sourcecode 1.63.0__tar.gz → 1.65.0__tar.gz

{sourcecode-1.63.0 → sourcecode-1.65.0}/CHANGELOG.md

@@ -1,5 +1,110 @@
 # Changelog
 
+## [1.65.0] — 2026-06-30
+
+### Fixed — non-Spring / already-modernized repos no longer fabricate blockers (`migrate-check`)
+
+A Pro audit of a real enterprise repo (**Keycloak**, Quarkus 3.33 / Jakarta EE /
+Hibernate ORM 6.2.13, Jakarta migration **complete**, 7,885 Java files / 186
+modules) exposed a cluster of false positives that produced `readiness 0/100`, a
+phantom `hibernate_rewrite` headline, and a `boot3` dimension marked applicable
+with **zero** Spring. A migration verdict shown to a CTO must never contradict its
+own evidence. Keycloak is now a golden regression fixture
+(`tests/test_migrate_check_keycloak_regression.py`).
+
+- **Hibernate version is resolved before any 5→6 verdict (BUG #1).** The effective
+  Hibernate version is parsed from build descriptors, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>` values plus explicit
+  `hibernate-core`/`hibernate-orm` coordinates. Major ≥ 6 → the 5→6 axis is **N/A**
+  (migration already done), never a blocker. Unresolved version → low-confidence
+  hypothesis, **no** `headline_blocker`. New `hibernate.effective_version`,
+  `version_major`, `version_confidence`, `migration_applicable`.
+- **Boot3 dimension auto-disables without Spring (BUG #2).** `boot3.applicable` is
+  now a function of real Spring usage (build coordinate or `org.springframework`
+  import). Quarkus / Micronaut / Jakarta-pure repos report `boot3` as N/A instead
+  of a contradictory `applicable: true`.
+- **Jakarta scorer ignores permanent `javax.*` (BUG #3).** The JDK/JSR allowlist
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) is honored end-to-end, so the
+  Keycloak's 1,065 permanent `javax.*` imports stop counting as jakarta debt.
+- **Readiness headline can no longer be a misleading 0 (BUG #4).** Framework
+  blockers (jakarta / Boot3 / Security) deduct uncapped; orthogonal JDK debt is
+  advisory-capped and best-practice hygiene is excluded — so an already-modernized
+  repo reads high (Keycloak 85/100), never 0. The headline cannot contradict its
+  own note.
+- **Effort excludes N/A axes (BUG #5).** `estimated_effort_days` is computed over
+  product (`main`) findings only; the phantom Hibernate 5→6 effort is gone.
+- **Best-practice hygiene no longer sinks a dimension (BUG #6).**
+  `java.util.Date`/`Calendar` (MIG-016, `java_8_best_practice`) is reported as a
+  separate `hygiene_findings` metric and excluded from JDK-modernization scoring.
+- **MIG-006 explanation matches the actual symbol (BUG #7).** The explanation now
+  names the detected `javax.annotation.*` symbol instead of a fixed
+  `@PostConstruct/@PreDestroy/@Resource` blurb. `javax.annotation.Generated` (JSR-250,
+  emitted into autogenerated SCIM/JAXB sources) is downgraded to **low** and bucketed
+  as `generated`.
+- **Test/fixture findings segregated from `blocking_count` (BUG #8).** Findings in
+  test harness modules (`testsuite/`, `test-framework/`, `integration-arquillian/`,
+  `*-test*`) and under `src/test/` are tagged `code_context: test`; autogenerated
+  sources `generated`. Only `main` counts toward `blocking_count`, readiness, and
+  effort. The other buckets surface in `non_blocking{}`. Keycloak's 10 test `web.xml`
+  + 14 test-framework `sun.*` no longer inflate the verdict (`blocking_count` 30 → 6).
+- **`export --integrations` is no longer Spring-centric (BUG #9).** Detection now
+  covers plain-Java/Jakarta HTTP clients (JDK `HttpClient`, Apache, OkHttp), JNDI
+  LDAP, and JavaMail/SMTP in addition to Spring templates, and emits an explicit
+  `confidence` (`observed` / `not_analyzed`) + `coverage_note` rather than an
+  authoritative `0`. Keycloak: 0 → 144 integrations (80 HTTP / 33 LDAP / 31 SMTP).
+
+## [1.64.0] — 2026-06-30
+
+### Fixed — zero false-positive blockers (`migrate-check` / `endpoints`)
+
+A Pro audit of a real enterprise repo (Alfresco Content Services Community, 6,549
+classes) surfaced false blockers that would have invalidated a ~2 person-month
+budget decision. A migration blocker is a high-cost claim: if the tool cannot
+**prove** it from resolved AST/dependency signals, it must not be declared. This
+release enforces that — blockers operate on parsed imports / fully-qualified type
+references, never on a substring inside a comment, Javadoc, string literal, or
+classpath resource path. The `hibernate` sub-`schema_version` is now **2.1**.
+
+- **Phantom Hibernate eliminated.** Hibernate detection now requires real evidence:
+  an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+  parsed `import {jakarta,javax}.persistence.*`. Absent all three →
+  `hibernate.detected = false`, no `hibernate_rewrite` headline, no phantom effort.
+  All scanning runs on source with comments + string/char literals stripped (line
+  numbers preserved), so an `org.hibernate.dialect.*` substring in Javadoc or an
+  iBatis resource path can no longer trigger a verdict. Over-generic Criteria tokens
+  (`Predicate`, `Root<`, `Criterion`, `Conjunction`, `Disjunction`) were dropped —
+  they collide with project-owned domain classes. SPI bare-name matches
+  (`implements XInterceptor`, `extends XEventListener`) now require an
+  `org.hibernate` import in the same file; FQN-anchored SPI matches still count
+  on their own. New `hibernate.evidence{}` records the proof + `confidence`.
+- **MIG-004 / jakarta rules respect a JDK allowlist.** `javax.transaction.xa.*`
+  (the Java SE `java.transaction.xa` module), `javax.annotation.processing.*`,
+  `javax.sql.*`, `javax.xml.parsers/transform/...`, `javax.management.*`,
+  `javax.crypto.*`, and the other permanent JDK/JSR `javax` namespaces no longer
+  count as jakarta-migration findings. App-level `javax.transaction.Transactional`,
+  `javax.annotation.PostConstruct`, etc. are still flagged (true positives kept).
+  Matching is by fully-qualified import prefix, not simple name or partial token.
+- **`readiness_score` no longer sinks on an N/A dimension.** A dimension that does
+  not apply (e.g. Hibernate on a repo with no Hibernate) is reported as N/A
+  (`score: null`), never as 0. New `applicable_dimensions{}` and `readiness_note`
+  make the aggregate's derivation explicit — read the per-dimension breakdown +
+  `blocking_count`, not the single number.
+- **`endpoints` never implies "no API".** When the Spring-MVC surface is empty but
+  another REST framework is present (Alfresco WebScripts via `*.desc.xml` +
+  `AbstractWebScript`/`DeclarativeWebScript`, JAX-RS, or mapped Servlets),
+  `security_model` becomes `"undetermined"` (not `"unknown"`), a
+  `non_spring_rest_surface{}` block is emitted, and a warning states the surface is
+  unmodeled — so `total: 0` is never read as "this app exposes no endpoints".
+
+### Tests
+
+- New `tests/test_falsepositive_fixes.py` — positive **and** negative fixtures per
+  bug (phantom comment-only repo, project-owned `Dialect`/`Criteria`/`Interceptor`
+  classes, `javax.transaction.xa`, WebScripts) alongside the true positives that
+  must be preserved (real Hibernate, `javax.transaction.Transactional`,
+  `@RestController`). Full suite: 2827 passed.
+
 ## [1.63.0] — 2026-06-29
 
 ### Added — actionable Hibernate rewrite targets (`migrate-check`)

{sourcecode-1.63.0 → sourcecode-1.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.63.0
+Version: 1.65.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -377,6 +377,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -409,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations (`RestTemplate`, `WebClient`, `@FeignClient`, `LdapTemplate`, `JmsTemplate`, ActiveMQ) with `file:line` evidence and a literal `target` URL/name when present. |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -608,7 +610,7 @@ Detects migration blockers across Java source files, Spring XML config files, an
 | `MIG-002` | high | `javax.servlet` import — Servlet API changed |
 | `MIG-003` | high | `javax.validation` import — Bean Validation changed |
 | `MIG-004` | high | `javax.transaction` import — TX API changed |
-| `MIG-006` | medium | `javax.annotation` import — CDI annotations changed |
+| `MIG-006` | medium¹ | `javax.annotation` import — CDI annotations changed (¹`javax.annotation.Generated` in autogenerated code → **low**, bucketed `generated`; explanation names the actual symbol) |
 | `MIG-007` | medium | `javax.inject` import — DI annotations changed |
 | `MIG-008` | medium | `javax.ws.rs` import — JAX-RS changed |
 | `MIG-009` | medium | `javax.jms` import — JMS API changed |
@@ -663,7 +665,17 @@ A Hibernate major upgrade is **not** a single dependency bump for systems that u
 dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
 independent migration domains — never one aggregated score — and emits **actionable,
 machine-readable rewrite targets** so a migration agent can consume the output
-directly instead of re-parsing the repo. Sub-`schema_version`: `2.0`.
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
 
 **Four layers** (each on its own risk axis):
 
@@ -704,9 +716,45 @@ Hibernate is an orthogonal rewrite axis, so it does not sink the headline
 `readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
 to `"hibernate_rewrite"` so a reader of the headline score is not misled.
 
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
+#### Reliability guarantees (no version, no verdict)
+
+A migration verdict shown to a decision-maker must never contradict its own
+evidence. `migrate-check` enforces:
+
+- **Version-gated framework axes.** The Hibernate 5→6 axis applies only when the
+  effective Hibernate version (resolved from `pom.xml`/Gradle, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>`) is `< 6`. A resolved
+  Hibernate **6+** repo is reported `migration_applicable: false` (N/A) — no
+  `hibernate_rewrite` headline. An **unresolved** version degrades to a
+  low-confidence hypothesis with no headline blocker. See
+  `hibernate.effective_version` / `version_major` / `version_confidence`.
+- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
+  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
+  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
+  jakarta scorer.
+- **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
+  toward `blocking_count`, readiness, and effort. Test harnesses
+  (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,
+  `src/test/`) and autogenerated sources are tagged `code_context` and surfaced in
+  `non_blocking{}`. Best-practice hygiene (`java.util.Date`) is reported as
+  `hygiene_findings` and never sinks a dimension. Each finding carries
+  `code_context: main | test | generated`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+
+# product blockers only (excludes test/fixtures + hygiene)
+sourcecode migrate-check . --format json | jq '.blocking_count, .non_blocking, .hygiene_findings'
 ```
 
 ### `rename-class` — Java class rename

{sourcecode-1.63.0 → sourcecode-1.65.0}/README.md

@@ -339,6 +339,8 @@ Extracts all Spring MVC (`@GetMapping`, `@PostMapping`, `@RequestMapping`, etc.)
 
 **Functional / WebFlux routing (honest limitation).** Routes registered via the functional DSL — `route().GET("/path", handler)` / `RouterFunction` / `CustomEndpoint`, common in reactive Spring apps — are **not** modeled (their real paths depend on `nest()`/group-version prefixes that can't be resolved statically). Rather than emit partial paths that would mislead, the output reports a `functional_routing` block (`files`, `route_registrations`, `modeled: false`) plus a warning. When the annotation surface is empty but functional routes exist, the warning explicitly tells you not to read it as "no endpoints". Annotation-based (MVC/JAX-RS) repos are unaffected.
 
+**Non-Spring REST frameworks (never "no API").** When the Spring-MVC surface is empty but the repo exposes REST another way — Alfresco WebScripts (`*.desc.xml` descriptors + classes extending `AbstractWebScript`/`DeclarativeWebScript`), JAX-RS, or mapped Servlets — `security_model` is reported as `"undetermined"` (never `"unknown"`, which downstream reads as "no security"), a `non_spring_rest_surface` block names the detected frameworks, and a warning states the surface is unmodeled. `total: 0` therefore can never be read as "this application exposes no API".
+
 **Custom security annotations.** Enterprise repos often guard endpoints with a bespoke annotation instead of `@PreAuthorize`/`@Secured`. Drop a `sourcecode.config.json` at the repo root to teach the scanner about it — otherwise those endpoints report `policy: "none_detected"`:
 
 ```json
@@ -371,7 +373,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations (`RestTemplate`, `WebClient`, `@FeignClient`, `LdapTemplate`, `JmsTemplate`, ActiveMQ) with `file:line` evidence and a literal `target` URL/name when present. |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -570,7 +572,7 @@ Detects migration blockers across Java source files, Spring XML config files, an
 | `MIG-002` | high | `javax.servlet` import — Servlet API changed |
 | `MIG-003` | high | `javax.validation` import — Bean Validation changed |
 | `MIG-004` | high | `javax.transaction` import — TX API changed |
-| `MIG-006` | medium | `javax.annotation` import — CDI annotations changed |
+| `MIG-006` | medium¹ | `javax.annotation` import — CDI annotations changed (¹`javax.annotation.Generated` in autogenerated code → **low**, bucketed `generated`; explanation names the actual symbol) |
 | `MIG-007` | medium | `javax.inject` import — DI annotations changed |
 | `MIG-008` | medium | `javax.ws.rs` import — JAX-RS changed |
 | `MIG-009` | medium | `javax.jms` import — JMS API changed |
@@ -625,7 +627,17 @@ A Hibernate major upgrade is **not** a single dependency bump for systems that u
 dynamic persistence. `migrate-check` stratifies Hibernate exposure into four
 independent migration domains — never one aggregated score — and emits **actionable,
 machine-readable rewrite targets** so a migration agent can consume the output
-directly instead of re-parsing the repo. Sub-`schema_version`: `2.0`.
+directly instead of re-parsing the repo. Sub-`schema_version`: `2.1`.
+
+> **Evidence-gated (no false blockers).** Hibernate detection requires real proof —
+> an `org.hibernate:*` build dependency, a parsed `import org.hibernate.*`, or a
+> parsed `import {jakarta,javax}.persistence.*`. Absent all three,
+> `hibernate.detected` is `false` (no `hibernate_rewrite` headline, no phantom
+> effort). Scanning runs on source with comments + string/char literals stripped, so
+> an `org.hibernate.*` substring in Javadoc or a classpath resource path never
+> triggers a verdict; bare-name SPI matches (`implements XInterceptor`) require an
+> `org.hibernate` import in the same file. The proof is recorded under
+> `hibernate.evidence{}` with a `confidence`.
 
 **Four layers** (each on its own risk axis):
 
@@ -666,9 +678,45 @@ Hibernate is an orthogonal rewrite axis, so it does not sink the headline
 `readiness_score`; instead, in a rewrite zone the top-level `headline_blocker` is set
 to `"hibernate_rewrite"` so a reader of the headline score is not misled.
 
+A dimension that does not apply (e.g. Hibernate on a repo with no Hibernate) is
+reported as **N/A** (`score: null`), never as `0`. The top-level
+`applicable_dimensions{}` records which dimensions apply and `readiness_note`
+states that `readiness_score` is a derived aggregate over applicable dimensions
+only — for decisions, read the per-dimension breakdown + `blocking_count`.
+
+#### Reliability guarantees (no version, no verdict)
+
+A migration verdict shown to a decision-maker must never contradict its own
+evidence. `migrate-check` enforces:
+
+- **Version-gated framework axes.** The Hibernate 5→6 axis applies only when the
+  effective Hibernate version (resolved from `pom.xml`/Gradle, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>`) is `< 6`. A resolved
+  Hibernate **6+** repo is reported `migration_applicable: false` (N/A) — no
+  `hibernate_rewrite` headline. An **unresolved** version degrades to a
+  low-confidence hypothesis with no headline blocker. See
+  `hibernate.effective_version` / `version_major` / `version_confidence`.
+- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
+  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
+  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
+  jakarta scorer.
+- **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
+  toward `blocking_count`, readiness, and effort. Test harnesses
+  (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,
+  `src/test/`) and autogenerated sources are tagged `code_context` and surfaced in
+  `non_blocking{}`. Best-practice hygiene (`java.util.Date`) is reported as
+  `hygiene_findings` and never sinks a dimension. Each finding carries
+  `code_context: main | test | generated`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+
+# product blockers only (excludes test/fixtures + hygiene)
+sourcecode migrate-check . --format json | jq '.blocking_count, .non_blocking, .hygiene_findings'
 ```
 
 ### `rename-class` — Java class rename

{sourcecode-1.63.0 → sourcecode-1.65.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.63.0"
+version = "1.65.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.63.0 → sourcecode-1.65.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.63.0"
+__version__ = "1.65.0"