@suss/ir-core 0.20.0 → 0.21.1

package/dist/index.d.ts

@@ -1,6 +1,155 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology, D as DeployableUnit } from './schemas-Dt93kAZT.js';
-export { f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as typeDefinitionKey, y as withDefinitionsInlined } from './schemas-Dt93kAZT.js';
+import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-Dn1AzzWd.js';
+export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as storageContainerLabel, y as storageLabel, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.js';
+
+/**
+ * The boundary-name syntax, parsed and printed in one place.
+ *
+ * A name in a summary means one of three things, told apart by the
+ * braces alone: a literal (`orders-v1`), a pattern with deploy-time
+ * holes (`{stage}-orders-v1`), or a reference saying where to go and
+ * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
+ * disagree about which is which, and a second printer can spell a
+ * value this one cannot read back, so everything that touches the
+ * braces calls this module: `parseBoundaryName` and
+ * `boundaryNameString` are the two directions, and the helpers below
+ * are views over them. The package README tells the longer story,
+ * including why REST route paths and message-bus channels stay apart.
+ */
+/** One piece of a pattern: text the writer stated, or a hole. */
+type NamePart = {
+    type: "text";
+    text: string;
+} | {
+    type: "hole";
+    label: string;
+};
+/**
+ * What a name string means. A `reference` keeps its raw dot-separated
+ * path, and `referenceOf` is the view that checks the parts are all
+ * present, so a malformed spelling still classifies as a reference and
+ * still pairs with nothing.
+ */
+type BoundaryName = {
+    type: "literal";
+    value: string;
+} | {
+    type: "pattern";
+    parts: NamePart[];
+} | {
+    type: "reference";
+    path: string[];
+};
+/** What a name string means. The exact inverse of `boundaryNameString`. */
+declare function parseBoundaryName(name: string): BoundaryName;
+/** The one serializer. Everything a summary spells goes through here. */
+declare function boundaryNameString(name: BoundaryName): string;
+/**
+ * How a hole is spelled. A reader that assembles a pattern a part at a
+ * time, the way the adapter's name reader does, mints each hole here
+ * so the spelling cannot drift from the parse above.
+ */
+declare function patternHole(label: string): string;
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/**
+ * Whether a name says only that somebody else knows it. A wrapper that
+ * takes its bucket as an argument states `{location.bucket}` and
+ * nothing more, which says which parameter to ask rather than which
+ * bucket. A name like that agrees with nothing until something grounds
+ * it, since otherwise it would agree with every name there is.
+ */
+declare function namesNothing(name: string): boolean;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/** How much of a name the writer stated rather than left for deploy time. */
+declare function fixedTextLength(name: string): number;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized. A reference agrees with
+ * nothing on either side.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+/** Where a reference says to go and ask. */
+interface Reference {
+    /**
+     * The value the code starts from: a parameter of the unit the
+     * reference was written in, or a variable the deployment sets. Which
+     * of those it is depends on the unit's inputs, so the reader that
+     * grounds a reference decides, not the string.
+     */
+    root: string;
+    /** The fields to read inside it, outermost first. */
+    fields: string[];
+}
+/**
+ * How a reference is written. Null when a part of it is empty, since a
+ * reference has to say what to ask about.
+ */
+declare function referenceName(reference: Reference): string | null;
+/**
+ * The place a parsed reference says to ask, or null for a name that is
+ * not a reference, or for a reference with a part missing, which says
+ * nothing anybody could answer.
+ */
+declare function referenceOf(name: BoundaryName): Reference | null;
+/**
+ * The reference a name states, or null when the name states a name
+ * rather than where to go and ask.
+ */
+declare function referenceFromName(name: string): Reference | null;
+
+/**
+ * What the deployment running a piece of code fills its variables in
+ * with.
+ *
+ * A queue URL, a function name and a table name only exist once a stack
+ * is deployed, so the source reaches them through a variable and the
+ * template says what that variable is. Every protocol whose name has a
+ * hole in it asks the same two questions here, and whoever knows which
+ * deployment runs the code fills them in.
+ *
+ * The interface is declared next to the protocols because a protocol
+ * has to ask without knowing what a summary is. `@suss/behavioral-ir`
+ * works the values out from a set of summaries.
+ */
+
+interface Deployment {
+    /**
+     * Which variable a reference asks about, or null when what settles it
+     * is an argument a caller passes rather than anything the deployment
+     * says.
+     */
+    variableFor(reference: Reference): string | null;
+    /**
+     * The string this deployment sets that variable to. Null when it sets
+     * nothing, and null when two deployments of this code set it to
+     * different strings, since picking one of two would be a guess.
+     */
+    setTo(reference: Reference): string | null;
+    /**
+     * The declared resource this deployment wires that variable to, by
+     * the name the resource is declared under. A template that writes
+     * `!Ref ArchiveWorker` says which unit an invoke reaches without ever
+     * writing the deployed function's name, and that logical id is what
+     * the unit's own summary is keyed by.
+     */
+    pointsAt(reference: Reference): string | null;
+}
+/** A deployment that settles nothing, for a run with no template in it. */
+declare const NOTHING_DEPLOYED: Deployment;
 
 /**
  * Comparing two TypeShapes structurally.
@@ -123,6 +272,16 @@ interface BoundaryBehavior<S extends {
      * does not apply, and unknown means this declaration cannot settle it.
      */
     servesRequest?(semantics: S, method: string, path: string): MatchResult;
+    /**
+     * Whether every request this boundary takes falls inside a pattern
+     * something else was registered for. Middleware registered for
+     * `/v1/*` runs for `/v1/tenants/{id}` and not for `/health`, so
+     * composing it into a unit asks this first.
+     *
+     * A protocol whose boundaries no pattern addresses leaves this
+     * undefined, and nothing registered with a pattern reaches them.
+     */
+    withinScope?(semantics: S, scope: string): boolean;
     /**
      * The same boundary with a name the deployment fills in put in.
      *
@@ -131,16 +290,25 @@ interface BoundaryBehavior<S extends {
      * the code. Both parts have to be in before anybody can see that the
      * two sides describe one boundary.
      *
-     * `deployedAs` is already scoped to the unit this boundary belongs to.
-     * A protocol asks for a variable and gets back what this deployment
-     * sets it to, or null. Return null to leave the boundary as it is,
+     * `deployment` is already scoped to the unit this boundary belongs
+     * to. A protocol hands over the reference its name states and gets
+     * back what fills it in, or null. Return null to leave it as it is,
      * which is right whenever nothing needs filling in or nothing can
      * fill it.
      *
      * A protocol whose names are settled in the source leaves this
      * undefined.
      */
-    groundName?(semantics: S, deployedAs: (variable: string) => string | null): S | null;
+    groundName?(semantics: S, deployment: Deployment): S | null;
+    /**
+     * Where this boundary's name says to go and ask, when it says that
+     * rather than a name. A caller that has to explain why two sides did
+     * not meet reads it to say which input would settle them.
+     *
+     * A protocol that defines `groundName` defines this too, and the
+     * same reference is what `groundName` hands over.
+     */
+    nameReference?(semantics: S): Reference | null;
     /**
      * Whether a provider produces a status and a body that a consumer
      * reads back. Every protocol has to state this, so that one added
@@ -195,6 +363,15 @@ type BusIdentityKey = `bus:${MessageBusSemantics["messageBus"]} ${string}` & {
     readonly [IdentityKeyBrand]: "bus";
 };
 declare function busIdentityKey(messageBus: MessageBusSemantics["messageBus"], subject: string): BusIdentityKey;
+/**
+ * `unit:platform name`, the key an invoker and the unit it invokes pair
+ * on. The platform stays in because two clouds can each deploy
+ * something called `Worker` and they are not the same thing.
+ */
+type UnitIdentityKey = `unit:${DeployableUnit["deploymentTarget"]} ${string}` & {
+    readonly [IdentityKeyBrand]: "unit";
+};
+declare function unitIdentityKey(deploymentTarget: DeployableUnit["deploymentTarget"], instanceName: string): UnitIdentityKey;
 /** `metric:system type`, the key both sides of a metric pair on. */
 type MetricIdentityKey = `metric:${string} ${string}` & {
     readonly [IdentityKeyBrand]: "metric";
@@ -208,6 +385,25 @@ declare const MetricSemanticsSchema: z.ZodObject<{
 }, z.core.$strip>;
 type MetricSemantics = z.infer<typeof MetricSemanticsSchema>;
 
+/**
+ * `instanceName` is nullable here and required on the unit itself,
+ * because only the provider always knows the name. A call that works
+ * its callee out at run time still happened, and recording it with no
+ * name says so without pairing it against everything.
+ */
+declare const UnitInvocationSemanticsSchema: z.ZodObject<{
+    deploymentTarget: z.ZodEnum<{
+        lambda: "lambda";
+        "ecs-task": "ecs-task";
+        container: "container";
+        "k8s-deployment": "k8s-deployment";
+        worker: "worker";
+    }>;
+    name: z.ZodLiteral<"unit-invocation">;
+    instanceName: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type UnitInvocationSemantics = z.infer<typeof UnitInvocationSemanticsSchema>;
+
 /**
  * A boundary binding read as OpenTelemetry attributes.
  *
@@ -242,6 +438,17 @@ declare function semconvAttributes(binding: BoundaryBinding): Record<string, str
  * rather than in either checker.
  */
 
+/**
+ * Whether a binding is of one protocol, narrowed to that protocol's
+ * own semantics when it is. A caller reaching through the binding to
+ * compare the name by hand gets `string | undefined` and no narrowing,
+ * so a name that no protocol uses compiles and quietly never matches.
+ */
+declare function bindingIs<N extends Semantics["name"]>(binding: BoundaryBinding | null | undefined, name: N): binding is BoundaryBinding & {
+    semantics: Extract<Semantics, {
+        name: N;
+    }>;
+};
 declare function boundaryKey(binding: BoundaryBinding): string | null;
 /**
  * The binding with any filesystem path its semantics state rewritten.
@@ -258,7 +465,23 @@ declare function withRewrittenPaths(binding: BoundaryBinding, rewrite: (path: st
  * Every protocol that has such a name says how to fill it in, and one
  * whose names are settled in the source keys exactly as before.
  */
-declare function groundedPairingKey(binding: BoundaryBinding, deployedAs: (variable: string) => string | null): string | null;
+declare function groundedPairingKey(binding: BoundaryBinding, deployment: Deployment): string | null;
+/**
+ * The same boundary, with whatever the deployment fills in put in.
+ *
+ * Everything that reads a boundary's name for a person to see goes
+ * through here first: the pairing pass, the drafter that writes an
+ * intent document, and the intent checker that reads one back. A step
+ * only one of them took would have the drafter write a name the
+ * checker then argued with.
+ */
+declare function groundBinding(binding: BoundaryBinding, deployment: Deployment): BoundaryBinding;
+/**
+ * Where this boundary's name says to go and ask, or null when the
+ * source stated a name outright. A report that has to say why two
+ * sides did not meet reads it to say which input would settle them.
+ */
+declare function nameReference(binding: BoundaryBinding): Reference | null;
 declare function pairingKey(binding: BoundaryBinding): string | null;
 declare function semanticsAgree(a: Semantics, b: Semantics): boolean;
 declare function boundaryLabel(binding: BoundaryBinding): string | null;
@@ -282,115 +505,58 @@ declare function reportsUnpairedItself(binding: BoundaryBinding): boolean;
  * unknown means it does, but this declaration cannot settle the question.
  */
 declare function servesRequest(binding: BoundaryBinding, method: string, path: string): MatchResult | null;
-
-/**
- * The boundary-name syntax, parsed and printed in one place.
- *
- * A name in a summary means one of three things, told apart by the
- * braces alone: a literal (`orders-v1`), a pattern with deploy-time
- * holes (`{stage}-orders-v1`), or a reference saying where to go and
- * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
- * disagree about which is which, and a second printer can spell a
- * value this one cannot read back, so everything that touches the
- * braces calls this module: `parseBoundaryName` and
- * `boundaryNameString` are the two directions, and the helpers below
- * are views over them. The package README tells the longer story,
- * including why REST route paths and message-bus channels stay apart.
- */
-/** One piece of a pattern: text the writer stated, or a hole. */
-type NamePart = {
-    type: "text";
-    text: string;
-} | {
-    type: "hole";
-    label: string;
-};
 /**
- * What a name string means. A `reference` keeps its raw dot-separated
- * path, and `referenceOf` is the view that checks the parts are all
- * present, so a malformed spelling still classifies as a reference and
- * still pairs with nothing.
+ * Whether a wrapper registered for `scope` runs for this boundary.
+ * False for a protocol whose boundaries no pattern addresses, so a
+ * scoped registration reaches nothing it cannot be shown to cover.
  */
-type BoundaryName = {
-    type: "literal";
-    value: string;
-} | {
-    type: "pattern";
-    parts: NamePart[];
-} | {
-    type: "reference";
-    path: string[];
-};
-/** What a name string means. The exact inverse of `boundaryNameString`. */
-declare function parseBoundaryName(name: string): BoundaryName;
-/** The one serializer. Everything a summary spells goes through here. */
-declare function boundaryNameString(name: BoundaryName): string;
-/**
- * How a hole is spelled. A reader that assembles a pattern a part at a
- * time, the way the adapter's name reader does, mints each hole here
- * so the spelling cannot drift from the parse above.
- */
-declare function patternHole(label: string): string;
-/**
- * The name a CloudFormation `Fn::Sub` value states. The array form
- * takes its template from the first element, and the variable map only
- * says where a substitution comes from, which does not change the name.
- */
-declare function namePatternFromSub(value: unknown): string | null;
-/**
- * Whether a name says only that somebody else knows it. A wrapper that
- * takes its bucket as an argument states `{location.bucket}` and
- * nothing more, which says which parameter to ask rather than which
- * bucket. A name like that agrees with nothing until something grounds
- * it, since otherwise it would agree with every name there is.
- */
-declare function namesNothing(name: string): boolean;
-/** Whether a name has anything a source left for deploy time to fill. */
-declare function hasNameHole(name: string): boolean;
-/**
- * The form two patterns are compared in: every hole reduced to the same
- * token, since the two sides pick their own name for the parameter.
- */
-declare function namePatternKey(name: string): string;
-/** How much of a name the writer stated rather than left for deploy time. */
-declare function fixedTextLength(name: string): number;
-/**
- * Whether two names are the same name. Two patterns agree when their
- * fixed parts line up, since a hole on one side meets a hole on the
- * other. A pattern and a concrete name agree when the fixed parts are
- * where the pattern says they are, which is what happens when one side
- * hardcoded what the other parameterized. A reference agrees with
- * nothing on either side.
- */
-declare function namesAgree(a: string, b: string): boolean;
-/** Where a reference says to go and ask. */
-interface Reference {
-    /**
-     * The value the code starts from: a parameter of the unit the
-     * reference was written in, or a variable the deployment sets. Which
-     * of those it is depends on the unit's inputs, so the reader that
-     * grounds a reference decides, not the string.
-     */
-    root: string;
-    /** The fields to read inside it, outermost first. */
-    fields: string[];
-}
-/**
- * How a reference is written. Null when a part of it is empty, since a
- * reference has to say what to ask about.
- */
-declare function referenceName(reference: Reference): string | null;
+declare function withinScope(binding: BoundaryBinding, scope: string): boolean;
+
 /**
- * The place a parsed reference says to ask, or null for a name that is
- * not a reference, or for a reference with a part missing, which says
- * nothing anybody could answer.
+ * How somebody spells a boundary they want to talk about, and whether
+ * what they wrote picks out a given one.
+ *
+ * The words get cut into tokens, the boundary does too, and a boundary
+ * matches when it has every token somebody wrote. So
+ * `aws.dynamodb:editions` matches the table and every index on it, and
+ * adding `#by-publication` narrows it to the one index.
+ *
+ * `suss ask`, `suss check --at` and an intent document that says which
+ * store a write reaches all read this, so the question and the
+ * assertion are spelled and resolved the same way.
  */
-declare function referenceOf(name: BoundaryName): Reference | null;
+
 /**
- * The reference a name states, or null when the name states a name
- * rather than where to go and ask.
- */
-declare function referenceFromName(name: string): Reference | null;
+ * The name inside a fully-qualified cloud resource id, and anything
+ * else unchanged.
+ *
+ * `arn:aws:lambda:us-east-1:1234:function:prod-worker` and
+ * `projects/p/locations/l/functions/prod-worker` say the same thing as
+ * `prod-worker` plus an account and a region. Keeping the whole string
+ * makes one deployment's spelling of a resource disagree with
+ * another's, so every reader that meets one reduces it here and the two
+ * sides compare the part they can both know. A Lambda ARN's trailing
+ * alias or version comes off with the rest: the function is the
+ * boundary whichever published copy a call reaches.
+ */
+declare function resourceNameIn(spelling: string): string;
+/**
+ * The words in a boundary spelling. Separators between parts of a name
+ * are cut, and the characters inside one part are left alone, so
+ * `by-publication` stays one word and `{id}` and `:id` both come out as
+ * `id`.
+ */
+declare function spellingTokens(text: string): string[];
+/** Every word this boundary can be asked about by. */
+declare function bindingTokens(binding: BoundaryBinding): Set<string>;
+/**
+ * Whether what somebody typed is the whole of this boundary's name
+ * rather than part of it. `POST /articles` is exactly the collection
+ * route and only part of `POST /articles/{slug}/comments`.
+ */
+declare function namesBoundaryExactly(subject: string, binding: BoundaryBinding): boolean;
+/** Whether what somebody typed picks out this boundary. */
+declare function namesBoundary(subject: string, binding: BoundaryBinding): boolean;
 
 /**
  * Deciding when two message-bus channel strings mean the same thing.
@@ -474,6 +640,37 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * What a unit does at a boundary, in the words `suss ask` asks with.
+ *
+ * `what writes postgresql:invoices` is the question and "this outcome
+ * writes postgresql:invoices" is the assertion, so the report, the
+ * question parser and an intent doc all have to spell the verbs the
+ * same way. They are here rather than beside any one of them.
+ *
+ * `provides` is the unit's own boundary; `reads`, `writes` and
+ * `invokes` are what a call site does at somebody else's. Calling a
+ * deployed unit by name is one act, so it gets a verb of its own.
+ */
+
+declare const RelationSchema: z.ZodEnum<{
+    provides: "provides";
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type Relation = z.infer<typeof RelationSchema>;
+/**
+ * The verbs an effect can have. A boundary a unit serves is not an
+ * effect of the unit, so `provides` is not one of them.
+ */
+declare const EffectRelationSchema: z.ZodEnum<{
+    reads: "reads";
+    writes: "writes";
+    invokes: "invokes";
+}>;
+type EffectRelation = z.infer<typeof EffectRelationSchema>;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -710,6 +907,18 @@ declare function runtimeConfigBinding(opts: {
     deploymentTarget: DeployableUnit["deploymentTarget"];
     instanceName: string;
 }): BoundaryBinding;
+/**
+ * Build a unit-invocation binding, the boundary between a deployed unit
+ * and whatever calls it by name. Transport is `"invoke"` because the
+ * call goes through the platform's own invoke API whichever cloud runs
+ * the unit.
+ */
+declare function unitInvocationBinding(opts: {
+    recognition: string;
+    deploymentTarget: DeployableUnit["deploymentTarget"];
+    /** Null when this source does not say which unit it invokes. */
+    instanceName: string | null;
+}): BoundaryBinding;
 /**
  * Build a storage binding, the side of a store that both a schema
  * reader and a call site can spell. `transport` defaults to the store's
@@ -748,4 +957,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, statesAnOrigin, storageBinding, validateRule, withRewrittenPaths };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };