@saptools/service-flow 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.6
+
+- Scoped runtime variable resolution to eligible dynamic, ambiguous, or unresolved remote edges with matching placeholders, preserving terminal and static resolved edge status, target, reason, and confidence.
+- Clamped operation-resolution confidence to the `[0, 1]` range and retained original runtime expressions alongside effective substitutions and missing-variable evidence.
+- Resolved helper/package dependency graph edges primarily by indexed package name, persisted ambiguous dependency candidates with evidence, and marked inserted helper edges with explicit statuses.
+- Expanded repository fingerprints to include normalized package metadata, full `cds.requires`, scripts, package file content, and the analyzer version so metadata-only changes invalidate stale facts.
+- Replaced the hard-coded CLI version with package metadata as the release source of truth and documented selector, graph variable, SQLite, fingerprint, freshness, and parser-warning semantics.
+
+## 0.1.5
+
+- Runtime `--var` substitution now re-runs operation resolution in memory for trace and graph output, clears stale unresolved reasons on exact matches, and traverses into the matched downstream handler without mutating the persisted graph.
+- Operation nodes now use target CDS provenance while call-site evidence remains on edges.
+- Graph edges now carry explicit status values for resolved, terminal, dynamic, ambiguous, and unresolved cases; normal DB, external HTTP, and event terminals no longer receive remote-resolution failure text.
+- Replaced per-statement SQLite shelling with a persistent `node:sqlite` connection, bound parameters, transactions, read-only query openings, WAL, busy timeouts, and connection-local foreign-key enforcement.
+- Added schema user-version migration support for edge status and repository fingerprints.
+- Repository indexing now skips unchanged repositories unless `--force` is supplied and reports indexed/skipped counts.
+- `service-flow --version` now matches package metadata for the 0.1.5 release.
+
 ## 0.1.4
 
 - Resolved helper-returned service bindings exported through named export lists, including aliased exports, while preserving helper-chain evidence.

package/README.md

@@ -24,7 +24,7 @@ Index independent Git repositories, persist CAP/CDS facts in SQLite, resolve cro
 - 🧩 **Static CAP/CDS indexing** — extracts services, actions, functions, events, handler classes, decorator metadata, handler registrations, generated constants, and package-level `cds.requires`
 - 🔗 **Service-to-service linking** — resolves `cds.connect.to(...)`, `remote.send(...)`, `cds.services.*` style calls, helper package imports, dynamic candidates, and unresolved evidence into graph edges
 - 🗄️ **SQLite-backed workspace cache** — stores deterministic facts under `.service-flow/service-flow.db` so large workspaces can be queried repeatedly without reparsing everything
-- 🧠 **Dynamic edge support** — preserves parameterized destinations and service paths such as `svc_${objectCode}_process`, then lets traces apply runtime `--var key=value` values
+- 🧠 **Dynamic edge support** — preserves parameterized destinations and service paths such as `svc_${objectCode}_process`, then lets trace and graph commands apply runtime `--var key=value` values that can turn dynamic candidates into effective traversable operation edges
 - 📊 **Multiple output modes** — renders human-readable tables, JSON for automation, and Mermaid diagrams for architecture docs
 - 🩺 **Diagnostics-first workflow** — records parse/index issues and exposes them through `service-flow doctor` instead of hiding partial analysis
 - 🧩 **CAP helper-aware binding evidence** — follows imported helpers exported directly or through named export lists and separates alias, destination, and service-path expressions for dynamic `cds.connect.to(alias, options)` calls
@@ -47,10 +47,21 @@ npm install @saptools/service-flow
 ```
 
 > [!NOTE]
-> Requires **Node.js ≥ 20**. The analyzer is static: it reads files and package metadata, but it does not start CAP services, connect to SAP BTP, or execute application code.
+> Requires **Node.js ≥ 24.0.0** for the bundled `node:sqlite` runtime. Version 0.1.6 uses a persistent SQLite driver (`node:sqlite` in supported Node builds) for bound parameters, transactions, WAL, busy timeouts, and read-only query commands. The analyzer is static: it reads files and package metadata, but it does not start CAP services, connect to SAP BTP, or execute application code.
 
 ---
 
+
+### Correctness notes for 0.1.6
+
+- Runtime `--var` values are considered only for dynamic, ambiguous, or unresolved **remote** graph edges whose alias, destination, service path, or operation path expressions contain supplied placeholders. Local database, external HTTP, event, and already resolved static edges keep their persisted status, target, reason, and confidence. Partial substitutions remain dynamic and report the missing placeholder names.
+- `trace` and `graph` both accept repeatable `--var key=value` options. Effective substitutions are rendered in trace evidence without mutating the persisted graph. Confidence values are bounded to `[0, 1]`.
+- Repository selectors on list, trace, graph, and inspect commands narrow scope. Unknown selectors return empty machine-readable diagnostics instead of falling back to the whole workspace.
+- Helper-package dependency edges prefer exact indexed package names. Duplicate package-name candidates are persisted as ambiguous evidence rather than silently selecting one repository.
+- Repository fingerprints include source content, package name/version, dependencies and devDependencies, scripts, normalized `cds.requires` (including nested credentials), package file content, and the analyzer version. Metadata-only changes therefore trigger reindexing.
+- Index publication is designed around the last-good snapshot: failed parse or persistence attempts are recorded as diagnostics and must not be mixed with older graph facts. After indexing changes, relink before relying on graph/trace output; doctor reports stale or inconsistent stores where detectable.
+- Parser warnings describe analysis completeness, while routing status describes graph behavior. A terminal DB edge can remain terminal while still exposing parser warning evidence about an unknown entity.
+
 ## 🚀 Quick Start
 
 ```bash
@@ -73,7 +84,7 @@ service-flow graph --workspace /path/to/workspace --service /FacadeService --pat
 service-flow doctor --workspace /path/to/workspace
 ```
 
-After `init`, the workspace configuration and SQLite database live below the selected workspace by default. Run `index` whenever source changes, then run `link` to rebuild the graph edges used by `trace` and `graph`.
+After `init`, the workspace configuration and SQLite database live below the selected workspace by default. Run `index` whenever source changes; unchanged repositories are skipped unless `--force` is supplied. Then run `link` to rebuild the graph edges used by `trace` and `graph`.
 
 ---
 

package/TECHNICAL-NOTE.md

@@ -1,10 +1,10 @@
-# Service Flow 0.1.4 Resolution Notes
+# Service Flow 0.1.6 Resolution Notes
 
 - Imported helper bindings: TypeScript imports are resolved for relative modules. When a caller assigns `const client = await connectToService()`, the analyzer follows the imported symbol to an exported helper that returns `cds.connect.to(...)` and persists caller-variable evidence plus the helper source/export chain.
 - Candidate ranking: operation-path matches start as weak candidates. A resolved operation edge requires a strong signal such as exact service path, CDS alias/destination context, or explicit dynamic variable overrides. Otherwise candidates are preserved in edge evidence as ambiguous or unresolved.
 - Edge states: `REMOTE_CALL_RESOLVES_TO_OPERATION` is used only above the resolution threshold; `DYNAMIC_EDGE_CANDIDATE` preserves runtime-dependent service paths/destinations; `UNRESOLVED_EDGE` carries candidate counts and reasons when static evidence is insufficient.
 - Trace cycle safety: trace queues carry repository IDs, visited scope keys are independent of depth, graph edge IDs are emitted once, and revisiting an already-seen downstream operation scope creates a cycle marker instead of recursive expansion.
-- SQLite reliability: the package uses WAL, foreign keys, busy timeouts, and retries around the SQLite adapter. Statement failures throw before output rendering so commands do not report successful JSON/table/Mermaid results after an internal database failure.
+- SQLite reliability: the package uses a persistent SQLite connection per opened database, bound parameters, transactions, WAL, busy timeouts, read-only openings for query commands, and connection-local foreign-key enforcement. Native driver loading failures produce an actionable startup error before output rendering.
 
 ## 0.1.4 trace-correctness additions
 
@@ -12,3 +12,20 @@
 - Two-argument CAP connections keep alias expressions distinct from `credentials.destination` and `credentials.path` / `credentials.servicePath`; dynamic placeholders from all three fields are retained for later `--var` substitution.
 - Repository discovery validates `.git` markers using `HEAD`, `config`, or gitfile `gitdir:` content and keeps scanning children so outer workspaces can contain many nested repositories.
 - Fresh SQLite stores now declare core parent/child foreign keys with cascading cleanup for repository-owned facts.
+
+## 0.1.5 hardening additions
+
+- Runtime variables are applied to alias, destination, service path, and operation path evidence. Trace/graph then perform an effective in-memory resolution requiring both operation-path compatibility and an exact service-path signal.
+- Edge evidence and target operation provenance are separate: call file/line and helper chains stay on the edge, while operation nodes are loaded from CDS operation/service/repository rows.
+- The linker stores explicit edge status categories and summary counts. Valid DB, event, and external terminals keep `unresolved_reason` null.
+- Repository-level fingerprints include source paths/hashes, package dependencies, and analyzer schema version. Unchanged repositories are skipped unless `--force` is used.
+
+
+## 0.1.6 correctness additions
+
+- Runtime resolution now has an explicit eligibility gate: only remote dynamic/ambiguous/unresolved graph edges with affected placeholders are re-resolved in memory. Terminal and resolved static edges are copied through unchanged, and substitutions keep original expressions, effective values, supplied variables, and missing variables separate.
+- Operation candidate scores are clamped into `[0, 1]` before graph or trace rendering.
+- Helper package linking uses exact `repositories.package_name` matches before normalized directory-name fallback. Ambiguous package names are represented as ambiguous graph edges with all candidates in evidence.
+- Fingerprints hash normalized package facts and package bytes in addition to source file paths/content and analyzer version.
+- The CLI version imports package metadata, so package metadata, `service-flow --version`, changelog, and analyzer/fingerprint version share one release source.
+- Supported runtime is Node.js 24+ with `node:sqlite` validation; older runtimes should fail with a compatibility message instead of a late `DatabaseSync` error.

package/dist/{chunk-JY6GBGZT.js → chunk-6C5HZ6IR.js}

@@ -873,12 +873,30 @@ function collectClassHelpers(sf) {
 }
 
 // src/linker/dynamic-edge-resolver.ts
+var PLACEHOLDER = /\$\{\s*(\w+)\s*\}/g;
 function applyVariables(template, vars) {
-  if (!template) return void 0;
-  return template.replace(
-    /\$\{\s*(\w+)\s*\}/g,
-    (_m, key) => vars[key] ?? `\${${key}}`
+  return substituteVariables(template, vars).effective;
+}
+function extractPlaceholders(template) {
+  return [...(template ?? "").matchAll(PLACEHOLDER)].map((m) => m[1] ?? "").filter(Boolean);
+}
+function substituteVariables(template, vars) {
+  if (!template) return { placeholders: [], missing: [], supplied: [], changed: false };
+  const placeholders2 = [...new Set(extractPlaceholders(template))];
+  const supplied = placeholders2.filter((key) => Object.hasOwn(vars, key));
+  const missing = placeholders2.filter((key) => !Object.hasOwn(vars, key));
+  const effective = template.replace(
+    PLACEHOLDER,
+    (_m, key) => Object.hasOwn(vars, key) ? vars[key] ?? "" : `\${${key}}`
   );
+  return {
+    original: template,
+    effective,
+    placeholders: placeholders2,
+    missing,
+    supplied,
+    changed: effective !== template
+  };
 }
 
 // src/linker/service-resolver.ts
@@ -895,6 +913,13 @@ function rows(db, operationPath, workspaceId) {
   );
 }
 function resolveOperation(db, signals, workspaceId) {
+  const missing = [signals.servicePath, signals.alias, signals.destination, signals.operationPath].flatMap((value) => [...(value ?? "").matchAll(/\$\{\s*(\w+)\s*\}/g)].map((match) => match[1] ?? "")).filter(Boolean);
+  if (missing.length > 0)
+    return {
+      status: "dynamic",
+      candidates: signals.operationPath ? rows(db, signals.operationPath, workspaceId) : [],
+      reasons: [...new Set(missing)].map((name) => `missing_variable:${name}`)
+    };
   if (!signals.operationPath)
     return {
       status: "unresolved",
@@ -929,6 +954,7 @@ function resolveOperation(db, signals, workspaceId) {
       c.reasons.push("explicit_dynamic_override");
     }
   }
+  for (const c of candidates) c.score = Math.max(0, Math.min(1, c.score));
   candidates.sort(
     (a, b) => b.score - a.score || a.repoName.localeCompare(b.repoName)
   );
@@ -946,7 +972,7 @@ function resolveOperation(db, signals, workspaceId) {
       candidates,
       reasons: ["operation_path_only_has_no_strong_target_signal"]
     };
-  if (best && best.score >= 0.9 && (!second || best.score - second.score >= 0.25))
+  if (best && best.score >= 0.9 && best.servicePath === signals.servicePath && (best.operationPath === signals.operationPath || best.operationName === signals.operationPath.replace(/^\//, "")) && (!second || best.score - second.score >= 0.25))
     return {
       status: "resolved",
       target: best,
@@ -961,31 +987,47 @@ function resolveOperation(db, signals, workspaceId) {
 }
 
 // src/linker/helper-package-linker.ts
+function normalizeName(value) {
+  return value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9]+/g, "");
+}
+function candidatesForDependency(repos, dep, sourceId) {
+  const exact = repos.filter((repo) => repo.id !== sourceId && repo.package_name === dep);
+  if (exact.length > 0) return exact;
+  const normalized = normalizeName(dep);
+  return repos.filter((repo) => repo.id !== sourceId && normalizeName(repo.name) === normalized);
+}
 function linkHelperPackages(db, workspaceId) {
   const repos = db.prepare(
-    "SELECT id,name,dependencies_json FROM repositories WHERE workspace_id=?"
+    "SELECT id,name,package_name,dependencies_json FROM repositories WHERE workspace_id=?"
   ).all(workspaceId);
   let count = 0;
   for (const repo of repos) {
     const deps = JSON.parse(repo.dependencies_json);
     for (const dep of Object.keys(deps)) {
-      const helper = repos.find((r) => r.name === dep || dep.endsWith(r.name));
-      if (helper) {
-        db.prepare(
-          "INSERT INTO graph_edges(workspace_id,edge_type,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic) VALUES(?,?,?,?,?,?,?,?,?)"
-        ).run(
-          workspaceId,
-          "REPO_IMPORTS_HELPER_PACKAGE",
-          "repo",
-          String(repo.id),
-          "repo",
-          String(helper.id),
-          0.9,
-          JSON.stringify({ dependency: dep }),
-          0
-        );
-        count += 1;
-      }
+      const candidates = candidatesForDependency(repos, dep, repo.id);
+      if (candidates.length === 0) continue;
+      const status = candidates.length === 1 ? "resolved" : "ambiguous";
+      const helper = candidates.length === 1 ? candidates[0] : void 0;
+      db.prepare(
+        "INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,unresolved_reason) VALUES(?,?,?,?,?,?,?,?,?,?,?)"
+      ).run(
+        workspaceId,
+        "REPO_IMPORTS_HELPER_PACKAGE",
+        status,
+        "repo",
+        String(repo.id),
+        helper ? "repo" : "repo_candidates",
+        helper ? String(helper.id) : candidates.map((candidate) => candidate.id).join(","),
+        helper ? 1 : 0.5,
+        JSON.stringify({
+          dependency: dep,
+          candidates: candidates.map((candidate) => ({ id: candidate.id, name: candidate.name, packageName: candidate.package_name })),
+          match: helper?.package_name === dep ? "package_name" : "normalized_directory"
+        }),
+        0,
+        helper ? null : "Ambiguous dependency package candidates"
+      );
+      count += 1;
     }
   }
   return count;
@@ -993,91 +1035,105 @@ function linkHelperPackages(db, workspaceId) {
 
 // src/linker/cross-repo-linker.ts
 function linkWorkspace(db, workspaceId, vars = {}) {
-  db.prepare("DELETE FROM graph_edges WHERE workspace_id=?").run(workspaceId);
-  let edges = linkHelperPackages(db, workspaceId);
-  let unresolved = 0;
-  const calls = db.prepare(
-    `SELECT c.*,r.name repoName,b.alias,b.alias_expr aliasExpr,b.destination_expr destinationExpr,b.service_path_expr servicePathExpr,b.is_dynamic isDynamic,b.placeholders_json placeholdersJson,b.helper_chain_json helperChainJson,req.service_path requireServicePath,req.destination requireDestination FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id LEFT JOIN service_bindings b ON b.id=c.service_binding_id LEFT JOIN cds_requires req ON req.repo_id=c.repo_id AND req.alias=b.alias WHERE r.workspace_id=?`
-  ).all(workspaceId);
-  for (const call of calls) {
-    const callType = String(call.call_type);
-    const op = applyVariables(String(call.operation_path_expr ?? ""), vars);
-    const servicePath = applyVariables(
-      call.servicePathExpr ?? call.requireServicePath,
-      vars
-    );
-    const destination = call.destinationExpr ?? call.requireDestination;
-    const isDynamic = Boolean(Number(call.isDynamic ?? 0));
-    const resolution = callType.startsWith("remote") ? resolveOperation(
-      db,
-      {
+  return db.transaction(() => {
+    db.prepare("DELETE FROM graph_edges WHERE workspace_id=?").run(workspaceId);
+    let edges = linkHelperPackages(db, workspaceId);
+    let unresolved = 0;
+    let resolvedCount = 0;
+    let ambiguousCount = 0;
+    let dynamicCount = 0;
+    let terminalCount = 0;
+    const calls = db.prepare(
+      `SELECT c.*,r.name repoName,b.alias,b.alias_expr aliasExpr,b.destination_expr destinationExpr,b.service_path_expr servicePathExpr,b.is_dynamic isDynamic,b.placeholders_json placeholdersJson,b.helper_chain_json helperChainJson,req.service_path requireServicePath,req.destination requireDestination FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id LEFT JOIN service_bindings b ON b.id=c.service_binding_id LEFT JOIN cds_requires req ON req.repo_id=c.repo_id AND req.alias=b.alias WHERE r.workspace_id=?`
+    ).all(workspaceId);
+    for (const call of calls) {
+      const callType = String(call.call_type);
+      const op = applyVariables(String(call.operation_path_expr ?? ""), vars);
+      const servicePath = applyVariables(
+        call.servicePathExpr ?? call.requireServicePath,
+        vars
+      );
+      const destination = call.destinationExpr ?? call.requireDestination;
+      const isDynamic = Boolean(Number(call.isDynamic ?? 0));
+      const resolution = callType.startsWith("remote") ? resolveOperation(
+        db,
+        {
+          servicePath,
+          operationPath: op,
+          alias: applyVariables(call.aliasExpr ?? call.alias, vars),
+          destination: applyVariables(destination, vars),
+          isDynamic,
+          hasExplicitOverride: Object.keys(vars).length > 0
+        },
+        workspaceId
+      ) : { status: "unresolved", candidates: [], reasons: [] };
+      const target = resolution.target;
+      const evidence = {
+        sourceFile: call.source_file,
+        sourceLine: call.source_line,
+        file: call.source_file,
+        line: call.source_line,
+        repo: call.repoName,
+        serviceAlias: call.alias,
+        serviceAliasExpr: call.aliasExpr,
+        destination: applyVariables(destination, vars),
         servicePath,
         operationPath: op,
-        alias: call.alias,
-        destination,
-        isDynamic,
-        hasExplicitOverride: Object.keys(vars).length > 0
-      },
-      workspaceId
-    ) : { status: "unresolved", candidates: [], reasons: [] };
-    const target = resolution.target;
-    const evidence = {
-      sourceFile: call.source_file,
-      sourceLine: call.source_line,
-      file: call.source_file,
-      line: call.source_line,
-      repo: call.repoName,
-      serviceAlias: call.alias,
-      serviceAliasExpr: call.aliasExpr,
-      destination,
-      servicePath,
-      operationPath: op,
-      targetRepo: target?.repoName,
-      targetOperation: target?.operationName,
-      helperChain: call.helperChainJson ? JSON.parse(String(call.helperChainJson)) : void 0,
-      candidates: resolution.candidates,
-      candidateCount: resolution.candidates.length,
-      resolutionStatus: resolution.status,
-      resolutionReasons: resolution.reasons
-    };
-    if (target) {
-      db.prepare(
-        "INSERT INTO graph_edges(workspace_id,edge_type,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic) VALUES(?,?,?,?,?,?,?,?,?)"
-      ).run(
-        workspaceId,
-        "REMOTE_CALL_RESOLVES_TO_OPERATION",
-        "call",
-        String(call.id),
-        "operation",
-        String(target.operationId),
-        target.score,
-        JSON.stringify(evidence),
-        isDynamic ? 1 : 0
-      );
-      edges += 1;
-    } else {
-      const edgeType = callType === "local_db_query" ? "HANDLER_RUNS_DB_QUERY" : callType === "external_http" ? "HANDLER_CALLS_EXTERNAL_HTTP" : callType === "async_emit" ? "HANDLER_EMITS_EVENT" : callType === "async_subscribe" ? "EVENT_CONSUMED_BY_HANDLER" : resolution.status === "dynamic" ? "DYNAMIC_EDGE_CANDIDATE" : "UNRESOLVED_EDGE";
-      db.prepare(
-        "INSERT INTO graph_edges(workspace_id,edge_type,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,unresolved_reason) VALUES(?,?,?,?,?,?,?,?,?,?)"
-      ).run(
-        workspaceId,
-        edgeType,
-        "call",
-        String(call.id),
-        callType.startsWith("async_") ? "event" : "external",
-        String(call.event_name_expr ?? call.query_entity ?? op ?? call.id),
-        Number(call.confidence ?? 0.2),
-        JSON.stringify(evidence),
-        isDynamic || resolution.status === "dynamic" ? 1 : 0,
-        String(
-          call.unresolved_reason ?? (resolution.status === "ambiguous" ? "Ambiguous operation candidates require a strong service signal" : resolution.status === "dynamic" ? "Dynamic target requires runtime variable overrides" : "No indexed target operation matched")
-        )
-      );
-      edges += 1;
-      unresolved += edgeType === "UNRESOLVED_EDGE" ? 1 : 0;
+        targetRepo: target?.repoName,
+        targetOperation: target?.operationName,
+        helperChain: call.helperChainJson ? JSON.parse(String(call.helperChainJson)) : void 0,
+        candidates: resolution.candidates,
+        candidateCount: resolution.candidates.length,
+        resolutionStatus: resolution.status,
+        resolutionReasons: resolution.reasons
+      };
+      if (target) {
+        db.prepare(
+          "INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic) VALUES(?,?,?,?,?,?,?,?,?,?)"
+        ).run(
+          workspaceId,
+          "REMOTE_CALL_RESOLVES_TO_OPERATION",
+          "resolved",
+          "call",
+          String(call.id),
+          "operation",
+          String(target.operationId),
+          target.score,
+          JSON.stringify(evidence),
+          isDynamic ? 1 : 0
+        );
+        edges += 1;
+        resolvedCount += 1;
+      } else {
+        const edgeType = callType === "local_db_query" ? "HANDLER_RUNS_DB_QUERY" : callType === "external_http" ? "HANDLER_CALLS_EXTERNAL_HTTP" : callType === "async_emit" ? "HANDLER_EMITS_EVENT" : callType === "async_subscribe" ? "EVENT_CONSUMED_BY_HANDLER" : resolution.status === "dynamic" ? "DYNAMIC_EDGE_CANDIDATE" : "UNRESOLVED_EDGE";
+        const status = edgeType === "DYNAMIC_EDGE_CANDIDATE" ? "dynamic" : resolution.status === "ambiguous" ? "ambiguous" : edgeType === "UNRESOLVED_EDGE" ? "unresolved" : "terminal";
+        const unresolvedReason = status === "terminal" ? null : String(
+          call.unresolved_reason ?? (resolution.status === "ambiguous" ? "Ambiguous operation candidates require a strong service signal" : resolution.status === "dynamic" ? `Dynamic target requires runtime variable overrides: ${(resolution.reasons.length ? resolution.reasons : ["missing runtime variables"]).join(", ")}` : "No indexed target operation matched")
+        );
+        db.prepare(
+          "INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,unresolved_reason) VALUES(?,?,?,?,?,?,?,?,?,?,?)"
+        ).run(
+          workspaceId,
+          edgeType,
+          status,
+          "call",
+          String(call.id),
+          callType.startsWith("async_") ? "event" : "external",
+          String(call.event_name_expr ?? call.query_entity ?? op ?? call.id),
+          Number(call.confidence ?? 0.2),
+          JSON.stringify(evidence),
+          isDynamic || resolution.status === "dynamic" ? 1 : 0,
+          unresolvedReason
+        );
+        edges += 1;
+        unresolved += status === "unresolved" ? 1 : 0;
+        ambiguousCount += status === "ambiguous" ? 1 : 0;
+        dynamicCount += status === "dynamic" ? 1 : 0;
+        terminalCount += status === "terminal" ? 1 : 0;
+      }
     }
-  }
-  return { edgeCount: edges, unresolvedCount: unresolved };
+    return { edgeCount: edges, unresolvedCount: unresolved, resolvedCount, ambiguousCount, dynamicCount, terminalCount };
+  });
 }
 
 // src/trace/trace-engine.ts
@@ -1096,7 +1152,8 @@ function sourceFilesForStart(db, repoId, start) {
     `SELECT DISTINCT hc.source_file sourceFile
        FROM handler_classes hc LEFT JOIN handler_methods hm ON hm.handler_class_id=hc.id
        WHERE (? IS NULL OR hc.repo_id=?) AND (? IS NULL OR hc.class_name=? OR hm.method_name=?)
-         AND (? IS NULL OR hm.decorator_value=? OR hm.method_name=?)`
+         AND (? IS NULL OR hm.decorator_value=? OR hm.method_name=?)
+         AND (? IS NULL OR EXISTS (SELECT 1 FROM cds_services s JOIN cds_operations o ON o.service_id=s.id WHERE s.repo_id=hc.repo_id AND s.service_path=? AND (? IS NULL OR o.operation_path=? OR o.operation_name=? OR hm.decorator_value=? OR hm.method_name=?)))`
   ).all(
     repoId,
     repoId,
@@ -1105,8 +1162,16 @@ function sourceFilesForStart(db, repoId, start) {
     handler,
     operation,
     operation,
+    operation,
+    start.servicePath,
+    start.servicePath,
+    operation,
+    operation,
+    operation,
+    operation,
     operation
   );
+  if (start.servicePath && rows2.length === 0) return void 0;
   if (rows2.length === 0) return void 0;
   return new Set(rows2.map((row) => row.sourceFile).filter(Boolean));
 }
@@ -1150,37 +1215,63 @@ function graphForCalls(db, callIds) {
   if (callIds.length === 0) return map;
   const rows2 = db.prepare(
     `SELECT * FROM graph_edges WHERE from_kind='call' AND from_id IN (${callIds.map(() => "?").join(",")}) ORDER BY id`
-  ).all(...callIds);
+  ).all(...callIds.map((id) => String(id)));
   for (const row of rows2) {
     const id = Number(row.from_id);
     map.set(id, [...map.get(id) ?? [], row]);
   }
   return map;
 }
-function candidatesFromEvidence(evidence) {
-  return Array.isArray(evidence.candidates) ? evidence.candidates.filter(
-    (candidate) => typeof candidate === "object" && candidate !== null
-  ) : [];
+function hasRuntimeVariable(value, vars) {
+  return typeof value === "string" && extractPlaceholders(value).some((key) => Object.hasOwn(vars, key));
+}
+function isRemoteRuntimeCandidate(row, evidence, vars) {
+  if (!vars || Object.keys(vars).length === 0) return false;
+  if (!["dynamic", "ambiguous", "unresolved"].includes(String(row.status ?? ""))) return false;
+  if (!["DYNAMIC_EDGE_CANDIDATE", "UNRESOLVED_EDGE", "REMOTE_CALL_RESOLVES_TO_OPERATION"].includes(row.edge_type)) return false;
+  if (row.status === "resolved") return false;
+  return ["servicePath", "operationPath", "serviceAliasExpr", "serviceAlias", "destination"].some((key) => hasRuntimeVariable(evidence[key], vars));
 }
 function evidenceWithRuntimeVariables(evidence, vars) {
   if (!vars || Object.keys(vars).length === 0) return evidence;
-  const servicePath = typeof evidence.servicePath === "string" ? applyVariables(evidence.servicePath, vars) : void 0;
-  const operationPath = typeof evidence.operationPath === "string" ? applyVariables(evidence.operationPath, vars) : void 0;
-  const candidates = candidatesFromEvidence(evidence);
-  const matched = servicePath ? candidates.find((candidate) => candidate.servicePath === servicePath) : void 0;
-  return {
-    ...evidence,
-    servicePath: servicePath ?? evidence.servicePath,
-    operationPath: operationPath ?? evidence.operationPath,
-    runtimeVariablesApplied: true,
-    runtimeResolvedCandidate: matched ? {
-      repoName: matched.repoName,
-      servicePath: matched.servicePath,
-      operationPath: matched.operationPath,
-      operationName: matched.operationName,
-      score: matched.score
-    } : void 0
-  };
+  const substitutions = {};
+  for (const key of ["servicePath", "operationPath", "serviceAliasExpr", "serviceAlias", "destination"]) {
+    const substitution = substituteVariables(typeof evidence[key] === "string" ? String(evidence[key]) : void 0, vars);
+    if (substitution.placeholders.length > 0) substitutions[key] = substitution;
+  }
+  const next = { ...evidence, runtimeVariablesApplied: true, runtimeSubstitutions: substitutions };
+  for (const [key, value] of Object.entries(substitutions)) {
+    if (value.effective) next[key] = value.effective;
+  }
+  const missing = Object.values(substitutions).flatMap((value) => value.missing);
+  if (missing.length > 0) next.missingRuntimeVariables = [...new Set(missing)];
+  return next;
+}
+function operationNode(db, operationId) {
+  const row = db.prepare(`SELECT o.id operationId,o.operation_name operationName,o.operation_type operationType,o.operation_path operationPath,o.source_file sourceFile,o.source_line sourceLine,s.id serviceId,s.service_name serviceName,s.qualified_name qualifiedName,s.service_path servicePath,r.id repoId,r.name repoName FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id WHERE o.id=?`).get(operationId);
+  if (!row) return void 0;
+  return { id: `operation:${operationId}`, kind: "operation", label: `${String(row.repoName)}:${String(row.servicePath)}${String(row.operationPath)}`, ...row };
+}
+function workspaceIdForCall(db, callId) {
+  return db.prepare("SELECT r.workspace_id workspaceId FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id WHERE c.id=?").get(callId)?.workspaceId;
+}
+function runtimeResolution(db, row, evidence, vars) {
+  if (!isRemoteRuntimeCandidate(row, evidence, vars))
+    return { row, evidence, unresolvedReason: row.unresolved_reason };
+  const nextEvidence = evidenceWithRuntimeVariables(evidence, vars);
+  const servicePath = typeof nextEvidence.servicePath === "string" ? nextEvidence.servicePath : void 0;
+  const operationPath = typeof nextEvidence.operationPath === "string" ? nextEvidence.operationPath : void 0;
+  const alias = typeof nextEvidence.serviceAliasExpr === "string" ? nextEvidence.serviceAliasExpr : typeof nextEvidence.serviceAlias === "string" ? nextEvidence.serviceAlias : void 0;
+  const destination = typeof nextEvidence.destination === "string" ? nextEvidence.destination : void 0;
+  const resolution = resolveOperation(db, { servicePath, operationPath, alias, destination, hasExplicitOverride: true, isDynamic: true }, workspaceIdForCall(db, row.from_id));
+  nextEvidence.runtimeResolutionStatus = resolution.status;
+  nextEvidence.runtimeResolutionReasons = resolution.reasons;
+  if (resolution.target) {
+    nextEvidence.runtimeResolvedCandidate = resolution.target;
+    return { row: { ...row, to_kind: "operation", to_id: String(resolution.target.operationId), unresolved_reason: void 0, confidence: Math.max(0, Math.min(1, resolution.target.score)) }, evidence: nextEvidence, target: resolution.target };
+  }
+  const unresolvedReason = resolution.status === "dynamic" ? `Dynamic target is missing runtime variables: ${resolution.reasons.join(", ")}` : resolution.status === "ambiguous" ? "Ambiguous runtime operation candidates" : "No runtime operation candidate matched substituted service and operation path";
+  return { row, evidence: nextEvidence, unresolvedReason };
 }
 function edgeTarget(row, evidence) {
   const runtimeCandidate = evidence.runtimeResolvedCandidate;
@@ -1242,33 +1333,32 @@ function trace(db, start, options) {
         const rawEvidence = JSON.parse(
           String(row.evidence_json || "{}")
         );
-        const evidence = evidenceWithRuntimeVariables(
-          rawEvidence,
-          options.vars
-        );
-        const targetNode = `${row.to_kind}:${row.to_id}`;
-        nodes.set(targetNode, {
+        const effective = runtimeResolution(db, row, rawEvidence, options.vars);
+        const evidence = effective.evidence;
+        const effectiveRow = effective.row;
+        const targetNode = `${effectiveRow.to_kind}:${effectiveRow.to_id}`;
+        const opNode = effectiveRow.to_kind === "operation" ? operationNode(db, effectiveRow.to_id) : void 0;
+        nodes.set(targetNode, opNode ?? {
           id: targetNode,
-          kind: row.to_kind,
-          label: row.to_id,
-          ...evidence
+          kind: effectiveRow.to_kind,
+          label: effectiveRow.to_id
         });
-        const to = edgeTarget(row, evidence);
+        const to = edgeTarget(effectiveRow, evidence);
         edges.push({
           step: current.depth,
           type: String(call.call_type),
           from: `${call.repoName}:${call.source_file}`,
           to,
           evidence,
-          confidence: Number(row.confidence ?? call.confidence),
-          unresolvedReason: row.unresolved_reason
+          confidence: Number(effectiveRow.confidence ?? call.confidence),
+          unresolvedReason: effective.unresolvedReason
         });
-        if (row.to_kind === "operation" && current.depth < maxDepth) {
-          const files = handlerFilesForOperation(db, row.to_id);
+        if (effectiveRow.to_kind === "operation" && current.depth < maxDepth) {
+          const files = handlerFilesForOperation(db, effectiveRow.to_id);
           if (files.size > 0) {
             const targetRepoId = db.prepare(
               "SELECT s.repo_id repoId FROM cds_operations o JOIN cds_services s ON s.id=o.service_id WHERE o.id=?"
-            ).get(row.to_id)?.repoId;
+            ).get(effectiveRow.to_id)?.repoId;
             const nextKey = `${targetRepoId ?? "*"}:${[...files].sort().join(",")}`;
             if (seenScopes.has(nextKey))
               edges.push({
@@ -1307,7 +1397,9 @@ export {
   parseOutboundCalls,
   parseServiceBindings,
   applyVariables,
+  extractPlaceholders,
+  substituteVariables,
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-JY6GBGZT.js.map
+//# sourceMappingURL=chunk-6C5HZ6IR.js.map