@suss/ir-core 0.5.11 → 0.7.0

package/README.md

@@ -7,7 +7,7 @@ Primitives shared across suss's intermediate representations: the pieces every I
 The types that any suss IR is built from:
 
 - `TypeShape`: the structure of a value, for body / payload / field comparison.
-- `BoundaryBinding` + the `Semantics` variants (rest, function-call, graphql-resolver, graphql-operation, runtime-config, storage-relational, message-bus), plus the eight blessed binding constructors (`restBinding`, `functionCallBinding`, …).
+- `BoundaryBinding` + the `Semantics` variants (rest, function-call, graphql-resolver, graphql-operation, runtime-config, storage, message-bus), plus the eight blessed binding constructors (`restBinding`, `functionCallBinding`, …).
 - `SourceLocation` and `Confidence` (`source` + `level`).
 
 ```ts

package/dist/{chunk-WKR5SU4N.js → chunk-TEXSN75M.js}

@@ -414,29 +414,43 @@ var runtimeConfigSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/storageRelational.ts
+// src/semantics/storage.ts
 import { z as z8 } from "zod";
-var StorageRelationalSemanticsSchema = z8.object({
-  name: z8.literal("storage-relational"),
-  storageSystem: z8.enum(["postgres", "mysql", "sqlite"]),
+var StorageSemanticsSchema = z8.object({
+  name: z8.literal("storage"),
   /**
-   * The ORM or driver scope. A single-database setup uses `"default"`,
-   * and a monorepo with several schemas gives each one its own value.
+   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
+   * products' containers can share a name, so this keeps them apart,
+   * and it is what a finding message calls the store.
+   */
+  storageSystem: z8.string(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
    */
   scope: z8.string(),
   /**
-   * The table or model name as the schema declares it, or null when
-   * the source states one this reader could not settle. A null table
-   * pairs with nothing, rather than with whatever its source text
-   * happens to spell.
+   * The table, bucket, collection, or index, as the source declares
+   * it, or null when the source states one this reader could not
+   * settle. A null container pairs with nothing, rather than with
+   * whatever its source text happens to spell.
+   */
+  container: z8.string().nullable(),
+  /**
+   * A secondary way into the container, a DynamoDB global secondary
+   * index or an Elasticsearch alias, each with its own key fields.
+   * Null means the container's own primary way in. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
    */
-  table: z8.string().nullable()
+  accessPath: z8.string().nullable()
 });
-var storageRelationalSemantics = defineBoundarySemantics({
-  name: "storage-relational",
-  schema: StorageRelationalSemanticsSchema,
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
   behavior: {
-    /** A query returns rows, not a status and a body. */
+    /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
     identityKey: () => null
@@ -450,7 +464,7 @@ var SemanticsSchema = z9.discriminatedUnion("name", [
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
-  storageRelationalSemantics.schema,
+  storageSemantics.schema,
   messageBusSemantics.schema
 ]);
 var DEFINITIONS = [
@@ -459,7 +473,7 @@ var DEFINITIONS = [
   graphqlResolverSemantics,
   graphqlOperationSemantics,
   runtimeConfigSemantics,
-  storageRelationalSemantics,
+  storageSemantics,
   messageBusSemantics
 ];
 var BY_NAME = new Map(
@@ -614,7 +628,7 @@ export {
   DeployableUnitSchema,
   ecsContainerInstanceName,
   RuntimeConfigSemanticsSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SemanticsSchema,
   behaviorOf,
   allBehaviors,

package/dist/index.cjs

@@ -34,7 +34,7 @@ __export(index_exports, {
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
   SemanticsSchema: () => SemanticsSchema,
   SourceLocationSchema: () => SourceLocationSchema,
-  StorageRelationalSemanticsSchema: () => StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema: () => StorageSemanticsSchema,
   SuppressionFileSchema: () => SuppressionFileSchema,
   SuppressionRuleSchema: () => SuppressionRuleSchema,
   TypeShapeSchema: () => TypeShapeSchema,
@@ -59,9 +59,14 @@ __export(index_exports, {
   gqlIdentityKey: () => gqlIdentityKey,
   graphqlOperationBinding: () => graphqlOperationBinding,
   graphqlResolverBinding: () => graphqlResolverBinding,
+  hasNameHole: () => hasNameHole,
   isGraphqlOperationBinding: () => isGraphqlOperationBinding,
   messageBusBinding: () => messageBusBinding,
   methodsAgree: () => methodsAgree,
+  namePatternFromSub: () => namePatternFromSub,
+  namePatternKey: () => namePatternKey,
+  namesAgree: () => namesAgree,
+  namesNothing: () => namesNothing,
   normalizePath: () => normalizePath,
   normalizeRuleBoundary: () => normalizeRuleBoundary,
   packageExportBinding: () => packageExportBinding,
@@ -74,7 +79,7 @@ __export(index_exports, {
   runtimeConfigBinding: () => runtimeConfigBinding,
   semanticsAgree: () => semanticsAgree,
   servesRequest: () => servesRequest,
-  storageRelationalBinding: () => storageRelationalBinding,
+  storageBinding: () => storageBinding,
   typeDefinitionKey: () => typeDefinitionKey,
   validateRule: () => validateRule,
   withDefinitionsInlined: () => withDefinitionsInlined
@@ -497,29 +502,43 @@ var runtimeConfigSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/storageRelational.ts
+// src/semantics/storage.ts
 var import_zod8 = require("zod");
-var StorageRelationalSemanticsSchema = import_zod8.z.object({
-  name: import_zod8.z.literal("storage-relational"),
-  storageSystem: import_zod8.z.enum(["postgres", "mysql", "sqlite"]),
+var StorageSemanticsSchema = import_zod8.z.object({
+  name: import_zod8.z.literal("storage"),
   /**
-   * The ORM or driver scope. A single-database setup uses `"default"`,
-   * and a monorepo with several schemas gives each one its own value.
+   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
+   * products' containers can share a name, so this keeps them apart,
+   * and it is what a finding message calls the store.
+   */
+  storageSystem: import_zod8.z.string(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
    */
   scope: import_zod8.z.string(),
   /**
-   * The table or model name as the schema declares it, or null when
-   * the source states one this reader could not settle. A null table
-   * pairs with nothing, rather than with whatever its source text
-   * happens to spell.
+   * The table, bucket, collection, or index, as the source declares
+   * it, or null when the source states one this reader could not
+   * settle. A null container pairs with nothing, rather than with
+   * whatever its source text happens to spell.
+   */
+  container: import_zod8.z.string().nullable(),
+  /**
+   * A secondary way into the container, a DynamoDB global secondary
+   * index or an Elasticsearch alias, each with its own key fields.
+   * Null means the container's own primary way in. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
    */
-  table: import_zod8.z.string().nullable()
+  accessPath: import_zod8.z.string().nullable()
 });
-var storageRelationalSemantics = defineBoundarySemantics({
-  name: "storage-relational",
-  schema: StorageRelationalSemanticsSchema,
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
   behavior: {
-    /** A query returns rows, not a status and a body. */
+    /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
     identityKey: () => null
@@ -533,7 +552,7 @@ var SemanticsSchema = import_zod9.z.discriminatedUnion("name", [
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
-  storageRelationalSemantics.schema,
+  storageSemantics.schema,
   messageBusSemantics.schema
 ]);
 var DEFINITIONS = [
@@ -542,7 +561,7 @@ var DEFINITIONS = [
   graphqlResolverSemantics,
   graphqlOperationSemantics,
   runtimeConfigSemantics,
-  storageRelationalSemantics,
+  storageSemantics,
   messageBusSemantics
 ];
 var BY_NAME = new Map(
@@ -749,6 +768,59 @@ function dispatchByType(table, value) {
   return handler(value);
 }
 
+// src/namePattern.ts
+var HOLE = /\{[^}]*\}/g;
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+var SUB_ESCAPE = /\$\{!/;
+function namePatternFromSub(value) {
+  if (Array.isArray(value)) {
+    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (SUB_ESCAPE.test(value)) {
+    return null;
+  }
+  return value.replace(SUB_TOKEN, (_whole, inner) => `{${inner}}`);
+}
+function namesNothing(name) {
+  return /^\{[^}]*\}$/.test(name);
+}
+function hasNameHole(name) {
+  HOLE.lastIndex = 0;
+  return HOLE.test(name);
+}
+function namePatternKey(name) {
+  return name.replace(HOLE, "{}");
+}
+function admits(pattern, name) {
+  const source = pattern.split(/(\{[^}]*\})/).map(
+    (part) => part.startsWith("{") && part.endsWith("}") ? ".+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  ).join("");
+  return new RegExp(`^${source}$`).test(name);
+}
+function namesAgree(a, b) {
+  if (namesNothing(a) || namesNothing(b)) {
+    return false;
+  }
+  if (a === b) {
+    return true;
+  }
+  const aHasHole = hasNameHole(a);
+  const bHasHole = hasNameHole(b);
+  if (aHasHole && bHasHole) {
+    return namePatternKey(a) === namePatternKey(b);
+  }
+  if (aHasHole) {
+    return admits(a, b);
+  }
+  if (bHasHole) {
+    return admits(b, a);
+  }
+  return false;
+}
+
 // src/suppressions.ts
 var import_zod11 = require("zod");
 var SuppressionSideSchema = import_zod11.z.object({
@@ -1089,14 +1161,15 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
-function storageRelationalBinding(opts) {
+function storageBinding(opts) {
   return {
-    transport: opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem,
     semantics: {
-      name: "storage-relational",
+      name: "storage",
       storageSystem: opts.storageSystem,
       scope: opts.scope,
-      table: namedOrNull(opts.table, "storage table")
+      container: namedOrNull(opts.container, "storage container"),
+      accessPath: opts.accessPath ?? null
     },
     recognition: opts.recognition
   };
@@ -1128,7 +1201,7 @@ function messageBusBinding(opts) {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
@@ -1153,9 +1226,14 @@ function messageBusBinding(opts) {
   gqlIdentityKey,
   graphqlOperationBinding,
   graphqlResolverBinding,
+  hasNameHole,
   isGraphqlOperationBinding,
   messageBusBinding,
   methodsAgree,
+  namePatternFromSub,
+  namePatternKey,
+  namesAgree,
+  namesNothing,
   normalizePath,
   normalizeRuleBoundary,
   packageExportBinding,
@@ -1168,7 +1246,7 @@ function messageBusBinding(opts) {
   runtimeConfigBinding,
   semanticsAgree,
   servesRequest,
-  storageRelationalBinding,
+  storageBinding,
   typeDefinitionKey,
   validateRule,
   withDefinitionsInlined

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-N9GyG0Sn.cjs';
-export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageRelationalSemantics, q as StorageRelationalSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.cjs';
+import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D6hKT-zV.cjs';
+export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.cjs';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -262,6 +262,50 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * A name two sides state with a hole in it.
+ *
+ * A deployed resource is often called something built at deploy time:
+ * a template writes `!Sub "${StageName}-orders-v1"` and the code writes
+ * `` `${stage}-orders-v1` ``. Neither side states a string, both agree
+ * about the fixed text, and each spells the parameter its own way. So a
+ * name is written here as fixed text with `{}` holes, the way a REST
+ * path is written with `{id}`, and two names agree when their fixed
+ * parts line up.
+ *
+ * A hole covers a whole parameter rather than one path segment,
+ * because a name has no separator that every project agrees on.
+ */
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/**
+ * Whether a name says only that somebody else knows it. A wrapper that
+ * takes its bucket as an argument states `{location.bucket}` and
+ * nothing more, which says which parameter to ask rather than which
+ * bucket. A name like that agrees with nothing until something grounds
+ * it, since otherwise it would agree with every name there is.
+ */
+declare function namesNothing(name: string): boolean;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -475,17 +519,21 @@ declare function runtimeConfigBinding(opts: {
     instanceName: string;
 }): BoundaryBinding;
 /**
- * Build a storage-relational binding, the provider side of a relational
- * storage table. Transport stores the `storageSystem` value, which keeps
- * the layering informative without needing a separate wire-protocol
- * taxonomy.
+ * Build a storage binding, the side of a store that both a schema
+ * reader and a call site can spell. `transport` defaults to the store's
+ * own name, which is right for a database whose product and wire
+ * protocol are the same word, and a store reached over an SDK passes
+ * its wire instead.
  */
-declare function storageRelationalBinding(opts: {
+declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: "postgres" | "mysql" | "sqlite";
+    storageSystem: string;
+    transport?: string;
     scope: string;
-    /** Null when the source names a table this reader could not settle. */
-    table: string | null;
+    /** Null when the source gives a container this reader could not settle. */
+    container: string | null;
+    /** A secondary index or alias, or null for the container's own primary key. */
+    accessPath?: string | null;
 }): BoundaryBinding;
 /**
  * Build a message-bus binding, the boundary between a producer that
@@ -498,4 +546,4 @@ declare function messageBusBinding(opts: {
     channel: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, isGraphqlOperationBinding, messageBusBinding, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageRelationalBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, hasNameHole, isGraphqlOperationBinding, messageBusBinding, namePatternFromSub, namePatternKey, namesAgree, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageBinding, validateRule };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-N9GyG0Sn.js';
-export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageRelationalSemantics, q as StorageRelationalSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.js';
+import { T as TypeShape, M as MessageBusSemantics, S as Semantics, B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, d as SourceLocationSchema, e as MessageBusTechnology } from './schemas-D6hKT-zV.js';
+export { D as DeployableUnit, f as DeployableUnitSchema, F as FunctionCallSemantics, g as FunctionCallSemanticsSchema, G as GraphqlOperationSemantics, h as GraphqlOperationSemanticsSchema, i as GraphqlResolverSemantics, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, R as RestSemantics, l as RestSemanticsSchema, m as RuntimeConfigSemantics, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, p as StorageSemantics, q as StorageSemanticsSchema, r as TypeShapeSchema, s as ecsContainerInstanceName, t as methodsAgree, u as normalizePath, v as routePathAdmits, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.js';
 
 /**
  * Comparing two TypeShapes structurally.
@@ -262,6 +262,50 @@ declare function dispatchByType<T extends {
     type: string;
 }, R>(table: DispatchTable<T, R>, value: T): R;
 
+/**
+ * A name two sides state with a hole in it.
+ *
+ * A deployed resource is often called something built at deploy time:
+ * a template writes `!Sub "${StageName}-orders-v1"` and the code writes
+ * `` `${stage}-orders-v1` ``. Neither side states a string, both agree
+ * about the fixed text, and each spells the parameter its own way. So a
+ * name is written here as fixed text with `{}` holes, the way a REST
+ * path is written with `{id}`, and two names agree when their fixed
+ * parts line up.
+ *
+ * A hole covers a whole parameter rather than one path segment,
+ * because a name has no separator that every project agrees on.
+ */
+/**
+ * The name a CloudFormation `Fn::Sub` value states. The array form
+ * takes its template from the first element, and the variable map only
+ * says where a substitution comes from, which does not change the name.
+ */
+declare function namePatternFromSub(value: unknown): string | null;
+/**
+ * Whether a name says only that somebody else knows it. A wrapper that
+ * takes its bucket as an argument states `{location.bucket}` and
+ * nothing more, which says which parameter to ask rather than which
+ * bucket. A name like that agrees with nothing until something grounds
+ * it, since otherwise it would agree with every name there is.
+ */
+declare function namesNothing(name: string): boolean;
+/** Whether a name has anything a source left for deploy time to fill. */
+declare function hasNameHole(name: string): boolean;
+/**
+ * The form two patterns are compared in: every hole reduced to the same
+ * token, since the two sides pick their own name for the parameter.
+ */
+declare function namePatternKey(name: string): string;
+/**
+ * Whether two names are the same name. Two patterns agree when their
+ * fixed parts line up, since a hole on one side meets a hole on the
+ * other. A pattern and a concrete name agree when the fixed parts are
+ * where the pattern says they are, which is what happens when one side
+ * hardcoded what the other parameterized.
+ */
+declare function namesAgree(a: string, b: string): boolean;
+
 /**
  * The suppression pipeline, over the smallest finding both checkers share.
  *
@@ -475,17 +519,21 @@ declare function runtimeConfigBinding(opts: {
     instanceName: string;
 }): BoundaryBinding;
 /**
- * Build a storage-relational binding, the provider side of a relational
- * storage table. Transport stores the `storageSystem` value, which keeps
- * the layering informative without needing a separate wire-protocol
- * taxonomy.
+ * Build a storage binding, the side of a store that both a schema
+ * reader and a call site can spell. `transport` defaults to the store's
+ * own name, which is right for a database whose product and wire
+ * protocol are the same word, and a store reached over an SDK passes
+ * its wire instead.
  */
-declare function storageRelationalBinding(opts: {
+declare function storageBinding(opts: {
     recognition: string;
-    storageSystem: "postgres" | "mysql" | "sqlite";
+    storageSystem: string;
+    transport?: string;
     scope: string;
-    /** Null when the source names a table this reader could not settle. */
-    table: string | null;
+    /** Null when the source gives a container this reader could not settle. */
+    container: string | null;
+    /** A secondary index or alias, or null for the container's own primary key. */
+    accessPath?: string | null;
 }): BoundaryBinding;
 /**
  * Build a message-bus binding, the boundary between a producer that
@@ -498,4 +546,4 @@ declare function messageBusBinding(opts: {
     channel: string | null;
 }): BoundaryBinding;
 
-export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, isGraphqlOperationBinding, messageBusBinding, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageRelationalBinding, validateRule };
+export { type BoundaryBehavior, type BoundaryBinding, BoundaryBindingSchema, type BoundarySemanticsDefinition, type BusIdentityKey, type Channel, type ConfidenceInfo, ConfidenceInfoSchema, type ConfidenceLevel, ConfidenceLevelSchema, type ConfidenceSource, ConfidenceSourceSchema, type Corroboration, CorroborationSchema, type DispatchTable, type FindingSuppression, type FnIdentityKey, type GqlIdentityKey, type MatchResult, MessageBusSemantics, MessageBusTechnology, type ParsedChannel, Semantics, type SourceLocation, SourceLocationSchema, type SuppressableSeverity, type SuppressibleFinding, type SuppressionFile, SuppressionFileSchema, type SuppressionRule, SuppressionRuleSchema, TypeShape, applySuppressionsToFindings, bodyShapesMatch, boundaryKey, boundaryLabel, busIdentityKey, busesAgree, canPair, channelsPair, codeScopePath, countsForThreshold, dispatchByType, displayLabel, exchangesHttpResponses, fileInCodeScope, fnIdentityKey, formatChannel, functionCallBinding, gqlIdentityKey, graphqlOperationBinding, graphqlResolverBinding, hasNameHole, isGraphqlOperationBinding, messageBusBinding, namePatternFromSub, namePatternKey, namesAgree, namesNothing, normalizeRuleBoundary, packageExportBinding, pairingKey, parseChannel, reportsUnpairedItself, restBinding, ruleBoundaryMatchesKey, runtimeConfigBinding, semanticsAgree, servesRequest, storageBinding, validateRule };

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   TypeShapeSchema,
   allBehaviors,
   behaviorOf,
@@ -30,7 +30,7 @@ import {
   routePathAdmits,
   typeDefinitionKey,
   withDefinitionsInlined
-} from "./chunk-WKR5SU4N.js";
+} from "./chunk-TEXSN75M.js";
 
 // src/boundaryKey.ts
 function boundaryKey(binding) {
@@ -103,6 +103,59 @@ function dispatchByType(table, value) {
   return handler(value);
 }
 
+// src/namePattern.ts
+var HOLE = /\{[^}]*\}/g;
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+var SUB_ESCAPE = /\$\{!/;
+function namePatternFromSub(value) {
+  if (Array.isArray(value)) {
+    return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (SUB_ESCAPE.test(value)) {
+    return null;
+  }
+  return value.replace(SUB_TOKEN, (_whole, inner) => `{${inner}}`);
+}
+function namesNothing(name) {
+  return /^\{[^}]*\}$/.test(name);
+}
+function hasNameHole(name) {
+  HOLE.lastIndex = 0;
+  return HOLE.test(name);
+}
+function namePatternKey(name) {
+  return name.replace(HOLE, "{}");
+}
+function admits(pattern, name) {
+  const source = pattern.split(/(\{[^}]*\})/).map(
+    (part) => part.startsWith("{") && part.endsWith("}") ? ".+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  ).join("");
+  return new RegExp(`^${source}$`).test(name);
+}
+function namesAgree(a, b) {
+  if (namesNothing(a) || namesNothing(b)) {
+    return false;
+  }
+  if (a === b) {
+    return true;
+  }
+  const aHasHole = hasNameHole(a);
+  const bHasHole = hasNameHole(b);
+  if (aHasHole && bHasHole) {
+    return namePatternKey(a) === namePatternKey(b);
+  }
+  if (aHasHole) {
+    return admits(a, b);
+  }
+  if (bHasHole) {
+    return admits(b, a);
+  }
+  return false;
+}
+
 // src/suppressions.ts
 import { z } from "zod";
 var SuppressionSideSchema = z.object({
@@ -443,14 +496,15 @@ function runtimeConfigBinding(opts) {
     recognition: opts.recognition
   };
 }
-function storageRelationalBinding(opts) {
+function storageBinding(opts) {
   return {
-    transport: opts.storageSystem,
+    transport: opts.transport ?? opts.storageSystem,
     semantics: {
-      name: "storage-relational",
+      name: "storage",
       storageSystem: opts.storageSystem,
       scope: opts.scope,
-      table: namedOrNull(opts.table, "storage table")
+      container: namedOrNull(opts.container, "storage container"),
+      accessPath: opts.accessPath ?? null
     },
     recognition: opts.recognition
   };
@@ -481,7 +535,7 @@ export {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   SuppressionFileSchema,
   SuppressionRuleSchema,
   TypeShapeSchema,
@@ -506,9 +560,14 @@ export {
   gqlIdentityKey,
   graphqlOperationBinding,
   graphqlResolverBinding,
+  hasNameHole,
   isGraphqlOperationBinding,
   messageBusBinding,
   methodsAgree,
+  namePatternFromSub,
+  namePatternKey,
+  namesAgree,
+  namesNothing,
   normalizePath,
   normalizeRuleBoundary,
   packageExportBinding,
@@ -521,7 +580,7 @@ export {
   runtimeConfigBinding,
   semanticsAgree,
   servesRequest,
-  storageRelationalBinding,
+  storageBinding,
   typeDefinitionKey,
   validateRule,
   withDefinitionsInlined

package/dist/{schemas-N9GyG0Sn.d.cts → schemas-D6hKT-zV.d.cts}

@@ -124,14 +124,11 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     instanceName: z.ZodString;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>, z.ZodObject<{
-    name: z.ZodLiteral<"storage-relational">;
-    storageSystem: z.ZodEnum<{
-        postgres: "postgres";
-        mysql: "mysql";
-        sqlite: "sqlite";
-    }>;
+    name: z.ZodLiteral<"storage">;
+    storageSystem: z.ZodString;
     scope: z.ZodString;
-    table: z.ZodNullable<z.ZodString>;
+    container: z.ZodNullable<z.ZodString>;
+    accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"message-bus">;
     messageBus: z.ZodEnum<{
@@ -192,17 +189,14 @@ declare const RuntimeConfigSemanticsSchema: z.ZodObject<{
 }, z.core.$strip>;
 type RuntimeConfigSemantics = z.infer<typeof RuntimeConfigSemanticsSchema>;
 
-declare const StorageRelationalSemanticsSchema: z.ZodObject<{
-    name: z.ZodLiteral<"storage-relational">;
-    storageSystem: z.ZodEnum<{
-        postgres: "postgres";
-        mysql: "mysql";
-        sqlite: "sqlite";
-    }>;
+declare const StorageSemanticsSchema: z.ZodObject<{
+    name: z.ZodLiteral<"storage">;
+    storageSystem: z.ZodString;
     scope: z.ZodString;
-    table: z.ZodNullable<z.ZodString>;
+    container: z.ZodNullable<z.ZodString>;
+    accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
-type StorageRelationalSemantics = z.infer<typeof StorageRelationalSemanticsSchema>;
+type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -320,14 +314,11 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         instanceName: z.ZodString;
         name: z.ZodLiteral<"runtime-config">;
     }, z.core.$strip>, z.ZodObject<{
-        name: z.ZodLiteral<"storage-relational">;
-        storageSystem: z.ZodEnum<{
-            postgres: "postgres";
-            mysql: "mysql";
-            sqlite: "sqlite";
-        }>;
+        name: z.ZodLiteral<"storage">;
+        storageSystem: z.ZodString;
         scope: z.ZodString;
-        table: z.ZodNullable<z.ZodString>;
+        container: z.ZodNullable<z.ZodString>;
+        accessPath: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         name: z.ZodLiteral<"message-bus">;
         messageBus: z.ZodEnum<{
@@ -429,4 +420,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageRelationalSemantics as p, StorageRelationalSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, routePathAdmits as v, typeDefinitionKey as w, withDefinitionsInlined as x };
+export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, routePathAdmits as v, typeDefinitionKey as w, withDefinitionsInlined as x };

package/dist/{schemas-N9GyG0Sn.d.ts → schemas-D6hKT-zV.d.ts}

@@ -124,14 +124,11 @@ declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     instanceName: z.ZodString;
     name: z.ZodLiteral<"runtime-config">;
 }, z.core.$strip>, z.ZodObject<{
-    name: z.ZodLiteral<"storage-relational">;
-    storageSystem: z.ZodEnum<{
-        postgres: "postgres";
-        mysql: "mysql";
-        sqlite: "sqlite";
-    }>;
+    name: z.ZodLiteral<"storage">;
+    storageSystem: z.ZodString;
     scope: z.ZodString;
-    table: z.ZodNullable<z.ZodString>;
+    container: z.ZodNullable<z.ZodString>;
+    accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"message-bus">;
     messageBus: z.ZodEnum<{
@@ -192,17 +189,14 @@ declare const RuntimeConfigSemanticsSchema: z.ZodObject<{
 }, z.core.$strip>;
 type RuntimeConfigSemantics = z.infer<typeof RuntimeConfigSemanticsSchema>;
 
-declare const StorageRelationalSemanticsSchema: z.ZodObject<{
-    name: z.ZodLiteral<"storage-relational">;
-    storageSystem: z.ZodEnum<{
-        postgres: "postgres";
-        mysql: "mysql";
-        sqlite: "sqlite";
-    }>;
+declare const StorageSemanticsSchema: z.ZodObject<{
+    name: z.ZodLiteral<"storage">;
+    storageSystem: z.ZodString;
     scope: z.ZodString;
-    table: z.ZodNullable<z.ZodString>;
+    container: z.ZodNullable<z.ZodString>;
+    accessPath: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
-type StorageRelationalSemantics = z.infer<typeof StorageRelationalSemanticsSchema>;
+type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
 
 /**
  * @suss/ir-core schemas: primitives shared by every suss IR.
@@ -320,14 +314,11 @@ declare const BoundaryBindingSchema: z.ZodObject<{
         instanceName: z.ZodString;
         name: z.ZodLiteral<"runtime-config">;
     }, z.core.$strip>, z.ZodObject<{
-        name: z.ZodLiteral<"storage-relational">;
-        storageSystem: z.ZodEnum<{
-            postgres: "postgres";
-            mysql: "mysql";
-            sqlite: "sqlite";
-        }>;
+        name: z.ZodLiteral<"storage">;
+        storageSystem: z.ZodString;
         scope: z.ZodString;
-        table: z.ZodNullable<z.ZodString>;
+        container: z.ZodNullable<z.ZodString>;
+        accessPath: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         name: z.ZodLiteral<"message-bus">;
         messageBus: z.ZodEnum<{
@@ -429,4 +420,4 @@ declare const TypeShapeSchema: z.ZodType<TypeShape>;
  */
 declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;
 
-export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageRelationalSemantics as p, StorageRelationalSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, routePathAdmits as v, typeDefinitionKey as w, withDefinitionsInlined as x };
+export { BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, methodsAgree as t, normalizePath as u, routePathAdmits as v, typeDefinitionKey as w, withDefinitionsInlined as x };

package/dist/schemas.cjs

@@ -34,7 +34,7 @@ __export(schemas_exports, {
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
   SemanticsSchema: () => SemanticsSchema,
   SourceLocationSchema: () => SourceLocationSchema,
-  StorageRelationalSemanticsSchema: () => StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema: () => StorageSemanticsSchema,
   TypeShapeSchema: () => TypeShapeSchema,
   typeDefinitionKey: () => typeDefinitionKey,
   withDefinitionsInlined: () => withDefinitionsInlined
@@ -446,29 +446,43 @@ var runtimeConfigSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/storageRelational.ts
+// src/semantics/storage.ts
 var import_zod8 = require("zod");
-var StorageRelationalSemanticsSchema = import_zod8.z.object({
-  name: import_zod8.z.literal("storage-relational"),
-  storageSystem: import_zod8.z.enum(["postgres", "mysql", "sqlite"]),
+var StorageSemanticsSchema = import_zod8.z.object({
+  name: import_zod8.z.literal("storage"),
   /**
-   * The ORM or driver scope. A single-database setup uses `"default"`,
-   * and a monorepo with several schemas gives each one its own value.
+   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
+   * products' containers can share a name, so this keeps them apart,
+   * and it is what a finding message calls the store.
+   */
+  storageSystem: import_zod8.z.string(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
    */
   scope: import_zod8.z.string(),
   /**
-   * The table or model name as the schema declares it, or null when
-   * the source states one this reader could not settle. A null table
-   * pairs with nothing, rather than with whatever its source text
-   * happens to spell.
+   * The table, bucket, collection, or index, as the source declares
+   * it, or null when the source states one this reader could not
+   * settle. A null container pairs with nothing, rather than with
+   * whatever its source text happens to spell.
+   */
+  container: import_zod8.z.string().nullable(),
+  /**
+   * A secondary way into the container, a DynamoDB global secondary
+   * index or an Elasticsearch alias, each with its own key fields.
+   * Null means the container's own primary way in. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
    */
-  table: import_zod8.z.string().nullable()
+  accessPath: import_zod8.z.string().nullable()
 });
-var storageRelationalSemantics = defineBoundarySemantics({
-  name: "storage-relational",
-  schema: StorageRelationalSemanticsSchema,
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
   behavior: {
-    /** A query returns rows, not a status and a body. */
+    /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
     reportsUnpairedItself: false,
     identityKey: () => null
@@ -482,7 +496,7 @@ var SemanticsSchema = import_zod9.z.discriminatedUnion("name", [
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
-  storageRelationalSemantics.schema,
+  storageSemantics.schema,
   messageBusSemantics.schema
 ]);
 var DEFINITIONS = [
@@ -491,7 +505,7 @@ var DEFINITIONS = [
   graphqlResolverSemantics,
   graphqlOperationSemantics,
   runtimeConfigSemantics,
-  storageRelationalSemantics,
+  storageSemantics,
   messageBusSemantics
 ];
 var BY_NAME = new Map(
@@ -632,7 +646,7 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
   withDefinitionsInlined

package/dist/schemas.d.cts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageRelationalSemanticsSchema, T as TypeShape, r as TypeShapeSchema, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.cjs';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.cjs';

package/dist/schemas.d.ts

@@ -1,2 +1,2 @@
 import 'zod';
-export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageRelationalSemanticsSchema, T as TypeShape, r as TypeShapeSchema, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-N9GyG0Sn.js';
+export { B as BoundaryBindingSchema, C as ConfidenceInfoSchema, a as ConfidenceLevelSchema, b as ConfidenceSourceSchema, c as CorroborationSchema, f as DeployableUnitSchema, g as FunctionCallSemanticsSchema, h as GraphqlOperationSemanticsSchema, j as GraphqlResolverSemanticsSchema, k as MessageBusSemanticsSchema, l as RestSemanticsSchema, n as RuntimeConfigSemanticsSchema, o as SemanticsSchema, d as SourceLocationSchema, q as StorageSemanticsSchema, T as TypeShape, r as TypeShapeSchema, w as typeDefinitionKey, x as withDefinitionsInlined } from './schemas-D6hKT-zV.js';

package/dist/schemas.js

@@ -13,11 +13,11 @@ import {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
   withDefinitionsInlined
-} from "./chunk-WKR5SU4N.js";
+} from "./chunk-TEXSN75M.js";
 export {
   BoundaryBindingSchema,
   ConfidenceInfoSchema,
@@ -33,7 +33,7 @@ export {
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
   SourceLocationSchema,
-  StorageRelationalSemanticsSchema,
+  StorageSemanticsSchema,
   TypeShapeSchema,
   typeDefinitionKey,
   withDefinitionsInlined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/ir-core",
-  "version": "0.5.11",
+  "version": "0.7.0",
   "type": "module",
   "description": "Shared IR primitives for suss — type shapes, boundary bindings, source locations, and confidence. Imported by both @suss/behavioral-ir and @suss/intent-ir so neither depends on the other.",
   "keywords": [