@suss/ir-core 0.5.10 → 0.6.0

package/README.md

@@ -7,7 +7,7 @@ Primitives shared across suss's intermediate representations: the pieces every I
 The types that any suss IR is built from:
 
 - `TypeShape`: the structure of a value, for body / payload / field comparison.
-- `BoundaryBinding` + the `Semantics` variants (rest, function-call, graphql-resolver, graphql-operation, runtime-config, storage-relational, message-bus), plus the eight blessed binding constructors (`restBinding`, `functionCallBinding`, …).
+- `BoundaryBinding` + the `Semantics` variants (rest, function-call, graphql-resolver, graphql-operation, runtime-config, storage, message-bus), plus the eight blessed binding constructors (`restBinding`, `functionCallBinding`, …).
 - `SourceLocation` and `Confidence` (`source` + `level`).
 
 ```ts

package/dist/{chunk-WKR5SU4N.js → chunk-TEXSN75M.js}

@@ -414,29 +414,43 @@ var runtimeConfigSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/storageRelational.ts
+// src/semantics/storage.ts
 import { z as z8 } from "zod";
-var StorageRelationalSemanticsSchema = z8.object({
-  name: z8.literal("storage-relational"),
-  storageSystem: z8.enum(["postgres", "mysql", "sqlite"]),
+var StorageSemanticsSchema = z8.object({
+  name: z8.literal("storage"),
   /**
-   * The ORM or driver scope. A single-database setup uses `"default"`,
-   * and a monorepo with several schemas gives each one its own value.
+   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
+   * products' containers can share a name, so this keeps them apart,
+   * and it is what a finding message calls the store.
+   */
+  storageSystem: z8.string(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
    */
   scope: z8.string(),
   /**
-   * The table or model name as the schema declares it, or null when
-   * the source states one this reader could not settle. A null table
-   * pairs with nothing, rather than with whatever its source text
-   * happens to spell.
+   * The table, bucket, collection, or index, as the source declares
+   * it, or null when the source states one this reader could not
+   * settle. A null container pairs with nothing, rather than with
+   * whatever its source text happens to spell.
+   */
+  container: z8.string().nullable(),
+  /**
+   * A secondary way into the container, a DynamoDB global secondary
+   * index or an Elasticsearch alias, each with its own key fields.
+   * Null means the container's own primary way in. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
    */
-  table: z8.string().nullable()
+  accessPath: z8.string().nullable()
 });
-var storageRelationalSemantics = defineBoundarySemantics({
-  name: "storage-relational",
-  schema: StorageRelationalSemanticsSchema,
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
   behavior: {
-    /** A query returns rows, not a status and a body. */
+    /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
     identityKey: () => null
@@ -450,7 +464,7 @@ var SemanticsSchema = z9.discriminatedUnion("name", [
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
-  storageRelationalSemantics.schema,
+  storageSemantics.schema,
   messageBusSemantics.schema
 ]);
 var DEFINITIONS = [
@@ -459,7 +473,7 @@ var DEFINITIONS = [
   graphqlResolverSemantics,
   graphqlOperationSemantics,
   runtimeConfigSemantics,
-  storageRelationalSemantics,
+  storageSemantics,
   messageBusSemantics
 ];
 var BY_NAME = new Map(
@@ -614,7 +628,7 @@ export {
   DeployableUnitSchema,
   ecsContainerInstanceName,
   RuntimeConfigSemanticsSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SemanticsSchema,
   behaviorOf,
   allBehaviors,

package/dist/index.cjs

@@ -34,7 +34,7 @@ __export(index_exports, {
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
   SemanticsSchema: () => SemanticsSchema,
   SourceLocationSchema: () => SourceLocationSchema,
-  StorageRelationalSemanticsSchema: () => StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema: () => StorageSemanticsSchema,
   SuppressionFileSchema: () => SuppressionFileSchema,
   SuppressionRuleSchema: () => SuppressionRuleSchema,
   TypeShapeSchema: () => TypeShapeSchema,
@@ -59,9 +59,13 @@ __export(index_exports, {
   gqlIdentityKey: () => gqlIdentityKey,
   graphqlOperationBinding: () => graphqlOperationBinding,
   graphqlResolverBinding: () => graphqlResolverBinding,
+  hasNameHole: () => hasNameHole,
   isGraphqlOperationBinding: () => isGraphqlOperationBinding,
   messageBusBinding: () => messageBusBinding,
   methodsAgree: () => methodsAgree,
+  namePatternFromSub: () => namePatternFromSub,
+  namePatternKey: () => namePatternKey,
+  namesAgree: () => namesAgree,
   normalizePath: () => normalizePath,
   normalizeRuleBoundary: () => normalizeRuleBoundary,
   packageExportBinding: () => packageExportBinding,
@@ -74,7 +78,7 @@ __export(index_exports, {
   runtimeConfigBinding: () => runtimeConfigBinding,
   semanticsAgree: () => semanticsAgree,
   servesRequest: () => servesRequest,
-  storageRelationalBinding: () => storageRelationalBinding,
+  storageBinding: () => storageBinding,
   typeDefinitionKey: () => typeDefinitionKey,
   validateRule: () => validateRule,
   withDefinitionsInlined: () => withDefinitionsInlined
@@ -497,29 +501,43 @@ var runtimeConfigSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/storageRelational.ts
+// src/semantics/storage.ts
 var import_zod8 = require("zod");
-var StorageRelationalSemanticsSchema = import_zod8.z.object({
-  name: import_zod8.z.literal("storage-relational"),
-  storageSystem: import_zod8.z.enum(["postgres", "mysql", "sqlite"]),
+var StorageSemanticsSchema = import_zod8.z.object({
+  name: import_zod8.z.literal("storage"),
   /**
-   * The ORM or driver scope. A single-database setup uses `"default"`,
-   * and a monorepo with several schemas gives each one its own value.
+   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
+   * products' containers can share a name, so this keeps them apart,
+   * and it is what a finding message calls the store.
+   */
+  storageSystem: import_zod8.z.string(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
    */
   scope: import_zod8.z.string(),
   /**
-   * The table or model name as the schema declares it, or null when
-   * the source states one this reader could not settle. A null table
-   * pairs with nothing, rather than with whatever its source text
-   * happens to spell.
+   * The table, bucket, collection, or index, as the source declares
+   * it, or null when the source states one this reader could not
+   * settle. A null container pairs with nothing, rather than with
+   * whatever its source text happens to spell.
+   */
+  container: import_zod8.z.string().nullable(),
+  /**
+   * A secondary way into the container, a DynamoDB global secondary
+   * index or an Elasticsearch alias, each with its own key fields.
+   * Null means the container's own primary way in. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
    */
-  table: import_zod8.z.string().nullable()
+  accessPath: import_zod8.z.string().nullable()
 });
-var storageRelationalSemantics = defineBoundarySemantics({
-  name: "storage-relational",
-  schema: StorageRelationalSemanticsSchema,
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
   behavior: {
-    /** A query returns rows, not a status and a body. */
+    /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
     identityKey: () => null
@@ -533,7 +551,7 @@ var SemanticsSchema = import_zod9.z.discriminatedUnion("name", [
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
-  storageRelationalSemantics.schema,
+  storageSemantics.schema,
   messageBusSemantics.schema
 ]);
 var DEFINITIONS = [
@@ -542,7 +560,7 @@ var DEFINITIONS = [
   graphqlResolverSemantics,
   graphqlOperationSemantics,
   runtimeConfigSemantics,
-  storageRelationalSemantics,
+  storageSemantics,
   messageBusSemantics
 ];
 var BY_NAME = new Map(
@@ -749,6 +767,53 @@ function dispatchByType(table, value) {
   return handler(value);
 }
 
+// src/namePattern.ts
+var HOLE = /\{[^}]*\}/g;
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+var SUB_ESCAPE = /\$\{!/;
+function namePatternFromSub(value) {
+  if (Array.isArray(value)) {
+    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (SUB_ESCAPE.test(value)) {
+    return null;
+  }
+  return value.replace(SUB_TOKEN, (_whole, inner) => `{${inner}}`);
+}
+function hasNameHole(name) {
+  HOLE.lastIndex = 0;
+  return HOLE.test(name);
+}
+function namePatternKey(name) {
+  return name.replace(HOLE, "{}");
+}
+function admits(pattern, name) {
+  const source = pattern.split(/(\{[^}]*\})/).map(
+    (part) => part.startsWith("{") && part.endsWith("}") ? ".+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  ).join("");
+  return new RegExp(`^${source}$`).test(name);
+}
+function namesAgree(a, b) {
+  if (a === b) {
+    return true;
+  }
+  const aHasHole = hasNameHole(a);
+  const bHasHole = hasNameHole(b);
+  if (aHasHole && bHasHole) {
+    return namePatternKey(a) === namePatternKey(b);
+  }
+  if (aHasHole) {
+    return admits(a, b);
+  }
+  if (bHasHole) {
+    return admits(b, a);
+  }
+  return false;
+}
+
 // src/suppressions.ts
 var import_zod11 = require("zod");
 var SuppressionSideSchema = import_zod11.z.object({
@@ -1089,14 +1154,15 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
-function storageRelationalBinding(opts) {
+function storageBinding(opts) {
   return {
-    transport: opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem,
     semantics: {
-      name: "storage-relational",
+      name: "storage",
       storageSystem: opts.storageSystem,
       scope: opts.scope,
-      table: namedOrNull(opts.table, "storage table")
+      container: namedOrNull(opts.container, "storage container"),
+      accessPath: opts.accessPath ?? null
     },
     recognition: opts.recognition
   };
@@ -1128,7 +1194,7 @@ function messageBusBinding(opts) {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
@@ -1153,9 +1219,13 @@ function messageBusBinding(opts) {
   gqlIdentityKey,
   graphqlOperationBinding,
   graphqlResolverBinding,
+  hasNameHole,
   isGraphqlOperationBinding,
   messageBusBinding,
   methodsAgree,
+  namePatternFromSub,
+  namePatternKey,
+  namesAgree,
   normalizePath,
   normalizeRuleBoundary,
   packageExportBinding,
@@ -1168,7 +1238,7 @@ function messageBusBinding(opts) {
   runtimeConfigBinding,
   semanticsAgree,
   servesRequest,
-  storageRelationalBinding,
+  storageBinding,
   typeDefinitionKey,
   validateRule,
   withDefinitionsInlined

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-N9GyG0Sn.cjs';
-export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageRelationalSemantics, q as StorageRelationalSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.cjs';
+import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D6hKT-zV.cjs';
+export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.cjs';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -262,6 +262,42 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * A name two sides state with a hole in it.
+ *
+ * A deployed resource is often called something built at deploy time:
+ * a template writes `!Sub "${StageName}-orders-v1"` and the code writes
+ * `` `${stage}-orders-v1` ``. Neither side states a string, both agree
+ * about the fixed text, and each spells the parameter its own way. So a
+ * name is written here as fixed text with `{}` holes, the way a REST
+ * path is written with `{id}`, and two names agree when their fixed
+ * parts line up.
+ *
+ * A hole covers a whole parameter rather than one path segment,
+ * because a name has no separator that every project agrees on.
+ */
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -475,17 +511,21 @@ declare function runtimeConfigBinding(opts: {
     instanceName: string;
 }): BoundaryBinding;
 /**
- * Build a storage-relational binding, the provider side of a relational
- * storage table. Transport stores the `storageSystem` value, which keeps
- * the layering informative without needing a separate wire-protocol
- * taxonomy.
+ * Build a storage binding, the side of a store that both a schema
+ * reader and a call site can spell. `transport` defaults to the store's
+ * own name, which is right for a database whose product and wire
+ * protocol are the same word, and a store reached over an SDK passes
+ * its wire instead.
  */
-declare function storageRelationalBinding(opts: {
+declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: "postgres" | "mysql" | "sqlite";
+    storageSystem: string;
+    transport?: string;
     scope: string;
-    /** Null when the source names a table this reader could not settle. */
-    table: string | null;
+    /** Null when the source gives a container this reader could not settle. */
+    container: string | null;
+    /** A secondary index or alias, or null for the container's own primary key. */
+    accessPath?: string | null;
 }): BoundaryBinding;
 /**
  * Build a message-bus binding, the boundary between a producer that
@@ -498,4 +538,4 @@ declare function messageBusBinding(opts: {
     channel: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, isGraphqlOperationBinding, messageBusBinding, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageRelationalBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, hasNameHole, isGraphqlOperationBinding, messageBusBinding, namePatternFromSub, namePatternKey, namesAgree, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageBinding, validateRule };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-N9GyG0Sn.js';
-export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageRelationalSemantics, q as StorageRelationalSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.js';
+import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D6hKT-zV.js';
+export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.js';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -262,6 +262,42 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * A name two sides state with a hole in it.
+ *
+ * A deployed resource is often called something built at deploy time:
+ * a template writes `!Sub "${StageName}-orders-v1"` and the code writes
+ * `` `${stage}-orders-v1` ``. Neither side states a string, both agree
+ * about the fixed text, and each spells the parameter its own way. So a
+ * name is written here as fixed text with `{}` holes, the way a REST
+ * path is written with `{id}`, and two names agree when their fixed
+ * parts line up.
+ *
+ * A hole covers a whole parameter rather than one path segment,
+ * because a name has no separator that every project agrees on.
+ */
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -475,17 +511,21 @@ declare function runtimeConfigBinding(opts: {
     instanceName: string;
 }): BoundaryBinding;
 /**
- * Build a storage-relational binding, the provider side of a relational
- * storage table. Transport stores the `storageSystem` value, which keeps
- * the layering informative without needing a separate wire-protocol
- * taxonomy.
+ * Build a storage binding, the side of a store that both a schema
+ * reader and a call site can spell. `transport` defaults to the store's
+ * own name, which is right for a database whose product and wire
+ * protocol are the same word, and a store reached over an SDK passes
+ * its wire instead.
  */
-declare function storageRelationalBinding(opts: {
+declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: "postgres" | "mysql" | "sqlite";
+    storageSystem: string;
+    transport?: string;
     scope: string;
-    /** Null when the source names a table this reader could not settle. */
-    table: string | null;
+    /** Null when the source gives a container this reader could not settle. */
+    container: string | null;
+    /** A secondary index or alias, or null for the container's own primary key. */
+    accessPath?: string | null;
 }): BoundaryBinding;
 /**
  * Build a message-bus binding, the boundary between a producer that
@@ -498,4 +538,4 @@ declare function messageBusBinding(opts: {
     channel: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, isGraphqlOperationBinding, messageBusBinding, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageRelationalBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, hasNameHole, isGraphqlOperationBinding, messageBusBinding, namePatternFromSub, namePatternKey, namesAgree, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageBinding, validateRule };

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   TypeShapeSchema,
   allBehaviors,
   behaviorOf,
@@ -30,7 +30,7 @@ import {
   routePathAdmits,
   typeDefinitionKey,
   withDefinitionsInlined
-} from "./chunk-WKR5SU4N.js";
+} from "./chunk-TEXSN75M.js";
 
 // src/boundaryKey.ts
 function boundaryKey(binding) {
@@ -103,6 +103,53 @@ function dispatchByType(table, value) {
   return handler(value);
 }
 
+// src/namePattern.ts
+var HOLE = /\{[^}]*\}/g;
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+var SUB_ESCAPE = /\$\{!/;
+function namePatternFromSub(value) {
+  if (Array.isArray(value)) {
+    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (SUB_ESCAPE.test(value)) {
+    return null;
+  }
+  return value.replace(SUB_TOKEN, (_whole, inner) => `{${inner}}`);
+}
+function hasNameHole(name) {
+  HOLE.lastIndex = 0;
+  return HOLE.test(name);
+}
+function namePatternKey(name) {
+  return name.replace(HOLE, "{}");
+}
+function admits(pattern, name) {
+  const source = pattern.split(/(\{[^}]*\})/).map(
+    (part) => part.startsWith("{") && part.endsWith("}") ? ".+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  ).join("");
+  return new RegExp(`^${source}$`).test(name);
+}
+function namesAgree(a, b) {
+  if (a === b) {
+    return true;
+  }
+  const aHasHole = hasNameHole(a);
+  const bHasHole = hasNameHole(b);
+  if (aHasHole && bHasHole) {
+    return namePatternKey(a) === namePatternKey(b);
+  }
+  if (aHasHole) {
+    return admits(a, b);
+  }
+  if (bHasHole) {
+    return admits(b, a);
+  }
+  return false;
+}
+
 // src/suppressions.ts
 import { z } from "zod";
 var SuppressionSideSchema = z.object({
@@ -443,14 +490,15 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
-function storageRelationalBinding(opts) {
+function storageBinding(opts) {
   return {
-    transport: opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem,
     semantics: {
-      name: "storage-relational",
+      name: "storage",
       storageSystem: opts.storageSystem,
       scope: opts.scope,
-      table: namedOrNull(opts.table, "storage table")
+      container: namedOrNull(opts.container, "storage container"),
+      accessPath: opts.accessPath ?? null
     },
     recognition: opts.recognition
   };
@@ -481,7 +529,7 @@ export {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
@@ -506,9 +554,13 @@ export {
   gqlIdentityKey,
   graphqlOperationBinding,
   graphqlResolverBinding,
+  hasNameHole,
   isGraphqlOperationBinding,
   messageBusBinding,
   methodsAgree,
+  namePatternFromSub,
+  namePatternKey,
+  namesAgree,
   normalizePath,
   normalizeRuleBoundary,
   packageExportBinding,
@@ -521,7 +573,7 @@ export {
   runtimeConfigBinding,
   semanticsAgree,
   servesRequest,
-  storageRelationalBinding,
+  storageBinding,
   typeDefinitionKey,
   validateRule,
   withDefinitionsInlined