@saptools/service-flow 0.1.72 → 0.1.73

package/dist/cli.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import {
   ANALYZER_VERSION,
+  DEFAULT_EVENT_ENVIRONMENT_KEYS,
+  EVENT_ENVIRONMENT_KEY_CAP,
   PreparedRepositorySnapshotError,
   VERSION,
   analyzePackagePublicSurface,
@@ -34,6 +36,7 @@ import {
   loadPackageJsonSnapshot,
   loadRepositorySourceContext,
   migrate,
+  normalizeEventEnvironmentKeys,
   normalizeODataOperationInvocationPath,
   normalizePath,
   parseCdsFile,
@@ -55,8 +58,9 @@ import {
   sha256Text,
   stableLocalValueReference,
   symbolImportReference,
-  trace
-} from "./chunk-Z6D433R5.js";
+  trace,
+  validEventEnvironmentKey
+} from "./chunk-32WOTGTS.js";
 
 // src/cli.ts
 import { Command, Option } from "commander";
@@ -81,10 +85,18 @@ var DEFAULT_DB_FILE = "service-flow.db";
 import fs from "fs/promises";
 import path from "path";
 import { z } from "zod";
+var environmentKeys = z.array(
+  z.string().refine(validEventEnvironmentKey)
+).min(1).max(EVENT_ENVIRONMENT_KEY_CAP).transform(
+  normalizeEventEnvironmentKeys
+);
 var schema = z.object({
   rootPath: z.string(),
   dbPath: z.string(),
   ignore: z.array(z.string()),
+  eventEnvironmentKeys: environmentKeys.default(
+    [...DEFAULT_EVENT_ENVIRONMENT_KEYS]
+  ),
   createdAt: z.string(),
   updatedAt: z.string()
 });
@@ -121,6 +133,7 @@ function createWorkspaceConfig(rootPath, dbPath, ignore = [...DEFAULT_IGNORES])
     rootPath: root,
     dbPath: path.resolve(dbPath ?? defaultDbPath(root)),
     ignore,
+    eventEnvironmentKeys: [...DEFAULT_EVENT_ENVIRONMENT_KEYS],
     createdAt: now,
     updatedAt: now
   };
@@ -2594,8 +2607,12 @@ function resetPackageEventCalls(db, workspaceId, targetRepoId, names, batch) {
     const source = call.evidence.eventNameConstantSourceExpression;
     if (typeof source !== "string" || source.length === 0)
       throw new Error("invalid_current_package_event_constant_evidence");
-    const reason = call.evidence.receiverClassification === "unproven" ? call.unresolvedReason : "event_name_constant_resolution_pending";
-    update.run(source, reason, pendingEventEvidence(call.evidence), call.id);
+    update.run(
+      source,
+      "event_name_constant_resolution_pending",
+      pendingEventEvidence(call.evidence),
+      call.id
+    );
     batch.affectedCallerRepoIds.add(call.repoId);
     matched = true;
   }
@@ -2696,7 +2713,7 @@ function invalidateEventSurfaceFacts(db, repoId, calls, nextEnvironmentJson) {
 }
 
 // src/indexer/repository-indexer.ts
-async function prepareRepositoryIndex(repo, force, instrumentation) {
+async function prepareRepositoryIndex(repo, force, instrumentation, eventEnvironmentKeys) {
   const sourceFiles = await findSourceFiles(repo.absolute_path);
   const packageSnapshot = await loadPackageJsonSnapshot(repo.absolute_path, {
     strict: true,
@@ -2708,13 +2725,23 @@ async function prepareRepositoryIndex(repo, force, instrumentation) {
     sourceFiles,
     instrumentation
   );
+  const environmentDeclarations = collectEnvironmentDeclarations(
+    sources,
+    eventEnvironmentKeys
+  );
   const fingerprint = repositoryFingerprint(
     sources,
     packageFacts,
-    packageSnapshot.rawText
+    packageSnapshot.rawText,
+    environmentDeclarations
   );
   if (!force && repo.fingerprint === fingerprint) return { repo, fileCount: 0, diagnosticCount: 0, skipped: true };
-  const parsedFacts = await parseAllSourceFacts(repo.absolute_path, sources);
+  const parsedFacts = await parseAllSourceFacts(
+    repo.absolute_path,
+    sources,
+    environmentDeclarations,
+    eventEnvironmentKeys
+  );
   const packageSurface = analyzeRepositoryPackageSurface(
     packageFacts,
     packageSnapshot.manifest,
@@ -2731,7 +2758,7 @@ async function prepareRepositoryIndex(repo, force, instrumentation) {
     kind: await classifyRepository(repo.absolute_path, packageFacts),
     parsed,
     packagePublicSurface: packageSurface.surface,
-    environmentDeclarations: collectEnvironmentDeclarations(sources),
+    environmentDeclarations,
     fileCount: sourceFiles.length,
     diagnosticCount: parsed.handlers.filter((handler) => handler.hasHandlerDecorator && (handler.methods.length === 0 || handler.methods.some((method) => !handlerMethodIsExecutable(method)))).length,
     skipped: false
@@ -2822,11 +2849,16 @@ function recordIndexFailure(db, repoId, error) {
   )`).run(repoId);
   db.prepare("INSERT INTO diagnostics(repo_id,severity,code,message) VALUES(?,?,?,?)").run(repoId, "error", "source_read_failed", `Index failed before publication; previous facts and fingerprint were preserved. ${message}`);
 }
-async function parseAllSourceFacts(root, sources) {
+async function parseAllSourceFacts(root, sources, environmentDeclarations, eventEnvironmentKeys) {
   const facts = { services: [], handlers: [], registrations: [], bindings: [], calls: [], symbols: [], symbolCalls: [], generatedConstants: [], fileRecords: [] };
   for (const snapshot of sources.entries()) {
     const file = snapshot.filePath;
-    facts.fileRecords.push({ relativePath: normalizePath(file), extension: path5.extname(file), sha256: sha256Text(snapshot.text), sizeBytes: snapshot.sizeBytes });
+    facts.fileRecords.push({
+      relativePath: normalizePath(file),
+      extension: path5.extname(file),
+      sha256: sourceFactHash(snapshot, environmentDeclarations),
+      sizeBytes: snapshot.sizeBytes
+    });
     if (file.endsWith(".cds")) facts.services.push(...await parseCdsFile(root, file, sources));
     if (/\.[jt]s$/.test(file)) {
       const source = snapshot.sourceFile();
@@ -2837,7 +2869,12 @@ async function parseAllSourceFacts(root, sources) {
           source,
           file
         ),
-        eventEnvironmentReferenceResolver: createEventEnvironmentReferenceResolver(sources, source, file)
+        eventEnvironmentReferenceResolver: createEventEnvironmentReferenceResolver(
+          sources,
+          source,
+          file,
+          eventEnvironmentKeys
+        )
       });
       facts.handlers.push(...await parseDecorators(root, file, sources));
       facts.registrations.push(...await parseHandlerRegistrations(root, file, sources));
@@ -2893,7 +2930,7 @@ function isDefaultTestFile(relativeFile) {
   if (parts.some((part) => ["test", "tests", "__tests__"].includes(part))) return true;
   return /\.(test|spec)\.[jt]s$/.test(parts.at(-1) ?? "");
 }
-function repositoryFingerprint(sources, facts, packageJsonText) {
+function repositoryFingerprint(sources, facts, packageJsonText, environmentDeclarations) {
   const normalizedFacts = {
     analyzerVersion: ANALYZER_VERSION,
     packageName: facts.packageName,
@@ -2902,13 +2939,33 @@ function repositoryFingerprint(sources, facts, packageJsonText) {
     cdsRequires: [...facts.cdsRequires].sort((a, b) => a.alias.localeCompare(b.alias)),
     scripts: Object.fromEntries(Object.entries(facts.scripts).sort()),
     includeTests: false,
+    eventEnvironmentKeys: environmentDeclarations.allowedKeys,
     packageJsonHash: sha256Text(packageJsonText)
   };
   const entries = [`facts:${JSON.stringify(normalizedFacts)}`];
   for (const snapshot of sources.entries())
-    entries.push(`${snapshot.filePath}:${sha256Text(snapshot.text)}`);
+    entries.push(
+      `${snapshot.filePath}:${sourceFactHash(snapshot, environmentDeclarations)}`
+    );
   return sha256Text(entries.join("\n"));
 }
+function sourceFactHash(snapshot, environmentDeclarations) {
+  if (!isEnvironmentFactInput(snapshot.filePath))
+    return sha256Text(snapshot.text);
+  const declarations = environmentDeclarations.declarations.filter(
+    (item) => item.sourceFile === snapshot.filePath
+  );
+  return sha256Text(JSON.stringify({
+    allowedKeys: environmentDeclarations.allowedKeys,
+    declarations
+  }));
+}
+function isEnvironmentFactInput(filePath) {
+  const name = filePath.split("/").at(-1);
+  return ["nodemon.json", ".env", "mta.yaml", "manifest.yml"].includes(
+    name ?? ""
+  );
+}
 
 // src/indexer/cds-extension-resolver.ts
 function materializeCdsExtensionOperations(db, workspaceId, excludedRepoIds = /* @__PURE__ */ new Set()) {
@@ -3088,7 +3145,12 @@ async function indexWorkspace(db, workspaceId, options) {
     rows: []
   };
   try {
-    await prepareRepositories(repos, options.force, state);
+    await prepareRepositories(
+      repos,
+      options.force,
+      state,
+      options.eventEnvironmentKeys
+    );
     return publishPreparedWorkspaceRows(
       db,
       workspaceId,
@@ -3115,10 +3177,15 @@ function selectedRepositories(db, workspaceId, repoName) {
     );
   return repos;
 }
-async function prepareRepositories(repos, force, state) {
+async function prepareRepositories(repos, force, state, eventEnvironmentKeys) {
   for (const repo of repos) {
     state.activeRepoId = repo.id;
-    const result = await prepareRepositoryIndex(repo, force);
+    const result = await prepareRepositoryIndex(
+      repo,
+      force,
+      void 0,
+      eventEnvironmentKeys
+    );
     state.rows.push(result);
     state.fileCount += result.fileCount;
     state.diagnosticCount += result.diagnosticCount;
@@ -3470,6 +3537,16 @@ var eventNameReason = `COALESCE(
     OR c.unresolved_reason GLOB 'event_name_*'
     THEN c.unresolved_reason END
 )`;
+var receiverReason = `CASE
+  WHEN json_extract(c.evidence_json,
+    '$.receiverClassification')='name_fallback'
+    THEN COALESCE(json_extract(c.evidence_json,
+      '$.receiverFallbackRefusedReason'),'name_fallback')
+  WHEN json_extract(c.evidence_json,
+    '$.receiverClassification')='unproven'
+    THEN COALESCE(json_extract(c.evidence_json,
+      '$.receiverUnresolvedReason'),'unproven')
+  ELSE 'missing' END`;
 function workspacePredicate(alias) {
   return `(? IS NULL OR ${alias}.workspace_id=?)`;
 }
@@ -3507,6 +3584,14 @@ function eventNameResolutionQuality(db, workspaceId) {
     workspaceId
   );
   const unresolved = count2(aggregate?.unresolved);
+  const reasonCount = count2(db.prepare(`SELECT COUNT(DISTINCT reason) count
+    FROM (SELECT ${eventNameReason} reason
+      FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id
+      WHERE c.call_type='async_emit' AND ${workspacePredicate("r")}
+        AND ${eventNameReason} IS NOT NULL)`).get(
+    workspaceId,
+    workspaceId
+  )?.count);
   return {
     severity: unresolved > 0 ? "warning" : "info",
     code: "strict_event_name_resolution_quality",
@@ -3514,6 +3599,9 @@ function eventNameResolutionQuality(db, workspaceId) {
     publicationTotal: count2(aggregate?.total),
     unresolvedPublicationCount: unresolved,
     reasonBuckets: reasons,
+    reasonBucketCount: reasonCount,
+    shownReasonBucketCount: reasons.length,
+    omittedReasonBucketCount: Math.max(0, reasonCount - reasons.length),
     examples: unresolvedEventNameExamples(db, workspaceId),
     exampleCount: unresolved
   };
@@ -3639,8 +3727,12 @@ function unmatchedSubscriptionRows(db, workspaceId) {
   );
 }
 function unmatchedSubscriptionQuality(db, workspaceId) {
-  const row = db.prepare(`SELECT COUNT(*) siteCount,
+  const row = db.prepare(`SELECT
+    COUNT(DISTINCT json_extract(e.evidence_json,'$.subscribeCallId'))
+      siteCount,
     SUM(CASE
+      WHEN json_extract(e.evidence_json,'$.materializedLoopEventName')
+        IS NOT NULL THEN 1
       WHEN json_extract(c.evidence_json,
         '$.subscriptionLoopRegistrationStatus')='enumerated'
         THEN CAST(json_extract(c.evidence_json,
@@ -3650,7 +3742,7 @@ function unmatchedSubscriptionQuality(db, workspaceId) {
       ELSE 1 END) count,
     SUM(CASE WHEN json_extract(c.evidence_json,
       '$.subscriptionLoopRegistrationStatus')='unresolved'
-      THEN 1 ELSE 0 END) unknownMultiplicitySiteCount
+      THEN 1 ELSE 0 END) unknownMultiplicityEdgeCount
     FROM graph_edges e LEFT JOIN outbound_calls c
       ON c.id=CAST(json_extract(e.evidence_json,'$.subscribeCallId') AS INTEGER)
     WHERE e.edge_type='EVENT_SUBSCRIPTION_HANDLED_BY'
@@ -3663,19 +3755,37 @@ function unmatchedSubscriptionQuality(db, workspaceId) {
           AND publication.to_id=e.from_id)`).get(workspaceId, workspaceId);
   const total = count2(row?.count);
   const siteCount = count2(row?.siteCount);
+  const unknownSites = unknownMultiplicitySiteCount(db, workspaceId);
   return {
     severity: siteCount > 0 ? "warning" : "info",
     code: "strict_event_subscription_without_publication_quality",
     message: "Event subscriptions without a matching publication",
     unmatchedSubscriptionCount: total,
     unmatchedSubscriptionSiteCount: siteCount,
-    unknownMultiplicitySiteCount: count2(row?.unknownMultiplicitySiteCount),
+    unknownMultiplicitySiteCount: unknownSites,
     examples: unmatchedSubscriptionRows(db, workspaceId),
     exampleCount: siteCount
   };
 }
-function receiverProofQuality(db, workspaceId) {
-  const row = db.prepare(`SELECT COUNT(*) eventTotal,
+function unknownMultiplicitySiteCount(db, workspaceId) {
+  const row = db.prepare(`SELECT COUNT(DISTINCT
+    json_extract(e.evidence_json,'$.subscribeCallId')) count
+    FROM graph_edges e LEFT JOIN outbound_calls c
+      ON c.id=CAST(json_extract(e.evidence_json,'$.subscribeCallId') AS INTEGER)
+    WHERE e.edge_type='EVENT_SUBSCRIPTION_HANDLED_BY'
+      AND ${workspacePredicate("e")}
+      AND json_extract(c.evidence_json,
+        '$.subscriptionLoopRegistrationStatus')='unresolved'
+      AND NOT EXISTS (SELECT 1 FROM graph_edges publication
+        WHERE publication.workspace_id=e.workspace_id
+          AND publication.generation=e.generation
+          AND publication.edge_type='HANDLER_EMITS_EVENT'
+          AND publication.to_kind='event'
+          AND publication.to_id=e.from_id)`).get(workspaceId, workspaceId);
+  return count2(row?.count);
+}
+function receiverProofAggregate(db, workspaceId) {
+  return db.prepare(`SELECT COUNT(*) eventTotal,
     SUM(CASE WHEN json_extract(c.evidence_json,
       '$.receiverClassification')='cap_evidence' THEN 1 ELSE 0 END) proven,
     SUM(CASE WHEN json_extract(c.evidence_json,
@@ -3686,13 +3796,9 @@ function receiverProofQuality(db, workspaceId) {
     FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id
     WHERE c.call_type IN ('async_emit','async_subscribe')
       AND ${workspacePredicate("r")}`).get(workspaceId, workspaceId);
-  const buckets = db.prepare(`SELECT CASE
-      WHEN json_extract(c.evidence_json,
-        '$.receiverClassification')='name_fallback' THEN 'name_fallback'
-      WHEN json_extract(c.evidence_json,
-        '$.receiverClassification')='unproven'
-        THEN COALESCE(c.unresolved_reason,'unproven')
-      ELSE 'missing' END reason,COUNT(*) count
+}
+function receiverReasonBuckets(db, workspaceId) {
+  return db.prepare(`SELECT ${receiverReason} reason,COUNT(*) count
     FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id
     WHERE c.call_type IN ('async_emit','async_subscribe')
       AND ${workspacePredicate("r")}
@@ -3702,6 +3808,21 @@ function receiverProofQuality(db, workspaceId) {
     workspaceId,
     workspaceId
   );
+}
+function receiverReasonBucketCount(db, workspaceId) {
+  const row = db.prepare(`SELECT COUNT(DISTINCT reason) count
+    FROM (SELECT ${receiverReason} reason
+      FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id
+      WHERE c.call_type IN ('async_emit','async_subscribe')
+        AND ${workspacePredicate("r")}
+        AND json_extract(c.evidence_json,'$.receiverClassification')
+          <>'cap_evidence')`).get(workspaceId, workspaceId);
+  return count2(row?.count);
+}
+function receiverProofQuality(db, workspaceId) {
+  const row = receiverProofAggregate(db, workspaceId);
+  const buckets = receiverReasonBuckets(db, workspaceId);
+  const bucketCount = receiverReasonBucketCount(db, workspaceId);
   const questionable = count2(row?.nameFallback) + count2(row?.unproven);
   return {
     severity: questionable > 0 ? "warning" : "info",
@@ -3713,6 +3834,9 @@ function receiverProofQuality(db, workspaceId) {
     unproven: count2(row?.unproven),
     questionable,
     reasonBuckets: buckets,
+    reasonBucketCount: bucketCount,
+    shownReasonBucketCount: buckets.length,
+    omittedReasonBucketCount: Math.max(0, bucketCount - buckets.length),
     examples: receiverProofExamples(db, workspaceId),
     exampleCount: questionable
   };
@@ -3721,8 +3845,11 @@ function receiverProofExamples(db, workspaceId) {
   return db.prepare(`SELECT r.name repositoryName,c.call_type callType,
     c.source_file sourceFile,c.source_line sourceLine,
     json_extract(c.evidence_json,'$.receiverClassification')
-      receiverClassification,
-    c.unresolved_reason reason
+    receiverClassification,
+    COALESCE(json_extract(c.evidence_json,'$.receiverUnresolvedReason'),
+      json_extract(c.evidence_json,'$.receiverFallbackRefusedReason')) reason,
+    json_array_length(json_extract(c.evidence_json,
+      '$.consideredBindingSites')) consideredBindingSiteCount
     FROM outbound_calls c JOIN repositories r ON r.id=c.repo_id
     WHERE c.call_type IN ('async_emit','async_subscribe')
       AND ${workspacePredicate("r")}
@@ -4645,6 +4772,15 @@ function renderCompactJson(value) {
 `;
 }
 
+// src/output/repository-inspection.ts
+function projectRepositoryInspection(repository) {
+  return Object.fromEntries(
+    Object.entries(repository).filter(
+      ([key]) => key !== "environment_declarations_json"
+    )
+  );
+}
+
 // src/cli/clean.ts
 import fs6 from "fs/promises";
 import path6 from "path";
@@ -4758,7 +4894,7 @@ async function withWorkspace(workspace, fn) {
   try {
     const row = getWorkspace(db, config.rootPath);
     const workspaceId = row?.id ?? upsertWorkspace(db, config.rootPath, config.dbPath);
-    return await fn(db, workspaceId, config.rootPath);
+    return await fn(db, workspaceId, config.rootPath, config);
   } finally {
     db.close();
   }
@@ -4873,10 +5009,11 @@ function registerInitCommand(program) {
 }
 function registerIndexCommand(program) {
   program.command("index").option("--workspace <path>").option("--repo <name>").option("--force").action(
-    (opts) => void withWorkspace(opts.workspace, async (db, workspaceId) => {
+    (opts) => void withWorkspace(opts.workspace, async (db, workspaceId, _root, config) => {
       const r = await indexWorkspace(db, workspaceId, {
         repo: opts.repo,
-        force: Boolean(opts.force)
+        force: Boolean(opts.force),
+        eventEnvironmentKeys: config.eventEnvironmentKeys
       });
       const outcome = indexCommandOutcome(r);
       writeStdout(outcome.stdout);
@@ -4891,7 +5028,7 @@ function registerLinkCommand(program) {
       const upgradeWarnings = linkUpgradeWarnings(db, workspaceId);
       writeStdout(
         `${upgradeWarnings.length ? `Warnings: ${upgradeWarnings.map((item) => String(item.code)).join(", ")}. Run service-flow doctor --strict for remediation.
-` : ""}Linked ${r.edgeCount} edges: ${r.remoteResolvedCount} remote operation calls resolved, ${r.localResolvedCount} local operation calls resolved, ${r.unresolvedCount} unresolved operation calls, ${r.ambiguousCount} ambiguous operation calls, ${r.dynamicCount} dynamic operation calls, ${r.terminalCount} terminal call edges, ${r.dependencyResolvedCount} dependency resolved, ${r.dependencyAmbiguousCount} dependency ambiguous, ${r.implementationResolvedCount} implementation resolved, ${r.implementationAmbiguousCount} implementation ambiguous, ${r.implementationUnresolvedCount} implementation unresolved, ${r.subscriptionHandlerResolvedCount} subscription handlers resolved, ${r.subscriptionHandlerAmbiguousCount} subscription handlers ambiguous, ${r.subscriptionHandlerUnresolvedCount} subscription handlers unresolved, ${r.subscriptionHandlerMissingAssociationCount} subscription handler associations missing, ${r.eventShapeCandidateCount} event shape candidates
+` : ""}Linked ${r.edgeCount} edges: ${r.remoteResolvedCount} remote operation calls resolved, ${r.localResolvedCount} local operation calls resolved, ${r.unresolvedCount} unresolved operation calls, ${r.ambiguousCount} ambiguous operation calls, ${r.dynamicCount} dynamic operation calls, ${r.terminalCount} terminal call edges, ${r.dependencyResolvedCount} dependency resolved, ${r.dependencyAmbiguousCount} dependency ambiguous, ${r.implementationResolvedCount} implementation resolved, ${r.implementationAmbiguousCount} implementation ambiguous, ${r.implementationUnresolvedCount} implementation unresolved, ${r.subscriptionHandlerResolvedCount} subscription handlers resolved, ${r.subscriptionHandlerAmbiguousCount} subscription handlers ambiguous, ${r.subscriptionHandlerUnresolvedCount} subscription handlers unresolved, ${r.subscriptionHandlerMissingAssociationCount} subscription handler associations missing, ${r.eventShapeCandidateCount} event shape candidates, ${r.eventShapeCandidateOmittedCount} event shape candidates omitted by the link cap
 `
       );
     }).catch(fail)
@@ -4901,18 +5038,20 @@ function registerTraceCommand(program) {
   program.command("trace").option("--workspace <path>").option("--repo <name>").option("--operation <name>").option("--service <path>").option("--path <operationPath>").option("--handler <name>").option("--depth <n>", "trace depth", "25").addOption(traceFormatOption()).option("--include-external").option("--include-db").option("--include-async").option("--implementation-repo <name>").option("--implementation-hint <scope>", "scoped implementation hint", collect, []).option("--var <key=value>", "dynamic variable", collect, []).option("--dynamic-mode <mode>", "strict|candidates|infer", "strict").option("--max-dynamic-candidates <n>", "maximum dynamic candidates to show", "5").action((opts) => void runTraceCommand(opts).catch(fail));
 }
 function listRepositoriesCommand(opts) {
-  return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => writeStdout(
-    renderJson(
+  return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
+    writeStdout(renderJson(
       listRepositories(db, workspaceId).map((repo) => ({
         name: repo.name,
         kind: repo.kind,
         packageName: repo.package_name
       }))
-    )
-  ));
+    ));
+  });
 }
 function listServicesCommand(opts) {
   return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
     const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
     if (selection.diagnostic) {
       writeStdout(renderJson([selection.diagnostic]));
@@ -4927,6 +5066,7 @@ function listServicesCommand(opts) {
 }
 function listOperationsCommand(opts) {
   return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
     const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
     if (selection.diagnostic) {
       writeStdout(renderJson([selection.diagnostic]));
@@ -4947,6 +5087,7 @@ function listOperationsCommand(opts) {
 }
 function listCallsCommand(opts) {
   return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
     const selection = opts.repo ? selectRepository(db, opts.repo, workspaceId) : {};
     if (selection.diagnostic) {
       writeStdout(renderJson([selection.diagnostic]));
@@ -4987,20 +5128,29 @@ function registerGraphCommand(program) {
 }
 function inspectRepositoryCommand(name, opts) {
   return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
     const selection = selectRepository(db, name, workspaceId);
     writeStdout(renderJson(
-      selection.repo ?? selection.diagnostic ?? { error: "repo not found" }
+      selection.repo ? projectRepositoryInspection(selection.repo) : selection.diagnostic ?? { error: "repo not found" }
     ));
   });
 }
 function inspectOperationCommand(selector, opts) {
   return withReadOnlyWorkspace(opts.workspace, (db, workspaceId) => {
+    if (writeLifecycleBlock(db, workspaceId)) return;
     const rows = db.prepare(
       "SELECT o.* FROM cds_operations o JOIN cds_services s ON s.id=o.service_id JOIN repositories r ON r.id=s.repo_id WHERE r.workspace_id=? AND (o.operation_name=? OR o.operation_path=?)"
     ).all(workspaceId, selector, selector);
     writeStdout(renderJson(rows));
   });
 }
+function writeLifecycleBlock(db, workspaceId) {
+  const diagnostic = factLifecycleDiagnostic(db, workspaceId);
+  if (!diagnostic) return false;
+  writeStdout(renderJson([diagnostic]));
+  process.exitCode = 1;
+  return true;
+}
 function registerInspectCommands(program) {
   const inspect = program.command("inspect");
   inspect.command("repo").argument("<name>").option("--workspace <path>").action(