sourcecode 1.73.0__tar.gz → 2.0.1__tar.gz

{sourcecode-1.73.0 → sourcecode-2.0.1}/.gitignore

@@ -35,6 +35,10 @@ Thumbs.db
 
 .planning
 
+# ContextGraph baseline — full canonical outputs (multi-MB, from external repos).
+# The light oracle (index.json) and convergence.json ARE committed.
+tests/contextgraph_baseline/baseline/artifacts/
+
 # Supabase local temp
 supabase/.temp/
 # Internal agent playbook (not distributed)

{sourcecode-1.73.0 → sourcecode-2.0.1}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [2.0.1] — 2026-07-10
+
+### Added
+
+- **`migrate-check --compact` — bounded decision summary.** A new opt-in view of the
+  migration report that keeps every decision field (readiness scores, headline blocker,
+  blocking count, estimated effort, executive summary, Hibernate classification, aggregate
+  counts) and caps each large collection to its top items with a `+N more` count. On real
+  monoliths the report shrinks ~97% (BroadleafCommerce 1.2 MB → 32 KB, OpenMRS 908 KB →
+  23 KB) — an agent or reviewer gets the verdict without the leaf-level firehose. The full
+  report remains the default output.
+
+### Fixed
+
+- **`onboard` project summary no longer leaks raw README markup.** READMEs that open with
+  a logo block (`<img>` / `<p>` HTML) or use inline markdown links (`[label](url)`) had
+  produced summaries like `API: <img src="…"/>`. The summary is now rendered to clean prose
+  — HTML/badge blocks are skipped and inline links are unwrapped to their label.
+- **More complete blast radius in `impact` and `review-pr`.** Change-impact analysis now
+  surfaces every affected entry point for a changed repository/service, reducing missed
+  callers on interface- and DI-wired code.
+
+### Notes
+
+- No breaking changes. Default command outputs are unchanged except where explicitly noted.
+
 ## [1.73.0] — 2026-07-01
 
 ### Fixed — audit reliability on a large non-Boot Spring monolith (Alfresco Community Repo field test)

{sourcecode-1.73.0 → sourcecode-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.73.0
+Version: 2.0.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -36,22 +36,26 @@ Provides-Extra: mcp
 Requires-Dist: mcp>=1.0.0; extra == 'mcp'
 Description-Content-Type: text/markdown
 
-# sourcecode
+# ASK Engine
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.59.0-blue)
+![Version](https://img.shields.io/badge/version-2.0.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
+> **ASK Engine** is the product. The CLI you install and run is **`sourcecode`** (the
+> executable and Python package). The authoritative version is whatever
+> `sourcecode version` reports.
+
 ---
 
 ## The problem
 
 Every time an AI coding agent starts a new session, it has to re-parse the repository from scratch. For a large Java or TypeScript monolith, that means 5–15 seconds per invocation. Multiply by dozens of agent turns per hour, and repo context acquisition becomes a real bottleneck — not just latency, but tokens, compute, and iteration velocity.
 
-`sourcecode` solves this with a persistent structural cache keyed on file content hashes. After the first scan, every subsequent invocation returns pre-built context in milliseconds. The repo doesn't change? The cache doesn't expire.
+ASK Engine solves this with a persistent structural cache keyed on file content hashes. After the first scan, every subsequent invocation returns pre-built context in milliseconds. The repo doesn't change? The cache doesn't expire.
 
-**The cache is not a performance optimization. It is what makes sourcecode usable as infrastructure rather than a one-off tool.**
+**The cache is not a performance optimization. It is what makes ASK Engine usable as infrastructure rather than a one-off tool.**
 
 ---
 
@@ -114,7 +118,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.59.0
+# sourcecode 2.0.1
 ```
 
 ---
@@ -168,7 +172,7 @@ sourcecode fix-bug /path/to/repo --symptom "NullPointerException in checkout"
 
 ## Cache system
 
-sourcecode maintains a persistent cache at `.sourcecode-cache/` inside each repository. Two layers:
+ASK Engine maintains a persistent cache at `.sourcecode-cache/` inside each repository. Two layers:
 
 - **L1 (core):** analysis result keyed by `(git_sha, analysis_flags)`. Survives format changes — you can regenerate `--compact` vs `--agent` views from the same core.
 - **L2 (view):** rendered output keyed by `(core_hash, view_flags)`. Exact output match — no recomputation.
@@ -269,9 +273,9 @@ if [ "$DECISION" != "analysis_success" ]; then echo "Review failed: $DECISION";
 
 ---
 
-## What sourcecode does (and doesn't)
+## What ASK Engine does (and doesn't)
 
-**sourcecode reduces exploration cost.** It accelerates context acquisition and minimizes repeated repo parsing. It does not replace reading code — it reduces how often an agent needs to.
+**ASK Engine reduces exploration cost.** It accelerates context acquisition and minimizes repeated repo parsing. It does not replace reading code — it reduces how often an agent needs to.
 
 Specifically:
 
@@ -317,7 +321,7 @@ when the work gets bigger or automated.
 | Offline, no data egress, no account | ✅ | ✅ |
 
 **Non-Java repos are free at any size** — the size limit counts Java source
-files only, by design. sourcecode monetises enterprise Java monoliths.
+files only, by design. ASK Engine monetises enterprise Java monoliths.
 
 ```bash
 sourcecode activate <key>      # activate a license key
@@ -595,11 +599,19 @@ High-coupling nodes (high fan-in = risky to change), dead zone candidates (isola
 
 ```bash
 sourcecode migrate-check /path/to/repo
+sourcecode migrate-check . --compact          # bounded decision summary (score, blocker, effort, top items)
 sourcecode migrate-check . --min-severity high
 sourcecode migrate-check . --format text
 sourcecode migrate-check . --output migration.json
 ```
 
+`--compact` returns the decision-grade envelope — readiness scores, headline blocker,
+blocking count, estimated effort, executive summary, Hibernate classification and
+aggregate counts — with each large collection capped to its top items (`+N more`). On
+large monoliths this is ~97% smaller than the full report (e.g. 1.2 MB → 32 KB), so an
+agent or reviewer gets the verdict without the full leaf-level firehose. The complete
+report remains the default.
+
 Detects migration blockers across Java source files, Spring XML config files, and Maven/Gradle build files. 27 rules organized by target:
 
 **Jakarta namespace (MIG-001..009) — javax→jakarta**

{sourcecode-1.73.0 → sourcecode-2.0.1}/README.md

@@ -1,19 +1,23 @@
-# sourcecode
+# ASK Engine
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.59.0-blue)
+![Version](https://img.shields.io/badge/version-2.0.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
+> **ASK Engine** is the product. The CLI you install and run is **`sourcecode`** (the
+> executable and Python package). The authoritative version is whatever
+> `sourcecode version` reports.
+
 ---
 
 ## The problem
 
 Every time an AI coding agent starts a new session, it has to re-parse the repository from scratch. For a large Java or TypeScript monolith, that means 5–15 seconds per invocation. Multiply by dozens of agent turns per hour, and repo context acquisition becomes a real bottleneck — not just latency, but tokens, compute, and iteration velocity.
 
-`sourcecode` solves this with a persistent structural cache keyed on file content hashes. After the first scan, every subsequent invocation returns pre-built context in milliseconds. The repo doesn't change? The cache doesn't expire.
+ASK Engine solves this with a persistent structural cache keyed on file content hashes. After the first scan, every subsequent invocation returns pre-built context in milliseconds. The repo doesn't change? The cache doesn't expire.
 
-**The cache is not a performance optimization. It is what makes sourcecode usable as infrastructure rather than a one-off tool.**
+**The cache is not a performance optimization. It is what makes ASK Engine usable as infrastructure rather than a one-off tool.**
 
 ---
 
@@ -76,7 +80,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.59.0
+# sourcecode 2.0.1
 ```
 
 ---
@@ -130,7 +134,7 @@ sourcecode fix-bug /path/to/repo --symptom "NullPointerException in checkout"
 
 ## Cache system
 
-sourcecode maintains a persistent cache at `.sourcecode-cache/` inside each repository. Two layers:
+ASK Engine maintains a persistent cache at `.sourcecode-cache/` inside each repository. Two layers:
 
 - **L1 (core):** analysis result keyed by `(git_sha, analysis_flags)`. Survives format changes — you can regenerate `--compact` vs `--agent` views from the same core.
 - **L2 (view):** rendered output keyed by `(core_hash, view_flags)`. Exact output match — no recomputation.
@@ -231,9 +235,9 @@ if [ "$DECISION" != "analysis_success" ]; then echo "Review failed: $DECISION";
 
 ---
 
-## What sourcecode does (and doesn't)
+## What ASK Engine does (and doesn't)
 
-**sourcecode reduces exploration cost.** It accelerates context acquisition and minimizes repeated repo parsing. It does not replace reading code — it reduces how often an agent needs to.
+**ASK Engine reduces exploration cost.** It accelerates context acquisition and minimizes repeated repo parsing. It does not replace reading code — it reduces how often an agent needs to.
 
 Specifically:
 
@@ -279,7 +283,7 @@ when the work gets bigger or automated.
 | Offline, no data egress, no account | ✅ | ✅ |
 
 **Non-Java repos are free at any size** — the size limit counts Java source
-files only, by design. sourcecode monetises enterprise Java monoliths.
+files only, by design. ASK Engine monetises enterprise Java monoliths.
 
 ```bash
 sourcecode activate <key>      # activate a license key
@@ -557,11 +561,19 @@ High-coupling nodes (high fan-in = risky to change), dead zone candidates (isola
 
 ```bash
 sourcecode migrate-check /path/to/repo
+sourcecode migrate-check . --compact          # bounded decision summary (score, blocker, effort, top items)
 sourcecode migrate-check . --min-severity high
 sourcecode migrate-check . --format text
 sourcecode migrate-check . --output migration.json
 ```
 
+`--compact` returns the decision-grade envelope — readiness scores, headline blocker,
+blocking count, estimated effort, executive summary, Hibernate classification and
+aggregate counts — with each large collection capped to its top items (`+N more`). On
+large monoliths this is ~97% smaller than the full report (e.g. 1.2 MB → 32 KB), so an
+agent or reviewer gets the verdict without the full leaf-level firehose. The complete
+report remains the default.
+
 Detects migration blockers across Java source files, Spring XML config files, and Maven/Gradle build files. 27 rules organized by target:
 
 **Jakarta namespace (MIG-001..009) — javax→jakarta**

{sourcecode-1.73.0 → sourcecode-2.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.73.0"
+version = "2.0.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

sourcecode-2.0.1/scripts/compare_integration_engines.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Reproducible comparison harness for Increment #6 (Semantic Integration Engine spike).
+
+Runs the legacy heuristic `integration_detector` and the new read-only
+`SemanticIntegrationEngine` over one or more reference repos and prints the metrics
+used in docs/architecture/REPORT-p6-integration-detector-comparison.md.
+
+Usage:
+    python3 scripts/compare_integration_engines.py <repo_path> [<repo_path> ...]
+
+Neither engine is wired into the product; evidence-gathering only.
+"""
+from __future__ import annotations
+
+import sys
+import time
+from collections import Counter
+from pathlib import Path
+
+from sourcecode.context_graph import ContextGraph
+from sourcecode.integration_detector import detect_integrations
+from sourcecode.semantic_integration_engine import SemanticIntegrationEngine
+
+
+def run(repo: str) -> None:
+    root = Path(repo)
+    files = [str(p.relative_to(root)) for p in sorted(root.rglob("*.java"))
+             if "/test/" not in str(p)]
+
+    t0 = time.time()
+    det = detect_integrations(files, root)
+    det_s = time.time() - t0
+
+    t1 = time.time()
+    g = ContextGraph.build(files, root)
+    build_s = time.time() - t1
+    t2 = time.time()
+    sem = SemanticIntegrationEngine(g).as_report()
+    sem_s = time.time() - t2
+
+    det_kinds = Counter(r["kind"] for r in det["integrations"])
+    sem_kinds = Counter(r["kind"] for r in sem["integrations"])
+    det_targets = sum(1 for r in det["integrations"] if r.get("target"))
+    sem_targets = sum(1 for r in sem["integrations"] if r.get("target"))
+
+    print(f"### {root.name}  (files={len(files)})")
+    print(f"  detector : count={det['count']:>3} targets={det_targets:>3} "
+          f"kinds={dict(sorted(det_kinds.items()))} time={det_s:.2f}s source_read=yes")
+    print(f"  semantic : count={sem['count']:>3} targets={sem_targets:>3} "
+          f"kinds={dict(sorted(sem_kinds.items()))} build={build_s:.2f}s detect={sem_s:.2f}s source_read=no")
+    only_sem = sorted(set(sem_kinds) - set(det_kinds))
+    only_det = sorted(set(det_kinds) - set(sem_kinds))
+    print(f"  kinds only-semantic={only_sem}  only-detector={only_det}")
+    print()
+
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        print(__doc__)
+        sys.exit(1)
+    for repo in sys.argv[1:]:
+        run(repo)

sourcecode-2.0.1/scripts/customer_smoke_test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Customer Smoke Test — verify in < 5 minutes that a real customer can install,
+# activate, and use ASK Engine (Free + Pro), and that revocation removes access.
+#
+# Reproducible. Sections A/B/C escalate in what they require:
+#   A. Offline, no license   — always runnable (also covered by tests/test_customer_smoke.py)
+#   B. Real activation        — needs a real Pro key + network (set SC_SMOKE_KEY)
+#   C. Revocation             — needs the key to be cancelled/expired server-side first
+#
+# Env:
+#   SC_CLI            command to invoke the CLI            (default: "sourcecode")
+#   SC_SMOKE_SMALL    path to a small repo (<=500 Java)    (default: the repo fixture)
+#   SC_SMOKE_LARGE    path to a large repo (>500 Java)     (optional; enables Pro gate check)
+#   SC_SMOKE_KEY      a real Pro license key               (optional; enables section B/C)
+#
+# Exit non-zero on the first failed check in a runnable section.
+set -u
+
+CLI="${SC_CLI:-sourcecode}"
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+SMALL="${SC_SMOKE_SMALL:-$HERE/tests/fixtures/spring_boot_minimal}"
+pass() { printf '  \033[32mPASS\033[0m %s\n' "$1"; }
+fail() { printf '  \033[31mFAIL\033[0m %s\n' "$1"; exit 1; }
+skip() { printf '  \033[33mSKIP\033[0m %s\n' "$1"; }
+
+echo "== A. Install + Free (offline, no license) =="
+
+$CLI version >/dev/null 2>&1        || fail "install: 'version' did not run"
+pass "installed — 'version' runs"
+
+$CLI config  >/dev/null 2>&1         || fail "'config' did not run"
+pass "'config' runs"
+
+# A Free command on a small repo must succeed (exit 0) with no license.
+if $CLI endpoints "$SMALL" >/dev/null 2>&1; then
+  pass "Free command 'endpoints' runs on a small repo"
+else
+  fail "Free command 'endpoints' failed on a small repo"
+fi
+
+# auth status with no license → unauthenticated.
+if $CLI auth status 2>/dev/null | grep -q '"status": "unauthenticated"\|"status":"unauthenticated"'; then
+  pass "'auth status' reports unauthenticated with no license"
+else
+  skip "'auth status' not unauthenticated (a license may already be present)"
+fi
+
+echo "== B. Activation (needs SC_SMOKE_KEY + network) =="
+if [ -z "${SC_SMOKE_KEY:-}" ]; then
+  skip "SC_SMOKE_KEY not set — skipping real activation"
+else
+  if $CLI activate "$SC_SMOKE_KEY" 2>/dev/null | grep -q '"status": *"activated"\|"status":"activated"'; then
+    pass "activation succeeded"
+  else
+    fail "activation did NOT return status=activated (check key + Edge Function deploy)"
+  fi
+  if $CLI auth status 2>/dev/null | grep -q '"pro": *true'; then
+    pass "'auth status' reports pro=true after activation"
+  else
+    fail "'auth status' does not report pro=true after activation"
+  fi
+  if [ -n "${SC_SMOKE_LARGE:-}" ]; then
+    if $CLI impact --help >/dev/null 2>&1 && $CLI modernize "$SC_SMOKE_LARGE" >/dev/null 2>&1; then
+      pass "Pro command 'modernize' runs on a large repo while activated"
+    else
+      fail "Pro command failed on a large repo while activated"
+    fi
+  else
+    skip "SC_SMOKE_LARGE not set — skipping Pro-on-large-repo check"
+  fi
+fi
+
+echo "== C. Revocation (cancel/expire the subscription server-side FIRST) =="
+if [ -z "${SC_SMOKE_KEY:-}" ] || [ -z "${SC_SMOKE_LARGE:-}" ]; then
+  skip "needs SC_SMOKE_KEY + SC_SMOKE_LARGE (and a revoked key) — skipping"
+else
+  echo "  (assumes the key is now cancelled/expired and the revalidation TTL has elapsed;"
+  echo "   set SOURCECODE_SUPABASE_URL to force a fresh check or wait out the 30-min TTL)"
+  out="$($CLI modernize "$SC_SMOKE_LARGE" 2>&1)"; code=$?
+  if [ "$code" = "2" ]; then
+    pass "revoked license → Pro command on large repo exits 2 (access removed)"
+  else
+    fail "revoked license did NOT gate (exit=$code) — revocation path is broken"
+  fi
+fi
+
+echo "Smoke test complete."

{sourcecode-1.73.0 → sourcecode-2.0.1}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.73.0"
+__version__ = "2.0.1"

{sourcecode-1.73.0 → sourcecode-2.0.1}/src/sourcecode/architecture_analyzer.py

@@ -960,75 +960,83 @@ class ArchitectureAnalyzer:
     # Java annotation / base-class secondary scanner (C4)
     # ------------------------------------------------------------------
 
-    _ANNOTATION_DECL_RE = re.compile(
-        r"@interface\s+([A-Z][A-Za-z0-9_]+)", re.MULTILINE
-    )
-    _ANNOTATION_USAGE_RE = re.compile(
-        r"@([A-Z][A-Za-z0-9_]+)(?:\s*\(([^)]*)\))?", re.MULTILINE
-    )
-    _EXTENDS_RE = re.compile(
-        r"class\s+\w+\s+extends\s+([A-Z][A-Za-z0-9_]+)", re.MULTILINE
-    )
-    _ANNOTATION_PARAM_RE = re.compile(r"(\w+)\s*=\s*[\"']?([^,\"')]+)[\"']?")
-    _MAX_JAVA_SCAN = 2000  # cap files to avoid runaway scanning
+    # Annotations never reported as "custom": Java/Spring/JPA/bean-validation
+    # built-ins. (Kept from the historical text scan; the counts now come from
+    # the ContextGraph's node-grounded `annotated_with` relations.)
+    _BUILTIN_ANNOTATIONS: frozenset = frozenset({
+        "Override", "SuppressWarnings", "Deprecated", "FunctionalInterface",
+        "SafeVarargs", "Retention", "Target", "Documented", "Inherited",
+        "RestController", "Service", "Repository", "Component", "Controller",
+        "Autowired", "Value", "Bean", "Configuration", "SpringBootApplication",
+        "EnableAutoConfiguration", "Transactional", "RequestMapping",
+        "GetMapping", "PostMapping", "PutMapping", "DeleteMapping",
+        "PathVariable", "RequestBody", "RequestParam", "ResponseBody",
+        "NotNull", "NotBlank", "Size", "Min", "Max", "Valid",
+    })
+    # @interface member return types the historical scan reported as parameters.
+    _ANNOTATION_PARAM_TYPES: frozenset = frozenset({"String", "int", "boolean", "Class"})
 
     def _scan_java_patterns(
         self,
         root: Path,
         java_paths: list[str],
     ) -> tuple[list[dict], list[dict]]:
-        """Scan Java source files for custom @interface annotations and common base classes.
+        """Derive custom @interface annotations and common base classes from the
+        ContextGraph (the single structural access layer — no source parsing).
+
+        Counts are node-grounded: an annotation usage is an `annotated_with`
+        relation on a real symbol, and a subclass is an `extends` relation —
+        occurrences inside string literals, comments, or dead text never count
+        (the historical text scan could).
 
         Returns (custom_annotations, base_classes) lists for ArchitectureAnalysis.
         """
-        from sourcecode.tree_utils import safe_read_text
+        from sourcecode.context_graph import ContextGraph
+
+        graph = ContextGraph.build(java_paths, root)
 
-        annotation_decls: dict[str, dict] = {}  # name → {params, files, usage_count}
-        annotation_usage: dict[str, int] = {}    # name → total usages across codebase
+        annotation_decls: dict[str, dict] = {}  # name → {params, usage_count, purpose}
+        annotation_usage: dict[str, int] = {}    # name → node-grounded usages
         extends_counts: dict[str, int] = {}      # base_class_name → subclass count
 
-        for path_str in java_paths[:self._MAX_JAVA_SCAN]:
-            abs_path = root / path_str
-            try:
-                content = safe_read_text(abs_path)
-            except OSError:
+        # Custom annotation declarations: @interface nodes + their members with
+        # the historically-reported parameter return types.
+        for ann in graph.annotation_types():
+            ann_name = ann.fqn.rsplit(".", 1)[-1]
+            if ann_name in annotation_decls:
                 continue
+            prefix = ann.fqn + "#"
+            # Member return type from the node signature "(params)->ReturnType".
+            params = [
+                m.fqn[len(prefix):]
+                for m in graph.symbols(kind="method")
+                if m.fqn.startswith(prefix)
+                and (m.signature or "").rsplit("->", 1)[-1] in self._ANNOTATION_PARAM_TYPES
+            ]
+            annotation_decls[ann_name] = {
+                "name": ann_name,
+                "parameters": params,
+                "usage_count": 0,
+                "purpose": "",
+            }
 
-            # Custom annotation declarations: `public @interface FooAnnotation`
-            for m in self._ANNOTATION_DECL_RE.finditer(content):
-                ann_name = m.group(1)
-                if ann_name not in annotation_decls:
-                    # Extract parameters from the annotation body (next ~500 chars)
-                    body_start = m.end()
-                    body = content[body_start:body_start + 500]
-                    params = re.findall(r"(?:String|int|boolean|Class)\s+(\w+)\s*\(\)", body)
-                    annotation_decls[ann_name] = {
-                        "name": ann_name,
-                        "parameters": params,
-                        "usage_count": 0,
-                        "purpose": "",
-                    }
-
-            # Annotation usage frequency
-            for m in self._ANNOTATION_USAGE_RE.finditer(content):
-                ann_name = m.group(1)
-                # Skip common Java built-ins
-                if ann_name in {
-                    "Override", "SuppressWarnings", "Deprecated", "FunctionalInterface",
-                    "SafeVarargs", "Retention", "Target", "Documented", "Inherited",
-                    "RestController", "Service", "Repository", "Component", "Controller",
-                    "Autowired", "Value", "Bean", "Configuration", "SpringBootApplication",
-                    "EnableAutoConfiguration", "Transactional", "RequestMapping",
-                    "GetMapping", "PostMapping", "PutMapping", "DeleteMapping",
-                    "PathVariable", "RequestBody", "RequestParam", "ResponseBody",
-                    "NotNull", "NotBlank", "Size", "Min", "Max", "Valid",
-                }:
-                    continue
-                annotation_usage[ann_name] = annotation_usage.get(ann_name, 0) + 1
-
-            # extends BaseClass — count subclasses per base
-            for m in self._EXTENDS_RE.finditer(content):
-                base = m.group(1)
+        # Annotation usage frequency — one count per annotated_with relation.
+        for rel in graph.relations(kind="annotated_with"):
+            ann_name = rel.target.lstrip("@").rsplit(".", 1)[-1]
+            if not ann_name or not ann_name[0].isupper():
+                continue
+            if ann_name in self._BUILTIN_ANNOTATIONS:
+                continue
+            annotation_usage[ann_name] = annotation_usage.get(ann_name, 0) + 1
+
+        # extends BaseClass — count subclasses per base (class extends only,
+        # matching the historical `class X extends Y` scan).
+        class_fqns = {s.fqn for s in graph.symbols(kind="class")}
+        for rel in graph.relations(kind="extends"):
+            if rel.source not in class_fqns:
+                continue  # interface-extends-interface is not a subclass count
+            base = re.sub(r"<.*", "", rel.target).rsplit(".", 1)[-1].strip()
+            if base and base[0].isupper():
                 extends_counts[base] = extends_counts.get(base, 0) + 1
 
         # Merge usage counts into annotation_decls