sourcecode 5.5.2__py3-none-any.whl → 5.5.5__py3-none-any.whl

sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.2"
+__version__ = "5.5.5"

sourcecode/_docs/DEFECT-LEDGER.md

@@ -16,6 +16,21 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 
 ---
 
+## Audit synchronization
+
+| ID | Defect | Found | Severity | Status |
+|---|---|---|---|---|
+| AS-01 | `risk`/`enrich` could omit `sql_taint.bounded_interpolations`, making `sinks_total` impossible to audit against its bounded evidence. | 5.4.2 re-audit | Medium | **closed 5.4.2** — both projections preserve the bounded rows; the paired fixture asserts the sink total and the retained bounded interpolation. |
+| AS-02 | Route projection emitted declarations from abstract Spring controllers, creating phantom routes and inflating the unprotected census. | 5.4.2 re-audit | Low | **closed 5.4.2** — abstract declarers are excluded while concrete subtype projection remains admitted; the route-surface regression covers both sides. |
+| AS-03 | The distributed ledger could leave `C3-123` open after the 5.4.1 build already excluded static assets. | 5.4.2 re-audit | Informational | **closed 5.4.2** — the stale state was synchronized to the wheel it documents. |
+| AS-04 | An unconstrained `@RequestMapping` was described by consumers as GET although Spring admits every verb. | 5.5.1 audit | Medium | **closed 5.5.1** — primary `method` is `ANY`; 5.5.4 adds the concrete `methods` list so consumers do not need to infer its expansion. |
+| AS-05 | Test-source endpoint exclusion was neither visible nor reversible for modules whose test code lives below `src/main`. | 5.5.1 audit | High | **closed 5.5.3** — `--include-tests` changes admission and the production answer counts exclusions; 5.5.4 recovery adds the matched path basis. |
+| AS-06 | `@InitBinder` alone was treated as evidence of programmatic validation, contaminating gaps and confidence. | 5.5.1 audit | High | **closed 5.5.1** — only a Spring `Validator` implementation or `setValidator` wiring declares the limit; 5.5.4 recovery publishes that population separately from annotation validators. |
+| AS-07 | Nested types used as field types were reported statically unreferenced by modernization. | 5.5.1 audit | Medium | **closed 5.5.1** — field-type references contribute an incoming static edge. |
+| AS-08 | `spring-audit` severity census could sum to zero beside nonzero findings. | 5.5.4 re-audit | High | **closed 5.5.4** — severity partitions reconcile to `total_findings`; this is asserted in the audit battery. |
+
+---
+
 ## Class C1 — One fact, two authorities
 
 | ID | Defect | Found | Severity | Status |
@@ -35,7 +50,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C1-13 | **Hub-guard publishes `endpoints_total: 0` instead of `unknown`.** A service with 780 callers is capped at `depth=1` for cost — defensible — but reports 0 endpoints reached, contradicting the epistemic standard the tool imposes on itself everywhere else. Hubs are precisely where blast radius is asked for | 3.2.1 (eval #4) | Medium | **closed 3.6.0** — no battery repository crosses the guard (openmrs-core's largest hub, `Context`, has 215 caller classes against a threshold of 500), so it was reproduced on a generated fixture: `bfs_truncated: true`, `depth_reached: 1`, `endpoints_affected_count: 0` beside four more zeros nothing looked for. A reach-derived count of 0 under the cap is now `null`, named in `stats.unknown_under_cap`. The distinction is the point and is asserted both ways: a **non-zero** count under the cap stays a number (it is a floor the effect block already describes), and an **uncapped** run keeps its measured zero, because converting that would be the mirror-image defect. The hub threshold moved to module level so the fixture crosses the real guard instead of a copy of its value |
 | C1-14 | **File-count drift across commands**: 3 334 / 3 337 / 3 342 / 3 374 files for one repository in one session. No command is wrong in isolation; together they cost the one thing a deterministic tool cannot lose — that its numbers agree with themselves | 3.2.1 (eval #4) | Medium | **within-document half closed 3.6.0 · cross-command half does not reproduce.** Of six commands measured on openmrs-core (`--compact`, `endpoints`, `spring-audit`, `migrate-check`, `modernize`, `validation`) only `migrate-check` publishes a scanned-file count at all, so there are no two figures left to disagree. What does reproduce is the same defect *inside one document*: `affected_files` named two populations — 265 under `summary` (every finding, any scope) against 264 under `effort_breakdown` (blocking findings only). Both correct; the shared name was the contradiction. Same remedy as C1-5: the narrower becomes `blocking_affected_files`, both carry a `_basis`, the old key stays an alias, and the battery asserts the two diverge exactly when a finding is non-blocking |
 | C1-15 | **Analysis assumes a single destination.** Asked about a JDK move, `migrate-check` answers `headline_blocker: boot3_migration` and emits fix hints that send a developer to migrate namespaces they never planned to touch (481 `javax.persistence` under MIG-001). There is no way to say "JDK 11, keep Boot 2.7" | 3.2.1 (eval #4) | **High (product)** | **closed 3.6.0** — `--target-jdk N` and `--keep-boot` say which migration is being planned, filtered over the `migration_target` vocabulary every rule already carried rather than a parallel one. Measured on openmrs-core with `--target-jdk 11 --keep-boot`, the row's own acceptance: **MIG-001 85 → 0**, blocking 114 → 0, `headline_blocker` `hibernate_rewrite` → `none_applicable`, and the Hibernate 5→6 rewrite drops with it because Hibernate 6 arrives with Boot 3. Narrowing is not silencing: `metadata.route` publishes the target, the flag and every excluded axis, a `limitations` entry states how many findings were left out and that they are unresolved rather than fixed, and the route's own blockers stay (a JDK 11 route still reports MIG-021, asserted). The default is untouched, verified identical on three repositories |
-| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5) | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **closed 4.10.0** — the caller-axis unit fix closed in 3.5.0 (`caller_metrics.caller_classes`, unit-named figures, generated note, no `len(display_list)` in `compare`). The endpoint reach half then bound `impact`, `impact-chain` and `migrate-check --blast-radius` to `caller_reach`, crossing class→method keys and DI interface boundaries without admitting structural `implements`/`extends` edges as callers. The remaining asymmetry is now closed too: `impact` expands class/interface seeds to in-repo subtypes before BFS, using `ImplementationGraph` and a class-aware seed resolver so a base-class query reaches callers of subclass members the same way `impact-chain` does. Tests cover DI parity, endpoint count/list parity, caller-unit stability and the base-class subtype regression fixture |
+| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5), reopened 5.5.4 | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **reopened 5.5.4.** The DI and subtype fixtures remain closed, but the claimed one-authority implementation was false for service locators: `impact` kept a local BFS that elevated `Locator#accessor` to every caller of `Locator`, while `impact-chain` used `caller_reach` and did not. 5.5.4 recovery removes that elevation and adds a two-accessor regression fixture; authority unification and cross-command parity remain open as Q-03. |
 | C1-17 | **A fact with an authority still contradicts itself across two commands**: `--compact.analysis_gaps` says *"1 test file for 3 336 Java files"* while `review-pr.test_coverage_risk.repository_has_test_sources` says `false`, in the same repository. C1-2 was closed in 3.2.1 with five consumers rebound, and this evaluation ran **on 3.2.1** | 3.2.1 (eval #5) | Medium | **does not reproduce (measured 3.6.0)** — re-measured as the row instructed. On openmrs-core, keycloak and spring-petclinic neither statement is emitted, and both consumers reach one authority: `--compact` through `analyze_test_sources`, `review-pr` through `is_test_path`. What was missing is now asserted: the authority has **two entry points** and nothing held them to each other, which is exactly the shape a sixth consumer would take. Zero mismatches across a case table including the C1-2 discriminator (a `test` package inside a *main* source root is production code), plus the literal contradiction — "N test files" and "no test sources" — asserted unreachable in both directions |
 | C1-18 | **The profile population differs per command, and the narrower one is what an agent reads.** Field: `--agent` reports a two-name profile set while `prepare-context fix-bug` reports four for the same repository in the same session — and the two names missing from the agent payload are the ones the *build* names for its deployable artefacts. Every finding about conditional security is keyed on that set, so the default agent surface answers the profile question with the population that lost the environments | 3.5.0 (eval #6) | **High** — it is the input to the one capability nothing else in the market has | **closed (unreleased)** — **fixture first, as C1-10 required**, and it reproduced worse than reported: on `tests/fixtures/spring_profile_population` the same repository in one session answered **`["qa","dev"]`** (default view — filenames + overlay directories), **`["dev","prod","staging"]`** (`posture` — config documents + `@Profile`) and **`["dev","prod","qa","staging"]`** (`--agent` / `fix-bug`, the union). Three populations under one name; every conditional-security finding is keyed on it. Authority `spring_profiles.profile_population`: four named signals (`file_naming`, `overlay_directory`, `config_documents`, `annotations`, plus `caller_supplied`), the union, and `by_signal` published so a name's provenance is auditable. The stack detector, `posture` and the serializer section all read it — asserted per surface, not claimed. Closing it exposed two false positives in the signals it inherited, both fixed structurally (never by name — VAI): an `application-{x}` file counts only **beside its base config** (alfresco's `alfresco/messages/application-model_de.properties` + 19 siblings invented twenty environments; now 0) and an overlay directory counts only when it **holds a config file** (spring-petclinic's `db/ messages/ static/ templates/` reported four; now `mysql, postgres`, which are its real profiles) |
 | C1-19 | **File-count drift across commands, with witnesses this time.** 3 337 (`compact.project_summary`) / 3 336 (`analysis_gaps.testing`) / 3 342 (`migrate-check.metadata.java_files_scanned`) for one repository in one session | 3.8.0 (eval #7) | Medium | **closed 3.9.0** — measured, not equalised: the three figures count code-extension files in any language, the non-test denominator of a test ratio, and the .java files handed to the migration rules. Each names its population now, and `migrate-check.files_scanned_basis` states the two it is not. Original note: open — **C1-14's cross-command half, reopened.** 3.6.0 recorded that half as *not reproducing* because on openmrs-core only `migrate-check` published a scanned-file count at all; eval #7 shows three commands publishing one on a repository we do not have. Three populations are plausible and each may be right in isolation (all Java files / files admitted to the graph / files the migration rules scanned), which is exactly the C1-5 remedy: name the unit per figure, or bind them to one authority. Do not fix by making the numbers equal — measure which population each counts first |

sourcecode/_docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.2
+# ask 5.5.5
 ```
 
 Requires Python 3.9+.
@@ -261,7 +261,13 @@ ask endpoints /path/to/repo
 ask endpoints . --format yaml
 ```
 
-Output: list of `{method, path, controller, handler}`. Covers `@GetMapping`, `@PostMapping`, `@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`, `@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
+Output: list of `{method, methods, path, controller, handler}`. `method` remains
+the backwards-compatible primary verb; `methods` is the complete declared set.
+An unconstrained `@RequestMapping` reports `method: "ANY"` and
+`methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]`, because it accepts all
+of those verbs rather than defaulting to GET. Covers `@GetMapping`, `@PostMapping`,
+`@PutMapping`, `@DeleteMapping`, `@PatchMapping`, `@RequestMapping`, `@GET`,
+`@POST`, `@PUT`, `@DELETE`, `@PATCH` + `@Path`.
 
 Each endpoint carries a `security` policy. Standard annotations (`@PreAuthorize`, `@Secured`, `@RolesAllowed`, …) are recognized automatically; a custom authorization annotation reports `policy: "none_detected"` until declared in a `sourcecode.config.json` at the repo root:
 

sourcecode/cli.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import contextlib
+import errno
 import hashlib
 import json
 import difflib
@@ -1196,6 +1197,15 @@ def _safe_write_file(path: "Path", content: str) -> None:
             fh.flush()
             os.fsync(fh.fileno())
         tmp.replace(path)
+        # Atomic replacement alone does not prove that the destination is the
+        # requested artifact. Verify the postcondition before reporting a run
+        # output path, especially for non-empty JSON reports.
+        if not path.is_file() or (content and path.stat().st_size == 0):
+            raise OSError(
+                errno.EIO,
+                "atomic output replacement did not produce the requested file",
+                str(path),
+            )
         try:
             dir_fd = os.open(str(path.parent), os.O_RDONLY)
             try:
@@ -2071,6 +2081,14 @@ def _resolve_files_option(
 
     raw = str(files).replace(_text_input.BOM_CHAR, "").strip()
     if raw == "-":
+        if sys.stdin.isatty():
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                "--files - reads the file list from stdin, but stdin is a terminal.",
+                hint=f"Pipe the list: git diff --name-only main | ask {command} . --files -",
+                expected="Piped stdin, a list file, or a comma-separated file list.",
+            )
+            raise typer.Exit(code=1)
         return _text_input.parse_path_lines(_text_input.read_stdin_text()), "stdin"
     as_path = Path(raw)
     if as_path.is_file():
@@ -8857,7 +8875,8 @@ def spring_audit_cmd(
         help=(
             "Bounded summary: caps `findings` and the per-endpoint security projection "
             "to their top 5, most-severe first. Every count is still measured over the "
-            "whole population. The full report can exceed 1 MB on a monolith."
+            "whole population. Stdout also switches to this form only when the full "
+            "JSON exceeds its 50 KB budget; use --output for the complete report."
         ),
     ),
     table: bool = typer.Option(
@@ -9194,17 +9213,19 @@ def spring_audit_cmd(
                         "phase that never ran is not evidence there is none."
                     )
 
+            _full_data = combined.to_dict()
             _bounded_default = (
                 not compact and output_path is None and format == "json" and not table
+                and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
             )
-            data = (
-                combined.to_compact_dict()
-                if compact or _bounded_default
-                else combined.to_dict()
-            )
+            data = combined.to_compact_dict() if compact or _bounded_default else _full_data
             if _bounded_default:
                 data.pop("mode", None)
                 data["default_output"] = "bounded"
+                data.pop("compact_note", None)
+                data["stdout_budget_note"] = (
+                    "Capped by the stdout payload budget; use --output <file> for the complete report."
+                )
             data.setdefault("metadata", {})["cache_layers"] = _cache_state
             if _stopped_early:
                 # C3-87: the block is composed by `PhasedRun.status`, which is the
@@ -9239,7 +9260,19 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
-        data = combined.to_compact_dict() if compact else combined.to_dict()
+        _full_data = combined.to_dict()
+        _bounded_default = (
+            not compact and output_path is None and format == "json" and not table
+            and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
+        )
+        data = combined.to_compact_dict() if compact or _bounded_default else _full_data
+        if _bounded_default:
+            data.pop("mode", None)
+            data["default_output"] = "bounded"
+            data.pop("compact_note", None)
+            data["stdout_budget_note"] = (
+                "Capped by the stdout payload budget; use --output <file> for the complete report."
+            )
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -12850,7 +12883,8 @@ def config_cmd(
         _answer.say(f"Declaration: none at {_declaration_path}")
         _answer.say(
             "  Nothing is declared, so `data-exposure` answers "
-            "`answered: false` and no custom security annotation is recognised."
+            "`answered: false`. Custom security annotations may still be inferred "
+            "from usage with Likely confidence; declare them to make that policy Declared."
         )
     else:
         _answer.say(f"Declaration: {_declaration_path}")

sourcecode/deployment_prefix.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any, Iterable, Optional
 
 # Published Spring Boot property keys (DATA — never a predicate on a repo name).
 _CONTEXT_PATH_KEYS: tuple[str, ...] = (
@@ -163,25 +163,31 @@ def _profile_of_document(flat: "dict[str, str]", file_profile: Optional[str]) ->
     return file_profile
 
 
-def _config_files(root: Path) -> "list[Path]":
+def _config_files(root: Path, files: Optional[Iterable[Path]] = None) -> "list[Path]":
     """Spring config files under conventional resource directories.
 
     Bounded and sorted for determinism; test resources are excluded because a
     prefix declared for tests is not the deployed one.
     """
+    candidates = files if files is not None else root.rglob("application*.*")
     found: list[Path] = []
-    for pattern in ("**/src/main/resources/**/application*.*", "**/config/application*.*"):
-        for path in root.glob(pattern):
-            name = path.name
-            if name in _CONFIG_BASENAMES or _PROFILE_FILE_RE.match(name):
-                text = str(path).replace("\\", "/")
-                if "/src/test/" in text or "/target/" in text:
-                    continue
-                found.append(path)
+    for path in candidates:
+        path = Path(path)
+        name = path.name
+        if name not in _CONFIG_BASENAMES and not _PROFILE_FILE_RE.match(name):
+            continue
+        text = str(path).replace("\\", "/")
+        in_resources = "/src/main/resources/" in text
+        in_config = "/config/" in text
+        if not (in_resources or in_config) or "/src/test/" in text or "/target/" in text:
+            continue
+        found.append(path)
     return sorted(set(found))[:60]
 
 
-def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
+def detect_deployment_prefix(
+    root: Path, *, files: Optional[Iterable[Path]] = None
+) -> DeploymentPrefix:
     """Read the deployment prefix from the repo's Spring configuration.
 
     Best effort and never raises: an unreadable or malformed config yields an
@@ -190,7 +196,7 @@ def detect_deployment_prefix(root: Path) -> DeploymentPrefix:
     """
     result = DeploymentPrefix()
     try:
-        candidates = _config_files(Path(root))
+        candidates = _config_files(Path(root), files)
     except Exception:
         return result
 

sourcecode/repository_ir.py

@@ -3772,17 +3772,40 @@ def _route_path_expression(args_str: str, constants: "Optional[dict[str, str]]")
     return args_str.strip()
 
 
-def _parse_route_http_method(ann_name: str, args_str: str) -> str:
-    """Derive HTTP method from annotation name or explicit method= arg."""
+_ANY_HTTP_METHODS = ("GET", "POST", "PUT", "DELETE", "PATCH")
+
+
+def _parse_route_http_methods(ann_name: str, args_str: str) -> tuple[str, ...]:
+    """Derive every declared HTTP method, preserving annotation order."""
     explicit = _HTTP_METHOD_MAP.get(ann_name)
     if explicit:
-        return explicit
-    m = re.search(r'method\s*=\s*(?:RequestMethod\.)?(\w+)', args_str or "")
+        return (explicit,)
+    # Spring accepts both `method=RequestMethod.GET` and the array spelling
+    # `method={RequestMethod.GET, RequestMethod.POST}`. The old expression
+    # expected the token immediately after `=`, so the braces form fell through
+    # to ANY and overstated the reachable verb surface.
+    m = re.search(
+        r'\bmethod\s*=\s*\{?\s*((?:RequestMethod\.)?\w+(?:\s*,\s*(?:RequestMethod\.)?\w+)*)',
+        args_str or "",
+    )
     if m:
-        return m.group(1).upper()
+        methods = re.findall(r'(?:RequestMethod\.)?(\w+)', m.group(1))
+        if methods:
+            return tuple(dict.fromkeys(method.upper() for method in methods))
     if ann_name == "@RequestMapping":
-        return "ANY"
-    return ""
+        return ("ANY",)
+    return ()
+
+
+def _parse_route_http_method(ann_name: str, args_str: str) -> str:
+    """Backward-compatible primary HTTP method for a route."""
+    methods = _parse_route_http_methods(ann_name, args_str)
+    return methods[0] if methods else ""
+
+
+def _published_http_methods(method: str) -> list[str]:
+    """Concrete verbs a consumer must consider for a route's method label."""
+    return list(_ANY_HTTP_METHODS if method == "ANY" else (method,))
 
 
 def _parse_route_extras(args_str: str) -> dict:
@@ -5014,7 +5037,8 @@ def _build_route_surface(
             _suffix_expr = _route_path_expression(args, constants)
             effective_prefixes = class_info.get(cls_simple, {}).get("prefixes", [""])
 
-        method = _parse_route_http_method(ann_name, args) or "GET"
+        route_methods = _parse_route_http_methods(ann_name, args) or ("GET",)
+        method = route_methods[0]
 
         if cls_simple in class_info:
             class_info[cls_simple]["own_endpoints"].append(
@@ -5070,6 +5094,7 @@ def _build_route_surface(
                     "effective_class": cls_fqn,
                     "path": full_path,
                     "method": method,
+                    "methods": _published_http_methods(method) if method == "ANY" else list(route_methods),
                     "return_type": (sym.return_type.strip() if sym.return_type else "void"),
                     "stable_id": sym.stable_id,
                     "inheritance_depth": 0,
@@ -5175,6 +5200,7 @@ def _build_route_surface(
                                     "effective_class": data["fqn"],
                                     "path": full_path,
                                     "method": verb,
+                                    "methods": _published_http_methods(verb),
                                     "return_type": _parent_rt_by_sym.get(declaring_sym, "void"),
                                     "stable_id": stable_id,
                                     "inheritance_depth": depth,
@@ -6415,6 +6441,37 @@ def extract_java_endpoints(
         and "target/" not in str(p).replace("\\", "/")
         and not any(f in str(p).replace("\\", "/") for f in _CLIENT_PATH_FRAGMENTS)
     )
+    # `endpoints` needs XML both for Spring Security and WebScript detection.
+    # One inventory avoids seven name-specific walks plus a later desc.xml walk.
+    _xml_files = sorted(root.rglob("*.xml"))
+    # Deployment-prefix resolution formerly ran two independent `root.glob()`
+    # calls. One candidate list keeps that work bounded and reusable below.
+    _config_files = sorted(root.rglob("application*.*"))
+    _excluded_test_source_routes = 0
+    _excluded_test_patterns: set[str] = set()
+    if not include_tests:
+        _route_marker = _re.compile(
+            r"@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping|RequestMapping|GET|POST|PUT|DELETE|PATCH|Path)\b"
+        )
+        for _candidate in root.rglob("*.java"):
+            _candidate_rel = _rel(_candidate)
+            if not is_test_source_file(_candidate_rel):
+                continue
+            _candidate_parts = _candidate_rel.lower().split("/")
+            if "test-suite" in _candidate_parts:
+                _excluded_test_patterns.add("test-suite/")
+            elif "src/test/" in _candidate_rel.lower():
+                _excluded_test_patterns.add("src/test/")
+            elif "src/it/" in _candidate_rel.lower():
+                _excluded_test_patterns.add("src/it/")
+            else:
+                _excluded_test_patterns.add("test-source classification")
+            try:
+                _excluded_test_source_routes += len(
+                    _route_marker.findall(_candidate.read_text(encoding="utf-8", errors="replace"))
+                )
+            except OSError:
+                continue
 
     all_symbols: list[SymbolRecord] = []
     extends_map: dict[str, str] = {}
@@ -6620,6 +6677,7 @@ def extract_java_endpoints(
 
         entry: dict = {
             "method": route["method"],
+            "methods": route.get("methods", _published_http_methods(route["method"])),
             "path": route["path"],
             "controller": controller,
             # Two controllers can share a simple name across packages: keycloak
@@ -6776,23 +6834,23 @@ def extract_java_endpoints(
         re.IGNORECASE,
     )
     _xml_security_detected = False
-    _XML_GLOBS = (
-        "*security*.xml", "*Security*.xml",
-        "*applicationContext*.xml", "*-context.xml", "*Context.xml",
-        "*spring*.xml", "*Spring*.xml",
-    )
-    for _glob in _XML_GLOBS:
-        for _xf in root.rglob(_glob):
-            if "target/" in str(_xf).replace("\\", "/"):
-                continue
-            try:
-                _xt = _xf.read_text(encoding="utf-8", errors="replace")
-            except OSError:
-                continue
-            if _XML_SECURITY_RE.search(_xt):
-                _xml_security_detected = True
-                break
-        if _xml_security_detected:
+    for _xf in _xml_files:
+        _xml_name = _xf.name.lower()
+        if not (
+            "security" in _xml_name
+            or "spring" in _xml_name
+            or _xml_name.endswith("-context.xml")
+            or _xml_name.endswith("context.xml")
+        ):
+            continue
+        if "target/" in str(_xf).replace("\\", "/"):
+            continue
+        try:
+            _xt = _xf.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _XML_SECURITY_RE.search(_xt):
+            _xml_security_detected = True
             break
 
     if _xml_security_detected:
@@ -6892,7 +6950,7 @@ def extract_java_endpoints(
     try:
         from sourcecode.deployment_prefix import detect_deployment_prefix
 
-        _prefix = detect_deployment_prefix(root)
+        _prefix = detect_deployment_prefix(root, files=_config_files)
         if _prefix.sources:
             result["deployment_prefix"] = _prefix.to_dict()
         if _prefix.prefix:
@@ -6912,6 +6970,17 @@ def extract_java_endpoints(
         )
     elif _test_util_endpoints:
         result["test_util_included"] = len(_test_util_endpoints)
+    if _excluded_test_source_routes:
+        result["test_source_excluded"] = _excluded_test_source_routes
+        result["test_source_excluded_detail"] = {
+            "count": _excluded_test_source_routes,
+            "patterns_matched": sorted(_excluded_test_patterns),
+            "basis": "path classification; use --include-tests to include these routes",
+        }
+        result.setdefault("notes", []).append(
+            f"{_excluded_test_source_routes} route annotation(s) from test source trees "
+            "were excluded; use --include-tests to include them."
+        )
     # Surface incomplete-endpoint warnings (interface-defined controllers) only when
     # present, to keep output backward-compatible for the common case.
     if endpoint_warnings:
@@ -6949,7 +7018,9 @@ def extract_java_endpoints(
     # (*.desc.xml: <url>/<authentication>/<transaction>) in addition to the Java
     # signals gathered above.
     _webscript_descriptors = 0
-    for _df in root.rglob("*.desc.xml"):
+    for _df in _xml_files:
+        if not _df.name.endswith(".desc.xml"):
+            continue
         if "target/" in str(_df).replace("\\", "/"):
             continue
         try:
@@ -6977,7 +7048,7 @@ def extract_java_endpoints(
         from sourcecode.servlet_surface import build_servlet_surface
 
         _nonspring["servlets"] = int(
-            build_servlet_surface(root).get("declarations", 0)
+            build_servlet_surface(root, files=[*java_files, *_xml_files]).get("declarations", 0)
         )
     except Exception:
         pass
@@ -7131,6 +7202,10 @@ _DISPLAY_INDIRECT_CALLERS = 50
 HUB_CALLER_THRESHOLD = 500
 HUB_SAMPLE_SIZE = 20
 HUB_SAMPLE_DEPTH = 2
+# A frontier is a hub for this query when it materially exceeds the target's
+# own fan-in, even if it does not reach the global safety cap above.
+HUB_RELATIVE_FANIN_MULTIPLIER = 3
+HUB_RELATIVE_FANIN_FLOOR = 20
 
 
 def _symbol_listing_advice(root: "Optional[Path]") -> str:
@@ -7283,21 +7358,15 @@ def compute_blast_radius(
     _rg_index = _class_method_index(reverse_graph)
 
     def _walk_callers(_node: str) -> list[str]:
-        """Expand method frontiers through their owning class as well.
+        """Return the one-authority caller set for this exact frontier node.
 
-        Service-locator accessors enter the frontier as ``Class#accessor`` while
-        callers of the class are indexed under its method keys. Keeping the
-        exact lookup preserves method-level reach; adding the enclosing class
-        lookup prevents that frontier from becoming a false terminal node.
+        `caller_reach` expands class nodes through their method keys, which is
+        required for DI-normalized class frontiers. It deliberately does not
+        invert that containment for a method: callers of `Locator#getA` are a
+        subset of callers of `Locator`, and adding the latter leaks users of
+        every other locator accessor into the blast cone.
         """
-        candidates = list(_all_callers_from_rg(
-            _node, reverse_graph, _rg_index, _impl_graph
-        ))
-        if "#" in _node:
-            candidates.extend(_all_callers_from_rg(
-                _enclosing_class(_node), reverse_graph, _rg_index, _impl_graph
-            ))
-        return list(dict.fromkeys(candidates))
+        return _all_callers_from_rg(_node, reverse_graph, _rg_index, _impl_graph)
     # Callers inject the interface, not the implementation, so a walk that does not
     # know the implements relation stops one hop short of every DI consumer. Without
     # it this traversal reached 200 classes and **no controller at all** for
@@ -7417,6 +7486,26 @@ def compute_blast_radius(
                         if _effective_depth > 1:
                             queue.append((c, 1))
 
+    # A locator accessor can be a narrow method frontier on a broad class hub.
+    # Measure the owner only to classify that frontier, never to expand it: the
+    # latter would merge callers of unrelated accessors (Q-01).
+    _seed_fan_in = max(1, len(set(direct_callers)))
+    _hub_frontier_cutoff = max(
+        HUB_RELATIVE_FANIN_FLOOR,
+        _seed_fan_in * HUB_RELATIVE_FANIN_MULTIPLIER,
+    )
+
+    def _is_hub_frontier(_node: str) -> bool:
+        _fan_in = len(_walk_callers(_node))
+        if "#" in _node:
+            _fan_in = max(
+                _fan_in,
+                len(_all_callers_from_rg(
+                    _enclosing_class(_node), reverse_graph, _rg_index, _impl_graph
+                )),
+            )
+        return _fan_in > _hub_frontier_cutoff
+
     # BFS for indirect callers
     indirect_callers: list[str] = []
     _indirect_parent: dict[str, str] = {}
@@ -7428,7 +7517,7 @@ def compute_blast_radius(
         if depth >= _effective_depth:
             continue
         _node_callers = _walk_callers(node)
-        if len(_node_callers) > _HUB_CALLER_THRESHOLD:
+        if _is_hub_frontier(node):
             _hub_frontier_nodes.add(node)
         for caller in _node_callers:
             if caller not in visited:
@@ -7679,7 +7768,7 @@ def compute_blast_radius(
         if _depth >= _effective_depth:
             continue
         _next = _walk_callers(_node)
-        if len(_next) > _HUB_CALLER_THRESHOLD:
+        if _is_hub_frontier(_node):
             continue
         for _caller in _next:
             if _caller not in _without_hubs_seen:
@@ -7853,6 +7942,10 @@ def compute_blast_radius(
     _indirect_summary = (
         _indirect_ordered if _indirect_cap is None else _indirect_ordered[:_indirect_cap]
     )
+    _indirect_by_depth: dict[str, int] = {}
+    for _node in indirect_callers:
+        _depth_key = str(all_affected.get(_node, 0))
+        _indirect_by_depth[_depth_key] = _indirect_by_depth.get(_depth_key, 0) + 1
     def _via_hub(_node: str) -> bool:
         _seen_path: set[str] = set()
         _cursor = _node
@@ -7914,6 +8007,9 @@ def compute_blast_radius(
         ),
         "indirect_callers": _indirect_summary,
         "indirect_caller_details": _indirect_details,
+        "indirect_callers_unit": "reference symbols (methods or classes)",
+        "indirect_callers_by_depth": _indirect_by_depth,
+        "indirect_callers_without_hubs": _without_hubs,
         "container_wired": [w.to_dict() for w in _container_wired],
         "endpoints_affected": endpoints_affected,
         "mappers_affected": mappers_affected,

sourcecode/security_config_scan.py

@@ -276,7 +276,13 @@ def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":
                 ))
                 break  # one observation per algorithm per file
         for encoder in _DEPRECATED_ENCODERS:
-            m = re.search(re.escape(encoder), source)
+            # An import only makes the type available; it is not evidence that
+            # a password encoder is used. Require construction or the legacy
+            # factory call so the witness opens on a remediation site.
+            m = re.search(
+                rf"(?:new\s+{re.escape(encoder)}\b|{re.escape(encoder)}\s*\.\s*getInstance\s*\()",
+                source,
+            )
             if m:
                 out.append(SecurityConfigObservation(
                     rule="SEC-004",

sourcecode/servlet_surface.py

@@ -20,10 +20,11 @@ So the answer is a second, named population beside the first, with its own total
 
 from __future__ import annotations
 
+import os
 import re
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Optional
+from typing import Iterable, Optional
 from xml.etree import ElementTree as ET
 
 POPULATION = "servlet"
@@ -82,11 +83,12 @@ def _child_text(elem: "ET.Element", name: str) -> str:
     return ""
 
 
-def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
+def _from_web_xml(xml_path: Path, relative: str) -> "tuple[list[ServletMapping], int]":
     try:
-        root = ET.parse(str(xml_path)).getroot()
+        text = xml_path.read_text(encoding="utf-8", errors="replace")
+        root = ET.fromstring(text)
     except Exception:
-        return []
+        return [], 0
     classes: "dict[str, str]" = {}
     for elem in root.iter():
         if _local(elem.tag) != "servlet":
@@ -96,10 +98,17 @@ def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
         if name:
             classes[name] = klass
     out: "list[ServletMapping]" = []
+    undeclared_servlet_mappings = 0
     for elem in root.iter():
         if _local(elem.tag) != "servlet-mapping":
             continue
         name = _child_text(elem, "servlet-name")
+        if not name or name not in classes:
+            undeclared_servlet_mappings += sum(
+                1 for child in elem.iter()
+                if _local(child.tag) == "url-pattern" and (child.text or "").strip()
+            )
+            continue
         for child in elem.iter():
             if _local(child.tag) != "url-pattern" or not (child.text or "").strip():
                 continue
@@ -110,7 +119,31 @@ def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
                 source_file=relative,
                 source="web.xml",
             ))
-    return out
+    # Keep a tolerant lexical fallback for descriptors containing legacy XML
+    # constructs that ElementTree rejects or partially normalizes. Comments are
+    # removed first so commented deployment examples never become live routes.
+    try:
+        active = re.sub(r"<!--.*?-->", "", text, flags=re.DOTALL)
+        for block in re.findall(r"<servlet-mapping\b[^>]*>(.*?)</servlet-mapping>", active, re.DOTALL | re.IGNORECASE):
+            name_match = re.search(r"<servlet-name\b[^>]*>\s*([^<]+?)\s*</servlet-name>", block, re.DOTALL | re.IGNORECASE)
+            pattern_match = re.search(r"<url-pattern\b[^>]*>\s*([^<]+?)\s*</url-pattern>", block, re.DOTALL | re.IGNORECASE)
+            if not pattern_match:
+                continue
+            servlet_name = name_match.group(1).strip() if name_match else ""
+            if not servlet_name or servlet_name not in classes:
+                continue
+            candidate = ServletMapping(
+                url_pattern=pattern_match.group(1).strip(),
+                servlet_name=servlet_name,
+                servlet_class=classes[servlet_name],
+                source_file=relative,
+                source="web.xml",
+            )
+            if candidate not in out:
+                out.append(candidate)
+    except Exception:
+        pass
+    return out, undeclared_servlet_mappings
 
 
 def _from_registration_beans(java_path: Path, relative: str) -> "list[ServletMapping]":
@@ -144,14 +177,37 @@ def _from_registration_beans(java_path: Path, relative: str) -> "list[ServletMap
     return out
 
 
-def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
+def build_servlet_surface(
+    root: Path,
+    *,
+    limit: Optional[int] = None,
+    files: Optional[Iterable[Path]] = None,
+) -> dict:
     """Every servlet-mapped URL pattern under `root`, as a population of its own."""
     from sourcecode import non_coverage
 
     root = Path(root)
     mappings: "list[ServletMapping]" = []
-    for path in sorted(root.rglob("*")):
-        if any(part in _SKIP_DIRS for part in path.parts) or not path.is_file():
+    undeclared_servlet_mappings = 0
+    if files is None:
+        candidates: list[Path] = []
+        for directory, dirs, names in os.walk(root):
+            dirs[:] = sorted(name for name in dirs if name not in _SKIP_DIRS)
+            candidates.extend(
+                Path(directory) / name
+                for name in sorted(names)
+                if name == "web.xml" or name.endswith(".java")
+            )
+    else:
+        candidates = sorted(
+            {
+                Path(path)
+                for path in files
+                if Path(path).name == "web.xml" or Path(path).suffix == ".java"
+            }
+        )
+    for path in candidates:
+        if not path.is_file():
             continue
         try:
             # POSIX, like every other path this CLI publishes. C2-18 fixed this
@@ -164,7 +220,9 @@ def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
         except ValueError:
             relative = Path(path).as_posix()
         if path.name == "web.xml":
-            mappings.extend(_from_web_xml(path, relative))
+            parsed, omitted = _from_web_xml(path, relative)
+            mappings.extend(parsed)
+            undeclared_servlet_mappings += omitted
         elif path.suffix == ".java":
             mappings.extend(_from_registration_beans(path, relative))
 
@@ -176,6 +234,7 @@ def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
     _unique: dict[str, ServletMapping] = {}
     for mapping in sorted(mappings, key=lambda m: (m.url_pattern, m.source_file, m.source)):
         _unique.setdefault(mapping.url_pattern, mapping)
+    declared_mappings = list(mappings)
     mappings = list(_unique.values())
     patterns = sorted(_unique)
     by_source: "dict[str, int]" = {}
@@ -187,15 +246,25 @@ def build_servlet_surface(root: Path, *, limit: Optional[int] = None) -> dict:
     )]
     shown = rows if limit is None else rows[:limit]
 
+    display_omitted = len(rows) - len(shown)
+    omitted_total = undeclared_servlet_mappings + display_omitted
+    omitted_by_reason: dict[str, int] = {}
+    if undeclared_servlet_mappings:
+        omitted_by_reason["servlet_not_declared"] = undeclared_servlet_mappings
+    if display_omitted:
+        omitted_by_reason["display_limit"] = display_omitted
+
     return {
         "schema_version": SCHEMA_VERSION,
         "population_key": POPULATION,
         "total_url_patterns": len(patterns),
-        "declarations": len(mappings),
+        "declarations": len(declared_mappings),
+        "declarations_unit": "live servlet-mapping declarations before URL-pattern deduplication",
         "by_source": dict(sorted(by_source.items())),
         "url_patterns": patterns,
         "mappings": shown,
-        "mappings_omitted": len(rows) - len(shown),
+        "mappings_omitted": omitted_total,
+        "mappings_omitted_by_reason": omitted_by_reason,
         "population": (
             "servlet mappings declared in `web.xml` or registered as a "
             "`ServletRegistrationBean` — HTTP surface that is NOT a Spring handler "

sourcecode/validation_surface.py

@@ -614,7 +614,16 @@ def build_validation_surface(
         "summary": {
             "endpoints_with_body": len(out_endpoints),
             "validated_fields": total_validated_fields,
+            # This catalog contains annotation-based ConstraintValidator types.
+            # Spring Validator wiring is detected separately below and must not
+            # be read as zero just because it belongs to another population.
             "custom_validators_declared": len(custom_list),
+            "custom_validators_declared_unit": "annotation-based ConstraintValidator declarations",
+            "programmatic_validators_declared": len(programmatic_evidence),
+            "programmatic_validators_declared_unit": (
+                "detected org.springframework.validation.Validator implementations "
+                "or setValidator wiring; rules are not modeled per endpoint"
+            ),
             "custom_validators_linked": len(custom_used),
             "gaps": len(gaps),
         },

{sourcecode-5.5.2.dist-info → sourcecode-5.5.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.2
+Version: 5.5.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.2-blue)
+![Version](https://img.shields.io/badge/version-5.5.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.2 — and, on a build that has aged,
+ask version                    # ask 5.5.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.2.dist-info → sourcecode-5.5.5.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=N8caEJv8V-c5M8fb_R3zr9u-Fd7axm-yB4yw-d_rbf0,308
+sourcecode/__init__.py,sha256=LWoy6uySGMfIcuMSAGcCF4LHEF2d_DbNo4PrVl8kous,308
 sourcecode/adaptive_scanner.py,sha256=yJBKjNpkY6bpueYJ2YnRezen3sYZDecEt7WaaNWdqug,9466
 sourcecode/archetype.py,sha256=CZvRLpkHot_D8D3JFQVorr-EHDJyh0BbS7RnSTqBigM,40499
 sourcecode/architectural_baseline.py,sha256=4GiMVBLJVHvRKSWQGf2ZVurI1-R0qk5pmaevgvGSgVA,26325
@@ -19,7 +19,7 @@ sourcecode/chain_rules.py,sha256=Bi6UHfgd-GxWswmnHRcPz5jdbAuqka3Zkz_P-MTvqhw,127
 sourcecode/change_plan.py,sha256=aX1mp2XnlDN-8R2BcTiu8HlkDwQ_4fN1ZLckj0VMXHM,9945
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
 sourcecode/classifier.py,sha256=JBzPwSSrDG-tUHAbcKB678HRbjLpD-ohzbzzO62mgpo,20114
-sourcecode/cli.py,sha256=hJukwL8ZTc1ZHVkkZWau9J0LFYtAfyHvVdp4HKIRWIY,648972
+sourcecode/cli.py,sha256=Lq6Kbunzj01R5pbcDbrF8lMslaTpc4JbrLyVozCsstA,650907
 sourcecode/client_calls.py,sha256=5_sBfFVXi6RgGiyWrlJKH4x4EF21do6gKlAOuFCKAoA,17709
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/compare.py,sha256=2GdDy0qkDSgmkkpgvoCHitoLj3mt30EeFgJ8PGEXJng,14712
@@ -42,7 +42,7 @@ sourcecode/declarations.py,sha256=Jr7oJDg004sFw0TvJySNVggXFT2jB6hQgbeQK2qreVo,70
 sourcecode/defect_identity.py,sha256=XS2VFDImg9NLaRImybKTeyk-CoDSsXmchldg0dwvM7c,7028
 sourcecode/degradation.py,sha256=BtuGUKFgkzI3Z6fwmUdxEUEaLFAcPQ_bHhU2w9ItDxw,18376
 sourcecode/dependency_analyzer.py,sha256=MRv6eh1TG5E9Y5Db-bNdZHDIJ3gWvvL3bBU1-9_QSZI,64593
-sourcecode/deployment_prefix.py,sha256=g0_4bE_m9svjhnapRpOp8BJkj6Ul94Ij_iVezygMZ0I,11956
+sourcecode/deployment_prefix.py,sha256=kPHPT6ZLg6CnMqCp9QwhbNNjDyS0sXAfKlPtSHUMggs,12180
 sourcecode/detach.py,sha256=PvkCcbIuTaDKKt5TGqtQLahmsmCkflui33jLnMEWkvg,8006
 sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24411
 sourcecode/dynamic_argument_surface.py,sha256=u6zJoY-zChYVw1-SrgiyAq-rUwqMZ5ZqBwLfbPJ_8ng,2960
@@ -106,7 +106,7 @@ sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcr
 sourcecode/remedies.py,sha256=V2_cD4pLq8bKRkzF-3RGFoiu1xWYZS384WDVp1MrlZw,10225
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=tV0Uu7qWw_gDUG9WldYxmbNLZnbQljxHYZznWP4cdlA,384071
+sourcecode/repository_ir.py,sha256=nSStGh9z8uHSTj92IJp85Y1J8NDGqlY59KtEsgHThqY,388812
 sourcecode/ris.py,sha256=Xbx34dkJI_uXil9xsgw-fA_Apcm4nbnTjQgFm66dP1g,27489
 sourcecode/risk.py,sha256=u2V7nG5yGW8VV4sFDSgFkZqdI6ltmilWhlQwlIH7d2o,82660
 sourcecode/rule_catalog.py,sha256=pTkgkQZ1u7atB3fkQJ9BPWo8lNiamvEuRN7MtRgle0c,5263
@@ -118,14 +118,14 @@ sourcecode/scanner.py,sha256=z3CV0rcGunu0Y8mpNgp07wI7nxT0pxw1BkXRRtI0Rpo,9609
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_chain.py,sha256=1YZVeFLwy65kntMBhMNvz1cUpOoKCmvEqYICgxs66Gw,6823
 sourcecode/security_config.py,sha256=LUppRDYQK0oKM4qdEOLObaeU3frFTS-paEZo7dMgtY8,5467
-sourcecode/security_config_scan.py,sha256=CttiIYVhBlPCuLNYMWTEtgbZmwXGYm2GYiFo9ehD1Go,32487
+sourcecode/security_config_scan.py,sha256=iXDeulgdbAwUFR01p9PgrJED2vd4HE2FCZgqrxX5D0E,32824
 sourcecode/security_posture.py,sha256=FiEGood01y5gKhuYyL6NK4VT-WtCUMJwHOSR5xTfnPI,54063
 sourcecode/semantic_analyzer.py,sha256=bpgdC6m0_ftVtRf3rSdwhbhWjnZnGxRXaZVcfe4BbcQ,95414
 sourcecode/semantic_impact_engine.py,sha256=t09IirGC3JjQDy33JZd1_WKzQVKXkoNl3-XEUr5kjis,20563
 sourcecode/semantic_integration_engine.py,sha256=7a0WqAInOv39f0Yr_94TYo_JP_8QpeI9KGaknpzAyQU,18899
 sourcecode/semantic_services.py,sha256=nbUuPv-F01USTt_9CHT8iy_ucCIw3fz4W3Aquea_pd4,10782
 sourcecode/serializer.py,sha256=cK4I3WzX0H-oBPbqzBsUBRux5GcYmH_yPDQwxvkf8yQ,141598
-sourcecode/servlet_surface.py,sha256=QY3QPw6pZJ4CQK4yS8q7uDd3f2PDyUUsQ8TS_BkbGs8,9506
+sourcecode/servlet_surface.py,sha256=1ZB76G5PrIGqmRAO8rEd20SMYoexZ5t01v82HtHLSXo,12481
 sourcecode/source_text.py,sha256=R52gmSljz7L6YVPbixv5W-LOZ5eKUVvSUP3S-QH_IWc,9047
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=cW6NiQAFUM9mDYPitJr6MrQg--YBI41LxrSEMI9aeIQ,25272
@@ -147,7 +147,7 @@ sourcecode/token_estimate.py,sha256=G-ivzIJfVq5TLQN04dC0WK4LZJjWVYL54Ebcxe4fJ7M,
 sourcecode/tree_utils.py,sha256=8GAkIfQAsvtEudIeW1l4ooH_oRtrWR8cpJQJsEa_Pfw,2093
 sourcecode/type_usage_surface.py,sha256=51IrKRQoIoRnlsiDjHnqpJBn2rc6E59aRhgS0HTzAF0,4428
 sourcecode/validation_inference.py,sha256=-oWJqE6PqkqcZbCFDJeWCQHgI9Dbuv5ggJWD3LE_2IU,20817
-sourcecode/validation_surface.py,sha256=06muCMxymQEQSqmNgTMdsguC7XQ22tqcZmYJOmvWFHY,34745
+sourcecode/validation_surface.py,sha256=diiAyPiLdvmtTYrx9EywDXHG8odg9gITmN4od8Tj3JQ,35390
 sourcecode/verify_edit.py,sha256=SUaJeH5Icc54mutQx3-gh7i8U6d50cb_oxYc9SDUnHs,42757
 sourcecode/verify_repo.py,sha256=aHlNIUfoVVUxTXTNtSFryP4dOFBOvCfdyC31fFRXU6s,15346
 sourcecode/verify_rules.py,sha256=R3l6nLT6WQzUNBzxtmnxyGZcKj9qMDW38Y0c0gNdCGk,19973
@@ -213,10 +213,10 @@ sourcecode/telemetry/consent.py,sha256=pQdl-QeLl6Gcibn0eWHSKZrm-HYSsjpVqOnjrgFp8
 sourcecode/telemetry/events.py,sha256=4_yeO58U-Cwc1Qb27VB0_EjhmroY0k91n3_VGxeALB8,2776
 sourcecode/telemetry/filters.py,sha256=RzxauTz8HliO4BllQnXEXc7zTeqdCZi5MgqGEDuW7OQ,6570
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode/_docs/DEFECT-LEDGER.md,sha256=sTFPEV2xx-L9n4mrG8UO4LxeETMJpGKHXyKQBZlqNog,497112
-sourcecode/_docs/USER_GUIDE.md,sha256=IOYL9rI9tLViNMICXma_uRSiztjMaW92V5sDAYlPkfo,79546
-sourcecode-5.5.2.dist-info/METADATA,sha256=VjdCWsZA1Bm_mhWsXA-yr6JT1zTSKcLVJA8lejltoug,47104
-sourcecode-5.5.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-5.5.2.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
-sourcecode-5.5.2.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-5.5.2.dist-info/RECORD,,
+sourcecode/_docs/DEFECT-LEDGER.md,sha256=5SxWnKt6p5ZRmx-WsFhIlMfe7-e5fLF0QRa9lAmzYug,499071
+sourcecode/_docs/USER_GUIDE.md,sha256=ykjudytfe1VLgGJQAcs36wkXsEO3N-QJY2js1cJc7y0,79837
+sourcecode-5.5.5.dist-info/METADATA,sha256=bMkQLLoD1zYBemJ5ZJpHyy9xIurRVdVOTCP20jSLN6I,47104
+sourcecode-5.5.5.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-5.5.5.dist-info/entry_points.txt,sha256=-JEAdChrK5We51kZcb7OaDcyil-dHBjBPL-NhuO-QY8,89
+sourcecode-5.5.5.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-5.5.5.dist-info/RECORD,,