Baixar Vayu 0.18.0 per a Windows

0.18.0 - 2026-08-16
The OpenAPI release. v0.17.0 could read a spec and make requests out of it; the document was then thrown away, so nothing downstream knew a contract existed. A collection now binds the document it answers to, every request remembers which operation it is, and that identity is what the rest of the release is built on: re-fetch and diff the spec, apply the diff selectively in one transaction, export the collection back out as a document, and judge what came back against the schemas the spec declares - in design mode, in a collection run and over a load run's samples - beside a coverage block saying which of the contract a run actually exercised. Streams grow the other half they were missing (a load run may now consume text/event-stream, with events on its sampled captures), a single Send can carry one data row, and a live response can be saved as an example. The bulk of the change is new TypeScript in the app, with the validator, the coverage tally and the streaming load path landing engine-side.
Added
- A collection binds the spec it came from, and every request knows its operation. An OpenAPI import now stores the document verbatim in a new spec_documents table with an engine-computed hash, binds it to the root collection, and stamps each request with the operation it is (operationId when declared, plus the method and the templated path). A document is bound rather than owned - several collections may bind one, so nothing cascades to it and deleting a spec that a collection still holds is a 409 naming the binder. There is no PUT /specs/:id on purpose: a changed document is a new one, because rewriting in place would invalidate the hash every run of every bound collection was stamped with. A Spec tab shows the binding, unbinds it, and binds a collection that was never imported from a spec by matching operations to existing requests on method and path shape, disclosing the counts on both sides before anything is written.
- Sync: re-fetch a bound spec, see exactly what moved, apply only what you tick. The Spec tab re-reads the document from the origin the binding stored and reports the three buckets - added, changed, removed - as a checklist, with "up to date" meaning byte equality against the stored document rather than a second opinion computed in the renderer. An operation is followed by its operationId first and its path shape second, so a path moved under a stable id and an id moved under a stable path each stay one operation, while both-moved is disclosed as a removal plus an addition rather than guessed at. A field you edited yourself is flagged three-way and is never overwritten unless you tick it, and a deletion is never a default. Applying sends one POST /specs/sync that the engine performs as a single transaction over the document, the binding and the created, updated and deleted requests; the bound subtree is the boundary, so the route cannot become a way to delete an arbitrary row by id. On an update, only origin="import" examples are replaced - examples you saved survive untouched and keep their position, which is what a mock server answers with.
- Importing a document a collection is already bound to offers Sync. It used to make a second collection from scratch, without the bound one's operation identities, saved examples or coverage history, and with nothing anywhere saying the first existed. Import now looks the document up before it writes anything, by stored source_url or by the bytes, and names the collection it found. Import anyway is still there beside it: a second copy of a spec is a real thing to want, so this is a fork and never a block.
- Response schema validation, on all three execution paths. The app extracts what a document declares each response looks like and translates it out of OpenAPI's dialect rather than forwarding it - nullable: true and draft-04's boolean exclusiveMinimum mean something else under draft-07, and a wrong verdict is worse than none. The engine matches a response to one of those schemas by status pattern and media type and validates it: a chip in the status band and the detail in the Tests tab for a single send, a per-step verdict on collection runs (with an opt-in failOnSchemaError that fails only a step which passed everything else), and a deferred walk of the sample reservoirs for load runs. Keywords a draft-07 validator cannot evaluate are counted and named, so nothing is reported clean because part of its contract went unread, and a collection bound to no document shows nothing at all - never judged and judged-and-passed are different answers.
- Contract coverage on a run report. "14 of 18 operations covered, every declared 2xx seen, three declared 4xxs never triggered", as a first-class block in the history Overview, the collection run view and a one-line last-run summary on the Spec tab. Every number is exact rather than derived from the bounded results reservoir, counted as each request is sent and each response arrives, and a status hits the most specific pattern that covers it. The index is read once when the plan resolves, so a sync landing mid-run cannot move a run onto a contract it never ran against; a binding whose hash no longer matches yields no block rather than a measurement against the wrong document.
- Export a collection back out as an OpenAPI document. A bound collection's stored document is patched, never rebuilt - operations nothing claims are removed, a declared parameter whose row carries a value gets it as an example, stored examples become response examples, and everything Vayu does not model is carried through by not being visited. A free-form collection gets a skeleton the dialog calls a starting point, with nothing inferred: no schema that was not read off an example body, no required from a row's toggle, no response for a status nobody saved. A request with no operation identity is never added to a bound document - the contract never described it - and is counted and named instead.
- External $refs resolve before parse. A $ref naming another file was walked as a #/ pointer, landed on undefined, and imported the operation as though the spec had documented nothing: an empty body stub, a missing parameter, and no entry in the skip tally to say so. Referenced documents are now fetched or read from beside the picked file, inlined under a root x-vayu-bundled key and every ref rewritten to an in-document pointer, transitively and once per target. What could not be reached keeps its $ref and is counted as an external_ref skip.
- Import many files, or a whole folder. The Import dialog read dataTransfer.files[0] and its file input carried no multiple, so dropping a folder's contents imported the first file and discarded the rest without a word - in the one subsystem that tallies every item it cannot represent. Entry is per file now: mixed formats in one batch work by construction, the preview becomes a ledger with a row for every picked file (parsed, unrecognised, unreadable, or inlined into another document as a $ref target), and Apply is one call per file so a refused seventh cannot roll back six good ones. Vendors shipping one spec per service are the norm - PayPal's public surface is 13 documents in one folder.
- Load runs can consume SSE. POST /runs takes stream: true, reading the flag and its two caps through the same parser POST /execute uses. A stream under load is bounded by construction - the loop refills concurrency per completion, so both caps are always set from the payload or the settings with no zero-means-unbounded spelling, and reaching either is a successful completion. The report gains a stream section: the per-completion event distribution, the totals, a derived events/sec and whether a cap was hit, absent for every run that did not stream.
- A sampled streaming capture carries its events. A post-request script asserting on pm.response.events passed in design mode and silently read undefined when replayed over load samples - the same script, two behaviours. The events are now rebuilt from the stored body by the same parser the live path feeds, so what counts as an event has one definition, and both sampled-capture viewers render a streamed sample's timeline.
- Send one request with one data row. A pre-request script reading pm.iterationData, or a URL carrying {{data.id}}, needed a whole collection run per line of script to test. A caret on Send now lists the collection's data rows and sends bound to one, with both scripts reading the row as pm.iterationData at iteration 0 of 1. The row binds before the run row exists, so a refusal leaves no trace of an execution that never happened; a streaming send binds it too. run_request over MCP takes the same field, and its allowlist gate is now positional about templates - one in the path or query leaves the host knowable and is judged on that host.
- {{data.*}} in auth credentials on a single send. A credentials file is the canonical data-driven run, yet the token worked under Run collection and was refused under Send-with-row, the surface built for iterating on exactly that request. build_request now takes an auth resolution, so a caller that must reach the credentials first says so instead of hiding the auth key, and the join-then-apply is shared with the plan path rather than existing in two spellings. Percent-encoding an api key and base64-ing basic auth stay after the bind, which is the whole point of the ordering. OAuth 2.0 stays refused, narrowed to that mode: its token is acquired against the token endpoint, so no row can reach it.