@suss/ir-core 0.19.0 → 0.21.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology, D as DeployableUnit } from './schemas-k-169oiY.cjs';
-export { f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as typeDefinitionKey, y as withDefinitionsInlined } from './schemas-k-169oiY.cjs';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-Dn1AzzWd.cjs';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as storageContainerLabel, y as storageLabel, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.cjs';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -101,6 +101,12 @@ interface BoundaryBehavior<S extends {
     sidesAgree?(a: S, b: S): boolean;
     /** The line a reader sees for this boundary. Defaults to `identityKey`. */
     displayLabel?(semantics: S): string | null;
+    /**
+     * The semantics with any filesystem path it states rewritten, for
+     * the pass that makes a summary's paths project-relative. A
+     * protocol that states no path declares nothing here.
+     */
+    rewritePaths?(semantics: S, rewrite: (path: string) => string): S;
     /**
      * The first protocol whose `claims` returns true normalizes a
      * hand-written suppression boundary, and a string nobody claims is
@@ -117,6 +123,16 @@ interface BoundaryBehavior<S extends {
      * does not apply, and unknown means this declaration cannot settle it.
      */
     servesRequest?(semantics: S, method: string, path: string): MatchResult;
+    /**
+     * Whether every request this boundary takes falls inside a pattern
+     * something else was registered for. Middleware registered for
+     * `/v1/*` runs for `/v1/tenants/{id}` and not for `/health`, so
+     * composing it into a unit asks this first.
+     *
+     * A protocol whose boundaries no pattern addresses leaves this
+     * undefined, and nothing registered with a pattern reaches them.
+     */
+    withinScope?(semantics: S, scope: string): boolean;
     /**
      * The same boundary with a name the deployment fills in put in.
      *
@@ -189,6 +205,15 @@ type BusIdentityKey = `bus:${MessageBusSemantics["messageBus"]} ${string}` & {
     readonly [IdentityKeyBrand]: "bus";
 };
 declare function busIdentityKey(messageBus: MessageBusSemantics["messageBus"], subject: string): BusIdentityKey;
+/**
+ * `unit:platform name`, the key an invoker and the unit it invokes pair
+ * on. The platform stays in because two clouds can each deploy
+ * something called `Worker` and they are not the same thing.
+ */
+type UnitIdentityKey = `unit:${DeployableUnit["deploymentTarget"]} ${string}` & {
+    readonly [IdentityKeyBrand]: "unit";
+};
+declare function unitIdentityKey(deploymentTarget: DeployableUnit["deploymentTarget"], instanceName: string): UnitIdentityKey;
 /** `metric:system type`, the key both sides of a metric pair on. */
 type MetricIdentityKey = `metric:${string} ${string}` & {
     readonly [IdentityKeyBrand]: "metric";
@@ -202,6 +227,25 @@ declare const MetricSemanticsSchema: z.ZodObject<{
 }, z.core.$strip>;
 type MetricSemantics = z.infer<typeof MetricSemanticsSchema>;
 
+/**
+ * `instanceName` is nullable here and required on the unit itself,
+ * because only the provider always knows the name. A call that works
+ * its callee out at run time still happened, and recording it with no
+ * name says so without pairing it against everything.
+ */
+declare const UnitInvocationSemanticsSchema: z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type UnitInvocationSemantics = z.infer<typeof UnitInvocationSemanticsSchema>;
+
 /**
  * A boundary binding read as OpenTelemetry attributes.
  *
@@ -236,7 +280,24 @@ declare function semconvAttributes(binding: BoundaryBinding): Record<string, str
  * rather than in either checker.
  */
 
+/**
+ * Whether a binding is of one protocol, narrowed to that protocol's
+ * own semantics when it is. A caller reaching through the binding to
+ * compare the name by hand gets `string | undefined` and no narrowing,
+ * so a name that no protocol uses compiles and quietly never matches.
+ */
+declare function bindingIs<N extends Semantics["name"]>(binding: BoundaryBinding | null | undefined, name: N): binding is BoundaryBinding & {
+    semantics: Extract<Semantics, {
+        name: N;
+    }>;
+};
 declare function boundaryKey(binding: BoundaryBinding): string | null;
+/**
+ * The binding with any filesystem path its semantics state rewritten.
+ * The CLI uses it to make a summary's paths project-relative, and each
+ * protocol says for itself whether it states one.
+ */
+declare function withRewrittenPaths(binding: BoundaryBinding, rewrite: (path: string) => string): BoundaryBinding;
 /**
  * The bucket a boundary pairs in, with any name the deployment fills in
  * put in first.
@@ -270,6 +331,12 @@ declare function reportsUnpairedItself(binding: BoundaryBinding): boolean;
  * unknown means it does, but this declaration cannot settle the question.
  */
 declare function servesRequest(binding: BoundaryBinding, method: string, path: string): MatchResult | null;
+/**
+ * Whether a wrapper registered for `scope` runs for this boundary.
+ * False for a protocol whose boundaries no pattern addresses, so a
+ * scoped registration reaches nothing it cannot be shown to cover.
+ */
+declare function withinScope(binding: BoundaryBinding, scope: string): boolean;
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -380,6 +447,52 @@ declare function referenceOf(name: BoundaryName): Reference | null;
  */
 declare function referenceFromName(name: string): Reference | null;
 
+/**
+ * How somebody spells a boundary they want to talk about, and whether
+ * what they wrote picks out a given one.
+ *
+ * The words get cut into tokens, the boundary does too, and a boundary
+ * matches when it has every token somebody wrote. So
+ * `aws.dynamodb:editions` matches the table and every index on it, and
+ * adding `#by-publication` narrows it to the one index.
+ *
+ * `suss ask`, `suss check --at` and an intent document that says which
+ * store a write reaches all read this, so the question and the
+ * assertion are spelled and resolved the same way.
+ */
+
+/**
+ * The name inside a fully-qualified cloud resource id, and anything
+ * else unchanged.
+ *
+ * `arn:aws:lambda:us-east-1:1234:function:prod-worker` and
+ * `projects/p/locations/l/functions/prod-worker` say the same thing as
+ * `prod-worker` plus an account and a region. Keeping the whole string
+ * makes one deployment's spelling of a resource disagree with
+ * another's, so every reader that meets one reduces it here and the two
+ * sides compare the part they can both know. A Lambda ARN's trailing
+ * alias or version comes off with the rest: the function is the
+ * boundary whichever published copy a call reaches.
+ */
+declare function resourceNameIn(spelling: string): string;
+/**
+ * The words in a boundary spelling. Separators between parts of a name
+ * are cut, and the characters inside one part are left alone, so
+ * `by-publication` stays one word and `{id}` and `:id` both come out as
+ * `id`.
+ */
+declare function spellingTokens(text: string): string[];
+/** Every word this boundary can be asked about by. */
+declare function bindingTokens(binding: BoundaryBinding): Set<string>;
+/**
+ * Whether what somebody typed is the whole of this boundary's name
+ * rather than part of it. `POST /articles` is exactly the collection
+ * route and only part of `POST /articles/{slug}/comments`.
+ */
+declare function namesBoundaryExactly(subject: string, binding: BoundaryBinding): boolean;
+/** Whether what somebody typed picks out this boundary. */
+declare function namesBoundary(subject: string, binding: BoundaryBinding): boolean;
+
 /**
  * Deciding when two message-bus channel strings mean the same thing.
  *
@@ -462,6 +575,37 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * What a unit does at a boundary, in the words `suss ask` asks with.
+ *
+ * `what writes postgresql:invoices` is the question and "this outcome
+ * writes postgresql:invoices" is the assertion, so the report, the
+ * question parser and an intent doc all have to spell the verbs the
+ * same way. They are here rather than beside any one of them.
+ *
+ * `provides` is the unit's own boundary; `reads`, `writes` and
+ * `invokes` are what a call site does at somebody else's. Calling a
+ * deployed unit by name is one act, so it gets a verb of its own.
+ */
+
+declare const RelationSchema: z.ZodEnum<{
+    provides: "provides";
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type Relation = z.infer<typeof RelationSchema>;
+/**
+ * The verbs an effect can have. A boundary a unit serves is not an
+ * effect of the unit, so `provides` is not one of them.
+ */
+declare const EffectRelationSchema: z.ZodEnum<{
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type EffectRelation = z.infer<typeof EffectRelationSchema>;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -698,6 +842,18 @@ declare function runtimeConfigBinding(opts: {
     deploymentTarget: DeployableUnit["deploymentTarget"];
     instanceName: string;
 }): BoundaryBinding;
+/**
+ * Build a unit-invocation binding, the boundary between a deployed unit
+ * and whatever calls it by name. Transport is `"invoke"` because the
+ * call goes through the platform's own invoke API whichever cloud runs
+ * the unit.
+ */
+declare function unitInvocationBinding(opts: {
+    recognition: string;
+    deploymentTarget: DeployableUnit["deploymentTarget"];
+    /** Null when this source does not say which unit it invokes. */
+    instanceName: string | null;
+}): BoundaryBinding;
 /**
  * Build a storage binding, the side of a store that both a schema
  * reader and a call site can spell. `transport` defaults to the store's
@@ -736,4 +892,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, statesAnOrigin, storageBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology, D as DeployableUnit } from './schemas-k-169oiY.js';
-export { f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as typeDefinitionKey, y as withDefinitionsInlined } from './schemas-k-169oiY.js';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-Dn1AzzWd.js';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as storageContainerLabel, y as storageLabel, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.js';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -101,6 +101,12 @@ interface BoundaryBehavior<S extends {
     sidesAgree?(a: S, b: S): boolean;
     /** The line a reader sees for this boundary. Defaults to `identityKey`. */
     displayLabel?(semantics: S): string | null;
+    /**
+     * The semantics with any filesystem path it states rewritten, for
+     * the pass that makes a summary's paths project-relative. A
+     * protocol that states no path declares nothing here.
+     */
+    rewritePaths?(semantics: S, rewrite: (path: string) => string): S;
     /**
      * The first protocol whose `claims` returns true normalizes a
      * hand-written suppression boundary, and a string nobody claims is
@@ -117,6 +123,16 @@ interface BoundaryBehavior<S extends {
      * does not apply, and unknown means this declaration cannot settle it.
      */
     servesRequest?(semantics: S, method: string, path: string): MatchResult;
+    /**
+     * Whether every request this boundary takes falls inside a pattern
+     * something else was registered for. Middleware registered for
+     * `/v1/*` runs for `/v1/tenants/{id}` and not for `/health`, so
+     * composing it into a unit asks this first.
+     *
+     * A protocol whose boundaries no pattern addresses leaves this
+     * undefined, and nothing registered with a pattern reaches them.
+     */
+    withinScope?(semantics: S, scope: string): boolean;
     /**
      * The same boundary with a name the deployment fills in put in.
      *
@@ -189,6 +205,15 @@ type BusIdentityKey = `bus:${MessageBusSemantics["messageBus"]} ${string}` & {
     readonly [IdentityKeyBrand]: "bus";
 };
 declare function busIdentityKey(messageBus: MessageBusSemantics["messageBus"], subject: string): BusIdentityKey;
+/**
+ * `unit:platform name`, the key an invoker and the unit it invokes pair
+ * on. The platform stays in because two clouds can each deploy
+ * something called `Worker` and they are not the same thing.
+ */
+type UnitIdentityKey = `unit:${DeployableUnit["deploymentTarget"]} ${string}` & {
+    readonly [IdentityKeyBrand]: "unit";
+};
+declare function unitIdentityKey(deploymentTarget: DeployableUnit["deploymentTarget"], instanceName: string): UnitIdentityKey;
 /** `metric:system type`, the key both sides of a metric pair on. */
 type MetricIdentityKey = `metric:${string} ${string}` & {
     readonly [IdentityKeyBrand]: "metric";
@@ -202,6 +227,25 @@ declare const MetricSemanticsSchema: z.ZodObject<{
 }, z.core.$strip>;
 type MetricSemantics = z.infer<typeof MetricSemanticsSchema>;
 
+/**
+ * `instanceName` is nullable here and required on the unit itself,
+ * because only the provider always knows the name. A call that works
+ * its callee out at run time still happened, and recording it with no
+ * name says so without pairing it against everything.
+ */
+declare const UnitInvocationSemanticsSchema: z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type UnitInvocationSemantics = z.infer<typeof UnitInvocationSemanticsSchema>;
+
 /**
  * A boundary binding read as OpenTelemetry attributes.
  *
@@ -236,7 +280,24 @@ declare function semconvAttributes(binding: BoundaryBinding): Record<string, str
  * rather than in either checker.
  */
 
+/**
+ * Whether a binding is of one protocol, narrowed to that protocol's
+ * own semantics when it is. A caller reaching through the binding to
+ * compare the name by hand gets `string | undefined` and no narrowing,
+ * so a name that no protocol uses compiles and quietly never matches.
+ */
+declare function bindingIs<N extends Semantics["name"]>(binding: BoundaryBinding | null | undefined, name: N): binding is BoundaryBinding & {
+    semantics: Extract<Semantics, {
+        name: N;
+    }>;
+};
 declare function boundaryKey(binding: BoundaryBinding): string | null;
+/**
+ * The binding with any filesystem path its semantics state rewritten.
+ * The CLI uses it to make a summary's paths project-relative, and each
+ * protocol says for itself whether it states one.
+ */
+declare function withRewrittenPaths(binding: BoundaryBinding, rewrite: (path: string) => string): BoundaryBinding;
 /**
  * The bucket a boundary pairs in, with any name the deployment fills in
  * put in first.
@@ -270,6 +331,12 @@ declare function reportsUnpairedItself(binding: BoundaryBinding): boolean;
  * unknown means it does, but this declaration cannot settle the question.
  */
 declare function servesRequest(binding: BoundaryBinding, method: string, path: string): MatchResult | null;
+/**
+ * Whether a wrapper registered for `scope` runs for this boundary.
+ * False for a protocol whose boundaries no pattern addresses, so a
+ * scoped registration reaches nothing it cannot be shown to cover.
+ */
+declare function withinScope(binding: BoundaryBinding, scope: string): boolean;
 
 /**
  * The boundary-name syntax, parsed and printed in one place.
@@ -380,6 +447,52 @@ declare function referenceOf(name: BoundaryName): Reference | null;
  */
 declare function referenceFromName(name: string): Reference | null;
 
+/**
+ * How somebody spells a boundary they want to talk about, and whether
+ * what they wrote picks out a given one.
+ *
+ * The words get cut into tokens, the boundary does too, and a boundary
+ * matches when it has every token somebody wrote. So
+ * `aws.dynamodb:editions` matches the table and every index on it, and
+ * adding `#by-publication` narrows it to the one index.
+ *
+ * `suss ask`, `suss check --at` and an intent document that says which
+ * store a write reaches all read this, so the question and the
+ * assertion are spelled and resolved the same way.
+ */
+
+/**
+ * The name inside a fully-qualified cloud resource id, and anything
+ * else unchanged.
+ *
+ * `arn:aws:lambda:us-east-1:1234:function:prod-worker` and
+ * `projects/p/locations/l/functions/prod-worker` say the same thing as
+ * `prod-worker` plus an account and a region. Keeping the whole string
+ * makes one deployment's spelling of a resource disagree with
+ * another's, so every reader that meets one reduces it here and the two
+ * sides compare the part they can both know. A Lambda ARN's trailing
+ * alias or version comes off with the rest: the function is the
+ * boundary whichever published copy a call reaches.
+ */
+declare function resourceNameIn(spelling: string): string;
+/**
+ * The words in a boundary spelling. Separators between parts of a name
+ * are cut, and the characters inside one part are left alone, so
+ * `by-publication` stays one word and `{id}` and `:id` both come out as
+ * `id`.
+ */
+declare function spellingTokens(text: string): string[];
+/** Every word this boundary can be asked about by. */
+declare function bindingTokens(binding: BoundaryBinding): Set<string>;
+/**
+ * Whether what somebody typed is the whole of this boundary's name
+ * rather than part of it. `POST /articles` is exactly the collection
+ * route and only part of `POST /articles/{slug}/comments`.
+ */
+declare function namesBoundaryExactly(subject: string, binding: BoundaryBinding): boolean;
+/** Whether what somebody typed picks out this boundary. */
+declare function namesBoundary(subject: string, binding: BoundaryBinding): boolean;
+
 /**
  * Deciding when two message-bus channel strings mean the same thing.
  *
@@ -462,6 +575,37 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * What a unit does at a boundary, in the words `suss ask` asks with.
+ *
+ * `what writes postgresql:invoices` is the question and "this outcome
+ * writes postgresql:invoices" is the assertion, so the report, the
+ * question parser and an intent doc all have to spell the verbs the
+ * same way. They are here rather than beside any one of them.
+ *
+ * `provides` is the unit's own boundary; `reads`, `writes` and
+ * `invokes` are what a call site does at somebody else's. Calling a
+ * deployed unit by name is one act, so it gets a verb of its own.
+ */
+
+declare const RelationSchema: z.ZodEnum<{
+    provides: "provides";
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type Relation = z.infer<typeof RelationSchema>;
+/**
+ * The verbs an effect can have. A boundary a unit serves is not an
+ * effect of the unit, so `provides` is not one of them.
+ */
+declare const EffectRelationSchema: z.ZodEnum<{
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type EffectRelation = z.infer<typeof EffectRelationSchema>;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -698,6 +842,18 @@ declare function runtimeConfigBinding(opts: {
     deploymentTarget: DeployableUnit["deploymentTarget"];
     instanceName: string;
 }): BoundaryBinding;
+/**
+ * Build a unit-invocation binding, the boundary between a deployed unit
+ * and whatever calls it by name. Transport is `"invoke"` because the
+ * call goes through the platform's own invoke API whichever cloud runs
+ * the unit.
+ */
+declare function unitInvocationBinding(opts: {
+    recognition: string;
+    deploymentTarget: DeployableUnit["deploymentTarget"];
+    /** Null when this source does not say which unit it invokes. */
+    instanceName: string | null;
+}): BoundaryBinding;
 /**
  * Build a storage binding, the side of a store that both a schema
  * reader and a call site can spell. `transport` defaults to the store's
@@ -736,4 +892,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, statesAnOrigin, storageBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };