# Bone Flow #043 Link Specification v1.0

Component: #043 Link
Runtime: `bone-link.js`
Current implementation version: 1.0.1
Status: Development

## 1. Responsibility

#043 owns LINK Action UI rendering, safe href handling, native anchor attributes, activation state, safe Joint IN href updates, and executed Link OUT handoff to #002 Delivery Channel.

## 2. Responsibility boundaries

- #001 Core v1.0.0: Bone foundation.
- #002 Joint v1.1.36: connection evaluation/rendering and WAIT/FIFO/BLOCKED delivery.
- #017 Text v1.0.34: displayed text responsibility reference.
- #020 Label v1.0.61: common UI / QA / Completion structure reference.
- #022 Hover Border Effect v1.0.10: Active/focus and mouse-over border effects.
- #040 ColorPicker v1.0.15: Link normal/hover, Parent, Effect color selection through Caller API.
- #043 does not duplicate #002 delivery, #022 effect internals, or #040 picker internals.

## 3. Bone contract

`{ id: string, type: "LINK", value: string }`

`value` is the Link href. `javascript:`, `vbscript:`, and `data:` schemes are blocked. ASCII control characters are rejected.

## 4. Link-specific properties

- `text`: visible link text.
- `href`: destination.
- `target`: `_self | _blank | _parent | _top`.
- `rel`: rel token list.
- `download`: absent / empty / filename.
- `tooltip`: native title / aria-label text.
- `disabled`: prevents navigation and activation.
- `underline`: `always | hover | none`.
- `normalColor`: solid or #040 GRADIENT_V1.
- `hoverColor`: solid or #040 GRADIENT_V1.
- `preventNavigation`: caller/test option that suppresses browser navigation while still exercising activation/OUT.

## 5. Parent / layout

Common Parent Preview, parent dependency, FIT, 9-direction placement, width/height, and text alignment are retained.

## 6. Effects

Active/focus and mouse-over border effects are delegated to #022. Effect color is solid/theme because #022 owns the effect rendering contract.

## 7. Untrusted IN / Security

`inspectUntrustedInput()` and `applyJointInput()` inspect `payload.value` as href. Accessor/getter values, non-string values, dangerous schemes, ASCII control characters, and excessive length are BLOCKED. BLOCK preserves the previous href. Security uses a dedicated Link instance and never mutates normal Preview.

## 8. Connection Image

The test page uses #002 `BoneJoint.evaluate()` and `BoneJoint.drawLine()` for five isolated cases: normal IN/OUT, IN target field missing, OUT target field missing, IN type mismatch, OUT type mismatch.

## 9. OUT WAIT / FIFO / BLOCKED

`connectOutput()` delegates to #002 `createDeliveryChannel()`. Target Busy queues WAIT data, Target Ready delivers FIFO, and guard reject produces BLOCKED without Target delivery.

## 10. QA / Completion

Smoke/Validation start at NOT RUN. Static/Node checks are package-side only. Browser Runtime ALL PASS requires the user to run the localhost page. Completion requires Browser Runtime ALL PASS plus WAIT and BLOCK visual confirmations.

## 11. HTML Functional Class

Marker: `bone-html-class-use`. Public APIs have `bone-link-*` functional classes. The Guide stays directly after Preview/API and before Security.

## v1.0.1 correction

- FIT now includes automatic text font-size fitting to the available Link area.
- No Icon/Image link responsibility is added; #043 remains text Link only.