@suss/ir-core 0.19.0 → 0.21.0

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   ConfidenceSourceSchema,
   CorroborationSchema,
   DeployableUnitSchema,
+  EVERY_FIELD,
   FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
@@ -16,6 +17,7 @@ import {
   SourceLocationSchema,
   StorageSemanticsSchema,
   TypeShapeSchema,
+  UnitInvocationSemanticsSchema,
   allBehaviors,
   behaviorOf,
   busIdentityKey,
@@ -34,9 +36,12 @@ import {
   routePathAdmits,
   semconvMappingOf,
   statesAnOrigin,
+  storageContainerLabel,
+  storageLabel,
   typeDefinitionKey,
+  unitIdentityKey,
   withDefinitionsInlined
-} from "./chunk-HSJYPBJU.js";
+} from "./chunk-QHFMZPEG.js";
 
 // src/semconv.ts
 function semconvAttributes(binding) {
@@ -58,9 +63,22 @@ function semconvAttributes(binding) {
 }
 
 // src/boundaryKey.ts
+function bindingIs(binding, name) {
+  return binding?.semantics.name === name;
+}
 function boundaryKey(binding) {
   return behaviorOf(binding.semantics).identityKey(binding.semantics);
 }
+function withRewrittenPaths(binding, rewrite) {
+  const behavior = behaviorOf(binding.semantics);
+  if (behavior.rewritePaths === void 0) {
+    return binding;
+  }
+  return {
+    ...binding,
+    semantics: behavior.rewritePaths(binding.semantics, rewrite)
+  };
+}
 function groundedPairingKey(binding, deployedAs) {
   const behavior = behaviorOf(binding.semantics);
   const grounded = behavior.groundName?.(binding.semantics, deployedAs) ?? null;
@@ -115,6 +133,10 @@ function servesRequest(binding, method, path) {
   }
   return serves(binding.semantics, method, path);
 }
+function withinScope(binding, scope) {
+  const within = behaviorOf(binding.semantics).withinScope;
+  return within === void 0 ? false : within(binding.semantics, scope);
+}
 
 // src/dispatch.ts
 function dispatchByType(table, value) {
@@ -251,6 +273,57 @@ function referenceFromName(name) {
   return referenceOf(parseBoundaryName(name));
 }
 
+// src/boundarySpelling.ts
+function resourceNameIn(spelling) {
+  if (spelling.startsWith("arn:")) {
+    const segments2 = spelling.split(":");
+    return segments2[6] ?? segments2[5] ?? spelling;
+  }
+  const segments = spelling.split("/");
+  if (segments.length >= 4 && segments.length % 2 === 0) {
+    return segments[segments.length - 1] ?? spelling;
+  }
+  return spelling;
+}
+function spellingTokens(text) {
+  return text.toLowerCase().replace(/[{}]/g, " ").split(/[\s:#,()/]+/).filter((token) => token.length > 0);
+}
+function bindingTokens(binding) {
+  const tokens = new Set(spellingTokens(displayLabel(binding)));
+  for (const value of Object.values(binding.semantics)) {
+    if (typeof value === "string") {
+      for (const token of spellingTokens(value)) {
+        tokens.add(token);
+      }
+    }
+  }
+  for (const token of [...tokens]) {
+    for (const part of token.split(".")) {
+      tokens.add(part);
+    }
+  }
+  return tokens;
+}
+function namesBoundaryExactly(subject, binding) {
+  const wanted = new Set(spellingTokens(subject));
+  if (wanted.size === 0) {
+    return false;
+  }
+  const spelled = new Set(spellingTokens(displayLabel(binding)));
+  if (spelled.size !== wanted.size) {
+    return false;
+  }
+  return [...spelled].every((token) => wanted.has(token));
+}
+function namesBoundary(subject, binding) {
+  const wanted = spellingTokens(subject);
+  if (wanted.length === 0) {
+    return false;
+  }
+  const tokens = bindingTokens(binding);
+  return wanted.every((token) => tokens.has(token));
+}
+
 // src/codeScope.ts
 function codeScopePath(raw) {
   return raw.trim().replace(/^\.\//, "").replace(/\/+$/, "");
@@ -264,26 +337,36 @@ function fileInCodeScope(file, scope) {
   return path === prefix || path.startsWith(`${prefix}/`);
 }
 
-// src/suppressions.ts
+// src/relation.ts
 import { z } from "zod";
-var SuppressionSideSchema = z.object({
-  summary: z.string().optional(),
-  transitionId: z.string().optional()
+var RelationSchema = z.enum([
+  "provides",
+  "reads",
+  "writes",
+  "invokes"
+]);
+var EffectRelationSchema = RelationSchema.exclude(["provides"]);
+
+// src/suppressions.ts
+import { z as z2 } from "zod";
+var SuppressionSideSchema = z2.object({
+  summary: z2.string().optional(),
+  transitionId: z2.string().optional()
 }).optional();
-var SuppressionRuleSchema = z.object({
+var SuppressionRuleSchema = z2.object({
   /**
    * The finding kind to match, behavioural or intent. It is an open
    * string here because this package is below both IRs, and the loader
    * is what validates it against the published kind enums.
    */
-  kind: z.string().optional(),
+  kind: z2.string().optional(),
   /**
    * Boundary as a human-readable key, e.g. "GET /pet/{petId}" or
    * "fn:@acme/api::getUser". REST keys are normalized via the same
    * path normalizer the checkers use, so `:id` and `{id}` compare
    * equal.
    */
-  boundary: z.string().optional(),
+  boundary: z2.string().optional(),
   /**
    * Consumer-side discriminators, the narrowest useful match. These
    * mean something only for behavioural findings: a rule that
@@ -306,15 +389,15 @@ var SuppressionRuleSchema = z.object({
    * kind-only or boundary-only matches, which also silence future
    * regressions in that category.
    */
-  scope: z.enum(["narrow", "broad"]).default("narrow"),
+  scope: z2.enum(["narrow", "broad"]).default("narrow"),
   /** Required human-written justification. */
-  reason: z.string().min(1),
+  reason: z2.string().min(1),
   /** What to do when a finding matches. */
-  effect: z.enum(["mark", "downgrade", "hide"]).default("mark")
+  effect: z2.enum(["mark", "downgrade", "hide"]).default("mark")
 }).strict();
-var SuppressionFileSchema = z.object({
-  version: z.literal(1),
-  rules: z.array(SuppressionRuleSchema)
+var SuppressionFileSchema = z2.object({
+  version: z2.literal(1),
+  rules: z2.array(SuppressionRuleSchema)
 }).strict();
 function validateRule(rule) {
   if (rule.scope === "broad") {
@@ -604,6 +687,17 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
+function unitInvocationBinding(opts) {
+  return {
+    transport: "invoke",
+    semantics: {
+      name: "unit-invocation",
+      deploymentTarget: opts.deploymentTarget,
+      instanceName: namedOrNull(opts.instanceName, "invoked unit")
+    },
+    recognition: opts.recognition
+  };
+}
 function storageBinding(opts) {
   return {
     transport: opts.transport ?? opts.storageSystem,
@@ -646,11 +740,14 @@ export {
   ConfidenceSourceSchema,
   CorroborationSchema,
   DeployableUnitSchema,
+  EVERY_FIELD,
+  EffectRelationSchema,
   FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
+  RelationSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
@@ -659,7 +756,10 @@ export {
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
+  UnitInvocationSemanticsSchema,
   applySuppressionsToFindings,
+  bindingIs,
+  bindingTokens,
   bodyShapesMatch,
   boundaryKey,
   boundaryLabel,
@@ -692,6 +792,8 @@ export {
   namePatternFromSub,
   namePatternKey,
   namesAgree,
+  namesBoundary,
+  namesBoundaryExactly,
   namesNothing,
   normalizePath,
   normalizeRuleBoundary,
@@ -706,6 +808,7 @@ export {
   referenceName,
   referenceOf,
   reportsUnpairedItself,
+  resourceNameIn,
   restBinding,
   routePathAdmits,
   ruleBoundaryMatchesKey,
@@ -713,9 +816,16 @@ export {
   semanticsAgree,
   semconvAttributes,
   servesRequest,
+  spellingTokens,
   statesAnOrigin,
   storageBinding,
+  storageContainerLabel,
+  storageLabel,
   typeDefinitionKey,
+  unitIdentityKey,
+  unitInvocationBinding,
   validateRule,
-  withDefinitionsInlined
+  withDefinitionsInlined,
+  withRewrittenPaths,
+  withinScope
 };

package/dist/{schemas-k-169oiY.d.cts → schemas-Dn1AzzWd.d.cts}

@@ -155,6 +155,16 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     name: z.ZodLiteral<"metric">;
     metricSystem: z.ZodString;
     metricType: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>], "name">;
 type Semantics = z.infer<typeof SemanticsSchema>;
 
@@ -220,6 +230,22 @@ declare const StorageSemanticsSchema: z.ZodObject<{
     accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
+/**
+ * `postgresql:invoices`, `aws.dynamodb:editions#by-publication`. The
+ * pairing pass has no key to fall back on here, so a reader who types
+ * this back at `suss ask`, the pass that indexes accesses by it, and an
+ * intent doc that says which store a write reaches all read this one.
+ */
+declare function storageLabel(semantics: StorageSemantics): string;
+/**
+ * What an access writes for its columns when it asked for all of them,
+ * which is a query with no explicit projection. It covers every column
+ * rather than saying which one, so anything comparing column lists has
+ * to tell it apart from a list of columns.
+ */
+declare const EVERY_FIELD = "*";
+/** The store on its own, which a finding writes without the system. */
+declare function storageContainerLabel(semantics: StorageSemantics): string;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -299,6 +325,10 @@ declare const SourceLocationSchema: z.ZodObject<{
         start: z.ZodNumber;
         end: z.ZodNumber;
     }, z.core.$strip>;
+    span: z.ZodOptional<z.ZodObject<{
+        start: z.ZodNumber;
+        end: z.ZodNumber;
+    }, z.core.$strip>>;
     exportName: z.ZodNullable<z.ZodString>;
     workspace: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -362,6 +392,16 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         name: z.ZodLiteral<"metric">;
         metricSystem: z.ZodString;
         metricType: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        deploymentTarget: z.ZodEnum<{
+            lambda: "lambda";
+            "ecs-task": "ecs-task";
+            container: "container";
+            "k8s-deployment": "k8s-deployment";
+            worker: "worker";
+        }>;
+        name: z.ZodLiteral<"unit-invocation">;
+        instanceName: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>], "name">;
     recognition: z.ZodString;
 }, z.core.$strip>;
@@ -451,4 +491,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, typeDefinitionKey as x, withDefinitionsInlined as y };
+export { withDefinitionsInlined as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, storageContainerLabel as x, storageLabel as y, typeDefinitionKey as z };

package/dist/{schemas-k-169oiY.d.ts → schemas-Dn1AzzWd.d.ts}

@@ -155,6 +155,16 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     name: z.ZodLiteral<"metric">;
     metricSystem: z.ZodString;
     metricType: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>], "name">;
 type Semantics = z.infer<typeof SemanticsSchema>;
 
@@ -220,6 +230,22 @@ declare const StorageSemanticsSchema: z.ZodObject<{
     accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
+/**
+ * `postgresql:invoices`, `aws.dynamodb:editions#by-publication`. The
+ * pairing pass has no key to fall back on here, so a reader who types
+ * this back at `suss ask`, the pass that indexes accesses by it, and an
+ * intent doc that says which store a write reaches all read this one.
+ */
+declare function storageLabel(semantics: StorageSemantics): string;
+/**
+ * What an access writes for its columns when it asked for all of them,
+ * which is a query with no explicit projection. It covers every column
+ * rather than saying which one, so anything comparing column lists has
+ * to tell it apart from a list of columns.
+ */
+declare const EVERY_FIELD = "*";
+/** The store on its own, which a finding writes without the system. */
+declare function storageContainerLabel(semantics: StorageSemantics): string;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -299,6 +325,10 @@ declare const SourceLocationSchema: z.ZodObject<{
         start: z.ZodNumber;
         end: z.ZodNumber;
     }, z.core.$strip>;
+    span: z.ZodOptional<z.ZodObject<{
+        start: z.ZodNumber;
+        end: z.ZodNumber;
+    }, z.core.$strip>>;
     exportName: z.ZodNullable<z.ZodString>;
     workspace: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -362,6 +392,16 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         name: z.ZodLiteral<"metric">;
         metricSystem: z.ZodString;
         metricType: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        deploymentTarget: z.ZodEnum<{
+            lambda: "lambda";
+            "ecs-task": "ecs-task";
+            container: "container";
+            "k8s-deployment": "k8s-deployment";
+            worker: "worker";
+        }>;
+        name: z.ZodLiteral<"unit-invocation">;
+        instanceName: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>], "name">;
     recognition: z.ZodString;
 }, z.core.$strip>;
@@ -451,4 +491,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, typeDefinitionKey as x, withDefinitionsInlined as y };
+export { withDefinitionsInlined as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, storageContainerLabel as x, storageLabel as y, typeDefinitionKey as z };