#Changelog

#Unreleased

#Fixes

• **stop() no longer reports a killed server as running.** After escalating to SIGKILL it now waits for the kill to actually land, so status(), list_instances() and check_already_running() called right after a stop tell the truth instead of seeing the corpse's PID.

#0.6.0

Graceful background-server shutdown, two new documentation guides, and a declared strictcli floor.

#Features

• Two new documentation guides. An observability guide (request IDs, timing middleware, the error log and the audit log) and a tasks-and-features guide (background task lifecycle and feature flags), plus live extras and middleware tables that are generated from the source rather than hand-maintained.

#Fixes

• **The fastware dev CLI works again on current strictcli.** It was pinned three releases behind and hard-errored at registration under 0.36.0; all three commands now declare their effect classification and use the framework's ctx-first handler signature.
• **fastware now declares strictcli>=0.36.0.** The CLI's effect classification requires it, so an environment resolving an older strictcli used to hard-error at command registration instead of being fixed by the resolver.
• **stop() now shuts a background server down gracefully instead of always killing it.** A server started with serve_background() became a zombie in the caller's process table on exit, and every liveness probe (kill -0) reported it as still running -- so stop() waited out its full 10-second grace window and escalated to SIGKILL every time, status() reported a dead server as running, list_instances() kept returning it, and check_already_running() refused to start a replacement.

#0.5.0

Streaming client-disconnect detection, the /__fastware/ runtime namespace (version endpoint, cache headers, blessed service worker, live update channel), an instance registry with presence markers, and the file-driven fastware dev CLI.

#Features

• Version endpoint and static-asset caching. Every app now serves /__fastware/version returning an opaque build_id (a content hash of the static assets, stable across mtime changes) plus the app name when configured. Static serving also gained cache headers: hashed Vite-style assets (name-<hash>.ext) get Cache-Control: public, max-age=31536000, immutable, while unhashed assets, index.html, and the SPA fallback get no-cache.
• Instance registry. Server instances now register a JSON descriptor (PID, port, name) so peers can enumerate running instances via list_instances(), with register_instance()/deregister_instance() for lifecycle and automatic stale-entry pruning on read.
• Blessed service worker. Apps that serve a frontend now choose an explicit sw_mode (cache, reset, or off). cache serves a generated worker at /__fastware/sw.js (per-build cache name, network-first shell, cache-first hashed assets, never intercepting API/SSE/WebSocket/reserved paths) plus a /__fastware/sw-register.js snippet with foreign-worker detection; reset serves a self-destruct worker at both the reserved path and legacy registration paths (legacy_sw_paths) to free clients with a stale worker; off disables it. sw_mode is mandatory with a frontend and forbidden for API-only apps.
• Live update channel. Every app now exposes an SSE update channel at /__fastware/events (each connection primed with the current build id) and a dependency-free /__fastware/client.js that reloads the page once when the build id changes, preserving form fields and app-registered state across the reload.
• fastware dev CLI. New fastware dev run|status|stop commands drive a file-driven [tool.fastware.dev] Vite + backend development environment: pre-spawn gates, health-gated aux services, topology ordering (backend-first/vite-first), process-group supervision with graceful-then-kill teardown, and an optional --daemon mode registered in the instance registry.
• Presence-marker registry API. New write_marker/list_markers/remove_marker helpers on the instance registry for lightweight per-file cross-process signals (e.g. window refcounting, focus requests) that live beside instance descriptors.

#Fixes

• Streaming disconnect detection. Streaming handlers now detect client disconnects: a single receive-owning watcher cancels abandoned stream generators so their finally cleanup runs, fixing resource leaks (DB sessions, queues) on streams the client walked away from. request.is_disconnected() is reliable in streaming and non-streaming handlers, and DI-provided resources stay alive for the whole stream body.
• Service worker cache-retirement guidance. The sw_mode validation error and docs now spell out the mandatory cache -> reset -> off migration route, warning that switching a cache worker straight to off strands clients (a 404'd worker script never unregisters).
• dev SW-mode guard notice. fastware dev run now prints a one-line stderr notice when it skips the service-worker cache guard for a cmd-form backend (which cannot be introspected for sw_mode), instead of skipping silently.
• Granian embed stability. The embedded Granian server is pinned to a compatible API range (>=2.7,<3.0) to guard against upstream breaking changes, and no longer emits Granian's experimental-API warning at startup.

#0.4.0

Embedded async server for background mode with graceful shutdown

#Features

• New feature. Background serve (foreground=False) now uses embedded async server, fixing hang/stop/fork issues. New stop_background(url) function cleanly shuts down background servers.

#0.3.1

Fix CI so the 0.3.1 publish gate can pass: 0.3.0 was blocked because test dependencies (pyjwt, bcrypt, structlog, watchfiles, websockets, mcp, pydantic) were missing from the dev group and CI's uv sync --locked never installed them.

#Infrastructure

• Fix CI so the 0.3.1 publish gate can pass: 0.3.0 was blocked because test dependencies (pyjwt, bcrypt, structlog, watchfiles, websockets, mcp, pydantic) were missing from the dev group and CI's uv sync --locked never installed them.

#0.3.0

Server, testing, and serialization hardening: pinned event loop with loop/workers config on serve(), test-client exception re-raise plus pytest-collection fix, msgspec-native json_as, and a broad sweep of ASGI correctness, auth, middleware, SSE, WebSocket, routing, DI, and static-file fixes.

#Breaking

• check_already_running() no longer accepts the unused name parameter
• Breaking. fastware.mcp no longer ships built-in ROLES/DEFAULT_ROLE; register_tools_for_role and create_mcp_server now require an explicit roles mapping, the SA_ROLE env fallback is gone, and the mcp package is imported lazily (faster import fastware.mcp)
• **Pinned event loop on serve()/serve_background().** New loop parameter ("asyncio" default, or "uvloop"/"rloop") and workers parameter. The effective default changes from Granian's auto (which silently switches loops when rloop/uvloop are installed) to a pinned asyncio, keeping subprocess-based workloads predictable.
• **raise_server_exceptions on the test clients.** AsyncTestClient/TestClient now re-raise unhandled handler exceptions into the test by default (matching Starlette). Pass raise_server_exceptions=False to restore the previous behaviour where exceptions become a 500 response.
• Query-param JWT acceptance is now opt-in via allow_query_token (default off); tokens supplied in the query string are rejected unless explicitly enabled.
• Breaking. The internal ParsedSegment type is no longer exported from the top-level fastware package; import it from fastware.routing if you still need it.

#Features

• **request.json_as now decodes msgspec.Struct bodies natively.** When the target type is a msgspec.Struct subclass, json_as decodes via msgspec (the framework's fast path); other types still use Pydantic. Decode failures raise HTTPError(422) in both branches.
• Dev/Vite proxy improvements: ViteDevProxy streams HTTP responses (honoring backend_prefixes) instead of buffering, /ws WebSocket upgrades route to the backend in dev mode via the newly exposed backend_prefixes option, and proxy WebSocket failures close with code 1011 instead of being swallowed.
• HTTP method handling: unmatched methods return 405 with an Allow header, HEAD is served through the matching GET handler with an empty body, and allowed_methods is exposed for 405 responses.
• Request bodies are capped at a configurable max_body_size (returning 413 when exceeded), and body chunks accumulate without O(n^2) concatenation.
• ASGI lifespan support: startup/shutdown events forward to mounted sub-apps with merged lifespan state, lifespan.startup.failed/lifespan.shutdown.failed are emitted on errors, and the test clients run the full lifespan protocol.
• Performance: query strings are parsed once and cached, handler accepted-parameter sets are precomputed at app creation (no per-request inspect.signature), and single-header lookups use a linear scan instead of building a full header dict.
• Error-log SQLite writes are offloaded to a background worker thread, so recording errors no longer blocks the event loop.

#Fixes

• serve_background readiness no longer requires a /health route: any HTTP response (including 404) counts as server-ready
• **Callable targets now work with serve_background and serve(reload=True).** Module-level callables are materialized as importable shim modules for the spawned server process; non-importable callables (locals, lambdas, __main__) raise a clear error immediately instead of crashing the child
• ensure_port_available no longer kills a port holder based on its /health response body; it only stops a process whose PID matches the server's own PID file
• stop() now signals the server's whole process group (when the server leads it), so granian workers terminate with the main process
• A foreground serve() after a background serve() in the same process no longer silently loses SIGTERM/SIGINT handling
• Single-instance serve() creates the PID file atomically (O_CREAT|O_EXCL), so two concurrent starts can no longer both pass the already-running check
• fastware.types declares __all__ again -- from fastware.types import * no longer leaks Any/Awaitable/Callable/annotations
• **No more PytestCollectionWarning from TestClient.** Both test client classes set __test__ = False, so importing TestClient into a test module no longer emits a pytest collection warning.
• SSE hardening: subscriber queues register on iteration start (no leak), multi-line event data is emitted as repeated data: lines, and event data is serialized via msgspec.
• WebSocket handlers close with the correct codes (1008/1011) on dependency failures, and accept() handles a client disconnect before the handshake instead of sending a spurious accept.
• Auth hardening: verify_token catches only jwt.InvalidTokenError, hash_password rejects passwords over the bcrypt 72-byte limit, user-store writes are atomic with locked read-modify-write, and rate_limit evicts stale buckets while preserving the handler signature.
• CORS middleware rejects a wildcard origin combined with credentials, adds Vary: Origin, and gates preflight handling on Access-Control-Request-Method.
• TrustedHost validates the Host header on WebSocket scopes, rejecting disallowed hosts with close code 1008.
• Response and disconnect handling: never emit a second http.response.start after streaming begins, is_disconnected no longer drops messages or masks errors, and exception-handler dispatch is guarded when receive() fails before a request is bound.
• Dependency injection fixes: generator-dependency cleanup errors are logged instead of silently swallowed, dependencies that yield more than once raise RuntimeError, and factories with only keyword-only parameters are no longer mis-called with a positional request.
• Static file serving: fixed a path-traversal hole where sibling-prefix directories escaped the startswith guard, and file reads (static, FileResponse, SPA) are offloaded via asyncio.to_thread.

#0.2.0

ASGI sub-app mounting via Router.mount(), WebSocketDisconnect exception, benchmark suite, and a new documentation site.

#Features

• New. ASGI sub-app mounting via Router.mount() for composing multiple routers.
• New. WebSocketDisconnect exception and automatic disconnect detection in WebSocket receive methods.
• New. Benchmark suite comparing fastware vs FastAPI (serialization, import time, throughput).
• New. Documentation site (guides, quickstart, API reference, framework comparisons) deployed via Cloudflare Pages.

#0.1.0

Initial release of fastware, a fast batteries-included ASGI framework.

#Features

• Initial release. ASGI micro-framework: Router, Request/Response types, WebSocket, SSE broadcaster, middleware (CORS, RequestID, RequestTiming, TrustedHost, ViteDevProxy), Granian server lifecycle, dependency injection, auth (JWT, passwords, CSRF), structured logging, background tasks, feature flags, MCP server support, and test client utilities.