# Changelog

## 0.2.0

- **Self-updating.** Every command now checks npm for a newer `@saptools/service-flow` (at most once an hour)
  and, when one exists, installs that exact version and re-runs the command on it, announcing both steps
  on stderr. `SAPTOOLS_AUTO_UPDATE=on|notify|off` controls it (see the README's Updates section); it is
  off by itself in CI, in tests, from a source checkout and inside the re-run. New `service-flow self-update
  [--check]` forces the check and install now. `--version` now reads `package.json` at runtime. Both come
  from the private, build-time-bundled `@saptools/core` package; the published tarball gains no runtime
  dependency.


## 0.1.80

- Publishes each canonical implementation decision into the per-database cache
  during implementation linking, including operations with no candidates.
  Later ownership checks reuse the exact decision instead of deriving it
  again; the existing phase-start reset keeps same-process relinks fresh.
- Remote `.send({ query })` facts now record the structural CQL `queryRoot`
  when available. An absent `method` property is disclosed separately as
  `methodDefaulted: true`; a present but unresolved method retains
  `dynamicMethodDefaulted: true`.
- Table traces surface `proof=<strategy>(<receiver>)` only for
  `dispatchCertainty=receiver_unproven`, making the existing JSON receiver
  evidence visible without changing other certainty tiers.
- Package/CLI is `0.1.80`; SQLite remains schema `15`, compact remains
  `service-flow/compact-graph@1`, and detailed JSON remains
  `service-flow/detailed-trace@3`. Analyzer compatibility advances to
  `0.1.80-facts.1`; existing workspaces require `index --force` followed by
  `link --force`.

## 0.1.79

- Added covering graph-edge lookup indexes and three repository/name symbol
  indexes with the measured prefix order. Existing schema-15 databases receive
  them on their next read-write open without a schema migration.
- Runs full SQLite `ANALYZE` after a successful link transaction so the new
  indexes and every implementation-candidate join table have planner
  statistics. Run `link --force` once after upgrade to install the indexes and
  statistics; no fact re-index is required.
- Memoizes canonical implementation evidence per database and operation during
  call linking, with an explicit reset before every implementation-link phase
  so same-process relinks cannot reuse stale decisions.
- Reserved the `scope:` caption namespace for structural scope tuples and
  restored flat-array rendering for invalid four-element tuple candidates.
- Renamed the doctor branch counter to
  `deploymentComparisonAssessments` and added
  `deploymentComparisonEdgeCount`, making one-edge/many-deployment expansion
  explicit.
- Read-only commands accept `SERVICE_FLOW_DB` as an operational database-path
  override. Index and link continue to mutate only the database named by the
  workspace configuration.
- Package/CLI is `0.1.79`; SQLite remains schema `15`, analyzer compatibility
  remains `0.1.77-facts.1`, compact remains
  `service-flow/compact-graph@1`, and detailed JSON remains
  `service-flow/detailed-trace@3`.

## 0.1.78

- Restored the always-array `inspect operation` JSON shape while retaining a
  non-zero missing-selector exit, and made trace/graph return exit 1 in every
  format only when the requested start itself is refused. Runtime-variable,
  hidden-candidate, and omission diagnostics remain successful trace results.
- Versioned detailed JSON as `service-flow/detailed-trace@3`.
  `fromLabel`/`toLabel` are resolved endpoint captions; ambiguous label-only
  fallback is represented separately by `fromLabelAmbiguousMatches` or
  `toLabelAmbiguousMatches` instead of embedding diagnostic prose in a data
  field. Canonical `from`/`to` node ids remain unchanged.
- Preserved the injective structural-scope grammar with executable
  round-trip/collision checks, restored readable flat-array identifiers after
  the scope attempt, and added non-zero fixtures for typed Node-parameter
  exclusion, development-environment comparisons, Mermaid metacharacters, and
  strict unproven subscriptions.
- Extended branch reachability with deployment-comparison reason populations
  and removed the unused incremental-index and depth-filter modules.
- Corrected after release: the stored `package_import_provenance_missing`
  reduction from four site rows to two repository rows occurred in 0.1.76,
  when diagnostics became one bounded row per affected repository. Pristine
  0.1.76 and later builds already store two rows for the measured workspace.
- Package/CLI is `0.1.78`; SQLite remains schema `15`, analyzer compatibility
  remains `0.1.77-facts.1`, compact remains
  `service-flow/compact-graph@1`, and detailed JSON is
  `service-flow/detailed-trace@3`. This output-only patch does not require
  re-indexing or relinking a workspace already on analyzer
  `0.1.77-facts.1`.

## 0.1.77

- Restored terminal dispatch for statically named publications whose receiver
  propagation remains unproven, while retaining the receiver reason and
  `dispatchCertainty=receiver_unproven`. Unproven subscriptions remain dynamic
  candidates, making the precision-for-recall boundary explicit and
  asymmetric.
- Applied one receiver-level compatibility decision to every listener on an
  unproven `stream` identifier. Affirmative CAP evidence still wins, so a
  CAP-connected receiver named `stream` remains an event client.
- Replaced the inert flat-tuple formatter with an injective structural-scope
  grammar, normalised scope labels before endpoint closure, deduplicated
  synthetic nodes by scope, and shared one id-first endpoint caption resolver
  across table, Mermaid, and detailed JSON. Mermaid now escapes labels
  independently.
- Replaced spelling-derived sibling-operation refusal with exact resolved
  decorator values from sibling methods, added the supporting handler-method
  index, and memoized lexical binding indexes by TypeScript source-file
  identity.
- Strengthened schema-15 migration validation with direct foreign-key target
  checks, fixed multi-scope dynamic-candidate totals, made doctor
  deduplication executable, exposed branch and publication-certainty
  populations, and made unknown operation inspection a non-zero diagnostic.
- Package/CLI is `0.1.77`, SQLite remains schema `15`, analyzer compatibility
  is `0.1.77-facts.1`, compact remains `service-flow/compact-graph@1`, and
  detailed JSON remains `service-flow/detailed-trace@2`. Parser facts changed,
  so existing workspaces require `index --force` followed by `link --force`.

## 0.1.76

- Guarded the schema-15 repository-table rebuild with explicit
  `foreign_keys=OFF` and `legacy_alter_table=ON` assertions and direct child-row
  count preservation. The migration now refuses before mutation when either
  prerequisite is absent.
- Made the sibling-operation fallback guard reachable for dotted generated
  decorator expressions through exact persisted decorator identity, without
  substring matching. Spelling-only decisions are labelled
  `expression_spelling_fallback`, and candidate evidence now includes method
  names.
- Proved typed Node stream/event parameters before generic parameter flow,
  populated `this` roots, and made unproven event receivers dynamic candidates
  rather than terminal dispatch edges. Proven CAP receiver facts and
  single-hop helper returns retain their existing behavior.
- Made environment comparison evidence say whether values were compared,
  mismatched non-authoritatively, or could not be compared and why. Shape
  candidate visibility and cap counts now describe the rows actually rendered.
- Resolved Mermaid endpoints by canonical id before labels, disclosed ambiguous
  label fallbacks, preserved full doctor locations, rendered tuple-shaped
  internal ids readably, and deduplicated repeated diagnostics with an explicit
  multiplicity.
- Versioned detailed JSON as `service-flow/detailed-trace@2`; `from` and `to`
  are canonical node ids while `fromLabel` and `toLabel` retain display text.
  Compact remains `service-flow/compact-graph@1` and now computes omitted
  detailed nodes from the current canonical endpoint scheme.
- Package/CLI is `0.1.76`, SQLite remains schema `15`, and analyzer
  compatibility is `0.1.76-facts.1`. Event receiver facts changed, so existing
  workspaces require `index --force` followed by `link --force`.

## 0.1.75

- Restored exported enum-member identity through dotted TypeScript namespaces. Generated decorator constants now use their declared string value across files, while private nested namespaces remain refused.
- Added an explicit implementation `selectionBasis` to detailed, table, Mermaid, and compact output. Method-name fallback refuses a handler whose unresolved decorator names a sibling operation, and rejected alternatives are disclosed instead of rendering as an unexplained bare resolution.
- Preserved canonical node identity throughout trace closure, added explicit detailed-JSON endpoint references, repository-qualified synthesized targets, and full-width table identifiers. Every rendered detailed JSON edge now references nodes present in the same document.
- Collapsed duplicate environment-derived shape candidates into bounded deployment groups, removed the false same-repository scope assertion, and made dynamic display caps report effective, shown, and omitted counts.
- Excluded imported Node stream/event receivers structurally and followed chained pipe receivers to their root. Unknown receiver bindings remain visible and proven CAP helper-return receivers remain unchanged.
- Persisted explicit event-environment keys, removed non-actionable placeholder `--var` suggestions, rejected unbounded trace invocations, and made missing operation/detail-mode CLI requests diagnostic.
- Package/CLI is `0.1.75`, SQLite schema is `15`, analyzer compatibility is `0.1.75-facts.1`, and compact remains `service-flow/compact-graph@1`. Schema 15 restores the historical schema-14 default and normalizes repository defaults without editing the applied migration. Parser facts changed, so existing workspaces require `index --force` followed by `link --force`.

## 0.1.74

- Recovered CAP event publications reached through a later assignment from a single-hop helper-return binding. Missing receiver bindings remain visible as explicitly unproven facts, while proven socket, stream, pipe, desktop, realtime, and CAP CRUD receivers remain excluded.
- Contained every structured prepared-snapshot validation failure at the individual fact boundary during normal indexing. Package factory-return and package-instance calls persist as unresolved provenance gaps; other unrepresentable facts are omitted with one site-aware diagnostic each, without discarding valid sibling facts or their repository.
- Reused repository-scoped TypeScript analysis for member-write, stable-value, import-binding, and string-constant lookups so identifier-dense frontend sources terminate without changing parser facts. Decorator operation names now come from exact relative or `#cds-models` exported nested constants rather than source-text naming guesses.
- Removed unregistered third-party package calls and decorator applications from trace edges while retaining bounded omission diagnostics. Every rendered edge target now has a canonical node, shape-candidate nodes are repository-qualified, and strict output discloses hidden event-shape candidates with a copyable mode hint.
- Scoped environment-derived shape pairings to equal values of a shared deployment key, collapsed missing consumer declarations into one bounded refusal, and refuses excessive expansion with a diagnostic instead of truncating it. The environment-key default is empty, `index --event-environment-key` is repeatable, and doctor reports configured and unmatched keys.
- Package/CLI is `0.1.74`, SQLite remains schema `14` because all new state uses existing evidence and diagnostic carriers, analyzer compatibility is `0.1.74-facts.1`, and compact remains `service-flow/compact-graph@1`. Parser facts changed, so existing workspaces require `index --force` followed by `link --force`.

## 0.1.73

- Repaired the schema-14 writer/validator contract: resolved empty string constants remain legal facts, empty event topics fail closed at use, and const-alias templates retain complete signed skeletons. Lifecycle failures now use the actual workspace path and expose bounded repository/file/line/predicate examples without replacing the last good graph.
- Separated event-name resolution from receiver proof. Static names retain canonical event identity while receiver confidence remains disclosed; single proven CAP-connect assignments inside branches are accepted, affirmative non-CAP proof wins over name compatibility, and comments or string contents cannot seed receiver evidence. Known socket, stream, desktop, and CAP CRUD handler calls stay outside EventMesh aggregates.
- Refused partial folding for spread/computed/getter/shorthand constant containers, accepted type-position references as immutable uses, materialized complete loop registrations, bounded link-time skeleton fan-out, deduplicated equal dispatch decisions, and completed bounded doctor reason-bucket counts.
- Made event environment keys configurable through `eventEnvironmentKeys` in `.service-flow/config.json`, while preserving the default, grammar/cap, provenance, transform, ambiguity, fingerprint, and neighbouring-key exclusion guarantees. Repository inspection omits stored declaration values and environment-file fingerprints hash only allowlisted derived facts.
- Package/CLI is `0.1.73`, SQLite remains schema `14`, analyzer compatibility is `0.1.73-facts.1`, and compact remains `service-flow/compact-graph@1`. Parser facts changed, so existing workspaces require `index --force` followed by `link --force`.

## 0.1.72

- Published the completed event-surface provenance, constant-topic, candidate-subscriber, environment-declaration, and doctor-quality work as a package-only patch. SQLite remains schema `14`, analyzer compatibility remains `0.1.71-facts.1`, and compact remains `service-flow/compact-graph@1`; no additional reindex is required after applying the schema-14 fact release.

## 0.1.71

- Replaced event-receiver name gating with structural CAP-connect and lexical reaching-assignment proof for declarations, later assignments, destructuring, and formatter-split chains. Property and non-CAP receivers now persist bounded fail-closed facts instead of disappearing; compatibility names remain explicit `name_fallback` evidence.
- Folded proven local, relative-module, and public package enum/const-object event topics without evaluating expressions. Mutable, non-string, unexposed, duplicate, computed, or incomplete containers retain typed unresolved reasons, and package constant facts are invalidated and re-resolved when their target surface changes.
- Added schema 14 carriers for canonical event skeletons, allowlisted repository environment declarations, and generated string-constant provenance. Shape-equivalent subscriptions are opt-in dynamic candidates only when the identical hole layout has a literal span of at least eight characters; one canonical positional `--var` key can resolve both source-name variants.
- Added per-repository `SHARD_CODE` declarations from bounded dev/deployment metadata, with explicit provenance, only `toUpperCase`/`toLowerCase` transforms, duplicate-value ambiguity, dependency-aware consumer expansion, fingerprint invalidation, and exclusion of every non-allowlisted neighbouring environment key.
- Added strict doctor aggregates for unresolved names, dynamic candidates, unmatched publications/subscriptions, receiver proof outcomes, skeleton candidates, and environment ambiguities. Loop registrations retain enumerable multiplicity evidence, payload-routed sites remain non-authoritative candidates, and table/compact evidence exposes workspace-name-only delivery certainty.
- Package/CLI was `0.1.71`, SQLite is schema `14`, analyzer compatibility is `0.1.71-facts.1`, and compact remains `service-flow/compact-graph@1`. The writer-only migration leaves legacy event skeleton/environment provenance null and marks old facts stale; existing workspaces require `index --force` followed by `link --force`.

## 0.1.70

- Removed numeric ordering prefixes from every tracked source and test filename and updated all package-local imports. This is a source-layout-only release: SQLite remains schema `13`, analyzer compatibility remains `0.1.69-facts.1`, and the compact schema remains `service-flow/compact-graph@1`.

## 0.1.69

- Corrected one-hop derived import identity: conventional relative default-class instances use target-side default-export evidence, package-derived members cannot leak into same-file exact-name resolution, and package-backed proxy aliases fail closed with an honest unsupported reason. Unresolved and ambiguous local/package symbol-call facts now remain visible as non-traversable trace edges.
- Contained invalid prepared-repository snapshots with typed, site-aware diagnostics and repository savepoints. Healthy repositories in the same index invocation publish normally; partial and total failures return bounded summaries and non-zero CLI status, while the final cross-repository invalidation/materialization phase remains atomic.
- Persisted template-literal `.emit()`/`.on()` topics as runtime-dependent event facts. Missing exact keys produce dynamic candidates and compact-safe missing-variable diagnostics; supplying every emit/subscription key traverses only an exact case-sensitive substituted event-name match.
- Recognized multi-line `cds.run(...)` structurally and recorded bounded `hasForUpdate: true` evidence on both wrapped and directly executed fluent CQL chains.
- Added the fail-closed `single_hop_helper_return` binding strategy for a direct connect-derived helper return inside a try block whose catch has no value return or connect. Branching, value-returning/connect-producing catch/finally blocks, and second-hop helpers remain unresolved.
- Kept `service-flow/compact-graph@1` while rejecting raw control characters before trimming, completing tuple-equivalent status/target elision for non-database-backed target kinds, exposing bounded tied implementation repositories and selector/lifecycle categories, and sourcing safe reason codes from parser warnings. Tuple columns, refs, redaction, and detailed JSON remain unchanged.
- Package/CLI is `0.1.69`, SQLite remains schema `13`, analyzer compatibility is `0.1.69-facts.1`, and the compact schema remains `service-flow/compact-graph@1`. Existing workspaces require `index --force` followed by `link --force`; no schema migration is required.

## 0.1.68

- Replaced line-based call and binding ownership with deterministic UTF-16 full-span containment, exact subscription-registration identity, durable handler-reference status, and parser-carried lexical binding-site provenance. Unsupported or ambiguous ownership and reaching assignments now fail closed instead of selecting a convenient same-line row.
- Upgraded SQLite to schema 13 with binding-site span/owner columns, an exact-site uniqueness backstop, and a repository package-public-surface carrier. Legacy rows keep null provenance and `legacy_unknown`; upgrading requires `index --force` followed by `link --force`, while invalid prepared lexical proofs and failed lifecycle preflight preserve the last good facts and graph.
- Preserved typed ESM/CommonJS binding shape, imported versus local names, requested package/subpath, exact relative-module scope, public exposure completeness, and executable-body eligibility. Package resolution no longer guesses from repository-wide exported-name uniqueness; aliases and namespace members resolve only through a proven public entry, proxy target module ambiguity fails closed, and package identity changes stale dependency-only helper edges as well as matching symbol calls. Mutable, reassigned, or escaped public values and mutated CommonJS namespace objects fail closed instead of selecting a stale executable body.
- Strengthened current-fact lifecycle validation for link-consumed JSON, event origin/status/cardinality, exact owners, binding references, package provenance/state, and resolution matrices. Trace, doctor, and link return bounded `reindex_required` diagnostics before JSON-dependent work or graph replacement; doctor reports valid pre-link package rows as pending/relink work instead of terminal unresolved quality.
- Made `${...}` scanning balanced and non-evaluating, and made OData query, segment, quote, and invocation analysis treat accepted placeholders as opaque tokens. Optional chaining, calls, strings, regular expressions, and slashes inside a placeholder no longer become path syntax; exact complex `--var` keys can recover dynamic GET operation resolution.
- Kept `service-flow/compact-graph@1` while restoring complex missing-variable names and authoritative shown/omitted counts under the documented safe grammar. Compact edges omit only effective status/target summaries proven identical to their canonical tuple cells; differing persisted decisions and every bounded drill-down reference remain. This recovers the representative compact budgets of at most 15% of pretty and 20% of minified detailed JSON without weakening the detailed artifact or deleting references.
- Re-exported the public fact and trace type contracts from the package root. Package/CLI `0.1.68`, schema `13`, analyzer `0.1.68-facts.1`, and compact schema `service-flow/compact-graph@1` remain independent compatibility values.

## 0.1.67

- Published the completed event-subscriber and compact-graph release as an output/package-only patch. SQLite remains schema 12 and `ANALYZER_VERSION` remains `0.1.66-facts.1`, proving package version changes no longer force an unnecessary fact reindex.

## 0.1.66

- Made event-subscription handler identity durable with explicit `event_subscribe_handler` symbol-call roles, resolver-independent `factOrigin` provenance, and exact zero-based UTF-16 outer-call spans on outbound and symbol-call facts. Ordinary calls use `ordinary_call`; migrated facts remain fail-closed as `legacy_unknown` instead of receiving heuristic roles or spans.
- Upgraded SQLite to schema 12 with indexed call-site/role columns, stale-analyzer lifecycle checks, bounded read-only upgrade diagnostics, and a link preflight that refuses legacy or incomplete facts before replacing the existing graph. Upgrading from 0.1.65 requires `index --force` followed by `link --force`.
- Persisted one bounded `EVENT_SUBSCRIPTION_HANDLED_BY` edge per subscription after final symbol-call resolution, using the exact workspace/repository/file/full-span association and stable resolved, ambiguous, unresolved, or missing-association targets. Link never falls back to caller, line, start offset, labels, or case-folded event names.
- Continued async traces from an emitted event through every exact, case-sensitive workspace-name subscriber registration into each distinct resolved generic handler symbol and its downstream scope. Preserved registration fan-out and duplicate bridges, isolated subscriber context, enforced causal depth, convergence, and structural cycle safeguards, and kept ambiguous/unresolved/missing associations non-traversable. This is explicitly `static_name_only` inference, not proof of runtime broker/channel/tenant/payload delivery.
- Prevented event-handler-role and legacy symbol calls from leaking through ordinary synchronous local-symbol traversal when async traversal is disabled.
- Added versioned `compact-json` output to trace and graph. `service-flow/compact-graph@1` uses canonical semantic endpoints, sorted dictionaries, fixed-width tuples, dense output-local IDs, bounded allowlisted decision/diagnostic summaries, deterministic aggregation, and invocation-scoped `traceOrdinals` plus generation-scoped audit references.
- Kept existing pretty detailed JSON as the authoritative complete evidence/candidate artifact, along with existing table and Mermaid output. Compact JSON is intentionally lossy and omits raw evidence, candidate bodies and scores, payload/call expressions, helper chains, supplied runtime values, and arbitrary diagnostic/remediation text; it is deterministic only for identical database state and inputs.
- Made invalid trace/graph formats fail before database access with non-zero status, no stdout, and an explicit accepted-format list instead of silently falling back.
- Decoupled package/CLI version `0.1.66`, SQLite schema version `12`, and analyzer compatibility `0.1.66-facts.1`, allowing future output-only package patches to retain the analyzer without forcing a reindex.

## 0.1.65

- Captured event-subscription handler references from `.on('Event', handlerRef)` as resolvable symbol-call facts using the existing import-binding-aware machinery for relative imports, package imports, namespace members, same-file symbols, and static accessors.
- Covered bare identifiers, `Class.member` references, and one level of single-argument wrapper-call unwrapping; inline callbacks, multi-argument wrappers, nested wrappers, and other unsupported expressions remain unrepresented and fail closed.
- Kept the SQLite schema, event-registration and outbound-call facts, linkers, trace engine, renderers, and output shapes unchanged.

## 0.1.63

- Stopped recording CAP runtime lifecycle activity on the `cds` facade (`bootstrap`, `loaded`, `connect`, `serving`, `served`, `listening`, and `shutdown`) and supported-receiver `on('error')` hooks as asynchronous domain-event facts or derived event edges, while preserving custom facade events, lifecycle-named service events, domain messaging events, error emissions, and synthetic event-registration symbols.
- Made object-form `send({ method, ... })` calls with a dynamic method default to `POST` with bounded `dynamicMethodDefaulted` parser evidence instead of storing a property name or expression as the HTTP verb, without a schema, linker, trace-engine, or output-shape change.

## 0.1.62

- Assigned every distinct Mermaid trace/graph node its own stable per-render identifier instead of truncating normalized endpoint strings to 60 characters, preventing nodes with long shared prefixes from collapsing into one.
- Preserved full node labels, edge order and types, table/JSON output, trace behavior, and the SQLite schema.

## 0.1.61

- Recorded public static arrow-function and function-expression properties on exported classes as exported qualified symbols, matching static method declarations and enabling unique cross-package and relative `Class.member` resolution with `local_symbol_call` trace descent.
- Kept instance properties, private/protected static properties, and members of non-exported classes fail-closed as unexported, with no schema, linker-edge, trace, CLI, or output-shape change.

## 0.1.60

- Fixed RC-A by resolving remote `send({ query: ... })` entities from the original query initializer AST and its real lexical scope, removing the isolated text reparse that fabricated parameter, mutable-local, runtime-const, runtime-destructured, and shadowed entity names while preserving genuine static entities and top-level query aliases.
- Fixed RC-B by assigning the existing query warning to query-present remote calls whose entity stays dynamic, matching local query diagnostics without changing the `remote_query` call type, confidence, schema, linker, trace, or output shape and completing the remote identifier-reparsing follow-up documented in 0.1.59.

## 0.1.59

- Fixed RC-A by making local DB query entities lexical-binding-aware: parameters, simple mutable locals, runtime const aliases, destructuring from runtime or reassigned sources, and direct `this.<field>` targets now remain dynamic at the existing low-confidence warning path instead of becoming fabricated entities.
- Preserved concrete imported/global and string entities, bounded immutable aliases, literal element access, `<x>.entities.Name`, and P1/P2/P3 entity destructuring from CAP entity collections or `#cds-models`; aliased destructuring records the public source property. Direct `this.<field>` entity caches deliberately pay the fail-closed compatibility cost, including in isolated remote-query hints, while remote identifier reparsing remains a known follow-up.
- Fixed RC-B by recognizing `SELECT.distinct.from` and `SELECT.distinct.one.from` as CAP query-builder roots for both direct and `cds.run(...)` execution, retaining one fact per fluent statement without schema, linker, trace, or output-shape changes.

## 0.1.58

- Completed RC5 with a deterministic link-phase workspace pass that resolves package-import symbol calls to uniquely matching exported symbols in uniquely identified indexed sibling packages, including package subpath imports and receiver-qualified member calls.
- Kept external packages, same-repository imports, missing or non-exported names, unsafe aliases/default imports, deeper member chains, duplicate package mappings, and duplicate exported targets fail-closed as unresolved or ambiguous.
- Recomputed owned package-import rows on every link without a schema, edge, trace-engine, or CLI output change, preserving bounded evidence and cross-package `local_symbol_call` trace descent across repeated link and force-index/relink runs.

## 0.1.57

- Made local executable symbol-call resolution import-binding-aware: relative helper shadowing now bypasses same-file methods (RC1), namespace members resolve within their imported module (RC2), duplicate exports use fail-closed path disambiguation while barrels remain ambiguous (RC3), and singleton-accessor chains reach non-exported instance methods in the imported class module (RC4).
- Recorded non-relative package-import calls with `package_import` evidence instead of silently dropping them (RC5 minimal-safe); they remain deterministically unresolved until a post-publication workspace pass can resolve sibling-package symbols without index-order or stale-ID risk.
- Persisted bounded module-path and candidate-strategy evidence without a schema migration or trace/rendering shape change, with neutral parser, SQLite, trace-edge, and repeated force-index/relink coverage.

## 0.1.56

- Completed direct CAP query-builder execution-context indexing for builders returned by async or syntactically guaranteed-Promise callables and for static builder elements in awaited `Promise.all(...)`, while retaining one fact per logical statement and the existing conservative unknown-entity behavior.
- Recorded stable direct execution-context evidence (`await`, `async_return`, `promise_return`, or `promise_aggregate`) without changing the SQLite schema, graph edge type, trace filters, or wrapper ownership.

## 0.1.55

- Indexed directly awaited CAP query-builder statements as local database calls, preserving exact builder-root evidence, fluent statement offsets, dynamic-entity warnings, method ownership, and the existing single `cds.run(...)` fact.
- Made normal CLI stdout pipeline-safe: an early downstream pipe close stops further output without an unhandled `EPIPE` stack trace, while unrelated stream failures remain non-zero diagnostics.

## 0.1.54

- Made contextual dynamic trace diagnostics runtime-current after `--var` substitution while retaining labelled pre-substitution binding state and distinct structural blockers.
- Added explicit selected-handler provenance to resolved implementation hops, so table, JSON, and Mermaid trace output follow the graph target rather than a rejected candidate.
- Preserved semantic candidate order through bounded evidence projections, retaining raw discovery rank alongside selection-aware display rank and existing count metadata.

## 0.1.53

- Validated dynamic routes from the outbound call's selected service binding, including helper-return provenance, exact template matches, and explicit alias/destination conflicts that now fail closed with structured no-match evidence.
- Kept deterministic identity inference attached to the concrete service route owner while allowing a separately validated helper implementation for inherited operations.
- Bounded persisted call, implementation, parser-alternative, trace, selector, and strict-doctor candidate projections with stable count and omission metadata while retaining canonical SQLite facts for decisions and scoped hints.

## 0.1.52

- Narrowed dynamic targets before ranking, scoped strong evidence by exact repository IDs, required workspace-wide identity uniqueness, refused conflicting/incomplete/margin-bound inference, shell-quoted suggestions, and bounded all candidate projections.
- Indexed supported zero-argument CAP lifecycle decorators with runtime import provenance, kept lifecycle/event methods out of operation implementation matching, and added fail-closed repository, operation, handler, and no-executable-method diagnostics.
- Coordinated index and clean writers with recoverable owner metadata and actionable lock failures while preserving atomic last-good publication, including backward-safe index creation during migration.
- Reused immutable package/source text and TypeScript AST snapshots during sequential preparation, and added deterministic table/JSON, workspace-scope, integrity, concurrency, migration, and parse-failure coverage.

## 0.1.51

- Added trace and graph `--dynamic-mode strict|candidates|infer` with capped `--max-dynamic-candidates` exploration for runtime-dependent remote targets.
- Ranked dynamic operation candidates with derived `--var` suggestions from service-path, alias, destination, package require, and implementation evidence while keeping strict mode fail-closed.
- Added infer-mode traversal only when all required placeholders are uniquely derived above threshold; tied candidates remain unresolved with explicit evidence.
- Normalized dynamic candidate score reasons to arrays and added neutral regression coverage for explicit vars, strict suggestions, candidate branches, and infer ties.

## 0.1.50

- Resolved local string, enum-member, and const-object decorator arguments with persisted evidence while keeping unsupported expressions conservative.
- Prevented handler registrations with exact class ids from producing cross-repository class-name candidates; genuine duplicate implementations remain ambiguous with scoped hints.
- Added copyable service-and-path trace-start selectors and strict doctor aggregates for decorator resolution and registration pairing.
- Added a neutral implementation-resolution workspace with SQLite, trace, hint, and runtime-variable regression coverage.

## 0.1.49

- Unified direct and wrapper operation-path analysis with deterministic static, ambiguous, and dynamic candidate evidence while preserving lexical scope and source order.
- Prevented future or mutable service-client assignments from becoming persisted bindings; trace and strict doctor now distinguish direct, contextual, ambiguous, unrecoverable, and missing-parameter-metadata cases.
- Added explicit OData entity-versus-operation precedence evidence, richer trace-start remediation, capped implementation hint alternatives, and repository-correct guided traversal.
- Added a neutral seven-package CAP workspace covering runtime substitutions, contextual clients, imported wrappers, OData/entity paths, duplicate helper implementations, SQLite evidence, and CLI quality gates.

## 0.1.48

- Added deterministic `doctor --format json|table` output while preserving legacy-compatible default doctor output; JSON mode returns `[]` for clean workspaces and table mode renders concise diagnostic rows with capped hint lines.
- Documented the 0.1.47 audit follow-up evidence fields for service-client ownership chains, normalized OData operation paths, wrapper path candidates, and implementation hint suggestions.
- Bumped the package patch version for the service-flow audit follow-up release.

## 0.1.46

- Improved ambiguous implementation diagnostics with ready-to-copy scoped hint suggestions for each blocked helper hop.
- Persisted deterministic service-client ownership across helper boundaries, object and tuple destructuring, returned clients, and transaction aliases while preserving dynamic evidence for ambiguous flows.
- Tightened OData operation-invocation normalization and dynamic wrapper-path evidence without promoting entity addressing paths to operation calls.
- Kept strict doctor output concise by default with actionable categories and detail-mode evidence expansion.

## 0.1.45

- Added repeatable scoped implementation hints with explicit selection and mismatch evidence while preserving conservative automatic and legacy repository selection.
- Propagated proven CAP clients and literal or runtime wrapper paths across relative imports, including object, array, returned-client, and transaction contexts.
- Kept OData invocation arguments, routing placeholders, and compact candidate scores distinct while preserving terminal entity paths.
- Added compact strict-doctor summaries with actionable detail mode and expanded publication atomicity recovery coverage.

## 0.1.44

- Separated trace-time effective resolution evidence from persisted graph resolution, including runtime substitution details and missing `--var` suggestions.
- Added duplicate package-name implementation ambiguity evidence plus trace-time implementation repo hints for guided traversal.
- Aggregated strict doctor implementation candidate noise into actionable categories with capped examples.
- Tightened contextual binding, nested wrapper, OData invocation, and incremental publication atomicity regression coverage.

## 0.1.43

- Reconciled inherited CDS operation search rows from the exact effective-operation set during extension materialization.
- Invalidated concrete extension repositories when derived inherited operations or base resolution semantics change, while preserving no-op generations.
- Tightened lexical binding scope so nested block declarations inside catch and loop bodies do not escape their real blocks.
- Classified proven CAP `send(operationName, payload)` calls, including immutable aliases, without applying the rule to generic `send()` receivers.

## 0.1.42

- Continued inherited CDS extension operations into the selected base implementation while retaining concrete routing evidence.
- Reconciled materialized inherited operations on reindex so renamed or removed base operations do not leave stale effective rows.
- Kept ambiguous or unresolved extension bases without a selected base id and ignored commented CDS `using` declarations.
- Added positional remote CAP `Service.send(method, path, ...)` classification for proven CAP clients and tightened catch/loop lexical constant resolution.

## 0.1.41

- Added imported CDS extension provenance and materialized inherited operations at concrete extension paths without guessing by simple service name.
- Resolved TypeScript identifier expressions through lexical bindings so module constants work and inaccessible shadowed block values are excluded.
- Classified positional CAP `Service.send(...)` dispatch only for proven CAP service receivers while leaving generic `send` calls untouched.
- Bumped the SQLite schema to persist extension/base and operation provenance metadata.

## 0.1.40

- Hardened operation path expression analysis to respect lexical scope, declaration order, aliases, and bounded branch candidates.
- Kept external URL and destination templates with substitutions dynamic with sanitized labels.
- Fixed CDS path annotation parsing for prefix/suffix annotations and supported service extension syntax.

## 0.1.35

- Hardened OData path precedence so entity key, navigation, and media/property paths with placeholders remain terminal entity evidence instead of dynamic operation candidates.
- Preserved separate evidence for service-routing placeholders, operation invocation argument placeholders, and entity key placeholders.
- Render operation-resolved parser entity calls as operation calls in traces while retaining the original parser call type for auditability.
- Added strict doctor coverage for dynamic remote-entity false positives without indexed operation evidence.

## 0.1.34

- Prefer indexed CDS operation evidence over heuristic remote-entity classification for service-client operation invocations, while keeping true collection, entity, delete, navigation, and media paths terminal.
- Added strict doctor collision diagnostics for terminal remote entity edges that look like operation invocations with indexed operation candidates.
- Persist repository fact analyzer versions and warn during link/strict doctor when force reindex is required after an analyzer upgrade.

## 0.1.33

- Preserved persisted graph decisions and call-site evidence during trace and graph rendering while keeping contextual runtime resolution as enrichment.
- Classified OData entity reads, mutations, deletes, navigation, media streams, and uppercase entity candidates as terminal remote entity edges instead of unresolved operation candidates.
- Kept dynamic external HTTP destinations dynamic with stable synthetic ids, neutral labels, bounded safe candidates, and sanitized URL evidence.
- Bumped the SQLite schema capability to version 7 and added strict doctor diagnostics for legacy schema drift and reindex-required external metadata.
- Standardized terminal trace-start diagnostics so non-traversable starts return zero graph nodes and edges by default.

## 0.1.32

- Hardened operation-first trace starts to fail closed on ambiguous, rejected, or non-executable implementation evidence.
- Made decorator normalization explicit and conservative for unsupported expressions.
- Populated queryable external HTTP target metadata with sanitized labels and kept CAP candidates distinct from HTTP endpoints.
- Removed accidental fresh-schema external-target columns from symbols and documented migration/re-index expectations.

## 0.1.31

- Resolve operation and path trace selectors from indexed CDS operations and persisted implementation edges before conservative handler fallback, including generated `Action<Name>` and `Func<Name>` decorator constants whose method names differ from public operation names.
- Emit the selected start operation and initial implementation hop once, with structured start-resolution evidence and ambiguity/not-found diagnostics that point to the operation, implementation edge, or handler-scope stage.
- Replace numeric external HTTP terminal targets with semantic external destination and endpoint nodes, preserving redacted structured target evidence for destinations, static URLs, dynamic URL expressions, and unknown calls.
- Add schema version 6 migration columns for queryable external target metadata and a strict doctor aggregate for external HTTP target quality.

## 0.1.30

- Normalize balanced OData operation invocations when multiline template placeholders appear inside function/action argument lists.
- Preserve invocation argument placeholders as non-routing evidence instead of treating them as missing operation-target runtime variables.
- Reuse the shared OData invocation normalizer during contextual trace resolution so persisted links and trace-time helper propagation handle the same path shapes.
- Keep GET entity key reads, navigation reads, and collection queries terminal unless strong indexed operation evidence resolves them.

## 0.1.29

- Classify GET OData entity/query paths with query strings, filter functions, key predicates, navigation reads, and query placeholders as terminal remote query/entity edges when no strong indexed CDS operation candidate resolves them.
- Preserve raw path, entity segment, query-string presence, query placeholders, method, and classifier reason in link evidence without creating dynamic operation edges from query parameters.
- Keep balanced top-level OData action/function invocation normalization for real operation imports while avoiding truncation at parentheses inside query strings.
- Document the conservative entity-query versus operation-invocation distinction for neutral CAP service-client calls.

## 0.1.28

- Propagate contextual service-client bindings through one-level object-parameter destructuring aliases, including renamed and assignment destructuring in neutral CAP helpers.
- Prefer caller-site higher-order wrapper remote-action evidence for literal wrapper paths while keeping dynamic wrapper path diagnostics on the caller edge.
- Refine contextual implementation selection evidence for duplicate helper candidates and report structured duplicate-candidate ties when selection is unsafe.
- Fix strict doctor contextual opportunity metrics so aggregate totals, capped examples, and actionable severity remain internally consistent.

## 0.1.27

- Enrich trace-time contextual service-client bindings from package-level CAP `cds.requires` aliases so helper-internal sends resolve through require-derived service paths and destinations.
- Preserve contextual binding attempt evidence for unresolved helper sends, including effective service path, destination, candidate counts, and resolution reasons.
- Refine strict doctor diagnostics for contextual helper sends to distinguish resolved contextual opportunities, missing `cds.requires` rows, require-backed unresolved sends, remaining runtime variables, and workspaces with no contextual opportunity.
- Expand neutral CAP coverage for positional helper arguments, destructured object helper parameters, renamed properties, late assignments, table output, Mermaid output, and require-derived target operations.

## 0.1.26

- Resolve helper-internal remote sends contextually in trace output when service clients are passed through positional arguments or one-level destructured object parameters.
- Add auditable contextual binding evidence for propagated helper client receivers, including caller argument, caller object property, callee parameter, callee receiver, and propagation source.
- Keep nested `this.<property>.<method>()` symbol-call resolution conservative unless explicit same-file or relative-import helper instance evidence exists.
- Update strict doctor diagnostics for trace-time contextual propagation opportunities and nested `this` receiver quality signals.

## 0.1.25

- Make class-instance symbol-call indexing conservative so only same-file and relatively imported helper classes are traced, while built-in collection, date, URL, error, typed-array, promise, and abort-controller instances are ignored.
- Persist identifier and one-level destructured object parameter metadata for executable symbols, including class methods, so contextual service-client binding propagation can map helper arguments to callee receiver names.
- Propagate contextual service bindings through positional helper arguments and destructured object helper parameters with auditable caller and callee evidence.
- Refine unresolved operation diagnostics when indexed candidates exist but service context is absent or the resolution score is below threshold.

## 0.1.24

- Add conservative class instance method symbol-call resolution for same-file and relatively imported helper classes, with auditable class-instance evidence.
- Propagate service-client binding context through resolved local symbol calls for explicit positional and object-literal helper arguments during trace rendering.
- Harden one-hop higher-order send wrapper literal path propagation for returned async closures and expose wrapper definition evidence.
- Refine strict doctor categories for no-binding remote actions and split ambiguous versus unresolved implementation diagnostics with capped examples.

## 0.1.23

- Retrospective note: preserve same-file late-assignment service binding extraction for connected clients, `cds.connect.to(...)` assignments, identity aliases, and simple transaction aliases before outbound `send(...)` calls.
- Retrospective note: preserve explicit object destructuring from safe helper-returned client objects so binding rows remain available for downstream remote action linking.

## 0.1.22

- Propagate conservative same-file identity aliases of connected service clients, including typed, `as`, `satisfies`, helper-returned, and transitive aliases, while preserving `.tx()` alias evidence.
- Link outbound `send(...)` calls through identity aliases to the closest same-file binding row so destination, service-path, placeholder, and helper-chain evidence remains available.
- Add narrow same-file wrapper literal-path propagation for wrappers that pass a client parameter directly to `send({ path })`; dynamic wrapper paths remain semantic dynamic targets with parser warnings.
- Improve trace-time contextual implementation selection evidence and suppress stale ambiguous unresolved reasons when a unique contextual handler is selected.
- Expand `doctor --strict` with alias-binding, no-binding remote-action, contextual implementation, and wrapper path propagation quality aggregates.

## 0.1.21

- Propagate helper-returned connected clients from function declarations, arrow-function variables, function-expression variables, named export lists, and aliased exports into caller destructuring and transaction aliases.
- Preserve conservative object-return analysis by binding only returned properties backed by local `cds.connect.to(...)` client variables, while ignoring unrelated metadata fields.
- Document contextual implementation selection evidence and strict doctor checks for operation-path-only remote actions.

## 0.1.20

- Preserve service-binding evidence when helpers return connected clients inside object properties and callers destructure or create simple transaction aliases.
- Track full template-expression placeholder keys such as `${domainInfo.serviceName}`, `${domainInfo.shortName?.toLowerCase()}`, and `${items[0].service}` for runtime `--var` substitution without evaluating JavaScript.
- Render unresolved remote actions with unknown or dynamic paths as semantic targets instead of numeric call ids, with parser evidence for shorthand `path` identifiers.
- Expand strict doctor aggregates for normalized OData invocation ambiguity and remote-action unresolved target quality.

## 0.1.19

- Normalize balanced top-level OData action/function invocation paths before remote operation resolution, including namespace-qualified invocation lookup, while preserving raw and normalized evidence.
- Model remote service-client queries as terminal remote-query edges with stable semantic targets instead of unresolved operation calls.
- Add strict doctor aggregates for remote-query target quality and OData invocation resolution quality.
- Document remote query terminal semantics and normalized invocation resolution behavior.

## 0.1.18

- Applied conservative CAP receiver eligibility to `.emit()` and `.publish()` so generic realtime, socket, DOM, and EventEmitter-style calls no longer become CAP async event facts without explicit CAP messaging/service evidence.
- Added structured parser evidence for local CAP service calls, including source offsets, service lookup/name, operation, and alias chain.
- Propagated outbound parser evidence into call-derived graph and JSON trace evidence under `outboundEvidence` for remote, local, DB, external, and async edges.
- Clarified graph-level dynamic flags so terminal DB, external, and event edges stay static while dynamic binding details remain in edge evidence.
- Expanded `doctor --strict` with outbound evidence, graph evidence propagation, event receiver classification, and dynamic terminal-edge consistency aggregates.

## 0.1.17

- Replaced remaining raw-text outbound call detection with TypeScript AST classification so comments and strings do not create outbound facts or graph edges.
- Added AST parser/range evidence for outbound calls and conservative CAP/service event registration ownership.
- Tightened synthetic callback and async subscription classification to avoid generic response `.send()` and non-CAP event listener noise.
- Expanded strict doctor ownerless source categories and examples.

## 0.1.16

- Index class property arrow/function members as executable symbols so outbound calls inside handler helper properties receive precise source-symbol ownership.
- Add conservative synthetic callback symbols for top-level CAP lifecycle, route, and event callbacks that contain supported outbound calls.
- Harden proxy-member symbol-call resolution with richer evidence and avoid ambiguous repository-wide member-name fallback.
- Split `service-flow link` operation-call output into remote resolved, local resolved, unresolved, ambiguous, dynamic, and terminal buckets.
- Extend strict doctor ownership diagnostics with ownerless outbound-call details by call type and syntactic gap.
- Keep `OutboundCallFact.sourceSymbolQualifiedName` aligned with persistence by preferring explicit qualified names before line-range fallback.

## 0.1.15

- Fixed `symbol_calls.evidence_json` persistence so inserted rows store the parser evidence object instead of a numeric repository id, with explicit initial resolved/unresolved statuses.
- Added strict doctor diagnostics for non-object symbol-call evidence, documented unresolved/unknown parser-quality thresholds, and outbound-call source-symbol ownership ratios.
- Made exported public static class methods addressable through relative imports while keeping non-exported, private/protected, and package-imported class member calls conservative.
- Indexed exported shorthand object maps as alias symbols and added conservative proxy-variable evidence for `const worker = ExportedClass.staticFactory(); worker.method()` flows when the factory comes from a relative import.
- Preserved 0.1.14 symbol-call noise filtering, semantic unknown DB targets, terminal transport-client classification, and strict parser-quality aggregates.

## 0.1.14

- Made local symbol-call indexing opt-in: CAP DSL, request helpers, package namespace/CommonJS calls, global runtime APIs, and service-client transport helpers are filtered unless indexed local or relative-import evidence makes the edge actionable.
- Expanded local DB query entity extraction for `SELECT.one(Entity)`, `UPSERT.into(Entity)`, `UPDATE.entity(Entity)`, static element access such as `this.model['Books']`, and clearer dynamic-query warning reasons.
- Persisted unknown DB query graph targets as semantic `db_entity:unknown` terminal nodes with source `callId` and parser-warning evidence, so fresh relinks no longer store numeric call ids as DB targets.
- Classified unresolved local service-client `.send`, `.emit`, `.publish`, and `.on` calls as terminal transport/client calls when the model does not declare a matching operation, while preserving real declared operations.
- Tightened doctor default local-service warnings and added compact `doctor --strict` symbol-call and DB-query quality aggregates with capped top unresolved examples.
- Added neutral regression fixtures for symbol-call noise, DB query forms, and local service-client methods.

## 0.1.13

- Added implementation-context fallback for local `cds.services.*` calls so helper packages can resolve model-package operations only when handler/dependency/registration evidence ties the caller repository to the target operation.
- Preserved same-repository local service resolution as the strongest path and added explicit evidence/reasons for implementation-context ownership, rejected candidates, and candidate-without-caller-ownership cases.
- Replaced fragile CAP DB query string extraction with AST traversal for chained `cds.run(SELECT/INSERT/UPDATE/DELETE...)` forms, including multiline `columns(...).where(...)` chains and `this.EntityName` targets.
- Kept genuinely dynamic DB queries terminal while exposing parser-warning evidence and rendering unknown targets as `Entity: unknown` instead of raw numeric call ids in table/Mermaid output.
- Further reduced symbol-call noise by filtering built-in collection/string methods, logger calls, global built-ins, third-party package property calls, and unindexed `this.container.method()` calls while retaining indexed local helpers and relative object-literal helper imports.
- Added doctor aggregate visibility for local service calls resolved by implementation context and calls left unresolved because candidates lack caller ownership.
- Updated README and technical notes to clarify generated constants remain low-level parser output rather than persisted graph facts.

## 0.1.12

- Resolved same-repository local CAP service calls by qualified CDS name, simple service name, and service path, with explicit local transport and alias-chain evidence.
- Made implementation matching decorator-aware so generated `Func*`/`Action*` constants outrank method-name fallback and contradictory decorators are rejected without making edges ambiguous.
- Cleared stale unresolved reasons from resolved symbol calls and suppressed false trace unresolved reasons for symbol edges with concrete callee ids.
- Made local symbol-call collection conservative, added named export-list support, and indexed one-level object-literal helper methods as executable symbols so traces can reach helper database queries.
- Added first-class symbol nodes and readable symbol labels/locations to JSON, table, and Mermaid trace output.
- Deduplicated implementation candidates by method identity while retaining multiple registration rows as nested evidence, and kept default doctor output from failing on explainable source-ownership gaps.
- Documented the generated-constant decision: this patch uses deterministic decorator normalization for linking while `parseGeneratedConstants` remains a low-level parser export rather than a persisted graph fact.

## 0.1.11

- Added repository-owned executable symbols, source-symbol ownership for outbound calls, and local symbol-call facts so traces can follow reachable same-file/imported helpers without including unrelated calls from the same file.
- Replaced local CAP service call extraction with AST alias tracking for `cds.services` lookups, ignored entity accessors, and linked local calls to exact local operations with explicit local transport evidence.
- Scoped service/path trace starts by repository, reports ambiguous starts instead of choosing the first row, and queues resolved implementation handlers by their handler repository and symbol identity.
- Deduplicated operation implementation candidates by logical identity while preserving distinct registration evidence in nested arrays.
- Link output now reports implementation-unresolved counts, table evidence falls back to nested implementation source locations, and depth `step` values remain within the requested scope depth.
- Generated-constant claims were removed from runtime documentation until persistence and resolution are fully integrated.
- Doctor now reports aggregate analyzer-quality diagnostics for systematic local-service, source-symbol, and trace-scope problems.

## 0.1.10

- Persist unresolved `OPERATION_IMPLEMENTED_BY_HANDLER` audit edges when implementation candidates exist but all are rejected, including ranked candidate evidence and rejected reasons.
- Added a conservative helper-owned implementation path for unique registered helper handlers that implement model-oriented CDS operations without direct package dependency evidence, while keeping multiple helper matches ambiguous and local service-path contradictions rejected.
- Trace output now includes operation-to-handler implementation hops and terminal handler nodes in JSON/table/Mermaid-compatible edge data, including runtime-resolved operation targets.
- Doctor now reports rejected implementation candidates and strict remote-target implementation coverage gaps without making entity-only services noisy by default.
- Updated Node compatibility errors, package metadata, and README wording so current behavior is not described with stale release-specific version strings.

## 0.1.9

- Fixed implementation dependency matching by binding graph repository ids as text when comparing against `graph_edges.from_id` and `graph_edges.to_id`, restoring cross-package application-to-model and application-to-handler evidence under `node:sqlite`.
- Improved implementation candidate ranking with model/application/handler package ownership, exact local service-path evidence, and cross-package dependency/import signals so duplicate operation names in different services resolve to the correct registered handler without false ambiguity.
- Expanded `OPERATION_IMPLEMENTED_BY_HANDLER` evidence with candidate ranks, scores, accepted/rejected reasons, package identities, service/operation paths, and dependency/ownership signals for auditability.
- Added neutral regression coverage for cross-package app/model/handler registration, duplicate same-name service operations, and graph-id string comparison behavior.

## 0.1.8

- Replaced regex-only handler registration extraction with TypeScript AST evidence for direct handler arrays, identifier arrays, spreads, imported arrays, default exports, aliases, and safe relative re-exports.
- Persisted class-level `handler_registrations` rows with registration file/line and import evidence so registered handlers can be resolved across same-repository and cross-package layouts.
- Relaxed implementation linking to support same-repository registrations, handler-package-owned registrations, and application registrations while preserving ambiguous candidate evidence.
- Continued trace traversal from static and runtime-resolved operations into registered implementation handlers via `OPERATION_IMPLEMENTED_BY_HANDLER` edges.
- Moved source discovery, reads, and fingerprinting into the protected repository indexing flow so failed reads preserve last-good facts/fingerprints and produce doctor-visible diagnostics.
- Added a legacy-schema doctor warning when migrated stores lack fresh foreign-key metadata for key tables.
- Suppressed the known `node:sqlite` experimental warning for normal supported-runtime database commands without suppressing application errors.
- Changed `index_run_abandoned` doctor policy to report only running index runs older than the documented 60-minute threshold, including run id and start time.

## 0.1.6

- Scoped runtime variable resolution to eligible dynamic, ambiguous, or unresolved remote edges with matching placeholders, preserving terminal and static resolved edge status, target, reason, and confidence.
- Clamped operation-resolution confidence to the `[0, 1]` range and retained original runtime expressions alongside effective substitutions and missing-variable evidence.
- Resolved helper/package dependency graph edges primarily by indexed package name, persisted ambiguous dependency candidates with evidence, and marked inserted helper edges with explicit statuses.
- Expanded repository fingerprints to include normalized package metadata, full `cds.requires`, scripts, package file content, and the analyzer version so metadata-only changes invalidate stale facts.
- Replaced the hard-coded CLI version with package metadata as the release source of truth and documented selector, graph variable, SQLite, fingerprint, freshness, and parser-warning semantics.

## 0.1.5

- Runtime `--var` substitution now re-runs operation resolution in memory for trace and graph output, clears stale unresolved reasons on exact matches, and traverses into the matched downstream handler without mutating the persisted graph.
- Operation nodes now use target CDS provenance while call-site evidence remains on edges.
- Graph edges now carry explicit status values for resolved, terminal, dynamic, ambiguous, and unresolved cases; normal DB, external HTTP, and event terminals no longer receive remote-resolution failure text.
- Replaced per-statement SQLite shelling with a persistent `node:sqlite` connection, bound parameters, transactions, read-only query openings, WAL, busy timeouts, and connection-local foreign-key enforcement.
- Added schema user-version migration support for edge status and repository fingerprints.
- Repository indexing now skips unchanged repositories unless `--force` is supplied and reports indexed/skipped counts.
- `service-flow --version` now matches package metadata for the 0.1.5 release.

## 0.1.4

- Resolved helper-returned service bindings exported through named export lists, including aliased exports, while preserving helper-chain evidence.
- Parsed `cds.connect.to(alias, options)` as separate alias, destination, and service-path evidence so dynamic service paths can resolve with runtime variables.
- Improved repository discovery so valid workspace-root Git repositories no longer prevent nested repository discovery, and empty `.git` markers are ignored.
- Added explicit SQLite foreign-key constraints for fresh databases and recorded alias-expression evidence for service bindings.
- Documented clearer operator guidance for test-file hygiene, doctor severity, and list/trace selector semantics.

## 0.1.3

- Propagated imported helper-returned `cds.connect.to(...)` bindings to caller-local service variables with helper-chain evidence.
- Changed operation resolution to prefer ambiguous/dynamic/unresolved graph edges over confident operation-path-only links.
- Improved chained CAP query entity extraction and table/JSON source-location evidence.
- Hardened trace traversal with repo-aware downstream scopes, stable visited keys, edge de-duplication, and cycle markers.
- Added safer clean behavior that only recursively removes marker-owned state directories.
- Added `doctor --strict` to separate entity-only service noise from action-oriented default diagnostics.

## 0.1.2

- Hardened SQLite CLI access with busy timeouts, retries, and larger read buffers for large graph/link runs.
- Improved CDS service extraction for annotation placement/whitespace variants and materialized inherited operations for `extend service` declarations.
- Scoped service binding resolution by source file and added helper-returned binding propagation to prevent cross-file variable false positives.
- Improved outbound call extraction for `SELECT.one.from` and common CAP query builders.
- Reworked trace traversal to consume linked graph edges recursively and populate JSON nodes.
- Added doctor health checks for silent index-quality issues.

## 0.1.0

- Initial `@saptools/service-flow` CLI package for indexing and tracing SAP CAP service flows.