@saptools/service-flow 0.1.31 → 0.1.32

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.32
+
+- Hardened operation-first trace starts to fail closed on ambiguous, rejected, or non-executable implementation evidence.
+- Made decorator normalization explicit and conservative for unsupported expressions.
+- Populated queryable external HTTP target metadata with sanitized labels and kept CAP candidates distinct from HTTP endpoints.
+- Removed accidental fresh-schema external-target columns from symbols and documented migration/re-index expectations.
+
 ## 0.1.31
 
 - Resolve operation and path trace selectors from indexed CDS operations and persisted implementation edges before conservative handler fallback, including generated `Action<Name>` and `Func<Name>` decorator constants whose method names differ from public operation names.

package/README.md

@@ -490,3 +490,14 @@ The `graph` command accepts repeatable `--var key=value` options, matching `trac
 ### 0.1.17 parser ownership policy
 
 Outbound call extraction is AST-based and ignores comments, block comments, and string literals. CAP/service `.on(...)` registrations are indexed only when the receiver has CAP/service evidence, and top-level registrations receive `module:<relative-file>#event:<event-name>:<line>` synthetic owners. Generic event emitters such as desktop or window events are ignored by default rather than guessed as CAP async edges. Unsupported source shapes are surfaced through diagnostics and strict doctor ownerless categories instead of guessed graph edges.
+
+
+## 0.1.32 hardening notes
+
+Operation trace starts resolve indexed CDS operations before handler fallback. Ambiguous operation matches, ambiguous/rejected implementation edges, and resolved edges without an executable handler scope now fail closed with structured `resolutionStage` and `resolutionStatus` diagnostics and no speculative traversal. Handler fallback is only considered when no indexed CDS operation matches and the fallback is unique under the existing registration and ownership policy.
+
+Decorator signals are interpreted as resolved, absent, unsupported, or malformed. Only resolved string/template values, generated `Action<Name>.name`/`Func<Name>.name` constants, qualified generated constants ending in `.name`, and narrow safe `String(identifier)` wrappers can contradict method-name fallback. Unsupported expressions are preserved as evidence but are not treated as proof that a handler targets another operation.
+
+External HTTP facts persist queryable target kind, stable id, safe label, and dynamic flag on `outbound_calls`; graph evidence uses the same sanitized model. URL user info, fragments, query values, headers, cookies, credentials, tokens, API keys, and request/response bodies are not persisted. Legacy workspaces may relink from old evidence when possible, but full semantic enrichment requires re-index plus relink when old parser facts did not contain safe target metadata.
+
+Graph taxonomy now keeps CAP operation candidates separate from external HTTP targets. Dynamic, ambiguous, and unresolved CAP calls use operation-candidate semantics, external destinations/endpoints are produced only by `external_http` calls, and terminal local transport-client methods use transport-method semantics rather than external HTTP edges. `doctor --strict` reports external target quality and taxonomy consistency.

package/dist/{chunk-AM2JZFQ6.js → chunk-VT5FVMOA.js}

@@ -720,6 +720,52 @@ function topLevelQueryIndex(text) {
 import fs6 from "fs/promises";
 import path7 from "path";
 import ts4 from "typescript";
+
+// src/linker/external-http-target.ts
+import { createHash } from "crypto";
+var sensitiveKeys = /* @__PURE__ */ new Set(["token", "access_token", "id_token", "api_key", "apikey", "key", "password", "passwd", "pwd", "secret", "client_secret", "authorization", "cookie", "signature"]);
+function hash(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function methodPrefix(method) {
+  return typeof method === "string" && method.length > 0 ? `${method.toUpperCase()} ` : "";
+}
+function redactUrl(value) {
+  try {
+    const url = new URL(value, value.startsWith("/") ? "https://relative.invalid" : void 0);
+    url.username = "";
+    url.password = "";
+    for (const key of [...url.searchParams.keys()]) url.searchParams.set(key, sensitiveKeys.has(key.toLowerCase()) ? "<redacted>" : "<redacted>");
+    const path9 = `${url.pathname}${url.search ? url.search : ""}`;
+    return value.startsWith("/") ? path9 : `${url.origin}${path9}`;
+  } catch {
+    return value.replace(/([?&][^=;&]*(?:token|key|password|secret|cookie|authorization)[^=;&]*=)[^&]*/gi, "$1<redacted>");
+  }
+}
+function externalHttpTarget(call) {
+  const evidence = typeof call.evidence_json === "string" ? safeParse(call.evidence_json) : {};
+  const target = evidence.externalTarget && typeof evidence.externalTarget === "object" && !Array.isArray(evidence.externalTarget) ? evidence.externalTarget : {};
+  const method = typeof call.method === "string" ? call.method : typeof target.method === "string" ? target.method : void 0;
+  const kind = typeof target.kind === "string" ? target.kind : "unknown";
+  const expression = typeof target.expression === "string" ? target.expression : void 0;
+  if (kind === "destination" && expression) return { kind, toKind: "external_destination", toId: `destination:${expression}`, label: `External destination: ${expression}`, method, dynamic: false, expression };
+  if (kind === "static_url" && expression) {
+    const redacted = redactUrl(expression);
+    return { kind, toKind: "external_endpoint", toId: `endpoint:${hash(`${method ?? ""}:${redacted}`)}`, label: `External endpoint: ${methodPrefix(method)}${redacted}`, method, dynamic: false, expression: redacted };
+  }
+  if (kind === "url_expression" && expression) return { kind, toKind: "external_endpoint", toId: `dynamic:${hash(expression)}`, label: `External endpoint: ${methodPrefix(method)}dynamic URL`, method, dynamic: true, expression: `expr:${hash(expression)}` };
+  return { kind: "unknown", toKind: "external_endpoint", toId: "unknown", label: "External endpoint: unknown", method, dynamic: false };
+}
+function safeParse(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+// src/parsers/outbound-call-parser.ts
 function lineOf3(text, idx) {
   return text.slice(0, idx).split("\n").length;
 }
@@ -996,7 +1042,11 @@ function classifyOutboundCallsInSource(source, filePath) {
         }
       } else {
         const external = externalHttpEvidence(node, source, initializers);
-        if (external) add(node, { callType: "external_http", method: external.method, payloadSummary: summarizeExpression(node.arguments.map((arg) => arg.getText(source)).join(", ")), confidence: 0.7, unresolvedReason: "External HTTP destination is outside indexed CAP services" }, { classifier: external.classifier, externalTarget: { ...external.externalTarget, method: external.method, parserClassifier: external.classifier, sourceCallShape: external.sourceCallShape }, sourceCallShape: external.sourceCallShape });
+        if (external) {
+          const evidenceTarget = { ...external.externalTarget, method: external.method, parserClassifier: external.classifier, sourceCallShape: external.sourceCallShape };
+          const safeTarget = externalHttpTarget({ method: external.method, evidence_json: JSON.stringify({ externalTarget: evidenceTarget }) });
+          add(node, { callType: "external_http", method: external.method, payloadSummary: void 0, confidence: 0.7, unresolvedReason: "External HTTP destination is outside indexed CAP services", externalTarget: { kind: safeTarget.kind, stableId: safeTarget.toId, label: safeTarget.label, dynamic: safeTarget.dynamic } }, { classifier: external.classifier, externalTarget: safeTarget, sourceCallShape: external.sourceCallShape });
+        }
       }
     }
     ts4.forEachChild(node, visit);
@@ -1450,16 +1500,16 @@ async function parseServiceBindings(repoPath, filePath) {
         helperChain: aliasKind === "assignment" ? [{ callerVariable: targetName, assignedFrom: call.expression.getText(sourceFileAst), aliasKind, scopeRule: "same-file-source-order" }] : void 0
       });
     else if (ts5.isIdentifier(call.expression)) {
-      const resolved = await importedHelper(call.expression.text);
-      if (resolved)
+      const resolved2 = await importedHelper(call.expression.text);
+      if (resolved2)
         out.push({
           variableName: targetName,
-          alias: resolved.helper.alias,
-          aliasExpr: resolved.helper.aliasExpr,
-          destinationExpr: resolved.helper.destinationExpr,
-          servicePathExpr: resolved.helper.servicePathExpr,
-          isDynamic: resolved.helper.isDynamic,
-          placeholders: resolved.helper.placeholders,
+          alias: resolved2.helper.alias,
+          aliasExpr: resolved2.helper.aliasExpr,
+          destinationExpr: resolved2.helper.destinationExpr,
+          servicePathExpr: resolved2.helper.servicePathExpr,
+          isDynamic: resolved2.helper.isDynamic,
+          placeholders: resolved2.helper.placeholders,
           sourceFile: normalizePath(filePath),
           sourceLine: lineOf4(sourceFileAst, node),
           helperChain: [
@@ -1467,10 +1517,10 @@ async function parseServiceBindings(repoPath, filePath) {
               callerVariable: targetName,
               ...aliasKind === "assignment" ? { assignedFrom: call.expression.text, aliasKind, scopeRule: "same-file-source-order" } : {},
               importedHelper: call.expression.text,
-              importSource: resolved.imp.sourceFile,
-              exportedSymbol: resolved.imp.exportedName,
-              helperSourceFile: resolved.helper.sourceFile,
-              helperSourceLine: resolved.helper.sourceLine
+              importSource: resolved2.imp.sourceFile,
+              exportedSymbol: resolved2.imp.exportedName,
+              helperSourceFile: resolved2.helper.sourceFile,
+              helperSourceLine: resolved2.helper.sourceLine
             }
           ]
         });
@@ -1497,18 +1547,18 @@ async function parseServiceBindings(repoPath, filePath) {
       const propertyName = el.propertyName && ts5.isIdentifier(el.propertyName) ? el.propertyName.text : el.name.text;
       const matches = helpers.filter((row) => row.helper.returnedProperty === propertyName);
       if (matches.length !== 1) continue;
-      const resolved = matches[0];
+      const resolved2 = matches[0];
       out.push({
         variableName: el.name.text,
-        alias: resolved.helper.alias,
-        aliasExpr: resolved.helper.aliasExpr,
-        destinationExpr: resolved.helper.destinationExpr,
-        servicePathExpr: resolved.helper.servicePathExpr,
-        isDynamic: resolved.helper.isDynamic,
-        placeholders: resolved.helper.placeholders,
+        alias: resolved2.helper.alias,
+        aliasExpr: resolved2.helper.aliasExpr,
+        destinationExpr: resolved2.helper.destinationExpr,
+        servicePathExpr: resolved2.helper.servicePathExpr,
+        isDynamic: resolved2.helper.isDynamic,
+        placeholders: resolved2.helper.placeholders,
         sourceFile: normalizePath(filePath),
         sourceLine: lineOf4(sourceFileAst, decl),
-        helperChain: [{ callerVariable: el.name.text, helperFunction: call.expression.getText(sourceFileAst), returnedProperty: propertyName, importSource: resolved.imp?.sourceFile, exportedSymbol: resolved.imp?.exportedName, helperSourceFile: resolved.helper.sourceFile, helperSourceLine: resolved.helper.sourceLine }]
+        helperChain: [{ callerVariable: el.name.text, helperFunction: call.expression.getText(sourceFileAst), returnedProperty: propertyName, importSource: resolved2.imp?.sourceFile, exportedSymbol: resolved2.imp?.exportedName, helperSourceFile: resolved2.helper.sourceFile, helperSourceLine: resolved2.helper.sourceLine }]
       });
     }
   }
@@ -1530,18 +1580,18 @@ async function parseServiceBindings(repoPath, filePath) {
       if (!propertyName || !targetName) continue;
       const matches = helpers.filter((row) => row.helper.returnedProperty === propertyName);
       if (matches.length !== 1) continue;
-      const resolved = matches[0];
+      const resolved2 = matches[0];
       out.push({
         variableName: targetName,
-        alias: resolved.helper.alias,
-        aliasExpr: resolved.helper.aliasExpr,
-        destinationExpr: resolved.helper.destinationExpr,
-        servicePathExpr: resolved.helper.servicePathExpr,
-        isDynamic: resolved.helper.isDynamic,
-        placeholders: resolved.helper.placeholders,
+        alias: resolved2.helper.alias,
+        aliasExpr: resolved2.helper.aliasExpr,
+        destinationExpr: resolved2.helper.destinationExpr,
+        servicePathExpr: resolved2.helper.servicePathExpr,
+        isDynamic: resolved2.helper.isDynamic,
+        placeholders: resolved2.helper.placeholders,
         sourceFile: normalizePath(filePath),
         sourceLine: lineOf4(sourceFileAst, node),
-        helperChain: [{ callerVariable: targetName, assignedFrom: call.expression.getText(sourceFileAst), aliasKind: "assignment", scopeRule: "same-file-source-order", returnedProperty: propertyName, importSource: resolved.imp?.sourceFile, exportedSymbol: resolved.imp?.exportedName, helperSourceFile: resolved.helper.sourceFile, helperSourceLine: resolved.helper.sourceLine }]
+        helperChain: [{ callerVariable: targetName, assignedFrom: call.expression.getText(sourceFileAst), aliasKind: "assignment", scopeRule: "same-file-source-order", returnedProperty: propertyName, importSource: resolved2.imp?.sourceFile, exportedSymbol: resolved2.imp?.exportedName, helperSourceFile: resolved2.helper.sourceFile, helperSourceLine: resolved2.helper.sourceLine }]
       });
     }
   }
@@ -1942,62 +1992,28 @@ function generatedFromConstantName(value) {
   }
   return void 0;
 }
-function normalizeDecoratorOperation(value, raw) {
-  if (value) {
-    const literal = clean(value);
-    const generated = generatedFromConstantName(literal);
-    return generated ?? normalizedOperationName(literal);
-  }
-  if (!raw) return void 0;
+function resolved(value, raw) {
+  const literal = clean(value);
+  const generated = generatedFromConstantName(literal);
+  return { status: "resolved", operationName: generated ?? normalizedOperationName(literal), raw };
+}
+function normalizeDecoratorOperationSignal(value, raw, candidateOperation) {
+  if (value) return resolved(value, raw);
+  if (!raw || raw.trim().length === 0) return { status: "none", raw };
   const expression = raw.trim();
   const nameMatch = /(?:^|\.)(Action[A-Z][\w$]*|Func[A-Z][\w$]*)\.name$/.exec(expression);
-  if (nameMatch?.[1]) return generatedFromConstantName(nameMatch[1]);
-  const tail = expression.split(".").filter(Boolean).at(-1);
-  return tail ? normalizedOperationName(clean(tail)) : void 0;
-}
-
-// src/linker/external-http-target.ts
-import { createHash } from "crypto";
-var sensitiveKeys = /* @__PURE__ */ new Set(["token", "access_token", "id_token", "api_key", "apikey", "key", "password", "passwd", "pwd", "secret", "client_secret", "authorization", "cookie", "signature"]);
-function hash(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function methodPrefix(method) {
-  return typeof method === "string" && method.length > 0 ? `${method.toUpperCase()} ` : "";
-}
-function redactUrl(value) {
-  try {
-    const url = new URL(value, value.startsWith("/") ? "https://relative.invalid" : void 0);
-    url.username = "";
-    url.password = "";
-    for (const key of [...url.searchParams.keys()]) url.searchParams.set(key, sensitiveKeys.has(key.toLowerCase()) ? "<redacted>" : "<redacted>");
-    const path9 = `${url.pathname}${url.search ? url.search : ""}`;
-    return value.startsWith("/") ? path9 : `${url.origin}${path9}`;
-  } catch {
-    return value.replace(/([?&][^=;&]*(?:token|key|password|secret|cookie|authorization)[^=;&]*=)[^&]*/gi, "$1<redacted>");
-  }
-}
-function externalHttpTarget(call) {
-  const evidence = typeof call.evidence_json === "string" ? safeParse(call.evidence_json) : {};
-  const target = evidence.externalTarget && typeof evidence.externalTarget === "object" && !Array.isArray(evidence.externalTarget) ? evidence.externalTarget : {};
-  const method = typeof call.method === "string" ? call.method : typeof target.method === "string" ? target.method : void 0;
-  const kind = typeof target.kind === "string" ? target.kind : "unknown";
-  const expression = typeof target.expression === "string" ? target.expression : void 0;
-  if (kind === "destination" && expression) return { kind, toKind: "external_destination", toId: `destination:${expression}`, label: `External destination: ${expression}`, method, dynamic: false, expression };
-  if (kind === "static_url" && expression) {
-    const redacted = redactUrl(expression);
-    return { kind, toKind: "external_endpoint", toId: `endpoint:${hash(`${method ?? ""}:${redacted}`)}`, label: `External endpoint: ${methodPrefix(method)}${redacted}`, method, dynamic: false, expression: redacted };
-  }
-  if (kind === "url_expression" && expression) return { kind, toKind: "external_endpoint", toId: `dynamic:${hash(expression)}`, label: `External endpoint: ${methodPrefix(method)}dynamic URL`, method, dynamic: true, expression: `expr:${hash(expression)}` };
-  return { kind: "unknown", toKind: "external_endpoint", toId: "unknown", label: "External endpoint: unknown", method, dynamic: false };
-}
-function safeParse(value) {
-  try {
-    const parsed = JSON.parse(value);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
+  if (nameMatch?.[1]) return resolved(nameMatch[1], expression);
+  const stringMatch = /^String\(([A-Za-z_$][\w$]*)\)$/.exec(expression);
+  if (stringMatch?.[1]) {
+    const identifier = stringMatch[1];
+    const generated = generatedFromConstantName(identifier);
+    const normalizedCandidate = candidateOperation ? normalizedOperationName(candidateOperation) : void 0;
+    if (generated) return { status: "resolved", operationName: generated, raw: expression };
+    if (normalizedCandidate && identifier === normalizedCandidate) return { status: "resolved", operationName: identifier, raw: expression };
+    return { status: "unsupported", raw: expression, reason: "string_wrapper_identifier_not_resolved" };
+  }
+  if (/^[`'"]/.test(expression) && !/[`'"]$/.test(expression)) return { status: "malformed", raw: expression, reason: "unterminated_literal" };
+  return { status: "unsupported", raw: expression, reason: "unsupported_decorator_expression" };
 }
 
 // src/linker/cross-repo-linker.ts
@@ -2059,7 +2075,7 @@ function insertCallEdge(db, workspaceId, call, vars, generation) {
     return { status: "terminal", callType };
   }
   if (callType === "local_service_call" && call.unresolved_reason === "transport_client_method" && !resolution.target && resolution.candidates.length === 0) {
-    db.prepare("INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,generation) VALUES(?,?,?,?,?,?,?,?,?,?,?)").run(workspaceId, "HANDLER_CALLS_EXTERNAL_HTTP", "terminal", "call", String(call.id), "external", String(op || "transport_client_method"), Number(call.confidence ?? 0.5), JSON.stringify({ ...evidence, classification: "transport_client_method" }), 0, generation);
+    db.prepare("INSERT INTO graph_edges(workspace_id,edge_type,status,from_kind,from_id,to_kind,to_id,confidence,evidence_json,is_dynamic,generation) VALUES(?,?,?,?,?,?,?,?,?,?,?)").run(workspaceId, "HANDLER_CALLS_TRANSPORT_METHOD", "terminal", "call", String(call.id), "transport_method", String(op || "transport_client_method"), Number(call.confidence ?? 0.5), JSON.stringify({ ...evidence, classification: "transport_client_method" }), 0, generation);
     return { status: "terminal", callType };
   }
   if (resolution.target) {
@@ -2070,7 +2086,7 @@ function insertCallEdge(db, workspaceId, call, vars, generation) {
   const status = edgeType === "DYNAMIC_EDGE_CANDIDATE" ? "dynamic" : resolution.status === "ambiguous" ? "ambiguous" : edgeType === "UNRESOLVED_EDGE" ? "unresolved" : "terminal";
   const unresolvedReason = status === "terminal" ? null : String(call.unresolved_reason ?? unresolvedOperationReason(resolution));
   const externalTarget = callType === "external_http" ? externalHttpTarget(call) : void 0;
-  const targetKind = callType === "local_db_query" ? "db_entity" : callType.startsWith("async_") ? "event" : externalTarget?.toKind ?? "external_endpoint";
+  const targetKind = callType === "local_db_query" ? "db_entity" : callType.startsWith("async_") ? "event" : callType === "external_http" ? externalTarget?.toKind ?? "external_endpoint" : "operation_candidate";
   const targetId = callType === "local_db_query" ? String(call.query_entity ?? "unknown") : callType === "remote_action" ? op ? `Remote action: ${op}` : call.unresolved_reason === "dynamic_operation_path_identifier" ? "Remote action: dynamic path" : "Remote action: unknown path" : callType === "external_http" ? String(externalTarget?.toId ?? "unknown") : String(call.event_name_expr ?? op ?? "unknown");
   const graphLevelDynamic = edgeType === "DYNAMIC_EDGE_CANDIDATE" && resolution.status === "dynamic";
   const finalEvidence = externalTarget ? { ...evidence, externalTarget } : evidence;
@@ -2329,9 +2345,9 @@ function candidateEvidence(candidate, rank) {
 }
 function implementationMethodSignal(row, operation) {
   const op = normalizedOperationName(String(operation.operationPath ?? operation.operationName ?? ""));
-  const decorator = normalizeDecoratorOperation(typeof row.decoratorValue === "string" ? row.decoratorValue : void 0, typeof row.decoratorRawExpression === "string" ? row.decoratorRawExpression : void 0);
-  if (decorator && decorator === op) return { matches: true, contradicted: false, acceptedReasons: ["decorator targets operation"], rejectedReasons: [] };
-  if (decorator && decorator !== op) return { matches: false, contradicted: true, acceptedReasons: [], rejectedReasons: ["method_name_matches_but_decorator_targets_different_operation"] };
+  const decorator = normalizeDecoratorOperationSignal(typeof row.decoratorValue === "string" ? row.decoratorValue : void 0, typeof row.decoratorRawExpression === "string" ? row.decoratorRawExpression : void 0, op);
+  if (decorator.status === "resolved" && decorator.operationName === op) return { matches: true, contradicted: false, acceptedReasons: ["decorator targets operation"], rejectedReasons: [] };
+  if (decorator.status === "resolved" && decorator.operationName !== op) return { matches: false, contradicted: true, acceptedReasons: [], rejectedReasons: ["method_name_matches_but_decorator_targets_different_operation"] };
   if (String(row.methodName ?? "") === op) return { matches: true, contradicted: false, acceptedReasons: ["method name fallback matched operation"], rejectedReasons: [] };
   return { matches: false, contradicted: false, acceptedReasons: [], rejectedReasons: ["method name does not match operation"] };
 }
@@ -2363,17 +2379,17 @@ function operationStartScope(db, repoId, start) {
     FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id
     WHERE (? IS NULL OR r.id=?) AND (? IS NULL OR s.service_path=?) AND (o.operation_name=? OR o.operation_path=? OR o.operation_path=?)
     ORDER BY r.name,s.service_path,o.operation_name,o.id`).all(repoId, repoId, start.servicePath, start.servicePath, requested, requested, requested.startsWith("/") ? requested : `/${requested}`);
-  if (rows2.length === 0) return { diagnostics: [{ severity: "warning", code: "trace_start_not_found", message: "No indexed operation matched the requested trace selector", normalizedSelectorValue: requested }] };
+  if (rows2.length === 0) return void 0;
   const repoCount = new Set(rows2.map((row) => String(row.repoName))).size;
   const serviceCount = new Set(rows2.map((row) => `${String(row.repoName)}:${String(row.servicePath)}`)).size;
-  if (!repoId && repoCount > 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple repositories; add --repo to disambiguate", normalizedSelectorValue: requested, candidates: rows2 }] };
-  if (!start.servicePath && serviceCount > 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple services; add --service to disambiguate", normalizedSelectorValue: requested, candidates: rows2 }] };
-  if (rows2.length !== 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple indexed operations", normalizedSelectorValue: requested, candidates: rows2 }] };
+  if (!repoId && repoCount > 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple repositories; add --repo to disambiguate", normalizedSelectorValue: requested, resolutionStage: "operation", resolutionStatus: "ambiguous_operation", candidates: rows2 }] };
+  if (!start.servicePath && serviceCount > 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple services; add --service to disambiguate", normalizedSelectorValue: requested, resolutionStage: "operation", resolutionStatus: "ambiguous_operation", candidates: rows2 }] };
+  if (rows2.length !== 1) return { diagnostics: [{ severity: "warning", code: "trace_start_ambiguous", message: "Operation trace start matched multiple indexed operations", normalizedSelectorValue: requested, resolutionStage: "operation", resolutionStatus: "ambiguous_operation", candidates: rows2 }] };
   const operationId = String(rows2[0]?.operationId);
   const impl = implementationScope(db, operationId);
   if (impl.edge?.status === "resolved" && impl.files.size > 0) return { files: impl.files, symbols: impl.symbolId ? /* @__PURE__ */ new Set([impl.symbolId]) : void 0, operationId, diagnostics: [] };
-  if (impl.edge) return { operationId, diagnostics: [{ severity: "warning", code: impl.edge.status === "ambiguous" ? "trace_start_ambiguous" : "trace_start_not_found", message: `Indexed operation matched but implementation edge is ${String(impl.edge.status ?? "unresolved")}`, implementationEdgeId: impl.edge.id, implementationStatus: impl.edge.status, candidates: parseEvidence(impl.edge.evidence_json).candidates }] };
-  return { operationId, diagnostics: [{ severity: "warning", code: "trace_start_not_found", message: "Indexed operation matched but no implementation candidate exists" }] };
+  if (impl.edge) return { operationId, diagnostics: [{ severity: "warning", code: impl.edge.status === "ambiguous" ? "trace_start_ambiguous" : "trace_start_implementation_unresolved", message: `Indexed operation matched but implementation edge is ${String(impl.edge.status ?? "unresolved")}`, resolutionStage: "implementation", resolutionStatus: impl.edge.status === "ambiguous" ? "ambiguous_implementation" : "rejected_implementation", implementationEdgeId: impl.edge.id, implementationStatus: impl.edge.status, candidates: parseEvidence(impl.edge.evidence_json).candidates }] };
+  return { operationId, diagnostics: [{ severity: "warning", code: "trace_start_implementation_unresolved", message: "Indexed operation matched but no implementation candidate exists", resolutionStage: "implementation", resolutionStatus: "operation_without_implementation" }] };
 }
 function sourceFilesForStart(db, repoId, start) {
   const handler = start.handler;
@@ -2421,7 +2437,8 @@ function startScope(db, start) {
   ).get(start.repo, start.repo) : void 0;
   if (start.repo && !repo) return { repo, selectorMatched: false };
   const operationScope = operationStartScope(db, repo?.id, start);
-  const sourceScope = operationScope?.files ? operationScope : sourceFilesForStart(db, repo?.id, start);
+  const terminalOperationScope = operationScope && !operationScope.files && (operationScope.diagnostics ?? []).some((d) => d.resolutionStage === "operation" || d.resolutionStage === "implementation");
+  const sourceScope = operationScope?.files || terminalOperationScope ? operationScope : sourceFilesForStart(db, repo?.id, start);
   const sourceFiles = sourceScope?.files;
   const hasSelector = Boolean(
     start.handler ?? start.operation ?? start.operationPath ?? start.servicePath
@@ -2432,7 +2449,7 @@ function startScope(db, start) {
     repo,
     sourceFiles,
     symbolIds: sourceScope?.symbols,
-    selectorMatched: !hasSelector || sourceFiles !== void 0,
+    selectorMatched: !terminalOperationScope && (!hasSelector || sourceFiles !== void 0),
     startOperationId: operationScope?.operationId,
     startDiagnostics: operationScope?.diagnostics
   };
@@ -2711,7 +2728,7 @@ function trace(db, start, options) {
     const op = operationNode(db, scope.startOperationId);
     const impl = implementationScope(db, scope.startOperationId);
     if (op) nodes.set(String(op.id), op);
-    if (impl.edge) {
+    if (impl.edge && impl.edge.status === "resolved") {
       const implEvidence = { ...parseEvidence(impl.edge.evidence_json), startResolution: { strategy: "indexed_operation_graph", matchedOperationId: scope.startOperationId, implementationEdgeId: impl.edge.id, implementationStatus: impl.edge.status, selectedHandlerMethodId: impl.edge.status === "resolved" ? impl.edge.to_id : void 0 } };
       const handlerNode = impl.edge.status === "resolved" ? handlerMethodNode(db, impl.edge.to_id) : void 0;
       if (handlerNode) nodes.set(String(handlerNode.id), handlerNode);
@@ -2867,4 +2884,4 @@ export {
   linkWorkspace,
   trace
 };
-//# sourceMappingURL=chunk-AM2JZFQ6.js.map
+//# sourceMappingURL=chunk-VT5FVMOA.js.map