@saptools/service-flow 0.1.16 → 0.1.17

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.17
+
+- Replaced remaining raw-text outbound call detection with TypeScript AST classification so comments and strings do not create outbound facts or graph edges.
+- Added AST parser/range evidence for outbound calls and conservative CAP/service event registration ownership.
+- Tightened synthetic callback and async subscription classification to avoid generic response `.send()` and non-CAP event listener noise.
+- Expanded strict doctor ownerless source categories and examples.
+
 ## 0.1.16
 
 - Index class property arrow/function members as executable symbols so outbound calls inside handler helper properties receive precise source-symbol ownership.

package/README.md

@@ -18,9 +18,9 @@ Index independent Git repositories, persist CAP/CDS facts in SQLite, resolve cro
 
 ---
 
-## 0.1.16 quality update
+## 0.1.17 quality update
 
-`service-flow` 0.1.16 tightens source ownership and proxy evidence after the 0.1.15 audit. It indexes class property arrow/function members, creates conservative synthetic callback symbols only for top-level framework callbacks containing supported outbound calls, prefers explicit outbound source-symbol names when provided, hardens proxy-member resolution away from ambiguous global name-only matches, and splits link output into remote/local/unresolved/ambiguous/dynamic/terminal operation-call buckets.
+`service-flow` 0.1.17 hardens outbound extraction after the 0.1.16 audit. Outbound calls are classified from the TypeScript AST, so comments and strings are ignored; CAP/service lifecycle registrations that remain indexed receive synthetic event-registration owners; generic event emitters and response `.send()` calls are not treated as CAP service-flow edges; and `doctor --strict` reports actionable ownerless categories. The previous 0.1.16 source ownership and proxy-evidence improvements remain in place. It indexes class property arrow/function members, creates conservative synthetic callback symbols only for top-level framework callbacks containing supported outbound calls, prefers explicit outbound source-symbol names when provided, hardens proxy-member resolution away from ambiguous global name-only matches, and splits link output into remote/local/unresolved/ambiguous/dynamic/terminal operation-call buckets.
 
 ## ✨ Features
 
@@ -473,3 +473,8 @@ Handler registrations persist parsed class names and import sources. Linking res
 ### Graph variables
 
 The `graph` command accepts repeatable `--var key=value` options, matching `trace`, for runtime substitution previews in JSON or Mermaid output.
+
+
+### 0.1.17 parser ownership policy
+
+Outbound call extraction is AST-based and ignores comments, block comments, and string literals. CAP/service `.on(...)` registrations are indexed only when the receiver has CAP/service evidence, and top-level registrations receive `module:<relative-file>#event:<event-name>:<line>` synthetic owners. Generic event emitters such as desktop or window events are ignored by default rather than guessed as CAP async edges. Unsupported source shapes are surfaced through diagnostics and strict doctor ownerless categories instead of guessed graph edges.

package/TECHNICAL-NOTE.md

@@ -68,3 +68,8 @@
 - Fingerprints hash normalized package facts and package bytes in addition to source file paths/content and analyzer version.
 - The CLI version imports package metadata, so package metadata, `service-flow --version`, changelog, and analyzer/fingerprint version share one release source.
 - Supported runtime is Node.js 24+ with `node:sqlite` validation; older runtimes should fail with a compatibility message instead of a late `DatabaseSync` error.
+
+
+### 0.1.17 parser ownership policy
+
+Outbound call extraction is AST-based and ignores comments, block comments, and string literals. CAP/service `.on(...)` registrations are indexed only when the receiver has CAP/service evidence, and top-level registrations receive `module:<relative-file>#event:<event-name>:<line>` synthetic owners. Generic event emitters such as desktop or window events are ignored by default rather than guessed as CAP async edges. Unsupported source shapes are surfaced through diagnostics and strict doctor ownerless categories instead of guessed graph edges.

package/dist/{chunk-SSSBQIMK.js → chunk-HBR27SPD.js}

@@ -528,33 +528,6 @@ import ts4 from "typescript";
 function lineOf3(text, idx) {
   return text.slice(0, idx).split("\n").length;
 }
-function firstArg2(body, key) {
-  return new RegExp(`${key}\\s*:\\s*([^,}\\n]+)`).exec(body)?.[1]?.trim();
-}
-function matchingParen(text, open) {
-  let depth = 0;
-  let quote;
-  let escaped = false;
-  for (let i = open; i < text.length; i += 1) {
-    const ch = text[i] ?? "";
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === quote) quote = void 0;
-      continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") {
-      quote = ch;
-      continue;
-    }
-    if (ch === "(") depth += 1;
-    if (ch === ")") {
-      depth -= 1;
-      if (depth === 0) return i;
-    }
-  }
-  return -1;
-}
 function entityFromExpression(expr) {
   if (!expr) return void 0;
   if (ts4.isIdentifier(expr) || ts4.isStringLiteral(expr) || ts4.isNoSubstitutionTemplateLiteral(expr)) return expr.text;
@@ -606,64 +579,98 @@ function queryWarning(expr) {
   if (/^\s*\w+\s*$/.test(expr)) return "query_variable_without_static_initializer";
   return "dynamic_entity_expression";
 }
+function parserEvidence(source, node, extra) {
+  return { parser: "typescript_ast", startOffset: node.getStart(source), endOffset: node.getEnd(), ...extra };
+}
+function isStringLike(expr) {
+  return Boolean(expr && (ts4.isStringLiteral(expr) || ts4.isNoSubstitutionTemplateLiteral(expr)));
+}
+function literalText(expr) {
+  if (isStringLike(expr)) return expr.text;
+  return void 0;
+}
+function objectPropertyText(object, key) {
+  const prop = object.properties.find((property) => ts4.isPropertyAssignment(property) && nameOfProperty(property.name) === key);
+  return prop ? prop.initializer.getText() : void 0;
+}
+function nameOfProperty(name) {
+  if (ts4.isIdentifier(name) || ts4.isStringLiteral(name) || ts4.isNumericLiteral(name)) return name.text;
+  return void 0;
+}
+function collectServiceVariables(source) {
+  const vars = /* @__PURE__ */ new Set(["cds", "messaging", "messageClient", "eventClient"]);
+  const visit = (node) => {
+    if (ts4.isVariableDeclaration(node) && ts4.isIdentifier(node.name) && node.initializer) {
+      const text = node.initializer.getText(source);
+      if (/cds\.connect\.(to|messaging)\s*\(/.test(text) || /create.*(Client|Remote|Service|Messaging)/.test(text)) vars.add(node.name.text);
+    }
+    ts4.forEachChild(node, visit);
+  };
+  visit(source);
+  return vars;
+}
+function receiverName(expr) {
+  if (ts4.isIdentifier(expr)) return expr.text;
+  if (ts4.isPropertyAccessExpression(expr)) return expr.getText();
+  return void 0;
+}
+function isSupportedEventReceiver(receiver, serviceVariables) {
+  if (!receiver) return false;
+  if (receiver === "cds") return true;
+  if (serviceVariables.has(receiver)) return true;
+  if (/^(srv|service|serviceClient|messaging|messageClient|eventClient|.*Client)$/.test(receiver)) return true;
+  return false;
+}
+function classifyOutboundCallsInSource(source, filePath) {
+  const calls = [];
+  const sourceFile = normalizePath(filePath);
+  const initializers = variableInitializers(source);
+  const serviceVariables = collectServiceVariables(source);
+  const add = (node, fact, extra) => {
+    calls.push({ node, fact: { ...fact, sourceFile, sourceLine: lineOf3(source.text, node.getStart(source)), confidence: fact.confidence ?? 0.8, evidence: parserEvidence(source, node, extra) } });
+  };
+  const visit = (node) => {
+    if (ts4.isCallExpression(node)) {
+      const expr = node.expression;
+      const exprText = expr.getText(source);
+      if (exprText === "cds.run") {
+        const arg = node.arguments[0];
+        const entity = arg ? queryEntityFromAst(arg, initializers) : void 0;
+        const payload = arg?.getText(source) ?? "";
+        add(node, { callType: "local_db_query", queryEntity: entity, payloadSummary: summarizeExpression(payload), confidence: entity ? 0.9 : 0.55, unresolvedReason: entity ? void 0 : queryWarning(payload) });
+      } else if (ts4.isPropertyAccessExpression(expr) && expr.name.text === "send" && ts4.isIdentifier(expr.expression)) {
+        const objectArg = node.arguments[0];
+        if (objectArg && ts4.isObjectLiteralExpression(objectArg)) {
+          const receiver = expr.expression.text;
+          const query = objectPropertyText(objectArg, "query");
+          const op = objectPropertyText(objectArg, "path") ?? objectPropertyText(objectArg, "event");
+          add(node, { callType: query ? "remote_query" : "remote_action", serviceVariableName: receiver, method: stripQuotes(objectPropertyText(objectArg, "method") ?? "POST"), operationPathExpr: op ? `/${stripQuotes(op).replace(/^\//, "")}` : void 0, queryEntity: query ? extractQueryEntity(query) : void 0, payloadSummary: summarizeExpression(objectArg.getText(source)), confidence: op || query ? 0.8 : 0.4 }, { receiver, classifier: "service_client_send_object" });
+        }
+      } else if (ts4.isPropertyAccessExpression(expr) && ["emit", "publish", "on"].includes(expr.name.text)) {
+        const receiver = receiverName(expr.expression);
+        if (expr.name.text !== "on" || isSupportedEventReceiver(receiver, serviceVariables)) {
+          const eventName = literalText(node.arguments[0]);
+          if (eventName) add(node, { callType: expr.name.text === "on" ? "async_subscribe" : "async_emit", serviceVariableName: receiver, eventNameExpr: eventName }, { receiver, classifier: expr.name.text === "on" ? "cap_service_event_subscription" : "cap_service_event_emit" });
+        }
+      } else if (exprText === "axios" || exprText === "executeHttpRequest" || exprText === "useOrFetchDestination") {
+        add(node, { callType: "external_http", payloadSummary: summarizeExpression(node.arguments.map((arg) => arg.getText(source)).join(", ")), confidence: 0.7, unresolvedReason: "External HTTP destination is outside indexed CAP services" });
+      }
+    }
+    ts4.forEachChild(node, visit);
+  };
+  visit(source);
+  return calls;
+}
+function containsSupportedOutboundCall(node) {
+  const source = node.getSourceFile();
+  const start = node.getFullStart();
+  const end = node.getEnd();
+  return classifyOutboundCallsInSource(source, source.fileName).some((call) => call.node.getStart(source) >= start && call.node.getEnd() <= end);
+}
 async function parseOutboundCalls(repoPath, filePath) {
   const text = await fs6.readFile(path7.join(repoPath, filePath), "utf8");
-  const out = [];
-  for (const m of text.matchAll(/(\w+)\.send\s*\(\s*\{([\s\S]*?)\}\s*\)/g)) {
-    const body = m[2] ?? "";
-    const query = firstArg2(body, "query");
-    const op = firstArg2(body, "path") ?? firstArg2(body, "event");
-    out.push({
-      callType: query ? "remote_query" : "remote_action",
-      serviceVariableName: m[1],
-      method: stripQuotes(firstArg2(body, "method") ?? "POST"),
-      operationPathExpr: op ? `/${stripQuotes(op).replace(/^\//, "")}` : void 0,
-      queryEntity: extractQueryEntity(query ?? ""),
-      payloadSummary: summarizeExpression(body),
-      sourceFile: normalizePath(filePath),
-      sourceLine: lineOf3(text, m.index ?? 0),
-      confidence: op || query ? 0.8 : 0.4
-    });
-  }
-  for (const m of text.matchAll(/cds\.run\s*\(/g)) {
-    const open = (m.index ?? 0) + m[0].lastIndexOf("(");
-    const close = matchingParen(text, open);
-    const expr = close > open ? text.slice(open + 1, close) : "";
-    const entity = extractQueryEntity(expr);
-    out.push({
-      callType: "local_db_query",
-      queryEntity: entity,
-      payloadSummary: summarizeExpression(expr),
-      sourceFile: normalizePath(filePath),
-      sourceLine: lineOf3(text, m.index ?? 0),
-      confidence: entity ? 0.9 : 0.55,
-      unresolvedReason: entity ? void 0 : queryWarning(expr)
-    });
-  }
-  for (const m of text.matchAll(
-    /(\w+)\.(emit|publish|on)\s*\(\s*(['"`])([^'"`]+)\3/g
-  ))
-    out.push({
-      callType: m[2] === "on" ? "async_subscribe" : "async_emit",
-      serviceVariableName: m[1],
-      eventNameExpr: m[4],
-      sourceFile: normalizePath(filePath),
-      sourceLine: lineOf3(text, m.index ?? 0),
-      confidence: 0.8
-    });
-  for (const m of text.matchAll(
-    /(?:axios\s*\(|executeHttpRequest\s*\(|useOrFetchDestination\s*\()([\s\S]*?)\)/g
-  ))
-    out.push({
-      callType: "external_http",
-      payloadSummary: summarizeExpression(m[1] ?? ""),
-      sourceFile: normalizePath(filePath),
-      sourceLine: lineOf3(text, m.index ?? 0),
-      confidence: 0.7,
-      unresolvedReason: "External HTTP destination is outside indexed CAP services"
-    });
-  out.push(...parseLocalServiceCalls(text, filePath));
-  return out;
+  const source = ts4.createSourceFile(filePath, text, ts4.ScriptTarget.Latest, true, filePath.endsWith(".ts") ? ts4.ScriptKind.TS : ts4.ScriptKind.JS);
+  return [...classifyOutboundCallsInSource(source, filePath).map((call) => call.fact), ...parseLocalServiceCalls(text, filePath)];
 }
 function parseLocalServiceCalls(text, filePath) {
   const source = ts4.createSourceFile(filePath, text, ts4.ScriptTarget.Latest, true, filePath.endsWith(".ts") ? ts4.ScriptKind.TS : ts4.ScriptKind.JS);
@@ -1987,6 +1994,7 @@ export {
   parseHandlerRegistrations,
   redactText,
   redactValue,
+  containsSupportedOutboundCall,
   parseOutboundCalls,
   parseServiceBindings,
   applyVariables,
@@ -1995,4 +2003,4 @@ export {
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-SSSBQIMK.js.map
+//# sourceMappingURL=chunk-HBR27SPD.js.map