codeanalyzer-python 1.2.0__py3-none-any.whl → 1.3.0__py3-none-any.whl

{codeanalyzer_python-1.2.0.dist-info → codeanalyzer_python-1.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.2.0
+Version: 1.3.0
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE
@@ -21,6 +21,7 @@ Requires-Dist: ray==2.0.0; python_version < '3.11'
 Requires-Dist: requests<3.0.0,>=2.20.0; python_version >= '3.11'
 Requires-Dist: rich<14.0.0,>=12.6.0; python_version < '3.11'
 Requires-Dist: rich<15.0.0,>=14.0.0; python_version >= '3.11'
+Requires-Dist: tomli>=2.0; python_version < '3.11'
 Requires-Dist: typer<1.0.0,>=0.9.0; python_version < '3.11'
 Requires-Dist: typer<2.0.0,>=0.9.0; python_version >= '3.11'
 Requires-Dist: typing-extensions<5.0.0,>=4.0.0; python_version < '3.11'
@@ -315,6 +316,16 @@ $ canpy --help
 │                                                             environment      │
 │                                                             instead.         │
 │                                                             [default: venv]  │
+│ --resolve-instal…                                           Additionally     │
+│                                                             bind imports via │
+│                                                             the project      │
+│                                                             venv's installed │
+│                                                             metadata         │
+│                                                             (*.dist-info);   │
+│                                                             output becomes   │
+│                                                             machine-depende… │
+│                                                             (prov:           │
+│                                                             installed-metad… │
 │ --file-name                               <path>            Analyze only the │
 │                                                             specified file   │
 │                                                             (relative to     │
@@ -346,6 +357,30 @@ $ canpy --help
 │                                                             shipped rules. A │
 │                                                             malformed file   │
 │                                                             is an error.     │
+│ --artifact-text        --no-artifact-…                      Capture verbatim │
+│                                                             `source` text on │
+│                                                             discovered       │
+│                                                             artifacts.       │
+│                                                             --no-artifact-t… │
+│                                                             empties `source` │
+│                                                             everywhere       │
+│                                                             (inventory       │
+│                                                             unchanged).      │
+│                                                             [default:        │
+│                                                             artifact-text]   │
+│ --artifact-text-…                         <int range>       Per-file byte    │
+│                                           [x>=1]            cap on captured  │
+│                                                             artifact         │
+│                                                             `source`; a      │
+│                                                             decodable file   │
+│                                                             over the cap is  │
+│                                                             truncated        │
+│                                                             (text_truncated… │
+│                                                             sha256/size_byt… │
+│                                                             always reflect   │
+│                                                             the full file.   │
+│                                                             [default:        │
+│                                                             262144]          │
 │ --help                                                      Show this        │
 │                                                             message and      │
 │                                                             exit.            │
@@ -517,14 +552,29 @@ A **callable** (function or method) carries its own CPG, keyed by node id:
 }
 ```
 
+The application envelope also contains three substrate sections:
+
+- **`artifacts`** — discovered non-code files (manifests, configs, Docker files, CI workflows,
+  packaging files, scripts, docs, and legal files) with extraction status (`none`, `partial`, or
+  `full`; default `none`), keyed by relative path; each artifact carries the
+  `can://artifact/<app>/<path>` id namespace. Config files carry extracted `config_keys`
+  (keys, values, namespaces, and references) and `DEFINES_CONFIG` Neo4j edges.
+- **`dependencies`** — declared packages with kind (`runtime`/`dev`/`optional`/`build`), spec,
+  locked version, and provenance (`prov`): where each binding came from (manifest file, lock file,
+  installed metadata).
+- **`unresolved_imports`** — modules imported but not resolvable in the declared dependency set,
+  one entry per module.
+
 Notable properties:
 
 - **Durable `can://` ids** identify every node at callable granularity and above
   (`can://python/<app>/<file>/<callable-sig>`); nodes below a callable use ordinal ids
   (`@entry`, `@exit`, `line:col`, `@formal_in:N`, `line:col/actual_in:N`).
 - **`source` lives once per module**; every node's text is the `module.source[span.bytes]` slice.
-- **Cross-function edges** — `call_graph`, `param_in`, `param_out` — live at **application** scope;
+- **Cross-function edges** — `call_graph`, `param_in`, `param_out`, `config_uses` — live at **application** scope;
   the intraprocedural `cfg`/`cdg`/`ddg` and the `summary` edges live **on the callable**.
+  `config_uses` resolve from call-site key arguments to `ConfigKey` nodes; unresolved reads
+  go to `config_reads_unresolved`.
 - **No dangling endpoints** — every `call_graph` `src`/`dst` joins the id space: declared
   callables by their tree id, imported/builtin targets by a `…/@external/<module>/<name>` id
   homed in `application.external_symbols`.
@@ -545,9 +595,13 @@ binary format).
 
 ### Neo4j graph
 
-`--emit neo4j` projects the same schema v2.0.0 analysis into a labeled property graph. Every node
-label is `Py`-prefixed and every relationship type is `PY_`-prefixed (e.g. `:PyClass`, `PY_CALLS`)
-so multiple language analyzers can share one database without label or relationship-type collisions.
+`--emit neo4j` projects the same schema v2.0.0 analysis into a labeled property graph. Every
+Python-specific node label is `Py`-prefixed and every Python-specific relationship type is
+`PY_`-prefixed (e.g. `:PyClass`, `PY_CALLS`) so multiple language analyzers can share one database
+without label or relationship-type collisions. The one deliberate exception is the language-neutral
+`Artifact`/`Package` subgraph (non-code files and third-party dependencies) — those nodes carry no
+`Py` prefix, since they are meant as cross-language merge targets: a sibling-language analyzer over
+the same repo should land on the same `Artifact`/`Package` nodes, not a per-language duplicate.
 Declarations are keyed by their **`can://` id** under a shared `:PySymbol` label; calls, imports,
 inheritance, decorators, and call sites are relationships. At `-a 3`/`-a 4` the projection gains the
 **CPG overlay** — `:PyBodyNode` nodes (statements, and at level 4 the parameter vertices) wired by
@@ -608,6 +662,56 @@ runtime (Docker or Podman) and is enabled with an environment variable:
 RUN_CONTAINER_TESTS=1 uv run pytest test/test_neo4j_bolt.py -s
 ```
 
+## Graph query cookbook
+
+Example Cypher over the projected graph (`--emit neo4j`, then load `graph.cypher` or push via Bolt).
+
+```cypher
+// who calls this function? (direct callers)
+MATCH (c:PyCallable)-[:PY_CALLS]->(t:PyCallable {name: "process_payment"})
+RETURN c.id
+
+// every callable that reaches a given library, via the external ghosts
+MATCH (c:PyCallable)-[:PY_CALLS]->(e:PyExternal)
+WHERE e.id CONTAINS "/@external/requests/"
+RETURN DISTINCT c.id
+
+// entrypoints and the frameworks that invoke them
+MATCH (m:PyCallable {is_entrypoint: true})
+RETURN m.id, m.entrypoint_frameworks
+
+// data dependences into one statement (level 3+)
+MATCH (s:PyBodyNode {id: $stmt})<-[d:PY_DDG]-(src:PyBodyNode)
+RETURN src.id, d.var, d.prov
+
+// interprocedural flow through a parameter (level 4)
+MATCH (a:PyBodyNode)-[:PY_PARAM_IN]->(f:PyBodyNode)
+WHERE f.id STARTS WITH "can://python/myapp/src/api.py"
+RETURN a.id, f.id
+```
+
+Artifact and dependency queries (1.3.0+):
+
+```cypher
+// all container/orchestration configs in the app
+MATCH (a:PyApplication)-[:HAS_ARTIFACT]->(f:Artifact)
+WHERE any(r IN f.roles WHERE r IN ["service-topology", "container-image"])
+RETURN f.id, f.format
+
+// every callable that reaches code from a declared package
+MATCH (c:PyCallable)-[:PY_CALLS]->(:PyExternal)<-[:PY_PROVIDES]-(p:Package {id: "pkg:pypi/requests"})
+RETURN c.id
+
+// undeclared imports (dependency hygiene)
+MATCH (a:PyApplication)-[u:PY_UNRESOLVED_IMPORT]->(e:PyExternal)
+WHERE NOT (e)<-[:PY_PROVIDES]-(:Package)
+RETURN e.id, u.prov
+
+// which lock file pins this package, and to what
+MATCH (f:Artifact)-[l:LOCKS]->(p:Package {id: "pkg:pypi/numpy"})
+RETURN f.id, l.version
+```
+
 ## License
 
 Apache 2.0 — see [LICENSE](./LICENSE).

{codeanalyzer_python-1.2.0.dist-info → codeanalyzer_python-1.3.0.dist-info}/RECORD

@@ -1,12 +1,19 @@
 codeanalyzer/__init__.py,sha256=BZ3Kuwl-F_F-8H8cepLnVJ4Ku4NNUjjqg0Y6ujPQSsI,108
-codeanalyzer/__main__.py,sha256=hmuIKxpW7TFfGaBGb1HiHCFS02dCQxVhG7FkruXECWQ,14954
-codeanalyzer/core.py,sha256=vkU8djqKmyX4mXmb5rOz3oRjlMWYjMB7dWB_toIHnu4,42140
+codeanalyzer/__main__.py,sha256=VVGmkwLGkcfCdbikp2FdXzpGZEA1md8n8WhNSxJWz1E,16080
+codeanalyzer/core.py,sha256=yJ14_jL2V4qDD6pEMEltfeOLcFYTMRkRnh0dyP6RVR4,46715
 codeanalyzer/provenance.py,sha256=DT-DqwdVwO7g-GyK3sC0_4vDNCUjZYEY1fyYCt-7VRM,2306
 codeanalyzer/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+codeanalyzer/artifacts/__init__.py,sha256=317sEeZLS1AYsfYDYIk7tLR3AdDFwWw_cmkeZDabkJo,906
+codeanalyzer/artifacts/config_keys.py,sha256=ovwptAErLYutlCzUwvyim2kH6-6vUKxuRcBV2KJS71Y,26843
+codeanalyzer/artifacts/config_use.py,sha256=1-jGacW249dwF7b6DOrTFuJ7sA5Ho9khgrgZqND0nro,27173
+codeanalyzer/artifacts/config_use_rules.yml,sha256=fNgI6IceOsj78LYmgoDH-vQ4-Mfb2ZFGKIQhLuoL4ik,1483
+codeanalyzer/artifacts/dependencies.py,sha256=bURMUbBzHaF8bInRk-INp1GaGujsUSXnFqLtNyECUMI,10888
+codeanalyzer/artifacts/discovery.py,sha256=8as4RD5oNgZM2qyg19HUqsdq9eETwPDGQUOn4fZLOsQ,7427
+codeanalyzer/artifacts/parsers.py,sha256=xOjC53tT0Mv0k7ONGwzl5XUvpBLnZlEcGmyrX5DS45k,9035
 codeanalyzer/dataflow/__init__.py,sha256=HCNOH24rAGLUMG94N9aC-2SsAWSntk3uys7e39ipU5o,1725
 codeanalyzer/dataflow/access_paths.py,sha256=wC8Q9qD-RZzkoFWMVvu_6uNNmYP8z48OGp9h9v3F1d4,23623
 codeanalyzer/dataflow/alias.py,sha256=ZYKY0DiR3GHv6YJr7C001Lode9rZsk6-gxdomUyIvwg,3928
-codeanalyzer/dataflow/builder.py,sha256=sCngN3MWfCbHteSHiue8l7AUVQNttETJInsgVMy_xkY,31317
+codeanalyzer/dataflow/builder.py,sha256=OOj5J-O0WgBnLMSu6hhixkM8dVkUopwBR-wlQq0INhE,32463
 codeanalyzer/dataflow/cfg.py,sha256=u5YXJjAaDshdgv-9kWWITbBJFP-MwXKq6hbNh0fhDm8,25307
 codeanalyzer/dataflow/defuse.py,sha256=LrX1ToOZzR79NlAGg5T647UAFkpiEqEnT7t0K5RXOiI,4377
 codeanalyzer/dataflow/dominance.py,sha256=X7Ki1QRdVqaseYsJtiUL7m9MbcC2WHEv9b8bczSLFUA,5086
@@ -41,31 +48,31 @@ codeanalyzer/neo4j/__init__.py,sha256=8Ei6uThTOqmul6GhnKoGOjLXJZbyDwF5Jo-8I8NxnA
 codeanalyzer/neo4j/bolt.py,sha256=qEBtQlBjaMPpLQPUCOAR9jEqLxpXYJG5mtxdYAhjtMI,10134
 codeanalyzer/neo4j/cypher.py,sha256=a7YSmxxDbPcYc5gI4TW9sM6_WOE3RgLXTGBR9K8W8kw,5321
 codeanalyzer/neo4j/emit.py,sha256=QdrZWG3_IQHMcKCX4bFINpXvqZU2Qfsi9beIJovC2p4,3493
-codeanalyzer/neo4j/project.py,sha256=LFj8O_2DYA_dvMTbSYK_PYxmnP2UJ4h_3J8rCIoK1w8,25927
+codeanalyzer/neo4j/project.py,sha256=DcymijKIy9TvBUhzlB_0fDmoSA8WRufJU-1oVP1hH1w,35102
 codeanalyzer/neo4j/rows.py,sha256=med0XFa63PPUVUhJMq1TtVcJxgaVW39sgxBRZJDIJ_w,7811
-codeanalyzer/neo4j/schema.py,sha256=kx134hxG_Uv6b5PkHFfkX7L1STpxSaW4pGTDe_Wruf0,10768
+codeanalyzer/neo4j/schema.py,sha256=HXM-rG-NBuujXU2fXGAUb65sGRKKTXDGB7jr360qEYQ,14330
 codeanalyzer/options/__init__.py,sha256=6NewN0a-1HAEgKcxQjYyVn2WEDLrhax8h3WLgZddeqI,94
-codeanalyzer/options/options.py,sha256=5gmKNxb51vWmIknE4e8kyT9nJRchL0VYspZxe_PAsws,1389
+codeanalyzer/options/options.py,sha256=3GF1m4AI-9NN2sWmhl8wrvi2HjMwofec-We3WqKs_HA,1642
 codeanalyzer/schema/__init__.py,sha256=hIyz02abUJNPW8yUgguaeKflZjTmOZWbDiKICNBD7yk,4141
 codeanalyzer/schema/assign_ids.py,sha256=pQHluLaO5a6hFREp3vjVRsUeAfTYSJ95RXS9TZvnoys,1590
 codeanalyzer/schema/call_graph_ids.py,sha256=mWAhJDBsW8i-siJiINOHCXEm4qM6F_5se9-HuHWIFqU,568
-codeanalyzer/schema/ids.py,sha256=G5NGPjJ3UdJ1k0opy2MrvgWRWNBZgKU1PwY1MR6hDT4,829
+codeanalyzer/schema/ids.py,sha256=aOzsgVaOo6x72dnRgNxlnt6b5wbZzhTm0JOz6pdI57I,1672
 codeanalyzer/schema/l1_body.py,sha256=5Su347kwAPNflJDf7SvBR3sNXx9PVdGEml2pOpQCwo0,1684
 codeanalyzer/schema/l2_callees.py,sha256=CTcBeGoO04DstDC6h-1sHMbbIrHDEOMxP01U9VLBcfc,2327
-codeanalyzer/schema/py_schema.py,sha256=VwwRqr_jFolkbRKi8ytiwUScKZmscJBZvh16Y2tDbII,18449
+codeanalyzer/schema/py_schema.py,sha256=pN03WJcb96LegGSFs7HIBWzTE8bnn8T2adH9M9FJGgQ,23966
 codeanalyzer/semantic_analysis/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/semantic_analysis/call_graph.py,sha256=6YEB_wTn5-oQYLrbIhJYE0BsHl4fpWPoy5Hwd9mTnGc,11918
 codeanalyzer/semantic_analysis/defuse_linker.py,sha256=bSn1rCun28OQqSd2NOc9aVBSm47Gt9Iul4r_gwfqO1w,64930
 codeanalyzer/syntactic_analysis/__init__.py,sha256=EUQkJEh6wHjWx2qTTKbTbUgwSbfKeNieKHNy7RknVXA,476
 codeanalyzer/syntactic_analysis/exceptions.py,sha256=whs_n0vIu655Jkk1a7iOoXY6iIca4pZqJnU40V9Ejaw,537
 codeanalyzer/syntactic_analysis/import_resolver.py,sha256=Q8noZwSdDNt4P4NMqDTB9FaS-M0_d4ASK9GnJop9MDI,2751
-codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=2bp9S5Z9Atx0Ovd70nMzAbutoNx_FD0VYBY397GAAVo,47343
+codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=eTknBDlUuuQd3JEwbRtJt5pGVU89kOnzfmT4D5J_GKQ,47917
 codeanalyzer/utils/__init__.py,sha256=hC6VWdR5rerSqBxzu9KQHTASWqwrrYJv-CMDwrTlzkc,137
 codeanalyzer/utils/logging.py,sha256=Fw0tattPAOMs3o0JMjjXhRVLIF64f-SCcygUXF9jqeg,904
 codeanalyzer/utils/progress_bar.py,sha256=C9JtzVdd10lIxTv-KA6PebqjKWueC_vMGwVzAtHuHIw,2818
-codeanalyzer_python-1.2.0.dist-info/METADATA,sha256=Un9ZuyLWDpzfB_CNuAXiXGvM8eN0HQmr_0r2jGsBqqA,36319
-codeanalyzer_python-1.2.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-codeanalyzer_python-1.2.0.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
-codeanalyzer_python-1.2.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-codeanalyzer_python-1.2.0.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
-codeanalyzer_python-1.2.0.dist-info/RECORD,,
+codeanalyzer_python-1.3.0.dist-info/METADATA,sha256=QAUQ1DK8997qsSI8-g4d294RfI7wLPljdOL4gi42Ofo,42305
+codeanalyzer_python-1.3.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeanalyzer_python-1.3.0.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
+codeanalyzer_python-1.3.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+codeanalyzer_python-1.3.0.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
+codeanalyzer_python-1.3.0.dist-info/RECORD,,