import { z } from 'zod';

/**
 * One thing that gets deployed and runs on its own: a Lambda function,
 * an ECS task's container, a plain container, a k8s deployment, or an
 * edge worker.
 */

/**
 * `instanceName` is the stable identifier the deployment medium uses:
 * the CFN logical resource id for Lambda and ECS, the deployment name
 * for k8s, the container name for a plain container, and the script
 * name for an edge worker.
 */
declare const DeployableUnitSchema: z.ZodObject<{
    deploymentTarget: z.ZodEnum<{
        lambda: "lambda";
        "ecs-task": "ecs-task";
        container: "container";
        "k8s-deployment": "k8s-deployment";
        worker: "worker";
    }>;
    instanceName: z.ZodString;
}, z.core.$strip>;
type DeployableUnit = z.infer<typeof DeployableUnitSchema>;
/**
 * The `instanceName` for an ECS task's container: the task definition's
 * own logical id, plus the container name from CFN's
 * `ContainerDefinitions[*].Name`. Everyone who writes an ECS
 * `DeployableUnit`, and everyone who matches a routing edge against
 * one, has to put the two together the same way, so they all call this.
 */
declare function ecsContainerInstanceName(taskDefinitionLogicalId: string, containerName: string): string;

declare const FunctionCallSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"function-call">;
    module: z.ZodOptional<z.ZodString>;
    exportName: z.ZodOptional<z.ZodString>;
    package: z.ZodOptional<z.ZodString>;
    exportPath: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strip>;
type FunctionCallSemantics = z.infer<typeof FunctionCallSemanticsSchema>;
/**
 * Whether `module` is the name a project gave one of its modules rather
 * than a path. A path always has a separator in it, and a module name
 * never does, so a rewrite that makes paths relative leaves a name alone.
 */
declare function isModuleName(module: string): boolean;

declare const GraphqlOperationSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"graphql-operation">;
    operationName: z.ZodOptional<z.ZodString>;
    operationType: z.ZodEnum<{
        query: "query";
        mutation: "mutation";
        subscription: "subscription";
    }>;
}, z.core.$strip>;
type GraphqlOperationSemantics = z.infer<typeof GraphqlOperationSemanticsSchema>;

declare const GraphqlResolverSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"graphql-resolver">;
    typeName: z.ZodNullable<z.ZodString>;
    fieldName: z.ZodString;
}, z.core.$strip>;
type GraphqlResolverSemantics = z.infer<typeof GraphqlResolverSemanticsSchema>;

declare const MessageBusSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"message-bus">;
    messageBus: z.ZodEnum<{
        aws_sqs: "aws_sqs";
        "aws.sns": "aws.sns";
        s3: "s3";
        eventbridge: "eventbridge";
        aws_kinesis: "aws_kinesis";
        aws_firehose: "aws_firehose";
        gcp_pubsub: "gcp_pubsub";
        bullmq: "bullmq";
        kafka: "kafka";
        nats: "nats";
        "cloudflare-queues": "cloudflare-queues";
        "cloudflare-cron": "cloudflare-cron";
        "cloudflare-tail": "cloudflare-tail";
    }>;
    channel: z.ZodNullable<z.ZodString>;
}, z.core.$strip>;
type MessageBusSemantics = z.infer<typeof MessageBusSemanticsSchema>;
/**
 * The bus technologies the schema allows. It is derived from the enum,
 * so there is no hand-written copy to fall out of step.
 */
type MessageBusTechnology = MessageBusSemantics["messageBus"];

/**
 * The list of protocol definitions, and the lookups built from it.
 *
 * Each protocol module in this directory exports one
 * `BoundarySemanticsDefinition`. They are listed twice, once for the
 * schema union and once for the behavior lookup, and the type check at
 * the bottom fails compilation if the two lists differ. Besides its own
 * module, a new protocol needs one line in each list.
 */

/**
 * The discriminated union every boundary binding validates against.
 * Built from the protocol modules' own schemas.
 */
declare const SemanticsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    name: z.ZodLiteral<"rest">;
    method: z.ZodNullable<z.ZodString>;
    path: z.ZodNullable<z.ZodString>;
    declaredResponses: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"function-call">;
    module: z.ZodOptional<z.ZodString>;
    exportName: z.ZodOptional<z.ZodString>;
    package: z.ZodOptional<z.ZodString>;
    exportPath: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"graphql-resolver">;
    typeName: z.ZodNullable<z.ZodString>;
    fieldName: z.ZodString;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"graphql-operation">;
    operationName: z.ZodOptional<z.ZodString>;
    operationType: z.ZodEnum<{
        query: "query";
        mutation: "mutation";
        subscription: "subscription";
    }>;
}, z.core.$strip>, z.ZodObject<{
    deploymentTarget: z.ZodOptional<z.ZodEnum<{
        lambda: "lambda";
        "ecs-task": "ecs-task";
        container: "container";
        "k8s-deployment": "k8s-deployment";
        worker: "worker";
    }>>;
    instanceName: z.ZodOptional<z.ZodString>;
    name: z.ZodLiteral<"runtime-config">;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"storage">;
    storageSystem: z.ZodNullable<z.ZodString>;
    scope: z.ZodString;
    container: z.ZodNullable<z.ZodString>;
    accessPath: z.ZodNullable<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"message-bus">;
    messageBus: z.ZodEnum<{
        aws_sqs: "aws_sqs";
        "aws.sns": "aws.sns";
        s3: "s3";
        eventbridge: "eventbridge";
        aws_kinesis: "aws_kinesis";
        aws_firehose: "aws_firehose";
        gcp_pubsub: "gcp_pubsub";
        bullmq: "bullmq";
        kafka: "kafka";
        nats: "nats";
        "cloudflare-queues": "cloudflare-queues";
        "cloudflare-cron": "cloudflare-cron";
        "cloudflare-tail": "cloudflare-tail";
    }>;
    channel: z.ZodNullable<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"metric">;
    metricSystem: z.ZodString;
    metricType: z.ZodNullable<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{
    deploymentTarget: z.ZodEnum<{
        lambda: "lambda";
        "ecs-task": "ecs-task";
        container: "container";
        "k8s-deployment": "k8s-deployment";
        worker: "worker";
    }>;
    name: z.ZodLiteral<"unit-invocation">;
    instanceName: z.ZodNullable<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{
    name: z.ZodLiteral<"io">;
    target: z.ZodNullable<z.ZodString>;
}, z.core.$strip>], "name">;
type Semantics = z.infer<typeof SemanticsSchema>;

declare const RestSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"rest">;
    method: z.ZodNullable<z.ZodString>;
    path: z.ZodNullable<z.ZodString>;
    declaredResponses: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
}, z.core.$strip>;
type RestSemantics = z.infer<typeof RestSemanticsSchema>;
/**
 * Normalize a route path to a canonical form for matching.
 *
 * - Converts Express-style params (`:id`) to brace-style (`{id}`), and
 *   keeps a range modifier (`:id?`, `:rest+`, `:rest*`) inside the braces
 * - Strips trailing slashes (except bare `/`)
 * - Lowercases the static segments (params stay case-sensitive)
 */
declare function normalizePath(path: string): string;
/**
 * A path with every parameter name removed, for comparing two paths.
 * `/users/{id}` and `/users/:userId` both become `/users/{}`, since a
 * parameter's name does not change which requests the path serves. A
 * parameter's range stays, since `{tenant?}` serves a different set of
 * requests from `{tenant}`.
 */
declare function pathShape(path: string): string;
/**
 * Whether two REST methods mean the same thing. Equal methods agree,
 * and `"*"` agrees with any given method, because a handler that
 * responds to every method responds to this one. A null method means
 * the source never gave one, so it agrees with nothing.
 *
 * This is the REST counterpart of `busesAgree`. There is no list of
 * known methods, so a wildcard pairs with whatever methods consumers
 * write.
 */
declare function methodsAgree(a: string | null, b: string | null): boolean;
/**
 * Whether a declared route path admits a concrete request path. Both
 * are normalized first. A hole in the request path is compared as plain
 * text, so a mount pattern admits a route inside it and rejects a wider
 * route.
 */
declare function routePathAdmits(declaredPath: string, requestPath: string): boolean;
/** Whether two declared route paths serve at least one request in common. */
declare function routePathsMeet(a: string, b: string): boolean;

/**
 * The dedicated pass pairs on `(deploymentTarget, instanceName)`, which
 * is a deployable unit, so the two fields come from
 * `DeployableUnitSchema`.
 *
 * A provider sets both. The reading side is code, and code does not say
 * which deployment will run it, so a recognizer at a read leaves both
 * out and does not guess. The pairing pass takes the deployment from
 * the provider.
 */
declare const RuntimeConfigSemanticsSchema: z.ZodObject<{
    deploymentTarget: z.ZodOptional<z.ZodEnum<{
        lambda: "lambda";
        "ecs-task": "ecs-task";
        container: "container";
        "k8s-deployment": "k8s-deployment";
        worker: "worker";
    }>>;
    instanceName: z.ZodOptional<z.ZodString>;
    name: z.ZodLiteral<"runtime-config">;
}, z.core.$strip>;
type RuntimeConfigSemantics = z.infer<typeof RuntimeConfigSemanticsSchema>;

declare const StorageSemanticsSchema: z.ZodObject<{
    name: z.ZodLiteral<"storage">;
    storageSystem: z.ZodNullable<z.ZodString>;
    scope: z.ZodString;
    container: z.ZodNullable<z.ZodString>;
    accessPath: z.ZodNullable<z.ZodString>;
}, z.core.$strip>;
type StorageSemantics = z.infer<typeof StorageSemanticsSchema>;
/**
 * The store's label, such as `postgresql:invoices` or
 * `aws.dynamodb:editions#by-publication`. Storage has no identity key,
 * so `suss ask`, the pass that indexes accesses, and an intent doc all
 * refer to a store by this label.
 */
declare function storageLabel(semantics: StorageSemantics): string;
/** The storage system, or `<unknown engine>` when it is null. */
declare function storageSystemLabel(semantics: StorageSemantics): string;
/**
 * The column list an access records when it reads every column, as a
 * query without an explicit projection does. It means all columns and
 * does not list any, so code comparing column lists has to handle it
 * separately.
 */
declare const EVERY_FIELD = "*";
/** The store's label without the storage system, as a finding writes it. */
declare function storageContainerLabel(semantics: StorageSemantics): string;

/**
 * The zod schemas for the primitives every suss IR uses.
 *
 * `TypeShape` is the structure of a value. `BoundaryBinding` and its
 * `Semantics` variants identify a boundary. `SourceLocation` says where
 * something is in the source, and `Confidence` says how much to trust a
 * claim. Behavioral summaries and intent docs are both built from these,
 * so they live in a package of their own and neither IR depends on the
 * other.
 *
 * The schemas are the source of truth. The package index derives the
 * types from them with `z.infer`.
 */

declare const ConfidenceSourceSchema: z.ZodEnum<{
    inferred_static: "inferred_static";
    inferred_ai: "inferred_ai";
    declared: "declared";
    derived: "derived";
}>;
declare const ConfidenceLevelSchema: z.ZodEnum<{
    high: "high";
    medium: "medium";
    low: "low";
}>;
/**
 * The result of checking a claim by running the code (`suss
 * corroborate`). The harness generates inputs that satisfy the claim's
 * own conditions and runs the function on them.
 *
 * - `observed`: every run agreed with the claim.
 * - `refuted`: at least one run disagreed, which is either an extractor
 *   bug or a surprise. `counterexample` gives the input.
 * - `untested`: no run produced a verdict. No satisfying input was
 *   found, or every run hit a dependency the harness cannot supply.
 *
 * Corroboration adds evidence to a derived claim and never rewrites it.
 */
declare const CorroborationSchema: z.ZodObject<{
    outcome: z.ZodEnum<{
        observed: "observed";
        refuted: "refuted";
        untested: "untested";
    }>;
    runs: z.ZodNumber;
    counterexample: z.ZodOptional<z.ZodUnknown>;
    reason: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
declare const ConfidenceInfoSchema: z.ZodObject<{
    source: z.ZodEnum<{
        inferred_static: "inferred_static";
        inferred_ai: "inferred_ai";
        declared: "declared";
        derived: "derived";
    }>;
    level: z.ZodEnum<{
        high: "high";
        medium: "medium";
        low: "low";
    }>;
    corroboration: z.ZodOptional<z.ZodObject<{
        outcome: z.ZodEnum<{
            observed: "observed";
            refuted: "refuted";
            untested: "untested";
        }>;
        runs: z.ZodNumber;
        counterexample: z.ZodOptional<z.ZodUnknown>;
        reason: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>;
}, z.core.$strip>;
declare const SourceLocationSchema: z.ZodObject<{
    file: z.ZodString;
    range: z.ZodObject<{
        start: z.ZodNumber;
        end: z.ZodNumber;
    }, z.core.$strip>;
    span: z.ZodOptional<z.ZodObject<{
        start: z.ZodNumber;
        end: z.ZodNumber;
    }, z.core.$strip>>;
    exportName: z.ZodNullable<z.ZodString>;
    workspace: z.ZodOptional<z.ZodString>;
    module: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
declare const BoundaryBindingSchema: z.ZodObject<{
    transport: z.ZodString;
    semantics: z.ZodDiscriminatedUnion<[z.ZodObject<{
        name: z.ZodLiteral<"rest">;
        method: z.ZodNullable<z.ZodString>;
        path: z.ZodNullable<z.ZodString>;
        declaredResponses: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"function-call">;
        module: z.ZodOptional<z.ZodString>;
        exportName: z.ZodOptional<z.ZodString>;
        package: z.ZodOptional<z.ZodString>;
        exportPath: z.ZodOptional<z.ZodArray<z.ZodString>>;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"graphql-resolver">;
        typeName: z.ZodNullable<z.ZodString>;
        fieldName: z.ZodString;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"graphql-operation">;
        operationName: z.ZodOptional<z.ZodString>;
        operationType: z.ZodEnum<{
            query: "query";
            mutation: "mutation";
            subscription: "subscription";
        }>;
    }, z.core.$strip>, z.ZodObject<{
        deploymentTarget: z.ZodOptional<z.ZodEnum<{
            lambda: "lambda";
            "ecs-task": "ecs-task";
            container: "container";
            "k8s-deployment": "k8s-deployment";
            worker: "worker";
        }>>;
        instanceName: z.ZodOptional<z.ZodString>;
        name: z.ZodLiteral<"runtime-config">;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"storage">;
        storageSystem: z.ZodNullable<z.ZodString>;
        scope: z.ZodString;
        container: z.ZodNullable<z.ZodString>;
        accessPath: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"message-bus">;
        messageBus: z.ZodEnum<{
            aws_sqs: "aws_sqs";
            "aws.sns": "aws.sns";
            s3: "s3";
            eventbridge: "eventbridge";
            aws_kinesis: "aws_kinesis";
            aws_firehose: "aws_firehose";
            gcp_pubsub: "gcp_pubsub";
            bullmq: "bullmq";
            kafka: "kafka";
            nats: "nats";
            "cloudflare-queues": "cloudflare-queues";
            "cloudflare-cron": "cloudflare-cron";
            "cloudflare-tail": "cloudflare-tail";
        }>;
        channel: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"metric">;
        metricSystem: z.ZodString;
        metricType: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>, z.ZodObject<{
        deploymentTarget: z.ZodEnum<{
            lambda: "lambda";
            "ecs-task": "ecs-task";
            container: "container";
            "k8s-deployment": "k8s-deployment";
            worker: "worker";
        }>;
        name: z.ZodLiteral<"unit-invocation">;
        instanceName: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>, z.ZodObject<{
        name: z.ZodLiteral<"io">;
        target: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>], "name">;
    recognition: z.ZodString;
}, z.core.$strip>;
type TypeShape = {
    type: "record";
    properties: Record<string, TypeShape>;
    spreads?: Array<{
        sourceText: string;
    }> | undefined;
} | {
    type: "dictionary";
    values: TypeShape;
} | {
    type: "array";
    items: TypeShape;
} | {
    type: "literal";
    value: string | number | boolean;
    raw?: string | undefined;
} | {
    type: "text";
} | {
    type: "integer";
} | {
    type: "number";
} | {
    type: "boolean";
} | {
    type: "null";
} | {
    type: "undefined";
} | {
    type: "union";
    variants: TypeShape[];
} | {
    type: "ref";
    name: string;
    /**
     * Where this type is written down, when it is written down
     * anywhere. It is the key into the summary's table of definitions.
     *
     * A name does not identify a type. Every instantiation of one
     * generic reports the generic's own name and file, so `Omit<User,
     * "secret">` and `Omit<Order, "total">` are both `Omit`, and a
     * table keyed on that gives the second one the first one's fields.
     * This key is built from what the type actually is.
     */
    def?: string | undefined;
    /**
     * The file that declares this type, when the project declares it.
     * Absent for a name the language or a dependency defines, which
     * means the same thing everywhere.
     *
     * A name on its own does not identify a type. Two modules that each
     * declare a `User` produce the same ref, and `from` is the only
     * field that tells them apart.
     */
    from?: string | undefined;
} | {
    type: "unknown";
};
/**
 * The key a table of definitions uses for the type a ref points at,
 * which is the ref's `def`. Null for a ref without one, such as a name
 * the language or a dependency defines, and such a ref is never looked
 * up.
 */
declare function typeDefinitionKey(ref: {
    def?: string | undefined;
}): string | null;
declare const TypeShapeSchema: z.ZodType<TypeShape>;
/**
 * A shape with the definitions it refers to substituted back into it.
 *
 * Comparing two shapes means comparing their structure, and a ref has
 * none. Substituting the definitions once means no comparison has to
 * look anything up in a table.
 *
 * Substituting a definition does not count as a level of nesting. If it
 * did, a type six levels deep would come back three deep, and a
 * consumer reading a field past that would be told the provider lacks
 * it. A type that refers to itself stops at a key already substituted
 * on this path, the same cycle guard the shape walk uses.
 */
declare function withDefinitionsInlined(shape: TypeShape, definitions: Record<string, TypeShape> | undefined, depth?: number, inProgress?: ReadonlySet<string>): TypeShape;

export { storageLabel as A, BoundaryBindingSchema as B, ConfidenceInfoSchema as C, type DeployableUnit as D, EVERY_FIELD as E, type FunctionCallSemantics as F, type GraphqlOperationSemantics as G, storageSystemLabel as H, typeDefinitionKey as I, withDefinitionsInlined as J, type MessageBusSemantics as M, type RestSemantics as R, type Semantics as S, type TypeShape as T, ConfidenceLevelSchema as a, ConfidenceSourceSchema as b, CorroborationSchema as c, SourceLocationSchema as d, type MessageBusTechnology as e, DeployableUnitSchema as f, FunctionCallSemanticsSchema as g, GraphqlOperationSemanticsSchema as h, type GraphqlResolverSemantics as i, GraphqlResolverSemanticsSchema as j, MessageBusSemanticsSchema as k, RestSemanticsSchema as l, type RuntimeConfigSemantics as m, RuntimeConfigSemanticsSchema as n, SemanticsSchema as o, type StorageSemantics as p, StorageSemanticsSchema as q, TypeShapeSchema as r, ecsContainerInstanceName as s, isModuleName as t, methodsAgree as u, normalizePath as v, pathShape as w, routePathAdmits as x, routePathsMeet as y, storageContainerLabel as z };