Baixar Vayu 0.20.0 per a Windows

0.20.0 - 2026-08-20
The contracts and certificates release. Two long-running moves finish. Everything that reads a document - an OpenAPI spec, a Postman collection, an Insomnia export - now reads it in the engine, so there is exactly one opinion about what a document says: the reader, both indexes, operation matching, request drafts, the sync diff, spec export and every import parser move out of the renderer, and an MCP agent can bind a collection to a spec, ask whether the contract has drifted, apply that drift under a policy that will not overwrite a person's edits, export a spec and import a document. Alongside it, client-certificate (mTLS) support grows a per-host registry that answers for every subdomain, ships PKCS#12 as well as PEM, and runs on one OpenSSL backend the engine names for itself on all three platforms, so Windows gets a working mutual-TLS handshake for the first time. The app adds a system proxy mode with a connection test, and a collection run's step list gains search, a way back from a step to the request that produced it, and the ability to scale to thousands of steps. The shape of the release is that move: the engine grows about 10,000 lines of new C++ while the renderer sheds roughly 7,700 net, most of it parsers and comparators that now have a single home.
Added
- The OpenAPI stack runs engine-side, end to end. The engine could not read a stored document at all, so every question about one was answered twice - once by the renderer's parsers and once by whatever the engine derived - and two readers disagree exactly where it matters. core/openapi_document is now the one translation unit that includes a YAML library, and rapidyaml (ryml) was picked by measurement against js-yaml, the reader the importer already used: it matches on every corpus file, keeps document order, and parses a 2.9 MB / 4,000-operation spec in 33 ms, where yaml-cpp turns the string "2.0" into the number 2.0 (which is what Swagger detection reads) and fkYAML sorts mapping keys. Scalars are typed by js-yaml's core schema, anchors, aliases and merge keys expand the way js-yaml expands them, a duplicate mapping key is refused, and expansion is bounded at one node per input byte - without which a 300-byte alias bomb reads for 7.9 seconds and gigabytes. On that reader: spec_documents.operations is derived on every write and refused in the body, so the index is a fact about the stored bytes the way hash is; the response schema index is derived off the same single walk, including OpenAPI 3.0's schema dialect translated to JSON Schema and a response object that is itself a $ref; POST /specs/match owns operation matching, ambiguity refused in both directions rather than guessed at; the engine can answer, for a stored document, the requests an import of it would build - method, URL, params, headers, sampled body and the folder each is filed under - off the same walk the indexes come from, which is what the sync diff compares a stored request against field by field; POST /specs/describe answers a picked document's format, title and operations so the bind preview and the bind commit read the same bytes through the same reader; POST /specs/bind does the whole bind in one transaction, matching the subtree itself and clearing the stamps a re-bind orphans; POST /specs/diff is the sync comparison, reading the bound document from the binding and walking the collection's subtree itself, because the three-way user-touched rule is worth nothing if the caller can supply the previous side; and POST /specs/export assembles the document, patching a bound collection's own stored bytes rather than regenerating (a regenerated document silently drops every security scheme, vendor extension and description Vayu has no model for) and inventing nothing for an unbound one. Each move is pinned to the renderer's own answers by a cross-language conformance fixture rather than to its code, because a draft the two sides build differently reads as "the document changed this request" on a document nobody edited.
- Every import format is parsed by the engine, and an agent can import a document. POST /import/apply took a parsed tree and the four parsers that built one lived in the renderer, which left an agent able to bind, describe, diff, sync, export and unbind a spec and unable to import anything. All four formats move: OpenAPI 2.0/3.x, Postman Collection v2.0/v2.1, the Postman environment and globals exports, and Insomnia v4. The OpenAPI half does not get a second reader - it is the same walk the sync diff compares against - and the JavaScript semantics both sides rest on (?? falling through null alone, truthiness, JSON.stringify's number spelling) move into shared engine code rather than being copied. Three routes: POST /import/parse reads a raw document and answers the whole result, detecting by content in the order the renderer's detectors ran; POST /import parses and applies in one transaction for a caller with no preview to show, with globals written last because that write replaces the whole set and must not run ahead of one that can still fail; and POST /import/document hands back a document as a JSON DOM for the one caller that needs a tree to rewrite external $refs. Every parser under app/src/services/importers/ is deleted and js-yaml leaves production src/. A 15-document conformance corpus, recorded from the renderer's parsers at the last commit that had them, asserts the engine matches on every build.
- An agent can ask whether a contract has drifted, and apply the drift without choosing which of it. diff_spec relays the engine's added / removed / changed / unchanged / unmapped answer for a re-fetched document, reading only - nothing stored, no binding moved, no request stamped - so an agent may ask about a document it has not decided to apply, with the write toggle off. Each bucket is capped at 50 entries while the summary carries the engine's true totals, so a document that renamed every operation comes back described rather than whole and a count read off a cut list cannot understate a drift. Applying it is POST /specs/sync with policy: "safe": the selection rule that decides what a sync writes when nobody has ticked anything is now core::safe_spec_apply rather than renderer-only code, and it is the one judgement whose silent failure destroys a person's work - never write a field somebody edited, never delete by default, leave a request nothing can be told apart about alone. POST /specs/diff reports it per entry as safe / safeFields, so the Spec tab's pre-ticked boxes and a caller with no checkboxes are one answer, and skipped counts what the policy declined, because a call answering only with what it wrote reads as "applied the drift". A user who changes a tick still sends explicit rows: a choice a person made is not a policy. Beside those, get_spec answers what a collection is bound to, where the document came from and when it was fetched, off the metadata route rather than the document (a real spec runs to megabytes); unbind_spec resets the binding and leaves the recorded operation identities alone; bind_spec binds from bytes with no pairing supplied; export_spec reads a document back out capped at 32 KB with its true size beside it; and import_document covers the import.
- mTLS works on all three platforms, wildcards a host, and ships PKCS#12. Windows built libcurl against Schannel, whose client-certificate path in curl 8.21 cannot complete a handshake with an identity read from a file, so mutual TLS was simply unavailable there. curl now pins the openssl feature with default-features: false, which is load-bearing: without it the port's default ssl feature keeps Schannel on and the result is a MultiSSL build where the backend a transfer uses is whichever libcurl picked, or whichever a leftover CURL_SSL_BACKEND in the environment names. So the engine names its own backend - pin_tls_backend() calls curl_global_sslset before curl_global_init, since curl answers too-late once initialized - and the assertion checks that this process selected it rather than that only one was compiled in. An OpenSSL build on Windows has no CA file to fall back to, so CURLSSLOPT_NATIVE_CA is set unconditionally there; without it a user who has pasted nothing would trust nothing at all, and every custom-CA test would have stayed green while it happened. On top of that: a registered certificate's host now takes one wildcard pattern read as a label suffix, so an estate behind one mTLS gateway needs one row rather than a row per service - *.example.com answers for api.example.com and a.b.example.com, never for example.com itself, never for notexample.com, and never for an address literal, because without that last guard *.0.1 would present the user's identity to 127.0.0.1. Once two rows can match one transfer, matches are ranked and the maximum taken (closest host first, then port), and the Settings card prints per row what the entry will and will not match, for exact rows too, because a certificate silently not presented is the failure this registry exists to end. A certificate can also go out as PKCS#12 rather than only a PEM pair: the format is a column on the row, the applier writes CURLOPT_SSLCERTTYPE on every handle, a declared format that contradicts the file's first bytes is refused, and the card drops the key picker for a bundle instead of demanding a file the format does not have.