[github-actions]

Changepacks

vespera@0.8.0 → 0.8.1 - crates/vespera/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_core@0.8.0 → 0.8.1 - crates/vespera_core/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_inprocess@0.8.0 → 0.8.1 - crates/vespera_inprocess/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_jni@0.8.0 → 0.8.1 - crates/vespera_jni/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_macro@0.8.0 → 0.8.1 - crates/vespera_macro/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera-bridge@0.8.0 → 0.8.1 - libs/vespera-bridge/build.gradle.kts

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera-bridge-gradle-plugin@0.8.0 → 0.8.1 - libs/vespera-bridge-gradle-plugin/build.gradle.kts

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).