dead-cst 0.1.0__tar.gz

dead_cst-0.1.0/.claude/settings.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path // .tool_response.filePath // empty' | { read -r f; [ -z \"$f\" ] && exit 0; case \"$f\" in *.py) cd /home/user/dead-cst && uv run --quiet ruff format \"$f\" && uv run --quiet ruff check --fix --unfixable F401 \"$f\" ;; esac; } 2>/dev/null || true"
+          },
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path // .tool_response.filePath // empty' | { read -r f; [ -z \"$f\" ] && exit 0; case \"$f\" in *.py) cd /home/user/dead-cst && uv run --quiet ty check ;; esac; } 2>/dev/null || true"
+          }
+        ]
+      }
+    ]
+  }
+}

dead_cst-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: 3.12
+          activate-environment: true
+          enable-cache: true
+          cache-dependency-glob: "**/uv.lock"
+      - uses: actions/cache@v5
+        with:
+          path: ~/.cache/prek
+          key: prek-${{ hashFiles('.pre-commit-config.yaml') }}
+      - run: uv sync --frozen
+      - run: uv run prek run --show-diff-on-failure --color=always --all-files
+        env:
+          RUFF_OUTPUT_FORMAT: github
+          CONFTEST_OUTPUT: github
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          activate-environment: true
+          enable-cache: true
+          cache-dependency-glob: "**/uv.lock"
+      - run: uv sync --frozen
+      - name: Run tests
+        run: uv run pytest ${{ matrix.python-version == '3.13' && '--cov=dead_cst --cov-branch --cov-report=xml' || '' }}
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.13'
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}

dead_cst-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,68 @@
+name: Publish
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-testpypi:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    environment: testpypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  publish-pypi:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*
+          prerelease: true
+          fail_on_unmatched_files: true

dead_cst-0.1.0/.gitignore

@@ -0,0 +1,210 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+#poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+#pdm.lock
+#pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+#pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Abstra
+# Abstra is an AI-powered process automation framework.
+# Ignore directories containing user credentials, local state, and settings.
+# Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+
+# hatch-vcs generated version file
+dead_cst/_version.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor
+#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/

dead_cst-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,38 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        types: [python]
+      - id: end-of-file-fixer
+        types: [python]
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: check-json
+      - id: check-toml
+      - id: check-yaml
+      - id: check-ast
+      - id: debug-statements
+      - id: check-docstring-first
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.11.2
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+      - id: ruff-format
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: 0.7.2
+    hooks:
+      - id: uv-lock
+
+  - repo: local
+    hooks:
+      - id: ty
+        name: ty check
+        entry: uv run --frozen ty check
+        language: system
+        types_or: [python, pyi]
+        pass_filenames: false
+        require_serial: true

dead_cst-0.1.0/.python-version

@@ -0,0 +1 @@
+3.13

dead_cst-0.1.0/CHANGELOG.md

@@ -0,0 +1,122 @@
+# Changelog
+
+All notable changes to `dead-cst` will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+Until the first stable release the public API and CLI may change between any
+two versions.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-04-28
+
+Initial alpha release. `dead-cst` is pre-1.0 software: the public Python API,
+CLI flags, and output formats may change without notice between any two
+versions until the first stable release.
+
+### Added
+- Symbol-level reachability analysis built on LibCST's
+  `FullyQualifiedNameProvider` and `ScopeProvider`.
+- Resolution of relative imports, aliased imports, and re-export chains
+  through `__init__.py`.
+- `dead-cst analyze` CLI for reporting unreachable symbols and unreachable
+  branches (`if False:`, raise-only suites, etc.), with `text` and `json`
+  output formats.
+- `dead-cst why-alive` CLI for explaining why a symbol is kept alive.
+- `dead-cst remove` CLI that rewrites files in place via a LibCST codemod,
+  with import pruning when the last local user of an import is deleted and
+  position-aware shadowing so a shadowed dead binding no longer drags its
+  live sibling out with it.
+- `dead-cst unused-exports` CLI command: report `__all__` entries whose
+  targets are kept alive only because they are listed in `__all__`.
+- `dead-cst dependencies` CLI command: list third-party distributions and
+  files imported by the codebase, surfaced as synthetic
+  `[external dist] <name>` / `[external file] <name>` graph nodes.
+- Multi-package / monorepo support via the `-p base:dep1,dep2` search-path
+  spec, with topological ordering of bases.
+- Edge plugin architecture (`EdgePlugin`, `CSTAwareEdgePlugin`,
+  `PluginContext`, `GraphOp`/`AddNode`/`AddEdge`/`RemoveEdge`, `apply_ops`,
+  `synthetic_node`). Built-in plugins: `MainBlockPlugin`,
+  `ProjectScriptsPlugin`, `ExplicitEntrypointPlugin`, `ModuleDundersPlugin`,
+  `PytestPlugin`, `FastAPIPlugin`, `FlaskPlugin`, `TyperPlugin`,
+  `ClickPlugin`, `UnittestPlugin`, `InitSubclassPlugin`. Third-party
+  plugins register under the `dead_cst.plugins` entry-point group and load
+  via `load_plugin`.
+- `PytestPlugin` (`--plugin pytest`): keep pytest-discovered tests,
+  `conftest.py` decls, and `@pytest.fixture` functions alive.
+- `FastAPIPlugin` (`--plugin fastapi`): detect top-level `FastAPI()` and
+  `APIRouter()` instances (including factory-style apps), mark `FastAPI`
+  apps as entrypoints, and emit `instance -> handler` edges for
+  `@app.get(...)`-style decorators (HTTP methods, websockets, middleware,
+  exception handlers, `on_event`). Routers stay pass-through, so an
+  `APIRouter` that's never `include_router`'d remains dead.
+- `FlaskPlugin` (`--plugin flask`): detect top-level `Flask()` /
+  `Blueprint()` instances (including factory-style apps) and emit
+  `instance -> handler` edges for `@app.route(...)`, HTTP-verb shortcuts,
+  request-lifecycle hooks (`before_request`, `after_request`,
+  `teardown_*`), error handlers, template helpers (`context_processor`,
+  `template_filter`, ...), and URL processors. `Flask` apps are seeded as
+  entrypoints (WSGI servers load `module:app`); `Blueprint`s stay
+  pass-through, so a blueprint never `register_blueprint`'d remains dead,
+  mirroring the `APIRouter` behavior in `FastAPIPlugin`.
+- `TyperPlugin` (`--plugin typer`): detect top-level `Typer()` instances
+  and emit `instance -> handler` edges for `@app.command(...)` and
+  `@app.callback(...)` decorators. Typer apps are pass-through;
+  reachability is expected through `[project.scripts]` or a `__main__`
+  block, after which every registered command and callback stays alive.
+  Sub-typers that are never `add_typer`'d remain dead.
+- `ClickPlugin` (`--plugin click`): detect top-level Click `Group`
+  instances (functions decorated `@click.group(...)` / `@click.Group(...)`,
+  `X = click.Group(...)` constructor calls, and inline sub-groups
+  registered via `@<group>.group(...)`, all resolved via fixpoint so a
+  chain of nested groups is fully discovered) and emit
+  `instance -> handler` edges for `@<group>.command(...)`,
+  `@<group>.group(...)`, and `@<group>.result_callback(...)` decorators.
+  Click groups stay pass-through; reachability is expected through
+  `[project.scripts]` or a `__main__` block, mirroring `TyperPlugin`.
+- `UnittestPlugin` (`--plugin unittest`): mark stdlib `unittest.TestCase`
+  and `unittest.IsolatedAsyncioTestCase` subclasses, plus module-level
+  `setUpModule` / `tearDownModule` / `load_tests` hooks, as entrypoints.
+  Discovery is CST-based and prefiltered to files whose import nodes
+  reference `unittest`. Supports `import unittest` (with alias),
+  `from unittest import TestCase` (with alias), and module-prefixed base
+  references. Only direct base-class matches are recognised; transitive
+  subclasses through a project-local mixin need an explicit `-e`
+  entrypoint or coverage from `PytestPlugin`'s filename heuristics.
+  `from unittest import *`-only files are skipped (the resolver doesn't
+  surface stdlib star imports as graph nodes); use a non-star import.
+- `InitSubclassPlugin` (`--plugin init_subclass`): detect classes that
+  define `__init_subclass__` and route reachability through a synthetic
+  marker node `<__init_subclass__>:<parent.fqname>` with edges
+  `parent -> marker -> subclass` for every transitive first-party
+  subclass. Registry-pattern subclasses stay alive whenever the parent
+  class does; the marker shows up in `why-alive` chains as a labeled
+  breadcrumb. Parents are pass-through, so a registry base nobody else
+  uses still surfaces as dead code.
+- `ModuleDundersPlugin`: keep module-level dunder variables (`__all__`,
+  `__version__`, `__future__` imports, etc.) alive. Always registered by
+  the CLI.
+- Path resolver architecture (`PathResolver`, `merge_paths`). Built-in
+  resolvers: `VenvResolver`, `PyprojectResolver`, `UvWorkspaceResolver`
+  (parses `uv.lock` to discover workspace members and inter-member
+  edges, including virtual workspace members that don't ship as wheels).
+  Third-party resolvers register under `dead_cst.resolvers` and load via
+  `load_resolver`.
+- `exported_roots(base)` in `dead_cst._resolvers`: inspect a base's
+  `pyproject.toml` (src-layout, hatchling/setuptools/poetry/pdm/flit
+  backends, name-match fallback) to determine which subdirs the build
+  backend would actually ship, so internal dirs like `tests/` stay scoped
+  to their owning workspace member during cross-member import resolution.
+- `--resolver` and `--plugin` flags on `analyze`, `why-alive`,
+  `unused-exports`, and `remove` for selecting path resolvers and edge
+  plugins.
+- Public Python API: `build_symbol_graph`, `find_reachable`,
+  `count_nodes`, `order_paths`, `remove_code`, plus a `position` field
+  on `SymbolNode`.
+- `py.typed` marker for downstream type-checking.
+- `README.md`, `CONTRIBUTING.md`, `CHANGELOG.md`, and `ROADMAP.md` with a
+  stack-ranked plan from alpha to 1.0.
+
+[Unreleased]: https://github.com/lpetre/dead-cst/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/lpetre/dead-cst/releases/tag/v0.1.0

dead_cst-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,154 @@
+# Contributing to dead-cst
+
+Thanks for your interest. `dead-cst` is small and pre-release — bug reports with minimal repros, real-world test cases, and PRs are all welcome. Expect APIs and CLI flags to keep moving until the first stable release. See [`ROADMAP.md`](ROADMAP.md) for the planned trajectory.
+
+## Development setup
+
+`dead-cst` uses [uv](https://github.com/astral-sh/uv) for environment management.
+
+```bash
+git clone https://github.com/lpetre/dead-cst
+cd dead-cst
+uv sync
+```
+
+That installs the package in editable mode along with the `dev` group: `pytest`, `ruff`, `prek`, and `ty`.
+
+## Running tests
+
+```bash
+uv run pytest
+```
+
+For a tight inner loop while editing the visitor, resolver, or a plugin, `pytest-watcher` is in the dev group:
+
+```bash
+uv run ptw
+```
+
+To collect coverage locally:
+
+```bash
+uv run pytest --cov=dead_cst --cov-branch --cov-report=term-missing
+```
+
+CI uploads branch coverage from the 3.13 matrix entry to Codecov on every push and PR.
+
+## Coverage policy
+
+Per-component thresholds reflect blast radius, not total LOC. The full
+configuration lives in `codecov.yml`; the targets are:
+
+| Component | Target | Why |
+|---|---|---|
+| `_codemod.py` | 95% | Rewrites user files. Regressions corrupt source. |
+| `cli.py` | 80% | User-visible trust surface. |
+| `_plugins/**` | 85% | Each plugin is a framework promise. |
+| `_resolvers/**` | 85% | Path resolution drives every analysis. |
+| `_analyze.py`, `_visitor.py`, `_resolve.py`, `_flow.py`, `_branches.py`, `_symbols.py`, `_fqn.py` | 80% | Analytical core. |
+
+Per-component statuses are **informational** until Tier 1 of `ROADMAP.md`
+(CLI integration tests, remaining framework presets) lands and the numbers
+clear the bars above. The patch-coverage gate on new code is **enforcing**
+at 90% — regressions are caught at the diff, not in aggregate.
+
+`if TYPE_CHECKING:` blocks, `@overload` stubs, and `_version.py` are
+excluded; see `[tool.coverage.*]` in `pyproject.toml`.
+
+## Linting and formatting
+
+Ruff (lint + format), `ty` (type check), and a small set of hooks run on every commit via [`prek`](https://github.com/j178/prek), a fast Rust-based drop-in replacement for `pre-commit` that reads the same `.pre-commit-config.yaml`.
+
+```bash
+uv run prek install        # one-time, sets up the git hook
+uv run prek run --all-files
+```
+
+CI runs `prek run --all-files` on every push and pull request, so running it locally before committing avoids round-trips.
+
+## Project layout
+
+```
+dead_cst/
+  __init__.py            # public API surface
+  _analyze.py            # build_symbol_graph, find_reachable, count_nodes, order_paths
+  _codemod.py            # remove_code -- LibCST transformer + import pruner
+  _resolve.py            # import resolution (stdlib / first-party / third-party)
+  _resolvers/            # path resolvers:
+    venv.py              #   sibling .venv -> site-packages
+    pyproject.py         #   [tool.dead-cst] paths or src/ fallback
+    uv_workspace.py      #   uv.lock workspace members + inter-member deps
+    _exports.py          #   exported_roots: hide internal dirs from consumers
+  _symbols.py            # SymbolNode, SymbolTrie data classes
+  _visitor.py            # SymbolVisitor -- walks each file and emits symbols + edges
+  _flow.py               # flow-sensitive live-at-exit analysis for shadowing
+  _branches.py           # statically-dead suite detection
+  _fqn.py                # FullyQualifiedNameProvider patches / wrappers
+  _plugins/              # edge plugins:
+    main_block.py        #   if __name__ == "__main__"
+    project_scripts.py   #   pyproject.toml [project.scripts]
+    explicit.py          #   user-supplied -e specs
+    module_dunders.py    #   __all__, __version__, ...
+    pytest.py            #   conftest, test_*.py, @pytest.fixture
+    fastapi.py           #   FastAPI / APIRouter route handlers
+  cli.py                 # Typer entrypoints: analyze, why-alive, unused-exports,
+                         #                    dependencies, remove
+tests/                   # pytest suite, fixture-driven from inline source snippets
+```
+
+Modules prefixed with `_` are internal; only the names re-exported from `dead_cst/__init__.py` are part of the supported API. Within the package, plugins and resolvers are stable extension points — see below.
+
+## Adding a plugin
+
+A plugin is any class that satisfies `EdgePlugin` (or `CSTAwareEdgePlugin` if it needs LibCST metadata). Implement `name: str` and a `contribute(ctx)` method that yields `AddNode`, `AddEdge`, or `RemoveEdge` ops.
+
+```python
+from dead_cst import AddEdge, AddNode, GraphOp, PluginContext, synthetic_node
+
+class FlaskRoutesPlugin:
+    name = "flask_routes"
+
+    def contribute(self, ctx: PluginContext):
+        for node in ctx.graph.nodes:
+            ...  # detect @app.route handlers and emit AddNode(..., entrypoint=True)
+```
+
+Built-in plugins live in `dead_cst/_plugins/<name>.py`; out-of-tree plugins register under the `dead_cst.plugins` entry-point group:
+
+```toml
+[project.entry-points."dead_cst.plugins"]
+flask_routes = "myproj.plugins:FlaskRoutesPlugin"
+```
+
+`FastAPIPlugin` is a good full-featured reference — it walks each module's CST, recognises the `FastAPI()` / `APIRouter()` instance pattern, and wires `instance -> handler` edges through decorator detection.
+
+## Adding a resolver
+
+A resolver implements `PathResolver`: a `name: str` attribute and a `resolve(project_root)` method returning a `{base: [dep_paths]}` dict. Built-in resolvers live in `_resolvers.py`; third-party resolvers register under `dead_cst.resolvers`.
+
+## Adding a test
+
+Tests use the `build_decl_graph` fixture (in `tests/conftest.py`), which writes a dict of `{filename: source}` to a tmpdir, runs `build_symbol_graph` on it, and returns the resulting graph. The `assert_edges` fixture compares edges as `"src.fqname -> dst.fqname"` strings.
+
+```python
+def test_something(build_decl_graph, assert_edges):
+    graph = build_decl_graph({"mod.py": "def a(): pass\na()"})
+    assert_edges(graph, {"mod.a -> mod", "mod -> mod.a"})
+```
+
+Plugin tests follow the same pattern in `tests/test_plugins/`. For codemod regressions, `tests/test_codemod.py` writes a source snippet, runs `remove_code`, and asserts on the rewritten text.
+
+## Reporting bugs
+
+A good bug report contains a minimal `.py` file (or pair of files) and the entrypoint flag you ran, plus the actual vs. expected dead-symbol output. The smaller the repro, the faster it gets fixed.
+
+## Pull requests
+
+- Keep PRs focused — one logical change per PR.
+- Add or update tests for behaviour changes.
+- Run `prek run --all-files` and `pytest` before pushing.
+- If your change is user-visible, add an entry to `CHANGELOG.md` under `[Unreleased]`.
+
+## Releasing
+
+Releases are tag-driven. Pushing a `vX.Y.Z` tag triggers `.github/workflows/publish.yml`, which builds the package with `uv build` and publishes to PyPI via OIDC. The version is read from the tag by `hatch-vcs`, so no manual version bumps in source files are needed.