candor-ts 0.5.8 → 0.5.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/scan-core.mjs

@@ -49,6 +49,13 @@ export const KAPPA_RULES = [
   [/^(node:)?dns(\/promises)?$/,
    /^(?!(new|getServers|setServers|getDefaultResultOrder|setDefaultResultOrder)$)/, "Net"],
   [/^(node:)?child_process$/, null, "Exec"],
+  // node:worker_threads — `postMessage` crosses a thread boundary (the canonical Node worker IPC);
+  // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
+  // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
+  // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
+  [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
+  // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
+  [/^(node:)?cluster$/, /^fork$/, "Ipc"],
   [/^(node:)?sqlite$/, null, "Db"],
   // the curated npm tier
   [/^(axios|got|node-fetch|undici|ws|socket\.io(-client)?|nodemailer)$/, null, "Net"],
@@ -79,9 +86,17 @@ export const KAPPA_RULES = [
   [/^mongoose$/,
    /^(find|save|create|insertMany|updateOne|updateMany|replaceOne|deleteOne|deleteMany|aggregate|countDocuments|estimatedDocumentCount|distinct|exec|bulkWrite)/,
    "Db"],
-  [/^(sequelize|drizzle-orm)$/,
-   /^(find|create|update|destroy|upsert|count|max|min|sum|query|select|insert|delete|execute|transaction)/,
+  // Sequelize is EXECUTE-ON-CALL: `Model.findAll()/create()/update()/destroy()` issue the query and
+  // return a promise — so its verbs are the I/O boundary.
+  [/^sequelize$/,
+   /^(find|create|update|destroy|upsert|count|max|min|sum|increment|decrement|reload|save|query|transaction)/,
    "Db"],
+  // Drizzle is a BUILDER: `db.select().from().where()` / `db.insert().values()` / `db.update().set()` /
+  // `db.delete().where()` issue NOTHING until a terminal `.execute()`/await/`.all()`/`.get()`/`.run()` (or
+  // the relational `db.query.x.findMany/findFirst`). Listing select/insert/update/delete as Db fabricated
+  // the effect onto a pure builder chain (the typeorm rule's `createQueryBuilder` discipline, violated).
+  // VERB-PRECISE: only the terminal execution verbs; the builder heads under-report (sound) until executed.
+  [/^drizzle-orm$/, /^(execute|transaction|findMany|findFirst|all|get|run)$/, "Db"],
   // Nest's HttpService wraps axios — the request verbs are Net.
   [/^@nestjs\/axios$/, /^(get|post|put|patch|delete|head|request)$/, "Net"],
 ];