@suss/ir-core 0.20.0 → 0.21.1

package/dist/index.cjs

@@ -26,11 +26,15 @@ __export(index_exports, {
   ConfidenceSourceSchema: () => ConfidenceSourceSchema,
   CorroborationSchema: () => CorroborationSchema,
   DeployableUnitSchema: () => DeployableUnitSchema,
+  EVERY_FIELD: () => EVERY_FIELD,
+  EffectRelationSchema: () => EffectRelationSchema,
   FunctionCallSemanticsSchema: () => FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema: () => GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema: () => GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema: () => MessageBusSemanticsSchema,
   MetricSemanticsSchema: () => MetricSemanticsSchema,
+  NOTHING_DEPLOYED: () => NOTHING_DEPLOYED,
+  RelationSchema: () => RelationSchema,
   RestSemanticsSchema: () => RestSemanticsSchema,
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
   SemanticsSchema: () => SemanticsSchema,
@@ -39,7 +43,10 @@ __export(index_exports, {
   SuppressionFileSchema: () => SuppressionFileSchema,
   SuppressionRuleSchema: () => SuppressionRuleSchema,
   TypeShapeSchema: () => TypeShapeSchema,
+  UnitInvocationSemanticsSchema: () => UnitInvocationSemanticsSchema,
   applySuppressionsToFindings: () => applySuppressionsToFindings,
+  bindingIs: () => bindingIs,
+  bindingTokens: () => bindingTokens,
   bodyShapesMatch: () => bodyShapesMatch,
   boundaryKey: () => boundaryKey,
   boundaryLabel: () => boundaryLabel,
@@ -62,6 +69,7 @@ __export(index_exports, {
   gqlIdentityKey: () => gqlIdentityKey,
   graphqlOperationBinding: () => graphqlOperationBinding,
   graphqlResolverBinding: () => graphqlResolverBinding,
+  groundBinding: () => groundBinding,
   groundedPairingKey: () => groundedPairingKey,
   hasNameHole: () => hasNameHole,
   isGraphqlOperationBinding: () => isGraphqlOperationBinding,
@@ -71,7 +79,10 @@ __export(index_exports, {
   metricIdentityKey: () => metricIdentityKey,
   namePatternFromSub: () => namePatternFromSub,
   namePatternKey: () => namePatternKey,
+  nameReference: () => nameReference,
   namesAgree: () => namesAgree,
+  namesBoundary: () => namesBoundary,
+  namesBoundaryExactly: () => namesBoundaryExactly,
   namesNothing: () => namesNothing,
   normalizePath: () => normalizePath,
   normalizeRuleBoundary: () => normalizeRuleBoundary,
@@ -86,6 +97,7 @@ __export(index_exports, {
   referenceName: () => referenceName,
   referenceOf: () => referenceOf,
   reportsUnpairedItself: () => reportsUnpairedItself,
+  resourceNameIn: () => resourceNameIn,
   restBinding: () => restBinding,
   routePathAdmits: () => routePathAdmits,
   ruleBoundaryMatchesKey: () => ruleBoundaryMatchesKey,
@@ -93,12 +105,18 @@ __export(index_exports, {
   semanticsAgree: () => semanticsAgree,
   semconvAttributes: () => semconvAttributes,
   servesRequest: () => servesRequest,
+  spellingTokens: () => spellingTokens,
   statesAnOrigin: () => statesAnOrigin,
   storageBinding: () => storageBinding,
+  storageContainerLabel: () => storageContainerLabel,
+  storageLabel: () => storageLabel,
   typeDefinitionKey: () => typeDefinitionKey,
+  unitIdentityKey: () => unitIdentityKey,
+  unitInvocationBinding: () => unitInvocationBinding,
   validateRule: () => validateRule,
   withDefinitionsInlined: () => withDefinitionsInlined,
-  withRewrittenPaths: () => withRewrittenPaths
+  withRewrittenPaths: () => withRewrittenPaths,
+  withinScope: () => withinScope
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -151,15 +169,18 @@ function fnIdentityKey(packageName, exportPath) {
 function busIdentityKey(messageBus, subject) {
   return `bus:${messageBus} ${subject}`;
 }
+function unitIdentityKey(deploymentTarget, instanceName) {
+  return `unit:${deploymentTarget} ${instanceName}`;
+}
 function metricIdentityKey(metricSystem, metricType) {
   return `metric:${metricSystem} ${metricType}`;
 }
 
 // src/schemas.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 
 // src/semantics/registry.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // src/semantics/functionCall.ts
 var import_zod2 = require("zod");
@@ -424,6 +445,141 @@ var metricSemantics = defineBoundarySemantics({
 // src/semantics/rest.ts
 var import_zod6 = require("zod");
 
+// src/dispatch.ts
+function dispatchByType(table, value) {
+  const handler = table[value.type];
+  return handler(value);
+}
+
+// src/boundaryName.ts
+var HOLE_SPLIT = /(\{[^}]*\})/;
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+var SUB_ESCAPE = /\$\{!/;
+function isHole(piece) {
+  return piece.startsWith("{") && piece.endsWith("}");
+}
+function parseBoundaryName(name) {
+  const parts = name.split(HOLE_SPLIT).filter((piece) => piece !== "").map(
+    (piece) => isHole(piece) ? { type: "hole", label: piece.slice(1, -1) } : { type: "text", text: piece }
+  );
+  const only = parts.length === 1 ? parts[0] : void 0;
+  if (only !== void 0 && only.type === "hole") {
+    return { type: "reference", path: only.label.split(".") };
+  }
+  if (parts.some((part) => part.type === "hole")) {
+    return { type: "pattern", parts };
+  }
+  return { type: "literal", value: name };
+}
+var partString = {
+  text: (part) => part.text,
+  hole: (part) => patternHole(part.label)
+};
+var nameString = {
+  literal: (name) => name.value,
+  pattern: (name) => name.parts.map((part) => dispatchByType(partString, part)).join(""),
+  reference: (name) => patternHole(name.path.join("."))
+};
+function boundaryNameString(name) {
+  return dispatchByType(nameString, name);
+}
+function patternHole(label) {
+  return `{${label}}`;
+}
+function namePatternFromSub(value) {
+  if (Array.isArray(value)) {
+    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (SUB_ESCAPE.test(value)) {
+    return null;
+  }
+  return value.replace(
+    SUB_TOKEN,
+    (_whole, inner) => patternHole(inner)
+  );
+}
+function namesNothing(name) {
+  return parseBoundaryName(name).type === "reference";
+}
+function hasNameHole(name) {
+  return parseBoundaryName(name).type !== "literal";
+}
+function namePatternKey(name) {
+  return dispatchByType(
+    {
+      literal: (parsed) => parsed.value,
+      pattern: (parsed) => boundaryNameString({
+        type: "pattern",
+        parts: parsed.parts.map(
+          (part) => part.type === "hole" ? { type: "hole", label: "" } : part
+        )
+      }),
+      reference: () => patternHole("")
+    },
+    parseBoundaryName(name)
+  );
+}
+function fixedTextLength(name) {
+  return dispatchByType(
+    {
+      literal: (parsed) => parsed.value.length,
+      pattern: (parsed) => parsed.parts.reduce(
+        (total, part) => total + (part.type === "text" ? part.text.length : 0),
+        0
+      ),
+      reference: () => 0
+    },
+    parseBoundaryName(name)
+  );
+}
+function quote(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function admits(pattern, name) {
+  const source = pattern.parts.map((part) => part.type === "hole" ? ".+" : quote(part.text)).join("");
+  return new RegExp(`^${source}$`).test(name);
+}
+function namesAgree(a, b) {
+  const left = parseBoundaryName(a);
+  const right = parseBoundaryName(b);
+  if (left.type === "reference" || right.type === "reference") {
+    return false;
+  }
+  if (left.type === "pattern" && right.type === "pattern") {
+    return namePatternKey(a) === namePatternKey(b);
+  }
+  if (left.type === "pattern") {
+    return admits(left, b);
+  }
+  if (right.type === "pattern") {
+    return admits(right, a);
+  }
+  return a === b;
+}
+function referenceName(reference) {
+  const path = [reference.root, ...reference.fields];
+  if (path.some((part) => part === "")) {
+    return null;
+  }
+  return boundaryNameString({ type: "reference", path });
+}
+function referenceOf(name) {
+  if (name.type !== "reference") {
+    return null;
+  }
+  const root = name.path[0];
+  if (root === void 0 || name.path.some((part) => part === "")) {
+    return null;
+  }
+  return { root, fields: name.path.slice(1) };
+}
+function referenceFromName(name) {
+  return referenceOf(parseBoundaryName(name));
+}
+
 // src/urlPath.ts
 var SCHEME_ORIGIN = /^[a-zA-Z][a-zA-Z\d+.-]*:\/\/[^/]*/;
 var PROTOCOL_RELATIVE_ORIGIN = /^\/\/[^/]*/;
@@ -456,9 +612,9 @@ var RestSemanticsSchema = import_zod6.z.object({
   declaredResponses: import_zod6.z.array(import_zod6.z.number()).optional()
 });
 var OPENING_HOLE = /^\{([^{}]+)\}(.*)$/;
-function variableOf(label) {
-  const parts = label.split(".");
-  return parts[parts.length - 1] ?? label;
+function baseUrlReference(semantics) {
+  const label = OPENING_HOLE.exec(semantics.path ?? "")?.[1];
+  return label === void 0 ? null : referenceFromName(patternHole(label));
 }
 function normalizePath(path) {
   let normalized = path.replace(/:([a-zA-Z_]\w*)/g, "{$1}");
@@ -569,6 +725,14 @@ var restSemantics = defineBoundarySemantics({
       }
       return routePathAdmits(semantics.path, path) ? "match" : "nomatch";
     },
+    /**
+     * A route the registration pattern admits is inside it. A route
+     * whose path this source never gave is left outside, because
+     * nothing here can show it is one the pattern covers.
+     */
+    withinScope(semantics, scope) {
+      return semantics.path !== null && routePathAdmits(scope, semantics.path);
+    },
     /**
      * A call whose base URL the deployment fills in, resolved to the
      * path it reaches.
@@ -584,22 +748,20 @@ var restSemantics = defineBoundarySemantics({
      * route parameter, and `/orders/{id}` means every id rather than a
      * variable somebody set.
      */
-    groundName(semantics, deployedAs) {
-      if (semantics.path === null) {
-        return null;
-      }
-      const opening = OPENING_HOLE.exec(semantics.path);
-      if (opening === null) {
+    groundName(semantics, deployment) {
+      const reference = baseUrlReference(semantics);
+      if (reference === null) {
         return null;
       }
-      const [, label, rest] = opening;
-      const base = deployedAs(variableOf(label));
+      const base = deployment.setTo(reference);
       if (base === null) {
         return null;
       }
+      const rest = OPENING_HOLE.exec(semantics.path ?? "")?.[2] ?? "";
       const grounded = pathAfterOrigin(`${base}${rest}`);
       return { ...semantics, path: grounded === "" ? "/" : grounded };
     },
+    nameReference: baseUrlReference,
     ruleBoundary: {
       // "METHOD /path": one leading token, then an absolute path.
       claims(raw) {
@@ -689,6 +851,9 @@ var StorageSemanticsSchema = import_zod9.z.object({
    */
   accessPath: import_zod9.z.string().nullable()
 });
+function containerReference(semantics) {
+  return semantics.container === null ? null : referenceFromName(semantics.container);
+}
 var storageSemantics = defineBoundarySemantics({
   name: "storage",
   schema: StorageSemanticsSchema,
@@ -704,12 +869,109 @@ var storageSemantics = defineBoundarySemantics({
     /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
-    identityKey: () => null
+    identityKey: () => null,
+    displayLabel: storageLabel,
+    /**
+     * A container the source states as a variable is whatever the
+     * deployment sets that variable to. `{SUBSCRIBERS_TABLE}` in the
+     * code and `prod-subscribers-v1` in the manifest are one table.
+     */
+    groundName(semantics, deployment) {
+      const reference = containerReference(semantics);
+      if (reference === null) {
+        return null;
+      }
+      const name = deployment.setTo(reference);
+      return name === null ? null : { ...semantics, container: name };
+    },
+    nameReference: containerReference
+  }
+});
+function storageLabel(semantics) {
+  return `${semantics.storageSystem}:${storageContainerLabel(semantics)}`;
+}
+var EVERY_FIELD = "*";
+function storageContainerLabel(semantics) {
+  const container = semantics.container ?? "<unnamed container>";
+  const addressed = semantics.accessPath === null ? container : `${container}#${semantics.accessPath}`;
+  return semantics.scope === "default" ? addressed : `${semantics.scope}/${addressed}`;
+}
+
+// src/semantics/unitInvocation.ts
+var import_zod10 = require("zod");
+var UnitInvocationSemanticsSchema = DeployableUnitSchema.extend({
+  name: import_zod10.z.literal("unit-invocation"),
+  instanceName: DeployableUnitSchema.shape.instanceName.nullable()
+});
+function calleeReference(semantics) {
+  return semantics.instanceName === null ? null : referenceFromName(semantics.instanceName);
+}
+var unitInvocationSemantics = defineBoundarySemantics({
+  name: "unit-invocation",
+  schema: UnitInvocationSemanticsSchema,
+  // faas.name is the deployed function's own name and instanceName is
+  // the deployment template's logical id, which is a different string.
+  // Runtime config leaves the pair off for the same reason.
+  semconv: {},
+  behavior: {
+    /**
+     * A synchronous invoke gives back whatever the handler returned,
+     * which is a value rather than a status and a body. A handler's
+     * return only becomes an HTTP response under a proxy integration,
+     * and that route gets a REST binding instead of this one.
+     */
+    exchangesHttpResponses: false,
+    /**
+     * A unit nothing in the run invokes is the ordinary case, since
+     * most services are reached from a stack suss never read. So an
+     * uninvoked unit stays in the generic unmatched list rather than
+     * being reported as a problem here.
+     */
+    reportsUnpairedItself: false,
+    /**
+     * A callee the source states only as a variable is not a name for
+     * anything until the deployment fills it in, so it keys as nothing
+     * rather than as a bucket that would agree with itself alone.
+     */
+    identityKey(semantics) {
+      if (semantics.instanceName === null || namesNothing(semantics.instanceName)) {
+        return null;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    },
+    displayLabel(semantics) {
+      if (semantics.instanceName === null) {
+        return `unit:${semantics.deploymentTarget} (named at runtime)`;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    },
+    /**
+     * A call that reads its callee's name out of the environment
+     * reaches whichever resource the template wires that variable to.
+     * The logical id is the answer rather than the deployed name,
+     * because the invoked unit's own summary is keyed by the logical
+     * id and neither side ever writes the other's string.
+     */
+    groundName(semantics, deployment) {
+      const reference = calleeReference(semantics);
+      if (reference === null) {
+        return null;
+      }
+      const logicalId = deployment.pointsAt(reference);
+      return logicalId === null ? null : { ...semantics, instanceName: logicalId };
+    },
+    nameReference: calleeReference
   }
 });
 
 // src/semantics/registry.ts
-var SemanticsSchema = import_zod10.z.discriminatedUnion("name", [
+var SemanticsSchema = import_zod11.z.discriminatedUnion("name", [
   restSemantics.schema,
   functionCallSemantics.schema,
   graphqlResolverSemantics.schema,
@@ -717,7 +979,8 @@ var SemanticsSchema = import_zod10.z.discriminatedUnion("name", [
   runtimeConfigSemantics.schema,
   storageSemantics.schema,
   messageBusSemantics.schema,
-  metricSemantics.schema
+  metricSemantics.schema,
+  unitInvocationSemantics.schema
 ]);
 var DEFINITIONS = [
   restSemantics,
@@ -727,7 +990,8 @@ var DEFINITIONS = [
   runtimeConfigSemantics,
   storageSemantics,
   messageBusSemantics,
-  metricSemantics
+  metricSemantics,
+  unitInvocationSemantics
 ];
 var BY_NAME = new Map(
   DEFINITIONS.map((d) => [d.name, d])
@@ -750,31 +1014,31 @@ function allBehaviors() {
 }
 
 // src/schemas.ts
-var ConfidenceSourceSchema = import_zod11.z.enum([
+var ConfidenceSourceSchema = import_zod12.z.enum([
   "inferred_static",
   "inferred_ai",
   "declared",
   "derived"
 ]);
-var ConfidenceLevelSchema = import_zod11.z.enum(["high", "medium", "low"]);
-var CorroborationSchema = import_zod11.z.object({
-  outcome: import_zod11.z.enum(["observed", "refuted", "untested"]),
+var ConfidenceLevelSchema = import_zod12.z.enum(["high", "medium", "low"]);
+var CorroborationSchema = import_zod12.z.object({
+  outcome: import_zod12.z.enum(["observed", "refuted", "untested"]),
   /** Executions that produced a verdict for this claim. */
-  runs: import_zod11.z.number(),
+  runs: import_zod12.z.number(),
   /** Present when refuted: the input and observation that disagreed. */
-  counterexample: import_zod11.z.unknown().optional(),
+  counterexample: import_zod12.z.unknown().optional(),
   /** Present when untested: why no verdict was reachable. */
-  reason: import_zod11.z.string().optional()
+  reason: import_zod12.z.string().optional()
 });
-var ConfidenceInfoSchema = import_zod11.z.object({
+var ConfidenceInfoSchema = import_zod12.z.object({
   source: ConfidenceSourceSchema,
   level: ConfidenceLevelSchema,
   corroboration: CorroborationSchema.optional()
 });
-var SourceLocationSchema = import_zod11.z.object({
-  file: import_zod11.z.string(),
+var SourceLocationSchema = import_zod12.z.object({
+  file: import_zod12.z.string(),
   /** Line numbers, for a person reading the summary or an editor link. */
-  range: import_zod11.z.object({ start: import_zod11.z.number(), end: import_zod11.z.number() }),
+  range: import_zod12.z.object({ start: import_zod12.z.number(), end: import_zod12.z.number() }),
   /**
    * Character offsets of the unit in its file. Identity and joins
    * measure with these, since two functions can share a line and never
@@ -782,8 +1046,8 @@ var SourceLocationSchema = import_zod11.z.object({
    * same place. Absent on summaries no source position backs, a
    * contract artifact's say.
    */
-  span: import_zod11.z.object({ start: import_zod11.z.number(), end: import_zod11.z.number() }).optional(),
-  exportName: import_zod11.z.string().nullable(),
+  span: import_zod12.z.object({ start: import_zod12.z.number(), end: import_zod12.z.number() }).optional(),
+  exportName: import_zod12.z.string().nullable(),
   /**
    * The project the extract was pointed at, by the name that project
    * calls itself.
@@ -793,47 +1057,47 @@ var SourceLocationSchema = import_zod11.z.object({
    * summaries puts them on top of each other. This field is what tells
    * them apart, and what a reader groups by.
    */
-  workspace: import_zod11.z.string().optional()
+  workspace: import_zod12.z.string().optional()
 });
-var BoundaryBindingSchema = import_zod11.z.object({
-  transport: import_zod11.z.string(),
+var BoundaryBindingSchema = import_zod12.z.object({
+  transport: import_zod12.z.string(),
   semantics: SemanticsSchema,
-  recognition: import_zod11.z.string()
+  recognition: import_zod12.z.string()
 });
 function typeDefinitionKey(ref) {
   return ref.def ?? null;
 }
-var TypeShapeSchema = import_zod11.z.lazy(
-  () => import_zod11.z.discriminatedUnion("type", [
-    import_zod11.z.object({
-      type: import_zod11.z.literal("record"),
-      properties: import_zod11.z.record(import_zod11.z.string(), TypeShapeSchema),
-      spreads: import_zod11.z.array(import_zod11.z.object({ sourceText: import_zod11.z.string() })).optional()
+var TypeShapeSchema = import_zod12.z.lazy(
+  () => import_zod12.z.discriminatedUnion("type", [
+    import_zod12.z.object({
+      type: import_zod12.z.literal("record"),
+      properties: import_zod12.z.record(import_zod12.z.string(), TypeShapeSchema),
+      spreads: import_zod12.z.array(import_zod12.z.object({ sourceText: import_zod12.z.string() })).optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("dictionary"), values: TypeShapeSchema }),
-    import_zod11.z.object({ type: import_zod11.z.literal("array"), items: TypeShapeSchema }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("literal"),
-      value: import_zod11.z.union([import_zod11.z.string(), import_zod11.z.number(), import_zod11.z.boolean()]),
-      raw: import_zod11.z.string().optional()
+    import_zod12.z.object({ type: import_zod12.z.literal("dictionary"), values: TypeShapeSchema }),
+    import_zod12.z.object({ type: import_zod12.z.literal("array"), items: TypeShapeSchema }),
+    import_zod12.z.object({
+      type: import_zod12.z.literal("literal"),
+      value: import_zod12.z.union([import_zod12.z.string(), import_zod12.z.number(), import_zod12.z.boolean()]),
+      raw: import_zod12.z.string().optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("text") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("integer") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("number") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("boolean") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("null") }),
-    import_zod11.z.object({ type: import_zod11.z.literal("undefined") }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("union"),
-      variants: import_zod11.z.array(TypeShapeSchema)
+    import_zod12.z.object({ type: import_zod12.z.literal("text") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("integer") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("number") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("boolean") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("null") }),
+    import_zod12.z.object({ type: import_zod12.z.literal("undefined") }),
+    import_zod12.z.object({
+      type: import_zod12.z.literal("union"),
+      variants: import_zod12.z.array(TypeShapeSchema)
     }),
-    import_zod11.z.object({
-      type: import_zod11.z.literal("ref"),
-      name: import_zod11.z.string(),
-      from: import_zod11.z.string().optional(),
-      def: import_zod11.z.string().optional()
+    import_zod12.z.object({
+      type: import_zod12.z.literal("ref"),
+      name: import_zod12.z.string(),
+      from: import_zod12.z.string().optional(),
+      def: import_zod12.z.string().optional()
     }),
-    import_zod11.z.object({ type: import_zod11.z.literal("unknown") })
+    import_zod12.z.object({ type: import_zod12.z.literal("unknown") })
   ])
 );
 var MAX_DEFINITION_DEPTH = 6;
@@ -897,6 +1161,9 @@ function semconvAttributes(binding) {
 }
 
 // src/boundaryKey.ts
+function bindingIs(binding, name) {
+  return binding?.semantics.name === name;
+}
 function boundaryKey(binding) {
   return behaviorOf(binding.semantics).identityKey(binding.semantics);
 }
@@ -910,12 +1177,16 @@ function withRewrittenPaths(binding, rewrite) {
     semantics: behavior.rewritePaths(binding.semantics, rewrite)
   };
 }
-function groundedPairingKey(binding, deployedAs) {
+function groundedPairingKey(binding, deployment) {
+  return pairingKey(groundBinding(binding, deployment));
+}
+function groundBinding(binding, deployment) {
   const behavior = behaviorOf(binding.semantics);
-  const grounded = behavior.groundName?.(binding.semantics, deployedAs) ?? null;
-  return pairingKey(
-    grounded === null ? binding : { ...binding, semantics: grounded }
-  );
+  const grounded = behavior.groundName?.(binding.semantics, deployment) ?? null;
+  return grounded === null ? binding : { ...binding, semantics: grounded };
+}
+function nameReference(binding) {
+  return behaviorOf(binding.semantics).nameReference?.(binding.semantics) ?? null;
 }
 function pairingKey(binding) {
   const behavior = behaviorOf(binding.semantics);
@@ -964,140 +1235,60 @@ function servesRequest(binding, method, path) {
   }
   return serves(binding.semantics, method, path);
 }
-
-// src/dispatch.ts
-function dispatchByType(table, value) {
-  const handler = table[value.type];
-  return handler(value);
+function withinScope(binding, scope) {
+  const within = behaviorOf(binding.semantics).withinScope;
+  return within === void 0 ? false : within(binding.semantics, scope);
 }
 
-// src/boundaryName.ts
-var HOLE_SPLIT = /(\{[^}]*\})/;
-var SUB_TOKEN = /\$\{([^}]*)\}/g;
-var SUB_ESCAPE = /\$\{!/;
-function isHole(piece) {
-  return piece.startsWith("{") && piece.endsWith("}");
-}
-function parseBoundaryName(name) {
-  const parts = name.split(HOLE_SPLIT).filter((piece) => piece !== "").map(
-    (piece) => isHole(piece) ? { type: "hole", label: piece.slice(1, -1) } : { type: "text", text: piece }
-  );
-  const only = parts.length === 1 ? parts[0] : void 0;
-  if (only !== void 0 && only.type === "hole") {
-    return { type: "reference", path: only.label.split(".") };
-  }
-  if (parts.some((part) => part.type === "hole")) {
-    return { type: "pattern", parts };
-  }
-  return { type: "literal", value: name };
-}
-var partString = {
-  text: (part) => part.text,
-  hole: (part) => patternHole(part.label)
-};
-var nameString = {
-  literal: (name) => name.value,
-  pattern: (name) => name.parts.map((part) => dispatchByType(partString, part)).join(""),
-  reference: (name) => patternHole(name.path.join("."))
-};
-function boundaryNameString(name) {
-  return dispatchByType(nameString, name);
-}
-function patternHole(label) {
-  return `{${label}}`;
-}
-function namePatternFromSub(value) {
-  if (Array.isArray(value)) {
-    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
-  }
-  if (typeof value !== "string") {
-    return null;
+// src/boundarySpelling.ts
+function resourceNameIn(spelling) {
+  if (spelling.startsWith("arn:")) {
+    const segments2 = spelling.split(":");
+    return segments2[6] ?? segments2[5] ?? spelling;
+  }
+  const segments = spelling.split("/");
+  if (segments.length >= 4 && segments.length % 2 === 0) {
+    return segments[segments.length - 1] ?? spelling;
+  }
+  return spelling;
+}
+function spellingTokens(text) {
+  return text.toLowerCase().replace(/[{}]/g, " ").split(/[\s:#,()/]+/).filter((token) => token.length > 0);
+}
+function bindingTokens(binding) {
+  const tokens = new Set(spellingTokens(displayLabel(binding)));
+  for (const value of Object.values(binding.semantics)) {
+    if (typeof value === "string") {
+      for (const token of spellingTokens(value)) {
+        tokens.add(token);
+      }
+    }
   }
-  if (SUB_ESCAPE.test(value)) {
-    return null;
+  for (const token of [...tokens]) {
+    for (const part of token.split(".")) {
+      tokens.add(part);
+    }
   }
-  return value.replace(
-    SUB_TOKEN,
-    (_whole, inner) => patternHole(inner)
-  );
-}
-function namesNothing(name) {
-  return parseBoundaryName(name).type === "reference";
-}
-function hasNameHole(name) {
-  return parseBoundaryName(name).type !== "literal";
+  return tokens;
 }
-function namePatternKey(name) {
-  return dispatchByType(
-    {
-      literal: (parsed) => parsed.value,
-      pattern: (parsed) => boundaryNameString({
-        type: "pattern",
-        parts: parsed.parts.map(
-          (part) => part.type === "hole" ? { type: "hole", label: "" } : part
-        )
-      }),
-      reference: () => patternHole("")
-    },
-    parseBoundaryName(name)
-  );
-}
-function fixedTextLength(name) {
-  return dispatchByType(
-    {
-      literal: (parsed) => parsed.value.length,
-      pattern: (parsed) => parsed.parts.reduce(
-        (total, part) => total + (part.type === "text" ? part.text.length : 0),
-        0
-      ),
-      reference: () => 0
-    },
-    parseBoundaryName(name)
-  );
-}
-function quote(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function admits(pattern, name) {
-  const source = pattern.parts.map((part) => part.type === "hole" ? ".+" : quote(part.text)).join("");
-  return new RegExp(`^${source}$`).test(name);
-}
-function namesAgree(a, b) {
-  const left = parseBoundaryName(a);
-  const right = parseBoundaryName(b);
-  if (left.type === "reference" || right.type === "reference") {
+function namesBoundaryExactly(subject, binding) {
+  const wanted = new Set(spellingTokens(subject));
+  if (wanted.size === 0) {
     return false;
   }
-  if (left.type === "pattern" && right.type === "pattern") {
-    return namePatternKey(a) === namePatternKey(b);
-  }
-  if (left.type === "pattern") {
-    return admits(left, b);
-  }
-  if (right.type === "pattern") {
-    return admits(right, a);
-  }
-  return a === b;
-}
-function referenceName(reference) {
-  const path = [reference.root, ...reference.fields];
-  if (path.some((part) => part === "")) {
-    return null;
+  const spelled = new Set(spellingTokens(displayLabel(binding)));
+  if (spelled.size !== wanted.size) {
+    return false;
   }
-  return boundaryNameString({ type: "reference", path });
+  return [...spelled].every((token) => wanted.has(token));
 }
-function referenceOf(name) {
-  if (name.type !== "reference") {
-    return null;
-  }
-  const root = name.path[0];
-  if (root === void 0 || name.path.some((part) => part === "")) {
-    return null;
+function namesBoundary(subject, binding) {
+  const wanted = spellingTokens(subject);
+  if (wanted.length === 0) {
+    return false;
   }
-  return { root, fields: name.path.slice(1) };
-}
-function referenceFromName(name) {
-  return referenceOf(parseBoundaryName(name));
+  const tokens = bindingTokens(binding);
+  return wanted.every((token) => tokens.has(token));
 }
 
 // src/codeScope.ts
@@ -1113,26 +1304,43 @@ function fileInCodeScope(file, scope) {
   return path === prefix || path.startsWith(`${prefix}/`);
 }
 
+// src/deployment.ts
+var NOTHING_DEPLOYED = {
+  variableFor: () => null,
+  setTo: () => null,
+  pointsAt: () => null
+};
+
+// src/relation.ts
+var import_zod13 = require("zod");
+var RelationSchema = import_zod13.z.enum([
+  "provides",
+  "reads",
+  "writes",
+  "invokes"
+]);
+var EffectRelationSchema = RelationSchema.exclude(["provides"]);
+
 // src/suppressions.ts
-var import_zod12 = require("zod");
-var SuppressionSideSchema = import_zod12.z.object({
-  summary: import_zod12.z.string().optional(),
-  transitionId: import_zod12.z.string().optional()
+var import_zod14 = require("zod");
+var SuppressionSideSchema = import_zod14.z.object({
+  summary: import_zod14.z.string().optional(),
+  transitionId: import_zod14.z.string().optional()
 }).optional();
-var SuppressionRuleSchema = import_zod12.z.object({
+var SuppressionRuleSchema = import_zod14.z.object({
   /**
    * The finding kind to match, behavioural or intent. It is an open
    * string here because this package is below both IRs, and the loader
    * is what validates it against the published kind enums.
    */
-  kind: import_zod12.z.string().optional(),
+  kind: import_zod14.z.string().optional(),
   /**
    * Boundary as a human-readable key, e.g. "GET /pet/{petId}" or
    * "fn:@acme/api::getUser". REST keys are normalized via the same
    * path normalizer the checkers use, so `:id` and `{id}` compare
    * equal.
    */
-  boundary: import_zod12.z.string().optional(),
+  boundary: import_zod14.z.string().optional(),
   /**
    * Consumer-side discriminators, the narrowest useful match. These
    * mean something only for behavioural findings: a rule that
@@ -1155,15 +1363,15 @@ var SuppressionRuleSchema = import_zod12.z.object({
    * kind-only or boundary-only matches, which also silence future
    * regressions in that category.
    */
-  scope: import_zod12.z.enum(["narrow", "broad"]).default("narrow"),
+  scope: import_zod14.z.enum(["narrow", "broad"]).default("narrow"),
   /** Required human-written justification. */
-  reason: import_zod12.z.string().min(1),
+  reason: import_zod14.z.string().min(1),
   /** What to do when a finding matches. */
-  effect: import_zod12.z.enum(["mark", "downgrade", "hide"]).default("mark")
+  effect: import_zod14.z.enum(["mark", "downgrade", "hide"]).default("mark")
 }).strict();
-var SuppressionFileSchema = import_zod12.z.object({
-  version: import_zod12.z.literal(1),
-  rules: import_zod12.z.array(SuppressionRuleSchema)
+var SuppressionFileSchema = import_zod14.z.object({
+  version: import_zod14.z.literal(1),
+  rules: import_zod14.z.array(SuppressionRuleSchema)
 }).strict();
 function validateRule(rule) {
   if (rule.scope === "broad") {
@@ -1453,6 +1661,17 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
+function unitInvocationBinding(opts) {
+  return {
+    transport: "invoke",
+    semantics: {
+      name: "unit-invocation",
+      deploymentTarget: opts.deploymentTarget,
+      instanceName: namedOrNull(opts.instanceName, "invoked unit")
+    },
+    recognition: opts.recognition
+  };
+}
 function storageBinding(opts) {
   return {
     transport: opts.transport ?? opts.storageSystem,
@@ -1496,11 +1715,15 @@ function metricBinding(opts) {
   ConfidenceSourceSchema,
   CorroborationSchema,
   DeployableUnitSchema,
+  EVERY_FIELD,
+  EffectRelationSchema,
   FunctionCallSemanticsSchema,
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema,
   MetricSemanticsSchema,
+  NOTHING_DEPLOYED,
+  RelationSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
@@ -1509,7 +1732,10 @@ function metricBinding(opts) {
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
+  UnitInvocationSemanticsSchema,
   applySuppressionsToFindings,
+  bindingIs,
+  bindingTokens,
   bodyShapesMatch,
   boundaryKey,
   boundaryLabel,
@@ -1532,6 +1758,7 @@ function metricBinding(opts) {
   gqlIdentityKey,
   graphqlOperationBinding,
   graphqlResolverBinding,
+  groundBinding,
   groundedPairingKey,
   hasNameHole,
   isGraphqlOperationBinding,
@@ -1541,7 +1768,10 @@ function metricBinding(opts) {
   metricIdentityKey,
   namePatternFromSub,
   namePatternKey,
+  nameReference,
   namesAgree,
+  namesBoundary,
+  namesBoundaryExactly,
   namesNothing,
   normalizePath,
   normalizeRuleBoundary,
@@ -1556,6 +1786,7 @@ function metricBinding(opts) {
   referenceName,
   referenceOf,
   reportsUnpairedItself,
+  resourceNameIn,
   restBinding,
   routePathAdmits,
   ruleBoundaryMatchesKey,
@@ -1563,10 +1794,16 @@ function metricBinding(opts) {
   semanticsAgree,
   semconvAttributes,
   servesRequest,
+  spellingTokens,
   statesAnOrigin,
   storageBinding,
+  storageContainerLabel,
+  storageLabel,
   typeDefinitionKey,
+  unitIdentityKey,
+  unitInvocationBinding,
   validateRule,
   withDefinitionsInlined,
-  withRewrittenPaths
+  withRewrittenPaths,
+  withinScope
 });