@suss/ir-core 0.3.1 → 0.4.0

package/dist/index.d.cts

@@ -1,69 +1,217 @@
 import { z } from 'zod';
-import { TypeShape, BoundaryBindingSchema, ConfidenceInfoSchema, ConfidenceLevelSchema, ConfidenceSourceSchema, CorroborationSchema, DeployableUnitSchema, SemanticsSchema, SourceLocationSchema } from './schemas.cjs';
-export { FunctionCallSemanticsSchema, GraphqlOperationSemanticsSchema, GraphqlResolverSemanticsSchema, MessageBusSemanticsSchema, RestSemanticsSchema, RuntimeConfigSemanticsSchema, StorageRelationalSemanticsSchema, TypeShapeSchema, typeDefinitionKey, withDefinitionsInlined } from './schemas.cjs';
+import { T as TypeShape, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, M as MessageBusTechnology } from './schemas-BWvfkxSH.cjs';
+export { D as DeployableUnit, e as DeployableUnitSchema, F as FunctionCallSemantics, f as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, g as GraphqlOperationSemanticsSchema, h as GraphqlResolverSemantics, i as GraphqlResolverSemanticsSchema, j as MessageBusSemantics, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageRelationalSemantics, q as StorageRelationalSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-BWvfkxSH.cjs';
 
 /**
- * Normalize a route path to a canonical form for matching.
+ * Comparing two TypeShapes structurally.
  *
- * - Converts Express-style params (`:id`) to brace-style (`{id}`)
- * - Strips trailing slashes (except bare `/`)
- * - Lowercases the static segments (params stay case-sensitive)
+ * Both checkers do this. The behavioural checker compares a provider
+ * body against a declared contract, and the intent checker compares a
+ * code body against declared intent, and the two have to reach the same
+ * verdict for the same pair. The comparison is here, next to the
+ * TypeShape it works on, so neither checker owns it and the two cannot
+ * drift apart.
+ *
+ * The comparison is asymmetric, and the answer has three values rather
+ * than two. `unknown` is what keeps a shape nobody can see into from
+ * being reported as agreement.
+ */
+
+/**
+ * A comparison result with three values:
+ *   - "match": `actual` satisfies `declared`
+ *   - "nomatch": there is a concrete, verifiable incompatibility
+ *   - "unknown": uncertainty that would otherwise mask a mismatch
+ *                (spreads, refs, unknown shapes)
+ */
+type MatchResult = "match" | "nomatch" | "unknown";
+/**
+ * Compare an actual body against a declared body and say whether the
+ * actual satisfies the declared.
+ *
+ * The two sides are not interchangeable. `actual` is the value that gets
+ * produced (a response body, a return value), and `declared` is the
+ * contract it has to conform to. `unknown` is a soft signal, and the
+ * caller decides whether to show it.
+ */
+declare function bodyShapesMatch(actual: TypeShape, declared: TypeShape): MatchResult;
+
+/**
+ * The contract a boundary protocol implements.
+ *
+ * A protocol (REST, message-bus, one side of GraphQL) is a single
+ * module in this directory. Its schema says what the identity fields
+ * are, its behavior says how those fields key and agree, and the two
+ * travel together so neither can be added without the other. Nothing
+ * outside a protocol's own module decides how its boundaries behave.
+ *
+ * These definitions ship with ir-core rather than with the packs,
+ * because a published summary has to mean the same thing to a reader
+ * who never installed the pack that wrote it. If a pack needs a
+ * protocol nobody has defined yet, add a module here.
  */
-declare function normalizePath(path: string): string;
+
 /**
- * Compute a stable string key from a boundary binding for grouping.
- * Dispatches on `semantics.name`:
- *   - `rest` → `"METHOD /normalized/path"` (null if method or path empty)
- *   - `graphql-resolver` → `"gql:<TypeName>.<fieldName>"` (null when
- *     either is empty, which is how a resolver says the source never
- *     named the field it answers)
- *   - `message-bus` → `"bus:<messageBus> <subject>"` (null if the
- *     subject is empty)
- *   - `function-call` → `"fn:<package>::<exportPath>"` when both
- *     `package` and `exportPath` are set; other in-process function-call
- *     units (intra-repo components, bare handlers) return null.
- *   - everything else → null
+ * How one semantics variant keys its boundaries and pairs them up. Each
+ * variant fills this in inside its own module, and nothing else in the
+ * tree gets a say in how a boundary keys or agrees.
  */
+interface BoundaryBehavior<S extends {
+    name: string;
+}> {
+    /** Null when the source never gave the boundary a name. */
+    identityKey(semantics: S): string | null;
+    /**
+     * The bucket the pairing pass groups by. Defaults to `identityKey`.
+     * Define it where one side can know more than its counterpart, and put
+     * only the shared part in the bucket: a `"*"` REST route has to meet
+     * consumers that each specify one method, so REST buckets by path
+     * alone. Whatever the bucket leaves out, `sidesAgree` has to compare.
+     */
+    pairingKey?(semantics: S): string | null;
+    /**
+     * Settles whatever `pairingKey` left out of the bucket. A variant that
+     * does not define it always agrees.
+     */
+    sidesAgree?(a: S, b: S): boolean;
+    /** The line a reader sees for this boundary. Defaults to `identityKey`. */
+    displayLabel?(semantics: S): string | null;
+    /**
+     * The first protocol whose `claims` returns true normalizes a
+     * hand-written suppression boundary, and a string nobody claims is
+     * compared byte for byte. A protocol whose keys are exact declares
+     * nothing here and stays verbatim.
+     */
+    ruleBoundary?: {
+        claims(raw: string): boolean;
+        normalize(raw: string): string;
+    };
+    /**
+     * A protocol whose boundaries have no URL leaves this undefined, which
+     * is different from an "unknown" result: undefined means the question
+     * does not apply, and unknown means this declaration cannot settle it.
+     */
+    servesRequest?(semantics: S, method: string, path: string): MatchResult;
+    /**
+     * Whether a provider produces a status and a body that a consumer
+     * reads back. Every protocol has to state this, so that one added
+     * later says what it is instead of landing in the HTTP-style checks
+     * because nobody remembered to exclude it.
+     */
+    exchangesHttpResponses: boolean;
+    /**
+     * Whether this protocol's own pass already reports a boundary that
+     * paired with nothing, so the generic unmatched list can leave it out.
+     */
+    reportsUnpairedItself: boolean;
+}
+/**
+ * One protocol in full: the schema for its identity fields, and the
+ * behavior that keys them. The registry composes these into the
+ * `Semantics` union and the runtime lookup.
+ */
+interface BoundarySemanticsDefinition<Z extends z.ZodType<{
+    name: string;
+}>> {
+    name: z.infer<Z>["name"];
+    schema: Z;
+    behavior: BoundaryBehavior<z.infer<Z>>;
+}
+
+/**
+ * Keys for a boundary binding, and whether two of them agree. Every
+ * function here asks the binding's protocol and returns whatever it
+ * says, so the rules themselves are in the protocol's own module under
+ * `semantics/` and not in this file.
+ *
+ * The sharing is the point. The behavioural checker pairs code
+ * summaries by these keys, and the intent checker pairs intent against
+ * code by the same keys. If the two ever keyed differently, intent and
+ * code would stop lining up, so the keying is here next to the binding
+ * rather than in either checker.
+ */
+
 declare function boundaryKey(binding: BoundaryBinding): string | null;
+declare function pairingKey(binding: BoundaryBinding): string | null;
+declare function semanticsAgree(a: Semantics, b: Semantics): boolean;
+declare function boundaryLabel(binding: BoundaryBinding): string | null;
+declare function displayLabel(binding: BoundaryBinding): string;
+/**
+ * A boundary string that no protocol claims keeps its case, because
+ * message-bus keys are case-sensitive and uppercasing one would break
+ * the rule without saying so.
+ */
+declare function normalizeRuleBoundary(raw: string): string;
+declare function exchangesHttpResponses(binding: BoundaryBinding): boolean;
+declare function reportsUnpairedItself(binding: BoundaryBinding): boolean;
+/**
+ * Null means the protocol does not address its boundaries by method and
+ * path at all, which a caller has to tell apart from an unknown answer:
+ * unknown means it does, but this declaration cannot settle the question.
+ */
+declare function servesRequest(binding: BoundaryBinding, method: string, path: string): MatchResult | null;
 
 /**
- * A channel split into the bus that carries it and the subject on that
- * bus. `default#order.placed` is the subject `order.placed` on the bus
- * `default`. `OrdersQueue` is a subject with no bus, which is what a
- * queue's logical id and an env-var-named channel look like.
+ * Deciding when two message-bus channel strings mean the same thing.
+ *
+ * A channel is a subject, optionally qualified by the bus that carries
+ * it, written `${bus}#${subject}`. The two sides of a pairing rarely
+ * know the same amount, so they pair on the subject and the buses have
+ * to agree only when both sides know one. The package README works
+ * through why, with examples.
+ *
+ * Everything that writes or reads that string goes through
+ * `formatChannel` and `parseChannel`, so the wire format has a single
+ * author. A template reader that hand-writes the `#` would be a second
+ * author, and the two would drift the first time either one changed.
  */
+/** A channel string, written `${bus}#${subject}`, split into its two parts. */
 interface ParsedChannel {
     bus: string | null;
     subject: string;
 }
-/**
- * Split a channel on its first `#`. Later `#`s stay in the subject, so
- * a subject that contains one is compared whole rather than being cut
- * into pieces that pair with the wrong things.
- */
 declare function parseChannel(channel: string): ParsedChannel;
-/** Two buses agree when they are the same, or when either is unknown. */
+declare function formatChannel(bus: string | null, subject: string): string;
 declare function busesAgree(a: string | null, b: string | null): boolean;
-/** Whether two channels name the same subject on agreeing buses. */
 declare function channelsPair(a: string, b: string): boolean;
 
+/**
+ * One convention for the source directory a deployable unit is built
+ * from, and one test for whether a file is inside it.
+ *
+ * A deploy template gives a directory per unit, and a summary stores it
+ * as `metadata.codeScope.path`. Producers write that path and the
+ * checker reads it back as a prefix test, so the two sides have to
+ * agree on whether it ends in a slash. Normalizing it in one place is
+ * what keeps them agreeing. The test also has to stop at a segment
+ * boundary, or `src/foo` would cover `src/foobar` and a handler would
+ * pair with the wrong function.
+ */
 /**
  * The canonical form of a code-scope directory: no leading `./`, no
  * trailing slash, no surrounding whitespace. An empty result means the
- * scope names the project root.
+ * scope is the project root.
  */
 declare function codeScopePath(raw: string): string;
 /**
- * Whether a project-relative file sits inside a code scope. Matching
- * stops at a segment boundary, so `src/foo` covers `src/foo/a.ts` and
- * never `src/foobar/a.ts`. A scope naming the project root covers
- * every file.
+ * Whether a project-relative file is inside a code scope. Matching stops
+ * at a segment boundary, so `src/foo` covers `src/foo/a.ts` and never
+ * `src/foobar/a.ts`. A scope that is the project root covers every file.
  *
- * Both arguments pass through `codeScopePath`, so a scope stored under
- * either of the older trailing-slash conventions still reads correctly.
+ * Both arguments go through `codeScopePath`, so a scope stored with a
+ * trailing slash and one stored without it are read the same way.
  */
 declare function fileInCodeScope(file: string, scope: string): boolean;
 
+/**
+ * The DispatchTable idiom: dispatch on a discriminated union through a
+ * mapped-type Record, so a missing variant is a type error rather than a
+ * runtime fall-through. It is decision #8 in docs/internal/style.md.
+ *
+ * It is here rather than in one package because the decision applies
+ * repo-wide, and every package that walks an IR union needs it. Three
+ * of them had written their own copy before this one existed.
+ */
 type DispatchTable<T extends {
     type: string;
 }, R> = {
@@ -75,6 +223,21 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * The suppression pipeline, over the smallest finding both checkers share.
+ *
+ * Behavioural `Finding` and intent `IntentFinding` both have `kind`,
+ * `severity`, and an optional `suppressed`, which is all the pipeline
+ * needs. The rule schema, first-match-wins matching, effect application,
+ * and threshold counting are here so the two checkers share one
+ * implementation without depending on each other. Only the matching of a
+ * rule's discriminators differs, and a caller passes that in.
+ *
+ * The module owns rules and matching, not file I/O. The CLI reads a
+ * .sussignore file, checks each kind against the published enums, and
+ * hands the parsed rules over.
+ */
+
 declare const SuppressionRuleSchema: z.ZodObject<{
     kind: z.ZodOptional<z.ZodString>;
     boundary: z.ZodOptional<z.ZodString>;
@@ -133,9 +296,9 @@ interface FindingSuppression {
     originalSeverity?: SuppressableSeverity | undefined;
 }
 /**
- * The structural base both finding shapes satisfy. Behavioural
+ * The structural base that both finding types satisfy. Behavioural
  * `Finding` and intent `IntentFinding` each declare these fields in
- * their own schemas (kept structurally identical); the pipeline needs
+ * their own schemas, kept structurally identical, and the pipeline needs
  * nothing more. The `| undefined` unions match what zod infers for
  * `.optional()` fields under exactOptionalPropertyTypes.
  */
@@ -145,32 +308,24 @@ interface SuppressibleFinding {
     suppressed?: FindingSuppression | undefined;
 }
 /**
- * Validate that a narrow rule actually constrains *something* — a bare
- * rule with only `reason` would suppress every finding in the codebase,
- * which is almost always a mistake. Broad-scope rules deliberately
- * allow less-specific matching.
+ * Check that a narrow rule constrains something. A bare rule with only
+ * a `reason` would suppress every finding in the codebase, which is
+ * almost always a mistake. Broad-scope rules are allowed to match less
+ * specifically, on purpose.
  */
 declare function validateRule(rule: SuppressionRule): string | null;
+
 /**
- * Normalize a rule's boundary string to match `boundaryKey`'s output
- * format. Authors may write "GET /pet/:id" or "GET /pet/{id}"; we
- * accept either. Method is uppercased; the path goes through
- * `normalizePath` (colon-to-brace, trailing-slash stripping, lowercase
- * static segments). Non-REST keys ("fn:...", "gql:...") don't have the
- * METHOD-space-path shape and are compared verbatim by callers.
- */
-declare function normalizeRuleBoundary(raw: string): string;
-/**
- * Does a rule's `boundary` discriminator match a finding's boundary
- * key? Exact match first (covers "fn:...", "gql:..."), then the
- * REST-normalized form.
+ * Whether a rule's `boundary` discriminator matches a finding's boundary
+ * key. It tries an exact match first, which covers "fn:..." and
+ * "gql:...", and then the REST-normalized form.
  */
 declare function ruleBoundaryMatchesKey(ruleBoundary: string, key: string | null): boolean;
 /**
- * Apply suppression rules to a list of findings. Generic over the
- * finding shape: `matches` decides whether a rule's discriminators
- * beyond `kind` (boundary, consumer, ...) match a finding — the kind
- * check itself is universal and handled here.
+ * Apply suppression rules to a list of findings. This works for either
+ * finding type: `matches` decides whether a rule's discriminators past
+ * `kind` (boundary, consumer, and so on) match a finding, and the kind
+ * check itself is the same everywhere, so it happens here.
  *
  * Returns a new array. Findings with `effect: "hide"` are omitted from
  * the output entirely unless `keepHidden` is set. Findings with
@@ -181,30 +336,23 @@ declare function applySuppressionsToFindings<T extends SuppressibleFinding>(find
     keepHidden?: boolean;
 }): T[];
 /**
- * `hide` and `mark` findings are excluded from exit-code threshold
- * calculations; `downgrade` findings count at their post-downgrade
- * severity. Callers use this to decide whether a finding contributes
- * to `hasErrors`-style gating.
+ * `hide` and `mark` findings are left out of the exit-code threshold,
+ * and a `downgrade` finding counts at the severity it was downgraded
+ * to. Callers use this to decide whether a finding contributes to
+ * `hasErrors`-style gating.
  */
 declare function countsForThreshold(finding: SuppressibleFinding): boolean;
 
 /**
- * Three-valued comparison result:
- *   - "match"   — `actual` satisfies `declared`
- *   - "nomatch" — a concrete, verifiable incompatibility exists
- *   - "unknown" — uncertainty that would mask a real mismatch (spreads,
- *                 refs, unknown shapes)
- */
-type MatchResult = "match" | "nomatch" | "unknown";
-/**
- * Compare an actual body shape against a declared body shape and report
- * whether the actual satisfies the declared.
+ * @suss/ir-core: primitives shared across suss IRs.
  *
- * Semantics are asymmetric: `actual` is the produced value (a response
- * body, a return value) and `declared` is the contract it must conform
- * to. `unknown` is a soft signal; callers decide whether to surface it.
+ * The schemas are the single source of truth, and the types come from
+ * them. Each boundary protocol's schema and behavior are in one module
+ * under `./semantics`, and everything else is in `./schemas`. The
+ * boundary-binding constructors are here too, so that any package that
+ * produces an IR object (pattern packs, contract readers, intent docs,
+ * tests) can build a binding without depending on a specific IR.
  */
-declare function bodyShapesMatch(actual: TypeShape, declared: TypeShape): MatchResult;
 
 type ConfidenceSource = z.infer<typeof ConfidenceSourceSchema>;
 type ConfidenceLevel = z.infer<typeof ConfidenceLevelSchema>;
@@ -212,39 +360,17 @@ type ConfidenceInfo = z.infer<typeof ConfidenceInfoSchema>;
 type Corroboration = z.infer<typeof CorroborationSchema>;
 type SourceLocation = z.infer<typeof SourceLocationSchema>;
 type BoundaryBinding = z.infer<typeof BoundaryBindingSchema>;
-type Semantics = z.infer<typeof SemanticsSchema>;
-type RestSemantics = Extract<Semantics, {
-    name: "rest";
-}>;
-type FunctionCallSemantics = Extract<Semantics, {
-    name: "function-call";
-}>;
-type GraphqlResolverSemantics = Extract<Semantics, {
-    name: "graphql-resolver";
-}>;
-type GraphqlOperationSemantics = Extract<Semantics, {
-    name: "graphql-operation";
-}>;
-type RuntimeConfigSemantics = Extract<Semantics, {
-    name: "runtime-config";
-}>;
-type StorageRelationalSemantics = Extract<Semantics, {
-    name: "storage-relational";
-}>;
-type MessageBusSemantics = Extract<Semantics, {
-    name: "message-bus";
-}>;
-type DeployableUnit = z.infer<typeof DeployableUnitSchema>;
 
 /**
- * Build a REST-semantics binding. `method` and `path` can be empty
- * strings to signal "not yet resolved" (the adapter's wrapper-expansion
- * pass uses this); pairing treats empty method/path as unplaced.
+ * Build a REST-semantics binding. `method` and `path` are null when the
+ * source does not specify them. `"*"` is the method wildcard, for a
+ * handler that responds to every method. When pairing, null means
+ * unspecified and matches nothing, and `"*"` matches every concrete method.
  */
 declare function restBinding(opts: {
     transport: string;
-    method: string;
-    path: string;
+    method: string | null;
+    path: string | null;
     recognition: string;
     declaredResponses?: number[];
 }): BoundaryBinding;
@@ -261,9 +387,9 @@ declare function functionCallBinding(opts: {
     exportPath?: string[];
 }): BoundaryBinding;
 /**
- * Build a function-call binding that identifies a public package export
- * — the provider side of a library boundary. Transport defaults to
- * `"in-process"` for typical TypeScript library consumption.
+ * Build a function-call binding that identifies a public package export,
+ * which is the provider side of a library boundary. Transport defaults
+ * to `"in-process"`, which is how a TypeScript library is usually used.
  */
 declare function packageExportBinding(opts: {
     transport?: string;
@@ -278,12 +404,13 @@ declare function packageExportBinding(opts: {
 declare function graphqlResolverBinding(opts: {
     transport: string;
     recognition: string;
-    typeName: string;
+    /** Null when the source never says which type the resolver attaches to. */
+    typeName: string | null;
     fieldName: string;
 }): BoundaryBinding;
 /**
- * Build a graphql-operation-semantics binding — the consumer side of a
- * GraphQL boundary. Anonymous operations leave `operationName` unset.
+ * Build a graphql-operation-semantics binding, which is the consumer side
+ * of a GraphQL boundary. Anonymous operations leave `operationName` unset.
  */
 declare function graphqlOperationBinding(opts: {
     transport: string;
@@ -292,10 +419,10 @@ declare function graphqlOperationBinding(opts: {
     operationName?: string;
 }): BoundaryBinding;
 /**
- * Build a runtime-config binding — the provider side of a runtime
- * configuration channel (env vars on a Lambda / ECS task / container /
- * k8s pod). Transport is `"os"`: env vars are handed to the process by
- * the OS at startup regardless of the deployment medium.
+ * Build a runtime-config binding, the provider side of a runtime
+ * configuration channel (env vars on a Lambda, ECS task, container, or
+ * k8s pod). Transport is `"os"` because the OS hands env vars to the
+ * process at startup no matter what the deployment medium is.
  */
 declare function runtimeConfigBinding(opts: {
     recognition: string;
@@ -303,10 +430,10 @@ declare function runtimeConfigBinding(opts: {
     instanceName: string;
 }): BoundaryBinding;
 /**
- * Build a storage-relational binding — the provider side of a
- * relational storage table. Transport carries the `storageSystem`
- * value so the layering stays informative without a separate
- * wire-protocol taxonomy.
+ * Build a storage-relational binding, the provider side of a relational
+ * storage table. Transport stores the `storageSystem` value, which keeps
+ * the layering informative without needing a separate wire-protocol
+ * taxonomy.
  */
 declare function storageRelationalBinding(opts: {
     recognition: string;
@@ -315,13 +442,14 @@ declare function storageRelationalBinding(opts: {
     table: string;
 }): BoundaryBinding;
 /**
- * Build a message-bus binding — the boundary between a producer that
+ * Build a message-bus binding, the boundary between a producer that
  * sends discrete messages and the consumer(s) that receive them.
  */
 declare function messageBusBinding(opts: {
     recognition: string;
-    messageBus: "sqs" | "eventbridge" | "bullmq" | "kafka" | "nats";
-    channel: string;
+    messageBus: MessageBusTechnology;
+    /** Null when this source does not say which channel. */
+    channel: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBinding, BoundaryBindingSchema, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DeployableUnit, DeployableUnitSchema, type DispatchTable, type FindingSuppression, type FunctionCallSemantics, type GraphqlOperationSemantics, type GraphqlResolverSemantics, type MatchResult, type MessageBusSemantics, type ParsedChannel, type RestSemantics, type RuntimeConfigSemantics, type Semantics, SemanticsSchema, type SourceLocation, SourceLocationSchema, type StorageRelationalSemantics, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, busesAgree, channelsPair, codeScopePath, countsForThreshold, dispatchByType, fileInCodeScope, functionCallBinding, graphqlOperationBinding, graphqlResolverBinding, messageBusBinding, normalizePath, normalizeRuleBoundary, packageExportBinding, parseChannel, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, storageRelationalBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type MatchResult, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busesAgree, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, formatChannel, functionCallBinding, graphqlOperationBinding, graphqlResolverBinding, messageBusBinding, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageRelationalBinding, validateRule };