[pitboss] phase 12: Track L.10 — Flask / Django / FastAPI / Starlette adapters

src/dynamic/framework/adapters/mod.rs

@@ -29,8 +29,13 @@ pub mod php_unserialize;
 pub mod pp_json_deep_assign;
 pub mod pp_lodash_merge;
 pub mod pp_object_assign;
+pub mod python_django;
+pub mod python_fastapi;
+pub mod python_flask;
 pub mod python_jinja2;
 pub mod python_pickle;
+pub mod python_routes;
+pub mod python_starlette;
 pub mod redirect_go;
 pub mod redirect_java;
 pub mod redirect_js;
@@ -68,8 +73,12 @@ pub use php_unserialize::PhpUnserializeAdapter;
 pub use pp_json_deep_assign::{PpJsonDeepAssignJsAdapter, PpJsonDeepAssignTsAdapter};
 pub use pp_lodash_merge::{PpLodashMergeJsAdapter, PpLodashMergeTsAdapter};
 pub use pp_object_assign::{PpObjectAssignJsAdapter, PpObjectAssignTsAdapter};
+pub use python_django::PythonDjangoAdapter;
+pub use python_fastapi::PythonFastApiAdapter;
+pub use python_flask::PythonFlaskAdapter;
 pub use python_jinja2::PythonJinja2Adapter;
 pub use python_pickle::PythonPickleAdapter;
+pub use python_starlette::PythonStarletteAdapter;
 pub use redirect_go::RedirectGoAdapter;
 pub use redirect_java::RedirectJavaAdapter;
 pub use redirect_js::RedirectJsAdapter;

src/dynamic/framework/adapters/python_django.rs

@@ -0,0 +1,335 @@
+//! Python Django [`super::super::FrameworkAdapter`] (Phase 12 — Track L.10).
+//!
+//! Two recognition shapes:
+//!
+//!   - `urls.py` registrations: `path("…", view)`, `re_path(r"…", view)`,
+//!     `url(r"…", view)`.  Adapter matches the second argument's last
+//!     identifier segment (so `views.list_users`, `MyView.as_view()`,
+//!     and bare `list_users` all hit the same predicate) against
+//!     `summary.name`.
+//!   - Class-based views: a method named `get` / `post` / `put` /
+//!     `patch` / `delete` / `head` / `options` on a class extending
+//!     `View` / `APIView` / `ViewSet` / `TemplateView`.  The route
+//!     path is left as `"/"` when no matching `urls.py` entry can be
+//!     found in the same file — the runner is still able to drive
+//!     the view through `RequestFactory`, which does not require a
+//!     real URL conf.
+
+use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding, HttpMethod, RouteShape};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+use tree_sitter::Node;
+
+use super::python_routes::{
+    bind_path_params, find_python_function, function_formal_names, source_imports_django,
+};
+
+pub struct PythonDjangoAdapter;
+
+const ADAPTER_NAME: &str = "python-django";
+
+fn http_method_from_method_name(name: &str) -> Option<HttpMethod> {
+    HttpMethod::from_ident(name)
+}
+
+fn class_super_looks_like_view(text: &str) -> bool {
+    text.contains("View")
+        || text.contains("APIView")
+        || text.contains("ViewSet")
+        || text.contains("TemplateView")
+        || text.contains("ListView")
+        || text.contains("DetailView")
+        || text.contains("CreateView")
+        || text.contains("UpdateView")
+        || text.contains("DeleteView")
+}
+
+fn enclosing_class<'a>(node: Node<'a>) -> Option<Node<'a>> {
+    let mut cur = node.parent();
+    while let Some(p) = cur {
+        if p.kind() == "class_definition" {
+            return Some(p);
+        }
+        cur = p.parent();
+    }
+    None
+}
+
+/// Walk `urls.py`-style registrations (`path(...)`, `re_path(...)`,
+/// `url(...)`) and return `Some(path_template)` when one of them
+/// references `target` as the second positional argument.  When
+/// `class_target` is `Some`, an `as_view`-based registration whose
+/// receiver class matches is also accepted (so `path("users/<id>",
+/// UserView.as_view())` binds the class's method-as-view).
+fn url_template_for(
+    root: Node<'_>,
+    bytes: &[u8],
+    target: &str,
+    class_target: Option<&str>,
+) -> Option<String> {
+    let mut hit: Option<String> = None;
+    walk_url_registrations(root, bytes, target, class_target, &mut hit);
+    hit
+}
+
+fn walk_url_registrations(
+    node: Node<'_>,
+    bytes: &[u8],
+    target: &str,
+    class_target: Option<&str>,
+    out: &mut Option<String>,
+) {
+    if out.is_some() {
+        return;
+    }
+    if node.kind() == "call"
+        && let Some(callee) = node
+            .child_by_field_name("function")
+            .and_then(|n| n.utf8_text(bytes).ok())
+    {
+        let last = callee.rsplit_once('.').map(|(_, s)| s).unwrap_or(callee);
+        if matches!(last, "path" | "re_path" | "url") {
+            if let Some(args) = node.child_by_field_name("arguments") {
+                let positional = positional_args(args);
+                if positional.len() >= 2 {
+                    let view_arg = positional[1];
+                    if view_arg_references(view_arg, bytes, target, class_target) {
+                        if let Some(template) = first_string_arg(args, bytes) {
+                            *out = Some(template);
+                            return;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    let mut cur = node.walk();
+    for child in node.children(&mut cur) {
+        walk_url_registrations(child, bytes, target, class_target, out);
+    }
+}
+
+fn positional_args(args: Node<'_>) -> Vec<Node<'_>> {
+    let mut out = Vec::new();
+    let mut cur = args.walk();
+    for c in args.named_children(&mut cur) {
+        if c.kind() != "keyword_argument" {
+            out.push(c);
+        }
+    }
+    out
+}
+
+fn first_string_arg(args: Node<'_>, bytes: &[u8]) -> Option<String> {
+    let mut cur = args.walk();
+    for c in args.named_children(&mut cur) {
+        if c.kind() == "string" {
+            let raw = c.utf8_text(bytes).ok()?;
+            return Some(strip_quotes(raw).to_owned());
+        }
+    }
+    None
+}
+
+fn strip_quotes(raw: &str) -> &str {
+    let t = raw.trim();
+    let t = t.strip_prefix("b").unwrap_or(t);
+    let t = t.strip_prefix("r").unwrap_or(t);
+    let t = t.strip_prefix("u").unwrap_or(t);
+    t.trim_matches(['\'', '"'])
+}
+
+fn view_arg_references(
+    node: Node<'_>,
+    bytes: &[u8],
+    target: &str,
+    class_target: Option<&str>,
+) -> bool {
+    let Ok(text) = node.utf8_text(bytes) else {
+        return false;
+    };
+    let trimmed = text.trim();
+    // `MyView.as_view()` (with or without args) → strip trailing `()`
+    // and `.as_view` so the residual is the class name.
+    if let Some(class) = trimmed
+        .strip_suffix(')')
+        .and_then(|s| s.rfind('(').map(|i| &s[..i]))
+        .and_then(|s| s.strip_suffix(".as_view"))
+    {
+        if let Some(ct) = class_target
+            && class.rsplit_once('.').map(|(_, s)| s).unwrap_or(class) == ct
+        {
+            return true;
+        }
+    }
+    let stripped = trimmed.trim_end_matches("()");
+    let last = stripped.rsplit_once('.').map(|(_, s)| s).unwrap_or(stripped);
+    last == target || stripped == target
+}
+
+impl FrameworkAdapter for PythonDjangoAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Python
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        ast: Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        if !source_imports_django(file_bytes) {
+            return None;
+        }
+        let (func_node, _) = find_python_function(ast, file_bytes, &summary.name)?;
+
+        // Class-based view: method named after an HTTP verb inside a
+        // View-derived class.
+        let enclosing = enclosing_class(func_node);
+        let cbv_class_name = enclosing
+            .and_then(|c| c.child_by_field_name("name"))
+            .and_then(|n| n.utf8_text(file_bytes).ok())
+            .map(str::to_owned);
+        let cbv_method = http_method_from_method_name(&summary.name).filter(|_| {
+            enclosing
+                .and_then(|c| c.child_by_field_name("superclasses"))
+                .map(|supers| {
+                    let mut cur = supers.walk();
+                    supers.named_children(&mut cur).any(|sup| {
+                        sup.utf8_text(file_bytes)
+                            .map(class_super_looks_like_view)
+                            .unwrap_or(false)
+                    })
+                })
+                .unwrap_or(false)
+        });
+
+        // Pick (method, path) from one of:
+        //   - urls.py registration referencing the function
+        //   - urls.py `ClassName.as_view()` registration referencing the enclosing class
+        //   - class-based view method name (path falls back to `/`)
+        //   - function-based view with `def name(request, ...):` signature
+        let url_template = url_template_for(
+            ast,
+            file_bytes,
+            &summary.name,
+            cbv_class_name.as_deref(),
+        );
+
+        let (method, path) = if let Some(m) = cbv_method {
+            (m, url_template.unwrap_or_else(|| "/".to_owned()))
+        } else if url_template.is_some() {
+            (HttpMethod::GET, url_template.unwrap())
+        } else {
+            // Last-resort: treat any function whose first formal is
+            // `request` as a function-based view.  This catches the
+            // common Django pattern in files without an inlined
+            // urls.py snippet.
+            let formals = function_formal_names(func_node, file_bytes);
+            if formals.first().map(String::as_str) != Some("request") {
+                return None;
+            }
+            (HttpMethod::GET, "/".to_owned())
+        };
+
+        let formals = function_formal_names(func_node, file_bytes);
+        let request_params = bind_path_params(&formals, &path);
+
+        Some(FrameworkBinding {
+            adapter: ADAPTER_NAME.to_owned(),
+            kind: EntryKind::HttpRoute,
+            route: Some(RouteShape { method, path }),
+            request_params,
+            response_writer: None,
+            middleware: Vec::new(),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::dynamic::framework::ParamSource;
+
+    fn parse(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    fn summary(name: &str) -> FuncSummary {
+        FuncSummary {
+            name: name.into(),
+            lang: "python".into(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn fires_on_function_view_with_path_registration() {
+        let src: &[u8] = b"from django.http import HttpResponse\nfrom django.urls import path\ndef list_users(request):\n    return HttpResponse(\"ok\")\nurlpatterns = [path(\"users/\", list_users)]\n";
+        let tree = parse(src);
+        let binding = PythonDjangoAdapter
+            .detect(&summary("list_users"), tree.root_node(), src)
+            .unwrap();
+        assert_eq!(binding.route.as_ref().unwrap().path, "users/");
+        assert_eq!(binding.route.as_ref().unwrap().method, HttpMethod::GET);
+        let request_arg = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "request")
+            .unwrap();
+        assert!(matches!(request_arg.source, ParamSource::Implicit));
+    }
+
+    #[test]
+    fn fires_on_class_based_view_get_method() {
+        let src: &[u8] = b"from django.views import View\nfrom django.http import HttpResponse\nclass UserView(View):\n    def get(self, request, id):\n        return HttpResponse(id)\n";
+        let tree = parse(src);
+        let binding = PythonDjangoAdapter
+            .detect(&summary("get"), tree.root_node(), src)
+            .unwrap();
+        assert_eq!(binding.route.as_ref().unwrap().method, HttpMethod::GET);
+    }
+
+    #[test]
+    fn fires_on_as_view_registration() {
+        let src: &[u8] = b"from django.views import View\nfrom django.urls import path\nclass UserView(View):\n    def get(self, request, id):\n        return None\nurlpatterns = [path(\"users/<int:id>/\", UserView.as_view())]\n";
+        let tree = parse(src);
+        let binding = PythonDjangoAdapter
+            .detect(&summary("get"), tree.root_node(), src)
+            .unwrap();
+        let route = binding.route.unwrap();
+        assert_eq!(route.path, "users/<int:id>/");
+        let id_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "id")
+            .unwrap();
+        assert!(matches!(id_binding.source, ParamSource::PathSegment(_)));
+    }
+
+    #[test]
+    fn skips_when_django_not_imported() {
+        let src: &[u8] = b"def list_users(request):\n    return None\n";
+        let tree = parse(src);
+        assert!(PythonDjangoAdapter
+            .detect(&summary("list_users"), tree.root_node(), src)
+            .is_none());
+    }
+
+    #[test]
+    fn skips_plain_helper_function() {
+        let src: &[u8] = b"from django.http import HttpResponse\ndef helper(x):\n    return HttpResponse(x)\n";
+        let tree = parse(src);
+        assert!(PythonDjangoAdapter
+            .detect(&summary("helper"), tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/python_fastapi.rs

@@ -0,0 +1,344 @@
+//! Python FastAPI [`super::super::FrameworkAdapter`] (Phase 12 — Track L.10).
+//!
+//! Recognises `@app.get("/path")`, `@app.post(...)`, `@router.put(...)`,
+//! `@router.patch(...)`, `@router.delete(...)`, `@app.options(...)`,
+//! `@app.head(...)`, `@app.websocket(...)`, and the `Depends(...)` /
+//! Pydantic `BaseModel` formals that come with them.  Decorator
+//! detection walks the AST so the adapter sees the literal path
+//! template; the per-formal [`super::super::ParamBinding`] list
+//! classifies request-body-typed formals as
+//! [`super::super::ParamSource::JsonBody`] when the annotation refers
+//! to a class declared earlier in the same file (a strong Pydantic
+//! signal) and falls back to `QueryParam(name)` otherwise.
+
+use crate::dynamic::framework::{
+    FrameworkAdapter, FrameworkBinding, HttpMethod, ParamBinding, ParamSource, RouteShape,
+};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+use tree_sitter::Node;
+
+use super::python_routes::{
+    bind_path_params, find_python_function, function_formal_names, source_imports_fastapi,
+};
+
+pub struct PythonFastApiAdapter;
+
+const ADAPTER_NAME: &str = "python-fastapi";
+
+fn shortcut_method(attr: &str) -> Option<HttpMethod> {
+    match attr.to_ascii_lowercase().as_str() {
+        "get" => Some(HttpMethod::GET),
+        "head" => Some(HttpMethod::HEAD),
+        "post" => Some(HttpMethod::POST),
+        "put" => Some(HttpMethod::PUT),
+        "patch" => Some(HttpMethod::PATCH),
+        "delete" => Some(HttpMethod::DELETE),
+        "options" => Some(HttpMethod::OPTIONS),
+        "websocket" | "websocket_route" => Some(HttpMethod::GET),
+        _ => None,
+    }
+}
+
+fn receiver_looks_like_fastapi(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    matches!(
+        lower.as_str(),
+        "app" | "application" | "router" | "api_router"
+    ) || lower.ends_with("_router")
+        || lower.ends_with("_app")
+}
+
+fn decorator_route_shape(decorator: Node<'_>, bytes: &[u8]) -> Option<(HttpMethod, String)> {
+    let mut cur = decorator.walk();
+    let expr = decorator.children(&mut cur).find(|c| c.kind() != "@")?;
+    if expr.kind() != "call" {
+        return None;
+    }
+    let target = expr.child_by_field_name("function")?;
+    let args = expr.child_by_field_name("arguments")?;
+    if target.kind() != "attribute" {
+        return None;
+    }
+    let object = target.child_by_field_name("object")?.utf8_text(bytes).ok()?;
+    let attr = target.child_by_field_name("attribute")?.utf8_text(bytes).ok()?;
+    if !receiver_looks_like_fastapi(object) {
+        return None;
+    }
+    let method = shortcut_method(attr)?;
+    let path = first_string_arg(args, bytes)?;
+    Some((method, path))
+}
+
+fn first_string_arg(args: Node<'_>, bytes: &[u8]) -> Option<String> {
+    let mut cur = args.walk();
+    for c in args.named_children(&mut cur) {
+        if c.kind() == "string" {
+            let raw = c.utf8_text(bytes).ok()?;
+            return Some(strip_quotes(raw).to_owned());
+        }
+    }
+    None
+}
+
+fn strip_quotes(raw: &str) -> &str {
+    let t = raw.trim();
+    let t = t.strip_prefix("b").unwrap_or(t);
+    let t = t.strip_prefix("r").unwrap_or(t);
+    let t = t.strip_prefix("u").unwrap_or(t);
+    t.trim_matches(['\'', '"'])
+}
+
+/// Refine per-formal bindings by inspecting the parameter list for
+/// Pydantic body models and `Depends(...)` declarations.  An
+/// annotation pointing at a class declared in the same file is
+/// treated as a `JsonBody`; an `= Depends(...)` default is treated
+/// as `Implicit` (dependency-injected — not adversary-controlled
+/// directly).
+fn refine_for_fastapi(
+    func: Node<'_>,
+    bytes: &[u8],
+    file_classes: &[String],
+    base: Vec<ParamBinding>,
+) -> Vec<ParamBinding> {
+    let Some(params) = func.child_by_field_name("parameters") else {
+        return base;
+    };
+    let mut by_name: std::collections::HashMap<String, ParamRefinement> =
+        std::collections::HashMap::new();
+    let mut cur = params.walk();
+    for child in params.named_children(&mut cur) {
+        if let Some((name, refinement)) = classify_formal(child, bytes, file_classes) {
+            by_name.insert(name, refinement);
+        }
+    }
+    base.into_iter()
+        .map(|b| match by_name.get(&b.name) {
+            Some(ParamRefinement::JsonBody) => ParamBinding {
+                source: ParamSource::JsonBody,
+                ..b
+            },
+            Some(ParamRefinement::Implicit) => ParamBinding {
+                source: ParamSource::Implicit,
+                ..b
+            },
+            _ => b,
+        })
+        .collect()
+}
+
+enum ParamRefinement {
+    JsonBody,
+    Implicit,
+}
+
+fn classify_formal(
+    node: Node<'_>,
+    bytes: &[u8],
+    file_classes: &[String],
+) -> Option<(String, ParamRefinement)> {
+    match node.kind() {
+        "typed_default_parameter" | "default_parameter" => {
+            let value = node.child_by_field_name("value")?;
+            let name = first_identifier(node, bytes)?;
+            if call_callee_text(value, bytes)
+                .map(|t| t.contains("Depends"))
+                .unwrap_or(false)
+            {
+                return Some((name, ParamRefinement::Implicit));
+            }
+            if let Some(t) = node.child_by_field_name("type")
+                && let Some(ann) = t.utf8_text(bytes).ok()
+                && file_classes.iter().any(|c| ann.contains(c))
+            {
+                return Some((name, ParamRefinement::JsonBody));
+            }
+            None
+        }
+        "typed_parameter" => {
+            let name = first_identifier(node, bytes)?;
+            let t = node.child_by_field_name("type")?.utf8_text(bytes).ok()?;
+            if file_classes.iter().any(|c| t.contains(c)) {
+                return Some((name, ParamRefinement::JsonBody));
+            }
+            None
+        }
+        _ => None,
+    }
+}
+
+fn first_identifier(node: Node<'_>, bytes: &[u8]) -> Option<String> {
+    let mut cur = node.walk();
+    for c in node.named_children(&mut cur) {
+        if c.kind() == "identifier" {
+            return c.utf8_text(bytes).ok().map(str::to_owned);
+        }
+    }
+    None
+}
+
+fn call_callee_text(node: Node<'_>, bytes: &[u8]) -> Option<String> {
+    if node.kind() != "call" {
+        return None;
+    }
+    node.child_by_field_name("function")?
+        .utf8_text(bytes)
+        .ok()
+        .map(str::to_owned)
+}
+
+/// Enumerate top-level class names so [`refine_for_fastapi`] can spot
+/// Pydantic body models.  Conservative: walks the file once and
+/// records every `class_definition`'s name.
+fn collect_class_names(root: Node<'_>, bytes: &[u8]) -> Vec<String> {
+    let mut out = Vec::new();
+    walk_classes(root, bytes, &mut out);
+    out
+}
+
+fn walk_classes(node: Node<'_>, bytes: &[u8], out: &mut Vec<String>) {
+    if node.kind() == "class_definition"
+        && let Some(name) = node
+            .child_by_field_name("name")
+            .and_then(|n| n.utf8_text(bytes).ok())
+    {
+        out.push(name.to_owned());
+    }
+    let mut cur = node.walk();
+    for child in node.children(&mut cur) {
+        walk_classes(child, bytes, out);
+    }
+}
+
+impl FrameworkAdapter for PythonFastApiAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Python
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        ast: Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        if !source_imports_fastapi(file_bytes) {
+            return None;
+        }
+        let (func_node, decorated_node) = find_python_function(ast, file_bytes, &summary.name)?;
+        let decorated = decorated_node?;
+        let classes = collect_class_names(ast, file_bytes);
+        let mut cur = decorated.walk();
+        for d in decorated.children(&mut cur) {
+            if d.kind() != "decorator" {
+                continue;
+            }
+            if let Some((method, path)) = decorator_route_shape(d, file_bytes) {
+                let formals = function_formal_names(func_node, file_bytes);
+                let base = bind_path_params(&formals, &path);
+                let request_params = refine_for_fastapi(func_node, file_bytes, &classes, base);
+                return Some(FrameworkBinding {
+                    adapter: ADAPTER_NAME.to_owned(),
+                    kind: EntryKind::HttpRoute,
+                    route: Some(RouteShape { method, path }),
+                    request_params,
+                    response_writer: None,
+                    middleware: Vec::new(),
+                });
+            }
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    fn summary(name: &str) -> FuncSummary {
+        FuncSummary {
+            name: name.into(),
+            lang: "python".into(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn fires_on_app_get() {
+        let src: &[u8] = b"from fastapi import FastAPI\napp = FastAPI()\n@app.get(\"/items/{id}\")\ndef read_item(id):\n    return id\n";
+        let tree = parse(src);
+        let binding = PythonFastApiAdapter
+            .detect(&summary("read_item"), tree.root_node(), src)
+            .unwrap();
+        let route = binding.route.unwrap();
+        assert_eq!(route.method, HttpMethod::GET);
+        assert_eq!(route.path, "/items/{id}");
+        let id_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "id")
+            .unwrap();
+        assert!(matches!(id_binding.source, ParamSource::PathSegment(_)));
+    }
+
+    #[test]
+    fn fires_on_router_post() {
+        let src: &[u8] =
+            b"from fastapi import APIRouter\nrouter = APIRouter()\n@router.post(\"/items\")\ndef create_item(payload):\n    return payload\n";
+        let tree = parse(src);
+        let binding = PythonFastApiAdapter
+            .detect(&summary("create_item"), tree.root_node(), src)
+            .unwrap();
+        assert_eq!(binding.route.unwrap().method, HttpMethod::POST);
+    }
+
+    #[test]
+    fn pydantic_body_becomes_json_body() {
+        let src: &[u8] = b"from fastapi import FastAPI\nfrom pydantic import BaseModel\nclass Item(BaseModel):\n    name: str\napp = FastAPI()\n@app.post(\"/items\")\ndef create_item(item: Item):\n    return item\n";
+        let tree = parse(src);
+        let binding = PythonFastApiAdapter
+            .detect(&summary("create_item"), tree.root_node(), src)
+            .unwrap();
+        let item_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "item")
+            .unwrap();
+        assert!(matches!(item_binding.source, ParamSource::JsonBody));
+    }
+
+    #[test]
+    fn depends_default_becomes_implicit() {
+        let src: &[u8] = b"from fastapi import FastAPI, Depends\napp = FastAPI()\ndef get_db():\n    return None\n@app.get(\"/items\")\ndef list_items(db = Depends(get_db)):\n    return db\n";
+        let tree = parse(src);
+        let binding = PythonFastApiAdapter
+            .detect(&summary("list_items"), tree.root_node(), src)
+            .unwrap();
+        let db_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "db")
+            .unwrap();
+        assert!(matches!(db_binding.source, ParamSource::Implicit));
+    }
+
+    #[test]
+    fn skips_when_fastapi_not_imported() {
+        let src: &[u8] = b"from flask import Flask\napp = Flask(__name__)\n@app.get(\"/x\")\ndef x():\n    return 1\n";
+        let tree = parse(src);
+        assert!(PythonFastApiAdapter
+            .detect(&summary("x"), tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/python_flask.rs

@@ -0,0 +1,291 @@
+//! Python Flask [`super::super::FrameworkAdapter`] (Phase 12 — Track L.10).
+//!
+//! Recognises `@app.route("/path", methods=[…])` plus the verb-shortcut
+//! decorators `@app.get`, `@app.post`, `@app.put`, `@app.patch`,
+//! `@app.delete` on either an application object or a
+//! `flask.Blueprint` (typical aliases: `app`, `application`, `bp`,
+//! `blueprint`, `router`).  Decorator detection walks the AST so the
+//! adapter sees the literal path template + the `methods=` kwarg —
+//! both of which feed [`super::super::RouteShape`] and the per-formal
+//! [`super::super::ParamBinding`] list that downstream harness emitters
+//! use to construct a real HTTP request.
+
+use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding, HttpMethod, RouteShape};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+use tree_sitter::Node;
+
+use super::python_routes::{
+    bind_path_params, find_python_function, function_formal_names, source_imports_flask,
+};
+
+pub struct PythonFlaskAdapter;
+
+const ADAPTER_NAME: &str = "python-flask";
+
+/// Verb shortcuts (`@app.get` / `@app.post` / …).  Excludes
+/// `route` — that decorator carries the verb in a `methods=` kwarg
+/// instead of in the attribute name and is handled separately.
+fn shortcut_method(attr: &str) -> Option<HttpMethod> {
+    match attr.to_ascii_lowercase().as_str() {
+        "get" => Some(HttpMethod::GET),
+        "head" => Some(HttpMethod::HEAD),
+        "post" => Some(HttpMethod::POST),
+        "put" => Some(HttpMethod::PUT),
+        "patch" => Some(HttpMethod::PATCH),
+        "delete" => Some(HttpMethod::DELETE),
+        "options" => Some(HttpMethod::OPTIONS),
+        _ => None,
+    }
+}
+
+/// Receiver names accepted on the left side of `@<recv>.route(...)`.
+/// Flask convention covers `app`, `application`, plus blueprint
+/// aliases (`bp`, `blueprint`, `router`).  The check is permissive
+/// because Phase 12 only uses the adapter to surface a route shape
+/// for the harness — false positives are bounded by the
+/// caller-supplied `summary` (the function must actually exist).
+fn receiver_looks_like_flask(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    matches!(
+        lower.as_str(),
+        "app" | "application" | "bp" | "blueprint" | "router"
+    ) || lower.ends_with("_bp")
+        || lower.ends_with("_app")
+        || lower.ends_with("_blueprint")
+        || lower.ends_with("_router")
+}
+
+/// Parse a single decorator node into (method, path).  Returns `None`
+/// when the decorator is not a Flask route decorator on a recognised
+/// receiver.
+fn decorator_route_shape(decorator: Node<'_>, bytes: &[u8]) -> Option<(HttpMethod, String)> {
+    let mut cur = decorator.walk();
+    let expr = decorator.children(&mut cur).find(|c| c.kind() != "@")?;
+    let call = match expr.kind() {
+        "call" => expr,
+        _ => return None,
+    };
+    let target = call.child_by_field_name("function")?;
+    let args = call.child_by_field_name("arguments")?;
+    if target.kind() != "attribute" {
+        return None;
+    }
+    let object = target.child_by_field_name("object")?;
+    let attr = target.child_by_field_name("attribute")?;
+    let object_text = object.utf8_text(bytes).ok()?;
+    let attr_text = attr.utf8_text(bytes).ok()?;
+    if !receiver_looks_like_flask(object_text) {
+        return None;
+    }
+
+    let path = first_string_arg(args, bytes)?;
+
+    if attr_text.eq_ignore_ascii_case("route") {
+        let method = methods_kwarg(args, bytes).unwrap_or(HttpMethod::GET);
+        return Some((method, path));
+    }
+    let method = shortcut_method(attr_text)?;
+    Some((method, path))
+}
+
+fn first_string_arg(args: Node<'_>, bytes: &[u8]) -> Option<String> {
+    let mut cur = args.walk();
+    for c in args.named_children(&mut cur) {
+        if c.kind() == "string" {
+            return Some(strip_string_quotes(c.utf8_text(bytes).ok()?).to_owned());
+        }
+    }
+    None
+}
+
+fn strip_string_quotes(raw: &str) -> &str {
+    let t = raw.trim();
+    let t = t.strip_prefix("b").unwrap_or(t);
+    let t = t.strip_prefix("r").unwrap_or(t);
+    let t = t.strip_prefix("u").unwrap_or(t);
+    t.trim_matches(['\'', '"'])
+}
+
+fn methods_kwarg(args: Node<'_>, bytes: &[u8]) -> Option<HttpMethod> {
+    let mut cur = args.walk();
+    for arg in args.children(&mut cur) {
+        if arg.kind() != "keyword_argument" {
+            continue;
+        }
+        let name = arg.child_by_field_name("name")?.utf8_text(bytes).ok()?;
+        if name != "methods" {
+            continue;
+        }
+        let value = arg.child_by_field_name("value")?;
+        let mut vc = value.walk();
+        for child in value.named_children(&mut vc) {
+            if child.kind() == "string" {
+                let raw = strip_string_quotes(child.utf8_text(bytes).ok()?);
+                if let Some(m) = HttpMethod::from_ident(raw) {
+                    return Some(m);
+                }
+            }
+        }
+    }
+    None
+}
+
+impl FrameworkAdapter for PythonFlaskAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Python
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        ast: Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        if !source_imports_flask(file_bytes) {
+            return None;
+        }
+        let (func_node, decorated_node) = find_python_function(ast, file_bytes, &summary.name)?;
+        let decorated = decorated_node?;
+        let mut cur = decorated.walk();
+        for d in decorated.children(&mut cur) {
+            if d.kind() != "decorator" {
+                continue;
+            }
+            if let Some((method, path)) = decorator_route_shape(d, file_bytes) {
+                let formals = function_formal_names(func_node, file_bytes);
+                let request_params = bind_path_params(&formals, &path);
+                return Some(FrameworkBinding {
+                    adapter: ADAPTER_NAME.to_owned(),
+                    kind: EntryKind::HttpRoute,
+                    route: Some(RouteShape { method, path }),
+                    request_params,
+                    response_writer: None,
+                    middleware: Vec::new(),
+                });
+            }
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::dynamic::framework::ParamSource;
+
+    fn parse(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    fn summary(name: &str) -> FuncSummary {
+        FuncSummary {
+            name: name.into(),
+            lang: "python".into(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn fires_on_app_route_with_get_default() {
+        let src: &[u8] =
+            b"from flask import Flask\napp = Flask(__name__)\n@app.route(\"/users\")\ndef list_users():\n    return []\n";
+        let tree = parse(src);
+        let binding = PythonFlaskAdapter
+            .detect(&summary("list_users"), tree.root_node(), src)
+            .expect("binding");
+        assert_eq!(binding.adapter, "python-flask");
+        assert_eq!(binding.kind, EntryKind::HttpRoute);
+        let route = binding.route.expect("route shape");
+        assert_eq!(route.method, HttpMethod::GET);
+        assert_eq!(route.path, "/users");
+    }
+
+    #[test]
+    fn fires_on_app_route_with_methods_kwarg() {
+        let src: &[u8] =
+            b"from flask import Flask\napp = Flask(__name__)\n@app.route(\"/x\", methods=[\"POST\"])\ndef save(payload):\n    return payload\n";
+        let tree = parse(src);
+        let binding = PythonFlaskAdapter
+            .detect(&summary("save"), tree.root_node(), src)
+            .expect("binding");
+        let route = binding.route.unwrap();
+        assert_eq!(route.method, HttpMethod::POST);
+        assert_eq!(route.path, "/x");
+    }
+
+    #[test]
+    fn fires_on_verb_shortcut_post() {
+        let src: &[u8] =
+            b"from flask import Flask\napp = Flask(__name__)\n@app.post(\"/items\")\ndef create_item(payload):\n    return payload\n";
+        let tree = parse(src);
+        let binding = PythonFlaskAdapter
+            .detect(&summary("create_item"), tree.root_node(), src)
+            .expect("binding");
+        assert_eq!(binding.route.unwrap().method, HttpMethod::POST);
+    }
+
+    #[test]
+    fn fires_on_blueprint_route() {
+        let src: &[u8] =
+            b"from flask import Blueprint\nuser_bp = Blueprint('user_bp', __name__)\n@user_bp.route(\"/users/<id>\")\ndef get_user(id):\n    return id\n";
+        let tree = parse(src);
+        let binding = PythonFlaskAdapter
+            .detect(&summary("get_user"), tree.root_node(), src)
+            .expect("binding");
+        let route = binding.route.unwrap();
+        assert_eq!(route.path, "/users/<id>");
+        assert!(binding
+            .request_params
+            .iter()
+            .any(|p| p.name == "id" && matches!(p.source, ParamSource::PathSegment(_))));
+    }
+
+    #[test]
+    fn binds_path_segment_and_implicit_formal() {
+        let src: &[u8] =
+            b"from flask import Flask\napp = Flask(__name__)\n@app.route(\"/users/<int:id>\")\ndef show(id, extra=\"x\"):\n    return id\n";
+        let tree = parse(src);
+        let binding = PythonFlaskAdapter
+            .detect(&summary("show"), tree.root_node(), src)
+            .expect("binding");
+        let id_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "id")
+            .unwrap();
+        assert!(matches!(id_binding.source, ParamSource::PathSegment(_)));
+        let extra_binding = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "extra")
+            .unwrap();
+        assert!(matches!(extra_binding.source, ParamSource::QueryParam(_)));
+    }
+
+    #[test]
+    fn skips_when_flask_not_imported() {
+        let src: &[u8] = b"def add(a, b):\n    return a + b\n";
+        let tree = parse(src);
+        assert!(PythonFlaskAdapter
+            .detect(&summary("add"), tree.root_node(), src)
+            .is_none());
+    }
+
+    #[test]
+    fn skips_when_function_has_no_decorator() {
+        let src: &[u8] = b"from flask import Flask\napp = Flask(__name__)\ndef helper(x):\n    return x\n";
+        let tree = parse(src);
+        assert!(PythonFlaskAdapter
+            .detect(&summary("helper"), tree.root_node(), src)
+            .is_none());
+    }
+}

src/dynamic/framework/adapters/python_routes.rs

@@ -0,0 +1,327 @@
+//! Shared Python-route adapter helpers (Phase 12 — Track L.10).
+//!
+//! The Flask / Django / FastAPI / Starlette adapters all need the same
+//! handful of tree-sitter helpers: locate a `function_definition` by
+//! name, peek at its parent `decorated_definition` for decorator data,
+//! enumerate formal parameter names, and bind a path template's
+//! placeholders to those formals.  Centralising the helpers here keeps
+//! the four adapters terse and lets every framework share the same
+//! placeholder-binding semantics (so an unmatched formal becomes a
+//! `QueryParam(name)` everywhere, not just in one adapter).
+
+use crate::dynamic::framework::{ParamBinding, ParamSource};
+use tree_sitter::Node;
+
+/// True when `bytes` carries any of the well-known Flask import
+/// stanzas.  Used by [`super::python_flask::PythonFlaskAdapter`] to
+/// short-circuit non-Flask Python files before the AST walk.
+pub fn source_imports_flask(bytes: &[u8]) -> bool {
+    contains_any(
+        bytes,
+        &[
+            b"from flask",
+            b"import flask",
+            b"Flask(",
+            b"Blueprint(",
+            b"flask.Blueprint",
+        ],
+    )
+}
+
+/// True when `bytes` carries any of the well-known FastAPI import
+/// stanzas.
+pub fn source_imports_fastapi(bytes: &[u8]) -> bool {
+    contains_any(
+        bytes,
+        &[b"from fastapi", b"import fastapi", b"FastAPI(", b"APIRouter("],
+    )
+}
+
+/// True when `bytes` carries any of the well-known Django import
+/// stanzas — including the `urls.py` `path(` / `re_path(` / `url(`
+/// registration helpers that the Django adapter consults.
+pub fn source_imports_django(bytes: &[u8]) -> bool {
+    contains_any(
+        bytes,
+        &[
+            b"from django",
+            b"import django",
+            b"django.http",
+            b"django.urls",
+            b"django.views",
+            b"django.shortcuts",
+            b"urlpatterns",
+        ],
+    )
+}
+
+/// True when `bytes` carries any of the well-known Starlette import
+/// stanzas.  Excludes the FastAPI-only imports so the Starlette
+/// adapter does not collide with FastAPI files that re-export
+/// Starlette types.
+pub fn source_imports_starlette(bytes: &[u8]) -> bool {
+    contains_any(
+        bytes,
+        &[
+            b"from starlette",
+            b"import starlette",
+            b"Starlette(",
+            b"starlette.routing",
+            b"starlette.applications",
+        ],
+    )
+}
+
+fn contains_any(haystack: &[u8], needles: &[&[u8]]) -> bool {
+    needles
+        .iter()
+        .any(|n| haystack.windows(n.len()).any(|w| w == *n))
+}
+
+/// Find the `function_definition` node whose `name` field equals
+/// `target`.  Returns `(func_node, Option<decorated_definition>)` —
+/// the decorated parent is `Some` when the function carries one or
+/// more decorators.
+pub fn find_python_function<'a>(
+    root: Node<'a>,
+    bytes: &[u8],
+    target: &str,
+) -> Option<(Node<'a>, Option<Node<'a>>)> {
+    walk(root, bytes, target)
+}
+
+fn walk<'a>(node: Node<'a>, bytes: &[u8], target: &str) -> Option<(Node<'a>, Option<Node<'a>>)> {
+    if node.kind() == "function_definition" {
+        if let Some(name) = node
+            .child_by_field_name("name")
+            .and_then(|n| n.utf8_text(bytes).ok())
+        {
+            if name == target {
+                let decorated = node.parent().filter(|p| p.kind() == "decorated_definition");
+                return Some((node, decorated));
+            }
+        }
+    }
+    let mut cur = node.walk();
+    for child in node.children(&mut cur) {
+        if let Some(found) = walk(child, bytes, target) {
+            return Some(found);
+        }
+    }
+    None
+}
+
+/// Enumerate formal parameter names from a `function_definition` node.
+/// Skips `self`/`cls` so class-based handler methods bind only the
+/// adversary-controlled formals.
+pub fn function_formal_names(func: Node<'_>, bytes: &[u8]) -> Vec<String> {
+    let mut out = Vec::new();
+    let Some(parameters) = func.child_by_field_name("parameters") else {
+        return out;
+    };
+    let mut cur = parameters.walk();
+    for child in parameters.named_children(&mut cur) {
+        if let Some(name) = parameter_name(child, bytes) {
+            if name == "self" || name == "cls" {
+                continue;
+            }
+            out.push(name);
+        }
+    }
+    out
+}
+
+fn parameter_name(node: Node<'_>, bytes: &[u8]) -> Option<String> {
+    match node.kind() {
+        "identifier" => node.utf8_text(bytes).ok().map(str::to_owned),
+        "default_parameter"
+        | "typed_parameter"
+        | "typed_default_parameter"
+        | "list_splat_pattern"
+        | "dictionary_splat_pattern" => {
+            // Each of these wraps either a plain identifier or another
+            // structure whose first identifier is the parameter name.
+            let mut cur = node.walk();
+            for c in node.named_children(&mut cur) {
+                if c.kind() == "identifier" {
+                    return c.utf8_text(bytes).ok().map(str::to_owned);
+                }
+                if let Some(n) = parameter_name(c, bytes) {
+                    return Some(n);
+                }
+            }
+            None
+        }
+        _ => None,
+    }
+}
+
+/// Bind formals to request slots given a route path template.
+///
+/// Accepts both Flask-style placeholders (`<id>`, `<int:id>`) and
+/// FastAPI/Starlette/Django-style placeholders (`{id}`, `<int:id>`).
+/// A formal whose name matches a placeholder becomes a
+/// [`ParamSource::PathSegment`]; an unmatched formal becomes a
+/// [`ParamSource::QueryParam`] of the same name so downstream
+/// harness emitters have a deterministic slot to populate.
+pub fn bind_path_params(formals: &[String], path: &str) -> Vec<ParamBinding> {
+    let placeholders = extract_path_placeholders(path);
+    formals
+        .iter()
+        .enumerate()
+        .map(|(idx, name)| {
+            let source = if name == "request" || name == "req" {
+                ParamSource::Implicit
+            } else if placeholders.iter().any(|p| p == name) {
+                ParamSource::PathSegment(name.clone())
+            } else {
+                ParamSource::QueryParam(name.clone())
+            };
+            ParamBinding {
+                index: idx,
+                name: name.clone(),
+                source,
+            }
+        })
+        .collect()
+}
+
+/// Extract placeholder names from a route path template.
+///
+/// Supports three placeholder syntaxes:
+///   - Flask: `/users/<id>`, `/users/<int:id>` → `id`
+///   - FastAPI / Starlette: `/users/{id}` → `id`
+///   - Django: `<int:id>`, `<id>` (same as Flask) plus regex
+///     `(?P<id>...)` capture groups.
+///
+/// Names are deduplicated while preserving first-occurrence order
+/// so a single placeholder reused across the path (or matched by
+/// two scanners on the same span — e.g. `(?P<id>...)`) does not
+/// double-bind a formal.
+pub fn extract_path_placeholders(path: &str) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    let mut push = |name: String| {
+        if !name.is_empty() && !out.iter().any(|n| n == &name) {
+            out.push(name);
+        }
+    };
+    let bytes = path.as_bytes();
+    let mut i = 0;
+    while i < bytes.len() {
+        match bytes[i] {
+            b'<' => {
+                // Skip the `<` that opens a Django named capture
+                // group `(?P<id>...)` — the `(?P<id>` scan below
+                // handles it.  The two preceding bytes encode the
+                // `?P` marker.
+                let in_named_group = i >= 2 && &bytes[i - 2..i] == b"?P";
+                if let Some(end) = bytes[i + 1..].iter().position(|&b| b == b'>') {
+                    if !in_named_group {
+                        let inner = &path[i + 1..i + 1 + end];
+                        let name = inner.rsplit_once(':').map(|(_, n)| n).unwrap_or(inner);
+                        push(name.to_owned());
+                    }
+                    i += end + 2;
+                    continue;
+                }
+            }
+            b'{' => {
+                if let Some(end) = bytes[i + 1..].iter().position(|&b| b == b'}') {
+                    let inner = &path[i + 1..i + 1 + end];
+                    let name = inner.split(':').next().unwrap_or(inner);
+                    push(name.to_owned());
+                    i += end + 2;
+                    continue;
+                }
+            }
+            _ => {}
+        }
+        i += 1;
+    }
+    let mut rest = path;
+    while let Some(pos) = rest.find("(?P<") {
+        let after = &rest[pos + 4..];
+        if let Some(end) = after.find('>') {
+            push(after[..end].to_owned());
+            rest = &after[end + 1..];
+        } else {
+            break;
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    #[test]
+    fn finds_decorated_function() {
+        let src: &[u8] = b"@dec\ndef target(a, b):\n    return a + b\n";
+        let tree = parse(src);
+        let (_func, decorated) = find_python_function(tree.root_node(), src, "target").unwrap();
+        assert!(decorated.is_some());
+    }
+
+    #[test]
+    fn finds_function_without_decorator() {
+        let src: &[u8] = b"def target(a):\n    return a\n";
+        let tree = parse(src);
+        let (_func, decorated) = find_python_function(tree.root_node(), src, "target").unwrap();
+        assert!(decorated.is_none());
+    }
+
+    #[test]
+    fn skips_self_and_cls() {
+        let src: &[u8] = b"class X:\n    def m(self, a, b):\n        return a + b\n";
+        let tree = parse(src);
+        let (func, _) = find_python_function(tree.root_node(), src, "m").unwrap();
+        let names = function_formal_names(func, src);
+        assert_eq!(names, vec!["a", "b"]);
+    }
+
+    #[test]
+    fn extracts_flask_placeholders() {
+        let p = extract_path_placeholders("/users/<id>");
+        assert_eq!(p, vec!["id"]);
+        let p = extract_path_placeholders("/items/<int:id>/<slug>");
+        assert_eq!(p, vec!["id", "slug"]);
+    }
+
+    #[test]
+    fn extracts_fastapi_placeholders() {
+        let p = extract_path_placeholders("/users/{id}");
+        assert_eq!(p, vec!["id"]);
+        let p = extract_path_placeholders("/items/{id:int}");
+        assert_eq!(p, vec!["id"]);
+    }
+
+    #[test]
+    fn extracts_django_regex_placeholders() {
+        let p = extract_path_placeholders(r"^/users/(?P<id>\d+)/?$");
+        assert_eq!(p, vec!["id"]);
+    }
+
+    #[test]
+    fn binds_known_placeholder_as_path_segment() {
+        let formals = vec!["id".to_string(), "extra".to_string()];
+        let bindings = bind_path_params(&formals, "/users/{id}");
+        assert!(matches!(bindings[0].source, ParamSource::PathSegment(_)));
+        assert!(matches!(bindings[1].source, ParamSource::QueryParam(_)));
+    }
+
+    #[test]
+    fn binds_request_as_implicit() {
+        let formals = vec!["request".to_string(), "id".to_string()];
+        let bindings = bind_path_params(&formals, "/users/{id}");
+        assert!(matches!(bindings[0].source, ParamSource::Implicit));
+        assert!(matches!(bindings[1].source, ParamSource::PathSegment(_)));
+    }
+}

src/dynamic/framework/adapters/python_starlette.rs

@@ -0,0 +1,265 @@
+//! Python Starlette [`super::super::FrameworkAdapter`] (Phase 12 — Track L.10).
+//!
+//! Recognises `Route("/path", endpoint=handler)` and
+//! `Route("/path", handler)` registrations inside a Starlette
+//! application file (`from starlette.routing import Route` /
+//! `from starlette.applications import Starlette`).  Detection walks
+//! every `call` node in the AST so the order of declaration relative
+//! to the handler does not matter.  Methods are picked up from the
+//! `methods=[...]` kwarg when present and default to `GET`.
+
+use crate::dynamic::framework::{
+    FrameworkAdapter, FrameworkBinding, HttpMethod, RouteShape,
+};
+use crate::evidence::EntryKind;
+use crate::summary::FuncSummary;
+use crate::symbol::Lang;
+use tree_sitter::Node;
+
+use super::python_routes::{
+    bind_path_params, find_python_function, function_formal_names, source_imports_starlette,
+};
+
+pub struct PythonStarletteAdapter;
+
+const ADAPTER_NAME: &str = "python-starlette";
+
+/// Find a `Route("/path", endpoint=target)` or
+/// `Route("/path", target)` call and return its `(method, path)`.
+/// Returns `None` when no matching call is present.
+fn route_registration_for(
+    root: Node<'_>,
+    bytes: &[u8],
+    target: &str,
+) -> Option<(HttpMethod, String)> {
+    let mut hit: Option<(HttpMethod, String)> = None;
+    walk_routes(root, bytes, target, &mut hit);
+    hit
+}
+
+fn walk_routes(node: Node<'_>, bytes: &[u8], target: &str, out: &mut Option<(HttpMethod, String)>) {
+    if out.is_some() {
+        return;
+    }
+    if node.kind() == "call"
+        && let Some(callee) = node
+            .child_by_field_name("function")
+            .and_then(|n| n.utf8_text(bytes).ok())
+    {
+        let last = callee.rsplit_once('.').map(|(_, s)| s).unwrap_or(callee);
+        if matches!(last, "Route" | "WebSocketRoute") {
+            if let Some(args) = node.child_by_field_name("arguments") {
+                if let Some(path) = first_string_arg(args, bytes) {
+                    if endpoint_references(args, bytes, target) {
+                        let method = methods_kwarg(args, bytes).unwrap_or(HttpMethod::GET);
+                        *out = Some((method, path));
+                        return;
+                    }
+                }
+            }
+        }
+    }
+    let mut cur = node.walk();
+    for child in node.children(&mut cur) {
+        walk_routes(child, bytes, target, out);
+    }
+}
+
+fn first_string_arg(args: Node<'_>, bytes: &[u8]) -> Option<String> {
+    let mut cur = args.walk();
+    for c in args.named_children(&mut cur) {
+        if c.kind() == "string" {
+            let raw = c.utf8_text(bytes).ok()?;
+            return Some(strip_quotes(raw).to_owned());
+        }
+    }
+    None
+}
+
+fn strip_quotes(raw: &str) -> &str {
+    let t = raw.trim();
+    let t = t.strip_prefix("b").unwrap_or(t);
+    let t = t.strip_prefix("r").unwrap_or(t);
+    let t = t.strip_prefix("u").unwrap_or(t);
+    t.trim_matches(['\'', '"'])
+}
+
+fn endpoint_references(args: Node<'_>, bytes: &[u8], target: &str) -> bool {
+    let mut cur = args.walk();
+    let mut seen_positional = 0usize;
+    for arg in args.named_children(&mut cur) {
+        if arg.kind() == "keyword_argument" {
+            let Some(name) = arg.child_by_field_name("name") else {
+                continue;
+            };
+            let Ok(name_text) = name.utf8_text(bytes) else {
+                continue;
+            };
+            if name_text == "endpoint" {
+                if let Some(value) = arg.child_by_field_name("value") {
+                    if identifier_matches(value, bytes, target) {
+                        return true;
+                    }
+                }
+            }
+        } else {
+            seen_positional += 1;
+            // Second positional argument is the endpoint when no
+            // keyword form is used.
+            if seen_positional == 2 && identifier_matches(arg, bytes, target) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn identifier_matches(node: Node<'_>, bytes: &[u8], target: &str) -> bool {
+    let Ok(text) = node.utf8_text(bytes) else {
+        return false;
+    };
+    let trimmed = text.trim().trim_end_matches("()");
+    let last = trimmed.rsplit_once('.').map(|(_, s)| s).unwrap_or(trimmed);
+    last == target || trimmed == target
+}
+
+fn methods_kwarg(args: Node<'_>, bytes: &[u8]) -> Option<HttpMethod> {
+    let mut cur = args.walk();
+    for arg in args.children(&mut cur) {
+        if arg.kind() != "keyword_argument" {
+            continue;
+        }
+        let Some(name) = arg
+            .child_by_field_name("name")
+            .and_then(|n| n.utf8_text(bytes).ok())
+        else {
+            continue;
+        };
+        if name != "methods" {
+            continue;
+        }
+        let Some(value) = arg.child_by_field_name("value") else {
+            continue;
+        };
+        let mut vc = value.walk();
+        for child in value.named_children(&mut vc) {
+            if child.kind() == "string"
+                && let Some(raw) = child.utf8_text(bytes).ok()
+                && let Some(m) = HttpMethod::from_ident(strip_quotes(raw))
+            {
+                return Some(m);
+            }
+        }
+    }
+    None
+}
+
+impl FrameworkAdapter for PythonStarletteAdapter {
+    fn name(&self) -> &'static str {
+        ADAPTER_NAME
+    }
+
+    fn lang(&self) -> Lang {
+        Lang::Python
+    }
+
+    fn detect(
+        &self,
+        summary: &FuncSummary,
+        ast: Node<'_>,
+        file_bytes: &[u8],
+    ) -> Option<FrameworkBinding> {
+        if !source_imports_starlette(file_bytes) {
+            return None;
+        }
+        let (func_node, _) = find_python_function(ast, file_bytes, &summary.name)?;
+        let (method, path) = route_registration_for(ast, file_bytes, &summary.name)?;
+        let formals = function_formal_names(func_node, file_bytes);
+        let request_params = bind_path_params(&formals, &path);
+        Some(FrameworkBinding {
+            adapter: ADAPTER_NAME.to_owned(),
+            kind: EntryKind::HttpRoute,
+            route: Some(RouteShape { method, path }),
+            request_params,
+            response_writer: None,
+            middleware: Vec::new(),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::dynamic::framework::ParamSource;
+
+    fn parse(src: &[u8]) -> tree_sitter::Tree {
+        let mut parser = tree_sitter::Parser::new();
+        let lang = tree_sitter::Language::from(tree_sitter_python::LANGUAGE);
+        parser.set_language(&lang).unwrap();
+        parser.parse(src, None).unwrap()
+    }
+
+    fn summary(name: &str) -> FuncSummary {
+        FuncSummary {
+            name: name.into(),
+            lang: "python".into(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn fires_on_route_with_keyword_endpoint() {
+        let src: &[u8] = b"from starlette.applications import Starlette\nfrom starlette.routing import Route\nasync def homepage(request):\n    return None\napp = Starlette(routes=[Route(\"/\", endpoint=homepage)])\n";
+        let tree = parse(src);
+        let binding = PythonStarletteAdapter
+            .detect(&summary("homepage"), tree.root_node(), src)
+            .unwrap();
+        let route = binding.route.unwrap();
+        assert_eq!(route.path, "/");
+        assert_eq!(route.method, HttpMethod::GET);
+    }
+
+    #[test]
+    fn fires_on_route_with_positional_endpoint() {
+        let src: &[u8] = b"from starlette.routing import Route\nasync def homepage(request):\n    return None\nroutes = [Route(\"/items/{id}\", homepage)]\n";
+        let tree = parse(src);
+        let binding = PythonStarletteAdapter
+            .detect(&summary("homepage"), tree.root_node(), src)
+            .unwrap();
+        assert_eq!(binding.route.unwrap().path, "/items/{id}");
+    }
+
+    #[test]
+    fn picks_up_post_methods_kwarg() {
+        let src: &[u8] = b"from starlette.routing import Route\nasync def create(request):\n    return None\nroutes = [Route(\"/items\", endpoint=create, methods=[\"POST\"])]\n";
+        let tree = parse(src);
+        let binding = PythonStarletteAdapter
+            .detect(&summary("create"), tree.root_node(), src)
+            .unwrap();
+        assert_eq!(binding.route.unwrap().method, HttpMethod::POST);
+    }
+
+    #[test]
+    fn binds_request_as_implicit() {
+        let src: &[u8] = b"from starlette.routing import Route\nasync def homepage(request):\n    return None\nroutes = [Route(\"/\", endpoint=homepage)]\n";
+        let tree = parse(src);
+        let binding = PythonStarletteAdapter
+            .detect(&summary("homepage"), tree.root_node(), src)
+            .unwrap();
+        let req = binding
+            .request_params
+            .iter()
+            .find(|p| p.name == "request")
+            .unwrap();
+        assert!(matches!(req.source, ParamSource::Implicit));
+    }
+
+    #[test]
+    fn skips_when_starlette_not_imported() {
+        let src: &[u8] = b"def homepage(request):\n    return None\n";
+        let tree = parse(src);
+        assert!(PythonStarletteAdapter
+            .detect(&summary("homepage"), tree.root_node(), src)
+            .is_none());
+    }
+}