fastapi/fastapi
FastAPI's extension model is almost entirely composition and subclassing rather than registries. The three canonical hooks are `route_class` on `APIRouter` (swap `APIRoute` for a subclass overriding `get_route_handler`), `dependency_overrides` (a dict keyed by the original callable), and `exception_handlers` (a dict keyed by exception type or status code). Beyond those, `SecurityBase` is the contract for new auth schemes, `generate_unique_id_function` controls operation IDs for client generators, `default_response_class` and `response_class` control output encoding, and `openapi_extra` plus overriding `app.openapi()` let you post-process the schema. The `DefaultPlaceholder`/`Default()` sentinel is the mechanism that lets app → router → route parameter inheritance distinguish 'not set' from 'explicitly set to the default value'.
- `APIRouter(route_class=...)` accepts any `APIRoute` subclass; the documented pattern is to override `get_route_handler()` to wrap the returned coroutine, and `tests/test_custom_route_class.py` plus `docs_src/custom_request_and_route/` exercise it.
- New authentication schemes plug in by subclassing `SecurityBase` — a two-attribute protocol (`model: SecurityBaseModel`, `scheme_name: str`) — which `_is_security_scheme` detects via `isinstance` on the unwrapped callable to feed OpenAPI `securitySchemes`.
- `dependency_overrides` is the testing seam: any object with a `.dependency_overrides` dict can be passed as `dependency_overrides_provider`, and `solve_dependencies` rebuilds the `Dependant` from the substitute callable so its own parameters are resolved.
- `exception_handlers` is a mutable dict keyed by exception class or the ints 500 / `Exception`; `build_middleware_stack` splits the 500/`Exception` entry out as `ServerErrorMiddleware`'s handler and hands the rest to `ExceptionMiddleware`.
- `generate_unique_id_function` (default `generate_unique_id`, which slugifies `route.name + path_format + method`) is inheritable app → router → route and is the hook for client-generator-friendly operation IDs.
- The `DefaultPlaceholder` / `Default()` pattern plus `get_value_or_default` is how a router's setting overrides an app's only when explicitly provided — `Default(JSONResponse)` is not the same as passing `JSONResponse`.
- `_RouterIncludeContext.for_include` and `.combine` are the single place where inherited router attributes (prefix, tags, dependencies, responses, callbacks, deprecated, include_in_schema, unique-id fn, strict_content_type) are merged — new inheritable router options must be added to both methods.
- `_low_priority_routes` on `APIRouter` is a general extension slot, not frontend-specific: `frontend()` appends a `_FrontendRouteGroup` to it, and `_match_low_priority` consults the list only after normal matching and redirect-slashes handling fail.
- Custom response encodings plug in by subclassing `starlette.responses.Response` and passing it as `response_class`; `EventSourceResponse` is itself just such a marker subclass, detected with `lenient_issubclass(actual_response_class, EventSourceResponse)`.
- OpenAPI can be extended at three levels: per-operation `openapi_extra` on a route, whole-document post-processing by reassigning `app.openapi`, and swapping the `openapi_url`/`docs_url`/`redoc_url` routes by passing `None` and registering your own.
- `jsonable_encoder` accepts `custom_encoder` and `sqlalchemy_safe`, and the class→encoder mapping is precomputed by `generate_encoders_by_class_tuples(ENCODERS_BY_TYPE)`, which is the hook for adding new type serializers.
- Middleware plugs in three ways: the `middleware=[Middleware(...)]` constructor argument, `app.add_middleware(...)`, and the `@app.middleware("http")` decorator which wraps the function in `BaseHTTPMiddleware`.
- For agent tooling specifically, the extension point is `fastapi/.agents/skills/fastapi/` — adding a new `references/*.md` page and linking it from `SKILL.md`'s Quick Reference list is how new guidance is surfaced, and the directory ships inside the installed package. (inferred)