sourcecode 2.1.0__py3-none-any.whl → 2.3.0__py3-none-any.whl

sourcecode/spring_semantic.py

@@ -122,9 +122,17 @@ class TransactionBoundary:
 class TransactionBoundaryIndex:
     """Index of all @Transactional boundaries in a repository."""
 
-    # FQN → boundary (both class-level and method-level)
+    # FQN → boundary (both class-level and method-level). Keyed by FQN for
+    # effective_boundary() call-graph lookups; OVERLOADED methods share an FQN
+    # (e.g. findAll() and findAll(Pageable) → Repo#findAll) so this dict collapses
+    # them — do NOT count from it (see all_declared / A1 field-validation fix).
     by_symbol: dict[str, TransactionBoundary] = field(default_factory=dict)
 
+    # Every declared @Transactional boundary, one entry per annotation site.
+    # Unlike by_symbol this does NOT collapse overloaded methods, so it is the
+    # authoritative source for counts/stats.
+    all_declared: list[TransactionBoundary] = field(default_factory=list)
+
     # class FQN → list of method-level boundaries declared on that class
     by_class: dict[str, list[TransactionBoundary]] = field(default_factory=dict)
 
@@ -152,17 +160,19 @@ class TransactionBoundaryIndex:
         return list(self.by_symbol.values())
 
     def stats(self) -> dict:
+        # Count from all_declared (one entry per annotation site) so overloaded
+        # @Transactional methods are not collapsed by the FQN-keyed by_symbol.
         n_class = len(self.class_level)
-        n_method = sum(1 for b in self.by_symbol.values() if b.scope == "method")
+        n_method = sum(1 for b in self.all_declared if b.scope == "method")
         propagations: dict[str, int] = {}
-        for b in self.by_symbol.values():
+        for b in self.all_declared:
             propagations[b.propagation] = propagations.get(b.propagation, 0) + 1
         return {
-            "total": len(self.by_symbol),
+            "total": len(self.all_declared),
             "class_level": n_class,
             "method_level": n_method,
             "propagations": propagations,
-            "read_only_count": sum(1 for b in self.by_symbol.values() if b.read_only),
+            "read_only_count": sum(1 for b in self.all_declared if b.read_only),
         }
 
 
@@ -353,6 +363,9 @@ def build_tx_index(cir: "CanonicalRepositoryIR") -> TransactionBoundaryIndex:
             boundary = _build_boundary(fqn, scope, raw_args, source_file, modifiers)
 
             index.by_symbol[fqn] = boundary
+            # Authoritative per-site list — overloaded methods share an FQN and would
+            # collapse in by_symbol; all_declared keeps one entry per annotation site.
+            index.all_declared.append(boundary)
 
             if scope == "class":
                 index.class_level[fqn] = boundary

sourcecode/spring_tx_analyzer.py

@@ -194,8 +194,12 @@ class _TX001ProxyBypass:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared (one entry per annotation site), not the
+        # FQN-keyed all_boundaries which collapses overloads — a public overload
+        # overwriting a private one would hide the proxy-bypass risk. Dedupe by
+        # finding id (symbol-keyed) so two risky overloads of the same FQN yield one.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.is_proxy_bypass_risk:
@@ -209,10 +213,14 @@ class _TX001ProxyBypass:
                 if problematic_modifier == "private"
                 else "Spring CGLIB proxy cannot override final methods"
             )
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
 
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,
@@ -550,8 +558,11 @@ class _TX005ExceptionSwallowing:
             return []
 
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared so a write overload that swallows is not
+        # hidden by a read_only overload of the same FQN winning the by_symbol slot
+        # (the read_only gate below would skip the whole FQN). Dedupe by finding id.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.source_file:
@@ -573,9 +584,13 @@ class _TX005ExceptionSwallowing:
             if not self._has_swallowed_exception(source, boundary.symbol):
                 continue
 
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,

{sourcecode-2.1.0.dist-info → sourcecode-2.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.1.0
+Version: 2.3.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -38,11 +38,11 @@ Description-Content-Type: text/markdown
 
 # ASK Engine
 
-> **Persistent structural intelligence for AI coding agents.**
+> **ASK — Actionable Software Knowledge.** Persistent structural intelligence for AI coding agents.
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-2.1.0-blue)
+![Version](https://img.shields.io/badge/version-2.3.0-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -84,7 +84,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 2.1.0
+ask version                    # ask 2.3.0
 ```
 
 > **Package vs. command.** The install package is named `sourcecode` this release

{sourcecode-2.1.0.dist-info → sourcecode-2.3.0.dist-info}/RECORD

@@ -1,14 +1,16 @@
-sourcecode/__init__.py,sha256=6IP6ug5fLqU_NKOIzfMwRs-jSKYDBb21TLg1tIzLWAk,308
+sourcecode/__init__.py,sha256=_9_i7ziVcM1wLhG9oULnIMnZhX9H1T1qmnmsiNwXBmg,308
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
+sourcecode/archetype.py,sha256=ezeyCR4E0VeZUUBPwmsWUUPAhIlqwwkc8qDieUx2JWA,31087
 sourcecode/architecture_analyzer.py,sha256=6_wC4TYuBYxaqckZS0I1vBSMRPeH2vzlDB48gXwOOd4,46627
-sourcecode/architecture_summary.py,sha256=UaxmUU77oTlWxttMU3c6PxHrU-Q6q5N31TeU_NWWTdU,24297
+sourcecode/architecture_summary.py,sha256=pkl6lIOnSy-poa9EzW43U0MkXhx2FDfAFh8pDXLpcTo,26630
 sourcecode/ast_extractor.py,sha256=FEsYTsMCXbJfSYQZRk1k-I-PjUNGnKqO1IxMftsgA5U,51351
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/call_surface.py,sha256=fiqYfHooxN1fX9oQoysq1LS3LoZcobhyUNjAGEZKpwk,4148
+sourcecode/caller_metrics.py,sha256=HG8RCOkpzzsEGdnMRob6byrwjoj5__t0TEsBj4yR7ks,2574
 sourcecode/canonical_ir.py,sha256=U69m8Vkr0p407xF1q5y1KguHXWEAubYw8NFHR9hDNJk,29178
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
-sourcecode/classifier.py,sha256=YTTCoRdcLEFRVcql9Ow1dE7eYQj0jq2rgx32bRDnb1k,13852
-sourcecode/cli.py,sha256=PksGF5DiVcPU0SUHw0vKwQA-9w934ZMKCix1K4WX8Rs,289590
+sourcecode/classifier.py,sha256=RhLMDR031FAiUcT3bsf2EL3KrFwl7KsWh_wXXR_Bumo,18729
+sourcecode/cli.py,sha256=rK4umQmgajbQwuwmhhm6q898X-xaniHuRpXbUnW1WUk,296904
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_graph.py,sha256=8MVDu06bPhvRDTgUqWEvRME2fOw34bFLf4OUILZd13I,43527
@@ -21,17 +23,19 @@ sourcecode/dependency_analyzer.py,sha256=fQCaWQ7_BNcVgZv8gweJCwJ1CGlXsz8nw_tqN3a
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=iRzrJhs57UXrGvLhNPiTA-e_sdO6ka-wNqc0wIiegiM,2554
 sourcecode/endpoint_literals.py,sha256=Qf4gTZzvNSFDGDuOvF0YRL9NvaYKKj24klhR5LIOaXc,3263
+sourcecode/endpoint_metrics.py,sha256=wkAonXe34ItHlvlGur3YRFUrcZfg6GdiiwiE4bMa21Y,2590
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
 sourcecode/evidence_provider.py,sha256=GSSL44JEaouO5AHks2sB3d1YvC9xIKIld1yBYxZpXxo,4277
-sourcecode/explain.py,sha256=DyGRH7DXvtuioE1TF7kq8xwprrSSHRXErm840RJ9pIc,21055
+sourcecode/explain.py,sha256=bo4sy8qkEstIF3sIefECKRYJBK97C6cMjyzRa8USCdI,21189
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=A0fEABqtfVu1MfoaxnPAvGpZgneGgVXlJDhT74NYXxE,15314
 sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8,3466
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=lp0eB1PWC20BYF-GpPhAyegRpKrUKgOmXZIcZSIX_Ks,65777
+sourcecode/graph_evidence.py,sha256=rENNsYRZeNstX_ExNCLlbHJAruFQwxo5d00x6wO3xwI,15030
 sourcecode/hibernate_strat.py,sha256=h0leIhlWvSjYq3F99LxvLIDLrJ-xPYxWAREG4LkqZ-4,61190
 sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=keFuwNxdAtvK2Ds91Wl79GMYxuxWYnN5Wbw1qBpaoUI,24896
@@ -40,7 +44,7 @@ sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7
 sourcecode/migrate_check.py,sha256=HJhvHuvXDGTJSRQU9_AMx0L94h2TImC1DCGs3m3RTu0,108199
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
+sourcecode/path_filters.py,sha256=T1y0SJsmUJBju2Hh_-z40kURAowUEq42FpPgWLbOaY0,6931
 sourcecode/pr_comment_renderer.py,sha256=KmcjMruhR44gjzMDJwjBSkWP9QEvh8xWBLyxzxoRbj0,14542
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=PYygAKL_jwz8gGElgM9mroUSih18UKSSjv08ndfl4aA,222877
@@ -50,7 +54,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=mMmEAcs5aTS-eHv48tVUQToLylONPRoBAsM_VM3mAmQ,281526
+sourcecode/repository_ir.py,sha256=3DONydNhy-UU1R_1l-caePlBiUlZxkk9X5h92VXsQ34,284195
 sourcecode/ris.py,sha256=aG2D4159gtpg968yD3PylYbIXhGFOwIlFBI0DSr84yY,20412
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -59,16 +63,16 @@ sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs
 sourcecode/security_posture.py,sha256=CAJw4oJD0aAW2yRewvd_fonkzi9_HpUjBZlIDZle00s,26034
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=HpgjenY6DLPHPomP7Hw850zA-EBokf1S4O2sh8NegdI,20351
-sourcecode/semantic_integration_engine.py,sha256=cUJFZaBfgzsYpj9hRa9CZjo3U9VSfIQV1k2SQYM5HZw,14524
+sourcecode/semantic_integration_engine.py,sha256=rxoCuP-uM_Y4-ELeBN0sz1a88e2eI1XTJDgsS57IOLI,15513
 sourcecode/semantic_services.py,sha256=AO_p7PRfjc-AUh6ThvLMfm4iUGi0issL_frCf8sxGlI,10637
-sourcecode/serializer.py,sha256=_3aLX3iFbHlqVDx_IlmOBQUI6QLPrL_XX2jxF6gL_No,129094
+sourcecode/serializer.py,sha256=FmQo7eojA_z3ptLW-Vgze5mrEJ6FabcZqiwbQWWTgFI,130056
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=EX7kLZLN74CFyR9iZPm3CI115BfFKNd4WRPuErNljZM,5729
 sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=Rk-aSohezdc7YDYbSoJquVnwpkDB8ty1BCD-4Hc4R5A,22832
-sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
-sourcecode/spring_tx_analyzer.py,sha256=iH9mK0Tgvhgy_Ee2r13KA_RMf8HKN-pjCKQGuyCCBjM,33812
+sourcecode/spring_semantic.py,sha256=jteQ1PkY9ArFJv0embg_jBIdbOxqrk9mQ2Xz8OF_FKA,14214
+sourcecode/spring_tx_analyzer.py,sha256=QMXkxa_hrqDVN3D8WJsd0nT7vfdZCT1E8ZWNoFFbvgU,34692
 sourcecode/summarizer.py,sha256=ByfFxIGVRrGrf3paQPuDOg1rVj78LyzXN_EXBkfbCLU,23582
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
@@ -85,7 +89,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=xlp4mqd26QWJf3MWqmTbD0IND_VEVzPHlGaLC4MNXNA,39028
+sourcecode/detectors/java.py,sha256=rTeVIKIliElE1yPdIkll1pKqDUzXD1EFFJdXxp24gr4,41005
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ug9K31tyHqinmv0HkIVQVjdTZpBv67FYKAEf52YXOSM,3178
@@ -113,8 +117,8 @@ sourcecode/telemetry/consent.py,sha256=LIAO9ohJZF8OuZwM4u1VWtALlYfTCCKq4wV3Vwc7i
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-2.1.0.dist-info/METADATA,sha256=YcJphSnTG4SGmAeb7R2XWhj4nIp4-1hazejT7QdPo9Y,10798
-sourcecode-2.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-2.1.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-2.1.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-2.1.0.dist-info/RECORD,,
+sourcecode-2.3.0.dist-info/METADATA,sha256=sOmWl4PHteHOjBgUxeKpVh6H6Hc2Yo-Zyrk3c62z1CE,10837
+sourcecode-2.3.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-2.3.0.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-2.3.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-2.3.0.dist-info/RECORD,,