@suss/ir-core 0.20.0 → 0.21.0

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   ConfidenceSourceSchema,
   CorroborationSchema,
   DeployableUnitSchema,
+  EVERY_FIELD,
   FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
@@ -16,6 +17,7 @@ import {
   SourceLocationSchema,
   StorageSemanticsSchema,
   TypeShapeSchema,
+  UnitInvocationSemanticsSchema,
   allBehaviors,
   behaviorOf,
   busIdentityKey,
@@ -34,9 +36,12 @@ import {
   routePathAdmits,
   semconvMappingOf,
   statesAnOrigin,
+  storageContainerLabel,
+  storageLabel,
   typeDefinitionKey,
+  unitIdentityKey,
   withDefinitionsInlined
-} from "./chunk-52CH76PE.js";
+} from "./chunk-QHFMZPEG.js";
 
 // src/semconv.ts
 function semconvAttributes(binding) {
@@ -58,6 +63,9 @@ function semconvAttributes(binding) {
 }
 
 // src/boundaryKey.ts
+function bindingIs(binding, name) {
+  return binding?.semantics.name === name;
+}
 function boundaryKey(binding) {
   return behaviorOf(binding.semantics).identityKey(binding.semantics);
 }
@@ -125,6 +133,10 @@ function servesRequest(binding, method, path) {
   }
   return serves(binding.semantics, method, path);
 }
+function withinScope(binding, scope) {
+  const within = behaviorOf(binding.semantics).withinScope;
+  return within === void 0 ? false : within(binding.semantics, scope);
+}
 
 // src/dispatch.ts
 function dispatchByType(table, value) {
@@ -261,6 +273,57 @@ function referenceFromName(name) {
   return referenceOf(parseBoundaryName(name));
 }
 
+// src/boundarySpelling.ts
+function resourceNameIn(spelling) {
+  if (spelling.startsWith("arn:")) {
+    const segments2 = spelling.split(":");
+    return segments2[6] ?? segments2[5] ?? spelling;
+  }
+  const segments = spelling.split("/");
+  if (segments.length >= 4 && segments.length % 2 === 0) {
+    return segments[segments.length - 1] ?? spelling;
+  }
+  return spelling;
+}
+function spellingTokens(text) {
+  return text.toLowerCase().replace(/[{}]/g, " ").split(/[\s:#,()/]+/).filter((token) => token.length > 0);
+}
+function bindingTokens(binding) {
+  const tokens = new Set(spellingTokens(displayLabel(binding)));
+  for (const value of Object.values(binding.semantics)) {
+    if (typeof value === "string") {
+      for (const token of spellingTokens(value)) {
+        tokens.add(token);
+      }
+    }
+  }
+  for (const token of [...tokens]) {
+    for (const part of token.split(".")) {
+      tokens.add(part);
+    }
+  }
+  return tokens;
+}
+function namesBoundaryExactly(subject, binding) {
+  const wanted = new Set(spellingTokens(subject));
+  if (wanted.size === 0) {
+    return false;
+  }
+  const spelled = new Set(spellingTokens(displayLabel(binding)));
+  if (spelled.size !== wanted.size) {
+    return false;
+  }
+  return [...spelled].every((token) => wanted.has(token));
+}
+function namesBoundary(subject, binding) {
+  const wanted = spellingTokens(subject);
+  if (wanted.length === 0) {
+    return false;
+  }
+  const tokens = bindingTokens(binding);
+  return wanted.every((token) => tokens.has(token));
+}
+
 // src/codeScope.ts
 function codeScopePath(raw) {
   return raw.trim().replace(/^\.\//, "").replace(/\/+$/, "");
@@ -274,26 +337,36 @@ function fileInCodeScope(file, scope) {
   return path === prefix || path.startsWith(`${prefix}/`);
 }
 
-// src/suppressions.ts
+// src/relation.ts
 import { z } from "zod";
-var SuppressionSideSchema = z.object({
-  summary: z.string().optional(),
-  transitionId: z.string().optional()
+var RelationSchema = z.enum([
+  "provides",
+  "reads",
+  "writes",
+  "invokes"
+]);
+var EffectRelationSchema = RelationSchema.exclude(["provides"]);
+
+// src/suppressions.ts
+import { z as z2 } from "zod";
+var SuppressionSideSchema = z2.object({
+  summary: z2.string().optional(),
+  transitionId: z2.string().optional()
 }).optional();
-var SuppressionRuleSchema = z.object({
+var SuppressionRuleSchema = z2.object({
   /**
    * The finding kind to match, behavioural or intent. It is an open
    * string here because this package is below both IRs, and the loader
    * is what validates it against the published kind enums.
    */
-  kind: z.string().optional(),
+  kind: z2.string().optional(),
   /**
    * Boundary as a human-readable key, e.g. "GET /pet/{petId}" or
    * "fn:@acme/api::getUser". REST keys are normalized via the same
    * path normalizer the checkers use, so `:id` and `{id}` compare
    * equal.
    */
-  boundary: z.string().optional(),
+  boundary: z2.string().optional(),
   /**
    * Consumer-side discriminators, the narrowest useful match. These
    * mean something only for behavioural findings: a rule that
@@ -316,15 +389,15 @@ var SuppressionRuleSchema = z.object({
    * kind-only or boundary-only matches, which also silence future
    * regressions in that category.
    */
-  scope: z.enum(["narrow", "broad"]).default("narrow"),
+  scope: z2.enum(["narrow", "broad"]).default("narrow"),
   /** Required human-written justification. */
-  reason: z.string().min(1),
+  reason: z2.string().min(1),
   /** What to do when a finding matches. */
-  effect: z.enum(["mark", "downgrade", "hide"]).default("mark")
+  effect: z2.enum(["mark", "downgrade", "hide"]).default("mark")
 }).strict();
-var SuppressionFileSchema = z.object({
-  version: z.literal(1),
-  rules: z.array(SuppressionRuleSchema)
+var SuppressionFileSchema = z2.object({
+  version: z2.literal(1),
+  rules: z2.array(SuppressionRuleSchema)
 }).strict();
 function validateRule(rule) {
   if (rule.scope === "broad") {
@@ -614,6 +687,17 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
+function unitInvocationBinding(opts) {
+  return {
+    transport: "invoke",
+    semantics: {
+      name: "unit-invocation",
+      deploymentTarget: opts.deploymentTarget,
+      instanceName: namedOrNull(opts.instanceName, "invoked unit")
+    },
+    recognition: opts.recognition
+  };
+}
 function storageBinding(opts) {
   return {
     transport: opts.transport ?? opts.storageSystem,
@@ -656,11 +740,14 @@ export {
   ConfidenceSourceSchema,
   CorroborationSchema,
   DeployableUnitSchema,
+  EVERY_FIELD,
+  EffectRelationSchema,
   FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
+  RelationSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
@@ -669,7 +756,10 @@ export {
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
+  UnitInvocationSemanticsSchema,
   applySuppressionsToFindings,
+  bindingIs,
+  bindingTokens,
   bodyShapesMatch,
   boundaryKey,
   boundaryLabel,
@@ -702,6 +792,8 @@ export {
   namePatternFromSub,
   namePatternKey,
   namesAgree,
+  namesBoundary,
+  namesBoundaryExactly,
   namesNothing,
   normalizePath,
   normalizeRuleBoundary,
@@ -716,6 +808,7 @@ export {
   referenceName,
   referenceOf,
   reportsUnpairedItself,
+  resourceNameIn,
   restBinding,
   routePathAdmits,
   ruleBoundaryMatchesKey,
@@ -723,10 +816,16 @@ export {
   semanticsAgree,
   semconvAttributes,
   servesRequest,
+  spellingTokens,
   statesAnOrigin,
   storageBinding,
+  storageContainerLabel,
+  storageLabel,
   typeDefinitionKey,
+  unitIdentityKey,
+  unitInvocationBinding,
   validateRule,
   withDefinitionsInlined,
-  withRewrittenPaths
+  withRewrittenPaths,
+  withinScope
 };

package/dist/{schemas-Dt93kAZT.d.cts → schemas-Dn1AzzWd.d.cts}

@@ -155,6 +155,16 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     name: z.ZodLiteral<"metric">;
     metricSystem: z.ZodString;
     metricType: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>], "name">;
 type Semantics = z.infer<typeof SemanticsSchema>;
 
@@ -220,6 +230,22 @@ declare const StorageSemanticsSchema: z.ZodObject<{
     accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
+/**
+ * `postgresql:invoices`, `aws.dynamodb:editions#by-publication`. The
+ * pairing pass has no key to fall back on here, so a reader who types
+ * this back at `suss ask`, the pass that indexes accesses by it, and an
+ * intent doc that says which store a write reaches all read this one.
+ */
+declare function storageLabel(semantics: StorageSemantics): string;
+/**
+ * What an access writes for its columns when it asked for all of them,
+ * which is a query with no explicit projection. It covers every column
+ * rather than saying which one, so anything comparing column lists has
+ * to tell it apart from a list of columns.
+ */
+declare const EVERY_FIELD = "*";
+/** The store on its own, which a finding writes without the system. */
+declare function storageContainerLabel(semantics: StorageSemantics): string;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -366,6 +392,16 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         name: z.ZodLiteral<"metric">;
         metricSystem: z.ZodString;
         metricType: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        deploymentTarget: z.ZodEnum<{
+            lambda: "lambda";
+            "ecs-task": "ecs-task";
+            container: "container";
+            "k8s-deployment": "k8s-deployment";
+            worker: "worker";
+        }>;
+        name: z.ZodLiteral<"unit-invocation">;
+        instanceName: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>], "name">;
     recognition: z.ZodString;
 }, z.core.$strip>;
@@ -455,4 +491,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, typeDefinitionKey as x, withDefinitionsInlined as y };
+export { withDefinitionsInlined as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, storageContainerLabel as x, storageLabel as y, typeDefinitionKey as z };

package/dist/{schemas-Dt93kAZT.d.ts → schemas-Dn1AzzWd.d.ts}

@@ -155,6 +155,16 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     name: z.ZodLiteral<"metric">;
     metricSystem: z.ZodString;
     metricType: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>], "name">;
 type Semantics = z.infer<typeof SemanticsSchema>;
 
@@ -220,6 +230,22 @@ declare const StorageSemanticsSchema: z.ZodObject<{
     accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
+/**
+ * `postgresql:invoices`, `aws.dynamodb:editions#by-publication`. The
+ * pairing pass has no key to fall back on here, so a reader who types
+ * this back at `suss ask`, the pass that indexes accesses by it, and an
+ * intent doc that says which store a write reaches all read this one.
+ */
+declare function storageLabel(semantics: StorageSemantics): string;
+/**
+ * What an access writes for its columns when it asked for all of them,
+ * which is a query with no explicit projection. It covers every column
+ * rather than saying which one, so anything comparing column lists has
+ * to tell it apart from a list of columns.
+ */
+declare const EVERY_FIELD = "*";
+/** The store on its own, which a finding writes without the system. */
+declare function storageContainerLabel(semantics: StorageSemantics): string;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -366,6 +392,16 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         name: z.ZodLiteral<"metric">;
         metricSystem: z.ZodString;
         metricType: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        deploymentTarget: z.ZodEnum<{
+            lambda: "lambda";
+            "ecs-task": "ecs-task";
+            container: "container";
+            "k8s-deployment": "k8s-deployment";
+            worker: "worker";
+        }>;
+        name: z.ZodLiteral<"unit-invocation">;
+        instanceName: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>], "name">;
     recognition: z.ZodString;
 }, z.core.$strip>;
@@ -455,4 +491,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, typeDefinitionKey as x, withDefinitionsInlined as y };
+export { withDefinitionsInlined as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, storageContainerLabel as x, storageLabel as y, typeDefinitionKey as z };

package/dist/schemas.cjs

@@ -40,10 +40,10 @@ __export(schemas_exports, {
   withDefinitionsInlined: () => withDefinitionsInlined
 });
 module.exports = __toCommonJS(schemas_exports);
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 
 // src/semantics/registry.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // src/semantics/functionCall.ts
 var import_zod = require("zod");
@@ -58,6 +58,9 @@ function fnIdentityKey(packageName, exportPath) {
 function busIdentityKey(messageBus, subject) {
   return `bus:${messageBus} ${subject}`;
 }
+function unitIdentityKey(deploymentTarget, instanceName) {
+  return `unit:${deploymentTarget} ${instanceName}`;
+}
 function metricIdentityKey(metricSystem, metricType) {
   return `metric:${metricSystem} ${metricType}`;
 }
@@ -497,6 +500,14 @@ var restSemantics = defineBoundarySemantics({
       }
       return routePathAdmits(semantics.path, path) ? "match" : "nomatch";
     },
+    /**
+     * A route the registration pattern admits is inside it. A route
+     * whose path this source never gave is left outside, because
+     * nothing here can show it is one the pattern covers.
+     */
+    withinScope(semantics, scope) {
+      return semantics.path !== null && routePathAdmits(scope, semantics.path);
+    },
     /**
      * A call whose base URL the deployment fills in, resolved to the
      * path it reaches.
@@ -629,12 +640,70 @@ var storageSemantics = defineBoundarySemantics({
     /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
-    identityKey: () => null
+    identityKey: () => null,
+    displayLabel: storageLabel
+  }
+});
+function storageLabel(semantics) {
+  return `${semantics.storageSystem}:${storageContainerLabel(semantics)}`;
+}
+function storageContainerLabel(semantics) {
+  const container = semantics.container ?? "<unnamed container>";
+  const addressed = semantics.accessPath === null ? container : `${container}#${semantics.accessPath}`;
+  return semantics.scope === "default" ? addressed : `${semantics.scope}/${addressed}`;
+}
+
+// src/semantics/unitInvocation.ts
+var import_zod10 = require("zod");
+var UnitInvocationSemanticsSchema = DeployableUnitSchema.extend({
+  name: import_zod10.z.literal("unit-invocation"),
+  instanceName: DeployableUnitSchema.shape.instanceName.nullable()
+});
+var unitInvocationSemantics = defineBoundarySemantics({
+  name: "unit-invocation",
+  schema: UnitInvocationSemanticsSchema,
+  // faas.name is the deployed function's own name and instanceName is
+  // the deployment template's logical id, which is a different string.
+  // Runtime config leaves the pair off for the same reason.
+  semconv: {},
+  behavior: {
+    /**
+     * A synchronous invoke gives back whatever the handler returned,
+     * which is a value rather than a status and a body. A handler's
+     * return only becomes an HTTP response under a proxy integration,
+     * and that route gets a REST binding instead of this one.
+     */
+    exchangesHttpResponses: false,
+    /**
+     * A unit nothing in the run invokes is the ordinary case, since
+     * most services are reached from a stack suss never read. So an
+     * uninvoked unit stays in the generic unmatched list rather than
+     * being reported as a problem here.
+     */
+    reportsUnpairedItself: false,
+    identityKey(semantics) {
+      if (semantics.instanceName === null) {
+        return null;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    },
+    displayLabel(semantics) {
+      if (semantics.instanceName === null) {
+        return `unit:${semantics.deploymentTarget} (named at runtime)`;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    }
   }
 });
 
 // src/semantics/registry.ts
-var SemanticsSchema = import_zod10.z.discriminatedUnion("name", [
+var SemanticsSchema = import_zod11.z.discriminatedUnion("name", [
   restSemantics.schema,
   functionCallSemantics.schema,
   graphqlResolverSemantics.schema,
@@ -642,7 +711,8 @@ var SemanticsSchema = import_zod10.z.discriminatedUnion("name", [
   runtimeConfigSemantics.schema,
   storageSemantics.schema,
   messageBusSemantics.schema,
-  metricSemantics.schema
+  metricSemantics.schema,
+  unitInvocationSemantics.schema
 ]);
 var DEFINITIONS = [
   restSemantics,
@@ -652,38 +722,39 @@ var DEFINITIONS = [
   runtimeConfigSemantics,
   storageSemantics,
   messageBusSemantics,
-  metricSemantics
+  metricSemantics,
+  unitInvocationSemantics
 ];
 var BY_NAME = new Map(
   DEFINITIONS.map((d) => [d.name, d])
 );
 
 // src/schemas.ts
-var ConfidenceSourceSchema = import_zod11.z.enum([
+var ConfidenceSourceSchema = import_zod12.z.enum([
   "inferred_static",
   "inferred_ai",
   "declared",
   "derived"
 ]);
-var ConfidenceLevelSchema = import_zod11.z.enum(["high", "medium", "low"]);
-var CorroborationSchema = import_zod11.z.object({
-  outcome: import_zod11.z.enum(["observed", "refuted", "untested"]),
+var ConfidenceLevelSchema = import_zod12.z.enum(["high", "medium", "low"]);
+var CorroborationSchema = import_zod12.z.object({
+  outcome: import_zod12.z.enum(["observed", "refuted", "untested"]),
   /** Executions that produced a verdict for this claim. */
-  runs: import_zod11.z.number(),
+  runs: import_zod12.z.number(),
   /** Present when refuted: the input and observation that disagreed. */
-  counterexample: import_zod11.z.unknown().optional(),
+  counterexample: import_zod12.z.unknown().optional(),
   /** Present when untested: why no verdict was reachable. */
-  reason: import_zod11.z.string().optional()
+  reason: import_zod12.z.string().optional()
 });
-var ConfidenceInfoSchema = import_zod11.z.object({
+var ConfidenceInfoSchema = import_zod12.z.object({
   source: ConfidenceSourceSchema,
   level: ConfidenceLevelSchema,
   corroboration: CorroborationSchema.optional()
 });
-var SourceLocationSchema = import_zod11.z.object({
-  file: import_zod11.z.string(),
+var SourceLocationSchema = import_zod12.z.object({
+  file: import_zod12.z.string(),
   /** Line numbers, for a person reading the summary or an editor link. */
-  range: import_zod11.z.object({ start: import_zod11.z.number(), end: import_zod11.z.number() }),
+  range: import_zod12.z.object({ start: import_zod12.z.number(), end: import_zod12.z.number() }),
   /**
    * Character offsets of the unit in its file. Identity and joins
    * measure with these, since two functions can share a line and never
@@ -691,8 +762,8 @@ var SourceLocationSchema = import_zod11.z.object({
    * same place. Absent on summaries no source position backs, a
    * contract artifact's say.
    */
-  span: import_zod11.z.object({ start: import_zod11.z.number(), end: import_zod11.z.number() }).optional(),
-  exportName: import_zod11.z.string().nullable(),
+  span: import_zod12.z.object({ start: import_zod12.z.number(), end: import_zod12.z.number() }).optional(),
+  exportName: import_zod12.z.string().nullable(),
   /**
    * The project the extract was pointed at, by the name that project
    * calls itself.
@@ -702,47 +773,47 @@ var SourceLocationSchema = import_zod11.z.object({
    * summaries puts them on top of each other. This field is what tells
    * them apart, and what a reader groups by.
    */
-  workspace: import_zod11.z.string().optional()
+  workspace: import_zod12.z.string().optional()
 });
-var BoundaryBindingSchema = import_zod11.z.object({
-  transport: import_zod11.z.string(),
+var BoundaryBindingSchema = import_zod12.z.object({
+  transport: import_zod12.z.string(),
   semantics: SemanticsSchema,
-  recognition: import_zod11.z.string()
+  recognition: import_zod12.z.string()
 });
 function typeDefinitionKey(ref) {
   return ref.def ?? null;
 }
-var TypeShapeSchema = import_zod11.z.lazy(
-  () => import_zod11.z.discriminatedUnion("type", [
-    import_zod11.z.object({
-      type: import_zod11.z.literal("record"),
-      properties: import_zod11.z.record(import_zod11.z.string(), TypeShapeSchema),
-      spreads: import_zod11.z.array(import_zod11.z.object({ sourceText: import_zod11.z.string() })).optional()
+var TypeShapeSchema = import_zod12.z.lazy(
+  () => import_zod12.z.discriminatedUnion("type", [
+    import_zod12.z.object({
+      type: import_zod12.z.literal("record"),
+      properties: import_zod12.z.record(import_zod12.z.string(), TypeShapeSchema),
+      spreads: import_zod12.z.array(import_zod12.z.object({ sourceText: import_zod12.z.string() })).optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("dictionary"), values: TypeShapeSchema }),
-    import_zod11.z.object({ type: import_zod11.z.literal("array"), items: TypeShapeSchema }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("literal"),
-      value: import_zod11.z.union([import_zod11.z.string(), import_zod11.z.number(), import_zod11.z.boolean()]),
-      raw: import_zod11.z.string().optional()
+    import_zod12.z.object({ type: import_zod12.z.literal("dictionary"), values: TypeShapeSchema }),
+    import_zod12.z.object({ type: import_zod12.z.literal("array"), items: TypeShapeSchema }),
+    import_zod12.z.object({
+      type: import_zod12.z.literal("literal"),
+      value: import_zod12.z.union([import_zod12.z.string(), import_zod12.z.number(), import_zod12.z.boolean()]),
+      raw: import_zod12.z.string().optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("text") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("integer") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("number") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("boolean") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("null") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("undefined") }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("union"),
-      variants: import_zod11.z.array(TypeShapeSchema)
+    import_zod12.z.object({ type: import_zod12.z.literal("text") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("integer") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("number") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("boolean") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("null") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("undefined") }),
+    import_zod12.z.object({
+      type: import_zod12.z.literal("union"),
+      variants: import_zod12.z.array(TypeShapeSchema)
     }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("ref"),
-      name: import_zod11.z.string(),
-      from: import_zod11.z.string().optional(),
-      def: import_zod11.z.string().optional()
+    import_zod12.z.object({
+      type: import_zod12.z.literal("ref"),
+      name: import_zod12.z.string(),
+      from: import_zod12.z.string().optional(),
+      def: import_zod12.z.string().optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("unknown") })
+    import_zod12.z.object({ type: import_zod12.z.literal("unknown") })
   ])
 );
 var MAX_DEFINITION_DEPTH = 6;

package/dist/schemas.d.cts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, x as typeDefinitionKey, y as withDefinitionsInlined } from './schemas-Dt93kAZT.cjs';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.cjs';

package/dist/schemas.d.ts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, x as typeDefinitionKey, y as withDefinitionsInlined } from './schemas-Dt93kAZT.js';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.js';

package/dist/schemas.js

@@ -17,7 +17,7 @@ import {
   TypeShapeSchema,
   typeDefinitionKey,
   withDefinitionsInlined
-} from "./chunk-52CH76PE.js";
+} from "./chunk-QHFMZPEG.js";
 export {
   BoundaryBindingSchema,
   ConfidenceInfoSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/ir-core",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "type": "module",
   "description": "Shared IR primitives for suss — type shapes, boundary bindings, source locations, and confidence. Imported by both @suss/behavioral-ir and @suss/intent-ir so neither depends on the other.",
   "keywords": [