@telorun/analyzer 0.68.0 → 0.70.0

package/dist/analysis-registry.d.ts

@@ -1,4 +1,5 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import type { BuildModuleGraphOptions, ModuleGraphDeps } from "./module-graph.js";
 import { ManifestAnalysis } from "./manifest-analysis.js";
 import { type ManifestVisitor } from "./manifest-visitor.js";
 import type { AnalysisContext } from "./types.js";
@@ -138,6 +139,17 @@ export declare class AnalysisRegistry {
      * function of the whole manifest set.
      */
     analysisOf(manifests: ResourceManifest[]): ManifestAnalysis;
+    /**
+     * What the projection needs that only this registry knows: how a kind
+     * resolves, what its reference slots are, which capabilities they target, and
+     * what a resource can raise.
+     *
+     * The GRAPH itself is built by `ManifestAnalysis.moduleGraph`, which is the
+     * pairing of a registry with a manifest set — a fifth
+     * `registry.x(manifests, …)` factory is the accretion naming that class
+     * stopped. This is the half the registry owns.
+     */
+    moduleGraphDeps(manifests: ResourceManifest[], options?: BuildModuleGraphOptions): ModuleGraphDeps;
     /**
      * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
      * seeds these on construction; this method exposes them so callers (e.g. the kernel's

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAKhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;;;;uBAUmB;IACnB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1D;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAkBvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAU3B;;;;;;+DAM2D;IAC3D,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAO7F;;;;;;;;;OASG;IACH,UAAU,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,gBAAgB;IAQ3D;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAMhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE;;+EAE2E;IAC3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI9E,wFAAwF;IACxF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;;;;uBAUmB;IACnB,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1D;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;mEAM+D;IAC/D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAInE;;;oBAGgB;IAChB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIpE,OAAO,CAAC,eAAe;IAkBvB;;;;sBAIkB;IAClB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,mBAAmB;IAU3B;;;;;;+DAM2D;IAC3D,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAO7F;;;;;;;;;OASG;IACH,UAAU,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,gBAAgB;IAQ3D;;;;;;;;;OASG;IACH,eAAe,CACb,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,GAAE,uBAA4B,GACpC,eAAe;IAsBlB;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D;;;;gCAI4B;IAC5B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAMlF;;;;;;;;yCAQqC;IACrC,qBAAqB,CAAC,GAAG,EAAE;QACzB,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS;IASpD;;qFAEiF;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;;;;iDAQ6C;IAC7C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;IAqB9D;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAiB7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -5,6 +5,7 @@ import { DefinitionRegistry } from "./definition-registry.js";
 import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.js";
 import { visitManifest as runVisitManifest } from "./manifest-visitor.js";
 import { resolveContract } from "./invocation-contract.js";
+import { createResolveCtx, resolveThrowsUnion } from "./resolve-throws-union.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import { resolveSchemaTypeRefs as resolveSchemaTypeRefsIn } from "./resolve-schema-type-refs.js";
 /**
@@ -226,6 +227,31 @@ export class AnalysisRegistry {
             aliasesByModule: this.aliasesByModule,
         });
     }
+    /**
+     * What the projection needs that only this registry knows: how a kind
+     * resolves, what its reference slots are, which capabilities they target, and
+     * what a resource can raise.
+     *
+     * The GRAPH itself is built by `ManifestAnalysis.moduleGraph`, which is the
+     * pairing of a registry with a manifest set — a fifth
+     * `registry.x(manifests, …)` factory is the accretion naming that class
+     * stopped. This is the half the registry owns.
+     */
+    moduleGraphDeps(manifests, options = {}) {
+        // The error contract is resolved through the SAME resolver `telo check`
+        // uses, memoized across the whole graph — so what a box says it can raise
+        // is what a route's `catches:` is validated against.
+        const throwsCtx = createResolveCtx(manifests, this.defs, this.aliases, this.aliasesByModule, new Set(options.entryModule ? [options.entryModule] : []));
+        return {
+            refFields: (resource) => this.refFieldsForResource(resource),
+            definition: (kind, module) => this.resolveDefinitionIn(kind, module),
+            aliasesForModule: (module) => this.aliases.aliasesFor(module),
+            throwsOf: (resource) => {
+                const union = resolveThrowsUnion(resource, throwsCtx);
+                return { codes: [...union.codes.keys()], unbounded: union.unbounded };
+            },
+        };
+    }
     /**
      * Returns the built-in kernel definitions. The underlying DefinitionRegistry already
      * seeds these on construction; this method exposes them so callers (e.g. the kernel's

package/dist/call-graph.d.ts

@@ -74,6 +74,47 @@ export interface StepGraphNode {
     index: number;
     /** The step value as written. */
     step: Record<string, unknown>;
+    /**
+     * Which branch of the step grammar this step IS — the branch's own title
+     * (`invoke`, `if/then/else`, `while/do`, `switch/cases/default`,
+     * `try/catch/finally`, `throw`, `value`).
+     *
+     * Matched on the branch's REQUIRED keys, and IS those keys — sorted and
+     * joined (`if+then`, `invoke`, `do+while`). A machine identity, so a consumer
+     * may branch on it; it was the branch's `title`, which is prose an author may
+     * reword at any time, and a view was splitting it on `/` to recover a keyword.
+     * Absent for a step matching no branch — one just added, and still empty.
+     */
+    variant?: string;
+    /** The branch's `title` as its author wrote it, for a view to render verbatim.
+     *  Never parsed: it is a label, and the moment anything reads its SHAPE it
+     *  becomes a vocabulary the author cannot change. */
+    variantLabel?: string;
+    /**
+     * The expression that decides whether or how this step runs, as written: an
+     * `if:`, a `while:`, a `switch:`, or the `when:` guard on a dispatch.
+     *
+     * Found through `x-telo-topology-role`, never by keyword, so a third-party
+     * composer annotating its own predicate is read the same way.
+     */
+    predicate?: string;
+    /**
+     * Every reference slot this step's grammar declares — filled, empty, or
+     * holding a declaration written at the site.
+     *
+     * Recorded here because this is the one place a step's item schema and its
+     * value are both in hand: a step array's items sit behind a local `$ref`, so
+     * the reference field map deliberately never reaches them, and a consumer
+     * asking "what may this step dispatch to, and where is that written" has
+     * nowhere else to look. An EMPTY slot is listed for exactly that reason — it
+     * is a site an editor can offer to fill, and an edge says nothing about one.
+     */
+    refSlots?: {
+        key: string;
+        path: string;
+        kinds: string[];
+        inline?: boolean;
+    }[];
 }
 export type CallGraphNode = ResourceGraphNode | StepGraphNode;
 export interface CallGraphEdge {
@@ -133,7 +174,15 @@ export interface CallGraph {
     /** Edges arriving at a resource node. */
     edgesTo(id: string): CallGraphEdge[];
     resource(kind: string, name: string): ResourceGraphNode | undefined;
-    resourceByName(name: string): ResourceGraphNode | undefined;
+    /**
+     * The resource a bare name addresses, read from `fromModule`'s scope.
+     *
+     * A name is module-scoped, so the module is how two declarations of one name
+     * are told apart — see {@link resolveScopedName}. Omitting it answers for a
+     * name declared once and, where several modules declare it, declines rather
+     * than taking whichever came first.
+     */
+    resourceByName(name: string, fromModule?: string): ResourceGraphNode | undefined;
     /** Step nodes declared by a resource, in lexical order. */
     steps(resourceId: string): StepGraphNode[];
     /** Every edge whose `use` includes at least one control transfer, plus every
@@ -141,6 +190,36 @@ export interface CallGraph {
     controlEdges(): CallGraphEdge[];
 }
 export declare const resourceId: (kind: string, name: string) => string;
+/**
+ * The id a manifest's node is keyed by.
+ *
+ * **A resource name is MODULE-SCOPED**, so `(kind, name)` is unique inside one
+ * module and not across a flattened set: two libraries each exporting an
+ * `Http.Api` named `routes` are two declarations, and keying both as
+ * `http.Api\0routes` silently made them one — the second overwrote the first,
+ * taking its edges and its steps with it. The module is part of the identity
+ * wherever the loader stamped one; a manifest with no stamp keeps the bare form,
+ * so nothing that never crossed a module boundary moves.
+ */
+export declare function nodeIdFor(manifest: ResourceManifest): string;
+/**
+ * A bare `<name>` read from a resource declared in `fromModule`.
+ *
+ * **Same module first**, because that is what a bare name MEANS: it is resolved
+ * in the scope it was written in, and a cross-module reference is written with
+ * an alias. A name declared in exactly one module resolves to it whatever the
+ * reader's scope — which is what keeps an unstamped manifest set (every
+ * fixture, every single-module load) behaving as it did. A name declared in
+ * SEVERAL other modules and none of the reader's resolves to NOTHING: guessing
+ * between them attributes a reference to a resource the author never named, and
+ * some other pass reports the dangling name honestly.
+ *
+ * Exported because more than one pass resolves a bare name — the call graph's
+ * own sites, and the projection's inline declarations and CEL state reads. Two
+ * spellings of this rule is how a fix in one leaves a first-wins lookup in the
+ * other, which is exactly the collision it exists to prevent.
+ */
+export declare function resolveScopedName<T>(candidates: readonly T[] | undefined, moduleOf: (item: T) => string | undefined, fromModule: string | undefined): T | undefined;
 export interface BuildCallGraphOptions {
     aliases?: AliasResolver;
     aliasesByModule?: Map<string, AliasResolver>;

package/dist/call-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAKvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC5D,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAuTrF,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA4QX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}
+{"version":3,"file":"call-graph.d.ts","sourceRoot":"","sources":["../src/call-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAUvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;yEAEqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;yDAEqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC/E;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;+CAG2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf;;;iCAG6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;0EACsE;IACtE,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;mEAE+D;IAC/D,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;+BAM2B;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;gBAGY;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACvC,yCAAyC;IACzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACjF,2DAA2D;IAC3D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC3C;yFACqF;IACrF,YAAY,IAAI,aAAa,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAA4B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAK5D;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,SAAS,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,EACzC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,CAAC,GAAG,SAAS,CAIf;AAoYD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,qBAA0B,GAClC,SAAS,CA8RX;AAYD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACrC;0EACsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,qBAA0B,GAClC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB1B"}

package/dist/call-graph.js

@@ -3,9 +3,52 @@ import { enclosingOf, propertySchemas, resolveLocalRef, } from "./manifest-navig
 import { visitManifest } from "./manifest-visitor.js";
 import { possibleUses, readRefSlot, transfersControl, } from "./ref-slot.js";
 import { isStepSlot } from "./step-slot.js";
-import { isRefEntry, resolveFieldEntries } from "./reference-field-map.js";
+import { isInlineResource, isRefEntry, resolveFieldEntries, } from "./reference-field-map.js";
 import { DEPENDENCY_GRAPH_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
 export const resourceId = (kind, name) => `${kind}\0${name}`;
+/**
+ * The id a manifest's node is keyed by.
+ *
+ * **A resource name is MODULE-SCOPED**, so `(kind, name)` is unique inside one
+ * module and not across a flattened set: two libraries each exporting an
+ * `Http.Api` named `routes` are two declarations, and keying both as
+ * `http.Api\0routes` silently made them one — the second overwrote the first,
+ * taking its edges and its steps with it. The module is part of the identity
+ * wherever the loader stamped one; a manifest with no stamp keeps the bare form,
+ * so nothing that never crossed a module boundary moves.
+ */
+export function nodeIdFor(manifest) {
+    const kind = manifest.kind;
+    const name = manifest.metadata?.name;
+    const module = manifest.metadata?.module;
+    return module ? `${module}\0${resourceId(kind, name)}` : resourceId(kind, name);
+}
+/** The module a manifest was declared in, when the loader stamped one. */
+const declaringModule = (manifest) => manifest.metadata?.module;
+/**
+ * A bare `<name>` read from a resource declared in `fromModule`.
+ *
+ * **Same module first**, because that is what a bare name MEANS: it is resolved
+ * in the scope it was written in, and a cross-module reference is written with
+ * an alias. A name declared in exactly one module resolves to it whatever the
+ * reader's scope — which is what keeps an unstamped manifest set (every
+ * fixture, every single-module load) behaving as it did. A name declared in
+ * SEVERAL other modules and none of the reader's resolves to NOTHING: guessing
+ * between them attributes a reference to a resource the author never named, and
+ * some other pass reports the dangling name honestly.
+ *
+ * Exported because more than one pass resolves a bare name — the call graph's
+ * own sites, and the projection's inline declarations and CEL state reads. Two
+ * spellings of this rule is how a fix in one leaves a first-wins lookup in the
+ * other, which is exactly the collision it exists to prevent.
+ */
+export function resolveScopedName(candidates, moduleOf, fromModule) {
+    if (!candidates || candidates.length === 0)
+        return undefined;
+    if (candidates.length === 1)
+        return candidates[0];
+    return candidates.find((candidate) => moduleOf(candidate) === fromModule);
+}
 /**
  * Does control reach this edge's target?
  *
@@ -141,6 +184,64 @@ function isPlainRefValue(value) {
         return false;
     return Object.keys(value).every((k) => k === "kind" || k === "name" || k === "alias" || k === "__ref");
 }
+/**
+ * What a step IS, and what decides whether it runs.
+ *
+ * Both come off the schema rather than off a keyword list: the variant is the
+ * `oneOf` branch whose REQUIRED keys the step carries, and the predicate is the
+ * field annotated as one. A composer that declares a step body of its own is
+ * therefore described in its own words, and nothing here knows that `while`
+ * exists.
+ *
+ * A step matching several branches takes the FIRST — the grammar is a `oneOf`,
+ * so more than one match is a manifest the checker rejects, and guessing among
+ * them would be a second opinion on a question the checker already answers.
+ */
+function classifyStep(step, itemSchema, rootSchema) {
+    if (!itemSchema)
+        return {};
+    const branches = Array.isArray(itemSchema.oneOf) ? itemSchema.oneOf : [];
+    let variant;
+    let variantLabel;
+    for (const raw of branches) {
+        const branch = resolveLocalRef(raw, rootSchema);
+        const required = Array.isArray(branch?.required) ? branch.required : [];
+        if (required.length === 0 || !required.every((key) => step[key] !== undefined))
+            continue;
+        // The keys are what the branch IS; the title is what it is called.
+        variant = [...required].sort().join("+");
+        if (typeof branch?.title === "string")
+            variantLabel = branch.title;
+        break;
+    }
+    let predicate;
+    for (const [key, propSchema] of propertySchemas(itemSchema)) {
+        const role = propSchema?.["x-telo-topology-role"];
+        if (role !== "predicate" && role !== "discriminator")
+            continue;
+        const written = expressionSource(step[key]);
+        if (written !== undefined) {
+            predicate = written;
+            break;
+        }
+    }
+    return {
+        ...(variant ? { variant } : {}),
+        ...(variantLabel ? { variantLabel } : {}),
+        ...(predicate ? { predicate } : {}),
+    };
+}
+/** A predicate as the author wrote it. A CEL value reaches here as a tagged
+ *  sentinel or as an already-compiled node, and the SOURCE is the only part of
+ *  either worth showing. */
+function expressionSource(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    return typeof record.source === "string" ? record.source : undefined;
+}
 /**
  * Emit the edges a single step's own ref slots declare.
  *
@@ -158,7 +259,20 @@ function emitStepEdges(node, ctx) {
         const slot = readRefSlot(propSchema);
         if (!slot || slot.kinds.length === 0)
             continue;
-        const targetName = refTargetName(node.step[key]);
+        const written = node.step[key];
+        const inline = written !== null &&
+            typeof written === "object" &&
+            !Array.isArray(written) &&
+            isInlineResource(written);
+        // Every declared slot is recorded, whatever is in it: an empty one is a
+        // site an editor can fill, and a declaration written at the site is a real
+        // dispatch that emits no edge — which is what made an inline step read
+        // exactly like one that dispatches nothing.
+        node.refSlots = [
+            ...(node.refSlots ?? []),
+            { key, path: `${node.path}.${key}`, kinds: slot.kinds, ...(inline ? { inline: true } : {}) },
+        ];
+        const targetName = refTargetName(written);
         if (targetName === undefined)
             continue;
         const entry = {
@@ -252,6 +366,13 @@ function walkSteps(steps, arrayPath, parent, ctx) {
         };
         if (typeof value.name === "string")
             node.name = value.name;
+        const { variant, variantLabel, predicate } = classifyStep(value, ctx.itemSchema, ctx.rootSchema);
+        if (variant)
+            node.variant = variant;
+        if (variantLabel)
+            node.variantLabel = variantLabel;
+        if (predicate)
+            node.predicate = predicate;
         if (parent)
             node.parent = parent;
         ctx.nodes.set(id, node);
@@ -296,6 +417,8 @@ function ownerStepOf(steps, concretePath) {
 export function buildCallGraph(resources, registry, options = {}) {
     const nodes = new Map();
     const edges = [];
+    /** Every declaration of a bare name, in declaration order — a name may be
+     *  declared once per module, so this is a list rather than one node. */
     const byName = new Map();
     const stepsByOwner = new Map();
     const stepEdgesByPath = new Map();
@@ -325,14 +448,17 @@ export function buildCallGraph(resources, registry, options = {}) {
             continue;
         const node = {
             type: "resource",
-            id: resourceId(manifest.kind, name),
+            id: nodeIdFor(manifest),
             kind: manifest.kind,
             name: name,
             manifest,
         };
+        if (nodes.has(node.id))
+            continue;
         nodes.set(node.id, node);
-        byName.set(node.name, node);
+        byName.set(node.name, [...(byName.get(node.name) ?? []), node]);
     }
+    const resolveByName = (name, fromModule) => resolveScopedName(byName.get(name), (node) => declaringModule(node.manifest), fromModule);
     // --- step nodes ---
     const collectStepsFor = (node, resolveName) => {
         const definition = definitionFor(node.manifest);
@@ -362,7 +488,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             stepsByOwner.set(node.id, collected);
     };
     for (const node of [...nodes.values()]) {
-        collectStepsFor(node, (name) => byName.get(name));
+        collectStepsFor(node, (name) => resolveByName(name, declaringModule(node.manifest)));
     }
     // --- edges ---
     // Scope-local nodes of the CURRENT resource. The visitor fires `onScope`
@@ -386,7 +512,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             const ownerName = event.source.metadata?.name;
             if (!ownerName || !event.source.kind)
                 return;
-            const ownerId = resourceId(event.source.kind, ownerName);
+            const ownerId = nodeIdFor(event.source);
             // Inline declarations inside `x-telo-scope` arrays become nodes of
             // their own, keyed by their scope site — the declaration-site identity
             // the zones plan correlates on. They are excluded from init ordering
@@ -413,7 +539,8 @@ export function buildCallGraph(resources, registry, options = {}) {
             }
             if (scopeLocal.size === 0)
                 return;
-            const resolveScoped = (name) => scopeLocal.get(name) ?? byName.get(name);
+            const ownerModule = declaringModule(event.source);
+            const resolveScoped = (name) => scopeLocal.get(name) ?? resolveByName(name, ownerModule);
             // The owner's own step edges were emitted before this scope was seen
             // (step collection precedes the visit), so their names resolved
             // module-level. Re-resolve them now that the scope exists: scope-local
@@ -474,7 +601,7 @@ export function buildCallGraph(resources, registry, options = {}) {
             const sourceName = event.source.metadata?.name;
             if (!sourceName || !event.source.kind)
                 return;
-            const sourceId = resourceId(event.source.kind, sourceName);
+            const sourceId = nodeIdFor(event.source);
             if (!nodes.has(sourceId))
                 return;
             // A site inside a step was already emitted by the step walk, which
@@ -507,9 +634,10 @@ export function buildCallGraph(resources, registry, options = {}) {
                 path: event.concretePath,
                 use,
             };
+            const sourceModule = declaringModule(event.source);
             const target = scopedNames.has(targetName)
-                ? (scopeLocal.get(targetName) ?? byName.get(targetName))
-                : byName.get(targetName);
+                ? (scopeLocal.get(targetName) ?? resolveByName(targetName, sourceModule))
+                : resolveByName(targetName, sourceModule);
             if (target)
                 edge.to = target.id;
             if (unresolved)
@@ -552,8 +680,13 @@ export function buildCallGraph(resources, registry, options = {}) {
         edges,
         edgesFrom: (id) => fromIndex.get(id) ?? [],
         edgesTo: (id) => toIndex.get(id) ?? [],
-        resource: (kind, name) => nodes.get(resourceId(kind, name)),
-        resourceByName: (name) => byName.get(name),
+        // Both accessors take a name with no module, so both answer for the one
+        // declaration that name has — and, where a flattened set has several, the
+        // first in declaration order. A caller that must tell two apart holds a
+        // node id, which carries the module.
+        resource: (kind, name) => nodes.get(resourceId(kind, name)) ??
+            byName.get(name)?.find((n) => n.kind === kind),
+        resourceByName: (name, fromModule) => resolveScopedName(byName.get(name), (node) => declaringModule(node.manifest), fromModule),
         steps: (ownerId) => stepsByOwner.get(ownerId) ?? [],
         controlEdges: () => edges.filter(reachesTarget),
     };

package/dist/canonical-json.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../src/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD"}

package/dist/canonical-json.js

@@ -0,0 +1,26 @@
+/**
+ * Canonical JSON: a rendering under which two structurally equal values produce
+ * the same string — object keys sorted, `undefined`-valued entries dropped.
+ *
+ * Shared rather than duplicated because both readers compare the RESULT for
+ * equality: `contentKey` anchors a module-graph row's identity to its content so
+ * an inserted sibling does not move it, and `declarationSignature` decides
+ * whether a resource has to be rebuilt. Two implementations would eventually
+ * disagree about key order or about `undefined`, and the disagreement surfaces
+ * as a row that silently changes identity, or as a resource that silently fails
+ * to restart.
+ *
+ * Browser-safe: no hashing, no `node:crypto`. Callers that only need equality
+ * compare the strings, which cannot collide; a caller that needs a short key
+ * hashes it itself.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}

package/dist/cel-access-chains.d.ts

@@ -0,0 +1,14 @@
+import type { ResourceManifest } from "@telorun/sdk";
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export declare function accessChains(source: string): string[][];
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export declare function celResourceReads(manifest: ResourceManifest): string[];
+//# sourceMappingURL=cel-access-chains.d.ts.map

package/dist/cel-access-chains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cel-access-chains.d.ts","sourceRoot":"","sources":["../src/cel-access-chains.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD;4DAC4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAOvD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQrE"}

package/dist/cel-access-chains.js

@@ -0,0 +1,45 @@
+/**
+ * What a manifest's CEL READS, as opposed to what its slots reference.
+ *
+ * A dependency a manifest states without a slot: `!cel "resources.db.dsn"` makes
+ * the reader depend on `db` as surely as a `!ref` would, and no reference walk
+ * can see it. Two consumers ask for it — the module graph draws it as a `data`
+ * edge, and the kernel needs it to know who becomes invalid when a resource is
+ * rebuilt — so the extraction is here rather than in either of them.
+ *
+ * The expensive half is the CEL environment used to parse, which is built once
+ * per process and evaluates nothing.
+ */
+import { extractAccessChains } from "@telorun/templating";
+import { walkCelExpressions } from "@telorun/templating";
+import { buildCelEnvironment } from "./cel-environment.js";
+let parseEnv;
+/** Access chains an expression reads, or none when it does not parse — a syntax
+ *  error is the engine pass's to report, not this one's. */
+export function accessChains(source) {
+    try {
+        parseEnv ??= buildCelEnvironment();
+        return extractAccessChains(parseEnv.parse(source).ast);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The bare resource names a manifest's expressions read through
+ * `resources.<name>`, deduplicated.
+ *
+ * Read from the DECLARATION: a compile-eval field is expanded before a
+ * controller sees it, so by then `resources.db.dsn` is a literal with nothing
+ * left to say where it came from.
+ */
+export function celResourceReads(manifest) {
+    const names = new Set();
+    walkCelExpressions(manifest, "", (source) => {
+        for (const chain of accessChains(source)) {
+            if (chain[0] === "resources" && chain.length >= 2 && chain[1])
+                names.add(chain[1]);
+        }
+    });
+    return [...names];
+}

package/dist/import-resolution-diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-resolution-diagnostics.d.ts","sourceRoot":"","sources":["../src/import-resolution-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAyCzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAepF"}
+{"version":3,"file":"import-resolution-diagnostics.d.ts","sourceRoot":"","sources":["../src/import-resolution-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA2DzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAepF"}

package/dist/import-resolution-diagnostics.js

@@ -1,15 +1,13 @@
 import { isLocalPathSource } from "./sources/local-path-ref.js";
-import { isRegistryRef } from "./sources/module-ref.js";
 import { isOciRef } from "./sources/oci-ref.js";
 import { DiagnosticSeverity } from "./types.js";
 const SOURCE = "telo-analyzer";
-/** True when `source` is a shape some transport claims — a registry ref, an OCI
- *  ref, an HTTP(S) URL, or a relative/absolute path. A source matching none of
- *  these is malformed (no transport can ever resolve it), which we report
- *  differently from a well-formed ref that simply failed to fetch. */
+/** True when `source` is a shape some transport claims — an OCI ref, an HTTP(S)
+ *  URL, or a relative/absolute path. A source matching none of these is
+ *  malformed (no transport can ever resolve it), which we report differently
+ *  from a well-formed ref that simply failed to fetch. */
 function isRecognizedSourceShape(source) {
-    return (isRegistryRef(source) ||
-        isOciRef(source) ||
+    return (isOciRef(source) ||
         source.startsWith("http://") ||
         source.startsWith("https://") ||
         isLocalPathSource(source));
@@ -21,12 +19,28 @@ function classify(e) {
         return "INVALID_IMPORT_TARGET";
     return isRecognizedSourceShape(e.source ?? e.url) ? "IMPORT_UNRESOLVED" : "INVALID_IMPORT_SOURCE";
 }
+/** The removed bare `<namespace>/<name>@<version>` ref: no scheme, not a path,
+ *  carrying both a `/` and an `@`. Recognised only to explain itself — no
+ *  migration can rewrite it, because the OCI host it moved to is not derivable
+ *  from the ref, and the failing line is frequently inside a dependency the
+ *  consumer cannot edit. The message is the whole remedy available to them. */
+function isRemovedBareRef(source) {
+    return (!source.includes("://") &&
+        !source.startsWith("/") &&
+        !source.startsWith(".") &&
+        source.includes("@") &&
+        source.includes("/"));
+}
 function messageFor(e, code) {
     const authored = e.source ?? e.url;
     const via = e.alias ? `import '${e.alias}' → '${authored}'` : `'${authored}'`;
     if (code === "INVALID_IMPORT_SOURCE") {
+        const removedForm = isRemovedBareRef(authored)
+            ? ` The bare '<namespace>/<name>@<version>' form was removed — rewrite it to the ` +
+                `module's 'oci://' ref (\`telo search <name>\` reports it).`
+            : "";
         return (`Cannot resolve ${via}: not a recognized module reference. Expected ` +
-            `'namespace/name@version', 'oci://host/repo@tag', 'https://…', or a relative path.`);
+            `'oci://host/repo@tag', 'https://…', or a relative path.${removedForm}`);
     }
     // The target WAS obtained, so "cannot resolve" would name the wrong problem —
     // and the wrong person to fix it. The loader's message already says what was