@suss/ir-core 0.36.0 → 0.37.1

package/README.md

@@ -33,6 +33,10 @@ The two sides rarely know the same amount. A CloudFormation template gives both
 
 The boundary key uses only the subject, so both forms end up in the same bucket, and `channelsPair` compares the buses within it.
 
+A background job is a message too. For ActiveJob, Sidekiq and Celery the subject is the job class or the task name, and the bus part is the queue the job declares. A job with `queue_as :mailers` is `mailers#ReportExportJob`, and the enqueue `ReportExportJob.perform_later(id)` is `ReportExportJob`, so the two pair whichever queue the job runs on. A BullMQ worker takes every job on its queue, so for BullMQ the subject is the queue.
+
+A job queue's work can also come from a scheduler that reads job names out of a config file, such as Sidekiq's `sidekiq.yml` or Celery beat, from another service, or through code the run cannot follow. `MESSAGE_BUS_TRAITS` marks every job queue `jobQueue`, BullMQ included, and the message-bus check does not report a consumer on one of them as having no producer. A send on a job queue whose job a pack could not settle has no channel, and the summary gets an `unfollowedCall` gap with the reason `unsettledJob`, whichever language the send is in.
+
 ## Boundary names
 
 A container or an access path in a summary is a string that means one of three things, and the braces alone decide which:

package/dist/{chunk-7IOGU4OC.js → chunk-OROVMQY2.js}

@@ -248,7 +248,11 @@ var MessageBusSemanticsSchema = z5.object({
     "aws_kinesis",
     "aws_firehose",
     "gcp_pubsub",
+    // Job queues. The header says what their channel is.
     "bullmq",
+    "activejob",
+    "sidekiq",
+    "celery",
     "kafka",
     "nats",
     "cloudflare-queues",
@@ -264,6 +268,26 @@ var MessageBusSemanticsSchema = z5.object({
    */
   channel: z5.string().min(1).nullable()
 });
+var MESSAGES = { jobQueue: false };
+var JOBS = { jobQueue: true };
+var MESSAGE_BUS_TRAITS = {
+  aws_sqs: MESSAGES,
+  "aws.sns": MESSAGES,
+  s3: MESSAGES,
+  eventbridge: MESSAGES,
+  aws_kinesis: MESSAGES,
+  aws_firehose: MESSAGES,
+  gcp_pubsub: MESSAGES,
+  bullmq: JOBS,
+  activejob: JOBS,
+  sidekiq: JOBS,
+  celery: JOBS,
+  kafka: MESSAGES,
+  nats: MESSAGES,
+  "cloudflare-queues": MESSAGES,
+  "cloudflare-cron": MESSAGES,
+  "cloudflare-tail": MESSAGES
+};
 var messageBusSemantics = defineBoundarySemantics({
   name: "message-bus",
   schema: MessageBusSemanticsSchema,
@@ -280,6 +304,8 @@ var messageBusSemantics = defineBoundarySemantics({
      * the generic unmatched list leaves them out.
      */
     reportsUnpairedItself: true,
+    consumedAs: ["reads"],
+    unsettledJob: (semantics) => semantics.channel === null && MESSAGE_BUS_TRAITS[semantics.messageBus].jobQueue,
     /**
      * A channel that is null here can still pair. The dedicated pass
      * follows environment variable chains before comparing, so a
@@ -1198,6 +1224,7 @@ var runtimeConfigSemantics = defineBoundarySemantics({
     // comes from outside the code.
     leavesTheProcess: true,
     reportsUnpairedItself: false,
+    findingsAreReadsByName: true,
     identityKey: () => null,
     // A reader sees which deployable's environment this is. Code that
     // reads a variable does not say which deployable runs it, so a read
@@ -1543,23 +1570,25 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
       /* @__PURE__ */ new Set([...inProgress, key])
     );
   }
-  if (shape.type === "record") {
+  return withChildShapes(shape, deeper);
+}
+var CHILD_REBUILDS = {
+  record: (shape, each) => {
+    if (shape.type !== "record") {
+      return shape;
+    }
     const properties = {};
     for (const [name, value] of Object.entries(shape.properties)) {
-      properties[name] = deeper(value);
+      properties[name] = each(value);
     }
     return { ...shape, properties };
-  }
-  if (shape.type === "array") {
-    return { ...shape, items: deeper(shape.items) };
-  }
-  if (shape.type === "dictionary") {
-    return { ...shape, values: deeper(shape.values) };
-  }
-  if (shape.type === "union") {
-    return { ...shape, variants: shape.variants.map(deeper) };
-  }
-  return shape;
+  },
+  array: (shape, each) => shape.type === "array" ? { ...shape, items: each(shape.items) } : shape,
+  dictionary: (shape, each) => shape.type === "dictionary" ? { ...shape, values: each(shape.values) } : shape,
+  union: (shape, each) => shape.type === "union" ? { ...shape, variants: shape.variants.map(each) } : shape
+};
+function withChildShapes(shape, each) {
+  return CHILD_REBUILDS[shape.type]?.(shape, each) ?? shape;
 }
 
 export {
@@ -1579,6 +1608,7 @@ export {
   busesAgree,
   channelsPair,
   MessageBusSemanticsSchema,
+  MESSAGE_BUS_TRAITS,
   MetricSemanticsSchema,
   dispatchByType,
   parseBoundaryName,
@@ -1626,5 +1656,6 @@ export {
   BoundaryBindingSchema,
   typeDefinitionKey,
   TypeShapeSchema,
-  withDefinitionsInlined
+  withDefinitionsInlined,
+  withChildShapes
 };

package/dist/index.cjs

@@ -32,6 +32,7 @@ __export(index_exports, {
   GraphqlOperationSemanticsSchema: () => GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema: () => GraphqlResolverSemanticsSchema,
   IoSemanticsSchema: () => IoSemanticsSchema,
+  MESSAGE_BUS_TRAITS: () => MESSAGE_BUS_TRAITS,
   MessageBusSemanticsSchema: () => MessageBusSemanticsSchema,
   MetricSemanticsSchema: () => MetricSemanticsSchema,
   NOTHING_DEPLOYED: () => NOTHING_DEPLOYED,
@@ -61,12 +62,14 @@ __export(index_exports, {
   channelsPair: () => channelsPair,
   codeScopePath: () => codeScopePath,
   compareRanks: () => compareRanks,
+  consumedAs: () => consumedAs,
   countsForThreshold: () => countsForThreshold,
   dispatchByType: () => dispatchByType,
   displayLabel: () => displayLabel,
   ecsContainerInstanceName: () => ecsContainerInstanceName,
   exchangesHttpResponses: () => exchangesHttpResponses,
   fileInCodeScope: () => fileInCodeScope,
+  findingsAreReadsByName: () => findingsAreReadsByName,
   fixedTextLength: () => fixedTextLength,
   fnIdentityKey: () => fnIdentityKey,
   formatChannel: () => formatChannel,
@@ -82,6 +85,7 @@ __export(index_exports, {
   ioIdentityKey: () => ioIdentityKey,
   isGraphqlOperationBinding: () => isGraphqlOperationBinding,
   isModuleName: () => isModuleName,
+  isUnsettledJob: () => isUnsettledJob,
   labelWithDetail: () => labelWithDetail,
   leavesTheProcess: () => leavesTheProcess,
   messageBusBinding: () => messageBusBinding,
@@ -135,6 +139,7 @@ __export(index_exports, {
   unitIdentityKey: () => unitIdentityKey,
   unitInvocationBinding: () => unitInvocationBinding,
   validateRule: () => validateRule,
+  withChildShapes: () => withChildShapes,
   withDefinitionsInlined: () => withDefinitionsInlined,
   withRewrittenPaths: () => withRewrittenPaths,
   withinScope: () => withinScope,
@@ -392,7 +397,11 @@ var MessageBusSemanticsSchema = import_zod5.z.object({
     "aws_kinesis",
     "aws_firehose",
     "gcp_pubsub",
+    // Job queues. The header says what their channel is.
     "bullmq",
+    "activejob",
+    "sidekiq",
+    "celery",
     "kafka",
     "nats",
     "cloudflare-queues",
@@ -408,6 +417,26 @@ var MessageBusSemanticsSchema = import_zod5.z.object({
    */
   channel: import_zod5.z.string().min(1).nullable()
 });
+var MESSAGES = { jobQueue: false };
+var JOBS = { jobQueue: true };
+var MESSAGE_BUS_TRAITS = {
+  aws_sqs: MESSAGES,
+  "aws.sns": MESSAGES,
+  s3: MESSAGES,
+  eventbridge: MESSAGES,
+  aws_kinesis: MESSAGES,
+  aws_firehose: MESSAGES,
+  gcp_pubsub: MESSAGES,
+  bullmq: JOBS,
+  activejob: JOBS,
+  sidekiq: JOBS,
+  celery: JOBS,
+  kafka: MESSAGES,
+  nats: MESSAGES,
+  "cloudflare-queues": MESSAGES,
+  "cloudflare-cron": MESSAGES,
+  "cloudflare-tail": MESSAGES
+};
 var messageBusSemantics = defineBoundarySemantics({
   name: "message-bus",
   schema: MessageBusSemanticsSchema,
@@ -424,6 +453,8 @@ var messageBusSemantics = defineBoundarySemantics({
      * the generic unmatched list leaves them out.
      */
     reportsUnpairedItself: true,
+    consumedAs: ["reads"],
+    unsettledJob: (semantics) => semantics.channel === null && MESSAGE_BUS_TRAITS[semantics.messageBus].jobQueue,
     /**
      * A channel that is null here can still pair. The dedicated pass
      * follows environment variable chains before comparing, so a
@@ -1342,6 +1373,7 @@ var runtimeConfigSemantics = defineBoundarySemantics({
     // comes from outside the code.
     leavesTheProcess: true,
     reportsUnpairedItself: false,
+    findingsAreReadsByName: true,
     identityKey: () => null,
     // A reader sees which deployable's environment this is. Code that
     // reads a variable does not say which deployable runs it, so a read
@@ -1687,23 +1719,25 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
       /* @__PURE__ */ new Set([...inProgress, key])
     );
   }
-  if (shape.type === "record") {
+  return withChildShapes(shape, deeper);
+}
+var CHILD_REBUILDS = {
+  record: (shape, each) => {
+    if (shape.type !== "record") {
+      return shape;
+    }
     const properties = {};
     for (const [name, value] of Object.entries(shape.properties)) {
-      properties[name] = deeper(value);
+      properties[name] = each(value);
     }
     return { ...shape, properties };
-  }
-  if (shape.type === "array") {
-    return { ...shape, items: deeper(shape.items) };
-  }
-  if (shape.type === "dictionary") {
-    return { ...shape, values: deeper(shape.values) };
-  }
-  if (shape.type === "union") {
-    return { ...shape, variants: shape.variants.map(deeper) };
-  }
-  return shape;
+  },
+  array: (shape, each) => shape.type === "array" ? { ...shape, items: each(shape.items) } : shape,
+  dictionary: (shape, each) => shape.type === "dictionary" ? { ...shape, values: each(shape.values) } : shape,
+  union: (shape, each) => shape.type === "union" ? { ...shape, variants: shape.variants.map(each) } : shape
+};
+function withChildShapes(shape, each) {
+  return CHILD_REBUILDS[shape.type]?.(shape, each) ?? shape;
 }
 
 // src/semconv.ts
@@ -1817,6 +1851,15 @@ function exchangesHttpResponses(binding) {
 function leavesTheProcess(binding) {
   return behaviorOf(binding.semantics).leavesTheProcess;
 }
+function findingsAreReadsByName(binding) {
+  return behaviorOf(binding.semantics).findingsAreReadsByName === true;
+}
+function consumedAs(binding) {
+  return behaviorOf(binding.semantics).consumedAs ?? ["reads", "writes"];
+}
+function isUnsettledJob(binding) {
+  return behaviorOf(binding.semantics).unsettledJob?.(binding.semantics) ?? false;
+}
 function canPair(binding) {
   const behavior = behaviorOf(binding.semantics);
   if (behavior.canPair !== void 0) {
@@ -2029,6 +2072,13 @@ var SuppressionRuleSchema = import_zod15.z.object({
    * only intent findings about a scenario with that title.
    */
   scenario: import_zod15.z.string().optional(),
+  /**
+   * The deployments, by name, that a finding about one environment read
+   * is accepted for. The rule takes them off the finding's list, and
+   * the finding stays while any deployment it lists is left. Without
+   * this, a rule covers every deployment.
+   */
+  deployments: import_zod15.z.array(import_zod15.z.string().min(1)).min(1).optional(),
   /**
    * "narrow", the default, requires `kind` plus one of `boundary`,
    * `scenario`, `consumer.transitionId` or `provider.transitionId`, so
@@ -2418,6 +2468,7 @@ function ioBinding(opts) {
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   IoSemanticsSchema,
+  MESSAGE_BUS_TRAITS,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
   NOTHING_DEPLOYED,
@@ -2447,12 +2498,14 @@ function ioBinding(opts) {
   channelsPair,
   codeScopePath,
   compareRanks,
+  consumedAs,
   countsForThreshold,
   dispatchByType,
   displayLabel,
   ecsContainerInstanceName,
   exchangesHttpResponses,
   fileInCodeScope,
+  findingsAreReadsByName,
   fixedTextLength,
   fnIdentityKey,
   formatChannel,
@@ -2468,6 +2521,7 @@ function ioBinding(opts) {
   ioIdentityKey,
   isGraphqlOperationBinding,
   isModuleName,
+  isUnsettledJob,
   labelWithDetail,
   leavesTheProcess,
   messageBusBinding,
@@ -2521,6 +2575,7 @@ function ioBinding(opts) {
   unitIdentityKey,
   unitInvocationBinding,
   validateRule,
+  withChildShapes,
   withDefinitionsInlined,
   withRewrittenPaths,
   withinScope,

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D-cxOSiQ.cjs';
-export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as isModuleName, u as methodsAgree, v as normalizePath, w as pathShape, x as routePathAdmits, y as routePathsMeet, z as storageContainerLabel, A as storageLabel, H as storageSystemLabel, I as typeDefinitionKey, J as withDefinitionsInlined } from './schemas-D-cxOSiQ.cjs';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-CL8yCMd0.cjs';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MESSAGE_BUS_TRAITS, l as MessageBusSemanticsSchema, R as RestSemantics, m as RestSemanticsSchema, n as RuntimeConfigSemantics, o as RuntimeConfigSemanticsSchema, p as SemanticsSchema, q as StorageSemantics, r as StorageSemanticsSchema, s as TypeShapeSchema, t as ecsContainerInstanceName, u as isModuleName, v as methodsAgree, w as normalizePath, x as pathShape, y as routePathAdmits, z as routePathsMeet, A as storageContainerLabel, H as storageLabel, I as storageSystemLabel, J as typeDefinitionKey, K as withChildShapes, L as withDefinitionsInlined } from './schemas-CL8yCMd0.cjs';
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -141,6 +141,38 @@ interface Deployment {
 /** A deployment that settles nothing, for a run with no template in it. */
 declare const NOTHING_DEPLOYED: Deployment;
 
+/**
+ * What a unit does at a boundary, in the words `suss ask` uses.
+ *
+ * A user asks `what writes postgresql:invoices`, and an intent doc
+ * asserts "this outcome writes postgresql:invoices". The report, the
+ * question parser and the intent reader all have to spell the verbs the
+ * same way, so the verbs are defined here once.
+ *
+ * `provides` is a boundary the unit serves. `reads`, `writes` and
+ * `invokes` are what a call site does at a boundary somebody else
+ * serves. Calling a deployed unit by name is its own act, so it gets
+ * its own verb.
+ */
+
+declare const RelationSchema: z.ZodEnum<{
+    provides: "provides";
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type Relation = z.infer<typeof RelationSchema>;
+/**
+ * The verbs an effect can have. A boundary a unit serves is not an
+ * effect of the unit, so `provides` is not one of them.
+ */
+declare const EffectRelationSchema: z.ZodEnum<{
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type EffectRelation = z.infer<typeof EffectRelationSchema>;
+
 /**
  * Structural comparison of two TypeShapes.
  *
@@ -340,6 +372,25 @@ interface BoundaryBehavior<S extends {
      * paired with nothing, so the generic unmatched list can leave it out.
      */
     reportsUnpairedItself: boolean;
+    /**
+     * Whether a finding with the reader on both sides is about one read,
+     * with the name read as its field, as an environment variable is. A
+     * rule accepts such a finding by the boundary and that name, so it
+     * keeps matching when the reader moves to another file.
+     */
+    findingsAreReadsByName?: boolean;
+    /**
+     * What a consumer bound to this boundary does there. A client of a
+     * route sends a request and reads the response, which is the default.
+     * A consumer of a channel only receives, so it reads.
+     */
+    consumedAs?: readonly Relation[];
+    /**
+     * Whether a send on this boundary enqueues a background job its pack
+     * could not settle, so the summary says what the job does is missing.
+     * A protocol that never sends a job leaves this undefined.
+     */
+    unsettledJob?(semantics: S): boolean;
     /**
      * Whether a boundary with these semantics can pair with anything.
      * Defaults to a non-null pairing key. A protocol whose dedicated
@@ -638,6 +689,12 @@ declare function normalizeRuleBoundary(raw: string): string;
 declare function exchangesHttpResponses(binding: BoundaryBinding): boolean;
 /** Whether crossing this boundary leaves the process. */
 declare function leavesTheProcess(binding: BoundaryBinding): boolean;
+/** Whether a finding at this binding with the reader on both sides is about one read of the name in its field. */
+declare function findingsAreReadsByName(binding: BoundaryBinding): boolean;
+/** What a consumer bound to this binding does there, reading and writing unless its protocol says otherwise. */
+declare function consumedAs(binding: BoundaryBinding): readonly Relation[];
+/** Whether a send on this binding enqueues a background job nothing settled. */
+declare function isUnsettledJob(binding: BoundaryBinding): boolean;
 /**
  * Whether anything can pair with this binding: it has a pairing key,
  * or its protocol pairs keyless boundaries in a dedicated pass.
@@ -834,38 +891,6 @@ declare function dispatchByType<T extends {
  */
 declare const PLATFORM_INJECTED_ENV_VARS: Record<DeployableUnit["deploymentTarget"], ReadonlyArray<string>>;
 
-/**
- * What a unit does at a boundary, in the words `suss ask` uses.
- *
- * A user asks `what writes postgresql:invoices`, and an intent doc
- * asserts "this outcome writes postgresql:invoices". The report, the
- * question parser and the intent reader all have to spell the verbs the
- * same way, so the verbs are defined here once.
- *
- * `provides` is a boundary the unit serves. `reads`, `writes` and
- * `invokes` are what a call site does at a boundary somebody else
- * serves. Calling a deployed unit by name is its own act, so it gets
- * its own verb.
- */
-
-declare const RelationSchema: z.ZodEnum<{
-    provides: "provides";
-    reads: "reads";
-    writes: "writes";
-    invokes: "invokes";
-}>;
-type Relation = z.infer<typeof RelationSchema>;
-/**
- * The verbs an effect can have. A boundary a unit serves is not an
- * effect of the unit, so `provides` is not one of them.
- */
-declare const EffectRelationSchema: z.ZodEnum<{
-    reads: "reads";
-    writes: "writes";
-    invokes: "invokes";
-}>;
-type EffectRelation = z.infer<typeof EffectRelationSchema>;
-
 /**
  * Whether two route paths describe a request in common.
  *
@@ -922,6 +947,7 @@ declare const SuppressionRuleSchema: z.ZodObject<{
         field: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     scenario: z.ZodOptional<z.ZodString>;
+    deployments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     scope: z.ZodDefault<z.ZodEnum<{
         narrow: "narrow";
         broad: "broad";
@@ -950,6 +976,7 @@ declare const SuppressionFileSchema: z.ZodObject<{
             field: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         scenario: z.ZodOptional<z.ZodString>;
+        deployments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         scope: z.ZodDefault<z.ZodEnum<{
             narrow: "narrow";
             broad: "broad";
@@ -1232,4 +1259,4 @@ declare function ioBinding(opts: {
     target: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type IoIdentityKey, type IoSemantics, IoSemanticsSchema, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TEST_TITLE_SEPARATOR, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, hostCanBeOwn, ioBinding, ioIdentityKey, isGraphqlOperationBinding, labelWithDetail, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, moduleExportBinding, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, operationKey, packageExportBinding, pairRank, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, testUnitName, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope, withoutOwnHost };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type IoIdentityKey, type IoSemantics, IoSemanticsSchema, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TEST_TITLE_SEPARATOR, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, consumedAs, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, findingsAreReadsByName, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, hostCanBeOwn, ioBinding, ioIdentityKey, isGraphqlOperationBinding, isUnsettledJob, labelWithDetail, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, moduleExportBinding, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, operationKey, packageExportBinding, pairRank, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, testUnitName, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope, withoutOwnHost };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D-cxOSiQ.js';
-export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as isModuleName, u as methodsAgree, v as normalizePath, w as pathShape, x as routePathAdmits, y as routePathsMeet, z as storageContainerLabel, A as storageLabel, H as storageSystemLabel, I as typeDefinitionKey, J as withDefinitionsInlined } from './schemas-D-cxOSiQ.js';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-CL8yCMd0.js';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MESSAGE_BUS_TRAITS, l as MessageBusSemanticsSchema, R as RestSemantics, m as RestSemanticsSchema, n as RuntimeConfigSemantics, o as RuntimeConfigSemanticsSchema, p as SemanticsSchema, q as StorageSemantics, r as StorageSemanticsSchema, s as TypeShapeSchema, t as ecsContainerInstanceName, u as isModuleName, v as methodsAgree, w as normalizePath, x as pathShape, y as routePathAdmits, z as routePathsMeet, A as storageContainerLabel, H as storageLabel, I as storageSystemLabel, J as typeDefinitionKey, K as withChildShapes, L as withDefinitionsInlined } from './schemas-CL8yCMd0.js';
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -141,6 +141,38 @@ interface Deployment {
 /** A deployment that settles nothing, for a run with no template in it. */
 declare const NOTHING_DEPLOYED: Deployment;
 
+/**
+ * What a unit does at a boundary, in the words `suss ask` uses.
+ *
+ * A user asks `what writes postgresql:invoices`, and an intent doc
+ * asserts "this outcome writes postgresql:invoices". The report, the
+ * question parser and the intent reader all have to spell the verbs the
+ * same way, so the verbs are defined here once.
+ *
+ * `provides` is a boundary the unit serves. `reads`, `writes` and
+ * `invokes` are what a call site does at a boundary somebody else
+ * serves. Calling a deployed unit by name is its own act, so it gets
+ * its own verb.
+ */
+
+declare const RelationSchema: z.ZodEnum<{
+    provides: "provides";
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type Relation = z.infer<typeof RelationSchema>;
+/**
+ * The verbs an effect can have. A boundary a unit serves is not an
+ * effect of the unit, so `provides` is not one of them.
+ */
+declare const EffectRelationSchema: z.ZodEnum<{
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type EffectRelation = z.infer<typeof EffectRelationSchema>;
+
 /**
  * Structural comparison of two TypeShapes.
  *
@@ -340,6 +372,25 @@ interface BoundaryBehavior<S extends {
      * paired with nothing, so the generic unmatched list can leave it out.
      */
     reportsUnpairedItself: boolean;
+    /**
+     * Whether a finding with the reader on both sides is about one read,
+     * with the name read as its field, as an environment variable is. A
+     * rule accepts such a finding by the boundary and that name, so it
+     * keeps matching when the reader moves to another file.
+     */
+    findingsAreReadsByName?: boolean;
+    /**
+     * What a consumer bound to this boundary does there. A client of a
+     * route sends a request and reads the response, which is the default.
+     * A consumer of a channel only receives, so it reads.
+     */
+    consumedAs?: readonly Relation[];
+    /**
+     * Whether a send on this boundary enqueues a background job its pack
+     * could not settle, so the summary says what the job does is missing.
+     * A protocol that never sends a job leaves this undefined.
+     */
+    unsettledJob?(semantics: S): boolean;
     /**
      * Whether a boundary with these semantics can pair with anything.
      * Defaults to a non-null pairing key. A protocol whose dedicated
@@ -638,6 +689,12 @@ declare function normalizeRuleBoundary(raw: string): string;
 declare function exchangesHttpResponses(binding: BoundaryBinding): boolean;
 /** Whether crossing this boundary leaves the process. */
 declare function leavesTheProcess(binding: BoundaryBinding): boolean;
+/** Whether a finding at this binding with the reader on both sides is about one read of the name in its field. */
+declare function findingsAreReadsByName(binding: BoundaryBinding): boolean;
+/** What a consumer bound to this binding does there, reading and writing unless its protocol says otherwise. */
+declare function consumedAs(binding: BoundaryBinding): readonly Relation[];
+/** Whether a send on this binding enqueues a background job nothing settled. */
+declare function isUnsettledJob(binding: BoundaryBinding): boolean;
 /**
  * Whether anything can pair with this binding: it has a pairing key,
  * or its protocol pairs keyless boundaries in a dedicated pass.
@@ -834,38 +891,6 @@ declare function dispatchByType<T extends {
  */
 declare const PLATFORM_INJECTED_ENV_VARS: Record<DeployableUnit["deploymentTarget"], ReadonlyArray<string>>;
 
-/**
- * What a unit does at a boundary, in the words `suss ask` uses.
- *
- * A user asks `what writes postgresql:invoices`, and an intent doc
- * asserts "this outcome writes postgresql:invoices". The report, the
- * question parser and the intent reader all have to spell the verbs the
- * same way, so the verbs are defined here once.
- *
- * `provides` is a boundary the unit serves. `reads`, `writes` and
- * `invokes` are what a call site does at a boundary somebody else
- * serves. Calling a deployed unit by name is its own act, so it gets
- * its own verb.
- */
-
-declare const RelationSchema: z.ZodEnum<{
-    provides: "provides";
-    reads: "reads";
-    writes: "writes";
-    invokes: "invokes";
-}>;
-type Relation = z.infer<typeof RelationSchema>;
-/**
- * The verbs an effect can have. A boundary a unit serves is not an
- * effect of the unit, so `provides` is not one of them.
- */
-declare const EffectRelationSchema: z.ZodEnum<{
-    reads: "reads";
-    writes: "writes";
-    invokes: "invokes";
-}>;
-type EffectRelation = z.infer<typeof EffectRelationSchema>;
-
 /**
  * Whether two route paths describe a request in common.
  *
@@ -922,6 +947,7 @@ declare const SuppressionRuleSchema: z.ZodObject<{
         field: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     scenario: z.ZodOptional<z.ZodString>;
+    deployments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     scope: z.ZodDefault<z.ZodEnum<{
         narrow: "narrow";
         broad: "broad";
@@ -950,6 +976,7 @@ declare const SuppressionFileSchema: z.ZodObject<{
             field: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         scenario: z.ZodOptional<z.ZodString>;
+        deployments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         scope: z.ZodDefault<z.ZodEnum<{
             narrow: "narrow";
             broad: "broad";
@@ -1232,4 +1259,4 @@ declare function ioBinding(opts: {
     target: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type IoIdentityKey, type IoSemantics, IoSemanticsSchema, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TEST_TITLE_SEPARATOR, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, hostCanBeOwn, ioBinding, ioIdentityKey, isGraphqlOperationBinding, labelWithDetail, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, moduleExportBinding, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, operationKey, packageExportBinding, pairRank, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, testUnitName, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope, withoutOwnHost };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type Ecosystem, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type HoleRange, type IoIdentityKey, type IoSemantics, IoSemanticsSchema, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, PLATFORM_INJECTED_ENV_VARS, type PackConfiguration, type PackDeclaration, type ParsedChannel, type ParsedHandler, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TEST_TITLE_SEPARATOR, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, bucketsMeet, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, compareRanks, consumedAs, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, findingsAreReadsByName, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, hostCanBeOwn, ioBinding, ioIdentityKey, isGraphqlOperationBinding, isUnsettledJob, labelWithDetail, leavesTheProcess, messageBusBinding, metricBinding, metricIdentityKey, moduleExportBinding, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, operationKey, packageExportBinding, pairRank, pairingKey, parseBoundaryName, parseChannel, parseHandler, pathAfterOrigin, patternHole, rangedHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, setPiece, spansBuckets, spellingTokens, statesAnOrigin, storageBinding, testUnitName, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope, withoutOwnHost };

package/dist/index.js

@@ -10,6 +10,7 @@ import {
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   IoSemanticsSchema,
+  MESSAGE_BUS_TRAITS,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
   RestSemanticsSchema,
@@ -62,8 +63,9 @@ import {
   storageSystemLabel,
   typeDefinitionKey,
   unitIdentityKey,
+  withChildShapes,
   withDefinitionsInlined
-} from "./chunk-7IOGU4OC.js";
+} from "./chunk-OROVMQY2.js";
 
 // src/semconv.ts
 function semconvAttributes(binding) {
@@ -176,6 +178,15 @@ function exchangesHttpResponses(binding) {
 function leavesTheProcess(binding) {
   return behaviorOf(binding.semantics).leavesTheProcess;
 }
+function findingsAreReadsByName(binding) {
+  return behaviorOf(binding.semantics).findingsAreReadsByName === true;
+}
+function consumedAs(binding) {
+  return behaviorOf(binding.semantics).consumedAs ?? ["reads", "writes"];
+}
+function isUnsettledJob(binding) {
+  return behaviorOf(binding.semantics).unsettledJob?.(binding.semantics) ?? false;
+}
 function canPair(binding) {
   const behavior = behaviorOf(binding.semantics);
   if (behavior.canPair !== void 0) {
@@ -388,6 +399,13 @@ var SuppressionRuleSchema = z2.object({
    * only intent findings about a scenario with that title.
    */
   scenario: z2.string().optional(),
+  /**
+   * The deployments, by name, that a finding about one environment read
+   * is accepted for. The rule takes them off the finding's list, and
+   * the finding stays while any deployment it lists is left. Without
+   * this, a rule covers every deployment.
+   */
+  deployments: z2.array(z2.string().min(1)).min(1).optional(),
   /**
    * "narrow", the default, requires `kind` plus one of `boundary`,
    * `scenario`, `consumer.transitionId` or `provider.transitionId`, so
@@ -776,6 +794,7 @@ export {
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   IoSemanticsSchema,
+  MESSAGE_BUS_TRAITS,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
   NOTHING_DEPLOYED,
@@ -805,12 +824,14 @@ export {
   channelsPair,
   codeScopePath,
   compareRanks,
+  consumedAs,
   countsForThreshold,
   dispatchByType,
   displayLabel,
   ecsContainerInstanceName,
   exchangesHttpResponses,
   fileInCodeScope,
+  findingsAreReadsByName,
   fixedTextLength,
   fnIdentityKey,
   formatChannel,
@@ -826,6 +847,7 @@ export {
   ioIdentityKey,
   isGraphqlOperationBinding,
   isModuleName,
+  isUnsettledJob,
   labelWithDetail,
   leavesTheProcess,
   messageBusBinding,
@@ -879,6 +901,7 @@ export {
   unitIdentityKey,
   unitInvocationBinding,
   validateRule,
+  withChildShapes,
   withDefinitionsInlined,
   withRewrittenPaths,
   withinScope,

package/dist/{schemas-D-cxOSiQ.d.cts → schemas-CL8yCMd0.d.cts}

@@ -76,6 +76,9 @@ declare const MessageBusSemanticsSchema: z.ZodObject<{
         aws_firehose: "aws_firehose";
         gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
+        activejob: "activejob";
+        sidekiq: "sidekiq";
+        celery: "celery";
         kafka: "kafka";
         nats: "nats";
         "cloudflare-queues": "cloudflare-queues";
@@ -90,6 +93,17 @@ type MessageBusSemantics = z.infer<typeof MessageBusSemanticsSchema>;
  * so there is no hand-written copy to fall out of step.
  */
 type MessageBusTechnology = MessageBusSemantics["messageBus"];
+/** What a bus is like, where the checks treat one bus differently from another. */
+interface MessageBusTraits {
+    /**
+     * The bus is a background job queue. A send whose job is unsettled
+     * leaves a gap, and a job no code enqueues is never an orphan: a
+     * scheduler config, another service, or code the run cannot follow
+     * may enqueue it.
+     */
+    jobQueue: boolean;
+}
+declare const MESSAGE_BUS_TRAITS: Record<MessageBusTechnology, MessageBusTraits>;
 
 /**
  * The list of protocol definitions, and the lookups built from it.
@@ -157,6 +171,9 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         aws_firehose: "aws_firehose";
         gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
+        activejob: "activejob";
+        sidekiq: "sidekiq";
+        celery: "celery";
         kafka: "kafka";
         nats: "nats";
         "cloudflare-queues": "cloudflare-queues";
@@ -426,6 +443,9 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             aws_firehose: "aws_firehose";
             gcp_pubsub: "gcp_pubsub";
             bullmq: "bullmq";
+            activejob: "activejob";
+            sidekiq: "sidekiq";
+            celery: "celery";
             kafka: "kafka";
             nats: "nats";
             "cloudflare-queues": "cloudflare-queues";
@@ -535,5 +555,7 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  * on this path, the same cycle guard the shape walk uses.
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
+/** The shape with `each` applied to every shape written directly inside it. One with nothing inside, such as a ref, comes back as it is. */
+declare function withChildShapes(shape: TypeShape, each: (inner: TypeShape) => TypeShape): TypeShape;
 
-export { storageLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, storageSystemLabel as H, typeDefinitionKey as I, withDefinitionsInlined as J, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, isModuleName as t, methodsAgree as u, normalizePath as v, pathShape as w, routePathAdmits as x, routePathsMeet as y, storageContainerLabel as z };
+export { storageContainerLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, storageLabel as H, storageSystemLabel as I, typeDefinitionKey as J, withChildShapes as K, withDefinitionsInlined as L, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MESSAGE_BUS_TRAITS as k, MessageBusSemanticsSchema as l, RestSemanticsSchema as m, type RuntimeConfigSemantics as n, RuntimeConfigSemanticsSchema as o, SemanticsSchema as p, type StorageSemantics as q, StorageSemanticsSchema as r, TypeShapeSchema as s, ecsContainerInstanceName as t, isModuleName as u, methodsAgree as v, normalizePath as w, pathShape as x, routePathAdmits as y, routePathsMeet as z };

package/dist/{schemas-D-cxOSiQ.d.ts → schemas-CL8yCMd0.d.ts}

@@ -76,6 +76,9 @@ declare const MessageBusSemanticsSchema: z.ZodObject<{
         aws_firehose: "aws_firehose";
         gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
+        activejob: "activejob";
+        sidekiq: "sidekiq";
+        celery: "celery";
         kafka: "kafka";
         nats: "nats";
         "cloudflare-queues": "cloudflare-queues";
@@ -90,6 +93,17 @@ type MessageBusSemantics = z.infer<typeof MessageBusSemanticsSchema>;
  * so there is no hand-written copy to fall out of step.
  */
 type MessageBusTechnology = MessageBusSemantics["messageBus"];
+/** What a bus is like, where the checks treat one bus differently from another. */
+interface MessageBusTraits {
+    /**
+     * The bus is a background job queue. A send whose job is unsettled
+     * leaves a gap, and a job no code enqueues is never an orphan: a
+     * scheduler config, another service, or code the run cannot follow
+     * may enqueue it.
+     */
+    jobQueue: boolean;
+}
+declare const MESSAGE_BUS_TRAITS: Record<MessageBusTechnology, MessageBusTraits>;
 
 /**
  * The list of protocol definitions, and the lookups built from it.
@@ -157,6 +171,9 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         aws_firehose: "aws_firehose";
         gcp_pubsub: "gcp_pubsub";
         bullmq: "bullmq";
+        activejob: "activejob";
+        sidekiq: "sidekiq";
+        celery: "celery";
         kafka: "kafka";
         nats: "nats";
         "cloudflare-queues": "cloudflare-queues";
@@ -426,6 +443,9 @@ declare const BoundaryBindingSchema: z.ZodObject<{
             aws_firehose: "aws_firehose";
             gcp_pubsub: "gcp_pubsub";
             bullmq: "bullmq";
+            activejob: "activejob";
+            sidekiq: "sidekiq";
+            celery: "celery";
             kafka: "kafka";
             nats: "nats";
             "cloudflare-queues": "cloudflare-queues";
@@ -535,5 +555,7 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  * on this path, the same cycle guard the shape walk uses.
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
+/** The shape with `each` applied to every shape written directly inside it. One with nothing inside, such as a ref, comes back as it is. */
+declare function withChildShapes(shape: TypeShape, each: (inner: TypeShape) => TypeShape): TypeShape;
 
-export { storageLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, storageSystemLabel as H, typeDefinitionKey as I, withDefinitionsInlined as J, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, isModuleName as t, methodsAgree as u, normalizePath as v, pathShape as w, routePathAdmits as x, routePathsMeet as y, storageContainerLabel as z };
+export { storageContainerLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, storageLabel as H, storageSystemLabel as I, typeDefinitionKey as J, withChildShapes as K, withDefinitionsInlined as L, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MESSAGE_BUS_TRAITS as k, MessageBusSemanticsSchema as l, RestSemanticsSchema as m, type RuntimeConfigSemantics as n, RuntimeConfigSemanticsSchema as o, SemanticsSchema as p, type StorageSemantics as q, StorageSemanticsSchema as r, TypeShapeSchema as s, ecsContainerInstanceName as t, isModuleName as u, methodsAgree as v, normalizePath as w, pathShape as x, routePathAdmits as y, routePathsMeet as z };

package/dist/schemas.cjs

@@ -37,6 +37,7 @@ __export(schemas_exports, {
   StorageSemanticsSchema: () => StorageSemanticsSchema,
   TypeShapeSchema: () => TypeShapeSchema,
   typeDefinitionKey: () => typeDefinitionKey,
+  withChildShapes: () => withChildShapes,
   withDefinitionsInlined: () => withDefinitionsInlined
 });
 module.exports = __toCommonJS(schemas_exports);
@@ -283,7 +284,11 @@ var MessageBusSemanticsSchema = import_zod5.z.object({
     "aws_kinesis",
     "aws_firehose",
     "gcp_pubsub",
+    // Job queues. The header says what their channel is.
     "bullmq",
+    "activejob",
+    "sidekiq",
+    "celery",
     "kafka",
     "nats",
     "cloudflare-queues",
@@ -299,6 +304,26 @@ var MessageBusSemanticsSchema = import_zod5.z.object({
    */
   channel: import_zod5.z.string().min(1).nullable()
 });
+var MESSAGES = { jobQueue: false };
+var JOBS = { jobQueue: true };
+var MESSAGE_BUS_TRAITS = {
+  aws_sqs: MESSAGES,
+  "aws.sns": MESSAGES,
+  s3: MESSAGES,
+  eventbridge: MESSAGES,
+  aws_kinesis: MESSAGES,
+  aws_firehose: MESSAGES,
+  gcp_pubsub: MESSAGES,
+  bullmq: JOBS,
+  activejob: JOBS,
+  sidekiq: JOBS,
+  celery: JOBS,
+  kafka: MESSAGES,
+  nats: MESSAGES,
+  "cloudflare-queues": MESSAGES,
+  "cloudflare-cron": MESSAGES,
+  "cloudflare-tail": MESSAGES
+};
 var messageBusSemantics = defineBoundarySemantics({
   name: "message-bus",
   schema: MessageBusSemanticsSchema,
@@ -315,6 +340,8 @@ var messageBusSemantics = defineBoundarySemantics({
      * the generic unmatched list leaves them out.
      */
     reportsUnpairedItself: true,
+    consumedAs: ["reads"],
+    unsettledJob: (semantics) => semantics.channel === null && MESSAGE_BUS_TRAITS[semantics.messageBus].jobQueue,
     /**
      * A channel that is null here can still pair. The dedicated pass
      * follows environment variable chains before comparing, so a
@@ -1111,6 +1138,7 @@ var runtimeConfigSemantics = defineBoundarySemantics({
     // comes from outside the code.
     leavesTheProcess: true,
     reportsUnpairedItself: false,
+    findingsAreReadsByName: true,
     identityKey: () => null,
     // A reader sees which deployable's environment this is. Code that
     // reads a variable does not say which deployable runs it, so a read
@@ -1439,23 +1467,25 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
       /* @__PURE__ */ new Set([...inProgress, key])
     );
   }
-  if (shape.type === "record") {
+  return withChildShapes(shape, deeper);
+}
+var CHILD_REBUILDS = {
+  record: (shape, each) => {
+    if (shape.type !== "record") {
+      return shape;
+    }
     const properties = {};
     for (const [name, value] of Object.entries(shape.properties)) {
-      properties[name] = deeper(value);
+      properties[name] = each(value);
     }
     return { ...shape, properties };
-  }
-  if (shape.type === "array") {
-    return { ...shape, items: deeper(shape.items) };
-  }
-  if (shape.type === "dictionary") {
-    return { ...shape, values: deeper(shape.values) };
-  }
-  if (shape.type === "union") {
-    return { ...shape, variants: shape.variants.map(deeper) };
-  }
-  return shape;
+  },
+  array: (shape, each) => shape.type === "array" ? { ...shape, items: each(shape.items) } : shape,
+  dictionary: (shape, each) => shape.type === "dictionary" ? { ...shape, values: each(shape.values) } : shape,
+  union: (shape, each) => shape.type === "union" ? { ...shape, variants: shape.variants.map(each) } : shape
+};
+function withChildShapes(shape, each) {
+  return CHILD_REBUILDS[shape.type]?.(shape, each) ?? shape;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1476,5 +1506,6 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
   StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
+  withChildShapes,
   withDefinitionsInlined
 });

package/dist/schemas.d.cts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, I as typeDefinitionKey, J as withDefinitionsInlined } from './schemas-D-cxOSiQ.cjs';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, l as MessageBusSemanticsSchema, m as RestSemanticsSchema, o as RuntimeConfigSemanticsSchema, p as SemanticsSchema, d as SourceLocationSchema, r as StorageSemanticsSchema, T as TypeShape, s as TypeShapeSchema, J as typeDefinitionKey, K as withChildShapes, L as withDefinitionsInlined } from './schemas-CL8yCMd0.cjs';

package/dist/schemas.d.ts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, I as typeDefinitionKey, J as withDefinitionsInlined } from './schemas-D-cxOSiQ.js';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, l as MessageBusSemanticsSchema, m as RestSemanticsSchema, o as RuntimeConfigSemanticsSchema, p as SemanticsSchema, d as SourceLocationSchema, r as StorageSemanticsSchema, T as TypeShape, s as TypeShapeSchema, J as typeDefinitionKey, K as withChildShapes, L as withDefinitionsInlined } from './schemas-CL8yCMd0.js';

package/dist/schemas.js

@@ -16,8 +16,9 @@ import {
   StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
+  withChildShapes,
   withDefinitionsInlined
-} from "./chunk-7IOGU4OC.js";
+} from "./chunk-OROVMQY2.js";
 export {
   BoundaryBindingSchema,
   ConfidenceInfoSchema,
@@ -36,5 +37,6 @@ export {
   StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
+  withChildShapes,
   withDefinitionsInlined
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/ir-core",
-  "version": "0.36.0",
+  "version": "0.37.1",
   "type": "module",
   "description": "The type primitives every suss summary is built from: type shapes, boundary bindings, source locations and confidence.",
   "keywords": [