sourcecode 1.3.0__tar.gz → 1.5.0__tar.gz

{sourcecode-1.3.0 → sourcecode-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.3.0
+Version: 1.5.0
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004

{sourcecode-1.3.0 → sourcecode-1.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.3.0"
+version = "1.5.0"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.3.0"
+__version__ = "1.5.0"

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/architecture_analyzer.py

@@ -182,8 +182,19 @@ class ArchitectureAnalyzer:
         ddd_result = self._detect_ddd(sm.file_paths)
         if ddd_result is not None:
             ddd_pattern, ddd_layers, ddd_contexts, ddd_layer_names = ddd_result
-            domains_for_ddd = self._cluster_domains(filtered) if len(filtered) >= 2 else []
             module_files = self._build_ddd_module_files(sm.file_paths, ddd_contexts)
+            # Use DDD bounded context names as domains so --architecture shows each
+            # context as a distinct domain instead of collapsing all files under
+            # the Maven path segment (e.g. "java").
+            domains_for_ddd = [
+                ArchitectureDomain(
+                    name=n,
+                    files=module_files.get(n, []),
+                    role="DDD bounded context",
+                    confidence="high",
+                )
+                for n in ddd_contexts
+            ]
             bc_list = [
                 BoundedContext(name=n, modules=module_files.get(n, []), confidence="high")
                 for n in ddd_contexts

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/ast_extractor.py

@@ -940,19 +940,51 @@ def _extract_python(path: str, source: str) -> FileContract:
 
 
 # ---------------------------------------------------------------------------
-# Minimal Java extraction (regex-based, no AST)
+# ---------------------------------------------------------------------------
+# Enhanced Java extraction (regex-based, annotation-aware)
 # ---------------------------------------------------------------------------
 
-_JAVA_CLASS_DECL_RE = re.compile(
-    r'public\s+(?:(?:abstract|final|static)\s+)*(class|interface|enum)\s+(\w+)'
-    r'(?:\s+extends\s+([\w.]+))?(?:\s+implements\s+([\w.,\s]+?))?(?=\s*[\{<])',
-    re.MULTILINE,
+_JAVA_IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([^;\s]+)\s*;', re.MULTILINE)
+
+# Single annotation on one line (captures name + optional parens args)
+_JAVA_ANNO_LINE_RE = re.compile(r'^\s*(@[\w.]+(?:\s*\([^)]*\))?)\s*$')
+# Class/interface/enum declaration line (public or package-private)
+_JAVA_CLASS_LINE_RE = re.compile(
+    r'(?:public\s+)?(?:(?:abstract|final|static|sealed)\s+)*'
+    r'(class|interface|enum|@interface)\s+(\w+)'
+    r'(?:\s+extends\s+([\w.]+))?'
+    r'(?:\s+implements\s+([\w.,\s<>]+?))?'
+    r'(?=\s*[\{<])'
 )
-_JAVA_METHOD_SIG_RE = re.compile(
-    r'^\s{0,12}public\s+[^\{]+\(',
+# Public method: up to 12 leading spaces, return type, name, open paren
+_JAVA_PUB_METHOD_LINE_RE = re.compile(
+    r'^\s{0,12}public\s+(?:(?:static|final|synchronized|abstract|default)\s+)*'
+    r'[\w<>\[\]?,\s]+?\s+(\w+)\s*\(',
     re.MULTILINE,
 )
-_JAVA_IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([^;\s]+)\s*;', re.MULTILINE)
+# @Autowired or @Inject field
+_JAVA_FIELD_DECL_RE = re.compile(
+    r'^\s*(?:private|protected|public)?\s*'
+    r'([\w<>.,\[\]? ]+?)\s+(\w+)\s*[;=]'
+)
+
+
+def _java_collect_preceding_annotations(lines: list[str], decl_idx: int) -> list[str]:
+    """Walk back from decl_idx and collect @annotation lines immediately before it."""
+    annotations: list[str] = []
+    i = decl_idx - 1
+    while i >= 0:
+        stripped = lines[i].strip()
+        if not stripped or stripped.startswith("//") or stripped.startswith("*"):
+            i -= 1
+            continue
+        m = re.match(r'(@[\w.]+(?:\s*\([^)]*\))?)', stripped)
+        if m:
+            annotations.insert(0, m.group(1))
+            i -= 1
+        else:
+            break
+    return annotations
 
 
 def _extract_java(path: str, source: str) -> FileContract:
@@ -960,35 +992,93 @@ def _extract_java(path: str, source: str) -> FileContract:
     types: list[TypeDefinition] = []
     functions: list[FunctionSignature] = []
     imports: list[ImportRecord] = []
+    autowired_fields: list[dict] = []
 
-    # Class / interface / enum declarations
-    for m in _JAVA_CLASS_DECL_RE.finditer(source):
-        name = m.group(2)
-        extends_str = m.group(3)
-        implements_str = m.group(4)
-        all_extends: list[str] = []
-        if extends_str:
-            all_extends.append(extends_str.strip())
-        if implements_str:
-            all_extends.extend(i.strip() for i in implements_str.split(",") if i.strip())
-        types.append(TypeDefinition(name=name, kind="class", fields=[], extends=all_extends))
-        exports.append(ExportRecord(name=name, kind="class"))
-
-    class_names = {t.name for t in types}
-
-    # Public method signatures (one-line heuristic)
+    lines = source.splitlines()
+
+    # Pass 1: collect imports
+    seen_sources: set[str] = set()
+    for m in _JAVA_IMPORT_RE.finditer(source):
+        full_import = m.group(1).strip()
+        if full_import not in seen_sources:
+            seen_sources.add(full_import)
+            imports.append(ImportRecord(source=full_import, kind="named", symbols=[]))
+
+    # Pass 2: line-by-line scan for classes, methods, @Autowired fields
+    class_names: set[str] = set()
     seen_methods: set[str] = set()
-    for m in _JAVA_METHOD_SIG_RE.finditer(source):
-        sig_text = m.group(0).strip()
-        name_match = re.search(r'(\w+)\s*\($', sig_text)
-        if not name_match:
-            name_match = re.search(r'(\w+)\s*\(', sig_text)
-        if not name_match:
+    autowired_pending = False
+
+    for idx, line in enumerate(lines):
+        stripped = line.strip()
+
+        # Detect @Autowired / @Inject annotations
+        if stripped.startswith("@Autowired") or stripped.startswith("@Inject"):
+            autowired_pending = True
             continue
-        mname = name_match.group(1)
-        if mname in class_names or mname in seen_methods or mname in {"if", "for", "while", "switch"}:
+
+        # Capture autowired field on next non-annotation, non-blank line
+        if autowired_pending and stripped and not stripped.startswith("@"):
+            autowired_pending = False
+            fm = _JAVA_FIELD_DECL_RE.match(line)
+            if fm:
+                type_name = fm.group(1).strip().split()[-1]  # last word = simple type
+                field_name = fm.group(2).strip()
+                if field_name and type_name and field_name not in {"class", "interface"}:
+                    autowired_fields.append({"type": type_name, "name": field_name})
+        elif stripped and not stripped.startswith("@"):
+            autowired_pending = False
+
+        # Class/interface/enum declaration
+        cm = _JAVA_CLASS_LINE_RE.search(stripped)
+        if cm and ("class " in stripped or "interface " in stripped or "enum " in stripped):
+            kind_kw = cm.group(1)  # class | interface | enum | @interface
+            name = cm.group(2)
+            extends_str = cm.group(3)
+            implements_str = cm.group(4)
+
+            annotations = _java_collect_preceding_annotations(lines, idx)
+            all_extends: list[str] = []
+            if extends_str:
+                all_extends.append(extends_str.strip())
+
+            implements_list: list[str] = []
+            if implements_str:
+                implements_list = [i.strip() for i in implements_str.split(",") if i.strip()]
+
+            export_kind = "class" if kind_kw in ("class", "@interface") else kind_kw
+            exports.append(ExportRecord(
+                name=name,
+                kind=export_kind,
+                annotations=annotations,
+                extends=extends_str.strip() if extends_str else None,
+                implements=implements_list,
+            ))
+            types.append(TypeDefinition(
+                name=name,
+                kind=export_kind,
+                fields=[],
+                extends=all_extends,
+            ))
+            class_names.add(name)
+
+    # Pass 3: public methods with their preceding annotations
+    for m in _JAVA_PUB_METHOD_LINE_RE.finditer(source):
+        sig_text = m.group(0).strip()
+        mname = m.group(1)
+        if (mname in class_names or mname in seen_methods
+                or mname in {"if", "for", "while", "switch", "return", "new"}):
             continue
         seen_methods.add(mname)
+        # Find line index for this match to collect preceding annotations
+        line_start = source.count("\n", 0, m.start())
+        annotations = _java_collect_preceding_annotations(lines, line_start)
+        exports.append(ExportRecord(
+            name=mname,
+            kind="method",
+            annotations=annotations,
+            signature=sig_text,
+        ))
         functions.append(FunctionSignature(
             name=mname,
             signature=sig_text,
@@ -997,14 +1087,6 @@ def _extract_java(path: str, source: str) -> FileContract:
             return_type=None,
         ))
 
-    # Import statements
-    seen_sources: set[str] = set()
-    for m in _JAVA_IMPORT_RE.finditer(source):
-        full_import = m.group(1).strip()
-        if full_import not in seen_sources:
-            seen_sources.add(full_import)
-            imports.append(ImportRecord(source=full_import, kind="named", symbols=[]))
-
     # External deps: top-2 package segments, skip java.* / javax.*
     deps = sorted({
         ".".join(imp.source.split(".")[:2])
@@ -1021,6 +1103,7 @@ def _extract_java(path: str, source: str) -> FileContract:
         functions=sorted(functions, key=lambda f: f.name)[:20],
         types=sorted(types, key=lambda t: t.name),
         dependencies=deps[:20],
+        autowired_fields=autowired_fields[:20],
         extraction_method="heuristic",
     )
 
@@ -1089,6 +1172,51 @@ def _detect_role(path: str, contract: FileContract) -> str:
     return "util"
 
 
+# ---------------------------------------------------------------------------
+# MyBatis XML mapper extractor
+# ---------------------------------------------------------------------------
+
+def _extract_mybatis_xml(rel_path: str, source: str) -> FileContract:
+    """Extract namespace and SQL operations from a MyBatis *Mapper.xml file."""
+    import re as _re
+    from xml.etree import ElementTree
+
+    _NS_STRIP = _re.compile(r"\{[^}]+\}")
+    _SQL_OPS = frozenset({"select", "insert", "update", "delete"})
+
+    exports: list[ExportRecord] = []
+    namespace: str | None = None
+
+    try:
+        root_elem = ElementTree.fromstring(source.encode("utf-8"))
+        namespace = root_elem.get("namespace") or None
+        for elem in root_elem:
+            tag = _NS_STRIP.sub("", elem.tag).lower()
+            if tag in _SQL_OPS:
+                op_id = (elem.get("id") or "").strip()
+                if op_id:
+                    # type_ref carries select/insert/update/delete for the serializer
+                    exports.append(ExportRecord(kind="query", name=op_id, type_ref=tag))
+    except Exception:
+        return FileContract(
+            path=rel_path,
+            language="mybatis-xml",
+            role="mybatis-mapper",
+            extraction_method="heuristic",
+            limitations=["xml_parse_error: failed to parse mapper XML"],
+        )
+
+    deps = [f"namespace:{namespace}"] if namespace else []
+    return FileContract(
+        path=rel_path,
+        language="mybatis-xml",
+        role="mybatis-mapper",
+        exports=exports,
+        dependencies=deps,
+        extraction_method="heuristic",
+    )
+
+
 # ---------------------------------------------------------------------------
 # AstExtractor public class
 # ---------------------------------------------------------------------------
@@ -1108,6 +1236,16 @@ class AstExtractor:
         return self._ts_ok
 
     def extract(self, path: Path, root: Optional[Path] = None) -> Optional[FileContract]:
+        # MyBatis mapper XML — handled before the language map lookup so .xml
+        # files are only processed when they match the mapper naming convention.
+        if path.suffix.lower() == ".xml" and path.name.endswith("Mapper.xml"):
+            try:
+                source = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                return None
+            rel_path = str(path.relative_to(root)).replace("\\", "/") if root else path.name
+            return _extract_mybatis_xml(rel_path, source)
+
         ext = path.suffix.lower()
         language = _LANGUAGE_MAP.get(ext)
         if language is None:

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/cli.py

@@ -728,15 +728,13 @@ def main(
         mode = "contract"   # unknown → safe default
 
     # Legacy flags imply raw mode unless --mode was explicitly overridden.
-    # These flags produce standard_view-only output sections not in contract_view.
-    # Preserves backward compat: callers using any legacy flag get their previous format.
-    # New callers opt into contract mode via --mode contract (or bare invocation).
-    # Legacy flags that produce output sections incompatible with contract_view
-    # force mode to raw. --agent is excluded: it now runs the contract pipeline
-    # and enriches contract_view with auto-enabled analyzers (deps, env, notes).
+    # --format yaml and --graph-modules are now compatible with contract_view:
+    #   yaml is a serialization format (not an output-section flag)
+    #   graph-modules output is included in contract_view when available
+    # Other flags that produce sections exclusive to standard_view still force raw.
     _legacy_flags_active = (
-        compact or tree or format == "yaml" or trace_pipeline
-        or docs or semantics or graph_modules or full_metrics or architecture
+        compact or tree or trace_pipeline
+        or docs or semantics or full_metrics or architecture
     )
     if mode in ("contract", "standard") and _legacy_flags_active:
         mode = "raw"
@@ -1106,6 +1104,17 @@ def main(
         metrics_summary=metrics_summary,
     )
 
+    # Populate Java-specific root fields from java stack detection (FIX-6, 7, 8)
+    _java_stack = next((s for s in stacks if s.stack == "java"), None)
+    if _java_stack is not None:
+        from dataclasses import replace as _dc_replace
+        sm = _dc_replace(sm,
+            packaging=getattr(_java_stack, "packaging", None) or None,
+            language_version=getattr(_java_stack, "language_version", None) or None,
+            spring_profiles=getattr(_java_stack, "spring_profiles", []) or [],
+            app_server_hint=getattr(_java_stack, "app_server_hint", None) or None,
+        )
+
     # Semantic analysis (--semantics flag)
     if semantic_analyzer is not None:
         if workspace_analysis.workspaces:
@@ -1402,7 +1411,16 @@ def main(
     if _is_contract_mode:
         from sourcecode.contract_pipeline import ContractPipeline
         from sourcecode.contract_model import ContractSummary as _ContractSummary
-        _cp = ContractPipeline()
+        # FIX-1: Java projects need higher caps — many files, comprehensive coverage required
+        _jvm_stacks = {"java", "kotlin", "scala", "groovy"}
+        _is_jvm = any(s.stack in _jvm_stacks for s in sm.stacks)
+        # FIX-1: Java projects need higher caps and no relevance threshold
+        _max_files_cp = 2500 if _is_jvm else 500
+        _cp = ContractPipeline(max_files=_max_files_cp)
+        _java_pipeline_kwargs: dict = {}
+        if _is_jvm:
+            _java_pipeline_kwargs["max_contracts"] = 500
+            _java_pipeline_kwargs["min_score"] = 0.0
         try:
             _contracts, _contract_summary = _cp.run(
                 target,
@@ -1420,6 +1438,7 @@ def main(
                 max_importers=max_importers,
                 semantic_calls=sm.semantic_calls or None,
                 code_notes=sm.code_notes or None,
+                **_java_pipeline_kwargs,
             )
         except Exception as _exc:
             typer.echo(f"[error] contract pipeline failed: {_exc}", err=True)
@@ -1462,7 +1481,22 @@ def main(
         data = _contract_view(sm, emit_graph=emit_graph, depth=_depth)
         if not no_redact:
             data = redact_dict(data)
-        content = json.dumps(data, indent=2, ensure_ascii=False)
+        if format == "yaml":
+            from io import StringIO
+            from ruamel.yaml import YAML as _YAML
+            _yaml = _YAML()
+            _yaml.default_flow_style = False
+            _yaml.representer.add_representer(
+                type(None),
+                lambda dumper, data_val: dumper.represent_scalar(
+                    "tag:yaml.org,2002:null", "null"
+                ),
+            )
+            _stream = StringIO()
+            _yaml.dump(data, _stream)
+            content = _stream.getvalue()
+        else:
+            content = json.dumps(data, indent=2, ensure_ascii=False)
     elif agent:
         data = agent_view(sm)
         # When contract pipeline ran (mode=contract, no legacy flags), include

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/contract_model.py

@@ -25,9 +25,13 @@ class ExportRecord:
     """Exported symbol."""
 
     name: str
-    kind: str = "unknown"  # function | class | const | type | default | react_component | enum | interface
+    kind: str = "unknown"  # function | class | const | type | default | react_component | enum | interface | method
     type_ref: Optional[str] = None
     async_: bool = False
+    annotations: list[str] = field(default_factory=list)  # Java: ["@Controller", "@Transactional"]
+    extends: Optional[str] = None                          # Java: parent class
+    implements: list[str] = field(default_factory=list)    # Java: interfaces
+    signature: Optional[str] = None                        # Java method: full signature
 
 
 @dataclass
@@ -96,6 +100,8 @@ class FileContract:
     # Extraction quality
     extraction_method: str = "heuristic"  # ast | tree_sitter | heuristic
     limitations: list[str] = field(default_factory=list)
+    # Java-specific (FIX-1)
+    autowired_fields: list[dict] = field(default_factory=list)  # [{"type": "...", "name": "..."}]
 
 
 @dataclass

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/contract_pipeline.py

@@ -182,6 +182,7 @@ class ContractPipeline:
         semantic_calls: Optional[list] = None,
         code_notes: Optional[list] = None,
         max_contracts: Optional[int] = _MAX_CONTRACTS,
+        min_score: Optional[float] = None,
     ) -> tuple[list[FileContract], ContractSummary]:
         """Run the full extraction pipeline.
 
@@ -218,9 +219,18 @@ class ContractPipeline:
             fname = Path(pn).name
             return any(fname.startswith(pat) or f".{pat.strip('.')}" in fname for pat in _TEST_PATTERNS)
 
+        def _is_extractable(p: str) -> bool:
+            suf = Path(p).suffix.lower()
+            if suf in _SRC_EXTENSIONS:
+                return True
+            # MyBatis mapper XML files — only *Mapper.xml, not all XML
+            if suf == ".xml" and p.endswith("Mapper.xml"):
+                return True
+            return False
+
         src_paths = [
             p for p in file_paths
-            if Path(p).suffix.lower() in _SRC_EXTENSIONS
+            if _is_extractable(p)
             and not scorer.is_noise(p)
             and (symbol is not None or changed_only or not _is_test(p))
         ]
@@ -317,11 +327,17 @@ class ContractPipeline:
         # 10. Top-N cap — enforce max_contracts when not in symbol-search mode.
         # Symbol searches must return all matching files; budget applies only to
         # the default architectural briefing use case.
+        _effective_min_score = min_score if min_score is not None else _MIN_CONTRACT_SCORE
         if symbol is None and max_contracts is not None:
             contracts = [
                 c for c in contracts
-                if c.relevance_score >= _MIN_CONTRACT_SCORE or c.is_entrypoint
+                if c.relevance_score >= _effective_min_score or c.is_entrypoint
             ][:max_contracts]
+        elif symbol is None and max_contracts is None:
+            contracts = [
+                c for c in contracts
+                if c.relevance_score >= _effective_min_score or c.is_entrypoint
+            ]
 
         # 11. Compress types if requested
         if compress_types:

{sourcecode-1.3.0 → sourcecode-1.5.0}/src/sourcecode/dependency_analyzer.py

@@ -128,6 +128,8 @@ def _infer_role(name: str, ecosystem: str, scope: str) -> str:
         return "runtime"
 
     if ecosystem == "java":
+        if scope == "provided":
+            return "provided"
         artifact = n.split(":")[-1] if ":" in n else n
         if any(x in artifact for x in ("spring-boot", "spring-security")):
             return "runtime"
@@ -1120,6 +1122,23 @@ class DependencyAnalyzer:
         properties = self._parse_maven_properties(root_elem, ns)
         dm_versions = self._parse_dependency_management(root_elem, ns, properties)
 
+        # FIX-9: extract parent version for BOM resolution
+        parent_elem = root_elem.find(f"{ns}parent")
+        parent_version: Optional[str] = None
+        parent_group: str = ""
+        if parent_elem is not None:
+            parent_version = (parent_elem.findtext(f"{ns}version") or "").strip() or None
+            parent_group = (parent_elem.findtext(f"{ns}groupId") or "").strip()
+            parent_artifact = (parent_elem.findtext(f"{ns}artifactId") or "").strip()
+            # Propagate parent version into properties for ${project.parent.version}
+            if parent_version:
+                properties.setdefault("project.parent.version", parent_version)
+                properties.setdefault("revision", parent_version)
+
+        # Infer packaging for FIX-6 (used by scope hint for provided)
+        packaging_elem = root_elem.find(f"{ns}packaging")
+        is_war = packaging_elem is not None and (packaging_elem.text or "").strip().lower() == "war"
+
         records: list[DependencyRecord] = []
         deps_elem = root_elem.find(f"{ns}dependencies")
         if deps_elem is None:
@@ -1134,14 +1153,36 @@ class DependencyAnalyzer:
             declared = self._resolve_maven_version(version_raw, properties)
             if declared is None:
                 declared = dm_versions.get(f"{group_id}:{artifact_id}")
+
+            # FIX-4: proper maven scope mapping
             scope_text = (dep.findtext(f"{ns}scope") or "compile").strip().lower()
-            scope = "dev" if scope_text == "test" else "direct"
+            if scope_text == "test":
+                scope = "dev"
+            elif scope_text == "provided":
+                scope = "provided"
+            else:
+                scope = "direct"  # compile, runtime, system, import
+
+            # FIX-4: infer provided for embedded tomcat in WAR projects
+            if (is_war and scope == "direct"
+                    and artifact_id in ("spring-boot-starter-tomcat", "tomcat-embed-core")):
+                scope = "provided"
+
+            # FIX-9: resolve BOM version for Spring Boot / Spring Security starters
+            resolved_version: Optional[str] = None
+            if declared is None and parent_version:
+                if group_id == "org.springframework.boot":
+                    resolved_version = parent_version
+                elif group_id == "org.springframework.security" and "spring-security.version" in properties:
+                    resolved_version = properties["spring-security.version"]
+
             records.append(
                 DependencyRecord(
                     name=f"{group_id}:{artifact_id}",
                     ecosystem="java",
                     scope=scope,
                     declared_version=declared,
+                    resolved_version=resolved_version,
                     source="manifest",
                     manifest_path="pom.xml",
                 )
@@ -1150,6 +1191,18 @@ class DependencyAnalyzer:
         limitations: list[str] = []
         if not records:
             limitations.append("java: pom.xml sin dependencias parseables (puede usar BOM o propiedades)")
+
+        # Warn when Spring Boot BOM manages transitive deps — they can't be resolved statically.
+        parent_artifact_local = (
+            root_elem.findtext(f"{ns}parent/{ns}artifactId") or ""
+        ).strip() if parent_elem is not None else ""
+        if parent_artifact_local == "spring-boot-starter-parent" and parent_version:
+            limitations.append(
+                f"spring_boot_bom_detected: transitive deps managed by Spring Boot BOM "
+                f"v{parent_version}, not resolved statically. "
+                "Run 'mvn dependency:tree' for the full transitive tree."
+            )
+
         return records, limitations
 
     def _analyze_gradle(self, root: Path) -> tuple[list[DependencyRecord], list[str]]: