@suss/ir-core 0.32.0 → 0.33.1

package/README.md

@@ -108,8 +108,8 @@ v0: type shapes, boundary bindings + constructors, source locations, confidence.
 
 ## More
 
-- [Documentation](https://nimbuscloud-ai.github.io/suss/)
-- [Every package and pack suss ships](https://nimbuscloud-ai.github.io/suss/reference/packages)
+- [Documentation](https://suss.sh/)
+- [Every package and pack suss ships](https://suss.sh/packs/catalog)
 - [Source and issues](https://github.com/nimbuscloud-ai/suss)
 
 ## Coverage

package/dist/{chunk-ODHT5T2Q.js → chunk-N564FH5U.js}

@@ -212,6 +212,12 @@ var MessageBusSemanticsSchema = z4.object({
     "aws.sns",
     "s3",
     "eventbridge",
+    // A Kinesis stream and a Firehose delivery stream are different
+    // APIs with different destinations, so a stream named `orders` and
+    // a delivery stream named `orders` are not the same channel.
+    "aws_kinesis",
+    "aws_firehose",
+    "gcp_pubsub",
     "bullmq",
     "kafka",
     "nats",
@@ -880,7 +886,10 @@ function ecsContainerInstanceName(taskDefinitionLogicalId, containerName) {
 }
 
 // src/semantics/runtimeConfig.ts
-var RuntimeConfigSemanticsSchema = DeployableUnitSchema.extend({
+var RuntimeConfigSemanticsSchema = DeployableUnitSchema.partial({
+  deploymentTarget: true,
+  instanceName: true
+}).extend({
   name: z8.literal("runtime-config")
 });
 var runtimeConfigSemantics = defineBoundarySemantics({
@@ -907,10 +916,13 @@ var StorageSemanticsSchema = z9.object({
   name: z9.literal("storage"),
   /**
    * Which store this is: postgresql, mysql, aws.dynamodb, or our own
-   * word for one OpenTelemetry never named, such as s3. Two products'
-   * containers can share a name, so this keeps them apart.
+   * word for one OpenTelemetry never named, such as s3, or null when
+   * the source states one this reader could not settle. Two products'
+   * containers can share a name, so this keeps them apart. A null
+   * keeps none of them apart, and the pairing pass says what it does
+   * with one.
    */
-  storageSystem: z9.string(),
+  storageSystem: z9.string().nullable(),
   /**
    * The ORM, schema, or deployment scope. A single-database setup uses
    * `"default"`, and a monorepo with several schemas gives each one its
@@ -973,8 +985,12 @@ var storageSemantics = defineBoundarySemantics({
   }
 });
 function storageLabel(semantics) {
-  return `${semantics.storageSystem}:${storageContainerLabel(semantics)}`;
+  return `${storageSystemLabel(semantics)}:${storageContainerLabel(semantics)}`;
 }
+function storageSystemLabel(semantics) {
+  return semantics.storageSystem ?? UNKNOWN_ENGINE;
+}
+var UNKNOWN_ENGINE = "<unknown engine>";
 var EVERY_FIELD = "*";
 function storageContainerLabel(semantics) {
   const container = semantics.container ?? "<unnamed container>";
@@ -1271,6 +1287,7 @@ export {
   RuntimeConfigSemanticsSchema,
   StorageSemanticsSchema,
   storageLabel,
+  storageSystemLabel,
   EVERY_FIELD,
   storageContainerLabel,
   UnitInvocationSemanticsSchema,

package/dist/index.cjs

@@ -34,6 +34,7 @@ __export(index_exports, {
   MessageBusSemanticsSchema: () => MessageBusSemanticsSchema,
   MetricSemanticsSchema: () => MetricSemanticsSchema,
   NOTHING_DEPLOYED: () => NOTHING_DEPLOYED,
+  PLATFORM_INJECTED_ENV_VARS: () => PLATFORM_INJECTED_ENV_VARS,
   RelationSchema: () => RelationSchema,
   RestSemanticsSchema: () => RestSemanticsSchema,
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
@@ -94,6 +95,7 @@ __export(index_exports, {
   pairingKey: () => pairingKey,
   parseBoundaryName: () => parseBoundaryName,
   parseChannel: () => parseChannel,
+  parseHandler: () => parseHandler,
   pathAfterOrigin: () => pathAfterOrigin,
   pathShape: () => pathShape,
   patternHole: () => patternHole,
@@ -118,6 +120,7 @@ __export(index_exports, {
   storageBinding: () => storageBinding,
   storageContainerLabel: () => storageContainerLabel,
   storageLabel: () => storageLabel,
+  storageSystemLabel: () => storageSystemLabel,
   typeDefinitionKey: () => typeDefinitionKey,
   unitIdentityKey: () => unitIdentityKey,
   unitInvocationBinding: () => unitInvocationBinding,
@@ -342,6 +345,12 @@ var MessageBusSemanticsSchema = import_zod4.z.object({
     "aws.sns",
     "s3",
     "eventbridge",
+    // A Kinesis stream and a Firehose delivery stream are different
+    // APIs with different destinations, so a stream named `orders` and
+    // a delivery stream named `orders` are not the same channel.
+    "aws_kinesis",
+    "aws_firehose",
+    "gcp_pubsub",
     "bullmq",
     "kafka",
     "nats",
@@ -1010,7 +1019,10 @@ function ecsContainerInstanceName(taskDefinitionLogicalId, containerName) {
 }
 
 // src/semantics/runtimeConfig.ts
-var RuntimeConfigSemanticsSchema = DeployableUnitSchema.extend({
+var RuntimeConfigSemanticsSchema = DeployableUnitSchema.partial({
+  deploymentTarget: true,
+  instanceName: true
+}).extend({
   name: import_zod8.z.literal("runtime-config")
 });
 var runtimeConfigSemantics = defineBoundarySemantics({
@@ -1037,10 +1049,13 @@ var StorageSemanticsSchema = import_zod9.z.object({
   name: import_zod9.z.literal("storage"),
   /**
    * Which store this is: postgresql, mysql, aws.dynamodb, or our own
-   * word for one OpenTelemetry never named, such as s3. Two products'
-   * containers can share a name, so this keeps them apart.
+   * word for one OpenTelemetry never named, such as s3, or null when
+   * the source states one this reader could not settle. Two products'
+   * containers can share a name, so this keeps them apart. A null
+   * keeps none of them apart, and the pairing pass says what it does
+   * with one.
    */
-  storageSystem: import_zod9.z.string(),
+  storageSystem: import_zod9.z.string().nullable(),
   /**
    * The ORM, schema, or deployment scope. A single-database setup uses
    * `"default"`, and a monorepo with several schemas gives each one its
@@ -1103,8 +1118,12 @@ var storageSemantics = defineBoundarySemantics({
   }
 });
 function storageLabel(semantics) {
-  return `${semantics.storageSystem}:${storageContainerLabel(semantics)}`;
+  return `${storageSystemLabel(semantics)}:${storageContainerLabel(semantics)}`;
 }
+function storageSystemLabel(semantics) {
+  return semantics.storageSystem ?? UNKNOWN_ENGINE;
+}
+var UNKNOWN_ENGINE = "<unknown engine>";
 var EVERY_FIELD = "*";
 function storageContainerLabel(semantics) {
   const container = semantics.container ?? "<unnamed container>";
@@ -1535,6 +1554,17 @@ function fileInCodeScope(file, scope) {
   const path = codeScopePath(file);
   return path === prefix || path.startsWith(`${prefix}/`);
 }
+function parseHandler(handler) {
+  const trimmed = handler.trim();
+  const lastDot = trimmed.lastIndexOf(".");
+  if (lastDot <= 0 || lastDot === trimmed.length - 1) {
+    return null;
+  }
+  return {
+    modulePath: trimmed.slice(0, lastDot),
+    exportName: trimmed.slice(lastDot + 1)
+  };
+}
 
 // src/deployment.ts
 var NOTHING_DEPLOYED = {
@@ -1543,6 +1573,49 @@ var NOTHING_DEPLOYED = {
   pointsAt: () => null
 };
 
+// src/platformEnvVars.ts
+var PLATFORM_INJECTED_ENV_VARS = {
+  lambda: [
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION",
+    "AWS_LAMBDA_FUNCTION_NAME",
+    "AWS_LAMBDA_FUNCTION_VERSION",
+    "AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+    "AWS_LAMBDA_LOG_GROUP_NAME",
+    "AWS_LAMBDA_LOG_STREAM_NAME",
+    "AWS_LAMBDA_RUNTIME_API",
+    "AWS_EXECUTION_ENV",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "LAMBDA_TASK_ROOT",
+    "LAMBDA_RUNTIME_DIR",
+    "_HANDLER",
+    "_X_AMZN_TRACE_ID",
+    "TZ"
+  ],
+  "ecs-task": [
+    "AWS_DEFAULT_REGION",
+    "AWS_REGION",
+    "ECS_CONTAINER_METADATA_URI",
+    "ECS_CONTAINER_METADATA_URI_V4",
+    "ECS_AGENT_URI"
+  ],
+  // Which variables a container gets depends on what runs it, and the
+  // bare target says nothing about that, so the pack for the product
+  // states them.
+  container: [],
+  "k8s-deployment": [
+    "KUBERNETES_SERVICE_HOST",
+    "KUBERNETES_SERVICE_PORT",
+    "KUBERNETES_PORT",
+    "HOSTNAME"
+  ],
+  // A Worker reads its configuration off the argument every trigger
+  // takes, and Cloudflare puts nothing of its own on it.
+  worker: []
+};
+
 // src/relation.ts
 var import_zod13 = require("zod");
 var RelationSchema = import_zod13.z.enum([
@@ -1887,8 +1960,8 @@ function runtimeConfigBinding(opts) {
     transport: "os",
     semantics: {
       name: "runtime-config",
-      deploymentTarget: opts.deploymentTarget,
-      instanceName: opts.instanceName
+      ...opts.deploymentTarget === void 0 ? {} : { deploymentTarget: opts.deploymentTarget },
+      ...opts.instanceName === void 0 ? {} : { instanceName: opts.instanceName }
     },
     recognition: opts.recognition
   };
@@ -1906,7 +1979,7 @@ function unitInvocationBinding(opts) {
 }
 function storageBinding(opts) {
   return {
-    transport: opts.transport ?? opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem ?? "storage",
     semantics: {
       name: "storage",
       storageSystem: opts.storageSystem,
@@ -1955,6 +2028,7 @@ function metricBinding(opts) {
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
   NOTHING_DEPLOYED,
+  PLATFORM_INJECTED_ENV_VARS,
   RelationSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
@@ -2015,6 +2089,7 @@ function metricBinding(opts) {
   pairingKey,
   parseBoundaryName,
   parseChannel,
+  parseHandler,
   pathAfterOrigin,
   pathShape,
   patternHole,
@@ -2039,6 +2114,7 @@ function metricBinding(opts) {
   storageBinding,
   storageContainerLabel,
   storageLabel,
+  storageSystemLabel,
   typeDefinitionKey,
   unitIdentityKey,
   unitInvocationBinding,

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-BDB_vB6m.cjs';
-export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as routePathsMeet, y as storageContainerLabel, z as storageLabel, A as typeDefinitionKey, H as withDefinitionsInlined } from './schemas-BDB_vB6m.cjs';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-CIns0fqF.cjs';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as routePathsMeet, y as storageContainerLabel, z as storageLabel, A as storageSystemLabel, H as typeDefinitionKey, I as withDefinitionsInlined } from './schemas-CIns0fqF.cjs';
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -683,15 +683,17 @@ declare function channelsPair(a: string, b: string): boolean;
 
 /**
  * One convention for the source directory a deployable unit is built
- * from, and one test for whether a file is inside it.
+ * from, one test for whether a file is inside it, and one reading of
+ * the handler string that says which code the platform calls.
  *
  * A deploy template gives a directory per unit, and a summary stores it
  * as `metadata.codeScope.path`. Producers write that path and the
  * checker reads it back as a prefix test, so the two sides have to
- * agree on whether it ends in a slash. Normalizing it in one place is
- * what keeps them agreeing. The test also has to stop at a segment
- * boundary, or `src/foo` would cover `src/foobar` and a handler would
- * pair with the wrong function.
+ * agree on whether it ends in a slash. The test also has to stop at a
+ * segment boundary, or `src/foo` would cover `src/foobar` and a handler
+ * would pair with the wrong function. A CloudFormation template and a
+ * Terraform configuration spell a handler the same way, so they read it
+ * through the same function rather than through two of them.
  */
 /**
  * The canonical form of a code-scope directory: no leading `./`, no
@@ -708,11 +710,22 @@ declare function codeScopePath(raw: string): string;
  * trailing slash and one stored without it are read the same way.
  */
 declare function fileInCodeScope(file: string, scope: string): boolean;
+interface ParsedHandler {
+    modulePath: string;
+    exportName: string;
+}
+/**
+ * Split a handler string into its module path and exported symbol.
+ * The final dot separates them: `"src/handlers/confirmToken.handler"` →
+ * `{ modulePath: "src/handlers/confirmToken", exportName: "handler" }`.
+ * Returns null when there's no dot, since there's no export to bind to.
+ */
+declare function parseHandler(handler: string): ParsedHandler | null;
 
 /**
  * The DispatchTable idiom: dispatch on a discriminated union through a
  * mapped-type Record, so a missing variant is a type error rather than a
- * runtime fall-through. It is decision #8 in docs/internal/style.md.
+ * runtime fall-through. It is decision #8 in design/docs-internal/style.md.
  *
  * It is here rather than in one package because the decision applies
  * repo-wide, and every package that walks an IR union needs it. Three
@@ -729,6 +742,30 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * The variables a deployment medium puts in a process's environment
+ * whatever its configuration says.
+ *
+ * Code reads them and nothing declares them, so a reader that left them
+ * out would accuse every deployment of failing to supply `AWS_REGION`.
+ * Two readers describe the same Lambda, a CloudFormation template and a
+ * Terraform configuration, and a variable one of them knew about and
+ * the other did not would be an error in one and not the other, so the
+ * list is stated once here. A medium whose vendor documents a different
+ * set per product, Cloud Run's `K_SERVICE` against a plain container's
+ * nothing, states its own list in the pack that describes it.
+ */
+
+/**
+ * Sourced from each platform's own documentation:
+ *
+ *   Lambda: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html
+ *           "Reserved environment variables"
+ *   ECS:    https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_metadata.html
+ *           plus the AWS_DEFAULT_REGION the Fargate runtime sets.
+ */
+declare const PLATFORM_INJECTED_ENV_VARS: Record<DeployableUnit["deploymentTarget"], ReadonlyArray<string>>;
+
 /**
  * What a unit does at a boundary, in the words `suss ask` asks with.
  *
@@ -1013,15 +1050,19 @@ declare function graphqlOperationBinding(opts: {
  */
 declare function isGraphqlOperationBinding(binding: BoundaryBinding | null | undefined): boolean;
 /**
- * Build a runtime-config binding, the provider side of a runtime
- * configuration channel (env vars on a Lambda, ECS task, container, or
- * k8s pod). Transport is `"os"` because the OS hands env vars to the
- * process at startup no matter what the deployment medium is.
+ * Build a runtime-config binding for a runtime configuration channel
+ * (env vars on a Lambda, ECS task, container, or k8s pod). Transport is
+ * `"os"` because the OS hands env vars to the process at startup no
+ * matter what the deployment medium is.
+ *
+ * A provider says which deployment it is. A recognizer standing at a
+ * read in the code leaves both off, since nothing in the code says
+ * which deployment will run it.
  */
 declare function runtimeConfigBinding(opts: {
     recognition: string;
-    deploymentTarget: DeployableUnit["deploymentTarget"];
-    instanceName: string;
+    deploymentTarget?: DeployableUnit["deploymentTarget"];
+    instanceName?: string;
 }): BoundaryBinding;
 /**
  * Build a unit-invocation binding, the boundary between a deployed unit
@@ -1039,12 +1080,13 @@ declare function unitInvocationBinding(opts: {
  * Build a storage binding, the side of a store that both a schema
  * reader and a call site can spell. `transport` defaults to the store's
  * own name, which is right for a database whose product and wire
- * protocol are the same word, and a store reached over an SDK passes
- * its wire instead.
+ * protocol are the same word; a store reached over an SDK passes its
+ * wire instead, and one whose engine nobody settled has none to pass.
  */
 declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: string;
+    /** Null when the source states an engine this reader could not settle. */
+    storageSystem: string | null;
     transport?: string;
     scope: string;
     /** Null when the source gives a container this reader could not settle. */
@@ -1073,4 +1115,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, type PackConfiguration, type PackDeclaration, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketRank, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketRank, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-BDB_vB6m.js';
-export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as routePathsMeet, y as storageContainerLabel, z as storageLabel, A as typeDefinitionKey, H as withDefinitionsInlined } from './schemas-BDB_vB6m.js';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-CIns0fqF.js';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as routePathsMeet, y as storageContainerLabel, z as storageLabel, A as storageSystemLabel, H as typeDefinitionKey, I as withDefinitionsInlined } from './schemas-CIns0fqF.js';
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -683,15 +683,17 @@ declare function channelsPair(a: string, b: string): boolean;
 
 /**
  * One convention for the source directory a deployable unit is built
- * from, and one test for whether a file is inside it.
+ * from, one test for whether a file is inside it, and one reading of
+ * the handler string that says which code the platform calls.
  *
  * A deploy template gives a directory per unit, and a summary stores it
  * as `metadata.codeScope.path`. Producers write that path and the
  * checker reads it back as a prefix test, so the two sides have to
- * agree on whether it ends in a slash. Normalizing it in one place is
- * what keeps them agreeing. The test also has to stop at a segment
- * boundary, or `src/foo` would cover `src/foobar` and a handler would
- * pair with the wrong function.
+ * agree on whether it ends in a slash. The test also has to stop at a
+ * segment boundary, or `src/foo` would cover `src/foobar` and a handler
+ * would pair with the wrong function. A CloudFormation template and a
+ * Terraform configuration spell a handler the same way, so they read it
+ * through the same function rather than through two of them.
  */
 /**
  * The canonical form of a code-scope directory: no leading `./`, no
@@ -708,11 +710,22 @@ declare function codeScopePath(raw: string): string;
  * trailing slash and one stored without it are read the same way.
  */
 declare function fileInCodeScope(file: string, scope: string): boolean;
+interface ParsedHandler {
+    modulePath: string;
+    exportName: string;
+}
+/**
+ * Split a handler string into its module path and exported symbol.
+ * The final dot separates them: `"src/handlers/confirmToken.handler"` →
+ * `{ modulePath: "src/handlers/confirmToken", exportName: "handler" }`.
+ * Returns null when there's no dot, since there's no export to bind to.
+ */
+declare function parseHandler(handler: string): ParsedHandler | null;
 
 /**
  * The DispatchTable idiom: dispatch on a discriminated union through a
  * mapped-type Record, so a missing variant is a type error rather than a
- * runtime fall-through. It is decision #8 in docs/internal/style.md.
+ * runtime fall-through. It is decision #8 in design/docs-internal/style.md.
  *
  * It is here rather than in one package because the decision applies
  * repo-wide, and every package that walks an IR union needs it. Three
@@ -729,6 +742,30 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * The variables a deployment medium puts in a process's environment
+ * whatever its configuration says.
+ *
+ * Code reads them and nothing declares them, so a reader that left them
+ * out would accuse every deployment of failing to supply `AWS_REGION`.
+ * Two readers describe the same Lambda, a CloudFormation template and a
+ * Terraform configuration, and a variable one of them knew about and
+ * the other did not would be an error in one and not the other, so the
+ * list is stated once here. A medium whose vendor documents a different
+ * set per product, Cloud Run's `K_SERVICE` against a plain container's
+ * nothing, states its own list in the pack that describes it.
+ */
+
+/**
+ * Sourced from each platform's own documentation:
+ *
+ *   Lambda: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html
+ *           "Reserved environment variables"
+ *   ECS:    https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_metadata.html
+ *           plus the AWS_DEFAULT_REGION the Fargate runtime sets.
+ */
+declare const PLATFORM_INJECTED_ENV_VARS: Record<DeployableUnit["deploymentTarget"], ReadonlyArray<string>>;
+
 /**
  * What a unit does at a boundary, in the words `suss ask` asks with.
  *
@@ -1013,15 +1050,19 @@ declare function graphqlOperationBinding(opts: {
  */
 declare function isGraphqlOperationBinding(binding: BoundaryBinding | null | undefined): boolean;
 /**
- * Build a runtime-config binding, the provider side of a runtime
- * configuration channel (env vars on a Lambda, ECS task, container, or
- * k8s pod). Transport is `"os"` because the OS hands env vars to the
- * process at startup no matter what the deployment medium is.
+ * Build a runtime-config binding for a runtime configuration channel
+ * (env vars on a Lambda, ECS task, container, or k8s pod). Transport is
+ * `"os"` because the OS hands env vars to the process at startup no
+ * matter what the deployment medium is.
+ *
+ * A provider says which deployment it is. A recognizer standing at a
+ * read in the code leaves both off, since nothing in the code says
+ * which deployment will run it.
  */
 declare function runtimeConfigBinding(opts: {
     recognition: string;
-    deploymentTarget: DeployableUnit["deploymentTarget"];
-    instanceName: string;
+    deploymentTarget?: DeployableUnit["deploymentTarget"];
+    instanceName?: string;
 }): BoundaryBinding;
 /**
  * Build a unit-invocation binding, the boundary between a deployed unit
@@ -1039,12 +1080,13 @@ declare function unitInvocationBinding(opts: {
  * Build a storage binding, the side of a store that both a schema
  * reader and a call site can spell. `transport` defaults to the store's
  * own name, which is right for a database whose product and wire
- * protocol are the same word, and a store reached over an SDK passes
- * its wire instead.
+ * protocol are the same word; a store reached over an SDK passes its
+ * wire instead, and one whose engine nobody settled has none to pass.
  */
 declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: string;
+    /** Null when the source states an engine this reader could not settle. */
+    storageSystem: string | null;
     transport?: string;
     scope: string;
     /** Null when the source gives a container this reader could not settle. */
@@ -1073,4 +1115,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, type PackConfiguration, type PackDeclaration, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketRank, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketRank, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };

package/dist/index.js

@@ -55,10 +55,11 @@ import {
   statesAnOrigin,
   storageContainerLabel,
   storageLabel,
+  storageSystemLabel,
   typeDefinitionKey,
   unitIdentityKey,
   withDefinitionsInlined
-} from "./chunk-ODHT5T2Q.js";
+} from "./chunk-N564FH5U.js";
 
 // src/semconv.ts
 function semconvAttributes(binding) {
@@ -238,6 +239,17 @@ function fileInCodeScope(file, scope) {
   const path = codeScopePath(file);
   return path === prefix || path.startsWith(`${prefix}/`);
 }
+function parseHandler(handler) {
+  const trimmed = handler.trim();
+  const lastDot = trimmed.lastIndexOf(".");
+  if (lastDot <= 0 || lastDot === trimmed.length - 1) {
+    return null;
+  }
+  return {
+    modulePath: trimmed.slice(0, lastDot),
+    exportName: trimmed.slice(lastDot + 1)
+  };
+}
 
 // src/deployment.ts
 var NOTHING_DEPLOYED = {
@@ -246,6 +258,49 @@ var NOTHING_DEPLOYED = {
   pointsAt: () => null
 };
 
+// src/platformEnvVars.ts
+var PLATFORM_INJECTED_ENV_VARS = {
+  lambda: [
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION",
+    "AWS_LAMBDA_FUNCTION_NAME",
+    "AWS_LAMBDA_FUNCTION_VERSION",
+    "AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+    "AWS_LAMBDA_LOG_GROUP_NAME",
+    "AWS_LAMBDA_LOG_STREAM_NAME",
+    "AWS_LAMBDA_RUNTIME_API",
+    "AWS_EXECUTION_ENV",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "LAMBDA_TASK_ROOT",
+    "LAMBDA_RUNTIME_DIR",
+    "_HANDLER",
+    "_X_AMZN_TRACE_ID",
+    "TZ"
+  ],
+  "ecs-task": [
+    "AWS_DEFAULT_REGION",
+    "AWS_REGION",
+    "ECS_CONTAINER_METADATA_URI",
+    "ECS_CONTAINER_METADATA_URI_V4",
+    "ECS_AGENT_URI"
+  ],
+  // Which variables a container gets depends on what runs it, and the
+  // bare target says nothing about that, so the pack for the product
+  // states them.
+  container: [],
+  "k8s-deployment": [
+    "KUBERNETES_SERVICE_HOST",
+    "KUBERNETES_SERVICE_PORT",
+    "KUBERNETES_PORT",
+    "HOSTNAME"
+  ],
+  // A Worker reads its configuration off the argument every trigger
+  // takes, and Cloudflare puts nothing of its own on it.
+  worker: []
+};
+
 // src/relation.ts
 import { z } from "zod";
 var RelationSchema = z.enum([
@@ -590,8 +645,8 @@ function runtimeConfigBinding(opts) {
     transport: "os",
     semantics: {
       name: "runtime-config",
-      deploymentTarget: opts.deploymentTarget,
-      instanceName: opts.instanceName
+      ...opts.deploymentTarget === void 0 ? {} : { deploymentTarget: opts.deploymentTarget },
+      ...opts.instanceName === void 0 ? {} : { instanceName: opts.instanceName }
     },
     recognition: opts.recognition
   };
@@ -609,7 +664,7 @@ function unitInvocationBinding(opts) {
 }
 function storageBinding(opts) {
   return {
-    transport: opts.transport ?? opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem ?? "storage",
     semantics: {
       name: "storage",
       storageSystem: opts.storageSystem,
@@ -657,6 +712,7 @@ export {
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
   NOTHING_DEPLOYED,
+  PLATFORM_INJECTED_ENV_VARS,
   RelationSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
@@ -717,6 +773,7 @@ export {
   pairingKey,
   parseBoundaryName,
   parseChannel,
+  parseHandler,
   pathAfterOrigin,
   pathShape,
   patternHole,
@@ -741,6 +798,7 @@ export {
   storageBinding,
   storageContainerLabel,
   storageLabel,
+  storageSystemLabel,
   typeDefinitionKey,
   unitIdentityKey,
   unitInvocationBinding,

package/dist/{schemas-BDB_vB6m.d.cts → schemas-CIns0fqF.d.cts}

@@ -66,6 +66,9 @@ declare const MessageBusSemanticsSchema: z.ZodObject<{
         "aws.sns": "aws.sns";
         s3: "s3";
         eventbridge: "eventbridge";
+        aws_kinesis: "aws_kinesis";
+        aws_firehose: "aws_firehose";
+        gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
         kafka: "kafka";
         nats: "nats";
@@ -121,18 +124,18 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         subscription: "subscription";
     }>;
 }, z.core.$strip>, z.ZodObject<{
-    deploymentTarget: z.ZodEnum<{
+    deploymentTarget: z.ZodOptional<z.ZodEnum<{
         lambda: "lambda";
         "ecs-task": "ecs-task";
         container: "container";
         "k8s-deployment": "k8s-deployment";
         worker: "worker";
-    }>;
-    instanceName: z.ZodString;
+    }>>;
+    instanceName: z.ZodOptional<z.ZodString>;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"storage">;
-    storageSystem: z.ZodString;
+    storageSystem: z.ZodNullable<z.ZodString>;
     scope: z.ZodString;
     container: z.ZodNullable<z.ZodString>;
     accessPath: z.ZodNullable<z.ZodString>;
@@ -143,6 +146,9 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         "aws.sns": "aws.sns";
         s3: "s3";
         eventbridge: "eventbridge";
+        aws_kinesis: "aws_kinesis";
+        aws_firehose: "aws_firehose";
+        gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
         kafka: "kafka";
         nats: "nats";
@@ -218,23 +224,28 @@ declare function routePathsMeet(a: string, b: string): boolean;
  * The pairing key is `(deploymentTarget, instanceName)`, which is
  * exactly a deployable unit, so the two fields come from
  * `DeployableUnitSchema` instead of being written out a second time.
+ *
+ * A provider states both. The reading side is the code, which knows it
+ * reads its configuration and not which deployment will run it, so a
+ * recognizer standing at a read leaves both off rather than guessing.
+ * The pairing pass takes the deployment from the provider anyway.
  */
 declare const RuntimeConfigSemanticsSchema: z.ZodObject<{
-    deploymentTarget: z.ZodEnum<{
+    deploymentTarget: z.ZodOptional<z.ZodEnum<{
         lambda: "lambda";
         "ecs-task": "ecs-task";
         container: "container";
         "k8s-deployment": "k8s-deployment";
         worker: "worker";
-    }>;
-    instanceName: z.ZodString;
+    }>>;
+    instanceName: z.ZodOptional<z.ZodString>;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>;
 type RuntimeConfigSemantics = z.infer<typeof RuntimeConfigSemanticsSchema>;
 
 declare const StorageSemanticsSchema: z.ZodObject<{
     name: z.ZodLiteral<"storage">;
-    storageSystem: z.ZodString;
+    storageSystem: z.ZodNullable<z.ZodString>;
     scope: z.ZodString;
     container: z.ZodNullable<z.ZodString>;
     accessPath: z.ZodNullable<z.ZodString>;
@@ -247,6 +258,8 @@ type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
  * intent doc that says which store a write reaches all read this one.
  */
 declare function storageLabel(semantics: StorageSemantics): string;
+/** The engine, or the words a report writes where nobody settled one. */
+declare function storageSystemLabel(semantics: StorageSemantics): string;
 /**
  * What an access writes for its columns when it asked for all of them,
  * which is a query with no explicit projection. It covers every column
@@ -368,18 +381,18 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             subscription: "subscription";
         }>;
     }, z.core.$strip>, z.ZodObject<{
-        deploymentTarget: z.ZodEnum<{
+        deploymentTarget: z.ZodOptional<z.ZodEnum<{
             lambda: "lambda";
             "ecs-task": "ecs-task";
             container: "container";
             "k8s-deployment": "k8s-deployment";
             worker: "worker";
-        }>;
-        instanceName: z.ZodString;
+        }>>;
+        instanceName: z.ZodOptional<z.ZodString>;
         name: z.ZodLiteral<"runtime-config">;
     }, z.core.$strip>, z.ZodObject<{
         name: z.ZodLiteral<"storage">;
-        storageSystem: z.ZodString;
+        storageSystem: z.ZodNullable<z.ZodString>;
         scope: z.ZodString;
         container: z.ZodNullable<z.ZodString>;
         accessPath: z.ZodNullable<z.ZodString>;
@@ -390,6 +403,9 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             "aws.sns": "aws.sns";
             s3: "s3";
             eventbridge: "eventbridge";
+            aws_kinesis: "aws_kinesis";
+            aws_firehose: "aws_firehose";
+            gcp_pubsub: "gcp_pubsub";
             bullmq: "bullmq";
             kafka: "kafka";
             nats: "nats";
@@ -501,4 +517,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { typeDefinitionKey as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, withDefinitionsInlined as H, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, routePathsMeet as x, storageContainerLabel as y, storageLabel as z };
+export { storageSystemLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, typeDefinitionKey as H, withDefinitionsInlined as I, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, routePathsMeet as x, storageContainerLabel as y, storageLabel as z };

package/dist/{schemas-BDB_vB6m.d.ts → schemas-CIns0fqF.d.ts}

@@ -66,6 +66,9 @@ declare const MessageBusSemanticsSchema: z.ZodObject<{
         "aws.sns": "aws.sns";
         s3: "s3";
         eventbridge: "eventbridge";
+        aws_kinesis: "aws_kinesis";
+        aws_firehose: "aws_firehose";
+        gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
         kafka: "kafka";
         nats: "nats";
@@ -121,18 +124,18 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         subscription: "subscription";
     }>;
 }, z.core.$strip>, z.ZodObject<{
-    deploymentTarget: z.ZodEnum<{
+    deploymentTarget: z.ZodOptional<z.ZodEnum<{
         lambda: "lambda";
         "ecs-task": "ecs-task";
         container: "container";
         "k8s-deployment": "k8s-deployment";
         worker: "worker";
-    }>;
-    instanceName: z.ZodString;
+    }>>;
+    instanceName: z.ZodOptional<z.ZodString>;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"storage">;
-    storageSystem: z.ZodString;
+    storageSystem: z.ZodNullable<z.ZodString>;
     scope: z.ZodString;
     container: z.ZodNullable<z.ZodString>;
     accessPath: z.ZodNullable<z.ZodString>;
@@ -143,6 +146,9 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         "aws.sns": "aws.sns";
         s3: "s3";
         eventbridge: "eventbridge";
+        aws_kinesis: "aws_kinesis";
+        aws_firehose: "aws_firehose";
+        gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
         kafka: "kafka";
         nats: "nats";
@@ -218,23 +224,28 @@ declare function routePathsMeet(a: string, b: string): boolean;
  * The pairing key is `(deploymentTarget, instanceName)`, which is
  * exactly a deployable unit, so the two fields come from
  * `DeployableUnitSchema` instead of being written out a second time.
+ *
+ * A provider states both. The reading side is the code, which knows it
+ * reads its configuration and not which deployment will run it, so a
+ * recognizer standing at a read leaves both off rather than guessing.
+ * The pairing pass takes the deployment from the provider anyway.
  */
 declare const RuntimeConfigSemanticsSchema: z.ZodObject<{
-    deploymentTarget: z.ZodEnum<{
+    deploymentTarget: z.ZodOptional<z.ZodEnum<{
         lambda: "lambda";
         "ecs-task": "ecs-task";
         container: "container";
         "k8s-deployment": "k8s-deployment";
         worker: "worker";
-    }>;
-    instanceName: z.ZodString;
+    }>>;
+    instanceName: z.ZodOptional<z.ZodString>;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>;
 type RuntimeConfigSemantics = z.infer<typeof RuntimeConfigSemanticsSchema>;
 
 declare const StorageSemanticsSchema: z.ZodObject<{
     name: z.ZodLiteral<"storage">;
-    storageSystem: z.ZodString;
+    storageSystem: z.ZodNullable<z.ZodString>;
     scope: z.ZodString;
     container: z.ZodNullable<z.ZodString>;
     accessPath: z.ZodNullable<z.ZodString>;
@@ -247,6 +258,8 @@ type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
  * intent doc that says which store a write reaches all read this one.
  */
 declare function storageLabel(semantics: StorageSemantics): string;
+/** The engine, or the words a report writes where nobody settled one. */
+declare function storageSystemLabel(semantics: StorageSemantics): string;
 /**
  * What an access writes for its columns when it asked for all of them,
  * which is a query with no explicit projection. It covers every column
@@ -368,18 +381,18 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             subscription: "subscription";
         }>;
     }, z.core.$strip>, z.ZodObject<{
-        deploymentTarget: z.ZodEnum<{
+        deploymentTarget: z.ZodOptional<z.ZodEnum<{
             lambda: "lambda";
             "ecs-task": "ecs-task";
             container: "container";
             "k8s-deployment": "k8s-deployment";
             worker: "worker";
-        }>;
-        instanceName: z.ZodString;
+        }>>;
+        instanceName: z.ZodOptional<z.ZodString>;
         name: z.ZodLiteral<"runtime-config">;
     }, z.core.$strip>, z.ZodObject<{
         name: z.ZodLiteral<"storage">;
-        storageSystem: z.ZodString;
+        storageSystem: z.ZodNullable<z.ZodString>;
         scope: z.ZodString;
         container: z.ZodNullable<z.ZodString>;
         accessPath: z.ZodNullable<z.ZodString>;
@@ -390,6 +403,9 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             "aws.sns": "aws.sns";
             s3: "s3";
             eventbridge: "eventbridge";
+            aws_kinesis: "aws_kinesis";
+            aws_firehose: "aws_firehose";
+            gcp_pubsub: "gcp_pubsub";
             bullmq: "bullmq";
             kafka: "kafka";
             nats: "nats";
@@ -501,4 +517,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { typeDefinitionKey as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, withDefinitionsInlined as H, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, routePathsMeet as x, storageContainerLabel as y, storageLabel as z };
+export { storageSystemLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, typeDefinitionKey as H, withDefinitionsInlined as I, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, pathShape as v, routePathAdmits as w, routePathsMeet as x, storageContainerLabel as y, storageLabel as z };

package/dist/schemas.cjs

@@ -247,6 +247,12 @@ var MessageBusSemanticsSchema = import_zod4.z.object({
     "aws.sns",
     "s3",
     "eventbridge",
+    // A Kinesis stream and a Firehose delivery stream are different
+    // APIs with different destinations, so a stream named `orders` and
+    // a delivery stream named `orders` are not the same channel.
+    "aws_kinesis",
+    "aws_firehose",
+    "gcp_pubsub",
     "bullmq",
     "kafka",
     "nats",
@@ -796,7 +802,10 @@ var DeployableUnitSchema = import_zod7.z.object({
 });
 
 // src/semantics/runtimeConfig.ts
-var RuntimeConfigSemanticsSchema = DeployableUnitSchema.extend({
+var RuntimeConfigSemanticsSchema = DeployableUnitSchema.partial({
+  deploymentTarget: true,
+  instanceName: true
+}).extend({
   name: import_zod8.z.literal("runtime-config")
 });
 var runtimeConfigSemantics = defineBoundarySemantics({
@@ -823,10 +832,13 @@ var StorageSemanticsSchema = import_zod9.z.object({
   name: import_zod9.z.literal("storage"),
   /**
    * Which store this is: postgresql, mysql, aws.dynamodb, or our own
-   * word for one OpenTelemetry never named, such as s3. Two products'
-   * containers can share a name, so this keeps them apart.
+   * word for one OpenTelemetry never named, such as s3, or null when
+   * the source states one this reader could not settle. Two products'
+   * containers can share a name, so this keeps them apart. A null
+   * keeps none of them apart, and the pairing pass says what it does
+   * with one.
    */
-  storageSystem: import_zod9.z.string(),
+  storageSystem: import_zod9.z.string().nullable(),
   /**
    * The ORM, schema, or deployment scope. A single-database setup uses
    * `"default"`, and a monorepo with several schemas gives each one its
@@ -889,8 +901,12 @@ var storageSemantics = defineBoundarySemantics({
   }
 });
 function storageLabel(semantics) {
-  return `${semantics.storageSystem}:${storageContainerLabel(semantics)}`;
+  return `${storageSystemLabel(semantics)}:${storageContainerLabel(semantics)}`;
 }
+function storageSystemLabel(semantics) {
+  return semantics.storageSystem ?? UNKNOWN_ENGINE;
+}
+var UNKNOWN_ENGINE = "<unknown engine>";
 function storageContainerLabel(semantics) {
   const container = semantics.container ?? "<unnamed container>";
   const addressed = semantics.accessPath === null ? container : `${container}#${semantics.accessPath}`;

package/dist/schemas.d.cts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, A as typeDefinitionKey, H as withDefinitionsInlined } from './schemas-BDB_vB6m.cjs';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, H as typeDefinitionKey, I as withDefinitionsInlined } from './schemas-CIns0fqF.cjs';

package/dist/schemas.d.ts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, A as typeDefinitionKey, H as withDefinitionsInlined } from './schemas-BDB_vB6m.js';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, H as typeDefinitionKey, I as withDefinitionsInlined } from './schemas-CIns0fqF.js';

package/dist/schemas.js

@@ -17,7 +17,7 @@ import {
   TypeShapeSchema,
   typeDefinitionKey,
   withDefinitionsInlined
-} from "./chunk-ODHT5T2Q.js";
+} from "./chunk-N564FH5U.js";
 export {
   BoundaryBindingSchema,
   ConfidenceInfoSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/ir-core",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "type": "module",
   "description": "The type primitives every suss summary is built from: type shapes, boundary bindings, source locations and confidence.",
   "keywords": [