@suss/ir-core 0.33.0 → 0.34.0

package/dist/{chunk-N564FH5U.js → chunk-WOXA5GBL.js}

@@ -1,8 +1,8 @@
 // src/schemas.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/semantics/registry.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/semantics/functionCall.ts
 import { z } from "zod";
@@ -23,6 +23,9 @@ function unitIdentityKey(deploymentTarget, instanceName) {
 function metricIdentityKey(metricSystem, metricType) {
   return `metric:${metricSystem} ${metricType}`;
 }
+function ioIdentityKey(target) {
+  return `io:${target}`;
+}
 
 // src/semantics/definition.ts
 function defineBoundarySemantics(definition) {
@@ -33,10 +36,11 @@ function defineBoundarySemantics(definition) {
 var FunctionCallSemanticsSchema = z.object({
   name: z.literal("function-call"),
   /**
-   * Optional module identifier for cross-unit references
-   * (e.g. `"./components/Button"` for a React component, or the TS
-   * module path for a bare function export). Packs that don't do
-   * cross-module pairing can leave it unset.
+   * Where the function lives inside this repository. It is either the
+   * name of a module the project lists in `suss.json`, such as
+   * `"billing"`, or a module path, such as the file a server action is
+   * written in. A name has no separator in it and a path always does.
+   * Packs that don't do cross-module pairing can leave it unset.
    */
   module: z.string().optional(),
   /** Named export within the module, when applicable. */
@@ -61,35 +65,38 @@ var FunctionCallSemanticsSchema = z.object({
    */
   exportPath: z.array(z.string()).optional()
 });
+function isModuleName(module) {
+  return !module.includes("/") && !module.includes("\\");
+}
 var functionCallSemantics = defineBoundarySemantics({
   name: "function-call",
   schema: FunctionCallSemanticsSchema,
-  // A call that never leaves the process does not produce a span, and
-  // the conventions do not name one. All of it is ours.
+  // A call inside the process does not produce a span, and the
+  // conventions have no attributes for it.
   semconv: {},
   behavior: {
-    /** A call returns a value, which is not a status and a body. */
+    /** A call returns a value, with no status. */
     exchangesHttpResponses: false,
     leavesTheProcess: false,
     reportsUnpairedItself: false,
     /**
-     * In-repo units (components, bare handlers) are keyless by design
-     * and pair through call edges rather than the keyed pass, so a
-     * missing key is not a boundary nothing can reach.
+     * In-repo units such as components have no key on purpose. They
+     * pair through call edges instead of the keyed pass, so a missing
+     * key does not make them unreachable.
      */
     canPair: () => true,
-    /**
-     * `"fn:<package>::<exportPath>"` when both are set, and
-     * `"fn:<module>::<exportName>"` for an in-repo unit that states its
-     * module, the way a server action does. Components and bare
-     * handlers state neither and have no key at all.
-     */
     rewritePaths(semantics, rewrite) {
-      if (semantics.module === void 0) {
+      if (semantics.module === void 0 || isModuleName(semantics.module)) {
         return semantics;
       }
       return { ...semantics, module: rewrite(semantics.module) };
     },
+    /**
+     * `"fn:<package>::<exportPath>"` when both are set, and
+     * `"fn:<module>::<exportName>"` for an in-repo unit that gives its
+     * module, as a server action does. Components and plain handlers
+     * give neither and have no key.
+     */
     identityKey(semantics) {
       if (semantics.package !== void 0 && semantics.exportPath !== void 0 && semantics.exportPath.length > 0) {
         return fnIdentityKey(semantics.package, semantics.exportPath);
@@ -120,15 +127,15 @@ var graphqlOperationSemantics = defineBoundarySemantics({
   behavior: {
     /**
      * An operation gets a data-and-errors document back, which the
-     * GraphQL contract checker reads. Status codes say nothing here.
+     * GraphQL contract checker reads. Status codes do not apply.
      */
     exchangesHttpResponses: false,
     leavesTheProcess: true,
     reportsUnpairedItself: false,
     identityKey: () => null,
-    /** Keyless by design; the dedicated pass pairs it by its document. */
+    /** No key on purpose. The dedicated pass pairs an operation by its document. */
     canPair: () => true,
-    /** "query GetUser". The contract checker pairs it, the key does not. */
+    /** `query GetUser`. Only for display, since the contract checker does the pairing. */
     displayLabel(semantics) {
       return `${semantics.operationType} ${semantics.operationName ?? "<anonymous>"}`;
     }
@@ -151,14 +158,14 @@ var GraphqlResolverSemanticsSchema = z3.object({
 var graphqlResolverSemantics = defineBoundarySemantics({
   name: "graphql-resolver",
   schema: GraphqlResolverSemanticsSchema,
-  // The conventions name the operation a client sent, not the
-  // resolver the server ran for one field of it.
+  // The conventions describe the operation a client sent. They have no
+  // attribute for the resolver the server ran for one field of it.
   semconv: {},
   behavior: {
-    /** A resolver returns a field value, not a status and a body. */
+    /** A resolver returns a field value, with no status. */
     exchangesHttpResponses: false,
-    // A query somebody sent from outside runs it, even though the
-    // server calls the function in its own process.
+    // A resolver runs because a client outside the process sent a query,
+    // even though the server calls it in its own process.
     leavesTheProcess: true,
     reportsUnpairedItself: false,
     /**
@@ -175,8 +182,32 @@ var graphqlResolverSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/messageBus.ts
+// src/semantics/io.ts
 import { z as z4 } from "zod";
+var IoSemanticsSchema = z4.object({
+  name: z4.literal("io"),
+  /** The stream, such as `stdout` or `stderr`. Null when the source does not say which. */
+  target: z4.string().nullable()
+});
+var ioSemantics = defineBoundarySemantics({
+  name: "io",
+  schema: IoSemanticsSchema,
+  // The semantic conventions have no attribute for a process's own streams.
+  semconv: {},
+  behavior: {
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey(semantics) {
+      return semantics.target === null ? null : ioIdentityKey(semantics.target);
+    },
+    // Nothing declares the reading side, so a write has nothing to meet.
+    canPair: () => false
+  }
+});
+
+// src/semantics/messageBus.ts
+import { z as z5 } from "zod";
 
 // src/channel.ts
 function parseChannel(channel) {
@@ -202,12 +233,11 @@ function channelsPair(a, b) {
 }
 
 // src/semantics/messageBus.ts
-var MessageBusSemanticsSchema = z4.object({
-  name: z4.literal("message-bus"),
-  messageBus: z4.enum([
-    // The conventions spell the two AWS buses this way, one with an
-    // underscore and one with a dot, so these are their strings and
-    // not a typo.
+var MessageBusSemanticsSchema = z5.object({
+  name: z5.literal("message-bus"),
+  messageBus: z5.enum([
+    // The conventions write these two AWS buses differently, one with an
+    // underscore and one with a dot. Both are as the conventions give them.
     "aws_sqs",
     "aws.sns",
     "s3",
@@ -226,12 +256,13 @@ var MessageBusSemanticsSchema = z4.object({
     "cloudflare-tail"
   ]),
   /**
-   * Stable channel identifier: a CFN logical id, a queue or topic name,
-   * a subject pattern, or `bus#detailType`. Null when this source does
-   * not say which channel, as with a send whose queue the code picks at
-   * runtime, or a receive whose queue the event-source mapping states.
+   * A stable channel identifier: a CloudFormation logical id, a queue or
+   * topic name, a subject pattern, or `bus#detailType`. Null when this
+   * source does not say which channel, as with a send whose queue the
+   * code picks at run time, or a receive whose queue is set in the
+   * event-source mapping.
    */
-  channel: z4.string().min(1).nullable()
+  channel: z5.string().min(1).nullable()
 });
 var messageBusSemantics = defineBoundarySemantics({
   name: "message-bus",
@@ -245,25 +276,26 @@ var messageBusSemantics = defineBoundarySemantics({
     exchangesHttpResponses: false,
     leavesTheProcess: true,
     /**
-     * `checkMessageBus` looks at every channel, including the unused
-     * ones, so the generic unmatched lists leave them alone.
+     * `checkMessageBus` reports every channel, unused ones included, so
+     * the generic unmatched list leaves them out.
      */
     reportsUnpairedItself: true,
     /**
-     * A channel unnamed here can still pair: the dedicated pass
-     * collapses env chains before comparing, so a consumer whose
-     * channel arrives at runtime meets the template that declares it.
+     * A channel that is null here can still pair. The dedicated pass
+     * follows environment variable chains before comparing, so a
+     * consumer whose channel is set at run time meets the template that
+     * declares it.
      */
     canPair: () => true,
     /**
      * `"bus:<messageBus> <subject>"`, or null when the channel is null
      * or its subject is empty.
      *
-     * The key has the subject in it and leaves out the bus, so a
-     * template writing `default#order.placed` and a handler writing
+     * The key has the subject and leaves out the bus, so a template
+     * writing `default#order.placed` and a handler writing
      * `order.placed` land in one bucket, where `sidesAgree` compares the
-     * buses. A side that cannot know its bus would otherwise be keyed
-     * away from the side that can.
+     * buses. Keying on the bus would separate a side that cannot know
+     * its bus from the side that can.
      *
      * The bus technology stays in, because a queue and an event router
      * are different destinations even with the same subject. Case stays
@@ -286,9 +318,9 @@ var messageBusSemantics = defineBoundarySemantics({
       return channelsPair(a.channel, b.channel);
     },
     /**
-     * The whole channel, bus included, unlike the identity key, which
-     * has the subject alone. Someone reading a list of unmatched
-     * channels wants to see which bus each one was on.
+     * The whole channel, bus included, where the identity key has only
+     * the subject. A reader looking at unmatched channels needs to see
+     * which bus each one was on.
      */
     displayLabel(semantics) {
       if (semantics.channel === null) {
@@ -300,25 +332,25 @@ var messageBusSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/metric.ts
-import { z as z5 } from "zod";
-var MetricSemanticsSchema = z5.object({
-  name: z5.literal("metric"),
-  /** Which system the series lives in: cloud-monitoring, cloudwatch. */
-  metricSystem: z5.string(),
+import { z as z6 } from "zod";
+var MetricSemanticsSchema = z6.object({
+  name: z6.literal("metric"),
+  /** The system the series is stored in, such as `cloud-monitoring` or `cloudwatch`. */
+  metricSystem: z6.string(),
   /**
-   * The type string the system knows the metric by, spelled the way
-   * both sides spell it. Null when the source states one this reader
-   * could not settle, as with a query it could not read: a metric
-   * nobody could name pairs with nothing rather than with whatever
-   * happens to share its source text.
+   * The type string the system uses for the metric, written the same
+   * way on both sides. Null when the reader could not work the string
+   * out, as with a query it could not parse. A null type pairs with
+   * nothing, so it cannot pair with an unrelated metric that happens to
+   * share its source text.
    */
-  metricType: z5.string().nullable()
+  metricType: z6.string().nullable()
 });
 var metricSemantics = defineBoundarySemantics({
   name: "metric",
   schema: MetricSemanticsSchema,
-  // OpenTelemetry knows a metric by its instrument name, and has no
-  // attribute for the system it lives in or the type string it goes by.
+  // OpenTelemetry identifies a metric by its instrument name. It has no
+  // attribute for the metric's system or its type string.
   semconv: {},
   behavior: {
     exchangesHttpResponses: false,
@@ -334,7 +366,7 @@ var metricSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/rest.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/dispatch.ts
 function dispatchByType(table, value) {
@@ -681,23 +713,23 @@ function compareRanks(a, b) {
 }
 
 // src/semantics/rest.ts
-var RestSemanticsSchema = z6.object({
-  name: z6.literal("rest"),
+var RestSemanticsSchema = z7.object({
+  name: z7.literal("rest"),
   /**
    * Uppercase HTTP method ("GET", "POST", …), `"*"` for a handler that
    * responds to every method, or null when this source does not say
    * which method.
    */
-  method: z6.string().min(1).nullable(),
+  method: z7.string().min(1).nullable(),
   /** Normalized route path ("/users/{id}"), or null when this source does not give one. */
-  path: z6.string().min(1).nullable(),
+  path: z7.string().min(1).nullable(),
   /**
-   * Status codes the producing source explicitly declared (OpenAPI
-   * responses, CFN MethodResponses, ts-rest router statuses). They are
-   * kept here so the pairing layer can see them without unwrapping any
-   * metadata. Absent, or empty, for a source that was inferred.
+   * Status codes the producing source declared explicitly, such as
+   * OpenAPI responses or CloudFormation MethodResponses. They are kept
+   * here so the pairing layer can see them without unwrapping any
+   * metadata. Absent or empty for an inferred source.
    */
-  declaredResponses: z6.array(z6.number()).optional()
+  declaredResponses: z7.array(z7.number()).optional()
 });
 var OPENING_HOLE = /^\{([^{}]+)\}(.*)$/;
 function baseUrlReference(semantics) {
@@ -754,16 +786,15 @@ var restSemantics = defineBoundarySemantics({
       return `${semantics.method.toUpperCase()} ${normalizePath(semantics.path)}`;
     },
     /**
-     * The bucket has only the path in it, so a `"*"` route lands with
-     * the consumers that each specify a method, and `methodsAgree`
-     * settles it inside the bucket. The identity key stays what a reader
-     * sees and a suppression targets ("GET /users", "* /users"), and
-     * this key groups what a reader still tells apart.
+     * The bucket has only the path, so a `"*"` route lands with the
+     * consumers that each give a method, and `methodsAgree` compares the
+     * methods inside the bucket. The identity key is still what a reader
+     * sees and what a suppression targets ("GET /users", "* /users").
      *
-     * A parameter's name goes too. A spec written by hand says
-     * `{userId}` where the Express route that serves it says `:id`, and
-     * both match the same requests, so pairing on the name gave two
-     * boundaries that never met and a run with nothing to report.
+     * Parameter names are dropped too. A hand-written spec writes
+     * `{userId}` where the Express route that serves it writes `:id`,
+     * and both match the same requests. Pairing on the name would leave
+     * two boundaries that never meet.
      */
     pairingKey(semantics) {
       if (semantics.method === null || semantics.path === null) {
@@ -784,9 +815,9 @@ var restSemantics = defineBoundarySemantics({
       return semantics.path === null ? [] : pathSpecificity(normalizePath(semantics.path));
     },
     /**
-     * What the identity key says, with a missing half still readable:
-     * ANY when no method was stated, and ? when no path was. Null when
-     * neither was stated, because then there is nothing to show.
+     * The identity key, with a missing half still readable: `ANY` when
+     * the source gave no method, and `?` when it gave no path. Null when
+     * both are missing, since then there is nothing to show.
      */
     displayLabel(semantics) {
       if (semantics.method === null && semantics.path === null) {
@@ -797,11 +828,11 @@ var restSemantics = defineBoundarySemantics({
       return `${method} ${path}`;
     },
     /**
-     * A route with both halves stated decides for itself: the method
-     * through `methodsAgree` (so a `"*"` route matches every method),
-     * and the path through `routePathAdmits`. A route missing either
-     * half might still be the one that handles the request, and nothing
-     * here can settle that, so it abstains instead of refusing.
+     * With both halves present, the method goes through `methodsAgree`
+     * (so a `"*"` route matches every method) and the path through
+     * `routePathAdmits`. A route missing either half might still handle
+     * the request, and this declaration cannot settle that, so the
+     * result is `"unknown"`.
      */
     servesRequest(semantics, method, path) {
       if (semantics.method === null || semantics.path === null) {
@@ -814,8 +845,8 @@ var restSemantics = defineBoundarySemantics({
     },
     /**
      * A route the registration pattern admits is inside it. A route
-     * whose path this source never gave is left outside, because
-     * nothing here can show it is one the pattern covers.
+     * without a path counts as outside, because nothing shows that the
+     * pattern covers it.
      */
     withinScope(semantics, scope) {
       return semantics.path !== null && routePathAdmits(scope, semantics.path);
@@ -824,16 +855,12 @@ var restSemantics = defineBoundarySemantics({
      * A call whose base URL the deployment fills in, resolved to the
      * path it reaches.
      *
-     * The source cannot settle this on its own, which is why the
-     * adapter leaves the hole in. `API_BASE` could be
-     * `http://backend.internal`, and then the path is `/orders`. It
-     * could equally be `/api/v2`, and then the path is
-     * `/api/v2/orders`. Putting the deployed value in and reading the
-     * path back out gets the right one either way.
-     *
-     * Only a hole at the front is a base URL. A hole further along is a
-     * route parameter, and `/orders/{id}` means every id rather than a
-     * variable somebody set.
+     * The source cannot settle this on its own, so the adapter leaves
+     * the hole in. `API_BASE` could be `http://backend.internal`, and
+     * then the path is `/orders`. It could equally be `/api/v2`, and
+     * then the path is `/api/v2/orders`. Filling in the deployed value
+     * and reading the path back out gets the right one either way.
+     * `baseUrlReference` finds the hole that is the base URL.
      */
     groundName(semantics, deployment) {
       const reference = baseUrlReference(semantics);
@@ -850,7 +877,7 @@ var restSemantics = defineBoundarySemantics({
     },
     nameReference: baseUrlReference,
     ruleBoundary: {
-      // "METHOD /path": one leading token, then an absolute path.
+      // "METHOD /path": one token, a space, then an absolute path.
       claims(raw) {
         return /^\S+ +\//.test(raw.trim());
       },
@@ -865,12 +892,12 @@ var restSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/runtimeConfig.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/deployableUnit.ts
-import { z as z7 } from "zod";
-var DeployableUnitSchema = z7.object({
-  deploymentTarget: z7.enum([
+import { z as z8 } from "zod";
+var DeployableUnitSchema = z8.object({
+  deploymentTarget: z8.enum([
     "lambda",
     "ecs-task",
     "container",
@@ -879,7 +906,7 @@ var DeployableUnitSchema = z7.object({
   ]),
   // An empty name would agree with every other empty name, so a unit
   // with no name has to leave the field off instead.
-  instanceName: z7.string().min(1)
+  instanceName: z8.string().min(1)
 });
 function ecsContainerInstanceName(taskDefinitionLogicalId, containerName) {
   return `${taskDefinitionLogicalId}/${containerName}`;
@@ -890,14 +917,14 @@ var RuntimeConfigSemanticsSchema = DeployableUnitSchema.partial({
   deploymentTarget: true,
   instanceName: true
 }).extend({
-  name: z8.literal("runtime-config")
+  name: z9.literal("runtime-config")
 });
 var runtimeConfigSemantics = defineBoundarySemantics({
   name: "runtime-config",
   schema: RuntimeConfigSemanticsSchema,
-  // service.name and cloud.resource_id name the same deployable, but
-  // instanceName is the deployment template's logical id, which is
-  // neither of those strings.
+  // service.name and cloud.resource_id identify the same deployable, but
+  // instanceName is the template's logical id, a different string from
+  // both.
   semconv: {},
   behavior: {
     /** A process reads its config at startup, and nothing replies. */
@@ -906,46 +933,53 @@ var runtimeConfigSemantics = defineBoundarySemantics({
     // comes from outside the code.
     leavesTheProcess: true,
     reportsUnpairedItself: false,
-    identityKey: () => null
+    identityKey: () => null,
+    // A reader sees which deployable's environment this is. Code that
+    // reads a variable does not say which deployable runs it, so a read
+    // has no name.
+    displayLabel(semantics) {
+      const instance = semantics.instanceName;
+      return instance === void 0 ? null : `runtime-config:${instance}`;
+    }
   }
 });
 
 // src/semantics/storage.ts
-import { z as z9 } from "zod";
-var StorageSemanticsSchema = z9.object({
-  name: z9.literal("storage"),
+import { z as z10 } from "zod";
+var StorageSemanticsSchema = z10.object({
+  name: z10.literal("storage"),
   /**
-   * Which store this is: postgresql, mysql, aws.dynamodb, or our own
-   * word for one OpenTelemetry never named, such as s3, or null when
-   * the source states one this reader could not settle. Two products'
-   * containers can share a name, so this keeps them apart. A null
-   * keeps none of them apart, and the pairing pass says what it does
-   * with one.
+   * The storage system: an OpenTelemetry value such as `postgresql` or
+   * `aws.dynamodb`, or suss's own word for one the conventions do not
+   * cover, such as `s3`. Null when the reader could not work out which
+   * system the source uses. Two products' containers can share a name,
+   * and this field keeps them apart. The pairing pass decides how to
+   * treat a null.
    */
-  storageSystem: z9.string().nullable(),
+  storageSystem: z10.string().nullable(),
   /**
    * The ORM, schema, or deployment scope. A single-database setup uses
    * `"default"`, and a monorepo with several schemas gives each one its
    * own value.
    */
-  scope: z9.string(),
+  scope: z10.string(),
   /**
-   * The table, bucket, collection, or index, as the source declares
-   * it, or null when the source states one this reader could not
-   * settle. A null container pairs with nothing, rather than with
-   * whatever its source text happens to spell. The string is in the
-   * boundary-name syntax: a literal, a pattern with `{}` holes, or a
-   * reference, and `parseBoundaryName` is the one reader of it.
+   * The table, bucket, collection or index, as the source declares it.
+   * Null when the reader could not work out the container, and a null
+   * container pairs with nothing, so it cannot match by accident of
+   * shared source text. The string uses the boundary-name syntax (a
+   * literal, a pattern with `{}` holes, or a reference), and only
+   * `parseBoundaryName` should read it.
    */
-  container: z9.string().nullable(),
+  container: z10.string().nullable(),
   /**
-   * A secondary way into the container, a DynamoDB global secondary
-   * index or an Elasticsearch alias, each with its own key fields.
-   * Null means the container's own primary way in. A query through an
+   * A secondary way into the container, such as a DynamoDB global
+   * secondary index or an Elasticsearch alias, each with its own key
+   * fields. Null means the container's primary key. A query through an
    * index and a query through the table are different accesses, so
    * they pair separately.
    */
-  accessPath: z9.string().nullable()
+  accessPath: z10.string().nullable()
 });
 function containerReference(semantics) {
   return semantics.container === null ? null : referenceFromName(semantics.container);
@@ -955,21 +989,21 @@ var storageSemantics = defineBoundarySemantics({
   schema: StorageSemanticsSchema,
   semconv: {
     storageSystem: { name: "db.system.name" },
-    // "default" is our word for a source that named no database.
+    // suss writes "default" when the source did not say which database.
     scope: { name: "db.namespace", placeholderValues: ["default"] },
     container: { name: "db.collection.name" }
-    // A secondary index has no attribute of its own, so accessPath
-    // stays our word.
+    // The conventions have no attribute for a secondary index, so
+    // accessPath is left out.
   },
   behavior: {
-    /** A query returns rows or items, not a status and a body. */
+    /** A query returns rows or items, with no status. */
     exchangesHttpResponses: false,
     leavesTheProcess: true,
     reportsUnpairedItself: false,
     identityKey: () => null,
     displayLabel: storageLabel,
     /**
-     * A container the source states as a variable is whatever the
+     * A container the source gives as a variable is whatever the
      * deployment sets that variable to. `{SUBSCRIBERS_TABLE}` in the
      * code and `prod-subscribers-v1` in the manifest are one table.
      */
@@ -999,9 +1033,9 @@ function storageContainerLabel(semantics) {
 }
 
 // src/semantics/unitInvocation.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var UnitInvocationSemanticsSchema = DeployableUnitSchema.extend({
-  name: z10.literal("unit-invocation"),
+  name: z11.literal("unit-invocation"),
   instanceName: DeployableUnitSchema.shape.instanceName.nullable()
 });
 function calleeReference(semantics) {
@@ -1031,9 +1065,9 @@ var unitInvocationSemantics = defineBoundarySemantics({
      */
     reportsUnpairedItself: false,
     /**
-     * A callee the source states only as a variable is not a name for
-     * anything until the deployment fills it in, so it keys as nothing
-     * rather than as a bucket that would agree with itself alone.
+     * A callee the source gives only as a variable has no name until the
+     * deployment fills it in. It gets no key, since a key built from the
+     * variable would pair only with itself.
      */
     identityKey(semantics) {
       if (semantics.instanceName === null || namesNothing(semantics.instanceName)) {
@@ -1054,11 +1088,10 @@ var unitInvocationSemantics = defineBoundarySemantics({
       );
     },
     /**
-     * A call that reads its callee's name out of the environment
-     * reaches whichever resource the template wires that variable to.
-     * The logical id is the answer rather than the deployed name,
-     * because the invoked unit's own summary is keyed by the logical
-     * id and neither side ever writes the other's string.
+     * A call that reads its callee's name from the environment reaches
+     * whichever resource the template wires that variable to. The name
+     * is grounded to the logical id and not the deployed name, because
+     * the invoked unit's own summary is keyed by the logical id.
      */
     groundName(semantics, deployment) {
       const reference = calleeReference(semantics);
@@ -1073,7 +1106,7 @@ var unitInvocationSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/registry.ts
-var SemanticsSchema = z11.discriminatedUnion("name", [
+var SemanticsSchema = z12.discriminatedUnion("name", [
   restSemantics.schema,
   functionCallSemantics.schema,
   graphqlResolverSemantics.schema,
@@ -1082,7 +1115,8 @@ var SemanticsSchema = z11.discriminatedUnion("name", [
   storageSemantics.schema,
   messageBusSemantics.schema,
   metricSemantics.schema,
-  unitInvocationSemantics.schema
+  unitInvocationSemantics.schema,
+  ioSemantics.schema
 ]);
 var DEFINITIONS = [
   restSemantics,
@@ -1093,7 +1127,8 @@ var DEFINITIONS = [
   storageSemantics,
   messageBusSemantics,
   metricSemantics,
-  unitInvocationSemantics
+  unitInvocationSemantics,
+  ioSemantics
 ];
 var BY_NAME = new Map(
   DEFINITIONS.map((d) => [d.name, d])
@@ -1116,90 +1151,95 @@ function allBehaviors() {
 }
 
 // src/schemas.ts
-var ConfidenceSourceSchema = z12.enum([
+var ConfidenceSourceSchema = z13.enum([
   "inferred_static",
   "inferred_ai",
   "declared",
   "derived"
 ]);
-var ConfidenceLevelSchema = z12.enum(["high", "medium", "low"]);
-var CorroborationSchema = z12.object({
-  outcome: z12.enum(["observed", "refuted", "untested"]),
+var ConfidenceLevelSchema = z13.enum(["high", "medium", "low"]);
+var CorroborationSchema = z13.object({
+  outcome: z13.enum(["observed", "refuted", "untested"]),
   /** Executions that produced a verdict for this claim. */
-  runs: z12.number(),
+  runs: z13.number(),
   /** Present when refuted: the input and observation that disagreed. */
-  counterexample: z12.unknown().optional(),
+  counterexample: z13.unknown().optional(),
   /** Present when untested: why no verdict was reachable. */
-  reason: z12.string().optional()
+  reason: z13.string().optional()
 });
-var ConfidenceInfoSchema = z12.object({
+var ConfidenceInfoSchema = z13.object({
   source: ConfidenceSourceSchema,
   level: ConfidenceLevelSchema,
   corroboration: CorroborationSchema.optional()
 });
-var SourceLocationSchema = z12.object({
-  file: z12.string(),
+var SourceLocationSchema = z13.object({
+  file: z13.string(),
   /** Line numbers, for a person reading the summary or an editor link. */
-  range: z12.object({ start: z12.number(), end: z12.number() }),
+  range: z13.object({ start: z13.number(), end: z13.number() }),
   /**
-   * Character offsets of the unit in its file. Identity and joins
-   * measure with these, since two functions can share a line and never
-   * an offset range; the line `range` above is the presentation of the
-   * same place. Absent on summaries no source position backs, a
-   * contract artifact's say.
+   * Character offsets of the unit in its file. Identity and joins use
+   * these, because two functions can share a line but never an offset
+   * range. `range` gives the same place in lines. Absent on a summary
+   * with no source position, such as one read from a contract.
    */
-  span: z12.object({ start: z12.number(), end: z12.number() }).optional(),
-  exportName: z12.string().nullable(),
+  span: z13.object({ start: z13.number(), end: z13.number() }).optional(),
+  exportName: z13.string().nullable(),
   /**
-   * The project the extract was pointed at, by the name that project
-   * calls itself.
+   * The project the extract ran on, by the name the project gives
+   * itself.
    *
    * Paths are relative to wherever the extract ran, so two services in
-   * one repository both report `src/handlers.ts`, and merging their
-   * summaries puts them on top of each other. This field is what tells
-   * them apart, and what a reader groups by.
+   * one repository can both report `src/handlers.ts`, and merging their
+   * summaries would mix them up. This field tells them apart, and a
+   * reader groups by it.
+   */
+  workspace: z13.string().optional(),
+  /**
+   * The module of the application the unit belongs to, by the name the
+   * project's `suss.json` gives it. Set only when the project lists its
+   * modules, and then on every unit whose file is under a module's root.
    */
-  workspace: z12.string().optional()
+  module: z13.string().optional()
 });
-var BoundaryBindingSchema = z12.object({
-  transport: z12.string(),
+var BoundaryBindingSchema = z13.object({
+  transport: z13.string(),
   semantics: SemanticsSchema,
-  recognition: z12.string()
+  recognition: z13.string()
 });
 function typeDefinitionKey(ref) {
   return ref.def ?? null;
 }
-var TypeShapeSchema = z12.lazy(
-  () => z12.discriminatedUnion("type", [
-    z12.object({
-      type: z12.literal("record"),
-      properties: z12.record(z12.string(), TypeShapeSchema),
-      spreads: z12.array(z12.object({ sourceText: z12.string() })).optional()
+var TypeShapeSchema = z13.lazy(
+  () => z13.discriminatedUnion("type", [
+    z13.object({
+      type: z13.literal("record"),
+      properties: z13.record(z13.string(), TypeShapeSchema),
+      spreads: z13.array(z13.object({ sourceText: z13.string() })).optional()
     }),
-    z12.object({ type: z12.literal("dictionary"), values: TypeShapeSchema }),
-    z12.object({ type: z12.literal("array"), items: TypeShapeSchema }),
-    z12.object({
-      type: z12.literal("literal"),
-      value: z12.union([z12.string(), z12.number(), z12.boolean()]),
-      raw: z12.string().optional()
+    z13.object({ type: z13.literal("dictionary"), values: TypeShapeSchema }),
+    z13.object({ type: z13.literal("array"), items: TypeShapeSchema }),
+    z13.object({
+      type: z13.literal("literal"),
+      value: z13.union([z13.string(), z13.number(), z13.boolean()]),
+      raw: z13.string().optional()
     }),
-    z12.object({ type: z12.literal("text") }),
-    z12.object({ type: z12.literal("integer") }),
-    z12.object({ type: z12.literal("number") }),
-    z12.object({ type: z12.literal("boolean") }),
-    z12.object({ type: z12.literal("null") }),
-    z12.object({ type: z12.literal("undefined") }),
-    z12.object({
-      type: z12.literal("union"),
-      variants: z12.array(TypeShapeSchema)
+    z13.object({ type: z13.literal("text") }),
+    z13.object({ type: z13.literal("integer") }),
+    z13.object({ type: z13.literal("number") }),
+    z13.object({ type: z13.literal("boolean") }),
+    z13.object({ type: z13.literal("null") }),
+    z13.object({ type: z13.literal("undefined") }),
+    z13.object({
+      type: z13.literal("union"),
+      variants: z13.array(TypeShapeSchema)
     }),
-    z12.object({
-      type: z12.literal("ref"),
-      name: z12.string(),
-      from: z12.string().optional(),
-      def: z12.string().optional()
+    z13.object({
+      type: z13.literal("ref"),
+      name: z13.string(),
+      from: z13.string().optional(),
+      def: z13.string().optional()
     }),
-    z12.object({ type: z12.literal("unknown") })
+    z13.object({ type: z13.literal("unknown") })
   ])
 );
 var MAX_DEFINITION_DEPTH = 6;
@@ -1250,8 +1290,11 @@ export {
   busIdentityKey,
   unitIdentityKey,
   metricIdentityKey,
+  ioIdentityKey,
   FunctionCallSemanticsSchema,
+  isModuleName,
   GraphqlResolverSemanticsSchema,
+  IoSemanticsSchema,
   parseChannel,
   formatChannel,
   busesAgree,