@saptools/service-flow 0.1.12 → 0.1.13

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.13
+
+- Added implementation-context fallback for local `cds.services.*` calls so helper packages can resolve model-package operations only when handler/dependency/registration evidence ties the caller repository to the target operation.
+- Preserved same-repository local service resolution as the strongest path and added explicit evidence/reasons for implementation-context ownership, rejected candidates, and candidate-without-caller-ownership cases.
+- Replaced fragile CAP DB query string extraction with AST traversal for chained `cds.run(SELECT/INSERT/UPDATE/DELETE...)` forms, including multiline `columns(...).where(...)` chains and `this.EntityName` targets.
+- Kept genuinely dynamic DB queries terminal while exposing parser-warning evidence and rendering unknown targets as `Entity: unknown` instead of raw numeric call ids in table/Mermaid output.
+- Further reduced symbol-call noise by filtering built-in collection/string methods, logger calls, global built-ins, third-party package property calls, and unindexed `this.container.method()` calls while retaining indexed local helpers and relative object-literal helper imports.
+- Added doctor aggregate visibility for local service calls resolved by implementation context and calls left unresolved because candidates lack caller ownership.
+- Updated README and technical notes to clarify generated constants remain low-level parser output rather than persisted graph facts.
+
 ## 0.1.12
 
 - Resolved same-repository local CAP service calls by qualified CDS name, simple service name, and service path, with explicit local transport and alias-chain evidence.

package/README.md

@@ -152,11 +152,11 @@ target handler up to `--depth` instead of showing only calls in the first file.
 
 `service-flow trace` starts from the selected handler method symbol, renders outbound calls owned by that symbol, and follows conservative local helper-call facts. Supported helper edges include same-file functions, `this.method()` calls, and exactly mapped relative imports/exports that resolve to an indexed executable symbol. Calls from unrelated functions in the same source file are not included merely because the file path matches.
 
-Local CAP calls through `cds.services.<Service>.<operation>()`, bracket service lookups, and simple aliases are indexed as local operation calls. Linking stays within the same repository by default and matches the target operation by exact qualified CDS service name, exact simple service name, exact service path, or an unambiguous service-path suffix. Entity accessors such as `cds.services.db.entities(...)` are treated as entity metadata access, not operation calls.
+Local CAP calls through `cds.services.<Service>.<operation>()`, bracket service lookups, and simple aliases are indexed as local operation calls. Linking first stays within the same repository and matches the target operation by exact qualified CDS service name, exact simple service name, exact service path, or an unambiguous service-path suffix. If no same-repository service exists, the linker can use implementation-context evidence to resolve model-package operations for helper packages: a resolved/ambiguous implementation candidate, registration package, or dependency/import edge must tie the caller repository to the model operation. Name-only global matches are preserved as unresolved candidate evidence rather than guessed links. Entity accessors such as `cds.services.db.entities(...)` are treated as entity metadata access, not operation calls.
 
 Conservative local symbol traversal intentionally excludes decorators, built-ins such as `JSON.parse`, collection methods, third-party APIs, and arbitrary property chains unless the callee can plausibly resolve to an indexed local symbol. Named export lists such as `export { loadTemplate as publicLoadTemplate }` are indexed with the public exported name so relative imports can resolve. One-level object-literal helpers are indexed as symbols named like `cacheHelper.getConfiguration`; nested object literals are not yet expanded beyond the first helper level. `parseGeneratedConstants` remains a public low-level parser export for callers that need it, but generated constants are not persisted as graph facts in this patch; linking uses the deterministic decorator normalizer described above.
 JSON output includes typed nodes for calls, operations, database entities,
-external destinations, and unresolved/dynamic candidates when edges exist.
+external destinations, and unresolved/dynamic candidates when edges exist. Chained CAP DB queries inside `cds.run(...)` are parsed with TypeScript AST evidence for `SELECT`, `INSERT`, `UPDATE`, and `DELETE` forms. When the query target is genuinely dynamic, graph status remains terminal and JSON retains `parserWarning` evidence, while table and Mermaid render the target as `Entity: unknown` rather than a numeric call id.
 
 ```bash
 service-flow trace --workspace /path/to/workspace --repo facade-service --operation doWork
@@ -287,7 +287,7 @@ service-flow clean --workspace /path/to/workspace
 | Local data access | `cds.run(SELECT...)` and local entity query evidence |
 | Async channels | Event Mesh-style `emit`, `publish`, and `on` facts |
 | External calls | Cloud SDK-style HTTP/destination calls and external edge evidence |
-| Generated constants | constants used to resolve service paths, operation paths, and thin helper wrappers |
+| Generated constants | low-level `parseGeneratedConstants` parser output for integrations; not persisted as first-class graph facts in this patch |
 
 ---
 

package/TECHNICAL-NOTE.md

@@ -1,4 +1,4 @@
-# Service Flow 0.1.8 Resolution Notes
+# Service Flow Resolution Notes
 
 - Imported helper bindings: TypeScript imports are resolved for relative modules. When a caller assigns `const client = await connectToService()`, the analyzer follows the imported symbol to an exported helper that returns `cds.connect.to(...)` and persists caller-variable evidence plus the helper source/export chain.
 - Candidate ranking: operation-path matches start as weak candidates. A resolved operation edge requires a strong signal such as exact service path, CDS alias/destination context, or explicit dynamic variable overrides. Otherwise candidates are preserved in edge evidence as ambiguous or unresolved.
@@ -6,6 +6,15 @@
 - Trace cycle safety: trace queues carry repository IDs, visited scope keys are independent of depth, graph edge IDs are emitted once, and revisiting an already-seen downstream operation scope creates a cycle marker instead of recursive expansion.
 - SQLite reliability: the package uses a persistent SQLite connection per opened database, bound parameters, transactions, WAL, busy timeouts, read-only openings for query commands, and connection-local foreign-key enforcement. Native driver loading failures produce an actionable startup error before output rendering.
 
+## 0.1.13 audit follow-up notes
+
+- Local CAP service calls keep same-repository service ownership as the strongest resolution path. When the caller repository does not own the CDS service model, the linker searches workspace operations by service identity and operation name/path, then requires caller ownership evidence from implementation edges, ambiguous implementation candidates, registration packages, or resolved dependency/import edges before resolving. Candidate operations without caller evidence are retained with `local_service_candidate_without_caller_ownership` rather than guessed.
+- Trace traversal can use local-call context to choose the caller repository's handler from an otherwise ambiguous global implementation edge. This is scoped to the local call and does not rewrite the global `OPERATION_IMPLEMENTED_BY_HANDLER` ambiguity.
+- CAP DB entity extraction for local `cds.run(...)` calls uses TypeScript AST traversal across chained query expressions, including `SELECT.one.from(Entity).columns(...).where(...)`, `INSERT.into(Entity)`, `UPDATE(Entity)`, and `DELETE.from(Entity)`. Dynamic or unknowable query targets remain terminal graph edges with parser-warning evidence.
+- Human output never labels an unknown DB query target with the raw call id. Table and Mermaid output use `Entity: unknown`; JSON keeps the parser warning and call id evidence for machines.
+- Symbol-call indexing is intentionally conservative for property accesses. Built-in collection/string calls, global built-ins, logger calls, third-party package properties, and unindexed `this.someContainer.method()` calls are filtered unless indexed local helper or relative import evidence makes the edge actionable.
+- Generated constants remain low-level parser output through `parseGeneratedConstants`. They are not persisted as graph facts; implementation linking only uses deterministic decorator normalization for common generated action/function names.
+
 ## 0.1.4 trace-correctness additions
 
 - Helper exports are normalized through a public-to-local export map, so `export { helper }` and `export { helper as publicHelper }` both resolve to the local declaration that contains the `cds.connect.to(...)` call.

package/dist/{chunk-MXYYARUP.js → chunk-Q7W7TE3W.js}

@@ -555,22 +555,39 @@ function matchingParen(text, open) {
   }
   return -1;
 }
-function argumentForCall(expr, marker) {
-  const idx = expr.indexOf(marker);
-  if (idx < 0) return void 0;
-  const open = expr.indexOf("(", idx + marker.length);
-  if (open < 0) return void 0;
-  const close = matchingParen(expr, open);
-  return close > open ? expr.slice(open + 1, close).trim() : void 0;
-}
-function entityFromArg(arg) {
-  if (!arg) return void 0;
-  const first = arg.split(",")[0]?.trim();
-  if (!first) return void 0;
-  return stripQuotes(first).replace(/^this\./, "");
+function entityFromExpression(expr) {
+  if (!expr) return void 0;
+  if (ts4.isIdentifier(expr) || ts4.isStringLiteral(expr) || ts4.isNoSubstitutionTemplateLiteral(expr)) return expr.text;
+  if (ts4.isPropertyAccessExpression(expr) && expr.expression.kind === ts4.SyntaxKind.ThisKeyword) return expr.name.text;
+  return void 0;
+}
+function expressionName(expr) {
+  if (ts4.isIdentifier(expr)) return expr.text;
+  if (ts4.isPropertyAccessExpression(expr)) return `${expressionName(expr.expression)}.${expr.name.text}`;
+  return expr.getText();
+}
+function queryEntityFromAst(expr) {
+  if (ts4.isParenthesizedExpression(expr) || ts4.isAwaitExpression(expr)) return queryEntityFromAst(expr.expression);
+  if (ts4.isCallExpression(expr)) {
+    const name = expressionName(expr.expression);
+    if (name === "cds.run") return queryEntityFromAst(expr.arguments[0]);
+    if (name === "SELECT.one.from" || name === "SELECT.from" || name === "INSERT.into" || name === "DELETE.from") return entityFromExpression(expr.arguments[0]);
+    if (name === "UPDATE") return entityFromExpression(expr.arguments[0]);
+    const receiver = ts4.isPropertyAccessExpression(expr.expression) ? expr.expression.expression : void 0;
+    if (receiver) return queryEntityFromAst(receiver);
+  }
+  return void 0;
 }
 function extractQueryEntity(expr) {
-  return entityFromArg(argumentForCall(expr, "SELECT.one.from")) ?? entityFromArg(argumentForCall(expr, "SELECT.from")) ?? entityFromArg(argumentForCall(expr, "INSERT.into")) ?? entityFromArg(argumentForCall(expr, "UPDATE")) ?? entityFromArg(argumentForCall(expr, "DELETE.from"));
+  const source = ts4.createSourceFile("query.ts", `const __query = (${expr});`, ts4.ScriptTarget.Latest, true, ts4.ScriptKind.TS);
+  let found;
+  const visit = (node) => {
+    if (found) return;
+    if (ts4.isParenthesizedExpression(node)) found = queryEntityFromAst(node.expression);
+    ts4.forEachChild(node, visit);
+  };
+  visit(source);
+  return found;
 }
 async function parseOutboundCalls(repoPath, filePath) {
   const text = await fs6.readFile(path7.join(repoPath, filePath), "utf8");
@@ -1074,7 +1091,7 @@ function substituteVariables(template, vars) {
 // src/linker/service-resolver.ts
 function rows(db, operationPath, workspaceId) {
   return db.prepare(
-    `SELECT o.id operationId,r.name repoName,s.service_name serviceName,s.qualified_name qualifiedName,s.service_path servicePath,o.operation_path operationPath,o.operation_name operationName,o.source_file sourceFile,o.source_line sourceLine,0 score,'' reasons
+    `SELECT o.id operationId,r.id repoId,r.name repoName,r.package_name packageName,s.service_name serviceName,s.qualified_name qualifiedName,s.service_path servicePath,o.operation_path operationPath,o.operation_name operationName,o.source_file sourceFile,o.source_line sourceLine,0 score,'' reasons
        FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id
        WHERE (? IS NULL OR r.workspace_id=?) AND (o.operation_path=? OR o.operation_name=?) ORDER BY r.name,s.service_path,o.operation_name`
   ).all(
@@ -1098,11 +1115,21 @@ function resolveOperation(db, signals, workspaceId) {
       candidates: [],
       reasons: ["missing_operation_path"]
     };
-  const candidates = rows(db, signals.operationPath, workspaceId).filter((c) => matchesLocalRepo(db, c.operationId, signals.repoId)).map((c) => ({
+  const allCandidates = rows(db, signals.operationPath, workspaceId).map((c) => ({
     ...c,
     score: 0.2,
     reasons: ["operation_path_match"]
   }));
+  let candidates = allCandidates.filter((c) => matchesLocalRepo(db, c.operationId, signals.repoId));
+  if (candidates.length === 0 && signals.repoId !== void 0 && signals.serviceName) {
+    candidates = implementationContextCandidates(db, allCandidates, signals.repoId, signals.serviceName);
+    if (candidates.length === 0)
+      return {
+        status: "unresolved",
+        candidates: allCandidates.filter((c) => serviceMatches(c, signals.serviceName)),
+        reasons: allCandidates.some((c) => serviceMatches(c, signals.serviceName)) ? ["local_service_candidate_without_caller_ownership"] : ["no_operation_candidates"]
+      };
+  }
   if (candidates.length === 0)
     return {
       status: "unresolved",
@@ -1173,6 +1200,34 @@ function resolveOperation(db, signals, workspaceId) {
     reasons: ["candidate_score_below_resolution_threshold"]
   };
 }
+function serviceMatches(candidate, serviceName) {
+  if (!serviceName) return false;
+  const simple = serviceName.split(".").at(-1) ?? serviceName;
+  return candidate.qualifiedName === serviceName || candidate.serviceName === serviceName || candidate.serviceName === simple || candidate.servicePath === serviceName || candidate.servicePath === `/${serviceName}` || candidate.servicePath === `/${simple}` || candidate.servicePath.endsWith(`/${simple}`);
+}
+function implementationContextCandidates(db, candidates, callerRepoId, serviceName) {
+  const matching = candidates.filter((candidate) => serviceMatches(candidate, serviceName));
+  const owned = matching.map((candidate) => ownershipReason(db, candidate, callerRepoId)).filter((item) => Boolean(item));
+  if (owned.length === 0) return [];
+  const direct = owned.filter((item) => item.reason !== "caller_depends_on_model_package");
+  const chosen = direct.length > 0 ? direct : owned.length === 1 ? owned : [];
+  return chosen.map((item) => ({ ...item.candidate, score: 0.95, reasons: [...item.candidate.reasons, "implementation_context_caller_ownership", item.reason] }));
+}
+function ownershipReason(db, candidate, callerRepoId) {
+  const edge = db.prepare("SELECT status,evidence_json,to_id FROM graph_edges WHERE edge_type='OPERATION_IMPLEMENTED_BY_HANDLER' AND from_kind='operation' AND from_id=? ORDER BY CASE status WHEN 'resolved' THEN 0 WHEN 'ambiguous' THEN 1 ELSE 2 END LIMIT 1").get(String(candidate.operationId));
+  if (edge?.status === "resolved") {
+    const row = db.prepare("SELECT hc.repo_id repoId FROM handler_methods hm JOIN handler_classes hc ON hc.id=hm.handler_class_id WHERE hm.id=?").get(edge.to_id);
+    if (row?.repoId === callerRepoId) return { candidate, reason: "resolved_implementation_handler_repo_matches_caller" };
+  }
+  if (edge?.evidence_json) {
+    const evidence = JSON.parse(edge.evidence_json);
+    const hit = evidence.candidates?.find((item) => item.accepted && (Number(item.handlerPackage?.id) === callerRepoId || Number(item.applicationPackage?.id) === callerRepoId));
+    if (hit) return { candidate, reason: edge.status === "ambiguous" ? "ambiguous_implementation_candidate_repo_matches_caller" : "registration_package_matches_caller" };
+  }
+  const dep = db.prepare("SELECT 1 FROM graph_edges WHERE edge_type='REPO_IMPORTS_HELPER_PACKAGE' AND status='resolved' AND from_kind='repo' AND from_id=? AND to_id=?").get(String(callerRepoId), String(candidate.repoId));
+  if (dep) return { candidate, reason: "caller_depends_on_model_package" };
+  return void 0;
+}
 function matchesLocalRepo(db, operationId, repoId) {
   if (repoId === void 0) return true;
   const row = db.prepare("SELECT s.repo_id repoId FROM cds_operations o JOIN cds_services s ON s.id=o.service_id WHERE o.id=?").get(operationId);
@@ -1227,8 +1282,8 @@ function linkWorkspace(db, workspaceId, vars = {}) {
     const generation = nextGraphGeneration(db, workspaceId);
     db.prepare("DELETE FROM graph_edges WHERE workspace_id=?").run(workspaceId);
     const deps = linkHelperPackages(db, workspaceId, generation);
-    const callSummary = linkCalls(db, workspaceId, vars, generation);
     const impl = linkImplementations(db, workspaceId, generation);
+    const callSummary = linkCalls(db, workspaceId, vars, generation);
     db.prepare("UPDATE repositories SET graph_generation=?, graph_stale_reason=NULL, graph_stale_at=NULL WHERE workspace_id=?").run(generation, workspaceId);
     return { ...callSummary, edgeCount: deps.edgeCount + callSummary.edgeCount + impl.edgeCount, dependencyResolvedCount: deps.resolvedCount, dependencyAmbiguousCount: deps.ambiguousCount, implementationResolvedCount: impl.resolvedCount, implementationAmbiguousCount: impl.ambiguousCount, implementationUnresolvedCount: impl.unresolvedCount };
   });
@@ -1633,6 +1688,17 @@ function implementationScope(db, operationId) {
   const row = db.prepare("SELECT hc.repo_id repoId,hc.source_file sourceFile,s.id symbolId FROM handler_methods hm JOIN handler_classes hc ON hc.id=hm.handler_class_id LEFT JOIN symbols s ON s.repo_id=hc.repo_id AND s.source_file=hc.source_file AND s.name=hm.method_name WHERE hm.id=?").get(edge.to_id);
   return { repoId: row?.repoId, files: new Set(row?.sourceFile ? [row.sourceFile] : []), symbolId: row?.symbolId, edge };
 }
+function contextImplementationMethodId(edge, callerRepoId) {
+  if (!edge || edge.status !== "ambiguous" || callerRepoId === void 0) return void 0;
+  const evidence = JSON.parse(String(edge.evidence_json || "{}"));
+  const candidate = evidence.candidates?.find((item) => item.accepted && (Number(item.handlerPackage?.id) === callerRepoId || Number(item.applicationPackage?.id) === callerRepoId));
+  return candidate?.methodId === void 0 ? void 0 : String(candidate.methodId);
+}
+function handlerScope(db, methodId) {
+  const row = db.prepare("SELECT hc.repo_id repoId,hc.source_file sourceFile,s.id symbolId FROM handler_methods hm JOIN handler_classes hc ON hc.id=hm.handler_class_id LEFT JOIN symbols s ON s.repo_id=hc.repo_id AND s.source_file=hc.source_file AND s.name=hm.method_name WHERE hm.id=?").get(methodId);
+  if (!row) return void 0;
+  return { repoId: row.repoId, files: new Set(row.sourceFile ? [row.sourceFile] : []), symbolId: row.symbolId };
+}
 function includeCall(type, options) {
   if (!options.includeDb && type === "local_db_query") return false;
   if (!options.includeExternal && type === "external_http") return false;
@@ -1716,6 +1782,7 @@ function edgeTarget(row, evidence) {
   const operationPath = typeof evidence.operationPath === "string" ? evidence.operationPath : void 0;
   const targetOperation = typeof evidence.targetOperation === "string" ? evidence.targetOperation : void 0;
   const targetRepo = typeof evidence.targetRepo === "string" ? evidence.targetRepo : "";
+  if (row.edge_type === "HANDLER_RUNS_DB_QUERY") return /^\d+$/.test(row.to_id) ? "Entity: unknown" : `Entity: ${row.to_id}`;
   return servicePath && operationPath ? `${servicePath}${operationPath}` : targetOperation ? `${targetRepo}:${targetOperation}` : row.to_id;
 }
 function trace(db, start, options) {
@@ -1827,9 +1894,11 @@ function trace(db, start, options) {
         });
         if (effectiveRow.to_kind === "operation") {
           const implementation = implementationScope(db, effectiveRow.to_id);
+          const contextMethodId = contextImplementationMethodId(implementation.edge, current.repoId);
+          const contextNode = contextMethodId ? handlerMethodNode(db, contextMethodId) : void 0;
           if (implementation.edge) {
             const implEvidence = JSON.parse(String(implementation.edge.evidence_json || "{}"));
-            const handlerNode = implementation.edge.status === "resolved" ? handlerMethodNode(db, implementation.edge.to_id) : void 0;
+            const handlerNode = implementation.edge.status === "resolved" ? handlerMethodNode(db, implementation.edge.to_id) : contextNode;
             const implTo = handlerNode?.label ? String(handlerNode.label) : `${implementation.edge.to_kind}:${implementation.edge.to_id}`;
             if (handlerNode) nodes.set(String(handlerNode.id), handlerNode);
             edges.push({
@@ -1843,10 +1912,11 @@ function trace(db, start, options) {
             });
           }
           if (current.depth >= maxDepth) continue;
-          const files = implementation.files.size > 0 ? implementation.files : handlerFilesForOperation(db, effectiveRow.to_id);
-          const symbolIds = implementation.symbolId ? /* @__PURE__ */ new Set([implementation.symbolId]) : void 0;
-          if (implementation.edge?.status === "resolved" && files.size > 0) {
-            const targetRepoId = implementation.repoId ?? db.prepare(
+          const contextScope = contextMethodId ? handlerScope(db, contextMethodId) : void 0;
+          const files = contextScope?.files ?? (implementation.files.size > 0 ? implementation.files : handlerFilesForOperation(db, effectiveRow.to_id));
+          const symbolIds = contextScope?.symbolId ? /* @__PURE__ */ new Set([contextScope.symbolId]) : implementation.symbolId ? /* @__PURE__ */ new Set([implementation.symbolId]) : void 0;
+          if ((implementation.edge?.status === "resolved" || contextScope) && files.size > 0) {
+            const targetRepoId = contextScope?.repoId ?? implementation.repoId ?? db.prepare(
               "SELECT s.repo_id repoId FROM cds_operations o JOIN cds_services s ON s.id=o.service_id WHERE o.id=?"
             ).get(effectiveRow.to_id)?.repoId;
             const nextKey = `${targetRepoId ?? "*"}:${[...symbolIds ?? /* @__PURE__ */ new Set(["*"])].sort().join(",")}:${[...files].sort().join(",")}`;
@@ -1893,4 +1963,4 @@ export {
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-MXYYARUP.js.map
+//# sourceMappingURL=chunk-Q7W7TE3W.js.map