codeanalyzer-python 1.3.0__py3-none-any.whl → 1.4.1__py3-none-any.whl

codeanalyzer/__main__.py

@@ -175,7 +175,10 @@ def main(
         bool,
         typer.Option(
             "--eager/--lazy",
-            help="Enable eager or lazy analysis. Defaults to lazy.",
+            help="Enable eager or lazy analysis. Defaults to lazy. Also gates every "
+            "destructive step of a '--emit neo4j' Bolt push: a lazy push only adds and "
+            "updates, an eager one also removes declarations and edges the source no "
+            "longer has.",
         ),
     ] = False,
     skip_tests: Annotated[
@@ -239,19 +242,11 @@ def main(
         typer.Option(
             "--artifact-text/--no-artifact-text",
             help="Capture verbatim `source` text on discovered artifacts. "
-            "--no-artifact-text empties `source` everywhere (inventory unchanged).",
+            "`source` is the whole file; --no-artifact-text empties it "
+            "everywhere (inventory unchanged). sha256/size_bytes always "
+            "reflect the full file.",
         ),
     ] = True,
-    artifact_text_max_bytes: Annotated[
-        int,
-        typer.Option(
-            "--artifact-text-max-bytes",
-            help="Per-file byte cap on captured artifact `source`; a decodable "
-            "file over the cap is truncated (text_truncated=True). "
-            "sha256/size_bytes always reflect the full file.",
-            min=1,
-        ),
-    ] = 262144,
 ):
     # Determinism: pin the interpreter hash seed before any analysis (no-op
     # when PYTHONHASHSEED is already set; --version exits before this).
@@ -336,7 +331,6 @@ def main(
         verbosity=verbosity,
         entrypoint_rules=tuple(entrypoint_rules or ()),
         artifact_text=artifact_text,
-        artifact_text_max_bytes=artifact_text_max_bytes,
     )
 
     _set_log_level(options.verbosity)

codeanalyzer/artifacts/dependencies.py

@@ -81,9 +81,9 @@ def _resolve_ref(manifest_path: str, ref: str) -> Optional[str]:
 
 def _full_text(project_dir: Path, path: str, art: PyArtifact) -> str:
     """Manifest/lock extraction must never depend on the stored ``source`` --
-    that's capped by ``text_max_bytes`` and emptied by ``capture_text=False``
-    (both payload-size controls on the JSON/Neo4j payload, not extraction
-    controls). Read the real file fresh instead; fall back to ``art.source``
+    that's emptied by ``capture_text=False`` (a payload-size control on the
+    JSON/Neo4j payload, not an extraction control). Read the real file fresh
+    instead; fall back to ``art.source``
     only if it is gone (e.g. a synthetic artifact in a unit test, or the file
     vanished mid-run).
 

codeanalyzer/artifacts/discovery.py

@@ -76,27 +76,11 @@ def _classify(rel_posix: str) -> Tuple[str, List[str]] | None:
     return None
 
 
-def _capture_source(
-    raw: bytes, text: str, capture_text: bool, text_max_bytes: int
-) -> Tuple[str, bool]:
-    """Decide ``(source, text_truncated)`` for a decodable file.
-
-    Slices ``raw`` (not ``text``) for the cap, so it is a true byte cap even
-    when it lands inside a multi-byte character -- ``errors="ignore"`` drops
-    the dangling partial char at the cut, so this never raises."""
-    if not capture_text:
-        return "", False
-    if len(raw) <= text_max_bytes:
-        return text, False
-    return raw[:text_max_bytes].decode("utf-8", errors="ignore"), True
-
-
 def discover_artifacts(
     project_dir: Path,
     app_name: str,
     *,
     capture_text: bool = True,
-    text_max_bytes: int = 262144,
 ) -> Dict[str, PyArtifact]:
     """Walk the project and return every file as an artifact, sorted by path.
 
@@ -109,15 +93,11 @@ def discover_artifacts(
     deliberate exception -- it IS rule-matched (a dependency-manifest), so it
     is captured like any other manifest despite the `.py` suffix.
 
-    ``capture_text=False`` empties ``source`` everywhere (inventory otherwise
-    identical); a decodable file over ``text_max_bytes`` gets a truncated
-    ``source`` and ``text_truncated=True`` -- except a ``dependency-manifest``
-    role artifact, which is always captured in full when decodable and
-    ``capture_text`` is on: its source is what ``build_dependency_view``
-    parses, not bulk/incidental content, so the byte cap does not apply to
-    it (``capture_text=False`` still empties it like everything else).
-    ``sha256``/``size_bytes`` always reflect the full file regardless of
-    either knob."""
+    ``source`` is the WHOLE file or nothing -- never a prefix (#172). A
+    decodable file is captured in full; ``capture_text=False`` empties
+    ``source`` everywhere (inventory otherwise identical), and an undecodable
+    file gets ``""`` as ``binary``. ``sha256``/``size_bytes`` always reflect
+    the full file regardless."""
     out: Dict[str, PyArtifact] = {}
     for path in sorted(project_dir.rglob("*")):
         if not path.is_file():
@@ -148,20 +128,14 @@ def discover_artifacts(
             if decodable and "." not in name and text.startswith("#!"):
                 roles = ["script"]
         if decodable:
-            # A dependency-manifest's source IS the extracted meaning (build_
-            # dependency_view parses it) -- the byte cap targets bulk/incidental
-            # assets, never the files extraction depends on, so manifests are
-            # exempt from it. capture_text=False still empties source (handled
-            # inside _capture_source); only the byte CAP is bypassed here.
-            cap = len(raw) if "dependency-manifest" in roles else text_max_bytes
-            source, text_truncated = _capture_source(raw, text, capture_text, cap)
+            source = text if capture_text else ""
         else:
-            fmt, source, text_truncated = "binary", "", False
+            fmt, source = "binary", ""
 
         out[rel_posix] = PyArtifact(
             id=artifact_id(app_name, rel_posix), path=rel_posix, format=fmt,
             roles=list(roles), size_bytes=len(raw),
             sha256=hashlib.sha256(raw).hexdigest(),
-            source=source, text_truncated=text_truncated,
+            source=source,
         )
     return out

codeanalyzer/core.py

@@ -40,9 +40,9 @@ from codeanalyzer.provenance import analyzer_info, repository_info
 def _artifact_full_text(project_dir: Path, path: str, art) -> str:
     """Mirrors ``artifacts.dependencies._full_text`` verbatim (not imported
     -- that name is module-private to ``dependencies.py``): config-key
-    extraction (#152) must never depend on the stored ``source`` -- capped
-    by ``text_max_bytes`` and emptied by ``capture_text=False`` (payload-size
-    controls, not extraction controls). Read the real file fresh instead;
+    extraction (#152) must never depend on the stored ``source`` -- emptied
+    by ``capture_text=False`` (a payload-size control, not an extraction
+    control). Read the real file fresh instead;
     fall back to ``art.source`` only if it's gone (e.g. a synthetic artifact
     in a unit test, or the file vanished mid-run). Keep the two in sync if
     this logic changes."""
@@ -673,7 +673,6 @@ class Codeanalyzer:
         app.artifacts = discover_artifacts(
             self.project_dir, app_name,
             capture_text=self.options.artifact_text,
-            text_max_bytes=self.options.artifact_text_max_bytes,
         )
         app.dependencies, app.unresolved_imports = build_dependency_view(
             app.artifacts,

codeanalyzer/dataflow/builder.py

@@ -43,6 +43,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.pdg import build_pdg
 from codeanalyzer.dataflow.sdg import ProgramGraphsIR, assemble_sdg
 from codeanalyzer.dataflow.summaries import CallSite, FunctionInfo, compute_summaries
+from codeanalyzer.schema.ids import stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
 
@@ -333,6 +334,7 @@ def emit_l3_body(
                     for e in pdg.edges
                     if e.type == "DDG"
                 ]
+            stamp_body_ids(pycallable)
 
 
 def build_program_graphs(
@@ -442,8 +444,13 @@ def build_program_graphs(
             for t in cs.targets:
                 call_edges.append((sig, t))
 
-    summaries = compute_summaries(infos, sorted(set(call_edges)))
-    return assemble_sdg(infos, summaries, k)
+    # The converged (facts, ddg) per function are threaded straight into the
+    # assembler rather than re-derived there (#155).
+    solutions: Dict[str, object] = {}
+    summaries = compute_summaries(
+        infos, sorted(set(call_edges)), solutions=solutions
+    )
+    return assemble_sdg(infos, summaries, k, solutions=solutions)
 
 
 def emit_l4(
@@ -533,6 +540,7 @@ def emit_l4(
             pycallable.body[im.local(pn.id)] = BodyNode(
                 kind=pn.kind, of=pn.var, parent=parent
             )
+        stamp_body_ids(pycallable)
 
     # (b/c/d) SDG edges → summary / param_in / param_out; CALL dropped.
     for e in ir.sdg_edges:

codeanalyzer/dataflow/identity.py

@@ -16,6 +16,8 @@ from __future__ import annotations
 from collections import defaultdict
 from typing import Dict, Iterable, Optional, Tuple
 
+from codeanalyzer.schema.ids import global_ordinal
+
 
 class IdentityMap:
     def __init__(self, callable_id: str, id_to_local: Dict[int, str]):
@@ -83,9 +85,7 @@ class IdentityMap:
 
     def global_id(self, node_id: int) -> str:
         """Fully addressable id: ``"<callable-id>@<local>"``."""
-        loc = self._map[node_id]
-        # local statements are "line:col"; bookends already carry the leading "@"
-        return f"{self._callable_id}{loc}" if loc.startswith("@") else f"{self._callable_id}@{loc}"
+        return global_ordinal(self._callable_id, self._map[node_id])
 
     def node_ids(self) -> Iterable[int]:
         return self._map.keys()

codeanalyzer/dataflow/sdg.py

@@ -386,8 +386,18 @@ def assemble_sdg(
     infos: Dict[str, FunctionInfo],
     summaries: Dict[str, FunctionSummary],
     k: int,
+    *,
+    solutions: Optional[Dict[str, Tuple[Dict[int, object], List[object]]]] = None,
 ) -> ProgramGraphsIR:
-    """Stitch every function's PDG into the whole-program SDG."""
+    """Stitch every function's PDG into the whole-program SDG.
+
+    *solutions* optionally carries the converged ``(facts, ddg)`` that
+    :func:`~codeanalyzer.dataflow.summaries.compute_summaries` already
+    derived, sparing a second identical solve per function (#155). Omit it and
+    every function is re-solved, which is the historical behaviour and the
+    right posture whenever *summaries* did not come from an immediately
+    preceding run over these same *infos*.
+    """
     ir = ProgramGraphsIR(k_limit=k)
 
     # Pass 1: solve each function against the final summaries and lay out its
@@ -396,7 +406,12 @@ def assemble_sdg(
     formal_ids: Dict[str, Dict[str, int]] = {}
     for sig in sorted(infos):
         info = infos[sig]
-        summary, facts, ddg = solve_function(info, summaries)
+        cached = solutions.get(sig) if solutions is not None else None
+        if cached is None:
+            summary, facts, ddg = solve_function(info, summaries)
+        else:
+            facts, ddg = cached
+            summary = summaries[sig]
         asm = _FunctionAssembler(info, summary, facts, ddg)
         asm.build_formals()
         assemblers[sig] = asm

codeanalyzer/dataflow/summaries.py

@@ -199,19 +199,42 @@ def solve_function(
 def compute_summaries(
     infos: Dict[str, FunctionInfo],
     call_edges: List[Tuple[str, str]],
+    *,
+    solutions: Optional[Dict[str, Tuple[Dict[int, object], List[DDGEdge]]]] = None,
 ) -> Dict[str, FunctionSummary]:
     """Bottom-up composition over the SCC condensation DAG, monotone fixpoint
-    within each SCC."""
+    within each SCC.
+
+    A **singleton SCC with no self-edge** is solved exactly once: the
+    condensation is processed bottom-up, so every callee summary it reads is
+    already final and a second pass could only recompute the same answer to
+    observe that nothing changed. Genuinely recursive SCCs (several members,
+    or one member calling itself) still iterate to fixpoint.
+
+    When *solutions* is supplied it receives each signature's converged
+    ``(facts, ddg)`` — the by-products of the final solve, which
+    :func:`~codeanalyzer.dataflow.sdg.assemble_sdg` would otherwise recompute
+    from scratch. They are the same values that a fresh solve against the
+    final summaries produces, because a converged pass is by definition one
+    in which no member's summary changed (#155).
+    """
     order = strongly_connected_components(sorted(infos), call_edges)
+    self_calls = {src for src, dst in call_edges if src == dst}
     summaries: Dict[str, FunctionSummary] = {}
     for scc in order:
         members = [s for s in scc if s in infos]
-        changed = True
-        while changed:
+        if not members:
+            continue
+        recursive = len(members) > 1 or members[0] in self_calls
+        while True:
             changed = False
             for sig in members:
-                new, _, _ = solve_function(infos[sig], summaries)
+                new, facts, ddg = solve_function(infos[sig], summaries)
+                if solutions is not None:
+                    solutions[sig] = (facts, ddg)
                 if summaries.get(sig) != new:
                     summaries[sig] = new
                     changed = True
+            if not (recursive and changed):
+                break
     return summaries

codeanalyzer/entrypoints/matching.py

@@ -64,7 +64,8 @@ def _compile(pattern: str) -> str:
         if ch == "{":
             j = pattern.index("}", i)
             alts = pattern[i + 1 : j].split(",")
-            out.append("(?:" + "|".join(re.escape(a.strip()) for a in alts) + ")")
+            # `*` keeps its meaning inside an alternative, so `{route,*.route}` works.
+            out.append("(?:" + "|".join(_compile(a.strip()) for a in alts) + ")")
             i = j + 1
         elif ch == "*":
             out.append(r"[^.\s]*")
@@ -93,15 +94,17 @@ def _route_of(dec, spec: Optional[Dict[str, Any]]) -> Optional[str]:
     if idx >= len(args):
         return None
     value = _literal(args[idx])
+    if isinstance(value, (list, tuple)):
+        value = next((v for v in value if isinstance(v, str)), None)
     return value if isinstance(value, str) else None
 
 
-def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
+def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] = None) -> List[str]:
     if not spec:
         return []
     source = spec.get("from")
     if source == "match_suffix":
-        verb = (dec.qualified_name or "").rsplit(".", 1)[-1]
+        verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
         return [verb.upper()]
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
@@ -113,12 +116,27 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
 
 
 def entrypoints_from_decorators(
-    node, framework: str, rules: Iterable["DecoratorRule"]
+    node,
+    framework: str,
+    rules: Iterable["DecoratorRule"],
+    resolve: Optional[Callable[[str], str]] = None,
+    on_written: bool = False,
 ) -> List[PyEntrypoint]:
+    """``resolve`` is the module's import-table resolver (#177): when Jedi could
+    not resolve a decorator (the framework is not importable in the analysis
+    environment -- every ``--no-venv`` run), ``@http.route`` still resolves to
+    ``odoo.http.route`` from ``from odoo import http`` alone, the same way base
+    classes already do. Jedi's definition path wins when it exists.
+
+    ``on_written`` is the heuristic tier: rules match the decorator's spelling
+    as WRITTEN (``http.route``, ``router.post``), no resolution at all, so a
+    shape that reads as an HTTP entrypoint is recorded whether or not any
+    framework rule knows the library behind it."""
     out: List[PyEntrypoint] = []
     for dec in getattr(node, "decorators", []) or []:
+        qualified = dec.name if on_written else decorator_qualified_name(dec, resolve)
         for rule in rules:
-            if not match_pattern(rule.match, dec.qualified_name):
+            if not match_pattern(rule.match, qualified):
                 continue
             out.append(
                 PyEntrypoint(
@@ -126,14 +144,25 @@ def entrypoints_from_decorators(
                     confidence=rule.confidence,
                     rule=rule.id,
                     ruleset=rule.origin,
-                    evidence=dec.qualified_name,
+                    evidence=qualified,
                     route=_route_of(dec, rule.route),
-                    http_methods=_methods_of(dec, rule.methods),
+                    http_methods=_methods_of(dec, rule.methods, qualified),
                 )
             )
     return out
 
 
+def decorator_qualified_name(dec, resolve: Optional[Callable[[str], str]]) -> Optional[str]:
+    """Jedi's resolution, else the import-table resolution of the written
+    spelling, else ``None`` (a spelling the import table cannot map either)."""
+    if dec.qualified_name:
+        return dec.qualified_name
+    if resolve is None:
+        return None
+    resolved = resolve(dec.name)
+    return resolved if resolved != dec.name else None
+
+
 def entrypoints_from_bases(
     cls,
     framework: str,

codeanalyzer/entrypoints/pipeline.py

@@ -6,11 +6,14 @@ loses flags, never the analysis.
 """
 from __future__ import annotations
 
+import builtins
 from pathlib import Path
-from typing import Dict, Iterable, Iterator
+from typing import Dict, Iterable, Iterator, Set
 
 from codeanalyzer.entrypoints.detect import detected_frameworks
-from codeanalyzer.entrypoints.matching import entrypoints_from_bases, entrypoints_from_decorators
+from codeanalyzer.entrypoints.matching import (
+    decorator_qualified_name, entrypoints_from_bases, entrypoints_from_decorators,
+)
 from codeanalyzer.entrypoints.rules import RuleSet, load_rules
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
@@ -56,18 +59,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
     """
     for node in _walk(app):
         node.entrypoints = []
+    app.entrypoint_report.unresolved = {}
 
     app.entrypoint_report.rulesets = list(rules.rulesets)
     frameworks = detected_frameworks(app, project_dir, rules)
     app.entrypoint_report.frameworks_detected = sorted(frameworks)
 
     names = sorted(frameworks)
+    unresolved = app.entrypoint_report.unresolved
     for mod in app.symbol_table.values():
         resolve = _base_resolver(mod)
+        known = _known_heads(mod)
         for node in _walk_module(mod):
+            # #177: what neither Jedi nor the import table could name. This is
+            # the counter that makes silence visible; it was never written before.
+            # A builtin, a declared class, or a name whose head is imported is
+            # nameable and is not counted (`object`, `Exception`, `typing.Generic[T]`).
+            for dec in getattr(node, "decorators", None) or []:
+                if decorator_qualified_name(dec, resolve) is None and _unnameable(dec.name, known):
+                    unresolved[dec.name] = unresolved.get(dec.name, 0) + 1
+            if isinstance(node, PyClass):
+                for base in node.base_classes or []:
+                    if _unnameable(base, known):
+                        unresolved[base] = unresolved.get(base, 0) + 1
             for name in names:
                 fw = rules.frameworks[name]
-                node.entrypoints.extend(entrypoints_from_decorators(node, name, fw.decorators))
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(node, name, fw.decorators, resolve)
+                )
                 if isinstance(node, PyClass) and fw.bases:
                     class_eps, method_eps = entrypoints_from_bases(
                         node, name, fw.bases, resolve
@@ -77,6 +96,34 @@ def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
                         target = (node.callables or {}).get(method_name)
                         if target is not None:
                             target.entrypoints.extend(eps)
+            # Heuristic tier: the written spelling, no framework needed. Runs
+            # last so a node a framework rule already claimed keeps one record.
+            if not node.entrypoints and rules.heuristics:
+                node.entrypoints.extend(
+                    entrypoints_from_decorators(
+                        node, "heuristic", rules.heuristics, resolve, on_written=True
+                    )
+                )
+
+
+_BUILTIN_NAMES: Set[str] = set(dir(builtins))
+
+
+def _known_heads(mod: PyModule) -> Set[str]:
+    """Names that can head a nameable spelling in this module: its declared classes
+    and every imported name or alias."""
+    heads = {cl.name for cl in (mod.types or {}).values()}
+    for imp in mod.imports or []:
+        heads.add(imp.alias or imp.name)
+    return heads
+
+
+def _unnameable(written: str, known: Set[str]) -> bool:
+    """Whether a written base/decorator spelling maps to nothing this module can
+    name: not a builtin, not a declared class, and its head is not imported.
+    Subscripts (`Generic[T]`, `dict[K, V]`) are stripped before the check."""
+    head = written.split("[", 1)[0].split(".", 1)[0].strip()
+    return bool(head) and head not in _BUILTIN_NAMES and head not in known
 
 
 def _base_resolver(mod: PyModule):
@@ -90,7 +137,8 @@ def _base_resolver(mod: PyModule):
     aliases: Dict[str, str] = {}
     for imp in mod.imports or []:
         original = imp.alias or imp.name
-        aliases[imp.name] = imp.module if imp.module == original else f"{imp.module}.{original}"
+        module = imp.resolved_module or imp.module
+        aliases[imp.name] = module if imp.module == original else f"{module}.{original}"
 
     def resolve(written: str) -> str:
         head, _, rest = written.partition(".")

codeanalyzer/entrypoints/rules.py

@@ -22,7 +22,7 @@ _CONFIDENCE = {"declared", "certain", "heuristic"}
 # blocks (Units 4-5) not implemented yet; they are deliberately absent here
 # rather than accepted-and-ignored, so a user file using them fails loudly
 # instead of loading clean and doing nothing.
-_TOP_LEVEL_KEYS = {"version", "frameworks", "disable"}
+_TOP_LEVEL_KEYS = {"version", "frameworks", "heuristics", "disable"}
 
 
 class RulesError(Exception):
@@ -60,6 +60,10 @@ class Framework:
 @dataclass
 class RuleSet:
     frameworks: Dict[str, Framework] = field(default_factory=dict)
+    # Framework-independent decorator rules matched on the WRITTEN spelling,
+    # confidence `heuristic` by default. They run on every node regardless of
+    # `frameworks_detected` and never double a record a framework rule made.
+    heuristics: List[DecoratorRule] = field(default_factory=list)
     rulesets: List[str] = field(default_factory=list)
 
 
@@ -103,9 +107,16 @@ def _merge(out: RuleSet, data: Dict[str, Any], origin: str) -> None:
         for raw in body.get("bases") or []:
             fw.bases.append(_base_rule(raw, origin))
 
+    heuristics = data.get("heuristics") or {}
+    if not isinstance(heuristics, dict):
+        raise RulesError(f"{origin}: `heuristics` must be a mapping")
+    for raw in heuristics.get("decorators") or []:
+        out.heuristics.append(_decorator_rule({"confidence": "heuristic", **raw}, origin))
+
     for fw in out.frameworks.values():
         fw.decorators = [r for r in fw.decorators if r.id not in disabled]
         fw.bases = [r for r in fw.bases if r.id not in disabled]
+    out.heuristics = [r for r in out.heuristics if r.id not in disabled]
 
 
 def _disable_list(data: Dict[str, Any], origin: str) -> List[str]:

codeanalyzer/entrypoints/rules.yml

@@ -22,6 +22,24 @@ frameworks:
         transitive: true
         dispatch: [get, post, put, delete, patch]
 
+  odoo:
+    detect: [odoo]
+    decorators:
+      # `route` is a plain function in odoo/http.py, so Jedi's definition path
+      # and the import-table fallback (`from odoo import http` + `@http.route`,
+      # the shape every --no-venv run sees) both spell it `odoo.http.route`.
+      # The first positional may be one route or a list of them. Odoo serves
+      # GET and POST on a route unless `methods=` narrows it (json-typed routes
+      # are POST), so the default is both, not GET.
+      - id: odoo.route
+        match: "odoo.http.route"
+        route: {from: positional, index: 0}
+        methods: {from: keyword, name: methods, default: [GET, POST]}
+    bases:
+      - id: odoo.controller
+        match: "odoo.http.Controller"
+        transitive: true
+
   fastapi:
     detect: [fastapi]
     decorators:
@@ -86,3 +104,19 @@ frameworks:
         match: "django.views.generic.*"
         transitive: true
         dispatch: [get, post, put, patch, delete, head, options]
+
+# Framework-independent tier. Matched on the decorator's WRITTEN spelling, never
+# on a resolved name, so a shape that reads as an HTTP entrypoint is flagged even
+# when the library behind it has no `frameworks:` block above (or is not
+# importable). Confidence `heuristic`; a consumer wanting only certain hits
+# filters on it. A node a framework rule already matched gets no heuristic record.
+heuristics:
+  decorators:
+    - id: heuristic.http-route
+      match: "{route,*.route,*.*.route}"
+      route: {from: positional, index: 0}
+      methods: {from: keyword, name: methods}
+    - id: heuristic.http-verb
+      match: "{*,*.*}.{get,post,put,patch,delete,head,options,websocket}"
+      route: {from: positional, index: 0}
+      methods: {from: match_suffix}