makeGetOverriddenResourceNames = (compartmentMap, policyOverride) => {
  /**
   * A cache of {@link CompartmentDescriptor} to a list of module names present
   * in policy resources.
   *
   * @type {WeakMap<CompartmentDescriptor, Set<string>>}
   */
  const overriddenResourcesCache = new WeakMap()

  /**
   * Accepts a {@link CompartmentDescriptor} (presumably one present in
   * {@link CompartmentMapDescriptor.compartments}) and returns a set of module
   * names present in LavaMoat policy resources because it's possible that
   * policy-override contains package references that were added by the user
   * when not detected by policy generator on previous pass.
   *
   * Memoized on `CompartmentMapDescriptor`
   *
   * @param {CompartmentDescriptor} compartmentDescriptor Compartment to check
   * @returns {Set<string>} Keys in policy resources which need updating
   */
  const getOverriddenResources = (compartmentDescriptor) => {
    if (overriddenResourcesCache.has(compartmentDescriptor)) {
      return /** @type {Set<string>} */ (
        overriddenResourcesCache.get(compartmentDescriptor)
      )
    }

    /**
     * Gets a valid {@link CompartmentDescriptor} from a compartment name, but
     * only if it's not the entry compartment or the
     * {@link compartmentDescriptor current one}.
     *
     * @param {string} [compartmentName] Compartment name
     * @returns {CompartmentDescriptor | undefined}
     */
    const getValidCompartmentDescriptor = (compartmentName) => {
      /* c8 ignore next */
      if (!compartmentName) {
        // The `compartment` prop can be `undefined` per the typings, though
        // I'm not sure if this will ever occur in practice.
        return
      }

      const moduleDescriptorCompartment =
        compartmentMap.compartments[compartmentName]

      /* c8 ignore next */
      if (!moduleDescriptorCompartment) {
        // "should never happen". maybe throw instead
        return
      }

      // All compartment descriptors will have a module descriptor which
      // refers to itself. We can safely ignore the module descriptor for
      // the current compartment, since we only wish to consider _other_
      // imports.
      if (moduleDescriptorCompartment === compartmentDescriptor) {
        return
      }

      return moduleDescriptorCompartment
    }

    const { label: canonicalName } = compartmentDescriptor
    const packagePolicy =
      policyOverride.resources[canonicalName]?.packages ?? {}

    /**
     * A set of keys from {@link LavaMoatPolicy.resources} matching
     * {@link CompartmentDescriptor.modules the current `CompartmentDescriptor`'s `modules`}.
     * These will be updated by {@link updateModuleSource}.
     *
     * Cached on {@link compartmentDescriptor}.
     */
    const overriddenResources = entries(compartmentDescriptor.modules).reduce(
      (
        overriddenResources,
        [moduleDescriptorName, { compartment: moduleDescriptorCompartmentName }]
      ) => {
        if (!moduleDescriptorCompartmentName) {
          return overriddenResources
        }
        const otherCompartmentDescriptor = getValidCompartmentDescriptor(
          moduleDescriptorCompartmentName
        )
        if (
          !otherCompartmentDescriptor ||
          otherCompartmentDescriptor === compartmentDescriptor
        ) {
          return overriddenResources
        }

        const { label: otherCanonicalName } = otherCompartmentDescriptor

        if (!(otherCanonicalName in packagePolicy)) {
          return overriddenResources
        }

        // this is _not_ the canonical name, but the compartment.name field,
        // which is different, but remains in a 1:1 relationship with the
        // canonical name. It's what @endo/compartment-mapper uses internally
        // for linking and finding compartments
        overriddenResources.add(moduleDescriptorName)

        return overriddenResources
      },
      /** @type {Set<string>} */ (new Set())
    )

    return overriddenResources
  }
  return getOverriddenResources
}
Factory function for a thing which Accepts a {@link CompartmentDescriptor}
(presumably one present in {@link CompartmentMapDescriptor.compartments}) and
returns a set of module names present in LavaMoat policy resources which need
to be updated.

@param {CompartmentMapDescriptor} compartmentMap Compartment map descriptor
@param {LavaMoatPolicy} policyOverride LavaMoat policy override
@returns {(compartmentDescriptor: CompartmentDescriptor) => Set<string>}