@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/packages/extractors/dialects/fixtures/terraform-aws/forge-aws-infra/envs/prod/terraform.tfvars

@@ -0,0 +1 @@
+env = "prod"

package/dist/packages/extractors/dialects/fixtures/terraform-aws/forge-aws-infra/envs/prod/variables.tf

@@ -0,0 +1,4 @@
+variable "env" {
+  type    = string
+  default = "dev"
+}

package/dist/packages/extractors/dialects/fixtures/terraform-azure/forge-azure-infra/main.tf

@@ -0,0 +1,102 @@
+# Forge's Azure estate (invented). One resource of each type the terraform-azure dialect reads,
+# and some it leaves to built-in readers (the storage container) or to no record (the AKS cluster).
+
+variable "env" {
+  default = "prod"
+}
+
+# ---- messaging
+resource "azurerm_servicebus_queue" "orders_in" {
+  name         = "orders-in"
+  namespace_id = azurerm_servicebus_namespace.main.id
+}
+
+resource "azurerm_servicebus_topic" "order_events" {
+  name         = "order-events"
+  namespace_id = azurerm_servicebus_namespace.main.id
+}
+
+resource "azurerm_eventhub" "telemetry" {
+  name              = "device-telemetry"
+  namespace_name    = "forge-hubs"
+  partition_count   = 4
+  message_retention = 1
+}
+
+# ---- compute
+resource "azurerm_linux_function_app" "billing" {
+  name = "billing-func"
+  tags = {
+    env = var.env
+  }
+}
+
+resource "azurerm_windows_function_app" "legacy_billing" {
+  name = "legacy-billing-func"
+}
+
+resource "azurerm_function_app" "notifier" {
+  name = "notifier-func"
+}
+
+resource "azurerm_linux_web_app" "portal" {
+  name = "portal-web"
+  tags = {
+    env = var.env
+  }
+}
+
+resource "azurerm_windows_web_app" "backoffice" {
+  name = "backoffice-web"
+}
+
+resource "azurerm_app_service" "statements" {
+  name = "statements-web"
+}
+
+resource "azurerm_kubernetes_cluster" "main" {
+  name = "forge-aks"
+}
+
+# ---- gateway
+resource "azurerm_api_management_api" "orders" {
+  name                = "orders-api"
+  api_management_name = "forge-apim"
+  display_name        = "Orders API"
+  path                = "orders"
+  service_url         = "https://orders.forge.internal"
+  revision            = "1"
+}
+
+# ---- data
+resource "azurerm_cosmosdb_account" "catalog" {
+  name       = "forge-catalog"
+  offer_type = "Standard"
+}
+
+resource "azurerm_mssql_server" "reports" {
+  name    = "forge-reports-sql"
+  version = "12.0"
+}
+
+resource "azurerm_postgresql_flexible_server" "ledger" {
+  name    = "forge-ledger-pg"
+  version = "16"
+}
+
+resource "azurerm_postgresql_server" "legacy" {
+  name = "forge-legacy-pg"
+}
+
+resource "azurerm_mysql_flexible_server" "loyalty" {
+  name = "forge-loyalty-mysql"
+}
+
+resource "azurerm_redis_cache" "sessions" {
+  name = "forge-sessions"
+}
+
+# Read by the cloud-stores extractor, not by the dialect.
+resource "azurerm_storage_container" "statements" {
+  name = "statements"
+}

package/dist/packages/extractors/dialects/fixtures/terraform-gcp/forge-gcp-infra/main.tf

@@ -0,0 +1,51 @@
+# Forge's Google Cloud estate (invented). The terraform-gcp dialect reads the databases, caches
+# and task queues; Cloud Run, Pub/Sub, Cloud Functions, buckets, BigQuery and IAM stay with the
+# built-in gcp, serverless and cloud-stores readers, and a GKE cluster gives no record.
+
+variable "region" {
+  default = "europe-west1"
+}
+
+resource "google_sql_database_instance" "ledger" {
+  name             = "ledger-db"
+  database_version = "POSTGRES_15"
+  region           = var.region
+}
+
+resource "google_sql_database_instance" "loyalty" {
+  name             = "loyalty-db"
+  database_version = "MYSQL_8_0"
+}
+
+resource "google_sql_database_instance" "reporting" {
+  name             = "reporting-db"
+  database_version = "SQLSERVER_2019_STANDARD"
+}
+
+resource "google_sql_database_instance" "scratch" {
+  name = "scratch-db"
+}
+
+resource "google_redis_instance" "sessions" {
+  name           = "forge-sessions"
+  memory_size_gb = 1
+}
+
+resource "google_cloud_tasks_queue" "emails" {
+  name     = "forge-emails"
+  location = var.region
+}
+
+resource "google_spanner_database" "accounts" {
+  instance = "forge-spanner"
+  name     = "accounts"
+}
+
+resource "google_container_cluster" "main" {
+  name = "forge-gke"
+}
+
+# Read by the gcp extractor, not by the dialect.
+resource "google_pubsub_topic" "orders" {
+  name = "orders"
+}

package/dist/packages/extractors/dialects/harness.yaml

@@ -0,0 +1,101 @@
+# Harness CD and CI pipelines (ADR 0062). Shipped with Atticus (C2). A pipeline in .harness/
+# is a pipeline QualityAsset, described the way the built-in pipeline readers describe one:
+# its stages, the environments its deploy stages target, the deploy steps (as Atticus's words:
+# kubernetes, helm, terraform...), the steps that run tests, and the org templates it uses
+# (a pipeline model, ADR 0062, says what a template does). Runtime inputs (<+input>) aren't
+# values. Triggers live in their own files and aren't joined to their pipeline yet.
+schemaVersion: 1
+name: harness
+version: 1.0.0
+description: Harness pipelines as pipeline QualityAssets, with stages, environments, deploy targets, test steps and templates.
+appliesTo:
+  repoTypes: ["*"]
+  marker: "**/.harness/**/*.y*ml"
+rules:
+  - id: pipeline
+    description: A Harness pipeline file is a pipeline, with what its stages and steps say.
+    match:
+      jsonPath: "$.pipeline"
+      files: ["**/.harness/**/*.yaml", "**/.harness/**/*.yml"]
+      contains: "pipeline:"
+    emit:
+      kind: QualityAsset
+      id: "${repo.component}.pipeline.${attr.identifier | slug}"
+      fields:
+        component: "${repo.component}"
+        assetKind: pipeline
+        details:
+          tool: harness
+          name: "${attr.name}"
+          stages:
+            - { each: "@.stages[*].stage", value: "${item.name}" }
+            - { each: "@.stages[*].parallel[*].stage", value: "${item.name}" }
+          environments:
+            - each: "@..environment"
+              value: "${item.environmentRef | lower}"
+              where: [{ value: "${item.environmentRef}", matches: "^[^<]" }]
+          deployTargets:
+            - each: "@..step"
+              value: "${item.type | map('K8sRollingDeploy=kubernetes,K8sCanaryDeploy=kubernetes,K8sBlueGreenDeploy=kubernetes,K8sApply=kubernetes,HelmDeploy=helm,NativeHelmDeploy=helm,TerraformApply=terraform,TerraformCloudRun=terraform,ServerlessAwsLambdaDeploy=aws-lambda,AwsLambdaDeploy=aws-lambda,ECSRollingDeploy=aws-ecs,AzureWebAppSlotDeployment=azure-web-app,AzureFunctionDeploy=azure-functions,GoogleCloudRunDeploy=cloud-run,TanzuCommand=tanzu')}"
+          testSteps:
+            - each: "@..step"
+              value: "${item.name}"
+              where: [{ value: "${item.type}", matches: "^RunTests$" }]
+            - each: "@..step"
+              value: "${item.spec.command}"
+              where:
+                - { value: "${item.type}", matches: "^Run$" }
+                - {
+                    value: "${item.spec.command}",
+                    matches: "\\b(test|tests|verify|pytest|jest|vitest)\\b",
+                  }
+          templates:
+            - { each: "@..template", value: "${item.templateRef}" }
+      evidence: { source: pipeline, side: definition }
+    confidence: verified
+tests:
+  - name: a CI stage with tests, a deploy stage to prod, and a stage from an org template
+    files:
+      .harness/pipelines/cards_deploy.yaml: |
+        pipeline:
+          name: Cards build and deploy
+          identifier: cards_deploy
+          stages:
+            - stage:
+                name: Build
+                type: CI
+                spec:
+                  execution:
+                    steps:
+                      - step: { type: Run, name: Unit tests, spec: { command: mvn -B verify } }
+                      - step: { type: Run, name: Package, spec: { command: mvn -B package -DskipTests } }
+                      - step: { type: RunTests, name: Contract tests }
+            - stage:
+                name: Deploy prod
+                type: Deployment
+                spec:
+                  environment: { environmentRef: Prod }
+                  execution:
+                    steps:
+                      - step: { type: K8sRollingDeploy, name: Rollout }
+                      - step: { type: ShellScript, name: Notify }
+            - stage:
+                name: Deploy uat
+                type: Deployment
+                spec:
+                  environment: { environmentRef: <+input> }
+            - stage:
+                name: Release notes
+                template: { templateRef: org.tide_release, versionLabel: v2 }
+    expect:
+      - kind: QualityAsset
+        id: dialect-test.pipeline.cards_deploy
+        assetKind: pipeline
+        details:
+          tool: harness
+          name: Cards build and deploy
+          stages: [Build, Deploy prod, Deploy uat, Release notes]
+          environments: [prod]
+          deployTargets: [kubernetes]
+          testSteps: [Contract tests, mvn -B verify]
+          templates: [org.tide_release]

package/dist/packages/extractors/dialects/jaxrs.yaml

@@ -0,0 +1,155 @@
+# JAX-RS (Jakarta REST) resources and MicroProfile REST clients. Shipped with Atticus (C2).
+#
+# A JAX-RS endpoint is a class-level @Path, a method-level @Path and an HTTP-method
+# annotation that sit side by side, in either order. Annotation matches only see the matched
+# annotation and the enclosing class, so these rules use regular expressions with lookbehinds
+# for the class (groups are numbered as they appear, lookbehinds included).
+#
+# Limits, by design: the component is the repo id (C2 has no template value for the manifest's
+# component); @ApplicationPath prefixes and sub-resource locators are not followed; a client's
+# host is its configKey (the usual convention is to name the target service), because a
+# template can't look a config key up by a name it has just matched. normalizedPath is left to
+# merge, which derives it from pathOrTopic.
+schemaVersion: 1
+name: jaxrs
+version: 1.0.0
+description: JAX-RS resource methods as REST endpoints, and MicroProfile REST client methods as HTTP calls.
+extends: []
+appliesTo:
+  repoTypes: []
+layout:
+  sourceRoots: [src/main/java]
+  configFiles: []
+rules:
+  - id: resource-method
+    description: >-
+      A method with an HTTP-method annotation and its own @Path, in a class with a @Path that
+      is not a @RegisterRestClient interface, serves the class path joined with the method path.
+    match:
+      regex: '(?=@(?:Path|GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?<!@RegisterRestClient[\s\S]*)(?<=@Path\(\s*"/?([^"]*?)/?"\s*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:(?:public|abstract|final)\s+)*class\s+(\w+)\b[\s\S]*)(?:@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b(?:\s*@(?!Path\b)[\w.]+(?:\([^)]*\))?)*\s*@Path\(\s*"/?([^"]*?)/?"\s*\)|@Path\(\s*"/?([^"]*?)/?"\s*\)(?:\s*@(?!(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)[\w.]+(?:\([^)]*\))?)*\s*@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Endpoint
+      id: "${repo.name}.${match.2 | slug}.${match.3 | lower}${match.6 | lower}-${match.7 | slug}"
+      fields:
+        component: "${repo.name}"
+        endpointType: rest
+        method: "${match.3}${match.6}"
+        pathOrTopic: "/${match.1}/${match.4}${match.5}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: resource-method-without-path
+    description: >-
+      A method with an HTTP-method annotation and no @Path of its own, in a class with a @Path,
+      serves the class path.
+    match:
+      regex: '(?=@(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?<!@RegisterRestClient[\s\S]*)(?<=@Path\(\s*"/?([^"]*?)/?"\s*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:(?:public|abstract|final)\s+)*class\s+(\w+)\b[\s\S]*)(?<!@Path\([^)]*\)(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*)@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b(?:\s*@(?!Path\b)[\w.]+(?:\([^)]*\))?)*\s*(?=[^@\s])(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Endpoint
+      id: "${repo.name}.${match.2 | slug}.${match.3 | lower}-${match.4 | slug}"
+      fields:
+        component: "${repo.name}"
+        endpointType: rest
+        method: "${match.3}"
+        pathOrTopic: "/${match.1}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: rest-client-call
+    description: >-
+      A method with an HTTP-method annotation and a @Path in a @RegisterRestClient(configKey)
+      interface that has its own @Path calls http://<configKey>/<interface path>/<method path>.
+    match:
+      regex: '(?=@(?:Path|GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?<=@RegisterRestClient\([^)]*configKey\s*=\s*"([^"]+)"[^)]*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?interface\s+(\w+)\b[\s\S]*)(?<=@Path\(\s*"/?([^"]*?)/?"\s*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?interface\s[\s\S]*)(?:@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b(?:\s*@(?!Path\b)[\w.]+(?:\([^)]*\))?)*\s*@Path\(\s*"/?([^"]*?)/?"\s*\)|@Path\(\s*"/?([^"]*?)/?"\s*\)(?:\s*@(?!(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)[\w.]+(?:\([^)]*\))?)*\s*@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Unresolved
+      id: "${repo.name}.call.${match.1 | slug}.${match.4 | lower}${match.7 | lower}-${match.8 | slug}"
+      fields:
+        unresolvedKind: http-call
+        raw: "${match.4}${match.7} http://${match.1}/${match.3}/${match.5}${match.6}"
+        owner: "${repo.name}"
+      evidence: { source: code, side: caller }
+    confidence: inferred
+
+  - id: rest-client-call-without-interface-path
+    description: >-
+      The same in a @RegisterRestClient(configKey) interface with no @Path of its own: the call
+      goes to http://<configKey>/<method path>.
+    match:
+      regex: '(?=@(?:Path|GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?<=@RegisterRestClient\([^)]*configKey\s*=\s*"([^"]+)"[^)]*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?interface\s+(\w+)\b[\s\S]*)(?<!@Path\(\s*"/?([^"]*?)/?"\s*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?interface\s[\s\S]*)(?:@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b(?:\s*@(?!Path\b)[\w.]+(?:\([^)]*\))?)*\s*@Path\(\s*"/?([^"]*?)/?"\s*\)|@Path\(\s*"/?([^"]*?)/?"\s*\)(?:\s*@(?!(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)[\w.]+(?:\([^)]*\))?)*\s*@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b)(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Unresolved
+      id: "${repo.name}.call.${match.1 | slug}.${match.4 | lower}${match.7 | lower}-${match.8 | slug}"
+      fields:
+        unresolvedKind: http-call
+        raw: "${match.4}${match.7} http://${match.1}/${match.5}${match.6}"
+        owner: "${repo.name}"
+      evidence: { source: code, side: caller }
+    confidence: inferred
+
+tests:
+  - name: resources and MicroProfile clients in accounts-service
+    fixture: fixtures/jaxrs/accounts-service
+    expect:
+      - kind: Endpoint
+        id: accounts-service.accountresource.get-list
+        component: accounts-service
+        method: GET
+        pathOrTopic: /accounts
+      - kind: Endpoint
+        id: accounts-service.accountresource.get-get
+        method: GET
+        pathOrTopic: /accounts/{id}
+      - kind: Endpoint
+        id: accounts-service.accountresource.post-placehold
+        method: POST
+        pathOrTopic: /accounts/{id}/holds
+      - kind: Endpoint
+        id: accounts-service.accountresource.delete-close
+        method: DELETE
+        pathOrTopic: /accounts/{id}
+      - kind: Endpoint
+        id: accounts-service.accountresource.put-rename
+        method: PUT
+        pathOrTopic: /accounts/{id}/owner
+      - kind: Endpoint
+        id: accounts-service.accountresource.get-count
+        method: GET
+        pathOrTopic: /accounts
+      - kind: Unresolved
+        id: accounts-service.call.ledger-api.get-balance
+        unresolvedKind: http-call
+        raw: GET http://ledger-api/ledger/v1/accounts/{id}/balance
+        owner: accounts-service
+      - kind: Unresolved
+        id: accounts-service.call.ledger-api.post-transfer
+        raw: POST http://ledger-api/ledger/v1/transfers
+      - kind: Unresolved
+        id: accounts-service.call.audit-svc.post-record
+        raw: POST http://audit-svc/audit/events
+    absent:
+      - accounts-service.ledgerclient.get-balance
+      - accounts-service.ledgerclient.post-transfer
+      - accounts-service.auditclient.post-record
+  - name: a class without a class-level @Path (a sub-resource) gives nothing
+    files:
+      src/main/java/x/HoldResource.java: |
+        public class HoldResource {
+            @GET
+            @Path("/{holdId}")
+            public Hold get(@PathParam("holdId") String holdId) { return null; }
+        }
+    expect: []
+  - name: test sources are not scanned
+    files:
+      src/test/java/x/FakeResource.java: |
+        @Path("/fake")
+        public class FakeResource {
+            @GET
+            public String get() { return ""; }
+        }
+    expect: []

package/dist/packages/extractors/dialects/micronaut.yaml

@@ -0,0 +1,207 @@
+# Micronaut HTTP controllers and declarative clients. Shipped with Atticus (C2).
+#
+# Controllers: the HTTP-method annotation carries the method path, so plain annotation rules
+# work; the controller's path comes from the enclosing @Controller. The id uses that path, so a
+# @Get in a class without @Controller("...") (a declarative client) fails to fill and is skipped.
+# A @Controller with no path is skipped for the same reason.
+#
+# Declarative clients (@Client on an interface or abstract class): a service id becomes the
+# host (http://<id>), with @Client(path) as a base path; an absolute URL is used as written.
+# Placeholders like @Client("${ledger.url}") are not followed. The component is the configured
+# micronaut.application.name; a repo without one gives no records.
+schemaVersion: 1
+name: micronaut
+version: 1.0.0
+description: Micronaut controllers as REST endpoints, and declarative @Client methods as HTTP calls.
+extends: []
+appliesTo:
+  repoTypes: []
+layout:
+  sourceRoots: [src/main/java]
+  configFiles:
+    - "**/src/main/resources/application.yml"
+    - "**/src/main/resources/application.yaml"
+    - "**/src/main/resources/application.properties"
+rules:
+  - id: controller-get
+    description: A @Get method in a @Controller class serves GET on the controller path joined with the method path.
+    match: { annotation: Get, target: method, files: ["**/src/main/java/**/*.java"] }
+    emit:
+      kind: Endpoint
+      id: "${config:micronaut.application.name}.${annotation.Controller.value | slug}.get-${member.name | slug}"
+      fields:
+        component: "${config:micronaut.application.name}"
+        endpointType: rest
+        method: GET
+        pathOrTopic: "${annotation.Controller.value}${attr.value | default('')}${attr.uri | default('')}"
+        normalizedPath: "${annotation.Controller.value | normalizePath}${attr.value | default('') | normalizePath}${attr.uri | default('') | normalizePath}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: controller-post
+    description: A @Post method in a @Controller class serves POST.
+    match: { annotation: Post, target: method, files: ["**/src/main/java/**/*.java"] }
+    emit:
+      kind: Endpoint
+      id: "${config:micronaut.application.name}.${annotation.Controller.value | slug}.post-${member.name | slug}"
+      fields:
+        component: "${config:micronaut.application.name}"
+        endpointType: rest
+        method: POST
+        pathOrTopic: "${annotation.Controller.value}${attr.value | default('')}${attr.uri | default('')}"
+        normalizedPath: "${annotation.Controller.value | normalizePath}${attr.value | default('') | normalizePath}${attr.uri | default('') | normalizePath}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: controller-put
+    description: A @Put method in a @Controller class serves PUT.
+    match: { annotation: Put, target: method, files: ["**/src/main/java/**/*.java"] }
+    emit:
+      kind: Endpoint
+      id: "${config:micronaut.application.name}.${annotation.Controller.value | slug}.put-${member.name | slug}"
+      fields:
+        component: "${config:micronaut.application.name}"
+        endpointType: rest
+        method: PUT
+        pathOrTopic: "${annotation.Controller.value}${attr.value | default('')}${attr.uri | default('')}"
+        normalizedPath: "${annotation.Controller.value | normalizePath}${attr.value | default('') | normalizePath}${attr.uri | default('') | normalizePath}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: controller-delete
+    description: A @Delete method in a @Controller class serves DELETE.
+    match: { annotation: Delete, target: method, files: ["**/src/main/java/**/*.java"] }
+    emit:
+      kind: Endpoint
+      id: "${config:micronaut.application.name}.${annotation.Controller.value | slug}.delete-${member.name | slug}"
+      fields:
+        component: "${config:micronaut.application.name}"
+        endpointType: rest
+        method: DELETE
+        pathOrTopic: "${annotation.Controller.value}${attr.value | default('')}${attr.uri | default('')}"
+        normalizedPath: "${annotation.Controller.value | normalizePath}${attr.value | default('') | normalizePath}${attr.uri | default('') | normalizePath}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: controller-patch
+    description: A @Patch method in a @Controller class serves PATCH.
+    match: { annotation: Patch, target: method, files: ["**/src/main/java/**/*.java"] }
+    emit:
+      kind: Endpoint
+      id: "${config:micronaut.application.name}.${annotation.Controller.value | slug}.patch-${member.name | slug}"
+      fields:
+        component: "${config:micronaut.application.name}"
+        endpointType: rest
+        method: PATCH
+        pathOrTopic: "${annotation.Controller.value}${attr.value | default('')}${attr.uri | default('')}"
+        normalizedPath: "${annotation.Controller.value | normalizePath}${attr.value | default('') | normalizePath}${attr.uri | default('') | normalizePath}"
+      evidence: { source: code, side: callee }
+    confidence: verified
+
+  - id: client-call-service-id
+    description: >-
+      An HTTP-method annotation in an interface (or abstract class) annotated @Client with a
+      service id calls http://<service id><@Client path><method path>.
+    match:
+      regex: '(?=@(?:Get|Post|Put|Delete|Patch|Head|Options)\b)(?<=@Client\((?=(?:[^)]*\bpath\s*=\s*"([^"]*)")?)\s*(?:[^)]*\b(?:id|value)\s*=\s*)?"([\w.-]+)"[^)]*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?(?:interface|abstract\s+class)\s+(\w+)\b[\s\S]*)@(Get|Post|Put|Delete|Patch|Head|Options)\b(?:\(\s*(?:(?:value|uri)\s*=\s*)?"([^"]*)"[^)]*\)|\([^)]*\))?(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Unresolved
+      id: "${config:micronaut.application.name}.call.${match.2 | slug}.${match.4 | lower}-${match.6 | slug}"
+      fields:
+        unresolvedKind: http-call
+        raw: "${match.4 | upper} http://${match.2}${match.1}${match.5}"
+        owner: "${config:micronaut.application.name}"
+      evidence: { source: code, side: caller }
+    confidence: inferred
+
+  - id: client-call-url
+    description: An HTTP-method annotation in an interface annotated @Client with an absolute URL calls that URL joined with the method path.
+    match:
+      regex: '(?=@(?:Get|Post|Put|Delete|Patch|Head|Options)\b)(?<=@Client\(\s*(?:value\s*=\s*)?"(https?://[^"]*?)/?"[^)]*\)\s*(?:@[\w.]+(?:\([^)]*\))?\s*)*(?:public\s+)?(?:interface|abstract\s+class)\s+(\w+)\b[\s\S]*)@(Get|Post|Put|Delete|Patch|Head|Options)\b(?:\(\s*(?:(?:value|uri)\s*=\s*)?"([^"]*)"[^)]*\)|\([^)]*\))?(?:\s*@[\w.]+(?:\([^)]*\))?)*\s*(?:(?:public|protected|private|static|final|synchronized|abstract|default)\s+)*[\w.$]+(?:<[^;{}()]*>)?(?:\[\])*\s+(\w+)\s*\('
+      files: ["**/src/main/java/**/*.java"]
+    emit:
+      kind: Unresolved
+      id: "${config:micronaut.application.name}.call.${match.2 | slug}.${match.3 | lower}-${match.5 | slug}"
+      fields:
+        unresolvedKind: http-call
+        raw: "${match.3 | upper} ${match.1}${match.4}"
+        owner: "${config:micronaut.application.name}"
+      evidence: { source: code, side: caller }
+    confidence: inferred
+
+tests:
+  - name: controller endpoints and declarative clients in statements-service
+    fixture: fixtures/micronaut/statements-service
+    expect:
+      - kind: Endpoint
+        id: statements-service.statements.get-get
+        component: statements-service
+        method: GET
+        pathOrTopic: /statements/{id}
+        normalizedPath: /statements/{}
+      - kind: Endpoint
+        id: statements-service.statements.get-list
+        method: GET
+        pathOrTopic: /statements
+        normalizedPath: /statements
+      - kind: Endpoint
+        id: statements-service.statements.post-send
+        method: POST
+        pathOrTopic: /statements/{id}/send
+        normalizedPath: /statements/{}/send
+      - kind: Endpoint
+        id: statements-service.statements.delete-remove
+        method: DELETE
+        pathOrTopic: /statements/{id}
+      - kind: Unresolved
+        id: statements-service.call.ledger-api.get-balance
+        unresolvedKind: http-call
+        raw: GET http://ledger-api/ledger/v1/accounts/{id}/balance
+        owner: statements-service
+      - kind: Unresolved
+        id: statements-service.call.ledger-api.post-transfer
+        raw: POST http://ledger-api/ledger/v1/transfers
+      - kind: Unresolved
+        id: statements-service.call.ratesclient.get-rate
+        raw: GET https://rates.northwind-pay.example/v2/fx/{currency}
+  - name: a client whose target is a placeholder, and a controller without an application name, give nothing
+    files:
+      src/main/java/x/LedgerClient.java: |
+        @Client("${ledger.url}")
+        public interface LedgerClient {
+            @Get("/accounts")
+            List<Account> accounts();
+        }
+      src/main/java/x/PingController.java: |
+        @Controller("/ping")
+        public class PingController {
+            @Get
+            public String ping() { return "pong"; }
+        }
+    expect: []
+  - name: PUT and PATCH methods, with the path as value or uri
+    files:
+      src/main/resources/application.yml: |
+        micronaut:
+          application:
+            name: limits-service
+      src/main/java/x/LimitsController.java: |
+        @Controller("/limits")
+        public class LimitsController {
+            @Put("/{id}")
+            public Limit replace(String id, Limit l) { return l; }
+            @Patch(uri = "/{id}/amount")
+            public Limit adjust(String id, int amount) { return null; }
+        }
+    expect:
+      - kind: Endpoint
+        id: limits-service.limits.put-replace
+        method: PUT
+        pathOrTopic: /limits/{id}
+        normalizedPath: /limits/{}
+      - kind: Endpoint
+        id: limits-service.limits.patch-adjust
+        method: PATCH
+        pathOrTopic: /limits/{id}/amount
+        normalizedPath: /limits/{}/amount