apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/analyzer.py

@@ -0,0 +1,2309 @@
+"""
+Main analysis orchestrator for generating manifests.
+
+This module coordinates:
+- File discovery
+- Parsing (Python, Java)
+- Framework detection and extraction
+- Data flow analysis
+- Manifest generation
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import time
+from dataclasses import dataclass, field
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+from pydantic import ValidationError
+
+from ..core.config import CodeBoltConfig
+from ..core.discovery import DiscoveryResult, discover_files
+from ..core.manifest import (
+    MANIFEST_VERSION,
+    AnalysisMetadataModel,
+    AuthDependencyModel,
+    AuthModel,
+    AuthSchemeModel,
+    BodyFieldModel,
+    CallContextModel,
+    CapabilityModel,
+    ClassModel,
+    ConfigurationModel,
+    DataFlowModel,
+    EnvVarUsageModel,
+    FunctionCallModel,
+    FunctionModel,
+    HttpBodyModel,
+    HttpParameterModel,
+    IntegrationModel,
+    JwtConfigModel,
+    LiteralsModel,
+    LocationModel,
+    Manifest,
+    MiddlewareModel,
+    ParameterModel,
+    ProjectMetadata,
+    RouteAuthModel,
+    RouteModel,
+    SchemaFieldModel,
+    SchemaModel,
+    stable_id,
+)
+from ..core.types import Framework, Language
+from ..frameworks import dotnet as _dotnet_fw  # noqa: F401 — registers AspNetCorePlugin
+from ..frameworks import java as _java_fw  # noqa: F401 — registers SpringBootPlugin
+from ..frameworks.base import FrameworkPluginRegistry
+from ..parsing import csharp as _csharp_pkg  # noqa: F401 — registers CSharpParser
+from ..parsing import js as _js_pkg  # noqa: F401 — registers JavaScriptParser
+from ..parsing import jvm as _jvm_pkg  # noqa: F401 — registers JavaParser
+from ..parsing.base import ParsedFile, ParserRegistry
+from ..parsing.csharp.language_services import CSharpLanguageServices
+from ..parsing.js.language_services import JavaScriptLanguageServices
+from ..parsing.jvm import language_services as _jvm_lang_services  # noqa: F401
+from ..parsing.jvm.language_services import JavaLanguageServices
+from ..parsing.python.language_services import PythonLanguageServices
+from ..parsing.python.parser import PythonProjectParser
+from ..parsing.python.type_resolver import SchemaBuilder, TypeResolver
+from ..parsing.services import AnalysisContext, LanguageServices
+from .call_graph import CallGraph, build_call_graph_with_context
+from .data_flow import DataFlowAnalyzer
+from .dependency_extractor import DependencyExtractor
+from .flow_analysis import build_flow_sensitive_bindings
+
+
+def _auto_discover_plugins() -> None:
+    """Import all framework plugins to trigger their self-registration."""
+    import importlib
+    import pkgutil
+
+    from .. import frameworks as _fw_pkg
+
+    for _importer, mod_name, _is_pkg in pkgutil.walk_packages(
+        _fw_pkg.__path__,
+        prefix=_fw_pkg.__name__ + ".",
+    ):
+        if "plugin" in mod_name or mod_name.endswith("_plugin"):
+            try:
+                importlib.import_module(mod_name)
+            except Exception as e:  # noqa: BLE001
+                logger.debug("Could not load framework plugin %s: %s", mod_name, e)
+
+
+_auto_discover_plugins()
+
+
+logger = logging.getLogger(__name__)
+
+
+def _get_probe_version() -> str:
+    try:
+        from .. import __version__
+
+        return __version__
+    except Exception:
+        return "0.1.0"
+
+
+# =============================================================================
+# Analysis Result
+# =============================================================================
+
+
+@dataclass
+class AnalysisWarning:
+    """A non-fatal issue encountered during analysis."""
+
+    phase: str
+    message: str
+    file: str | None = None
+    detail: str | None = None
+
+
+@dataclass
+class AnalysisResult:
+    """Result of analysis containing manifest and metadata."""
+
+    manifest: Manifest
+
+    # Statistics
+    files_analyzed: int = 0
+    files_failed: int = 0
+    parse_errors: list[str] = field(default_factory=list)
+
+    # Non-fatal warnings accumulated during analysis
+    warnings: list[AnalysisWarning] = field(default_factory=list)
+
+    # Timing — top-level
+    discovery_time_ms: int = 0
+    parse_time_ms: int = 0
+    extraction_time_ms: int = 0
+    total_time_ms: int = 0
+
+    # Timing — full per-stage breakdown (stage_name → ms)
+    stage_times_ms: dict[str, int] = field(default_factory=dict)
+
+    # Timing — per-framework-plugin extraction (framework_name → ms across all files)
+    extractor_times_ms: dict[str, int] = field(default_factory=dict)
+
+    # Per-language file counts (language name → count)
+    files_by_language: dict[str, int] = field(default_factory=dict)
+
+    # Per-language parse failures (language name → count)
+    failures_by_language: dict[str, int] = field(default_factory=dict)
+
+    # Files excluded by discovery (gitignore, --exclude, --max-files, unknown extension)
+    files_skipped: int = 0
+
+    # Per-framework route counts (framework_name → route count)
+    routes_by_framework: dict[str, int] = field(default_factory=dict)
+
+    # Structured parse errors with file + line + message (replaces plain strings)
+    parse_error_details: list[dict[str, Any]] = field(default_factory=list)
+
+    # Detected frameworks
+    frameworks_detected: list[Framework] = field(default_factory=list)
+
+
+# =============================================================================
+# Analyzer
+# =============================================================================
+
+
+class ProjectAnalyzer:
+    """
+    Main analyzer for extracting manifest from a project.
+
+    Coordinates:
+    1. File discovery
+    2. Parsing files by language
+    3. Framework detection
+    4. Route/dependency/auth extraction
+    5. Data flow analysis
+    6. Manifest generation
+    """
+
+    def __init__(self, config: CodeBoltConfig) -> None:
+        self.config = config
+
+        # Parsers
+        self._python_parser = PythonProjectParser()
+        self._type_resolver = TypeResolver()
+        self._schema_builder = SchemaBuilder(self._type_resolver)
+
+        # Language services (builds context for each language)
+        self._language_services: dict[Language, LanguageServices] = {
+            Language.PYTHON: PythonLanguageServices(),
+            Language.JAVA: JavaLanguageServices(),
+            Language.CSHARP: CSharpLanguageServices(),
+            Language.JAVASCRIPT: JavaScriptLanguageServices(),
+        }
+
+        # Analysis contexts per language (built during analysis)
+        self._analysis_contexts: dict[Language, AnalysisContext] = {}
+
+        # Parsed data
+        self._parsed_files: dict[Path, ParsedFile] = {}
+        self._discovery_result: DiscoveryResult | None = None
+
+        # Call graph
+        self._call_graph: CallGraph | None = None
+
+        # Data flow analysis results (for manifest metadata)
+        self._data_flow_stats: dict[str, int] = {}
+
+        # Shared flow-sensitive bindings (built once, reused by call graph + data flow)
+        self._flow_bindings: Any = None
+
+        # Framework plugins
+        self._detected_frameworks: set[Framework] = set()
+
+        # Per-plugin extraction timing (populated by _extract_all_routes)
+        self._extractor_times_ms: dict[str, int] = {}
+
+        # Accumulated non-fatal warnings
+        self._warnings: list[AnalysisWarning] = []
+
+    # Pipeline stage definitions: (name, method_name)
+    _PIPELINE_STAGES: list[tuple[str, str]] = [
+        ("discover", "_stage_discover"),
+        ("parse", "_stage_parse"),
+        ("resolve", "_stage_resolve"),
+        ("detect_frameworks", "_stage_detect_frameworks"),
+        ("flow_bindings", "_stage_flow_bindings"),
+        ("call_graph", "_stage_call_graph"),
+        ("extract", "_stage_extract"),
+        ("analyze_flows", "_stage_analyze_flows"),
+        ("enrich", "_stage_enrich"),
+    ]
+
+    def analyze(self) -> AnalysisResult:
+        """
+        Analyze the project and generate manifest.
+
+        Runs a named pipeline of stages. Each stage is independently
+        testable and reports its own timing.
+        """
+        start_time = time.perf_counter()
+        stage_times: dict[str, int] = {}
+        ctx: dict[str, Any] = {}
+
+        for stage_name, method_name in self._PIPELINE_STAGES:
+            stage_start = time.perf_counter()
+            stage_fn = getattr(self, method_name)
+            stage_fn(ctx)
+            stage_times[stage_name] = int((time.perf_counter() - stage_start) * 1000)
+            logger.debug("Stage '%s' completed in %dms", stage_name, stage_times[stage_name])
+
+        total_time_ms = int((time.perf_counter() - start_time) * 1000)
+
+        manifest = self._build_manifest(
+            routes=ctx["routes"],
+            functions=ctx["functions"],
+            classes=ctx["classes"],
+            calls=ctx["calls"],
+            data_flows=ctx["data_flows"],
+            auth=ctx["auth"],
+            middleware=ctx["middleware"],
+            dependencies=ctx["pkg_dependencies"],
+            integrations=ctx["integrations"],
+            capabilities=ctx["capabilities"],
+            schemas=ctx["schemas"],
+            literals=ctx["literals"],
+            configuration=ctx["config_data"],
+            analysis_time_ms=total_time_ms,
+        )
+
+        # Build both legacy string errors and structured error details
+        parse_errors: list[str] = []
+        parse_error_details: list[dict[str, Any]] = []
+        for path, parsed in self._parsed_files.items():
+            if not parsed.success and parsed.error:
+                err = parsed.error
+                parse_errors.append(f"{path}: {err}")
+                detail: dict[str, Any] = {
+                    "file": str(path),
+                    "error": str(err),
+                }
+                if hasattr(err, "line") and err.line is not None:
+                    detail["line"] = err.line
+                if hasattr(err, "column") and err.column is not None:
+                    detail["column"] = err.column
+                parse_error_details.append(detail)
+
+        # Per-language file counts from the parsed file registry
+        files_by_language: dict[str, int] = {}
+        failures_by_language: dict[str, int] = {}
+        for parsed in self._parsed_files.values():
+            lang_name = parsed.language.name.lower() if parsed.language else "unknown"
+            if parsed.success:
+                files_by_language[lang_name] = files_by_language.get(lang_name, 0) + 1
+            else:
+                failures_by_language[lang_name] = failures_by_language.get(lang_name, 0) + 1
+
+        # Per-framework route counts from the manifest
+        routes_by_framework: dict[str, int] = {}
+        for ep in manifest.entry_points:
+            fw = (ep.framework or "unknown").lower()
+            routes_by_framework[fw] = routes_by_framework.get(fw, 0) + 1
+
+        return AnalysisResult(
+            manifest=manifest,
+            files_analyzed=len([p for p in self._parsed_files.values() if p.success]),
+            files_failed=len([p for p in self._parsed_files.values() if not p.success]),
+            files_skipped=self._discovery_result.total_skipped if self._discovery_result else 0,
+            parse_errors=parse_errors,
+            parse_error_details=parse_error_details,
+            warnings=list(self._warnings),
+            discovery_time_ms=stage_times.get("discover", 0),
+            parse_time_ms=stage_times.get("parse", 0),
+            extraction_time_ms=stage_times.get("extract", 0),
+            total_time_ms=total_time_ms,
+            stage_times_ms=dict(stage_times),
+            extractor_times_ms=self._extractor_times_ms,
+            files_by_language=files_by_language,
+            failures_by_language=failures_by_language,
+            routes_by_framework=routes_by_framework,
+            frameworks_detected=list(self._detected_frameworks),
+        )
+
+    # -- Pipeline stage implementations ----------------------------------------
+
+    def _stage_discover(self, ctx: dict[str, Any]) -> None:
+        logger.info("Discovering files in %s", self.config.project_root)
+        self._discovery_result = discover_files(
+            self.config.project_root,
+            self.config.analysis.file_discovery,
+        )
+        logger.info(
+            "Discovered %d files, skipped %d",
+            self._discovery_result.total_selected,
+            self._discovery_result.total_skipped,
+        )
+
+    def _stage_parse(self, ctx: dict[str, Any]) -> None:
+        self._parse_all_files()
+
+    def _stage_resolve(self, ctx: dict[str, Any]) -> None:
+        self._build_cross_file_resolver()
+
+    def _stage_detect_frameworks(self, ctx: dict[str, Any]) -> None:
+        self._detect_frameworks()
+
+    def _stage_flow_bindings(self, ctx: dict[str, Any]) -> None:
+        self._build_shared_flow_bindings()
+
+    def _stage_call_graph(self, ctx: dict[str, Any]) -> None:
+        self._build_call_graph()
+
+    def _stage_extract(self, ctx: dict[str, Any]) -> None:
+        raw_routes = self._extract_all_routes()
+        ctx["routes"] = self._apply_group_prefixes(raw_routes)
+        ctx["dependencies"] = self._extract_all_dependencies()
+        ctx["auth"] = self._extract_auth_data()
+        ctx["middleware"] = self._extract_middleware()
+        self._populate_route_auth_mapping(ctx["auth"], ctx["routes"], ctx["middleware"])
+        self._link_routes_to_auth_schemes(ctx["routes"], ctx["auth"])
+        self._propagate_file_auth_to_routes(ctx["routes"], ctx["auth"])
+        self._apply_spring_filter_chain_policy(ctx["routes"])
+        ctx["calls"] = self._extract_all_calls()
+
+    def _stage_analyze_flows(self, ctx: dict[str, Any]) -> None:
+        ctx["data_flows"], _ = self._analyze_data_flows(ctx["routes"])
+        ctx["integrations"] = self._detect_integrations()
+        ctx["literals"] = self._scan_literals()
+        self._classify_sensitivity(ctx["integrations"], ctx["literals"])
+
+    def _stage_enrich(self, ctx: dict[str, Any]) -> None:
+        dep_extractor = DependencyExtractor(self.config.project_root, self._parsed_files)
+        ctx["pkg_dependencies"] = dep_extractor.extract()
+        ctx["config_data"] = self._extract_configuration()
+        ctx["capabilities"] = self._tag_capabilities(
+            ctx["integrations"],
+            ctx["routes"],
+            ctx["config_data"],
+        )
+        functions, func_id_index = self._collect_all_functions()
+        ctx["functions"] = functions
+        ctx["classes"] = self._collect_all_classes(func_id_index)
+        ctx["schemas"] = self._collect_schemas(ctx["routes"])
+
+    # =========================================================================
+    # Parsing
+    # =========================================================================
+
+    def _parse_all_files(self) -> None:
+        """Parse all discovered files using registry-based language dispatch."""
+        if not self._discovery_result:
+            return
+
+        # Group files by language
+        files_by_lang: dict[Language, list[Path]] = {}
+        for f in self._discovery_result.files:
+            if f.language:
+                files_by_lang.setdefault(f.language, []).append(f.path)
+
+        for language, file_paths in files_by_lang.items():
+            parser = ParserRegistry.get_parser(language)
+            if parser is None:
+                logger.info(
+                    "Found %d %s files (no parser registered)",
+                    len(file_paths),
+                    language.name,
+                )
+                continue
+
+            logger.info("Parsing %d %s files", len(file_paths), language.name)
+
+            # Use PythonProjectParser for Python (has cross-file resolution)
+            if language == Language.PYTHON:
+                self._parsed_files.update(self._python_parser.parse_project(file_paths))
+            else:
+                for path in file_paths:
+                    try:
+                        parsed = parser.parse_file(path)
+                        self._parsed_files[path] = parsed
+                    except Exception as e:
+                        logger.warning("Failed to parse %s: %s", path, e)
+
+    def _build_analysis_contexts(self) -> None:
+        """
+        Build analysis contexts for each language using LanguageServices.
+
+        This replaces the old approach of manually building each resolver.
+        Now each language provides a factory that builds all required services.
+        """
+        if not self._parsed_files:
+            return
+
+        # Group parsed files by language
+        files_by_language: dict[Language, list[ParsedFile]] = {}
+        for parsed in self._parsed_files.values():
+            if not parsed.success:
+                continue
+            lang = parsed.language
+            if lang not in files_by_language:
+                files_by_language[lang] = []
+            files_by_language[lang].append(parsed)
+
+        # Build context for each language
+        for language, files in files_by_language.items():
+            if language not in self._language_services:
+                logger.warning(f"No language services available for {language.name}")
+                continue
+
+            services = self._language_services[language]
+
+            # Detect primary framework for this language
+            framework = self._detect_primary_framework(files, language)
+            framework_name = framework.name.lower() if framework else None
+
+            logger.info(
+                f"Building analysis context for {language.name} (framework: {framework_name})"
+            )
+
+            # Build context using the language services factory
+            context = services.build_context(
+                parsed_files=files,
+                project_root=self.config.project_root,
+                framework=framework_name,
+            )
+
+            # Wire URL prefix maps for Django and Express/NestJS
+            if language == Language.PYTHON and framework_name == "django":
+                try:
+                    from .url_prefix_resolver import build_django_prefix_map
+
+                    pm = build_django_prefix_map(files, project_root=self.config.project_root)
+                    context.language_services["_url_prefix_map"] = pm
+                    logger.debug("Django prefix map built: %d entries", len(pm))
+                except Exception as e:
+                    logger.debug("Django prefix map failed: %s", e)
+            elif language == Language.JAVASCRIPT:
+                try:
+                    from .url_prefix_resolver import build_express_prefix_map
+
+                    pm = build_express_prefix_map(files, project_root=self.config.project_root)
+                    context.language_services["_url_prefix_map"] = pm
+                    logger.debug("Express prefix map built: %d entries", len(pm))
+                except Exception as e:
+                    logger.debug("Express prefix map failed: %s", e)
+
+            self._analysis_contexts[language] = context
+
+            # Log statistics
+            if context.type_resolver:
+                models = context.type_resolver.get_all_models()
+                logger.info(f"  - Resolved {len(models)} model types")
+
+            if context.constant_resolver:
+                constants = context.constant_resolver.get_all_constants()
+                logger.info(f"  - Resolved {len(constants)} constants")
+
+            if context.router_registry:
+                routers = context.router_registry.get_all_routers()
+                logger.info(f"  - Registered {len(routers)} routers")
+
+    def _detect_primary_framework(
+        self,
+        files: list[ParsedFile],
+        language: Language,
+    ) -> Framework | None:
+        """Detect the primary framework for a set of files."""
+        framework_counts: dict[Framework, int] = {}
+
+        for parsed_file in files:
+            detected = FrameworkPluginRegistry.detect_frameworks(parsed_file)
+            for fw in detected:
+                framework_counts[fw] = framework_counts.get(fw, 0) + 1
+
+        if not framework_counts:
+            return None
+
+        # Return the most common framework
+        return max(framework_counts, key=framework_counts.get)
+
+    # Backward compatibility alias
+    def _build_cross_file_resolver(self) -> None:
+        """Build cross-file resolution (alias for _build_analysis_contexts)."""
+        self._build_analysis_contexts()
+
+    def _build_shared_flow_bindings(self) -> None:
+        """Build flow-sensitive bindings once for reuse by call graph and data flow."""
+        successful_files = [p for p in self._parsed_files.values() if p.success]
+        if not successful_files:
+            return
+        try:
+            self._flow_bindings = build_flow_sensitive_bindings(successful_files)
+            logger.info("Built shared flow-sensitive bindings for %d files", len(successful_files))
+        except Exception as e:
+            logger.warning("Could not build flow-sensitive bindings: %s", e)
+            self._flow_bindings = None
+
+    def _build_call_graph(self) -> None:
+        """Build the call graph for inter-procedural analysis."""
+        if not self._parsed_files:
+            return
+
+        logger.info("Building call graph...")
+
+        # Get successfully parsed files
+        successful_files = [parsed for parsed in self._parsed_files.values() if parsed.success]
+
+        if not successful_files:
+            logger.warning("No successfully parsed files for call graph")
+            return
+
+        # Get the primary analysis context (prefer Python, fall back to Java, then C#)
+        context = (
+            self._analysis_contexts.get(Language.PYTHON)
+            or self._analysis_contexts.get(Language.JAVA)
+            or self._analysis_contexts.get(Language.CSHARP)
+        )
+
+        try:
+            if context:
+                self._call_graph = build_call_graph_with_context(
+                    successful_files,
+                    context,
+                    flow_bindings=self._flow_bindings,
+                )
+            else:
+                from .call_graph import build_call_graph
+
+                self._call_graph = build_call_graph(
+                    successful_files,
+                    project_root=self.config.project_root,
+                    flow_bindings=self._flow_bindings,
+                )
+
+            stats = self._call_graph.get_statistics()
+            logger.info(
+                f"Call graph built: {stats['internal_nodes']} internal functions, "
+                f"{stats['total_edges']} call edges"
+            )
+            logger.info(f"  - Entry points: {stats['entry_points']}")
+            logger.info(f"  - Resolution confidence: {stats['resolution_confidence']}")
+
+        except ImportError as e:
+            logger.warning(f"Could not build call graph: {e}")
+
+    def _detect_frameworks(self) -> None:
+        """Detect frameworks used in parsed files."""
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            detected = FrameworkPluginRegistry.detect_frameworks(parsed_file)
+            self._detected_frameworks.update(detected)
+
+        logger.info(f"Detected frameworks: {[f.name for f in self._detected_frameworks]}")
+
+    # =========================================================================
+    # Route Extraction
+    # =========================================================================
+
+    def _extract_all_routes(self) -> list[RouteModel]:
+        """Extract routes from all parsed files using analysis contexts."""
+        routes: list[RouteModel] = []
+
+        # Build plugin list from the language-keyed registry so that multiple
+        # plugins sharing the same Framework enum value (e.g. GraphQLPythonPlugin
+        # and GraphQLJavaPlugin both register as Framework.GRAPHQL) are both
+        # included.  get_plugin(fw) returns only one entry per framework key and
+        # would silently drop the second registrant.
+        seen_plugin_ids: set[int] = set()
+        plugins = []
+        for language in Language:
+            for plugin in FrameworkPluginRegistry.get_plugins_for_language(language):
+                if (
+                    plugin.framework in self._detected_frameworks
+                    and id(plugin) not in seen_plugin_ids
+                ):
+                    seen_plugin_ids.add(id(plugin))
+                    plugins.append(plugin)
+
+        # Per-plugin wall-clock accumulator: framework_name → total ms
+        plugin_times: dict[str, int] = {}
+
+        # Extract routes from each file
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            # Get analysis context for this file's language
+            context = self._analysis_contexts.get(parsed_file.language)
+
+            for plugin in plugins:
+                if not plugin.detect(parsed_file):
+                    continue
+
+                # Extract routes, passing context when supported
+                if hasattr(plugin, "extract_routes"):
+                    fw_key = plugin.framework.name.lower()
+                    _t0 = time.perf_counter()
+                    try:
+                        extracted_routes = plugin.extract_routes(parsed_file, context=context)
+                    except TypeError:
+                        self._setup_legacy_plugin(plugin, parsed_file.language)
+                        extracted_routes = plugin.extract_routes(parsed_file)
+
+                    elapsed_ms = int((time.perf_counter() - _t0) * 1000)
+                    plugin_times[fw_key] = plugin_times.get(fw_key, 0) + elapsed_ms
+
+                    framework_name = plugin.framework.name.lower()
+                    for route in extracted_routes:
+                        ep_id = stable_id("ep", route.method.name, route.path)
+                        routes.append(self._convert_route(route, ep_id, framework=framework_name))
+
+        self._extractor_times_ms = plugin_times
+        return routes
+
+    # =========================================================================
+    # Group Prefix Propagation (cross-file module → endpoint extension pattern)
+    # =========================================================================
+
+    def _apply_group_prefixes(self, routes: list[RouteModel]) -> list[RouteModel]:
+        """Prepend MapGroup prefix to routes registered via the module-extension pattern.
+
+        Handles three patterns:
+        1. Cross-file: module file calls MapGroup + extension methods; handler files
+           define those methods.
+        2. Same-file: file calls MapGroup and registers routes on the result directly
+           (e.g. ``var api = app.MapGroup("x"); api.MapGet("/y", ...)``)
+        3. Program.cs auth: an outer file calls ``handler.MapXxxApi().RequireAuthorization()``
+           without its own MapGroup; auth is propagated to the handler file's routes.
+        """
+        import re as _re
+
+        _STANDARD_MAP = frozenset(
+            {
+                "MapGet",
+                "MapPost",
+                "MapPut",
+                "MapDelete",
+                "MapPatch",
+                "MapIdentityApi",
+                "MapGroup",
+                "MapHub",
+            }
+        )
+
+        # ── Step 1: collect extension-method names per file ──────────────────
+        # Static methods whose first parameter is IEndpointRouteBuilder or similar.
+        ext_methods_by_file: dict[str, set[str]] = {}
+        for file_path, parsed_file in self._parsed_files.items():
+            if not parsed_file.success:
+                continue
+            for cls in parsed_file.classes:
+                for method in cls.methods:
+                    if method.binding != "static" or not method.parameters:
+                        continue
+                    first_type = (method.parameters[0].type_annotation or "").split("<")[0].strip()
+                    if first_type in (
+                        "IEndpointRouteBuilder",
+                        "RouteGroupBuilder",
+                        "WebApplication",
+                        "IApplicationBuilder",
+                    ):
+                        ext_methods_by_file.setdefault(str(file_path), set()).add(method.name)
+
+        # Reverse map: extension method name → file that defines it
+        ext_method_to_file: dict[str, str] = {}
+        for file_path, method_names in ext_methods_by_file.items():
+            for method_name in method_names:
+                ext_method_to_file[method_name] = file_path
+
+        # ── Step 2: scan all files for group patterns ─────────────────────────
+        # group_registry: ext_method_name → (prefix, auth, anon)  [cross-file pattern]
+        group_registry: dict[str, tuple[str, bool, bool]] = {}
+        # same_file_prefix_map: file_path → (prefix, auth, anon)  [same-file pattern, single prefix]
+        same_file_prefix_map: dict[str, tuple[str, bool, bool]] = {}
+        # same_file_multi_map: file_path → sorted [(group_line, prefix, has_auth)]
+        # Used when a file has multiple MapGroup prefixes (e.g. versioned API)
+        same_file_multi_map: dict[str, list[tuple[int, str, bool]]] = {}
+        # program_auth_overrides: handler file paths that get auth from an outer caller
+        program_auth_overrides: set[str] = set()
+
+        for file_path_obj, parsed_file in self._parsed_files.items():
+            file_path = str(file_path_obj)
+            if not parsed_file.success:
+                continue
+
+            # Find MapGroup calls with literal prefix arguments
+            group_lines: dict[int, str] = {}  # start_line → prefix
+            for call in parsed_file.call_sites:
+                if call.callee_name.split(".")[-1] != "MapGroup":
+                    continue
+                if not call.arguments or not call.arguments[0].is_literal:
+                    continue
+                raw = str(call.arguments[0].literal_value or "")
+                # Resolve API versioning placeholder → v1
+                raw = _re.sub(r"v\{[^}]*[Vv]ersion[^}]*\}", "v1", raw)
+                # Strip remaining route constraints: {id:int} → {id}
+                raw = _re.sub(r"\{([^:}]+):[^}]+\}", r"{\1}", raw)
+                prefix = "/" + raw.strip("/") if raw else ""
+                line = call.location.line if call.location else -1
+                if line > 0:
+                    group_lines[line] = prefix
+
+            # Build the full chain-line set for fluent group chaining
+            chain_lines: set[int] = set(group_lines.keys())
+            changed = True
+            while changed:
+                changed = False
+                for call in parsed_file.call_sites:
+                    recv = call.receiver_expression or ""
+                    if not recv.startswith("line:"):
+                        continue
+                    try:
+                        target = int(recv[5:])
+                    except ValueError:
+                        continue
+                    if target in chain_lines:
+                        ln = call.location.line if call.location else -1
+                        if ln > 0 and ln not in chain_lines:
+                            chain_lines.add(ln)
+                            changed = True
+
+            # Group-level auth: RequireAuthorization chained on the group
+            has_group_auth = any(
+                call.callee_name.split(".")[-1] == "RequireAuthorization"
+                and (call.receiver_expression or "").startswith("line:")
+                and (
+                    lambda rv=call.receiver_expression: (
+                        rv[5:].isdigit() and int(rv[5:]) in chain_lines
+                    )
+                )()
+                for call in parsed_file.call_sites
+            )
+
+            # Find calls to custom Map* extension methods (non-standard, non-chained).
+            # These are calls like ``group.MapCreateBrandEndpoint()`` where the method
+            # is a project-defined extension, not one of the standard Map* helpers.
+            # Note: _STANDARD_MAP filters out MapGet/Post/etc; we keep any custom Map*
+            # regardless of receiver name so that group variables named "api", "v1" etc.
+            # are also captured.
+            ext_call_lines: dict[str, int] = {}
+            for call in parsed_file.call_sites:
+                method_name = call.callee_name.split(".")[-1]
+                recv = call.receiver_expression or ""
+                # Skip: no receiver, class-name receiver (uppercase), chained receiver
+                if not recv or recv[0].isupper() or recv.startswith("line:"):
+                    continue
+                # Skip: standard Map* methods and the IEndpointGroup groupBuilder receiver
+                if not method_name.startswith("Map") or method_name in _STANDARD_MAP:
+                    continue
+                if recv == "groupBuilder":
+                    continue
+                ln = call.location.line if call.location else -1
+                if ln > 0:
+                    ext_call_lines[method_name] = ln
+
+            # Per-extension-method auth overrides (.AllowAnonymous() / .RequireAuthorization()
+            # chained on group.MapXxxEndpoint() in the caller file).
+            ext_auth_override: dict[str, str | None] = dict.fromkeys(ext_call_lines, None)
+            for call in parsed_file.call_sites:
+                method_name = call.callee_name.split(".")[-1]
+                recv = call.receiver_expression or ""
+                if not recv.startswith("line:"):
+                    continue
+                try:
+                    target = int(recv[5:])
+                except ValueError:
+                    continue
+                for ext_name, ext_line in ext_call_lines.items():
+                    if target == ext_line and method_name in (
+                        "AllowAnonymous",
+                        "RequireAuthorization",
+                    ):
+                        ext_auth_override[ext_name] = method_name
+
+            # --- Pattern A: same-file MapGroup with local Map* route calls ---
+            # Detect files that call MapGroup AND register routes on the result directly
+            # (e.g. eShop OrdersApi.cs: ``var api = app.MapGroup("x"); api.MapPut(...)``)
+            if group_lines:
+                has_local_map_calls = any(
+                    (m := call.callee_name.split(".")[-1]) in _STANDARD_MAP
+                    and m != "MapGroup"
+                    and (recv := call.receiver_expression or "")
+                    and not recv.startswith("line:")
+                    and not recv[0].isupper()
+                    and recv != "groupBuilder"
+                    for call in parsed_file.call_sites
+                )
+                unique_prefixes = set(group_lines.values())
+                if has_local_map_calls and len(unique_prefixes) == 1:
+                    grp_prefix = next(iter(unique_prefixes))
+                    same_file_prefix_map[file_path] = (grp_prefix, has_group_auth, False)
+                elif has_local_map_calls and len(unique_prefixes) > 1:
+                    # Multi-prefix file (e.g. versioned API): assign each route the
+                    # nearest preceding MapGroup prefix by line number
+                    same_file_multi_map[file_path] = sorted(
+                        [(ln, pfx, has_group_auth) for ln, pfx in group_lines.items()],
+                        key=lambda t: t[0],
+                    )
+
+            # --- Pattern B: cross-file extension method (with MapGroup in caller) ---
+            # OR: auth-only from Program.cs (no MapGroup in caller)
+            if ext_call_lines:
+                if group_lines:
+                    # Module file: MapGroup + custom extension method calls → cross-file
+                    unique_prefixes = set(group_lines.values())
+                    if len(unique_prefixes) == 1:
+                        grp_prefix = next(iter(unique_prefixes))
+                        for ext_name in ext_call_lines:
+                            override = ext_auth_override.get(ext_name)
+                            allow_anon = override == "AllowAnonymous"
+                            route_auth = (
+                                has_group_auth and not allow_anon
+                            ) or override == "RequireAuthorization"
+                            group_registry[ext_name] = (grp_prefix, route_auth, allow_anon)
+                else:
+                    # Program.cs-like file: no MapGroup, but ext method calls with auth
+                    # (e.g. ``orders.MapOrdersApiV1().RequireAuthorization()``)
+                    for ext_name, override in ext_auth_override.items():
+                        if override == "RequireAuthorization":
+                            handler_file = ext_method_to_file.get(ext_name)
+                            if handler_file:
+                                program_auth_overrides.add(handler_file)
+
+        # ── Step 3: build unified file_path → (prefix, route_auth, allow_anon) ──
+        # Same-file patterns take precedence for prefix resolution.
+        file_prefix_map: dict[str, tuple[str, bool, bool]] = dict(same_file_prefix_map)
+        # Cross-file patterns fill in files not already covered by same-file
+        for file_path, method_names in ext_methods_by_file.items():
+            for method_name in method_names:
+                if method_name in group_registry and file_path not in file_prefix_map:
+                    file_prefix_map[file_path] = group_registry[method_name]
+                    break
+
+        if not file_prefix_map and not same_file_multi_map and not program_auth_overrides:
+            return routes
+
+        # ── Step 4: apply prefix + auth to matching routes ───────────────────
+        updated: list[RouteModel] = []
+        for route in routes:
+            handler_file = route.handler_location.file if route.handler_location else None
+            if not handler_file:
+                updated.append(route)
+                continue
+
+            has_prog_auth = handler_file in program_auth_overrides
+
+            # Multi-prefix: find the nearest preceding MapGroup by route line
+            multi_entries = same_file_multi_map.get(handler_file)
+            if multi_entries and route.handler_location:
+                route_line = route.handler_location.line
+                chosen_pfx, chosen_auth = multi_entries[0][1], multi_entries[0][2]
+                for grp_line, grp_pfx, grp_auth in multi_entries:
+                    if grp_line <= route_line:
+                        chosen_pfx, chosen_auth = grp_pfx, grp_auth
+                    else:
+                        break
+                prefix_entry: tuple[str, bool, bool] | None = (chosen_pfx, chosen_auth, False)
+            else:
+                prefix_entry = file_prefix_map.get(handler_file)
+
+            if prefix_entry:
+                prefix, route_auth, allow_anon = prefix_entry
+                # Program.cs-level auth override (e.g. .RequireAuthorization() on the
+                # extension method call) takes precedence over no-auth from same-file group
+                if has_prog_auth:
+                    route_auth = True
+                    allow_anon = False
+
+                new_path = prefix.rstrip("/") + "/" + route.path.lstrip("/")
+                new_path = _re.sub(r"/+", "/", new_path)
+
+                new_deps = list(route.dependencies or [])
+                if allow_anon:
+                    new_deps = [d for d in new_deps if "Authorize" not in d]
+                elif route_auth:
+                    if not any("Authorize" in d or "permission" in d.lower() for d in new_deps):
+                        new_deps.insert(0, "Authorize@group")
+
+                updated.append(
+                    route.model_copy(
+                        update={
+                            "path": new_path,
+                            "id": stable_id("ep", route.method, new_path),
+                            "dependencies": new_deps,
+                        }
+                    )
+                )
+
+            elif has_prog_auth:
+                # Auth-only override without a prefix change (extension method defines
+                # its own routes directly, prefix already correct in the route)
+                new_deps = list(route.dependencies or [])
+                if not any("Authorize" in d or "permission" in d.lower() for d in new_deps):
+                    new_deps.insert(0, "Authorize@group")
+                updated.append(route.model_copy(update={"dependencies": new_deps}))
+
+            else:
+                updated.append(route)
+
+        return updated
+
+    def _setup_legacy_plugin(self, plugin, language: Language) -> None:
+        """
+        Set up a legacy plugin that doesn't use AnalysisContext.
+
+        This provides backward compatibility with plugins that use
+        the old setter-based approach.
+        """
+        context = self._analysis_contexts.get(language)
+        if not context:
+            return
+
+        # Get successfully parsed files for this language
+        successful_files = [
+            p for p in self._parsed_files.values() if p.success and p.language == language
+        ]
+
+        # Set up legacy services from context
+        if hasattr(plugin, "set_cross_file_resolver"):
+            # Get raw resolver from language services
+            raw_resolver = context.language_services.get("_raw_cross_file_resolver")
+            if raw_resolver:
+                plugin.set_cross_file_resolver(raw_resolver)
+
+        if hasattr(plugin, "set_router_registry"):
+            raw_registry = context.language_services.get("_raw_router_registry")
+            if raw_registry:
+                plugin.set_router_registry(raw_registry)
+
+        if hasattr(plugin, "set_path_resolver"):
+            raw_path_resolver = context.language_services.get("_raw_path_resolver")
+            if raw_path_resolver:
+                plugin.set_path_resolver(raw_path_resolver)
+
+        if hasattr(plugin, "set_project_context"):
+            plugin.set_project_context(
+                successful_files,
+                project_root=self.config.project_root,
+            )
+
+    def _convert_route(self, route, route_id: str, framework: str = "fastapi") -> RouteModel:
+        """Convert ExtractedRoute to RouteModel (framework from plugin)."""
+        # Convert parameters, using the actual ParameterLocation name when available
+        path_params = [
+            HttpParameterModel(
+                name=p.name,
+                location=p.location.name.lower() if hasattr(p.location, "name") else "path",
+                type_annotation=p.type_annotation,
+                required=p.required,
+                default_value=p.default_value,
+                alias=p.alias,
+                constraints=p.constraints,
+            )
+            for p in route.path_params
+        ]
+
+        query_params = [
+            HttpParameterModel(
+                name=p.name,
+                location=p.location.name.lower() if hasattr(p.location, "name") else "query",
+                type_annotation=p.type_annotation,
+                required=p.required,
+                default_value=p.default_value,
+                alias=p.alias,
+                constraints=p.constraints,
+            )
+            for p in route.query_params
+        ]
+
+        header_params = [
+            HttpParameterModel(
+                name=p.name,
+                location="header",
+                type_annotation=p.type_annotation,
+                required=p.required,
+                default_value=p.default_value,
+            )
+            for p in route.header_params
+        ]
+
+        cookie_params = [
+            HttpParameterModel(
+                name=p.name,
+                location="cookie",
+                type_annotation=p.type_annotation,
+                required=p.required,
+                default_value=p.default_value,
+            )
+            for p in route.cookie_params
+        ]
+
+        # Convert body — enrich field list with types from the resolver
+        body = None
+        if route.body:
+            enriched_fields = self._enrich_body_fields(
+                route.body.model_name,
+                route.body.model_fields,
+                route.handler_location.file if route.handler_location else None,
+            )
+            body = HttpBodyModel(
+                content_type=route.body.content_type,
+                model_name=route.body.model_name,
+                model_fields=enriched_fields,
+                required=route.body.required,
+            )
+
+        return RouteModel(
+            id=route_id,
+            kind=route.kind,
+            method=route.method.name,
+            path=route.path,
+            path_params=path_params,
+            query_params=query_params,
+            header_params=header_params,
+            cookie_params=cookie_params,
+            body=body,
+            handler_function=route.handler_function.full,
+            handler_location=LocationModel(
+                file=str(route.handler_location.file),
+                line=route.handler_location.line,
+                column=route.handler_location.column,
+            ),
+            framework=framework,
+            router_name=route.router_name,
+            tags=route.tags,
+            operation_id=route.operation_id,
+            summary=route.summary,
+            deprecated=route.deprecated,
+            dependencies=route.dependency_refs,
+            response_model=route.response.model_name,
+            response_status_code=route.response.status_code,
+        )
+
+    # =========================================================================
+    # Body Field Enrichment & Schema Collection
+    # =========================================================================
+
+    def _enrich_body_fields(
+        self,
+        model_name: str | None,
+        raw_field_names: list[str],
+        in_file: Path | None,
+    ) -> list[BodyFieldModel]:
+        """Resolve raw field name strings into typed BodyFieldModel objects."""
+        if not model_name:
+            return [BodyFieldModel(name=n) for n in raw_field_names]
+
+        type_resolver = self._get_type_resolver()
+        if not type_resolver:
+            return [BodyFieldModel(name=n) for n in raw_field_names]
+
+        known_models = set(type_resolver.get_all_models().keys())
+        resolved_fields = type_resolver.get_model_fields(model_name, in_file)
+        resolved_by_name = {f.name: f for f in resolved_fields}
+        result: list[BodyFieldModel] = []
+
+        # When raw_field_names is empty (e.g. Ardalis pattern where body type is
+        # known but fields were not pre-populated), use the resolved fields directly.
+        names_to_process = raw_field_names if raw_field_names else [f.name for f in resolved_fields]
+
+        for name in names_to_process:
+            rf = resolved_by_name.get(name)
+            if rf:
+                inner_type = self._unwrap_inner_type(rf.type_annotation)
+                is_complex = self._is_known_model(inner_type, known_models)
+                result.append(
+                    BodyFieldModel(
+                        name=name,
+                        type_annotation=rf.type_annotation,
+                        required=rf.is_required,
+                        is_complex=is_complex,
+                        nested_model=inner_type if is_complex else None,
+                        constraints=rf.constraints,
+                    )
+                )
+            else:
+                result.append(BodyFieldModel(name=name))
+
+        return result
+
+    _ORM_BASE_CLASSES = frozenset(
+        {
+            "SQLModel",
+            "DeclarativeBase",
+            "Base",
+            "Model",
+            "db.Model",
+            "Document",
+            "EmbeddedDocument",
+        }
+    )
+
+    def _collect_schemas(self, routes: list[RouteModel]) -> dict[str, SchemaModel]:
+        """
+        Transitively collect all schemas referenced by route bodies.
+
+        Walks the body model for every route, resolves each nested model,
+        and keeps going until no new models are discovered.
+        """
+        type_resolver = self._get_type_resolver()
+        if not type_resolver:
+            return {}
+
+        known_models = set(type_resolver.get_all_models().keys())
+        simple_to_qualified: dict[str, str] = {}
+        for qname in known_models:
+            simple = qname.rsplit(".", 1)[-1]
+            simple_to_qualified[simple] = qname
+
+        # Pre-compute usage sets from routes
+        request_body_names: set[str] = set()
+        response_model_names: set[str] = set()
+        for route in routes:
+            if route.body and route.body.model_name:
+                request_body_names.add(route.body.model_name)
+            if route.response_model:
+                response_model_names.add(route.response_model)
+
+        schemas: dict[str, SchemaModel] = {}
+        queue: list[str] = []
+
+        for name in request_body_names:
+            if name not in schemas:
+                queue.append(name)
+
+        for name in response_model_names:
+            if name not in schemas:
+                queue.append(name)
+
+        for model_qname in type_resolver.get_all_models():
+            simple_name = model_qname.rsplit(".", 1)[-1]
+            if simple_name not in schemas:
+                queue.append(simple_name)
+
+        visited: set[str] = set()
+
+        while queue:
+            model_name = queue.pop(0)
+            if model_name in visited:
+                continue
+            visited.add(model_name)
+
+            resolved_fields = type_resolver.get_model_fields(model_name, None)
+            if not resolved_fields:
+                continue
+
+            resolved_type = type_resolver.resolve_type(model_name, None)
+            qualified_name = resolved_type.qualified_name if resolved_type else None
+            base_classes = (
+                list(resolved_type.base_classes)
+                if resolved_type and resolved_type.base_classes
+                else []
+            )
+            is_enum = resolved_type.is_enum if resolved_type else False
+
+            # Determine usage based on discovery source and base classes
+            usage: list[str] = []
+            if model_name in request_body_names:
+                usage.append("request_body")
+            if model_name in response_model_names:
+                usage.append("response")
+            base_simple_names = {b.rsplit(".", 1)[-1] for b in base_classes}
+            if base_simple_names & self._ORM_BASE_CLASSES:
+                usage.append("orm")
+            if not usage:
+                usage.append("domain")
+
+            schema_fields: list[SchemaFieldModel] = []
+            for rf in resolved_fields:
+                inner_type = self._unwrap_inner_type(rf.type_annotation)
+                is_complex = self._is_known_model(inner_type, known_models)
+                schema_fields.append(
+                    SchemaFieldModel(
+                        name=rf.name,
+                        type_annotation=rf.type_annotation,
+                        required=rf.is_required,
+                        default_value=rf.default_value,
+                        is_complex=is_complex,
+                        nested_model=inner_type if is_complex else None,
+                        alias=rf.alias,
+                        constraints=rf.constraints,
+                    )
+                )
+                if is_complex and inner_type and inner_type not in visited:
+                    queue.append(inner_type)
+
+            schemas[model_name] = SchemaModel(
+                name=model_name,
+                qualified_name=qualified_name,
+                fields=schema_fields,
+                base_classes=base_classes,
+                is_enum=is_enum,
+                usage=usage,
+            )
+
+        return schemas
+
+    @staticmethod
+    def _unwrap_inner_type(type_annotation: str | None) -> str | None:
+        """Strip Optional[...] and list[...] wrappers to get the core type name."""
+        if not type_annotation:
+            return None
+        t = type_annotation
+        for prefix in ("Optional[", "optional["):
+            if t.startswith(prefix) and t.endswith("]"):
+                t = t[len(prefix) : -1].strip()
+        for prefix in (
+            "list[",
+            "List[",
+            "Sequence[",
+            "set[",
+            "Set[",
+            "frozenset[",
+            "FrozenSet[",
+            "tuple[",
+            "Tuple[",
+        ):
+            if t.startswith(prefix) and t.endswith("]"):
+                t = t[len(prefix) : -1].strip()
+                # Handle list[Optional[X]]
+                for inner_prefix in ("Optional[", "optional["):
+                    if t.startswith(inner_prefix) and t.endswith("]"):
+                        t = t[len(inner_prefix) : -1].strip()
+                break
+        return t
+
+    @staticmethod
+    def _is_known_model(type_name: str | None, known_models: set[str]) -> bool:
+        """Check whether a (simple) type name matches any known model."""
+        if not type_name:
+            return False
+        if type_name in known_models:
+            return True
+        # known_models contains qualified names; check if the simple name
+        # matches the suffix of any qualified name.
+        return any(qn.endswith("." + type_name) for qn in known_models)
+
+    def _get_type_resolver(self):
+        """Get the type resolver from whichever analysis context is available."""
+        ctx = (
+            self._analysis_contexts.get(Language.PYTHON)
+            or self._analysis_contexts.get(Language.JAVA)
+            or self._analysis_contexts.get(Language.CSHARP)
+        )
+        return ctx.type_resolver if ctx else None
+
+    # =========================================================================
+    # Dependency Extraction
+    # =========================================================================
+
+    def _extract_all_dependencies(self) -> list[dict]:
+        """Extract all dependency definitions."""
+        dependencies = []
+
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            for fw in self._detected_frameworks:
+                plugin = FrameworkPluginRegistry.get_plugin(fw)
+                if plugin and plugin.detect(parsed_file):
+                    deps = plugin.extract_dependencies(parsed_file)
+                    dependencies.extend(deps)
+
+        return dependencies
+
+    # =========================================================================
+    # Auth Extraction
+    # =========================================================================
+
+    def _extract_auth_data(self) -> AuthModel:
+        """Extract authentication data from all files."""
+        schemes: list[AuthSchemeModel] = []
+        auth_deps: list[AuthDependencyModel] = []
+        jwt_config = JwtConfigModel()
+
+        # Pre-pass: collect all Depends() argument names and all auth-scheme
+        # variable names across the entire project.  This bridges the standard
+        # FastAPI pattern where auth deps are defined in deps.py but used via
+        # Depends() in routers/*.py — both sets will be non-empty even though
+        # neither file contains both halves.
+        import re as _re
+
+        all_project_depends_names: set[str] = set()
+        all_project_scheme_names: set[str] = set()
+        for _pf in self._parsed_files.values():
+            if not _pf.success:
+                continue
+            for _call in _pf.call_sites:
+                if getattr(_call, "callee_name", None) == "Depends":
+                    for _arg in _call.arguments:
+                        if getattr(_arg, "is_variable", False) and _arg.variable_name:
+                            # Direct reference: Depends(get_current_user)
+                            all_project_depends_names.add(_arg.variable_name)
+                        if getattr(_arg, "literal_value", None):
+                            all_project_depends_names.add(str(_arg.literal_value))
+                        # Factory-call pattern: Depends(get_current_user_authorizer())
+                        _expr = getattr(_arg, "expression_text", None) or ""
+                        _fm = _re.match(r"(\w+)\s*\(", _expr)
+                        if _fm:
+                            all_project_depends_names.add(_fm.group(1))
+            for _func in _pf.functions:
+                for _param in _func.parameters:
+                    if _param.default_value:
+                        for _m in _re.finditer(r"Depends\s*\(\s*(\w+)", _param.default_value):
+                            all_project_depends_names.add(_m.group(1))
+            for _fw in self._detected_frameworks:
+                _plugin = FrameworkPluginRegistry.get_plugin(_fw)
+                if _plugin and _plugin.detect(_pf):
+                    for _scheme in _plugin.extract_auth_schemes(_pf):
+                        if _scheme.name:
+                            all_project_scheme_names.add(_scheme.name)
+
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            for fw in self._detected_frameworks:
+                plugin = FrameworkPluginRegistry.get_plugin(fw)
+                if plugin and plugin.detect(parsed_file):
+                    # Extract schemes and collect names for dependency correlation
+                    file_scheme_names: set[str] = set()
+                    for scheme in plugin.extract_auth_schemes(parsed_file):
+                        file_scheme_names.add(scheme.name)
+                        try:
+                            schemes.append(
+                                AuthSchemeModel(
+                                    id=stable_id(
+                                        "scheme",
+                                        scheme.scheme_type.name,
+                                        str(scheme.location.file),
+                                        str(scheme.location.line),
+                                    ),
+                                    type=scheme.scheme_type.name,
+                                    framework=fw.name.lower(),
+                                    location=LocationModel(
+                                        file=str(scheme.location.file),
+                                        line=scheme.location.line,
+                                    ),
+                                    config=scheme.config,
+                                )
+                            )
+                        except ValidationError as exc:
+                            # Malformed scheme record — skip rather than abort the entire
+                            # analysis. This was previously a hard-crash path (see
+                            # dispatch-main repro) because a single framework plugin
+                            # producing a bad LocationModel killed the whole run.
+                            logger.warning(
+                                "Skipping malformed AuthSchemeModel for scheme=%r file=%s: %s",
+                                scheme.name,
+                                getattr(scheme.location, "file", "<unknown>"),
+                                exc,
+                            )
+                            continue
+
+                    # Extract auth dependencies using cross-file pre-pass sets
+                    # so that deps defined in deps.py and used in routers/*.py
+                    # are correctly detected in both directions.
+                    for dep in plugin.extract_auth_dependencies(
+                        parsed_file,
+                        known_scheme_names=file_scheme_names | all_project_scheme_names,
+                        all_project_depends_names=all_project_depends_names,
+                    ):
+                        try:
+                            auth_deps.append(
+                                AuthDependencyModel(
+                                    id=stable_id("dep", dep.name, dep.dependency_type.name),
+                                    name=dep.name,
+                                    type=dep.dependency_type.name,
+                                    location=LocationModel(
+                                        file=str(dep.location.file),
+                                        line=dep.location.line,
+                                    ),
+                                    uses_schemes=list(dep.uses_schemes),
+                                    extracts=dep.extracts_fields,
+                                    validates=dep.validates,
+                                    jwt_operations=dep.jwt_operations,
+                                )
+                            )
+                        except ValidationError as exc:
+                            logger.warning(
+                                "Skipping malformed AuthDependencyModel for dep=%r file=%s: %s",
+                                dep.name,
+                                getattr(dep.location, "file", "<unknown>"),
+                                exc,
+                            )
+                            continue
+
+                    # Extract JWT config
+                    jwt = plugin.extract_jwt_config(parsed_file)
+                    if jwt and jwt.detected:
+                        jwt_config.detected = True
+                        jwt_config.library = jwt.library
+                        jwt_config.algorithms = jwt.algorithms
+
+        # Framework-independent JWT scan: detect JWT usage in files that
+        # framework plugins don't cover (e.g. service modules without FastAPI imports).
+        if not jwt_config.detected:
+            jwt_libraries = {"jose", "python-jose", "pyjwt", "jwt", "authlib"}
+            for parsed_file in self._parsed_files.values():
+                if not parsed_file.success:
+                    continue
+                for imp in parsed_file.imports:
+                    if imp.module in jwt_libraries or any(
+                        imp.module.startswith(f"{lib}.") for lib in jwt_libraries
+                    ):
+                        jwt_config.detected = True
+                        jwt_config.library = imp.module.split(".")[0]
+                        for call in parsed_file.call_sites:
+                            if (
+                                "decode" in call.callee_name.lower()
+                                or "encode" in call.callee_name.lower()
+                            ):
+                                jwt_config.locations.append(call.location)
+                        break
+                if jwt_config.detected:
+                    break
+
+        # Synthetic fallback: if JWT usage is detected (via any library) but no
+        # framework-specific security objects were found, create an inferred
+        # JWT_BEARER scheme so downstream auth mapping has something to match.
+        if jwt_config.detected and not schemes:
+            # jwt_config.locations contains CodeLocation objects (file: Path);
+            # AuthSchemeModel.location expects a LocationModel (file: str).
+            # Always construct explicitly to avoid Pydantic validation failures.
+            if jwt_config.locations:
+                raw_loc = jwt_config.locations[0]
+                loc = LocationModel(
+                    file=str(getattr(raw_loc, "file", "unknown")),
+                    line=getattr(raw_loc, "line", 0) or 0,
+                )
+            else:
+                loc = LocationModel(file="unknown", line=0)
+            try:
+                schemes.append(
+                    AuthSchemeModel(
+                        id=stable_id("scheme", "JWT_BEARER", jwt_config.library or "jwt"),
+                        type="JWT_BEARER",
+                        framework="generic",
+                        location=loc,
+                        config={
+                            "library": jwt_config.library,
+                            "algorithms": jwt_config.algorithms,
+                            "synthetic": True,
+                        },
+                    )
+                )
+            except ValidationError as exc:
+                logger.warning("Skipping synthetic JWT_BEARER AuthSchemeModel: %s", exc)
+
+        return AuthModel(
+            schemes_detected=schemes,
+            auth_dependencies=auth_deps,
+            jwt_config=jwt_config,
+        )
+
+    def _propagate_file_auth_to_routes(
+        self,
+        routes: list[RouteModel],
+        auth_model: AuthModel,
+    ) -> None:
+        """
+        Propagate file-level auth dependencies to routes that have no per-route
+        auth signal (router_name is None).
+
+        Middleware-based auth frameworks (Express, NestJS without per-route guards)
+        express auth as router.use(middleware) at the sub-router level.
+        extract_auth_dependencies() correctly detects these as MIDDLEWARE-type deps,
+        but the routes themselves carry no router_name because the middleware is not
+        an inline argument to the route registration call.
+
+        This pass closes that gap: for each route without router_name, if its
+        handler file has a MIDDLEWARE auth dependency, set router_name to that
+        dependency's name so the benchmark's auth signal is populated.
+
+        Only MIDDLEWARE-type deps are used — CLASS/DECORATOR/ANNOTATION deps are
+        already captured directly on routes during extraction.
+        """
+        # Build file → first MIDDLEWARE auth dep name
+        file_to_auth_dep: dict[str, str] = {}
+        for dep in auth_model.auth_dependencies:
+            if dep.type != "MIDDLEWARE":
+                continue
+            if not dep.location or not dep.location.file:
+                continue
+            file_key = dep.location.file
+            if file_key not in file_to_auth_dep:
+                file_to_auth_dep[file_key] = dep.name
+
+        if not file_to_auth_dep:
+            return
+
+        for route in routes:
+            if route.router_name is not None:
+                continue  # already has a per-route auth signal
+            if not route.handler_location or not route.handler_location.file:
+                continue
+            dep_name = file_to_auth_dep.get(route.handler_location.file)
+            if dep_name:
+                route.router_name = dep_name
+
+    def _apply_spring_filter_chain_policy(self, routes: list[RouteModel]) -> None:
+        """Apply a Spring SecurityFilterChain policy to Spring/GraphQL routes.
+
+        Routes already carrying a router_name (per-method annotations) are left
+        alone.  Routes with no auth signal are marked router_name="SecurityFilterChain"
+        if the global policy says they require authentication.
+        """
+        from ..frameworks.java.spring_plugin import FilterChainPolicy, SpringBootPlugin
+
+        plugin = FrameworkPluginRegistry.get_plugin(Framework.SPRING_BOOT)
+        if not isinstance(plugin, SpringBootPlugin):
+            return
+
+        policy: FilterChainPolicy | None = plugin.get_filter_chain_policy(
+            list(self._parsed_files.values())
+        )
+        if policy is None or not policy.any_request_auth:
+            return
+
+        for route in routes:
+            if route.router_name is not None:
+                continue
+            if route.framework not in ("spring_boot", "graphql"):
+                continue
+            if policy.requires_auth(route.path):
+                route.router_name = "SecurityFilterChain"
+
+    def _populate_route_auth_mapping(
+        self,
+        auth_model: AuthModel,
+        routes: list[RouteModel],
+        middleware_list: list[MiddlewareModel] | None = None,
+    ) -> None:
+        """Generate route_auth_mapping by correlating route dependencies with auth deps.
+
+        A route is considered authenticated if any of its ``dependencies``
+        reference a known auth dependency (by name match).  Auth dependencies
+        are identified by their name appearing in ``auth_model.auth_dependencies``.
+
+        Heuristic fallback: if no formal auth dependencies were detected but
+        routes have dependency names containing auth-related keywords
+        (``auth``, ``user``, ``token``, ``permission``, ``login``, ``verify``),
+        we still treat those as auth-related.
+
+        Middleware-based auth (e.g. ``app.add_middleware(AuthMiddleware, ...)``)
+        is also propagated: if any globally-applied middleware declares
+        ``operations=['auth']``, every route without route-level auth is marked
+        authenticated with mechanism ``middleware:<name>`` so the engine's
+        missing_auth rule will not fire for middleware-protected apps.
+        """
+        AUTH_KEYWORDS = {
+            "auth",
+            "user",
+            "token",
+            "permission",
+            "login",
+            "verify",
+            "current_user",
+            "principal",
+            "credential",
+            "identity",
+            "session",
+            "bearer",
+            "api_key",
+            "apikey",
+            "security",
+            "authorize",
+            "authenticated",
+        }
+
+        known_auth_names = {dep.name for dep in auth_model.auth_dependencies}
+
+        global_auth_middleware: list[MiddlewareModel] = []
+        if middleware_list:
+            for mw in middleware_list:
+                if "auth" not in mw.operations:
+                    continue
+                # Only applies_to=["all"] (set by explicit app.UseMiddleware<T>() registration)
+                # indicates truly global scope. Empty applies_to means "not explicitly scoped",
+                # which is how class-based definitions are recorded — they are NOT necessarily global.
+                if mw.applies_to == ["all"]:
+                    global_auth_middleware.append(mw)
+
+        has_global_auth_middleware = bool(global_auth_middleware)
+        middleware_mechanisms = [f"middleware:{mw.name}" for mw in global_auth_middleware]
+
+        mapping: list[RouteAuthModel] = []
+        for route in routes:
+            if not route.dependencies:
+                # No route-level Depends(), but a global auth middleware may
+                # still protect this endpoint.
+                if has_global_auth_middleware:
+                    mapping.append(
+                        RouteAuthModel(
+                            route_id=route.id,
+                            auth_required=True,
+                            mechanisms=list(middleware_mechanisms),
+                        )
+                    )
+                else:
+                    mapping.append(
+                        RouteAuthModel(
+                            route_id=route.id,
+                            auth_required=False,
+                        )
+                    )
+                continue
+
+            matched_mechanisms: list[str] = []
+            for dep_name in route.dependencies:
+                dep_base = dep_name.rsplit(".", 1)[-1]
+
+                if dep_base in known_auth_names or dep_name in known_auth_names:
+                    matched_mechanisms.append(dep_name)
+                    continue
+
+                name_lower = dep_base.lower()
+                if any(kw in name_lower for kw in AUTH_KEYWORDS):
+                    matched_mechanisms.append(dep_name)
+
+            # Even if route-level deps didn't match, middleware can still
+            # provide auth.
+            if not matched_mechanisms and has_global_auth_middleware:
+                matched_mechanisms = list(middleware_mechanisms)
+
+            mapping.append(
+                RouteAuthModel(
+                    route_id=route.id,
+                    auth_required=bool(matched_mechanisms),
+                    mechanisms=matched_mechanisms,
+                )
+            )
+
+        auth_model.route_auth_mapping = mapping
+        auth_model.global_middleware_auth = has_global_auth_middleware
+
+    def _link_routes_to_auth_schemes(
+        self,
+        routes: list[RouteModel],
+        auth_model: AuthModel,
+    ) -> None:
+        """Populate ``auth_config_ref`` on each route from the auth model.
+
+        Strategy:
+        1. Build a dep-name → scheme-id index from ``auth_dependencies.uses_schemes``.
+        2. For each authenticated route, look up its mechanisms (dep names) in
+           that index and set ``auth_config_ref`` to the first matching scheme.
+        3. Fallback: if the index yields no match but auth *is* required and
+           at least one scheme exists, assign the first scheme (common in
+           single-scheme apps).
+        """
+        scheme_by_dep: dict[str, str] = {}
+        for dep in auth_model.auth_dependencies:
+            for scheme_id in dep.uses_schemes:
+                scheme_by_dep[dep.name] = scheme_id
+
+        mapping_by_route: dict[str, RouteAuthModel] = {
+            m.route_id: m for m in auth_model.route_auth_mapping
+        }
+        fallback_scheme = auth_model.schemes_detected[0].id if auth_model.schemes_detected else None
+
+        for route in routes:
+            mapping = mapping_by_route.get(route.id)
+            if not mapping or not mapping.auth_required:
+                continue
+            for mech in mapping.mechanisms:
+                mech_base = mech.rsplit(".", 1)[-1]
+                if mech_base in scheme_by_dep:
+                    route.auth_config_ref = scheme_by_dep[mech_base]
+                    break
+                if mech in scheme_by_dep:
+                    route.auth_config_ref = scheme_by_dep[mech]
+                    break
+            if not route.auth_config_ref and fallback_scheme:
+                route.auth_config_ref = fallback_scheme
+
+    # =========================================================================
+    # Middleware Extraction
+    # =========================================================================
+
+    def _extract_middleware(self) -> list[MiddlewareModel]:
+        """Extract middleware from all files."""
+        middleware: list[MiddlewareModel] = []
+
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            for fw in self._detected_frameworks:
+                plugin = FrameworkPluginRegistry.get_plugin(fw)
+                if plugin and plugin.detect(parsed_file):
+                    for mw in plugin.extract_middleware(parsed_file):
+                        middleware.append(
+                            MiddlewareModel(
+                                id=stable_id("mw", mw.name, mw.middleware_type),
+                                name=mw.name,
+                                type=mw.middleware_type,
+                                location=LocationModel(
+                                    file=str(mw.location.file),
+                                    line=mw.location.line,
+                                ),
+                                order=mw.order,
+                                applies_to=mw.applies_to_patterns or ["all"]
+                                if mw.applies_to_all
+                                else [],
+                                operations=mw.operations,
+                            )
+                        )
+
+        return middleware
+
+    # =========================================================================
+    # Call Site Extraction
+    # =========================================================================
+
+    def _extract_all_calls(self) -> list[FunctionCallModel]:
+        """Extract all function call sites from the call graph.
+
+        Assigns a ``sequence_index`` to each call so the reasoning engine
+        can reason about intra-function ordering (e.g. mutation-before-authz).
+        """
+        if not self._call_graph:
+            return []
+
+        raw_calls = list(self._call_graph.to_manifest_calls())
+
+        # Group by caller and sort by line number to assign sequence_index.
+        from collections import defaultdict
+
+        by_caller: dict[str, list[dict]] = defaultdict(list)
+        for cd in raw_calls:
+            by_caller[cd["caller"]].append(cd)
+        for group in by_caller.values():
+            group.sort(key=lambda c: c["location"].get("line", 0))
+            for idx, cd in enumerate(group):
+                cd["_sequence_index"] = idx
+
+        calls: list[FunctionCallModel] = []
+        for call_dict in raw_calls:
+            try:
+                ctx = call_dict.get("context", {})
+                call = FunctionCallModel(
+                    id=call_dict["id"],
+                    caller=call_dict["caller"],
+                    callee=call_dict["callee"],
+                    callee_resolved=call_dict["callee_resolved"],
+                    location=LocationModel(
+                        file=call_dict["location"]["file"],
+                        line=call_dict["location"]["line"],
+                        column=call_dict["location"].get("column", 0),
+                    ),
+                    context=CallContextModel(
+                        in_try_block=ctx.get("in_try_block", False),
+                        in_conditional=ctx.get("in_conditional", False),
+                        in_loop=ctx.get("in_loop", False),
+                    ),
+                    possible_callees=call_dict.get("possible_callees", []),
+                    sequence_index=call_dict.get("_sequence_index"),
+                )
+                calls.append(call)
+            except (KeyError, ValueError, TypeError) as e:
+                logger.error("Failed to convert call: %s", e, exc_info=True)
+                self._warnings.append(
+                    AnalysisWarning(
+                        phase="call_extraction",
+                        message=f"Failed to convert call: {e}",
+                        file=call_dict.get("location", {}).get("file"),
+                    )
+                )
+                continue
+
+        return calls
+
+    # =========================================================================
+    # Data Flow Analysis
+    # =========================================================================
+
+    def _analyze_data_flows(
+        self, routes: list[RouteModel]
+    ) -> tuple[list[DataFlowModel], dict[str, int]]:
+        """
+        Analyze data flows from entry points to sinks.
+
+        Uses inter-procedural taint tracking through the call graph.
+        Returns (flows, stats) for manifest metadata.
+        """
+        flows: list[DataFlowModel] = []
+        self._data_flow_stats = {
+            "entry_points_analyzed": 0,
+            "origins_identified": 0,
+            "flows_discovered": 0,
+            "truncated_flows": 0,
+        }
+
+        if not self._call_graph:
+            return flows, self._data_flow_stats
+
+        successful_files = [p for p in self._parsed_files.values() if p.success]
+        if not successful_files:
+            return flows, self._data_flow_stats
+
+        entry_points = [
+            {
+                "id": r.id,
+                "path": r.path,
+                "handler_qualified_name": r.handler_function,
+                "framework": r.framework,
+                "path_params": [{"name": p.name} for p in (r.path_params or [])],
+                "query_params": [{"name": p.name} for p in (r.query_params or [])],
+                "header_params": [{"name": p.name} for p in (r.header_params or [])],
+                "cookie_params": [{"name": p.name} for p in (r.cookie_params or [])],
+                "body": {
+                    "model_fields": [
+                        {"name": f.name} if hasattr(f, "name") else {"name": f}
+                        for f in (r.body.model_fields or [])
+                    ]
+                }
+                if r.body
+                else None,
+            }
+            for r in routes
+        ]
+
+        # Reuse shared flow-sensitive bindings (built once in _build_shared_flow_bindings)
+        flow_bindings = self._flow_bindings
+
+        # Resolve handler names to call graph symbols (qualified name consistency)
+        entry_points = self._resolve_entry_points(entry_points)
+
+        max_depth = self.config.analysis.data_flow.max_depth
+
+        try:
+            df_analyzer = DataFlowAnalyzer(
+                call_graph=self._call_graph,
+                parsed_files=successful_files,
+                entry_points=entry_points,
+                flow_bindings=flow_bindings,
+                max_depth=max_depth,
+            )
+            df_analyzer.analyze()
+            self._data_flow_stats = df_analyzer.get_statistics()
+
+            # Convert to manifest format
+            for flow_dict in df_analyzer.to_manifest_flows():
+                try:
+                    flow_model = DataFlowModel(**flow_dict)
+                    flows.append(flow_model)
+                except (KeyError, ValueError, TypeError) as e:
+                    logger.error("Failed to convert data flow to model: %s", e, exc_info=True)
+                    self._warnings.append(
+                        AnalysisWarning(
+                            phase="data_flow",
+                            message=f"Failed to convert data flow: {e}",
+                        )
+                    )
+
+        except Exception as e:
+            logger.error("Data flow analysis failed: %s", e, exc_info=True)
+            self._warnings.append(
+                AnalysisWarning(
+                    phase="data_flow",
+                    message=f"Data flow analysis failed: {e}",
+                )
+            )
+
+        return flows, self._data_flow_stats
+
+    def _resolve_entry_points(self, entry_points: list[dict[str, Any]]) -> list[dict[str, Any]]:
+        """
+        Resolve handler qualified names to call graph symbols.
+
+        Handles mismatches between route extraction and call graph naming
+        (e.g., module path variations).
+        """
+        if not self._call_graph:
+            return entry_points
+
+        symbols = set(self._call_graph._symbols.keys())
+        resolved = []
+
+        for ep in entry_points:
+            handler = ep.get("handler_qualified_name")
+            if not handler:
+                resolved.append(ep)
+                continue
+
+            if handler in symbols:
+                resolved.append(ep)
+                continue
+
+            # Try common variations
+            candidates = [
+                handler,
+                handler.replace(".__init__", ""),
+            ]
+            # Try with/without package prefix (e.g., "app.main.get_user" -> "main.get_user")
+            if "." in handler:
+                parts = handler.split(".")
+                for i in range(1, len(parts)):
+                    variant = ".".join(parts[i:])
+                    if variant not in candidates:
+                        candidates.append(variant)
+
+            for cand in candidates:
+                if cand in symbols:
+                    ep = dict(ep)
+                    ep["handler_qualified_name"] = cand
+                    break
+            resolved.append(ep)
+
+        return resolved
+
+    # =========================================================================
+    # Integration Detection
+    # =========================================================================
+
+    def _detect_integrations(self) -> list[IntegrationModel]:
+        """Detect external integrations with usage tracking and SDK analysis."""
+        from .integration_detector import IntegrationDetector
+
+        detector = IntegrationDetector(list(self._parsed_files.values()))
+        return detector.to_manifest_models()
+
+    def _scan_literals(self) -> LiteralsModel:
+        """Scan all string literals for URLs, SQL fragments, and connection strings."""
+        from .literal_scanner import LiteralScanner
+
+        scanner = LiteralScanner(list(self._parsed_files.values()))
+        return scanner.to_manifest_models()
+
+    def _classify_sensitivity(
+        self,
+        integrations: list[IntegrationModel],
+        literals: LiteralsModel,
+    ) -> None:
+        """Classify sensitivity on integrations and SQL patterns (mutates in place)."""
+        from .sensitivity_classifier import SensitivityClassifier
+
+        classifier = SensitivityClassifier()
+        classifier.enrich_integrations(integrations)
+        classifier.enrich_sql_patterns(literals.sql_patterns)
+
+    def _tag_capabilities(
+        self,
+        integrations: list[IntegrationModel],
+        routes: list[RouteModel],
+        configuration: ConfigurationModel,
+    ) -> list[CapabilityModel]:
+        """Infer business capabilities from integrations, routes, and config."""
+        from .capability_tagger import CapabilityTagger
+
+        tagger = CapabilityTagger()
+        return tagger.tag(integrations, routes, configuration)
+
+    # =========================================================================
+    # Configuration Extraction
+    # =========================================================================
+
+    def _extract_configuration(self) -> ConfigurationModel:
+        """Extract configuration usage from code and .env files."""
+        from .config_scanner import ConfigScanner
+
+        env_var_names: dict[str, list[LocationModel]] = {}
+
+        # Phase 1: env vars referenced in code (os.getenv, os.environ.get)
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+            for call in parsed_file.call_sites:
+                if call.callee_name in {"os.environ.get", "os.getenv", "environ.get"}:
+                    for arg in call.arguments:
+                        if arg.position == 0 and arg.literal_value:
+                            var_name = str(arg.literal_value)
+                            if var_name not in env_var_names:
+                                env_var_names[var_name] = []
+                            env_var_names[var_name].append(
+                                LocationModel(
+                                    file=str(call.location.file),
+                                    line=call.location.line,
+                                )
+                            )
+
+        env_vars: list[EnvVarUsageModel] = [
+            EnvVarUsageModel(name=name, locations=locations)
+            for name, locations in env_var_names.items()
+        ]
+
+        # Phase 2: discover .env files and merge any new variable names
+        scanner = ConfigScanner(self.config.project_root)
+        env_file_vars = scanner.to_env_var_models()
+        existing_names = {ev.name for ev in env_vars}
+        for ev_model in env_file_vars:
+            if ev_model.name not in existing_names:
+                env_vars.append(ev_model)
+
+        # Phase 3: discover config files
+        config_files = scanner.to_config_file_models()
+
+        return ConfigurationModel(env_vars_used=env_vars, config_files=config_files)
+
+    # =========================================================================
+    # Function/Class Collection
+    # =========================================================================
+
+    def _collect_all_functions(self) -> tuple[list[FunctionModel], dict[str, str]]:
+        """Collect all functions (free + class methods) from parsed files.
+
+        Returns the function list and a qualified_name -> func_id index
+        so that _collect_all_classes can resolve method IDs.
+        """
+        functions: list[FunctionModel] = []
+        qn_to_id: dict[str, str] = {}
+
+        def _normalize_body(source: str | None) -> str:
+            """Normalize function body for hashing: strip comments, blank lines, and collapse whitespace."""
+            if not source:
+                return ""
+            lines = []
+            for line in source.splitlines():
+                stripped = line.strip()
+                if not stripped or stripped.startswith("#"):
+                    continue
+                if "#" in stripped:
+                    stripped = stripped[: stripped.index("#")].rstrip()
+                if stripped:
+                    lines.append(stripped)
+            return "\n".join(lines)
+
+        def _content_hash(func: ParsedFunction) -> str:  # noqa: F821
+            parts = []
+            for p in func.parameters:
+                parts.append(f"{p.name}:{p.type_annotation or ''}")
+            parts.append(f"ret:{func.return_type or ''}")
+            parts.append(f"ann:{','.join(d.name for d in func.decorators)}")
+            body = _normalize_body(func.body_source)
+            parts.append(f"body:{hashlib.sha256(body.encode()).hexdigest()[:16]}")
+            raw = "|".join(parts)
+            return hashlib.sha256(raw.encode("utf-8")).hexdigest()[:16]
+
+        def _append(func: ParsedFunction) -> None:  # noqa: F821
+            func_id = stable_id("func", func.qualified_name.full)
+            qn_to_id[func.qualified_name.full] = func_id
+            functions.append(
+                FunctionModel(
+                    id=func_id,
+                    qualified_name=func.qualified_name.full,
+                    name=func.name,
+                    location=LocationModel(
+                        file=str(func.location.file),
+                        line=func.location.line,
+                        column=func.location.column,
+                        end_line=func.location.end_line,
+                    ),
+                    is_async=func.is_async,
+                    binding=func.binding,
+                    visibility=self._infer_visibility(func.name),
+                    parameters=[
+                        ParameterModel(
+                            name=p.name,
+                            type_annotation=p.type_annotation,
+                            default_value=p.default_value,
+                            is_variadic=p.is_variadic,
+                            is_keyword_variadic=p.is_keyword_variadic,
+                        )
+                        for p in func.parameters
+                    ],
+                    return_type=func.return_type,
+                    annotations=[d.name for d in func.decorators],
+                    docstring=func.docstring,
+                    owner_type=func.owner_type,
+                    content_hash=_content_hash(func),
+                )
+            )
+
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+            for func in parsed_file.functions:
+                _append(func)
+            for cls in parsed_file.classes:
+                for method in cls.methods:
+                    _append(method)
+
+        return functions, qn_to_id
+
+    @staticmethod
+    def _infer_visibility(name: str) -> str | None:
+        """Infer visibility from Python naming convention."""
+        if name.startswith("__") and name.endswith("__"):
+            return "public"
+        if name.startswith("__") or name.startswith("_"):
+            return "private"
+        return "public"
+
+    def _collect_all_classes(self, func_id_index: dict[str, str]) -> list[ClassModel]:
+        """Collect all classes from parsed files.
+
+        Args:
+            func_id_index: qualified_name -> func_id mapping built by
+                _collect_all_functions, used to resolve method IDs.
+        """
+        classes: list[ClassModel] = []
+
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            for cls in parsed_file.classes:
+                method_ids = [func_id_index.get(m.qualified_name.full, m.name) for m in cls.methods]
+                classes.append(
+                    ClassModel(
+                        id=stable_id("cls", cls.qualified_name.full),
+                        qualified_name=cls.qualified_name.full,
+                        name=cls.name,
+                        location=LocationModel(
+                            file=str(cls.location.file),
+                            line=cls.location.line,
+                            column=cls.location.column,
+                            end_line=cls.location.end_line,
+                        ),
+                        base_classes=cls.base_classes,
+                        annotations=[d.name for d in cls.decorators],
+                        methods=method_ids,
+                        docstring=cls.docstring,
+                    )
+                )
+
+        return classes
+
+    # =========================================================================
+    # Manifest Building
+    # =========================================================================
+
+    def _build_analysis_metadata(self) -> AnalysisMetadataModel:
+        """Build analysis metadata from real statistics."""
+        truncated_flows = self._data_flow_stats.get("truncated_flows", 0)
+        unresolved_calls = 0
+
+        if self._call_graph:
+            cg_stats = self._call_graph.get_statistics()
+            resolution = cg_stats.get("resolution_confidence", {})
+            unresolved_calls = resolution.get("UNRESOLVED", 0)
+
+        return AnalysisMetadataModel(
+            data_flow_mode=self.config.analysis.data_flow.mode,
+            data_flow_depth=self.config.analysis.data_flow.max_depth,
+            truncated_flows=truncated_flows,
+            unresolved_calls=unresolved_calls,
+        )
+
+    def _build_manifest(
+        self,
+        routes: list[RouteModel],
+        functions: list[FunctionModel],
+        classes: list[ClassModel],
+        calls: list[FunctionCallModel],
+        data_flows: list[DataFlowModel],
+        auth: AuthModel,
+        middleware: list[MiddlewareModel],
+        dependencies: DependenciesModel,  # noqa: F821
+        integrations: list[IntegrationModel],
+        capabilities: list[CapabilityModel],
+        schemas: dict[str, SchemaModel],
+        literals: LiteralsModel,
+        configuration: ConfigurationModel,
+        analysis_time_ms: int,
+    ) -> Manifest:
+        """Build the final manifest."""
+        # Get project name
+        project_name = self.config.project_root.name
+        pyproject = self.config.project_root / "pyproject.toml"
+        if pyproject.exists():
+            try:
+                import tomllib
+
+                data = tomllib.loads(pyproject.read_text())
+                project_name = data.get("project", {}).get("name", project_name)
+            except Exception as e:
+                logger.debug("Could not read project name from pyproject.toml: %s", e)
+
+        # Determine languages
+        languages = []
+        if any(
+            f.language == Language.PYTHON
+            for f in self._discovery_result.files
+            if self._discovery_result
+        ):
+            languages.append("python")
+        if any(
+            f.language == Language.JAVA
+            for f in self._discovery_result.files
+            if self._discovery_result
+        ):
+            languages.append("java")
+        if any(
+            f.language == Language.CSHARP
+            for f in self._discovery_result.files
+            if self._discovery_result
+        ):
+            languages.append("csharp")
+        if any(
+            f.language == Language.JAVASCRIPT
+            for f in self._discovery_result.files
+            if self._discovery_result
+        ):
+            languages.append("javascript")
+
+        # Determine frameworks
+        frameworks = [fw.name.lower() for fw in self._detected_frameworks]
+
+        return Manifest(
+            manifest_version=MANIFEST_VERSION,
+            generated_at=datetime.utcnow(),
+            probe_version=_get_probe_version(),
+            project=ProjectMetadata(
+                root=str(self.config.project_root),
+                name=project_name,
+                languages_detected=languages,
+                frameworks_detected=frameworks,
+                files_analyzed=len([p for p in self._parsed_files.values() if p.success]),
+                files_skipped=len([p for p in self._parsed_files.values() if not p.success]),
+                analysis_duration_ms=analysis_time_ms,
+            ),
+            entry_points=routes,
+            functions=functions,
+            classes=classes,
+            calls=calls,
+            data_flows=data_flows,
+            auth=auth,
+            middleware=middleware,
+            dependencies=dependencies,
+            integrations=integrations,
+            capabilities=capabilities,
+            schemas=schemas,
+            literals=literals,
+            configuration=configuration,
+            analysis_metadata=self._build_analysis_metadata(),
+        )
+
+
+# =============================================================================
+# Convenience Function
+# =============================================================================
+
+
+def analyze_project(config: CodeBoltConfig) -> AnalysisResult:
+    """
+    Analyze a project and generate manifest.
+
+    Args:
+        config: Configuration for the analysis
+
+    Returns:
+        AnalysisResult containing manifest and metadata
+    """
+    analyzer = ProjectAnalyzer(config)
+    return analyzer.analyze()