@suss/ir-core 0.21.0 → 0.21.1

package/dist/index.d.cts

@@ -2,6 +2,155 @@ import { z } from 'zod';
 import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-Dn1AzzWd.cjs';
 export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as storageContainerLabel, y as storageLabel, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.cjs';
 
+/**
+ * The boundary-name syntax, parsed and printed in one place.
+ *
+ * A name in a summary means one of three things, told apart by the
+ * braces alone: a literal (`orders-v1`), a pattern with deploy-time
+ * holes (`{stage}-orders-v1`), or a reference saying where to go and
+ * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
+ * disagree about which is which, and a second printer can spell a
+ * value this one cannot read back, so everything that touches the
+ * braces calls this module: `parseBoundaryName` and
+ * `boundaryNameString` are the two directions, and the helpers below
+ * are views over them. The package README tells the longer story,
+ * including why REST route paths and message-bus channels stay apart.
+ */
+/** One piece of a pattern: text the writer stated, or a hole. */
+type NamePart = {
+    type: "text";
+    text: string;
+} | {
+    type: "hole";
+    label: string;
+};
+/**
+ * What a name string means. A `reference` keeps its raw dot-separated
+ * path, and `referenceOf` is the view that checks the parts are all
+ * present, so a malformed spelling still classifies as a reference and
+ * still pairs with nothing.
+ */
+type BoundaryName = {
+    type: "literal";
+    value: string;
+} | {
+    type: "pattern";
+    parts: NamePart[];
+} | {
+    type: "reference";
+    path: string[];
+};
+/** What a name string means. The exact inverse of `boundaryNameString`. */
+declare function parseBoundaryName(name: string): BoundaryName;
+/** The one serializer. Everything a summary spells goes through here. */
+declare function boundaryNameString(name: BoundaryName): string;
+/**
+ * How a hole is spelled. A reader that assembles a pattern a part at a
+ * time, the way the adapter's name reader does, mints each hole here
+ * so the spelling cannot drift from the parse above.
+ */
+declare function patternHole(label: string): string;
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/**
+ * Whether a name says only that somebody else knows it. A wrapper that
+ * takes its bucket as an argument states `{location.bucket}` and
+ * nothing more, which says which parameter to ask rather than which
+ * bucket. A name like that agrees with nothing until something grounds
+ * it, since otherwise it would agree with every name there is.
+ */
+declare function namesNothing(name: string): boolean;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/** How much of a name the writer stated rather than left for deploy time. */
+declare function fixedTextLength(name: string): number;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized. A reference agrees with
+ * nothing on either side.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+/** Where a reference says to go and ask. */
+interface Reference {
+    /**
+     * The value the code starts from: a parameter of the unit the
+     * reference was written in, or a variable the deployment sets. Which
+     * of those it is depends on the unit's inputs, so the reader that
+     * grounds a reference decides, not the string.
+     */
+    root: string;
+    /** The fields to read inside it, outermost first. */
+    fields: string[];
+}
+/**
+ * How a reference is written. Null when a part of it is empty, since a
+ * reference has to say what to ask about.
+ */
+declare function referenceName(reference: Reference): string | null;
+/**
+ * The place a parsed reference says to ask, or null for a name that is
+ * not a reference, or for a reference with a part missing, which says
+ * nothing anybody could answer.
+ */
+declare function referenceOf(name: BoundaryName): Reference | null;
+/**
+ * The reference a name states, or null when the name states a name
+ * rather than where to go and ask.
+ */
+declare function referenceFromName(name: string): Reference | null;
+
+/**
+ * What the deployment running a piece of code fills its variables in
+ * with.
+ *
+ * A queue URL, a function name and a table name only exist once a stack
+ * is deployed, so the source reaches them through a variable and the
+ * template says what that variable is. Every protocol whose name has a
+ * hole in it asks the same two questions here, and whoever knows which
+ * deployment runs the code fills them in.
+ *
+ * The interface is declared next to the protocols because a protocol
+ * has to ask without knowing what a summary is. `@suss/behavioral-ir`
+ * works the values out from a set of summaries.
+ */
+
+interface Deployment {
+    /**
+     * Which variable a reference asks about, or null when what settles it
+     * is an argument a caller passes rather than anything the deployment
+     * says.
+     */
+    variableFor(reference: Reference): string | null;
+    /**
+     * The string this deployment sets that variable to. Null when it sets
+     * nothing, and null when two deployments of this code set it to
+     * different strings, since picking one of two would be a guess.
+     */
+    setTo(reference: Reference): string | null;
+    /**
+     * The declared resource this deployment wires that variable to, by
+     * the name the resource is declared under. A template that writes
+     * `!Ref ArchiveWorker` says which unit an invoke reaches without ever
+     * writing the deployed function's name, and that logical id is what
+     * the unit's own summary is keyed by.
+     */
+    pointsAt(reference: Reference): string | null;
+}
+/** A deployment that settles nothing, for a run with no template in it. */
+declare const NOTHING_DEPLOYED: Deployment;
+
 /**
  * Comparing two TypeShapes structurally.
  *
@@ -141,16 +290,25 @@ interface BoundaryBehavior<S extends {
      * the code. Both parts have to be in before anybody can see that the
      * two sides describe one boundary.
      *
-     * `deployedAs` is already scoped to the unit this boundary belongs to.
-     * A protocol asks for a variable and gets back what this deployment
-     * sets it to, or null. Return null to leave the boundary as it is,
+     * `deployment` is already scoped to the unit this boundary belongs
+     * to. A protocol hands over the reference its name states and gets
+     * back what fills it in, or null. Return null to leave it as it is,
      * which is right whenever nothing needs filling in or nothing can
      * fill it.
      *
      * A protocol whose names are settled in the source leaves this
      * undefined.
      */
-    groundName?(semantics: S, deployedAs: (variable: string) => string | null): S | null;
+    groundName?(semantics: S, deployment: Deployment): S | null;
+    /**
+     * Where this boundary's name says to go and ask, when it says that
+     * rather than a name. A caller that has to explain why two sides did
+     * not meet reads it to say which input would settle them.
+     *
+     * A protocol that defines `groundName` defines this too, and the
+     * same reference is what `groundName` hands over.
+     */
+    nameReference?(semantics: S): Reference | null;
     /**
      * Whether a provider produces a status and a body that a consumer
      * reads back. Every protocol has to state this, so that one added
@@ -307,7 +465,23 @@ declare function withRewrittenPaths(binding: BoundaryBinding, rewrite: (path: st
  * Every protocol that has such a name says how to fill it in, and one
  * whose names are settled in the source keys exactly as before.
  */
-declare function groundedPairingKey(binding: BoundaryBinding, deployedAs: (variable: string) => string | null): string | null;
+declare function groundedPairingKey(binding: BoundaryBinding, deployment: Deployment): string | null;
+/**
+ * The same boundary, with whatever the deployment fills in put in.
+ *
+ * Everything that reads a boundary's name for a person to see goes
+ * through here first: the pairing pass, the drafter that writes an
+ * intent document, and the intent checker that reads one back. A step
+ * only one of them took would have the drafter write a name the
+ * checker then argued with.
+ */
+declare function groundBinding(binding: BoundaryBinding, deployment: Deployment): BoundaryBinding;
+/**
+ * Where this boundary's name says to go and ask, or null when the
+ * source stated a name outright. A report that has to say why two
+ * sides did not meet reads it to say which input would settle them.
+ */
+declare function nameReference(binding: BoundaryBinding): Reference | null;
 declare function pairingKey(binding: BoundaryBinding): string | null;
 declare function semanticsAgree(a: Semantics, b: Semantics): boolean;
 declare function boundaryLabel(binding: BoundaryBinding): string | null;
@@ -338,115 +512,6 @@ declare function servesRequest(binding: BoundaryBinding, method: string, path: s
  */
 declare function withinScope(binding: BoundaryBinding, scope: string): boolean;
 
-/**
- * The boundary-name syntax, parsed and printed in one place.
- *
- * A name in a summary means one of three things, told apart by the
- * braces alone: a literal (`orders-v1`), a pattern with deploy-time
- * holes (`{stage}-orders-v1`), or a reference saying where to go and
- * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
- * disagree about which is which, and a second printer can spell a
- * value this one cannot read back, so everything that touches the
- * braces calls this module: `parseBoundaryName` and
- * `boundaryNameString` are the two directions, and the helpers below
- * are views over them. The package README tells the longer story,
- * including why REST route paths and message-bus channels stay apart.
- */
-/** One piece of a pattern: text the writer stated, or a hole. */
-type NamePart = {
-    type: "text";
-    text: string;
-} | {
-    type: "hole";
-    label: string;
-};
-/**
- * What a name string means. A `reference` keeps its raw dot-separated
- * path, and `referenceOf` is the view that checks the parts are all
- * present, so a malformed spelling still classifies as a reference and
- * still pairs with nothing.
- */
-type BoundaryName = {
-    type: "literal";
-    value: string;
-} | {
-    type: "pattern";
-    parts: NamePart[];
-} | {
-    type: "reference";
-    path: string[];
-};
-/** What a name string means. The exact inverse of `boundaryNameString`. */
-declare function parseBoundaryName(name: string): BoundaryName;
-/** The one serializer. Everything a summary spells goes through here. */
-declare function boundaryNameString(name: BoundaryName): string;
-/**
- * How a hole is spelled. A reader that assembles a pattern a part at a
- * time, the way the adapter's name reader does, mints each hole here
- * so the spelling cannot drift from the parse above.
- */
-declare function patternHole(label: string): string;
-/**
- * The name a CloudFormation `Fn::Sub` value states. The array form
- * takes its template from the first element, and the variable map only
- * says where a substitution comes from, which does not change the name.
- */
-declare function namePatternFromSub(value: unknown): string | null;
-/**
- * Whether a name says only that somebody else knows it. A wrapper that
- * takes its bucket as an argument states `{location.bucket}` and
- * nothing more, which says which parameter to ask rather than which
- * bucket. A name like that agrees with nothing until something grounds
- * it, since otherwise it would agree with every name there is.
- */
-declare function namesNothing(name: string): boolean;
-/** Whether a name has anything a source left for deploy time to fill. */
-declare function hasNameHole(name: string): boolean;
-/**
- * The form two patterns are compared in: every hole reduced to the same
- * token, since the two sides pick their own name for the parameter.
- */
-declare function namePatternKey(name: string): string;
-/** How much of a name the writer stated rather than left for deploy time. */
-declare function fixedTextLength(name: string): number;
-/**
- * Whether two names are the same name. Two patterns agree when their
- * fixed parts line up, since a hole on one side meets a hole on the
- * other. A pattern and a concrete name agree when the fixed parts are
- * where the pattern says they are, which is what happens when one side
- * hardcoded what the other parameterized. A reference agrees with
- * nothing on either side.
- */
-declare function namesAgree(a: string, b: string): boolean;
-/** Where a reference says to go and ask. */
-interface Reference {
-    /**
-     * The value the code starts from: a parameter of the unit the
-     * reference was written in, or a variable the deployment sets. Which
-     * of those it is depends on the unit's inputs, so the reader that
-     * grounds a reference decides, not the string.
-     */
-    root: string;
-    /** The fields to read inside it, outermost first. */
-    fields: string[];
-}
-/**
- * How a reference is written. Null when a part of it is empty, since a
- * reference has to say what to ask about.
- */
-declare function referenceName(reference: Reference): string | null;
-/**
- * The place a parsed reference says to ask, or null for a name that is
- * not a reference, or for a reference with a part missing, which says
- * nothing anybody could answer.
- */
-declare function referenceOf(name: BoundaryName): Reference | null;
-/**
- * The reference a name states, or null when the name states a name
- * rather than where to go and ask.
- */
-declare function referenceFromName(name: string): Reference | null;
-
 /**
  * How somebody spells a boundary they want to talk about, and whether
  * what they wrote picks out a given one.
@@ -892,4 +957,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };

package/dist/index.d.ts

@@ -2,6 +2,155 @@ import { z } from 'zod';
 import { T as TypeShape, M as MessageBusSemantics, D as DeployableUnit, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-Dn1AzzWd.js';
 export { f as DeployableUnitSchema, E as EVERY_FIELD, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as pathShape, w as routePathAdmits, x as storageContainerLabel, y as storageLabel, z as typeDefinitionKey, A as withDefinitionsInlined } from './schemas-Dn1AzzWd.js';
 
+/**
+ * The boundary-name syntax, parsed and printed in one place.
+ *
+ * A name in a summary means one of three things, told apart by the
+ * braces alone: a literal (`orders-v1`), a pattern with deploy-time
+ * holes (`{stage}-orders-v1`), or a reference saying where to go and
+ * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
+ * disagree about which is which, and a second printer can spell a
+ * value this one cannot read back, so everything that touches the
+ * braces calls this module: `parseBoundaryName` and
+ * `boundaryNameString` are the two directions, and the helpers below
+ * are views over them. The package README tells the longer story,
+ * including why REST route paths and message-bus channels stay apart.
+ */
+/** One piece of a pattern: text the writer stated, or a hole. */
+type NamePart = {
+    type: "text";
+    text: string;
+} | {
+    type: "hole";
+    label: string;
+};
+/**
+ * What a name string means. A `reference` keeps its raw dot-separated
+ * path, and `referenceOf` is the view that checks the parts are all
+ * present, so a malformed spelling still classifies as a reference and
+ * still pairs with nothing.
+ */
+type BoundaryName = {
+    type: "literal";
+    value: string;
+} | {
+    type: "pattern";
+    parts: NamePart[];
+} | {
+    type: "reference";
+    path: string[];
+};
+/** What a name string means. The exact inverse of `boundaryNameString`. */
+declare function parseBoundaryName(name: string): BoundaryName;
+/** The one serializer. Everything a summary spells goes through here. */
+declare function boundaryNameString(name: BoundaryName): string;
+/**
+ * How a hole is spelled. A reader that assembles a pattern a part at a
+ * time, the way the adapter's name reader does, mints each hole here
+ * so the spelling cannot drift from the parse above.
+ */
+declare function patternHole(label: string): string;
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/**
+ * Whether a name says only that somebody else knows it. A wrapper that
+ * takes its bucket as an argument states `{location.bucket}` and
+ * nothing more, which says which parameter to ask rather than which
+ * bucket. A name like that agrees with nothing until something grounds
+ * it, since otherwise it would agree with every name there is.
+ */
+declare function namesNothing(name: string): boolean;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/** How much of a name the writer stated rather than left for deploy time. */
+declare function fixedTextLength(name: string): number;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized. A reference agrees with
+ * nothing on either side.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+/** Where a reference says to go and ask. */
+interface Reference {
+    /**
+     * The value the code starts from: a parameter of the unit the
+     * reference was written in, or a variable the deployment sets. Which
+     * of those it is depends on the unit's inputs, so the reader that
+     * grounds a reference decides, not the string.
+     */
+    root: string;
+    /** The fields to read inside it, outermost first. */
+    fields: string[];
+}
+/**
+ * How a reference is written. Null when a part of it is empty, since a
+ * reference has to say what to ask about.
+ */
+declare function referenceName(reference: Reference): string | null;
+/**
+ * The place a parsed reference says to ask, or null for a name that is
+ * not a reference, or for a reference with a part missing, which says
+ * nothing anybody could answer.
+ */
+declare function referenceOf(name: BoundaryName): Reference | null;
+/**
+ * The reference a name states, or null when the name states a name
+ * rather than where to go and ask.
+ */
+declare function referenceFromName(name: string): Reference | null;
+
+/**
+ * What the deployment running a piece of code fills its variables in
+ * with.
+ *
+ * A queue URL, a function name and a table name only exist once a stack
+ * is deployed, so the source reaches them through a variable and the
+ * template says what that variable is. Every protocol whose name has a
+ * hole in it asks the same two questions here, and whoever knows which
+ * deployment runs the code fills them in.
+ *
+ * The interface is declared next to the protocols because a protocol
+ * has to ask without knowing what a summary is. `@suss/behavioral-ir`
+ * works the values out from a set of summaries.
+ */
+
+interface Deployment {
+    /**
+     * Which variable a reference asks about, or null when what settles it
+     * is an argument a caller passes rather than anything the deployment
+     * says.
+     */
+    variableFor(reference: Reference): string | null;
+    /**
+     * The string this deployment sets that variable to. Null when it sets
+     * nothing, and null when two deployments of this code set it to
+     * different strings, since picking one of two would be a guess.
+     */
+    setTo(reference: Reference): string | null;
+    /**
+     * The declared resource this deployment wires that variable to, by
+     * the name the resource is declared under. A template that writes
+     * `!Ref ArchiveWorker` says which unit an invoke reaches without ever
+     * writing the deployed function's name, and that logical id is what
+     * the unit's own summary is keyed by.
+     */
+    pointsAt(reference: Reference): string | null;
+}
+/** A deployment that settles nothing, for a run with no template in it. */
+declare const NOTHING_DEPLOYED: Deployment;
+
 /**
  * Comparing two TypeShapes structurally.
  *
@@ -141,16 +290,25 @@ interface BoundaryBehavior<S extends {
      * the code. Both parts have to be in before anybody can see that the
      * two sides describe one boundary.
      *
-     * `deployedAs` is already scoped to the unit this boundary belongs to.
-     * A protocol asks for a variable and gets back what this deployment
-     * sets it to, or null. Return null to leave the boundary as it is,
+     * `deployment` is already scoped to the unit this boundary belongs
+     * to. A protocol hands over the reference its name states and gets
+     * back what fills it in, or null. Return null to leave it as it is,
      * which is right whenever nothing needs filling in or nothing can
      * fill it.
      *
      * A protocol whose names are settled in the source leaves this
      * undefined.
      */
-    groundName?(semantics: S, deployedAs: (variable: string) => string | null): S | null;
+    groundName?(semantics: S, deployment: Deployment): S | null;
+    /**
+     * Where this boundary's name says to go and ask, when it says that
+     * rather than a name. A caller that has to explain why two sides did
+     * not meet reads it to say which input would settle them.
+     *
+     * A protocol that defines `groundName` defines this too, and the
+     * same reference is what `groundName` hands over.
+     */
+    nameReference?(semantics: S): Reference | null;
     /**
      * Whether a provider produces a status and a body that a consumer
      * reads back. Every protocol has to state this, so that one added
@@ -307,7 +465,23 @@ declare function withRewrittenPaths(binding: BoundaryBinding, rewrite: (path: st
  * Every protocol that has such a name says how to fill it in, and one
  * whose names are settled in the source keys exactly as before.
  */
-declare function groundedPairingKey(binding: BoundaryBinding, deployedAs: (variable: string) => string | null): string | null;
+declare function groundedPairingKey(binding: BoundaryBinding, deployment: Deployment): string | null;
+/**
+ * The same boundary, with whatever the deployment fills in put in.
+ *
+ * Everything that reads a boundary's name for a person to see goes
+ * through here first: the pairing pass, the drafter that writes an
+ * intent document, and the intent checker that reads one back. A step
+ * only one of them took would have the drafter write a name the
+ * checker then argued with.
+ */
+declare function groundBinding(binding: BoundaryBinding, deployment: Deployment): BoundaryBinding;
+/**
+ * Where this boundary's name says to go and ask, or null when the
+ * source stated a name outright. A report that has to say why two
+ * sides did not meet reads it to say which input would settle them.
+ */
+declare function nameReference(binding: BoundaryBinding): Reference | null;
 declare function pairingKey(binding: BoundaryBinding): string | null;
 declare function semanticsAgree(a: Semantics, b: Semantics): boolean;
 declare function boundaryLabel(binding: BoundaryBinding): string | null;
@@ -338,115 +512,6 @@ declare function servesRequest(binding: BoundaryBinding, method: string, path: s
  */
 declare function withinScope(binding: BoundaryBinding, scope: string): boolean;
 
-/**
- * The boundary-name syntax, parsed and printed in one place.
- *
- * A name in a summary means one of three things, told apart by the
- * braces alone: a literal (`orders-v1`), a pattern with deploy-time
- * holes (`{stage}-orders-v1`), or a reference saying where to go and
- * ask (`{location.bucket}`, `{ORDER_TABLE}`). A second parser can
- * disagree about which is which, and a second printer can spell a
- * value this one cannot read back, so everything that touches the
- * braces calls this module: `parseBoundaryName` and
- * `boundaryNameString` are the two directions, and the helpers below
- * are views over them. The package README tells the longer story,
- * including why REST route paths and message-bus channels stay apart.
- */
-/** One piece of a pattern: text the writer stated, or a hole. */
-type NamePart = {
-    type: "text";
-    text: string;
-} | {
-    type: "hole";
-    label: string;
-};
-/**
- * What a name string means. A `reference` keeps its raw dot-separated
- * path, and `referenceOf` is the view that checks the parts are all
- * present, so a malformed spelling still classifies as a reference and
- * still pairs with nothing.
- */
-type BoundaryName = {
-    type: "literal";
-    value: string;
-} | {
-    type: "pattern";
-    parts: NamePart[];
-} | {
-    type: "reference";
-    path: string[];
-};
-/** What a name string means. The exact inverse of `boundaryNameString`. */
-declare function parseBoundaryName(name: string): BoundaryName;
-/** The one serializer. Everything a summary spells goes through here. */
-declare function boundaryNameString(name: BoundaryName): string;
-/**
- * How a hole is spelled. A reader that assembles a pattern a part at a
- * time, the way the adapter's name reader does, mints each hole here
- * so the spelling cannot drift from the parse above.
- */
-declare function patternHole(label: string): string;
-/**
- * The name a CloudFormation `Fn::Sub` value states. The array form
- * takes its template from the first element, and the variable map only
- * says where a substitution comes from, which does not change the name.
- */
-declare function namePatternFromSub(value: unknown): string | null;
-/**
- * Whether a name says only that somebody else knows it. A wrapper that
- * takes its bucket as an argument states `{location.bucket}` and
- * nothing more, which says which parameter to ask rather than which
- * bucket. A name like that agrees with nothing until something grounds
- * it, since otherwise it would agree with every name there is.
- */
-declare function namesNothing(name: string): boolean;
-/** Whether a name has anything a source left for deploy time to fill. */
-declare function hasNameHole(name: string): boolean;
-/**
- * The form two patterns are compared in: every hole reduced to the same
- * token, since the two sides pick their own name for the parameter.
- */
-declare function namePatternKey(name: string): string;
-/** How much of a name the writer stated rather than left for deploy time. */
-declare function fixedTextLength(name: string): number;
-/**
- * Whether two names are the same name. Two patterns agree when their
- * fixed parts line up, since a hole on one side meets a hole on the
- * other. A pattern and a concrete name agree when the fixed parts are
- * where the pattern says they are, which is what happens when one side
- * hardcoded what the other parameterized. A reference agrees with
- * nothing on either side.
- */
-declare function namesAgree(a: string, b: string): boolean;
-/** Where a reference says to go and ask. */
-interface Reference {
-    /**
-     * The value the code starts from: a parameter of the unit the
-     * reference was written in, or a variable the deployment sets. Which
-     * of those it is depends on the unit's inputs, so the reader that
-     * grounds a reference decides, not the string.
-     */
-    root: string;
-    /** The fields to read inside it, outermost first. */
-    fields: string[];
-}
-/**
- * How a reference is written. Null when a part of it is empty, since a
- * reference has to say what to ask about.
- */
-declare function referenceName(reference: Reference): string | null;
-/**
- * The place a parsed reference says to ask, or null for a name that is
- * not a reference, or for a reference with a part missing, which says
- * nothing anybody could answer.
- */
-declare function referenceOf(name: BoundaryName): Reference | null;
-/**
- * The reference a name states, or null when the name states a name
- * rather than where to go and ask.
- */
-declare function referenceFromName(name: string): Reference | null;
-
 /**
  * How somebody spells a boundary they want to talk about, and whether
  * what they wrote picks out a given one.
@@ -892,4 +957,4 @@ declare function metricBinding(opts: {
     metricType: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundaryName, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, DeployableUnit, type Deployment, type DispatchTable, type EffectRelation, EffectRelationSchema, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type MetricIdentityKey, type MetricSemantics, MetricSemanticsSchema, NOTHING_DEPLOYED, type NamePart, type ParsedChannel, type Reference, type Relation, RelationSchema, Semantics, type SemconvAttribute, type SemconvMapping, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, type UnitIdentityKey, type UnitInvocationSemantics, UnitInvocationSemanticsSchema, applySuppressionsToFindings, bindingIs, bindingTokens, bodyShapesMatch, boundaryKey, boundaryLabel, boundaryNameString, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fixedTextLength, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, groundBinding, groundedPairingKey, hasNameHole, isGraphqlOperationBinding, messageBusBinding, metricBinding, metricIdentityKey, namePatternFromSub, namePatternKey, nameReference, namesAgree, namesBoundary, namesBoundaryExactly, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseBoundaryName, parseChannel, pathAfterOrigin, patternHole, referenceFromName, referenceName, referenceOf, reportsUnpairedItself, resourceNameIn, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, semconvAttributes, servesRequest, spellingTokens, statesAnOrigin, storageBinding, unitIdentityKey, unitInvocationBinding, validateRule, withRewrittenPaths, withinScope };