@telorun/analyzer 0.73.0 → 0.74.0

package/dist/reference-field-map.js

@@ -1,5 +1,23 @@
+import { resolveLocalRef } from "./manifest-navigation.js";
 import { readRefSlot } from "./ref-slot.js";
+import { readStepSlot } from "./step-slot.js";
 export { readRefSlot, isRefSlot, hasDeclaredUse } from "./ref-slot.js";
+/** The slot an entry records, as `readRefSlot` read it. */
+export function refSlotOfEntry(entry) {
+    const slot = {
+        kinds: entry.refs,
+        uses: entry.uses,
+        inline: entry.inline === true,
+        valueBranches: entry.valueBranches ?? [],
+    };
+    if (entry.useCases)
+        slot.useCases = entry.useCases;
+    if (entry.inputs !== undefined)
+        slot.inputs = entry.inputs;
+    if (entry.throwsThrough)
+        slot.throwsThrough = true;
+    return slot;
+}
 export function isRefEntry(entry) {
     return "refs" in entry;
 }
@@ -121,9 +139,10 @@ export function resolveFieldValues(obj, path) {
  */
 export function buildReferenceFieldMap(schema) {
     const map = new Map();
+    const sink = injectionSink(map);
     if (schema.properties) {
         for (const [key, propSchema] of Object.entries(schema.properties)) {
-            traverseNode(propSchema, key, map, schema);
+            traverseNode(propSchema, key, sink, schema);
         }
     }
     return map;
@@ -140,32 +159,175 @@ export function collectRefs(node) {
  *  hid behind the schema-from indirection. */
 export function buildFieldMapAtPath(schema, pathPrefix) {
     const map = new Map();
-    traverseNode(schema, pathPrefix, map, schema);
+    traverseNode(schema, pathPrefix, injectionSink(map), schema);
     return map;
 }
-function traverseNode(node, path, map, root, visitedRefs = new Set()) {
-    // Local `$ref` is intentionally NOT followed. This map is the kernel's
+const drivenSlotMaps = new WeakMap();
+/** The resource envelope: present on every resource document, and never
+ *  configuration a kind's root `additionalProperties` describes. */
+const RESOURCE_ENVELOPE_KEYS = ["kind", "metadata"];
+/**
+ * Every slot through which a resource of this schema DRIVES another — the
+ * reference field map's own traversal, plus what a dispatch analysis needs and
+ * the injection surface must not have:
+ *
+ * - local `$ref` is followed, resolved against the root. The injection map
+ *   stops there so a step's `invoke` never becomes an injection site; this map
+ *   stops AT a step body instead, which removes that reason. A reference back
+ *   to a node already on the descent is recorded as a back-edge rather than
+ *   unrolled, so a recursive shape stays finite here and is followed as deep as
+ *   the data goes by `forEachDrivenSlot`;
+ * - a step body is recorded and not descended — the step traversal owns
+ *   everything below it;
+ * - the root's own variant branches and `additionalProperties` are walked, not
+ *   only its `properties`;
+ * - a path keeps EVERY slot any branch declares there, where the injection map
+ *   keeps the last one written (see {@link DrivenPath.refs});
+ * - each `{}` path records the keys its `additionalProperties` does not cover.
+ *
+ * Shared by every throws question (a kind's `inherit` union, a scope list's
+ * denominator, catch-scope enclosure, and whether `inherit` is legal at all),
+ * so none can reach a slot another cannot. Memoized per schema object.
+ */
+export function buildDrivenSlotMap(schema) {
+    const cached = drivenSlotMaps.get(schema);
+    if (cached)
+        return cached;
+    const slots = { paths: new Map(), declaredKeys: new Map(), drives: false };
+    traverseNode(schema, "", drivenSink(slots), schema);
+    drivenSlotMaps.set(schema, slots);
+    return slots;
+}
+const joinPath = (path, key) => (path ? `${path}.${key}` : key);
+/** The injection map: one entry per path, the last one written. Step bodies,
+ *  back-edges and map-value keys are the driven map's alone. */
+function injectionSink(map) {
+    return {
+        driven: false,
+        ref: (path, entry) => {
+            map.set(path, entry);
+        },
+        stop: (path, entry) => {
+            map.set(path, entry);
+        },
+        step: () => { },
+        recurse: () => { },
+        mapValue: () => { },
+    };
+}
+function drivenSink(slots) {
+    const recorded = new Map();
+    const at = (path) => {
+        let entry = slots.paths.get(path);
+        if (!entry) {
+            entry = { refs: [], steps: [], recurse: [] };
+            slots.paths.set(path, entry);
+        }
+        return entry;
+    };
+    // One schema node reached twice at one path (two branches `$ref`-ing one
+    // definition) is one slot.
+    const firstTime = (path, node) => {
+        let nodes = recorded.get(path);
+        if (!nodes)
+            recorded.set(path, (nodes = new Set()));
+        if (nodes.has(node))
+            return false;
+        nodes.add(node);
+        return true;
+    };
+    return {
+        driven: true,
+        ref: (path, entry, node) => {
+            if (!firstTime(path, node))
+                return;
+            at(path).refs.push(entry);
+            slots.drives = true;
+        },
+        stop: () => { },
+        step: (path, step, node) => {
+            if (!firstTime(path, node))
+                return;
+            at(path).steps.push(step);
+            slots.drives = true;
+        },
+        recurse: (path, to) => {
+            const entry = at(path);
+            if (!entry.recurse.includes(to))
+                entry.recurse.push(to);
+        },
+        mapValue: (mapPath, declared) => {
+            const previous = slots.declaredKeys.get(mapPath);
+            slots.declaredKeys.set(mapPath, new Set(previous ? declared.filter((key) => previous.has(key)) : declared));
+        },
+    };
+}
+/** Follow a local `$ref` in driven mode. `onStack` maps each node on the
+ *  current descent to the path it was entered at: re-entering one records a
+ *  back-edge to that path, and a cycle that made no structural progress (same
+ *  path) records nothing, since its body is already recorded there. */
+function followLocalRef(node, path, sink, root, onStack) {
+    if (!root)
+        return;
+    const target = resolveLocalRef(node, root);
+    if (!target || target === node)
+        return;
+    const entered = onStack.get(target);
+    if (entered !== undefined) {
+        if (entered !== path)
+            sink.recurse(path, entered);
+        return;
+    }
+    onStack.set(target, path);
+    try {
+        traverseNode(target, path, sink, root, onStack);
+    }
+    finally {
+        onStack.delete(target);
+    }
+}
+/** `owner.additionalProperties`, the schema of every value in an open-keyed
+ *  object. JSON Schema applies it only to keys `owner` does not declare, which
+ *  the driven map records so a walk skips them. */
+function traverseMapValue(owner, path, sink, root, onStack) {
+    const valueSchema = owner.additionalProperties;
+    if (!valueSchema || typeof valueSchema !== "object" || Array.isArray(valueSchema))
+        return;
+    const mapPath = joinPath(path, "{}");
+    const declared = owner.properties && typeof owner.properties === "object" ? Object.keys(owner.properties) : [];
+    sink.mapValue(mapPath, path === "" ? [...declared, ...RESOURCE_ENVELOPE_KEYS] : declared);
+    traverseNode(valueSchema, mapPath, sink, root, onStack);
+}
+function traverseNode(node, path, sink, root, onStack = new Map()) {
+    const driven = sink.driven;
+    // Local `$ref` is intentionally NOT followed here. This map is the kernel's
     // Phase-5 injection surface: descending into shared `$defs` (notably
     // `Run.Sequence`'s `step` definition) would make every step's `invoke` an
     // injection site, and step slots resolve at dispatch — injecting there is
     // unwanted regardless of tracing (the original dispatcher-bypass blocker
     // has since shipped via the `REF_IDENTITY` stamp). Static analysis is NOT
     // limited by this stop: the call graph (`call-graph.ts`) reads step slots
-    // from the item schema itself and scans the value tree, so it sees what
-    // this map deliberately hides. `visitedRefs` stays as a parameter so the
-    // recursive calls below thread the right signature.
-    if (typeof node?.$ref === "string")
+    // from the item schema itself and scans the value tree, and the driven-slot
+    // mode (`buildDrivenSlotMap`) follows the reference.
+    if (typeof node?.$ref === "string" && !driven)
         return;
     // Scope slot — record and stop; do not recurse into scope contents
     if ("x-telo-scope" in node) {
-        map.set(path, { scope: node["x-telo-scope"] });
+        sink.stop(path, { scope: node["x-telo-scope"] });
         return;
     }
     // Schema-from slot — record and stop; no further traversal needed
     if ("x-telo-schema-from" in node) {
-        map.set(path, { schemaFrom: node["x-telo-schema-from"] });
+        sink.stop(path, { schemaFrom: node["x-telo-schema-from"] });
         return;
     }
+    if (driven) {
+        const step = readStepSlot(node);
+        if (step) {
+            sink.step(path, step, node);
+            return;
+        }
+    }
     // Reference slot (direct, via a `kind:` list, or via anyOf)
     const slot = readRefSlot(node);
     if (slot && slot.kinds.length > 0) {
@@ -184,7 +346,9 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
             entry.context = node["x-telo-context"];
         if (slot.inline)
             entry.inline = true;
-        map.set(path, entry);
+        if (slot.throwsThrough)
+            entry.throwsThrough = true;
+        sink.ref(path, entry, node);
         // A node can mix item-level ref branches (a bare string / `{kind, name}`)
         // with object branches that carry their OWN nested refs — e.g. Application
         // `targets`: a bare ref vs inline `{ invoke }` vs gated `{ ref }`. Descend
@@ -198,21 +362,24 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
             for (const variant of variants) {
                 if (!variant || typeof variant !== "object")
                     continue;
-                traverseVariant(variant, path, map, root, visitedRefs);
+                traverseVariant(variant, path, sink, root, onStack);
             }
         }
         return;
     }
-    if (typeof node?.$ref === "string")
+    // Reached only in driven mode — the injection map stopped at the top.
+    if (typeof node?.$ref === "string") {
+        followLocalRef(node, path, sink, root, onStack);
         return;
+    }
     // Array — recurse into items
     if (node.type === "array" && node.items) {
-        traverseNode(node.items, path + "[]", map, root, visitedRefs);
+        traverseNode(node.items, path + "[]", sink, root, onStack);
     }
     // Object — recurse into properties
     if (node.properties) {
         for (const [key, propSchema] of Object.entries(node.properties)) {
-            traverseNode(propSchema, `${path}.${key}`, map, root, visitedRefs);
+            traverseNode(propSchema, joinPath(path, key), sink, root, onStack);
         }
     }
     // Variant branches — descend into every alternative's properties / items.
@@ -221,10 +388,11 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
     // slots inside the branch. Walking each branch surfaces those slots into
     // the field map so downstream passes (ref validation, sentinel
     // resolution, dependency graph) cover them without a runtime fallback.
-    // The same field path may be added by multiple branches; the later
-    // assignment wins, which is fine — branches with the same field path
-    // share the same ref/context configuration (any divergence is already
-    // a schema bug).
+    // The same field path may be added by multiple branches. The injection map
+    // keeps the later assignment, which is fine for injection — branches with
+    // the same field path share the same ref/context configuration. The driven
+    // map keeps every one, because which branch applies decides what a
+    // dispatch can throw.
     for (const variantKey of ["oneOf", "anyOf", "allOf"]) {
         const variants = node[variantKey];
         if (!Array.isArray(variants))
@@ -232,34 +400,32 @@ function traverseNode(node, path, map, root, visitedRefs = new Set()) {
         for (const variant of variants) {
             if (!variant || typeof variant !== "object")
                 continue;
-            traverseVariant(variant, path, map, root, visitedRefs);
+            traverseVariant(variant, path, sink, root, onStack);
         }
     }
     // Map — `additionalProperties: { ... }` describes every value in an
     // open-keyed object. Encoder refs nested inside `content[mime]` map
     // entries reach Phase 5 through this branch.
-    if (node.additionalProperties &&
-        typeof node.additionalProperties === "object" &&
-        !Array.isArray(node.additionalProperties)) {
-        traverseNode(node.additionalProperties, `${path}.{}`, map, root, visitedRefs);
-    }
+    traverseMapValue(node, path, sink, root, onStack);
 }
 /** Walk a single variant of a `oneOf` / `anyOf` / `allOf` branch. Only
  *  the properties / items / map slots are followed — collectRefs at the
  *  variant root is handled by the parent's `collectRefs(node)` already
- *  (anyOf of x-telo-ref branches is the canonical multi-ref shape). */
-function traverseVariant(variant, path, map, root, visitedRefs = new Set()) {
+ *  (anyOf of x-telo-ref branches is the canonical multi-ref shape). In
+ *  driven mode a `$ref` branch is followed as a node in its own right, since
+ *  `readRefSlot` does not look through one. */
+function traverseVariant(variant, path, sink, root, onStack = new Map()) {
+    if (sink.driven && typeof variant.$ref === "string") {
+        followLocalRef(variant, path, sink, root, onStack);
+        return;
+    }
     if (variant.properties) {
         for (const [key, propSchema] of Object.entries(variant.properties)) {
-            traverseNode(propSchema, `${path}.${key}`, map, root, visitedRefs);
+            traverseNode(propSchema, joinPath(path, key), sink, root, onStack);
         }
     }
     if (variant.type === "array" && variant.items) {
-        traverseNode(variant.items, path + "[]", map, root, visitedRefs);
-    }
-    if (variant.additionalProperties &&
-        typeof variant.additionalProperties === "object" &&
-        !Array.isArray(variant.additionalProperties)) {
-        traverseNode(variant.additionalProperties, `${path}.{}`, map, root, visitedRefs);
+        traverseNode(variant.items, path + "[]", sink, root, onStack);
     }
+    traverseMapValue(variant, path, sink, root, onStack);
 }

package/dist/release/payload-digest.d.ts

@@ -49,7 +49,8 @@ export declare const LOCALLY_DERIVED_LAYERS: ReadonlySet<string>;
  * `axis=value;…` form, because this string is read by a human in a ledger diff
  * and written into a plain YAML key; the axis order is `PLATFORM_AXES`, so the
  * rendering is deterministic rather than dependent on how the selector was
- * built.
+ * built. An axis a selector omits renders nothing, so a new axis appended to the
+ * vocabulary leaves every existing key unchanged — reordering it would not.
  */
 export declare function layerDigestKey(role: LayerRole | string, selector?: ArtifactSelector): string;
 /** A layer whose digest differs between two readings, or that exists in only

package/dist/release/payload-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-digest.d.ts","sourceRoot":"","sources":["../../src/release/payload-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE/F,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAM5F;AAED;;;mBAGmB;AACnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;mCACmC;AACnC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,WAAW,EAAE,CAQzF"}
+{"version":3,"file":"payload-digest.d.ts","sourceRoot":"","sources":["../../src/release/payload-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE/F,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,yDAAyD;AACzD,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAErF;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAM5F;AAED;;;mBAGmB;AACnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;mCACmC;AACnC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,WAAW,EAAE,CAQzF"}

package/dist/release/payload-digest.js

@@ -47,7 +47,8 @@ export const LOCALLY_DERIVED_LAYERS = new Set([MANIFEST_LAYER]);
  * `axis=value;…` form, because this string is read by a human in a ledger diff
  * and written into a plain YAML key; the axis order is `PLATFORM_AXES`, so the
  * rendering is deterministic rather than dependent on how the selector was
- * built.
+ * built. An axis a selector omits renders nothing, so a new axis appended to the
+ * vocabulary leaves every existing key unchanged — reordering it would not.
  */
 export function layerDigestKey(role, selector) {
     if (!selector)

package/dist/resolve-ref-sentinels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;+CAC+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO;AAC3C;;+CAE+C;AAC/C,IAAI,CAAC,EAAE,mBAAmB,GACzB,IAAI,CAyIN"}
+{"version":3,"file":"resolve-ref-sentinels.d.ts","sourceRoot":"","sources":["../src/resolve-ref-sentinels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAIlC;+CAC+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS,CAAC;CAClC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,aAAa,EACvB,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAK5C,kBAAkB,GAAE,gBAAgB,EAAO;AAC3C;;+CAE+C;AAC/C,IAAI,CAAC,EAAE,mBAAmB,GACzB,IAAI,CAyIN"}

package/dist/resolve-ref-sentinels.js

@@ -1,6 +1,7 @@
 import { isRefSentinel, isTaggedSentinel } from "@telorun/templating";
 import { isScopeEntry, resolveFieldEntries, } from "./reference-field-map.js";
 import { REF_RESOLUTION_SKIP_KINDS as SYSTEM_KINDS } from "./system-kinds.js";
+import { isForwardedDeclaration, isForwardedExport } from "./forwarded-declaration.js";
 /**
  * Rewrites every `!ref <name>` sentinel in each non-system resource's value tree
  * to `{kind, name}` (local) or `{kind, name, alias}` (cross-module), in place.
@@ -48,9 +49,10 @@ crossModuleTargets = [],
  *  it shadows — so both call sites pass it. */
 defs) {
     const moduleOf = (r) => r.metadata?.module;
-    // Forwarded exports are flagged by flattenForAnalyzer (`metadata.forwardedExport`); they're
-    // cross-module resolution targets only — never walked as local ref sources here.
-    const isForeign = (r) => r.metadata?.forwardedExport === true;
+    // A dependency's code — a forwarded export, or what extraction pulled out of one — is
+    // never walked as a local ref source here and never a local name; only an EXPORT is a
+    // cross-module resolution target.
+    const isForeign = isForwardedDeclaration;
     // Local resources resolve a bare / `Self.`-qualified name; forwarded foreign exports
     // resolve an `Alias.`-qualified name keyed by (module, name).
     const byName = new Map();
@@ -60,14 +62,15 @@ defs) {
             continue;
         const name = r.metadata.name;
         if (isForeign(r)) {
-            byModuleName.set(`${moduleOf(r)}\0${name}`, r);
+            if (isForwardedExport(r))
+                byModuleName.set(`${moduleOf(r)}\0${name}`, r);
         }
         else {
             byName.set(name, r);
         }
     }
     for (const r of crossModuleTargets) {
-        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind) || !isForeign(r))
+        if (!r.metadata?.name || SYSTEM_KINDS.has(r.kind) || !isForwardedExport(r))
             continue;
         byModuleName.set(`${moduleOf(r)}\0${r.metadata.name}`, r);
     }

package/dist/resolve-throws-union.d.ts

@@ -1,6 +1,7 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { type AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { type RefSlot, type RefUse } from "./ref-slot.js";
 export interface ThrowsCodeMeta {
     data?: Record<string, any>;
 }
@@ -56,11 +57,31 @@ export interface ResolveCtx {
 }
 export declare function createResolveCtx(allManifests: ResourceManifest[], defs: DefinitionRegistry, aliases: AliasResolver, aliasesByModule?: Map<string, AliasResolver>, rootModules?: Set<string>, moduleManifests?: Map<string, ResourceManifest[]>): ResolveCtx;
 /** Resolve the effective throw union for a named manifest. The result combines
- *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
- *  traversal with try/catch subtraction), and unbounded markers for
- *  unresolvable passthrough call sites. Cycles short-circuit to an empty
- *  result so resolution always terminates. */
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step bodies with
+ *  try/catch subtraction, plus reference slots that hand a failure back), and
+ *  unbounded markers for unresolvable passthrough call sites. Cycles
+ *  short-circuit to an empty result so resolution always terminates. */
 export declare function resolveThrowsUnion(manifest: ResourceManifest, ctx: ResolveCtx): ThrowsUnion;
+/**
+ * True for a use through which a target's failure reaches the declaring
+ * resource's CALLER: `call` returns into my invocation, and `trigger.consumer`
+ * rejects the value my caller drains. `detached` and `trigger.inbound` run where
+ * no caller of mine awaits them; `dependency` and `schema` dispatch nothing.
+ *
+ * The reduction `inherit` is read through — by the resolver and by the check
+ * that a definition declaring it has something to inherit from.
+ */
+export declare function handsFailureBack(use: RefUse): boolean;
+/**
+ * The uses a throws consumer reads off a slot. A slot that declares no use —
+ * the legacy bare-string form — reads as `call`: the throws union must assume
+ * `call` to keep an error path, the direction the call graph takes for the same
+ * slot. The zone projection reads it the opposite way, deliberately.
+ *
+ * `uses` defaults to every use the slot can take; a consumer that resolved the
+ * slot's case map for one instance passes that answer instead.
+ */
+export declare function throwsUses(slot: RefSlot, uses?: readonly RefUse[]): readonly RefUse[];
 /**
  * The union a SCOPE-LEVEL `catches:` list can be asked to render — everything
  * the resource it is written on drives, transitively.

package/dist/resolve-throws-union.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB;;;wFAGoF;IACpF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,0FAA0F;IAC1F,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjD;uEACmE;IACnE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,EACpC,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,UAAU,CAWZ;AA2HD;;;;8CAI8C;AAC9C,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CAiDb;AAiCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,GAAG,CAAC,gBAAgB,CAAa,GACtC,WAAW,CAmCb;AAkMD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EACjB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,gBAAgB,GAAG,SAAS,CAsB9B"}
+{"version":3,"file":"resolve-throws-union.d.ts","sourceRoot":"","sources":["../src/resolve-throws-union.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,MAAM,EACZ,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;gFAEgF;AAChF,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC;;;8EAG0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;gDAI4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB;;;wFAGoF;IACpF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,0FAA0F;IAC1F,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjD;uEACmE;IACnE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,EAAE,EAChC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAa,EACvD,WAAW,GAAE,GAAG,CAAC,MAAM,CAAa,EACpC,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAa,GAC3D,UAAU,CAWZ;AA2HD;;;;wEAIwE;AACxE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,UAAU,GACd,WAAW,CAiDb;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,SAAS,MAAM,EAAuB,GAC3C,SAAS,MAAM,EAAE,CAEnB;AAuCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,GAAG,CAAC,gBAAgB,CAAa,GACtC,WAAW,CAkCb;AAiND;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EACjB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,gBAAgB,GAAG,SAAS,CAsB9B"}

package/dist/resolve-throws-union.js

@@ -1,9 +1,8 @@
 import { isTaggedSentinel } from "@telorun/templating";
 import { scopeResolverForModule } from "./alias-resolver.js";
-import { resolveScopedName } from "./call-graph.js";
+import { resolveScopedName, resolveSlotUseAt } from "./call-graph.js";
 import { refSentinelTarget } from "./ref-sentinel-target.js";
-import { possibleUses, transfersControl } from "./ref-slot.js";
-import { readStepSlot } from "./step-slot.js";
+import { hasDeclaredUse, possibleUses, transfersControl, } from "./ref-slot.js";
 import { forEachDrivenSlot } from "./schema-walk.js";
 /** Code a non-`InvokeError` failure surfaces as inside a `catch` block. Mirrors
  *  `PLAIN_ERROR_CODE` in `@telorun/run`'s `toSequenceError`: any invoke can throw
@@ -127,10 +126,10 @@ function codesFromDefinition(definition) {
     return out;
 }
 /** Resolve the effective throw union for a named manifest. The result combines
- *  explicit `throws.codes`, `throws.inherit: true` dataflow (step-context
- *  traversal with try/catch subtraction), and unbounded markers for
- *  unresolvable passthrough call sites. Cycles short-circuit to an empty
- *  result so resolution always terminates. */
+ *  explicit `throws.codes`, `throws.inherit: true` dataflow (step bodies with
+ *  try/catch subtraction, plus reference slots that hand a failure back), and
+ *  unbounded markers for unresolvable passthrough call sites. Cycles
+ *  short-circuit to an empty result so resolution always terminates. */
 export function resolveThrowsUnion(manifest, ctx) {
     const name = memoKey(manifest);
     if (name) {
@@ -182,29 +181,52 @@ export function resolveThrowsUnion(manifest, ctx) {
     }
 }
 /**
- * `throws.inherit: true` — the union a composer's own STEP BODIES reach.
+ * True for a use through which a target's failure reaches the declaring
+ * resource's CALLER: `call` returns into my invocation, and `trigger.consumer`
+ * rejects the value my caller drains. `detached` and `trigger.inbound` run where
+ * no caller of mine awaits them; `dependency` and `schema` dispatch nothing.
  *
- * Deliberately steps only, and not every slot the resource drives: `inherit` is
- * a DECLARATION that a kind's union is the union of what it dispatches, and a
- * kind that does not make that claim must not have it inferred — a kind holding
- * a `call` ref it catches internally would silently gain codes it never lets
- * escape. What a CATCH SCOPE needs is a different question with a different
- * answer, and it has its own resolver below.
+ * The reduction `inherit` is read through — by the resolver and by the check
+ * that a definition declaring it has something to inherit from.
+ */
+export function handsFailureBack(use) {
+    return use === "call" || use === "trigger.consumer";
+}
+/**
+ * The uses a throws consumer reads off a slot. A slot that declares no use —
+ * the legacy bare-string form — reads as `call`: the throws union must assume
+ * `call` to keep an error path, the direction the call graph takes for the same
+ * slot. The zone projection reads it the opposite way, deliberately.
+ *
+ * `uses` defaults to every use the slot can take; a consumer that resolved the
+ * slot's case map for one instance passes that answer instead.
+ */
+export function throwsUses(slot, uses = possibleUses(slot)) {
+    return hasDeclaredUse(slot) ? uses : ["call"];
+}
+/**
+ * `throws.inherit: true` — the union of what the resource dispatches: its step
+ * bodies (try/catch subtraction included) and every reference slot whose use,
+ * resolved for THIS instance, hands a failure back ({@link handsFailureBack}).
+ *
+ * Only on a kind that DECLARES `inherit`: it is a claim that the kind lets what
+ * it dispatches escape, and a kind catching a slot internally does not make it.
+ * What a CATCH SCOPE encloses is a different question, answered below.
  */
 function resolveInherited(manifest, definition, ctx, ownerModule) {
     const result = { codes: new Map(), unbounded: false };
-    const props = definition.schema?.properties;
-    if (!props)
-        return result;
-    for (const [fieldName, fieldSchema] of Object.entries(props)) {
-        const stepCtx = readStepSlot(fieldSchema);
-        if (!stepCtx)
-            continue;
-        const steps = manifest[fieldName];
-        if (!Array.isArray(steps))
-            continue;
-        unionInto(result, collectStepArrayThrows(steps, stepCtx.invoke, undefined, ctx, ownerModule));
-    }
+    const schema = definition.schema;
+    forEachDrivenSlot(schema, manifest, (driven) => {
+        if (driven.kind === "step") {
+            unionInto(result, stepSiteThrows(driven.data, driven.slots, ctx, ownerModule));
+            return;
+        }
+        // Several slots at one site are the branches declaring it; any one that
+        // hands a failure back counts, since a branch not applying can only add codes.
+        const handsBack = driven.slots.some(({ slot, fieldPath }) => throwsUses(slot, resolveSlotUseAt(slot, manifest, schema, driven.path, fieldPath).use).some(handsFailureBack));
+        if (handsBack)
+            unionInto(result, resolveRefTargetThrows(driven.data, ctx, ownerModule));
+    });
     return result;
 }
 /**
@@ -233,10 +255,13 @@ export function resolveScopeUnion(manifest, definition, ctx, seen = new Set()) {
     const ownerModule = manifest.metadata?.module;
     forEachDrivenSlot(definition.schema, manifest, (driven) => {
         if (driven.kind === "step") {
-            unionInto(result, collectStepArrayThrows(driven.data, driven.slot.invoke, undefined, ctx, ownerModule));
+            unionInto(result, stepSiteThrows(driven.data, driven.slots, ctx, ownerModule));
             return;
         }
-        if (driven.slot.throwsThrough) {
+        if (driven.slots.some(({ slot }) => !slot.throwsThrough && throwsUses(slot).some(transfersControl))) {
+            unionInto(result, resolveRefTargetThrows(driven.data, ctx, ownerModule));
+        }
+        if (driven.slots.some(({ slot }) => slot.throwsThrough)) {
             const target = resolveRefManifest(driven.data, ctx, ownerModule);
             const targetDef = target
                 ? definitionFor(target.kind, ctx.defs, ctx.aliases, scopeResolverFor(ctx, target.metadata?.module))
@@ -247,14 +272,19 @@ export function resolveScopeUnion(manifest, definition, ctx, seen = new Set()) {
             // the scope's union is no longer enumerable.
             else
                 result.unbounded = true;
-            return;
         }
-        if (!possibleUses(driven.slot).some(transfersControl))
-            return;
-        unionInto(result, resolveRefTargetThrows(driven.data, ctx, ownerModule));
     });
     return result;
 }
+/** The union a step-body site reaches — once per distinct invoke field, since
+ *  several branches may declare a body at one site. */
+function stepSiteThrows(steps, slots, ctx, ownerModule) {
+    const result = emptyUnion();
+    for (const invoke of new Set(slots.map((slot) => slot.invoke))) {
+        unionInto(result, collectStepArrayThrows(steps, invoke, undefined, ctx, ownerModule));
+    }
+    return result;
+}
 function collectStepArrayThrows(steps, invokeField, enclosingTryCodes, ctx, ownerModule) {
     const result = emptyUnion();
     for (const step of steps) {

package/dist/resolve-zone-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAuKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAoZ9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}
+{"version":3,"file":"resolve-zone-requirements.d.ts","sourceRoot":"","sources":["../src/resolve-zone-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMzE;;uCAEuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;wBAEoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sDACkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;gCAG4B;IAC5B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAkBhE,UAAU,cAAc;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;qEACiE;IACjE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;0EACsE;IACtE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3C;2CACuC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAuKD,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAoZ9E;AAED;;;;iEAIiE;AACjE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAUrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3C,KAAK,CAAC,EAAE,eAAe,GACtB,sBAAsB,CAkBxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAwF5E"}

package/dist/resolve-zone-requirements.js

@@ -4,6 +4,7 @@ import { enclosingOf, propertySchemas, resolveLocalRef, } from "./manifest-navig
 import { readProvidesZone, readRequiresZone } from "./zone-slot.js";
 import { DiagnosticSeverity } from "./types.js";
 import { moduleAliasScope } from "./module-alias-scope.js";
+import { isForwardedDeclaration } from "./forwarded-declaration.js";
 const SOURCE = "telo-analyzer";
 /** Resolve a possibly alias-form kind to its definition in the DECLARING
  *  module's scope — the same layering `AnalysisRegistry.resolveDefinitionIn`
@@ -379,7 +380,7 @@ export function projectZoneRequirements(args) {
         // (with the internal graph in hand) and seeded below — deriving them here
         // against the flattened view would resolve correlation against a graph
         // that no longer holds the library's internals.
-        if (meta?.forwardedExport)
+        if (isForwardedDeclaration(node.manifest))
             continue;
         const def = resolveDef(node.kind, meta?.module);
         const schema = def?.schema;

package/dist/rewrite-synthetic-origins.d.ts

@@ -5,6 +5,11 @@ import type { AnalysisDiagnostic } from "./types.js";
  *  `data.resource`, which has no YAML source. Rewrite each such diagnostic
  *  back to the chain root: walk up `metadata.xTeloOrigin` until a manifest
  *  with no origin is reached, and prepend each hop's `pathFromParent` to
- *  `data.path` so position-index lookups against the root doc resolve. */
+ *  `data.path` so position-index lookups against the root doc resolve.
+ *
+ *  An extraction from a scope member lives INSIDE the scope array rather than at
+ *  the top level, so a diagnostic about it names the top-level owner and a path
+ *  through an array index the author never wrote (`with[3]`). That prefix is
+ *  unfolded the same way, into the position the declaration was written at. */
 export declare function rewriteSyntheticOrigins(diagnostics: AnalysisDiagnostic[], manifests: ResourceManifest[]): AnalysisDiagnostic[];
 //# sourceMappingURL=rewrite-synthetic-origins.d.ts.map