codeanalyzer-python 1.1.1__py3-none-any.whl → 1.3.0__py3-none-any.whl

codeanalyzer/core.py

@@ -29,7 +29,7 @@ from codeanalyzer.semantic_analysis.call_graph import (
     merge_edges,
     resolve_unresolved_constructors,
 )
-from codeanalyzer.semantic_analysis.pycg import PyCG, PyCGExceptions
+from codeanalyzer.semantic_analysis.defuse_linker import defuse_linker_edges
 from codeanalyzer.syntactic_analysis.exceptions import SymbolTableBuilderRayError
 from codeanalyzer.syntactic_analysis.import_resolver import resolve_imports
 from codeanalyzer.syntactic_analysis.symbol_table_builder import SymbolTableBuilder
@@ -37,11 +37,26 @@ from codeanalyzer.utils import ProgressBar
 from codeanalyzer.options import AnalysisOptions
 from codeanalyzer.provenance import analyzer_info, repository_info
 
+def _artifact_full_text(project_dir: Path, path: str, art) -> str:
+    """Mirrors ``artifacts.dependencies._full_text`` verbatim (not imported
+    -- that name is module-private to ``dependencies.py``): config-key
+    extraction (#152) must never depend on the stored ``source`` -- capped
+    by ``text_max_bytes`` and emptied by ``capture_text=False`` (payload-size
+    controls, not extraction controls). Read the real file fresh instead;
+    fall back to ``art.source`` only if it's gone (e.g. a synthetic artifact
+    in a unit test, or the file vanished mid-run). Keep the two in sync if
+    this logic changes."""
+    try:
+        return (project_dir / path).read_bytes().decode("utf-8")
+    except (OSError, UnicodeDecodeError):
+        return art.source
+
+
 def _ensure_ray() -> None:
     """Initialize Ray with the driver's pinned hash seed in the workers.
 
     An implicit auto-init would not carry PYTHONHASHSEED into worker
-    interpreters, so PyCG shards (and Jedi inference) run there with random
+    interpreters, so Jedi inference in Ray workers would run with random
     set-iteration order and the emitted edges vary run to run (issue #99)."""
     if not ray.is_initialized():
         ray.init(
@@ -592,14 +607,20 @@ class Codeanalyzer:
         logger.info("✅ Jedi: %d edges in %.1fs", len(call_graph), time.perf_counter() - t0_jedi)
 
         if self.analysis_level >= 2:
-            # Level 2: also add PyCG edges. The Jedi edges double as the
-            # coupling graph that drives coupling-aware PyCG sharding.
-            pycg_edges = self._get_pycg_call_graph(symbol_table, jedi_edges)
-            call_graph = merge_edges(call_graph, pycg_edges)
+            # Level 2: the defuse linker backfills call sites Jedi could not
+            # resolve, from local def-use chains and module-scope bindings
+            # (docs/design/specs/2026-08-25-defuse-linker-call-graph-design.md).
+            t0_linker = time.perf_counter()
+            defuse_edges, defuse_resolutions = defuse_linker_edges(symbol_table)
+            call_graph = merge_edges(call_graph, defuse_edges)
+            logger.info(
+                "✅ defuse linker: %d edges in %.1fs",
+                len(defuse_edges), time.perf_counter() - t0_linker,
+            )
 
         call_graph = filter_external_edges(call_graph, symbol_table)
-        # Canonical edge order: backend iteration order (PyCG dicts, Counter
-        # insertion) is not a contract — sort so identical edge SETS always
+        # Canonical edge order: backend iteration order (Counter insertion,
+        # dict iteration) is not a contract — sort so identical edge SETS always
         # serialize identically (issue #99 determinism gate), and so the
         # external-symbol homing below assigns ids in a stable order.
         call_graph.sort(key=lambda e: (e.src, e.dst))
@@ -633,9 +654,68 @@ class Codeanalyzer:
         app.external_symbols = self._home_external_symbols(app, app.id, sig_to_id)
         populate_l1_body(app)
         if self.analysis_level >= 2:
-            backfill_callees(app, sig_to_id)
+            backfill_callees(app, sig_to_id, resolutions=defuse_resolutions)
         reidentify_call_graph(app, sig_to_id)
 
+        # Entrypoints: a post-pass over the built L1 tree (#27). Runs at every
+        # level -- entrypoints are L1 data and must not vary with -a.
+        from codeanalyzer.entrypoints import detect_entrypoints
+
+        detect_entrypoints(app, self.project_dir, self.options.entrypoint_rules)
+
+        # Artifacts + dependencies: L1 data, every level, never varies with -a
+        # (spec 2026-08-27). Deterministic by default; venv probing is opt-in.
+        from codeanalyzer.artifacts import (
+            build_dependency_view, discover_artifacts, extract_config_keys,
+            is_config_eligible,
+        )
+
+        app.artifacts = discover_artifacts(
+            self.project_dir, app_name,
+            capture_text=self.options.artifact_text,
+            text_max_bytes=self.options.artifact_text_max_bytes,
+        )
+        app.dependencies, app.unresolved_imports = build_dependency_view(
+            app.artifacts,
+            app.symbol_table,
+            self.project_dir,
+            self.virtualenv if self.options.resolve_installed else None,
+            self.options.resolve_installed,
+        )
+
+        # Config keys (#152): L1 data, layered onto the same artifacts, every
+        # level. Namespace-eligible artifacts only (env-family by basename,
+        # else by format). `extraction` combines with any prior
+        # dependency-manifest pass on the same artifact: a parse failure here
+        # always downgrades to "partial" (never drops the artifact); a clean
+        # parse upgrades an untouched "none" to "full", but never overwrites
+        # an existing "partial" (e.g. from a failed dependency-manifest parse
+        # on the same artifact) -- a successful pass here must not silently
+        # erase an unrelated failure already recorded on the artifact.
+        for path in sorted(app.artifacts):
+            art = app.artifacts[path]
+            if not is_config_eligible(art):
+                continue
+            full_text = _artifact_full_text(self.project_dir, path, art)
+            keys, ok = extract_config_keys(art, full_text, self.options.artifact_text)
+            art.config_keys = keys
+            if not ok:
+                art.extraction = "partial"
+            elif art.extraction == "none":
+                art.extraction = "full"
+
+        # config_use (#162) detection: needs callees resolved (backfill_
+        # callees above, gated the same >= 2) and config_keys just extracted
+        # above, so this runs after both rather than immediately following
+        # the callee backfill call itself. Resolution is deferred past the
+        # L3/L4 blocks below (the dataflow tiers need DDG and call_graph/
+        # caller-argument substrate those blocks populate) and gated by
+        # level there, literal tier included.
+        if self.analysis_level >= 2:
+            from codeanalyzer.artifacts import detect_config_reads
+
+            config_reads = detect_config_reads(app)
+
         # L3: intraprocedural dataflow (CFG/CDG/DDG) emitted onto the v2 tree.
         if self.analysis_level >= 3:
             from codeanalyzer.dataflow.builder import (
@@ -676,6 +756,29 @@ class Codeanalyzer:
             # ``infos`` are the syntactic (L3) PDGs from the >=3 block above.
             emit_ddg_pointsto_delta(app, infos, ir, sig_to_id)
 
+        # config_use (#162) resolution: literal tier always runs at >= 2;
+        # the dataflow tiers widen the set as substrate comes online -- intra
+        # needs the DDG the L3 block above just emitted, interproc needs
+        # call_graph + caller PyCallArgument values (already present since
+        # L2) plus, for its one-hop caller-side closure, the caller's own
+        # DDG -- populated for every callable by the same L3 block, which
+        # always runs before this when analysis_level >= 4. A read resolved
+        # at a lower tier is never recomputed, so `-a 2 ⊆ -a 3 ⊆ -a 4` holds
+        # by construction.
+        if self.analysis_level >= 2:
+            from codeanalyzer.artifacts import (
+                dataflow_intra_tier, dataflow_interproc_tier, resolve_uses,
+            )
+
+            tier_fns = []
+            if self.analysis_level >= 3:
+                tier_fns.append(dataflow_intra_tier)
+            if self.analysis_level >= 4:
+                tier_fns.append(dataflow_interproc_tier)
+            app.config_uses, app.config_reads_unresolved = resolve_uses(
+                config_reads, app, tier_fns=tier_fns
+            )
+
         # Build the v2 envelope, then persist it (the cache stores the full
         # ``Analysis`` envelope so a reused cache round-trips schema_version).
         # k_limit is an L3+ envelope key: below the dataflow levels it stays
@@ -936,39 +1039,3 @@ class Codeanalyzer:
             len(symbol_table), time.perf_counter() - t0_st,
         )
         return symbol_table
-
-    def _get_pycg_call_graph(
-        self,
-        symbol_table: Dict[str, PyModule],
-        jedi_edges: List[PyCallEdge],
-    ) -> List[PyCallEdge]:
-        """Build PyCG-resolved call edges.
-
-        Runs PyCG's iterative name-pointer analysis over the whole project
-        and returns edges with ``prov=["pycg"]``.  Falls back to an
-        empty list and logs a warning on any failure so the caller can
-        continue with Jedi-only edges.
-
-        *jedi_edges* are the level-1 call edges; under the ``jedi`` shard
-        strategy they drive coupling-aware partitioning (see
-        :func:`shard_planner.plan_shards`).
-        """
-        try:
-            pycg = PyCG(
-                self.project_dir,
-                skip_tests=self.skip_tests,
-                shard=self.options.pycg_shard,
-                shard_ceiling=self.options.pycg_shard_ceiling,
-                shard_timeout=self.options.pycg_shard_timeout,
-                shard_strategy=self.options.pycg_shard_strategy,
-                max_iter=self.options.pycg_max_iter,
-                using_ray=self.using_ray,
-            )
-            return pycg.build_call_graph_edges(symbol_table, jedi_edges=jedi_edges)
-        except PyCGExceptions.PyCGImportError as exc:
-            logger.warning(f"PyCG not installed — level 2 edges will be Jedi-only: {exc}")
-            return []
-        except PyCGExceptions.PyCGAnalysisError as exc:
-            logger.warning(f"PyCG analysis failed — level 2 edges will be Jedi-only: {exc}")
-            logger.debug("PyCG full traceback:", exc_info=True)
-            return []

codeanalyzer/dataflow/access_paths.py

@@ -245,15 +245,37 @@ def _names_loaded(node: ast.AST) -> Set[str]:
     return out
 
 
-def build_scope(func: ast.AST, enclosing_locals: Set[str]) -> FunctionScope:
+#: Jedi resolves every spelling of the builtin -- ``@staticmethod``,
+#: ``@builtins.staticmethod``, ``from builtins import staticmethod as sm`` --
+#: to this one name (#135).
+_STATICMETHOD_QUALIFIED = "builtins.staticmethod"
+
+
+def build_scope(
+    func: ast.AST,
+    enclosing_locals: Set[str],
+    decorator_names: Optional[Set[str]] = None,
+) -> FunctionScope:
     """Classify every base name the callable touches. ``enclosing_locals`` is
     the union of locals/params of all enclosing callables (for capture vs
-    global disambiguation)."""
+    global disambiguation).
+
+    ``decorator_names`` are the callable's Jedi-resolved decorator
+    ``qualified_name``s. When supplied, staticmethod detection is by identity,
+    so a dotted or aliased spelling is recognised (#135). When omitted -- a
+    caller with no resolved records -- it falls back to matching the written
+    source, which only recognises the bare ``@staticmethod``.
+    """
     params = _param_names(func)
     scope = FunctionScope(params=params)
     if params and isinstance(func, (ast.FunctionDef, ast.AsyncFunctionDef)):
-        decorators = {ast.unparse(d) for d in func.decorator_list}
-        if params[0] in ("self", "cls") and "staticmethod" not in decorators:
+        if decorator_names is None:
+            is_static = "staticmethod" in {
+                ast.unparse(d) for d in func.decorator_list
+            }
+        else:
+            is_static = _STATICMETHOD_QUALIFIED in decorator_names
+        if params[0] in ("self", "cls") and not is_static:
             scope.self_name = params[0]
     scope.globals_ = _declared(func, ast.Global)
     nonlocals = _declared(func, ast.Nonlocal)

codeanalyzer/dataflow/builder.py

@@ -186,6 +186,13 @@ def build_function_pdgs(
                 oracle=oracle,
                 k=k,
                 global_qualifier=module.module_name,
+                # Resolved decorator names, so staticmethod detection works for a
+                # dotted or aliased spelling and not just bare `@staticmethod` (#135).
+                decorator_names={
+                    d.qualified_name
+                    for d in (pycallable.decorators or [])
+                    if d.qualified_name
+                },
             )
             infos[pycallable.signature] = FunctionInfo(
                 signature=pycallable.signature, pdg=pdg, oracle=oracle
@@ -346,6 +353,10 @@ def build_program_graphs(
     """
     class_idx = _class_index(app)
     callable_idx = _callable_index(app)
+    # Reverse of callable_idx: a callsite's already-L2-backfilled BodyNode.callee
+    # (a can:// id, folding in the defuse linker's resolution -- not just Jedi's
+    # own callee_signature side channel) resolved back to a dotted signature.
+    id_to_sig = {c.id: sig for sig, c in callable_idx.items()}
 
     infos, func_asts = build_function_pdgs(app, k, oracle_factory=oracle_factory)
 
@@ -366,7 +377,17 @@ def build_program_graphs(
                 calls_by_line.setdefault(call.lineno, (node.id, call))
 
         for site in pycallable.call_sites or []:
-            target = site.callee_signature
+            # Prefer the callsite's body-backfilled callee over Jedi's own
+            # callee_signature side channel: under cross-test parso/Jedi cache
+            # pressure that inference can silently degrade (full-suite-only
+            # loss of SDG summary/global stitching -- test_dataflow_sdg.py),
+            # while BodyNode.callee is the deterministic L2 path (Jedi filtered
+            # the same way, PLUS the defuse linker's fallback -- l2_callees.py).
+            # Only a resolved INTERNAL target counts (id_to_sig misses on an
+            # external/unresolved callee); falls through to callee_signature
+            # exactly as before whenever the body doesn't have an answer.
+            body_node = pycallable.body.get(f"{site.start_line}:{site.start_column}")
+            target = (id_to_sig.get(body_node.callee) if body_node else None) or site.callee_signature
             if not target:
                 continue
             if target in class_idx and target not in infos:

codeanalyzer/dataflow/identity.py

@@ -10,7 +10,7 @@ Two forms per node:
   an L1 body node and its coinciding CFG node land on the same key and L1 ⊆ L3
   holds.
 * **global** — ``"<callable can:// id>@<local>"``, the fully addressable id for
-  cross-callable references and the Neo4j PyCFGNode keys (a later task).
+  cross-callable references and the Neo4j PyBodyNode keys (a later task).
 """
 from __future__ import annotations
 from collections import defaultdict

codeanalyzer/dataflow/pdg.py

@@ -66,10 +66,15 @@ def build_pdg(
     oracle: TypeBasedAliasOracle,
     k: int = 3,
     global_qualifier: Optional[str] = None,
+    decorator_names: Optional[Set[str]] = None,
 ) -> FunctionPDG:
-    """CFG → dominance → def-use → PDG for one callable."""
+    """CFG → dominance → def-use → PDG for one callable.
+
+    ``decorator_names`` are the callable's resolved decorator qualified names,
+    used for staticmethod detection by identity rather than spelling (#135).
+    """
     cfg = build_cfg(func)
-    scope = build_scope(func, enclosing_locals)
+    scope = build_scope(func, enclosing_locals, decorator_names=decorator_names)
     facts = statement_facts(cfg, func, scope, k, global_qualifier)
 
     edges: List[PDGEdge] = [

codeanalyzer/dataflow/scc.py

@@ -17,7 +17,7 @@
 """Stage 5b of the level-3 dataflow ladder: SCC condensation of the call graph.
 
 The call graph is a frozen oracle (level-1 Jedi edges, provenance-merged with
-level-2 PyCG when enabled); Tarjan condenses it into strongly connected
+level-2 resolvers); Tarjan condenses it into strongly connected
 components, and the condensation DAG in reverse topological order is the
 bottom-up processing schedule for summary composition — callees before
 callers, one monotone fixpoint per SCC (mutual recursion).

codeanalyzer/entrypoints/__init__.py

@@ -0,0 +1,3 @@
+from codeanalyzer.entrypoints.pipeline import detect_entrypoints
+
+__all__ = ["detect_entrypoints"]

codeanalyzer/entrypoints/detect.py

@@ -0,0 +1,124 @@
+"""Stage 0: which frameworks is this project actually using? (#27)
+
+Gates every later stage, so a project without Celery never pays for Celery
+rules and cannot false-positive on a locally-defined ``shared_task``. A
+package counts as present if first-party source imports it OR the dependency
+manifest names it -- either is sufficient, since an import may be dynamic.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Optional, Set
+
+from codeanalyzer.entrypoints.rules import RuleSet
+from codeanalyzer.schema.py_schema import PyApplication
+
+_REQ = re.compile(r"^\s*['\"]?([A-Za-z0-9_.\-]+)")
+_DEPS_START = re.compile(r"dependencies\s*=\s*\[")
+_TABLE_HEADER = re.compile(r"(?m)^[ \t]*\[")
+_PKG = re.compile(r"['\"]([A-Za-z0-9][A-Za-z0-9_.\-]*)")
+
+
+def detected_frameworks(app: PyApplication, project_dir: Path, rules: RuleSet) -> Set[str]:
+    # `present` (imports, manifest names) and `detect:` values are both
+    # lowercased before comparison -- manifest names were already lowercased
+    # (PyPI/pip is case-insensitive) but imports and `detect:` were not, so
+    # a `detect: [Flask]` user rule silently never matched a `flask` import.
+    present = _imported_packages(app) | _manifest_packages(project_dir)
+    return {
+        name
+        for name, fw in rules.frameworks.items()
+        if any(pkg.lower() in present for pkg in (fw.detect or [name]))
+    }
+
+
+def _imported_packages(app: PyApplication) -> Set[str]:
+    out: Set[str] = set()
+    for mod in app.symbol_table.values():
+        for imp in mod.imports or []:
+            # `from flask import Flask` puts the package in `module`, not `name`.
+            # Prefer `module`; fall back to `name` for a bare `import flask`.
+            spelling = (getattr(imp, "module", "") or getattr(imp, "name", "") or "")
+            spelling = spelling.lstrip(".")
+            if spelling:
+                out.add(spelling.split(".", 1)[0].lower())
+    return out
+
+
+def _manifest_packages(project_dir: Path) -> Set[str]:
+    out: Set[str] = set()
+    pyproject = project_dir / "pyproject.toml"
+    if pyproject.exists():
+        # PEP 621 `[project] dependencies = [...]` -- single- or multi-line,
+        # possibly containing nested `[...]` extras (`celery[redis]`).
+        span = _deps_array_span(_strip_comments(pyproject.read_text()))
+        if span is not None:
+            for pm in _PKG.finditer(span):
+                out.add(pm.group(1).split("[", 1)[0].lower())
+    requirements = project_dir / "requirements.txt"
+    if requirements.exists():
+        for line in requirements.read_text().splitlines():
+            m = _REQ.match(line)
+            if m:
+                out.add(m.group(1).split("[", 1)[0].lower())
+    return out
+
+
+def _strip_comments(text: str) -> str:
+    """Drop everything from an unquoted ``#`` to end of line.
+
+    # ponytail: quote tracking resets each line, so a `#` inside a
+    # triple-quoted string spanning lines could be mis-stripped. TOML
+    # dependency arrays don't use those in practice; revisit if they do.
+    """
+    out_lines = []
+    for line in text.splitlines():
+        in_str = None
+        cut = len(line)
+        for i, ch in enumerate(line):
+            if in_str:
+                if ch == in_str:
+                    in_str = None
+            elif ch in ("'", '"'):
+                in_str = ch
+            elif ch == "#":
+                cut = i
+                break
+        out_lines.append(line[:cut])
+    return "\n".join(out_lines)
+
+
+def _deps_array_span(text: str) -> Optional[str]:
+    """Return the contents between the `dependencies = [` and its matching
+    `]`, counting bracket depth so a nested `[...]` (extras, e.g.
+    `celery[redis]`) doesn't close the span early.
+
+    Bounded by the next TOML table header (a `[` starting a line): if the
+    array never closes before then, it's unterminated (truncated/corrupt
+    file) and this returns None rather than harvesting quoted strings out
+    of whatever table follows.
+    """
+    m = _DEPS_START.search(text)
+    if not m:
+        return None
+    boundary = _TABLE_HEADER.search(text, m.end())
+    limit = boundary.start() if boundary else len(text)
+    depth = 1
+    in_str = None
+    i = m.end()
+    while i < limit and depth > 0:
+        ch = text[i]
+        if in_str:
+            if ch == in_str:
+                in_str = None
+        elif ch in ("'", '"'):
+            in_str = ch
+        elif ch == "[":
+            depth += 1
+        elif ch == "]":
+            depth -= 1
+        i += 1
+    if depth != 0:
+        return None
+    return text[m.end() : i - 1]

codeanalyzer/entrypoints/matching.py

@@ -0,0 +1,182 @@
+"""Stage 3: match rules against decorators and base classes (#27).
+
+Matching is on ``PyDecorator.qualified_name`` -- never the written spelling --
+so ``@route`` under ``from flask import route`` hits the same rule as
+``@app.route``. An unresolved decorator (``qualified_name is None``) never
+matches: under-approximate rather than guess.
+
+Pattern grammar: ``{a,b}`` alternation (not nested) and a trailing/embedded
+``*`` that matches module MEMBERS only -- it does not cross a ``.``, so
+``rest_framework.viewsets.*`` matches ``ModelViewSet`` but not
+``viewsets.mixins.ListModelMixin``. Everything else is literal.
+``validate_pattern`` rejects anything outside this grammar (unbalanced or
+nested ``{``) so a typo in a rules file is a load-time ``RulesError``
+(enforced by ``rules.py``), never a crash mid-analysis.
+"""
+from __future__ import annotations
+
+import ast
+import re
+from typing import TYPE_CHECKING, Any, Callable, Dict, Iterable, List, Optional, Tuple
+
+from codeanalyzer.schema.py_schema import PyEntrypoint
+
+if TYPE_CHECKING:
+    from codeanalyzer.entrypoints.rules import BaseRule, DecoratorRule
+
+# Dispatch names that are HTTP verbs. DRF's ViewSet dispatch names
+# (list, retrieve, create, ...) are NOT verbs and must not be emitted as such.
+_HTTP_VERBS = {"get", "post", "put", "patch", "delete", "head", "options"}
+
+
+class PatternError(ValueError):
+    """A ``match`` pattern outside the ``{a,b}`` / ``*`` grammar `_compile` handles."""
+
+
+def validate_pattern(pattern: str) -> None:
+    """Raise ``PatternError`` for unbalanced or nested ``{``."""
+    depth = 0
+    for ch in pattern:
+        if ch == "{":
+            depth += 1
+            if depth > 1:
+                raise PatternError(f"nested '{{' is not supported: {pattern!r}")
+        elif ch == "}":
+            depth -= 1
+            if depth < 0:
+                raise PatternError(f"unmatched '}}': {pattern!r}")
+    if depth != 0:
+        raise PatternError(f"unbalanced '{{': {pattern!r}")
+
+
+def match_pattern(pattern: str, qualified_name: Optional[str]) -> bool:
+    """``{a,b}`` alternation and trailing ``*``; everything else is literal."""
+    if not qualified_name:
+        return False
+    return re.fullmatch(_compile(pattern), qualified_name) is not None
+
+
+def _compile(pattern: str) -> str:
+    validate_pattern(pattern)
+    out, i = [], 0
+    while i < len(pattern):
+        ch = pattern[i]
+        if ch == "{":
+            j = pattern.index("}", i)
+            alts = pattern[i + 1 : j].split(",")
+            out.append("(?:" + "|".join(re.escape(a.strip()) for a in alts) + ")")
+            i = j + 1
+        elif ch == "*":
+            out.append(r"[^.\s]*")
+            i += 1
+        else:
+            out.append(re.escape(ch))
+            i += 1
+    return "".join(out)
+
+
+def _literal(text: Optional[str]) -> Any:
+    """Best-effort: decorator arguments are unparsed source fragments."""
+    if text is None:
+        return None
+    try:
+        return ast.literal_eval(text)
+    except (ValueError, SyntaxError):
+        return None
+
+
+def _route_of(dec, spec: Optional[Dict[str, Any]]) -> Optional[str]:
+    if not spec or spec.get("from") != "positional":
+        return None
+    args = dec.positional_arguments or []
+    idx = int(spec.get("index", 0))
+    if idx >= len(args):
+        return None
+    value = _literal(args[idx])
+    return value if isinstance(value, str) else None
+
+
+def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
+    if not spec:
+        return []
+    source = spec.get("from")
+    if source == "match_suffix":
+        verb = (dec.qualified_name or "").rsplit(".", 1)[-1]
+        return [verb.upper()]
+    if source == "keyword":
+        raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
+        value = _literal(raw)
+        if isinstance(value, (list, tuple)):
+            return [str(v).upper() for v in value]
+        return [str(v).upper() for v in (spec.get("default") or [])]
+    return []
+
+
+def entrypoints_from_decorators(
+    node, framework: str, rules: Iterable["DecoratorRule"]
+) -> List[PyEntrypoint]:
+    out: List[PyEntrypoint] = []
+    for dec in getattr(node, "decorators", []) or []:
+        for rule in rules:
+            if not match_pattern(rule.match, dec.qualified_name):
+                continue
+            out.append(
+                PyEntrypoint(
+                    framework=framework,
+                    confidence=rule.confidence,
+                    rule=rule.id,
+                    ruleset=rule.origin,
+                    evidence=dec.qualified_name,
+                    route=_route_of(dec, rule.route),
+                    http_methods=_methods_of(dec, rule.methods),
+                )
+            )
+    return out
+
+
+def entrypoints_from_bases(
+    cls,
+    framework: str,
+    rules: Iterable["BaseRule"],
+    resolve: Callable[[str], Optional[str]],
+) -> Tuple[List[PyEntrypoint], Dict[str, List[PyEntrypoint]]]:
+    """Records for a routed class and for the methods the framework dispatches.
+
+    ``resolve`` maps a written base-class name to its resolved qualified name
+    (identity when already qualified). Dispatch names are intersected with the
+    methods the class actually defines, so a ``ListView`` with only ``get``
+    gains no phantom ``post`` entrypoint.
+    """
+    class_eps: List[PyEntrypoint] = []
+    method_eps: Dict[str, List[PyEntrypoint]] = {}
+
+    for rule in rules:
+        if not any(
+            match_pattern(rule.match, resolve(b) or b) for b in (cls.base_classes or [])
+        ):
+            continue
+        class_eps.append(
+            PyEntrypoint(
+                framework=framework,
+                confidence=rule.confidence,
+                rule=rule.id,
+                ruleset=rule.origin,
+                evidence=cls.signature,
+            )
+        )
+        defined = set((cls.callables or {}).keys())
+        for name in rule.dispatch:
+            if name not in defined:
+                continue
+            method_eps.setdefault(name, []).append(
+                PyEntrypoint(
+                    framework=framework,
+                    confidence=rule.confidence,
+                    rule=f"{rule.id}.dispatch",
+                    ruleset=rule.origin,
+                    evidence=cls.signature,
+                    http_methods=[name.upper()] if name in _HTTP_VERBS else [],
+                    via=cls.id or None,
+                )
+            )
+    return class_eps, method_eps