@telorun/analyzer 0.16.1 → 0.18.0

package/README.md

@@ -54,20 +54,13 @@ metadata:
   description: |
     A complete feedback collection REST API — no code, pure YAML.
     Persists entries to SQLite and serves them over HTTP.
+imports:
+  Http: std/http-server@0.6.1
+  Sql: std/sql@0.5.1
 targets:
   - Migrations
   - Server
 ---
-kind: Telo.Import
-metadata:
-  name: Http
-source: std/http-server@0.5.0
----
-kind: Telo.Import
-metadata:
-  name: Sql
-source: std/sql@0.3.0
----
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection
 metadata:
@@ -127,7 +120,7 @@ routes:
               minLength: 1
             source:
               type: string
-          required: [text]
+          required: [ text ]
     handler:
       kind: Sql.Exec
       connection:
@@ -157,7 +150,7 @@ routes:
         kind: Sql.Connection
         name: Db
       from: feedback
-      columns: [id, text, source, score, created_at]
+      columns: [ id, text, source, score, created_at ]
       orderBy:
         - { column: created_at, direction: desc }
     response:
@@ -176,14 +169,14 @@ routes:
           properties:
             id:
               type: integer
-          required: [id]
+          required: [ id ]
     handler:
       kind: Sql.Select
       connection:
         kind: Sql.Connection
         name: Db
       from: feedback
-      columns: [id, text, source, score, created_at]
+      columns: [ id, text, source, score, created_at ]
       where:
         - { column: id, op: "=", value: "${{ request.params.id }}" }
     response:

package/dist/analysis-registry.d.ts

@@ -1,6 +1,23 @@
 import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import { type ManifestVisitor } from "./manifest-visitor.js";
 import type { AnalysisContext } from "./types.js";
+/** One reference field declared by a resource's definition, derived purely from
+ *  the schema field map (independent of whether the manifest fills it). Editor
+ *  hosts render these as ports / adapters on a node. */
+export interface RefFieldInfo {
+    /** Field-map path with `[]` / `{}` markers (e.g. `targets[]`,
+     *  `routes[].handler`, `encoder`). */
+    path: string;
+    /** True when the path traverses at least one array. */
+    isArray: boolean;
+    /** Accepted `x-telo-ref` constraint strings (e.g. `telo#Runnable`). */
+    refs: string[];
+    /** Distinct capabilities the slot may target (`Telo.Runnable`,
+     *  `Telo.Service`, `Telo.Provider`, …) — one per resolvable constraint. The
+     *  first classifies the port (node-capability → edge, ambient → picker); the
+     *  full set validates drag-to-wire endpoints. Empty when none resolve. */
+    capabilities: string[];
+}
 /**
  * Accumulates type and alias knowledge for a running kernel or analysis session.
  * Wraps AliasResolver and DefinitionRegistry into a single domain-level interface
@@ -23,6 +40,31 @@ export declare class AnalysisRegistry {
      * sub-schema (e.g. Server.notFoundHandler.returns[].content[mime].encoder).
      */
     iterateFieldEntries(resource: ResourceManifest, onRef: (fieldPath: string) => void, onScope: (fieldPath: string) => void): void;
+    /**
+     * Returns every reference field a resource's definition declares, with arity
+     * and the capability each slot targets — derived purely from the schema field
+     * map, so it lists slots even when the manifest leaves them empty. Editor
+     * hosts render these as node ports (drag-to-wire for node-capability targets,
+     * inline picker for ambient targets).
+     */
+    refFieldsForResource(resource: ResourceManifest): RefFieldInfo[];
+    /** Base capability an `x-telo-ref` constraint targets. A definition's declared
+     *  `capability` is always one of the base capabilities, so it wins — this
+     *  resolves user-defined abstracts (e.g. `std/ai#Model`, declared
+     *  `capability: Telo.Invocable`) to the capability instances satisfy, not the
+     *  abstract kind. Builtin abstracts (`telo#Runnable`) carry no `capability`
+     *  field — there the kind itself *is* the capability. Undefined when
+     *  unresolvable. */
+    capabilityForRef(xTeloRef: string): string | undefined;
+    /** Resolves the JSON Schema for a kind's `invoke()` inputs, for editor hosts
+     *  that render a typed inputs form. Two-layer fallback mirroring the analyzer's
+     *  template inputs typing: the definition's own `inputType`, then the
+     *  `extends`-declared abstract's `inputType`. Resolves the inline
+     *  (`{ kind: Type.JsonSchema, schema }`) and raw-schema forms; a bare named
+     *  type reference is left unresolved (returns undefined) so the caller can fall
+     *  back to a freeform map. Undefined when the kind declares no input contract. */
+    inputTypeForKind(kind: string): Record<string, unknown> | undefined;
+    private capabilitiesForRefs;
     /**
      * Walks a manifest's annotation sites (refs, scopes, schema-from, CEL) via
      * the shared manifest visitor, bound to this registry's definitions and

package/dist/analysis-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IA+B7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}
+{"version":3,"file":"analysis-registry.d.ts","sourceRoot":"","sources":["../src/analysis-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKzE,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;8EAG0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IAEpE,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAIjD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;;;;;;OAOG;IACH,mBAAmB,CACjB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,EAClC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI;IAkBP;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,EAAE;IAoBhE;;;;;;wBAMoB;IACpB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAQtD;;;;;;sFAMkF;IAClF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAenE,OAAO,CAAC,mBAAmB;IAS3B;;;;;;OAMG;IACH,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,IAAI;IAQP;;;;OAIG;IACH,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAM/D,QAAQ,IAAI,MAAM,EAAE;IAIpB;mEAC+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC;;;gCAG4B;IAC5B,oBAAoB,IAAI,MAAM,EAAE;IAIhC;wEACoE;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD;;;;;gEAK4D;IAC5D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IA+B7D,qFAAqF;IACrF,QAAQ,IAAI,eAAe;CAG5B"}

package/dist/analysis-registry.js

@@ -4,6 +4,7 @@ import { DefinitionRegistry } from "./definition-registry.js";
 import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.js";
 import { visitManifest as runVisitManifest } from "./manifest-visitor.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
 /**
  * Accumulates type and alias knowledge for a running kernel or analysis session.
  * Wraps AliasResolver and DefinitionRegistry into a single domain-level interface
@@ -47,6 +48,79 @@ export class AnalysisRegistry {
             }
         }
     }
+    /**
+     * Returns every reference field a resource's definition declares, with arity
+     * and the capability each slot targets — derived purely from the schema field
+     * map, so it lists slots even when the manifest leaves them empty. Editor
+     * hosts render these as node ports (drag-to-wire for node-capability targets,
+     * inline picker for ambient targets).
+     */
+    refFieldsForResource(resource) {
+        const fieldMap = this.defs.expandedFieldMapForResource(resource, this.aliases, this.aliasesByModule);
+        if (!fieldMap)
+            return [];
+        const out = [];
+        for (const [path, entry] of fieldMap) {
+            if (!isRefEntry(entry))
+                continue;
+            out.push({
+                path,
+                isArray: entry.isArray,
+                refs: entry.refs,
+                capabilities: this.capabilitiesForRefs(entry.refs),
+            });
+        }
+        return out;
+    }
+    /** Base capability an `x-telo-ref` constraint targets. A definition's declared
+     *  `capability` is always one of the base capabilities, so it wins — this
+     *  resolves user-defined abstracts (e.g. `std/ai#Model`, declared
+     *  `capability: Telo.Invocable`) to the capability instances satisfy, not the
+     *  abstract kind. Builtin abstracts (`telo#Runnable`) carry no `capability`
+     *  field — there the kind itself *is* the capability. Undefined when
+     *  unresolvable. */
+    capabilityForRef(xTeloRef) {
+        const kind = this.defs.resolveRef(xTeloRef);
+        if (!kind)
+            return undefined;
+        const def = this.defs.resolve(kind);
+        if (!def)
+            return undefined;
+        return def.capability ?? kind;
+    }
+    /** Resolves the JSON Schema for a kind's `invoke()` inputs, for editor hosts
+     *  that render a typed inputs form. Two-layer fallback mirroring the analyzer's
+     *  template inputs typing: the definition's own `inputType`, then the
+     *  `extends`-declared abstract's `inputType`. Resolves the inline
+     *  (`{ kind: Type.JsonSchema, schema }`) and raw-schema forms; a bare named
+     *  type reference is left unresolved (returns undefined) so the caller can fall
+     *  back to a freeform map. Undefined when the kind declares no input contract. */
+    inputTypeForKind(kind) {
+        const def = this.resolveDefinition(kind);
+        if (!def)
+            return undefined;
+        const own = resolveTypeFieldToSchema(def.inputType, []);
+        if (own)
+            return own;
+        if (def.extends) {
+            const abstractDef = this.resolveDefinition(def.extends);
+            if (abstractDef) {
+                const inherited = resolveTypeFieldToSchema(abstractDef.inputType, []);
+                if (inherited)
+                    return inherited;
+            }
+        }
+        return undefined;
+    }
+    capabilitiesForRefs(refs) {
+        const out = [];
+        for (const ref of refs) {
+            const cap = this.capabilityForRef(ref);
+            if (cap && !out.includes(cap))
+                out.push(cap);
+        }
+        return out;
+    }
     /**
      * Walks a manifest's annotation sites (refs, scopes, schema-from, CEL) via
      * the shared manifest visitor, bound to this registry's definitions and

package/dist/flatten-for-analyzer.d.ts

@@ -1,9 +1,31 @@
 import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedGraph, LoadedModule } from "./loaded-types.js";
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export declare function selectModuleManifestsForAnalysis(moduleManifests: ResourceManifest[], isRoot: boolean): ResourceManifest[];
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest

package/dist/flatten-for-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;6EAkB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA6EzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}
+{"version":3,"file":"flatten-for-analyzer.d.ts","sourceRoot":"","sources":["../src/flatten-for-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAc,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;2CAmB2C;AAC3C,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,gBAAgB,EAAE,EACnC,MAAM,EAAE,OAAO,GACd,gBAAgB,EAAE,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;6EAmB6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,gBAAgB,EAAE,CA+CzE;AAED;;;;;6BAK6B;AAC7B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAEzE"}

package/dist/flatten-for-analyzer.js

@@ -1,8 +1,50 @@
 import { isModuleKind } from "./module-kinds.js";
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export function selectModuleManifestsForAnalysis(moduleManifests, isRoot) {
+    if (isRoot)
+        return moduleManifests;
+    const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
+    const exportedResources = new Set(libDoc?.exports?.resources ?? []);
+    const out = [];
+    for (const m of moduleManifests) {
+        if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
+            out.push(m);
+        }
+        else if (!isModuleKind(m.kind) &&
+            typeof m.metadata?.name === "string" &&
+            exportedResources.has(m.metadata.name)) {
+            out.push({
+                ...m,
+                metadata: { ...m.metadata, forwardedExport: true },
+            });
+        }
+    }
+    return out;
+}
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest
@@ -20,8 +62,7 @@ import { isModuleKind } from "./module-kinds.js";
  *  callers look it up via `findPositions(graph, ...)` on the LoadedGraph. */
 export function flattenForAnalyzer(graph) {
     const result = [];
-    const stampedEntry = collectModuleManifests(graph.entry);
-    result.push(...stampedEntry);
+    result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(graph.entry), true));
     const seen = new Set([graph.rootSource]);
     const queue = [graph.rootSource];
     while (queue.length > 0) {
@@ -37,31 +78,7 @@ export function flattenForAnalyzer(graph) {
             const targetModule = graph.modules.get(edge.targetSource);
             if (!targetModule)
                 continue;
-            const stamped = collectModuleManifests(targetModule);
-            const libDoc = stamped.find((m) => isModuleKind(m.kind));
-            const exportedResources = new Set(libDoc?.exports?.resources ?? []);
-            for (const m of stamped) {
-                if (m.kind === "Telo.Definition" ||
-                    m.kind === "Telo.Abstract" ||
-                    m.kind === "Telo.Import") {
-                    result.push(m);
-                }
-                else if (!isModuleKind(m.kind) &&
-                    typeof m.metadata?.name === "string" &&
-                    exportedResources.has(m.metadata.name)) {
-                    // Forward instances listed in the library's `exports.resources` so the
-                    // consumer's analyzer can resolve, gate, kind-check, and draw topology edges
-                    // for cross-module `!ref Alias.name`. The gate IS this forwarding — only
-                    // exported names cross the boundary. `metadata.forwardedExport` marks them as
-                    // cross-module resolution targets only (keyed by `metadata.module`), so ref
-                    // resolution / validation treats them as targets, never as local sources to
-                    // re-validate or walk.
-                    result.push({
-                        ...m,
-                        metadata: { ...m.metadata, forwardedExport: true },
-                    });
-                }
-            }
+            result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
         }
     }
     // Stamp resolved import identity on every Telo.Import in the result by

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
+export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type { GraphLoadError, ImportEdge, LoadedFile, LoadedGraph, LoadedModule, ParseError, } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type { CelSiteEvent, ManifestVisitor, RefSiteEvent, ResourceEnterEvent, ResourceExitEvent, ScopeBoundaryEvent, SchemaFromSiteEvent, VisitOptions, } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACR,cAAc,EACd,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,UAAU,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,YAAY,EACR,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACR,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,EACR,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export { flattenForAnalyzer, flattenLoadedModule, selectModuleManifestsForAnalysis, } from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export { Loader } from "./manifest-loader.js";
 export { isModuleKind, MODULE_KINDS } from "./module-kinds.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.17.0"
+    "@telorun/sdk": "0.18.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -6,6 +6,25 @@ import { computeSuggestKind, computeValidUserFacingKinds } from "./kind-suggest.
 import { visitManifest as runVisitManifest, type ManifestVisitor } from "./manifest-visitor.js";
 import { isRefEntry, isScopeEntry } from "./reference-field-map.js";
 import type { AnalysisContext } from "./types.js";
+import { resolveTypeFieldToSchema } from "./validate-cel-context.js";
+
+/** One reference field declared by a resource's definition, derived purely from
+ *  the schema field map (independent of whether the manifest fills it). Editor
+ *  hosts render these as ports / adapters on a node. */
+export interface RefFieldInfo {
+  /** Field-map path with `[]` / `{}` markers (e.g. `targets[]`,
+   *  `routes[].handler`, `encoder`). */
+  path: string;
+  /** True when the path traverses at least one array. */
+  isArray: boolean;
+  /** Accepted `x-telo-ref` constraint strings (e.g. `telo#Runnable`). */
+  refs: string[];
+  /** Distinct capabilities the slot may target (`Telo.Runnable`,
+   *  `Telo.Service`, `Telo.Provider`, …) — one per resolvable constraint. The
+   *  first classifies the port (node-capability → edge, ambient → picker); the
+   *  full set validates drag-to-wire endpoints. Empty when none resolve. */
+  capabilities: string[];
+}
 
 /**
  * Accumulates type and alias knowledge for a running kernel or analysis session.
@@ -63,6 +82,79 @@ export class AnalysisRegistry {
     }
   }
 
+  /**
+   * Returns every reference field a resource's definition declares, with arity
+   * and the capability each slot targets — derived purely from the schema field
+   * map, so it lists slots even when the manifest leaves them empty. Editor
+   * hosts render these as node ports (drag-to-wire for node-capability targets,
+   * inline picker for ambient targets).
+   */
+  refFieldsForResource(resource: ResourceManifest): RefFieldInfo[] {
+    const fieldMap = this.defs.expandedFieldMapForResource(
+      resource,
+      this.aliases,
+      this.aliasesByModule,
+    );
+    if (!fieldMap) return [];
+    const out: RefFieldInfo[] = [];
+    for (const [path, entry] of fieldMap) {
+      if (!isRefEntry(entry)) continue;
+      out.push({
+        path,
+        isArray: entry.isArray,
+        refs: entry.refs,
+        capabilities: this.capabilitiesForRefs(entry.refs),
+      });
+    }
+    return out;
+  }
+
+  /** Base capability an `x-telo-ref` constraint targets. A definition's declared
+   *  `capability` is always one of the base capabilities, so it wins — this
+   *  resolves user-defined abstracts (e.g. `std/ai#Model`, declared
+   *  `capability: Telo.Invocable`) to the capability instances satisfy, not the
+   *  abstract kind. Builtin abstracts (`telo#Runnable`) carry no `capability`
+   *  field — there the kind itself *is* the capability. Undefined when
+   *  unresolvable. */
+  capabilityForRef(xTeloRef: string): string | undefined {
+    const kind = this.defs.resolveRef(xTeloRef);
+    if (!kind) return undefined;
+    const def = this.defs.resolve(kind);
+    if (!def) return undefined;
+    return def.capability ?? kind;
+  }
+
+  /** Resolves the JSON Schema for a kind's `invoke()` inputs, for editor hosts
+   *  that render a typed inputs form. Two-layer fallback mirroring the analyzer's
+   *  template inputs typing: the definition's own `inputType`, then the
+   *  `extends`-declared abstract's `inputType`. Resolves the inline
+   *  (`{ kind: Type.JsonSchema, schema }`) and raw-schema forms; a bare named
+   *  type reference is left unresolved (returns undefined) so the caller can fall
+   *  back to a freeform map. Undefined when the kind declares no input contract. */
+  inputTypeForKind(kind: string): Record<string, unknown> | undefined {
+    const def = this.resolveDefinition(kind);
+    if (!def) return undefined;
+    const own = resolveTypeFieldToSchema(def.inputType, []);
+    if (own) return own;
+    if (def.extends) {
+      const abstractDef = this.resolveDefinition(def.extends);
+      if (abstractDef) {
+        const inherited = resolveTypeFieldToSchema(abstractDef.inputType, []);
+        if (inherited) return inherited;
+      }
+    }
+    return undefined;
+  }
+
+  private capabilitiesForRefs(refs: string[]): string[] {
+    const out: string[] = [];
+    for (const ref of refs) {
+      const cap = this.capabilityForRef(ref);
+      if (cap && !out.includes(cap)) out.push(cap);
+    }
+    return out;
+  }
+
   /**
    * Walks a manifest's annotation sites (refs, scopes, schema-from, CEL) via
    * the shared manifest visitor, bound to this registry's definitions and

package/src/flatten-for-analyzer.ts

@@ -2,10 +2,60 @@ import type { ResourceManifest } from "@telorun/sdk";
 import type { LoadedFile, LoadedGraph, LoadedModule } from "./loaded-types.js";
 import { isModuleKind } from "./module-kinds.js";
 
+/** The import-boundary forwarding rule, shared by `flattenForAnalyzer` (the
+ *  CLI / kernel loader path) and the telo-editor's workspace projection so the
+ *  two cannot drift. Given one module's stamped manifests and whether that
+ *  module is the analysis entry (root), returns the manifests that cross into
+ *  the consumer's flat analysis list:
+ *
+ *  - **Root module** — every manifest is local; returned unchanged. The root's
+ *    internals (CEL / schema / refs) are validated in full.
+ *  - **Imported module** — only `Telo.Definition` / `Telo.Abstract` /
+ *    `Telo.Import` docs cross unconditionally, plus the instances named in the
+ *    module's `exports.resources` (stamped `metadata.forwardedExport: true`).
+ *    The module doc and internal (unexported) instances are dropped — they
+ *    belong to that module's own analysis pass.
+ *
+ *  `forwardedExport` marks an instance as a cross-module resolution TARGET only
+ *  (keyed by `metadata.module`), so `resolveRefSentinels` files it under
+ *  `byModuleName` and `!ref Alias.name` resolves, while `validate-references` /
+ *  the per-resource validation loop never re-walk or re-validate it against the
+ *  consumer's scope. A consumer that instead emits every module doc as a peer
+ *  local manifest silently breaks both. */
+export function selectModuleManifestsForAnalysis(
+  moduleManifests: ResourceManifest[],
+  isRoot: boolean,
+): ResourceManifest[] {
+  if (isRoot) return moduleManifests;
+
+  const libDoc = moduleManifests.find((m) => isModuleKind(m.kind));
+  const exportedResources = new Set<string>(
+    (libDoc as { exports?: { resources?: string[] } } | undefined)?.exports?.resources ?? [],
+  );
+
+  const out: ResourceManifest[] = [];
+  for (const m of moduleManifests) {
+    if (m.kind === "Telo.Definition" || m.kind === "Telo.Abstract" || m.kind === "Telo.Import") {
+      out.push(m);
+    } else if (
+      !isModuleKind(m.kind) &&
+      typeof m.metadata?.name === "string" &&
+      exportedResources.has(m.metadata.name as string)
+    ) {
+      out.push({
+        ...m,
+        metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
+      });
+    }
+  }
+  return out;
+}
+
 /** Produce the flat manifest list `analyze()` consumes today.
  *
  *  Combines the entry module's manifests with `Telo.Definition`,
- *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries.
+ *  `Telo.Abstract`, and `Telo.Import` docs forwarded from imported libraries
+ *  (plus their `exports.resources` instances) via `selectModuleManifestsForAnalysis`.
  *  Stamps three flavours of metadata along the way:
  *
  *  - `metadata.source` and `metadata.sourceLine` — already on each manifest
@@ -24,8 +74,7 @@ import { isModuleKind } from "./module-kinds.js";
 export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
   const result: ResourceManifest[] = [];
 
-  const stampedEntry = collectModuleManifests(graph.entry);
-  result.push(...stampedEntry);
+  result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(graph.entry), true));
 
   const seen = new Set<string>([graph.rootSource]);
   const queue: string[] = [graph.rootSource];
@@ -43,36 +92,7 @@ export function flattenForAnalyzer(graph: LoadedGraph): ResourceManifest[] {
       const targetModule = graph.modules.get(edge.targetSource);
       if (!targetModule) continue;
 
-      const stamped = collectModuleManifests(targetModule);
-      const libDoc = stamped.find((m) => isModuleKind(m.kind));
-      const exportedResources = new Set<string>(
-        (libDoc as { exports?: { resources?: string[] } } | undefined)?.exports?.resources ?? [],
-      );
-      for (const m of stamped) {
-        if (
-          m.kind === "Telo.Definition" ||
-          m.kind === "Telo.Abstract" ||
-          m.kind === "Telo.Import"
-        ) {
-          result.push(m);
-        } else if (
-          !isModuleKind(m.kind) &&
-          typeof m.metadata?.name === "string" &&
-          exportedResources.has(m.metadata.name as string)
-        ) {
-          // Forward instances listed in the library's `exports.resources` so the
-          // consumer's analyzer can resolve, gate, kind-check, and draw topology edges
-          // for cross-module `!ref Alias.name`. The gate IS this forwarding — only
-          // exported names cross the boundary. `metadata.forwardedExport` marks them as
-          // cross-module resolution targets only (keyed by `metadata.module`), so ref
-          // resolution / validation treats them as targets, never as local sources to
-          // re-validate or walk.
-          result.push({
-            ...m,
-            metadata: { ...m.metadata, forwardedExport: true } as ResourceManifest["metadata"],
-          });
-        }
-      }
+      result.push(...selectModuleManifestsForAnalysis(collectModuleManifests(targetModule), false));
     }
   }
 

package/src/index.ts

@@ -1,4 +1,5 @@
 export { AnalysisRegistry } from "./analysis-registry.js";
+export type { RefFieldInfo } from "./analysis-registry.js";
 export { StaticAnalyzer } from "./analyzer.js";
 export type {
     GraphLoadError,
@@ -8,7 +9,11 @@ export type {
     LoadedModule,
     ParseError,
 } from "./loaded-types.js";
-export { flattenForAnalyzer, flattenLoadedModule } from "./flatten-for-analyzer.js";
+export {
+    flattenForAnalyzer,
+    flattenLoadedModule,
+    selectModuleManifestsForAnalysis,
+} from "./flatten-for-analyzer.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {
     CelSiteEvent,