{
  "schema": "cce-analysis-recipes/v1",
  "recipes": [
    {
      "id": "cloud-entitlements",
      "version": "1.0.0",
      "title": "Cloud SDK entitlements",
      "description": "Map application code to cloud Provider/Resource/Operation for IAM and PoLP.",
      "languages": ["GO", "JAVA", "PYTHON", "JAVASCRIPT", "AUTO"],
      "filter": "cloud",
      "lens_path": "",
      "providers": ["AWS", "GCP", "AZURE", "OCI", "IBM", "ALIBABA"],
      "proof_status": "verified",
      "example_cli": "cce -folder . -language AUTO -filter cloud -format json -output entitlements.json"
    },
    {
      "id": "sdk-uplift",
      "version": "1.0.0",
      "title": "SDK / framework uplift inventory",
      "description": "Inventory AWS v1/v2, Spring Cloud AWS, javax/jakarta call sites for migration planning.",
      "languages": ["GO", "JAVA", "PYTHON", "AUTO"],
      "filter": "cloud",
      "lens_path": "docs/use-cases/guides/sdk-uplift/sdk-uplift_lenses.yaml",
      "providers": ["AWS"],
      "lens_url": "https://releases.stackgen.com/cce/lenses/sdk-uplift/latest/sdk-uplift_lenses.yaml",
      "proof_status": "verified",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/sdk-uplift/latest/sdk-uplift_lenses.yaml -filter cloud -format json -output sdk-uplift.json",
      "openrewrite_recipes": [
        "org.openrewrite.aws.sdk.v2.UpgradeSdkDependencies",
        "org.openrewrite.java.migrate.jakarta.JavaxMigrationToJakarta"
      ]
    },
    {
      "id": "tech-debt-inventory",
      "version": "1.0.0",
      "title": "Deprecated API & tech-debt inventory",
      "description": "Call-site backlog for deprecated libraries (requests, ioutil, etc.).",
      "languages": ["GO", "JAVA", "PYTHON", "JAVASCRIPT", "AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/tech-debt-inventory/tech-debt-inventory_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/tech-debt-inventory/latest/tech-debt-inventory_lenses.yaml",
      "proof_status": "verified",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/tech-debt-inventory/latest/tech-debt-inventory_lenses.yaml -filter all -format json -output tech-debt.json",
      "openrewrite_recipes": [
        "org.openrewrite.python.migrate.ReplaceRequestsWithHttpx"
      ]
    },
    {
      "id": "pre-deploy-iam-review",
      "version": "1.0.0",
      "title": "Pre-deploy IAM review",
      "description": "Cloud entitlements for PR diff against baseline; pair with cce diff.",
      "languages": ["AUTO"],
      "filter": "cloud",
      "lens_path": "",
      "providers": ["AWS", "GCP", "AZURE", "OCI", "IBM", "ALIBABA"],
      "proof_status": "verified",
      "example_cli": "cce -folder . -language AUTO -filter cloud -format json -output pr-entitlements.json"
    },
    {
      "id": "change-control",
      "version": "1.0.0",
      "title": "Change control / new cloud usage",
      "description": "Detect new cloud API usage in PRs for CAB and security review.",
      "languages": ["AUTO"],
      "filter": "cloud",
      "lens_path": "",
      "providers": ["AWS", "GCP", "AZURE", "OCI", "IBM", "ALIBABA"],
      "proof_status": "verified",
      "example_cli": "cce diff baseline.json pr-entitlements.json --fail-new"
    },
    {
      "id": "cve-reachability",
      "version": "1.0.0",
      "title": "CVE reachability (template lens)",
      "description": "Map vulnerable API call sites; customize Grok rules per advisory.",
      "languages": ["AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/cve-reachability/cve-reachability_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/cve-reachability/latest/cve-reachability_lenses.yaml",
      "proof_status": "lens-only",
      "example_cli": "cce -folder . -mapper-file https://releases.stackgen.com/cce/lenses/cve-reachability/latest/cve-reachability_lenses.yaml -filter all -format json"
    },
    {
      "id": "microservice-decomposition",
      "version": "1.0.0",
      "title": "Outbound HTTP / microservice boundaries",
      "description": "Inventory outbound HTTP and messaging call sites.",
      "languages": ["GO", "PYTHON", "AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/microservice-decomposition/microservice-decomposition_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/microservice-decomposition/latest/microservice-decomposition_lenses.yaml",
      "proof_status": "verified",
      "example_cli": "cce -folder . -mapper-file https://releases.stackgen.com/cce/lenses/microservice-decomposition/latest/microservice-decomposition_lenses.yaml -filter all -format json"
    },
    {
      "id": "llm-code-context",
      "version": "1.0.0",
      "title": "LLM / agent code context",
      "description": "Structured call sites with parent function and snippets for grounded agents.",
      "languages": ["AUTO"],
      "filter": "all",
      "lens_path": "",
      "proof_status": "verified",
      "example_cli": "cce -folder . -language AUTO -filter all -format json"
    },
    {
      "id": "platform-adoption",
      "version": "1.0.0",
      "title": "Platform SDK adoption",
      "description": "Direct cloud SDK vs internal platform wrapper call sites.",
      "languages": ["GO", "JAVA", "PYTHON", "AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/platform-adoption/platform-adoption_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/platform-adoption/latest/platform-adoption_lenses.yaml",
      "proof_status": "lens-only",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/platform-adoption/latest/platform-adoption_lenses.yaml -filter all -format json -output platform.json"
    },
    {
      "id": "regression-gates",
      "version": "1.0.0",
      "title": "Regression gates (forbidden APIs)",
      "description": "Detect forbidden or deprecated API call sites for CI failure.",
      "languages": ["AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/regression-gates/regression-gates_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/regression-gates/latest/regression-gates_lenses.yaml",
      "proof_status": "lens-only",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/regression-gates/latest/regression-gates_lenses.yaml -filter all -format json -output gates.json"
    },
    {
      "id": "secrets-hygiene",
      "version": "1.0.0",
      "title": "Secrets & credential hygiene",
      "description": "Inventory hardcoded secrets and risky credential patterns in code.",
      "languages": ["AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/secrets-hygiene/secrets-hygiene_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/secrets-hygiene/latest/secrets-hygiene_lenses.yaml",
      "proof_status": "lens-only",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/secrets-hygiene/latest/secrets-hygiene_lenses.yaml -filter all -format json -output secrets.json"
    },
    {
      "id": "regulatory-scope",
      "version": "1.0.0",
      "title": "Regulatory scope (PCI / HIPAA / SOC)",
      "description": "Map call sites to regulated data-plane APIs for scope reviews.",
      "languages": ["AUTO"],
      "filter": "all",
      "lens_path": "docs/use-cases/guides/regulatory-scope/regulatory-scope_lenses.yaml",
      "lens_url": "https://releases.stackgen.com/cce/lenses/regulatory-scope/latest/regulatory-scope_lenses.yaml",
      "proof_status": "lens-only",
      "example_cli": "cce -folder . -language AUTO -mapper-file https://releases.stackgen.com/cce/lenses/regulatory-scope/latest/regulatory-scope_lenses.yaml -filter all -format json -output scope.json"
    }
  ]
}