fastapi-injected 0.3.2__tar.gz → 0.3.6__tar.gz

{fastapi_injected-0.3.2 → fastapi_injected-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-injected
-Version: 0.3.2
+Version: 0.3.6
 Summary: Yet another library to reuse fastapi dependency injection
 Project-URL: Repository, https://github.com/uriyyo/fastapi-injected
 Author-email: Yurii Karabas <1998uriyyo@gmail.com>
@@ -14,7 +14,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.12
-Requires-Dist: fastapi>=0.139.2
+Requires-Dist: fastapi>=0.141.0
 Requires-Dist: typing-extensions>=4.16.0
 Requires-Dist: typing-inspection>=0.4.4
 Description-Content-Type: text/markdown
@@ -164,7 +164,25 @@ async with push_inject_scope(app=app):
 
 Without it, reading `request.app` raises a `KeyError` naming what is missing rather than a bare `'app'`.
 
-Analysing a dependency is the expensive part of resolving one, so the result is cached — keyed by the dependency itself, not by whatever object carried it, so nothing that only passed through is kept alive. `clear_dependant_cache()` drops it, for long-lived processes and test suites that want the memory back.
+When a dependency reads more of the request than that — a header, a cookie, a query or path parameter, the body — describe the request with `synthetic_request` and hand it to the scope:
+
+```python
+from fastapi_injected import push_inject_scope, synthetic_request
+
+request = synthetic_request(
+    headers={"x-trace": "job-42"},
+    cookies={"sid": "abc"},
+    query={"page": "2"},
+    path_params={"item_id": 7},
+    body={"name": "readme"},  # sent as JSON; bytes and str are sent as they are
+    app=app,
+)
+
+async with push_inject_scope(request=request):
+    await handler()  # `Header()`, `Cookie()`, `Query()`, `Path()` and `Body()` resolve from it
+```
+
+Analysing a dependency is the expensive part of resolving one, so the result is cached — keyed by the dependency itself, not by whatever object carried it, so nothing that only passed through is kept alive. Only dependencies written in source code are cached this way: functions and classes, and annotations built from them. One made at runtime — `Given(...)`, a `MakeInjected` or `bind_deps` result, an object that brings its own `Depends` — is analysed again on every resolve, and FastAPI never gets to keep it: what it carries is released with the resolve instead of living as long as the process. `clear_dependant_cache()` drops the cache, for long-lived processes and test suites that want the memory back.
 
 ### Overriding dependencies
 
@@ -227,7 +245,7 @@ async with push_inject_scope({Session: fake}) as scope:
 
 ### Dependencies that are objects
 
-Dependants are cached by the callable that resolves them, so a dependency that is an object — a class holding configuration, a parametrized resolver — has to be hashable to get there. A plain dataclass is not, and a frozen one still refuses as soon as it holds a list or a dict.
+Resolved values are cached in their scope by the callable that resolves them, so a dependency that is an object — a class holding configuration, a parametrized resolver — has to be hashable to get there. A plain dataclass is not, and a frozen one still refuses as soon as it holds a list or a dict.
 
 `MakeDataclass` is a base class that makes its subclasses dataclasses with a hash that always answers: by fields when they can be hashed, by identity when they cannot.
 
@@ -351,6 +369,54 @@ async def route(service: Dep[Service]) -> str:
 
 Anything called from the handler — including `@inject`-ed helpers — resolves against the request's cache, so a per-request dependency like a DB session stays a single instance for the whole request.
 
+WebSocket routes work the same way: the scope is bound to the `WebSocket` instead of a `Request`, and dependencies that ask for one get it. A websocket handed to a dependency shares its handshake with the one the route received, so it can be talked through after the route has called `accept()`:
+
+```python
+async def notify(websocket: WebSocket) -> None:
+    await websocket.send_json({"ready": True})
+
+
+@app.websocket("/ws")
+async def ws_route(websocket: WebSocket, service: Dep[Service]) -> None:
+    await websocket.accept()
+    await resolve(notify)  # sends through the connection the route accepted
+```
+
+Dependencies that take request parameters — `Header()`, `Cookie()`, `Query()`, `Path()`, and the body as `Body()`, `Form()`, `File()` or a pydantic model — resolve from the request the scope is bound to, exactly as they would in the route:
+
+```python
+class Item(BaseModel):
+    name: str
+
+
+async def get_item(item: Item) -> Item:
+    return item
+
+
+@app.post("/items")
+async def create(request: Request) -> str:
+    item = await resolve(get_item)  # the request body, parsed as FastAPI would
+    ...
+```
+
+A request parameter is a dependency of its own as well - resolve a marker, or an annotation carrying one, without writing a function around it. On its own it has no parameter name, so the marker says what to read; a marker without an alias raises `UnnamedParamError`:
+
+```python
+api_key = await resolve(Header(alias="x-api-key"))  # the raw header, as `Any`
+page = await resolve(Annotated[int, Query(alias="page")])  # validated as `int`
+item_id = await resolve(Annotated[int, Path(alias="item_id")])
+item = await resolve(Annotated[Item, Body()])  # the whole body needs no name
+
+
+@inject
+async def handler(*, api_key: Annotated[str, Header()] = Injected) -> str:
+    return api_key  # a parameter has a name - `x-api-key`, as FastAPI derives it
+```
+
+The body is read only when the resolved dependency declares one, and it is read once per request, shared with the route and every scope nested in it. When the route itself declares a body, dependencies see it in the shape the route gave it: a route with several body parameters embeds them under their names, and a dependency reads its own from there.
+
+`push_inject_scope(request=...)` accepts either a `Request` or a `WebSocket`, and so does everything that reads `InjectScope.request` — the union is `fastapi_injected.types.BoundConnection`.
+
 ## What is public
 
 Everything the package supports is importable from `fastapi_injected` itself, and that is the surface a release keeps:
@@ -359,10 +425,10 @@ Everything the package supports is importable from `fastapi_injected` itself, an
 | --- | --- |
 | Markers | `Dep`, `DepFactory`, `DepOf`, `Arg`, `Given`, `Injected` |
 | Resolving | `inject`, `resolve`, `bind_deps`, `signature_with_deps`, `remap_dep_args`, `clear_dependant_cache` |
-| Scopes and overrides | `InjectScope`, `push_inject_scope`, `inside_inject_scope`, `push_overrides`, `Overrides`, `OverridesProvider`, `ValueOverride`, `FactoryOverride` |
+| Scopes and overrides | `InjectScope`, `push_inject_scope`, `inside_inject_scope`, `synthetic_request`, `push_overrides`, `Overrides`, `OverridesProvider`, `ValueOverride`, `FactoryOverride` |
 | Building on top | `MakeDataclass`, `MakeInjected`, `HasDependsHook`, `ArgMarker`, `is_arg`, `is_dep`, `unwrap_dep_tp`, `unwrap_dep_dependency` |
 | FastAPI integration | `add_injected_scope`, `init_inject_scope` |
-| Errors | `DependencyResolutionError`, `MissedDependencyError`, `MissingDependencyCacheError`, `NotADependencyError`, `UnboundDepArgsError`, `UnboundScopeError` |
+| Errors | `DependencyResolutionError`, `MissedDependencyError`, `MissingDependencyCacheError`, `NotADependencyError`, `UnboundDepArgsError`, `UnboundScopeError`, `UnnamedParamError` |
 
 `fastapi_injected.types` holds the typing vocabulary the signatures are written in — `DepReturn`, `DepShape`, `DepDecl`, `AsyncFunc`, `Coro` and friends — and is public too. Anything else, including every module whose name starts with an underscore, is machinery that can change in a patch release.
 

{fastapi_injected-0.3.2 → fastapi_injected-0.3.6}/README.md

@@ -143,7 +143,25 @@ async with push_inject_scope(app=app):
 
 Without it, reading `request.app` raises a `KeyError` naming what is missing rather than a bare `'app'`.
 
-Analysing a dependency is the expensive part of resolving one, so the result is cached — keyed by the dependency itself, not by whatever object carried it, so nothing that only passed through is kept alive. `clear_dependant_cache()` drops it, for long-lived processes and test suites that want the memory back.
+When a dependency reads more of the request than that — a header, a cookie, a query or path parameter, the body — describe the request with `synthetic_request` and hand it to the scope:
+
+```python
+from fastapi_injected import push_inject_scope, synthetic_request
+
+request = synthetic_request(
+    headers={"x-trace": "job-42"},
+    cookies={"sid": "abc"},
+    query={"page": "2"},
+    path_params={"item_id": 7},
+    body={"name": "readme"},  # sent as JSON; bytes and str are sent as they are
+    app=app,
+)
+
+async with push_inject_scope(request=request):
+    await handler()  # `Header()`, `Cookie()`, `Query()`, `Path()` and `Body()` resolve from it
+```
+
+Analysing a dependency is the expensive part of resolving one, so the result is cached — keyed by the dependency itself, not by whatever object carried it, so nothing that only passed through is kept alive. Only dependencies written in source code are cached this way: functions and classes, and annotations built from them. One made at runtime — `Given(...)`, a `MakeInjected` or `bind_deps` result, an object that brings its own `Depends` — is analysed again on every resolve, and FastAPI never gets to keep it: what it carries is released with the resolve instead of living as long as the process. `clear_dependant_cache()` drops the cache, for long-lived processes and test suites that want the memory back.
 
 ### Overriding dependencies
 
@@ -206,7 +224,7 @@ async with push_inject_scope({Session: fake}) as scope:
 
 ### Dependencies that are objects
 
-Dependants are cached by the callable that resolves them, so a dependency that is an object — a class holding configuration, a parametrized resolver — has to be hashable to get there. A plain dataclass is not, and a frozen one still refuses as soon as it holds a list or a dict.
+Resolved values are cached in their scope by the callable that resolves them, so a dependency that is an object — a class holding configuration, a parametrized resolver — has to be hashable to get there. A plain dataclass is not, and a frozen one still refuses as soon as it holds a list or a dict.
 
 `MakeDataclass` is a base class that makes its subclasses dataclasses with a hash that always answers: by fields when they can be hashed, by identity when they cannot.
 
@@ -330,6 +348,54 @@ async def route(service: Dep[Service]) -> str:
 
 Anything called from the handler — including `@inject`-ed helpers — resolves against the request's cache, so a per-request dependency like a DB session stays a single instance for the whole request.
 
+WebSocket routes work the same way: the scope is bound to the `WebSocket` instead of a `Request`, and dependencies that ask for one get it. A websocket handed to a dependency shares its handshake with the one the route received, so it can be talked through after the route has called `accept()`:
+
+```python
+async def notify(websocket: WebSocket) -> None:
+    await websocket.send_json({"ready": True})
+
+
+@app.websocket("/ws")
+async def ws_route(websocket: WebSocket, service: Dep[Service]) -> None:
+    await websocket.accept()
+    await resolve(notify)  # sends through the connection the route accepted
+```
+
+Dependencies that take request parameters — `Header()`, `Cookie()`, `Query()`, `Path()`, and the body as `Body()`, `Form()`, `File()` or a pydantic model — resolve from the request the scope is bound to, exactly as they would in the route:
+
+```python
+class Item(BaseModel):
+    name: str
+
+
+async def get_item(item: Item) -> Item:
+    return item
+
+
+@app.post("/items")
+async def create(request: Request) -> str:
+    item = await resolve(get_item)  # the request body, parsed as FastAPI would
+    ...
+```
+
+A request parameter is a dependency of its own as well - resolve a marker, or an annotation carrying one, without writing a function around it. On its own it has no parameter name, so the marker says what to read; a marker without an alias raises `UnnamedParamError`:
+
+```python
+api_key = await resolve(Header(alias="x-api-key"))  # the raw header, as `Any`
+page = await resolve(Annotated[int, Query(alias="page")])  # validated as `int`
+item_id = await resolve(Annotated[int, Path(alias="item_id")])
+item = await resolve(Annotated[Item, Body()])  # the whole body needs no name
+
+
+@inject
+async def handler(*, api_key: Annotated[str, Header()] = Injected) -> str:
+    return api_key  # a parameter has a name - `x-api-key`, as FastAPI derives it
+```
+
+The body is read only when the resolved dependency declares one, and it is read once per request, shared with the route and every scope nested in it. When the route itself declares a body, dependencies see it in the shape the route gave it: a route with several body parameters embeds them under their names, and a dependency reads its own from there.
+
+`push_inject_scope(request=...)` accepts either a `Request` or a `WebSocket`, and so does everything that reads `InjectScope.request` — the union is `fastapi_injected.types.BoundConnection`.
+
 ## What is public
 
 Everything the package supports is importable from `fastapi_injected` itself, and that is the surface a release keeps:
@@ -338,10 +404,10 @@ Everything the package supports is importable from `fastapi_injected` itself, an
 | --- | --- |
 | Markers | `Dep`, `DepFactory`, `DepOf`, `Arg`, `Given`, `Injected` |
 | Resolving | `inject`, `resolve`, `bind_deps`, `signature_with_deps`, `remap_dep_args`, `clear_dependant_cache` |
-| Scopes and overrides | `InjectScope`, `push_inject_scope`, `inside_inject_scope`, `push_overrides`, `Overrides`, `OverridesProvider`, `ValueOverride`, `FactoryOverride` |
+| Scopes and overrides | `InjectScope`, `push_inject_scope`, `inside_inject_scope`, `synthetic_request`, `push_overrides`, `Overrides`, `OverridesProvider`, `ValueOverride`, `FactoryOverride` |
 | Building on top | `MakeDataclass`, `MakeInjected`, `HasDependsHook`, `ArgMarker`, `is_arg`, `is_dep`, `unwrap_dep_tp`, `unwrap_dep_dependency` |
 | FastAPI integration | `add_injected_scope`, `init_inject_scope` |
-| Errors | `DependencyResolutionError`, `MissedDependencyError`, `MissingDependencyCacheError`, `NotADependencyError`, `UnboundDepArgsError`, `UnboundScopeError` |
+| Errors | `DependencyResolutionError`, `MissedDependencyError`, `MissingDependencyCacheError`, `NotADependencyError`, `UnboundDepArgsError`, `UnboundScopeError`, `UnnamedParamError` |
 
 `fastapi_injected.types` holds the typing vocabulary the signatures are written in — `DepReturn`, `DepShape`, `DepDecl`, `AsyncFunc`, `Coro` and friends — and is public too. Anything else, including every module whose name starts with an underscore, is machinery that can change in a patch release.
 

{fastapi_injected-0.3.2 → fastapi_injected-0.3.6}/fastapi_injected/__init__.py

@@ -8,12 +8,13 @@ from .deps import (
     DependencyResolutionError,
     HasDependsHook,
     MissedDependencyError,
+    UnnamedParamError,
     clear_dependant_cache,
 )
 from .inject import inject
 from .overrides import FactoryOverride, Overrides, OverridesProvider, ValueOverride, push_overrides
 from .resolve import resolve
-from .scope import InjectScope, UnboundScopeError, inside_inject_scope, push_inject_scope
+from .scope import InjectScope, UnboundScopeError, inside_inject_scope, push_inject_scope, synthetic_request
 from .sign import NotADependencyError
 from .types import Arg, ArgMarker, Dep, DepFactory, DepOf, Injected
 
@@ -38,6 +39,7 @@ __all__ = [
     "OverridesProvider",
     "UnboundDepArgsError",
     "UnboundScopeError",
+    "UnnamedParamError",
     "ValueOverride",
     "add_injected_scope",
     "bind_deps",
@@ -52,6 +54,7 @@ __all__ = [
     "remap_dep_args",
     "resolve",
     "signature_with_deps",
+    "synthetic_request",
     "unwrap_dep_dependency",
     "unwrap_dep_tp",
 ]

{fastapi_injected-0.3.2 → fastapi_injected-0.3.6}/fastapi_injected/_bind.py

@@ -1,12 +1,13 @@
 import inspect
 from collections.abc import Callable, Sequence
 from functools import wraps
-from typing import Annotated, Any, Concatenate, overload
+from typing import Annotated, Any, Concatenate, get_origin, overload
 
 from fastapi.dependencies.utils import get_typed_signature
 from fastapi.params import Depends
 
-from ._deps_tp import is_dep
+from ._calls import annotated
+from ._deps_tp import unwrap_tp
 from .sign import update_func_sign
 from .types import AsyncFunc, DepOf, Func
 
@@ -33,16 +34,18 @@ def _dep_arg_index(name: str, /) -> int | None:
     return int(index) if index.isdigit() else None
 
 
+def _is_annotation(tp: Any, /) -> bool:
+    return get_origin(unwrap_tp(tp)) is Annotated
+
+
 def _dep_annotation(dep: DepOf[Any] | Callable[..., Any], /) -> Any:
     if isinstance(dep, Depends):
-        return Annotated[Any, dep]
+        return annotated(Any, dep)
 
-    # a marker is an annotation already, while a callable is a dependency the same way
-    # `resolve` takes one - anything else is left as it was written
-    if is_dep(dep) or not callable(dep):
+    if _is_annotation(dep) or not callable(dep):
         return dep
 
-    return Annotated[Any, Depends(dep)]
+    return annotated(Any, Depends(dep))
 
 
 def signature_with_deps(

fastapi_injected-0.3.6/fastapi_injected/_body.py

@@ -0,0 +1,108 @@
+import email.message
+import json
+from contextlib import AsyncExitStack
+from typing import Any
+
+from fastapi import Request, params
+from fastapi.dependencies.models import Dependant
+from fastapi.dependencies.utils import _get_flat_body_params, _should_embed_body_fields
+from fastapi.routing import APIRoute
+from starlette.datastructures import FormData
+
+from .types import BoundConnection
+
+type RequestBody = tuple[Any, bool]
+
+
+class InvalidBodyError(ValueError):
+    def __init__(self, errors: list[Any], /) -> None:
+        super().__init__(errors)
+        self.errors = errors
+
+
+def _is_json_content_type(content_type: str | None, /) -> bool:
+    if not content_type:
+        return False
+
+    message = email.message.Message()
+    message["content-type"] = content_type
+
+    if message.get_content_maintype() != "application":
+        return False
+
+    subtype = message.get_content_subtype()
+    return subtype == "json" or subtype.endswith("+json")
+
+
+async def _read_form(request: Request, /) -> FormData:
+    parsed = request._form is not None  # noqa: SLF001
+
+    form = await request.form()
+
+    if not parsed:
+        stack: AsyncExitStack = request.scope["fastapi_middleware_astack"]
+        stack.push_async_callback(form.close)
+
+    return form
+
+
+async def _read_body(request: Request, *, is_form: bool) -> Any:
+    if is_form:
+        return await _read_form(request)
+
+    if not (body := await request.body()):
+        return None
+
+    if not _is_json_content_type(request.headers.get("content-type")):
+        return body
+
+    try:
+        return await request.json()
+    except json.JSONDecodeError as exc:
+        raise InvalidBodyError(
+            [
+                {
+                    "type": "json_invalid",
+                    "loc": ("body", exc.pos),
+                    "msg": "JSON decode error",
+                    "input": {},
+                    "ctx": {"error": exc.msg},
+                },
+            ],
+        ) from exc
+
+
+def _body_shape(request: Request, dependant: Dependant, /) -> tuple[bool, bool] | None:
+    route = request.scope.get("route")
+
+    match route:
+        case APIRoute(body_field=body_field) if body_field is not None:
+            return (
+                isinstance(body_field.field_info, params.Form),
+                route._embed_body_fields,  # noqa: SLF001
+            )
+
+    if not (body_params := _get_flat_body_params(dependant)):
+        return None
+
+    is_form = any(isinstance(field.field_info, params.Form) for field in body_params)
+
+    return is_form, _should_embed_body_fields(body_params)
+
+
+async def request_body(request: BoundConnection, dependant: Dependant, /) -> RequestBody:
+    if not isinstance(request, Request) or (shape := _body_shape(request, dependant)) is None:
+        return None, False
+
+    is_form, embed_body_fields = shape
+
+    return (
+        await _read_body(request, is_form=is_form),
+        embed_body_fields,
+    )
+
+
+__all__ = [
+    "InvalidBodyError",
+    "request_body",
+]

{fastapi_injected-0.3.2 → fastapi_injected-0.3.6}/fastapi_injected/_cache.py

@@ -5,6 +5,7 @@ from typing import Any
 from fastapi.dependencies.models import Dependant
 from fastapi.types import DependencyCacheKey
 
+from ._calls import unwrap_proxy
 from ._dataclass import MakeDataclass
 from .types import DependencyCache
 
@@ -16,13 +17,14 @@ def overridden_calls(dependant: Dependant, overrides: Collection[Any], /) -> fro
     overridden: set[Any] = set()
 
     def _visit(dep: Dependant, /) -> bool:
-        is_overridden = dep.call is not None and dep.call in overrides
+        call = unwrap_proxy(dep.call)
+        is_overridden = call is not None and call in overrides
 
         for sub_dep in dep.dependencies:
             is_overridden = _visit(sub_dep) or is_overridden
 
-        if is_overridden and dep.call is not None:
-            overridden.add(dep.call)
+        if is_overridden and call is not None:
+            overridden.add(call)
 
         return is_overridden
 
@@ -30,6 +32,14 @@ def overridden_calls(dependant: Dependant, overrides: Collection[Any], /) -> fro
     return frozenset(overridden)
 
 
+def _cache_key(key: DependencyCacheKey, /) -> DependencyCacheKey:
+    # kept under the call a proxy stands for: the proxy is released once its resolve is
+    # done, the entry has to stay reachable for the rest of the scope
+    call, *rest = key
+
+    return (unwrap_proxy(call), *rest)  # type: ignore[ty:invalid-return-type]
+
+
 class ScopeCache(MakeDataclass, MutableMapping[DependencyCacheKey, Any]):
     cache: DependencyCache
     fallbacks: Sequence[tuple[Mapping[DependencyCacheKey, Any], frozenset[Any]]] = field(default_factory=tuple)
@@ -42,6 +52,8 @@ class ScopeCache(MakeDataclass, MutableMapping[DependencyCacheKey, Any]):
                 yield cache
 
     def __getitem__(self, key: DependencyCacheKey) -> Any:
+        key = _cache_key(key)
+
         try:
             return self.cache[key]
         except KeyError:
@@ -56,10 +68,10 @@ class ScopeCache(MakeDataclass, MutableMapping[DependencyCacheKey, Any]):
         raise KeyError(key)
 
     def __setitem__(self, key: DependencyCacheKey, value: Any) -> None:
-        self.cache[key] = value
+        self.cache[_cache_key(key)] = value
 
     def __delitem__(self, key: DependencyCacheKey) -> None:
-        del self.cache[key]
+        del self.cache[_cache_key(key)]
 
     def __iter__(self) -> Iterator[DependencyCacheKey]:
         seen = set(self.cache)

fastapi_injected-0.3.6/fastapi_injected/_calls.py

@@ -0,0 +1,192 @@
+import dataclasses
+import inspect
+import typing
+from collections.abc import Callable, Iterator, Mapping
+from typing import Any, get_args, get_origin
+
+from fastapi.dependencies.utils import get_typed_signature
+from fastapi.params import Depends
+
+from ._deps_tp import unwrap_tp
+
+
+def annotated(tp: Any, /, *metadata: Any) -> Any:
+    # `Annotated[...]` goes through typing's own cache, which holds on to the last
+    # aliases it built - and with them whatever value a runtime marker carries
+    return typing._AnnotatedAlias(tp, metadata)  # type: ignore[ty:unresolved-attribute] # noqa: SLF001
+
+
+def is_static_call(call: Any, /) -> bool:
+    # what source code wrote down lives as long as the process anyway, so caching
+    # by it keeps nothing extra alive - an instance or a closure may carry request data
+    if inspect.isclass(call):
+        return True
+
+    # a builtin bound to an instance, like `cache.get`, carries that instance along
+    if inspect.isbuiltin(call):
+        return call.__self__ is None or inspect.ismodule(call.__self__)
+
+    # `__qualname__` is what `functools.wraps` copied over, the code knows where it was defined
+    if inspect.isfunction(call):
+        return "<locals>" not in call.__code__.co_qualname
+
+    return False
+
+
+def _depends_metadata(annotation: Any, /) -> tuple[Any, list[Any]] | None:
+    annotation = unwrap_tp(annotation)
+
+    if get_origin(annotation) is not typing.Annotated:
+        return None
+
+    tp, *metadata = get_args(annotation)
+
+    return tp, metadata
+
+
+def is_static_annotation(annotation: Any, /) -> bool:
+    match _depends_metadata(annotation):
+        case (tp, metadata):
+            return all(
+                is_static_call(tp if meta.dependency is None else meta.dependency)
+                for meta in metadata
+                if isinstance(meta, Depends)
+            )
+        case _:
+            return False
+
+
+class CallProxy:
+    # what FastAPI is handed in place of a call made at runtime: its classification
+    # caches keep every call they are shown, and once released this is all they keep
+    __slots__ = ("_hash", "_proxies", "_signature", "call")
+
+    def __init__(self, call: Callable[..., Any], proxies: list["CallProxy"], /) -> None:
+        self.call: Callable[..., Any] | None = call
+        self._proxies = proxies
+        self._signature: inspect.Signature | None = None
+
+        try:
+            self._hash = hash(call)
+        except TypeError:
+            self._hash = id(call)
+
+        proxies.append(self)
+
+    @property
+    def __wrapped__(self) -> Callable[..., Any]:
+        # FastAPI unwraps a call to tell a coroutine from a generator, so it sees the
+        # real one - a released proxy has nothing left to show
+        if self.call is None:
+            raise AttributeError("__wrapped__")
+
+        return self.call
+
+    @property
+    def __signature__(self) -> inspect.Signature:
+        # FastAPI builds the dependencies of this call from its signature, so whatever
+        # was made at runtime among them is handed over behind a proxy as well
+        if self._signature is None:
+            sign = get_typed_signature(self.__wrapped__)
+            self._signature = sign.replace(
+                parameters=[self._detach_param(param) for param in sign.parameters.values()],
+            )
+
+        return self._signature
+
+    def __call__(self, *args: Any, **kwargs: Any) -> Any:
+        return self.__wrapped__(*args, **kwargs)
+
+    def __hash__(self) -> int:
+        return self._hash
+
+    def __eq__(self, other: object) -> bool:
+        # equal to the call it stands for, so it finds the same cache entries and overrides
+        if self.call is None:
+            return other is self
+
+        return self.call == unwrap_proxy(other)
+
+    def release(self) -> None:
+        self.call = None
+        self._signature = None
+        self._proxies = []
+
+    def _detach_depends(self, depends: Depends, /) -> Depends:
+        if depends.dependency is None or is_static_call(depends.dependency):
+            return depends
+
+        return dataclasses.replace(depends, dependency=CallProxy(depends.dependency, self._proxies))
+
+    def _detach_param(self, param: inspect.Parameter, /) -> inspect.Parameter:
+        if isinstance(param.default, Depends):
+            param = param.replace(default=self._detach_depends(param.default))
+
+        match _depends_metadata(param.annotation):
+            case (tp, metadata):
+                detached = [self._detach_depends(meta) if isinstance(meta, Depends) else meta for meta in metadata]
+
+                if any(new is not old for new, old in zip(detached, metadata, strict=True)):
+                    param = param.replace(annotation=annotated(tp, *detached))
+
+        return param
+
+
+class DetachedOverrides(Mapping[Any, Any]):
+    # an override replaces a call inside FastAPI, past where a proxy could be put on it,
+    # so the overrides of a resolve hand out what they hold behind one
+    __slots__ = ("_handed", "_overrides", "_proxies")
+
+    def __init__(self, overrides: Mapping[Any, Any], proxies: list[CallProxy], /) -> None:
+        self._overrides = overrides
+        self._proxies = proxies
+        self._handed: dict[int, CallProxy] = {}
+
+    @property
+    def dependency_overrides(self) -> Mapping[Any, Any]:
+        # FastAPI asks a provider for its overrides, and this is both
+        return self
+
+    def __getitem__(self, key: Any) -> Any:
+        override = self._overrides[key]
+
+        if is_static_call(override):
+            return override
+
+        if (proxy := self._handed.get(id(override))) is None:
+            proxy = self._handed[id(override)] = CallProxy(override, self._proxies)
+
+        return proxy
+
+    def __iter__(self) -> Iterator[Any]:
+        return iter(self._overrides)
+
+    def __len__(self) -> int:
+        return len(self._overrides)
+
+    def __bool__(self) -> bool:
+        # FastAPI takes the override path only when there are some, and asks at every step
+        return bool(self._overrides)
+
+
+def release(proxies: list[CallProxy], /) -> None:
+    for proxy in proxies:
+        proxy.release()
+
+
+def unwrap_proxy(call: Any, /) -> Any:
+    if isinstance(call, CallProxy) and call.call is not None:
+        return call.call
+
+    return call
+
+
+__all__ = [
+    "CallProxy",
+    "DetachedOverrides",
+    "annotated",
+    "is_static_annotation",
+    "is_static_call",
+    "release",
+    "unwrap_proxy",
+]