@terpjs/spec 0.19.0 → 0.20.0

package/VERSION

@@ -1 +1 @@
-0.19.0
+0.20.0

package/catalog/backend/emitted_events_are_declared.json

@@ -0,0 +1,22 @@
+{
+  "id": "backend/emitted_events_are_declared",
+  "surface": "backend",
+  "title": "A module emits only the events its manifest declares",
+  "intent": "The manifest's emits list is the module's published contract: it is what the control plane validates, what an operator reads to know what a module produces, and what another team subscribes against. An emit the manifest never declared makes that contract quietly untrue — the event really does go out, so nothing fails, while the document everyone reasons from says it cannot happen. The rule compares every event constant an emit call or lifecycle event map names inside a module package against that module's declared emits.",
+  "layer": "static-bespoke",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_emitted_events_are_declared"
+    }
+  ],
+  "reference": "ModuleSpec(emits=[...]) in modules/<name>/module.py, compared against emit(event=...) and LifecycleEventMap(created=/updated=/deleted=...) references in the same module package.",
+  "opt_out": "# arch-allow-emitted-events-are-declared: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "emit() carries no module identity at the call site, so the running system cannot attribute an emit to the manifest that should have declared it; the association exists only in the source layout (which module package the call lives in). Adding a module handle to emit() to make it runtime-checkable would put the answer in the caller's hands, which is exactly what the rule is verifying."
+  },
+  "guide_topic": "events",
+  "corpus": true
+}

package/corpus/backend/emitted_events_are_declared/compliant-01/modules/notes/module.py

@@ -0,0 +1,13 @@
+from control_plane.events import NOTE_CREATED, NOTE_DELETED
+from terp.core import ModuleSpec, Policy, Roles, emit
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+    emits=[NOTE_CREATED, NOTE_DELETED],
+)
+
+
+def archive(session, note):
+    emit(session, event=NOTE_DELETED, payload={"id": str(note.id)})

package/corpus/backend/emitted_events_are_declared/violation-01/modules/notes/module.py

@@ -0,0 +1,14 @@
+from control_plane.events import NOTE_CREATED, NOTE_DELETED
+from terp.core import ModuleSpec, Policy, Roles, emit
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+    emits=[NOTE_CREATED],
+)
+
+
+def archive(session, note):
+    # Declared nowhere: the manifest above says this module emits only NOTE_CREATED.
+    emit(session, event=NOTE_DELETED, payload={"id": str(note.id)})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/spec",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "The Terp Standard — stack-neutral rule catalog, violation corpus, finding format, and refused-surface declaration (ADRs 0080/0081; packaged per ADR 0082, published per ADR 0086). Data only: consumers resolve the spec root via require.resolve('@terpjs/spec/package.json').",
   "files": [
     "VERSION",