[owjs3901]

Round-6 audit fixes for the macro crate. This PR covers the schema-macro findings (M1-M3, L1-L4) and the rest of the macro findings (M1-M3, L1-L11). L12 was skipped on purpose. Every fix has a test that failed first: rstest/insta cases, and a trybuild UI case for the new compile error.

Multipart and serde defaults

• macro-rest M1 / L5: #[derive(Multipart)] now follows serde's rules for missing fields.
  • A container #[serde(default)] or default = "fn" fills each missing field from the container value. It used to fall back to the field type's Default.
  • A field's default = "fn" now also applies to Option and Vec fields.
  • A skipped field takes the container's value.
  • A default fn named after a field is no longer shadowed by the field's local.
  • Behaviour change: a container #[serde(default)] now needs the struct to implement Default, as serde already requires. The axum-example test fixture gained #[derive(Default)].
• schema M3: schema_type!(..., multipart) now keeps these source attributes:
  • the source's serde default / default = "fn" (re-rooted), skip and skip_deserializing;
  • #[try_from_multipart(..)];
  • the container default, through a generated helper that builds the DTO from the source's default. The helper is not generated when add or relations are used.
• schema M1 / macro-rest L6: a #[serde(default = "fn")] function is looked up from the struct's own inline mod, through self:: / super:: / child paths, and through crate:: paths (the paths schema_type! re-roots to). Before, a schema_type DTO of a source with a default fn was rejected.
• schema M2: get_type_default now covers usize, isize, i128, u128, Vec, VecDeque, HashSet, BTreeSet, HashMap, BTreeMap and SeaORM's Date. A bare #[serde(default)] on these types no longer fails the derive.
• schema L3: a DateTimeLocal / DateTime<Local> NOW() default no longer documents a fixed +00:00 value.

schema! / schema_type! source lookup

• schema L1: a source declared in an inline mod now resolves its field types through that module. This used to fail with E0412/E0425.
• schema L2: sources are matched by their Rust identifier, not by the schema name.
• schema L4: the metadata registered for ignore, name = ".." now keeps the struct docs. In multipart mode it uses the multipart container attributes instead of the serde-mode ones.

Routes / export

• M3: a path parameter and a catch-all at the same position are now a compile error, and so is a segment after a catch-all. axum panics on both when the router is built. This also applies to merged child specs.
• M2: chained export namespace renames no longer overwrite one schema with another.
• L4: export prefixes must be static paths.
• L8: the unsupported-method message lists all eight methods.
• L2: a generic responses type in #[route] is now a compile error, because the type arguments would be silently dropped.
• L3: route errors are emitted as statements ahead of the router chain.

Other

• L1: garde integer bounds are emitted exactly, including the i64 / u128 extremes and values above 2^53. The fix is in garde_emit only; the OpenAPI number is still an f64.
• L7: removed the dead is_file_field_type.
• L9: the orchestrator tests now assert their outcomes.
• L10: measure-stress.ps1 clears the vespera target.
• L11: sync-landing-versions replaces each capture at its own position.

The #[schema(default = "light")] workaround in examples/axum-example/src/models/profile.rs is removed, and openapi.json is unchanged.

No files under parser/**, vespera_core, vespera_inprocess or vespera_jni were edited.

🤖 Generated with Claude Code

[github-actions]

Changepacks

vespera@0.8.0 - Cargo.toml

Maybe you forgot to write the following files to the latest version

vespera@0.8.0 → 0.8.1 - crates/vespera/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_core@0.8.0 → 0.8.1 - crates/vespera_core/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_inprocess@0.8.0 → 0.8.1 - crates/vespera_inprocess/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_jni@0.8.0 → 0.8.1 - crates/vespera_jni/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera_macro@0.8.0 → 0.8.1 - crates/vespera_macro/Cargo.toml

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera-bridge@0.8.0 → 0.8.1 - libs/vespera-bridge/build.gradle.kts

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).

vespera-bridge-gradle-plugin@0.8.0 → 0.8.1 - libs/vespera-bridge-gradle-plugin/build.gradle.kts

Patch

• vespera-bridge audit fixes: a non-web Spring Boot app without spring-web starts again (the core autoconfiguration no longer loads PathPatternParser); on virtual threads SmartDispatchModeResolver streams the response of safe requests (like DIRECT's overflow stash on platform threads) instead of buffering it, so large downloads and Accept-less event streams work (opt back into parking SYNC with new SmartDispatchModeResolver(direct, sync, true)); 1xx / 204 / 304 responses no longer carry Content-Length: 0; unpaired UTF-16 surrogates in wire header strings are encoded as U+FFFD instead of a \uD800 escape the Rust parser rejects; a prefix-mapped DispatcherServlet path is stripped from the forwarded path by decoded segments (%61pi, //, dot segments, %2F); an ASYNC dispatch that hits Spring's async timeout answers the proxy's plain-text 503 with the request id instead of the /error page; the springdoc group-mode document endpoint is mapped from the normalized docs-path (trailing slash, blank) and a root or pattern docs-path fails the startup clearly; dispatchDirectPooled / BufferTooSmallException / DispatchMode / VesperaClient docs describe the overflow stash and poll-first parking.
• vespera-bridge: multipart uploads through the servlet proxy now reach Rust byte-for-byte. The multipartResolver bean is wrapped in VesperaProxyMultipartResolver so DispatcherServlet no longer parses (drains) proxied multipart requests and Spring's multipart size limits no longer apply to them; Spring controllers keep normal multipart handling (opt out: vespera.bridge.multipart-passthrough=false). A multipart body consumed before the proxy is answered 500 with a clear message instead of being forwarded empty.
• vespera-bridge round-5 fixes: the async response executor bean no longer suppresses Boot's applicationTaskExecutor; POMs and JARs declare/ship the Apache-2.0 license; WebFlux streams bodyless GETs with a wildcard Accept (event streams no longer buffer forever); ASYNC bodies are written byte for byte (no Content-Disposition, no Spring 304/412); malformed Content-Type reaches Rust; loader, platform detection, config parsing, streaming executor, validation errors, DIRECT stash, client stream/header hardening; workflow template supports a Gradle build in a subdirectory
• vespera-bridge: a VesperaRequest InputStream body whose read fails is a VesperaClientException; the proxy honours a SmartDispatchModeResolver subclass; oversize-policy=throw streams the request once instead of a 500 or a false overflow; ASYNC HEAD has no body object; async CORS dedupe and reset keep the filter headers; explicitly configured native knobs count after init; shutdown(Duration) no longer overflows; springdoc spec-paths keys with underscores bind, merged components rename consistently, public Rust operations do not inherit the host's security, and native images register the docs mapping hint; docs and weak tests fixed
• vespera-bridge: the WebFlux proxy strips ;path parameters like the servlet proxy; WebFlux cors=spring applies WebFluxConfigurer#addCorsMappings to proxied paths (preflights answered by Spring); vespera.native.dir works with a missing or read-only java.io.tmpdir; ASYNC responses without a Rust Content-Type no longer get one from Accept, and ASYNC proxy errors echo the request id
• OpenApi::merge pushes a merged document's top-level security / servers down onto its own operations instead of adopting them for every operation; a nullable schema whose oneOf / allOf / not / anyOf rejects null is wrapped in anyOf [schema, null] even when it has a type; JNI async dispatch symbols moved to their own module (no behaviour change)
• Docs: the JNI demo build steps publish the bridge and the Gradle plugin to mavenLocal (as CI does); extractor tables document Form on GET/HEAD as query parameters and TypedHeader names derived from T; naive date/time and unit return mappings corrected; the landing site gains 0.7 / 0.8 migration notes, WebFlux / forwarded principal / reactive-streaming / max-request-producers / springdoc UI exclude docs and a C ABI page; SKILL.md covers serve_listener. No API change.
• C ABI: vespera_dispatch_async releases its async in-flight slot before invoking the callback (as JNI dispatchAsync does), so a callback that dispatches again is no longer answered 503 at the cap
• schema_type!/schema! audit: field types, serde function paths and relation paths resolve in the source module; sources found in crate roots, inline and #[path] modules; storage hits must match the requested module; relation loads select by the target FK column and fail loudly when unresolvable; adapter wrappers implement Clone/Deserialize and convert in from_model; field schema/garde/deprecated/cfg attributes are carried; type-correct NOW() defaults; primary_key with auto_increment = false is not a default; raw identifiers and non-identifier names no longer panic; split rename_all is kept; tuple/unit sources are rejected; generic sources take the macro's type arguments; schema! validates pick/omit names and filters flattened structs; relation_adapters, rename and partial entries are validated with diagnostics at the offending literal
• schema_type!: module-aware SeaORM relations, cycles and lookups (crate roots, tests/examples/bin targets, call-site imports), generic sources resolve call-site arguments and defaults correctly, shared relation adapters with serde container conversions, cfg_attr serde / deprecated / raw names carried, naming a dropped field is a compile error, typed SeaORM defaults
• Gradle plugin: a native-jar consumer (crateName + bundleNative = false, no cargoRoot / targetDir) no longer fails tasks --all, IDE sync or tasks.withType<Sync>().configureEach {} with "Cannot query the value": bundleNativeLib / verifyNativeLibs resolve the cdylib location lazily and verifyNativeLibs names the missing setting only when it runs. cargoProfile "test" bundles from target/debug and "bench" from target/release, where Cargo writes them.
• vespera-bridge-gradle-plugin: a build with no cdylib (and no extraNativeLibs) now fails in the new verifyNativeLibs task instead of silently producing a jar without a native library; a host platform key mapped to a musl triple keeps the host build in native//
• vespera_inprocess: a bidirectional request body that outlives its dispatch (moved into a detached task) no longer reads the host source after the dispatch returned; a stopped response sink is traced as a client disconnect (status 499, DEBUG) inside the dispatch span instead of an ERROR 500; app names are trimmed with ASCII-only whitespace everywhere (matching the compile-time checks); vespera.h and API docs corrected
• C ABI: vespera_dispatch_into answers an out buffer below VESPERA_MIN_OUT_BYTES (1024, NULL/0 size probe included) with VESPERA_OVERFLOW and *written = 1024 without running the handler, so a panic/timeout/shutdown error never forces a re-run; an oversized request_len is a 400 wire regardless of buffer addresses; bench header ladder respects MAX_REQUEST_HEADERS; stronger streaming/inline-pull tests and refreshed docs
• JNI: panic fallbacks of the void symbols actually run (panic wire / completed future instead of a swallowed panic); dispatchFullStreaming no longer flushes the caller's stream on flush hints; a panic after body bytes in the non-header streaming symbols throws VesperaStreamAbortedException(panicked); a DirectStash fetch panic answers a 500 panic wire instead of looking expired; dispatchAsync releases its in-flight permit before completing a future on the calling thread
• vespera! / export_app! build files: the library, a binary, the cargo test harness and rust-analyzer get separate cache and sidecar files, so one build no longer prunes the include_str! file another still reads; the target directory is read off rustc's --out-dir (dependencies and a relative CARGO_TARGET_DIR agree with the parent; VESPERA_TARGET_DIR overrides it); openapi.json and exported specs never describe #[cfg(test)]-only routes or schemas, so every build writes the same file; one path spelled with different parameter names (/{id} vs /{user_id}) and docs_url / redoc_url / spec_url colliding with an app or merged route are compile errors; undeclared security schemes are checked without a generated document; an ambiguous merge path lists the exporting crates; stale rust-analyzer route / cron entries of renamed handlers are ignored; sibling symlinked route directories are scanned; cron jobs outside src/ get real module paths or a clear error; two #[derive(Multipart)] fields reading one multipart field are a compile error.
• Schema validation: portable usize bounds (32-bit targets), minimum/maximum checked against the integer field type (compile error instead of a wrapping cast; fractional bounds round inward), and 422 error paths use the serde deserialize name. Multipart derive: every form_data / try_from_multipart key is read in any order, an invalid or overflowing limit is a compile error, serde(skip) / skip_deserializing fields default instead of being required, and generic structs are supported.
• OpenAPI request/response accuracy: OptionalQuery, WithRejection and Cached extractors are documented; Option<Path> types path params; Query/Path structs follow serde from/try_from and Option fields with a custom deserializer are required; Path maps/sequences type each segment; empty query structs no longer emit a fake parameter; response parts (CookieJar, HeaderMap, header arrays, AppendHeaders, TypedHeader, Extension) carry no body; Json<(A, B)> is a JSON array; error tuples document their payload; Box/Cow are text/plain, Cow<[u8]>/[u8; N] octet-stream; NoContent is 204 and Redirect 3XX; unresolved types inside Result are description-only; the Schema check no longer flags foreign paths like serde_json::Value and now checks Path; alias defaults may reference earlier parameters.
• Fix round-5 macro parser findings: serde default/skip/flatten detection after other keys and in literals, schema(default) lookup, transparent structs per serde side, Result and HasMany schemas, enum deny_unknown_fields, flattened maps and Option in request views, Cached<Validated<..>> 422, generic Query/Path structs, Path pairs/alias/flatten, raw identifiers, module-qualified renamed types, serde_repr enum matching by position, codec/value_type internally tagged newtypes, Option<Path> checks and the route dir mod.rs module path
• Fix round-6 macro parser findings: request-view parameters, transparent and from/try_from query/path extractors, value_type internally tagged newtypes, serde_repr and serde(other) request schemas, annotation-only garde rules, recursive generic definitions and colliding instance names, deny_unknown_fields with map-bearing flatten, flattened unit structs and unit variants, Result error status keys and Infallible errors, nested response tuples, scoped Result alias resolution, fast-path extractor checks, declared 4xx/2xx statuses and 205 bodies, wide integer examples, decorated block docs, schema(ref) with nullable or value_type, BelongsTo relations, user schemas named Json, and generic parameters inside value_type/into/from
• OpenAPI request extraction fixes: Result<Extractor, Rejection> arguments are documented like the bare extractor (required body / query / path / header params; Result<Validated<..>> still asserts garde::Validate); Option<Form> and Result<Form, _> on GET become query parameters; a Path<(..)> tuple longer than the route's own params (nest prefix) is aligned from the end; a parameter after a static prefix (/report-{year}) is documented, text after a parameter (/img/{name}.png, which axum cannot route) is a compile error, and escaped literal braces {{x}} are no longer a parameter (documented as %7Bx%7D).
• Multipart missing fields follow serde: a container #[serde(default)] / default = "fn" fills them from the container value (the struct now needs Default, as with serde), a field default = "fn" also applies to Option / Vec fields; schema_type!(..., multipart) keeps the source's serde default / skip keys, container default and #[try_from_multipart(strict)]; serde default functions resolve from the struct's inline module and through crate:: paths; route param vs catch-all conflicts and segments after a catch-all are compile errors; generic #[route] responses types are rejected; export namespace renames no longer swap schemas; garde integer bounds are exact; schema!/schema_type! find a source by its Rust name and inside inline modules; collection / wide-integer / Date serde defaults are documented; DateTimeLocal NOW() no longer documents a fixed default
• Router codegen and build cache: duplicate (method, path) routes and routes overlapping a merged child app are compile errors (with or without a spec); export_app specs are crate-scoped, merge resolves use aliases and checks the merged app at compile time; include_str sidecars are content-addressed and written atomically; route(path = "/") maps to the file path without a trailing slash; unknown route keys list the valid ones; duplicate tags / security_schemes are errors and declared tags keep their order; dir must be a module folder under src/ (nested "api/v1" supported); symlinked route files are followed; src/.rs edits and inline-module handlers are tracked; cron jobs in src/bin crates get their real module path.
• Schema fidelity: a struct #[serde(tag)] is documented as a required tag property in the response view (left out of the {Name}Input request view, since serde never reads it); Option of a type-less inline schema (oneOf / allOf) keeps null via anyOf, and Option of an inline string enum lists null; multipart field names use form_data(field_name) before serde rename in the request view, and the Multipart derive reads the deserialize-side serde rename / rename_all
• Runtime/core fixes: shutdown_runtime(Duration::MAX) no longer panics after closing the gate (the runtime is shut down and cleanup runs); a whole-number constraint of exactly 2^63 is emitted as a float instead of saturating to i64::MAX; Schema deserializes JSON Schema boolean schemas (true -> {}, false -> {"not":{}}) in components.schemas and $defs, and the OpenAPI 3.0 boolean exclusiveMinimum / exclusiveMaximum (true moves minimum / maximum into the 3.1 exclusive bound); OpenAPI 3.1 fields no longer dropped on deserialize: Components pathItems / links / callbacks, Response links, Header required / deprecated / style / explode / example / examples / content, Parameter deprecated / allowEmptyValue / allowReserved / examples / content, Example externalValue, and x-* extensions on OpenApi / Info / Operation / PathItem (new public fields; Parameter / Response / Header / Example / OpenApi now implement Default, use ..Default::default() in struct literals); JNI dispatchDirect0 answers an out buffer below MIN_DIRECT_OUT_BYTES (1 KiB) with -(1024) without dispatching, so a panic / timeout wire always fits and a retry never re-runs a failing handler; the cancel registry hasher spreads sequential tokens (Fibonacci multiply); doc fixes (streaming dispatch_timeout scope, Validated 422 builder, envelope API limits).
• Generated schemas now match what serde writes and reads: flattened maps, closed, unit and Option structs merge into one object; alias and other are accepted in request schemas; tuple fields honour codecs and one-sided skips; time crate types, sets, Duration, schema(any), generic defaults and instance names are fixed.
• CI/release hardening: release-artifacts.sh isolates every per-package step (a failed SBOM no longer drops all attestations) and verifies each published crate was packaged from the released commit; Gradle wrapper validation + distributionSha256Sum; tarpaulin image pinned by digest; bench gates fail when nothing was measured and trigger on toolchain/lockfile changes.
• Cron jobs sleep in slices of at most 60 s and re-read the wall clock, so a suspend or forward clock step no longer delays a run by the remaining monotonic time; cron::shutdown_and_wait needs no Tokio time driver (returns at once when idle); a cron expression with no occurrence left now logs a warning. vespera_core: nullable enums list null, a nullable schema without type or $ref whose oneOf/allOf/not/anyOf rejects null serializes as anyOf [schema, null], Operation.callbacks is callback name -> runtime expression -> PathItem (new Callback alias), SchemaRef deserializes boolean schemas (true as {}, false as {"not":{}}), OpenApiVersion adds 3.0.4, 3.1.1 and 3.1.2. Multipart errors echo part names bounded to 64 chars with control characters escaped; the DefaultBodyLimit docs now match axum (the extractor applies it on every transport, 2 MB by default).