@saptools/service-flow 0.1.19 → 0.1.20

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.20
+
+- Preserve service-binding evidence when helpers return connected clients inside object properties and callers destructure or create simple transaction aliases.
+- Track full template-expression placeholder keys such as `${domainInfo.serviceName}`, `${domainInfo.shortName?.toLowerCase()}`, and `${items[0].service}` for runtime `--var` substitution without evaluating JavaScript.
+- Render unresolved remote actions with unknown or dynamic paths as semantic targets instead of numeric call ids, with parser evidence for shorthand `path` identifiers.
+- Expand strict doctor aggregates for normalized OData invocation ambiguity and remote-action unresolved target quality.
+
 ## 0.1.19
 
 - Normalize balanced top-level OData action/function invocation paths before remote operation resolution, including namespace-qualified invocation lookup, while preserving raw and normalized evidence.

package/README.md

@@ -54,7 +54,7 @@ npm install @saptools/service-flow
 
 ### Correctness notes
 
-- Runtime `--var` values are considered only for dynamic, ambiguous, or unresolved **remote** graph edges whose alias, destination, service path, or operation path expressions contain supplied placeholders. Local database, external HTTP, event, and already resolved static edges keep their persisted status, target, reason, and confidence. Partial substitutions remain dynamic and report the missing placeholder names.
+- Runtime `--var` values are considered only for dynamic, ambiguous, or unresolved **remote** graph edges whose alias, destination, service path, or operation path expressions contain supplied placeholders. Placeholder keys are the full trimmed expression inside `${...}`, so keys such as `domainInfo.serviceName`, `domainInfo.shortName?.toLowerCase()`, and `items[0].service` can be supplied literally without JavaScript evaluation. Local database, external HTTP, event, and already resolved static edges keep their persisted status, target, reason, and confidence. Partial substitutions remain dynamic and report the missing placeholder names.
 - `trace` and `graph` both accept repeatable `--var key=value` options. Effective substitutions are rendered in trace evidence without mutating the persisted graph. Confidence values are bounded to `[0, 1]`.
 - Repository selectors on list, trace, graph, and inspect commands narrow scope. Unknown selectors return empty machine-readable diagnostics instead of falling back to the whole workspace.
 - Helper-package dependency edges prefer exact indexed package names. Duplicate package-name candidates are persisted as ambiguous evidence rather than silently selecting one repository.
@@ -310,7 +310,7 @@ service-flow trace --workspace /path/to/workspace --repo facade-service --operat
 
 When a concrete target exists after variable substitution, the trace shows both the parameterized evidence and the resolved match. When it does not, `service-flow` keeps the edge as a dynamic candidate or unresolved edge so the missing link remains visible.
 
-Service-binding evidence keeps these fields distinct: service alias, alias expression, destination expression, service-path expression, operation-path expression, and runtime placeholders. This is important for common CAP helpers such as `cds.connect.to(`remote_${code}`, { credentials: { destination: `remote_${code}`, path: `/${entityType}ProcessService` } })`, where the alias is not the service path.
+Service-binding evidence keeps these fields distinct: service alias, alias expression, destination expression, service-path expression, operation-path expression, and runtime placeholders. Helpers that return concrete connected clients inside object properties are followed through destructuring and simple transaction aliases while preserving helper-chain evidence. This is important for common CAP helpers such as `cds.connect.to(`remote_${code}`, { credentials: { destination: `remote_${code}`, path: `/${entityType}ProcessService` } })`, where the alias is not the service path.
 
 By default, production traces should be built from production source files. Keep generated credentials and local state out of git, and use explicit fixture/test workspaces when validating test-only mocked service clients so they do not pollute production graph interpretation.
 
@@ -411,7 +411,7 @@ Run `service-flow index` after source, CDS, package metadata, or helper-package
 <summary><b>Why is an expected call unresolved?</b></summary>
 
 Check `service-flow doctor`, then inspect the facts with `service-flow list services`, `service-flow list operations`, and `service-flow list calls`. Dynamic destinations may need `--var key=value`, and custom wrappers may need new parser support.
-Default doctor output is intended to focus on actionable indexing or trace-impacting issues; use `--strict` when you need exhaustive model-shape diagnostics for entity-only or extension-heavy CDS models.
+Default doctor output is intended to focus on actionable indexing or trace-impacting issues; use `--strict` when you need exhaustive model-shape diagnostics for entity-only or extension-heavy CDS models. Strict mode also reports normalized OData invocation ambiguity and remote-action target quality, including whether unresolved unknown/dynamic paths are semantic instead of numeric call ids.
 
 </details>
 

package/TECHNICAL-NOTE.md

@@ -1,5 +1,12 @@
 # Service Flow Resolution Notes
 
+## 0.1.20 helper object clients, expression placeholders, and remote-action target notes
+
+- Helper-return binding analysis now follows concrete `cds.connect.to(...)` clients returned through object shorthand or explicit properties. Callers that destructure those properties, rename them, or assign a simple `.tx()` transaction alias keep helper-chain evidence including caller variable, returned property, helper source, destination expression, service-path expression, and placeholders. Arbitrary object returns are ignored.
+- Template placeholders use the full trimmed expression inside `${...}` as the runtime key. Examples include `domain`, `domainInfo.serviceName`, `domainInfo.shortName?.toLowerCase()`, and `items[0].service`. Runtime `--var` substitution matches these keys literally and does not execute or partially evaluate JavaScript. Missing expression keys keep edges dynamic.
+- Remote action calls that do not expose a static path now use semantic unresolved targets such as `Remote action: unknown path` or `Remote action: dynamic path`; shorthand `path` properties retain `operationPathExpression` and `dynamic_operation_path_identifier` parser evidence.
+- Strict doctor reports normalized OData invocation totals by resolved/dynamic/ambiguous/unresolved status and remote-action target quality, including numeric unresolved targets and semantic unknown/dynamic target counts.
+
 ## 0.1.19 remote invocation and query notes
 
 - Remote action/function paths are scanned for a balanced top-level OData invocation suffix. Single-segment operation imports like `/readConfig(...)` normalize to `/readConfig`; namespace-qualified operation imports keep the qualified request segment for evidence and can resolve against the indexed simple CDS operation when service signals are strong. Navigation/property paths like `/Orders(id='123')/items` are left unchanged. Graph evidence keeps both `rawOperationPath` and `normalizedOperationPath` when normalization occurs.

package/dist/{chunk-YG66SHAR.js → chunk-EKLZJJW7.js}

@@ -590,8 +590,14 @@ function literalText(expr) {
   return void 0;
 }
 function objectPropertyText(object, key) {
-  const prop = object.properties.find((property) => ts4.isPropertyAssignment(property) && nameOfProperty(property.name) === key);
-  return prop ? prop.initializer.getText() : void 0;
+  const prop = object.properties.find(
+    (property) => ts4.isPropertyAssignment(property) && nameOfProperty(property.name) === key || ts4.isShorthandPropertyAssignment(property) && property.name.text === key
+  );
+  if (!prop) return void 0;
+  return ts4.isShorthandPropertyAssignment(prop) ? prop.name.text : prop.initializer.getText();
+}
+function objectPropertyIsShorthand(object, key) {
+  return object.properties.some((property) => ts4.isShorthandPropertyAssignment(property) && property.name.text === key);
 }
 function nameOfProperty(name) {
   if (ts4.isIdentifier(name) || ts4.isStringLiteral(name) || ts4.isNumericLiteral(name)) return name.text;
@@ -655,7 +661,8 @@ function classifyOutboundCallsInSource(source, filePath) {
           const receiver = expr.expression.text;
           const query = objectPropertyText(objectArg, "query");
           const op = objectPropertyText(objectArg, "path") ?? objectPropertyText(objectArg, "event");
-          add(node, { callType: query ? "remote_query" : "remote_action", serviceVariableName: receiver, method: stripQuotes(objectPropertyText(objectArg, "method") ?? "POST"), operationPathExpr: op ? `/${stripQuotes(op).replace(/^\//, "")}` : void 0, queryEntity: query ? extractQueryEntity(query) : void 0, payloadSummary: summarizeExpression(objectArg.getText(source)), confidence: op || query ? 0.8 : 0.4 }, { receiver, classifier: "service_client_send_object" });
+          const shorthandPath = objectPropertyIsShorthand(objectArg, "path");
+          add(node, { callType: query ? "remote_query" : "remote_action", serviceVariableName: receiver, method: stripQuotes(objectPropertyText(objectArg, "method") ?? "POST"), operationPathExpr: op && !shorthandPath ? `/${stripQuotes(op).replace(/^\//, "")}` : void 0, queryEntity: query ? extractQueryEntity(query) : void 0, payloadSummary: summarizeExpression(objectArg.getText(source)), confidence: op || query ? 0.8 : 0.4, unresolvedReason: !query && shorthandPath ? "dynamic_operation_path_identifier" : void 0 }, { receiver, classifier: "service_client_send_object", operationPathExpression: shorthandPath ? op : void 0, parserWarning: shorthandPath ? "dynamic_operation_path_identifier" : void 0 });
         }
       } else if (ts4.isPropertyAccessExpression(expr) && ["emit", "publish", "on"].includes(expr.name.text)) {
         const receiver = receiverName(expr.expression);
@@ -750,7 +757,7 @@ function stringValue(node) {
   return node.getText();
 }
 function placeholders(value) {
-  return [...(value ?? "").matchAll(/\$\{\s*(\w+)\s*\}/g)].map((m) => m[1] ?? "").filter(Boolean);
+  return [...(value ?? "").matchAll(/\$\{([^}]*)\}/g)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
 }
 function connectFactFromCall(call) {
   const expr = call.expression;
@@ -889,6 +896,33 @@ async function importsFor(repoPath, filePath, sf) {
   }
   return imports;
 }
+function collectReturnedObjectBindings(fn) {
+  const bindings = /* @__PURE__ */ new Map();
+  const returns = /* @__PURE__ */ new Map();
+  function visit(node) {
+    if (ts5.isVariableDeclaration(node) && ts5.isIdentifier(node.name) && node.initializer) {
+      const fact = findConnectInExpression(node.initializer);
+      if (fact) bindings.set(node.name.text, fact);
+    }
+    if (ts5.isReturnStatement(node) && node.expression && ts5.isObjectLiteralExpression(node.expression)) {
+      for (const prop of node.expression.properties) {
+        if (ts5.isShorthandPropertyAssignment(prop)) returns.set(prop.name.text, prop.name.text);
+        if (ts5.isPropertyAssignment(prop) && ts5.isIdentifier(prop.initializer)) {
+          const propertyName = ts5.isIdentifier(prop.name) || ts5.isStringLiteralLike(prop.name) ? prop.name.text : void 0;
+          if (propertyName) returns.set(propertyName, prop.initializer.text);
+        }
+      }
+    }
+    ts5.forEachChild(node, visit);
+  }
+  visit(fn);
+  const out = /* @__PURE__ */ new Map();
+  for (const [propertyName, variableName] of returns) {
+    const fact = bindings.get(variableName);
+    if (fact) out.set(propertyName, fact);
+  }
+  return out;
+}
 function exportedLocalNames(sf) {
   const exports = /* @__PURE__ */ new Map();
   for (const stmt of sf.statements) {
@@ -924,6 +958,8 @@ async function helperBindings(repoPath, filePath) {
         if (!fact) ts5.forEachChild(node, visit);
       });
       if (fact) factsByLocal.set(stmt.name.text, { ...fact, sourceLine: lineOf4(sf, stmt) });
+      for (const [returnedProperty, objectFact] of collectReturnedObjectBindings(stmt))
+        factsByLocal.set(`${stmt.name.text}#${returnedProperty}`, { ...objectFact, returnedProperty, sourceLine: lineOf4(sf, stmt) });
     }
     if (ts5.isVariableStatement(stmt))
       for (const decl of stmt.declarationList.declarations) {
@@ -946,6 +982,14 @@ async function helperBindings(repoPath, filePath) {
         sourceLine: fact.sourceLine
       });
   }
+  for (const [key, fact] of factsByLocal) {
+    const [localName, returnedProperty] = key.split("#");
+    if (!returnedProperty) continue;
+    for (const [exportedName, exportedLocal] of exportedLocals) {
+      if (exportedLocal !== localName) continue;
+      out.push({ ...fact, exportedName, returnedProperty, sourceFile: normalizePath(filePath), sourceLine: fact.sourceLine });
+    }
+  }
   return out;
 }
 async function parseServiceBindings(repoPath, filePath) {
@@ -956,6 +1000,14 @@ async function parseServiceBindings(repoPath, filePath) {
   const imports = await importsFor(repoPath, filePath, sf);
   const helperCache = /* @__PURE__ */ new Map();
   const classHelpers = collectClassHelpers(sourceFileAst);
+  const localObjectHelpers = /* @__PURE__ */ new Map();
+  for (const stmt of sourceFileAst.statements) {
+    if (!ts5.isFunctionDeclaration(stmt) || !stmt.name) continue;
+    const rows2 = [];
+    for (const [returnedProperty, fact] of collectReturnedObjectBindings(stmt))
+      rows2.push({ ...fact, exportedName: stmt.name.text, returnedProperty, sourceFile: normalizePath(filePath), sourceLine: lineOf4(sourceFileAst, stmt) });
+    if (rows2.length > 0) localObjectHelpers.set(stmt.name.text, rows2);
+  }
   async function importedHelper(localName) {
     const imp = imports.find((i) => i.localName === localName && i.sourceFile);
     if (!imp?.sourceFile) return void 0;
@@ -1005,6 +1057,37 @@ async function parseServiceBindings(repoPath, filePath) {
         });
     }
   }
+  async function helperForCall(call) {
+    if (!ts5.isIdentifier(call.expression)) return void 0;
+    const local = localObjectHelpers.get(call.expression.text)?.[0];
+    if (local) return { helper: local };
+    const resolved = await importedHelper(call.expression.text);
+    return resolved ? { helper: resolved.helper, imp: resolved.imp } : void 0;
+  }
+  async function recordDestructuredHelper(decl) {
+    if (!ts5.isObjectBindingPattern(decl.name) || !decl.initializer) return;
+    const call = unwrapCall(decl.initializer);
+    if (!call) return;
+    const resolved = await helperForCall(call);
+    if (!resolved) return;
+    for (const el of decl.name.elements) {
+      if (!ts5.isIdentifier(el.name)) continue;
+      const propertyName = el.propertyName && ts5.isIdentifier(el.propertyName) ? el.propertyName.text : el.name.text;
+      if (resolved.helper.returnedProperty !== propertyName) continue;
+      out.push({
+        variableName: el.name.text,
+        alias: resolved.helper.alias,
+        aliasExpr: resolved.helper.aliasExpr,
+        destinationExpr: resolved.helper.destinationExpr,
+        servicePathExpr: resolved.helper.servicePathExpr,
+        isDynamic: resolved.helper.isDynamic,
+        placeholders: resolved.helper.placeholders,
+        sourceFile: normalizePath(filePath),
+        sourceLine: lineOf4(sourceFileAst, decl),
+        helperChain: [{ callerVariable: el.name.text, helperFunction: call.expression.getText(sourceFileAst), returnedProperty: propertyName, importSource: resolved.imp?.sourceFile, helperSourceFile: resolved.helper.sourceFile, helperSourceLine: resolved.helper.sourceLine }]
+      });
+    }
+  }
   function recordDestructuredClassHelper(decl) {
     if (!ts5.isObjectBindingPattern(decl.name) || !decl.initializer) return;
     const call = unwrapCall(decl.initializer);
@@ -1044,8 +1127,14 @@ async function parseServiceBindings(repoPath, filePath) {
   }
   collectDeclarations(sourceFileAst);
   for (const decl of declarations) {
+    await recordDestructuredHelper(decl);
     recordDestructuredClassHelper(decl);
     await recordVariable(decl);
+    if (ts5.isIdentifier(decl.name) && decl.initializer && ts5.isCallExpression(decl.initializer) && ts5.isPropertyAccessExpression(decl.initializer.expression) && decl.initializer.expression.name.text === "tx" && ts5.isIdentifier(decl.initializer.expression.expression)) {
+      const sourceName = decl.initializer.expression.expression.text;
+      const existing = out.find((row) => row.variableName === sourceName && row.sourceFile === normalizePath(filePath));
+      if (existing) out.push({ ...existing, variableName: decl.name.text, sourceLine: lineOf4(sourceFileAst, decl), helperChain: [...existing.helperChain ?? [], { callerVariable: decl.name.text, aliasOf: sourceName, aliasKind: "transaction" }] });
+    }
   }
   return out;
 }
@@ -1106,22 +1195,22 @@ function collectClassHelpers(sf) {
 }
 
 // src/linker/dynamic-edge-resolver.ts
-var PLACEHOLDER = /\$\{\s*(\w+)\s*\}/g;
+var PLACEHOLDER = /\$\{([^}]*)\}/g;
 function applyVariables(template, vars) {
   return substituteVariables(template, vars).effective;
 }
 function extractPlaceholders(template) {
-  return [...(template ?? "").matchAll(PLACEHOLDER)].map((m) => m[1] ?? "").filter(Boolean);
+  return [...(template ?? "").matchAll(PLACEHOLDER)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
 }
 function substituteVariables(template, vars) {
   if (!template) return { placeholders: [], missing: [], supplied: [], changed: false };
   const placeholders2 = [...new Set(extractPlaceholders(template))];
   const supplied = placeholders2.filter((key) => Object.hasOwn(vars, key));
   const missing = placeholders2.filter((key) => !Object.hasOwn(vars, key));
-  const effective = template.replace(
-    PLACEHOLDER,
-    (_m, key) => Object.hasOwn(vars, key) ? vars[key] ?? "" : `\${${key}}`
-  );
+  const effective = template.replace(PLACEHOLDER, (_m, key) => {
+    const trimmed = key.trim();
+    return Object.hasOwn(vars, trimmed) ? vars[trimmed] ?? "" : `\${${trimmed}}`;
+  });
   return {
     original: template,
     effective,
@@ -1230,7 +1319,7 @@ function operationMatches(candidate, operationPath) {
   return candidate.operationPath === names.path || candidate.operationPath === names.simplePath || candidate.operationName === names.name || candidate.operationName === names.simpleName;
 }
 function resolveOperation(db, signals, workspaceId) {
-  const missing = [signals.servicePath, signals.alias, signals.destination, signals.operationPath].flatMap((value) => [...(value ?? "").matchAll(/\$\{\s*(\w+)\s*\}/g)].map((match) => match[1] ?? "")).filter(Boolean);
+  const missing = [signals.servicePath, signals.alias, signals.destination, signals.operationPath].flatMap((value) => [...(value ?? "").matchAll(/\$\{([^}]*)\}/g)].map((match) => (match[1] ?? "").trim())).filter(Boolean);
   if (missing.length > 0)
     return {
       status: "dynamic",
@@ -1475,7 +1564,7 @@ function insertCallEdge(db, workspaceId, call, vars, generation) {
   const status = edgeType === "DYNAMIC_EDGE_CANDIDATE" ? "dynamic" : resolution.status === "ambiguous" ? "ambiguous" : edgeType === "UNRESOLVED_EDGE" ? "unresolved" : "terminal";
   const unresolvedReason = status === "terminal" ? null : String(call.unresolved_reason ?? (resolution.status === "ambiguous" ? "Ambiguous operation candidates require a strong service signal" : resolution.status === "dynamic" ? `Dynamic target requires runtime variable overrides: ${(resolution.reasons.length ? resolution.reasons : ["missing runtime variables"]).join(", ")}` : "No indexed target operation matched"));
   const targetKind = callType === "local_db_query" ? "db_entity" : callType.startsWith("async_") ? "event" : "external";
-  const targetId = callType === "local_db_query" ? String(call.query_entity ?? "unknown") : String(call.event_name_expr ?? op ?? call.id);
+  const targetId = callType === "local_db_query" ? String(call.query_entity ?? "unknown") : callType === "remote_action" ? op ? `Remote action: ${op}` : call.unresolved_reason === "dynamic_operation_path_identifier" ? "Remote action: dynamic path" : "Remote action: unknown path" : String(call.event_name_expr ?? op ?? call.id);
   const graphLevelDynamic = edgeType === "DYNAMIC_EDGE_CANDIDATE" && resolution.status === "dynamic";
   db.prepare("INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,unresolved_reason,generation) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)").run(workspaceId, edgeType, status, "call", String(call.id), targetKind, targetId, Number(call.confidence ?? 0.2), JSON.stringify(evidence), graphLevelDynamic ? 1 : 0, unresolvedReason, generation);
   return { status, callType };
@@ -2132,4 +2221,4 @@ export {
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-YG66SHAR.js.map
+//# sourceMappingURL=chunk-EKLZJJW7.js.map