included routers alike \u2014 and raises a BootError naming this rule and the route when a route declares a bare list[...] / Sequence[...] response_model instead of Page[T]. PaginationDep's fail-closed skip/limit caps and the @terpjs/conformance Page-envelope probe remain in place on top of this in-app refusal."
   },
   "guide_topic": "service",
   "corpus": true

package/catalog/backend/migration_history_is_intact.json

@@ -0,0 +1,22 @@
+{
+  "id": "backend/migration_history_is_intact",
+  "surface": "backend",
+  "title": "Each migration history is one unbroken chain from a single first revision",
+  "intent": "A revision whose parent is missing, or a second revision claiming to start the history, means an already-authored migration was deleted or replaced rather than built upon. Every database that applied the removed revision then becomes unupgradable, and no schema-drift check can see it: a database rebuilt from the rewritten history is perfectly consistent with the models, so the build stays green while every provisioned environment is stranded. New schema changes are added on top of the existing chain.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_migration_history_is_intact"
+    }
+  ],
+  "reference": "Within each migrations/versions directory, every revision's declared parent (one id, or each id of a merge revision's tuple) must name a revision defined in that same directory, and at most one revision may declare no parent.",
+  "opt_out": "# arch-allow-migration-history-is-intact: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Chain integrity is a property of the authored revision files and is checked from source alone. The complementary runtime control (terp.migrations.assert_no_orphaned_revisions, which refuses a database whose applied revisions the code no longer defines) enforces a different invariant on a different input: it needs a live database and cannot be observed from the source tree."
+  },
+  "guide_topic": "migrations",
+  "corpus": true
+}

package/catalog/backend/no_hardcoded_credentials.json

@@ -2,7 +2,7 @@
   "id": "backend/no_hardcoded_credentials",
   "surface": "backend",
   "title": "App modules do not hard-code credentials or recognizable secret tokens",
-  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed.",
+  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed. One shape is exempt: an enum member whose literal is its own name (SECRET_REFERENCE = \"secret_reference\") is vocabulary, not secret material.",
   "layer": "static-portable",
   "enforcement": [
     {

package/catalog/backend/safe_methods_are_read_only.json

@@ -17,7 +17,7 @@
     },
     {
       "kind": "black-box",
-      "tool": "@terp/conformance",
+      "tool": "@terpjs/conformance",
       "ref": "standard: safe methods observably mutate nothing"
     }
   ],

package/catalog/backend/schemas_exclude_sensitive_fields.json

@@ -12,7 +12,7 @@
     },
     {
       "kind": "black-box",
-      "tool": "@terp/conformance",
+      "tool": "@terpjs/conformance",
       "ref": "standard: responses never expose credential-shaped fields"
     },
     {

package/catalog/frontend/escape-hatch.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/escape-hatch",
       "reported_as": "terp/escape-hatch"
     }

package/catalog/frontend/generated-client-only.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.restrictedGlobals",
       "reported_as": "no-restricted-globals"
     }
   ],
-  "reference": "useTerpClient() + unwrap from @terp/react-core for request/response; useRealtimeChannel() from @terp/react-core for typed SSE/WebSocket subscriptions (one-use ticket minted through the generated client).",
+  "reference": "useTerpClient() + unwrap from @terpjs/react-core for request/response; useRealtimeChannel() from @terpjs/react-core for typed SSE/WebSocket subscriptions (one-use ticket minted through the generated client).",
   "opt_out": "// terp-allow-generated-client-only: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/catalog/frontend/layout-contract.json

@@ -7,18 +7,18 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/layout-contract",
       "reported_as": "terp/layout-contract"
     },
     {
       "kind": "runtime",
-      "tool": "@terp/react-core",
+      "tool": "@terpjs/react-core",
       "ref": "verifySlotChildren"
     }
   ],
   "opt_out": "// terp-allow-layout-contract: <reason>",
-  "reference": "frontend/layout-contract.json + the layoutContract bootstrap option (ADR 0079); verifySlotChildren in @terp/react-core is the runtime DOM check.",
+  "reference": "frontend/layout-contract.json + the layoutContract bootstrap option (ADR 0079); verifySlotChildren in @terpjs/react-core is the runtime DOM check.",
   "runtime": {
     "applicability": "required"
   },

package/catalog/frontend/no-cross-module-imports.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/no-cross-module-imports",
       "reported_as": "terp/no-cross-module-imports"
     }

package/catalog/frontend/no-deep-imports.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.internalImportPatterns",
       "reported_as": "no-restricted-imports"
     }
   ],
-  "reference": "@terp/*/src/* and @terp/*/dist/* imports are refused; import from the @terp/* package root.",
+  "reference": "@terpjs/*/src/* and @terpjs/*/dist/* imports are refused; import from the @terpjs/* package root.",
   "opt_out": "// terp-allow-no-deep-imports: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/catalog/frontend/no-dom-html-injection.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/no-dom-html-injection",
       "reported_as": "terp/no-dom-html-injection"
     }
   ],
-  "reference": "The Markdown component from @terp/react-core for rich text.",
+  "reference": "The Markdown component from @terpjs/react-core for rich text.",
   "opt_out": "// terp-allow-no-dom-html-injection: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/catalog/frontend/no-eval.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/no-eval",
       "reported_as": "terp/no-eval"
     }

package/catalog/frontend/no-inline-styling.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.restrictedAttributes",
       "reported_as": "no-restricted-syntax"
     }
   ],
-  "reference": "Layout via Stack, DetailList and the page archetypes from @terp/react-core; theming via the app's token source.",
+  "reference": "Layout via Stack, DetailList and the page archetypes from @terpjs/react-core; theming via the app's token source.",
   "opt_out": "// terp-allow-no-inline-styling: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/catalog/frontend/no-style-imports.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.styleImportPatterns",
       "reported_as": "no-restricted-imports"
     }

package/catalog/frontend/no-unsafe-href.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/no-unsafe-href",
       "reported_as": "terp/no-unsafe-href"
     }

package/catalog/frontend/no-unsafe-target-blank.json

@@ -7,7 +7,7 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "terp/no-unsafe-target-blank",
       "reported_as": "terp/no-unsafe-target-blank"
     }

package/catalog/frontend/router-links.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.restrictInAppAnchors",
       "reported_as": "no-restricted-syntax"
     }
   ],
-  "reference": "Link from @terp/react-core (router-integrated, role-aware).",
+  "reference": "Link from @terpjs/react-core (router-integrated, role-aware).",
   "opt_out": "// terp-allow-router-links: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/catalog/frontend/token-styled-elements.json

@@ -7,12 +7,12 @@
   "enforcement": [
     {
       "kind": "build-time",
-      "tool": "@terp/eslint-boundaries",
+      "tool": "@terpjs/eslint-boundaries",
       "ref": "BOUNDARY_SPEC.restrictedElements",
       "reported_as": "no-restricted-syntax"
     }
   ],
-  "reference": "Button, Input, Select, Textarea, DataView, ConfirmDialog and Stack as=\"form\" from @terp/react-core (BOUNDARY_SPEC.restrictedElements maps each element to its replacement).",
+  "reference": "Button, Input, Select, Textarea, DataView, ConfirmDialog and Stack as=\"form\" from @terpjs/react-core (BOUNDARY_SPEC.restrictedElements maps each element to its replacement).",
   "opt_out": "// terp-allow-token-styled-elements: <reason>",
   "runtime": {
     "applicability": "not-applicable",

package/corpus/backend/migration_history_is_intact/compliant-01/modules/notes/migrations/versions/0001_base.py

@@ -0,0 +1,10 @@
+revision = "aaa111"
+down_revision = None
+
+
+def upgrade():
+    op.create_table("notes")
+
+
+def downgrade():
+    op.drop_table("notes")

package/corpus/backend/migration_history_is_intact/compliant-01/modules/notes/migrations/versions/0002_change.py

@@ -0,0 +1,10 @@
+revision = "bbb222"
+down_revision = "aaa111"
+
+
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/migration_history_is_intact/violation-01/modules/notes/migrations/versions/0001_base.py

@@ -0,0 +1,10 @@
+revision = "aaa111"
+down_revision = None
+
+
+def upgrade():
+    op.create_table("notes")
+
+
+def downgrade():
+    op.drop_table("notes")

package/corpus/backend/migration_history_is_intact/violation-01/modules/notes/migrations/versions/0002_change.py

@@ -0,0 +1,10 @@
+revision = "bbb222"
+down_revision = "deleted_parent"
+
+
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/no_hardcoded_credentials/compliant-03/modules/billing/schemas.py

@@ -0,0 +1,20 @@
+"""Compliant: enum vocabulary whose literal is the member's own name.
+
+A member like ``SECRET_REFERENCE = "secret_reference"`` names a parameter kind —
+the string carries no secret material, it *is* the identifier's wire spelling.
+Flagging it would push authors to spell the same vocabulary as ``auto()`` purely
+to dodge the rule, hiding the wire value from readers of the schema.
+"""
+
+from enum import StrEnum
+
+
+class ParameterType(StrEnum):
+    TEXT = "text"
+    NUMBER = "number"
+    SECRET_REFERENCE = "secret_reference"
+
+
+class TokenKind(StrEnum):
+    ACCESS_TOKEN = "access_token"
+    REFRESH_TOKEN = "refresh_token"

package/corpus/frontend/generated-client-only/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { useTerpClient } from "@terp/react-core";
+import { useTerpClient } from "@terpjs/react-core";
 export function Widget() {
   const client = useTerpClient();
   void client;

package/corpus/frontend/generated-client-only/compliant-02/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { useTerpClient } from "@terp/react-core";
+import { useTerpClient } from "@terpjs/react-core";
 
 const repository = {
   fetch(id: string): string {

package/corpus/frontend/generated-client-only/compliant-04/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { useRealtimeChannel } from "@terp/react-core";
+import { useRealtimeChannel } from "@terpjs/react-core";
 
 type Notice = { sequence: number; text: string };
 

package/corpus/frontend/layout-contract/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { HubCard, HubPage } from "@terp/react-core";
+import { HubCard, HubPage } from "@terpjs/react-core";
 export function Widget() {
   return (
     <HubPage title="Notes">

package/corpus/frontend/layout-contract/violation-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { DetailList, HubPage } from "@terp/react-core";
+import { DetailList, HubPage } from "@terpjs/react-core";
 export function Widget() {
   return (
     <HubPage title="Notes">

package/corpus/frontend/no-cross-module-imports/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/no-deep-imports/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/no-deep-imports/violation-01/src/modules/widgets/Widget.tsx

@@ -1,2 +1,2 @@
-import Button from "@terp/react-core/src/Button";
+import Button from "@terpjs/react-core/src/Button";
 export const Widget = () => <Button>x</Button>;

package/corpus/frontend/no-dom-html-injection/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/no-eval/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/no-inline-styling/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/no-style-imports/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/corpus/frontend/router-links/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Link } from "@terp/react-core";
+import { Link } from "@terpjs/react-core";
 export function Widget() {
   return <Link to="/notes">notes</Link>;
 }

package/corpus/frontend/token-styled-elements/compliant-01/src/modules/widgets/Widget.tsx

@@ -1,4 +1,4 @@
-import { Button } from "@terp/react-core";
+import { Button } from "@terpjs/react-core";
 export function Widget() {
   return <Button>ok</Button>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/spec",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "The Terp Standard — stack-neutral rule catalog, violation corpus, finding format, and refused-surface declaration (ADRs 0080/0081; packaged per ADR 0082, published per ADR 0086). Data only: consumers resolve the spec root via require.resolve('@terpjs/spec/package.json').",
   "files": [
     "VERSION",