@saptools/service-flow 0.1.39 → 0.1.40

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.40
+
+- Hardened operation path expression analysis to respect lexical scope, declaration order, aliases, and bounded branch candidates.
+- Kept external URL and destination templates with substitutions dynamic with sanitized labels.
+- Fixed CDS path annotation parsing for prefix/suffix annotations and supported service extension syntax.
+
 ## 0.1.35
 
 - Hardened OData path precedence so entity key, navigation, and media/property paths with placeholders remain terminal entity evidence instead of dynamic operation candidates.
@@ -261,3 +267,4 @@
 ## 0.1.0
 
 - Initial `@saptools/service-flow` CLI package for indexing and tracing SAP CAP service flows.
+

package/README.md

@@ -505,3 +505,7 @@ Decorator signals are interpreted as resolved, absent, unsupported, or malformed
 External HTTP facts persist queryable target kind, stable id, safe label, and dynamic flag on `outbound_calls`; graph evidence uses the same sanitized model. URL user info, fragments, query values, headers, cookies, credentials, tokens, API keys, and request/response bodies are not persisted. Legacy workspaces may relink from old evidence when possible, but full semantic enrichment requires re-index plus relink when old parser facts did not contain safe target metadata.
 
 Graph taxonomy now keeps CAP operation candidates separate from external HTTP targets. Dynamic, ambiguous, and unresolved CAP calls use operation-candidate semantics, external destinations/endpoints are produced only by `external_http` calls, and terminal local transport-client methods use transport-method semantics rather than external HTTP edges. `doctor --strict` reports external target quality and taxonomy consistency.
+### Runtime and parser hardening
+
+`service-flow` treats URL and destination templates with substitutions as dynamic external targets, preserves operation-path template evidence without promoting unrelated variables, and parses CDS `@(path: ...)` annotations from original source text. Service extension declarations using both `extend Name` and `extend service Name` are recognized for routing provenance.
+

package/TECHNICAL-NOTE.md

@@ -142,3 +142,7 @@ Outbound call extraction is AST-based and ignores comments, block comments, and
 ## 0.1.35 OData placeholder semantics
 
 Service-flow now records OData placeholders by semantic layer. Service-routing placeholders belong to service bindings and can make an operation edge dynamic until runtime variables are supplied. Operation invocation argument placeholders, such as action/function call arguments, remain operation evidence but are not service-routing variables. Entity key placeholders belong to entity addressing, so key, navigation, and media/property paths remain terminal remote entity/query edges unless indexed CDS operation evidence provides a credible operation match.
+## 0.1.40 analyzer hardening
+
+Expression resolution is consumer-specific: operation paths may retain template placeholders for OData normalization, while external URL and destination classifiers require literal or no-substitution-template evidence before a static target is persisted. Identifier resolution is bounded to the call-site lexical scope and ignores sibling scopes, later declarations, nested function bodies, and mutable or computed writes unless they are recorded as conservative candidate evidence.
+

package/dist/{chunk-SAZ5OK7R.js → chunk-774PPGGK.js}

@@ -187,16 +187,20 @@ function collectAnnotations(text, index) {
   return { end: i, raw };
 }
 function pathAnnotation(raw) {
-  return /path\s*:\s*['"]([^'"]+)['"]/s.exec(raw)?.[1];
+  return /path\s*:\s*(['"])(.*?)\1/s.exec(raw)?.[2];
 }
-function matchingBrace(text, open) {
+function matchingBrace(maskedText, open) {
   let depth = 0;
-  for (let i = open; i < text.length; i += 1) {
-    if (text[i] === "{") depth += 1;
-    if (text[i] === "}") depth -= 1;
+  for (let i = open; i < maskedText.length; i += 1) {
+    if (maskedText[i] === "{") depth += 1;
+    if (maskedText[i] === "}") depth -= 1;
     if (depth === 0) return i;
   }
-  return text.length - 1;
+  return maskedText.length - 1;
+}
+function annotationRawAt(original, masked, index) {
+  const collected = collectAnnotations(masked, index);
+  return { end: collected.end, raw: original.slice(index, collected.end) };
 }
 function operationsFromBody(text, maskedBody, bodyOffset, filePath) {
   return [...maskedBody.matchAll(/\b(action|function|event)\s+(\w+)\s*(?:\(([^)]*)\))?\s*(?:returns\s+([^;{]+))?/g)].map((m) => ({
@@ -216,22 +220,24 @@ async function parseCdsFile(repoPath, filePath) {
   const namespace = /namespace\s+([\w.]+)\s*;/.exec(masked)?.[1];
   const services = [];
   const pendingAnnotations = [];
-  for (const a of masked.matchAll(/@\s*\(/g)) {
-    const annotation = collectAnnotations(masked, a.index ?? 0);
-    pendingAnnotations.push(annotation);
-  }
-  const serviceRegex = /\b(extend\s+)?service\s+([\w.]+)\b/g;
+  for (const a of masked.matchAll(/@\s*\(/g)) pendingAnnotations.push(annotationRawAt(text, masked, a.index ?? 0));
+  const serviceRegex = /\b(?:(extend)\s+)?(?:(service)\s+)?([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\b/g;
   let match;
   while (match = serviceRegex.exec(masked)) {
-    const afterName = collectAnnotations(masked, serviceRegex.lastIndex);
+    const isExtend = match[1] === "extend";
+    const hasServiceKeyword = match[2] === "service";
+    if (!isExtend && !hasServiceKeyword) continue;
+    const afterName = annotationRawAt(text, masked, serviceRegex.lastIndex);
     const open = masked.indexOf("{", afterName.end);
     if (open === -1) continue;
+    const between = masked.slice(afterName.end, open).trim();
+    if (between.length > 0) continue;
     const matchIndex = match.index;
     const prefix = pendingAnnotations.filter((a) => a.end <= matchIndex && matchIndex - a.end < 8).map((a) => a.raw).join("");
     const annotations = `${prefix}${afterName.raw}`;
     const end = matchingBrace(masked, open);
     const body = masked.slice(open + 1, end);
-    const name = match[2] ?? "UnknownService";
+    const name = match[3] ?? "UnknownService";
     const serviceName = name.split(".").pop() ?? name;
     const servicePath = ensureLeadingSlash(pathAnnotation(annotations) ?? serviceName);
     services.push({
@@ -239,7 +245,7 @@ async function parseCdsFile(repoPath, filePath) {
       serviceName,
       qualifiedName: name.includes(".") ? name : namespace ? `${namespace}.${name}` : name,
       servicePath,
-      isExtend: Boolean(match[1]),
+      isExtend,
       sourceFile: normalizePath(filePath),
       sourceLine: lineOf(text, match.index),
       operations: operationsFromBody(text, body, open + 1, filePath)
@@ -815,11 +821,12 @@ function expressionName(expr) {
 }
 function variableInitializers(source) {
   const initializers = /* @__PURE__ */ new Map();
-  const visit = (node) => {
-    if (ts4.isVariableDeclaration(node) && ts4.isIdentifier(node.name) && node.initializer && (node.parent.flags & ts4.NodeFlags.Const) !== 0) initializers.set(node.name.text, node.initializer);
-    ts4.forEachChild(node, visit);
-  };
-  visit(source);
+  for (const statement of source.statements) {
+    if (!ts4.isVariableStatement(statement) || (statement.declarationList.flags & ts4.NodeFlags.Const) === 0) continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (ts4.isIdentifier(declaration.name) && declaration.initializer) initializers.set(declaration.name.text, declaration.initializer);
+    }
+  }
   return initializers;
 }
 function queryEntityFromAst(expr, initializers = /* @__PURE__ */ new Map()) {
@@ -876,48 +883,108 @@ function nameOfProperty(name) {
   if (ts4.isIdentifier(name) || ts4.isStringLiteral(name) || ts4.isNumericLiteral(name)) return name.text;
   return void 0;
 }
+var maxAliasDepth = 5;
+function safeRaw(expr) {
+  if (ts4.isStringLiteral(expr) || ts4.isNoSubstitutionTemplateLiteral(expr) || ts4.isIdentifier(expr) || ts4.isTemplateExpression(expr)) return expr.getText(expr.getSourceFile());
+  return void 0;
+}
+function placeholders(expr) {
+  return expr.templateSpans.map((span) => span.expression.getText(expr.getSourceFile()));
+}
+function isFunctionLikeScope(node) {
+  return ts4.isFunctionLike(node) || ts4.isSourceFile(node);
+}
+function containingScope(node) {
+  let current = node.parent;
+  while (current && !isFunctionLikeScope(current)) current = current.parent;
+  return current ?? node.getSourceFile();
+}
+function nodeContains(parent, child) {
+  return child.getStart(child.getSourceFile()) >= parent.getStart(parent.getSourceFile()) && child.getEnd() <= parent.getEnd();
+}
+function nestedFunctionContains(scope, candidate, use) {
+  let current = candidate.parent;
+  while (current && current !== scope) {
+    if (isFunctionLikeScope(current) && !nodeContains(current, use)) return true;
+    current = current.parent;
+  }
+  return false;
+}
+function resolveBinding(identifier, use) {
+  const scope = containingScope(use);
+  const source = use.getSourceFile();
+  let best;
+  const visit = (node) => {
+    if (node !== scope && isFunctionLikeScope(node)) return;
+    if (node.getStart(source) >= identifier.getStart(source)) return;
+    if (ts4.isVariableDeclaration(node) && ts4.isIdentifier(node.name) && node.name.text === identifier.text && !nestedFunctionContains(scope, node, use)) best = node;
+    if (ts4.isParameter(node) && ts4.isIdentifier(node.name) && node.name.text === identifier.text && !nestedFunctionContains(scope, node, use)) best = node;
+    ts4.forEachChild(node, visit);
+  };
+  visit(scope);
+  if (!best) return { immutable: false, evidence: ["binding_not_found"] };
+  const immutable = ts4.isVariableDeclaration(best) && (best.parent.flags & ts4.NodeFlags.Const) !== 0;
+  return { declaration: best, initializer: ts4.isVariableDeclaration(best) ? best.initializer : void 0, immutable, evidence: [immutable ? "const_binding_before_use" : "mutable_or_parameter_binding"] };
+}
+function resolveExpression(expr, use, policy, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (!expr) return { status: "unknown", sourceKind: "dynamic_expression", placeholderKeys: [], evidence: ["expression_missing"] };
+  if (ts4.isStringLiteral(expr)) return { status: "static", sourceKind: "string_literal", value: expr.text, rawExpression: safeRaw(expr), placeholderKeys: [], evidence: ["string_literal"] };
+  if (ts4.isNoSubstitutionTemplateLiteral(expr)) return { status: "static", sourceKind: "no_substitution_template", value: expr.text, rawExpression: safeRaw(expr), placeholderKeys: [], evidence: ["no_substitution_template"] };
+  if (ts4.isTemplateExpression(expr)) {
+    const keys = placeholders(expr);
+    if (policy === "operation_path") return { status: "dynamic", sourceKind: "template_with_substitutions", value: stripQuotes(expr.getText(expr.getSourceFile())), rawExpression: safeRaw(expr), placeholderKeys: keys, evidence: ["operation_path_template_placeholders_retained"] };
+    return { status: "dynamic", sourceKind: "template_with_substitutions", placeholderKeys: keys, evidence: ["template_substitutions_not_static_external_target"] };
+  }
+  if (ts4.isIdentifier(expr)) {
+    if (depth >= maxAliasDepth) return { status: "unknown", sourceKind: "const_alias", rawExpression: safeRaw(expr), placeholderKeys: [], evidence: ["alias_depth_exceeded"], constName: expr.text };
+    const binding = resolveBinding(expr, use);
+    if (!binding.declaration || !binding.initializer || !binding.immutable) return { status: "dynamic", sourceKind: "dynamic_expression", rawExpression: safeRaw(expr), placeholderKeys: [], evidence: binding.evidence, constName: expr.text };
+    if (seen.has(binding.declaration)) return { status: "unknown", sourceKind: "const_alias", rawExpression: safeRaw(expr), placeholderKeys: [], evidence: ["alias_cycle_detected"], constName: expr.text };
+    seen.add(binding.declaration);
+    const resolved2 = resolveExpression(binding.initializer, binding.declaration, policy, depth + 1, seen);
+    return { ...resolved2, sourceKind: "const_alias", rawExpression: safeRaw(expr), constName: expr.text, evidence: [...binding.evidence, ...resolved2.evidence] };
+  }
+  return { status: "dynamic", sourceKind: "dynamic_expression", rawExpression: safeRaw(expr), placeholderKeys: [], evidence: [`unsupported_${ts4.SyntaxKind[expr.kind] ?? "expression"}`] };
+}
 function staticExpressionText(expr, initializers) {
   if (!expr) return void 0;
   if (isStringLike(expr)) return expr.text;
-  if (ts4.isTemplateExpression(expr)) return stripQuotes(expr.getText(expr.getSourceFile()));
   if (ts4.isIdentifier(expr) && initializers.has(expr.text)) return staticExpressionText(initializers.get(expr.text), initializers);
   return void 0;
 }
-function staticPathExpression(expr, initializers) {
-  if (!expr) return { sourceKind: "dynamic" };
-  const rawExpression = expr.getText(expr.getSourceFile());
-  if (isStringLike(expr)) return { text: expr.text, sourceKind: "literal", rawExpression };
-  if (ts4.isTemplateExpression(expr)) return { text: stripQuotes(rawExpression), sourceKind: "template", rawExpression };
-  if (ts4.isIdentifier(expr) && initializers.has(expr.text)) {
-    const resolved2 = staticPathExpression(initializers.get(expr.text), initializers);
-    return resolved2.text ? { ...resolved2, sourceKind: "const", rawExpression, constName: expr.text } : { sourceKind: "dynamic", rawExpression };
-  }
-  return { sourceKind: "dynamic", rawExpression };
+function staticPathExpression(expr, use) {
+  const resolution = resolveExpression(expr, use, "operation_path");
+  const sourceKind = resolution.sourceKind === "const_alias" ? "const" : resolution.sourceKind === "template_with_substitutions" || resolution.sourceKind === "no_substitution_template" ? "template" : resolution.status === "static" ? "literal" : "dynamic";
+  return { text: resolution.value, sourceKind, rawExpression: resolution.rawExpression, constName: resolution.constName, resolution };
 }
 function operationPathFromStatic(text) {
   return text ? `/${stripQuotes(text).replace(/^\//, "")}` : void 0;
 }
-function staticPathCandidates(source, identifier, initializers) {
+function staticPathCandidates(identifier, call, method) {
+  const binding = resolveBinding(identifier, call);
+  const declaration = binding.declaration;
+  if (!declaration) return void 0;
+  const scope = containingScope(call);
+  const source = call.getSourceFile();
   const paths = [];
   let hasDynamicAssignments = false;
+  const addExpr = (expr, origin) => {
+    const resolved2 = staticPathExpression(expr, origin);
+    if (resolved2.text) paths.push(operationPathFromStatic(resolved2.text) ?? resolved2.text);
+    else hasDynamicAssignments = true;
+  };
+  if (ts4.isVariableDeclaration(declaration)) addExpr(declaration.initializer, declaration);
   const visit = (node) => {
-    if (ts4.isVariableDeclaration(node) && ts4.isIdentifier(node.name) && node.name.text === identifier && node.initializer) {
-      const resolved2 = staticPathExpression(node.initializer, initializers);
-      if (resolved2.text) paths.push(operationPathFromStatic(resolved2.text) ?? resolved2.text);
-      else hasDynamicAssignments = true;
-    }
-    if (ts4.isBinaryExpression(node) && node.operatorToken.kind === ts4.SyntaxKind.EqualsToken && ts4.isIdentifier(node.left) && node.left.text === identifier) {
-      const resolved2 = staticPathExpression(node.right, initializers);
-      if (resolved2.text) paths.push(operationPathFromStatic(resolved2.text) ?? resolved2.text);
-      else hasDynamicAssignments = true;
-    }
+    if (node !== scope && isFunctionLikeScope(node)) return;
+    if (node.getStart(source) >= call.getStart(source)) return;
+    if (ts4.isBinaryExpression(node) && node.operatorToken.kind === ts4.SyntaxKind.EqualsToken && ts4.isIdentifier(node.left) && node.left.text === identifier.text) addExpr(node.right, node);
     ts4.forEachChild(node, visit);
   };
-  visit(source);
+  visit(scope);
   const candidatePaths = [...new Set(paths)];
   if (candidatePaths.length === 0) return void 0;
-  const normalizedCandidateOperations = [...new Set(candidatePaths.map((candidate) => classifyODataPathIntent(candidate, "POST").topLevelOperationName).filter((value) => Boolean(value)))];
-  return { candidatePaths, normalizedCandidateOperations, candidateSourceKind: "static candidates observed", candidateIdentifier: identifier, hasDynamicAssignments };
+  const normalizedCandidateOperations = [...new Set(candidatePaths.map((candidate) => classifyODataPathIntent(candidate, method).topLevelOperationName).filter((value) => Boolean(value)))];
+  return { candidatePaths, normalizedCandidateOperations, candidateSourceKind: "static candidates observed before call in lexical scope", candidateIdentifier: identifier.text, hasDynamicAssignments, conservativeReason: hasDynamicAssignments ? "dynamic_assignment_observed" : normalizedCandidateOperations.length > 1 ? "candidate_tie" : void 0 };
 }
 function destinationExpressionShape(expr) {
   if (!expr) return void 0;
@@ -944,57 +1011,61 @@ function propertyInitializer(object, key) {
   }
   return void 0;
 }
-function httpMethodFromObject(object, initializers) {
-  const text = staticExpressionText(propertyInitializer(object, "method"), initializers);
+function httpMethodFromObject(object, use) {
+  const text = resolveExpression(propertyInitializer(object, "method"), use, "literal").value;
   return text ? stripQuotes(text).toUpperCase() : void 0;
 }
-function urlTargetFromExpression(expr, initializers) {
-  const text = staticExpressionText(expr, initializers);
-  if (text) return { kind: "static_url", expression: text, dynamic: false };
-  if (expr && (ts4.isTemplateExpression(expr) || ts4.isIdentifier(expr) || ts4.isPropertyAccessExpression(expr) || ts4.isCallExpression(expr))) return { kind: "url_expression", expression: expr.getText(expr.getSourceFile()), dynamic: true };
+function hasTemplatePlaceholder(value) {
+  return /\$\{|%7B|%7D/i.test(value);
+}
+function urlTargetFromExpression(expr, use) {
+  const resolved2 = resolveExpression(expr, use, "external");
+  if (resolved2.status === "static" && resolved2.value && !hasTemplatePlaceholder(resolved2.value)) return { kind: "static_url", expression: resolved2.value, dynamic: false, sourceKind: resolved2.sourceKind };
+  if (expr) return { kind: "url_expression", dynamic: true, expression: `${resolved2.sourceKind}:${resolved2.placeholderKeys.join("|")}`, expressionShape: resolved2.sourceKind, placeholderKeys: resolved2.placeholderKeys };
   return { kind: "unknown", dynamic: false };
 }
-function destinationTargetFromExpression(expr, initializers) {
-  const text = staticExpressionText(expr, initializers);
-  if (text) return { kind: "destination", expression: text, dynamic: false };
-  const candidates = staticConditionalCandidates(expr, initializers);
+function destinationTargetFromExpression(expr, use) {
+  const resolved2 = resolveExpression(expr, use, "external");
+  const text = resolved2.value;
+  if (resolved2.status === "static" && text && !hasTemplatePlaceholder(text)) return { kind: "destination", expression: text, dynamic: false, sourceKind: resolved2.sourceKind };
+  const candidates = staticConditionalCandidates(expr, /* @__PURE__ */ new Map());
   if (candidates) return { kind: "destination", dynamic: true, expressionShape: "conditional", candidateLiterals: candidates };
   const shape = destinationExpressionShape(expr);
   if (shape) return { kind: "destination", dynamic: true, expressionShape: shape };
   return void 0;
 }
-function externalHttpEvidence(node, source, initializers) {
+function externalHttpEvidence(node, source) {
   const expr = node.expression;
   const exprText = expr.getText(source);
   if (exprText === "useOrFetchDestination") {
     const objectArg = node.arguments[0];
     if (objectArg && ts4.isObjectLiteralExpression(objectArg)) {
-      const destination = destinationTargetFromExpression(propertyInitializer(objectArg, "destinationName"), initializers);
+      const destination = destinationTargetFromExpression(propertyInitializer(objectArg, "destinationName"), node);
       return { externalTarget: destination ?? { kind: "unknown", dynamic: false }, classifier: "sap_destination_lookup", sourceCallShape: "useOrFetchDestination" };
     }
   }
   if (exprText === "executeHttpRequest") {
-    const destination = destinationTargetFromExpression(node.arguments[0], initializers);
+    const destination = destinationTargetFromExpression(node.arguments[0], node);
     const config = node.arguments[1];
-    const method = config && ts4.isObjectLiteralExpression(config) ? httpMethodFromObject(config, initializers) : void 0;
-    const url = config && ts4.isObjectLiteralExpression(config) ? urlTargetFromExpression(propertyInitializer(config, "url"), initializers) : { kind: "unknown", dynamic: false };
+    const method = config && ts4.isObjectLiteralExpression(config) ? httpMethodFromObject(config, node) : void 0;
+    const url = config && ts4.isObjectLiteralExpression(config) ? urlTargetFromExpression(propertyInitializer(config, "url"), node) : { kind: "unknown", dynamic: false };
     return { method, externalTarget: destination ? { ...url, destination } : url, classifier: "sap_execute_http_request", sourceCallShape: "executeHttpRequest" };
   }
   if (exprText === "axios") {
     const config = node.arguments[0];
     if (config && ts4.isObjectLiteralExpression(config)) {
-      const method = httpMethodFromObject(config, initializers);
-      return { method, externalTarget: urlTargetFromExpression(propertyInitializer(config, "url"), initializers), classifier: "axios_config_call", sourceCallShape: "axios(config)" };
+      const method = httpMethodFromObject(config, node);
+      return { method, externalTarget: urlTargetFromExpression(propertyInitializer(config, "url"), node), classifier: "axios_config_call", sourceCallShape: "axios(config)" };
     }
     return { externalTarget: { kind: "unknown", dynamic: false }, classifier: "axios_unknown_call", sourceCallShape: "axios(...)" };
   }
   if (exprText === "fetch") {
     const init = node.arguments[1];
-    const method = init && ts4.isObjectLiteralExpression(init) ? httpMethodFromObject(init, initializers) : void 0;
-    return { method, externalTarget: urlTargetFromExpression(node.arguments[0], initializers), classifier: "fetch_call", sourceCallShape: "fetch" };
+    const method = init && ts4.isObjectLiteralExpression(init) ? httpMethodFromObject(init, node) : void 0;
+    return { method, externalTarget: urlTargetFromExpression(node.arguments[0], node), classifier: "fetch_call", sourceCallShape: "fetch" };
   }
   if (ts4.isPropertyAccessExpression(expr) && ["get", "post", "put", "patch", "delete", "head"].includes(expr.name.text) && expr.expression.getText(source) === "axios") {
-    return { method: expr.name.text.toUpperCase(), externalTarget: urlTargetFromExpression(node.arguments[0], initializers), classifier: "axios_member_call", sourceCallShape: `axios.${expr.name.text}` };
+    return { method: expr.name.text.toUpperCase(), externalTarget: urlTargetFromExpression(node.arguments[0], node), classifier: "axios_member_call", sourceCallShape: `axios.${expr.name.text}` };
   }
   return void 0;
 }
@@ -1057,7 +1128,7 @@ function collectWrapperSpecs(source) {
           const methodProp = propertyInitializer(objectArg, "method");
           const pathName = pathProp && ts4.isIdentifier(pathProp) ? pathProp.text : void 0;
           const methodName = methodProp && ts4.isIdentifier(methodProp) ? methodProp.text : void 0;
-          const methodLiteral = staticExpressionText(methodProp, variableInitializers(source));
+          const methodLiteral = resolveExpression(methodProp, node, "literal").value;
           if (pathName) sends.push({ client: node.expression.expression.text, path: pathName, method: methodName, methodLiteral, start: node.getStart(source), end: node.getEnd() });
         }
       }
@@ -1107,12 +1178,12 @@ function classifyOutboundCallsInSource(source, filePath) {
         if (objectArg && ts4.isObjectLiteralExpression(objectArg)) {
           const receiver = receiverName(expr.expression);
           const query = objectPropertyText(objectArg, "query");
-          const method = stripQuotes(objectPropertyText(objectArg, "method") ?? "POST");
+          const method = stripQuotes(resolveExpression(propertyInitializer(objectArg, "method"), node, "literal").value ?? objectPropertyText(objectArg, "method") ?? "POST");
           const pathExpr = propertyInitializer(objectArg, "path") ?? propertyInitializer(objectArg, "event");
-          const resolvedPath = staticPathExpression(pathExpr, initializers);
+          const resolvedPath = staticPathExpression(pathExpr, node);
           const op = pathExpr ? resolvedPath.text ?? pathExpr.getText(source) : void 0;
           const shorthandPath = objectPropertyIsShorthand(objectArg, "path");
-          const candidateEvidence2 = pathExpr && ts4.isIdentifier(pathExpr) && !resolvedPath.text ? staticPathCandidates(source, pathExpr.text, initializers) : void 0;
+          const candidateEvidence2 = pathExpr && ts4.isIdentifier(pathExpr) && !resolvedPath.text ? staticPathCandidates(pathExpr, node, method) : void 0;
           const candidateOperationPath = candidateEvidence2 && !candidateEvidence2.hasDynamicAssignments && candidateEvidence2.normalizedCandidateOperations.length === 1 && candidateEvidence2.candidatePaths.length > 0 ? candidateEvidence2.candidatePaths[0] : void 0;
           const operationPathExpr = operationPathFromStatic(resolvedPath.text) ?? candidateOperationPath;
           const intent = classifyODataPathIntent(operationPathExpr, method);
@@ -1129,8 +1200,8 @@ function classifyOutboundCallsInSource(source, filePath) {
         const pathArg = spec ? wrapperArgs[spec.pathIndex] : void 0;
         const methodArg = spec?.methodIndex === void 0 ? void 0 : wrapperArgs[spec.methodIndex];
         const receiver = clientArg && ts4.isIdentifier(clientArg) ? clientArg.text : spec?.clientName;
-        const method = stripQuotes(staticExpressionText(methodArg, initializers) ?? spec?.methodLiteral ?? "POST");
-        const resolvedPath = staticPathExpression(pathArg, initializers);
+        const method = stripQuotes(resolveExpression(methodArg, node, "literal").value ?? spec?.methodLiteral ?? "POST");
+        const resolvedPath = staticPathExpression(pathArg, node);
         const operationPathExpr = operationPathFromStatic(resolvedPath.text);
         const normalizedOperationPath = operationPathExpr ? classifyODataPathIntent(operationPathExpr, method).topLevelOperationName : void 0;
         if (spec && receiver && operationPathExpr) {
@@ -1146,7 +1217,7 @@ function classifyOutboundCallsInSource(source, filePath) {
           if (eventName) add(node, { callType: expr.name.text === "on" ? "async_subscribe" : "async_emit", serviceVariableName: rootReceiver ?? receiver, eventNameExpr: eventName }, { receiver, rootReceiver, classifier: expr.name.text === "on" ? "cap_service_event_subscription" : "cap_service_event_emit", receiverClassification: "cap_evidence" });
         }
       } else {
-        const external = externalHttpEvidence(node, source, initializers);
+        const external = externalHttpEvidence(node, source);
         if (external) {
           const evidenceTarget = { ...external.externalTarget, method: external.method, parserClassifier: external.classifier, sourceCallShape: external.sourceCallShape };
           const safeTarget = externalHttpTarget({ method: external.method, evidence_json: JSON.stringify({ externalTarget: evidenceTarget }) });
@@ -1235,7 +1306,7 @@ function stringValue(node) {
     return node.getText().replace(/^`|`$/g, "");
   return node.getText();
 }
-function placeholders(value) {
+function placeholders2(value) {
   return [...(value ?? "").matchAll(/\$\{([^}]*)\}/g)].map((m) => (m[1] ?? "").trim()).filter(Boolean);
 }
 function connectFactFromCall(call) {
@@ -1261,7 +1332,7 @@ function connectFactFromCall(call) {
     return {
       aliasExpr,
       isDynamic: true,
-      placeholders: placeholders(aliasExpr)
+      placeholders: placeholders2(aliasExpr)
     };
   let destinationExpr;
   let servicePathExpr;
@@ -1279,9 +1350,9 @@ function connectFactFromCall(call) {
   }
   if (objectArg) visitObject(objectArg);
   const ph = [
-    ...placeholders(aliasExpr ?? alias),
-    ...placeholders(destinationExpr),
-    ...placeholders(servicePathExpr)
+    ...placeholders2(aliasExpr ?? alias),
+    ...placeholders2(destinationExpr),
+    ...placeholders2(servicePathExpr)
   ];
   return {
     alias,
@@ -1931,9 +2002,9 @@ function extractPlaceholders(template) {
 }
 function substituteVariables(template, vars) {
   if (!template) return { placeholders: [], missing: [], supplied: [], changed: false };
-  const placeholders2 = [...new Set(extractPlaceholders(template))];
-  const supplied = placeholders2.filter((key) => Object.hasOwn(vars, key));
-  const missing = placeholders2.filter((key) => !Object.hasOwn(vars, key));
+  const placeholders3 = [...new Set(extractPlaceholders(template))];
+  const supplied = placeholders3.filter((key) => Object.hasOwn(vars, key));
+  const missing = placeholders3.filter((key) => !Object.hasOwn(vars, key));
   const effective = template.replace(PLACEHOLDER, (_m, key) => {
     const trimmed = key.trim();
     return Object.hasOwn(vars, trimmed) ? vars[trimmed] ?? "" : `\${${trimmed}}`;
@@ -1941,7 +2012,7 @@ function substituteVariables(template, vars) {
   return {
     original: template,
     effective,
-    placeholders: placeholders2,
+    placeholders: placeholders3,
     missing,
     supplied,
     changed: effective !== template
@@ -3120,4 +3191,4 @@ export {
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-SAZ5OK7R.js.map
+//# sourceMappingURL=chunk-774PPGGK.js.map