sourcecode 2.0.0__py3-none-any.whl → 2.1.0__py3-none-any.whl

sourcecode/summarizer.py

@@ -259,7 +259,15 @@ class ProjectSummarizer:
                     paragraphs.append(" ".join(current_lines).strip())
                     current_lines = []
                 continue
-            if _BADGE_RE.match(line) or _LINK_ONLY_RE.match(line):
+            # Treat HTML-markup-only lines (<img .../>, <p align=...>, <a><img></a>)
+            # as paragraph breaks, like badges/links — otherwise a README whose first
+            # block is a centered logo leaks raw markup into the project summary.
+            _html_stripped = _re.sub(r"<[^>]+>", "", line).strip()
+            if (
+                _BADGE_RE.match(line)
+                or _LINK_ONLY_RE.match(line)
+                or ("<" in line and ">" in line and not _html_stripped)
+            ):
                 if current_lines:
                     paragraphs.append(" ".join(current_lines).strip())
                     current_lines = []
@@ -290,9 +298,32 @@ class ProjectSummarizer:
             _link_count = len(_MD_LINK_RE.findall(paragraph))
             if _link_count > 2 and _link_count * 30 > len(paragraph):
                 continue
-            return paragraph
+            # Render to clean prose: unwrap inline markdown links, drop images,
+            # strip residual inline HTML tags and emphasis markers. A paragraph that
+            # collapses below the usefulness floor after cleaning is skipped.
+            cleaned = self._clean_inline_markup(paragraph)
+            if len(cleaned) < 30:
+                continue
+            return cleaned
         return None
 
+    @staticmethod
+    def _clean_inline_markup(text: str) -> str:
+        """Reduce README markdown/HTML to plain prose (presentation-only).
+
+        Removes inline images, unwraps `[label](url)` to `label`, strips residual
+        inline HTML tags and bold/italic/code markers, and collapses whitespace.
+        Does not touch underscores (they occur inside identifiers)."""
+        import re as _re
+        text = _re.sub(r"!\[[^\]]*\]\([^)]*\)", "", text)      # ![alt](url) images
+        text = _re.sub(r"\[([^\]]+)\]\([^)]*\)", r"\1", text)  # [label](url) -> label
+        text = _re.sub(r"<[^>]+>", "", text)                    # residual inline HTML
+        text = _re.sub(r"\*\*(.+?)\*\*", r"\1", text)           # **bold** -> bold
+        text = _re.sub(r"\*(.+?)\*", r"\1", text)               # *italic* -> italic
+        text = text.replace("`", "")                            # `code` -> code
+        text = _re.sub(r"\s+", " ", text).strip()
+        return text
+
     _TYPE_LABELS: dict[str, str] = {
         "cli": "CLI",
         "api": "API",

sourcecode/validation_inference.py

@@ -0,0 +1,249 @@
+"""validation_inference.py — Knowledge-Layer validation-pattern inference (P1-C).
+
+Answers the field-audit failure "the report goes quiet or says 0 validated" by
+classifying a repo's request-body validation *pattern* instead of counting zeros
+(DESIGN-robustness-security-inference.md §2 / §5). The true finding on the field
+repo was **909 `@RequestBody` and 0 `@Valid`** — "a bean-validation framework is
+on the classpath but unused", not "nothing to report".
+
+This is the Knowledge Layer: it reads facts that already exist — endpoint verbs,
+`@Valid`/`@Validated` markers captured on handler nodes, and
+`jakarta/javax.validation` import edges — and emits an Evidence-Confidence
+`Verdict` per the shared §0 envelope. It adds no IR atom.
+
+VAI note (§0.5): the only names this module keys on are **published open
+standards** (`jakarta.validation`, `javax.validation`, the bean-validation
+annotation vocabulary). No client / convention name enters a predicate.
+
+ARCHITECTURAL DIVERGENCE — manual_validation (design §2, deferred)
+-----------------------------------------------------------------
+Design §2 also asks for a `manual_validation` class detected by the **β
+GuardClause** shape on handler bodies (a guard that throws on a bad parameter).
+That path assumes guard atoms cover handlers. They do NOT: `_extract_guard_facts`
+(repository_ir.py) scans only `symbol_kind in {"method", "constructor"}`, and a
+mapped handler surfaces as kind `"endpoint"` — so `guard_facts` is empty for
+every handler body. Design §8 classifies §2 as *Incremental / no new primitive*;
+against the current architecture that is false. Rather than smuggle in an IR
+change under an "Incremental" increment, `manual_validation` is deferred and the
+conflict is documented in the design doc (EPV / INV-2: build the endpoint-scoped
+guard capability only when this consumer is ratified). The three classes that ARE
+reuse-only (active / available-unused / none) ship here and already resolve the
+field defect.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+from sourcecode.security_posture import (
+    Confidence,
+    Evidence,
+    Verdict,
+    _annotation_simple,
+    _graph_nodes,
+)
+
+if TYPE_CHECKING:
+    from sourcecode.canonical_ir import CanonicalRepositoryIR
+
+
+# Published bean-validation import namespaces — DATA, subtract/match only (§0.5).
+_VALIDATION_NAMESPACES: tuple[str, ...] = (
+    "jakarta.validation", "javax.validation",
+)
+
+# Published bean-validation constraint / marker simple-names (open standard).
+_BEAN_VALIDATION_VOCAB: frozenset[str] = frozenset({
+    "Valid", "Validated", "NotNull", "NotEmpty", "NotBlank", "Null", "AssertTrue",
+    "AssertFalse", "Min", "Max", "DecimalMin", "DecimalMax", "Digits", "Positive",
+    "PositiveOrZero", "Negative", "NegativeOrZero", "Size", "Pattern", "Email",
+    "Past", "PastOrPresent", "Future", "FutureOrPresent",
+})
+_VALIDATE_MARKERS: frozenset[str] = frozenset({"Valid", "Validated"})
+
+# Body-carrying HTTP verbs — the surface where request-body validation applies.
+_BODY_VERBS: frozenset[str] = frozenset({"POST", "PUT", "PATCH"})
+
+
+def _validation_available(cir: "CanonicalRepositoryIR") -> tuple[bool, list[str]]:
+    """True when a published bean-validation framework is on the classpath,
+    proven structurally by an import edge into a validation namespace (or, as a
+    fallback, any bean-validation annotation present anywhere). Returns
+    (available, evidence_imports)."""
+    imports_seen: list[str] = []
+    for edge in getattr(cir, "dependencies", None) or []:
+        if not isinstance(edge, dict) or edge.get("type") != "imports":
+            continue
+        target = str(edge.get("to") or "")
+        if any(target.startswith(ns + ".") or target == ns for ns in _VALIDATION_NAMESPACES):
+            imports_seen.append(target)
+    if imports_seen:
+        return True, sorted(set(imports_seen))
+
+    # Fallback: a bean-validation annotation used anywhere also proves the
+    # framework is on the classpath (even without a visible import edge).
+    for node in _graph_nodes(cir):
+        if not isinstance(node, dict):
+            continue
+        for tok in node.get("annotations") or []:
+            if _annotation_simple(str(tok)) in _BEAN_VALIDATION_VOCAB:
+                return True, []
+    return False, []
+
+
+def _validated_handler_symbols(cir: "CanonicalRepositoryIR") -> set[str]:
+    """handler_symbols whose node carries a captured `_validated_params` value
+    naming a @Valid/@Validated parameter (reuses the existing Phase-3.2 capture)."""
+    out: set[str] = set()
+    for node in _graph_nodes(cir):
+        if not isinstance(node, dict):
+            continue
+        av = node.get("annotation_values") or {}
+        params = av.get("_validated_params", "") if isinstance(av, dict) else ""
+        if not params:
+            continue
+        # the capture only fires when a marker is present, but re-check by shape
+        if "@Valid" in params or "@Validated" in params:
+            out.add(node.get("fqn") or "")
+    out.discard("")
+    return out
+
+
+@dataclass
+class ValidationInferenceResult:
+    """Repo + per-endpoint request-body validation-pattern projection (P1-C)."""
+
+    pattern: str                                    # repo-level class (see classify)
+    verdict: Verdict
+    endpoint_findings: list[dict] = field(default_factory=list)
+    rollup: dict = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        return {
+            "provenance": "validation_inference projection (P1-C)",
+            "pattern": self.pattern,
+            "verdict": self.verdict.to_dict(),
+            "endpoints": self.endpoint_findings,
+            "rollup": self.rollup,
+        }
+
+
+def infer_validation_pattern(cir: "CanonicalRepositoryIR") -> ValidationInferenceResult:
+    """Classify the repo's request-body validation pattern (P1-C).
+
+    Repo-level class (DESIGN §2):
+      - ``bean_validation_active``            — @Valid present on body handlers.
+      - ``bean_validation_available_unused``  — validation on the classpath and
+        body endpoints exist, but no handler validates → risk (Likely).
+      - ``no_validation_detected``            — none of the above (Unknown).
+        (``manual_validation`` deferred — see module docstring.)
+
+    Never raises.
+    """
+    available, import_evidence = _validation_available(cir)
+    validated_handlers = _validated_handler_symbols(cir)
+
+    body_eps = [ep for ep in cir.endpoints if str(ep.method).upper() in _BODY_VERBS]
+    body_total = len(body_eps)
+    validated_body = sum(1 for ep in body_eps if ep.handler_symbol in validated_handlers)
+    unvalidated_body = body_total - validated_body
+
+    # per-endpoint findings (only the body surface — where a request body applies)
+    endpoint_findings: list[dict] = []
+    rollup = {"validated": 0, "available_unused": 0, "unvalidated_unknown": 0}
+    for ep in body_eps:
+        if ep.handler_symbol in validated_handlers:
+            klass, conf = "validated", Confidence.VERIFIED
+        elif available:
+            # @RequestBody-shaped verb, framework available, no @Valid → gap
+            klass, conf = "available_unused", Confidence.LIKELY
+        else:
+            klass, conf = "unvalidated_unknown", Confidence.UNKNOWN
+        rollup[klass] += 1
+        endpoint_findings.append({
+            "endpoint_id": ep.id,
+            "method": ep.method,
+            "path": ep.path,
+            "handler_symbol": ep.handler_symbol,
+            "finding": klass,
+            "confidence": conf.value,
+        })
+
+    # repo-level classification + envelope
+    common_limitation = (
+        "Body surface is approximated by body-carrying verbs (POST/PUT/PATCH); "
+        "the exact @RequestBody parameter count is not captured (no IR atom "
+        "exposes it), so 'available_unused' may include body-less handlers."
+    )
+    manual_fn = (
+        "manual_validation (a handler that throws on a bad parameter) is not "
+        "detected — guard-clause atoms do not cover endpoint-kind handlers "
+        "(architectural defer, see module docstring); such a repo classifies "
+        "no_validation_detected here."
+    )
+
+    if validated_body > 0:
+        pattern = "bean_validation_active"
+        verdict = Verdict(
+            claim="Bean validation active on request bodies",
+            confidence=Confidence.VERIFIED,
+            evidence=Evidence(
+                atoms_used=[f"@Valid handler: {h}" for h in sorted(validated_handlers)][:50],
+                details={
+                    "validated_body_endpoints": validated_body,
+                    "body_endpoints": body_total,
+                    "unvalidated_body_endpoints": unvalidated_body,
+                    "validation_available": available,
+                },
+            ),
+            limitations=[common_limitation],
+            fn_causes=[manual_fn],
+        )
+    elif available and body_total > 0:
+        pattern = "bean_validation_available_unused"
+        verdict = Verdict(
+            claim="Validation framework present but unused on request bodies",
+            confidence=Confidence.LIKELY,
+            evidence=Evidence(
+                relations_used=[f"imports {i}" for i in import_evidence][:20],
+                details={
+                    "body_endpoints": body_total,
+                    "validated_body_endpoints": 0,
+                    "validation_available": True,
+                    "validation_imports": import_evidence[:20],
+                },
+            ),
+            limitations=[
+                common_limitation,
+                "Validation could live in a shared interceptor / filter this "
+                "projection does not traverse.",
+            ],
+            fp_causes=[
+                "A body endpoint may be intentionally unvalidated (idempotent "
+                "echo, internal-only), or validated manually.",
+            ],
+            fn_causes=[manual_fn],
+        )
+    else:
+        pattern = "no_validation_detected"
+        verdict = Verdict(
+            claim="No request-body validation pattern detected",
+            confidence=Confidence.UNKNOWN,
+            evidence=Evidence(details={
+                "body_endpoints": body_total,
+                "validation_available": available,
+            }),
+            limitations=[
+                "Absence of evidence is not evidence of absence — no @Valid, no "
+                "validation import, and no body endpoints, or validation is done "
+                "by a mechanism this projection does not model.",
+            ],
+            fn_causes=[manual_fn],
+        )
+
+    return ValidationInferenceResult(
+        pattern=pattern,
+        verdict=verdict,
+        endpoint_findings=endpoint_findings,
+        rollup=rollup,
+    )

sourcecode-2.1.0.dist-info/METADATA

@@ -0,0 +1,241 @@
+Metadata-Version: 2.4
+Name: sourcecode
+Version: 2.1.0
+Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
+License-File: LICENSE
+Keywords: agents,ai,codebase,context,developer-tools,llm
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Requires-Dist: defusedxml>=0.7
+Requires-Dist: mcp>=1.0.0
+Requires-Dist: pathspec>=1.0
+Requires-Dist: ruamel-yaml>=0.18
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Requires-Dist: typer>=0.24
+Provides-Extra: ast
+Requires-Dist: tree-sitter-javascript>=0.21; extra == 'ast'
+Requires-Dist: tree-sitter-typescript>=0.21; extra == 'ast'
+Requires-Dist: tree-sitter>=0.21; extra == 'ast'
+Provides-Extra: dev
+Requires-Dist: mcp>=1.0.0; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.15; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# ASK Engine
+
+> **Persistent structural intelligence for AI coding agents.**
+
+**Context · Impact · Migration · Architecture · Review — everything from one structural model.**
+
+![Version](https://img.shields.io/badge/version-2.1.0-blue)
+![Python](https://img.shields.io/badge/python-3.9%2B-green)
+
+> **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
+> command still works as a deprecated alias (it prints a one-line notice and forwards to
+> `ask`) and remains the Python/PyPI package name for now. The authoritative version is
+> whatever `ask version` reports. See [docs/PRODUCT_IDENTITY.md](docs/PRODUCT_IDENTITY.md).
+
+---
+
+## The problem
+
+Every time an AI coding agent starts a new session, it has to re-parse the repository from scratch. For a large Java or TypeScript monolith, that means 5–15 seconds per invocation. Multiply by dozens of agent turns per hour, and repo context acquisition becomes a real bottleneck — not just latency, but tokens, compute, and iteration velocity.
+
+ASK Engine solves this with a persistent structural cache keyed on file content hashes. After the first scan, every subsequent invocation returns pre-built context in milliseconds. The repo doesn't change? The cache doesn't expire.
+
+**The cache is not a performance optimization. It is what makes ASK Engine usable as infrastructure rather than a one-off tool.**
+
+---
+
+## Proof — measured on real repos
+
+| Repo | Size | Cold scan | Cache hit | Speedup |
+|------|------|-----------|-----------|---------|
+| Keycloak | 7,885 Java files | 10.5s | 0.6s | **~17x** |
+| BroadleafCommerce | 2,985 Java files | 2.7s | 0.3s | **~9x** |
+
+Cache keyed on content hashes — invalidated only when source changes. On repeated agent sessions against the same codebase, nearly every invocation is a cache hit.
+
+At 0.3s per call, ASK Engine becomes **constant infrastructure** inside agent loops — call it before every edit, every PR review, every test run, without batching or caching manually.
+
+---
+
+## Install
+
+```bash
+# Homebrew (macOS / Linux)
+brew tap haroundominique/sourcecode && brew install sourcecode
+
+# pip / pipx
+pipx install sourcecode        # or: pip install sourcecode
+
+ask version                    # ask 2.1.0
+```
+
+> **Package vs. command.** The install package is named `sourcecode` this release
+> (renaming the distribution is a separate, breaking change). Installing it gives you the
+> canonical **`ask`** command plus the deprecated **`sourcecode`** alias.
+
+---
+
+## Quickstart
+
+```bash
+# High-signal structural summary — warm cache ~0.3s, cold 2–10s
+ask --compact
+
+# Blast radius: what breaks if this class changes?
+ask impact OrderService /path/to/repo
+
+# Spring Boot 2→3 migration readiness (bounded decision summary)
+ask migrate-check /path/to/repo --compact
+
+# Spring semantic audit: TX anomalies + security surface
+ask spring-audit /path/to/repo
+
+# Onboard to an unfamiliar codebase
+ask onboard /path/to/repo
+
+# PR review: risk, test gaps, changed modules
+ask review-pr /path/to/repo --since main
+```
+
+Full command reference: **[docs/USER_GUIDE.md](docs/USER_GUIDE.md)**.
+
+---
+
+## Capabilities
+
+Everything is computed from one cached structural model. Seven groups:
+
+### 1 · Structural Context
+Bounded, noise-free repo context designed to drop straight into an agent's context window.
+`ask --compact` · `ask --agent` · `ask onboard` · `ask cold-start`
+→ [reference](docs/USER_GUIDE.md#core-commands)
+
+### 2 · Impact Analysis
+Blast radius from a class or interface — reverse dependencies, through Spring DI, to the HTTP endpoints a change reaches.
+`ask impact` · `ask impact-chain` (TX/SEC-enriched) · `ask pr-impact`
+→ [reference](docs/USER_GUIDE.md#core-commands)
+
+### 3 · Architecture Intelligence
+The system map: module graph, dependency views, REST surface, per-class summaries, and a symbol-level IR for downstream tooling.
+`ask export` · `ask repo-ir` · `ask endpoints` · `ask explain`
+→ [reference](docs/USER_GUIDE.md#core-commands)
+
+### 4 · Migration & Modernization
+Is this codebase ready to upgrade? Per-dimension readiness (Jakarta / Spring Boot / JDK / Hibernate), located blockers, and an effort estimate.
+`ask migrate-check` · `ask modernize`
+→ [migrate-check reference](docs/migrate-check.md) · [MODERNIZATION.md](docs/MODERNIZATION.md)
+
+### 5 · Spring Analysis
+Deterministic Spring semantics: transactional anomalies (e.g. `@Transactional` on a private method = silent CGLIB no-op), security surface, request-body validation.
+`ask spring-audit` · `ask validation`
+→ [reference](docs/USER_GUIDE.md#core-commands)
+
+### 6 · Developer Workflows
+The everyday loop: diff-based PR review, symptom-driven bug triage, and delta context for continuous agent runs.
+`ask review-pr` · `ask fix-bug` · `ask prepare-context`
+→ [reference](docs/USER_GUIDE.md#typical-workflows)
+
+### 7 · Utilities
+`ask rename-class` (word-boundary Java rename) · `ask chunk-file` (split large files for agents) · `ask cache` (status / warm / clear / freshness)
+→ [reference](docs/USER_GUIDE.md)
+
+---
+
+## What it does — and doesn't
+
+**ASK Engine reduces exploration cost.** It accelerates context acquisition and computes
+blast radius; it does not replace reading code — it reduces how often an agent needs to.
+All signals are **static and deterministic** (annotations, import graph, file structure) —
+no runtime analysis, no LLM guessing.
+
+Honest limits worth knowing before you rely on it:
+
+- `impact` on an **implementation** class (`OrderServiceImpl`) returns 0 callers in Spring Boot — callers inject the interface. **Always target the interface.**
+- `no_security_signal` on an endpoint means *no recognized method-level annotation*, **not** "unsecured" — Spring Security filter chains and custom authorization annotations show as `no_security_signal` unless taught via config (below).
+- `spring-audit` / `impact-chain` are **Java/Spring only**; non-Java repos return `spring_detected: false`.
+- Event topology (`--type events`) resolves Spring `ApplicationEvent` / `@EventListener` chains only — **not** Kafka/RabbitMQ/Redis routes.
+- Architecture classification is tuned for Spring MVC layered apps; SPI/plugin models (e.g. Quarkus extensions) may be misclassified. JAX-RS subresource-locator endpoint recall is ~65%.
+- Self-invocation `@Transactional` bypass (same-class call skipping the proxy) is not detected.
+
+---
+
+## Pricing
+
+> **🎉 Early-adoption: Pro is currently unlocked for everyone.** Every install runs with
+> full Pro entitlements — no size gate, no key. The tiers below describe the model the
+> paywall will return to later.
+
+**Gating is by repo size and automation — never by command.** Every command runs at full
+power on Free for small and mid-size repos; you upgrade when the work gets bigger or automated.
+
+| | **Free** — €0 | **Pro** — €19/mo · €190/yr per dev |
+|---|---|---|
+| Repo size | ≤ 500 Java source files | **> 500 Java files** (enterprise monoliths) |
+| Commands | All of them, full output | Same commands, unlocked at scale |
+| `impact` / `fix-bug` / `review-pr` / `modernize` | ✅ full on small repos | ✅ full on large repos (Free gets a capped preview) |
+| `prepare-context delta` | 30 free runs/repo | unlimited — CI/CD automation |
+| MCP local server, offline, no data egress | ✅ | ✅ |
+
+**Non-Java repos are free at any size** — the size limit counts Java source files only.
+ASK Engine monetises enterprise Java monoliths. Activate with `ask activate <key>`.
+Full breakdown: [docs/PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md).
+
+---
+
+## Configuration & privacy
+
+```bash
+ask config              # version, config file path, telemetry status
+ask telemetry disable   # anonymous telemetry is on by default (opt-out)
+```
+
+Telemetry collects version, OS, commands, flags, duration, repo-size range, and errors —
+**no source code, paths, secrets, or output**. Disable any time with
+`export SOURCECODE_TELEMETRY=0` (or `DO_NOT_TRACK=1`).
+
+**Custom security annotations.** Teach `endpoints`, `spring-audit`, and `explain` about
+project-specific authorization annotations via an optional `sourcecode.config.json` at the
+repo root (otherwise they report `policy: "none_detected"`):
+
+```json
+{
+  "customSecurityAnnotations": [
+    { "fullyQualifiedName": "com.example.security.M3FiltroSeguridad", "shortName": "M3FiltroSeguridad" }
+  ]
+}
+```
+
+Matching endpoints report `policy: "custom"` and drop out of the `no_security_signal` count.
+
+---
+
+## Documentation
+
+| Doc | What it covers |
+|-----|----------------|
+| [USER_GUIDE.md](docs/USER_GUIDE.md) | Full command reference, flags, output schema, workflows |
+| [migrate-check.md](docs/migrate-check.md) | Migration rule catalogue (MIG-001..043) + Hibernate stratification |
+| [MODERNIZATION.md](docs/MODERNIZATION.md) | The modernization product: assess → understand → plan → execute |
+| [PRODUCT_TIERS.md](docs/PRODUCT_TIERS.md) | Free vs Pro, pricing model |
+| [DEMO-5MIN.md](docs/DEMO-5MIN.md) | A reproducible 5-minute demo |
+| [MANUAL-USUARIO.md](docs/MANUAL-USUARIO.md) | Guía de usuario en español |
+| [PRODUCT_IDENTITY.md](docs/PRODUCT_IDENTITY.md) | `ask` (command) vs `sourcecode` (package/alias) |
+| [privacy.md](docs/privacy.md) | Telemetry and data-handling policy |

{sourcecode-2.0.0.dist-info → sourcecode-2.1.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=KXxsvCNAyt9RcCa2C-lchlVriTeFPszgzdkd0371mYU,308
+sourcecode/__init__.py,sha256=6IP6ug5fLqU_NKOIzfMwRs-jSKYDBb21TLg1tIzLWAk,308
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=6_wC4TYuBYxaqckZS0I1vBSMRPeH2vzlDB48gXwOOd4,46627
 sourcecode/architecture_summary.py,sha256=UaxmUU77oTlWxttMU3c6PxHrU-Q6q5N31TeU_NWWTdU,24297
@@ -8,7 +8,7 @@ sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,41
 sourcecode/canonical_ir.py,sha256=U69m8Vkr0p407xF1q5y1KguHXWEAubYw8NFHR9hDNJk,29178
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=YTTCoRdcLEFRVcql9Ow1dE7eYQj0jq2rgx32bRDnb1k,13852
-sourcecode/cli.py,sha256=5ykrowoQdp7i9CzPPVv1jrwE6jkNs1Myd6eY-wnZ8Kk,288344
+sourcecode/cli.py,sha256=PksGF5DiVcPU0SUHw0vKwQA-9w934ZMKCix1K4WX8Rs,289590
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_graph.py,sha256=8MVDu06bPhvRDTgUqWEvRME2fOw34bFLf4OUILZd13I,43527
@@ -37,7 +37,7 @@ sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=keFuwNxdAtvK2Ds91Wl79GMYxuxWYnN5Wbw1qBpaoUI,24896
 sourcecode/mcp_nudge.py,sha256=yjwclsBVsDg1BtocGdEi6GYV4vzPo-SBlC9pIcNmlDM,2910
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=Fz12IrMTQWjvbT7melwJGf1aNqQDtzbyRPd_bDA7hdw,105025
+sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
@@ -56,21 +56,23 @@ sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_X
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs,3503
+sourcecode/security_posture.py,sha256=CAJw4oJD0aAW2yRewvd_fonkzi9_HpUjBZlIDZle00s,26034
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=HpgjenY6DLPHPomP7Hw850zA-EBokf1S4O2sh8NegdI,20351
 sourcecode/semantic_integration_engine.py,sha256=cUJFZaBfgzsYpj9hRa9CZjo3U9VSfIQV1k2SQYM5HZw,14524
 sourcecode/semantic_services.py,sha256=AO_p7PRfjc-AUh6ThvLMfm4iUGi0issL_frCf8sxGlI,10637
 sourcecode/serializer.py,sha256=_3aLX3iFbHlqVDx_IlmOBQUI6QLPrL_XX2jxF6gL_No,129094
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
-sourcecode/spring_findings.py,sha256=G7Or2lKBUQbcTDqudLvSs9XvNg_YoAa-_lBOG_ULs8E,5457
+sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
 sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
-sourcecode/spring_security_audit.py,sha256=xrdv3MaR_m2wblA6a8MRWM7attvZeoPXKsoRO_R2lY4,21401
+sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
 sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
 sourcecode/spring_tx_analyzer.py,sha256=iH9mK0Tgvhgy_Ee2r13KA_RMf8HKN-pjCKQGuyCCBjM,33812
-sourcecode/summarizer.py,sha256=hV-kPFXXh15GnIvmLZnmVWTEbmr35C-yKVtPiR25U2g,21802
+sourcecode/summarizer.py,sha256=ByfFxIGVRrGrf3paQPuDOg1rVj78LyzXN_EXBkfbCLU,23582
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
+sourcecode/validation_inference.py,sha256=UtmYv-d4TEzT1ihGEipAhtXDrwq0XtVtjMpb3i7NsNc,10815
 sourcecode/validation_surface.py,sha256=A7h0Z9xHjPrxUPkyoPKlhGb8tCF0w0PI_XT-tOj5sC4,21375
 sourcecode/version_check.py,sha256=CHp6ZxTIfo8kyHPCBgJA1uFC0xQCoXMuuOfrW8QTL8o,4942
 sourcecode/workspace.py,sha256=X_6NmNnitvT3_38V-JDChydo_sR68s249hLFlrQskU0,8271
@@ -111,8 +113,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.0.0.dist-info/METADATA,sha256=qxaCEW0jVsLWYJeZczHV1L2NPXLpJScDWC3ztFPtL-k,48445
-sourcecode-2.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.0.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.0.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.0.0.dist-info/RECORD,,
+sourcecode-2.1.0.dist-info/METADATA,sha256=YcJphSnTG4SGmAeb7R2XWhj4nIp4-1hazejT7QdPo9Y,10798
+sourcecode-2.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.1.0.dist-info/RECORD,,