knodin 0.8.2 → 0.8.3

package/dist/src/engine/index.js

@@ -22,6 +22,7 @@ import { compareBytes } from "../compare.js";
 import { readIndexActivity } from "../index-activity.js";
 import { runReadOnlyLspQuery } from "../lsp-readonly.js";
 import { acquireRepairLease } from "../repair-lease.js";
+import { analyzeResourceReachability, resourceFingerprint, } from "../resource-reachability.js";
 import { contentFingerprint, writeStructuralSnapshot, } from "../structural-snapshot.js";
 import { KNODIN_VERSION } from "../version.js";
 import * as ann from "./ann-hnsw.js";
@@ -65,6 +66,7 @@ export const REPO_WIDE_QUERY_PATTERNS = [
     "surprising_connections",
     "suggested_questions",
     "architecture_overview",
+    "resource_reachability",
     "batch_outline",
     "project_overview",
     "community",
@@ -661,6 +663,7 @@ const initPromises = new Map();
 const watchers = new Map();
 const WATCH_DEBOUNCE_MS = 50;
 const watchQueues = new Map();
+const repositoryEngineOwners = new Map();
 /**
  * Test-only reclamation for the single long-lived worker (isolate:false, C50).
  * The module-level `dbInstances`/`watchers`/`watchQueues` caches are keyed by repo
@@ -718,7 +721,13 @@ export async function __evictRemovedRepoState() {
 }
 // Bumped whenever any repo is (re)indexed, so cached community-detection results
 // below can be invalidated cheaply instead of recomputed on every call.
+const KNODIN_SCHEMA_VERSION = 22;
+const LAST_REBUILD_SCHEMA_VERSION = 22;
 let indexGeneration = 0;
+const resourceReachabilityCache = new Map();
+const RESOURCE_REACHABILITY_CACHE_LIMIT = 32;
+const resourceCorpusCache = new Map();
+const RESOURCE_CORPUS_CACHE_LIMIT = 8;
 const mapCache = new Map();
 const minimalMapCache = new Map();
 const MINIMAL_MAP_CACHE_LIMIT = 32;
@@ -3014,11 +3023,21 @@ function resolveImportPath(sourceFile, importSource, repoPath) {
 // repoPath -> (package name -> { dir, entryFile }) for workspace/package-alias
 // import resolution. Cached because it scans package.json files.
 const packageMapCache = new Map();
+function invalidateResolutionCaches(repoPath) {
+    const resolved = path.resolve(repoPath);
+    packageMapCache.delete(resolved);
+    const prefix = `${resolved}\0`;
+    for (const key of reExportCache.keys())
+        if (key.startsWith(prefix))
+            reExportCache.delete(key);
+}
 function getPackageMap(repoPath) {
-    const cached = packageMapCache.get(repoPath);
-    if (cached)
-        return cached;
+    const resolvedRepoPath = path.resolve(repoPath);
+    const cached = packageMapCache.get(resolvedRepoPath);
+    if (cached?.generation === indexGeneration)
+        return cached.value;
     const map = new Map();
+    let cacheable = true;
     for (const rel of walkRepoFiles(repoPath, {
         accept: (file) => path.posix.basename(file) === "package.json",
     })) {
@@ -3032,9 +3051,14 @@ function getPackageMap(repoPath) {
                 });
             }
         }
-        catch { }
+        catch {
+            // A file can disappear or be rewritten while discovery is running. Do
+            // not turn that transient failure into a process-lifetime empty mapping.
+            cacheable = false;
+        }
     }
-    packageMapCache.set(repoPath, map);
+    if (cacheable)
+        packageMapCache.set(resolvedRepoPath, { generation: indexGeneration, value: map });
     return map;
 }
 /** Best source entry file for a package: prefer source-y fields, else src/index, else index. */
@@ -3083,8 +3107,8 @@ const reExportCache = new Map();
 function getReExports(repoPath, relFile) {
     const cacheKey = `${repoPath}\0${relFile}`;
     const cached = reExportCache.get(cacheKey);
-    if (cached)
-        return cached;
+    if (cached?.generation === indexGeneration)
+        return cached.value;
     const named = new Map();
     const stars = [];
     try {
@@ -3107,9 +3131,12 @@ function getReExports(repoPath, relFile) {
             stars.push(m[1]);
         }
     }
-    catch { }
+    catch {
+        // Never cache a transient read failure as an authoritative empty barrel.
+        return { named, stars };
+    }
     const result = { named, stars };
-    reExportCache.set(cacheKey, result);
+    reExportCache.set(cacheKey, { generation: indexGeneration, value: result });
     return result;
 }
 /**
@@ -3341,6 +3368,31 @@ function salesforceMetadataFile(relativePath) {
         return { type: "approval", object: match[1], name: match[2] };
     return null;
 }
+/** Resolve only one locally declared, annotated Apex invocable method. */
+function findUniqueInvocableApexMethod(className, methodName, repoPath) {
+    const file = findUniqueApexClassFilePath(className, repoPath);
+    if (!file)
+        return null;
+    let source;
+    try {
+        source = fs.readFileSync(path.join(repoPath, file), "utf8");
+    }
+    catch {
+        return null;
+    }
+    const matches = [];
+    for (const match of source.matchAll(/@InvocableMethod\b[\s\S]{0,300}?\b(?:global|public)\s+static\s(?:\s|[^({;]*?(?<!\s))\s+([a-z]\w*)\s*\(/gi)) {
+        if (!isExecutablePosition(source, match.index ?? 0) || match[1] !== methodName)
+            continue;
+        matches.push({
+            file,
+            method: methodName,
+            line: source.slice(0, match.index ?? 0).split("\n").length,
+            evidence: match[0].trim(),
+        });
+    }
+    return matches.length === 1 ? matches[0] : null;
+}
 function staticXmlTagValues(content, tag) {
     const uncommented = content.replace(/<!--[\s\S]*?-->/g, "");
     const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
@@ -3525,8 +3577,8 @@ function extractApexPlatformDependencies(content, repoPath) {
 /** Index C20's static, deployable Salesforce DX metadata without interpreting formulas or runtime values. */
 async function indexSalesforceMetadataFile(content, relativePath, repoPath, db, metadata) {
     const dependencies = [];
-    const add = (to, kind, sourceEvidence) => {
-        dependencies.push({ to, kind, confidence: 1, sourceEvidence });
+    const add = (to, kind, sourceEvidence, methodReference) => {
+        dependencies.push({ to, kind, confidence: 1, sourceEvidence, methodReference });
     };
     const addField = (object, value, kind, evidence) => {
         const qualified = value.includes(".") ? value : `${object}.${value}`;
@@ -3586,9 +3638,18 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
                     const target = /^([A-Za-z]\w*)\.([A-Za-z]\w*)$/.exec(entry.value);
                     if (!target)
                         continue;
-                    const classFile = findApexMethodFilePath(target[1], target[2], repoPath);
-                    if (classFile)
-                        add(classFile, "flow_apex_action", entry.evidence);
+                    const invocable = findUniqueInvocableApexMethod(target[1], target[2], repoPath);
+                    if (!invocable)
+                        continue;
+                    const actionOffset = action.index ?? 0;
+                    const entryOffset = content.indexOf(entry.evidence, actionOffset);
+                    const line = content.slice(0, Math.max(actionOffset, entryOffset)).split("\n").length;
+                    add(invocable.file, "flow_apex_action", entry.evidence, {
+                        callee: invocable.method,
+                        calleeFile: invocable.file,
+                        line,
+                        column: 0,
+                    });
                 }
             }
             for (const entry of staticXmlTagValues(content, "extensionName")) {
@@ -3618,9 +3679,10 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
         deleteSymbolsForFile(db, relativePath);
         db.run("DELETE FROM dependencies WHERE fromFile = ?", [relativePath]);
         db.run("DELETE FROM mcp_tools WHERE filePath = ?", [relativePath]);
+        const flowSymbol = metadata.type === "flow" ? metadata.name : path.basename(relativePath, ".xml");
         db.run(`INSERT INTO symbols (name, kind, filePath, startLine, endLine, startCol, endCol, summary)
 			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
-            path.basename(relativePath, ".xml"),
+            flowSymbol,
             "salesforce-metadata",
             relativePath,
             1,
@@ -3629,6 +3691,14 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
             0,
             "Salesforce DX metadata (static declarations only; formulas and runtime targets are not resolved).",
         ]);
+        const insertRef = db.prepare(`INSERT INTO "references" (callerSymbol, callerFile, calleeSymbol, calleeFile, line, column, kind, confidence)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+        for (const dependency of dependencies) {
+            if (!dependency.methodReference)
+                continue;
+            insertRef.run(flowSymbol, relativePath, dependency.methodReference.callee, dependency.methodReference.calleeFile, dependency.methodReference.line, dependency.methodReference.column, dependency.kind, dependency.confidence);
+        }
+        insertRef.finalize();
         const seen = new Set();
         const insertDep = db.prepare("INSERT INTO dependencies (fromFile, toFile, kind, confidence, sourceEvidence) VALUES (?, ?, ?, ?, ?)");
         for (const dependency of dependencies) {
@@ -3646,6 +3716,47 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
         throw error;
     }
 }
+/**
+ * Revisit only indexed Flow files that literally name an incrementally changed
+ * Apex class. This keeps persisted method edges coherent when an annotation,
+ * overload, or declaration changes without requiring a repository-wide scan.
+ */
+async function refreshFlowsForApexFiles(db, repoPath, apexFiles) {
+    const classNames = new Set(apexFiles
+        .filter((file) => /^force-app\/main\/default\/classes\/[A-Za-z]\w*\.cls$/.test(file))
+        .map((file) => path.basename(file, ".cls")));
+    if (classNames.size === 0)
+        return [];
+    const flowFiles = db
+        .query("SELECT DISTINCT filePath FROM symbols WHERE kind = 'salesforce-metadata' AND filePath LIKE 'force-app/main/default/flows/%.flow-meta.xml' ORDER BY filePath")
+        .all();
+    const refreshed = [];
+    for (const { filePath } of flowFiles) {
+        const absolute = path.join(repoPath, filePath);
+        let content;
+        try {
+            content = fs.readFileSync(absolute, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const mentionsChangedClass = [...content.matchAll(/<actionCalls>([\s\S]*?)<\/actionCalls>/g)]
+            .filter((match) => /<actionType>apex<\/actionType>/.test(match[1]))
+            .some((match) => staticXmlTagValues(match[1], "actionName").some((entry) => {
+            const target = /^([A-Za-z]\w*)\.([A-Za-z]\w*)$/.exec(entry.value);
+            return target ? classNames.has(target[1]) : false;
+        }));
+        if (!mentionsChangedClass)
+            continue;
+        const metadata = salesforceMetadataFile(filePath);
+        if (!metadata || metadata.type !== "flow")
+            continue;
+        await indexSalesforceMetadataFile(content, filePath, repoPath, db, metadata);
+        recordIndexState(db, repoPath, filePath);
+        refreshed.push(filePath);
+    }
+    return refreshed;
+}
 /** Index the source-only, statically resolvable portion of one Salesforce LWC bundle member. */
 async function indexLwcBundleFile(content, relativePath, repoPath, db, bundle) {
     const dependencies = [
@@ -5873,6 +5984,392 @@ async function indexFile(absolutePath, relativePath, repoPath, db, unparsed) {
             tallyOne(unparsed, extensionBucket(relativePath));
     }
 }
+/**
+ * Rebuild the deliberately bounded TypeScript DI overlay from current source.
+ * The overlay is derived into the existing references store, so every existing
+ * graph surface sees the exact same edges and incremental indexing can replace
+ * stale wiring atomically without a second schema or cache.
+ */
+function reconcileTypeScriptDi(db, repoPath) {
+    const files = collectRepoFiles(repoPath).filter((file) => (file.endsWith(".ts") || file.endsWith(".tsx")) && !file.endsWith(".d.ts"));
+    const frameworkFiles = files.filter((file) => {
+        try {
+            const source = fs.readFileSync(path.join(repoPath, file), "utf8");
+            const importsOnly = maskBlockComments(source, (text) => text.replace(/[^\n]/g, " ")).replace(/(^|\s)\/\/.*$/gm, (text, prefix) => prefix + " ".repeat(text.length - prefix.length));
+            return /^\s*import\b[^\n]*\bfrom\s+["'](?:inversify|tsyringe)["']/m.test(importsOnly);
+        }
+        catch {
+            return false;
+        }
+    });
+    const frameworkFileSet = new Set(frameworkFiles);
+    for (const row of db
+        .query("SELECT id, filePath FROM symbols WHERE kind = 'di_module'")
+        .all())
+        if (!frameworkFileSet.has(row.filePath))
+            db.run("DELETE FROM symbols WHERE id = ?", [row.id]);
+    for (const file of frameworkFiles) {
+        const present = db
+            .query("SELECT 1 AS present FROM symbols WHERE kind = 'di_module' AND filePath = ? LIMIT 1")
+            .get(file);
+        if (!present)
+            db.run("INSERT INTO symbols(name, kind, filePath, startLine, endLine, startCol, endCol, summary) VALUES (?, 'di_module', ?, 1, 1, 0, 0, ?)", [`di-module:${file}`, file, `Static DI module for ${file}`]);
+    }
+    if (frameworkFiles.length > 0)
+        persistSymbolIdentities(db, repoPath, frameworkFiles);
+    const symbols = db.query("SELECT * FROM symbols").all();
+    const byFile = new Map();
+    for (const symbol of symbols) {
+        const rows = byFile.get(symbol.filePath) ?? [];
+        rows.push(symbol);
+        byFile.set(symbol.filePath, rows);
+    }
+    const candidates = [];
+    const bindingCandidates = [];
+    const resolutionCandidates = [];
+    const ownerAt = (file, line) => {
+        const rows = byFile.get(file) ?? [];
+        return (rows
+            .filter((row) => row.startLine <= line &&
+            row.endLine >= line &&
+            ["function", "method", "class"].includes(row.kind))
+            .sort((a, b) => a.endLine - a.startLine - (b.endLine - b.startLine) || (a.kind === "class" ? 1 : -1))[0] ?? rows.find((row) => row.kind === "di_module"));
+    };
+    const exactSymbol = (file, name) => {
+        const matches = (byFile.get(file) ?? []).filter((row) => row.name === name);
+        return matches.length === 1 ? matches[0] : undefined;
+    };
+    for (const file of files) {
+        let source;
+        try {
+            source = fs.readFileSync(path.join(repoPath, file), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const masked = maskBlockComments(source, (text) => text.replace(/[^\n]/g, " ")).replace(/(^|\s)\/\/.*$/gm, (text, prefix) => prefix + " ".repeat(text.length - prefix.length));
+        const codePosition = new Uint8Array(masked.length).fill(1);
+        let quote = "";
+        for (let index = 0; index < masked.length; index++) {
+            const char = masked[index];
+            if (quote) {
+                codePosition[index] = 0;
+                if (char === "\\") {
+                    if (index + 1 < masked.length)
+                        codePosition[++index] = 0;
+                }
+                else if (char === quote)
+                    quote = "";
+            }
+            else if (char === '"' || char === "'" || char === "`") {
+                quote = char;
+                codePosition[index] = 0;
+            }
+        }
+        const isCodeMatch = (match) => codePosition[match.index ?? 0] === 1;
+        const hasInversify = [...masked.matchAll(/\bfrom\s+["']inversify["']/g)].some(isCodeMatch);
+        const hasTsyringe = [...masked.matchAll(/\bfrom\s+["']tsyringe["']/g)].some(isCodeMatch);
+        if (!hasInversify && !hasTsyringe)
+            continue;
+        const imports = new Map();
+        for (const match of masked.matchAll(/\bimport\s+(?:type\s+)?\{([^}]+)\}\s*from\s*["']([^"']+)["']/g)) {
+            if (!isCodeMatch(match))
+                continue;
+            for (const specifier of match[1].split(",")) {
+                const parts = specifier
+                    .trim()
+                    .replace(/^type\s+/, "")
+                    .split(/\s+as\s+/);
+                if (parts[0])
+                    imports.set(parts[1] ?? parts[0], { original: parts[0], module: match[2] });
+            }
+        }
+        for (const match of masked.matchAll(/\bimport\s+([A-Za-z_$][\w$]*)\s+from\s*["']([^"']+)["']/g))
+            if (isCodeMatch(match))
+                imports.set(match[1], { original: match[1], module: match[2] });
+        const receivers = new Set();
+        for (const [local, binding] of imports)
+            if (binding.module === "tsyringe" && binding.original === "container")
+                receivers.add(local);
+        if (hasInversify) {
+            const containerTypes = [...imports]
+                .filter(([, binding]) => binding.module === "inversify" && binding.original === "Container")
+                .map(([local]) => local);
+            for (const typeName of containerTypes) {
+                const escapedType = typeName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                for (const match of masked.matchAll(new RegExp(String.raw `\b(?:const|let|var)\s+(\w+)\s*=\s*new\s+${escapedType}\b`, "g")))
+                    if (isCodeMatch(match))
+                        receivers.add(match[1]);
+                for (const match of masked.matchAll(new RegExp(String.raw `\b([A-Za-z_$][\w$]*)\s*:\s*${escapedType}\b`, "g")))
+                    if (isCodeMatch(match))
+                        receivers.add(match[1]);
+            }
+        }
+        const point = (index) => getLineAndColumnForIndex(source, index);
+        const conditionalAt = (index) => {
+            const stack = [];
+            for (let cursor = 0; cursor < index; cursor++) {
+                if (masked[cursor] === "{") {
+                    const prefix = masked.slice(Math.max(0, cursor - 240), cursor);
+                    stack.push(/\b(?:if|switch|for|while)\s*\([^{}]*\)\s*$/.test(prefix));
+                }
+                else if (masked[cursor] === "}")
+                    stack.pop();
+            }
+            if (stack.includes(true))
+                return true;
+            const boundary = Math.max(masked.lastIndexOf(";", index - 1), masked.lastIndexOf("{", index - 1), masked.lastIndexOf("}", index - 1));
+            const prefix = masked.slice(boundary + 1, index);
+            return /\b(?:if|switch|for|while)\s*\(|&&|\|\||\?|=>/.test(prefix);
+        };
+        const canonicalToken = (expression) => {
+            const token = expression.trim();
+            const literal = /^(?:"([^"\n]*)"|'([^'\n]*)')$/.exec(token);
+            if (literal)
+                return { value: `literal:${literal[1] ?? literal[2]}` };
+            if (!/^[A-Za-z_$][\w$]*$/.test(token))
+                return { reason: "Token is dynamic or computed." };
+            const imported = imports.get(token);
+            if (imported) {
+                const moduleFile = resolveModuleToFile(file, imported.module, repoPath);
+                if (!moduleFile)
+                    return { reason: `Token import ${token} does not resolve uniquely.` };
+                const definitionFile = followReExports(repoPath, moduleFile, imported.original, 0);
+                if (!exactSymbol(definitionFile, imported.original))
+                    return { reason: `Token ${token} does not have one indexed declaration.` };
+                return { value: `symbol:${definitionFile}#${imported.original}` };
+            }
+            if (!exactSymbol(file, token))
+                return { reason: `Token ${token} does not have one indexed declaration.` };
+            return { value: `symbol:${file}#${token}` };
+        };
+        const implementation = (name) => {
+            if (!/^[A-Za-z_$][\w$]*$/.test(name))
+                return undefined;
+            const imported = imports.get(name);
+            if (imported) {
+                const moduleFile = resolveModuleToFile(file, imported.module, repoPath);
+                if (!moduleFile)
+                    return undefined;
+                return exactSymbol(followReExports(repoPath, moduleFile, imported.original, 0), imported.original);
+            }
+            return exactSymbol(file, name);
+        };
+        const addOmission = (index, kind, reason) => {
+            if (codePosition[index] !== 1)
+                return;
+            const where = point(index);
+            candidates.push({
+                type: "omission",
+                owner: ownerAt(file, where.line),
+                file,
+                line: where.line,
+                column: where.column,
+                kind,
+                reason,
+                evidence: source.split(/\r?\n/)[where.line - 1]?.trim().slice(0, 240) ?? "",
+            });
+        };
+        const registryFor = (framework, receiver, index) => {
+            if (framework === "tsyringe")
+                return "tsyringe:global";
+            const before = masked.slice(0, index);
+            if (new RegExp(String.raw `\b(?:const|let|var)\s+${receiver}\s*=\s*new\s+`).test(before))
+                return `inversify:${file}:module:${receiver}`;
+            const where = point(index);
+            const owner = ownerAt(file, where.line);
+            return `inversify:${file}:${owner?.identity ?? owner?.name ?? "module"}:${receiver}`;
+        };
+        const addBinding = (index, tokenExpression, implementationName, framework, receiver) => {
+            if (codePosition[index] !== 1)
+                return;
+            if (conditionalAt(index))
+                return addOmission(index, "di_conditional_registration", "Conditional registration is runtime-dependent.");
+            const where = point(index);
+            const token = canonicalToken(tokenExpression);
+            if (!token.value)
+                return addOmission(index, "di_dynamic_token", token.reason ?? "Dynamic token.");
+            const target = implementation(implementationName.trim());
+            if (!target)
+                return addOmission(index, "di_unresolved_implementation", `Implementation ${implementationName.trim()} does not resolve to one indexed symbol.`);
+            bindingCandidates.push({
+                type: "binding",
+                token: token.value,
+                framework,
+                registry: registryFor(framework, receiver, index),
+                implementation: target,
+                owner: ownerAt(file, where.line),
+                file,
+                line: where.line,
+                column: where.column,
+                evidence: source.split(/\r?\n/)[where.line - 1]?.trim().slice(0, 240) ?? "",
+            });
+        };
+        const addResolution = (index, tokenExpression, framework, receiver) => {
+            if (codePosition[index] !== 1)
+                return;
+            if (conditionalAt(index))
+                return addOmission(index, "di_conditional_resolution", "Conditional resolution is runtime-dependent.");
+            const where = point(index);
+            const token = canonicalToken(tokenExpression);
+            if (!token.value)
+                return addOmission(index, "di_dynamic_token", token.reason ?? "Dynamic token.");
+            resolutionCandidates.push({
+                type: "resolution",
+                token: token.value,
+                framework,
+                registry: receiver ? registryFor(framework, receiver, index) : `${framework}:decorator`,
+                owner: ownerAt(file, where.line),
+                file,
+                line: where.line,
+                column: where.column,
+                evidence: source.split(/\r?\n/)[where.line - 1]?.trim().slice(0, 240) ?? "",
+            });
+        };
+        if (hasInversify) {
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.bind\s*\(([^()]+)\)\.to\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g))
+                if (receivers.has(match[1]))
+                    addBinding(match.index ?? 0, match[2], match[3], "inversify", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.bind\s*\(\s*([A-Za-z_$][\w$]*)\s*\)\.toSelf\s*\(\s*\)/g))
+                if (receivers.has(match[1]))
+                    addBinding(match.index ?? 0, match[2], match[2], "inversify", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.get\s*\(([^()]+)\)/g))
+                if (receivers.has(match[1]))
+                    addResolution(match.index ?? 0, match[2], "inversify", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.bind\s*\([^)]*\)\.toFactory\s*\(/g))
+                if (receivers.has(match[1]))
+                    addOmission(match.index ?? 0, "di_unsupported_factory", "Factory providers are runtime behavior and are not resolved.");
+        }
+        if (hasTsyringe) {
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.register\s*\(([^,()]+),\s*\{\s*useClass\s*:\s*([A-Za-z_$][\w$]*)\s*\}\s*\)/g))
+                if (receivers.has(match[1]))
+                    addBinding(match.index ?? 0, match[2], match[3], "tsyringe", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.registerSingleton\s*\(([^,()]+),\s*([A-Za-z_$][\w$]*)\s*\)/g))
+                if (receivers.has(match[1]))
+                    addBinding(match.index ?? 0, match[2], match[3], "tsyringe", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.registerSingleton\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g))
+                if (receivers.has(match[1]))
+                    addBinding(match.index ?? 0, match[2], match[2], "tsyringe", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.resolve\s*\(([^()]+)\)/g))
+                if (receivers.has(match[1]))
+                    addResolution(match.index ?? 0, match[2], "tsyringe", match[1]);
+            for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.register\s*\(([^,()]+),\s*\{\s*useFactory\s*:/g))
+                if (receivers.has(match[1]))
+                    addOmission(match.index ?? 0, "di_unsupported_factory", "Factory providers are runtime behavior and are not resolved.");
+        }
+        for (const [local, binding] of imports) {
+            if (binding.original !== "inject" || !["inversify", "tsyringe"].includes(binding.module))
+                continue;
+            const escaped = local.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            for (const match of masked.matchAll(new RegExp(String.raw `@${escaped}\s*\(([^()]+)\)`, "g")))
+                addResolution(match.index ?? 0, match[1], binding.module);
+        }
+        for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.(bind|get|resolve|register|registerSingleton)\s*\(/g)) {
+            if (!receivers.has(match[1]))
+                addOmission(match.index ?? 0, "di_unverified_receiver", `Receiver ${match[1]} is not a source-proven framework container.`);
+        }
+        for (const receiver of receivers) {
+            const escaped = receiver.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            for (const match of masked.matchAll(new RegExp(String.raw `\b${escaped}\.load\s*\(`, "g")))
+                addOmission(match.index ?? 0, "di_runtime_module", "Runtime container modules are not statically expanded.");
+        }
+    }
+    const bindingsByToken = new Map();
+    for (const binding of bindingCandidates) {
+        const key = `${binding.framework}\0${binding.registry}\0${binding.token}`;
+        const rows = bindingsByToken.get(key) ?? [];
+        rows.push(binding);
+        bindingsByToken.set(key, rows);
+    }
+    for (const [key, bindings] of bindingsByToken) {
+        if (bindings.length === 1)
+            candidates.push(bindings[0]);
+        else {
+            for (const binding of bindings) {
+                candidates.push({
+                    ...binding,
+                    type: "omission",
+                    kind: "di_ambiguous_binding",
+                    reason: `Registry token ${key.split("\0").at(-1)} has ${bindings.length} static bindings.`,
+                });
+            }
+        }
+    }
+    for (const resolution of resolutionCandidates) {
+        const bindings = resolution.registry?.endsWith(":decorator")
+            ? bindingCandidates.filter((binding) => binding.framework === resolution.framework && binding.token === resolution.token)
+            : (bindingsByToken.get(`${resolution.framework}\0${resolution.registry}\0${resolution.token}`) ?? []);
+        if (bindings.length === 1)
+            candidates.push({ ...resolution, implementation: bindings[0].implementation });
+        else
+            candidates.push({
+                ...resolution,
+                type: "omission",
+                kind: bindings.length > 1 ? "di_ambiguous_resolution" : "di_unbound_resolution",
+                reason: bindings.length > 1
+                    ? `Token ${resolution.token} has multiple bindings.`
+                    : `Token ${resolution.token} has no static binding.`,
+            });
+    }
+    db.run("BEGIN TRANSACTION;");
+    try {
+        db.run("DELETE FROM \"references\" WHERE kind IN ('di_binding', 'di_resolution', 'di_omission')");
+        const insert = db.prepare(`
+			INSERT INTO "references" (callerSymbol, callerFile, calleeSymbol, calleeFile, line, column, kind, confidence)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		`);
+        for (const candidate of candidates) {
+            if (!candidate.owner)
+                continue;
+            if (candidate.type === "omission") {
+                insert.run(candidate.owner.name, candidate.file, `${candidate.kind}:${candidate.reason}`, null, candidate.line, candidate.column, "di_omission", 0);
+            }
+            else if (candidate.implementation) {
+                insert.run(candidate.owner.name, candidate.file, candidate.implementation.name, candidate.implementation.filePath, candidate.line, candidate.column, candidate.type === "binding" ? "di_binding" : "di_resolution", 1);
+            }
+        }
+        insert.finalize();
+        db.run("COMMIT;");
+    }
+    catch (error) {
+        db.run("ROLLBACK;");
+        throw error;
+    }
+    persistReferenceEndpoints(db);
+    setMeta(db, "typescriptDiVersion", "1");
+}
+/**
+ * Decide whether a changed-file repair can affect the repository-wide DI
+ * overlay without reading source outside that repair set. This check must run
+ * before file-owned rows are replaced so removal of a framework import still
+ * triggers reconciliation through the previously persisted DI evidence.
+ */
+function repairPathsAffectTypeScriptDi(db, repoPath, repairPaths) {
+    const typeScriptPaths = repairPaths.filter((file) => (file.endsWith(".ts") || file.endsWith(".tsx")) && !file.endsWith(".d.ts"));
+    if (typeScriptPaths.length === 0)
+        return false;
+    const persistedEvidence = db.query(`SELECT 1 AS present
+		 FROM symbols
+		 WHERE kind = 'di_module' AND filePath = ?
+		 UNION ALL
+		 SELECT 1 AS present
+		 FROM "references"
+		 WHERE kind IN ('di_binding', 'di_resolution', 'di_omission')
+		   AND (callerFile = ? OR calleeFile = ?)
+		 LIMIT 1`);
+    if (typeScriptPaths.some((file) => persistedEvidence.get(file, file, file)))
+        return true;
+    return typeScriptPaths.some((file) => {
+        try {
+            const source = fs.readFileSync(path.join(repoPath, file), "utf8");
+            const importsOnly = maskBlockComments(source, (text) => text.replace(/[^\n]/g, " ")).replace(/(^|\s)\/\/.*$/gm, (text, prefix) => prefix + " ".repeat(text.length - prefix.length));
+            return /^\s*import\b[^\n]*\bfrom\s+["'](?:inversify|tsyringe)["']/m.test(importsOnly);
+        }
+        catch {
+            return false;
+        }
+    });
+}
 // The installed Transformers runtime was slower for every tested multi-item
 // batch on the R43 clean-build protocol (R44). Keep the safe no-regression
 // default while retaining the bounded override for future runtime/hardware
@@ -6584,6 +7081,7 @@ async function reconcileIndex(repoPath, db, progress) {
         if (reindexed > 0) {
             progress?.("finalizing", 0, "Refreshing identities and semantic embeddings");
             persistSymbolIdentities(db, repoPath, reindexedPaths);
+            reconcileTypeScriptDi(db, repoPath);
             await indexEmbeddings(db, repoPath, progress);
             indexGeneration++;
         }
@@ -6997,6 +7495,7 @@ async function indexRepo(repoPath, db, progress, skipEmbeddings = false) {
     }
     progress?.("finalizing", 0, "Persisting symbol identities and semantic index");
     persistSymbolIdentities(db, repoPath);
+    reconcileTypeScriptDi(db, repoPath);
     // Structure is complete at this point; embeddings are the expensive tail. When
     // deferred, `semanticReadiness` reports the gap until a later pass fills it —
     // `indexEmbeddings` only ever embeds symbols that lack one, so resuming is
@@ -7080,6 +7579,7 @@ function startFileWatcher(repoPath, db) {
                         }
                     }
                     persistSymbolIdentities(db, resolvedRepoPath, paths);
+                    reconcileTypeScriptDi(db, resolvedRepoPath);
                     await indexEmbeddings(db, resolvedRepoPath);
                     queue.embeddingReconciliations++;
                     indexGeneration++;
@@ -7220,11 +7720,9 @@ async function getOrInitDb(repoPath, options = {}) {
             // newly indexable JSON files. v22 admits markdown as a link-only
             // participant, so previously skipped documentation must be visited once
             // to populate its doc_link / doc_link_broken edges.
-            const KNODIN_SCHEMA_VERSION = 22;
             // Highest version whose upgrade needs the stored data REBUILT. Versions
             // above it migrate in place, so an upgrade costs a DELETE rather than a
             // full re-index + re-embed (~40 min of CPU on an 18k-symbol corpus).
-            const LAST_REBUILD_SCHEMA_VERSION = 22;
             const versionRow = db.query("PRAGMA user_version").get();
             const storedVersion = versionRow?.user_version ?? 0;
             const needsMcpBackfill = storedVersion < 17;
@@ -7479,6 +7977,8 @@ async function getOrInitDb(repoPath, options = {}) {
                     options.onProgress?.("finalizing", 0, `Persisting stable identities for ${missingIdentities.toLocaleString()} missing symbols`);
                     persistSymbolIdentities(db, normalizedPath);
                 }
+                if (getMeta(db, "typescriptDiVersion") !== "1")
+                    reconcileTypeScriptDi(db, normalizedPath);
                 if (needsMcpBackfill || getMeta(db, "mcpBackfillVersion") !== "17") {
                     let backfillComplete = true;
                     const indexedFiles = db
@@ -8082,7 +8582,8 @@ function findCallersFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
 			SELECT *
 			FROM "references"
 			WHERE calleeSymbol = ? AND calleeFile = ?
-			  AND (? IS NULL OR calleeIdentity = ?) AND kind = 'call'
+			  AND (? IS NULL OR calleeIdentity = ?)
+			  AND kind IN ('call', 'di_binding', 'di_resolution', 'flow_apex_action')
 		`);
         rows = stmt.all(targetSymbol, targetFile, targetIdentity, targetIdentity);
         stmt.finalize();
@@ -8091,7 +8592,7 @@ function findCallersFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
         const stmt = db.query(`
 			SELECT id, callerSymbol, callerFile, calleeSymbol, calleeFile, line, column, kind
 			FROM "references"
-			WHERE calleeSymbol = ? AND kind = 'call'
+			WHERE calleeSymbol = ? AND kind IN ('call', 'di_binding', 'di_resolution', 'flow_apex_action')
 		`);
         rows = stmt.all(targetSymbol);
         stmt.finalize();
@@ -8108,6 +8609,9 @@ function findCallersFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
             lineNumber: row.line,
             repoPath: currentRepoPath,
             kind: row.kind,
+            confidence: row.confidence ?? 1,
+            evidenceFile: row.callerFile,
+            evidenceLine: row.line,
         });
         const parentCallers = findCallersFederated(allRepos, currentRepoPath, row.callerSymbol, depth - 1, visited, row.callerFile, row.callerIdentity ?? null);
         results.push(...parentCallers);
@@ -8143,7 +8647,7 @@ function findCallersFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
     // Deduplicate by symbol, file, line, and repoPath
     const seen = new Set();
     return results.filter((r) => {
-        const key = `${r.symbol}:${r.filePath}:${r.lineNumber}:${r.repoPath}`;
+        const key = `${r.symbol}:${r.filePath}:${r.lineNumber}:${r.repoPath}:${r.kind ?? "call"}`;
         if (seen.has(key))
             return false;
         seen.add(key);
@@ -8181,7 +8685,8 @@ function findCalleesFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
 			SELECT *
 			FROM "references"
 			WHERE callerSymbol = ? AND callerFile = ?
-			  AND (? IS NULL OR callerIdentity = ?) AND kind = 'call'
+			  AND (? IS NULL OR callerIdentity = ?)
+			  AND kind IN ('call', 'di_binding', 'di_resolution', 'flow_apex_action')
 		`);
         rows = stmt.all(targetSymbol, sourceFile, exactSourceIdentity, exactSourceIdentity);
         stmt.finalize();
@@ -8190,7 +8695,7 @@ function findCalleesFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
         const stmt = db.query(`
 			SELECT id, callerSymbol, callerFile, calleeSymbol, calleeFile, line, column, kind
 			FROM "references"
-			WHERE callerSymbol = ? AND kind = 'call'
+			WHERE callerSymbol = ? AND kind IN ('call', 'di_binding', 'di_resolution', 'flow_apex_action')
 		`);
         rows = stmt.all(targetSymbol);
         stmt.finalize();
@@ -8218,6 +8723,9 @@ function findCalleesFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
                 lineNumber: def.startLine,
                 repoPath: currentRepoPath,
                 kind: row.kind,
+                confidence: row.confidence ?? 1,
+                evidenceFile: row.callerFile,
+                evidenceLine: row.line,
             });
             const childCallees = findCalleesFederated(allRepos, currentRepoPath, row.calleeSymbol, depth - 1, visited, def.filePath, def.identity ?? null);
             results.push(...childCallees);
@@ -8260,7 +8768,7 @@ function findCalleesFederated(allRepos, currentRepoPath, targetSymbol, depth, vi
     // Deduplicate
     const seen = new Set();
     return results.filter((r) => {
-        const key = `${r.symbol}:${r.filePath}:${r.lineNumber}:${r.repoPath}`;
+        const key = `${r.symbol}:${r.filePath}:${r.lineNumber}:${r.repoPath}:${r.kind ?? "call"}`;
         if (seen.has(key))
             return false;
         seen.add(key);
@@ -9714,24 +10222,28 @@ function findImportSpecifierLines(absPath, symbol) {
  * threaded through each operation's many return sites, so the tag cannot be
  * forgotten on an early return (a not-found explain, a refused rename).
  */
-function withStaleness(engine) {
+function withStaleness(engine, claimRepository) {
     return {
         async explain(symbol, repoPath, detailLevel, selector) {
+            claimRepository(repoPath);
             const result = await engine.explain(symbol, repoPath, detailLevel, selector);
             result.staleness = stalenessFor(repoPath);
             return result;
         },
         async review(base, repoPath, detailLevel, options) {
+            claimRepository(repoPath);
             const result = await engine.review(base, repoPath, detailLevel, options);
             result.staleness = stalenessFor(repoPath);
             return result;
         },
         async dependencyGraph(repoPath) {
+            claimRepository(repoPath);
             const result = await engine.dependencyGraph(repoPath);
             result.staleness = stalenessFor(repoPath);
             return result;
         },
         async map(repoPath, detailLevel = "minimal", options) {
+            claimRepository(repoPath);
             const raw = await engine.map(repoPath, detailLevel, options);
             const result = options
                 ? {
@@ -9775,21 +10287,26 @@ function withStaleness(engine) {
             return result;
         },
         async wiki(repoPath, force) {
+            claimRepository(repoPath);
             const result = await engine.wiki(repoPath, force);
             result.staleness = stalenessFor(repoPath);
             return result;
         },
         status(repoPath, options) {
+            claimRepository(repoPath);
             return engine.status(repoPath, options);
         },
         repair(repoPath, options) {
+            claimRepository(repoPath);
             return engine.repair(repoPath, options);
         },
         index(repoPath, files, clean, options) {
+            claimRepository(repoPath);
             // `index` IS the refresh — it has no answer to qualify.
             return engine.index(repoPath, files, clean, options);
         },
         async search(query, repoPath, limit, options) {
+            claimRepository(repoPath);
             const page = await engine.search(query, repoPath, limit, options);
             const staleness = stalenessFor(repoPath);
             for (const row of page.results)
@@ -9797,11 +10314,13 @@ function withStaleness(engine) {
             return page;
         },
         async query(pattern, target, repoPath, to, limit, depth, detailLevel, selector, impactOptions, options) {
+            claimRepository(repoPath);
             const result = await engine.query(pattern, target, repoPath, to, limit, depth, detailLevel, selector, impactOptions, options);
             result.staleness = stalenessFor(repoPath);
             return result;
         },
         async rename(oldName, newName, repoPath, apply, verify, selector) {
+            claimRepository(repoPath);
             const result = await engine.rename(oldName, newName, repoPath, apply, verify, selector);
             result.staleness = stalenessFor(repoPath);
             return result;
@@ -9813,6 +10332,20 @@ function withStaleness(engine) {
 }
 /** Default SQLite + Tree-Sitter engine. */
 export function createEngine() {
+    const owner = Symbol("knodin-engine");
+    const ownedRepositories = new Set();
+    let closed = false;
+    const claimRepository = (repoPath) => {
+        if (closed)
+            throw new Error("knodin engine is closed");
+        const resolved = path.resolve(repoPath);
+        if (ownedRepositories.has(resolved))
+            return;
+        ownedRepositories.add(resolved);
+        const owners = repositoryEngineOwners.get(resolved) ?? new Set();
+        owners.add(owner);
+        repositoryEngineOwners.set(resolved, owners);
+    };
     // Bound to a name (rather than returned as a bare object literal) so the
     // `wiki` method below can call `engine.map(..., "standard")` and reuse its output
     // instead of duplicating community-detection logic. Safe: `wiki`'s body
@@ -9900,7 +10433,7 @@ export function createEngine() {
                 const out = [];
                 for (const c of refs) {
                     const filePath = formatPath(c.repoPath || targetRepoPath, c.filePath);
-                    const key = `${c.symbol}|${filePath}`;
+                    const key = `${c.symbol}|${filePath}|${c.kind ?? "call"}`;
                     if (seen.has(key))
                         continue;
                     seen.add(key);
@@ -9912,6 +10445,16 @@ export function createEngine() {
                         symbol: c.symbol,
                         filePath,
                         lineNumber: c.lineNumber,
+                        kind: c.kind,
+                        confidence: c.confidence,
+                        ...(c.kind?.startsWith("di_")
+                            ? {
+                                sourceEvidence: fs
+                                    .readFileSync(path.join(c.repoPath || targetRepoPath, c.evidenceFile ?? c.filePath), "utf8")
+                                    .split(/\r?\n/)[(c.evidenceLine ?? c.lineNumber) - 1]?.trim()
+                                    .slice(0, 240) ?? "",
+                            }
+                            : {}),
                         ...(definition
                             ? {
                                 identity: symbolIdentity(definitionRepo?.path || targetRepoPath, definition),
@@ -9923,11 +10466,39 @@ export function createEngine() {
             };
             const allCallers = dedupeRefs(directCallers);
             const allCallees = dedupeRefs(directCallees);
+            const targetDb = allRepos.find((repo) => repo.path === targetRepoPath)?.db;
+            const omissions = targetDb
+                ? targetDb
+                    .query(" SELECT calleeSymbol, callerFile, line FROM \"references\" WHERE callerSymbol = ? AND callerFile = ? AND kind = 'di_omission' ORDER BY line, calleeSymbol")
+                    .all(primaryDef.name, primaryDef.filePath)
+                    .map((row) => {
+                    const separator = row.calleeSymbol.indexOf(":");
+                    let evidence = "";
+                    try {
+                        evidence =
+                            fs
+                                .readFileSync(path.join(targetRepoPath, row.callerFile), "utf8")
+                                .split(/\r?\n/)[row.line - 1]?.trim()
+                                .slice(0, 240) ?? "";
+                    }
+                    catch { }
+                    return {
+                        kind: separator < 0 ? "di_unresolved" : row.calleeSymbol.slice(0, separator),
+                        reason: separator < 0 ? row.calleeSymbol : row.calleeSymbol.slice(separator + 1),
+                        filePath: formatPath(targetRepoPath, row.callerFile),
+                        lineNumber: row.line,
+                        evidence,
+                    };
+                })
+                : [];
             const allBlastFiles = Array.from(new Set(allCallers.map((c) => c.filePath)));
             const untested = !allCallers.some((c) => isTestFilePath(c.filePath));
             const minimal = detailLevel === "minimal";
             const cap = minimal ? 25 : 200;
-            const truncated = allCallers.length > cap || allCallees.length > cap || allBlastFiles.length > cap;
+            const truncated = allCallers.length > cap ||
+                allCallees.length > cap ||
+                allBlastFiles.length > cap ||
+                omissions.length > cap;
             return {
                 identity: symbolIdentity(targetRepoPath, primaryDef),
                 symbol,
@@ -9937,6 +10508,9 @@ export function createEngine() {
                 callerCount: allCallers.length,
                 callees: allCallees.slice(0, cap),
                 calleeCount: allCallees.length,
+                ...(omissions.length > 0
+                    ? { omissions: omissions.slice(0, cap), omissionCount: omissions.length }
+                    : {}),
                 blastRadius: allBlastFiles.slice(0, cap),
                 blastRadiusCount: allBlastFiles.length,
                 untested,
@@ -10350,7 +10924,7 @@ export function createEngine() {
                         addExtractedEdge(df.fromFile, df.toFile, df.kind, df.confidence, df.sourceEvidence);
                     }
                     const refsAll = db
-                        .query('SELECT callerFile, calleeSymbol, calleeFile FROM "references"')
+                        .query('SELECT callerFile, calleeSymbol, calleeFile, kind, line, confidence FROM "references"')
                         .all();
                     for (const r of refsAll) {
                         // Prefer the resolved calleeFile (one exact edge). When unresolved,
@@ -10364,7 +10938,12 @@ export function createEngine() {
                         }
                         if (!calleeFile || calleeFile === r.callerFile)
                             continue;
-                        addExtractedEdge(r.callerFile, calleeFile, "calls");
+                        addExtractedEdge(r.callerFile, calleeFile, r.kind.startsWith("di_") ? r.kind : "calls", r.confidence, r.kind.startsWith("di_")
+                            ? fs
+                                .readFileSync(path.join(resolvedRepoPath, r.callerFile), "utf8")
+                                .split(/\r?\n/)[r.line - 1]?.trim()
+                                .slice(0, 240)
+                            : undefined);
                     }
                     return {
                         repoPath: resolvedRepoPath,
@@ -10458,7 +11037,7 @@ export function createEngine() {
                 // Populating callers references & cross-repo routing
                 for (const repo of allRepos) {
                     const refsAll = repo.db
-                        .query('SELECT callerFile, calleeSymbol, calleeFile FROM "references"')
+                        .query('SELECT callerFile, calleeSymbol, calleeFile, kind, line, confidence FROM "references"')
                         .all();
                     for (const r of refsAll) {
                         const callerPrefixed = formatPath(repo.path, r.callerFile);
@@ -10476,7 +11055,12 @@ export function createEngine() {
                                 calleePrefixed = sameRepo[0].file;
                         }
                         if (calleePrefixed && calleePrefixed !== callerPrefixed) {
-                            addExtractedEdge(callerPrefixed, calleePrefixed, "calls");
+                            addExtractedEdge(callerPrefixed, calleePrefixed, r.kind.startsWith("di_") ? r.kind : "calls", r.confidence, r.kind.startsWith("di_")
+                                ? fs
+                                    .readFileSync(path.join(repo.path, r.callerFile), "utf8")
+                                    .split(/\r?\n/)[r.line - 1]?.trim()
+                                    .slice(0, 240)
+                                : undefined);
                         }
                         // 2. Cross-repo Routing: If it does not exist locally but matches endpoints in other repos
                         const localExists = calleeFiles?.some((c) => c.repoPath === repo.path);
@@ -10757,6 +11341,12 @@ export function createEngine() {
                     schemaProblems.push(`required index_state column is missing: ${column}`);
             if (schemaVersion < 18)
                 schemaProblems.push(`schema ${schemaVersion} is older than required schema 18`);
+            if (schemaVersion < LAST_REBUILD_SCHEMA_VERSION)
+                schemaProblems.push(`schema ${schemaVersion} requires a full rebuild for current schema ${KNODIN_SCHEMA_VERSION}`);
+            else if (schemaVersion < KNODIN_SCHEMA_VERSION)
+                schemaProblems.push(`schema ${schemaVersion} requires migration to current schema ${KNODIN_SCHEMA_VERSION}`);
+            else if (schemaVersion > KNODIN_SCHEMA_VERSION)
+                schemaProblems.push(`schema ${schemaVersion} is newer than supported schema ${KNODIN_SCHEMA_VERSION}`);
             if (schemaProblems.length) {
                 if (!activeDb)
                     db.close();
@@ -10783,10 +11373,15 @@ export function createEngine() {
                     lastIndexedHead: "",
                     freshness: buildFreshnessEnvelope(resolved, db, verifiedAt, "repair-needed"),
                     verification: { mode: "deep-audit", verifiedAt },
-                    repairSteps: [
-                        "Run `knodin repair` to migrate/rebuild damaged local schema.",
-                        "Run `knodin status` again to verify health.",
-                    ],
+                    repairSteps: schemaVersion > KNODIN_SCHEMA_VERSION
+                        ? [
+                            "Upgrade knodin to a version that supports this local graph schema.",
+                            "Run `knodin status` again after upgrading.",
+                        ]
+                        : [
+                            "Run `knodin repair` to migrate/rebuild damaged local schema.",
+                            "Run `knodin status` again to verify health.",
+                        ],
                 };
             }
             const indexedRows = db
@@ -10908,6 +11503,7 @@ export function createEngine() {
                     options?.signal?.removeEventListener("abort", abortShared);
                 }
             }
+            invalidateResolutionCaches(resolved);
             const operationId = crypto.randomUUID();
             const startedAt = Date.now();
             let sequence = 0;
@@ -10978,6 +11574,23 @@ export function createEngine() {
                     phaseTotal: 1,
                 });
                 cancelBoundary();
+                if (before.schemaVersion > KNODIN_SCHEMA_VERSION) {
+                    const outstandingIssues = {
+                        files: before.missing.files.length,
+                        records: before.missing.records.length,
+                        total: before.missing.files.length + before.missing.records.length,
+                    };
+                    emitProgress("completed", overallCompleted, "Repair stopped because the local graph schema requires a newer knodin version");
+                    return {
+                        repaired,
+                        before,
+                        after: before,
+                        verified: false,
+                        cancelled: false,
+                        remaining: 0,
+                        outstandingIssues,
+                    };
+                }
                 emitProgress("planning", 0, "Building the repair plan");
                 const repairKinds = new Map();
                 for (const file of before.missing.files)
@@ -11028,11 +11641,15 @@ export function createEngine() {
                         skipContentReconciliation: true,
                         skipFreshnessGuard: true,
                     }));
+                const schemaPrepared = before.schemaVersion !== KNODIN_SCHEMA_VERSION;
+                if (schemaPrepared)
+                    committedWork = true;
                 const inheritedPostprocessing = getMeta(db, "repairPostprocessingPending") === "1";
                 const eligibleRepairPaths = new Set(collectRepoFiles(resolved));
                 repairPaths = [...repairKinds.keys()]
                     .filter((file) => repairKinds.get(file) === "stale" || fileDriftedFromIndexState(db, resolved, file))
                     .sort(compareBytes);
+                const repairAffectsTypeScriptDi = inheritedPostprocessing || repairPathsAffectTypeScriptDi(db, resolved, repairPaths);
                 counts.skipped = Math.max(0, repairKinds.size - repairPaths.length);
                 overallTotal = repairPaths.length + 4;
                 emitProgress("planning", repairPaths.length, "Repair plan completed", {
@@ -11098,6 +11715,8 @@ export function createEngine() {
                     });
                     cancelBoundary();
                     persistSymbolIdentities(db, resolved, inheritedPostprocessing ? undefined : repairPaths);
+                    if (repairAffectsTypeScriptDi)
+                        reconcileTypeScriptDi(db, resolved);
                     committedWork = true;
                     overallCompleted++;
                     emitProgress("symbol-identities", 1, "Stable symbol identities persisted", {
@@ -11181,8 +11800,7 @@ export function createEngine() {
                     phaseTotal: 1,
                 });
                 cancelBoundary();
-                if (repairKinds.size > 0 || hasOrphans || needsPostprocessing) {
-                    const reconciledAt = new Date().toISOString();
+                if (schemaPrepared || repairKinds.size > 0 || hasOrphans || needsPostprocessing) {
                     // The first deep audit proves graph-content integrity. Only
                     // after that proof may this snapshot claim the current
                     // revision; a second deep audit proves the complete envelope.
@@ -11190,15 +11808,38 @@ export function createEngine() {
                         after.missing.files.length === 0 &&
                         after.missing.records.length === 0 &&
                         Object.values(after.orphaned).every((count) => count === 0);
-                    if (contentVerified &&
-                        (after.freshness.state === "stale-head" || after.freshness.state === "unknown")) {
-                        setMeta(db, "lastIndexedHead", gitHead(resolved) ?? "");
+                    if (contentVerified) {
+                        db.run("BEGIN TRANSACTION;");
+                        try {
+                            if (after.freshness.state === "stale-head" || after.freshness.state === "unknown") {
+                                setMeta(db, "lastIndexedHead", gitHead(resolved) ?? "");
+                            }
+                            setMeta(db, "lastSuccessfulReconciliation", new Date().toISOString());
+                            recordFreshnessBaseline(resolved, db);
+                            statusCache.delete(resolved);
+                            const candidate = await engine.status(resolved, { audit: "deep" });
+                            if (candidate.status === "healthy") {
+                                db.run("COMMIT;");
+                                after = candidate;
+                            }
+                            else {
+                                db.run("ROLLBACK;");
+                                statusCache.delete(resolved);
+                                after = await engine.status(resolved, { audit: "deep" });
+                            }
+                        }
+                        catch (error) {
+                            db.run("ROLLBACK;");
+                            statusCache.delete(resolved);
+                            throw error;
+                        }
                     }
-                    setMeta(db, "lastSuccessfulReconciliation", reconciledAt);
-                    recordFreshnessBaseline(resolved, db);
-                    statusCache.delete(resolved);
-                    after = await engine.status(resolved, { audit: "deep" });
                 }
+                const outstandingIssues = {
+                    files: after.missing.files.length,
+                    records: after.missing.records.length,
+                    total: after.missing.files.length + after.missing.records.length,
+                };
                 const result = {
                     repaired,
                     before,
@@ -11206,6 +11847,7 @@ export function createEngine() {
                     verified: after.status === "healthy",
                     cancelled: false,
                     remaining: 0,
+                    outstandingIssues,
                 };
                 emitProgress("completed", overallCompleted, result.verified
                     ? "Repair completed and verified"
@@ -11226,6 +11868,11 @@ export function createEngine() {
                         verified: false,
                         cancelled: true,
                         remaining,
+                        outstandingIssues: {
+                            files: after.missing.files.length,
+                            records: after.missing.records.length,
+                            total: after.missing.files.length + after.missing.records.length,
+                        },
                     };
                 }
                 counts.failed++;
@@ -11249,6 +11896,7 @@ export function createEngine() {
             }
         },
         async index(repoPath, files, clean = false, options) {
+            invalidateResolutionCaches(repoPath);
             const indexed = [];
             const unchanged = [];
             let scipReport;
@@ -11299,9 +11947,14 @@ export function createEngine() {
                         indexed.push(relativePath);
                     progress("indexing-files", fileIndex + 1, `Checking ${files.length.toLocaleString()} requested files`, { phaseTotal: files.length });
                 }
+                const refreshedFlows = await refreshFlowsForApexFiles(db, repoPath, indexed);
+                for (const flow of refreshedFlows)
+                    if (!indexed.includes(flow))
+                        indexed.push(flow);
                 if (indexed.length > 0) {
                     progress("finalizing", 0, "Refreshing identities and semantic embeddings");
                     persistSymbolIdentities(db, repoPath, indexed);
+                    reconcileTypeScriptDi(db, repoPath);
                     await indexEmbeddings(db, repoPath, progress);
                     indexGeneration++;
                 }
@@ -11961,6 +12614,14 @@ export function createEngine() {
                 throw new Error(`knodin query ${pattern}: includeDataFlow is unsupported`);
             if (options.flowVariable !== undefined && pattern !== "flow_analysis")
                 throw new Error(`knodin query ${pattern}: flowVariable is unsupported`);
+            if ((options.resourceOffset !== undefined ||
+                options.resourceMaxBytes !== undefined ||
+                options.resourceMaxTokens !== undefined) &&
+                pattern !== "resource_reachability")
+                throw new Error(`knodin query ${pattern}: resource reachability bounds are unsupported`);
+            if (options.resourceOffset !== undefined &&
+                (!Number.isInteger(options.resourceOffset) || options.resourceOffset < 0))
+                throw new Error("knodin query resource_reachability: offset must be a non-negative integer");
             if (options.architectureFacets?.length && pattern !== "architecture_overview")
                 throw new Error(`knodin query ${pattern}: architectureFacets is unsupported`);
             if (options.architectureFacets?.some((facet) => !["packages", "layers", "boundaries", "hotspots", "entryPoints", "languages"].includes(facet)))
@@ -11978,6 +12639,7 @@ export function createEngine() {
                 "structural_implementations_of",
                 "tests_for",
                 "shortest_path",
+                "cross_substrate_path",
                 "rename_preview",
                 "traverse",
                 "feature_path",
@@ -11995,6 +12657,22 @@ export function createEngine() {
                         count: 0,
                         results: [],
                         ...(pattern === "shortest_path" ? { path: [] } : {}),
+                        ...(pattern === "cross_substrate_path"
+                            ? {
+                                crossSubstratePath: {
+                                    steps: [],
+                                    omissions: [
+                                        "The source endpoint is ambiguous; select a stable identity or file.",
+                                    ],
+                                    unsupportedCrossings: [
+                                        "Terraform, dbt, and arbitrary Salesforce metadata crossings are not resolved.",
+                                    ],
+                                    budget: { stepLimit: 1, returnedSteps: 0 },
+                                    truncated: false,
+                                    continuation: null,
+                                },
+                            }
+                            : {}),
                         ambiguity: resolved.ambiguity,
                     };
                 selectedTarget = resolved.selected;
@@ -12877,6 +13555,102 @@ export function createEngine() {
                         },
                     })));
                 }
+                case "cross_substrate_path": {
+                    const unsupportedCrossings = [
+                        "Terraform, dbt, and arbitrary Salesforce metadata crossings are not resolved.",
+                    ];
+                    const empty = (omission) => finish([], {
+                        crossSubstratePath: {
+                            steps: [],
+                            omissions: [omission],
+                            unsupportedCrossings,
+                            budget: { stepLimit: 1, returnedSteps: 0 },
+                            truncated: false,
+                            continuation: null,
+                        },
+                    });
+                    if (!to)
+                        return empty("Both from and to endpoints are required.");
+                    if (!selectedTarget)
+                        return empty("The source endpoint was not resolved uniquely.");
+                    const destination = resolveSymbolRows(db, primary.path, to, {
+                        identity: selector.toIdentity,
+                        file: selector.toFile,
+                        kind: selector.toKind,
+                    });
+                    if (destination.ambiguity)
+                        return finish([], {
+                            ambiguity: destination.ambiguity,
+                            crossSubstratePath: {
+                                steps: [],
+                                omissions: [
+                                    "The destination endpoint is ambiguous; select a stable identity or file.",
+                                ],
+                                unsupportedCrossings,
+                                budget: { stepLimit: 1, returnedSteps: 0 },
+                                truncated: false,
+                                continuation: null,
+                            },
+                        });
+                    if (!destination.selected)
+                        return empty("The destination endpoint was not resolved uniquely.");
+                    if (selectedTarget.kind !== "salesforce-metadata" ||
+                        !selectedTarget.filePath.endsWith(".flow-meta.xml") ||
+                        !destination.selected.filePath.endsWith(".cls"))
+                        return empty("The endpoints are not a supported Salesforce Flow-to-Apex boundary.");
+                    const className = path.basename(destination.selected.filePath, ".cls");
+                    const actionName = `${className}.${destination.selected.name}`;
+                    let flowEvidence = "";
+                    try {
+                        const flowSource = fs.readFileSync(path.join(primary.path, selectedTarget.filePath), "utf8");
+                        const matchingActions = [
+                            ...flowSource.matchAll(/<actionCalls>([\s\S]*?)<\/actionCalls>/g),
+                        ]
+                            .filter((match) => /<actionType>apex<\/actionType>/.test(match[1]))
+                            .filter((match) => staticXmlTagValues(match[1], "actionName").some((entry) => entry.value === actionName));
+                        if (matchingActions.length === 1)
+                            flowEvidence = matchingActions[0][0].trim();
+                    }
+                    catch { }
+                    const apexEvidence = findUniqueInvocableApexMethod(className, destination.selected.name, primary.path)
+                        ?.evidence ?? "";
+                    if (!flowEvidence)
+                        return empty("No exact literal Apex action for the selected method exists in the Flow.");
+                    if (!apexEvidence)
+                        return empty("The selected Apex method is not one unique local @InvocableMethod.");
+                    if (!selectedTarget.identity || !destination.selected.identity)
+                        return empty("Exact endpoint identity is unavailable.");
+                    return finish([], {
+                        crossSubstratePath: {
+                            steps: [
+                                {
+                                    kind: "flow_apex_action",
+                                    from: {
+                                        symbol: selectedTarget.name,
+                                        file: selectedTarget.filePath,
+                                        identity: symbolIdentity(primary.path, selectedTarget),
+                                        substrate: "salesforce-flow",
+                                    },
+                                    to: {
+                                        symbol: destination.selected.name,
+                                        file: destination.selected.filePath,
+                                        identity: symbolIdentity(primary.path, destination.selected),
+                                        substrate: "salesforce-apex",
+                                    },
+                                    provenance: "EXTRACTED",
+                                    confidence: 1,
+                                    freshness: stalenessFor(resolvedRepoPath),
+                                    evidence: { flow: flowEvidence, apex: apexEvidence },
+                                },
+                            ],
+                            omissions: [],
+                            unsupportedCrossings,
+                            budget: { stepLimit: 1, returnedSteps: 1 },
+                            truncated: false,
+                            continuation: null,
+                        },
+                    });
+                }
                 case "shortest_path": {
                     if (!to)
                         return finish([], { path: [] });
@@ -12890,7 +13664,7 @@ export function createEngine() {
                         return finish([], { path: [], ambiguity: destination.ambiguity });
                     if (selectedTarget && destination.selected) {
                         const edges = db
-                            .query("SELECT callerSymbol, callerFile, calleeSymbol, calleeFile, callerIdentity, calleeIdentity FROM \"references\" WHERE callerSymbol IS NOT NULL AND calleeFile IS NOT NULL AND kind = 'call'")
+                            .query("SELECT callerSymbol, callerFile, calleeSymbol, calleeFile, callerIdentity, calleeIdentity, kind FROM \"references\" WHERE callerSymbol IS NOT NULL AND calleeFile IS NOT NULL AND kind IN ('call', 'di_binding', 'di_resolution', 'flow_apex_action')")
                             .all();
                         const key = (name, file, identity) => `${name}\0${file}\0${identity ?? ""}`;
                         const start = key(selectedTarget.name, selectedTarget.filePath, selectedTarget.identity);
@@ -13339,6 +14113,57 @@ export function createEngine() {
                         ...(truncated ? { truncated: true } : {}),
                     });
                 }
+                case "resource_reachability": {
+                    const indexed = db
+                        .query("SELECT filePath FROM index_state ORDER BY filePath")
+                        .all()
+                        .filter(({ filePath }) => /\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(filePath));
+                    let diskDrifted = indexed.some(({ filePath }) => fileDriftedFromIndexState(db, resolvedRepoPath, filePath));
+                    const cachedCorpus = resourceCorpusCache.get(resolvedRepoPath);
+                    let inputs;
+                    let diskFingerprint;
+                    if (!diskDrifted && cachedCorpus?.generation === indexGeneration) {
+                        inputs = cachedCorpus.inputs;
+                        diskFingerprint = cachedCorpus.fingerprint;
+                    }
+                    else {
+                        inputs = indexed.flatMap(({ filePath }) => {
+                            const absolute = path.join(resolvedRepoPath, filePath);
+                            try {
+                                const content = fs.readFileSync(absolute, "utf8");
+                                if (fileDriftedFromIndexState(db, resolvedRepoPath, filePath))
+                                    diskDrifted = true;
+                                return [{ path: filePath, content }];
+                            }
+                            catch {
+                                diskDrifted = true;
+                                return [];
+                            }
+                        });
+                        diskFingerprint = resourceFingerprint(inputs);
+                        if (!diskDrifted)
+                            setBoundedCache(resourceCorpusCache, resolvedRepoPath, { generation: indexGeneration, inputs, fingerprint: diskFingerprint }, RESOURCE_CORPUS_CACHE_LIMIT);
+                    }
+                    // Disk state is part of the cache identity. A generation-only key can
+                    // return a previously fresh result during the freshness-probe TTL after
+                    // an external edit. index_state is the graph's persisted disk snapshot;
+                    // any mismatch is passed into the analyzer as a fail-closed expectation.
+                    const cacheKey = `${resolvedRepoPath}\0${diskFingerprint}\0${diskDrifted ? "drifted" : "matched"}\0${cap}\0${options.resourceOffset ?? 0}\0${options.resourceMaxBytes ?? 65_536}\0${options.resourceMaxTokens ?? 16_384}`;
+                    const cached = resourceReachabilityCache.get(cacheKey);
+                    if (cached?.generation === indexGeneration) {
+                        const result = structuredClone(cached.result);
+                        return finish([], { count: result.paths.length, resourceReachability: result });
+                    }
+                    const result = analyzeResourceReachability(inputs, {
+                        maxItems: cap,
+                        maxBytes: options.resourceMaxBytes,
+                        maxTokens: options.resourceMaxTokens,
+                        offset: options.resourceOffset,
+                        expectedFingerprint: diskDrifted ? `indexed:${diskFingerprint}` : diskFingerprint,
+                    });
+                    setBoundedCache(resourceReachabilityCache, cacheKey, { generation: indexGeneration, result: structuredClone(result) }, RESOURCE_REACHABILITY_CACHE_LIMIT);
+                    return finish([], { count: result.paths.length, resourceReachability: result });
+                }
                 case "flow_analysis": {
                     // C8 deliberately does not persist a PDG. This is a bounded, local
                     // source read for one resolved TS/JS function-like symbol only.
@@ -14194,11 +15019,38 @@ export function createEngine() {
             return result;
         },
         async close() {
-            for (const watcher of watchers.values()) {
-                await watcher.close();
-            }
-            watchers.clear();
-            for (const queue of watchQueues.values()) {
+            if (closed)
+                return;
+            closed = true;
+            const releasable = new Set();
+            for (const repo of ownedRepositories) {
+                const owners = repositoryEngineOwners.get(repo);
+                owners?.delete(owner);
+                if (!owners?.size) {
+                    repositoryEngineOwners.delete(repo);
+                    releasable.add(repo);
+                }
+            }
+            // When the final tracked engine closes, also reclaim legacy/federated
+            // resources that predate ownership registration.
+            if (repositoryEngineOwners.size === 0) {
+                for (const repo of watchers.keys())
+                    releasable.add(repo);
+                for (const repo of watchQueues.keys())
+                    releasable.add(repo);
+                for (const repo of dbInstances.keys())
+                    releasable.add(repo);
+            }
+            for (const repo of releasable) {
+                const watcher = watchers.get(repo);
+                if (watcher)
+                    await watcher.close();
+                watchers.delete(repo);
+            }
+            for (const repo of releasable) {
+                const queue = watchQueues.get(repo);
+                if (!queue)
+                    continue;
                 queue.closed = true;
                 if (queue.timer) {
                     clearTimeout(queue.timer);
@@ -14209,13 +15061,15 @@ export function createEngine() {
                 await queue.drain();
                 if (queue.pending.size > 0)
                     await queue.drain();
+                watchQueues.delete(repo);
             }
-            watchQueues.clear();
-            for (const db of dbInstances.values()) {
-                db.close();
+            for (const repo of releasable) {
+                const db = dbInstances.get(repo);
+                if (db)
+                    db.close();
+                dbInstances.delete(repo);
+                initPromises.delete(repo);
             }
-            dbInstances.clear();
-            initPromises.clear();
             freshnessProbes.clear();
             mapCache.clear();
             minimalMapCache.clear();
@@ -14230,9 +15084,11 @@ export function createEngine() {
             annIndexCache.clear();
             searchMetadataCache.clear();
             searchCommunityLookupCache.clear();
+            resourceCorpusCache.clear();
+            resourceReachabilityCache.clear();
             packageMapCache.clear();
             reExportCache.clear();
         },
     };
-    return withStaleness(engine);
+    return withStaleness(engine, claimRepository);
 }