candor-ts 0.5.9 → 0.5.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/scan-core.mjs +7 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "candor-ts",
3
- "version": "0.5.9",
3
+ "version": "0.5.10",
4
4
  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
5
5
  "type": "module",
6
6
  "dependencies": {
package/scan-core.mjs CHANGED
@@ -49,6 +49,13 @@ export const KAPPA_RULES = [
49
49
  [/^(node:)?dns(\/promises)?$/,
50
50
  /^(?!(new|getServers|setServers|getDefaultResultOrder|setDefaultResultOrder)$)/, "Net"],
51
51
  [/^(node:)?child_process$/, null, "Exec"],
52
+ // node:worker_threads — `postMessage` crosses a thread boundary (the canonical Node worker IPC);
53
+ // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
54
+ // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
55
+ // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
56
+ [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
57
+ // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
58
+ [/^(node:)?cluster$/, /^fork$/, "Ipc"],
52
59
  [/^(node:)?sqlite$/, null, "Db"],
53
60
  // the curated npm tier
54
61
  [/^(axios|got|node-fetch|undici|ws|socket\.io(-client)?|nodemailer)$/, null, "Net"],