@telorun/analyzer 0.68.0 → 0.69.0

package/dist/reconcile-module-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOlE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAgJD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAsEvB"}
+{"version":3,"file":"reconcile-module-versions.d.ts","sourceRoot":"","sources":["../src/reconcile-module-versions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOlE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;;;0CAI0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;2EACuE;IACvE,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AA+ID;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAChD,qBAAqB,CAsEvB"}

package/dist/reconcile-module-versions.js

@@ -19,15 +19,14 @@ const SOURCE = "telo-analyzer";
  *  **What this key cannot relate.** It compares ref *spellings*, so it groups by
  *  origin exactly and nothing else. Two consequences, both accepted:
  *
- *  - A module imported once by a registry ref and once by a relative path is two
- *    groups, so a version skew between them is not hoisted. Keying on what the
- *    module declares about itself would catch that case, but only by trusting a
- *    self-declared identity — which is what this change removes, and which
- *    cannot tell two same-named modules from different origins apart.
- *  - A bare `std/kv-store@0.4.0` and the equivalent direct
- *    `https://<registry>/std/kv-store/0.4.0/telo.yaml` are two groups. Relating
- *    them needs the configured registry base, which this pure, browser-safe
- *    function does not have. */
+ *  - A module imported once by an `oci://` ref and once by a relative path is
+ *    two groups, so a version skew between them is not hoisted. Keying on what
+ *    the module declares about itself would catch that case, but only by
+ *    trusting a self-declared identity — which is what this change removes, and
+ *    which cannot tell two same-named modules from different origins apart.
+ *  - An `oci://` ref and a direct `https://…/telo.yaml` URL serving the same
+ *    module are two groups. Relating them needs knowledge of the origin's
+ *    layout, which this pure, browser-safe function does not have. */
 function refIdentity(ref) {
     const base = ref.split("#")[0];
     if (!base || base.startsWith(".") || base.startsWith("/") || base.startsWith("file:")) {
@@ -137,8 +136,8 @@ export function reconcileModuleVersions(modules, importEdges) {
     // source normally maps to exactly one identity; the entry module has no
     // inbound edge and needs none (it is never reconciled against itself).
     //
-    // One source CAN be reached by two spellings of the same location (a bare
-    // registry ref and the direct URL it resolves to). Both name the same module
+    // One source CAN be reached by two spellings of the same location (a ref and
+    // the direct URL it resolves to). Both name the same module
     // at the same version, so either identity groups it correctly — but the choice
     // must not depend on edge iteration order, or the same graph could reconcile
     // differently across runs. First edge wins.

package/dist/release/release-plan.d.ts

@@ -51,7 +51,7 @@ export interface ModuleEvidence {
     readonly inlines: ReadonlyMap<ModuleKey, readonly string[]>;
     /**
      * Modules reached by an in-repo **relative** `imports:` source. A pinned
-     * registry ref is deliberately not an edge: pinning is the statement "I am not
+     * remote ref is deliberately not an edge: pinning is the statement "I am not
      * affected until I choose to be", and moving it is `telo upgrade`'s job.
      */
     readonly imports: readonly ModuleKey[];

package/dist/resolve-zone-containment.d.ts

@@ -81,8 +81,15 @@ export interface ZoneRegion {
  *  DECLARED it — the same resolver the projection takes, passed in rather than
  *  rebuilt so both walks agree about what a kind means. */
 export type DefinitionLookup = (kind: string, module?: string) => ResourceDefinition | undefined;
+/** A region as the WALK finds it, before any attribute is asked for: the slot
+ *  that opens it and everything it reaches. Every attribute query is a filter
+ *  over these, so a consumer wanting regions regardless of what they declare —
+ *  an editor drawing the enclosure, where a zone declaring no attribute is
+ *  still a zone — reads them directly instead of enumerating the vocabulary and
+ *  silently missing whatever is not in it. */
+export type ZoneProvider = Omit<ZoneRegion, "attribute" | "reason">;
 /**
- * Every region in the graph opened by a slot declaring `attribute`.
+ * Every region in the graph, keyed by the slot that opens it.
  *
  * The provider itself is NOT in `contents` — a zone constrains what runs inside
  * its body, not the resource that establishes it. A transaction's own
@@ -90,6 +97,7 @@ export type DefinitionLookup = (kind: string, module?: string) => ResourceDefini
  * treated the provider as contained would report the provider against its own
  * constraint.
  */
+export declare function findZoneProviders(graph: CallGraph, resolveDef: DefinitionLookup): ZoneProvider[];
 export declare function findZoneRegions(graph: CallGraph, resolveDef: DefinitionLookup, attribute: string): ZoneRegion[];
 /** Convenience for a consumer that only wants membership: every node id inside
  *  any region opened by `attribute`, mapped to the region that contains it. */

package/dist/resolve-zone-containment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-zone-containment.d.ts","sourceRoot":"","sources":["../src/resolve-zone-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;wDACoD;IACpD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;gFAKgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;8EAC0E;IAC1E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AA4GjG;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CA6Dd;AAoCD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAQjC;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAMtE"}
+{"version":3,"file":"resolve-zone-containment.d.ts","sourceRoot":"","sources":["../src/resolve-zone-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;wDACoD;IACpD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;gFAKgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;uEACmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;8EAC0E;IAC1E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;2DAE2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAC;AA4GjG;;;;;8CAK8C;AAC9C,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,GAC3B,YAAY,EAAE,CA0DhB;AAmBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CAad;AAoCD;+EAC+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAQjC;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAMtE"}

package/dist/resolve-zone-containment.js

@@ -91,7 +91,7 @@ function collect(graph, entries, contents, boundaries) {
     }
 }
 /**
- * Every region in the graph opened by a slot declaring `attribute`.
+ * Every region in the graph, keyed by the slot that opens it.
  *
  * The provider itself is NOT in `contents` — a zone constrains what runs inside
  * its body, not the resource that establishes it. A transaction's own
@@ -99,7 +99,7 @@ function collect(graph, entries, contents, boundaries) {
  * treated the provider as contained would report the provider against its own
  * constraint.
  */
-export function findZoneRegions(graph, resolveDef, attribute) {
+export function findZoneProviders(graph, resolveDef) {
     const regions = [];
     for (const node of graph.nodes.values()) {
         if (node.type !== "resource")
@@ -112,8 +112,7 @@ export function findZoneRegions(graph, resolveDef, attribute) {
         // properties rather than by knowing any kind's field names.
         for (const [slot, slotSchema] of providingSlots(rootSchema)) {
             const provides = readProvidesZone(slotSchema);
-            const reason = provides?.attributes[attribute];
-            if (!provides || typeof reason !== "string")
+            if (!provides)
                 continue;
             const contents = new Map();
             const boundaries = [];
@@ -147,8 +146,6 @@ export function findZoneRegions(graph, resolveDef, attribute) {
                 collect(graph, entries, contents, boundaries);
             }
             regions.push({
-                attribute,
-                reason,
                 provider: node,
                 slot,
                 attributes: provides.attributes,
@@ -159,6 +156,37 @@ export function findZoneRegions(graph, resolveDef, attribute) {
     }
     return regions;
 }
+/**
+ * Every region opened by a slot declaring `attribute`.
+ *
+ * A filter over {@link findZoneProviders}, so the walk is stated once: what an
+ * attribute query adds is which regions are in scope and the author's `reason`,
+ * which is the attribute's own value.
+ *
+ * **The provider list is memoized per graph**, because the filter made the walk
+ * unconditional: it used to skip the containment BFS for any provider not
+ * declaring the queried attribute, and six queries per analysis (four zone
+ * attributes plus two durable ones) became six full walks over every provider
+ * in the module. The cache is keyed on the CallGraph object, which is itself
+ * built once per analysis — so it lives exactly as long as the answer stays
+ * true, and a rebuilt graph gets a fresh one.
+ */
+const providersByGraph = new WeakMap();
+export function findZoneRegions(graph, resolveDef, attribute) {
+    let providers = providersByGraph.get(graph);
+    if (!providers) {
+        providers = findZoneProviders(graph, resolveDef);
+        providersByGraph.set(graph, providers);
+    }
+    const out = [];
+    for (const region of providers) {
+        const reason = region.attributes[attribute];
+        if (typeof reason !== "string")
+            continue;
+        out.push({ ...region, attribute, reason });
+    }
+    return out;
+}
 /** Field-map paths of every slot in a kind's schema carrying a provides-zone
  *  annotation, with the schema node at each. Walks properties, array items and
  *  `additionalProperties`, resolving local `$ref`s — the paths the call graph's

package/dist/resolve-zone-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAwKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CA+Y9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}
+{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAwKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAoZ9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}

package/dist/resolve-zone-requirements.js

@@ -175,7 +175,9 @@ export function projectZoneRequirements(args) {
             if (local)
                 return local;
         }
-        return graph.resourceByName(name);
+        // In the scope that WROTE the name: a bare reference means the reader's own
+        // module, and two libraries may each declare one.
+        return graph.resourceByName(name, from.manifest.metadata?.module);
     };
     const acceptedFor = (zone) => {
         const out = new Set([zone]);
@@ -550,7 +552,7 @@ export function runZoneAnalysis(args) {
         for (const [exportName, specs] of openExports) {
             if (!lib.exportedNames.has(exportName))
                 continue;
-            const node = graph.resourceByName(exportName);
+            const node = graph.resourceByName(exportName, lib.module);
             if (!node || node.manifest.metadata?.module !== lib.module) {
                 continue;
             }

package/dist/sources/default-sources.d.ts

@@ -1,8 +1,8 @@
 import type { ManifestSource } from "../types.js";
-/** The browser-safe built-in sources, in resolution order: HTTP fetch then
- *  registry. Node-specific sources (local filesystem) are supplied by the
- *  consuming package and passed alongside these into the `Loader` constructor.
- *  Callers that only want a subset (e.g. the editor, which brings its own
- *  registry adapters) construct the individual sources directly. */
-export declare function defaultSources(registryUrl?: string): ManifestSource[];
+/** The browser-safe built-in sources. Node-specific sources (local filesystem)
+ *  are supplied by the consuming package and passed alongside these into the
+ *  `Loader` constructor. Callers that only want a subset (e.g. the editor, which
+ *  brings its own manifest-cache adapter) construct the individual sources
+ *  directly. */
+export declare function defaultSources(): ManifestSource[];
 //# sourceMappingURL=default-sources.d.ts.map

package/dist/sources/default-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-sources.d.ts","sourceRoot":"","sources":["../../src/sources/default-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD;;;;oEAIoE;AACpE,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAErE"}
+{"version":3,"file":"default-sources.d.ts","sourceRoot":"","sources":["../../src/sources/default-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;gBAIgB;AAChB,wBAAgB,cAAc,IAAI,cAAc,EAAE,CAEjD"}

package/dist/sources/default-sources.js

@@ -1,10 +1,9 @@
 import { HttpSource } from "./http-source.js";
-import { RegistrySource } from "./registry-source.js";
-/** The browser-safe built-in sources, in resolution order: HTTP fetch then
- *  registry. Node-specific sources (local filesystem) are supplied by the
- *  consuming package and passed alongside these into the `Loader` constructor.
- *  Callers that only want a subset (e.g. the editor, which brings its own
- *  registry adapters) construct the individual sources directly. */
-export function defaultSources(registryUrl) {
-    return [new HttpSource(), new RegistrySource(registryUrl)];
+/** The browser-safe built-in sources. Node-specific sources (local filesystem)
+ *  are supplied by the consuming package and passed alongside these into the
+ *  `Loader` constructor. Callers that only want a subset (e.g. the editor, which
+ *  brings its own manifest-cache adapter) construct the individual sources
+ *  directly. */
+export function defaultSources() {
+    return [new HttpSource()];
 }

package/dist/sources/integrity.d.ts

@@ -43,8 +43,9 @@ export declare function verifyIntegrity(bytes: Uint8Array, integrity: string, de
 /** The single verified network read for remote manifests: fetch `fetchUrl`,
  *  verify the raw bytes against `integrity` (when pinned), and return both the
  *  bytes and the decoded text. The one choke point every network `ManifestSource`
- *  routes through, so verification cannot drift between them. `describe` names
- *  the artifact in error messages. */
+ *  routes through, so verification cannot drift between them — which is also why
+ *  the object-storage non-manifest check lives here rather than in each source.
+ *  `describe` names the artifact in error messages. */
 export declare function verifiedFetch(fetchUrl: string, integrity: string | undefined, describe: string): Promise<{
     bytes: Uint8Array;
     text: string;

package/dist/sources/integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAc7E;;;qDAGqD;AACrD,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAED;;;;;;;;8DAQ8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;sCAIsC;AACtC,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAU9C"}
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/sources/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAc7E;;;qDAGqD;AACrD,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhF;AAED;;;kFAGkF;AAClF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAIxE;AAED;;;;;;;;8DAQ8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAcD,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;gFAEgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAgBD;;;;;uDAKuD;AACvD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB9C"}

package/dist/sources/integrity.js

@@ -93,18 +93,41 @@ export async function verifyIntegrity(bytes, integrity, describe) {
             `the module may have been tampered with or republished.`);
     }
 }
+/** Object-storage backends (Cloudflare R2, S3) surface auth and permission
+ *  failures as a **200 with an XML error body**. Caught here rather than left to
+ *  the loader, which would parse the XML as YAML and report a downstream
+ *  `UNDEFINED_KIND` — naming the manifest's contents as the problem instead of
+ *  the origin that refused to serve it. Returns the failure detail, or `null`
+ *  when the body is not an XML error document. */
+function objectStorageError(text) {
+    const head = text.trimStart();
+    if (!head.startsWith("<?xml") && !head.startsWith("<Error"))
+        return null;
+    const code = text.match(/<Code>([^<]+)<\/Code>/);
+    const message = text.match(/<Message>([^<]+)<\/Message>/);
+    return code && message ? `${code[1]}: ${message[1]}` : text.slice(0, 200);
+}
 /** The single verified network read for remote manifests: fetch `fetchUrl`,
  *  verify the raw bytes against `integrity` (when pinned), and return both the
  *  bytes and the decoded text. The one choke point every network `ManifestSource`
- *  routes through, so verification cannot drift between them. `describe` names
- *  the artifact in error messages. */
+ *  routes through, so verification cannot drift between them — which is also why
+ *  the object-storage non-manifest check lives here rather than in each source.
+ *  `describe` names the artifact in error messages. */
 export async function verifiedFetch(fetchUrl, integrity, describe) {
     const response = await fetch(fetchUrl);
     if (!response.ok) {
         throw new Error(`Failed to fetch manifest ${describe}: ${response.status} ${response.statusText} (${fetchUrl})`);
     }
     const bytes = new Uint8Array(await response.arrayBuffer());
+    const text = new TextDecoder().decode(bytes);
+    // Before the integrity check: a bucket's error page hashes to something, and
+    // reporting a pin mismatch would name the wrong cause just as the loader does.
+    const storageError = objectStorageError(text);
+    if (storageError) {
+        throw new Error(`The origin returned a non-manifest response for ${describe} ` +
+            `(URL: ${fetchUrl}): ${storageError}`);
+    }
     if (integrity)
         await verifyIntegrity(bytes, integrity, describe);
-    return { bytes, text: new TextDecoder().decode(bytes) };
+    return { bytes, text };
 }

package/dist/sources/versioned-ref.d.ts

@@ -2,11 +2,11 @@
  *  ref, the version segment it currently names, and any inline pin. */
 export interface ParsedVersionedRef {
     /** The ref with its `@version` segment and integrity fragment removed —
-     *  `std/run`, `oci://ghcr.io/telorun/timer`. This is the identity a version
-     *  list is keyed by (the hub registers modules under exactly this form). */
+     *  `oci://ghcr.io/telorun/timer`. This is the identity a version list is keyed
+     *  by (the hub registers modules under exactly this form). */
     baseRef: string;
-    /** The version segment, raw — a registry `@version`, an OCI tag, or an OCI
-     *  digest reference (`sha256:…`). The caller applies its own SemVer check. */
+    /** The version segment, raw — an OCI tag or an OCI digest reference
+     *  (`sha256:…`). The caller applies its own SemVer check. */
     version: string;
     /** Telo's inline `sha256-<base64url>` pin, when the ref carried one. */
     integrity?: string;
@@ -15,12 +15,17 @@ export interface ParsedVersionedRef {
  *  upgradeable version — a local path, a bare `https://` URL, or an OCI ref
  *  with no explicit reference (an implicit `latest` is not a pin).
  *
- *  Browser-safe and transport-neutral: this is the *grammar* half of an
- *  upgrade, shared by the kernel transports (whose `refVersion` / `withVersion`
- *  delegate here) and the editor, which cannot use a transport at all — the
- *  *network* half (enumerating versions) is scheme-specific and stays behind
- *  `Transport.listVersions` on Node and the hub's `/module/versions` in the
- *  browser. */
+ *  Browser-safe: this is the *grammar* half of an upgrade, shared by the kernel
+ *  transports (whose `refVersion` / `withVersion` delegate here) and the editor,
+ *  which cannot use a transport at all — the *network* half (enumerating
+ *  versions) is scheme-specific and stays behind `Transport.listVersions` on
+ *  Node and the hub's `/module/versions` in the browser.
+ *
+ *  It is NOT transport-neutral: `oci://` is the only versionable grammar, named
+ *  literally below. That was equally true when the registry ref was the second
+ *  branch, and a third scheme still means editing this file — the versionable
+ *  set would have to become data the transports contribute before that claim
+ *  could be made honestly. */
 export declare function parseVersionedRef(ref: string): ParsedVersionedRef | null;
 /** `ref` rewritten to name `version`, dropping any integrity fragment (the
  *  caller re-pins the result). Appends the version when the ref carries none —
@@ -28,7 +33,7 @@ export declare function parseVersionedRef(ref: string): ParsedVersionedRef | nul
  *
  *  Throws when the ref's grammar has no version segment at all — a relative
  *  path, a bare `https://` URL. Producing `../lib@0.4.0` for those would write
- *  a ref nothing can resolve, so this fails where the transport-specific
- *  parsers it replaced (`parseOciRef` / `parseModuleRef`) also failed. */
+ *  a ref nothing can resolve, so this fails where the transport-specific parser
+ *  it replaced (`parseOciRef`) also failed. */
 export declare function withRefVersion(ref: string, version: string): string;
 //# sourceMappingURL=versioned-ref.d.ts.map

package/dist/sources/versioned-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"versioned-ref.d.ts","sourceRoot":"","sources":["../../src/sources/versioned-ref.ts"],"names":[],"mappings":"AAIA;uEACuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;gFAE4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;kFAC8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;eASe;AACf,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOxE;AAED;;;;;;;0EAO0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUnE"}
+{"version":3,"file":"versioned-ref.d.ts","sourceRoot":"","sources":["../../src/sources/versioned-ref.ts"],"names":[],"mappings":"AAGA;uEACuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;kEAE8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB;iEAC6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;8BAc8B;AAC9B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAOxE;AAED;;;;;;;+CAO+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CASnE"}

package/dist/sources/versioned-ref.js

@@ -1,16 +1,20 @@
 import { splitIntegrity } from "./integrity.js";
-import { isRegistryRef } from "./module-ref.js";
 import { OCI_SCHEME } from "./oci-ref.js";
 /** Split a versioned module ref. Returns `null` when the ref names no
  *  upgradeable version — a local path, a bare `https://` URL, or an OCI ref
  *  with no explicit reference (an implicit `latest` is not a pin).
  *
- *  Browser-safe and transport-neutral: this is the *grammar* half of an
- *  upgrade, shared by the kernel transports (whose `refVersion` / `withVersion`
- *  delegate here) and the editor, which cannot use a transport at all — the
- *  *network* half (enumerating versions) is scheme-specific and stays behind
- *  `Transport.listVersions` on Node and the hub's `/module/versions` in the
- *  browser. */
+ *  Browser-safe: this is the *grammar* half of an upgrade, shared by the kernel
+ *  transports (whose `refVersion` / `withVersion` delegate here) and the editor,
+ *  which cannot use a transport at all — the *network* half (enumerating
+ *  versions) is scheme-specific and stays behind `Transport.listVersions` on
+ *  Node and the hub's `/module/versions` in the browser.
+ *
+ *  It is NOT transport-neutral: `oci://` is the only versionable grammar, named
+ *  literally below. That was equally true when the registry ref was the second
+ *  branch, and a third scheme still means editing this file — the versionable
+ *  set would have to become data the transports contribute before that claim
+ *  could be made honestly. */
 export function parseVersionedRef(ref) {
     const { base, integrity } = splitIntegrity(ref);
     const at = versionSeparator(base);
@@ -27,34 +31,28 @@ export function parseVersionedRef(ref) {
  *
  *  Throws when the ref's grammar has no version segment at all — a relative
  *  path, a bare `https://` URL. Producing `../lib@0.4.0` for those would write
- *  a ref nothing can resolve, so this fails where the transport-specific
- *  parsers it replaced (`parseOciRef` / `parseModuleRef`) also failed. */
+ *  a ref nothing can resolve, so this fails where the transport-specific parser
+ *  it replaced (`parseOciRef`) also failed. */
 export function withRefVersion(ref, version) {
     const { base } = splitIntegrity(ref);
-    if (refGrammar(base) === null) {
-        throw new Error(`Cannot set a version on '${ref}' — only registry (namespace/name@version) ` +
-            `and oci:// refs carry a version segment.`);
+    if (!isVersionableRef(base)) {
+        throw new Error(`Cannot set a version on '${ref}' — only oci:// refs carry a version segment.`);
     }
     const at = versionSeparator(base);
     return `${at === null ? base : base.slice(0, at)}@${version}`;
 }
-/** Which versionable ref grammar `base` is written in, or `null` when it is
- *  neither — a relative/absolute path, a `file:`/`https://` URL. */
-function refGrammar(base) {
-    if (base.startsWith(OCI_SCHEME)) {
-        // A host alone is not addressable; the repo path is what carries a version.
-        return base.indexOf("/", OCI_SCHEME.length) > OCI_SCHEME.length ? "oci" : null;
-    }
-    // `isRegistryRef` requires the `@`, so a version-less `std/console` is not a
-    // registry ref by this test — matching `parseModuleRef`, which throws on it.
-    return isRegistryRef(base) ? "registry" : null;
+/** True when `base` is written in a grammar that carries a version segment — a
+ *  relative/absolute path and a `file:`/`https://` URL are not. */
+function isVersionableRef(base) {
+    // A host alone is not addressable; the repo path is what carries a version.
+    return base.startsWith(OCI_SCHEME) && base.indexOf("/", OCI_SCHEME.length) > OCI_SCHEME.length;
 }
 /** Index of the `@` that separates the version, or `null` when the ref names
  *  none. Split on the LAST `@` so a digest reference (`repo@sha256:…`) keeps
  *  everything before it as the ref. */
 function versionSeparator(base) {
-    if (refGrammar(base) === null)
+    if (!isVersionableRef(base))
         return null;
     const at = base.lastIndexOf("@");
-    return at > (base.startsWith(OCI_SCHEME) ? OCI_SCHEME.length : 0) ? at : null;
+    return at > OCI_SCHEME.length ? at : null;
 }

package/dist/telo-version.d.ts

@@ -1,3 +1,3 @@
 /** The surface generation this analyzer implements. */
-export declare const TELO_SURFACE_VERSION = "0.84.0";
+export declare const TELO_SURFACE_VERSION = "0.85.0";
 //# sourceMappingURL=telo-version.d.ts.map

package/dist/telo-version.js

@@ -5,4 +5,4 @@
 // its release identity, this is the scale a module's `requires.telo` range is
 // written against, and every kernel in every language reports the same scale.
 /** The surface generation this analyzer implements. */
-export const TELO_SURFACE_VERSION = "0.84.0";
+export const TELO_SURFACE_VERSION = "0.85.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.68.0",
+  "version": "0.69.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analysis-registry.ts

@@ -1,12 +1,14 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { AliasResolver } from "./alias-resolver.js";
 import { KERNEL_BUILTINS } from "./builtins.js";
+import type { BuildModuleGraphOptions, ModuleGraphDeps } from "./module-graph.js";
 import { ManifestAnalysis } from "./manifest-analysis.js";
 import { DefinitionRegistry } from "./definition-registry.js";
 import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.js";
 import { visitManifest as runVisitManifest, type ManifestVisitor } from "./manifest-visitor.js";
 import type { ContractDirection, DefResolver } from "./extends-resolution.js";
 import { resolveContract } from "./invocation-contract.js";
+import { createResolveCtx, resolveThrowsUnion } from "./resolve-throws-union.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 import type { AnalysisContext } from "./types.js";
@@ -279,6 +281,41 @@ export class AnalysisRegistry {
     });
   }
 
+  /**
+   * What the projection needs that only this registry knows: how a kind
+   * resolves, what its reference slots are, which capabilities they target, and
+   * what a resource can raise.
+   *
+   * The GRAPH itself is built by `ManifestAnalysis.moduleGraph`, which is the
+   * pairing of a registry with a manifest set — a fifth
+   * `registry.x(manifests, …)` factory is the accretion naming that class
+   * stopped. This is the half the registry owns.
+   */
+  moduleGraphDeps(
+    manifests: ResourceManifest[],
+    options: BuildModuleGraphOptions = {},
+  ): ModuleGraphDeps {
+    // The error contract is resolved through the SAME resolver `telo check`
+    // uses, memoized across the whole graph — so what a box says it can raise
+    // is what a route's `catches:` is validated against.
+    const throwsCtx = createResolveCtx(
+      manifests,
+      this.defs,
+      this.aliases,
+      this.aliasesByModule,
+      new Set(options.entryModule ? [options.entryModule] : []),
+    );
+    return {
+      refFields: (resource) => this.refFieldsForResource(resource),
+      definition: (kind, module) => this.resolveDefinitionIn(kind, module),
+      aliasesForModule: (module) => this.aliases.aliasesFor(module),
+      throwsOf: (resource) => {
+        const union = resolveThrowsUnion(resource, throwsCtx);
+        return { codes: [...union.codes.keys()], unbounded: union.unbounded };
+      },
+    };
+  }
+
   /**
    * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
    * seeds these on construction; this method exposes them so callers (e.g. the kernel's