apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/dotnet/aspnet_plugin.py

@@ -0,0 +1,2546 @@
+"""
+ASP.NET Core framework plugin.
+
+Extracts HTTP routes, auth schemes, dependencies, JWT config, and
+middleware from ASP.NET Core applications using attribute-based detection.
+
+Supports
+--------
+- [ApiController] / [Controller] with [Route("prefix")]
+- [HttpGet/Post/Put/Delete/Patch/Head/Options] route attributes
+- [Route] on methods as an additional path contributor
+- Multi-value path templates: "/api/{version:apiVersion}/users/{id:int}"
+- [FromRoute], [FromQuery], [FromBody], [FromHeader], [FromForm] parameters
+- Bean Validation equivalents: [Required], [Range], [MinLength], [MaxLength],
+  [StringLength], [RegularExpression], [EmailAddress]
+- [Authorize] / [AllowAnonymous] per-controller and per-action
+- [Authorize(Roles = "Admin,User")] role extraction
+- [Authorize(Policy = "...")] policy extraction
+- services.AddAuthentication() / AddJwtBearer() / AddOAuth() in Startup/Program
+- Middleware: IMiddleware, IActionFilter, app.UseMiddleware<T>(), app.Use()
+- Minimal API (MapGet / MapPost …) on WebApplication
+- [ProducesResponseType] / [Produces] / [Consumes] content negotiation
+"""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+import re
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, ClassVar
+
+from ...core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+    QualifiedName,
+)
+from ...parsing.base import (
+    ParsedCallSite,
+    ParsedClass,
+    ParsedDecorator,
+    ParsedFile,
+    ParsedFunction,
+)
+from ...parsing.services import AnalysisContext
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedBody,
+    ExtractedDependency,
+    ExtractedJwtConfig,
+    ExtractedMiddleware,
+    ExtractedParameter,
+    ExtractedResponse,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+from .jwt_config_extractor import DotNetJwtConfigExtractor
+
+if TYPE_CHECKING:
+    pass
+
+logger = logging.getLogger(__name__)
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+# Attribute name → HTTP method
+_HTTP_METHOD_ATTRS: dict[str, HttpMethod] = {
+    "HttpGet": HttpMethod.GET,
+    "HttpPost": HttpMethod.POST,
+    "HttpPut": HttpMethod.PUT,
+    "HttpDelete": HttpMethod.DELETE,
+    "HttpPatch": HttpMethod.PATCH,
+    "HttpHead": HttpMethod.HEAD,
+    "HttpOptions": HttpMethod.OPTIONS,
+}
+
+# Minimal API WebApplication extension methods → HTTP method
+_MINIMAL_API_METHODS: dict[str, HttpMethod] = {
+    "MapGet": HttpMethod.GET,
+    "MapPost": HttpMethod.POST,
+    "MapPut": HttpMethod.PUT,
+    "MapDelete": HttpMethod.DELETE,
+    "MapPatch": HttpMethod.PATCH,
+}
+
+# IEndpointConventionBuilder extension methods that can be chained on Map* calls.
+# Used to recognise that a call site is chained on a route registration.
+_MINIMAL_API_CHAINERS: frozenset[str] = frozenset(
+    {
+        "RequireAuthorization",
+        "AllowAnonymous",
+        "RequireRateLimiting",
+        "RequireCors",
+        "RequirePermission",
+        "RequireScope",
+        "WithName",
+        "WithTags",
+        "WithGroupName",
+        "WithOpenApi",
+        "WithMetadata",
+        "WithApiVersionSet",
+        "Produces",
+        "ProducesProblem",
+        "WithSummary",
+        "WithDescription",
+        "ExcludeFromDescription",
+        "DisableRateLimiting",
+        "WithIdempotency",
+    }
+)
+
+# Subset that carry explicit auth intent and should generate a dep_ref.
+_MINIMAL_API_AUTH_CHAINERS: frozenset[str] = frozenset(
+    {
+        "RequireAuthorization",
+        "AllowAnonymous",
+        "RequirePermission",
+        "RequireScope",
+    }
+)
+
+_CONTROLLER_ATTRS: frozenset[str] = frozenset({"ApiController", "Controller"})
+
+# IEndpointGroup base interface name used in the CleanArchitecture / group-builder pattern.
+_ENDPOINT_GROUP_BASES: frozenset[str] = frozenset({"IEndpointGroup"})
+
+# Standard ASP.NET Core Identity API endpoints registered by MapIdentityApi<T>().
+# Tuple: (HttpMethod, path-suffix, requires_auth)
+_IDENTITY_API_ROUTES: list[tuple[HttpMethod, str, bool]] = [
+    (HttpMethod.POST, "register", False),
+    (HttpMethod.POST, "login", False),
+    (HttpMethod.POST, "refresh", False),
+    (HttpMethod.GET, "confirmEmail", False),
+    (HttpMethod.POST, "resendConfirmationEmail", False),
+    (HttpMethod.POST, "forgotPassword", False),
+    (HttpMethod.POST, "resetPassword", False),
+    (HttpMethod.POST, "manage/2fa", True),
+    (HttpMethod.GET, "manage/info", True),
+    (HttpMethod.POST, "manage/info", True),
+]
+
+# Base classes that mark a class as a controller/endpoint (not a DTO)
+_CONTROLLER_BASE_CLASSES: frozenset[str] = frozenset(
+    {
+        "ControllerBase",
+        "Controller",
+        "ApiController",
+        "EndpointBaseAsync",
+        "EndpointBase",  # Ardalis ApiEndpoints
+        "PageModel",  # Razor Pages
+    }
+)
+
+_SECURITY_ATTRS: frozenset[str] = frozenset(
+    {
+        "Authorize",
+        "AllowAnonymous",
+        "RequireScope",
+    }
+)
+
+# Method names inherited from System.Object — never conventional MVC actions.
+_OBJECT_METHOD_NAMES: frozenset[str] = frozenset(
+    {
+        "Equals",
+        "GetHashCode",
+        "ToString",
+        "Finalize",
+    }
+)
+
+# Attributes that mark a controller method as NOT routable to HTTP.
+# - `[NonAction]`        — explicit "don't route" marker (both MVC + Web API)
+# - `[ChildActionOnly]`  — System.Web.Mvc; method renders a partial view via
+#                          Html.Action(...) and is invoked from a parent view,
+#                          never from a direct HTTP request.
+_NON_ROUTABLE_ATTRS: frozenset[str] = frozenset(
+    {
+        "NonAction",
+        "ChildActionOnly",
+    }
+)
+
+# camelCase / PascalCase → kebab-case for the slugify route-parameter transformer.
+# Matches the canonical Microsoft example: Regex.Replace(value, "([a-z])([A-Z])", "$1-$2").ToLower().
+_SLUGIFY_RE = re.compile(r"([a-z0-9])([A-Z])")
+
+
+def _slugify(name: str) -> str:
+    return _SLUGIFY_RE.sub(r"\1-\2", name).lower()
+
+
+def _file_registers_slugify(parsed_file: ParsedFile) -> bool:
+    """
+    Return True if `parsed_file` contains a `MapControllerRoute` call whose
+    route template uses the `:slugify=` constraint — the canonical signal
+    that the project has registered `SlugifyParameterTransformer`.
+    """
+    for call in parsed_file.call_sites:
+        if not call.callee_name.endswith("MapControllerRoute"):
+            continue
+        for arg in call.arguments:
+            value = arg.literal_value
+            if value and isinstance(value, str) and ":slugify=" in value:
+                return True
+    return False
+
+
+# Match `controller = "Foo"` and `action = "Bar"` inside `new { ... }` anonymous
+# initializers passed to routes.MapRoute / MapLocalizedRoute defaults.
+_MAPROUTE_CONTROLLER_RE = re.compile(
+    r'\bcontroller\s*=\s*"([A-Za-z_][\w]*)"',
+    re.IGNORECASE,
+)
+_MAPROUTE_ACTION_RE = re.compile(
+    r'\baction\s*=\s*"([A-Za-z_][\w]*)"',
+    re.IGNORECASE,
+)
+
+
+def _scan_maproute_registrations(
+    parsed_file: ParsedFile,
+) -> dict[tuple[str, str], str]:
+    """
+    Find every `routes.MapRoute(name, url, defaults, ...)` or
+    `routes.MapLocalizedRoute(name, url, defaults, ...)` call and return
+    `{(controller, action): url_pattern}` extracted from the literal URL
+    + the `new { controller = "X", action = "Y" }` defaults expression.
+
+    Routes whose defaults can't be parsed are skipped silently.
+    """
+    overrides: dict[tuple[str, str], str] = {}
+    for call in parsed_file.call_sites:
+        leaf = call.callee_name.rsplit(".", 1)[-1]
+        if leaf not in ("MapRoute", "MapLocalizedRoute"):
+            continue
+        if len(call.arguments) < 3:
+            continue
+        url_arg = call.arguments[1]
+        defaults_arg = call.arguments[2]
+        if not isinstance(url_arg.literal_value, str):
+            continue
+        defaults_expr = defaults_arg.expression_text or ""
+        if "new" not in defaults_expr:
+            continue
+        ctl_match = _MAPROUTE_CONTROLLER_RE.search(defaults_expr)
+        act_match = _MAPROUTE_ACTION_RE.search(defaults_expr)
+        if not ctl_match or not act_match:
+            continue
+        url = url_arg.literal_value
+        if not url.startswith("/"):
+            url = "/" + url
+        # Trailing slash kept as-is; downstream normalization decides.
+        overrides[(ctl_match.group(1), act_match.group(1))] = url
+    return overrides
+
+
+# Auth-scheme detection from .AddXxx() call sites in Program.cs / Startup.cs.
+# Match order matters: more-specific patterns must come before less-specific.
+# Pattern is a lowercase substring of the callee name.
+_AUTH_SCHEME_CALL_PATTERNS: tuple[tuple[str, AuthSchemeType, str, Confidence], ...] = (
+    ("addjwtbearer", AuthSchemeType.JWT_BEARER, "jwt_bearer", Confidence.HIGH),
+    ("addoauth2", AuthSchemeType.OAUTH2_AUTHORIZATION_CODE, "oauth2", Confidence.MEDIUM),
+    ("addoauth", AuthSchemeType.OAUTH2_AUTHORIZATION_CODE, "oauth2", Confidence.MEDIUM),
+    ("addopenidconnect", AuthSchemeType.OAUTH2_AUTHORIZATION_CODE, "oidc", Confidence.HIGH),
+    # AspNet Core Identity (AddIdentity / AddDefaultIdentity) is cookie-driven.
+    # Match these *before* the generic AddCookie pattern below so the name
+    # surfaces as "identity" rather than "cookie".
+    ("adddefaultidentity", AuthSchemeType.SESSION_COOKIE, "identity", Confidence.HIGH),
+    ("addidentitycore", AuthSchemeType.SESSION_COOKIE, "identity", Confidence.HIGH),
+    ("addidentity", AuthSchemeType.SESSION_COOKIE, "identity", Confidence.HIGH),
+    ("addcookie", AuthSchemeType.SESSION_COOKIE, "cookie", Confidence.HIGH),
+    ("addapikeysupport", AuthSchemeType.API_KEY_HEADER, "api_key", Confidence.MEDIUM),
+    ("addapikey", AuthSchemeType.API_KEY_HEADER, "api_key", Confidence.MEDIUM),
+    ("addnegotiate", AuthSchemeType.CUSTOM, "negotiate", Confidence.HIGH),
+    ("addcertificate", AuthSchemeType.CUSTOM, "client_cert", Confidence.HIGH),
+    ("addbasic", AuthSchemeType.HTTP_BASIC, "basic", Confidence.MEDIUM),
+)
+
+# Return types that mark a method as an MVC action when no [HttpVerb] attribute
+# is present.  The C# parser doesn't expose method visibility, so this filter
+# substitutes for "is public": real actions return one of these; private
+# helpers on the same controller usually return view-model DTOs.
+_ACTION_RETURN_TYPE_NAMES: frozenset[str] = frozenset(
+    {
+        "IActionResult",
+        "ActionResult",
+        "IResult",
+        "ViewResult",
+        "JsonResult",
+        "ContentResult",
+        "FileResult",
+        "RedirectResult",
+        "RedirectToActionResult",
+        "RedirectToRouteResult",
+        "RedirectToPageResult",
+        "LocalRedirectResult",
+        "OkResult",
+        "OkObjectResult",
+        "NotFoundResult",
+        "NotFoundObjectResult",
+        "BadRequestResult",
+        "BadRequestObjectResult",
+        "UnauthorizedResult",
+        "StatusCodeResult",
+        "ObjectResult",
+        "EmptyResult",
+        "NoContentResult",
+        "PartialViewResult",
+        "ChallengeResult",
+        "ForbidResult",
+        "SignOutResult",
+        "CreatedResult",
+        "CreatedAtActionResult",
+        "CreatedAtRouteResult",
+        "AcceptedResult",
+        "AcceptedAtActionResult",
+        "AcceptedAtRouteResult",
+        "ConflictResult",
+        "ConflictObjectResult",
+        "UnprocessableEntityResult",
+        "UnprocessableEntityObjectResult",
+        # Web API 2 (System.Web.Http.ApiController) result types
+        "IHttpActionResult",
+        "HttpResponseMessage",
+    }
+)
+
+# Bases that mark a class as a Web API 2 ApiController (System.Web.Http).
+_WEB_API_CONTROLLER_BASES: frozenset[str] = frozenset({"ApiController"})
+
+# C# primitive / built-in scalar type names used as route-bindable parameters.
+# A method parameter of one of these types in a Web API 2 conventional route
+# becomes the `{id}` segment; complex types are bound from the body instead.
+_PRIMITIVE_PARAM_TYPES: frozenset[str] = frozenset(
+    {
+        "bool",
+        "Boolean",
+        "byte",
+        "Byte",
+        "sbyte",
+        "SByte",
+        "char",
+        "Char",
+        "short",
+        "Int16",
+        "ushort",
+        "UInt16",
+        "int",
+        "Int32",
+        "uint",
+        "UInt32",
+        "long",
+        "Int64",
+        "ulong",
+        "UInt64",
+        "float",
+        "Single",
+        "double",
+        "Double",
+        "decimal",
+        "Decimal",
+        "string",
+        "String",
+        "Guid",
+        "DateTime",
+        "DateTimeOffset",
+        "DateOnly",
+        "TimeOnly",
+    }
+)
+
+# Web API 2 method-name-prefix → HTTP verb convention.  Action methods on
+# an ApiController whose name starts with one of these prefixes (and that
+# carry no explicit [HttpVerb] attribute) bind to the corresponding verb.
+# Order matters here: longer prefixes must come first so that e.g.
+# `Options` doesn't accidentally match an OptionsForX method as just `O`.
+_WEBAPI_VERB_PREFIXES: tuple[tuple[str, HttpMethod], ...] = (
+    ("Options", HttpMethod.OPTIONS),
+    ("Delete", HttpMethod.DELETE),
+    ("Patch", HttpMethod.PATCH),
+    ("Post", HttpMethod.POST),
+    ("Head", HttpMethod.HEAD),
+    ("Put", HttpMethod.PUT),
+    ("Get", HttpMethod.GET),
+)
+
+_ASPNET_IMPORTS: frozenset[str] = frozenset(
+    {
+        "Microsoft.AspNetCore.Mvc",
+        "Microsoft.AspNetCore.Http",
+        "Microsoft.AspNetCore.Authorization",
+        "Microsoft.AspNetCore.Routing",
+        "Microsoft.AspNetCore.Builder",
+        "Microsoft.Extensions.DependencyInjection",
+    }
+)
+
+# Parameter binding attributes → ParameterLocation
+_PARAM_LOCATION: dict[str, ParameterLocation] = {
+    "FromRoute": ParameterLocation.PATH,
+    "FromQuery": ParameterLocation.QUERY,
+    "FromHeader": ParameterLocation.HEADER,
+    "FromForm": ParameterLocation.QUERY,  # surface as query; body flagged separately
+}
+
+# Bean-validation-equivalent constraints we surface
+_CONSTRAINT_ATTRS: frozenset[str] = frozenset(
+    {
+        "Required",
+        "Range",
+        "MinLength",
+        "MaxLength",
+        "StringLength",
+        "RegularExpression",
+        "EmailAddress",
+        "Url",
+        "Phone",
+        "CreditCard",
+    }
+)
+
+_AUTH_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "auth",
+        "authentication",
+        "authorization",
+        "security",
+        "jwt",
+        "token",
+        "user",
+        "identity",
+        "principal",
+        "credential",
+        "login",
+        "filter",
+        "middleware",
+    }
+)
+
+# HTTP status code map (covers common ASP.NET / RFC names)
+_STATUS_NAMES: dict[str, int] = {
+    "Ok": 200,
+    "Created": 201,
+    "NoContent": 204,
+    "BadRequest": 400,
+    "Unauthorized": 401,
+    "Forbidden": 403,
+    "NotFound": 404,
+    "Conflict": 409,
+    "UnprocessableEntity": 422,
+    "InternalServerError": 500,
+    # Numeric strings come through as-is
+}
+
+
+# =============================================================================
+# Helpers
+# =============================================================================
+
+
+def _str_to_qname(s: str) -> QualifiedName:
+    """Convert a dotted string like 'app.MapGet' to a QualifiedName."""
+    if "." in s:
+        module, _, name = s.rpartition(".")
+        return QualifiedName(module=module, name=name)
+    return QualifiedName(module="", name=s)
+
+
+# =============================================================================
+# AspNetCorePlugin
+# =============================================================================
+
+
+class AspNetCorePlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for ASP.NET Core applications.
+
+    Extracts routes, auth, dependencies, and middleware from
+    ASP.NET Core attribute-based and minimal-API patterns.
+    """
+
+    FRAMEWORK: ClassVar[Framework] = Framework.ASPNET_CORE
+    LANGUAGE: ClassVar[Language] = Language.CSHARP
+    DETECTION_IMPORTS: ClassVar[frozenset[str]] = _ASPNET_IMPORTS
+
+    def __init__(self) -> None:
+        # Project-wide signals derived from cross-file scanning, cached by
+        # AnalysisContext identity so the work is done once per analysis run.
+        self._slugify_active_cache: dict[int, bool] = {}
+        self._maproute_overrides_cache: dict[int, dict[tuple[str, str], str]] = {}
+
+    # -------------------------------------------------------------------------
+    # Detection
+    # -------------------------------------------------------------------------
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        has_system_web = any(
+            (imp.module or "").startswith("System.Web.Mvc")
+            or (imp.module or "").startswith("System.Web.Http")
+            for imp in parsed_file.imports
+        )
+        if has_system_web:
+            return False  # legacy file — handled by LegacyAspNetPlugin
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if module.startswith("Microsoft.AspNetCore") or module.startswith(
+                "Microsoft.Extensions.DependencyInjection"
+            ):
+                return True
+        # Also detect via class attributes (in case using statements were missed)
+        for cls in parsed_file.classes:
+            if any(d.name in _CONTROLLER_ATTRS for d in cls.decorators):
+                return True
+        # Also detect via base class (global usings / no explicit imports)
+        for cls in parsed_file.classes:
+            for base in cls.base_classes:
+                if base.rsplit(".", 1)[-1] in _CONTROLLER_BASE_CLASSES:
+                    return True
+        return False
+
+    # -------------------------------------------------------------------------
+    # Route extraction
+    # -------------------------------------------------------------------------
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+        slugify_active = self._project_uses_slugify(context, parsed_file)
+        maproute_overrides = self._project_maproute_overrides(context, parsed_file)
+
+        for cls in parsed_file.classes:
+            if not self._is_controller(cls):
+                continue
+            # Razor Pages PageModel subclasses are handled by the dedicated loop below.
+            if self._is_razor_page(cls):
+                continue
+
+            class_prefix = self._get_class_prefix(cls, parsed_file, slugify=slugify_active)
+
+            is_conventional = not any(
+                d.name == "Route" for d in cls.decorators
+            ) and self._is_controller(cls)
+
+            for method in cls.methods:
+                routes.extend(
+                    self._extract_routes_from_method(
+                        method,
+                        class_prefix,
+                        cls,
+                        parsed_file,
+                        context,
+                        is_conventional_mvc=is_conventional,
+                        slugify=slugify_active,
+                        maproute_overrides=maproute_overrides,
+                    )
+                )
+
+        # Razor Pages: PageModel subclasses with OnGet*/OnPost* handler methods
+        routes.extend(self._extract_razor_page_routes(parsed_file, context))
+
+        # Minimal API: top-level call sites (app.MapGet("/path", handler))
+        routes.extend(self._extract_minimal_api_routes(parsed_file, context))
+
+        # IEndpointGroup pattern (CleanArchitecture style): groupBuilder.Map*(handler, pattern)
+        routes.extend(self._extract_endpoint_group_routes(parsed_file, context))
+
+        return routes
+
+    def _is_controller(self, cls: ParsedClass) -> bool:
+        if any(d.name in _CONTROLLER_ATTRS for d in cls.decorators):
+            return True
+        # Ardalis ApiEndpoints / ControllerBase subclasses without [ApiController]
+        for base in cls.base_classes:
+            simple = base.rsplit(".", 1)[-1]
+            if simple in _CONTROLLER_BASE_CLASSES or base in _CONTROLLER_BASE_CLASSES:
+                return True
+        # Convention-based detection: a class named `XxxController` with at
+        # least one base class and one action-shaped method is a controller.
+        # This is how ASP.NET's runtime discovers controllers when intermediate
+        # base classes (`BasePublicController : Controller`) hide the well-
+        # known base from a single-file view of the code.
+        if (
+            cls.name.endswith("Controller")
+            and cls.name != "Controller"
+            and cls.base_classes
+            and any(self._is_action_return_type(m.return_type) for m in cls.methods)
+        ):
+            return True
+        return False
+
+    def _build_iendpoint_class_map(self, parsed_file: ParsedFile) -> dict[str, str]:
+        """
+        For every class implementing `IEndpoint<...>` (the MinimalApi.Endpoint
+        library pattern), return `{ClassName: HandlerMethodName}`.
+
+        Convention: the handler is the public method named ``HandleAsync``;
+        if no such method exists we fall back to the class name itself so
+        the caller still gets a class-level attribution.
+        """
+        mapping: dict[str, str] = {}
+        for cls in parsed_file.classes:
+            # The parser strips generic arguments from base_classes, so we
+            # match on the simple name `IEndpoint` regardless of arity.
+            if not any(base.rsplit(".", 1)[-1] == "IEndpoint" for base in cls.base_classes):
+                continue
+            handler_method = next(
+                (m.name for m in cls.methods if m.name == "HandleAsync"),
+                None,
+            )
+            mapping[cls.name] = f"{cls.name}.{handler_method}" if handler_method else cls.name
+        return mapping
+
+    def _project_maproute_overrides(
+        self,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> dict[tuple[str, str], str]:
+        """
+        Build `{(Controller, Action): explicit_url}` from every
+        `routes.MapRoute(...)` / `MapLocalizedRoute(...)` call across the
+        project.  These central registrations override the conventional
+        `/{Controller}/{Action}` path — e.g. `ShoppingCartController.Cart`
+        becomes `/cart/`, not `/ShoppingCart/Cart`.
+        """
+        if context is not None:
+            key = id(context)
+            cached = self._maproute_overrides_cache.get(key)
+            if cached is not None:
+                return cached
+            merged: dict[tuple[str, str], str] = {}
+            for pf in context.all_parsed_files or []:
+                merged.update(_scan_maproute_registrations(pf))
+            self._maproute_overrides_cache[key] = merged
+            return merged
+        return _scan_maproute_registrations(parsed_file)
+
+    def _project_uses_slugify(
+        self,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> bool:
+        """
+        Detect whether the project registers `SlugifyParameterTransformer` /
+        a `:slugify=` constraint on the default MVC route.  The signal lives
+        in Program.cs (route registration) but applies to controllers in
+        other files — so we scan the AnalysisContext's full file list, with
+        a fallback to the current file when no context is available.
+        """
+        if context is not None:
+            key = id(context)
+            cached = self._slugify_active_cache.get(key)
+            if cached is not None:
+                return cached
+            active = any(_file_registers_slugify(pf) for pf in (context.all_parsed_files or []))
+            self._slugify_active_cache[key] = active
+            return active
+        # No context (unit-test invocation): only the current file is visible.
+        return _file_registers_slugify(parsed_file)
+
+    def _iendpoint_handler_for_call(
+        self,
+        call: ParsedCallSite,
+        iendpoint_classes: dict[str, str],
+    ) -> str | None:
+        """If `call` lives inside an `AddRoute` method on an IEndpoint class,
+        return the dotted handler attribution.  Otherwise None."""
+        caller = call.caller_function
+        if caller is None or caller.name != "AddRoute":
+            return None
+        # caller.module is the dotted class path; we only care about the leaf.
+        enclosing_class = caller.module.rsplit(".", 1)[-1] if caller.module else ""
+        return iendpoint_classes.get(enclosing_class)
+
+    def _is_conventional_action(
+        self,
+        method: ParsedFunction,
+        cls: ParsedClass | None = None,
+    ) -> bool:
+        """
+        Whether a method on a conventional-routing controller should be treated
+        as an action (i.e. emitted as a GET route in the absence of an explicit
+        [HttpVerb] attribute).
+
+        MVC: the C# parser doesn't expose visibility, so visibility is
+        approximated by return-type filtering — real actions return one of
+        the well-known IActionResult-family types, view-model-returning
+        helpers fail the check.
+
+        Web API 2 (`ApiController` subclass): the convention is different.
+        Every public action returns *something* — the framework serializes
+        whatever you give it (IEnumerable<T>, POCO, IHttpActionResult, …).
+        Visibility-by-return-type doesn't work, so we accept any non-void
+        return type on an ApiController subclass.
+        """
+        if method.binding != "instance" or method.is_abstract:
+            return False
+        if method.name in _OBJECT_METHOD_NAMES:
+            return False
+        if any(d.name in _NON_ROUTABLE_ATTRS for d in method.decorators):
+            return False
+        # Web API 2: any non-void, non-junk return is an action — but
+        # only when the method is `public` AND bound to an HTTP verb.
+        if cls is not None and self._is_web_api_controller(cls):
+            ret = (method.return_type or "").strip()
+            if not ret or ret == "void":
+                return False
+            # Parser sometimes captures the leading `//` comment as the return
+            # type when there's a comment immediately above the method.  Reject
+            # those so we don't accept comment-as-return-type as valid.
+            if ret.startswith("//") or ret.startswith("/*"):
+                return False
+            # Web API 2 only routes `public` methods.  ParsedFunction
+            # doesn't track access modifiers; we read the source line
+            # for the method declaration and look for `public`.  In C#,
+            # methods in a class default to `private` when no modifier
+            # is present, so absence-of-`public` is non-routable.
+            if not _method_is_public_csharp(method):
+                return False
+            # Web API 2 action selection requires the method bind to an
+            # HTTP verb — either via an explicit attribute
+            # (`[HttpGet]`/`[HttpPost]`/...) or via a method-name prefix
+            # (`Get*`/`Post*`/...).  Methods without either are
+            # unreachable through Web API 2 conventional routing.
+            has_verb_attr = any(d.name in _HTTP_METHOD_ATTRS for d in method.decorators)
+            if has_verb_attr:
+                return True
+            has_verb_prefix = any(
+                method.name.startswith(prefix) for prefix, _ in _WEBAPI_VERB_PREFIXES
+            )
+            return has_verb_prefix
+        return self._is_action_return_type(method.return_type)
+
+    def _is_web_api_controller(self, cls: ParsedClass) -> bool:
+        """True if the class directly inherits from a Web API 2 base."""
+        for base in cls.base_classes:
+            simple = base.rsplit(".", 1)[-1]
+            if simple in _WEB_API_CONTROLLER_BASES:
+                return True
+        return False
+
+    def _webapi_verb_for_method(self, method_name: str) -> HttpMethod:
+        """Resolve a Web API 2 method's HTTP verb from its name prefix.
+
+        `Get*` → GET, `Post*` → POST, `Put*` → PUT, `Delete*` → DELETE,
+        `Patch*` → PATCH, `Head*` → HEAD, `Options*` → OPTIONS.
+        Unrecognised prefixes default to GET — matching Web API 2's
+        fallback for unmatched methods on conventional routing.
+        """
+        for prefix, verb in _WEBAPI_VERB_PREFIXES:
+            if method_name.startswith(prefix):
+                return verb
+        return HttpMethod.GET
+
+    def _webapi_path_suffix(self, method: ParsedFunction) -> str:
+        """
+        Return the per-method path segment for a Web API 2 conventional route.
+
+        The default Web API 2 route template is `api/{controller}/{id?}` —
+        the `{id}` route token binds to a method parameter literally named
+        `id`.  Primitive parameters with OTHER names (`start`, `notify`,
+        `productId`, etc.) bind from the QUERY STRING and don't contribute
+        a path segment — so the URL is just `/api/{controller}`.
+
+        Returns `"{id}"` when a primitive `id` parameter is present;
+        otherwise empty string.
+
+        (Earlier behaviour appended `{<param>}` for the first primitive
+        regardless of name, producing URLs like `/api/Contacts/{start}`
+        for `GetContacts(int start, ...)` — a route Web API 2's runtime
+        wouldn't actually dispatch.)
+        """
+        for param in method.parameters:
+            if param.name != "id":
+                continue
+            type_name = (param.type_annotation or "").strip()
+            if not type_name:
+                continue
+            base = type_name.split("<")[0].strip().rstrip("?")
+            simple = base.rsplit(".", 1)[-1]
+            if simple in _PRIMITIVE_PARAM_TYPES:
+                return "{id}"
+        return ""
+
+    def _is_action_return_type(self, return_type: str | None) -> bool:
+        """Return True for IActionResult-family return types (Task<…> aware)."""
+        if not return_type:
+            return False
+        ret = return_type.strip()
+        # Bare Task / ValueTask with no generic = async void action.
+        if ret in ("Task", "ValueTask"):
+            return True
+        for wrapper in ("Task<", "ValueTask<"):
+            if ret.startswith(wrapper) and ret.endswith(">"):
+                return self._is_action_return_type(ret[len(wrapper) : -1].strip())
+        base = ret.split("<")[0].strip().rsplit(".", 1)[-1]
+        return base in _ACTION_RETURN_TYPE_NAMES
+
+    def _get_class_prefix(
+        self,
+        cls: ParsedClass,
+        parsed_file: ParsedFile,
+        slugify: bool = False,
+    ) -> str:
+        """
+        Resolve [Route("prefix")] on the controller class.
+
+        Handles the [controller] token — replaced by the class name without
+        the "Controller" suffix.  When `slugify=True` (project registers
+        SlugifyParameterTransformer), the token expansion and conventional
+        fallback are kebab-cased: ``UsersController`` → ``/users``,
+        ``MyAdminController`` → ``/my-admin``.
+        """
+        controller_name = cls.name
+        if controller_name.endswith("Controller"):
+            controller_name = controller_name[: -len("Controller")]
+        token_value = _slugify(controller_name) if slugify else controller_name
+
+        # `[RoutePrefix("...")]` (Web API 2 attribute routing) takes priority
+        # over `[Route]` — it's a hard prefix that combines with method-level
+        # `[Route]` to form the full URL.  A `[Route]` *also* on the class is
+        # rare in this scenario; if present, the RoutePrefix wins.
+        for dec in cls.decorators:
+            if dec.name == "RoutePrefix":
+                path = self._dec_path(dec)
+                if path:
+                    path = path.replace("[controller]", token_value)
+                    path = path.replace("[Controller]", token_value)
+                    return ("/" + path.strip("/")).rstrip("/")
+
+        for dec in cls.decorators:
+            if dec.name == "Route":
+                path = self._dec_path(dec)
+                if path:
+                    path = path.replace("[controller]", token_value)
+                    path = path.replace("[Controller]", token_value)
+                    return path.rstrip("/")
+        # Conventional routing: no [Route] but the class is recognized as a
+        # controller.  Web API 2 ApiController subclasses get the framework's
+        # `api/{controller}` default; MVC Controllers get `/{controller}`.
+        if self._is_web_api_controller(cls):
+            return f"/api/{token_value}"
+        if self._is_controller(cls):
+            return f"/{token_value}"
+        return ""
+
+    def _extract_routes_from_method(
+        self,
+        method: ParsedFunction,
+        class_prefix: str,
+        cls: ParsedClass,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None,
+        is_conventional_mvc: bool = False,
+        slugify: bool = False,
+        maproute_overrides: dict[tuple[str, str], str] | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+
+        # [ChildActionOnly] / [NonAction] mark the method as non-HTTP — used
+        # for partial-view rendering (Html.Action) and helper methods.  ASP.NET
+        # MVC's runtime skips routing entirely for these, and so should we —
+        # otherwise the conventional-routing path emits hundreds of false
+        # positives (nopCommerce 3.90 has 204 [ChildActionOnly] methods).
+        if any(d.name in _NON_ROUTABLE_ATTRS for d in method.decorators):
+            return routes
+
+        # Collect HTTP-method attributes and optional [Route] on this method
+        method_paths: list[str] = []
+        http_methods: list[HttpMethod] = []
+        produces: str | None = None
+        consumes: str | None = None
+        response_status = 200
+        explicit_method_path = False  # True when an [HttpVerb("path")] carried an explicit path
+
+        for dec in method.decorators:
+            hm = _HTTP_METHOD_ATTRS.get(dec.name)
+            if hm is not None:
+                http_methods.append(hm)
+                # Only record a path from [HttpMethod] when it carries an explicit
+                # path argument (e.g. [HttpGet("{id}")]).  When there is no argument
+                # (e.g. bare [HttpPost]) we leave method_paths unchanged so that
+                # any earlier [Route("…")] path is used instead of generating a
+                # spurious duplicate route with an empty segment.
+                local = self._dec_path(dec)
+                if local is not None and local not in method_paths:
+                    method_paths.append(local)
+                    explicit_method_path = True
+
+            elif dec.name == "Route":
+                # [Route] on a method contributes a path but not an HTTP method.
+                # Counts as an explicit method path — when the class has no
+                # routing attribute, this is the FULL URL (no conventional
+                # `/api/{controller}` prefix prepended).
+                local = self._dec_path(dec) or ""
+                if local not in method_paths:
+                    method_paths.append(local)
+                    explicit_method_path = True
+
+            elif dec.name == "Produces":
+                produces = dec.positional_args[0] if dec.positional_args else None
+            elif dec.name == "Consumes":
+                consumes = dec.positional_args[0] if dec.positional_args else None
+            elif dec.name == "ProducesResponseType":
+                response_status = self._extract_response_status(dec)
+
+        if not http_methods:
+            # Methods without an explicit [HttpVerb] attribute can still bind
+            # to a verb in two cases:
+            #
+            # 1. Web API 2 (ApiController): the method-name prefix selects the
+            #    verb (Get*, Post*, Put*, …).  This is unconditional in Web
+            #    API 2 — it applies *whether or not* the class carries
+            #    [Route] / [RoutePrefix].  LPL-style controllers commonly
+            #    decorate the class with [RoutePrefix("api/v1/orders")] and
+            #    leave methods without [HttpVerb]; the runtime still binds
+            #    by name.
+            #
+            # 2. MVC (Controller) with conventional routing (no class-level
+            #    [Route]): the method is an action that defaults to GET.
+            if self._is_web_api_controller(cls) and self._is_conventional_action(method, cls):
+                http_methods = [self._webapi_verb_for_method(method.name)]
+            elif is_conventional_mvc and self._is_conventional_action(method, cls):
+                http_methods = [HttpMethod.GET]
+            else:
+                return routes
+
+        if not method_paths:
+            if is_conventional_mvc:
+                if self._is_web_api_controller(cls):
+                    # Web API 2 default route template is `api/{controller}/{id?}`
+                    # — there's no {action} segment.  Method name selected the
+                    # verb already (PR #18).  Append `{id}` when the method
+                    # takes an id-like parameter; otherwise the path is the
+                    # bare class prefix.
+                    method_paths = [self._webapi_path_suffix(method)]
+                else:
+                    # Conventional MVC: use method name as action;
+                    # Index() → controller root.  Slug-case when registered.
+                    action = (
+                        ""
+                        if method.name == "Index"
+                        else (_slugify(method.name) if slugify else method.name)
+                    )
+                    method_paths = [action]
+            else:
+                method_paths = [""]
+
+        auth_refs = self._method_auth_refs(cls, method)
+
+        # Resolve the controller name once for MapRoute-override lookup.
+        controller_short_name = cls.name
+        if controller_short_name.endswith("Controller"):
+            controller_short_name = controller_short_name[: -len("Controller")]
+
+        # When the class has no routing attribute at all (no `[Route]`,
+        # no `[RoutePrefix]`), a method's explicit `[Route]` or
+        # `[HttpVerb("path")]` IS the full URL — the conventional
+        # `/api/{controller}` fallback prefix doesn't apply.  When the
+        # class HAS `[RoutePrefix]` (or class-level `[Route]`), the
+        # method route is appended to that prefix.
+        class_has_routing_attr = any(d.name in ("Route", "RoutePrefix") for d in cls.decorators)
+
+        for http_method in http_methods:
+            for local_path in method_paths:
+                # Ardalis/single-method endpoint pattern: class has no
+                # routing attribute (is_conventional_mvc=True AND no
+                # `[RoutePrefix]`) and the method carries its own explicit
+                # route path.  The method path IS the full route — no
+                # controller-name prefix is applied.
+                if (
+                    is_conventional_mvc
+                    and explicit_method_path
+                    and local_path
+                    and not class_has_routing_attr
+                ):
+                    full_path = local_path if local_path.startswith("/") else "/" + local_path
+                else:
+                    full_path = self._join_paths(class_prefix, local_path)
+                # Resolve [action] / [Action] token inserted by [Route("[controller]/[action]")]
+                action_token = _slugify(method.name) if slugify else method.name
+                full_path = full_path.replace("[action]", action_token).replace(
+                    "[Action]", action_token
+                )
+
+                # Central registrations (routes.MapRoute / MapLocalizedRoute)
+                # override the conventional `/{Controller}/{Action}` path with
+                # whatever explicit URL was registered for this (controller,
+                # action) pair.  Only consult for conventional routing where
+                # no explicit method path was set — attribute-routed methods
+                # already carry the truth in `local_path`.
+                if is_conventional_mvc and not explicit_method_path and maproute_overrides:
+                    override = maproute_overrides.get((controller_short_name, method.name))
+                    if override is not None:
+                        full_path = override
+
+                full_path = self._normalize_path(full_path)
+
+                path_params, query_params, header_params, cookie_params, body = (
+                    self._extract_params(method, full_path, context, parsed_file)
+                )
+
+                if consumes and body is not None:
+                    body = ExtractedBody(
+                        content_type=consumes,
+                        model_name=body.model_name,
+                        model_fields=body.model_fields,
+                        required=body.required,
+                    )
+
+                response = ExtractedResponse(
+                    model_name=method.return_type,
+                    status_code=response_status,
+                    content_type=produces,
+                )
+
+                routes.append(
+                    ExtractedRoute(
+                        method=http_method,
+                        path=full_path,
+                        handler_function=method.qualified_name,
+                        handler_location=method.location,
+                        path_params=path_params,
+                        query_params=query_params,
+                        header_params=header_params,
+                        cookie_params=cookie_params,
+                        body=body,
+                        response=response,
+                        tags=[cls.name],
+                        dependency_refs=auth_refs,
+                        confidence=Confidence.HIGH,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    # -------------------------------------------------------------------------
+    # Razor Pages support
+    # -------------------------------------------------------------------------
+
+    # Handler name prefix → HTTP method (case-sensitive; Async suffix stripped first)
+    _RAZOR_HANDLER_VERBS: ClassVar[dict[str, HttpMethod]] = {
+        "OnGet": HttpMethod.GET,
+        "OnPost": HttpMethod.POST,
+        "OnPut": HttpMethod.PUT,
+        "OnDelete": HttpMethod.DELETE,
+        "OnPatch": HttpMethod.PATCH,
+        "OnHead": HttpMethod.HEAD,
+    }
+
+    def _is_razor_page(self, cls: ParsedClass) -> bool:
+        return any(base.rsplit(".", 1)[-1] == "PageModel" for base in cls.base_classes)
+
+    def _derive_razor_page_path(self, file_path: str, cls: ParsedClass) -> str:
+        """
+        Derive the Razor Pages URL from the source file path.
+
+        Conventions:
+        - ``{root}/Pages/{Rel}.cshtml.cs``  →  ``/{Rel}``
+        - ``{root}/Areas/{Name}/Pages/{Rel}.cshtml.cs``  →  ``/{Name}/{Rel}``
+        - ``Index`` as the final segment is stripped (maps to parent dir).
+        - ``[Route]`` on the class overrides the derived path entirely.
+
+        Falls back to ``/{ClassName}`` when the Pages directory is not found.
+        """
+        # Explicit [Route] on the class wins
+        for dec in cls.decorators:
+            if dec.name == "Route":
+                raw = self._dec_path(dec)
+                if raw:
+                    return raw if raw.startswith("/") else "/" + raw
+
+        # Normalise separators so we can search consistently
+        norm_path = file_path.replace("\\", "/")
+        # Strip .cshtml.cs or .cshtml extension
+        for ext in (".cshtml.cs", ".cshtml"):
+            if norm_path.endswith(ext):
+                norm_path = norm_path[: -len(ext)]
+                break
+
+        # Try Areas/{AreaName}/Pages/{Rel}
+        area_marker = "/Areas/"
+        pages_marker = "/Pages/"
+        area_idx = norm_path.find(area_marker)
+        if area_idx != -1:
+            rest = norm_path[area_idx + len(area_marker) :]
+            # rest = "{AreaName}/Pages/{Rel}"
+            pages_idx = rest.find(pages_marker)
+            if pages_idx != -1:
+                area_name = rest[:pages_idx]
+                rel = rest[pages_idx + len(pages_marker) :]
+                path = f"/{area_name}/{rel}"
+                return self._razor_strip_index(self._normalize_path(path))
+
+        # Regular Pages/{Rel}
+        pages_idx = norm_path.find(pages_marker)
+        if pages_idx != -1:
+            rel = norm_path[pages_idx + len(pages_marker) :]
+            path = "/" + rel
+            return self._razor_strip_index(self._normalize_path(path))
+
+        # Fallback: use class name, strip "Model" suffix
+        name = cls.name
+        if name.endswith("Model"):
+            name = name[: -len("Model")]
+        return "/" + name
+
+    @staticmethod
+    def _razor_strip_index(path: str) -> str:
+        """Strip a trailing ``/Index`` segment (Razor Pages convention)."""
+        if path.endswith("/Index"):
+            stripped = path[: -len("/Index")]
+            return stripped or "/"
+        return path
+
+    def _extract_razor_page_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """
+        Extract routes from Razor Pages PageModel classes.
+
+        Handler naming convention: ``On{Verb}[HandlerName][Async]``
+
+        - ``OnGet``         → GET  (no named handler)
+        - ``OnPost``        → POST (no named handler)
+        - ``OnPostUpdate``  → POST with query param ``handler=Update``
+        - ``OnGetAsync``    → GET  (Async suffix stripped before matching)
+        """
+        routes: list[ExtractedRoute] = []
+        file_path = str(parsed_file.path)
+
+        for cls in parsed_file.classes:
+            if not self._is_razor_page(cls):
+                continue
+
+            page_path = self._derive_razor_page_path(file_path, cls)
+
+            # Class-level auth applies to all handlers unless the method overrides
+            class_allow_anon = any(d.name == "AllowAnonymous" for d in cls.decorators)
+            class_authorize = any(d.name == "Authorize" for d in cls.decorators)
+
+            for method in cls.methods:
+                name = method.name
+                # Strip Async suffix before pattern matching
+                if name.endswith("Async"):
+                    name = name[: -len("Async")]
+
+                http_method: HttpMethod | None = None
+                handler_name: str | None = None
+
+                for verb_prefix, hm in self._RAZOR_HANDLER_VERBS.items():
+                    if name == verb_prefix:
+                        http_method = hm
+                        break
+                    if name.startswith(verb_prefix) and len(name) > len(verb_prefix):
+                        http_method = hm
+                        handler_name = name[len(verb_prefix) :]
+                        break
+
+                if http_method is None:
+                    continue
+
+                # Named handler → append ?handler=Name as a query param
+                query_params: list[ExtractedParameter] = []
+                if handler_name:
+                    query_params.append(
+                        ExtractedParameter(
+                            name="handler",
+                            location=ParameterLocation.QUERY,
+                            type_annotation="string",
+                            required=True,
+                            default_value=handler_name,
+                        )
+                    )
+
+                # Auth: method-level overrides class-level
+                method_allow_anon = any(d.name == "AllowAnonymous" for d in method.decorators)
+                method_authorize = any(d.name == "Authorize" for d in method.decorators)
+
+                if method_allow_anon or class_allow_anon:
+                    auth_refs: list[str] = []
+                elif method_authorize:
+                    auth_refs = [f"{cls.name}.{method.name}"]
+                elif class_authorize:
+                    auth_refs = [cls.name]
+                else:
+                    auth_refs = []
+
+                # Path params from [BindProperty(SupportsGet=true)] or route template
+                path_params = self._extract_path_params_from_template(page_path)
+
+                routes.append(
+                    ExtractedRoute(
+                        method=http_method,
+                        path=page_path,
+                        handler_function=_str_to_qname(f"{cls.name}.{method.name}"),
+                        handler_location=method.location,
+                        path_params=path_params,
+                        query_params=query_params,
+                        header_params=[],
+                        cookie_params=[],
+                        body=None,
+                        response=ExtractedResponse(
+                            status_code=200,
+                            model_name=method.return_type,
+                        ),
+                        tags=["razor-pages"],
+                        dependency_refs=auth_refs,
+                        confidence=Confidence.HIGH,
+                        kind="razor-page",
+                    )
+                )
+
+        return routes
+
+    def _extract_minimal_api_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """
+        Detect minimal-API call sites: app.MapGet("/users/{id}", handler)
+
+        Extracts:
+        - Actual path from first string-literal argument (HIGH confidence)
+          or falls back to "/[minimal-api]" when the path is dynamic (MEDIUM)
+        - Path parameters derived from the path template
+        - Handler function name from the second argument (method reference)
+          or "<lambda>" for inline lambdas.  When the call lives inside
+          `AddRoute(IEndpointRouteBuilder)` on a class implementing
+          `IEndpoint<...>` (the `MinimalApi.Endpoint` library pattern), the
+          handler is attributed to `{ClassName}.HandleAsync` instead.
+        - Auth chaining: .RequireAuthorization() / .AllowAnonymous() detected
+          via receiver_expression line-number correlation set by the parser
+        """
+        routes: list[ExtractedRoute] = []
+
+        # Gap 3: Build a name → ParsedFunction lookup for method-reference handlers
+        _method_lookup: dict[str, ParsedFunction] = {}
+        for _func in parsed_file.functions:
+            _method_lookup[_func.name] = _func
+        for _cls in parsed_file.classes:
+            for _m in _cls.methods:
+                _method_lookup[_m.name] = _m
+
+        # MinimalApi.Endpoint pattern: class → handler-method-name override.
+        # Built once per file because most projects with this pattern have
+        # one endpoint class per file.
+        _iendpoint_classes: dict[str, str] = self._build_iendpoint_class_map(parsed_file)
+
+        # Separate Map* calls from auth/metadata chainers
+        map_calls: list = []
+        map_methods_calls: list = []
+        # line → list of chainer method names that reference that line
+        auth_chainers: dict[int, list[str]] = {}
+
+        for call in parsed_file.call_sites:
+            method_name = call.callee_name.split(".")[-1]
+            if method_name in _MINIMAL_API_METHODS:
+                # Skip groupBuilder.Map* — handled by _extract_endpoint_group_routes
+                if call.receiver_expression == "groupBuilder":
+                    continue
+                map_calls.append(call)
+            elif method_name == "MapMethods":
+                # Skip groupBuilder.MapMethods
+                if call.receiver_expression == "groupBuilder":
+                    continue
+                map_methods_calls.append(call)
+            elif (
+                method_name in _MINIMAL_API_CHAINERS
+                and call.receiver_expression
+                and call.receiver_expression.startswith("line:")
+            ):
+                try:
+                    target_line = int(call.receiver_expression[5:])
+                    auth_chainers.setdefault(target_line, []).append(method_name)
+                except ValueError:
+                    pass
+
+        # ── Two-pass MapGroup inline prefix tracker ───────────────────────────
+        # First pass: collect MapGroup calls → map receiver_expression + "_group"
+        # to the resolved prefix string.
+        # This handles: var api = app.MapGroup("/api"); api.MapGet("/users", ...)
+        _map_group_prefixes: dict[str, str] = {}
+        for call in parsed_file.call_sites:
+            if call.callee_name.split(".")[-1] != "MapGroup":
+                continue
+            if not call.arguments or not call.arguments[0].is_literal:
+                continue
+            raw = str(call.arguments[0].literal_value or "")
+            grp_prefix = "/" + raw.strip("/") if raw else ""
+            # Map the receiver (e.g. "api", "app") to the group prefix
+            recv = call.receiver_expression or ""
+            if recv:
+                _map_group_prefixes[recv + "_group"] = grp_prefix
+
+        for call in map_calls:
+            method_name = call.callee_name.split(".")[-1]
+            hm = _MINIMAL_API_METHODS[method_name]
+
+            # ── Path ────────────────────────────────────────────────────────
+            path = "/[minimal-api]"
+            if (
+                call.arguments
+                and call.arguments[0].is_literal
+                and call.arguments[0].literal_type == "str"
+                and call.arguments[0].literal_value
+            ):
+                path = call.arguments[0].literal_value
+
+            # Strip route constraints: {id:int} → {id}
+            path = self._normalize_path(path)
+            # Normalise: all paths should start with /
+            if path and path != "/[minimal-api]" and not path.startswith("/"):
+                path = "/" + path
+
+            # Apply inline MapGroup prefix (same-file pattern)
+            recv = call.receiver_expression or ""
+            _inline_prefix = _map_group_prefixes.get(recv + "_group", "")
+            if _inline_prefix:
+                import re as _re
+
+                path = _inline_prefix.rstrip("/") + "/" + path.lstrip("/")
+                path = _re.sub(r"/+", "/", path)
+
+            # ── Handler name ─────────────────────────────────────────────────
+            handler_name = call.callee_name
+            lambda_arg = None
+            handler_method: ParsedFunction | None = None
+            if len(call.arguments) > 1:
+                arg1 = call.arguments[1]
+                if arg1.is_variable and arg1.variable_name:
+                    handler_name = arg1.variable_name
+                    handler_method = _method_lookup.get(handler_name)
+                elif arg1.is_expression and arg1.expression_text == "<lambda>":
+                    handler_name = f"{call.callee_name}/<lambda>"
+                    lambda_arg = arg1
+
+            # IEndpoint<T> override: the call is inside an `AddRoute` method on
+            # a class implementing IEndpoint — attribute to {Class}.HandleAsync
+            # (or the resolved handler-method name) rather than the lambda.
+            iendpoint_handler = self._iendpoint_handler_for_call(call, _iendpoint_classes)
+            if iendpoint_handler is not None:
+                handler_name = iendpoint_handler
+                # If the IEndpoint class exposes the resolved method, route
+                # param extraction can use it instead of the AddRoute lambda.
+                handler_method = (
+                    _method_lookup.get(iendpoint_handler.rsplit(".", 1)[-1]) or handler_method
+                )
+
+            # ── Path parameters ──────────────────────────────────────────────
+            path_params = self._extract_path_params_from_template(path)
+
+            # ── Body / query from lambda typed params or method reference ──────
+            query_params: list[ExtractedParameter] = []
+            header_params: list[ExtractedParameter] = []
+            body: ExtractedBody | None = None
+            if lambda_arg is not None and lambda_arg.lambda_parameter_types:
+                path_tpl_names = {m.group(1) for m in re.finditer(r"\{([^}:]+)(?::[^}]+)?\}", path)}
+                # path_params already seeded from template; don't duplicate
+                path_param_names = {p.name for p in path_params}
+                body, query_params = self._classify_lambda_params(
+                    lambda_arg.lambda_parameter_types,
+                    path_tpl_names,
+                    path_param_names,
+                    context,
+                )
+            elif handler_method is not None:
+                path_params, query_params, header_params, _cookie_params, body = (
+                    self._extract_params(handler_method, path, context, parsed_file)
+                )
+
+            # ── Auth chaining (.RequireAuthorization etc.) ────────────────────
+            call_line = call.location.line if call.location else -1
+            chained = auth_chainers.get(call_line, [])
+            # Only AUTH_CHAINERS (RequireAuthorization, AllowAnonymous, RequirePermission …)
+            # trigger an auth dep_ref.  Use the chainer name so the auth-keyword matcher in
+            # _populate_route_auth_mapping can recognize it (e.g. "permission" in "RequirePermission").
+            auth_chainer = next((c for c in chained if c in _MINIMAL_API_AUTH_CHAINERS), None)
+            auth_refs = [f"{auth_chainer}@{call_line}"] if auth_chainer else []
+            # [Authorize] on the lambda handler → add an explicit auth dep_ref
+            # that the auth-keyword matcher in _populate_route_auth_mapping picks up
+            lambda_auth_attrs = lambda_arg.lambda_attribute_names if lambda_arg else []
+            if "Authorize" in lambda_auth_attrs and "AllowAnonymous" not in lambda_auth_attrs:
+                auth_refs.append(f"Authorize@{call_line}")
+
+            # ── Response status from chained .Produces<T>(statusCode) ─────────
+            response_status = 200
+            produces_calls = [
+                c
+                for c in parsed_file.call_sites
+                if c.callee_name.split(".")[-1] == "Produces"
+                and c.receiver_expression
+                and c.receiver_expression.startswith("line:")
+                and c.receiver_expression[5:].lstrip("-").isdigit()
+                and int(c.receiver_expression[5:]) == call_line
+            ]
+            for pc in produces_calls[:1]:
+                # Produces<T>() → 200; Produces<T>(statusCode) → statusCode
+                int_args = [a for a in pc.arguments if a.is_literal and a.literal_type == "int"]
+                if int_args:
+                    response_status = int(int_args[0].literal_value)
+
+            # ── Confidence ───────────────────────────────────────────────────
+            confidence = Confidence.HIGH if path != "/[minimal-api]" else Confidence.MEDIUM
+
+            routes.append(
+                ExtractedRoute(
+                    method=hm,
+                    path=path,
+                    handler_function=_str_to_qname(handler_name),
+                    handler_location=call.location,
+                    path_params=path_params,
+                    query_params=query_params,
+                    header_params=header_params,
+                    cookie_params=[],
+                    body=body,
+                    response=ExtractedResponse(status_code=response_status),
+                    tags=["minimal-api"],
+                    dependency_refs=auth_refs,
+                    confidence=confidence,
+                    kind="http",
+                )
+            )
+
+        # Gap 1: MapMethods call sites
+        for call in map_methods_calls:
+            # arguments[0] = path, arguments[1] = http methods array, arguments[2] = handler
+            if not call.arguments or not call.arguments[0].is_literal:
+                continue
+            path = str(call.arguments[0].literal_value or "")
+            path = self._normalize_path(path)
+            if path and not path.startswith("/"):
+                path = "/" + path
+
+            # Parse HTTP methods from arguments[1]
+            http_methods_list: list[HttpMethod] = []
+            if len(call.arguments) > 1:
+                methods_text = call.arguments[1].expression_text or ""
+                for match in re.finditer(r'HttpMethods\.(\w+)|"(\w+)"', methods_text):
+                    raw = match.group(1) or match.group(2)
+                    with contextlib.suppress(KeyError):
+                        http_methods_list.append(HttpMethod[raw.upper()])
+            if not http_methods_list:
+                http_methods_list = [HttpMethod.GET]
+
+            # Extract handler name / method reference from arguments[2]
+            handler_name = call.callee_name
+            lambda_arg = None
+            handler_method = None
+            if len(call.arguments) > 2:
+                arg2 = call.arguments[2]
+                if arg2.is_variable and arg2.variable_name:
+                    handler_name = arg2.variable_name
+                    handler_method = _method_lookup.get(handler_name)
+                elif arg2.is_expression and arg2.expression_text == "<lambda>":
+                    handler_name = f"{call.callee_name}/<lambda>"
+                    lambda_arg = arg2
+
+            path_params = self._extract_path_params_from_template(path)
+            query_params = []
+            header_params = []
+            body = None
+            if lambda_arg is not None and lambda_arg.lambda_parameter_types:
+                path_tpl_names = {m.group(1) for m in re.finditer(r"\{([^}:]+)(?::[^}]+)?\}", path)}
+                path_param_names = {p.name for p in path_params}
+                body, query_params = self._classify_lambda_params(
+                    lambda_arg.lambda_parameter_types,
+                    path_tpl_names,
+                    path_param_names,
+                    context,
+                )
+            elif handler_method is not None:
+                path_params, query_params, header_params, _cookie_params, body = (
+                    self._extract_params(handler_method, path, context, parsed_file)
+                )
+
+            call_line = call.location.line if call.location else -1
+            chained = auth_chainers.get(call_line, [])
+            auth_chainer = next((c for c in chained if c in _MINIMAL_API_AUTH_CHAINERS), None)
+            auth_refs = [f"{auth_chainer}@{call_line}"] if auth_chainer else []
+            # C3: [Authorize] on the MapMethods lambda handler → explicit auth dep_ref
+            lambda_auth_attrs = lambda_arg.lambda_attribute_names if lambda_arg else []
+            if "Authorize" in lambda_auth_attrs and "AllowAnonymous" not in lambda_auth_attrs:
+                auth_refs.append(f"Authorize@{call_line}")
+
+            for hm in http_methods_list:
+                routes.append(
+                    ExtractedRoute(
+                        method=hm,
+                        path=path,
+                        handler_function=_str_to_qname(handler_name),
+                        handler_location=call.location,
+                        path_params=path_params,
+                        query_params=query_params,
+                        header_params=header_params,
+                        cookie_params=[],
+                        body=body,
+                        response=ExtractedResponse(status_code=200),
+                        tags=["minimal-api"],
+                        dependency_refs=auth_refs,
+                        confidence=Confidence.HIGH,
+                        kind="http",
+                    )
+                )
+
+        # Gap 4: MapHealthChecks call sites
+        for call in parsed_file.call_sites:
+            if call.callee_name.split(".")[-1] != "MapHealthChecks":
+                continue
+            if not call.arguments or not call.arguments[0].is_literal:
+                continue
+            hc_path = str(call.arguments[0].literal_value or "")
+            if not hc_path.startswith("/"):
+                hc_path = "/" + hc_path
+            routes.append(
+                ExtractedRoute(
+                    method=HttpMethod.GET,
+                    path=hc_path,
+                    handler_function=_str_to_qname("MapHealthChecks"),
+                    handler_location=call.location,
+                    path_params=[],
+                    query_params=[],
+                    header_params=[],
+                    cookie_params=[],
+                    body=None,
+                    response=ExtractedResponse(status_code=200),
+                    tags=["health"],
+                    dependency_refs=[],
+                    confidence=Confidence.HIGH,
+                    kind="health",
+                )
+            )
+
+        return routes
+
+    # -------------------------------------------------------------------------
+    # IEndpointGroup pattern (CleanArchitecture / RouteGroupBuilder style)
+    # -------------------------------------------------------------------------
+
+    def _extract_endpoint_group_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """Extract routes from the IEndpointGroup pattern.
+
+        In this pattern a class implements IEndpointGroup and registers routes
+        inside a static ``Map(RouteGroupBuilder groupBuilder)`` method:
+
+            public class TodoItems : IEndpointGroup {
+                public static void Map(RouteGroupBuilder groupBuilder) {
+                    groupBuilder.RequireAuthorization();   // ← group auth
+                    groupBuilder.MapPost(CreateTodoItem);
+                    groupBuilder.MapPut(UpdateTodoItem, "{id}");
+                }
+                public static async Task<...> CreateTodoItem(ISender s, CreateTodoItemCommand cmd) { ... }
+            }
+
+        Route prefix defaults to ``/api/{ClassName}``; group-level
+        ``RequireAuthorization()`` is inherited by all routes in the group;
+        handler parameters are resolved from the named static methods in the
+        same class.  ``MapIdentityApi<T>()`` emits the standard Identity
+        endpoint set.
+        """
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            if not any(b.rsplit(".", 1)[-1] in _ENDPOINT_GROUP_BASES for b in cls.base_classes):
+                continue
+
+            # Route prefix: check for an explicit Prefix field/property, else /api/{ClassName}
+            prefix_field = next(
+                (f for f in cls.fields if "prefix" in f.name.lower() and f.default_value),
+                None,
+            )
+            if prefix_field:
+                raw_prefix = prefix_field.default_value or ""
+                if (
+                    len(raw_prefix) >= 2
+                    and raw_prefix[0] == raw_prefix[-1]
+                    and raw_prefix[0] in ('"', "'")
+                ):
+                    raw_prefix = raw_prefix[1:-1]
+                group_prefix = raw_prefix if raw_prefix.startswith("/") else "/" + raw_prefix
+            else:
+                group_prefix = f"/api/{cls.name}"
+
+            # Handler method lookup: name → ParsedFunction
+            method_map: dict[str, ParsedFunction] = {m.name: m for m in cls.methods}
+
+            # Scan all call sites for group-builder calls and chainers
+            map_calls = []
+            auth_chainers: dict[int, list[str]] = {}
+            has_identity_api = False
+
+            for call in parsed_file.call_sites:
+                method_name = call.callee_name.split(".")[-1]
+                recv = call.receiver_expression or ""
+
+                if method_name == "MapIdentityApi" and recv == "groupBuilder":
+                    has_identity_api = True
+                elif method_name in _MINIMAL_API_METHODS and recv == "groupBuilder":
+                    map_calls.append(call)
+                elif method_name in _MINIMAL_API_CHAINERS and recv.startswith("line:"):
+                    with contextlib.suppress(ValueError):
+                        auth_chainers.setdefault(int(recv[5:]), []).append(method_name)
+
+            # Group-level auth: RequireAuthorization() called directly on groupBuilder
+            group_requires_auth = any(
+                call.callee_name.split(".")[-1] == "RequireAuthorization"
+                and (call.receiver_expression or "") == "groupBuilder"
+                for call in parsed_file.call_sites
+            )
+
+            if has_identity_api:
+                routes.extend(self._identity_api_routes(group_prefix))
+
+            for call in map_calls:
+                method_name = call.callee_name.split(".")[-1]
+                hm = _MINIMAL_API_METHODS[method_name]
+                call_line = call.location.line if call.location else -1
+
+                # Extract route suffix (first string literal arg) and handler name
+                route_suffix = ""
+                handler_name: str | None = None
+                for arg in call.arguments:
+                    if arg.is_literal and arg.literal_type == "str" and arg.literal_value:
+                        if not route_suffix:
+                            route_suffix = arg.literal_value.strip("/")
+                    elif arg.is_variable and arg.variable_name and handler_name is None:
+                        handler_name = arg.variable_name
+
+                path = f"{group_prefix}/{route_suffix}" if route_suffix else group_prefix
+                path = self._normalize_path(path)
+
+                path_params = self._extract_path_params_from_template(path)
+
+                # Extract body/query from handler method signature
+                body: ExtractedBody | None = None
+                query_params: list[ExtractedParameter] = []
+                if handler_name and handler_name in method_map:
+                    handler_method = method_map[handler_name]
+                    lambda_params = [
+                        (p.type_annotation or "object", p.name)
+                        for p in handler_method.parameters
+                        if p.type_annotation
+                    ]
+                    if lambda_params:
+                        path_tpl_names = {
+                            m.group(1) for m in re.finditer(r"\{([^}:]+)(?::[^}]+)?\}", path)
+                        }
+                        path_param_names = {p.name for p in path_params}
+                        body, query_params = self._classify_lambda_params(
+                            lambda_params,
+                            path_tpl_names,
+                            path_param_names,
+                            context,
+                        )
+
+                # Auth: group-level OR per-route chaining
+                chained = auth_chainers.get(call_line, [])
+                has_route_auth = any(c in _MINIMAL_API_AUTH_CHAINERS for c in chained)
+                auth_refs: list[str] = []
+                if group_requires_auth or has_route_auth:
+                    auth_refs = [f"Authorize@{call_line}"]
+
+                routes.append(
+                    ExtractedRoute(
+                        method=hm,
+                        path=path,
+                        handler_function=_str_to_qname(handler_name or method_name),
+                        handler_location=call.location,
+                        path_params=path_params,
+                        query_params=query_params,
+                        header_params=[],
+                        cookie_params=[],
+                        body=body,
+                        response=ExtractedResponse(status_code=200),
+                        tags=["endpoint-group"],
+                        dependency_refs=auth_refs,
+                        confidence=Confidence.HIGH,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def _identity_api_routes(self, group_prefix: str) -> list[ExtractedRoute]:
+        """Synthesise the well-known ASP.NET Core Identity API endpoints."""
+        routes = []
+        stub_location = CodeLocation(file="[identity-api]", line=0)
+        for method, suffix, requires_auth in _IDENTITY_API_ROUTES:
+            path = f"{group_prefix}/{suffix}"
+            auth_refs = ["Authorize@identity"] if requires_auth else []
+            routes.append(
+                ExtractedRoute(
+                    method=method,
+                    path=path,
+                    handler_function=_str_to_qname(f"IdentityApi.{suffix}"),
+                    handler_location=stub_location,
+                    path_params=[],
+                    query_params=[],
+                    header_params=[],
+                    cookie_params=[],
+                    body=None,
+                    response=ExtractedResponse(status_code=200),
+                    tags=["identity-api"],
+                    dependency_refs=auth_refs,
+                    confidence=Confidence.HIGH,
+                    kind="http",
+                )
+            )
+        return routes
+
+    def _extract_path_params_from_template(self, path: str) -> list[ExtractedParameter]:
+        """
+        Extract ``{name}`` placeholders from a (already-normalized) path template
+        as PATH parameters.
+
+        After ``_normalize_path`` all constraints have been stripped, so we only
+        need to match ``{name}`` forms.
+        """
+        params = []
+        for name in re.findall(r"\{([^}]+)\}", path):
+            params.append(
+                ExtractedParameter(
+                    name=name,
+                    location=ParameterLocation.PATH,
+                    required=True,
+                )
+            )
+        return params
+
+    # -------------------------------------------------------------------------
+    # Parameter extraction
+    # -------------------------------------------------------------------------
+
+    def _extract_params(
+        self,
+        method: ParsedFunction,
+        path: str,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> tuple[
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        ExtractedBody | None,
+    ]:
+        path_params: list[ExtractedParameter] = []
+        query_params: list[ExtractedParameter] = []
+        header_params: list[ExtractedParameter] = []
+        cookie_params: list[ExtractedParameter] = []
+        body: ExtractedBody | None = None
+
+        path_tpl_names = set(re.findall(r"\{([^}:]+)(?::[^}]+)?\}", path))
+
+        for param in method.parameters:
+            meta = param.metadata or {}
+            constraints = self._extract_constraints(meta)
+
+            # [AsParameters] — properties bound individually from query/route/path.
+            # Service bundles (Manager, Service, Context, etc.) are DI injections — skip them.
+            # Other types are value-object param groups — treat as aggregate query param.
+            if "AsParameters" in meta:
+                if param.type_annotation:
+                    _svc_sfx = (
+                        "Services",
+                        "Manager",
+                        "Service",
+                        "Repository",
+                        "Context",
+                        "DbContext",
+                        "Factory",
+                        "Provider",
+                        "Sender",
+                        "Mediator",
+                        "Dispatcher",
+                        "Processor",
+                        "Client",
+                        "Queries",
+                    )
+                    base_type = param.type_annotation.split("<")[0].strip()
+                    if any(base_type.endswith(s) for s in _svc_sfx):
+                        continue  # DI service bundle
+                    # Non-service [AsParameters]: emit as an aggregate query param
+                    query_params.append(
+                        ExtractedParameter(
+                            name=param.name,
+                            location=ParameterLocation.QUERY,
+                            type_annotation=param.type_annotation,
+                            required=False,
+                            code_location=param.location,
+                        )
+                    )
+                continue
+
+            # Explicit [FromBody]
+            if "FromBody" in meta:
+                body = ExtractedBody(
+                    content_type="application/json",
+                    model_name=param.type_annotation,
+                    required=True,
+                )
+                continue
+
+            # Explicit [FromRoute]
+            if "FromRoute" in meta:
+                alias = meta.get("FromRoute")
+                name = alias if isinstance(alias, str) and alias != "True" else param.name
+                path_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Explicit [FromQuery]
+            if "FromQuery" in meta:
+                alias = meta.get("FromQuery")
+                name = alias if isinstance(alias, str) and alias != "True" else param.name
+                req = "Required" in meta
+                query_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=req,
+                        default_value=param.default_value,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Explicit [FromHeader]
+            if "FromHeader" in meta:
+                alias = meta.get("FromHeader")
+                name = alias if isinstance(alias, str) and alias != "True" else param.name
+                header_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.HEADER,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Explicit [FromForm]
+            if "FromForm" in meta:
+                if body is None:
+                    body = ExtractedBody(
+                        content_type="multipart/form-data",
+                        model_name=param.type_annotation,
+                        required=True,
+                    )
+                continue
+
+            # No explicit annotation — infer from path template
+            if param.name in path_tpl_names:
+                path_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Skip framework-injected types
+            skip_types = {
+                "HttpContext",
+                "HttpRequest",
+                "HttpResponse",
+                "CancellationToken",
+                "ILogger",
+                "ClaimsPrincipal",
+                "IFormFile",
+                "IFormFileCollection",
+            }
+            if param.type_annotation in skip_types:
+                continue
+            # Also skip types that start with "I" (interfaces injected via DI)
+            if (
+                param.type_annotation
+                and param.type_annotation.startswith("I")
+                and len(param.type_annotation) > 1
+                and param.type_annotation[1].isupper()
+            ):
+                continue
+
+            # Complex type with no annotation → treat as [FromBody] (ASP.NET default)
+            if param.type_annotation and self._is_complex_type(param.type_annotation):
+                if body is None:
+                    body = ExtractedBody(
+                        content_type="application/json",
+                        model_name=param.type_annotation,
+                        required=True,
+                    )
+                continue
+
+            # Scalar with no annotation → query param (ASP.NET Core default for scalars)
+            query_params.append(
+                ExtractedParameter(
+                    name=param.name,
+                    location=ParameterLocation.QUERY,
+                    type_annotation=param.type_annotation,
+                    required=param.default_value is None and param.default_value != "null",
+                    default_value=param.default_value,
+                    constraints=constraints,
+                    code_location=param.location,
+                )
+            )
+
+        return path_params, query_params, header_params, cookie_params, body
+
+    def _extract_constraints(self, meta: dict[str, Any]) -> dict[str, Any]:
+        constraints: dict[str, Any] = {}
+        if "Required" in meta:
+            constraints["not_null"] = True
+        if "Range" in meta:
+            val = meta["Range"]
+            if isinstance(val, dict):
+                if "Minimum" in val:
+                    constraints["min"] = val["Minimum"]
+                if "Maximum" in val:
+                    constraints["max"] = val["Maximum"]
+        for attr in ("MinLength", "StringLength"):
+            if attr in meta:
+                val = meta[attr]
+                n = self._to_number(val)
+                if n is not None:
+                    constraints.setdefault("min_length", n)
+        if "MaxLength" in meta:
+            val = meta["MaxLength"]
+            n = self._to_number(val)
+            if n is not None:
+                constraints["max_length"] = n
+        if "RegularExpression" in meta:
+            val = meta["RegularExpression"]
+            constraints["pattern"] = val if isinstance(val, str) else str(val)
+        if "EmailAddress" in meta:
+            constraints["format"] = "email"
+        if "Url" in meta:
+            constraints["format"] = "url"
+        return constraints
+
+    @staticmethod
+    def _to_number(val: Any) -> int | float | None:
+        if isinstance(val, (int, float)) and not isinstance(val, bool):
+            return val
+        if isinstance(val, str):
+            try:
+                return int(val)
+            except ValueError:
+                pass
+            try:
+                return float(val)
+            except ValueError:
+                pass
+        return None
+
+    def _classify_lambda_params(
+        self,
+        lambda_params: list[tuple[str, str]],
+        path_tpl_names: set[str],
+        path_param_names: set[str],
+        context: AnalysisContext | None,
+    ) -> tuple[ExtractedBody | None, list[ExtractedParameter]]:
+        """Classify typed lambda parameters into body / query params.
+
+        ASP.NET Core Minimal API binding rules (simplified):
+        - Name matches a path template placeholder → already a path param (skip)
+        - DI interface (starts with ``I`` + uppercase) → skip (framework-injected)
+        - Framework special types (HttpContext, CancellationToken, …) → skip
+        - Complex (non-scalar) type → request body (first one wins)
+        - Scalar type → query param
+        """
+        _DI_SKIP: frozenset[str] = frozenset(
+            {
+                "HttpContext",
+                "HttpRequest",
+                "HttpResponse",
+                "CancellationToken",
+                "IFormFile",
+                "IFormFileCollection",
+                "ClaimsPrincipal",
+                "ILogger",
+                "LinkGenerator",
+                # Common ASP.NET Core service types injected directly (not via interface)
+                "SignInManager",
+                "UserManager",
+                "RoleManager",
+                "ISender",
+                "IMediator",
+            }
+        )
+
+        # Name suffixes that strongly indicate a DI service, not a data model
+        _SERVICE_SUFFIXES: tuple[str, ...] = (
+            "Manager",
+            "Service",
+            "Repository",
+            "Context",
+            "DbContext",
+            "Factory",
+            "Provider",
+            "Sender",
+            "Mediator",
+            "Dispatcher",
+            "Handler",
+            "Processor",
+            "Client",
+        )
+
+        body: ExtractedBody | None = None
+        query_params: list[ExtractedParameter] = []
+
+        for type_ann, param_name in lambda_params:
+            # Skip path params already extracted from the template
+            if param_name in path_tpl_names or param_name in path_param_names:
+                continue
+
+            # Strip generics for interface check
+            raw_type = type_ann.split("<")[0].strip()
+
+            # DI-injected interfaces (IRepository<T>, ILogger, etc.) and known services
+            if raw_type in _DI_SKIP:
+                continue
+            if len(raw_type) > 1 and raw_type[0] == "I" and raw_type[1].isupper():
+                continue
+            if any(raw_type.endswith(sfx) for sfx in _SERVICE_SUFFIXES):
+                continue
+
+            # Check type resolver first (best signal)
+            resolved = None
+            if context and context.type_resolver:
+                resolved = context.type_resolver.resolve_type(type_ann)
+
+            # If the type resolves but is NOT a model it's a service/entity class → skip
+            if resolved is not None and not resolved.is_model:
+                continue
+
+            if resolved is not None and resolved.is_model:
+                # Explicit model → body
+                if body is None:
+                    fields = (
+                        context.type_resolver.get_model_fields(resolved.qualified_name)
+                        if context and context.type_resolver
+                        else []
+                    )  # type: ignore[union-attr]
+                    body = ExtractedBody(
+                        content_type="application/json",
+                        model_name=type_ann,
+                        model_fields=[f.name for f in fields] if fields else [],
+                        required=True,
+                    )
+            elif self._is_complex_type(raw_type):
+                # Unknown complex type — treat as body (ASP.NET default)
+                if body is None:
+                    body = ExtractedBody(
+                        content_type="application/json",
+                        model_name=type_ann,
+                        required=True,
+                    )
+            else:
+                # Scalar → query param
+                query_params.append(
+                    ExtractedParameter(
+                        name=param_name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=type_ann,
+                        required=True,
+                    )
+                )
+
+        return body, query_params
+
+    def _is_complex_type(self, type_name: str) -> bool:
+        # Strip nullable marker and generics before checking — handles string?, Guid?, etc.
+        base = type_name.rstrip("?").split("<")[0].strip()
+        simple = {
+            "string",
+            "int",
+            "long",
+            "double",
+            "float",
+            "decimal",
+            "bool",
+            "char",
+            "byte",
+            "short",
+            "uint",
+            "ulong",
+            "Guid",
+            "DateTime",
+            "DateTimeOffset",
+            "TimeSpan",
+            "DateOnly",
+            "TimeOnly",
+            "object",
+        }
+        return base not in simple
+
+    # -------------------------------------------------------------------------
+    # Auth
+    # -------------------------------------------------------------------------
+
+    def _method_auth_refs(self, cls: ParsedClass, method: ParsedFunction) -> list[str]:
+        class_authorize = any(d.name == "Authorize" for d in cls.decorators)
+        method_authorize = any(d.name == "Authorize" for d in method.decorators)
+        method_allow_anon = any(d.name == "AllowAnonymous" for d in method.decorators)
+
+        # [AllowAnonymous] on the method always wins over class-level [Authorize]
+        if method_allow_anon:
+            return []
+        # Method-level [Authorize]: ref is qualified so it matches the method-level auth dep
+        if method_authorize:
+            return [f"{cls.name}.{method.name}"]
+        # Class-level [Authorize]: ref is the class name — matches the class-level auth dep
+        if class_authorize:
+            return [cls.name]
+        # Other security attributes (RequireScope, etc.)
+        for dec in method.decorators:
+            if dec.name in _SECURITY_ATTRS:
+                return [f"{cls.name}.{method.name}"]
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        schemes: list[ExtractedAuthScheme] = []
+
+        for cls in parsed_file.classes:
+            cls_lower = cls.name.lower()
+
+            # Startup / Program / WebApplicationBuilder auth registration
+            if any(
+                kw in cls_lower for kw in ("startup", "program", "serviceextension", "authconfig")
+            ):
+                for method in cls.methods:
+                    scheme = self._detect_auth_registration(method, cls)
+                    if scheme:
+                        schemes.append(scheme)
+
+        # Also scan top-level call sites (Program.cs minimal hosting).
+        # Match on the *final* segment of the dotted callee name and require
+        # exact equality so custom extension methods (`AddCookieSettings`)
+        # don't masquerade as built-in registrations (`AddCookie`).
+        for call in parsed_file.call_sites:
+            method_segment = call.callee_name.rsplit(".", 1)[-1].lower()
+            for pattern, scheme_type, name, confidence in _AUTH_SCHEME_CALL_PATTERNS:
+                if method_segment == pattern:
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=scheme_type,
+                            name=name,
+                            location=call.location,
+                            config={"detected_via": call.callee_name},
+                            confidence=confidence,
+                        )
+                    )
+                    break
+
+        return schemes
+
+    def _detect_auth_registration(
+        self, method: ParsedFunction, cls: ParsedClass
+    ) -> ExtractedAuthScheme | None:
+        """Scan a method's name for auth registration patterns."""
+        name_lower = method.name.lower()
+        if "addauthentication" in name_lower or "configureauth" in name_lower:
+            return ExtractedAuthScheme(
+                scheme_type=AuthSchemeType.CUSTOM,
+                name=method.name,
+                location=method.location,
+                config={"class": cls.name, "method": method.name, "framework": "aspnetcore"},
+                confidence=Confidence.MEDIUM,
+            )
+        return None
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        auth_deps: list[ExtractedAuthDependency] = []
+
+        for cls in parsed_file.classes:
+            # Class-level [Authorize] / [AllowAnonymous]
+            for dec in cls.decorators:
+                if dec.name == "Authorize":
+                    roles = self._extract_roles(dec)
+                    policy = dec.arguments.get("Policy") if dec.arguments else None
+                    if policy and isinstance(policy, str) and policy not in roles:
+                        roles = roles + [policy]
+                    auth_deps.append(
+                        ExtractedAuthDependency(
+                            name=cls.name,
+                            qualified_name=cls.qualified_name,
+                            location=cls.location,
+                            dependency_type=AuthDependencyType.ANNOTATION,
+                            requires_roles=roles,
+                            confidence=Confidence.HIGH,
+                        )
+                    )
+
+            # Method-level security annotations
+            for method in cls.methods:
+                roles: list[str] = []
+                has_security = False
+                for dec in method.decorators:
+                    if dec.name == "Authorize":
+                        has_security = True
+                        roles.extend(self._extract_roles(dec))
+                    elif dec.name == "AllowAnonymous":
+                        has_security = True
+                if has_security:
+                    auth_deps.append(
+                        ExtractedAuthDependency(
+                            name=f"{cls.name}.{method.name}",
+                            qualified_name=method.qualified_name,
+                            location=method.location,
+                            dependency_type=AuthDependencyType.ANNOTATION,
+                            requires_roles=roles,
+                            confidence=Confidence.HIGH,
+                        )
+                    )
+
+        return auth_deps
+
+    def _extract_roles(self, dec: ParsedDecorator) -> list[str]:
+        roles_val = dec.arguments.get("Roles", dec.arguments.get("roles", ""))
+        if not roles_val:
+            return []
+        if isinstance(roles_val, str):
+            return [r.strip() for r in roles_val.split(",") if r.strip()]
+        return []
+
+    # -------------------------------------------------------------------------
+    # Dependencies
+    # -------------------------------------------------------------------------
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        deps: list[ExtractedDependency] = []
+        for cls in parsed_file.classes:
+            ann_names = {d.name for d in cls.decorators}
+            if ann_names & {"Controller", "ApiController", "Service", "Repository", "Component"}:
+                is_auth = any(kw in cls.name.lower() for kw in _AUTH_KEYWORDS)
+                deps.append(
+                    ExtractedDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type="class",
+                        provides_type=cls.name,
+                        is_auth_related=is_auth,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+        return deps
+
+    # -------------------------------------------------------------------------
+    # Middleware
+    # -------------------------------------------------------------------------
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        middleware: list[ExtractedMiddleware] = []
+
+        for cls in parsed_file.classes:
+            mw_type = self._classify_middleware(cls)
+            if mw_type:
+                ops = self._infer_operations(cls)
+                middleware.append(
+                    ExtractedMiddleware(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        middleware_type=mw_type,
+                        # A class definition alone does NOT mean it is globally registered.
+                        # Only explicit app.UseMiddleware<T>() call sites set applies_to_all=True.
+                        applies_to_all=False,
+                        operations=ops,
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+
+        # Detect app.UseMiddleware<T>() call sites
+        for call in parsed_file.call_sites:
+            callee = call.callee_name
+            callee_lower = callee.lower()
+            if "usemiddleware" in callee_lower:
+                middleware.append(
+                    ExtractedMiddleware(
+                        name=callee,
+                        qualified_name=_str_to_qname(callee),
+                        location=call.location,
+                        middleware_type="middleware",
+                        applies_to_all=True,
+                        operations=["custom"],
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+            elif "usecors" in callee_lower:
+                middleware.append(
+                    ExtractedMiddleware(
+                        name="CORS",
+                        qualified_name=_str_to_qname(callee),
+                        location=call.location,
+                        middleware_type="cors",
+                        applies_to_all=True,
+                        operations=["cors"],
+                        confidence=Confidence.HIGH,
+                    )
+                )
+            elif "useauthentication" in callee_lower:
+                middleware.append(
+                    ExtractedMiddleware(
+                        name="Authentication",
+                        qualified_name=_str_to_qname(callee),
+                        location=call.location,
+                        middleware_type="auth",
+                        applies_to_all=True,
+                        # "auth_pipeline" rather than "auth": UseAuthentication only
+                        # reads the identity — it does not block unauthenticated requests
+                        # globally, so it must not be treated as a globally-enforcing guard.
+                        operations=["auth_pipeline"],
+                        confidence=Confidence.HIGH,
+                    )
+                )
+            elif "useauthorization" in callee_lower:
+                middleware.append(
+                    ExtractedMiddleware(
+                        name="Authorization",
+                        qualified_name=_str_to_qname(callee),
+                        location=call.location,
+                        middleware_type="auth",
+                        applies_to_all=True,
+                        # "auth_pipeline": UseAuthorization enables the authorization
+                        # framework but only enforces auth where [Authorize] is present.
+                        operations=["auth_pipeline"],
+                        confidence=Confidence.HIGH,
+                    )
+                )
+            elif "usehttpsredirection" in callee_lower:
+                middleware.append(
+                    ExtractedMiddleware(
+                        name="HttpsRedirection",
+                        qualified_name=_str_to_qname(callee),
+                        location=call.location,
+                        middleware_type="https_redirect",
+                        applies_to_all=True,
+                        operations=["https_redirect"],
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        return middleware
+
+    def _classify_middleware(self, cls: ParsedClass) -> str | None:
+        for base in cls.base_classes:
+            if base in ("IMiddleware", "IApplicationBuilder"):
+                return "middleware"
+            if "Filter" in base or base in (
+                "IActionFilter",
+                "IAuthorizationFilter",
+                "IResourceFilter",
+                "IResultFilter",
+                "IExceptionFilter",
+            ):
+                return "filter"
+        name_lower = cls.name.lower()
+        if "middleware" in name_lower:
+            return "middleware"
+        if "filter" in name_lower:
+            return "filter"
+        return None
+
+    def _infer_operations(self, cls: ParsedClass) -> list[str]:
+        combined = cls.name.lower() + " ".join(b.lower() for b in cls.base_classes)
+        ops: list[str] = []
+        if any(kw in combined for kw in ["auth", "jwt", "token", "security", "login"]):
+            ops.append("auth")
+        if "cors" in combined:
+            ops.append("cors")
+        if "log" in combined:
+            ops.append("logging")
+        if "rate" in combined or "throttl" in combined:
+            ops.append("rate_limiting")
+        return ops or ["custom"]
+
+    # -------------------------------------------------------------------------
+    # JWT config extraction
+    # -------------------------------------------------------------------------
+
+    _jwt_extractor = DotNetJwtConfigExtractor()
+
+    def extract_jwt_config(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> ExtractedJwtConfig | None:
+        return self._jwt_extractor.extract(parsed_file)
+
+    # -------------------------------------------------------------------------
+    # Annotation helpers
+    # -------------------------------------------------------------------------
+
+    def _dec_path(self, dec: ParsedDecorator) -> str | None:
+        """Extract path string from a routing attribute."""
+        if dec.positional_args:
+            val = dec.positional_args[0]
+            if isinstance(val, str):
+                return val
+        for key in ("template", "Template", "name", "Name"):
+            val = dec.arguments.get(key)
+            if val and isinstance(val, str):
+                return val
+        return None
+
+    def _join_paths(self, prefix: str, path: str) -> str:
+        if path.startswith("/"):
+            return path  # absolute path override ignores controller prefix
+        prefix = prefix.rstrip("/")
+        result = (prefix + "/" + path).rstrip("/") if path else prefix
+        if not result:
+            return "/"
+        if not result.startswith("/"):
+            result = "/" + result
+        return result
+
+    @staticmethod
+    def _normalize_path(path: str) -> str:
+        """Strip route constraint suffixes: {id:int} → {id}, {slug:regex(...)} → {slug}."""
+        return re.sub(r"\{([^}:]+):[^}]+\}", r"{\1}", path)
+
+    def _extract_response_status(self, dec: ParsedDecorator) -> int:
+        for val in dec.positional_args:
+            if isinstance(val, int):
+                return val
+            if isinstance(val, str):
+                code = _STATUS_NAMES.get(val)
+                if code:
+                    return code
+                try:
+                    return int(val)
+                except ValueError:
+                    pass
+        for key in ("StatusCode", "statusCode", "Type", "type"):
+            val = dec.arguments.get(key)
+            if val:
+                n = _STATUS_NAMES.get(str(val))
+                if n:
+                    return n
+        return 200
+
+
+def _method_is_public_csharp(method: ParsedFunction) -> bool:
+    """
+    Best-effort access-modifier detection from the method's signature
+    line.  `ParsedFunction` doesn't track `access_modifier` for methods
+    (only `ParsedField` does), so we read the source file at
+    `method.location` and look for the `public` keyword on the
+    signature line.
+
+    `method.location.line` may point at the topmost decorator line
+    rather than the signature for attributed methods, so we scan
+    forward for the first line containing `<MethodName>(`.
+
+    Returns True defensively when:
+      - The location has no file path (in-memory `parse_source` with no
+        `file_path=` — e.g. unit tests that construct fixtures inline).
+        These tests have always behaved as if visibility were not
+        enforced; preserve that.
+      - The file isn't readable (network/permissions error).
+      - The signature line can't be located within the next 15 lines.
+
+    Returns False only when an explicit `private`/`protected`/`internal`
+    modifier is present, or when no modifier appears at all (C#
+    in-class default is `private`).
+    """
+    if method.location is None or method.location.file is None:
+        return True
+    try:
+        text = Path(method.location.file).read_text(
+            encoding="utf-8",
+            errors="replace",
+        )
+    except OSError:
+        return True
+    lines = text.splitlines()
+    # Treat the unit-test in-memory case (file path looks synthetic /
+    # virtual / nonexistent on disk) as "visibility unknown — include."
+    if not lines:
+        return True
+    line_idx = method.location.line - 1
+    if line_idx < 0:
+        return True
+    name_re = re.compile(rf"\b{re.escape(method.name)}\s*\(")
+    for i in range(line_idx, min(len(lines), line_idx + 15)):
+        if not name_re.search(lines[i]):
+            continue
+        pre_paren = lines[i].split("(", 1)[0]
+        tokens = set(re.findall(r"\b\w+\b", pre_paren))
+        if "public" in tokens:
+            return True
+        if tokens & {"private", "protected", "internal"}:
+            return False
+        return False  # No explicit modifier — C# default is private
+    return True  # Couldn't locate signature line — defensive
+
+
+# =============================================================================
+# Registration
+# =============================================================================
+
+_aspnet_plugin = AspNetCorePlugin()
+FrameworkPluginRegistry.register(_aspnet_plugin)