sourcecode 1.60.0__py3-none-any.whl → 1.62.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.60.0"
+__version__ = "1.62.0"

sourcecode/cli.py

@@ -4838,6 +4838,13 @@ def migrate_check_cmd(
       MIG-007  javax.inject import (MEDIUM)
       MIG-008  javax.ws.rs import (MEDIUM — JAX-RS changed)
 
+    \b
+    Hibernate 5→6 stratification (in the 'hibernate' output section):
+      4 independent layers (JPA annotations / Criteria / HQL / SPI), a per-layer
+      risk matrix, a module exposure map, critical call-chain detection, and an
+      UPGRADE vs REWRITE verdict (dynamic Criteria, custom SPI, reflection-built
+      queries, or concatenated query strings force the REWRITE classification).
+
     \b
     Examples:
       sourcecode migrate-check .

sourcecode/hibernate_strat.py

@@ -0,0 +1,599 @@
+"""hibernate_strat.py — Hibernate 5.x → 6.x migration stratification model.
+
+A Hibernate major upgrade is NOT a single dependency bump for enterprise systems
+that use dynamic persistence. This module splits Hibernate exposure into four
+independent migration domains and classifies each one on its own risk axis:
+
+  1. JPA Annotation Layer        — LOW (unless deprecated annotations exist)
+  2. Criteria API Layer          — HIGH, escalates to CRITICAL when built
+                                    dynamically via reflection / abstraction DAOs
+  3. HQL / String-based Queries  — MEDIUM, escalates to HIGH on concatenation
+  4. Hibernate SPI / Internal    — CRITICAL BLOCKER (UserType, Interceptor, SPI)
+
+It also produces:
+  - a module-level Hibernate exposure map,
+  - critical call-chain detection (DynamicEntityDao, BasicPersistenceModule, …),
+  - stop-condition logic that decides UPGRADE ZONE vs REWRITE ZONE,
+  - separation of observable code risk from inferred runtime risk.
+
+Entry point: analyze_hibernate(file_paths, root) → HibernateStratification
+
+This is purely additive: it does not aggregate Hibernate into a single score, and
+it does not assume that a Spring Boot upgrade resolves ORM risk.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+
+# ---------------------------------------------------------------------------
+# Layer identifiers
+# ---------------------------------------------------------------------------
+
+LAYER_JPA = "jpa_annotations"
+LAYER_CRITERIA = "criteria_api"
+LAYER_HQL = "hql_string_queries"
+LAYER_SPI = "hibernate_spi_internal"
+
+_LAYER_TITLES: dict[str, str] = {
+    LAYER_JPA: "JPA Annotation Layer",
+    LAYER_CRITERIA: "Criteria API Layer",
+    LAYER_HQL: "HQL / String-based Queries",
+    LAYER_SPI: "Hibernate SPI / Internal API",
+}
+
+# Classification verdicts
+CLASS_NONE = "none"
+CLASS_UPGRADE = "upgrade_zone"
+CLASS_UPGRADE_CARE = "upgrade_with_care"
+CLASS_REWRITE = "rewrite_zone"
+
+_CLASS_LABELS: dict[str, str] = {
+    CLASS_NONE: "NO HIBERNATE USAGE DETECTED",
+    CLASS_UPGRADE: "HIBERNATE 6 MIGRATION IS UPGRADE ZONE (dependency bump + spot fixes)",
+    CLASS_UPGRADE_CARE: "HIBERNATE 6 MIGRATION IS UPGRADE-WITH-CARE ZONE (static queries to revalidate)",
+    CLASS_REWRITE: "HIBERNATE 6 MIGRATION IS HIGH RISK REWRITE ZONE (NOT UPGRADE ZONE)",
+}
+
+_SEVERITY_RANK: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low": 3}
+
+
+# ---------------------------------------------------------------------------
+# Detection patterns
+# ---------------------------------------------------------------------------
+
+# Layer 1 — standard JPA annotations (LOW baseline).
+_JPA_ANNOTATION_RE = re.compile(
+    r"@(Entity|Table|OneToMany|ManyToOne|OneToOne|ManyToMany|Column|"
+    r"Id|GeneratedValue|MappedSuperclass|Embeddable|Embedded|JoinColumn|"
+    r"JoinTable|Inheritance|DiscriminatorColumn)\b"
+)
+# Hibernate / JPA annotations deprecated or reworked in Hibernate 6 (escalate).
+_JPA_DEPRECATED_RE = re.compile(
+    r"@TypeDef\b|@TypeDefs\b|"
+    r"org\.hibernate\.annotations\.Type\b|"
+    r"@Type\s*\(\s*type\s*=|"
+    r"@GenericGenerator\b|"
+    r"@org\.hibernate\.annotations\.Entity\b"
+)
+
+# Layer 2 — JPA Criteria API + legacy Hibernate Criteria.
+_CRITERIA_JPA_RE = re.compile(
+    r"\bCriteriaBuilder\b|\bCriteriaQuery\b|\bCriteriaUpdate\b|"
+    r"\bCriteriaDelete\b|\bRoot\s*<|\bPredicate\b|\.criteria\b|"
+    r"persistence\.criteria"
+)
+_CRITERIA_LEGACY_RE = re.compile(
+    r"org\.hibernate\.Criteria\b|\.createCriteria\s*\(|\bDetachedCriteria\b|"
+    r"\bRestrictions\.|\bProjections\.|\bCriterion\b|"
+    r"\bConjunction\b|\bDisjunction\b"
+)
+
+# Layer 3 — HQL / native string queries. createQuery requires a string literal so
+# CriteriaBuilder.createQuery(Class) (Layer 2) is not double-counted here.
+_HQL_RE = re.compile(
+    r"\.createQuery\s*\(\s*\"|"
+    r"\.(createSQLQuery|createNativeQuery|getNamedQuery|createNamedQuery)\s*\("
+)
+# String concatenation inside a query call → dynamic SQL shape (HIGH).
+_HQL_CONCAT_RE = re.compile(
+    r"\.(?:createQuery|createSQLQuery|createNativeQuery)\s*\("
+    r"[^;]{0,400}?(?:\"[^\"]*\"\s*\+|\+\s*\"[^\"]*\"|\+\s*\w+\s*\+)",
+    re.DOTALL,
+)
+
+# Layer 4 — Hibernate SPI / internal API (CRITICAL blocker).
+_SPI_RE = re.compile(
+    r"\b(?:implements|extends)\s+\w*(?:UserType|CompositeUserType|UserCollectionType)\b|"
+    r"\bimplements\s+\w*UserType\b|"
+    r"\borg\.hibernate\.(?:type|engine|internal|persister|metamodel|"
+    r"boot\.spi|boot\.internal|event|tuple|property\.access|loader|sql\.ast)\b|"
+    r"\bEmptyInterceptor\b|"
+    r"\bimplements\s+\w*Interceptor\b|"
+    r"\b(?:implements|extends)\s+\w*EventListener\b|"
+    r"\bSessionFactoryImpl\b|\bSessionImplementor\b|"
+    r"\bSharedSessionContractImplementor\b|"
+    r"\bsetPropertyAccessStrategy\b|\bPropertyAccessStrategy\b|"
+    r"\bImplicitNamingStrategy\b|\bPhysicalNamingStrategy\b"
+)
+
+# Escalation markers — dynamic / reflection-based persistence construction.
+_ABSTRACTION_CLASS_RE = re.compile(
+    r"\b(DynamicEntityDao|DynamicEntityDaoImpl|BasicPersistenceModule|"
+    r"PersistenceModule|GenericDao|GenericEntityDao|GenericEntityService|"
+    r"DynamicDaoHelper|CriteriaTranslator|FieldManager|EntityMetadata)\w*\b"
+)
+_REFLECTION_RE = re.compile(
+    r"Class\.forName\s*\(|\.getDeclaredField|\.getDeclaredMethod|"
+    r"\.getDeclaredFields\s*\(|\.newInstance\s*\(|Method\.invoke|"
+    r"java\.lang\.reflect|\bField\[\]|metadata\.get|buildCriteria|"
+    r"\.getMetamodel\s*\("
+)
+
+
+# ---------------------------------------------------------------------------
+# Data model
+# ---------------------------------------------------------------------------
+
+@dataclass
+class HibernateFinding:
+    layer: str
+    severity: str
+    pattern: str          # short human label of what matched
+    source_file: str
+    first_line: int
+    module: str
+    occurrences: int = 1
+    dynamic: bool = False  # escalated via reflection / abstraction DAO context
+
+    def to_dict(self) -> dict:
+        return {
+            "layer": self.layer,
+            "severity": self.severity,
+            "pattern": self.pattern,
+            "source_file": self.source_file,
+            "first_line": self.first_line,
+            "module": self.module,
+            "occurrences": self.occurrences,
+            "dynamic": self.dynamic,
+        }
+
+
+@dataclass
+class HibernateLayerRisk:
+    layer: str
+    risk: str
+    reason: str
+    estimated_effort: str
+    file_count: int
+    occurrence_count: int
+
+    def to_dict(self) -> dict:
+        return {
+            "layer": self.layer,
+            "layer_title": _LAYER_TITLES.get(self.layer, self.layer),
+            "risk": self.risk,
+            "reason": self.reason,
+            "estimated_effort": self.estimated_effort,
+            "file_count": self.file_count,
+            "occurrence_count": self.occurrence_count,
+        }
+
+
+@dataclass
+class HibernateStratification:
+    detected: bool = False
+    classification: str = CLASS_NONE
+    classification_label: str = _CLASS_LABELS[CLASS_NONE]
+    risk_matrix: list[HibernateLayerRisk] = field(default_factory=list)
+    module_exposure: dict[str, dict] = field(default_factory=dict)
+    incompatible_patterns: list[str] = field(default_factory=list)
+    critical_call_chains: list[dict] = field(default_factory=list)
+    stop_conditions_triggered: list[str] = field(default_factory=list)
+    observable_risk: list[str] = field(default_factory=list)
+    inferred_runtime_risk: list[str] = field(default_factory=list)
+    findings: list[HibernateFinding] = field(default_factory=list)
+
+    def to_dict(self) -> dict:
+        return {
+            "detected": self.detected,
+            "classification": self.classification,
+            "classification_label": self.classification_label,
+            "stratified": True,
+            "risk_matrix": [r.to_dict() for r in self.risk_matrix],
+            "module_exposure_map": self.module_exposure,
+            "incompatible_patterns": self.incompatible_patterns,
+            "critical_call_chains": self.critical_call_chains,
+            "stop_conditions_triggered": self.stop_conditions_triggered,
+            "risk_separation": {
+                "observable_code_risk": self.observable_risk,
+                "inferred_runtime_risk": self.inferred_runtime_risk,
+            },
+            "findings": [f.to_dict() for f in self.findings],
+        }
+
+    def to_text(self) -> str:
+        if not self.detected:
+            return "Hibernate Migration: no Hibernate/JPA persistence usage detected."
+
+        lines: list[str] = [
+            "── Hibernate 5.x → 6.x Migration Stratification ──",
+            f"Classification: {self.classification_label}",
+            "",
+            "Hibernate Migration Impact Matrix:",
+            f"  {'Layer':<30} {'Risk':<9} Effort        Reason",
+        ]
+        for r in self.risk_matrix:
+            lines.append(
+                f"  {_LAYER_TITLES.get(r.layer, r.layer):<30} "
+                f"{r.risk.upper():<9} {r.estimated_effort:<13} {r.reason}"
+            )
+
+        lines.append("")
+        lines.append("Module Hibernate Exposure Map:")
+        if self.module_exposure:
+            for mod, info in sorted(
+                self.module_exposure.items(),
+                key=lambda kv: _SEVERITY_RANK.get(kv[1].get("max_risk", "low"), 3),
+            ):
+                tags = []
+                if info.get("criteria_dynamic"):
+                    tags.append("dynamic-criteria")
+                if info.get("has_spi"):
+                    tags.append("custom-SPI")
+                if info.get("has_reflection"):
+                    tags.append("reflection")
+                tag_str = f"  [{', '.join(tags)}]" if tags else ""
+                layers = ", ".join(sorted(info.get("layers", {}).keys()))
+                lines.append(
+                    f"  {mod:<40} {info.get('max_risk', 'low').upper():<9} "
+                    f"{layers}{tag_str}"
+                )
+        else:
+            lines.append("  (no module attribution)")
+
+        if self.critical_call_chains:
+            lines.append("")
+            lines.append("Critical Call Chains (dynamic / reflection-based persistence):")
+            for cc in self.critical_call_chains:
+                lines.append(
+                    f"  {cc['class']}  ({cc['source_file']}:{cc['first_line']}) — {cc['reason']}"
+                )
+
+        if self.incompatible_patterns:
+            lines.append("")
+            lines.append("Incompatible / High-risk Patterns Found:")
+            for p in self.incompatible_patterns:
+                lines.append(f"  - {p}")
+
+        if self.stop_conditions_triggered:
+            lines.append("")
+            lines.append("Stop Conditions Triggered (force REWRITE classification):")
+            for s in self.stop_conditions_triggered:
+                lines.append(f"  ! {s}")
+
+        lines.append("")
+        lines.append("Risk Separation:")
+        lines.append("  Observable code risk:")
+        for o in (self.observable_risk or ["  (none)"]):
+            lines.append(f"    - {o}")
+        lines.append("  Inferred runtime risk:")
+        for o in (self.inferred_runtime_risk or ["  (none)"]):
+            lines.append(f"    - {o}")
+
+        return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _module_of(rel_path: str) -> str:
+    """Derive a Maven/Gradle module name from a source path.
+
+    Uses the directory segment immediately before '/src/' (the module root). Falls
+    back to the first path segment, or 'root' for top-level files.
+    """
+    norm = rel_path.replace("\\", "/")
+    parts = norm.split("/")
+    for i, seg in enumerate(parts):
+        if seg == "src" and i > 0:
+            return parts[i - 1]
+    if len(parts) > 1:
+        return parts[0]
+    return "root"
+
+
+def _first_line(source: str, match: re.Match) -> int:
+    return source[: match.start()].count("\n") + 1
+
+
+def _count(pattern: re.Pattern, source: str) -> int:
+    return sum(1 for _ in pattern.finditer(source))
+
+
+# ---------------------------------------------------------------------------
+# Effort heuristics
+# ---------------------------------------------------------------------------
+
+def _effort_bucket(file_count: int, base_days_per_file: float, floor: float = 0.5) -> str:
+    days = round(max(floor, file_count * base_days_per_file), 1) if file_count else 0.0
+    return f"~{days}d"
+
+
+# ---------------------------------------------------------------------------
+# Public entry point
+# ---------------------------------------------------------------------------
+
+def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratification:
+    """Scan Java sources for stratified Hibernate 5→6 migration risk."""
+    findings: list[HibernateFinding] = []
+    # module -> aggregation accumulator
+    modules: dict[str, dict] = {}
+    call_chains: list[dict] = []
+
+    layer_files: dict[str, set[str]] = {
+        LAYER_JPA: set(), LAYER_CRITERIA: set(), LAYER_HQL: set(), LAYER_SPI: set()
+    }
+    layer_occ: dict[str, int] = {
+        LAYER_JPA: 0, LAYER_CRITERIA: 0, LAYER_HQL: 0, LAYER_SPI: 0
+    }
+    jpa_deprecated_seen = False
+    criteria_dynamic_global = False
+    spi_global = False
+    reflection_query_global = False
+    concat_query_global = False
+
+    incompatible: set[str] = set()
+
+    for rel_path in file_paths:
+        if not rel_path.endswith(".java"):
+            continue
+        abs_path = root / rel_path
+        try:
+            source = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+
+        # Per-file escalation context.
+        has_abstraction = bool(_ABSTRACTION_CLASS_RE.search(source))
+        has_reflection = bool(_REFLECTION_RE.search(source))
+        module = _module_of(rel_path)
+        mod = modules.setdefault(
+            module,
+            {"layers": {}, "max_risk": "low", "criteria_dynamic": False,
+             "has_spi": False, "has_reflection": False, "files": set()},
+        )
+
+        def _record(layer: str, severity: str, pattern_label: str,
+                    match: re.Match, occ: int, dynamic: bool = False) -> None:
+            findings.append(HibernateFinding(
+                layer=layer, severity=severity, pattern=pattern_label,
+                source_file=rel_path, first_line=_first_line(source, match),
+                module=module, occurrences=occ, dynamic=dynamic,
+            ))
+            layer_files[layer].add(rel_path)
+            layer_occ[layer] += occ
+            ml = mod["layers"].setdefault(layer, {"severity": severity, "occurrences": 0})
+            ml["occurrences"] += occ
+            if _SEVERITY_RANK[severity] < _SEVERITY_RANK[ml["severity"]]:
+                ml["severity"] = severity
+            if _SEVERITY_RANK[severity] < _SEVERITY_RANK[mod["max_risk"]]:
+                mod["max_risk"] = severity
+            mod["files"].add(rel_path)
+
+        if has_reflection:
+            mod["has_reflection"] = True
+
+        # ── Layer 1: JPA annotations ───────────────────────────────────────
+        m = _JPA_ANNOTATION_RE.search(source)
+        if m:
+            _record(LAYER_JPA, "low", "JPA mapping annotations",
+                    m, _count(_JPA_ANNOTATION_RE, source))
+        dm = _JPA_DEPRECATED_RE.search(source)
+        if dm:
+            jpa_deprecated_seen = True
+            _record(LAYER_JPA, "high", "Deprecated Hibernate annotation (@Type/@TypeDef/@GenericGenerator)",
+                    dm, _count(_JPA_DEPRECATED_RE, source))
+            incompatible.add("Deprecated Hibernate annotations (@Type(type=)/@TypeDef) — reworked in Hibernate 6")
+
+        # ── Layer 2: Criteria API ──────────────────────────────────────────
+        crit_m = _CRITERIA_JPA_RE.search(source)
+        legacy_m = _CRITERIA_LEGACY_RE.search(source)
+        crit_hit = crit_m or legacy_m
+        if crit_hit:
+            dynamic = has_abstraction or has_reflection
+            severity = "critical" if dynamic else "high"
+            occ = _count(_CRITERIA_JPA_RE, source) + _count(_CRITERIA_LEGACY_RE, source)
+            label = ("Dynamic Criteria construction (reflection/abstraction DAO)"
+                     if dynamic else "Criteria API usage")
+            _record(LAYER_CRITERIA, severity, label, crit_hit, occ, dynamic=dynamic)
+            if dynamic:
+                criteria_dynamic_global = True
+                mod["criteria_dynamic"] = True
+                incompatible.add("Criteria built dynamically via reflection/abstraction layer "
+                                 "(Hibernate 6 incompatible patterns likely)")
+            if legacy_m:
+                incompatible.add("Legacy org.hibernate.Criteria / Restrictions / Projections "
+                                 "(removed in Hibernate 6 — must move to JPA CriteriaBuilder)")
+
+        # ── Layer 3: HQL / string queries ──────────────────────────────────
+        hql_m = _HQL_RE.search(source)
+        if hql_m:
+            concat_m = _HQL_CONCAT_RE.search(source)
+            if concat_m:
+                concat_query_global = True
+                _record(LAYER_HQL, "high",
+                        "String-concatenated HQL/native query (dynamic SQL shape)",
+                        concat_m, _count(_HQL_RE, source))
+                incompatible.add("String-concatenated HQL/native queries — HIGH risk under "
+                                 "Hibernate 6 ORM parser changes")
+            else:
+                _record(LAYER_HQL, "medium", "HQL / native string query",
+                        hql_m, _count(_HQL_RE, source))
+
+        # ── Layer 4: Hibernate SPI / internal ──────────────────────────────
+        spi_m = _SPI_RE.search(source)
+        if spi_m:
+            spi_global = True
+            mod["has_spi"] = True
+            _record(LAYER_SPI, "critical", "Hibernate SPI / internal API (UserType/Interceptor/SPI)",
+                    spi_m, _count(_SPI_RE, source))
+            incompatible.add("Custom Hibernate SPI (UserType/CompositeUserType/Interceptor/"
+                             "EventListener) — primary Hibernate 5→6 breakage source")
+
+        # ── Critical call-chain detection ──────────────────────────────────
+        if has_abstraction and (crit_hit or has_reflection):
+            am = _ABSTRACTION_CLASS_RE.search(source)
+            reason_bits = []
+            if crit_hit:
+                reason_bits.append("Criteria construction")
+            if has_reflection:
+                reason_bits.append("reflection-based entity metadata")
+                reflection_query_global = True
+            call_chains.append({
+                "class": am.group(0),
+                "source_file": rel_path,
+                "first_line": _first_line(source, am),
+                "reason": "dynamic query generation: " + " + ".join(reason_bits),
+                "module": module,
+            })
+
+    strat = HibernateStratification()
+    strat.findings = findings
+
+    if not findings:
+        strat.detected = False
+        strat.classification = CLASS_NONE
+        strat.classification_label = _CLASS_LABELS[CLASS_NONE]
+        return strat
+
+    strat.detected = True
+    strat.critical_call_chains = call_chains
+    strat.incompatible_patterns = sorted(incompatible)
+
+    # ── Build per-layer risk matrix ────────────────────────────────────────
+    matrix: list[HibernateLayerRisk] = []
+
+    # Layer 1
+    if layer_files[LAYER_JPA]:
+        if jpa_deprecated_seen:
+            risk, reason = "high", ("Deprecated Hibernate annotations present "
+                                    "(@Type(type=)/@TypeDef/@GenericGenerator reworked in H6)")
+            effort = _effort_bucket(len(layer_files[LAYER_JPA]), 0.25)
+        else:
+            risk, reason = "low", ("Standard JPA mapping only — namespace handled by "
+                                   "jakarta migration, no Hibernate-6 annotation breakage")
+            effort = _effort_bucket(len(layer_files[LAYER_JPA]), 0.02, floor=0.2)
+        matrix.append(HibernateLayerRisk(
+            LAYER_JPA, risk, reason, effort,
+            len(layer_files[LAYER_JPA]), layer_occ[LAYER_JPA]))
+
+    # Layer 2
+    if layer_files[LAYER_CRITERIA]:
+        if criteria_dynamic_global:
+            risk, reason = "critical", ("Criteria constructed dynamically via reflection / "
+                                        "abstraction DAOs — Hibernate 6 rewrite zone")
+            effort = _effort_bucket(len(layer_files[LAYER_CRITERIA]), 0.75)
+        else:
+            risk, reason = "high", ("Criteria API in use — JPA Criteria semantics changed; "
+                                    "legacy org.hibernate.Criteria removed in H6")
+            effort = _effort_bucket(len(layer_files[LAYER_CRITERIA]), 0.4)
+        matrix.append(HibernateLayerRisk(
+            LAYER_CRITERIA, risk, reason, effort,
+            len(layer_files[LAYER_CRITERIA]), layer_occ[LAYER_CRITERIA]))
+
+    # Layer 3
+    if layer_files[LAYER_HQL]:
+        if concat_query_global:
+            risk, reason = "high", ("String-concatenated / dynamic queries — HIGH risk under "
+                                    "Hibernate 6 HQL parser changes")
+            effort = _effort_bucket(len(layer_files[LAYER_HQL]), 0.3)
+        else:
+            risk, reason = "medium", ("Static HQL / native queries — revalidate against "
+                                      "Hibernate 6 parser; mostly mechanical")
+            effort = _effort_bucket(len(layer_files[LAYER_HQL]), 0.15)
+        matrix.append(HibernateLayerRisk(
+            LAYER_HQL, risk, reason, effort,
+            len(layer_files[LAYER_HQL]), layer_occ[LAYER_HQL]))
+
+    # Layer 4
+    if layer_files[LAYER_SPI]:
+        risk, reason = "critical", ("Custom Hibernate SPI/internal API (UserType, Interceptor, "
+                                    "EventListener, engine.spi) — primary H5→H6 breakage")
+        effort = _effort_bucket(len(layer_files[LAYER_SPI]), 1.0)
+        matrix.append(HibernateLayerRisk(
+            LAYER_SPI, risk, reason, effort,
+            len(layer_files[LAYER_SPI]), layer_occ[LAYER_SPI]))
+
+    strat.risk_matrix = matrix
+
+    # ── Module exposure map: serialize sets ────────────────────────────────
+    exposure: dict[str, dict] = {}
+    for mod_name, info in modules.items():
+        exposure[mod_name] = {
+            "max_risk": info["max_risk"],
+            "criteria_dynamic": info["criteria_dynamic"],
+            "has_spi": info["has_spi"],
+            "has_reflection": info["has_reflection"],
+            "file_count": len(info["files"]),
+            "layers": {
+                layer: {"severity": d["severity"], "occurrences": d["occurrences"]}
+                for layer, d in info["layers"].items()
+            },
+        }
+    strat.module_exposure = exposure
+
+    # ── Stop-condition logic → upgrade vs rewrite classification ────────────
+    stops: list[str] = []
+    if criteria_dynamic_global:
+        stops.append("Criteria API used dynamically / via abstraction layers "
+                     "(DynamicEntityDao, GenericDao, reflection)")
+    if spi_global:
+        stops.append("Custom Hibernate SPI present (UserType / Interceptor / EventListener / "
+                     "engine.spi internals)")
+    if reflection_query_global:
+        stops.append("Queries generated via reflection / runtime entity metadata")
+    if concat_query_global:
+        stops.append("SQL/HQL shape not statically inferable (string concatenation)")
+    strat.stop_conditions_triggered = stops
+
+    if stops:
+        strat.classification = CLASS_REWRITE
+    elif layer_files[LAYER_CRITERIA] or concat_query_global or jpa_deprecated_seen:
+        strat.classification = CLASS_UPGRADE_CARE
+    elif layer_files[LAYER_HQL] or layer_files[LAYER_JPA]:
+        strat.classification = CLASS_UPGRADE
+    else:
+        strat.classification = CLASS_UPGRADE
+    strat.classification_label = _CLASS_LABELS[strat.classification]
+
+    # ── Risk separation: observable vs inferred ─────────────────────────────
+    observable: list[str] = []
+    inferred: list[str] = []
+    if layer_files[LAYER_JPA]:
+        observable.append(f"JPA mapping annotations in {len(layer_files[LAYER_JPA])} file(s)")
+    if layer_files[LAYER_CRITERIA]:
+        observable.append(f"Criteria API references in {len(layer_files[LAYER_CRITERIA])} file(s)")
+    if layer_files[LAYER_HQL]:
+        observable.append(f"HQL/native query calls in {len(layer_files[LAYER_HQL])} file(s)")
+    if layer_files[LAYER_SPI]:
+        observable.append(f"Hibernate SPI/internal API in {len(layer_files[LAYER_SPI])} file(s)")
+
+    if criteria_dynamic_global or reflection_query_global:
+        inferred.append("Runtime-generated query shapes (reflection/metadata) — exact SQL "
+                        "cannot be statically enumerated; breakage surface is larger than "
+                        "observable call sites")
+    if spi_global:
+        inferred.append("Custom SPI hooks fire at runtime across the persistence lifecycle — "
+                        "behavioural breakage may not be visible at the call site")
+    if concat_query_global:
+        inferred.append("Concatenated query strings resolve at runtime — H6 HQL parser changes "
+                        "may break queries not reachable by static inspection")
+    strat.observable_risk = observable
+    strat.inferred_runtime_risk = inferred
+
+    return strat

sourcecode/mcp/registry.py

@@ -1415,9 +1415,12 @@ Rules detected:
   MIG-007 medium   — javax.inject imports (DI annotations)
   MIG-008 medium   — javax.ws.rs imports (JAX-RS API)
 
-Returns: schema_version, readiness_score (0–100; 100=ready to migrate), blocking_count,
-  estimated_effort_days, spring_boot_2_detected, summary (total_findings, affected_files,
-  by_severity, by_rule), findings[], limitations, metadata.
+Returns: schema_version, readiness_score (0–100; 100=ready to migrate),
+  jakarta_readiness / boot3_readiness / jdk_modernization (per-dimension 0–100),
+  blocking_count, estimated_effort_days, spring_boot_2_detected (true|false|null —
+  null=undetermined, never assumed true), spring_boot_version_detected,
+  summary (total_findings, affected_files, by_severity, by_rule), findings[],
+  limitations, metadata.
 findings fields: id, rule_id, severity, title, source_file, first_line,
   imports_found, explanation, fix_hint.
 

sourcecode/mcp/server.py

@@ -792,7 +792,10 @@ def get_migration_readiness(repo_path: str = ".", min_severity: str = "low") ->
 
     Maps to: sourcecode migrate-check <repo_path> --min-severity <min_severity>
     Returns: MigrationReport with schema_version, readiness_score (0–100; 100=ready to migrate),
-             blocking_count, estimated_effort_days, spring_boot_2_detected,
+             jakarta_readiness / boot3_readiness / jdk_modernization (per-dimension 0–100),
+             blocking_count, estimated_effort_days,
+             spring_boot_2_detected (true|false|null — null=undetermined, never assumed true),
+             spring_boot_version_detected,
              summary (total_findings, affected_files, by_severity, by_rule),
              findings[], limitations, metadata.
     findings fields: id, rule_id, severity, title, source_file, first_line,

sourcecode/migrate_check.py

@@ -6,6 +6,8 @@ that must be addressed when migrating:
   - Java 8 → 17 / 21 (SecurityManager, Nashorn, Unsafe, reflection, etc.)
   - XML Spring config (applicationContext.xml, web.xml, security XML)
   - Dependency incompatibilities (SpringFox, Hibernate 5, ByteBuddy old)
+  - Hibernate 5→6 stratified migration model (see hibernate_strat) — 4 independent
+    layers, module exposure map, call-chain detection, upgrade-vs-rewrite verdict
 
 Entry point: run_migrate_check(file_paths, root) → MigrationReport
 """
@@ -18,7 +20,10 @@ import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Optional
+from typing import Optional, TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from sourcecode.hibernate_strat import HibernateStratification
 
 
 # ---------------------------------------------------------------------------
@@ -541,6 +546,26 @@ SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low":
 # headline on a repo with zero blockers. See MigrationReport.finalize.
 _LOW_SEVERITY_DEDUCTION_CAP: int = 15
 
+# Migration targets that block a Spring Boot 2→3 upgrade (namespace + security).
+# Everything else (java_8_best_practice, java_9_plus, java_11/15/17/18+) is
+# orthogonal JDK modernization debt and must not sink the migration headline.
+_JAKARTA_TARGETS: frozenset[str] = frozenset({"jakarta"})
+_BOOT3_MIGRATION_TARGETS: frozenset[str] = frozenset(
+    {"jakarta", "spring_boot_3", "spring_security_6"}
+)
+# Cap on total readiness deduction from JDK-modernization findings (medium/low),
+# so reflection/date cleanups cannot collapse a jakarta-ready repo's headline.
+_JDK_ADVISORY_DEDUCTION_CAP: int = 15
+
+# Jakarta EE 9+ namespace imports — strong evidence the repo is already on
+# Boot 3 / Jakarta. Used to veto a false spring_boot_2_detected verdict.
+_JAKARTA_IMPORT_RE: re.Pattern = re.compile(
+    r"^[ \t]*import\s+jakarta\.(?:persistence|servlet|validation|annotation|"
+    r"transaction|inject|ws\.rs|jms|ejb|mail|websocket|faces|enterprise|batch|"
+    r"json|el|security)\b",
+    re.MULTILINE,
+)
+
 
 # ---------------------------------------------------------------------------
 # XML config rules (applied to Spring XML config files)
@@ -979,22 +1004,72 @@ class MigrationFinding:
 # Report
 # ---------------------------------------------------------------------------
 
+def _dimension_score(
+    findings: list["MigrationFinding"],
+    targets: "Optional[frozenset[str]]",
+) -> int:
+    """0-100 readiness for one migration dimension.
+
+    targets=None scores the JDK-modernization dimension (every target NOT in the
+    Boot 2→3 migration set). Otherwise scores only findings whose migration_target
+    is in `targets`. Severity-weighted by distinct file (low capped, G-1).
+    """
+    crit: set[str] = set()
+    high: set[str] = set()
+    med: set[str] = set()
+    low: set[str] = set()
+    for f in findings:
+        if targets is None:
+            if f.migration_target in _BOOT3_MIGRATION_TARGETS:
+                continue
+        elif f.migration_target not in targets:
+            continue
+        if f.severity == "critical":
+            crit.add(f.source_file)
+        elif f.severity == "high":
+            high.add(f.source_file)
+        elif f.severity == "medium":
+            med.add(f.source_file)
+        else:
+            low.add(f.source_file)
+    deduction = (
+        len(crit) * 15
+        + len(high) * 8
+        + len(med) * 3
+        + min(len(low) * 1, _LOW_SEVERITY_DEDUCTION_CAP)
+    )
+    return max(0, 100 - deduction)
+
+
 @dataclass
 class MigrationReport:
-    schema_version: str = "1.2"
+    schema_version: str = "1.4"
     generated_at: str = ""
     repo_id: str = ""
     git_head: str = ""
 
     readiness_score: int = 100
+    # Per-dimension readiness (0-100). javax→jakarta namespace, full Boot 2→3
+    # migration, and orthogonal JDK modernization are scored independently so
+    # JDK debt (java.util.Date, reflection) does not sink a jakarta-ready repo.
+    jakarta_readiness: int = 100
+    boot3_readiness: int = 100
+    jdk_modernization: int = 100
     blocking_count: int = 0
     estimated_effort_days: float = 0.0
-    spring_boot_2_detected: bool = False
+    # Tri-state: True = Boot 2 confirmed, False = Boot 3+ confirmed,
+    # None = could not determine. Absence of evidence is never reported as True.
+    spring_boot_2_detected: Optional[bool] = None
+    spring_boot_version_detected: Optional[str] = None
 
     findings: list[MigrationFinding] = field(default_factory=list)
     limitations: list[str] = field(default_factory=list)
     summary: dict = field(default_factory=dict)
     metadata: dict = field(default_factory=dict)
+    # Hibernate 5→6 stratified migration model (4 independent layers, module
+    # exposure map, call-chain detection, upgrade-vs-rewrite verdict). Attached
+    # by run_migrate_check; None when not computed.
+    hibernate: Optional["HibernateStratification"] = None
 
     def finalize(self) -> "MigrationReport":
         if not self.generated_at:
@@ -1027,20 +1102,37 @@ class MigrationReport:
             else:
                 low_files.add(f.source_file)
 
-        # G-1: low-severity findings are advisory (e.g. java.time modernization),
-        # not Boot-2→3 blockers. Cap their total contribution so a repo with zero
-        # blockers cannot score near zero on optional cleanups alone (mall: 96 low
-        # findings dragged readiness to 4/100 despite 0 blocking, already on Boot 3).
-        # Blockers (critical/high) stay uncapped — a genuinely blocked repo still
-        # floors at 0 (shopizer: 301 blocking → 0/100, unchanged).
+        # BUG-2: aggregate readiness no longer collapses on raw JDK-modernization
+        # volume. Blockers (critical/high, any target) stay uncapped so a genuinely
+        # blocked repo floors at 0 (shopizer: 301 blocking → 0). Medium/low are
+        # split by target: migration-blocking (jakarta/boot3/security) count in
+        # full (low capped, G-1); orthogonal JDK debt (Date/reflection) is capped
+        # so it cannot sink a jakarta-ready repo (Broadleaf: 144 Date + 25 reflection
+        # no longer force 0/100).
+        mig_med = {f.source_file for f in self.findings
+                   if f.severity == "medium" and f.migration_target in _BOOT3_MIGRATION_TARGETS}
+        mig_low = {f.source_file for f in self.findings
+                   if f.severity == "low" and f.migration_target in _BOOT3_MIGRATION_TARGETS}
+        jdk_med = {f.source_file for f in self.findings
+                   if f.severity == "medium" and f.migration_target not in _BOOT3_MIGRATION_TARGETS}
+        jdk_low = {f.source_file for f in self.findings
+                   if f.severity == "low" and f.migration_target not in _BOOT3_MIGRATION_TARGETS}
+
         deduction = (
             len(critical_files) * 15
             + len(high_files) * 8
-            + len(medium_files) * 3
-            + min(len(low_files) * 1, _LOW_SEVERITY_DEDUCTION_CAP)
+            + len(mig_med) * 3
+            + min(len(mig_low) * 1, _LOW_SEVERITY_DEDUCTION_CAP)
+            + min(len(jdk_med) * 3 + len(jdk_low) * 1, _JDK_ADVISORY_DEDUCTION_CAP)
         )
         self.readiness_score = max(0, 100 - deduction)
 
+        # Per-dimension readiness — independent severity-weighted scores so the
+        # output reveals that jakarta/Boot3 may be complete even with JDK debt.
+        self.jakarta_readiness = _dimension_score(self.findings, _JAKARTA_TARGETS)
+        self.boot3_readiness = _dimension_score(self.findings, _BOOT3_MIGRATION_TARGETS)
+        self.jdk_modernization = _dimension_score(self.findings, None)
+
         self.estimated_effort_days = round(
             len(critical_files) * 0.5
             + len(high_files) * 0.25
@@ -1065,11 +1157,16 @@ class MigrationReport:
             "repo_id": self.repo_id,
             "git_head": self.git_head,
             "readiness_score": self.readiness_score,
+            "jakarta_readiness": self.jakarta_readiness,
+            "boot3_readiness": self.boot3_readiness,
+            "jdk_modernization": self.jdk_modernization,
             "blocking_count": self.blocking_count,
             "estimated_effort_days": self.estimated_effort_days,
             "spring_boot_2_detected": self.spring_boot_2_detected,
+            "spring_boot_version_detected": self.spring_boot_version_detected,
             "summary": self.summary,
             "findings": [f.to_dict() for f in self.findings],
+            "hibernate": self.hibernate.to_dict() if self.hibernate is not None else None,
             "limitations": self.limitations,
             "metadata": self.metadata,
         }
@@ -1078,8 +1175,18 @@ class MigrationReport:
         min_order = SEVERITY_ORDER.get(min_severity, 3)
         visible = [f for f in self.findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
 
+        if self.spring_boot_2_detected is True:
+            _boot = "Boot 2 (migration target)"
+        elif self.spring_boot_2_detected is False:
+            _boot = f"Boot {self.spring_boot_version_detected or '3+'} detected"
+        else:
+            _boot = "unknown"
         lines: list[str] = [
             f"Migration Readiness: {self.readiness_score}/100",
+            f"  jakarta: {self.jakarta_readiness}/100  "
+            f"boot3: {self.boot3_readiness}/100  "
+            f"jdk-modernization: {self.jdk_modernization}/100",
+            f"Spring Boot 2 detected: {_boot}",
             f"Blocking issues: {self.blocking_count}  "
             f"(critical: {self.summary.get('by_severity', {}).get('critical', 0)}, "
             f"high: {self.summary.get('by_severity', {}).get('high', 0)})",
@@ -1088,6 +1195,10 @@ class MigrationReport:
             "",
         ]
 
+        if self.hibernate is not None and self.hibernate.detected:
+            lines.append(self.hibernate.to_text())
+            lines.append("")
+
         if not visible:
             lines.append("No findings at or above selected severity.")
             return "\n".join(lines)
@@ -1200,6 +1311,7 @@ def run_migrate_check(
     all_findings: list[MigrationFinding] = []
     limitations: list[str] = []
     read_errors = 0
+    jakarta_import_count = 0
 
     # ── Java source scan ────────────────────────────────────────────────────
     for rel_path in file_paths:
@@ -1210,6 +1322,9 @@ def run_migrate_check(
             read_errors += 1
             continue
 
+        # Jakarta EE 9+ namespace adoption signal (vetoes a false Boot-2 verdict).
+        jakarta_import_count += len(_JAKARTA_IMPORT_RE.findall(source))
+
         file_findings = _scan_file(source, rel_path, _ALL_RULES)
         filtered = [f for f in file_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
         all_findings.extend(filtered)
@@ -1263,11 +1378,18 @@ def run_migrate_check(
 
     limitations.extend(_STATIC_LIMITATIONS)
 
-    spring_boot_2 = _detect_spring_boot_2(root)
+    spring_boot_2, spring_boot_version = _detect_spring_boot(root, jakarta_import_count)
+
+    # Hibernate 5→6 stratification (independent of min_severity — it is its own
+    # risk model, not a severity-filtered finding stream).
+    from sourcecode.hibernate_strat import analyze_hibernate
+    hibernate_strat = analyze_hibernate(file_paths, root)
 
     report = MigrationReport(
         spring_boot_2_detected=spring_boot_2,
+        spring_boot_version_detected=spring_boot_version,
         findings=all_findings,
+        hibernate=hibernate_strat,
         limitations=limitations,
         metadata={
             "java_files_scanned": len(file_paths),
@@ -1309,36 +1431,105 @@ _STATIC_LIMITATIONS: list[str] = [
 ]
 
 
-def _detect_spring_boot_2(root: Path) -> bool:
-    """Return True if any build file in the repo declares spring-boot 2.x.
+# Spring Boot version captured ONLY in an authoritative context (parent,
+# managed BOM, an explicit spring-boot* dependency version, a spring.boot.version
+# property, or the Gradle plugin) — NOT any stray 2.x library version elsewhere
+# in the pom. These run on property-resolved text so ${spring.boot.version}
+# is already substituted.
+_BOOT_VERSION_PATTERNS: tuple[re.Pattern, ...] = (
+    # <spring.boot.version>3.5.14</...> / <spring-boot.version> property declaration
+    re.compile(r"<spring[.\-_]?boot[.\-_]?version>\s*(\d+)\.\d", re.IGNORECASE),
+    # gradle.properties: springBootVersion=3.5.14 / spring.boot.version=2.7.18
+    re.compile(r"spring[.\-_]?boot[.\-_]?version\s*[=:]\s*[\"']?(\d+)\.\d", re.IGNORECASE),
+    # <artifactId>spring-boot-*</artifactId> immediately followed by <version>
+    re.compile(
+        r"<artifactId>\s*spring-boot[\w-]*\s*</artifactId>\s*<version>\s*(\d+)\.\d",
+        re.IGNORECASE,
+    ),
+    # <version> immediately followed by <artifactId>spring-boot-*</artifactId>
+    re.compile(
+        r"<version>\s*(\d+)\.\d[^<]*</version>\s*<artifactId>\s*spring-boot[\w-]*\s*</artifactId>",
+        re.IGNORECASE,
+    ),
+    # Gradle plugin: id 'org.springframework.boot' version '3.1.0'
+    re.compile(
+        r"org\.springframework\.boot[\"']?[^\n]*?version[^\n]*?[\"'](\d+)\.\d",
+        re.IGNORECASE,
+    ),
+)
+
+_BOOT_FULL_VERSION_PATTERNS: tuple[re.Pattern, ...] = (
+    re.compile(r"<spring[.\-_]?boot[.\-_]?version>\s*(\d+\.\d[\w.\-]*)", re.IGNORECASE),
+    re.compile(r"spring[.\-_]?boot[.\-_]?version\s*[=:]\s*[\"']?(\d+\.\d[\w.\-]*)", re.IGNORECASE),
+    re.compile(
+        r"<artifactId>\s*spring-boot[\w-]*\s*</artifactId>\s*<version>\s*(\d+\.\d[\w.\-]*)",
+        re.IGNORECASE,
+    ),
+)
+
 
-    Checks root build files plus one level of child modules to handle monorepos
-    where the Spring Boot parent version lives in a submodule pom.xml.
+def _extract_boot_versions(text: str) -> tuple[set[int], Optional[str]]:
+    """Return (set of detected Spring Boot major versions, first full version string)."""
+    majors: set[int] = set()
+    for pat in _BOOT_VERSION_PATTERNS:
+        for m in pat.finditer(text):
+            try:
+                majors.add(int(m.group(1)))
+            except (ValueError, IndexError):
+                pass
+    full: Optional[str] = None
+    for pat in _BOOT_FULL_VERSION_PATTERNS:
+        m = pat.search(text)
+        if m:
+            full = m.group(1).strip()
+            break
+    return majors, full
+
+
+def _detect_spring_boot(root: Path, jakarta_import_count: int) -> tuple[Optional[bool], Optional[str]]:
+    """Tri-state Spring Boot 2 detection. Returns (spring_boot_2_detected, version).
+
+    - True  → Spring Boot 2.x confirmed by build evidence (migration target).
+    - False → Boot 3+ confirmed, OR jakarta.* namespace already adopted en masse.
+    - None  → version could not be determined. Absence of evidence is never True.
+
+    Resolves Maven ${properties} so version-by-property (no starter-parent) works,
+    and detects Boot via parent, managed BOM, spring-boot* dependency, property,
+    or the Gradle plugin. Massive jakarta.* imports veto a Boot-2 verdict.
     """
-    _SB2 = re.compile(
-        # Maven: <parent>...<artifactId>spring-boot-*</artifactId>...<version>2.x
-        r"spring[.\-]?boot.*?<version>\s*2\.\d+|"
-        r"<version>\s*2\.\d+[\.\d]*\s*</version>.*?spring[.\-]?boot|"
-        # Maven properties: <spring.boot.version>2.x or spring-boot.version=2.x
-        r"spring[.\-_]?boot[.\-_]?version\s*[=>\"'\s]+2\.\d+|"
-        # Gradle plugin: id 'org.springframework.boot' version '2.x'
-        r"org\.springframework\.boot[^\n]*?['\"']2\.\d+",
-        re.IGNORECASE | re.DOTALL,
-    )
-    # Candidate build files: root + one level deep (child modules in monorepos)
     root_files = [
         root / name
         for name in ("pom.xml", "build.gradle", "build.gradle.kts", "gradle.properties")
     ]
     child_poms = list(root.glob("*/pom.xml"))
     child_gradle = list(root.glob("*/build.gradle")) + list(root.glob("*/build.gradle.kts"))
-    # Limit child scan to 30 files to stay fast on large monorepos
+    # Limit child scan to 30 files to stay fast on large monorepos.
     candidates = root_files + (child_poms + child_gradle)[:30]
+
+    majors: set[int] = set()
+    full_version: Optional[str] = None
     for candidate in candidates:
         try:
             text = candidate.read_text(encoding="utf-8", errors="replace")
-            if _SB2.search(text):
-                return True
         except OSError:
-            pass
-    return False
+            continue
+        if candidate.name == "pom.xml":
+            text = _resolve_maven_properties(text)
+        file_majors, file_full = _extract_boot_versions(text)
+        majors |= file_majors
+        if full_version is None and file_full is not None:
+            full_version = file_full
+
+    # Boot 3+ explicitly declared → not a Boot 2 repo.
+    if any(m >= 3 for m in majors):
+        return False, full_version
+    # Boot 2 declared. jakarta.* adoption en masse contradicts a literal Boot-2
+    # verdict (already mid/post namespace migration) → report unknown, never True.
+    if 2 in majors:
+        if jakarta_import_count > 0:
+            return None, full_version
+        return True, full_version
+    # No version evidence. jakarta.* present ⇒ Boot 3 (Jakarta EE 9+).
+    if jakarta_import_count > 0:
+        return False, full_version
+    return None, full_version

sourcecode/serializer.py

@@ -261,6 +261,49 @@ def _compact_git_context(sm: "SourceMap") -> "Optional[dict[str, Any]]":
     return ctx if ctx else None
 
 
+# Java EE namespaces that were renamed javax.* → jakarta.* in Jakarta EE 9.
+# Only these carry javax→jakarta migration risk. JDK / JSR namespaces that keep
+# the javax.* prefix forever (javax.cache=JSR-107, javax.sql, javax.xml JAXP,
+# javax.naming, javax.crypto, …) are deliberately NOT listed and must not flag.
+_JAKARTA_RENAMED_NAMESPACES: tuple[str, ...] = (
+    "javax.servlet",            # also covers javax.servlet.jsp
+    "javax.persistence",
+    "javax.validation",
+    "javax.transaction",
+    "javax.ws.rs",
+    "javax.ejb",
+    "javax.jms",
+    "javax.mail",
+    "javax.xml.bind",           # JAXB — moved; plain javax.xml (JAXP) does not
+    "javax.xml.ws",
+    "javax.xml.soap",
+    "javax.activation",
+    "javax.faces",
+    "javax.enterprise",
+    "javax.inject",
+    "javax.batch",
+    "javax.json",
+    "javax.websocket",
+    "javax.el",
+    "javax.security.enterprise",
+    "javax.security.jacc",
+    "javax.annotation",         # ambiguous: JSR-250 EE subset moved to jakarta
+)
+
+
+def _is_jakarta_renamed_namespace(nl: str) -> bool:
+    """True only for javax.* namespaces actually renamed to jakarta.* in Jakarta EE 9.
+
+    Matches exact namespace or a sub-package (e.g. javax.servlet → javax.servlet.http).
+    JDK/JSR namespaces that keep javax.* forever (javax.cache, javax.sql, javax.xml
+    JAXP, javax.naming, …) return False.
+    """
+    for ns in _JAKARTA_RENAMED_NAMESPACES:
+        if nl == ns or nl.startswith(ns + "."):
+            return True
+    return False
+
+
 def _dep_risk_flags(name: str, version: "Optional[str]") -> list[str]:
     """Static heuristic risk flags for a single dependency. No external lookups."""
     flags: list[str] = []
@@ -268,7 +311,7 @@ def _dep_risk_flags(name: str, version: "Optional[str]") -> list[str]:
     if "spring-boot" in nl or "spring.boot" in nl:
         if version and version.startswith("2."):
             flags.append("spring-boot-2.x-eol")
-    if nl.startswith("javax.") or nl == "javax":
+    if _is_jakarta_renamed_namespace(nl):
         flags.append("javax-to-jakarta-migration-risk")
     if "ojdbc" in nl or nl in {"com.oracle.database.jdbc", "oracle.jdbc.driver.oracledriver"}:
         flags.append("oracle-vendor-lock")

{sourcecode-1.60.0.dist-info → sourcecode-1.62.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.60.0
+Version: 1.62.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.60.0.dist-info → sourcecode-1.62.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=K2X8G7LVjuV1hmr12r2Qonlfz5_JfYRcVzSPr6Z564k,103
+sourcecode/__init__.py,sha256=M2ctLJu2Bc_7rapOGaPAxxYG50XM5jz5dbisyWgh-sE,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -7,7 +7,7 @@ sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/canonical_ir.py,sha256=DEwucOPJguLsVtg5cV8mWXNi112l5jmBhv73KGGebVk,24849
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=hKzg-nQ47htqqIUzSGvYxv15cXrA3KgICTwJmdqal0o,8095
-sourcecode/cli.py,sha256=9JLQ0OgRBwWa4Cf2ufpk9gKOpI3mx6t8yZSxqpF_kXw,275902
+sourcecode/cli.py,sha256=bEArsMTzwzag8xk-d2AkQk2I3WiZmVyoILRu_PtYBY0,276304
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -28,11 +28,12 @@ sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
+sourcecode/hibernate_strat.py,sha256=Q_IJpO2jZEDaFPyp0v9svlcB3LetOu56R8Mv7S2F3aU,26165
 sourcecode/integration_detector.py,sha256=ZJqrGwvZ4ee2JTGhlazKk67aZi173HxkhNpl8Yntpd8,6503
 sourcecode/license.py,sha256=wckiLuiwaE35KMCStUf1gYzleJuFe6qsSyxUQJvit3s,23500
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=H8iy7Vk8cGL0dnR3ZkFPS20CtfF5LJWuzQVQE4awQ9s,56192
+sourcecode/migrate_check.py,sha256=2f7f2NCrBmIqh4MzAHthaZ4UQTyAgjIkRPV9Fdi4Nic,65166
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=EN1RGZRvLq5EcPgpjYV_IyCKVlAQQn2bbpEisQ5LpGg,3780
@@ -52,7 +53,7 @@ sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs,3503
 sourcecode/semantic_analyzer.py,sha256=4OdG6tTSnTvq3_dSWMbQu8Ad1ndSCKeG-b9qM4hIxkw,89176
-sourcecode/serializer.py,sha256=TGzftrSKitZrtl6Hh-R05s4KdTOxwTmph_lGDbo2Wzg,125015
+sourcecode/serializer.py,sha256=6YoGyRqkjtp34ELwgRGCZ1r1b6zu6SqiAWT8ySjs-M8,126516
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=G7Or2lKBUQbcTDqudLvSs9XvNg_YoAa-_lBOG_ULs8E,5457
 sourcecode/spring_impact.py,sha256=qLwLfItX_o9LU-k_qjhD2hFpTX3PpEQ85TsYTAArzvg,56016
@@ -88,9 +89,9 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/orchestrator.py,sha256=kT7IssYNyQXVtDf2Q69qrMSTuyJlJ1Rhkp6_EHqc_38,36520
-sourcecode/mcp/registry.py,sha256=8LxxalpJy1L_BrEfwiVfywFVOcJJMXLGusJaUGGH7Y4,65663
+sourcecode/mcp/registry.py,sha256=8ot8A9_ccPNUvHgFkUO8lIlbp4XT_UcHR101nc71Gjc,65840
 sourcecode/mcp/runner.py,sha256=-Dp2qPGRkfNTVen6bKh7WtzQqpcEtsrXoiuajvshlKk,2866
-sourcecode/mcp/server.py,sha256=6Q98B1JkgBR5pZx3JyyXZosazpPX7FSBDqfG9nlZaII,63114
+sourcecode/mcp/server.py,sha256=AQN076joOHyKoU7HaISpzPIIN-5271DDn5DqbQsnTaI,63324
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=B9CneieWTpaDSDIyW3S5nrlRlBpvfqUcgi93-mm_ApQ,2135
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -102,8 +103,8 @@ sourcecode/telemetry/consent.py,sha256=H5z2Wu63pZqbaKucRPoJQJ0zCo4cke9ZlBrJC-MaW
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-1.60.0.dist-info/METADATA,sha256=13oyunu_mO7yr8DwHg2AwrNQ4tW0tHWydwzUEoOBnss,38941
-sourcecode-1.60.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.60.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.60.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.60.0.dist-info/RECORD,,
+sourcecode-1.62.0.dist-info/METADATA,sha256=pj1Wd3yqoYh6bYXMq-w9Z4ZF4bqAAAfyfMo4sWaMkzQ,38941
+sourcecode-1.62.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.62.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.62.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.62.0.dist-info/RECORD,,