@terpjs/spec 0.16.0 → 0.18.0

package/VERSION

@@ -1 +1 @@
-0.16.0
+0.18.0

package/catalog/backend/migration_history_is_intact.json

@@ -0,0 +1,22 @@
+{
+  "id": "backend/migration_history_is_intact",
+  "surface": "backend",
+  "title": "Each migration history is one unbroken chain from a single first revision",
+  "intent": "A revision whose parent is missing, or a second revision claiming to start the history, means an already-authored migration was deleted or replaced rather than built upon. Every database that applied the removed revision then becomes unupgradable, and no schema-drift check can see it: a database rebuilt from the rewritten history is perfectly consistent with the models, so the build stays green while every provisioned environment is stranded. New schema changes are added on top of the existing chain.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_migration_history_is_intact"
+    }
+  ],
+  "reference": "Within each non-empty migrations/versions directory, exactly one revision must declare no parent; every other revision's declared parent (one id, or each id of a merge revision's tuple) must name a revision defined in that same directory, and every revision must be reachable from that first revision (no cycles or disconnected chains).",
+  "opt_out": "# arch-allow-migration-history-is-intact: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Chain integrity is a property of the authored revision files and is checked from source alone. The complementary runtime control (terp.migrations.assert_no_orphaned_revisions, which refuses a database whose applied revisions the code no longer defines) enforces a different invariant on a different input: it needs a live database and cannot be observed from the source tree."
+  },
+  "guide_topic": "migrations",
+  "corpus": true
+}

package/catalog/backend/no_hardcoded_credentials.json

@@ -2,7 +2,7 @@
   "id": "backend/no_hardcoded_credentials",
   "surface": "backend",
   "title": "App modules do not hard-code credentials or recognizable secret tokens",
-  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed.",
+  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed. One shape is exempt: an enum member whose literal is its own name (SECRET_REFERENCE = \"secret_reference\") is vocabulary, not secret material.",
   "layer": "static-portable",
   "enforcement": [
     {

package/corpus/backend/migration_history_is_intact/compliant-01/modules/notes/migrations/versions/0001_base.py

@@ -0,0 +1,10 @@
+revision = "aaa111"
+down_revision = None
+
+
+def upgrade():
+    op.create_table("notes")
+
+
+def downgrade():
+    op.drop_table("notes")

package/corpus/backend/migration_history_is_intact/compliant-01/modules/notes/migrations/versions/0002_change.py

@@ -0,0 +1,10 @@
+revision = "bbb222"
+down_revision = "aaa111"
+
+
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/migration_history_is_intact/violation-01/modules/notes/migrations/versions/0001_base.py

@@ -0,0 +1,10 @@
+revision = "aaa111"
+down_revision = None
+
+
+def upgrade():
+    op.create_table("notes")
+
+
+def downgrade():
+    op.drop_table("notes")

package/corpus/backend/migration_history_is_intact/violation-01/modules/notes/migrations/versions/0002_change.py

@@ -0,0 +1,10 @@
+revision = "bbb222"
+down_revision = "deleted_parent"
+
+
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/migration_history_is_intact/violation-02/modules/notes/migrations/versions/0001_cycle.py

@@ -0,0 +1,10 @@
+revision = "aaa111"
+down_revision = "bbb222"
+
+
+def upgrade():
+    op.create_table("notes")
+
+
+def downgrade():
+    op.drop_table("notes")

package/corpus/backend/migration_history_is_intact/violation-02/modules/notes/migrations/versions/0002_cycle.py

@@ -0,0 +1,10 @@
+revision = "bbb222"
+down_revision = "aaa111"
+
+
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/no_hardcoded_credentials/compliant-03/modules/billing/schemas.py

@@ -0,0 +1,20 @@
+"""Compliant: enum vocabulary whose literal is the member's own name.
+
+A member like ``SECRET_REFERENCE = "secret_reference"`` names a parameter kind —
+the string carries no secret material, it *is* the identifier's wire spelling.
+Flagging it would push authors to spell the same vocabulary as ``auto()`` purely
+to dodge the rule, hiding the wire value from readers of the schema.
+"""
+
+from enum import StrEnum
+
+
+class ParameterType(StrEnum):
+    TEXT = "text"
+    NUMBER = "number"
+    SECRET_REFERENCE = "secret_reference"
+
+
+class TokenKind(StrEnum):
+    ACCESS_TOKEN = "access_token"
+    REFRESH_TOKEN = "refresh_token"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/spec",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "The Terp Standard — stack-neutral rule catalog, violation corpus, finding format, and refused-surface declaration (ADRs 0080/0081; packaged per ADR 0082, published per ADR 0086). Data only: consumers resolve the spec root via require.resolve('@terpjs/spec/package.json').",
   "files": [
     "VERSION",