@saptools/service-flow 0.1.50 → 0.1.52

package/dist/cli.js

@@ -1,10 +1,24 @@
 #!/usr/bin/env node
 import {
   classifyODataPathIntent,
+  clearRepoFacts,
   containsSupportedOutboundCall,
   discoverRepositories,
+  getWorkspace,
+  handlerMethodIsExecutable,
   implementationHintSuggestions,
+  insertBindings,
+  insertCalls,
+  insertExecutableSymbols,
+  insertHandler,
+  insertRegistrations,
+  insertRequires,
+  insertService,
+  insertSymbolCalls,
   linkWorkspace,
+  listRepositories,
+  loadPackageJsonSnapshot,
+  loadRepositorySourceContext,
   normalizeODataOperationInvocationPath,
   normalizePath,
   parseCdsFile,
@@ -15,13 +29,15 @@ import {
   parsePackageJson,
   parseServiceBindings,
   parseVars,
-  trace
-} from "./chunk-52OUS3MO.js";
+  reposByName,
+  selectorRepoAmbiguousDiagnostic,
+  trace,
+  upsertRepository,
+  upsertWorkspace
+} from "./chunk-PTLDSHRC.js";
 
 // src/cli.ts
 import { Command } from "commander";
-import path6 from "path";
-import fs6 from "fs/promises";
 
 // src/config/defaults.ts
 var DEFAULT_IGNORES = [
@@ -93,7 +109,7 @@ import fs2 from "fs";
 import path2 from "path";
 
 // src/db/schema.ts
-var schemaSql = `
+var schemaTablesSql = `
 CREATE TABLE IF NOT EXISTS workspaces (id INTEGER PRIMARY KEY, root_path TEXT UNIQUE NOT NULL, db_path TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS repositories (id INTEGER PRIMARY KEY, workspace_id INTEGER NOT NULL, name TEXT NOT NULL, absolute_path TEXT NOT NULL, relative_path TEXT NOT NULL, package_name TEXT, package_version TEXT, dependencies_json TEXT DEFAULT '{}', kind TEXT NOT NULL, is_git_repo INTEGER NOT NULL, last_indexed_at TEXT, index_status TEXT DEFAULT 'pending', error_count INTEGER DEFAULT 0, fingerprint TEXT, fact_generation INTEGER NOT NULL DEFAULT 0, graph_generation INTEGER NOT NULL DEFAULT 0, graph_stale_reason TEXT, graph_stale_at TEXT, fact_analyzer_version TEXT, UNIQUE(workspace_id, absolute_path), FOREIGN KEY(workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE);
 CREATE TABLE IF NOT EXISTS files (id INTEGER PRIMARY KEY, repo_id INTEGER NOT NULL, relative_path TEXT NOT NULL, extension TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL, last_indexed_at TEXT NOT NULL, UNIQUE(repo_id, relative_path), FOREIGN KEY(repo_id) REFERENCES repositories(id) ON DELETE CASCADE);
@@ -108,8 +124,10 @@ CREATE TABLE IF NOT EXISTS service_bindings (id INTEGER PRIMARY KEY, repo_id INT
 CREATE TABLE IF NOT EXISTS outbound_calls (id INTEGER PRIMARY KEY, repo_id INTEGER NOT NULL, source_symbol_id INTEGER, call_type TEXT NOT NULL, service_binding_id INTEGER, method TEXT, operation_path_expr TEXT, query_entity TEXT, event_name_expr TEXT, payload_summary TEXT, source_file TEXT NOT NULL, source_line INTEGER NOT NULL, confidence REAL NOT NULL, unresolved_reason TEXT, local_service_name TEXT, local_service_lookup TEXT, alias_chain_json TEXT, evidence_json TEXT, external_target_kind TEXT, external_target_id TEXT, external_target_label TEXT, external_target_dynamic INTEGER NOT NULL DEFAULT 0, FOREIGN KEY(repo_id) REFERENCES repositories(id) ON DELETE CASCADE, FOREIGN KEY(source_symbol_id) REFERENCES symbols(id) ON DELETE SET NULL, FOREIGN KEY(service_binding_id) REFERENCES service_bindings(id) ON DELETE SET NULL);
 CREATE TABLE IF NOT EXISTS symbol_calls (id INTEGER PRIMARY KEY, repo_id INTEGER NOT NULL, caller_symbol_id INTEGER NOT NULL, callee_symbol_id INTEGER, callee_expression TEXT NOT NULL, import_source TEXT, source_file TEXT NOT NULL, source_line INTEGER NOT NULL, status TEXT NOT NULL, confidence REAL NOT NULL, evidence_json TEXT NOT NULL, unresolved_reason TEXT, FOREIGN KEY(repo_id) REFERENCES repositories(id) ON DELETE CASCADE, FOREIGN KEY(caller_symbol_id) REFERENCES symbols(id) ON DELETE CASCADE, FOREIGN KEY(callee_symbol_id) REFERENCES symbols(id) ON DELETE SET NULL);
 CREATE TABLE IF NOT EXISTS graph_edges (id INTEGER PRIMARY KEY, workspace_id INTEGER NOT NULL, edge_type TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'unresolved', from_kind TEXT NOT NULL, from_id TEXT NOT NULL, to_kind TEXT NOT NULL, to_id TEXT NOT NULL, confidence REAL NOT NULL, evidence_json TEXT NOT NULL, is_dynamic INTEGER NOT NULL, unresolved_reason TEXT, generation INTEGER NOT NULL DEFAULT 0, FOREIGN KEY(workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE);
-CREATE TABLE IF NOT EXISTS index_runs (id INTEGER PRIMARY KEY, workspace_id INTEGER NOT NULL, started_at TEXT NOT NULL, finished_at TEXT, status TEXT NOT NULL, repo_count INTEGER NOT NULL, file_count INTEGER NOT NULL, diagnostic_count INTEGER NOT NULL, error_message TEXT, FOREIGN KEY(workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE);
+CREATE TABLE IF NOT EXISTS index_runs (id INTEGER PRIMARY KEY, workspace_id INTEGER NOT NULL, started_at TEXT NOT NULL, finished_at TEXT, status TEXT NOT NULL, repo_count INTEGER NOT NULL, file_count INTEGER NOT NULL, diagnostic_count INTEGER NOT NULL, error_message TEXT, owner_pid INTEGER, FOREIGN KEY(workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE);
 CREATE TABLE IF NOT EXISTS diagnostics (id INTEGER PRIMARY KEY, repo_id INTEGER, file_id INTEGER, severity TEXT NOT NULL, code TEXT NOT NULL, message TEXT NOT NULL, source_file TEXT, source_line INTEGER, FOREIGN KEY(repo_id) REFERENCES repositories(id) ON DELETE CASCADE, FOREIGN KEY(file_id) REFERENCES files(id) ON DELETE SET NULL);
+`;
+var schemaIndexesSql = `
 CREATE INDEX IF NOT EXISTS idx_repo_name ON repositories(name);
 CREATE INDEX IF NOT EXISTS idx_service_path ON cds_services(service_path);
 CREATE INDEX IF NOT EXISTS idx_extension_import ON cds_services(extension_module_specifier, extension_imported_symbol, is_extend);
@@ -119,9 +137,11 @@ CREATE INDEX IF NOT EXISTS idx_calls_repo ON outbound_calls(repo_id, call_type);
 CREATE INDEX IF NOT EXISTS idx_symbol_calls_caller ON symbol_calls(repo_id, caller_symbol_id);
 CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts5(kind, name, path, repo);
 `;
+var schemaSql = `${schemaTablesSql}
+${schemaIndexesSql}`;
 
 // src/db/migrations.ts
-var CURRENT_SCHEMA_VERSION = 10;
+var CURRENT_SCHEMA_VERSION = 11;
 var columns = {
   handler_methods: [
     { name: "decorator_resolution_json", ddl: "ALTER TABLE handler_methods ADD COLUMN decorator_resolution_json TEXT NOT NULL DEFAULT '{}'" }
@@ -177,7 +197,8 @@ var columns = {
     { name: "external_target_dynamic", ddl: "ALTER TABLE outbound_calls ADD COLUMN external_target_dynamic INTEGER NOT NULL DEFAULT 0" }
   ],
   index_runs: [
-    { name: "error_message", ddl: "ALTER TABLE index_runs ADD COLUMN error_message TEXT" }
+    { name: "error_message", ddl: "ALTER TABLE index_runs ADD COLUMN error_message TEXT" },
+    { name: "owner_pid", ddl: "ALTER TABLE index_runs ADD COLUMN owner_pid INTEGER" }
   ]
 };
 function hasColumn(db, table, column) {
@@ -202,8 +223,9 @@ function migrate(db) {
   db.transaction(() => {
     const version = userVersion(db);
     if (version > CURRENT_SCHEMA_VERSION) throw new Error(`Unsupported future service-flow schema version ${version}`);
-    db.exec(schemaSql);
+    db.exec(schemaTablesSql);
     addMissingColumns(db);
+    db.exec(schemaIndexesSql);
     normalizeLegacyStatus(db);
     const violations = db.pragma("foreign_key_check");
     if (violations.length > 0) throw new Error("SQLite foreign_key_check failed during migration");
@@ -214,7 +236,7 @@ function migrate(db) {
 // package.json
 var package_default = {
   name: "@saptools/service-flow",
-  version: "0.1.50",
+  version: "0.1.52",
   description: "Trace SAP CAP service-to-service flows across multi-repository workspaces with runtime-aware graph resolution",
   type: "module",
   publishConfig: {
@@ -356,8 +378,8 @@ function openDatabase(dbPath, options = {}) {
     },
     transaction(fn) {
       if (inTransaction) return fn();
-      inTransaction = true;
       native.exec("BEGIN IMMEDIATE");
+      inTransaction = true;
       try {
         const result = fn();
         native.exec("COMMIT");
@@ -385,410 +407,6 @@ function openReadOnlyDatabase(dbPath) {
   return openDatabase(dbPath, { readonly: true, migrate: false });
 }
 
-// src/db/repositories.ts
-function upsertWorkspace(db, rootPath, dbPath) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.prepare(
-    "INSERT INTO workspaces(root_path,db_path,created_at,updated_at) VALUES(?,?,?,?) ON CONFLICT(root_path) DO UPDATE SET db_path=excluded.db_path,updated_at=excluded.updated_at"
-  ).run(rootPath, dbPath, now, now);
-  return Number(
-    db.prepare("SELECT id FROM workspaces WHERE root_path=?").get(rootPath)?.id
-  );
-}
-function getWorkspace(db, rootPath) {
-  return db.prepare("SELECT * FROM workspaces WHERE root_path=?").get(rootPath);
-}
-function upsertRepository(db, workspaceId, r) {
-  db.prepare(
-    `INSERT INTO repositories(workspace_id,name,absolute_path,relative_path,package_name,package_version,dependencies_json,kind,is_git_repo) VALUES(?,?,?,?,?,?,?,?,?) ON CONFLICT(workspace_id,absolute_path) DO UPDATE SET name=excluded.name,relative_path=excluded.relative_path,package_name=excluded.package_name,package_version=excluded.package_version,dependencies_json=excluded.dependencies_json,kind=excluded.kind`
-  ).run(
-    workspaceId,
-    r.name,
-    r.absolutePath,
-    r.relativePath,
-    r.packageName,
-    r.packageVersion,
-    JSON.stringify(r.dependencies ?? {}),
-    r.kind ?? "unknown",
-    r.isGitRepo ? 1 : 0
-  );
-  return Number(
-    db.prepare(
-      "SELECT id FROM repositories WHERE workspace_id=? AND absolute_path=?"
-    ).get(workspaceId, r.absolutePath)?.id
-  );
-}
-function listRepositories(db) {
-  return db.prepare("SELECT * FROM repositories ORDER BY name").all();
-}
-function repoByName(db, name) {
-  return db.prepare("SELECT * FROM repositories WHERE name=? OR package_name=?").get(name, name);
-}
-function clearRepoFacts(db, repoId) {
-  for (const t of [
-    "cds_requires",
-    "cds_services",
-    "handler_classes",
-    "outbound_calls",
-    "symbol_calls",
-    "handler_registrations",
-    "service_bindings",
-    "symbols",
-    "diagnostics",
-    "files"
-  ])
-    db.prepare(`DELETE FROM ${t} WHERE repo_id=?`).run(repoId);
-  db.prepare("DELETE FROM search_index WHERE repo=?").run(String(repoId));
-}
-function insertRequires(db, repoId, rows) {
-  const stmt = db.prepare(
-    "INSERT INTO cds_requires(repo_id,alias,kind,model,destination,service_path,request_timeout,raw_json) VALUES(?,?,?,?,?,?,?,?)"
-  );
-  for (const r of rows)
-    stmt.run(
-      repoId,
-      r.alias,
-      r.kind,
-      r.model,
-      r.destination,
-      r.servicePath,
-      r.requestTimeout,
-      r.rawJson
-    );
-}
-function insertService(db, repoId, s) {
-  const id = Number(
-    db.prepare(
-      "INSERT INTO cds_services(repo_id,namespace,service_name,qualified_name,service_path,is_extend,source_file,source_line,extension_local_ref,extension_imported_symbol,extension_local_alias,extension_module_specifier,extension_import_kind) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?) RETURNING id"
-    ).get(
-      repoId,
-      s.namespace,
-      s.serviceName,
-      s.qualifiedName,
-      s.servicePath,
-      s.isExtend ? 1 : 0,
-      s.sourceFile,
-      s.sourceLine,
-      s.extension?.localReference,
-      s.extension?.importedSymbol,
-      s.extension?.localAlias,
-      s.extension?.moduleSpecifier,
-      s.extension?.importKind
-    )?.id
-  );
-  const stmt = db.prepare(
-    "INSERT INTO cds_operations(service_id,operation_type,operation_name,operation_path,params_json,return_type,source_file,source_line,provenance,base_operation_id) VALUES(?,?,?,?,?,?,?,?,?,?)"
-  );
-  db.prepare(
-    "INSERT INTO search_index(kind,name,path,repo) VALUES(?,?,?,?)"
-  ).run("service", s.qualifiedName, s.servicePath, String(repoId));
-  for (const o of s.operations)
-    stmt.run(
-      id,
-      o.operationType,
-      o.operationName,
-      o.operationPath,
-      o.paramsJson,
-      o.returnType,
-      o.sourceFile,
-      o.sourceLine,
-      o.provenance ?? "direct",
-      o.baseOperationId ?? null
-    );
-  const search = db.prepare(
-    "INSERT INTO search_index(kind,name,path,repo) VALUES(?,?,?,?)"
-  );
-  for (const o of s.operations)
-    search.run("operation", o.operationName, o.operationPath, String(repoId));
-  return id;
-}
-function insertHandler(db, repoId, h) {
-  const sid = Number(
-    db.prepare(
-      "INSERT INTO symbols(repo_id,kind,name,qualified_name,exported,start_line,end_line) VALUES(?,?,?,?,?,?,?) RETURNING id"
-    ).get(
-      repoId,
-      "class",
-      h.className,
-      h.className,
-      1,
-      h.sourceLine,
-      h.sourceLine
-    )?.id
-  );
-  const hid = Number(
-    db.prepare(
-      "INSERT INTO handler_classes(repo_id,symbol_id,class_name,source_file,source_line) VALUES(?,?,?,?,?) RETURNING id"
-    ).get(repoId, sid, h.className, h.sourceFile, h.sourceLine)?.id
-  );
-  const stmt = db.prepare(
-    "INSERT INTO handler_methods(handler_class_id,method_name,decorator_kind,decorator_value,decorator_raw_expression,decorator_resolution_json,source_file,source_line) VALUES(?,?,?,?,?,?,?,?)"
-  );
-  for (const m of h.methods)
-    stmt.run(
-      hid,
-      m.methodName,
-      m.decoratorKind,
-      m.decoratorValue,
-      m.decoratorRawExpression,
-      JSON.stringify(m.decoratorResolution),
-      m.sourceFile,
-      m.sourceLine
-    );
-  return hid;
-}
-function insertRegistrations(db, repoId, rows) {
-  const stmt = db.prepare(
-    "INSERT INTO handler_registrations(repo_id,handler_class_id,class_name,import_source,registration_file,registration_line,registration_kind,confidence) VALUES(?,?,?,?,?,?,?,?)"
-  );
-  for (const r of rows) {
-    const handlerClass = r.className ? db.prepare(
-      "SELECT id FROM handler_classes WHERE repo_id=? AND class_name=? ORDER BY id"
-    ).all(repoId, r.className) : [];
-    stmt.run(
-      repoId,
-      handlerClass.length === 1 ? handlerClass[0]?.id : null,
-      r.className,
-      r.importSource,
-      r.registrationFile,
-      r.registrationLine,
-      r.registrationKind,
-      r.confidence
-    );
-  }
-}
-function insertBindings(db, repoId, rows) {
-  const stmt = db.prepare(
-    "INSERT INTO service_bindings(repo_id,symbol_id,variable_name,alias,alias_expr,destination_expr,service_path_expr,is_dynamic,placeholders_json,source_file,source_line,helper_chain_json) VALUES(?,(SELECT id FROM symbols WHERE repo_id=? AND source_file=? AND start_line<=? AND end_line>=? ORDER BY (end_line-start_line),id LIMIT 1),?,?,?,?,?,?,?,?,?,?)"
-  );
-  for (const r of rows)
-    stmt.run(
-      repoId,
-      repoId,
-      r.sourceFile,
-      r.sourceLine,
-      r.sourceLine,
-      r.variableName,
-      r.alias,
-      r.aliasExpr,
-      r.destinationExpr,
-      r.servicePathExpr,
-      r.isDynamic ? 1 : 0,
-      JSON.stringify(r.placeholders),
-      r.sourceFile,
-      r.sourceLine,
-      r.helperChain ? JSON.stringify(r.helperChain) : null
-    );
-}
-function insertExecutableSymbols(db, repoId, rows) {
-  const stmt = db.prepare("INSERT INTO symbols(repo_id,file_id,kind,name,qualified_name,exported,start_line,end_line,start_offset,end_offset,source_file,exported_name,evidence_json) VALUES(?,(SELECT id FROM files WHERE repo_id=? AND relative_path=?),?,?,?,?,?,?,?,?,?,?,?)");
-  for (const r of rows) stmt.run(repoId, repoId, r.sourceFile, r.kind, r.localName, r.qualifiedName, r.exported ? 1 : 0, r.startLine, r.endLine, r.startOffset, r.endOffset, r.sourceFile, r.exportedName, r.importExportEvidence ? JSON.stringify(r.importExportEvidence) : null);
-}
-function insertSymbolCalls(db, repoId, rows) {
-  const callerStmt = db.prepare("SELECT id FROM symbols WHERE repo_id=? AND source_file=? AND qualified_name=? ORDER BY id LIMIT 1");
-  const insertStmt = db.prepare("INSERT INTO symbol_calls(repo_id,caller_symbol_id,callee_symbol_id,callee_expression,import_source,source_file,source_line,status,confidence,evidence_json,unresolved_reason) VALUES(?,?,?,?,?,?,?,?,?,?,?)");
-  for (const r of rows) {
-    const caller = callerStmt.get(repoId, r.sourceFile, r.callerQualifiedName);
-    const target = resolveSymbolCallTarget(db, repoId, r);
-    insertStmt.run(repoId, caller?.id, target.id, r.calleeExpression, r.importSource, r.sourceFile, r.sourceLine, target.status, 0.8, JSON.stringify({ ...r.evidence, candidateStrategy: target.strategy, candidateCount: target.candidateCount }), target.reason);
-  }
-}
-function isRelativeImportedSymbolCall(r) {
-  return Boolean(r.importSource?.startsWith("."));
-}
-function resolveSymbolCallTarget(db, repoId, r) {
-  const evidence = r.evidence;
-  const localRows = db.prepare("SELECT id FROM symbols WHERE repo_id=? AND source_file=? AND (name=? OR qualified_name=?) ORDER BY id").all(repoId, r.sourceFile, r.calleeLocalName, r.calleeLocalName);
-  if (localRows.length === 1) return { id: localRows[0]?.id ?? null, status: "resolved", reason: null, strategy: "same_file_exact", candidateCount: 1 };
-  if (localRows.length > 1) return { id: null, status: "ambiguous", reason: "Multiple same-file symbol targets matched exactly", strategy: "same_file_exact", candidateCount: localRows.length };
-  if (evidence.relation === "class_instance_method" && isRelativeImportedSymbolCall(r)) {
-    const classRows = db.prepare("SELECT id FROM symbols WHERE repo_id=? AND source_file<>? AND qualified_name=? ORDER BY id").all(repoId, r.sourceFile, r.calleeLocalName);
-    if (classRows.length === 1) return { id: classRows[0]?.id ?? null, status: "resolved", reason: null, strategy: "relative_import_class_instance_method", candidateCount: 1 };
-    if (classRows.length > 1) return { id: null, status: "ambiguous", reason: "Multiple relative class instance method targets matched exactly", strategy: "relative_import_class_instance_method", candidateCount: classRows.length };
-  }
-  const rows = db.prepare("SELECT id,kind,evidence_json evidenceJson FROM symbols WHERE repo_id=? AND source_file<>? AND exported=1 AND (exported_name=? OR name=? OR qualified_name=?) ORDER BY id").all(repoId, r.sourceFile, r.calleeLocalName, r.calleeLocalName, r.calleeLocalName);
-  if (evidence.relation === "relative_import_proxy_member" && rows.length > 1) {
-    const objectMapRows = rows.filter((row) => String(row.evidenceJson ?? "").includes("exported_object_shorthand") || String(row.evidenceJson ?? "").includes("exported_object_literal"));
-    if (objectMapRows.length > 0) {
-      const concrete = rows.find((row) => row.kind !== "object_alias") ?? objectMapRows[0];
-      return { id: concrete?.id ?? null, status: "resolved", reason: null, strategy: "proxy_member_exported_object_map", candidateCount: rows.length };
-    }
-    return { id: null, status: "ambiguous", reason: "Proxy member target requires explicit factory/module/type evidence; global member name is ambiguous", strategy: "proxy_member_no_global_name_fallback", candidateCount: rows.length };
-  }
-  if (rows.length === 1) return { id: rows[0]?.id ?? null, status: "resolved", reason: null, strategy: evidence.relation === "relative_import_proxy_member" ? "proxy_member_unique_exported_candidate" : "relative_import_exported_exact", candidateCount: 1 };
-  if (rows.length > 1) return { id: null, status: "ambiguous", reason: "Multiple exported symbol targets matched exactly", strategy: "exported_exact", candidateCount: rows.length };
-  return { id: null, status: "unresolved", reason: "No local symbol target matched exactly", strategy: evidence.relation === "relative_import_proxy_member" ? "proxy_member_no_global_name_fallback" : "exact_symbol_match", candidateCount: 0 };
-}
-function insertCalls(db, repoId, rows) {
-  const stmt = db.prepare(
-    "INSERT INTO outbound_calls(repo_id,source_symbol_id,call_type,method,operation_path_expr,query_entity,event_name_expr,payload_summary,source_file,source_line,confidence,unresolved_reason,local_service_name,local_service_lookup,alias_chain_json,evidence_json,external_target_kind,external_target_id,external_target_label,external_target_dynamic,service_binding_id) VALUES(?,COALESCE((SELECT id FROM symbols WHERE repo_id=? AND source_file=? AND qualified_name=? ORDER BY id LIMIT 1),(SELECT id FROM symbols WHERE repo_id=? AND source_file=? AND start_line<=? AND end_line>=? ORDER BY (end_line-start_line),id LIMIT 1)),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"
-  );
-  for (const r of rows) {
-    const binding = resolvePersistedBinding(db, repoId, r);
-    const evidence = {
-      ...r.evidence ?? {},
-      serviceBindingResolution: binding.evidence
-    };
-    stmt.run(
-      repoId,
-      repoId,
-      r.sourceFile,
-      r.sourceSymbolQualifiedName,
-      repoId,
-      r.sourceFile,
-      r.sourceLine,
-      r.sourceLine,
-      r.callType,
-      r.method,
-      r.operationPathExpr,
-      r.queryEntity,
-      r.eventNameExpr,
-      r.payloadSummary,
-      r.sourceFile,
-      r.sourceLine,
-      r.confidence,
-      r.unresolvedReason ?? binding.unresolvedReason,
-      r.localServiceName,
-      r.localServiceLookup,
-      r.aliasChain ? JSON.stringify(r.aliasChain) : null,
-      JSON.stringify(evidence),
-      r.externalTarget?.kind ?? null,
-      r.externalTarget?.stableId ?? null,
-      r.externalTarget?.label ?? null,
-      r.externalTarget?.dynamic ? 1 : 0,
-      binding.bindingId
-    );
-  }
-}
-function resolvePersistedBinding(db, repoId, call) {
-  if (!call.serviceVariableName)
-    return { bindingId: null, evidence: { status: "not_applicable", candidateCount: 0 } };
-  const candidates = bindingCandidates(db, repoId, call);
-  const prior = candidates.filter((candidate) => candidate.sourceLine <= call.sourceLine);
-  const families = new Set(prior.map(bindingSignature));
-  if (prior.length > 0 && families.size === 1) {
-    const selected = prior.at(-1);
-    return {
-      bindingId: selected?.id ?? null,
-      evidence: bindingEvidence("selected", prior, selected)
-    };
-  }
-  if (prior.length > 1) {
-    return {
-      bindingId: null,
-      unresolvedReason: "ambiguous_service_binding_candidates",
-      evidence: bindingEvidence("ambiguous", prior)
-    };
-  }
-  if (candidates.length > 0) {
-    return {
-      bindingId: null,
-      unresolvedReason: "service_binding_declared_after_call",
-      evidence: bindingEvidence("rejected_future_binding", candidates)
-    };
-  }
-  return {
-    bindingId: null,
-    evidence: bindingEvidence("unrecoverable", [])
-  };
-}
-function bindingCandidates(db, repoId, call) {
-  const ownerId = callSymbolId(db, repoId, call);
-  const rows = db.prepare(`
-    SELECT id,symbol_id symbolId,variable_name variableName,alias,alias_expr aliasExpr,
-      destination_expr destinationExpr,service_path_expr servicePathExpr,
-      source_file sourceFile,source_line sourceLine,helper_chain_json helperChainJson
-    FROM service_bindings
-    WHERE repo_id=? AND variable_name=? AND source_file=?
-      AND (? IS NULL OR symbol_id IS NULL OR symbol_id=?)
-    ORDER BY source_line,id
-  `).all(
-    repoId,
-    call.serviceVariableName,
-    call.sourceFile,
-    ownerId,
-    ownerId
-  );
-  return rows.flatMap((row) => {
-    if (typeof row.id !== "number" || typeof row.variableName !== "string" || typeof row.sourceFile !== "string" || typeof row.sourceLine !== "number")
-      return [];
-    return [{
-      id: row.id,
-      symbolId: nullableNumber(row.symbolId),
-      variableName: row.variableName,
-      alias: nullableString(row.alias),
-      aliasExpr: nullableString(row.aliasExpr),
-      destinationExpr: nullableString(row.destinationExpr),
-      servicePathExpr: nullableString(row.servicePathExpr),
-      sourceFile: row.sourceFile,
-      sourceLine: row.sourceLine,
-      helperChainJson: nullableString(row.helperChainJson)
-    }];
-  });
-}
-function nullableString(value) {
-  return value === null || typeof value === "string" ? value : void 0;
-}
-function nullableNumber(value) {
-  return value === null || typeof value === "number" ? value : void 0;
-}
-function callSymbolId(db, repoId, call) {
-  const row = db.prepare(`
-    SELECT id FROM symbols
-    WHERE repo_id=? AND source_file=?
-      AND ((? IS NOT NULL AND qualified_name=?)
-        OR (start_line<=? AND end_line>=?))
-    ORDER BY CASE WHEN qualified_name=? THEN 0 ELSE 1 END,
-      (end_line-start_line),id
-    LIMIT 1
-  `).get(
-    repoId,
-    call.sourceFile,
-    call.sourceSymbolQualifiedName,
-    call.sourceSymbolQualifiedName,
-    call.sourceLine,
-    call.sourceLine,
-    call.sourceSymbolQualifiedName
-  );
-  return typeof row?.id === "number" ? row.id : void 0;
-}
-function bindingEvidence(status, candidates, selected) {
-  return {
-    status,
-    candidateCount: candidates.length,
-    selectedBindingId: selected?.id,
-    sourceOrderRule: "binding_source_line_must_not_follow_call",
-    candidates: candidates.map((candidate) => ({
-      bindingId: candidate.id,
-      symbolId: candidate.symbolId,
-      variableName: candidate.variableName,
-      alias: candidate.alias,
-      aliasExpr: candidate.aliasExpr,
-      destinationExpr: candidate.destinationExpr,
-      servicePathExpr: candidate.servicePathExpr,
-      sourceFile: candidate.sourceFile,
-      sourceLine: candidate.sourceLine,
-      helperChain: parseBindingChain(candidate.helperChainJson)
-    }))
-  };
-}
-function bindingSignature(candidate) {
-  return JSON.stringify([
-    candidate.alias,
-    candidate.aliasExpr,
-    candidate.destinationExpr,
-    candidate.servicePathExpr
-  ]);
-}
-function parseBindingChain(value) {
-  if (!value) return void 0;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return void 0;
-  }
-}
-
 // src/discovery/classify-repository.ts
 import fs3 from "fs/promises";
 import path3 from "path";
@@ -1021,9 +639,16 @@ function parameterBindings(params) {
     return [];
   });
 }
-async function parseExecutableSymbols(repoPath, filePath) {
-  const text = await fs4.readFile(path4.join(repoPath, filePath), "utf8");
-  const source = ts.createSourceFile(filePath, text, ts.ScriptTarget.Latest, true, filePath.endsWith(".ts") ? ts.ScriptKind.TS : ts.ScriptKind.JS);
+async function parseExecutableSymbols(repoPath, filePath, context) {
+  const snapshot = context?.get(filePath);
+  const text = snapshot?.text ?? await fs4.readFile(path4.join(repoPath, filePath), "utf8");
+  const source = snapshot?.sourceFile() ?? ts.createSourceFile(
+    filePath,
+    text,
+    ts.ScriptTarget.Latest,
+    true,
+    filePath.endsWith(".ts") ? ts.ScriptKind.TS : ts.ScriptKind.JS
+  );
   const sourceFile = normalizePath(filePath);
   const symbols = [];
   const calls = [];
@@ -1199,27 +824,38 @@ async function parseExecutableSymbols(repoPath, filePath) {
 // src/utils/hashing.ts
 import { createHash } from "crypto";
 import { readFile } from "fs/promises";
-async function sha256File(filePath) {
-  return createHash("sha256").update(await readFile(filePath)).digest("hex");
-}
 function sha256Text(text) {
   return createHash("sha256").update(text).digest("hex");
 }
 
 // src/indexer/repository-indexer.ts
-async function prepareRepositoryIndex(repo, force) {
+async function prepareRepositoryIndex(repo, force, instrumentation) {
   const sourceFiles = await findSourceFiles(repo.absolute_path);
-  const packageFacts = await parsePackageJson(repo.absolute_path);
-  const fingerprint = await repositoryFingerprint(repo.absolute_path, sourceFiles, packageFacts);
+  const packageSnapshot = await loadPackageJsonSnapshot(repo.absolute_path, {
+    strict: true,
+    allowMissing: repo.package_name === null
+  });
+  const packageFacts = packageSnapshot.facts;
+  const sources = await loadRepositorySourceContext(
+    repo.absolute_path,
+    sourceFiles,
+    instrumentation
+  );
+  const fingerprint = repositoryFingerprint(
+    sources,
+    packageFacts,
+    packageSnapshot.rawText
+  );
   if (!force && repo.fingerprint === fingerprint) return { repo, fileCount: 0, diagnosticCount: 0, skipped: true };
+  const parsed = await parseAllSourceFacts(repo.absolute_path, sources);
   return {
     repo,
     packageFacts,
     fingerprint,
     kind: await classifyRepository(repo.absolute_path, packageFacts),
-    parsed: await parseAllSourceFacts(repo.absolute_path, sourceFiles),
+    parsed,
     fileCount: sourceFiles.length,
-    diagnosticCount: 0,
+    diagnosticCount: parsed.handlers.filter((handler) => handler.hasHandlerDecorator && (handler.methods.length === 0 || handler.methods.some((method) => !handlerMethodIsExecutable(method)))).length,
     skipped: false
   };
 }
@@ -1248,21 +884,20 @@ function recordIndexFailure(db, repoId, error) {
   db.prepare("DELETE FROM diagnostics WHERE repo_id=? AND code IN ('index_failed_snapshot_preserved','source_read_failed')").run(repoId);
   db.prepare("INSERT INTO diagnostics(repo_id,severity,code,message) VALUES(?,?,?,?)").run(repoId, "error", "source_read_failed", `Index failed before publication; previous facts and fingerprint were preserved. ${message}`);
 }
-async function parseAllSourceFacts(root, files) {
+async function parseAllSourceFacts(root, sources) {
   const facts = { services: [], handlers: [], registrations: [], bindings: [], calls: [], symbols: [], symbolCalls: [], fileRecords: [] };
-  for (const file of files) {
-    const abs = path5.join(root, file);
-    const stat = await fs5.stat(abs);
-    facts.fileRecords.push({ relativePath: normalizePath(file), extension: path5.extname(file), sha256: await sha256File(abs), sizeBytes: stat.size });
-    if (file.endsWith(".cds")) facts.services.push(...await parseCdsFile(root, file));
+  for (const snapshot of sources.entries()) {
+    const file = snapshot.filePath;
+    facts.fileRecords.push({ relativePath: normalizePath(file), extension: path5.extname(file), sha256: sha256Text(snapshot.text), sizeBytes: snapshot.sizeBytes });
+    if (file.endsWith(".cds")) facts.services.push(...await parseCdsFile(root, file, sources));
     if (/\.[jt]s$/.test(file)) {
-      facts.handlers.push(...await parseDecorators(root, file));
-      facts.registrations.push(...await parseHandlerRegistrations(root, file));
-      facts.bindings.push(...await parseServiceBindings(root, file));
-      const symbolFacts = await parseExecutableSymbols(root, file);
+      facts.handlers.push(...await parseDecorators(root, file, sources));
+      facts.registrations.push(...await parseHandlerRegistrations(root, file, sources));
+      facts.bindings.push(...await parseServiceBindings(root, file, sources));
+      const symbolFacts = await parseExecutableSymbols(root, file, sources);
       facts.symbols.push(...symbolFacts.symbols);
       facts.symbolCalls.push(...symbolFacts.calls);
-      facts.calls.push(...await parseOutboundCalls(root, file));
+      facts.calls.push(...await parseOutboundCalls(root, file, sources));
     }
   }
   return facts;
@@ -1270,7 +905,7 @@ async function parseAllSourceFacts(root, files) {
 async function findSourceFiles(root) {
   const out = [];
   async function walk(dir, prefix = "") {
-    const entries = await fs5.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fs5.readdir(dir, { withFileTypes: true });
     for (const e of entries) {
       const rel = prefix ? `${prefix}/${e.name}` : e.name;
       if (e.isDirectory()) {
@@ -1286,8 +921,7 @@ function isDefaultTestFile(relativeFile) {
   if (parts.some((part) => ["test", "tests", "__tests__"].includes(part))) return true;
   return /\.(test|spec)\.[jt]s$/.test(parts.at(-1) ?? "");
 }
-async function repositoryFingerprint(root, files, facts) {
-  const packageJson = await fs5.readFile(path5.join(root, "package.json"), "utf8").catch(() => "");
+function repositoryFingerprint(sources, facts, packageJsonText) {
   const normalizedFacts = {
     analyzerVersion: ANALYZER_VERSION,
     packageName: facts.packageName,
@@ -1296,13 +930,11 @@ async function repositoryFingerprint(root, files, facts) {
     cdsRequires: [...facts.cdsRequires].sort((a, b) => a.alias.localeCompare(b.alias)),
     scripts: Object.fromEntries(Object.entries(facts.scripts).sort()),
     includeTests: false,
-    packageJsonHash: sha256Text(packageJson)
+    packageJsonHash: sha256Text(packageJsonText)
   };
   const entries = [`facts:${JSON.stringify(normalizedFacts)}`];
-  for (const file of files) {
-    const content = await fs5.readFile(path5.join(root, file), "utf8");
-    entries.push(`${file}:${sha256Text(content)}`);
-  }
+  for (const snapshot of sources.entries())
+    entries.push(`${snapshot.filePath}:${sha256Text(snapshot.text)}`);
   return sha256Text(entries.join("\n"));
 }
 
@@ -1406,10 +1038,67 @@ function packageNameFromSpecifier(specifier) {
 }
 
 // src/indexer/workspace-indexer.ts
+var LEGACY_OWNER_RECOVERY_MS = 60 * 60 * 1e3;
+function ownerPid(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const ownerIsMissing = typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH";
+    return !ownerIsMissing;
+  }
+}
+function isRecoverableRun(row, now) {
+  const pid = ownerPid(row.ownerPid);
+  if (pid !== void 0) return !processIsAlive(pid);
+  if (typeof row.startedAt !== "string") return false;
+  const startedAt = Date.parse(row.startedAt);
+  return Number.isFinite(startedAt) && now - startedAt >= LEGACY_OWNER_RECOVERY_MS;
+}
+function recoveredOwnerMessage(row) {
+  const pid = ownerPid(row.ownerPid);
+  return pid === void 0 ? "Recovered stale legacy index writer without owner process metadata." : `Recovered stale index writer because owner process ${pid} is no longer running.`;
+}
+function claimIndexRun(db, workspaceId, repoCount) {
+  try {
+    return db.transaction(() => {
+      const now = Date.now();
+      const rows = db.prepare("SELECT id,workspace_id workspaceId,owner_pid ownerPid,started_at startedAt FROM index_runs WHERE status='running' ORDER BY id").all();
+      const active = rows.find((row) => !isRecoverableRun(row, now));
+      if (active) {
+        const pid = ownerPid(active.ownerPid);
+        const owner = pid === void 0 ? "an unknown owner" : `process ${pid}`;
+        throw new Error(`index_writer_active: this database is already being indexed for workspace ${String(active.workspaceId ?? "unknown")} by ${owner}; wait for that writer to finish.`);
+      }
+      const finish = db.prepare(
+        "UPDATE index_runs SET finished_at=?,status='failed',error_message=? WHERE id=?"
+      );
+      for (const row of rows)
+        finish.run(new Date(now).toISOString(), recoveredOwnerMessage(row), row.id);
+      const inserted = db.prepare("INSERT INTO index_runs(workspace_id,started_at,status,repo_count,file_count,diagnostic_count,owner_pid) VALUES(?,?,?,?,?,?,?) RETURNING id").get(workspaceId, new Date(now).toISOString(), "running", repoCount, 0, 0, process.pid);
+      const runId = Number(inserted?.id);
+      if (!Number.isSafeInteger(runId)) throw new Error("index_writer_claim_failed: SQLite did not return an index run identifier.");
+      return runId;
+    });
+  } catch (error) {
+    if (/\b(?:locked|busy)\b/i.test(errorMessage(error)))
+      throw new Error(
+        "index_writer_coordination_failed: SQLite remained busy beyond the bounded writer-claim interval; wait for the active publication to finish.",
+        { cause: error }
+      );
+    throw error;
+  }
+}
 async function indexWorkspace(db, workspaceId, options) {
-  const started = (/* @__PURE__ */ new Date()).toISOString();
-  const repos = options.repo ? [repoByName(db, options.repo)].filter((r) => r !== void 0) : listRepositories(db);
-  const runId = Number(db.prepare("INSERT INTO index_runs(workspace_id,started_at,status,repo_count,file_count,diagnostic_count) VALUES(?,?,?,?,?,?) RETURNING id").get(workspaceId, started, "running", repos.length, 0, 0)?.id);
+  const repos = options.repo ? reposByName(db, options.repo, workspaceId) : listRepositories(db, workspaceId);
+  if (options.repo && repos.length === 0)
+    throw new Error(`selector_repo_not_found: no indexed repository matched ${options.repo}.`);
+  if (options.repo && repos.length > 1)
+    throw new Error(`selector_repo_ambiguous: repository selector ${options.repo} matched ${repos.length} repositories; use a unique repository name.`);
+  const runId = claimIndexRun(db, workspaceId, repos.length);
   let fileCount = 0;
   let diagnosticCount = 0;
   let skippedCount = 0;
@@ -1431,12 +1120,12 @@ async function indexWorkspace(db, workspaceId, options) {
       }
       if (options.injectDerivedMaterializationFailure) throw new Error("Injected derived materialization failure");
       materializeCdsExtensionOperations(db, workspaceId);
-      db.prepare("UPDATE index_runs SET finished_at=?, status=?, file_count=?, diagnostic_count=? WHERE id=?").run((/* @__PURE__ */ new Date()).toISOString(), diagnosticCount ? "failed" : "success", fileCount, diagnosticCount, runId);
+      db.prepare("UPDATE index_runs SET finished_at=?, status='success', file_count=?, diagnostic_count=? WHERE id=?").run((/* @__PURE__ */ new Date()).toISOString(), fileCount, diagnosticCount, runId);
     });
     return { repoCount: repos.length, indexedCount: repos.length - skippedCount, skippedCount, fileCount, diagnosticCount };
   } catch (error) {
-    if (activeRepoId && preparedRows.length < repos.length) recordIndexFailure(db, activeRepoId, error);
     db.prepare("UPDATE index_runs SET finished_at=?, status='failed', file_count=?, diagnostic_count=?, error_message=? WHERE id=?").run((/* @__PURE__ */ new Date()).toISOString(), fileCount, diagnosticCount + 1, errorMessage(error), runId);
+    if (activeRepoId && preparedRows.length < repos.length) recordIndexFailure(db, activeRepoId, error);
     throw error;
   }
 }
@@ -2050,21 +1739,63 @@ function renderTraceTable(result) {
 }
 function diagnosticLines(diagnostic) {
   const first = `${String(diagnostic.severity ?? "info")} ${String(diagnostic.code ?? "diagnostic")} ${String(diagnostic.message ?? "")}`;
-  return [first, ...hintLines(diagnostic).map((hint) => `  ${hint}`)];
+  const details = diagnosticDetailLines(diagnostic);
+  return [first, ...[...details, ...hintLines(diagnostic)].map((hint) => `  ${hint}`)];
+}
+function diagnosticDetailLines(diagnostic) {
+  const lines = [];
+  if (diagnostic.sourceFile || diagnostic.sourceLine)
+    lines.push(`at ${String(diagnostic.sourceFile ?? "")}:${String(diagnostic.sourceLine ?? "")}`);
+  const unsupported = stringList(diagnostic.unsupportedDecoratorNames);
+  const observed = stringList(diagnostic.observedDecoratorNames);
+  if (unsupported.length > 0)
+    lines.push(`unsupported decorators: ${unsupported.join(", ")}`);
+  else if (observed.length > 0)
+    lines.push(`observed decorators: ${observed.join(", ")}`);
+  if (typeof diagnostic.remediation === "string")
+    lines.push(`hint: ${diagnostic.remediation}`);
+  return lines;
+}
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function hintLines(evidence) {
+  const dynamicLines = dynamicHintLines(evidence);
   const suggestions = evidence.implementationHintSuggestions;
-  if (!Array.isArray(suggestions)) return [];
+  if (!Array.isArray(suggestions)) return dynamicLines;
   const hints = suggestions.flatMap((item) => isRecord(item) && typeof item.cli === "string" ? [item.cli] : []);
   const unique = [...new Set(hints)];
   const shown = unique.slice(0, 3).map((hint) => `try ${hint}`);
   if (unique.length > shown.length)
     shown.push(`... ${unique.length - shown.length} more hint(s) available in JSON`);
-  return shown;
+  return [...dynamicLines, ...shown];
+}
+function dynamicHintLines(evidence) {
+  const exploration = isRecord(evidence.dynamicTargetExploration) ? evidence.dynamicTargetExploration : evidence;
+  const count = numberValue(exploration.candidateCount);
+  if (count === 0) return [];
+  const shown = numberValue(exploration.shownCandidateCount);
+  const omitted = numberValue(exploration.omittedCandidateCount);
+  const rejected = numberValue(exploration.rejectedCandidateCount);
+  const lines = [
+    `viable candidates: ${shown} shown, ${omitted} omitted; rejected: ${rejected}`
+  ];
+  lines.push(...varSetHints(exploration.suggestedVarSets));
+  if (omitted > 0 || rejected > 0 || shown < count)
+    lines.push("use --dynamic-mode candidates --max-dynamic-candidates 20 to explore candidate branches");
+  return lines;
+}
+function varSetHints(value) {
+  if (!Array.isArray(value)) return [];
+  const hints = value.flatMap((item) => isRecord(item) && typeof item.cli === "string" ? [`try ${item.cli}`] : []);
+  return [...new Set(hints)].slice(0, 3);
 }
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
 
 // src/output/json-output.ts
 function renderJson(value) {
@@ -2179,6 +1910,65 @@ function renderMermaid(trace2) {
 `;
 }
 
+// src/cli/000-clean.ts
+import fs6 from "fs/promises";
+import path6 from "path";
+async function cleanWorkspaceState(config, dbOnly) {
+  const dbDir = path6.resolve(path6.dirname(config.dbPath));
+  if (!dbOnly) await assertOwnedStateDirectory(dbDir, config.rootPath);
+  const runId = claimCleanWriter(config);
+  try {
+    if (dbOnly) await removeDatabaseFiles(config.dbPath);
+    else await fs6.rm(dbDir, { recursive: true, force: true });
+  } catch (error) {
+    await markCleanClaimFailed(config.dbPath, runId, error);
+    throw error;
+  }
+}
+function claimCleanWriter(config) {
+  const db = openDatabase(config.dbPath);
+  try {
+    const workspaceId = getWorkspace(db, config.rootPath)?.id ?? upsertWorkspace(db, config.rootPath, config.dbPath);
+    return claimIndexRun(db, workspaceId, 0);
+  } finally {
+    db.close();
+  }
+}
+async function assertOwnedStateDirectory(dbDir, rootPath) {
+  const marker = path6.join(dbDir, ".service-flow-state");
+  const dangerous = /* @__PURE__ */ new Set([
+    path6.parse(dbDir).root,
+    "/tmp",
+    process.env.HOME ? path6.resolve(process.env.HOME) : "",
+    path6.resolve(rootPath)
+  ]);
+  const ownsState = await fs6.stat(marker).then((stat) => stat.isFile()).catch(() => false);
+  if (!ownsState || dangerous.has(dbDir))
+    throw new Error(
+      `Refusing to recursively delete unowned or dangerous state directory: ${dbDir}. Use --db-only to remove only the database file.`
+    );
+}
+async function removeDatabaseFiles(dbPath) {
+  for (const suffix of ["-wal", "-shm", "-journal"])
+    await fs6.rm(`${dbPath}${suffix}`, { force: true });
+  await fs6.rm(dbPath, { force: true });
+}
+async function markCleanClaimFailed(dbPath, runId, error) {
+  const exists = await fs6.stat(dbPath).then(() => true).catch(() => false);
+  if (!exists) return;
+  const db = openDatabase(dbPath);
+  try {
+    db.prepare(`UPDATE index_runs SET finished_at=?,status='failed',
+      error_message=? WHERE id=? AND status='running'`).run(
+      (/* @__PURE__ */ new Date()).toISOString(),
+      `Clean failed after writer claim: ${errorMessage(error)}`,
+      runId
+    );
+  } finally {
+    db.close();
+  }
+}
+
 // src/cli.ts
 async function init(workspace, options) {
   const config = createWorkspaceConfig(
@@ -2233,6 +2023,27 @@ async function withReadOnlyWorkspace(workspace, fn) {
     db.close();
   }
 }
+function selectRepository(db, selector, workspaceId) {
+  const candidates = reposByName(db, selector, workspaceId);
+  if (candidates.length === 1) return { repo: candidates[0] };
+  if (candidates.length === 0) return {
+    diagnostic: {
+      severity: "warning",
+      code: "selector_repo_not_found",
+      message: `Repository selector not found: ${selector}`
+    }
+  };
+  return {
+    diagnostic: selectorRepoAmbiguousDiagnostic(
+      selector,
+      candidates.map((repo) => ({
+        id: repo.id,
+        name: repo.name,
+        packageName: repo.package_name ?? void 0
+      }))
+    )
+  };
+}
 function createProgram() {
   const program = new Command();
   program.name("service-flow").description(
@@ -2264,8 +2075,8 @@ function createProgram() {
       );
     }).catch(fail)
   );
-  program.command("trace").option("--workspace <path>").option("--repo <name>").option("--operation <name>").option("--service <path>").option("--path <operationPath>").option("--handler <name>").option("--depth <n>", "trace depth", "25").option("--format <format>", "table|json|mermaid", "table").option("--include-external").option("--include-db").option("--include-async").option("--implementation-repo <name>").option("--implementation-hint <scope>", "scoped implementation hint", collect, []).option("--var <key=value>", "dynamic variable", collect, []).action(
-    (opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
+  program.command("trace").option("--workspace <path>").option("--repo <name>").option("--operation <name>").option("--service <path>").option("--path <operationPath>").option("--handler <name>").option("--depth <n>", "trace depth", "25").option("--format <format>", "table|json|mermaid", "table").option("--include-external").option("--include-db").option("--include-async").option("--implementation-repo <name>").option("--implementation-hint <scope>", "scoped implementation hint", collect, []).option("--var <key=value>", "dynamic variable", collect, []).option("--dynamic-mode <mode>", "strict|candidates|infer", "strict").option("--max-dynamic-candidates <n>", "maximum dynamic candidates to show", "5").action(
+    (opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
       const result = trace(
         db,
         {
@@ -2277,12 +2088,15 @@ function createProgram() {
         },
         {
           depth: Number(opts.depth),
+          workspaceId,
           vars: parseVars(opts.var),
           includeExternal: Boolean(opts.includeExternal),
           includeDb: Boolean(opts.includeDb),
           includeAsync: Boolean(opts.includeAsync),
           implementationRepo: opts.implementationRepo,
-          implementationHints: opts.implementationHint.map(parseImplementationHint)
+          implementationHints: opts.implementationHint.map(parseImplementationHint),
+          dynamicMode: parseDynamicMode(opts.dynamicMode),
+          maxDynamicCandidates: parsePositiveInteger(opts.maxDynamicCandidates, 5)
         }
       );
       process.stdout.write(
@@ -2294,9 +2108,9 @@ function createProgram() {
   list.command("repos").option("--workspace <path>").action(
     (opts) => void withReadOnlyWorkspace(
       opts.workspace,
-      (db) => process.stdout.write(
+      (db, workspaceId) => process.stdout.write(
         renderJson(
-          listRepositories(db).map((r) => ({
+          listRepositories(db, workspaceId).map((r) => ({
             name: r.name,
             kind: r.kind,
             packageName: r.package_name
@@ -2306,41 +2120,45 @@ function createProgram() {
     ).catch(fail)
   );
   list.command("services").option("--workspace <path>").option("--repo <name>").action(
-    (opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
-      const repo = opts.repo ? repoByName(db, opts.repo) : void 0;
-      if (opts.repo && !repo) {
-        process.stdout.write(renderJson([{ severity: "warning", code: "selector_repo_not_found", message: `Repository selector not found: ${opts.repo}` }]));
+    (opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+      const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
+      if (selection.diagnostic) {
+        process.stdout.write(renderJson([selection.diagnostic]));
         return;
       }
+      const repo = selection.repo;
       const rows = db.prepare(
-        "SELECT r.name repo,s.service_path servicePath,s.qualified_name qualifiedName FROM cds_services s JOIN repositories r ON r.id=s.repo_id WHERE (? IS NULL OR s.repo_id=?) ORDER BY r.name,s.service_path"
-      ).all(repo?.id, repo?.id);
+        "SELECT r.name repo,s.service_path servicePath,s.qualified_name qualifiedName FROM cds_services s JOIN repositories r ON r.id=s.repo_id WHERE r.workspace_id=? AND (? IS NULL OR s.repo_id=?) ORDER BY r.name,s.service_path"
+      ).all(workspaceId, repo?.id, repo?.id);
       process.stdout.write(renderJson(rows));
     }).catch(fail)
   );
   list.command("operations").option("--workspace <path>").option("--repo <name>").option("--service <path>").action(
-    (opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
-      const repo = opts.repo ? repoByName(db, opts.repo) : void 0;
-      if (opts.repo && !repo) {
-        process.stdout.write(renderJson([{ severity: "warning", code: "selector_repo_not_found", message: `Repository selector not found: ${opts.repo}` }]));
+    (opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+      const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
+      if (selection.diagnostic) {
+        process.stdout.write(renderJson([selection.diagnostic]));
         return;
       }
+      const repo = selection.repo;
       const rows = db.prepare(
-        "SELECT r.name repo,s.service_path servicePath,o.operation_name operation,o.operation_path path FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id WHERE (? IS NULL OR s.repo_id=?) AND (? IS NULL OR s.service_path=?)"
-      ).all(repo?.id, repo?.id, opts.service, opts.service);
+        "SELECT r.name repo,s.service_path servicePath,o.operation_name operation,o.operation_path path FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id WHERE r.workspace_id=? AND (? IS NULL OR s.repo_id=?) AND (? IS NULL OR s.service_path=?)"
+      ).all(workspaceId, repo?.id, repo?.id, opts.service, opts.service);
       process.stdout.write(renderJson(rows));
     }).catch(fail)
   );
   list.command("calls").option("--workspace <path>").option("--repo <name>").option("--operation <name>").action(
-    (opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
-      const repo = opts.repo ? repoByName(db, opts.repo) : void 0;
-      if (opts.repo && !repo) {
-        process.stdout.write(renderJson([{ severity: "warning", code: "selector_repo_not_found", message: `Repository selector not found: ${opts.repo}` }]));
+    (opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+      const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
+      if (selection.diagnostic) {
+        process.stdout.write(renderJson([selection.diagnostic]));
         return;
       }
+      const repo = selection.repo;
       const rows = db.prepare(
-        "SELECT r.name repo,c.call_type type,c.operation_path_expr path,c.source_file file,c.source_line line FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id WHERE (? IS NULL OR c.repo_id=?) AND (? IS NULL OR c.operation_path_expr=? OR c.operation_path_expr=? OR c.payload_summary LIKE ?)"
+        "SELECT r.name repo,c.call_type type,c.operation_path_expr path,c.source_file file,c.source_line line FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id WHERE r.workspace_id=? AND (? IS NULL OR c.repo_id=?) AND (? IS NULL OR c.operation_path_expr=? OR c.operation_path_expr=? OR c.payload_summary LIKE ?)"
       ).all(
+        workspaceId,
         repo?.id,
         repo?.id,
         opts.operation,
@@ -2351,8 +2169,8 @@ function createProgram() {
       process.stdout.write(renderJson(rows));
     }).catch(fail)
   );
-  program.command("graph").option("--workspace <path>").option("--repo <name>").option("--operation <name>").option("--service <path>").option("--path <operationPath>").option("--format <format>", "mermaid|json", "mermaid").option("--implementation-repo <name>").option("--implementation-hint <scope>", "scoped implementation hint", collect, []).option("--var <key=value>", "dynamic variable", collect, []).action(
-    (opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
+  program.command("graph").option("--workspace <path>").option("--repo <name>").option("--operation <name>").option("--service <path>").option("--path <operationPath>").option("--format <format>", "mermaid|json", "mermaid").option("--implementation-repo <name>").option("--implementation-hint <scope>", "scoped implementation hint", collect, []).option("--var <key=value>", "dynamic variable", collect, []).option("--dynamic-mode <mode>", "strict|candidates|infer", "strict").option("--max-dynamic-candidates <n>", "maximum dynamic candidates to show", "5").action(
+    (opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
       const result = trace(
         db,
         {
@@ -2363,12 +2181,15 @@ function createProgram() {
         },
         {
           depth: 100,
+          workspaceId,
           includeAsync: true,
           includeDb: true,
           includeExternal: true,
           vars: parseVars(opts.var),
           implementationRepo: opts.implementationRepo,
-          implementationHints: opts.implementationHint.map(parseImplementationHint)
+          implementationHints: opts.implementationHint.map(parseImplementationHint),
+          dynamicMode: parseDynamicMode(opts.dynamicMode),
+          maxDynamicCandidates: parsePositiveInteger(opts.maxDynamicCandidates, 5)
         }
       );
       process.stdout.write(
@@ -2378,18 +2199,18 @@ function createProgram() {
   );
   const inspect = program.command("inspect");
   inspect.command("repo").argument("<name>").option("--workspace <path>").action(
-    (name, opts) => void withReadOnlyWorkspace(
-      opts.workspace,
-      (db) => process.stdout.write(
-        renderJson(repoByName(db, name) ?? { error: "repo not found" })
-      )
-    ).catch(fail)
+    (name, opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+      const selection = selectRepository(db, name, workspaceId);
+      process.stdout.write(renderJson(
+        selection.repo ?? selection.diagnostic ?? { error: "repo not found" }
+      ));
+    }).catch(fail)
   );
   inspect.command("operation").argument("<selector>").option("--workspace <path>").action(
-    (selector, opts) => void withReadOnlyWorkspace(opts.workspace, (db) => {
+    (selector, opts) => void withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
       const rows = db.prepare(
-        "SELECT * FROM cds_operations WHERE operation_name=? OR operation_path=?"
-      ).all(selector, selector);
+        "SELECT o.* FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id WHERE r.workspace_id=? AND (o.operation_name=? OR o.operation_path=?)"
+      ).all(workspaceId, selector, selector);
       process.stdout.write(renderJson(rows));
     }).catch(fail)
   );
@@ -2402,29 +2223,7 @@ function createProgram() {
   program.command("clean").option("--workspace <path>").option("--db-only").action(
     (opts) => void (async () => {
       const config = await loadWorkspaceConfig(opts.workspace);
-      const dbDir = path6.resolve(path6.dirname(config.dbPath));
-      const workspaceRoot = path6.resolve(config.rootPath);
-      await fs6.rm(config.dbPath, { force: true });
-      if (!opts.dbOnly) {
-        const marker = path6.join(dbDir, ".service-flow-state");
-        const dangerous = /* @__PURE__ */ new Set([
-          path6.parse(dbDir).root,
-          "/tmp",
-          process.env.HOME ? path6.resolve(process.env.HOME) : "",
-          workspaceRoot
-        ]);
-        let ownsState;
-        try {
-          ownsState = (await fs6.stat(marker)).isFile();
-        } catch {
-          ownsState = false;
-        }
-        if (!ownsState || dangerous.has(dbDir))
-          throw new Error(
-            `Refusing to recursively delete unowned or dangerous state directory: ${dbDir}. Use --db-only to remove only the database file.`
-          );
-        await fs6.rm(dbDir, { recursive: true, force: true });
-      }
+      await cleanWorkspaceState(config, Boolean(opts.dbOnly));
       process.stdout.write("Cleaned service-flow state\n");
     })().catch(fail)
   );
@@ -2434,6 +2233,15 @@ function collect(value, previous) {
   previous.push(value);
   return previous;
 }
+function parseDynamicMode(value) {
+  if (value === void 0 || value === "strict") return "strict";
+  if (value === "candidates" || value === "infer") return value;
+  throw new Error(`Invalid --dynamic-mode ${value}; expected strict, candidates, or infer`);
+}
+function parsePositiveInteger(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+}
 function fail(error) {
   process.stderr.write(
     `${error instanceof Error ? error.message : String(error)}