@suss/ir-core 0.8.0 → 0.10.0

package/dist/index.cjs

@@ -30,6 +30,7 @@ __export(index_exports, {
   GraphqlOperationSemanticsSchema: () => GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema: () => GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema: () => MessageBusSemanticsSchema,
+  MetricSemanticsSchema: () => MetricSemanticsSchema,
   RestSemanticsSchema: () => RestSemanticsSchema,
   RuntimeConfigSemanticsSchema: () => RuntimeConfigSemanticsSchema,
   SemanticsSchema: () => SemanticsSchema,
@@ -42,6 +43,7 @@ __export(index_exports, {
   bodyShapesMatch: () => bodyShapesMatch,
   boundaryKey: () => boundaryKey,
   boundaryLabel: () => boundaryLabel,
+  boundaryNameString: () => boundaryNameString,
   busIdentityKey: () => busIdentityKey,
   busesAgree: () => busesAgree,
   canPair: () => canPair,
@@ -53,6 +55,7 @@ __export(index_exports, {
   ecsContainerInstanceName: () => ecsContainerInstanceName,
   exchangesHttpResponses: () => exchangesHttpResponses,
   fileInCodeScope: () => fileInCodeScope,
+  fixedTextLength: () => fixedTextLength,
   fnIdentityKey: () => fnIdentityKey,
   formatChannel: () => formatChannel,
   functionCallBinding: () => functionCallBinding,
@@ -63,6 +66,8 @@ __export(index_exports, {
   isGraphqlOperationBinding: () => isGraphqlOperationBinding,
   messageBusBinding: () => messageBusBinding,
   methodsAgree: () => methodsAgree,
+  metricBinding: () => metricBinding,
+  metricIdentityKey: () => metricIdentityKey,
   namePatternFromSub: () => namePatternFromSub,
   namePatternKey: () => namePatternKey,
   namesAgree: () => namesAgree,
@@ -71,13 +76,19 @@ __export(index_exports, {
   normalizeRuleBoundary: () => normalizeRuleBoundary,
   packageExportBinding: () => packageExportBinding,
   pairingKey: () => pairingKey,
+  parseBoundaryName: () => parseBoundaryName,
   parseChannel: () => parseChannel,
+  patternHole: () => patternHole,
+  referenceFromName: () => referenceFromName,
+  referenceName: () => referenceName,
+  referenceOf: () => referenceOf,
   reportsUnpairedItself: () => reportsUnpairedItself,
   restBinding: () => restBinding,
   routePathAdmits: () => routePathAdmits,
   ruleBoundaryMatchesKey: () => ruleBoundaryMatchesKey,
   runtimeConfigBinding: () => runtimeConfigBinding,
   semanticsAgree: () => semanticsAgree,
+  semconvAttributes: () => semconvAttributes,
   servesRequest: () => servesRequest,
   storageBinding: () => storageBinding,
   typeDefinitionKey: () => typeDefinitionKey,
@@ -104,6 +115,10 @@ var GraphqlOperationSemanticsSchema = import_zod.z.object({
 var graphqlOperationSemantics = defineBoundarySemantics({
   name: "graphql-operation",
   schema: GraphqlOperationSemanticsSchema,
+  semconv: {
+    operationName: { name: "graphql.operation.name" },
+    operationType: { name: "graphql.operation.type" }
+  },
   behavior: {
     /**
      * An operation gets a data-and-errors document back, which the
@@ -131,12 +146,15 @@ function fnIdentityKey(packageName, exportPath) {
 function busIdentityKey(messageBus, subject) {
   return `bus:${messageBus} ${subject}`;
 }
+function metricIdentityKey(metricSystem, metricType) {
+  return `metric:${metricSystem} ${metricType}`;
+}
 
 // src/schemas.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // src/semantics/registry.ts
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 
 // src/semantics/functionCall.ts
 var import_zod2 = require("zod");
@@ -174,6 +192,9 @@ var FunctionCallSemanticsSchema = import_zod2.z.object({
 var functionCallSemantics = defineBoundarySemantics({
   name: "function-call",
   schema: FunctionCallSemanticsSchema,
+  // A call that never leaves the process does not produce a span, and
+  // the conventions do not name one. All of it is ours.
+  semconv: {},
   behavior: {
     /** A call returns a value, which is not a status and a body. */
     exchangesHttpResponses: false,
@@ -214,6 +235,9 @@ var GraphqlResolverSemanticsSchema = import_zod3.z.object({
 var graphqlResolverSemantics = defineBoundarySemantics({
   name: "graphql-resolver",
   schema: GraphqlResolverSemanticsSchema,
+  // The conventions name the operation a client sent, not the
+  // resolver the server ran for one field of it.
+  semconv: {},
   behavior: {
     /** A resolver returns a field value, not a status and a body. */
     exchangesHttpResponses: false,
@@ -262,8 +286,11 @@ function channelsPair(a, b) {
 var MessageBusSemanticsSchema = import_zod4.z.object({
   name: import_zod4.z.literal("message-bus"),
   messageBus: import_zod4.z.enum([
-    "sqs",
-    "sns",
+    // The conventions spell the two AWS buses this way, one with an
+    // underscore and one with a dot, so these are their strings and
+    // not a typo.
+    "aws_sqs",
+    "aws.sns",
     "s3",
     "eventbridge",
     "bullmq",
@@ -284,6 +311,10 @@ var MessageBusSemanticsSchema = import_zod4.z.object({
 var messageBusSemantics = defineBoundarySemantics({
   name: "message-bus",
   schema: MessageBusSemanticsSchema,
+  semconv: {
+    messageBus: { name: "messaging.system" },
+    channel: { name: "messaging.destination.name" }
+  },
   behavior: {
     /** A message goes onto the channel and nothing comes back. */
     exchangesHttpResponses: false,
@@ -342,25 +373,58 @@ var messageBusSemantics = defineBoundarySemantics({
   }
 });
 
-// src/semantics/rest.ts
+// src/semantics/metric.ts
 var import_zod5 = require("zod");
-var RestSemanticsSchema = import_zod5.z.object({
-  name: import_zod5.z.literal("rest"),
+var MetricSemanticsSchema = import_zod5.z.object({
+  name: import_zod5.z.literal("metric"),
+  /** Which system the series lives in: cloud-monitoring, cloudwatch. */
+  metricSystem: import_zod5.z.string(),
+  /**
+   * The type string the system knows the metric by, spelled the way
+   * both sides spell it. Null when the source states one this reader
+   * could not settle, as with a query it could not read: a metric
+   * nobody could name pairs with nothing rather than with whatever
+   * happens to share its source text.
+   */
+  metricType: import_zod5.z.string().nullable()
+});
+var metricSemantics = defineBoundarySemantics({
+  name: "metric",
+  schema: MetricSemanticsSchema,
+  // OpenTelemetry knows a metric by its instrument name, and has no
+  // attribute for the system it lives in or the type string it goes by.
+  semconv: {},
+  behavior: {
+    exchangesHttpResponses: false,
+    reportsUnpairedItself: false,
+    identityKey(semantics) {
+      if (semantics.metricType === null) {
+        return null;
+      }
+      return metricIdentityKey(semantics.metricSystem, semantics.metricType);
+    }
+  }
+});
+
+// src/semantics/rest.ts
+var import_zod6 = require("zod");
+var RestSemanticsSchema = import_zod6.z.object({
+  name: import_zod6.z.literal("rest"),
   /**
    * Uppercase HTTP method ("GET", "POST", …), `"*"` for a handler that
    * responds to every method, or null when this source does not say
    * which method.
    */
-  method: import_zod5.z.string().min(1).nullable(),
+  method: import_zod6.z.string().min(1).nullable(),
   /** Normalized route path ("/users/{id}"), or null when this source does not give one. */
-  path: import_zod5.z.string().min(1).nullable(),
+  path: import_zod6.z.string().min(1).nullable(),
   /**
    * Status codes the producing source explicitly declared (OpenAPI
    * responses, CFN MethodResponses, ts-rest router statuses). They are
    * kept here so the pairing layer can see them without unwrapping any
    * metadata. Absent, or empty, for a source that was inferred.
    */
-  declaredResponses: import_zod5.z.array(import_zod5.z.number()).optional()
+  declaredResponses: import_zod6.z.array(import_zod6.z.number()).optional()
 });
 function normalizePath(path) {
   let normalized = path.replace(/:([a-zA-Z_]\w*)/g, "{$1}");
@@ -399,6 +463,14 @@ function routePathAdmits(declaredPath, requestPath) {
 var restSemantics = defineBoundarySemantics({
   name: "rest",
   schema: RestSemanticsSchema,
+  semconv: {
+    // A span states the one method a request used, so a route that
+    // responds to every method has nothing to compare.
+    method: { name: "http.request.method", placeholderValues: ["*"] },
+    path: { name: "http.route" }
+    // declaredResponses is a list, and http.response.status_code is
+    // the one status a request got back.
+  },
   behavior: {
     /** A request goes out, a status and a body come back. */
     exchangesHttpResponses: true,
@@ -471,12 +543,12 @@ var restSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/runtimeConfig.ts
-var import_zod7 = require("zod");
+var import_zod8 = require("zod");
 
 // src/deployableUnit.ts
-var import_zod6 = require("zod");
-var DeployableUnitSchema = import_zod6.z.object({
-  deploymentTarget: import_zod6.z.enum([
+var import_zod7 = require("zod");
+var DeployableUnitSchema = import_zod7.z.object({
+  deploymentTarget: import_zod7.z.enum([
     "lambda",
     "ecs-task",
     "container",
@@ -485,7 +557,7 @@ var DeployableUnitSchema = import_zod6.z.object({
   ]),
   // An empty name would agree with every other empty name, so a unit
   // with no name has to leave the field off instead.
-  instanceName: import_zod6.z.string().min(1)
+  instanceName: import_zod7.z.string().min(1)
 });
 function ecsContainerInstanceName(taskDefinitionLogicalId, containerName) {
   return `${taskDefinitionLogicalId}/${containerName}`;
@@ -493,11 +565,15 @@ function ecsContainerInstanceName(taskDefinitionLogicalId, containerName) {
 
 // src/semantics/runtimeConfig.ts
 var RuntimeConfigSemanticsSchema = DeployableUnitSchema.extend({
-  name: import_zod7.z.literal("runtime-config")
+  name: import_zod8.z.literal("runtime-config")
 });
 var runtimeConfigSemantics = defineBoundarySemantics({
   name: "runtime-config",
   schema: RuntimeConfigSemanticsSchema,
+  // service.name and cloud.resource_id name the same deployable, but
+  // instanceName is the deployment template's logical id, which is
+  // neither of those strings.
+  semconv: {},
   behavior: {
     /** A process reads its config at startup, and nothing replies. */
     exchangesHttpResponses: false,
@@ -507,28 +583,30 @@ var runtimeConfigSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/storage.ts
-var import_zod8 = require("zod");
-var StorageSemanticsSchema = import_zod8.z.object({
-  name: import_zod8.z.literal("storage"),
+var import_zod9 = require("zod");
+var StorageSemanticsSchema = import_zod9.z.object({
+  name: import_zod9.z.literal("storage"),
   /**
-   * Which store this is: postgres, mysql, sqlite, dynamodb. Two
-   * products' containers can share a name, so this keeps them apart,
-   * and it is what a finding message calls the store.
+   * Which store this is: postgresql, mysql, aws.dynamodb, or our own
+   * word for one OpenTelemetry never named, such as s3. Two products'
+   * containers can share a name, so this keeps them apart.
    */
-  storageSystem: import_zod8.z.string(),
+  storageSystem: import_zod9.z.string(),
   /**
    * The ORM, schema, or deployment scope. A single-database setup uses
    * `"default"`, and a monorepo with several schemas gives each one its
    * own value.
    */
-  scope: import_zod8.z.string(),
+  scope: import_zod9.z.string(),
   /**
    * The table, bucket, collection, or index, as the source declares
    * it, or null when the source states one this reader could not
    * settle. A null container pairs with nothing, rather than with
-   * whatever its source text happens to spell.
+   * whatever its source text happens to spell. The string is in the
+   * boundary-name syntax: a literal, a pattern with `{}` holes, or a
+   * reference, and `parseBoundaryName` is the one reader of it.
    */
-  container: import_zod8.z.string().nullable(),
+  container: import_zod9.z.string().nullable(),
   /**
    * A secondary way into the container, a DynamoDB global secondary
    * index or an Elasticsearch alias, each with its own key fields.
@@ -536,11 +614,19 @@ var StorageSemanticsSchema = import_zod8.z.object({
    * index and a query through the table are different accesses, so
    * they pair separately.
    */
-  accessPath: import_zod8.z.string().nullable()
+  accessPath: import_zod9.z.string().nullable()
 });
 var storageSemantics = defineBoundarySemantics({
   name: "storage",
   schema: StorageSemanticsSchema,
+  semconv: {
+    storageSystem: { name: "db.system.name" },
+    // "default" is our word for a source that named no database.
+    scope: { name: "db.namespace", placeholderValues: ["default"] },
+    container: { name: "db.collection.name" }
+    // A secondary index has no attribute of its own, so accessPath
+    // stays our word.
+  },
   behavior: {
     /** A query returns rows or items, not a status and a body. */
     exchangesHttpResponses: false,
@@ -550,14 +636,15 @@ var storageSemantics = defineBoundarySemantics({
 });
 
 // src/semantics/registry.ts
-var SemanticsSchema = import_zod9.z.discriminatedUnion("name", [
+var SemanticsSchema = import_zod10.z.discriminatedUnion("name", [
   restSemantics.schema,
   functionCallSemantics.schema,
   graphqlResolverSemantics.schema,
   graphqlOperationSemantics.schema,
   runtimeConfigSemantics.schema,
   storageSemantics.schema,
-  messageBusSemantics.schema
+  messageBusSemantics.schema,
+  metricSemantics.schema
 ]);
 var DEFINITIONS = [
   restSemantics,
@@ -566,48 +653,55 @@ var DEFINITIONS = [
   graphqlOperationSemantics,
   runtimeConfigSemantics,
   storageSemantics,
-  messageBusSemantics
+  messageBusSemantics,
+  metricSemantics
 ];
 var BY_NAME = new Map(
   DEFINITIONS.map((d) => [d.name, d])
 );
 function behaviorOf(semantics) {
-  const definition = BY_NAME.get(semantics.name);
+  return definitionFor(semantics.name).behavior;
+}
+function definitionFor(name) {
+  const definition = BY_NAME.get(name);
   if (definition === void 0) {
-    throw new Error(`no boundary behavior for semantics "${semantics.name}"`);
+    throw new Error(`no boundary definition for semantics "${name}"`);
   }
-  return definition.behavior;
+  return definition;
+}
+function semconvMappingOf(semantics) {
+  return definitionFor(semantics.name).semconv;
 }
 function allBehaviors() {
   return DEFINITIONS.map((d) => d.behavior);
 }
 
 // src/schemas.ts
-var ConfidenceSourceSchema = import_zod10.z.enum([
+var ConfidenceSourceSchema = import_zod11.z.enum([
   "inferred_static",
   "inferred_ai",
   "declared",
   "derived"
 ]);
-var ConfidenceLevelSchema = import_zod10.z.enum(["high", "medium", "low"]);
-var CorroborationSchema = import_zod10.z.object({
-  outcome: import_zod10.z.enum(["observed", "refuted", "untested"]),
+var ConfidenceLevelSchema = import_zod11.z.enum(["high", "medium", "low"]);
+var CorroborationSchema = import_zod11.z.object({
+  outcome: import_zod11.z.enum(["observed", "refuted", "untested"]),
   /** Executions that produced a verdict for this claim. */
-  runs: import_zod10.z.number(),
+  runs: import_zod11.z.number(),
   /** Present when refuted: the input and observation that disagreed. */
-  counterexample: import_zod10.z.unknown().optional(),
+  counterexample: import_zod11.z.unknown().optional(),
   /** Present when untested: why no verdict was reachable. */
-  reason: import_zod10.z.string().optional()
+  reason: import_zod11.z.string().optional()
 });
-var ConfidenceInfoSchema = import_zod10.z.object({
+var ConfidenceInfoSchema = import_zod11.z.object({
   source: ConfidenceSourceSchema,
   level: ConfidenceLevelSchema,
   corroboration: CorroborationSchema.optional()
 });
-var SourceLocationSchema = import_zod10.z.object({
-  file: import_zod10.z.string(),
-  range: import_zod10.z.object({ start: import_zod10.z.number(), end: import_zod10.z.number() }),
-  exportName: import_zod10.z.string().nullable(),
+var SourceLocationSchema = import_zod11.z.object({
+  file: import_zod11.z.string(),
+  range: import_zod11.z.object({ start: import_zod11.z.number(), end: import_zod11.z.number() }),
+  exportName: import_zod11.z.string().nullable(),
   /**
    * The project the extract was pointed at, by the name that project
    * calls itself.
@@ -617,47 +711,47 @@ var SourceLocationSchema = import_zod10.z.object({
    * summaries puts them on top of each other. This field is what tells
    * them apart, and what a reader groups by.
    */
-  workspace: import_zod10.z.string().optional()
+  workspace: import_zod11.z.string().optional()
 });
-var BoundaryBindingSchema = import_zod10.z.object({
-  transport: import_zod10.z.string(),
+var BoundaryBindingSchema = import_zod11.z.object({
+  transport: import_zod11.z.string(),
   semantics: SemanticsSchema,
-  recognition: import_zod10.z.string()
+  recognition: import_zod11.z.string()
 });
 function typeDefinitionKey(ref) {
   return ref.def ?? null;
 }
-var TypeShapeSchema = import_zod10.z.lazy(
-  () => import_zod10.z.discriminatedUnion("type", [
-    import_zod10.z.object({
-      type: import_zod10.z.literal("record"),
-      properties: import_zod10.z.record(import_zod10.z.string(), TypeShapeSchema),
-      spreads: import_zod10.z.array(import_zod10.z.object({ sourceText: import_zod10.z.string() })).optional()
+var TypeShapeSchema = import_zod11.z.lazy(
+  () => import_zod11.z.discriminatedUnion("type", [
+    import_zod11.z.object({
+      type: import_zod11.z.literal("record"),
+      properties: import_zod11.z.record(import_zod11.z.string(), TypeShapeSchema),
+      spreads: import_zod11.z.array(import_zod11.z.object({ sourceText: import_zod11.z.string() })).optional()
     }),
-    import_zod10.z.object({ type: import_zod10.z.literal("dictionary"), values: TypeShapeSchema }),
-    import_zod10.z.object({ type: import_zod10.z.literal("array"), items: TypeShapeSchema }),
-    import_zod10.z.object({
-      type: import_zod10.z.literal("literal"),
-      value: import_zod10.z.union([import_zod10.z.string(), import_zod10.z.number(), import_zod10.z.boolean()]),
-      raw: import_zod10.z.string().optional()
+    import_zod11.z.object({ type: import_zod11.z.literal("dictionary"), values: TypeShapeSchema }),
+    import_zod11.z.object({ type: import_zod11.z.literal("array"), items: TypeShapeSchema }),
+    import_zod11.z.object({
+      type: import_zod11.z.literal("literal"),
+      value: import_zod11.z.union([import_zod11.z.string(), import_zod11.z.number(), import_zod11.z.boolean()]),
+      raw: import_zod11.z.string().optional()
     }),
-    import_zod10.z.object({ type: import_zod10.z.literal("text") }),
-    import_zod10.z.object({ type: import_zod10.z.literal("integer") }),
-    import_zod10.z.object({ type: import_zod10.z.literal("number") }),
-    import_zod10.z.object({ type: import_zod10.z.literal("boolean") }),
-    import_zod10.z.object({ type: import_zod10.z.literal("null") }),
-    import_zod10.z.object({ type: import_zod10.z.literal("undefined") }),
-    import_zod10.z.object({
-      type: import_zod10.z.literal("union"),
-      variants: import_zod10.z.array(TypeShapeSchema)
+    import_zod11.z.object({ type: import_zod11.z.literal("text") }),
+    import_zod11.z.object({ type: import_zod11.z.literal("integer") }),
+    import_zod11.z.object({ type: import_zod11.z.literal("number") }),
+    import_zod11.z.object({ type: import_zod11.z.literal("boolean") }),
+    import_zod11.z.object({ type: import_zod11.z.literal("null") }),
+    import_zod11.z.object({ type: import_zod11.z.literal("undefined") }),
+    import_zod11.z.object({
+      type: import_zod11.z.literal("union"),
+      variants: import_zod11.z.array(TypeShapeSchema)
     }),
-    import_zod10.z.object({
-      type: import_zod10.z.literal("ref"),
-      name: import_zod10.z.string(),
-      from: import_zod10.z.string().optional(),
-      def: import_zod10.z.string().optional()
+    import_zod11.z.object({
+      type: import_zod11.z.literal("ref"),
+      name: import_zod11.z.string(),
+      from: import_zod11.z.string().optional(),
+      def: import_zod11.z.string().optional()
     }),
-    import_zod10.z.object({ type: import_zod10.z.literal("unknown") })
+    import_zod11.z.object({ type: import_zod11.z.literal("unknown") })
   ])
 );
 var MAX_DEFINITION_DEPTH = 6;
@@ -701,6 +795,25 @@ function withDefinitionsInlined(shape, definitions, depth = 0, inProgress = /* @
   return shape;
 }
 
+// src/semconv.ts
+function semconvAttributes(binding) {
+  const semantics = binding.semantics;
+  const attributes = {};
+  for (const [field, attribute] of Object.entries(
+    semconvMappingOf(binding.semantics)
+  )) {
+    const value = semantics[field];
+    if (typeof value !== "string") {
+      continue;
+    }
+    if (attribute.placeholderValues?.includes(value) === true) {
+      continue;
+    }
+    attributes[attribute.name] = value;
+  }
+  return attributes;
+}
+
 // src/boundaryKey.ts
 function boundaryKey(binding) {
   return behaviorOf(binding.semantics).identityKey(binding.semantics);
@@ -753,29 +866,47 @@ function servesRequest(binding, method, path) {
   return serves(binding.semantics, method, path);
 }
 
-// src/codeScope.ts
-function codeScopePath(raw) {
-  return raw.trim().replace(/^\.\//, "").replace(/\/+$/, "");
-}
-function fileInCodeScope(file, scope) {
-  const prefix = codeScopePath(scope);
-  if (prefix === "" || prefix === ".") {
-    return true;
-  }
-  const path = codeScopePath(file);
-  return path === prefix || path.startsWith(`${prefix}/`);
-}
-
 // src/dispatch.ts
 function dispatchByType(table, value) {
   const handler = table[value.type];
   return handler(value);
 }
 
-// src/namePattern.ts
-var HOLE = /\{[^}]*\}/g;
+// src/boundaryName.ts
+var HOLE_SPLIT = /(\{[^}]*\})/;
 var SUB_TOKEN = /\$\{([^}]*)\}/g;
 var SUB_ESCAPE = /\$\{!/;
+function isHole(piece) {
+  return piece.startsWith("{") && piece.endsWith("}");
+}
+function parseBoundaryName(name) {
+  const parts = name.split(HOLE_SPLIT).filter((piece) => piece !== "").map(
+    (piece) => isHole(piece) ? { type: "hole", label: piece.slice(1, -1) } : { type: "text", text: piece }
+  );
+  const only = parts.length === 1 ? parts[0] : void 0;
+  if (only !== void 0 && only.type === "hole") {
+    return { type: "reference", path: only.label.split(".") };
+  }
+  if (parts.some((part) => part.type === "hole")) {
+    return { type: "pattern", parts };
+  }
+  return { type: "literal", value: name };
+}
+var partString = {
+  text: (part) => part.text,
+  hole: (part) => patternHole(part.label)
+};
+var nameString = {
+  literal: (name) => name.value,
+  pattern: (name) => name.parts.map((part) => dispatchByType(partString, part)).join(""),
+  reference: (name) => patternHole(name.path.join("."))
+};
+function boundaryNameString(name) {
+  return dispatchByType(nameString, name);
+}
+function patternHole(label) {
+  return `{${label}}`;
+}
 function namePatternFromSub(value) {
   if (Array.isArray(value)) {
     return typeof value[0] === "string" ? namePatternFromSub(value[0]) : null;
@@ -786,65 +917,123 @@ function namePatternFromSub(value) {
   if (SUB_ESCAPE.test(value)) {
     return null;
   }
-  return value.replace(SUB_TOKEN, (_whole, inner) => `{${inner}}`);
+  return value.replace(
+    SUB_TOKEN,
+    (_whole, inner) => patternHole(inner)
+  );
 }
 function namesNothing(name) {
-  return /^\{[^}]*\}$/.test(name);
+  return parseBoundaryName(name).type === "reference";
 }
 function hasNameHole(name) {
-  HOLE.lastIndex = 0;
-  return HOLE.test(name);
+  return parseBoundaryName(name).type !== "literal";
 }
 function namePatternKey(name) {
-  return name.replace(HOLE, "{}");
+  return dispatchByType(
+    {
+      literal: (parsed) => parsed.value,
+      pattern: (parsed) => boundaryNameString({
+        type: "pattern",
+        parts: parsed.parts.map(
+          (part) => part.type === "hole" ? { type: "hole", label: "" } : part
+        )
+      }),
+      reference: () => patternHole("")
+    },
+    parseBoundaryName(name)
+  );
+}
+function fixedTextLength(name) {
+  return dispatchByType(
+    {
+      literal: (parsed) => parsed.value.length,
+      pattern: (parsed) => parsed.parts.reduce(
+        (total, part) => total + (part.type === "text" ? part.text.length : 0),
+        0
+      ),
+      reference: () => 0
+    },
+    parseBoundaryName(name)
+  );
+}
+function quote(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function admits(pattern, name) {
-  const source = pattern.split(/(\{[^}]*\})/).map(
-    (part) => part.startsWith("{") && part.endsWith("}") ? ".+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
-  ).join("");
+  const source = pattern.parts.map((part) => part.type === "hole" ? ".+" : quote(part.text)).join("");
   return new RegExp(`^${source}$`).test(name);
 }
 function namesAgree(a, b) {
-  if (namesNothing(a) || namesNothing(b)) {
+  const left = parseBoundaryName(a);
+  const right = parseBoundaryName(b);
+  if (left.type === "reference" || right.type === "reference") {
     return false;
   }
-  if (a === b) {
-    return true;
-  }
-  const aHasHole = hasNameHole(a);
-  const bHasHole = hasNameHole(b);
-  if (aHasHole && bHasHole) {
+  if (left.type === "pattern" && right.type === "pattern") {
     return namePatternKey(a) === namePatternKey(b);
   }
-  if (aHasHole) {
-    return admits(a, b);
+  if (left.type === "pattern") {
+    return admits(left, b);
   }
-  if (bHasHole) {
-    return admits(b, a);
+  if (right.type === "pattern") {
+    return admits(right, a);
   }
-  return false;
+  return a === b;
+}
+function referenceName(reference) {
+  const path = [reference.root, ...reference.fields];
+  if (path.some((part) => part === "")) {
+    return null;
+  }
+  return boundaryNameString({ type: "reference", path });
+}
+function referenceOf(name) {
+  if (name.type !== "reference") {
+    return null;
+  }
+  const root = name.path[0];
+  if (root === void 0 || name.path.some((part) => part === "")) {
+    return null;
+  }
+  return { root, fields: name.path.slice(1) };
+}
+function referenceFromName(name) {
+  return referenceOf(parseBoundaryName(name));
+}
+
+// src/codeScope.ts
+function codeScopePath(raw) {
+  return raw.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function fileInCodeScope(file, scope) {
+  const prefix = codeScopePath(scope);
+  if (prefix === "" || prefix === ".") {
+    return true;
+  }
+  const path = codeScopePath(file);
+  return path === prefix || path.startsWith(`${prefix}/`);
 }
 
 // src/suppressions.ts
-var import_zod11 = require("zod");
-var SuppressionSideSchema = import_zod11.z.object({
-  summary: import_zod11.z.string().optional(),
-  transitionId: import_zod11.z.string().optional()
+var import_zod12 = require("zod");
+var SuppressionSideSchema = import_zod12.z.object({
+  summary: import_zod12.z.string().optional(),
+  transitionId: import_zod12.z.string().optional()
 }).optional();
-var SuppressionRuleSchema = import_zod11.z.object({
+var SuppressionRuleSchema = import_zod12.z.object({
   /**
    * The finding kind to match, behavioural or intent. It is an open
    * string here because this package is below both IRs, and the loader
    * is what validates it against the published kind enums.
    */
-  kind: import_zod11.z.string().optional(),
+  kind: import_zod12.z.string().optional(),
   /**
    * Boundary as a human-readable key, e.g. "GET /pet/{petId}" or
    * "fn:@acme/api::getUser". REST keys are normalized via the same
    * path normalizer the checkers use, so `:id` and `{id}` compare
    * equal.
    */
-  boundary: import_zod11.z.string().optional(),
+  boundary: import_zod12.z.string().optional(),
   /**
    * Consumer-side discriminators, the narrowest useful match. These
    * mean something only for behavioural findings: a rule that
@@ -867,15 +1056,15 @@ var SuppressionRuleSchema = import_zod11.z.object({
    * kind-only or boundary-only matches, which also silence future
    * regressions in that category.
    */
-  scope: import_zod11.z.enum(["narrow", "broad"]).default("narrow"),
+  scope: import_zod12.z.enum(["narrow", "broad"]).default("narrow"),
   /** Required human-written justification. */
-  reason: import_zod11.z.string().min(1),
+  reason: import_zod12.z.string().min(1),
   /** What to do when a finding matches. */
-  effect: import_zod11.z.enum(["mark", "downgrade", "hide"]).default("mark")
+  effect: import_zod12.z.enum(["mark", "downgrade", "hide"]).default("mark")
 }).strict();
-var SuppressionFileSchema = import_zod11.z.object({
-  version: import_zod11.z.literal(1),
-  rules: import_zod11.z.array(SuppressionRuleSchema)
+var SuppressionFileSchema = import_zod12.z.object({
+  version: import_zod12.z.literal(1),
+  rules: import_zod12.z.array(SuppressionRuleSchema)
 }).strict();
 function validateRule(rule) {
   if (rule.scope === "broad") {
@@ -1189,6 +1378,17 @@ function messageBusBinding(opts) {
     recognition: opts.recognition
   };
 }
+function metricBinding(opts) {
+  return {
+    transport: opts.metricSystem,
+    semantics: {
+      name: "metric",
+      metricSystem: opts.metricSystem,
+      metricType: namedOrNull(opts.metricType, "metric type")
+    },
+    recognition: opts.recognition
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BoundaryBindingSchema,
@@ -1201,6 +1401,7 @@ function messageBusBinding(opts) {
   GraphqlOperationSemanticsSchema,
   GraphqlResolverSemanticsSchema,
   MessageBusSemanticsSchema,
+  MetricSemanticsSchema,
   RestSemanticsSchema,
   RuntimeConfigSemanticsSchema,
   SemanticsSchema,
@@ -1213,6 +1414,7 @@ function messageBusBinding(opts) {
   bodyShapesMatch,
   boundaryKey,
   boundaryLabel,
+  boundaryNameString,
   busIdentityKey,
   busesAgree,
   canPair,
@@ -1224,6 +1426,7 @@ function messageBusBinding(opts) {
   ecsContainerInstanceName,
   exchangesHttpResponses,
   fileInCodeScope,
+  fixedTextLength,
   fnIdentityKey,
   formatChannel,
   functionCallBinding,
@@ -1234,6 +1437,8 @@ function messageBusBinding(opts) {
   isGraphqlOperationBinding,
   messageBusBinding,
   methodsAgree,
+  metricBinding,
+  metricIdentityKey,
   namePatternFromSub,
   namePatternKey,
   namesAgree,
@@ -1242,13 +1447,19 @@ function messageBusBinding(opts) {
   normalizeRuleBoundary,
   packageExportBinding,
   pairingKey,
+  parseBoundaryName,
   parseChannel,
+  patternHole,
+  referenceFromName,
+  referenceName,
+  referenceOf,
   reportsUnpairedItself,
   restBinding,
   routePathAdmits,
   ruleBoundaryMatchesKey,
   runtimeConfigBinding,
   semanticsAgree,
+  semconvAttributes,
   servesRequest,
   storageBinding,
   typeDefinitionKey,