sourcecode 2.1.0__py3-none-any.whl → 2.2.0__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"

sourcecode/caller_metrics.py

@@ -0,0 +1,42 @@
+"""Single source of truth for the caller / fan-in metric reconciliation note.
+
+Three commands report a "how many things reference this class" number, each
+derived from a different graph projection. Read side by side they can look
+contradictory (e.g. 215 vs 103 for the same class) — they are not. They count
+different populations:
+
+    modernize.in_degree  >=  explain.incoming_callers  ~=  impact.stats.direct_caller_count
+
+- ``modernize.in_degree`` counts graph *edges* (all edge types, symbol level, not
+  deduplicated per class) — a blast-radius ranking weight, always the largest, and
+  not a count of classes.
+- ``explain.incoming_callers`` and ``impact.stats.direct_caller_count`` both count
+  *distinct dependent classes*. They normally match and are always the same order
+  of magnitude, but can differ by a small margin because each includes a slightly
+  different edge set (import-only references, DI-interface resolution). The
+  truncated ``impact.direct_callers`` array is a display sample, not the count.
+
+Empirically verified across repositories (Broadleaf ExtensionManager: 215 / 103 /
+103; petclinic entities & repositories: equal; occasional margin-of-one divergence
+on classes with import-only references). The strict-equality claim was deliberately
+NOT made — the note asserts only the robust ordering and the "same distinct-class
+metric" relationship.
+
+Every command that emits one of these numbers references this same string so the
+explanation can never drift or contradict itself between commands.
+"""
+
+CALLER_METRIC_RECONCILIATION: str = (
+    "Fan-in / caller counts differ across commands BY DESIGN and are not "
+    "contradictory. For the same class the expected relationship is: "
+    "modernize.in_degree >= explain.incoming_callers ~= impact.stats.direct_caller_count. "
+    "modernize.in_degree = raw count of ALL incoming graph edges (imports, injects, "
+    "extends/implements, references, annotations), counted at symbol level and NOT "
+    "deduplicated per class — a blast-radius ranking weight, not a count of classes; "
+    "it is always the largest of the three. explain.incoming_callers and "
+    "impact.stats.direct_caller_count both count DISTINCT dependent classes "
+    "(deduplicated to class level); they normally match but can differ by a small "
+    "margin because each includes a slightly different edge set (e.g. import-only "
+    "references or DI-interface resolution). The top-level impact.direct_callers array "
+    "may be truncated for output size — use stats.direct_caller_count for the true total."
+)

sourcecode/cli.py

@@ -15,6 +15,7 @@ from sourcecode import __version__
 from sourcecode.error_schema import INVALID_INPUT_CODE, build_error_envelope
 from sourcecode.entrypoint_classifier import is_production_entry_point, normalize_entry_point
 from sourcecode.progress import Progress
+from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
 from sourcecode.repository_ir import extract_java_endpoints as _extract_java_endpoints
 
 
@@ -700,7 +701,8 @@ _WELCOME_CMDS = (
 
 def _print_welcome_plain(tier: str) -> None:
     """Plain-text welcome — fallback when rich is unavailable."""
-    lines = ["", f"  ASK Engine {__version__}   ·   {tier}   ·   CLI: ask", "",
+    lines = ["", f"  ASK Engine {__version__}   ·   {tier}   ·   CLI: ask",
+             "  Actionable Software Knowledge Engine", "",
              "  AI coding-agent context, instant.", "", "  Get started:"]
     for cmd, desc in _WELCOME_CMDS:
         lines.append(f"    {cmd.ljust(34)}{desc}")
@@ -747,8 +749,9 @@ def _print_welcome() -> None:
             t.append("   ")
             t.append(tier, style=tier_style)
         t.append("\n")
-    # "ENGINE" label beneath the wordmark.
-    t.append(_WELCOME_ENGINE + "\n", style="bold dim cyan")
+    # "ENGINE" label beneath the wordmark, with the acronym expansion.
+    t.append(_WELCOME_ENGINE, style="bold dim cyan")
+    t.append("   Actionable Software Knowledge\n", style="dim")
 
     t.append("\nAI coding-agent context, instant.\n\n", style="white")
 
@@ -3911,7 +3914,12 @@ def endpoints_cmd(
         )
         raise typer.Exit(code=1)
 
-    data = _extract_java_endpoints(target)
+    _prog = Progress()
+    _prog.start("scanning endpoints")
+    try:
+        data = _extract_java_endpoints(target)
+    finally:
+        _prog.finish()
 
     # Update RIS api_surface section (non-fatal side-effect).
     try:
@@ -4358,6 +4366,9 @@ def export_cmd(
         )
         raise typer.Exit(1)
 
+    _prog = Progress()
+    _prog.start("scanning repository")
+
     file_list = [
         f for f in find_java_files(root)
         if "/test/" not in f and "/tests/" not in f
@@ -4384,6 +4395,7 @@ def export_cmd(
             _integrations,
             endpoint_meta=_ep_data,
         )
+        _prog.finish()
         output = _serialize_dict(data, format)
         _emit_command_output(output, output_path, copy,
                              success_msg=f"C4 architecture export written to {output_path}")
@@ -4413,6 +4425,7 @@ def export_cmd(
             ContextGraph.build(file_list, root)
         ).as_report(len(file_list))
 
+    _prog.finish()
     output = _serialize_dict(data, format)
     _emit_command_output(output, output_path, copy,
                          success_msg=f"Export written to {output_path}")
@@ -4495,6 +4508,8 @@ def validation_cmd(
 
     from sourcecode.context_graph import ContextGraph
     from sourcecode.validation_surface import build_validation_surface
+    _prog = Progress()
+    _prog.start("mapping validation surface")
     # Structural facts come from the ContextGraph — the single access layer.
     _graph = ContextGraph.build_from_root(target)
     data = build_validation_surface(target, graph=_graph)
@@ -4527,6 +4542,7 @@ def validation_cmd(
         if _note:
             data["note"] = _note
 
+    _prog.finish()
     output = _serialize_dict(data, format)
     _summary = data.get("summary", {})
     # Human-facing heads-up when the result is empty purely because no OpenAPI
@@ -4750,6 +4766,8 @@ def spring_audit_cmd(
                              success_msg=f"Spring audit written to {output_path}")
         return
 
+    _prog = Progress()
+    _prog.start(f"auditing {len(file_list)} Java files")
     cir = ContextGraph.build(file_list, target).cir
     _model = SpringSemanticModel.build(cir)
 
@@ -4802,6 +4820,7 @@ def spring_audit_cmd(
     except Exception:
         pass
 
+    _prog.finish()
     if format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
@@ -4920,7 +4939,12 @@ def migrate_check_cmd(
 
     _file_limitations: list[str] = []
     file_list = find_java_files(target, limitations=_file_limitations)
-    report = run_migrate_check(file_list, target, min_severity=min_severity)
+    _prog = Progress()
+    _prog.start(f"checking migration ({len(file_list)} files)")
+    try:
+        report = run_migrate_check(file_list, target, min_severity=min_severity)
+    finally:
+        _prog.finish()
     if _file_limitations:
         report.limitations.extend(_file_limitations)
 
@@ -5079,6 +5103,8 @@ def impact_chain_cmd(
                              success_msg=f"Impact chain written to {output_path}")
         return
 
+    _prog = Progress()
+    _prog.start(f"analyzing impact ({len(file_list)} files)")
     cir = ContextGraph.build(file_list, target).cir
     _model = SpringSemanticModel.build(cir)
 
@@ -5086,6 +5112,7 @@ def impact_chain_cmd(
         from sourcecode.spring_event_topology import run_event_topology
         evt_result = run_event_topology(cir, symbol, model=_model)
         data = evt_result.to_dict()
+        _prog.finish()
         output = _serialize_dict(data, format)
         _emit_command_output(
             output, output_path, copy,
@@ -5101,6 +5128,7 @@ def impact_chain_cmd(
     result = run_impact_chain(cir, symbol, depth=depth, root=target, model=_model)
 
     data = result.to_dict()
+    _prog.finish()
     output = _serialize_dict(data, format)
     _emit_command_output(
         output, output_path, copy,
@@ -5229,9 +5257,14 @@ def pr_impact_cmd(
                              success_msg=f"PR impact report written to {output_path}")
         return
 
-    cir = ContextGraph.build(file_list, target).cir
-    model = SpringSemanticModel.build(cir)
-    report = run_pr_impact(cir, changed_files, root=target, model=model)
+    _prog = Progress()
+    _prog.start(f"analyzing PR impact ({len(file_list)} files)")
+    try:
+        cir = ContextGraph.build(file_list, target).cir
+        model = SpringSemanticModel.build(cir)
+        report = run_pr_impact(cir, changed_files, root=target, model=model)
+    finally:
+        _prog.finish()
 
     output = _serialize_dict(report.to_dict(), "json") if format == "json" else report.render_text()
     _emit_command_output(
@@ -5348,9 +5381,14 @@ def explain_cmd(
         )
         raise typer.Exit(code=1)
 
-    cir = ContextGraph.build(file_list, target).cir
-    model = SpringSemanticModel.build(cir)
-    explanation = explain_class(class_name, cir, model)
+    _prog = Progress()
+    _prog.start(f"explaining {class_name} ({len(file_list)} files)")
+    try:
+        cir = ContextGraph.build(file_list, target).cir
+        model = SpringSemanticModel.build(cir)
+        explanation = explain_class(class_name, cir, model)
+    finally:
+        _prog.finish()
 
     if format == "json":
         output = _json.dumps(explanation.to_dict(), indent=2, ensure_ascii=False)
@@ -5663,7 +5701,56 @@ def _partition_static_unreferenced(nodes: list[dict], root: Path) -> tuple[list[
             if files_scanned >= _CONFIG_SCAN_MAX_FILES or not unresolved_simple:
                 break
 
-    unreferenced = [n for n in nodes if n["fqn"] not in dispatched_fqns]
+    # 3. Nested-type qualified-reference scan (SC-2 residual). The static call-graph
+    #    does not emit an edge for a nested-type member access in ordinary method-body
+    #    code — e.g. `PropertyType.AdminGroupPresentation.NAME` credits the enclosing
+    #    type, not the nested holder — so a referenced nested class can look
+    #    zero-degree. When a candidate is a nested type (its second-to-last FQN segment
+    #    is an UpperCamel enclosing type) and its qualified `Outer.Nested` form appears
+    #    in some OTHER Java source, it is statically referenced: neither dead nor
+    #    framework-dispatched. Structural, name-agnostic (pattern derived from the
+    #    candidate's own FQN).
+    import re as _re_nested
+    statically_referenced: set[str] = set()
+    nested_patterns: dict[str, "tuple"] = {}
+    for n in nodes:
+        if n["fqn"] in dispatched_fqns:
+            continue
+        parts = (n.get("fqn") or "").split(".")
+        if len(parts) >= 2 and parts[-2][:1].isupper():
+            outer, nested = parts[-2], parts[-1]
+            nested_patterns[n["fqn"]] = (
+                _re_nested.compile(r"\b" + _re_nested.escape(outer) + r"\." + _re_nested.escape(nested) + r"\b"),
+                n.get("source_file") or "",
+            )
+    if nested_patterns:
+        files_scanned = 0
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames
+                           if d not in {".git", "build", "out", "target", "node_modules", ".gradle"}]
+            for fname in filenames:
+                if not fname.endswith(".java"):
+                    continue
+                if files_scanned >= _CONFIG_SCAN_MAX_FILES or len(statically_referenced) == len(nested_patterns):
+                    break
+                fpath = os.path.join(dirpath, fname)
+                rel = os.path.relpath(fpath, root)
+                try:
+                    with open(fpath, "r", encoding="utf-8", errors="replace") as fh:
+                        text = fh.read(_CONFIG_SCAN_MAX_BYTES)
+                except OSError:
+                    continue
+                files_scanned += 1
+                for fqn, (pat, own) in nested_patterns.items():
+                    if fqn in statically_referenced or rel == own:
+                        continue
+                    if pat.search(text):
+                        statically_referenced.add(fqn)
+            if files_scanned >= _CONFIG_SCAN_MAX_FILES or len(statically_referenced) == len(nested_patterns):
+                break
+
+    unreferenced = [n for n in nodes
+                    if n["fqn"] not in dispatched_fqns and n["fqn"] not in statically_referenced]
     dispatched = [n for n in nodes if n["fqn"] in dispatched_fqns]
     return unreferenced, dispatched
 
@@ -5870,8 +5957,13 @@ def modernize_cmd(
             "edge_count": _cnt,
             "reverse_edge_count": _reverse,
             # A mutual (cyclic) dependency is the actual "tangle" — both modules
-            # reference each other, so neither can be extracted independently.
+            # reference each other, so neither can be extracted independently. A
+            # one-way (directional) dependency is normal layering, NOT a tangle:
+            # TANGLE-1 (petclinic field test) surfaced owner→model / vet→model
+            # (reverse_edge_count:0) being labelled "tangles" when they are plain
+            # base-model usage. coupling_type states which it is, honestly.
             "mutual": _reverse > 0,
+            "coupling_type": "cyclic" if _reverse > 0 else "directional",
             "example": _pair_example.get((_a, _b), ""),
         })
     # Surface mutual tangles first (highest decomposition risk), then by strength.
@@ -5947,17 +6039,10 @@ def modernize_cmd(
                 {"fqn": n["fqn"], "in_degree": n.get("in_degree", 0), "role": n.get("role", "other")}
                 for n in coupling_nodes
             ],
-            # BUG #6 (Broadleaf field test): make the in_degree metric self-describing
-            # so it is not confused with `explain`'s caller count. They differ by design.
-            "high_coupling_nodes_note": (
-                "in_degree = raw count of incoming graph edges across ALL edge types "
-                "(imports, injects, extends/implements, references, annotations), "
-                "counted at symbol level. This is deliberately larger than and NOT "
-                "equal to `ask explain`'s caller count, which reports DISTINCT "
-                "dependent classes (DI dependents + reverse-call-graph callers, "
-                "deduplicated to class level). Use in_degree for blast-radius ranking, "
-                "explain's caller list for the concrete dependents to inspect."
-            ),
+            # SC-6 (Broadleaf field test): make the in_degree metric self-describing
+            # so it is not confused with `explain`'s / `impact`'s caller counts. All
+            # three share one reconciliation note so they can never contradict.
+            "high_coupling_nodes_note": CALLER_METRIC_RECONCILIATION,
             "statically_unreferenced": [
                 {"fqn": n["fqn"], "type": n.get("type", ""), "role": n.get("role", "other")}
                 for n in dead_zones
@@ -5978,10 +6063,12 @@ def modernize_cmd(
             "cross_module_tangles_note": (
                 "Directed inter-subsystem coupling measured from structural graph "
                 "edges (imports/injects/extends/implements/references/calls). "
-                "edge_count = edges from_package→to_package; mutual=true marks a "
-                "bidirectional (cyclic) dependency — the actual tangle that blocks "
-                "independent module extraction. Empty means no cross-subsystem "
-                "structural coupling was detected."
+                "edge_count = edges from_package→to_package. coupling_type=cyclic "
+                "(mutual=true) is a bidirectional dependency — the actual tangle "
+                "that blocks independent module extraction; coupling_type="
+                "directional (reverse_edge_count=0) is a normal one-way layered "
+                "dependency, listed for coupling strength, NOT a tangle. Empty "
+                "means no cross-subsystem structural coupling was detected."
             ),
             # BUG-05 fix: don't recommend "Start with hotspot_candidates" when the list is empty.
             "recommendation": (
@@ -5992,7 +6079,9 @@ def modernize_cmd(
                 )
                 + "statically_unreferenced lists classes with no Java callers — review "
                 + "for framework dispatch (XML/reflection/SPI) before removing. "
-                + "Cross-module tangles indicate coupling worth decomposing."
+                + "In cross_module_tangles, coupling_type=cyclic entries are the "
+                + "real tangles to decompose first; directional entries are normal "
+                + "layering ranked by coupling strength."
             ),
         }
 

sourcecode/detectors/java.py

@@ -176,6 +176,28 @@ class JavaDetector(AbstractDetector):
             frameworks = [f for f in frameworks if f.name != "MyBatis"]
 
         entry_points = self._collect_entry_points(context)
+
+        # C1 (Eureka field test): a repo whose REST surface is JAX-RS / Jakarta
+        # REST — declared on the source via @Path/@GET, not through a web framework
+        # coordinate in the build manifest — must still surface that in the headline
+        # stack. Eureka wires JAX-RS through Jersey 1.x (com.sun.jersey) + jsr311-api
+        # + Guice, none of which the manifest-coordinate scan models, and its child
+        # build.gradle files are not scanned at all — yet it ships 18 @Path resource
+        # classes. Without this the headline read "Java library / package" while the
+        # endpoints command listed a full JAX-RS API. When the annotation scan found
+        # JAX-RS entry points and no Jakarta-EE framework was inferred from the
+        # manifest, surface it so the stack (and project_type) reflect the REST API
+        # the endpoints already prove. Structural (VAI): reasons from the JAX-RS
+        # entry points found in source, not from a vendor dependency-name allowlist.
+        # detected_via carries no path form, so it is treated as repo-wide evidence
+        # (never localized to an adapter submodule).
+        if not any(f.name == "Jakarta EE" for f in frameworks) and any(
+            ep.kind in ("jax_rs_controller", "jax_rs_provider") for ep in entry_points
+        ):
+            frameworks.append(FrameworkDetection(
+                name="Jakarta EE", source="annotation", detected_via=["jax_rs_endpoints"],
+            ))
+
         transactional_classes = self._collect_transactional_classes(context, all_paths)
         stack = StackDetection(
             stack="java",
@@ -459,7 +481,13 @@ class JavaDetector(AbstractDetector):
         # 1. @SpringBootApplication entry: Application.java / Main.java by name
         # Exclude test trees: test helpers like AdminApplication.java in
         # integration/src/test/java/ must not be treated as production entrypoints.
-        from sourcecode.path_filters import is_test_path as _is_test_path
+        # B2 (openmrs field test): exclude not just src/test/ trees but whole
+        # test-harness MODULES whose sources sit under src/main — e.g. openmrs'
+        # `test-suite/module/omod/src/main/java/.../TestModuleController.java`, a
+        # scaffolding @Controller (`GET /module/testmodule/hello`) that a narrow
+        # src/test/ check misses, so it surfaced as a production entry point. The
+        # broader is_test_or_fixture_path catches test-suite / *-test / *-it modules.
+        from sourcecode.path_filters import is_test_or_fixture_path as _is_test_path
         # BUG #3 (Alfresco field test): a `*Application.java` / `*Main.java` NAME does
         # not make a file a bootstrap entry point. Alfresco has XSD-generated JAXB
         # `Application.java` model classes (no main(), no bootstrap annotation) in a

sourcecode/endpoint_metrics.py

@@ -0,0 +1,42 @@
+"""Single source of truth for the endpoint / route-surface reconciliation note.
+
+Three commands report an endpoint count, each from a different point in the
+pipeline. Read side by side they look contradictory (e.g. 245 vs 225 vs 220 for
+one repo) — they are not. Expected ordering for a single repo:
+
+    repo-ir.route_surface  >=  endpoints.total  >=  spring-audit.endpoints_analyzed
+
+- ``repo-ir.route_surface`` is the RAW structural surface (every @RequestMapping /
+  @Path handler after inheritance projection and JAX-RS sub-resource-locator
+  composition). It still contains framework dynamic-admin routes whose path is a
+  Java FQN (e.g. ``/org.broadleafcommerce.core.search.domain.FieldImpl``), which
+  the ``endpoints`` command filters out — so it is NOT the canonical API surface.
+- ``endpoints.total`` is the canonical REST/API surface (FQN-shaped framework
+  routes removed). This is the number to cite for "how many endpoints".
+- ``spring-audit.endpoints_analyzed`` is that canonical surface further deduplicated
+  by (method, path, controller, handler) for security analysis.
+
+The exact arithmetic between the three is intentionally NOT asserted (the pipelines
+differ in dedup/expansion, so route_surface minus FQN-paths does not equal
+endpoints.total). Only the robust ordering and the population of each are stated.
+
+``spring-audit`` already documents its own count inline; this note gives repo-ir's
+raw ``route_surface`` the same self-description so no reader mistakes it for the
+canonical endpoint total.
+"""
+
+ENDPOINT_SURFACE_RECONCILIATION: str = (
+    "route_surface is the RAW structural route surface: every @RequestMapping/@Path "
+    "handler after inheritance projection and JAX-RS sub-resource-locator composition. "
+    "It is NOT the canonical API surface — it still contains framework dynamic-admin "
+    "routes whose path is a Java FQN (e.g. /org.broadleafcommerce...), which the "
+    "`endpoints` command excludes. Endpoint counts differ across commands BY DESIGN "
+    "and are not contradictory; expected ordering for one repo is "
+    "repo-ir.route_surface (raw, includes FQN-shaped framework routes) >= "
+    "endpoints.total (canonical REST/API surface, FQN-shaped routes filtered out) >= "
+    "spring-audit.metadata.endpoints_analyzed (canonical surface further deduplicated "
+    "by (method, path, controller, handler) for security analysis). Cite "
+    "endpoints.total for the real API surface; the pipelines differ in dedup and "
+    "prefix expansion, so the three counts are related by this ordering, not by exact "
+    "arithmetic."
+)

sourcecode/explain.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Optional
 
+from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
 from sourcecode.fqn_utils import normalize_owner_fqn
 
 if TYPE_CHECKING:
@@ -121,6 +122,7 @@ class ClassExplanation:
             "purpose": self.purpose,
             "public_methods": self.public_methods,
             "incoming_callers": self.incoming_callers,
+            "incoming_callers_note": CALLER_METRIC_RECONCILIATION,
             "outgoing_deps": self.outgoing_deps,
             "events_published": self.events_published,
             "events_consumed": self.events_consumed,

sourcecode/path_filters.py

@@ -16,7 +16,8 @@ _TEST_SEGMENTS = frozenset({
 # code lives under src/main (e.g. a Maven module that ships a test framework).
 # A finding under one of these modules is test infrastructure, not the product.
 _TEST_MODULE_SEGMENTS = frozenset({
-    "testsuite", "test-framework", "testframework",
+    "testsuite", "test-suite", "test-suites",
+    "test-framework", "testframework",
     "integration-arquillian", "arquillian",
     "test-utils", "test-util", "testutils",
     "test-support", "testsupport",

sourcecode/repository_ir.py

@@ -22,6 +22,8 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Iterable, Optional
 
+from sourcecode.caller_metrics import CALLER_METRIC_RECONCILIATION
+from sourcecode.endpoint_metrics import ENDPOINT_SURFACE_RECONCILIATION
 from sourcecode.fqn_utils import normalize_owner_fqn as _normalize_owner_fqn
 from sourcecode.path_filters import is_test_path as _is_test_path
 from sourcecode.security_config import (
@@ -3965,6 +3967,11 @@ def _assemble(
     return {
         **_base,
         "route_surface": _route_surface,
+        # SC-9 (Broadleaf field test): route_surface is the RAW surface (includes
+        # framework dynamic-admin FQN-shaped routes the `endpoints` command filters).
+        # Self-describe it so its count is never read as contradicting endpoints /
+        # spring-audit totals when cross-referenced.
+        "route_surface_note": ENDPOINT_SURFACE_RECONCILIATION,
         "spring_events": _spring_events,
         "analysis_gaps": _analysis_gaps,
         "security_model": _security_model_asm,
@@ -4236,6 +4243,10 @@ def _build_route_surface(
                     "return_type": (sym.return_type.strip() if sym.return_type else "void"),
                     "stable_id": sym.stable_id,
                     "inheritance_depth": 0,
+                    # Provenance: which annotation family this modeled route came from.
+                    # Used downstream so a MODELED framework (JAX-RS) is never also reported
+                    # as an un-modeled "non_spring_rest_surface" (A2 field-validation fix).
+                    "framework": "jax_rs" if ann_name in _JAXRS_HTTP_ANNOTATIONS else "spring_mvc",
                 }
                 _route_entry["security_annotations"] = _sec
                 routes.append(_route_entry)
@@ -4721,11 +4732,16 @@ def apply_ir_size_limits(
         if isinstance(raw_rs, list):
             _rs_total = len(raw_rs)
             out["route_surface"] = raw_rs[:50]
+            # SC-9: always carry the raw-surface reconciliation note; prepend the
+            # truncation notice when the list was capped.
             if _rs_total > 50:
                 out["route_surface_note"] = (
-                    f"Showing 50/{_rs_total} endpoints. "
-                    "Remove --summary-only for full route surface."
+                    f"Showing 50/{_rs_total} route-surface entries. "
+                    "Remove --summary-only for the full route surface. "
+                    + ENDPOINT_SURFACE_RECONCILIATION
                 )
+            else:
+                out["route_surface_note"] = ENDPOINT_SURFACE_RECONCILIATION
         elif isinstance(raw_rs, dict):
             # Legacy dict format with "endpoints" sub-key
             raw_eps: list = raw_rs.get("endpoints") or []
@@ -5116,16 +5132,19 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # total false negative that also disables the `validation` command downstream.
     # Detection is by SYNTACTIC SHAPE (no framework knowledge): an HTTP-verb method
     # name, a first argument that is a string literal looking like a path (starts
-    # with "/", may contain :param / {param}), AND a second argument (the trailing
-    # comma) — the comma is what distinguishes a route registration from a 1-arg
-    # getter such as Map.get("/k"). Matches both bare `get(...)` (static-import /
-    # Spark style) and `app.get(...)` (Javalin style); the lookbehind only rejects
-    # an identifier char so `forget(` is not mistaken for `get(`. Reported at
-    # confidence "medium" — an occasional flagged false positive beats a total
-    # silent false negative.
+    # with "/", may contain :param / {param}), AND a second argument that is a
+    # HANDLER, not a literal. Matches both bare `get(...)` (static-import / Spark
+    # style) and `app.get(...)` (Javalin style); the lookbehind only rejects an
+    # identifier char so `forget(` is not mistaken for `get(`.
+    # B1 fix (field validation, openmrs FormUtil): a route handler is always a
+    # method-ref / lambda / call / identifier — never a bare literal. The negative
+    # lookahead after the comma rejects a literal second argument, so a plain map
+    # write like `swapChars.put("/", "slash")` is no longer mistaken for a `PUT /`
+    # route. Reported at confidence "medium" — an occasional flagged false positive
+    # beats a total silent false negative.
     _DSL_ROUTE_RE = _re.compile(
         r'(?<![A-Za-z0-9_])(get|post|put|delete|patch|head|options)\s*\(\s*'
-        r'"(/[^"\s]*)"\s*,'
+        r'"(/[^"\s]*)"\s*,(?!\s*(?:["0-9]|true\b|false\b|null\b))'
     )
     _dsl_routes: list[dict] = []
 
@@ -5441,6 +5460,15 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     if _webscript_descriptors:
         _nonspring["webscripts"] += _webscript_descriptors
 
+    # A2 fix (eureka/keycloak field validation): JAX-RS is MODELED by _build_route_surface
+    # (routes carry framework="jax_rs"). When we actually modeled JAX-RS endpoints, it is
+    # NOT an un-modeled "non_spring_rest_surface" — reporting it as such contradicted the
+    # endpoints just emitted (e.g. keycloak's 689 JAX-RS routes labelled "not modeled").
+    # Only genuinely un-modeled surfaces (WebScripts, Servlets, or JAX-RS that produced no
+    # modeled route — client proxies / extraction gaps) remain here.
+    if any(r.get("framework") == "jax_rs" for r in routes):
+        _nonspring.pop("jax_rs", None)
+
     _nonspring_total = sum(_nonspring.values())
     if _nonspring_total:
         _frameworks = [k for k, v in _nonspring.items() if v]
@@ -5471,9 +5499,9 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             )
         else:
             _msg = (
-                f"Additional REST surface present outside Spring MVC: detected {_fw_label}. "
-                f"These endpoints are NOT modeled here; the count covers Spring-MVC-annotated "
-                f"endpoints only."
+                f"Additional REST surface detected but NOT modeled here: {_fw_label}. "
+                f"The endpoints above cover the annotation-modeled surface (Spring MVC and "
+                f"JAX-RS); the {_fw_label} surface is additional and not included in the count."
             )
         result.setdefault("warnings", []).append(_msg)
 
@@ -6153,10 +6181,18 @@ def compute_blast_radius(
                 "no indirect callers reachable from sampled seeds (terminal sink or sparse graph). "
                 "Use a lower-fan-in entry point for full transitive traversal."
             )
+    # SC-6 (Broadleaf field test): the direct_callers array is a truncated display
+    # sample. Disclose the cap and point to stats.direct_caller_count as the true
+    # total (== explain.incoming_callers), then append the cross-command
+    # reconciliation so len(direct_callers) is never misread as a contradiction.
     if len(direct_callers) > 30:
         out["direct_callers_note"] = (
-            f"Showing 30/{n_direct} direct callers. Use --output to inspect full IR."
+            f"Showing 30/{n_direct} distinct direct callers; "
+            f"stats.direct_caller_count = {n_direct} is the true total "
+            f"(use --output for the full list). " + CALLER_METRIC_RECONCILIATION
         )
+    else:
+        out["direct_callers_note"] = CALLER_METRIC_RECONCILIATION
     if len(indirect_callers) > 50:
         out["indirect_callers_note"] = (
             f"Showing 50/{n_indirect} indirect callers. Use --output to inspect full IR."

sourcecode/semantic_integration_engine.py

@@ -179,7 +179,9 @@ class SemanticIntegrationEngine:
 
     def detect(self) -> list[Integration]:
         """All outbound integrations recoverable from typed facts, deterministically
-        ordered. One record per (type, kind, client). Targets are attributed by
+        ordered. One record per semantic point (kind + evidence location): a type that
+        touches several client libraries of the same kind counts once. Targets are
+        attributed by
         annotation args (declarative) or by literal scheme (imperative), never by a
         receiver variable name."""
         per_type: dict[str, list[Integration]] = {}
@@ -231,7 +233,21 @@ class SemanticIntegrationEngine:
             per_type[t.fqn] = list(recs.values())
 
         out = [r for recs in per_type.values() for r in recs]
-        return sorted(out, key=lambda i: (i.kind, i.client, i.evidence))
+        out.sort(key=lambda i: (i.kind, i.client, i.evidence))
+        # REG-1 (Broadleaf field test): one integration per semantic point =
+        # (kind, evidence location). A single type touching several client-library
+        # types of the SAME kind — e.g. spring-ldap + spring-security-ldap on one
+        # LdapUserDetailsMapper, or javamail + spring-mail on one MessageCreator —
+        # previously emitted one record per client label, double-counting the same
+        # integration. Collapse to a single record per (kind, evidence), preferring
+        # one that carries a resolved target; ties broken by the deterministic
+        # (kind, client, evidence) order established above.
+        deduped: dict[tuple, Integration] = {}
+        for r in out:
+            k = (r.kind, r.evidence)
+            if k not in deduped or (r.target and deduped[k].target is None):
+                deduped[k] = r
+        return list(deduped.values())
 
     def _coverage(self, n_records: int, n_files: int) -> "tuple[str, str]":
         """Honest coverage signal (mirrors integration_detector): a low count on a

sourcecode/serializer.py

@@ -462,11 +462,31 @@ def _mybatis_pairing(sm: "SourceMap", *, full: bool = False) -> "Optional[dict[s
 
 
 def _spring_boot_version(sm: "SourceMap") -> "Optional[str]":
-    """Extract Spring Boot version from detected frameworks."""
+    """Extract Spring Boot version from detected frameworks.
+
+    A3 fix (field validation, Broadleaf): when Spring Boot IS detected but the
+    stack detector could not attach a version (e.g. the version lives in a
+    `<spring.boot.version>` pom property rather than spring-boot-starter-parent),
+    fall back to migrate-check's property-resolving detector so `--compact`
+    reports the SAME version migrate-check already knows — the engine must not
+    surface a fact in one command and hide it in another. Gated on Boot already
+    being detected, so no phantom version is ever introduced.
+    """
+    _boot_detected = False
     for s in sm.stacks:
         for fw in s.frameworks:
-            if fw.name == "Spring Boot" and fw.version:
-                return fw.version
+            if fw.name == "Spring Boot":
+                if fw.version:
+                    return fw.version
+                _boot_detected = True
+    if _boot_detected:
+        _root = getattr(sm.metadata, "analyzed_path", None) if sm.metadata else None
+        if _root:
+            try:
+                from sourcecode.migrate_check import _detect_spring_boot
+                return _detect_spring_boot(Path(_root), 0)[1]
+            except Exception:
+                return None
     return None
 
 

sourcecode/spring_semantic.py

@@ -122,9 +122,17 @@ class TransactionBoundary:
 class TransactionBoundaryIndex:
     """Index of all @Transactional boundaries in a repository."""
 
-    # FQN → boundary (both class-level and method-level)
+    # FQN → boundary (both class-level and method-level). Keyed by FQN for
+    # effective_boundary() call-graph lookups; OVERLOADED methods share an FQN
+    # (e.g. findAll() and findAll(Pageable) → Repo#findAll) so this dict collapses
+    # them — do NOT count from it (see all_declared / A1 field-validation fix).
     by_symbol: dict[str, TransactionBoundary] = field(default_factory=dict)
 
+    # Every declared @Transactional boundary, one entry per annotation site.
+    # Unlike by_symbol this does NOT collapse overloaded methods, so it is the
+    # authoritative source for counts/stats.
+    all_declared: list[TransactionBoundary] = field(default_factory=list)
+
     # class FQN → list of method-level boundaries declared on that class
     by_class: dict[str, list[TransactionBoundary]] = field(default_factory=dict)
 
@@ -152,17 +160,19 @@ class TransactionBoundaryIndex:
         return list(self.by_symbol.values())
 
     def stats(self) -> dict:
+        # Count from all_declared (one entry per annotation site) so overloaded
+        # @Transactional methods are not collapsed by the FQN-keyed by_symbol.
         n_class = len(self.class_level)
-        n_method = sum(1 for b in self.by_symbol.values() if b.scope == "method")
+        n_method = sum(1 for b in self.all_declared if b.scope == "method")
         propagations: dict[str, int] = {}
-        for b in self.by_symbol.values():
+        for b in self.all_declared:
             propagations[b.propagation] = propagations.get(b.propagation, 0) + 1
         return {
-            "total": len(self.by_symbol),
+            "total": len(self.all_declared),
             "class_level": n_class,
             "method_level": n_method,
             "propagations": propagations,
-            "read_only_count": sum(1 for b in self.by_symbol.values() if b.read_only),
+            "read_only_count": sum(1 for b in self.all_declared if b.read_only),
         }
 
 
@@ -353,6 +363,9 @@ def build_tx_index(cir: "CanonicalRepositoryIR") -> TransactionBoundaryIndex:
             boundary = _build_boundary(fqn, scope, raw_args, source_file, modifiers)
 
             index.by_symbol[fqn] = boundary
+            # Authoritative per-site list — overloaded methods share an FQN and would
+            # collapse in by_symbol; all_declared keeps one entry per annotation site.
+            index.all_declared.append(boundary)
 
             if scope == "class":
                 index.class_level[fqn] = boundary

sourcecode/spring_tx_analyzer.py

@@ -194,8 +194,12 @@ class _TX001ProxyBypass:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared (one entry per annotation site), not the
+        # FQN-keyed all_boundaries which collapses overloads — a public overload
+        # overwriting a private one would hide the proxy-bypass risk. Dedupe by
+        # finding id (symbol-keyed) so two risky overloads of the same FQN yield one.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.is_proxy_bypass_risk:
@@ -209,10 +213,14 @@ class _TX001ProxyBypass:
                 if problematic_modifier == "private"
                 else "Spring CGLIB proxy cannot override final methods"
             )
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
 
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,
@@ -550,8 +558,11 @@ class _TX005ExceptionSwallowing:
             return []
 
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared so a write overload that swallows is not
+        # hidden by a read_only overload of the same FQN winning the by_symbol slot
+        # (the read_only gate below would skip the whole FQN). Dedupe by finding id.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.source_file:
@@ -573,9 +584,13 @@ class _TX005ExceptionSwallowing:
             if not self._has_swallowed_exception(source, boundary.symbol):
                 continue
 
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,

{sourcecode-2.1.0.dist-info → sourcecode-2.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.1.0
+Version: 2.2.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -38,11 +38,11 @@ Description-Content-Type: text/markdown
 
 # ASK Engine
 
-> **Persistent structural intelligence for AI coding agents.**
+> **ASK — Actionable Software Knowledge.** Persistent structural intelligence for AI coding agents.
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.1.0-blue)
+![Version](https://img.shields.io/badge/version-2.2.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.1.0
+ask version                    # ask 2.2.0
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.1.0.dist-info → sourcecode-2.2.0.dist-info}/RECORD

@@ -1,14 +1,15 @@
-sourcecode/__init__.py,sha256=6IP6ug5fLqU_NKOIzfMwRs-jSKYDBb21TLg1tIzLWAk,308
+sourcecode/__init__.py,sha256=QOkIfC7KA2tM2ix9_wUgS6fHiERh2v_TTNhjw8RBb1o,308
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=6_wC4TYuBYxaqckZS0I1vBSMRPeH2vzlDB48gXwOOd4,46627
 sourcecode/architecture_summary.py,sha256=UaxmUU77oTlWxttMU3c6PxHrU-Q6q5N31TeU_NWWTdU,24297
 sourcecode/ast_extractor.py,sha256=FEsYTsMCXbJfSYQZRk1k-I-PjUNGnKqO1IxMftsgA5U,51351
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
+sourcecode/caller_metrics.py,sha256=HG8RCOkpzzsEGdnMRob6byrwjoj5__t0TEsBj4yR7ks,2574
 sourcecode/canonical_ir.py,sha256=U69m8Vkr0p407xF1q5y1KguHXWEAubYw8NFHR9hDNJk,29178
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=YTTCoRdcLEFRVcql9Ow1dE7eYQj0jq2rgx32bRDnb1k,13852
-sourcecode/cli.py,sha256=PksGF5DiVcPU0SUHw0vKwQA-9w934ZMKCix1K4WX8Rs,289590
+sourcecode/cli.py,sha256=CKy6zdBfecnT6reYb749pLY4NqH1_Qy7c8DHnBWamrU,293593
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_graph.py,sha256=8MVDu06bPhvRDTgUqWEvRME2fOw34bFLf4OUILZd13I,43527
@@ -21,11 +22,12 @@ sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3a
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=iRzrJhs57UXrGvLhNPiTA-e_sdO6ka-wNqc0wIiegiM,2554
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
+sourcecode/endpoint_metrics.py,sha256=wkAonXe34ItHlvlGur3YRFUrcZfg6GdiiwiE4bMa21Y,2590
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
-sourcecode/explain.py,sha256=DyGRH7DXvtuioE1TF7kq8xwprrSSHRXErm840RJ9pIc,21055
+sourcecode/explain.py,sha256=bo4sy8qkEstIF3sIefECKRYJBK97C6cMjyzRa8USCdI,21189
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=A0fEABqtfVu1MfoaxnPAvGpZgneGgVXlJDhT74NYXxE,15314
 sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8,3466
@@ -40,7 +42,7 @@ sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7
 sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
+sourcecode/path_filters.py,sha256=T1y0SJsmUJBju2Hh_-z40kURAowUEq42FpPgWLbOaY0,6931
 sourcecode/pr_comment_renderer.py,sha256=KmcjMruhR44gjzMDJwjBSkWP9QEvh8xWBLyxzxoRbj0,14542
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=PYygAKL_jwz8gGElgM9mroUSih18UKSSjv08ndfl4aA,222877
@@ -50,7 +52,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=mMmEAcs5aTS-eHv48tVUQToLylONPRoBAsM_VM3mAmQ,281526
+sourcecode/repository_ir.py,sha256=3DONydNhy-UU1R_1l-caePlBiUlZxkk9X5h92VXsQ34,284195
 sourcecode/ris.py,sha256=aG2D4159gtpg968yD3PylYbIXhGFOwIlFBI0DSr84yY,20412
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -59,16 +61,16 @@ sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs
 sourcecode/security_posture.py,sha256=CAJw4oJD0aAW2yRewvd_fonkzi9_HpUjBZlIDZle00s,26034
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=HpgjenY6DLPHPomP7Hw850zA-EBokf1S4O2sh8NegdI,20351
-sourcecode/semantic_integration_engine.py,sha256=cUJFZaBfgzsYpj9hRa9CZjo3U9VSfIQV1k2SQYM5HZw,14524
+sourcecode/semantic_integration_engine.py,sha256=rxoCuP-uM_Y4-ELeBN0sz1a88e2eI1XTJDgsS57IOLI,15513
 sourcecode/semantic_services.py,sha256=AO_p7PRfjc-AUh6ThvLMfm4iUGi0issL_frCf8sxGlI,10637
-sourcecode/serializer.py,sha256=_3aLX3iFbHlqVDx_IlmOBQUI6QLPrL_XX2jxF6gL_No,129094
+sourcecode/serializer.py,sha256=FmQo7eojA_z3ptLW-Vgze5mrEJ6FabcZqiwbQWWTgFI,130056
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
 sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
-sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
-sourcecode/spring_tx_analyzer.py,sha256=iH9mK0Tgvhgy_Ee2r13KA_RMf8HKN-pjCKQGuyCCBjM,33812
+sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
+sourcecode/spring_tx_analyzer.py,sha256=QMXkxa_hrqDVN3D8WJsd0nT7vfdZCT1E8ZWNoFFbvgU,34692
 sourcecode/summarizer.py,sha256=ByfFxIGVRrGrf3paQPuDOg1rVj78LyzXN_EXBkfbCLU,23582
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
@@ -85,7 +87,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=xlp4mqd26QWJf3MWqmTbD0IND_VEVzPHlGaLC4MNXNA,39028
+sourcecode/detectors/java.py,sha256=rTeVIKIliElE1yPdIkll1pKqDUzXD1EFFJdXxp24gr4,41005
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ug9K31tyHqinmv0HkIVQVjdTZpBv67FYKAEf52YXOSM,3178
@@ -113,8 +115,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.1.0.dist-info/METADATA,sha256=YcJphSnTG4SGmAeb7R2XWhj4nIp4-1hazejT7QdPo9Y,10798
-sourcecode-2.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.1.0.dist-info/RECORD,,
+sourcecode-2.2.0.dist-info/METADATA,sha256=GWUjIL4RNPYx8cMKSRHxzELL49K0anIx6qH8aHAsB3I,10837
+sourcecode-2.2.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.2.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.2.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.2.0.dist-info/RECORD,,