sourcecode 1.72.0__tar.gz → 1.73.0__tar.gz

{sourcecode-1.72.0 → sourcecode-1.73.0}/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## [1.73.0] — 2026-07-01
+
+### Fixed — audit reliability on a large non-Boot Spring monolith (Alfresco Community Repo field test)
+
+A real architecture audit of **alfresco-community-repo** (`fe6dd26c3f`; 6,549
+classes, 24 Maven modules, Spring 7 **without Spring Boot**, iBatis persistence,
+Camel/ActiveMQ messaging, Acegi-derived security, WebScript REST surface)
+surfaced seven defects — each capable of leading an automated consultant to a
+false conclusion. All fixed at root cause with regression coverage and
+re-verified on the live repo.
+
+- **`--compact` did not resolve `language_version` from a Maven property (BUG #1).**
+  Alfresco declares `<maven.compiler.source>${java.version}</...>` chained to
+  `<java.version>21</java.version>`; the Java-stack detector picked the first key
+  and emitted the literal `${java.version}` while `migrate-check` resolved it. A
+  shared `substitute_maven_properties` resolver (in `detectors/parsers.py`) now
+  backs BOTH paths — `--compact` reports `21`.
+- **`explain --output` wrote Markdown to a `.json` file with no warning (BUG #2).**
+  Broke any consumer assuming JSON parity across subcommands. `explain` now infers
+  JSON from a `.json` output extension (an explicit `--format` always wins), and
+  `--help` documents that its default output is human-readable text/Markdown.
+- **`entry_points.bootstrap` false positives on `*Application.java` by name (BUG #3).**
+  Alfresco's XSD/JAXB-generated `Application.java` model classes (no `main()`, no
+  bootstrap annotation, in a WAR) were listed as application entry points. A file
+  now qualifies only with a real `main(String[])` or a bootstrap annotation
+  (`@SpringBootApplication` / WAR `SpringBootServletInitializer` / `@QuarkusMain`
+  / …); the serializer's name-based bootstrap fallback was removed.
+- **"MyBatis" framework declared against the tool's own zero evidence (BUG #4).**
+  A `org.mybatis:mybatis` pom coordinate alone produced a "MyBatis" framework label
+  while the `mybatis` block reported `mapper_interfaces: 0, xml_files: 0` (Alfresco's
+  SQL layer is iBatis-style `*-SqlMap.xml`, surfaced separately). MyBatis is now
+  emitted only with real usage evidence — an `@Mapper` interface or a `*Mapper.xml`.
+- **`export --integrations` missed ActiveMQ/Camel messaging (BUG #5).**
+  JMS detection recognized little beyond a direct `JmsTemplate`, reporting 1
+  integration on a repo with an ActiveMQ connection-factory config and Camel routes.
+  Added `ActiveMQSslConnectionFactory` / pooled / caching connection-factory tokens
+  and an Apache Camel route pass (literal `activemq:`/`jms:` endpoint URIs, plus
+  variable-URI `from()/to()` routes inside a `RouteBuilder` as honest low-confidence
+  `camel-route` messaging records). Alfresco JMS/messaging surface: 1 → 5.
+- **`readiness_score` Hibernate false-positive — regression test (BUG #6).**
+  v1.63.0 once scored this Hibernate-free repo 42/100 with a phantom
+  `hibernate_rewrite` headline (~46 days). Already fixed by v1.72.0; added an
+  explicit regression test (`no Hibernate/JPA imports → hibernate.detected False,
+  headline_blocker never hibernate_rewrite`) so a future detector refactor cannot
+  reintroduce it.
+- **`endpoints` / C4 `api_surface` returned 0 with no explanation (BUG #7).**
+  On an obvious API server (WebScripts: XML descriptor + handler class, not
+  `@RestController`), a bare `total: 0` reads as "no public API". `endpoints` now
+  emits a first-class `zero_result_reason` naming the routing patterns searched and
+  any non-Spring surface detected (Alfresco: 482 WebScript descriptors / 901 handler
+  classes), and the C4 export's `api_surface` carries the same explanation.
+
 ## [1.72.0] — 2026-07-01
 
 ### Fixed — correctness on a large real-world Spring Boot 3 monolith (Broadleaf Commerce CE field test)

{sourcecode-1.72.0 → sourcecode-1.73.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.72.0
+Version: 1.73.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.72.0 → sourcecode-1.73.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.72.0"
+version = "1.73.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.72.0"
+__version__ = "1.73.0"

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/cli.py

@@ -4221,6 +4221,7 @@ def _build_c4_export(
     edges: "list[dict]",
     endpoints: "list[dict]",
     integrations: "dict",
+    endpoint_meta: "Optional[dict]" = None,
 ) -> "dict":
     """Assemble a unified, tool-agnostic C4 architecture export + incremental manifest.
 
@@ -4236,6 +4237,15 @@ def _build_c4_export(
     # consumer counts/classifies modules instead of inferring them from leaf dirs.
     module_graph["module_roots"] = _detect_module_roots(by_directory)
     api_surface = _group_endpoints_by_controller(endpoints)
+    # BUG #7 (Alfresco field test): carry the endpoint extractor's structured
+    # zero-result explanation and non-Spring REST surface into api_surface, so a
+    # C4 consumer seeing 0 controllers understands WHY (unrecognized routing, e.g.
+    # WebScripts) instead of concluding the system has no public API.
+    if endpoint_meta:
+        if endpoint_meta.get("zero_result_reason"):
+            api_surface["zero_result_reason"] = endpoint_meta["zero_result_reason"]
+        if endpoint_meta.get("non_spring_rest_surface"):
+            api_surface["non_spring_rest_surface"] = endpoint_meta["non_spring_rest_surface"]
     containers = _detect_containers(root)
 
     limitations: "list[str]" = []
@@ -4364,7 +4374,8 @@ def export_cmd(
         from sourcecode.repository_ir import extract_java_endpoints
         ir = build_repo_ir(file_list, root)
         graph = ir.get("graph", {})
-        endpoints = extract_java_endpoints(root).get("endpoints", [])
+        _ep_data = extract_java_endpoints(root)
+        endpoints = _ep_data.get("endpoints", [])
         data = _build_c4_export(
             root,
             file_list,
@@ -4372,6 +4383,7 @@ def export_cmd(
             graph.get("edges", []),
             endpoints,
             detect_integrations(file_list, root),
+            endpoint_meta=_ep_data,
         )
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
@@ -5215,14 +5227,16 @@ def explain_cmd(
         Path("."),
         help="Repository root (default: current directory)",
     ),
-    format: str = typer.Option(
-        "text", "--format", "-f",
-        help="Output format: text (default) or json.",
-        show_default=True,
+    format: Optional[str] = typer.Option(
+        None, "--format", "-f",
+        help="Output format: text (default) or json. If unset and --output ends "
+             "in .json, JSON is written automatically.",
     ),
     output_path: Optional[Path] = typer.Option(
         None, "--output", "-o",
-        help="Write output to a file instead of stdout.",
+        help="Write output to a file instead of stdout. NOTE: the default format is "
+             "human-readable text/Markdown, NOT JSON — pass --format json (or use a "
+             ".json output path) for machine-readable output.",
     ),
     copy: bool = typer.Option(
         False, "--copy", "-c",
@@ -5231,6 +5245,11 @@ def explain_cmd(
 ) -> None:
     """Human-readable architectural summary for a class.
 
+    \b
+    OUTPUT FORMAT: defaults to text/Markdown (human-oriented). Unlike most
+    subcommands this is NOT JSON by default — pass --format json, or give an
+    --output path ending in .json, for a machine-readable envelope.
+
     \b
     Generates a structured explanation derived entirely from static analysis:
       - Purpose and Spring stereotype
@@ -5278,6 +5297,15 @@ def explain_cmd(
         )
         raise typer.Exit(code=1)
 
+    # BUG #2 (Alfresco field test): `explain -o out.json` previously wrote Markdown
+    # to a .json file, breaking any programmatic consumer that assumed JSON parity
+    # with the other subcommands. Infer JSON from a .json output extension when
+    # --format is unset; an explicit --format always wins.
+    if format is None:
+        if output_path and str(output_path).lower().endswith(".json"):
+            format = "json"
+        else:
+            format = "text"
     _enforce_format("explain", format)
 
     file_list = find_java_files(target)

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/detectors/java.py

@@ -10,7 +10,11 @@ from sourcecode.detectors.base import (
     EntryPoint,
     StackDetection,
 )
-from sourcecode.detectors.parsers import read_text_lines, unique_strings
+from sourcecode.detectors.parsers import (
+    read_text_lines,
+    substitute_maven_properties as _resolve_maven_property,
+    unique_strings,
+)
 from sourcecode.schema import FrameworkDetection
 from sourcecode.tree_utils import flatten_file_tree
 
@@ -55,6 +59,14 @@ _JAX_RS_PROVIDER_RE = re.compile(r'@Provider\b')
 
 # --- CDI / Jakarta EE scopes ---
 _CDI_SCOPED_RE = re.compile(r'@(?:ApplicationScoped|RequestScoped|SessionScoped|Singleton|Dependent)\b')
+# BUG #3: a genuine bootstrap entry declares a real main() or a bootstrap annotation
+# / WAR initializer supertype — never merely a `*Application.java` filename.
+_MAIN_METHOD_RE = re.compile(r'\bstatic\b[^;{}()]*\bmain\s*\(\s*(?:final\s+)?String')
+_BOOTSTRAP_ANNOTATION_RE = re.compile(
+    r'@(?:SpringBootApplication|QuarkusMain|MicronautApplication|'
+    r'EnableAutoConfiguration|SpringBootConfiguration)\b'
+    r'|\bextends\s+SpringBootServletInitializer\b'
+)
 
 # --- Keycloak / Quarkus SPI ---
 # Matches "implements EventListenerProvider" or "implements Foo, EventListenerProvider, Bar"
@@ -151,6 +163,18 @@ class JavaDetector(AbstractDetector):
         # Spring profiles — check src/main/options/, src/main/resources/
         spring_profiles = self._detect_spring_profiles(context.root, all_paths)
 
+        # BUG #4 (Alfresco field test): a `org.mybatis` coordinate in the pom is not
+        # proof the app USES MyBatis mappers. Alfresco declares org.mybatis:mybatis
+        # yet has zero @Mapper interfaces and zero *Mapper.xml — its SQL layer is
+        # iBatis-style *-SqlMap.xml (surfaced separately). Emitting "MyBatis" as an
+        # architecture framework then contradicted the tool's own evidence block
+        # (mapper_interfaces:0, xml_files:0) and mislabeled bean DTO mappers. Keep
+        # the label only with real usage evidence: a *Mapper.xml or an @Mapper interface.
+        if any(f.name == "MyBatis" for f in frameworks) and not self._has_mybatis_usage(
+            context.root, all_paths
+        ):
+            frameworks = [f for f in frameworks if f.name != "MyBatis"]
+
         entry_points = self._collect_entry_points(context)
         transactional_classes = self._collect_transactional_classes(context, all_paths)
         stack = StackDetection(
@@ -211,6 +235,17 @@ class JavaDetector(AbstractDetector):
                                 break
                     break
 
+        # BUG #1 (Alfresco field test): a picked value can be a Maven property
+        # reference — Alfresco's <maven.compiler.source>${java.version}</...> chains
+        # to <java.version>21</java.version> in the SAME <properties> block. Resolve
+        # ${...} references against the pom's own properties so --compact reports the
+        # concrete version ("21") instead of the literal "${java.version}", matching
+        # what migrate-check already surfaces. Bounded iteration guards ref cycles.
+        if "language_version" in result:
+            result["language_version"] = _resolve_maven_property(
+                result["language_version"], props
+            )
+
         return result
 
     def _detect_spring_profiles(self, root: Path, all_paths: list[str]) -> list[str]:
@@ -425,15 +460,25 @@ class JavaDetector(AbstractDetector):
         # Exclude test trees: test helpers like AdminApplication.java in
         # integration/src/test/java/ must not be treated as production entrypoints.
         from sourcecode.path_filters import is_test_path as _is_test_path
+        # BUG #3 (Alfresco field test): a `*Application.java` / `*Main.java` NAME does
+        # not make a file a bootstrap entry point. Alfresco has XSD-generated JAXB
+        # `Application.java` model classes (no main(), no bootstrap annotation) in a
+        # WAR with no own entry point — flagging them as `application` polluted the
+        # executive summary. Emit `kind="application"` ONLY when the file actually
+        # declares a `main(String[])` method or a bootstrap annotation.
         app_candidates = [
-            p for p in all_java
-            if p.endswith(("Application.java", "Main.java"))
-            and not _is_test_path(p)
-        ]
-        entry_points: list[EntryPoint] = [
-            EntryPoint(path=p, stack="java", kind="application", source="manifest")
-            for p in unique_strings(app_candidates)
+            p for p in unique_strings([
+                q for q in all_java
+                if q.endswith(("Application.java", "Main.java")) and not _is_test_path(q)
+            ])
         ]
+        entry_points: list[EntryPoint] = []
+        for p in app_candidates:
+            verified = self._verify_bootstrap_entry(context.root / p)
+            if verified:
+                entry_points.append(EntryPoint(
+                    path=p, stack="java", kind="application", source=verified,
+                ))
 
         # 2. Annotation-based scan: @RestController, @WebFilter, FilterRegistrationBean
         # Prioritize Controller-named files so all REST controllers are detected
@@ -481,6 +526,52 @@ class JavaDetector(AbstractDetector):
                 unique_eps.append(ep)
         return unique_eps
 
+    def _has_mybatis_usage(self, root: Path, all_paths: list[str]) -> bool:
+        """True when the repo shows real MyBatis usage, not just a pom coordinate.
+
+        Evidence = a *Mapper.xml file OR a *Mapper.java carrying the MyBatis
+        @Mapper annotation. iBatis-style *-SqlMap.xml is deliberately NOT counted
+        here — it is a distinct legacy pattern surfaced elsewhere (BUG #4).
+        """
+        if any(p.endswith("Mapper.xml") for p in all_paths):
+            return True
+        from sourcecode.path_filters import is_test_path as _is_test_path
+        mapper_java = [
+            p for p in all_paths
+            if p.endswith("Mapper.java") and not _is_test_path(p)
+        ]
+        for rel in mapper_java[:_MAX_JAVA_ENTRY_SCAN]:
+            try:
+                abs_path = root / rel
+                if abs_path.stat().st_size > _MAX_FILE_SIZE:
+                    continue
+                content = abs_path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if "org.apache.ibatis.annotations.Mapper" in content or "@Mapper" in content:
+                return True
+        return False
+
+    def _verify_bootstrap_entry(self, abs_path: Path) -> "str | None":
+        """Return the evidence source when *abs_path* is a real bootstrap entry.
+
+        A file is a genuine application entry point only if it declares a
+        `main(String[])` method OR carries a recognized bootstrap annotation /
+        WAR initializer supertype. Returns "main_method" / "bootstrap_annotation"
+        accordingly, else None (name alone is never sufficient — see BUG #3).
+        """
+        try:
+            if abs_path.stat().st_size > _MAX_FILE_SIZE:
+                return None
+            content = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            return None
+        if _BOOTSTRAP_ANNOTATION_RE.search(content):
+            return "bootstrap_annotation"
+        if _MAIN_METHOD_RE.search(content):
+            return "main_method"
+        return None
+
     def _augment_deep_java_controllers(self, context: DetectionContext, all_java: list[str]) -> None:
         """Scan standard Java source roots for *Controller*.java files not in all_java.
 

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/detectors/parsers.py

@@ -1,10 +1,33 @@
 from __future__ import annotations
 
 import json
+import re
 from collections.abc import Iterable
 from pathlib import Path
 from typing import Any, Optional
 
+_MAVEN_PROP_REF_RE = re.compile(r'\$\{([\w.\-]+)\}')
+
+
+def substitute_maven_properties(text: str, props: "dict[str, str]") -> str:
+    """Resolve Maven ${prop} references in *text* against *props*.
+
+    Shared single source of truth for Maven property resolution across
+    subcommands (BUG #1, Alfresco field test): both the --compact Java-stack
+    detector and migrate-check must resolve `${java.version}` → `21` identically.
+    Multi-level references (${a} where a=${b}) resolve in up to 3 passes; a
+    reference with no matching property is left verbatim (honest, not blanked).
+    """
+    if not props or "${" not in text:
+        return text
+    resolved = text
+    for _ in range(3):
+        new = _MAVEN_PROP_REF_RE.sub(lambda m: props.get(m.group(1), m.group(0)), resolved)
+        if new == resolved:
+            break
+        resolved = new
+    return resolved
+
 
 def load_json_file(path: Path) -> Optional[dict[str, Any]]:
     """Carga un fichero JSON sin lanzar si el contenido es invalido."""

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/integration_detector.py

@@ -101,12 +101,33 @@ _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
     # JMS / messaging
     ("JmsTemplate", "jms", "jmstemplate"),
     ("ActiveMQConnectionFactory", "jms", "activemq"),
+    # BUG #5 (Alfresco field test): the connection-factory family beyond the plain
+    # ActiveMQConnectionFactory — Alfresco wires ActiveMQSslConnectionFactory and
+    # pooled/caching factories as Spring @Beans, none of which were recognized.
+    ("ActiveMQSslConnectionFactory", "jms", "activemq"),
+    ("PooledConnectionFactory", "jms", "activemq-pooled"),
+    ("CachingConnectionFactory", "jms", "spring-jms"),
 )
 _TOKEN_RES = tuple(
     (re.compile(r"\b" + re.escape(tok) + r"\b"), kind, client)
     for tok, kind, client in _TOKEN_CLIENTS
 )
 
+# BUG #5: Apache Camel route detection. Only applied inside a confirmed Camel file.
+_CAMEL_CONTEXT_RE = re.compile(r"org\.apache\.camel\b|\bextends\s+RouteBuilder\b")
+# A from()/to() endpoint with a literal scheme URI, e.g. from("activemq:queue:foo").
+_CAMEL_URI_RE = re.compile(r'\b(from|to)\s*\(\s*"([a-z][a-z0-9+.\-]*):([^"]*)"')
+# A route anchored by from(<non-string>) — endpoint URI comes from a variable/property.
+_CAMEL_VAR_ROUTE_RE = re.compile(r'\bfrom\s*\(\s*[A-Za-z_]')
+# Camel URI scheme → integration kind (jms-family messaging schemes collapse to "jms").
+_CAMEL_SCHEME_KIND: "dict[str, str]" = {
+    "activemq": "jms", "amq": "jms", "jms": "jms", "sjms": "jms", "sjms2": "jms",
+    "amqp": "jms", "stomp": "jms",
+    "kafka": "kafka", "mqtt": "mqtt", "paho": "mqtt",
+    "http": "http", "https": "http", "http4": "http", "rest": "http",
+    "smtp": "smtp", "smtps": "smtp",
+}
+
 
 def _line_of(text: str, idx: int) -> int:
     """1-based line number of character offset ``idx`` in ``text``."""
@@ -323,6 +344,28 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                         _add(kind, client, url.group(1), rel, lineno)
                         break
 
+        # BUG #5 (Alfresco field test): Apache Camel routes are messaging/integration
+        # endpoints declared as a fluent DSL (from(...)/to(...)) inside a RouteBuilder,
+        # NOT as JmsTemplate/connection-factory constructs — so they were invisible.
+        # Only trust from()/to() inside a confirmed Camel file (import org.apache.camel
+        # or `extends RouteBuilder`) to avoid matching unrelated fluent `.to(...)`.
+        if _CAMEL_CONTEXT_RE.search(text):
+            for m in _CAMEL_URI_RE.finditer(text):
+                scheme = m.group(2).lower()
+                uri = f"{scheme}:{m.group(3)}"
+                kind = _CAMEL_SCHEME_KIND.get(scheme, "messaging")
+                _add(kind, f"camel-{scheme}", uri, rel, _line_of(text, m.start()))
+            # Routes whose endpoint URI is a variable/property (Alfresco's
+            # from(sourceQueue).to(targetTopic)) cannot yield a literal target, but the
+            # route IS a real messaging integration point — record it honestly with a
+            # null target and low confidence rather than dropping it.
+            if not any(r["client"].startswith("camel-") and r["evidence"].startswith(f"{rel}:")
+                       for r in records):
+                vm = _CAMEL_VAR_ROUTE_RE.search(text)
+                if vm:
+                    _add("messaging", "camel-route", None, rel,
+                         _line_of(text, vm.start()), confidence="low")
+
     records.sort(key=lambda r: (r["kind"], r["client"], r["evidence"]))
 
     by_kind: "dict[str, int]" = {}

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/migrate_check.py

@@ -1168,18 +1168,10 @@ def _resolve_maven_properties(text: str) -> str:
     props: dict[str, str] = {}
     for m in re.finditer(r'<([A-Za-z][\w.\-]*)>\s*([^<${}]+?)\s*</\1>', text):
         props[m.group(1)] = m.group(2).strip()
-    if not props:
-        return text
-
-    resolved = text
-    for _ in range(3):
-        def _sub(m: re.Match) -> str:  # noqa: E306
-            return props.get(m.group(1), m.group(0))
-        resolved_new = re.sub(r'\$\{([\w.\-]+)\}', _sub, resolved)
-        if resolved_new == resolved:
-            break
-        resolved = resolved_new
-    return resolved
+    # Shared ${...} substitution core (BUG #1): identical resolution semantics as
+    # the --compact Java-stack detector.
+    from sourcecode.detectors.parsers import substitute_maven_properties
+    return substitute_maven_properties(text, props)
 
 
 def _scan_dep_file(text: str, rel_path: str) -> list["MigrationFinding"]:

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/repository_ir.py

@@ -4735,6 +4735,41 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
                 f"endpoints only."
             )
         result.setdefault("warnings", []).append(_msg)
+
+    # BUG #7 (Alfresco field test): a bare "total: 0" must never be read by an
+    # automated consumer as "this service exposes no public API". Emit a first-class
+    # structured `zero_result_reason` (mirroring integrations.coverage_note /
+    # security_model_detail.reason) naming the routing patterns that WERE searched and
+    # any non-Spring surface detected, so a 0 is understood as "no RECOGNIZED pattern",
+    # not "no surface". Only when the Spring/annotation surface is genuinely empty.
+    if not endpoints:
+        _searched = (
+            "@RestController/@Controller + @RequestMapping/@GetMapping/@PostMapping/"
+            "@PutMapping/@DeleteMapping/@PatchMapping, JAX-RS @Path, functional "
+            "RouterFunction routing, and OpenAPI-spec-recovered routes"
+        )
+        if _nonspring_total:
+            _fw_names = {
+                "webscripts": "Alfresco WebScripts (XML descriptor + handler class)",
+                "jax_rs": "JAX-RS",
+                "servlets": "mapped Servlets",
+            }
+            _detected = ", ".join(
+                _fw_names.get(k, k) for k, v in _nonspring.items() if v
+            )
+            result["zero_result_reason"] = (
+                f"0 endpoints recognized. Searched: {_searched}. A NON-Spring REST "
+                f"surface WAS detected ({_detected}) but is not statically modeled — "
+                f"do NOT read this as 'no public API'. Inspect that framework's routing "
+                f"(e.g. *.desc.xml descriptors for WebScripts) to enumerate the surface."
+            )
+        else:
+            result["zero_result_reason"] = (
+                f"0 endpoints recognized. Searched: {_searched}. No recognized routing "
+                f"construct was found; a framework this analyzer does not model may "
+                f"still expose an HTTP surface — verify manually before concluding the "
+                f"service has no public API."
+            )
     return result
 
 

{sourcecode-1.72.0 → sourcecode-1.73.0}/src/sourcecode/serializer.py

@@ -702,7 +702,12 @@ def _bootstrap_structured(eps: list) -> "Optional[dict[str, Any]]":
         kind = getattr(ep, "kind", "")
         stem = _Path(path).stem
 
-        if kind == "application" or any(k in stem for k in ("Application", "Main", "Initializer", "Bootstrap")):
+        # BUG #3 (Alfresco field test): bootstrap membership is driven by the
+        # VERIFIED entry kind ("application" is emitted only when the detector
+        # confirmed a main()/bootstrap annotation), never by a `*Application*`
+        # filename alone — XSD-generated Application.java model classes must not
+        # appear here.
+        if kind == "application":
             if path not in seen_b:
                 seen_b.add(path)
                 bootstrap.append(path)