@suss/contract-wrangler 0.9.0 → 0.11.0

package/README.md

@@ -25,10 +25,14 @@ queue = "greeting-events"
 | --- | --- |
 | `name`, `main` | the deployable unit and the code it runs |
 | `[vars]` | the Worker's runtime configuration, names and values |
-| `[[kv_namespaces]]`, `[[r2_buckets]]`, `[[d1_databases]]` | one store each |
+| `[[kv_namespaces]]`, `[[r2_buckets]]`, `[[d1_databases]]` | one store each, under the binding name the code spells |
 | `[[queues.producers]]`, `[[queues.consumers]]` | one channel each, on `cloudflare-queues` |
 | `[env.<name>]` | the same Worker deployed again, with the top-level document as its default |
 
+A store's container is the binding name, `SESSIONS`, because that is what an access in the Worker spells (`env.SESSIONS.get(...)`), and `@suss/framework-cloudflare-workers` records the same name on the code side, so the storage check pairs the two. The resource's own name, the KV namespace id or the bucket name, goes on the summary as `physicalTable`, the same split a Prisma model has between the model and the table it maps to.
+
+Binding names are also listed on the runtime-config contract, beside the `[vars]` names: a binding is a property of the same `env` object, so a Worker that reads `env.AUDIT_KV` without a binding block for it gets the same finding as a read of a variable nobody set.
+
 ## The values, not only the names
 
 A runtime-config contract usually records which variables a runtime supplies, and that is enough to say whether code reads one nobody set. A Worker needs more, because it addresses its stores through a variable:

package/dist/index.cjs

@@ -79,9 +79,9 @@ function storeSummaries(document, context) {
   return summaries;
 }
 function storeSummary(store, entry, context) {
-  const container = stringOf(entry[store.nameKey]);
+  const resourceName = stringOf(entry[store.nameKey]);
   const boundAs = stringOf(entry.binding);
-  if (container === null) {
+  if (resourceName === null) {
     return null;
   }
   return {
@@ -92,13 +92,15 @@ function storeSummary(store, entry, context) {
       exportName: null
     },
     identity: {
-      name: `${store.block}.${boundAs ?? container}`,
+      name: `${store.block}.${boundAs ?? resourceName}`,
       exportPath: null,
       boundaryBinding: (0, import_behavioral_ir.storageBinding)({
         recognition: RECOGNITION,
         storageSystem: store.storageSystem,
         scope: "default",
-        container,
+        // The binding name is what an access in the Worker spells, so
+        // it is the name the storage check pairs on.
+        container: boundAs ?? resourceName,
         accessPath: null
       })
     },
@@ -107,11 +109,42 @@ function storeSummary(store, entry, context) {
     gaps: [],
     confidence: { source: "declared", level: "high" },
     metadata: {
-      storageContract: { fieldSet: store.fieldSet, physicalTable: container },
+      storageContract: {
+        fieldSet: store.fieldSet,
+        physicalTable: resourceName
+      },
       ...boundAs === null ? {} : { wrangler: { binding: boundAs } }
     }
   };
 }
+var BINDING_BLOCKS = [
+  "kv_namespaces",
+  "r2_buckets",
+  "d1_databases",
+  "queues"
+];
+function bindingNames(document) {
+  const names = [];
+  for (const store of STORES) {
+    for (const entry of blockEntries(document[store.block])) {
+      const boundAs = stringOf(entry.binding);
+      if (boundAs !== null) {
+        names.push(boundAs);
+      }
+    }
+  }
+  const queues = asRecord(document.queues);
+  for (const entry of blockEntries(queues?.producers)) {
+    const boundAs = stringOf(entry.binding);
+    if (boundAs !== null) {
+      names.push(boundAs);
+    }
+  }
+  return names;
+}
+function asRecord(raw) {
+  return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+}
 function queueSummaries(document, context) {
   const queues = document.queues;
   if (queues === null || typeof queues !== "object") {
@@ -248,10 +281,22 @@ function environmentDocuments(document) {
   return deployments;
 }
 function inheritedNames(document, overrides) {
-  if (overrides.vars !== void 0) {
-    return /* @__PURE__ */ new Set();
+  const names = /* @__PURE__ */ new Set();
+  if (overrides.vars === void 0) {
+    for (const name of Object.keys(varsOf(document))) {
+      names.add(name);
+    }
+  }
+  const kept = {};
+  for (const block of BINDING_BLOCKS) {
+    if (overrides[block] === void 0) {
+      kept[block] = document[block];
+    }
+  }
+  for (const name of bindingNames(kept)) {
+    names.add(name);
   }
-  return new Set(Object.keys(varsOf(document)));
+  return names;
 }
 function nameOf(document) {
   return typeof document.name === "string" && document.name.length > 0 ? document.name : null;
@@ -262,7 +307,9 @@ function varsOf(document) {
 }
 function runtimeConfigSummary(deployment, context) {
   const vars = varsOf(deployment.merged);
-  const names = Object.keys(vars).sort();
+  const names = [
+    .../* @__PURE__ */ new Set([...Object.keys(vars), ...bindingNames(deployment.merged)])
+  ].sort();
   const sources = {};
   const values = {};
   for (const name of names) {

package/dist/index.d.cts

@@ -57,10 +57,11 @@ declare function loadConfigurationDocument(file: string): WranglerDocument;
  *
  * Every binding block in a Wrangler document has the same two halves:
  * `binding`, the name the code reads it under, and a key giving the
- * resource's own name. The code says the first, the deployment declares the
- * second, so a summary keeps both: the container is the resource's own
- * name, which is what another manifest declaring that resource spells,
- * and `physicalTable` records it again for a reader.
+ * resource's own name. The code says the first, the deployment declares
+ * the second, so a summary keeps both: the container is the binding
+ * name, which is what an access in the Worker spells (`env.SESSIONS`),
+ * and `physicalTable` is the resource's own name, the same split a
+ * Prisma model has between the model and the table it maps to.
  */
 
 /** The manifest language recorded on every binding this reader writes. */

package/dist/index.d.ts

@@ -57,10 +57,11 @@ declare function loadConfigurationDocument(file: string): WranglerDocument;
  *
  * Every binding block in a Wrangler document has the same two halves:
  * `binding`, the name the code reads it under, and a key giving the
- * resource's own name. The code says the first, the deployment declares the
- * second, so a summary keeps both: the container is the resource's own
- * name, which is what another manifest declaring that resource spells,
- * and `physicalTable` records it again for a reader.
+ * resource's own name. The code says the first, the deployment declares
+ * the second, so a summary keeps both: the container is the binding
+ * name, which is what an access in the Worker spells (`env.SESSIONS`),
+ * and `physicalTable` is the resource's own name, the same split a
+ * Prisma model has between the model and the table it maps to.
  */
 
 /** The manifest language recorded on every binding this reader writes. */

package/dist/index.js

@@ -38,9 +38,9 @@ function storeSummaries(document, context) {
   return summaries;
 }
 function storeSummary(store, entry, context) {
-  const container = stringOf(entry[store.nameKey]);
+  const resourceName = stringOf(entry[store.nameKey]);
   const boundAs = stringOf(entry.binding);
-  if (container === null) {
+  if (resourceName === null) {
     return null;
   }
   return {
@@ -51,13 +51,15 @@ function storeSummary(store, entry, context) {
       exportName: null
     },
     identity: {
-      name: `${store.block}.${boundAs ?? container}`,
+      name: `${store.block}.${boundAs ?? resourceName}`,
       exportPath: null,
       boundaryBinding: storageBinding({
         recognition: RECOGNITION,
         storageSystem: store.storageSystem,
         scope: "default",
-        container,
+        // The binding name is what an access in the Worker spells, so
+        // it is the name the storage check pairs on.
+        container: boundAs ?? resourceName,
         accessPath: null
       })
     },
@@ -66,11 +68,42 @@ function storeSummary(store, entry, context) {
     gaps: [],
     confidence: { source: "declared", level: "high" },
     metadata: {
-      storageContract: { fieldSet: store.fieldSet, physicalTable: container },
+      storageContract: {
+        fieldSet: store.fieldSet,
+        physicalTable: resourceName
+      },
       ...boundAs === null ? {} : { wrangler: { binding: boundAs } }
     }
   };
 }
+var BINDING_BLOCKS = [
+  "kv_namespaces",
+  "r2_buckets",
+  "d1_databases",
+  "queues"
+];
+function bindingNames(document) {
+  const names = [];
+  for (const store of STORES) {
+    for (const entry of blockEntries(document[store.block])) {
+      const boundAs = stringOf(entry.binding);
+      if (boundAs !== null) {
+        names.push(boundAs);
+      }
+    }
+  }
+  const queues = asRecord(document.queues);
+  for (const entry of blockEntries(queues?.producers)) {
+    const boundAs = stringOf(entry.binding);
+    if (boundAs !== null) {
+      names.push(boundAs);
+    }
+  }
+  return names;
+}
+function asRecord(raw) {
+  return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+}
 function queueSummaries(document, context) {
   const queues = document.queues;
   if (queues === null || typeof queues !== "object") {
@@ -207,10 +240,22 @@ function environmentDocuments(document) {
   return deployments;
 }
 function inheritedNames(document, overrides) {
-  if (overrides.vars !== void 0) {
-    return /* @__PURE__ */ new Set();
+  const names = /* @__PURE__ */ new Set();
+  if (overrides.vars === void 0) {
+    for (const name of Object.keys(varsOf(document))) {
+      names.add(name);
+    }
+  }
+  const kept = {};
+  for (const block of BINDING_BLOCKS) {
+    if (overrides[block] === void 0) {
+      kept[block] = document[block];
+    }
+  }
+  for (const name of bindingNames(kept)) {
+    names.add(name);
   }
-  return new Set(Object.keys(varsOf(document)));
+  return names;
 }
 function nameOf(document) {
   return typeof document.name === "string" && document.name.length > 0 ? document.name : null;
@@ -221,7 +266,9 @@ function varsOf(document) {
 }
 function runtimeConfigSummary(deployment, context) {
   const vars = varsOf(deployment.merged);
-  const names = Object.keys(vars).sort();
+  const names = [
+    .../* @__PURE__ */ new Set([...Object.keys(vars), ...bindingNames(deployment.merged)])
+  ].sort();
   const sources = {};
   const values = {};
   for (const name of names) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/contract-wrangler",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "Generate suss behavioral summaries from a Cloudflare wrangler.toml or wrangler.jsonc.",
   "keywords": [
@@ -45,8 +45,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@suss/behavioral-ir": "0.9.0",
-    "@suss/ir-core": "0.9.0",
+    "@suss/behavioral-ir": "0.11.0",
+    "@suss/ir-core": "0.11.0",
     "jsonc-parser": "^3.3.1",
     "smol-toml": "^1.4.2"
   },