# `OpenFresco.Conformance`
[🔗](https://github.com/alexdont/open_fresco/blob/v0.2.0/lib/open_fresco/conformance.ex#L1)

Conformance checks and host-usable assertions for the generated SVG —
the enforcement side of `OpenFresco.Svg`'s security contract.

Two audiences:

  * **This package's tests** — `check_svg/1` verifies every generated
    document against a fixed tag / attribute / URL-scheme allowlist, and
    the fuzz corpus (`hostile_scenes/0`) drives hostile scene fields
    through the generator asserting the allowlist always holds.
  * **Host apps** — import `check_svg/1` (and `check_scene/2`) into your
    own test suite to CI your templates against this contract, so a
    library change that widened the emitted surface fails *your* build
    too.

The allowlist is intentionally strict: the generator emits a small,
fixed vocabulary. If a legitimate feature needs a new tag, it's added
here deliberately — never discovered in production.

# `allowed_tags`

```elixir
@spec allowed_tags() :: [String.t()]
```

The generator's emitted-tag allowlist (for host tests that assert on it).

# `check_scene`

```elixir
@spec check_scene(OpenFresco.Scene.t(), map(), keyword()) :: :ok | {:error, [term()]}
```

Render `scene` with `values`/`opts` and check the output — the common
host assertion (`assert :ok = check_scene(my_template, my_values)`).

# `check_svg`

```elixir
@spec check_svg(binary()) :: :ok | {:error, [term()]}
```

Check an SVG binary against the contract. Returns `:ok` or
`{:error, [violations]}` where each violation is
`{:disallowed_tag, tag}`, `{:banned_tag, tag}`,
`{:event_handler, attr}`, or `{:unsafe_url, scheme, url}`.

# `hostile_scenes`

```elixir
@spec hostile_scenes() :: [OpenFresco.Scene.t()]
```

A corpus of scenes whose fields carry hostile strings — `<script>`
injection, `javascript:` / `data:text/html` hrefs, quote-breakouts,
event-handler attribute breakouts, entity tricks. Every one must pass
`check_svg/1` after rendering; drives the fuzz test and is exported so
hosts can extend it.

---

*Consult [api-reference.md](api-reference.md) for complete listing*