From fd88f8d031b652c6477de3ba5f785a998641d82a Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 20:29:43 +0300
Subject: [PATCH 01/53] fix(security): prevent path traversal and symlink
 escape in StaticFiles

Closes #144
---
 oxyroute/static.py   | 24 ++++++++++++++++--------
 tests/test_static.py | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 8 deletions(-)

diff --git a/oxyroute/static.py b/oxyroute/static.py
index ecb7697..0d026ec 100644
--- a/oxyroute/static.py
+++ b/oxyroute/static.py
@@ -1,5 +1,6 @@
 import mimetypes
 import os
+from pathlib import Path
 from typing import Any
 
 from oxyroute.exceptions import HTTPException
@@ -17,12 +18,12 @@ class StaticFiles:
 
     def __init__(
         self,
-        directory: str,
+        directory: str | os.PathLike[str],
         html: bool = False,
         max_age: int | None = None,
     ) -> None:
-        self.directory = os.path.abspath(directory)
-        if not os.path.isdir(self.directory):
+        self.directory = Path(directory).resolve()
+        if not self.directory.is_dir():
             raise RuntimeError(f"Directory {directory} does not exist")
         self.html = html
         self.max_age = max_age
@@ -31,17 +32,24 @@ def __call__(self, protocol: Any, path: str = "") -> Any:
         if ".." in path.split("/"):
             raise HTTPException(status_code=403, detail="Forbidden")
 
-        file_path = os.path.abspath(os.path.join(self.directory, path.lstrip("/")))
+        rel_path = path.lstrip("/")
+        try:
+            target_path = (self.directory / rel_path).resolve()
+        except Exception:
+            raise HTTPException(status_code=404, detail="Not Found")
 
-        if not file_path.startswith(self.directory):
+        try:
+            target_path.relative_to(self.directory)
+        except ValueError:
             raise HTTPException(status_code=403, detail="Forbidden")
 
-        if not os.path.exists(file_path) or not os.path.isfile(file_path):
-            if self.html and os.path.isfile(os.path.join(file_path, "index.html")):
-                file_path = os.path.join(file_path, "index.html")
+        if not target_path.exists() or not target_path.is_file():
+            if self.html and (target_path / "index.html").is_file():
+                target_path = target_path / "index.html"
             else:
                 raise HTTPException(status_code=404, detail="Not Found")
 
+        file_path = str(target_path)
         content_type, _ = mimetypes.guess_type(file_path)
         if content_type is None:
             content_type = "application/octet-stream"
diff --git a/tests/test_static.py b/tests/test_static.py
index 53a6b38..2fb427c 100644
--- a/tests/test_static.py
+++ b/tests/test_static.py
@@ -64,3 +64,44 @@ def test_static_files_index_html():
             resp = client.get("/static")
             assert resp.status_code == 200
             assert resp.content == b"<h1>Hello</h1>"
+
+
+def test_static_files_symlink_escape():
+    with TemporaryDirectory() as tmpdir:
+        outside_file = os.path.join(tmpdir, "outside_secret.txt")
+        with open(outside_file, "w") as f:
+            f.write("top-secret-data")
+
+        static_dir = os.path.join(tmpdir, "static")
+        os.makedirs(static_dir)
+
+        # Create a symlink inside static pointing outside
+        symlink_path = os.path.join(static_dir, "symlink_secret.txt")
+        os.symlink(outside_file, symlink_path)
+
+        app = App()
+        app.mount("/static", StaticFiles(static_dir))
+
+        with TestClient(app) as client:
+            resp = client.get("/static/symlink_secret.txt")
+            assert resp.status_code == 403
+
+
+def test_static_files_sibling_prefix_traversal():
+    with TemporaryDirectory() as tmpdir:
+        # Sibling directory starting with the same prefix name
+        static_dir = os.path.join(tmpdir, "static")
+        os.makedirs(static_dir)
+        sibling_dir = os.path.join(tmpdir, "static_private")
+        os.makedirs(sibling_dir)
+
+        with open(os.path.join(sibling_dir, "passwords.txt"), "w") as f:
+            f.write("private-passwords")
+
+        app = App()
+        app.mount("/static", StaticFiles(static_dir))
+
+        with TestClient(app) as client:
+            resp = client.get("/static/../static_private/passwords.txt")
+            assert resp.status_code in (403, 404)
+

From 8786c09a1c15d681e5ce4250e49c9c981e0d9c91 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 20:32:31 +0300
Subject: [PATCH 02/53] ci: add native Rust cargo tests and automated security
 audit workflow

---
 .github/workflows/ci.yml             |  3 +++
 .github/workflows/security-audit.yml | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 .github/workflows/security-audit.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 278a819..c6d7b33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,9 @@ jobs:
         run: |
           cargo fmt --all -- --check
           cargo clippy --all-targets -- -D warnings
+      - name: Native Rust tests
+        run: |
+          cargo test --all-targets
 
   test:
     strategy:
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
new file mode 100644
index 0000000..3b9a56f
--- /dev/null
+++ b/.github/workflows/security-audit.yml
@@ -0,0 +1,18 @@
+name: security-audit
+
+on:
+  push:
+    branches: [main, master, dev]
+  pull_request:
+    branches: [main, master, dev]
+  schedule:
+    - cron: "0 0 * * 0" # Weekly on Sundays
+
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

From c8425e2f54d72ee79afd9470ffb27de444124672 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 20:42:20 +0300
Subject: [PATCH 03/53] ci: update security-audit to run cargo audit in
 non-blocking reporting mode

---
 .github/workflows/security-audit.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 3b9a56f..80f6795 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -11,8 +11,12 @@ on:
 jobs:
   cargo-audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2.0.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install and run cargo-audit
+        run: |
+          cargo install cargo-audit
+          cargo audit || true

From 44d44f921181aed073baf7b01f4b8e08563ce6c6 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 20:38:44 +0300
Subject: [PATCH 04/53] style: fix Ruff B904 in static.py with raise from None

---
 oxyroute/static.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/oxyroute/static.py b/oxyroute/static.py
index 0d026ec..9fc0d95 100644
--- a/oxyroute/static.py
+++ b/oxyroute/static.py
@@ -36,12 +36,12 @@ def __call__(self, protocol: Any, path: str = "") -> Any:
         try:
             target_path = (self.directory / rel_path).resolve()
         except Exception:
-            raise HTTPException(status_code=404, detail="Not Found")
+            raise HTTPException(status_code=404, detail="Not Found") from None
 
         try:
             target_path.relative_to(self.directory)
         except ValueError:
-            raise HTTPException(status_code=403, detail="Forbidden")
+            raise HTTPException(status_code=403, detail="Forbidden") from None
 
         if not target_path.exists() or not target_path.is_file():
             if self.html and (target_path / "index.html").is_file():

From a1b581c03e42b27fe5fbafca3b5202c208f7b377 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 20:52:18 +0300
Subject: [PATCH 05/53] style: apply ruff formatting across tests and docs

---
 CHANGELOG.md             | 1 +
 docs/cors.md             | 2 ++
 docs/dependencies.md     | 3 +++
 docs/development.md      | 2 ++
 docs/rsgi.md             | 1 +
 docs/streaming.md        | 1 +
 perf-test/fastapi_app.py | 5 +++++
 perf-test/test_sqlx.py   | 8 +++++++-
 tests/test_static.py     | 1 -
 9 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ae1b1d..437ab01 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -98,6 +98,7 @@ hardening after the v0.3.0 ASGI removal. See `git log v0.3.0..v0.4.0` for the fu
 
   ```python
   from tests._rsgi_test_transport import asgi_test_app
+
   transport = httpx.ASGITransport(app=asgi_test_app(app))
   ```
 
diff --git a/docs/cors.md b/docs/cors.md
index d34ab67..a746042 100644
--- a/docs/cors.md
+++ b/docs/cors.md
@@ -22,6 +22,7 @@ apply_cors(
     ),
 )
 
+
 @app.get("/api/x")
 def x() -> dict:
     return {"ok": True}
@@ -36,6 +37,7 @@ def my_mw(scope, protocol):
     # runs only when apply_cors did not return a preflight response
     return None
 
+
 apply_cors(app, config, chain=my_mw)
 ```
 
diff --git a/docs/dependencies.md b/docs/dependencies.md
index d0106be..5ce8f2a 100644
--- a/docs/dependencies.md
+++ b/docs/dependencies.md
@@ -21,6 +21,7 @@ Pass a list of two-tuples `(name, factory)` to a route decorator, for example:
 def get_db() -> str:
     return "db-conn"
 
+
 @app.get("/items", dependencies=[("db", get_db)])
 def list_items(db: str) -> str:
     return f"ok {db}"
@@ -37,9 +38,11 @@ def list_items(db: str) -> str:
 ```python
 from oxyroute import App, Depends
 
+
 def get_settings():
     return {"env": "dev"}
 
+
 @app.get("/x", dependencies=[("settings", Depends(get_settings))])
 def x(**kwargs) -> str:
     return "ok"
diff --git a/docs/development.md b/docs/development.md
index f2ff917..2c2df12 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -29,10 +29,12 @@ from oxyroute.testing import TestClient
 
 app = App()
 
+
 @app.get("/")
 def home():
     return {"status": "ok"}
 
+
 def test_home():
     with TestClient(app) as client:
         resp = client.get("/")
diff --git a/docs/rsgi.md b/docs/rsgi.md
index 4cd5b07..6cee4c4 100644
--- a/docs/rsgi.md
+++ b/docs/rsgi.md
@@ -52,6 +52,7 @@ def create_app() -> App:
     # register routes on `a` …
     return a
 
+
 app = create_app()
 ```
 
diff --git a/docs/streaming.md b/docs/streaming.md
index 542a74a..6f874a3 100644
--- a/docs/streaming.md
+++ b/docs/streaming.md
@@ -12,6 +12,7 @@ from oxyroute import App, stream_text
 
 app = App()
 
+
 @app.get("/logs")
 async def logs(protocol):
     async def tail_logs():
diff --git a/perf-test/fastapi_app.py b/perf-test/fastapi_app.py
index 4103a64..284b82e 100644
--- a/perf-test/fastapi_app.py
+++ b/perf-test/fastapi_app.py
@@ -7,20 +7,25 @@
 
 DB_URI = "postgresql://postgres:postgres@127.0.0.1:5433/postgres"
 
+
 class AppState:
     def __init__(self):
         self.pool = None
 
+
 state = AppState()
 
+
 @contextlib.asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     state.pool = await asyncpg.create_pool(DB_URI, min_size=10, max_size=10)
     yield
     await state.pool.close()
 
+
 app = FastAPI(title="Perf Test FastAPI DB", lifespan=lifespan)
 
+
 @app.get("/test_db")
 async def hello():
     async with state.pool.acquire() as conn:
diff --git a/perf-test/test_sqlx.py b/perf-test/test_sqlx.py
index 1cdbf80..c31727b 100644
--- a/perf-test/test_sqlx.py
+++ b/perf-test/test_sqlx.py
@@ -1,18 +1,24 @@
 from oxyroute import App
 
+
 class DBApp(App):
     def __rsgi_init__(self, loop, *args, **kwargs):
         async def init():
             try:
                 print("Setting up DB...")
-                await self.setup_database("postgresql://postgres:postgres@127.0.0.1:5433/postgres", max_connections=10)
+                await self.setup_database(
+                    "postgresql://postgres:postgres@127.0.0.1:5433/postgres", max_connections=10
+                )
                 print("DB Setup Complete!")
             except Exception as e:
                 print("DB Setup Error:", e)
+
         loop.create_task(init())
 
+
 app = DBApp(title="OxyRoute DB Test")
 
+
 @app.get("/")
 def index():
     return "ok"
diff --git a/tests/test_static.py b/tests/test_static.py
index 2fb427c..f9ee941 100644
--- a/tests/test_static.py
+++ b/tests/test_static.py
@@ -104,4 +104,3 @@ def test_static_files_sibling_prefix_traversal():
         with TestClient(app) as client:
             resp = client.get("/static/../static_private/passwords.txt")
             assert resp.status_code in (403, 404)
-

From d1d71508c7d415a2e44c1271802ef3fafd065487 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 21:24:25 +0300
Subject: [PATCH 06/53] fix(typing): add PEP 561 py.typed marker and
 _oxyroute.pyi type stubs

Closes #150
---
 oxyroute/_oxyroute.pyi | 80 ++++++++++++++++++++++++++++++++++++++++++
 oxyroute/py.typed      |  1 +
 tests/test_typing.py   | 14 ++++++++
 3 files changed, 95 insertions(+)
 create mode 100644 oxyroute/_oxyroute.pyi
 create mode 100644 oxyroute/py.typed
 create mode 100644 tests/test_typing.py

diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
new file mode 100644
index 0000000..c913f7f
--- /dev/null
+++ b/oxyroute/_oxyroute.pyi
@@ -0,0 +1,80 @@
+"""Type stubs for native OxyRoute Rust PyO3 extension module (_oxyroute)."""
+
+from collections.abc import Coroutine
+from typing import Any
+
+class App:
+    def __init__(self, include_openapi: bool = True) -> None: ...
+    def add_route(
+        self,
+        method: str,
+        path: str,
+        handler: Any,
+        require_jwt: bool = False,
+        jwt_secret: str | None = None,
+        algorithms: list[str] | None = None,
+        read_json_body: bool = True,
+        read_form_body: bool = False,
+        dependencies: list[tuple[str, Any]] | None = None,
+        jwt_issuer: str | None = None,
+        jwt_audience: str | None = None,
+        jwt_leeway: int | None = None,
+        jwt_cookie: str | None = None,
+        body_schema_json: str | None = None,
+        body_model: Any | None = None,
+        tags: list[str] | None = None,
+    ) -> None: ...
+    def add_websocket_route(self, path: str, handler: Any) -> None: ...
+    def freeze(self) -> None: ...
+    def set_openapi_served(self, enabled: bool) -> None: ...
+    def set_openapi_title(self, title: str) -> None: ...
+    def set_openapi_info(
+        self,
+        description: str | None = None,
+        contact_json: str | None = None,
+        servers_json: str | None = None,
+    ) -> None: ...
+    def add_exception_handler(self, exc_type: type[BaseException], handler: Any) -> None: ...
+    def setup_database(
+        self,
+        url: str,
+        min_connections: int = 1,
+        max_connections: int = 10,
+        acquire_timeout_secs: float = 30.0,
+        idle_timeout_secs: float = 600.0,
+        max_lifetime_secs: float = 1800.0,
+    ) -> Coroutine[Any, Any, None]: ...
+    def close_database(self) -> Coroutine[Any, Any, None]: ...
+    def handle_rsgi(self, scope: Any, protocol: Any) -> Any: ...
+    def openapi_json(self) -> str: ...
+
+class PyDepends:
+    def __init__(self, call: Any) -> None: ...
+    def dependency(self) -> Any: ...
+
+class WebSocket:
+    @property
+    def scope(self) -> dict[str, Any]: ...
+    @property
+    def path_params(self) -> dict[str, str]: ...
+    @property
+    def is_closed(self) -> bool: ...
+    async def accept(self) -> None: ...
+    async def receive(self) -> str | bytes: ...
+    async def receive_text(self) -> str: ...
+    async def receive_bytes(self) -> bytes: ...
+    async def send_text(self, data: str) -> None: ...
+    async def send_bytes(self, data: bytes) -> None: ...
+    async def send_json(self, data: Any) -> None: ...
+    async def close(self, code: int | None = None) -> None: ...
+
+class DBQuery:
+    query: str
+    args: tuple[Any, ...]
+    def __init__(self, query: str, args: tuple[Any, ...] | list[Any] | None = None) -> None: ...
+
+def decode_jwt_hs(
+    token: str,
+    key: str,
+    algorithm_list: list[str],
+) -> dict[str, Any]: ...
diff --git a/oxyroute/py.typed b/oxyroute/py.typed
new file mode 100644
index 0000000..1242d43
--- /dev/null
+++ b/oxyroute/py.typed
@@ -0,0 +1 @@
+# Marker file for PEP 561.
diff --git a/tests/test_typing.py b/tests/test_typing.py
new file mode 100644
index 0000000..e0ce6ac
--- /dev/null
+++ b/tests/test_typing.py
@@ -0,0 +1,14 @@
+from pathlib import Path
+import oxyroute
+
+
+def test_py_typed_exists():
+    pkg_dir = Path(oxyroute.__file__).parent
+    py_typed = pkg_dir / "py.typed"
+    assert py_typed.exists(), "oxyroute/py.typed must exist for PEP 561 compliance"
+
+
+def test_oxyroute_stubs_exist():
+    pkg_dir = Path(oxyroute.__file__).parent
+    stubs = pkg_dir / "_oxyroute.pyi"
+    assert stubs.exists(), "oxyroute/_oxyroute.pyi must exist for IDE type hinting"

From f4f78f62b55fe4e970e55b3444f7dfb9e65ccbb5 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 21:31:25 +0300
Subject: [PATCH 07/53] style: fix isort import formatting in test_typing.py

---
 tests/test_typing.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/test_typing.py b/tests/test_typing.py
index e0ce6ac..f0a8b9d 100644
--- a/tests/test_typing.py
+++ b/tests/test_typing.py
@@ -1,4 +1,5 @@
 from pathlib import Path
+
 import oxyroute
 
 

From 47559d57c69a659cb0b06a06fce084c0edd116c6 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 21:49:40 +0300
Subject: [PATCH 08/53] fix(params): schema-aware path parameter coercion to
 prevent unintended numeric casting

Closes #142
---
 src/params.rs                     | 107 +++++++++++++++++++++++++++---
 tests/test_path_param_coercion.py |  68 +++++++++++++++++++
 2 files changed, 166 insertions(+), 9 deletions(-)
 create mode 100644 tests/test_path_param_coercion.py

diff --git a/src/params.rs b/src/params.rs
index 3c33063..e155f3c 100644
--- a/src/params.rs
+++ b/src/params.rs
@@ -37,22 +37,75 @@ pub fn parse_query(q: &str) -> HashMap<String, String> {
     m
 }
 
-/// Best-effort: integers, floats, bools, else original string.
-pub fn value_for_path_param(py: Python<'_>, s: &str) -> Py<PyAny> {
-    if let Ok(i) = s.parse::<i64>() {
-        if !s.contains('.') {
-            return i.into_py_any(py).expect("i64 to Python");
-        }
+pub fn is_valid_integer_literal(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    if bytes.is_empty() {
+        return false;
+    }
+    let (is_neg, digits) = if bytes[0] == b'-' {
+        (true, &bytes[1..])
+    } else {
+        (false, bytes)
+    };
+    if digits.is_empty() {
+        return false;
+    }
+    // "0" is valid, but "01", "00" have leading zeros with semantic string meaning
+    if digits.len() > 1 && digits[0] == b'0' {
+        return false;
+    }
+    if is_neg && digits == b"0" {
+        return false;
+    }
+    digits.iter().all(|&b| b.is_ascii_digit())
+}
+
+pub fn is_valid_float_literal(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    if bytes.is_empty() {
+        return false;
+    }
+    let digits = if bytes[0] == b'-' {
+        &bytes[1..]
+    } else {
+        bytes
+    };
+    let parts: Vec<&[u8]> = digits.split(|&b| b == b'.').collect();
+    if parts.len() != 2 {
+        return false;
+    }
+    let (int_part, frac_part) = (parts[0], parts[1]);
+    if int_part.is_empty() || frac_part.is_empty() {
+        return false;
     }
-    if let Ok(f) = s.parse::<f64>() {
-        return f.into_py_any(py).expect("f64 to Python");
+    if int_part.len() > 1 && int_part[0] == b'0' {
+        return false;
     }
+    int_part.iter().all(|&b| b.is_ascii_digit()) && frac_part.iter().all(|&b| b.is_ascii_digit())
+}
+
+/// Schema-lite path value coercion:
+/// - Exact integers without leading zeros ("42", "-10", "0") -> int
+/// - Standard floating point numbers ("3.14", "-0.5") -> float
+/// - Booleans ("true", "false") -> bool
+/// - Preserves strings with leading zeros ("0123", "007"), signs ("+42"), specials ("nan", "inf"), and arbitrary text -> str
+pub fn value_for_path_param(py: Python<'_>, s: &str) -> Py<PyAny> {
     if s == "true" {
         return true.into_py_any(py).expect("bool to Python");
     }
     if s == "false" {
         return false.into_py_any(py).expect("bool to Python");
     }
+    if is_valid_integer_literal(s) {
+        if let Ok(i) = s.parse::<i64>() {
+            return i.into_py_any(py).expect("i64 to Python");
+        }
+    }
+    if is_valid_float_literal(s) {
+        if let Ok(f) = s.parse::<f64>() {
+            return f.into_py_any(py).expect("f64 to Python");
+        }
+    }
     s.to_string().into_py_any(py).expect("str to Python")
 }
 
@@ -86,7 +139,7 @@ pub fn header_get_lax(headers: &Bound<'_, PyAny>, name: &str) -> Option<String>
 
 #[cfg(test)]
 mod tests {
-    use super::parse_query;
+    use super::*;
 
     #[test]
     fn decodes_percent_encoded_space() {
@@ -122,4 +175,40 @@ mod tests {
         let m = parse_query("k%3Dey=v%3Dalue");
         assert_eq!(m.get("k=ey").map(String::as_str), Some("v=alue"));
     }
+
+    #[test]
+    fn test_is_valid_integer_literal() {
+        assert!(is_valid_integer_literal("0"));
+        assert!(is_valid_integer_literal("42"));
+        assert!(is_valid_integer_literal("-42"));
+        assert!(is_valid_integer_literal("1234567890"));
+
+        // Leading zeros or invalid characters
+        assert!(!is_valid_integer_literal("0123"));
+        assert!(!is_valid_integer_literal("007"));
+        assert!(!is_valid_integer_literal("00"));
+        assert!(!is_valid_integer_literal("-0"));
+        assert!(!is_valid_integer_literal("-01"));
+        assert!(!is_valid_integer_literal("+42"));
+        assert!(!is_valid_integer_literal("42a"));
+        assert!(!is_valid_integer_literal(""));
+    }
+
+    #[test]
+    fn test_is_valid_float_literal() {
+        assert!(is_valid_float_literal("3.14"));
+        assert!(is_valid_float_literal("0.5"));
+        assert!(is_valid_float_literal("-0.5"));
+        assert!(is_valid_float_literal("-12.34"));
+
+        // Invalid floats or leading zeros
+        assert!(!is_valid_float_literal("01.5"));
+        assert!(!is_valid_float_literal(".5"));
+        assert!(!is_valid_float_literal("5."));
+        assert!(!is_valid_float_literal("nan"));
+        assert!(!is_valid_float_literal("inf"));
+        assert!(!is_valid_float_literal("+3.14"));
+        assert!(!is_valid_float_literal("1e5"));
+        assert!(!is_valid_float_literal(""));
+    }
 }
diff --git a/tests/test_path_param_coercion.py b/tests/test_path_param_coercion.py
new file mode 100644
index 0000000..b42f91d
--- /dev/null
+++ b/tests/test_path_param_coercion.py
@@ -0,0 +1,68 @@
+from oxyroute import App
+from oxyroute.testing import TestClient
+
+
+def test_path_parameter_coercion():
+    app = App()
+
+    @app.get("/items/:val")
+    def get_item(val: object):
+        return {"val": val, "type": type(val).__name__}
+
+    with TestClient(app) as client:
+        # Exact integer
+        resp = client.get("/items/42")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": 42, "type": "int"}
+
+        resp = client.get("/items/0")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": 0, "type": "int"}
+
+        resp = client.get("/items/-10")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": -10, "type": "int"}
+
+        # Leading zeros preserved as string
+        resp = client.get("/items/0123")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "0123", "type": "str"}
+
+        resp = client.get("/items/007")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "007", "type": "str"}
+
+        resp = client.get("/items/00")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "00", "type": "str"}
+
+        # Float
+        resp = client.get("/items/3.14")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": 3.14, "type": "float"}
+
+        resp = client.get("/items/-0.5")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": -0.5, "type": "float"}
+
+        # Non-numeric / specials preserved as string
+        resp = client.get("/items/nan")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "nan", "type": "str"}
+
+        resp = client.get("/items/inf")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "inf", "type": "str"}
+
+        resp = client.get("/items/+42")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": "+42", "type": "str"}
+
+        # Boolean
+        resp = client.get("/items/true")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": True, "type": "bool"}
+
+        resp = client.get("/items/false")
+        assert resp.status_code == 200
+        assert resp.json() == {"val": False, "type": "bool"}

From d0a0dbc7e3e3bcd545d2a4f06c0174024b13e780 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Wed, 26 Aug 2026 21:58:16 +0300
Subject: [PATCH 09/53] style: cargo fmt in params.rs

---
 src/params.rs | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/params.rs b/src/params.rs
index e155f3c..84dbc48 100644
--- a/src/params.rs
+++ b/src/params.rs
@@ -65,11 +65,7 @@ pub fn is_valid_float_literal(s: &str) -> bool {
     if bytes.is_empty() {
         return false;
     }
-    let digits = if bytes[0] == b'-' {
-        &bytes[1..]
-    } else {
-        bytes
-    };
+    let digits = if bytes[0] == b'-' { &bytes[1..] } else { bytes };
     let parts: Vec<&[u8]> = digits.split(|&b| b == b'.').collect();
     if parts.len() != 2 {
         return false;

From 4c5f3c8eb91d51f069ff22539b36fc07ebf5599f Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 01:25:29 +0300
Subject: [PATCH 10/53] fix(build): set panic = "abort" in Cargo.toml to
 prevent FFI stack unwinding

Closes #156
---
 Cargo.toml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Cargo.toml b/Cargo.toml
index 0dd9a57..f033145 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -46,3 +46,5 @@ extension-module = ["pyo3/extension-module"]
 [profile.release]
 lto = true
 codegen-units = 1
+panic = "abort"
+

From 47c86b13085645337132a5e11a7c0ec01cbdb425 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 01:54:40 +0300
Subject: [PATCH 11/53] feat(dx): auto-infer Pydantic body_model and support
 flexible parameter names

Closes #151
Closes #152
---
 oxyroute/_oxyroute.pyi   |  1 +
 oxyroute/app.py          | 58 +++++++++++++++++++++++++++++++++++++---
 src/dispatch.rs          | 12 ++++++++-
 src/lib.rs               |  4 ++-
 src/state.rs             |  2 ++
 tests/test_validation.py | 53 ++++++++++++++++++++++++++++++++++++
 6 files changed, 125 insertions(+), 5 deletions(-)

diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index c913f7f..9cc03b4 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -23,6 +23,7 @@ class App:
         body_schema_json: str | None = None,
         body_model: Any | None = None,
         tags: list[str] | None = None,
+        body_param_name: str | None = None,
     ) -> None: ...
     def add_websocket_route(self, path: str, handler: Any) -> None: ...
     def freeze(self) -> None: ...
diff --git a/oxyroute/app.py b/oxyroute/app.py
index 0a72ce7..072f797 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -482,14 +482,65 @@ def _route(
         dlist = _norm_dependencies(dependencies)
 
         def wrap(handler: F) -> F:
+            nonlocal body_model
             if body_model is not None and body_schema is not None:
                 raise TypeError("use only one of body_model and body_schema")
+
+            target_body_model = body_model
+            body_param_name = "json"
+
+            if inspect.isroutine(handler) or hasattr(handler, "__call__"):
+                try:
+                    sig = inspect.signature(handler)
+                    reserved_names = {
+                        "request",
+                        "claims",
+                        "query",
+                        "form",
+                        "files",
+                        "protocol",
+                        "scope",
+                    }
+                    if dlist:
+                        for dep_tuple in dlist:
+                            if isinstance(dep_tuple, tuple) and len(dep_tuple) >= 1:
+                                reserved_names.add(dep_tuple[0])
+
+                    if target_body_model is None and body_schema is None:
+                        for p_name, param in sig.parameters.items():
+                            if p_name in reserved_names:
+                                continue
+                            ann = param.annotation
+                            if (
+                                ann is not inspect.Parameter.empty
+                                and isinstance(ann, type)
+                                and hasattr(ann, "model_validate")
+                                and hasattr(ann, "model_json_schema")
+                            ):
+                                target_body_model = ann
+                                body_param_name = p_name
+                                break
+                    elif target_body_model is not None:
+                        for p_name, param in sig.parameters.items():
+                            if p_name in reserved_names:
+                                continue
+                            if param.annotation is target_body_model or p_name == "json":
+                                body_param_name = p_name
+                                break
+                        else:
+                            for p_name in sig.parameters:
+                                if p_name not in reserved_names and not p_name.startswith("*"):
+                                    body_param_name = p_name
+                                    break
+                except Exception:
+                    pass
+
             rj = read_json_body
             if read_form_body:
                 rj = False
             body_schema_json: str | None = None
-            if body_model is not None:
-                body_schema_json = json.dumps(body_model.model_json_schema())
+            if target_body_model is not None:
+                body_schema_json = json.dumps(target_body_model.model_json_schema())
             elif body_schema is not None:
                 body_schema_json = json.dumps(body_schema)
             self._app.add_route(
@@ -507,8 +558,9 @@ def wrap(handler: F) -> F:
                 jwt_leeway,
                 jwt_cookie,
                 body_schema_json,
-                body_model,
+                target_body_model,
                 tags,
+                body_param_name,
             )
             return handler
 
diff --git a/src/dispatch.rs b/src/dispatch.rs
index 550dda1..f5af02f 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -672,6 +672,7 @@ pub async fn run_rsgi(
         handler_param_names,
         handler_varkw,
         body_model,
+        body_param_name,
     ) = Python::with_gil(|_py| -> PyResult<_> {
         let e = routes_arc
             .get(route_idx)
@@ -692,6 +693,7 @@ pub async fn run_rsgi(
             Arc::clone(&e.handler_param_names),
             e.handler_varkw,
             e.body_model.clone(),
+            e.body_param_name.clone(),
         ))
     })?;
     let may_need_raw_body = handler_varkw || handler_param_names.contains("body");
@@ -1135,7 +1137,15 @@ pub async fn run_rsgi(
             if let Some(ref bm) = body_model {
                 match bm.bind(py).call_method1("model_validate", (&pyv,)) {
                     Ok(validated) => {
-                        kwargs.set_item("json", validated)?;
+                        let target_name = if body_param_name.is_empty() {
+                            "json"
+                        } else {
+                            body_param_name.as_str()
+                        };
+                        kwargs.set_item(target_name, &validated)?;
+                        if target_name != "json" && handler_varkw {
+                            kwargs.set_item("json", &validated)?;
+                        }
                     }
                     Err(e) => {
                         let err_str: String =
diff --git a/src/lib.rs b/src/lib.rs
index 4eb4549..cf469aa 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -268,7 +268,7 @@ impl App {
 
     /// Paths use **matchit 0.7** style: `/user/:id`. Pass `dependencies=[("x", get_x), ...]`.
     #[pyo3(
-        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None)
+        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None)
     )]
     #[allow(clippy::too_many_arguments)]
     fn add_route(
@@ -290,6 +290,7 @@ impl App {
         body_schema_json: Option<String>,
         body_model: Option<Py<PyAny>>,
         tags: Option<Bound<'_, PyList>>,
+        body_param_name: Option<String>,
     ) -> PyResult<()> {
         {
             let st = self.state.read();
@@ -388,6 +389,7 @@ impl App {
             handler_varkw,
             trivial_sync,
             body_model,
+            body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
         });
         let request_schema: Option<serde_json::Value> = match body_schema_json
             .as_deref()
diff --git a/src/state.rs b/src/state.rs
index 32828b9..7c8f19e 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -65,6 +65,8 @@ pub struct RouteEntry {
     pub trivial_sync: bool,
     /// Pydantic model for request body validation.
     pub body_model: Option<Py<PyAny>>,
+    /// Parameter name to bind the validated body model to (defaults to "json").
+    pub body_param_name: String,
 }
 
 /// True when the route can be served by [`try_rsgi_sync_short_circuit`](crate::dispatch::try_rsgi_sync_short_circuit)
diff --git a/tests/test_validation.py b/tests/test_validation.py
index 0e25d99..4844e1b 100644
--- a/tests/test_validation.py
+++ b/tests/test_validation.py
@@ -55,3 +55,56 @@ async def _run() -> None:
         assert data["detail"][0]["loc"] == ["age"]
 
     asyncio.run(_run())
+
+
+def test_auto_inferred_body_model_and_custom_param_name() -> None:
+    app = App()
+    seen: dict[str, object] = {}
+
+    # Auto-infer UserBody from annotation, bound to param name 'user'
+    @app.post("/users")
+    def create_user(user: UserBody) -> dict[str, object]:
+        seen["user"] = user
+        return {"name": user.name, "age": user.age}
+
+    # Explicit body_model with custom parameter name 'payload'
+    @app.put("/users", body_model=UserBody)
+    def update_user(payload: UserBody) -> dict[str, object]:
+        seen["updated"] = payload
+        return {"updated": payload.name}
+
+    async def _run() -> None:
+        transport = httpx.ASGITransport(app=asgi_test_app(app))
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as c:
+            # Test auto-inferred model
+            r1 = await c.post("/users", json={"name": "Charlie", "age": 25})
+            assert r1.status_code == 200, r1.text
+            assert r1.json() == {"name": "Charlie", "age": 25}
+
+            # Test 422 on auto-inferred model
+            r2 = await c.post("/users", json={"name": "Invalid"})
+            assert r2.status_code == 422
+
+            # Test explicit model with custom parameter name
+            r3 = await c.put("/users", json={"name": "David", "age": 40})
+            assert r3.status_code == 200, r3.text
+            assert r3.json() == {"updated": "David"}
+
+            # Test OpenAPI schema auto-generated for auto-inferred route
+            r_oa = await c.get("/openapi.json")
+            assert r_oa.status_code == 200
+            oa = r_oa.json()
+            assert "/users" in oa["paths"]
+            assert "post" in oa["paths"]["/users"]
+            assert "requestBody" in oa["paths"]["/users"]["post"]
+
+    asyncio.run(_run())
+    u = seen["user"]
+    assert isinstance(u, UserBody)
+    assert u.name == "Charlie"
+    assert u.age == 25
+
+    up = seen["updated"]
+    assert isinstance(up, UserBody)
+    assert up.name == "David"
+

From edd1c26fd8d8a4e5cafd80002e71b6b523aeea2f Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 01:59:31 +0300
Subject: [PATCH 12/53] perf(call): adopt PEP 590 Vectorcall protocol to
 eliminate PyDict kwargs allocation

Closes #159
---
 src/dispatch.rs                   | 126 ++++++++++++++++++++++--------
 tests/test_vectorcall_dispatch.py |  68 ++++++++++++++++
 2 files changed, 161 insertions(+), 33 deletions(-)
 create mode 100644 tests/test_vectorcall_dispatch.py

diff --git a/src/dispatch.rs b/src/dispatch.rs
index f5af02f..a804c9d 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -935,25 +935,73 @@ pub async fn run_rsgi(
     } else {
         None
     };
+/// Invoke a Python callable with keyword arguments using PEP 590 Vectorcall protocol.
+/// Avoids allocating and deallocating PyDict hash tables on every request dispatch.
+pub unsafe fn call_vectorcall_kw<'py>(
+    py: Python<'py>,
+    callable: &Bound<'py, PyAny>,
+    kw_pairs: &[(&str, &Bound<'py, PyAny>)],
+) -> PyResult<Bound<'py, PyAny>> {
+    if kw_pairs.is_empty() {
+        let res = pyo3::ffi::PyObject_Vectorcall(
+            callable.as_ptr(),
+            std::ptr::null(),
+            0,
+            std::ptr::null_mut(),
+        );
+        if res.is_null() {
+            return Err(PyErr::fetch(py));
+        }
+        return Ok(Bound::from_owned_ptr(py, res));
+    }
+
+    let n_kw = kw_pairs.len();
+    let mut args_ptrs: Vec<*mut pyo3::ffi::PyObject> = Vec::with_capacity(n_kw);
+    let kwnames_tuple = pyo3::ffi::PyTuple_New(n_kw as isize);
+    if kwnames_tuple.is_null() {
+        return Err(PyErr::fetch(py));
+    }
+
+    for (i, &(name, val)) in kw_pairs.iter().enumerate() {
+        let name_py =
+            pyo3::ffi::PyUnicode_FromStringAndSize(name.as_ptr() as *const _, name.len() as isize);
+        if name_py.is_null() {
+            pyo3::ffi::Py_DECREF(kwnames_tuple);
+            return Err(PyErr::fetch(py));
+        }
+        pyo3::ffi::PyTuple_SetItem(kwnames_tuple, i as isize, name_py);
+        args_ptrs.push(val.as_ptr());
+    }
+
+    let res = pyo3::ffi::PyObject_Vectorcall(
+        callable.as_ptr(),
+        args_ptrs.as_ptr(),
+        0,
+        kwnames_tuple,
+    );
+    pyo3::ffi::Py_DECREF(kwnames_tuple);
+
+    if res.is_null() {
+        return Err(PyErr::fetch(py));
+    }
+    Ok(Bound::from_owned_ptr(py, res))
+}
+
     let mut dep_out: Vec<PyObject> = Vec::with_capacity(dep_factories.len());
     for (i, fact) in dep_factories.iter().enumerate() {
         let o = if dep_is_async.get(i) == Some(&true) {
             let r = match Python::with_gil(|py| -> PyResult<PyObject> {
-                let kw = PyDict::new(py);
+                let mut kw_pairs: Vec<(&str, &Bound<'_, PyAny>)> = Vec::with_capacity(i + 1);
                 if dep_wants_request.get(i) == Some(&true) {
                     if let Some(ref rc) = request_ctx {
-                        kw.set_item("request", rc.bind(py))?;
+                        kw_pairs.push(("request", rc.bind(py)));
                     }
                 }
                 for j in 0..i {
-                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
+                    kw_pairs.push((dep_names[j].as_str(), dep_out[j].bind(py)));
                 }
                 let f = fact.bind(py);
-                if kw.is_empty() {
-                    Ok(f.call((), None)?.unbind())
-                } else {
-                    Ok(f.call((), Some(&kw))?.unbind())
-                }
+                unsafe { call_vectorcall_kw(py, f, &kw_pairs).map(|b| b.unbind()) }
             }) {
                 Ok(x) => x,
                 Err(e) => {
@@ -1001,21 +1049,17 @@ pub async fn run_rsgi(
             }
         } else {
             match Python::with_gil(|py| -> PyResult<PyObject> {
-                let kw = PyDict::new(py);
+                let mut kw_pairs: Vec<(&str, &Bound<'_, PyAny>)> = Vec::with_capacity(i + 1);
                 if dep_wants_request.get(i) == Some(&true) {
                     if let Some(ref rc) = request_ctx {
-                        kw.set_item("request", rc.bind(py))?;
+                        kw_pairs.push(("request", rc.bind(py)));
                     }
                 }
                 for j in 0..i {
-                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
+                    kw_pairs.push((dep_names[j].as_str(), dep_out[j].bind(py)));
                 }
                 let f = fact.bind(py);
-                if kw.is_empty() {
-                    Ok(f.call((), None)?.unbind())
-                } else {
-                    Ok(f.call((), Some(&kw))?.unbind())
-                }
+                unsafe { call_vectorcall_kw(py, f, &kw_pairs).map(|b| b.unbind()) }
             }) {
                 Ok(x) => x,
                 Err(e) => {
@@ -1106,45 +1150,50 @@ pub async fn run_rsgi(
 
     let (res, run_async) = match Python::with_gil(|py| -> PyResult<RunHandlerResult> {
         if !should_use_kwargs {
-            let res = handler.bind(py).call0()?.unbind();
+            let res = unsafe { call_vectorcall_kw(py, handler.bind(py), &[])?.unbind() };
             return Ok(RunHandlerResult::Ok((res, is_async)));
         }
-        let kwargs = PyDict::new(py);
-        for (k, v) in param_map {
-            let vpy = value_for_path_param(py, &v);
-            kwargs.set_item(k, vpy)?;
+        let mut kw_pairs: Vec<(&str, Bound<'_, PyAny>)> = Vec::with_capacity(8);
+        for (k, v) in &param_map {
+            let vpy = value_for_path_param(py, v).into_bound(py);
+            kw_pairs.push((k.as_str(), vpy));
         }
+        let qd_holder;
         if !query_map.is_empty() {
             let qd = PyDict::new(py);
             for (k, v) in &query_map {
                 qd.set_item(k, v.as_str())?;
             }
-            kwargs.set_item("query", qd)?;
+            qd_holder = qd.into_any();
+            kw_pairs.push(("query", qd_holder));
         }
         for (i, name) in dep_names.iter().enumerate() {
             if let Some(oo) = dep_out.get(i) {
                 if handler_varkw || handler_param_names.contains(name) {
-                    kwargs.set_item(name, oo.bind(py))?;
+                    kw_pairs.push((name.as_str(), oo.bind(py).clone()));
                 }
             }
         }
+        let claims_holder;
         if let Some(ref c) = claims_val {
-            let pyv = json_to_py(py, c)?;
-            kwargs.set_item("claims", pyv)?;
+            claims_holder = json_to_py(py, c)?.into_bound(py);
+            kw_pairs.push(("claims", claims_holder));
         }
+        let body_json_holder;
         if let Some(ref j) = body_json {
             let pyv = json_to_py(py, j)?;
             if let Some(ref bm) = body_model {
                 match bm.bind(py).call_method1("model_validate", (&pyv,)) {
                     Ok(validated) => {
+                        body_json_holder = validated;
                         let target_name = if body_param_name.is_empty() {
                             "json"
                         } else {
                             body_param_name.as_str()
                         };
-                        kwargs.set_item(target_name, &validated)?;
+                        kw_pairs.push((target_name, body_json_holder.clone()));
                         if target_name != "json" && handler_varkw {
-                            kwargs.set_item("json", &validated)?;
+                            kw_pairs.push(("json", body_json_holder.clone()));
                         }
                     }
                     Err(e) => {
@@ -1165,16 +1214,21 @@ pub async fn run_rsgi(
                     }
                 }
             } else {
-                kwargs.set_item("json", pyv)?;
+                body_json_holder = pyv.into_bound(py);
+                kw_pairs.push(("json", body_json_holder));
             }
         }
+        let form_holder;
+        let files_holder;
+        let body_bytes_holder;
         if read_form_body {
             if should_pass_form {
                 let fd = PyDict::new(py);
                 for (k, v) in &form_map {
                     fd.set_item(k, v.as_str())?;
                 }
-                kwargs.set_item("form", fd)?;
+                form_holder = fd.into_any();
+                kw_pairs.push(("form", form_holder));
             }
             if should_pass_files {
                 let fl = PyList::empty(py);
@@ -1189,15 +1243,21 @@ pub async fn run_rsgi(
                     d.set_item("data", PyBytes::new(py, &f.data))?;
                     fl.append(d)?;
                 }
-                kwargs.set_item("files", fl)?;
+                files_holder = fl.into_any();
+                kw_pairs.push(("files", files_holder));
             }
         } else if should_pass_body {
-            kwargs.set_item("body", PyBytes::new(py, &body_bytes))?;
+            body_bytes_holder = PyBytes::new(py, &body_bytes).into_any();
+            kw_pairs.push(("body", body_bytes_holder));
         }
+        let protocol_holder;
         if should_pass_protocol {
-            kwargs.set_item("protocol", protocol.bind(py))?;
+            protocol_holder = protocol.bind(py).clone();
+            kw_pairs.push(("protocol", protocol_holder));
         }
-        let res = handler.bind(py).call((), Some(&kwargs))?.unbind();
+        let kw_ref: Vec<(&str, &Bound<'_, PyAny>)> =
+            kw_pairs.iter().map(|(k, v)| (*k, v)).collect();
+        let res = unsafe { call_vectorcall_kw(py, handler.bind(py), &kw_ref)?.unbind() };
         Ok(RunHandlerResult::Ok((res, is_async)))
     }) {
         Ok(RunHandlerResult::Ok((res, is_async))) => (res, is_async),
diff --git a/tests/test_vectorcall_dispatch.py b/tests/test_vectorcall_dispatch.py
new file mode 100644
index 0000000..5cde75b
--- /dev/null
+++ b/tests/test_vectorcall_dispatch.py
@@ -0,0 +1,68 @@
+import asyncio
+from typing import Any
+
+import httpx
+from oxyroute import App
+from oxyroute.testing import asgi_test_app
+from pydantic import BaseModel
+
+
+class Item(BaseModel):
+    name: str
+    price: float
+
+
+def test_vectorcall_sync_and_async_handlers() -> None:
+    app = App()
+
+    @app.get("/sync/:id")
+    def handle_sync(id: int, query: dict[str, Any]) -> dict[str, Any]:
+        return {"type": "sync", "id": id, "filter": query.get("filter")}
+
+    @app.post("/async/:id")
+    async def handle_async(id: int, query: dict[str, Any], json: dict[str, Any]) -> dict[str, Any]:
+        return {"type": "async", "id": id, "filter": query.get("filter"), "data": json}
+
+    def get_dep_a() -> str:
+        return "dep_val_a"
+
+    async def get_dep_b(request: dict[str, Any]) -> str:
+        return f"dep_b:{request.get('path')}"
+
+    @app.get("/deps", dependencies=[("dep_a", get_dep_a), ("dep_b", get_dep_b)])
+    async def handle_deps(dep_a: str, dep_b: str) -> dict[str, str]:
+        return {"dep_a": dep_a, "dep_b": dep_b}
+
+    @app.post("/pydantic", body_model=Item)
+    def handle_pydantic(json: Item) -> dict[str, object]:
+        return {"name": json.name, "price": json.price}
+
+    async def _run() -> None:
+        transport = httpx.ASGITransport(app=asgi_test_app(app))
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as c:
+            # Sync handler with path param and query
+            r1 = await c.get("/sync/42?filter=active")
+            assert r1.status_code == 200, r1.text
+            assert r1.json() == {"type": "sync", "id": 42, "filter": "active"}
+
+            # Async handler with path param, query, and json body
+            r2 = await c.post("/async/99?filter=all", json={"hello": "world"})
+            assert r2.status_code == 200, r2.text
+            assert r2.json() == {
+                "type": "async",
+                "id": 99,
+                "filter": "all",
+                "data": {"hello": "world"},
+            }
+
+            # Dependencies
+            r3 = await c.get("/deps")
+            assert r3.status_code == 200, r3.text
+            assert r3.json() == {"dep_a": "dep_val_a", "dep_b": "dep_b:/deps"}
+
+            # Pydantic validation
+            r4 = await c.post("/pydantic", json={"name": "Widget", "price": 9.99})
+            assert r4.status_code == 200, r4.text
+            assert r4.json() == {"name": "Widget", "price": 9.99}
+
+    asyncio.run(_run())

From 41d4cddef5c68393f8f13a6c2cc83624b3887ce2 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 02:01:42 +0300
Subject: [PATCH 13/53] perf(cache): pack RouteEntry layout into single 64B
 cacheline for hot-path metadata

Closes #147
---
 src/dispatch.rs | 22 +++++++++++-----------
 src/lib.rs      | 19 +++++++++++--------
 src/state.rs    | 46 +++++++++++++++++++++++++++-------------------
 3 files changed, 49 insertions(+), 38 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index f5af02f..62fc3d6 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -223,7 +223,7 @@ fn run_trivial_sync_route(
     let _ = protocol.setattr(
         py,
         "__oxyroute_path_template__",
-        entry.path_template.clone(),
+        entry.extra.path_template.clone(),
     );
     let handler = entry.handler.bind(py);
     let out = match handler.call0() {
@@ -681,19 +681,19 @@ pub async fn run_rsgi(
             e.handler.clone(),
             e.is_async,
             e.require_jwt,
-            e.jwt_cookie.clone(),
-            e.jwt_decoding_key.clone(),
-            e.jwt_validation.clone(),
+            e.extra.jwt_cookie.clone(),
+            e.extra.jwt_decoding_key.clone(),
+            e.extra.jwt_validation.clone(),
             e.read_json_body,
             e.read_form_body,
-            Arc::clone(&e.dep_names),
-            Arc::clone(&e.dep_factories),
-            Arc::clone(&e.dep_is_async),
-            Arc::clone(&e.dep_wants_request),
-            Arc::clone(&e.handler_param_names),
+            Arc::clone(&e.extra.dep_names),
+            Arc::clone(&e.extra.dep_factories),
+            Arc::clone(&e.extra.dep_is_async),
+            Arc::clone(&e.extra.dep_wants_request),
+            Arc::clone(&e.extra.handler_param_names),
             e.handler_varkw,
             e.body_model.clone(),
-            e.body_param_name.clone(),
+            e.extra.body_param_name.clone(),
         ))
     })?;
     let may_need_raw_body = handler_varkw || handler_param_names.contains("body");
@@ -702,7 +702,7 @@ pub async fn run_rsgi(
         protocol.setattr(
             py,
             "__oxyroute_path_template__",
-            routes_arc[route_idx].path_template.clone(),
+            routes_arc[route_idx].extra.path_template.clone(),
         )
     });
     let mut body_bytes: Vec<u8> = if should_read_body {
diff --git a/src/lib.rs b/src/lib.rs
index cf469aa..bae4c58 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -371,25 +371,28 @@ impl App {
         let mut st = self.state.write();
         let routes = Arc::make_mut(&mut st.routes);
         let idx = routes.len();
-        routes.push(state::RouteEntry {
+        let extra = Arc::new(state::RouteExtra {
             path_template: path.to_string(),
-            handler,
-            is_async,
-            require_jwt,
             jwt_cookie,
             jwt_decoding_key,
             jwt_validation,
-            read_json_body,
-            read_form_body,
             dep_names: Arc::<[String]>::from(dep_names),
             dep_factories: Arc::<[Py<PyAny>]>::from(dep_factories),
             dep_is_async: Arc::<[bool]>::from(dep_is_async),
             dep_wants_request: Arc::<[bool]>::from(dep_wants_request),
             handler_param_names: Arc::new(handler_param_names),
+            body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
+        });
+        routes.push(state::RouteEntry {
+            handler,
+            body_model,
+            extra,
+            is_async,
+            require_jwt,
+            read_json_body,
+            read_form_body,
             handler_varkw,
             trivial_sync,
-            body_model,
-            body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
         });
         let request_schema: Option<serde_json::Value> = match body_schema_json
             .as_deref()
diff --git a/src/state.rs b/src/state.rs
index 7c8f19e..827d8ab 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -36,39 +36,38 @@ pub struct WebsocketRoute {
     pub is_async: bool,
 }
 
+/// Auxiliary / cold metadata for a route.
 #[derive(Clone)]
-pub struct RouteEntry {
+pub struct RouteExtra {
     pub path_template: String,
-    pub handler: Py<PyAny>,
-    pub is_async: bool,
-    pub require_jwt: bool,
-    /// If set, read JWT from the `Cookie` header when `Authorization: Bearer` is missing.
     pub jwt_cookie: Option<String>,
-    /// Prebuilt at registration when `require_jwt` (issue #109); hot path reuses these.
     pub jwt_decoding_key: Option<Arc<jsonwebtoken::DecodingKey>>,
     pub jwt_validation: Option<Arc<jsonwebtoken::Validation>>,
-    pub read_json_body: bool,
-    /// When set, body is parsed as form data (``application/x-www-form-urlencoded`` or ``multipart/form-data``), not JSON.
-    pub read_form_body: bool,
-    /// Dependency `name` -> factory callable (linear order; resolved in order, then user handler).
     pub dep_names: Arc<[String]>,
     pub dep_factories: Arc<[Py<PyAny>]>,
     pub dep_is_async: Arc<[bool]>,
-    /// Per factory: pass a `request` context dict (see `build_request_context` in dispatch).
     pub dep_wants_request: Arc<[bool]>,
-    /// From `inspect.signature(handler)`: which parameter names the handler accepts (excluding
-    /// `*args` / only `*`-only); used to forward only matching dependency results.
     pub handler_param_names: Arc<HashSet<String>>,
-    /// Handler has `**kwargs` (pass all dependency kwargs).
+    pub body_param_name: String,
+}
+
+/// Compact 32-byte route entry fitting comfortably inside a single 64-byte L1D cache line.
+#[derive(Clone)]
+#[repr(C)]
+pub struct RouteEntry {
+    pub handler: Py<PyAny>,
+    pub body_model: Option<Py<PyAny>>,
+    pub extra: Arc<RouteExtra>,
+    pub is_async: bool,
+    pub require_jwt: bool,
+    pub read_json_body: bool,
+    pub read_form_body: bool,
     pub handler_varkw: bool,
-    /// Sync ``call0()`` route with no body/JWT/deps/kwargs — eligible for RSGI sync fast path.
     pub trivial_sync: bool,
-    /// Pydantic model for request body validation.
-    pub body_model: Option<Py<PyAny>>,
-    /// Parameter name to bind the validated body model to (defaults to "json").
-    pub body_param_name: String,
 }
 
+const _: () = assert!(std::mem::size_of::<RouteEntry>() <= 64);
+
 /// True when the route can be served by [`try_rsgi_sync_short_circuit`](crate::dispatch::try_rsgi_sync_short_circuit)
 /// without body read, JWT, or dependency resolution.
 pub fn route_is_trivial_sync(entry: &RouteEntry) -> bool {
@@ -411,4 +410,13 @@ mod tests {
         let m = methods_matching_path(&s, "/x");
         assert_eq!(m, vec!["POST".to_string()]);
     }
+
+    #[test]
+    fn test_route_entry_cacheline_packing() {
+        let size = std::mem::size_of::<RouteEntry>();
+        assert!(
+            size <= 64,
+            "RouteEntry size must be <= 64 bytes for L1D cacheline packing, got {size}"
+        );
+    }
 }

From ee95ef872e3dae638fa8e46b343e2e81447b4847 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 02:13:33 +0300
Subject: [PATCH 14/53] fix(app): use callable() instead of hasattr(__call__)
 for handler inspection

---
 oxyroute/app.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oxyroute/app.py b/oxyroute/app.py
index 072f797..149e987 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -489,7 +489,7 @@ def wrap(handler: F) -> F:
             target_body_model = body_model
             body_param_name = "json"
 
-            if inspect.isroutine(handler) or hasattr(handler, "__call__"):
+            if callable(handler):
                 try:
                     sig = inspect.signature(handler)
                     reserved_names = {

From f28e18c34064f0b0c5f206dd32308d5ffabcca1b Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 03:10:54 +0300
Subject: [PATCH 15/53] fix(dispatch): restore abi3-py310 compliant call0 and
 kwargs calling

---
 src/dispatch.rs                   | 177 ++++++++++--------------------
 tests/test_vectorcall_dispatch.py |   2 +-
 2 files changed, 60 insertions(+), 119 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 740f8fc..678facd 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -935,73 +935,25 @@ pub async fn run_rsgi(
     } else {
         None
     };
-/// Invoke a Python callable with keyword arguments using PEP 590 Vectorcall protocol.
-/// Avoids allocating and deallocating PyDict hash tables on every request dispatch.
-pub unsafe fn call_vectorcall_kw<'py>(
-    py: Python<'py>,
-    callable: &Bound<'py, PyAny>,
-    kw_pairs: &[(&str, &Bound<'py, PyAny>)],
-) -> PyResult<Bound<'py, PyAny>> {
-    if kw_pairs.is_empty() {
-        let res = pyo3::ffi::PyObject_Vectorcall(
-            callable.as_ptr(),
-            std::ptr::null(),
-            0,
-            std::ptr::null_mut(),
-        );
-        if res.is_null() {
-            return Err(PyErr::fetch(py));
-        }
-        return Ok(Bound::from_owned_ptr(py, res));
-    }
-
-    let n_kw = kw_pairs.len();
-    let mut args_ptrs: Vec<*mut pyo3::ffi::PyObject> = Vec::with_capacity(n_kw);
-    let kwnames_tuple = pyo3::ffi::PyTuple_New(n_kw as isize);
-    if kwnames_tuple.is_null() {
-        return Err(PyErr::fetch(py));
-    }
-
-    for (i, &(name, val)) in kw_pairs.iter().enumerate() {
-        let name_py =
-            pyo3::ffi::PyUnicode_FromStringAndSize(name.as_ptr() as *const _, name.len() as isize);
-        if name_py.is_null() {
-            pyo3::ffi::Py_DECREF(kwnames_tuple);
-            return Err(PyErr::fetch(py));
-        }
-        pyo3::ffi::PyTuple_SetItem(kwnames_tuple, i as isize, name_py);
-        args_ptrs.push(val.as_ptr());
-    }
-
-    let res = pyo3::ffi::PyObject_Vectorcall(
-        callable.as_ptr(),
-        args_ptrs.as_ptr(),
-        0,
-        kwnames_tuple,
-    );
-    pyo3::ffi::Py_DECREF(kwnames_tuple);
-
-    if res.is_null() {
-        return Err(PyErr::fetch(py));
-    }
-    Ok(Bound::from_owned_ptr(py, res))
-}
-
     let mut dep_out: Vec<PyObject> = Vec::with_capacity(dep_factories.len());
     for (i, fact) in dep_factories.iter().enumerate() {
         let o = if dep_is_async.get(i) == Some(&true) {
             let r = match Python::with_gil(|py| -> PyResult<PyObject> {
-                let mut kw_pairs: Vec<(&str, &Bound<'_, PyAny>)> = Vec::with_capacity(i + 1);
+                let kw = PyDict::new(py);
                 if dep_wants_request.get(i) == Some(&true) {
                     if let Some(ref rc) = request_ctx {
-                        kw_pairs.push(("request", rc.bind(py)));
+                        kw.set_item("request", rc.bind(py))?;
                     }
                 }
                 for j in 0..i {
-                    kw_pairs.push((dep_names[j].as_str(), dep_out[j].bind(py)));
+                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
                 }
                 let f = fact.bind(py);
-                unsafe { call_vectorcall_kw(py, f, &kw_pairs).map(|b| b.unbind()) }
+                if kw.is_empty() {
+                    Ok(f.call0()?.unbind())
+                } else {
+                    Ok(f.call((), Some(&kw))?.unbind())
+                }
             }) {
                 Ok(x) => x,
                 Err(e) => {
@@ -1049,17 +1001,21 @@ pub unsafe fn call_vectorcall_kw<'py>(
             }
         } else {
             match Python::with_gil(|py| -> PyResult<PyObject> {
-                let mut kw_pairs: Vec<(&str, &Bound<'_, PyAny>)> = Vec::with_capacity(i + 1);
+                let kw = PyDict::new(py);
                 if dep_wants_request.get(i) == Some(&true) {
                     if let Some(ref rc) = request_ctx {
-                        kw_pairs.push(("request", rc.bind(py)));
+                        kw.set_item("request", rc.bind(py))?;
                     }
                 }
                 for j in 0..i {
-                    kw_pairs.push((dep_names[j].as_str(), dep_out[j].bind(py)));
+                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
                 }
                 let f = fact.bind(py);
-                unsafe { call_vectorcall_kw(py, f, &kw_pairs).map(|b| b.unbind()) }
+                if kw.is_empty() {
+                    Ok(f.call0()?.unbind())
+                } else {
+                    Ok(f.call((), Some(&kw))?.unbind())
+                }
             }) {
                 Ok(x) => x,
                 Err(e) => {
@@ -1079,36 +1035,40 @@ pub unsafe fn call_vectorcall_kw<'py>(
         let db_query_opt = Python::with_gil(|py| -> PyResult<Option<crate::db::DBQuery>> {
             let b = o.bind(py);
             if b.is_instance_of::<crate::db::DBQuery>() {
-                Ok(Some(b.extract::<crate::db::DBQuery>()?))
+                let q: crate::db::DBQuery = b.extract()?;
+                Ok(Some(q))
             } else {
                 Ok(None)
             }
-        });
+        })?;
 
-        let resolved = match db_query_opt {
-            Ok(Some(db_query)) => {
-                if let Some(pool) = snapshot.db_pool.as_ref() {
-                    match crate::db::execute_query(pool, &db_query).await {
-                        Ok(res) => res,
-                        Err(e) => {
-                            return send_python_error(
-                                &protocol,
-                                &method,
-                                &path,
-                                e,
-                                Some(&scope),
-                                Some(&state),
-                            )
-                            .await
-                        }
+        let resolved = if let Some(query) = db_query_opt {
+            let db_pool = match state {
+                Some(st) => st.read().db_pool.clone(),
+                None => None,
+            };
+            match db_pool {
+                Some(pool) => match crate::db::execute_db_query(&pool, query).await {
+                    Ok(py_rows) => py_rows,
+                    Err(e) => {
+                        return send_python_error(
+                            &protocol,
+                            &method,
+                            &path,
+                            e,
+                            Some(&scope),
+                            Some(&state),
+                        )
+                        .await;
                     }
-                } else {
+                },
+                None => {
                     return send_python_error(
                         &protocol,
                         &method,
                         &path,
                         pyo3::exceptions::PyRuntimeError::new_err(
-                            "DBQuery returned by dependency but no database pool configured",
+                            "DBQuery used but database pool is not configured (call app.setup_database first)",
                         ),
                         Some(&scope),
                         Some(&state),
@@ -1116,11 +1076,8 @@ pub unsafe fn call_vectorcall_kw<'py>(
                     .await;
                 }
             }
-            Ok(None) => o,
-            Err(e) => {
-                return send_python_error(&protocol, &method, &path, e, Some(&scope), Some(&state))
-                    .await
-            }
+        } else {
+            o
         };
 
         dep_out.push(resolved);
@@ -1150,50 +1107,45 @@ pub unsafe fn call_vectorcall_kw<'py>(
 
     let (res, run_async) = match Python::with_gil(|py| -> PyResult<RunHandlerResult> {
         if !should_use_kwargs {
-            let res = unsafe { call_vectorcall_kw(py, handler.bind(py), &[])?.unbind() };
+            let res = handler.bind(py).call0()?.unbind();
             return Ok(RunHandlerResult::Ok((res, is_async)));
         }
-        let mut kw_pairs: Vec<(&str, Bound<'_, PyAny>)> = Vec::with_capacity(8);
-        for (k, v) in &param_map {
-            let vpy = value_for_path_param(py, v).into_bound(py);
-            kw_pairs.push((k.as_str(), vpy));
+        let kwargs = PyDict::new(py);
+        for (k, v) in param_map {
+            let vpy = value_for_path_param(py, &v);
+            kwargs.set_item(k, vpy)?;
         }
-        let qd_holder;
         if !query_map.is_empty() {
             let qd = PyDict::new(py);
             for (k, v) in &query_map {
                 qd.set_item(k, v.as_str())?;
             }
-            qd_holder = qd.into_any();
-            kw_pairs.push(("query", qd_holder));
+            kwargs.set_item("query", qd)?;
         }
         for (i, name) in dep_names.iter().enumerate() {
             if let Some(oo) = dep_out.get(i) {
                 if handler_varkw || handler_param_names.contains(name) {
-                    kw_pairs.push((name.as_str(), oo.bind(py).clone()));
+                    kwargs.set_item(name, oo.bind(py))?;
                 }
             }
         }
-        let claims_holder;
         if let Some(ref c) = claims_val {
-            claims_holder = json_to_py(py, c)?.into_bound(py);
-            kw_pairs.push(("claims", claims_holder));
+            let pyv = json_to_py(py, c)?;
+            kwargs.set_item("claims", pyv)?;
         }
-        let body_json_holder;
         if let Some(ref j) = body_json {
             let pyv = json_to_py(py, j)?;
             if let Some(ref bm) = body_model {
                 match bm.bind(py).call_method1("model_validate", (&pyv,)) {
                     Ok(validated) => {
-                        body_json_holder = validated;
                         let target_name = if body_param_name.is_empty() {
                             "json"
                         } else {
                             body_param_name.as_str()
                         };
-                        kw_pairs.push((target_name, body_json_holder.clone()));
+                        kwargs.set_item(target_name, &validated)?;
                         if target_name != "json" && handler_varkw {
-                            kw_pairs.push(("json", body_json_holder.clone()));
+                            kwargs.set_item("json", &validated)?;
                         }
                     }
                     Err(e) => {
@@ -1214,21 +1166,16 @@ pub unsafe fn call_vectorcall_kw<'py>(
                     }
                 }
             } else {
-                body_json_holder = pyv.into_bound(py);
-                kw_pairs.push(("json", body_json_holder));
+                kwargs.set_item("json", pyv)?;
             }
         }
-        let form_holder;
-        let files_holder;
-        let body_bytes_holder;
         if read_form_body {
             if should_pass_form {
                 let fd = PyDict::new(py);
                 for (k, v) in &form_map {
                     fd.set_item(k, v.as_str())?;
                 }
-                form_holder = fd.into_any();
-                kw_pairs.push(("form", form_holder));
+                kwargs.set_item("form", fd)?;
             }
             if should_pass_files {
                 let fl = PyList::empty(py);
@@ -1243,21 +1190,15 @@ pub unsafe fn call_vectorcall_kw<'py>(
                     d.set_item("data", PyBytes::new(py, &f.data))?;
                     fl.append(d)?;
                 }
-                files_holder = fl.into_any();
-                kw_pairs.push(("files", files_holder));
+                kwargs.set_item("files", fl)?;
             }
         } else if should_pass_body {
-            body_bytes_holder = PyBytes::new(py, &body_bytes).into_any();
-            kw_pairs.push(("body", body_bytes_holder));
+            kwargs.set_item("body", PyBytes::new(py, &body_bytes))?;
         }
-        let protocol_holder;
         if should_pass_protocol {
-            protocol_holder = protocol.bind(py).clone();
-            kw_pairs.push(("protocol", protocol_holder));
+            kwargs.set_item("protocol", protocol.bind(py))?;
         }
-        let kw_ref: Vec<(&str, &Bound<'_, PyAny>)> =
-            kw_pairs.iter().map(|(k, v)| (*k, v)).collect();
-        let res = unsafe { call_vectorcall_kw(py, handler.bind(py), &kw_ref)?.unbind() };
+        let res = handler.bind(py).call((), Some(&kwargs))?.unbind();
         Ok(RunHandlerResult::Ok((res, is_async)))
     }) {
         Ok(RunHandlerResult::Ok((res, is_async))) => (res, is_async),
diff --git a/tests/test_vectorcall_dispatch.py b/tests/test_vectorcall_dispatch.py
index 5cde75b..6c900cd 100644
--- a/tests/test_vectorcall_dispatch.py
+++ b/tests/test_vectorcall_dispatch.py
@@ -34,7 +34,7 @@ async def handle_deps(dep_a: str, dep_b: str) -> dict[str, str]:
         return {"dep_a": dep_a, "dep_b": dep_b}
 
     @app.post("/pydantic", body_model=Item)
-    def handle_pydantic(json: Item) -> dict[str, object]:
+    def handle_pydantic(json: Item) -> dict[str, Any]:
         return {"name": json.name, "price": json.price}
 
     async def _run() -> None:

From 0fe8cc653a356fb0bc93be3f6984fdef01c7b7f3 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 09:32:48 +0300
Subject: [PATCH 16/53] fix(dispatch): fix db query execution and pool
 reference in RSGI dispatch

---
 src/dispatch.rs | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 678facd..b1e3909 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -1043,12 +1043,9 @@ pub async fn run_rsgi(
         })?;
 
         let resolved = if let Some(query) = db_query_opt {
-            let db_pool = match state {
-                Some(st) => st.read().db_pool.clone(),
-                None => None,
-            };
+            let db_pool = state.read().db_pool.clone();
             match db_pool {
-                Some(pool) => match crate::db::execute_db_query(&pool, query).await {
+                Some(pool) => match crate::db::execute_query(&pool, &query).await {
                     Ok(py_rows) => py_rows,
                     Err(e) => {
                         return send_python_error(

From b2cd52a1dfa99be120ae4e0f1fce5630d31fc23d Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 09:39:56 +0300
Subject: [PATCH 17/53] fix(dispatch): filter kwargs passed to dependency
 factories by declared signature

---
 src/dispatch.rs          | 132 +++++++++++++++------------------------
 src/lib.rs               |  36 ++++++++---
 src/state.rs             |   2 +
 tests/test_validation.py |   1 -
 4 files changed, 82 insertions(+), 89 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index b1e3909..5a9b7a2 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -690,6 +690,8 @@ pub async fn run_rsgi(
             Arc::clone(&e.extra.dep_factories),
             Arc::clone(&e.extra.dep_is_async),
             Arc::clone(&e.extra.dep_wants_request),
+            Arc::clone(&e.extra.dep_factory_params),
+            Arc::clone(&e.extra.dep_factory_varkw),
             Arc::clone(&e.extra.handler_param_names),
             e.handler_varkw,
             e.body_model.clone(),
@@ -736,59 +738,46 @@ pub async fn run_rsgi(
     } else {
         Vec::new()
     };
-    let (auth, cookie_raw): (Option<String>, Option<String>) = if require_jwt {
-        Python::with_gil(|py| -> PyResult<(Option<String>, Option<String>)> {
-            let s = scope.bind(py);
-            let headers = s.getattr("headers")?;
-            Ok((
-                header_get_lax(&headers, "authorization"),
-                header_get_lax(&headers, "cookie"),
-            ))
-        })?
-    } else {
-        (None, None)
-    };
     let mut claims_val: Option<JsonValue> = None;
     if require_jwt {
-        let (dk, val) = match (jwt_decoding_key.as_ref(), jwt_validation.as_ref()) {
-            (Some(dk), Some(val)) => (dk, val),
+        let (key_arc, val_arc) = match (&jwt_decoding_key, &jwt_validation) {
+            (Some(k), Some(v)) => (Arc::clone(k), Arc::clone(v)),
             _ => {
-                return response::send_text(
+                return send_python_error(
                     &protocol,
-                    401,
-                    "Unauthorized",
-                    "text/plain; charset=utf-8",
+                    &method,
+                    &path,
+                    pyo3::exceptions::PyRuntimeError::new_err(
+                        "require_jwt is true but JWT decoding state is missing",
+                    ),
+                    Some(&scope),
+                    Some(&state),
                 )
-                .await
+                .await;
             }
         };
-        let token: String = match extract_bearer(auth.as_deref()).filter(|s| !s.is_empty()) {
-            Some(t) => t,
-            None => match (jwt_cookie.as_deref(), cookie_raw.as_deref()) {
-                (Some(cname), Some(raw)) => match extract_cookie_value(raw, cname) {
-                    Some(t) if !t.is_empty() => t,
-                    _ => {
-                        return response::send_text(
-                            &protocol,
-                            401,
-                            "Unauthorized",
-                            "text/plain; charset=utf-8",
-                        )
-                        .await;
-                    }
-                },
-                _ => {
-                    return response::send_text(
-                        &protocol,
-                        401,
-                        "Unauthorized",
-                        "text/plain; charset=utf-8",
-                    )
+        let token_opt = match extract_token_from_request(
+            &scope,
+            &jwt_cookie,
+            &param_map,
+            &query_string,
+        ) {
+            Ok(t) => t,
+            Err(e) => {
+                return send_python_error(&protocol, &method, &path, e, Some(&scope), Some(&state))
                     .await;
-                }
-            },
+            }
+        };
+        let Some(raw_token) = token_opt else {
+            return response::send_text(
+                &protocol,
+                401,
+                "Unauthorized",
+                "text/plain; charset=utf-8",
+            )
+            .await;
         };
-        match decode::<JsonValue>(&token, dk.as_ref(), val.as_ref()) {
+        match decode::<JsonValue>(&raw_token, &key_arc, &val_arc) {
             Ok(data) => {
                 claims_val = Some(data.claims);
             }
@@ -866,51 +855,25 @@ pub async fn run_rsgi(
                     .await;
                 }
             };
-            if ct.as_deref().map(str::is_empty) != Some(false) {
-                return response::send_text(
-                    &protocol,
-                    400,
-                    r#"{"error":"missing content-type"}"#,
-                    "application/json; charset=utf-8",
-                )
-                .await;
-            }
-            let cts = ct.unwrap();
-            let lower = cts.to_ascii_lowercase();
-            if lower.starts_with("application/x-www-form-urlencoded") {
-                (form::parse_urlencoded_form(&body_bytes), vec![])
-            } else if lower.starts_with("multipart/form-data") {
-                let boundary = match multer::parse_boundary(&cts) {
-                    Ok(b) => b,
-                    Err(_) => {
-                        return response::send_text(
-                            &protocol,
-                            400,
-                            r#"{"error":"invalid multipart boundary"}"#,
-                            "application/json; charset=utf-8",
-                        )
-                        .await
-                    }
-                };
-                let multipart_body = std::mem::take(&mut body_bytes);
-                let parsed = match form::parse_multipart(multipart_body, &boundary).await {
+            if let Some(ref content_type) = ct {
+                let parsed = match form::parse_form_or_multipart(content_type, &body_bytes) {
                     Ok(p) => p,
                     Err(e) => {
                         return response::send_text(
                             &protocol,
                             400,
-                            &format!(r#"{{"error":"multipart: {e}"}}"#),
+                            &format!(r#"{{"error":"{e}"}}"#),
                             "application/json; charset=utf-8",
                         )
-                        .await
+                        .await;
                     }
                 };
                 (parsed.form, parsed.files)
             } else {
                 return response::send_text(
                     &protocol,
-                    415,
-                    r#"{"error":"expected application/x-www-form-urlencoded or multipart/form-data"}"#,
+                    400,
+                    r#"{"error":"missing content-type"}"#,
                     "application/json; charset=utf-8",
                 )
                 .await;
@@ -937,16 +900,22 @@ pub async fn run_rsgi(
     };
     let mut dep_out: Vec<PyObject> = Vec::with_capacity(dep_factories.len());
     for (i, fact) in dep_factories.iter().enumerate() {
+        let wants_request = dep_wants_request.get(i) == Some(&true);
+        let factory_params = dep_factory_params.get(i);
+        let factory_varkw = dep_factory_varkw.get(i).copied().unwrap_or(false);
         let o = if dep_is_async.get(i) == Some(&true) {
             let r = match Python::with_gil(|py| -> PyResult<PyObject> {
                 let kw = PyDict::new(py);
-                if dep_wants_request.get(i) == Some(&true) {
+                if wants_request {
                     if let Some(ref rc) = request_ctx {
                         kw.set_item("request", rc.bind(py))?;
                     }
                 }
                 for j in 0..i {
-                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
+                    let name = &dep_names[j];
+                    if factory_varkw || factory_params.map_or(true, |p| p.contains(name)) {
+                        kw.set_item(name.as_str(), dep_out[j].bind(py))?;
+                    }
                 }
                 let f = fact.bind(py);
                 if kw.is_empty() {
@@ -1002,13 +971,16 @@ pub async fn run_rsgi(
         } else {
             match Python::with_gil(|py| -> PyResult<PyObject> {
                 let kw = PyDict::new(py);
-                if dep_wants_request.get(i) == Some(&true) {
+                if wants_request {
                     if let Some(ref rc) = request_ctx {
                         kw.set_item("request", rc.bind(py))?;
                     }
                 }
                 for j in 0..i {
-                    kw.set_item(dep_names[j].as_str(), dep_out[j].bind(py))?;
+                    let name = &dep_names[j];
+                    if factory_varkw || factory_params.map_or(true, |p| p.contains(name)) {
+                        kw.set_item(name.as_str(), dep_out[j].bind(py))?;
+                    }
                 }
                 let f = fact.bind(py);
                 if kw.is_empty() {
diff --git a/src/lib.rs b/src/lib.rs
index bae4c58..09bb94a 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -53,7 +53,14 @@ pub mod microbench {
     }
 }
 
-type ParsedDependencies = (Vec<String>, Vec<Py<PyAny>>, Vec<bool>, Vec<bool>);
+type ParsedDependencies = (
+    Vec<String>,
+    Vec<Py<PyAny>>,
+    Vec<bool>,
+    Vec<bool>,
+    Vec<HashSet<String>>,
+    Vec<bool>,
+);
 
 /// Parameter names the route handler accepts, plus whether it has `**kwargs`.
 fn handler_signature_kinds(
@@ -95,6 +102,8 @@ fn parse_dependencies(py: Python<'_>, dep_list: &Bound<PyList>) -> PyResult<Pars
     let mut facts = Vec::with_capacity(n);
     let mut asy = Vec::with_capacity(n);
     let mut want_req = Vec::with_capacity(n);
+    let mut factory_params = Vec::with_capacity(n);
+    let mut factory_varkw = Vec::with_capacity(n);
     for i in 0..n {
         let it = dep_list.get_item(i)?;
         let tup = it.downcast::<PyTuple>()?;
@@ -113,12 +122,15 @@ fn parse_dependencies(py: Python<'_>, dep_list: &Bound<PyList>) -> PyResult<Pars
         let is_a: bool = iscoro.call1((f.clone_ref(py),))?.extract()?;
         let f_b = f.bind(py);
         let has_req: bool = dependency_wants_request(py, f_b)?;
+        let (params, varkw) = handler_signature_kinds(py, f_b)?;
         names.push(name);
         facts.push(f);
         asy.push(is_a);
         want_req.push(has_req);
+        factory_params.push(params);
+        factory_varkw.push(varkw);
     }
-    Ok((names, facts, asy, want_req))
+    Ok((names, facts, asy, want_req, factory_params, factory_varkw))
 }
 
 /// True if the factory declares a `request` parameter (for the request context dict).
@@ -350,12 +362,18 @@ impl App {
         } else {
             (None, None)
         };
-        let (dep_names, dep_factories, dep_is_async, dep_wants_request) =
-            if let Some(d) = dependencies {
-                parse_dependencies(py, &d)?
-            } else {
-                (vec![], vec![], vec![], vec![])
-            };
+        let (
+            dep_names,
+            dep_factories,
+            dep_is_async,
+            dep_wants_request,
+            dep_factory_params,
+            dep_factory_varkw,
+        ) = if let Some(d) = dependencies {
+            parse_dependencies(py, &d)?
+        } else {
+            (vec![], vec![], vec![], vec![], vec![], vec![])
+        };
         let op_id: String = handler
             .bind(py)
             .getattr(pyo3::intern!(py, "__name__"))?
@@ -380,6 +398,8 @@ impl App {
             dep_factories: Arc::<[Py<PyAny>]>::from(dep_factories),
             dep_is_async: Arc::<[bool]>::from(dep_is_async),
             dep_wants_request: Arc::<[bool]>::from(dep_wants_request),
+            dep_factory_params: Arc::<[HashSet<String>]>::from(dep_factory_params),
+            dep_factory_varkw: Arc::<[bool]>::from(dep_factory_varkw),
             handler_param_names: Arc::new(handler_param_names),
             body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
         });
diff --git a/src/state.rs b/src/state.rs
index 827d8ab..c280e76 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -47,6 +47,8 @@ pub struct RouteExtra {
     pub dep_factories: Arc<[Py<PyAny>]>,
     pub dep_is_async: Arc<[bool]>,
     pub dep_wants_request: Arc<[bool]>,
+    pub dep_factory_params: Arc<[HashSet<String>]>,
+    pub dep_factory_varkw: Arc<[bool]>,
     pub handler_param_names: Arc<HashSet<String>>,
     pub body_param_name: String,
 }
diff --git a/tests/test_validation.py b/tests/test_validation.py
index 4844e1b..d1cf68f 100644
--- a/tests/test_validation.py
+++ b/tests/test_validation.py
@@ -107,4 +107,3 @@ async def _run() -> None:
     up = seen["updated"]
     assert isinstance(up, UserBody)
     assert up.name == "David"
-

From a1d5350637929d211f2e8054411763912246fdf3 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 09:42:42 +0300
Subject: [PATCH 18/53] fix(dispatch): correct route entry destructure and kw
 filtering

---
 src/dispatch.rs | 115 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 78 insertions(+), 37 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 5a9b7a2..2119a87 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -669,6 +669,8 @@ pub async fn run_rsgi(
         dep_factories,
         dep_is_async,
         dep_wants_request,
+        dep_factory_params,
+        dep_factory_varkw,
         handler_param_names,
         handler_varkw,
         body_model,
@@ -738,46 +740,59 @@ pub async fn run_rsgi(
     } else {
         Vec::new()
     };
+    let (auth, cookie_raw): (Option<String>, Option<String>) = if require_jwt {
+        Python::with_gil(|py| -> PyResult<(Option<String>, Option<String>)> {
+            let s = scope.bind(py);
+            let headers = s.getattr("headers")?;
+            Ok((
+                header_get_lax(&headers, "authorization"),
+                header_get_lax(&headers, "cookie"),
+            ))
+        })?
+    } else {
+        (None, None)
+    };
     let mut claims_val: Option<JsonValue> = None;
     if require_jwt {
-        let (key_arc, val_arc) = match (&jwt_decoding_key, &jwt_validation) {
-            (Some(k), Some(v)) => (Arc::clone(k), Arc::clone(v)),
+        let (dk, val) = match (jwt_decoding_key.as_ref(), jwt_validation.as_ref()) {
+            (Some(dk), Some(val)) => (dk, val),
             _ => {
-                return send_python_error(
+                return response::send_text(
                     &protocol,
-                    &method,
-                    &path,
-                    pyo3::exceptions::PyRuntimeError::new_err(
-                        "require_jwt is true but JWT decoding state is missing",
-                    ),
-                    Some(&scope),
-                    Some(&state),
+                    401,
+                    "Unauthorized",
+                    "text/plain; charset=utf-8",
                 )
-                .await;
+                .await
             }
         };
-        let token_opt = match extract_token_from_request(
-            &scope,
-            &jwt_cookie,
-            &param_map,
-            &query_string,
-        ) {
-            Ok(t) => t,
-            Err(e) => {
-                return send_python_error(&protocol, &method, &path, e, Some(&scope), Some(&state))
+        let token: String = match extract_bearer(auth.as_deref()).filter(|s| !s.is_empty()) {
+            Some(t) => t,
+            None => match (jwt_cookie.as_deref(), cookie_raw.as_deref()) {
+                (Some(cname), Some(raw)) => match extract_cookie_value(raw, cname) {
+                    Some(t) if !t.is_empty() => t,
+                    _ => {
+                        return response::send_text(
+                            &protocol,
+                            401,
+                            "Unauthorized",
+                            "text/plain; charset=utf-8",
+                        )
+                        .await;
+                    }
+                },
+                _ => {
+                    return response::send_text(
+                        &protocol,
+                        401,
+                        "Unauthorized",
+                        "text/plain; charset=utf-8",
+                    )
                     .await;
-            }
-        };
-        let Some(raw_token) = token_opt else {
-            return response::send_text(
-                &protocol,
-                401,
-                "Unauthorized",
-                "text/plain; charset=utf-8",
-            )
-            .await;
+                }
+            },
         };
-        match decode::<JsonValue>(&raw_token, &key_arc, &val_arc) {
+        match decode::<JsonValue>(&token, dk.as_ref(), val.as_ref()) {
             Ok(data) => {
                 claims_val = Some(data.claims);
             }
@@ -855,25 +870,51 @@ pub async fn run_rsgi(
                     .await;
                 }
             };
-            if let Some(ref content_type) = ct {
-                let parsed = match form::parse_form_or_multipart(content_type, &body_bytes) {
+            if ct.as_deref().map(str::is_empty) != Some(false) {
+                return response::send_text(
+                    &protocol,
+                    400,
+                    r#"{"error":"missing content-type"}"#,
+                    "application/json; charset=utf-8",
+                )
+                .await;
+            }
+            let cts = ct.unwrap();
+            let lower = cts.to_ascii_lowercase();
+            if lower.starts_with("application/x-www-form-urlencoded") {
+                (form::parse_urlencoded_form(&body_bytes), vec![])
+            } else if lower.starts_with("multipart/form-data") {
+                let boundary = match multer::parse_boundary(&cts) {
+                    Ok(b) => b,
+                    Err(_) => {
+                        return response::send_text(
+                            &protocol,
+                            400,
+                            r#"{"error":"invalid multipart boundary"}"#,
+                            "application/json; charset=utf-8",
+                        )
+                        .await
+                    }
+                };
+                let multipart_body = std::mem::take(&mut body_bytes);
+                let parsed = match form::parse_multipart(multipart_body, &boundary).await {
                     Ok(p) => p,
                     Err(e) => {
                         return response::send_text(
                             &protocol,
                             400,
-                            &format!(r#"{{"error":"{e}"}}"#),
+                            &format!(r#"{{"error":"multipart: {e}"}}"#),
                             "application/json; charset=utf-8",
                         )
-                        .await;
+                        .await
                     }
                 };
                 (parsed.form, parsed.files)
             } else {
                 return response::send_text(
                     &protocol,
-                    400,
-                    r#"{"error":"missing content-type"}"#,
+                    415,
+                    r#"{"error":"expected application/x-www-form-urlencoded or multipart/form-data"}"#,
                     "application/json; charset=utf-8",
                 )
                 .await;

From 0395bb0602077a17ff8501c426130bf74c710ddd Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 10:09:54 +0300
Subject: [PATCH 19/53] fix(clippy): use is_none_or instead of map_or(true,
 ...)

---
 src/dispatch.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 2119a87..a5796b2 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -954,7 +954,7 @@ pub async fn run_rsgi(
                 }
                 for j in 0..i {
                     let name = &dep_names[j];
-                    if factory_varkw || factory_params.map_or(true, |p| p.contains(name)) {
+                    if factory_varkw || factory_params.is_none_or(|p| p.contains(name)) {
                         kw.set_item(name.as_str(), dep_out[j].bind(py))?;
                     }
                 }
@@ -1019,7 +1019,7 @@ pub async fn run_rsgi(
                 }
                 for j in 0..i {
                     let name = &dep_names[j];
-                    if factory_varkw || factory_params.map_or(true, |p| p.contains(name)) {
+                    if factory_varkw || factory_params.is_none_or(|p| p.contains(name)) {
                         kw.set_item(name.as_str(), dep_out[j].bind(py))?;
                     }
                 }

From 68942135cb1f753ec4fd8116f8758e26aa19c080 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 10:23:14 +0300
Subject: [PATCH 20/53] perf(cache): unify dependency arrays into contiguous
 Arc<[DependencyEntry]> (#148)

---
 src/dispatch.rs | 51 ++++++++++++++------------------------
 src/lib.rs      | 66 +++++++++++++++++--------------------------------
 src/state.rs    | 18 +++++++++-----
 3 files changed, 54 insertions(+), 81 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index a5796b2..4f4836d 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -665,12 +665,7 @@ pub async fn run_rsgi(
         jwt_validation,
         read_json_body,
         read_form_body,
-        dep_names,
-        dep_factories,
-        dep_is_async,
-        dep_wants_request,
-        dep_factory_params,
-        dep_factory_varkw,
+        dependencies,
         handler_param_names,
         handler_varkw,
         body_model,
@@ -688,12 +683,7 @@ pub async fn run_rsgi(
             e.extra.jwt_validation.clone(),
             e.read_json_body,
             e.read_form_body,
-            Arc::clone(&e.extra.dep_names),
-            Arc::clone(&e.extra.dep_factories),
-            Arc::clone(&e.extra.dep_is_async),
-            Arc::clone(&e.extra.dep_wants_request),
-            Arc::clone(&e.extra.dep_factory_params),
-            Arc::clone(&e.extra.dep_factory_varkw),
+            Arc::clone(&e.extra.dependencies),
             Arc::clone(&e.extra.handler_param_names),
             e.handler_varkw,
             e.body_model.clone(),
@@ -923,7 +913,7 @@ pub async fn run_rsgi(
     } else {
         (HashMap::new(), vec![])
     };
-    let need_req_ctx = dep_wants_request.iter().any(|&x| x);
+    let need_req_ctx = dependencies.iter().any(|d| d.wants_request);
     let request_ctx: Option<Py<PyAny>> = if need_req_ctx {
         match Python::with_gil(|py| -> PyResult<Py<PyAny>> {
             let s = scope.bind(py);
@@ -939,26 +929,23 @@ pub async fn run_rsgi(
     } else {
         None
     };
-    let mut dep_out: Vec<PyObject> = Vec::with_capacity(dep_factories.len());
-    for (i, fact) in dep_factories.iter().enumerate() {
-        let wants_request = dep_wants_request.get(i) == Some(&true);
-        let factory_params = dep_factory_params.get(i);
-        let factory_varkw = dep_factory_varkw.get(i).copied().unwrap_or(false);
-        let o = if dep_is_async.get(i) == Some(&true) {
+    let mut dep_out: Vec<PyObject> = Vec::with_capacity(dependencies.len());
+    for (i, dep) in dependencies.iter().enumerate() {
+        let o = if dep.is_async {
             let r = match Python::with_gil(|py| -> PyResult<PyObject> {
                 let kw = PyDict::new(py);
-                if wants_request {
+                if dep.wants_request {
                     if let Some(ref rc) = request_ctx {
                         kw.set_item("request", rc.bind(py))?;
                     }
                 }
-                for j in 0..i {
-                    let name = &dep_names[j];
-                    if factory_varkw || factory_params.is_none_or(|p| p.contains(name)) {
+                for (j, prev_dep) in dependencies[..i].iter().enumerate() {
+                    let name = &prev_dep.name;
+                    if dep.factory_varkw || dep.factory_params.contains(name) {
                         kw.set_item(name.as_str(), dep_out[j].bind(py))?;
                     }
                 }
-                let f = fact.bind(py);
+                let f = dep.factory.bind(py);
                 if kw.is_empty() {
                     Ok(f.call0()?.unbind())
                 } else {
@@ -1012,18 +999,18 @@ pub async fn run_rsgi(
         } else {
             match Python::with_gil(|py| -> PyResult<PyObject> {
                 let kw = PyDict::new(py);
-                if wants_request {
+                if dep.wants_request {
                     if let Some(ref rc) = request_ctx {
                         kw.set_item("request", rc.bind(py))?;
                     }
                 }
-                for j in 0..i {
-                    let name = &dep_names[j];
-                    if factory_varkw || factory_params.is_none_or(|p| p.contains(name)) {
+                for (j, prev_dep) in dependencies[..i].iter().enumerate() {
+                    let name = &prev_dep.name;
+                    if dep.factory_varkw || dep.factory_params.contains(name) {
                         kw.set_item(name.as_str(), dep_out[j].bind(py))?;
                     }
                 }
-                let f = fact.bind(py);
+                let f = dep.factory.bind(py);
                 if kw.is_empty() {
                     Ok(f.call0()?.unbind())
                 } else {
@@ -1132,10 +1119,10 @@ pub async fn run_rsgi(
             }
             kwargs.set_item("query", qd)?;
         }
-        for (i, name) in dep_names.iter().enumerate() {
+        for (i, dep) in dependencies.iter().enumerate() {
             if let Some(oo) = dep_out.get(i) {
-                if handler_varkw || handler_param_names.contains(name) {
-                    kwargs.set_item(name, oo.bind(py))?;
+                if handler_varkw || handler_param_names.contains(&dep.name) {
+                    kwargs.set_item(&dep.name, oo.bind(py))?;
                 }
             }
         }
diff --git a/src/lib.rs b/src/lib.rs
index 09bb94a..f057457 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -53,15 +53,6 @@ pub mod microbench {
     }
 }
 
-type ParsedDependencies = (
-    Vec<String>,
-    Vec<Py<PyAny>>,
-    Vec<bool>,
-    Vec<bool>,
-    Vec<HashSet<String>>,
-    Vec<bool>,
-);
-
 /// Parameter names the route handler accepts, plus whether it has `**kwargs`.
 fn handler_signature_kinds(
     py: Python<'_>,
@@ -94,16 +85,15 @@ fn parse_algorithm(s: &str) -> PyResult<jsonwebtoken::Algorithm> {
     })
 }
 
-fn parse_dependencies(py: Python<'_>, dep_list: &Bound<PyList>) -> PyResult<ParsedDependencies> {
+fn parse_dependencies(
+    py: Python<'_>,
+    dep_list: &Bound<PyList>,
+) -> PyResult<Vec<state::DependencyEntry>> {
     let inspect = py.import("inspect")?;
     let iscoro = inspect.getattr("iscoroutinefunction")?;
     let n = dep_list.len();
-    let mut names = Vec::with_capacity(n);
-    let mut facts = Vec::with_capacity(n);
-    let mut asy = Vec::with_capacity(n);
-    let mut want_req = Vec::with_capacity(n);
-    let mut factory_params = Vec::with_capacity(n);
-    let mut factory_varkw = Vec::with_capacity(n);
+    let mut names = HashSet::with_capacity(n);
+    let mut out = Vec::with_capacity(n);
     for i in 0..n {
         let it = dep_list.get_item(i)?;
         let tup = it.downcast::<PyTuple>()?;
@@ -113,24 +103,26 @@ fn parse_dependencies(py: Python<'_>, dep_list: &Bound<PyList>) -> PyResult<Pars
             ));
         }
         let name: String = tup.get_item(0)?.extract()?;
-        if names.contains(&name) {
+        if !names.insert(name.clone()) {
             return Err(pyo3::exceptions::PyValueError::new_err(
                 "duplicate dependency name",
             ));
         }
         let f: Py<PyAny> = tup.get_item(1)?.unbind();
-        let is_a: bool = iscoro.call1((f.clone_ref(py),))?.extract()?;
+        let is_async: bool = iscoro.call1((f.clone_ref(py),))?.extract()?;
         let f_b = f.bind(py);
-        let has_req: bool = dependency_wants_request(py, f_b)?;
-        let (params, varkw) = handler_signature_kinds(py, f_b)?;
-        names.push(name);
-        facts.push(f);
-        asy.push(is_a);
-        want_req.push(has_req);
-        factory_params.push(params);
-        factory_varkw.push(varkw);
+        let wants_request: bool = dependency_wants_request(py, f_b)?;
+        let (factory_params, factory_varkw) = handler_signature_kinds(py, f_b)?;
+        out.push(state::DependencyEntry {
+            name,
+            factory: f,
+            is_async,
+            wants_request,
+            factory_params,
+            factory_varkw,
+        });
     }
-    Ok((names, facts, asy, want_req, factory_params, factory_varkw))
+    Ok(out)
 }
 
 /// True if the factory declares a `request` parameter (for the request context dict).
@@ -362,17 +354,10 @@ impl App {
         } else {
             (None, None)
         };
-        let (
-            dep_names,
-            dep_factories,
-            dep_is_async,
-            dep_wants_request,
-            dep_factory_params,
-            dep_factory_varkw,
-        ) = if let Some(d) = dependencies {
+        let dependencies = if let Some(d) = dependencies {
             parse_dependencies(py, &d)?
         } else {
-            (vec![], vec![], vec![], vec![], vec![], vec![])
+            vec![]
         };
         let op_id: String = handler
             .bind(py)
@@ -383,7 +368,7 @@ impl App {
             && !require_jwt
             && !read_json_body
             && !read_form_body
-            && dep_factories.is_empty()
+            && dependencies.is_empty()
             && !handler_varkw
             && handler_param_names.is_empty();
         let mut st = self.state.write();
@@ -394,12 +379,7 @@ impl App {
             jwt_cookie,
             jwt_decoding_key,
             jwt_validation,
-            dep_names: Arc::<[String]>::from(dep_names),
-            dep_factories: Arc::<[Py<PyAny>]>::from(dep_factories),
-            dep_is_async: Arc::<[bool]>::from(dep_is_async),
-            dep_wants_request: Arc::<[bool]>::from(dep_wants_request),
-            dep_factory_params: Arc::<[HashSet<String>]>::from(dep_factory_params),
-            dep_factory_varkw: Arc::<[bool]>::from(dep_factory_varkw),
+            dependencies: Arc::<[state::DependencyEntry]>::from(dependencies),
             handler_param_names: Arc::new(handler_param_names),
             body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
         });
diff --git a/src/state.rs b/src/state.rs
index c280e76..a1d8847 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -36,6 +36,17 @@ pub struct WebsocketRoute {
     pub is_async: bool,
 }
 
+/// A single route dependency definition.
+#[derive(Clone)]
+pub struct DependencyEntry {
+    pub name: String,
+    pub factory: Py<PyAny>,
+    pub is_async: bool,
+    pub wants_request: bool,
+    pub factory_params: HashSet<String>,
+    pub factory_varkw: bool,
+}
+
 /// Auxiliary / cold metadata for a route.
 #[derive(Clone)]
 pub struct RouteExtra {
@@ -43,12 +54,7 @@ pub struct RouteExtra {
     pub jwt_cookie: Option<String>,
     pub jwt_decoding_key: Option<Arc<jsonwebtoken::DecodingKey>>,
     pub jwt_validation: Option<Arc<jsonwebtoken::Validation>>,
-    pub dep_names: Arc<[String]>,
-    pub dep_factories: Arc<[Py<PyAny>]>,
-    pub dep_is_async: Arc<[bool]>,
-    pub dep_wants_request: Arc<[bool]>,
-    pub dep_factory_params: Arc<[HashSet<String>]>,
-    pub dep_factory_varkw: Arc<[bool]>,
+    pub dependencies: Arc<[DependencyEntry]>,
     pub handler_param_names: Arc<HashSet<String>>,
     pub body_param_name: String,
 }

From f97dbaef4612d9af40c265ef61b766c35e8b84b5 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 10:33:32 +0300
Subject: [PATCH 21/53] fix(dispatch): use dependencies for has_dep_kwargs
 check

---
 src/dispatch.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 4f4836d..08213db 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -1085,8 +1085,8 @@ pub async fn run_rsgi(
         read_form_body && (handler_varkw || handler_param_names.contains("files"));
     let should_pass_protocol = handler_varkw || handler_param_names.contains("protocol");
     let should_pass_body = !read_form_body && !body_bytes.is_empty() && body_json.is_none();
-    let has_dep_kwargs = dep_names.iter().enumerate().any(|(i, name)| {
-        dep_out.get(i).is_some() && (handler_varkw || handler_param_names.contains(name))
+    let has_dep_kwargs = dependencies.iter().enumerate().any(|(i, dep)| {
+        dep_out.get(i).is_some() && (handler_varkw || handler_param_names.contains(&dep.name))
     });
     let should_use_kwargs = !param_map.is_empty()
         || !query_map.is_empty()

From fbb7049fe1263447c782d1ffa75369c04a5716a0 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 10:50:30 +0300
Subject: [PATCH 22/53] perf(routing): single-pass bitmask / unified radix
 lookup for 405 Method Not Allowed (#139)

---
 src/lib.rs   |   4 ++
 src/state.rs | 155 +++++++++++++++++++++------------------------------
 2 files changed, 69 insertions(+), 90 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index f057457..4e50344 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -433,6 +433,10 @@ impl App {
             m.insert(&path, idx)
                 .map_err(|e| pyo3::exceptions::PyValueError::new_err(format!("{e}")))?;
         }
+        {
+            let mut masks = st.path_method_masks.lock();
+            masks.entry(path).or_default().insert_method(&method);
+        }
         // Keep auto-compiled routing snapshots fresh when routes are added before explicit freeze().
         st.compiled = None;
         Ok(())
diff --git a/src/state.rs b/src/state.rs
index a1d8847..eae8538 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -5,6 +5,55 @@ use matchit::Router;
 use parking_lot::Mutex;
 use pyo3::prelude::*;
 
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct MethodMask(pub u8);
+
+impl MethodMask {
+    pub const GET: u8 = 1 << 0;
+    pub const HEAD: u8 = 1 << 1;
+    pub const POST: u8 = 1 << 2;
+    pub const PUT: u8 = 1 << 3;
+    pub const PATCH: u8 = 1 << 4;
+    pub const DELETE: u8 = 1 << 5;
+    pub const OPTIONS: u8 = 1 << 6;
+
+    pub fn from_method(method: &str) -> Self {
+        match method {
+            "GET" => Self(Self::GET | Self::HEAD),
+            "HEAD" => Self(Self::HEAD),
+            "POST" => Self(Self::POST),
+            "PUT" => Self(Self::PUT),
+            "PATCH" => Self(Self::PATCH),
+            "DELETE" => Self(Self::DELETE),
+            "OPTIONS" => Self(Self::OPTIONS),
+            _ => Self(0),
+        }
+    }
+
+    pub fn insert_method(&mut self, method: &str) {
+        self.0 |= Self::from_method(method).0;
+    }
+
+    pub fn to_vec(self) -> Vec<String> {
+        const ORDER: [(&str, u8); 7] = [
+            ("GET", MethodMask::GET),
+            ("HEAD", MethodMask::HEAD),
+            ("POST", MethodMask::POST),
+            ("PUT", MethodMask::PUT),
+            ("PATCH", MethodMask::PATCH),
+            ("DELETE", MethodMask::DELETE),
+            ("OPTIONS", MethodMask::OPTIONS),
+        ];
+        let mut out = Vec::with_capacity(7);
+        for (name, flag) in ORDER {
+            if (self.0 & flag) != 0 {
+                out.push(name.to_string());
+            }
+        }
+        out
+    }
+}
+
 /// Immutable route tables built at [`AppState::freeze`](AppState) time so the request
 /// path can be matched without per-method `Mutex` locks (issue #4).
 pub struct CompiledRouters {
@@ -15,6 +64,7 @@ pub struct CompiledRouters {
     pub delete: Router<usize>,
     pub options: Router<usize>,
     pub websocket: Router<usize>,
+    pub all_paths: Router<MethodMask>,
 }
 
 fn router_for_compiled<'a>(c: &'a CompiledRouters, method: &str) -> Option<&'a Router<usize>> {
@@ -117,6 +167,8 @@ pub struct AppState {
     pub security_headers: Option<Py<PyAny>>,
     /// Global connection pool for the Postgres database.
     pub db_pool: Option<sqlx::PgPool>,
+    /// Bitmask of allowed HTTP methods per registered path template.
+    pub path_method_masks: Mutex<std::collections::HashMap<String, MethodMask>>,
 }
 
 impl AppState {
@@ -146,6 +198,7 @@ impl AppState {
             cors: None,
             security_headers: None,
             db_pool: None,
+            path_method_masks: Mutex::new(std::collections::HashMap::new()),
         }
     }
 
@@ -172,6 +225,10 @@ impl AppState {
 
     /// Clone current mutex-protected [`Router`]s into a snapshot (used at freeze / tests).
     pub fn snapshot_routers(&self) -> CompiledRouters {
+        let mut all_paths = Router::new();
+        for (path, mask) in self.path_method_masks.lock().iter() {
+            let _ = all_paths.insert(path, *mask);
+        }
         CompiledRouters {
             get: self.get.lock().clone(),
             post: self.post.lock().clone(),
@@ -180,6 +237,7 @@ impl AppState {
             delete: self.delete.lock().clone(),
             options: self.options.lock().clone(),
             websocket: self.websocket.lock().clone(),
+            all_paths,
         }
     }
 }
@@ -235,33 +293,11 @@ pub fn match_route_compiled(
 
 /// All HTTP methods that match `path` in a precomputed [`CompiledRouters`] (lock-free 405 list).
 pub fn methods_matching_path_compiled(compiled: &CompiledRouters, path: &str) -> Vec<String> {
-    const ORDER: [&str; 7] = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-    let mut have = [false; 7];
-    if compiled.get.at(path).is_ok() {
-        have[0] = true;
-        have[1] = true;
-    }
-    if compiled.post.at(path).is_ok() {
-        have[2] = true;
-    }
-    if compiled.put.at(path).is_ok() {
-        have[3] = true;
-    }
-    if compiled.patch.at(path).is_ok() {
-        have[4] = true;
-    }
-    if compiled.delete.at(path).is_ok() {
-        have[5] = true;
-    }
-    if compiled.options.at(path).is_ok() {
-        have[6] = true;
+    if let Ok(m) = compiled.all_paths.at(path) {
+        m.value.to_vec()
+    } else {
+        Vec::new()
     }
-    ORDER
-        .iter()
-        .zip(have)
-        .filter(|(_, ok)| *ok)
-        .map(|(m, _)| (*m).to_string())
-        .collect()
 }
 
 pub fn map_method_router<'a>(
@@ -286,73 +322,12 @@ pub fn map_method_router<'a>(
 /// [1]: https://www.rfc-editor.org/rfc/rfc9110#name-405-method-not-allowed
 #[cfg(test)]
 fn methods_matching_path(state: &AppState, path: &str) -> Vec<String> {
-    const ORDER: [&str; 7] = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
-    let mut have = [false; 7];
     if let Some(c) = &state.compiled {
-        if c.get.at(path).is_ok() {
-            have[0] = true;
-            have[1] = true;
-        }
-        if c.post.at(path).is_ok() {
-            have[2] = true;
-        }
-        if c.put.at(path).is_ok() {
-            have[3] = true;
-        }
-        if c.patch.at(path).is_ok() {
-            have[4] = true;
-        }
-        if c.delete.at(path).is_ok() {
-            have[5] = true;
-        }
-        if c.options.at(path).is_ok() {
-            have[6] = true;
-        }
+        methods_matching_path_compiled(c, path)
     } else {
-        {
-            let g = state.get.lock();
-            if g.at(path).is_ok() {
-                have[0] = true;
-                have[1] = true;
-            }
-        }
-        {
-            let r = state.post.lock();
-            if r.at(path).is_ok() {
-                have[2] = true;
-            }
-        }
-        {
-            let r = state.put.lock();
-            if r.at(path).is_ok() {
-                have[3] = true;
-            }
-        }
-        {
-            let r = state.patch.lock();
-            if r.at(path).is_ok() {
-                have[4] = true;
-            }
-        }
-        {
-            let r = state.delete.lock();
-            if r.at(path).is_ok() {
-                have[5] = true;
-            }
-        }
-        {
-            let r = state.options.lock();
-            if r.at(path).is_ok() {
-                have[6] = true;
-            }
-        }
+        let compiled = state.snapshot_routers();
+        methods_matching_path_compiled(&compiled, path)
     }
-    ORDER
-        .iter()
-        .zip(have)
-        .filter(|(_, ok)| *ok)
-        .map(|(m, _)| (*m).to_string())
-        .collect()
 }
 
 /// Returns route index and path params, or `None` if the method is unsupported; `Some(None)` if

From d5764d85754afeca160669f2f345313223ade607 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 10:53:51 +0300
Subject: [PATCH 23/53] fix(bench): initialize all_paths in
 sample_compiled_routers

---
 src/lib.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/lib.rs b/src/lib.rs
index 4e50344..bce9c1b 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -36,6 +36,16 @@ pub mod microbench {
         let mut get = Router::new();
         get.insert("/hello", 0usize).expect("static route");
         get.insert("/items/:id", 1usize).expect("param route");
+        let mut all_paths = Router::new();
+        all_paths
+            .insert("/hello", crate::state::MethodMask::from_method("GET"))
+            .expect("static all_paths");
+        all_paths
+            .insert(
+                "/items/:id",
+                crate::state::MethodMask::from_method("GET"),
+            )
+            .expect("param all_paths");
         CompiledRouters {
             get,
             post: Router::new(),
@@ -44,6 +54,7 @@ pub mod microbench {
             delete: Router::new(),
             options: Router::new(),
             websocket: Router::new(),
+            all_paths,
         }
     }
 

From f7a9e9c0f82b869630aa3516c0b5c9bf1ca01532 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:01:23 +0300
Subject: [PATCH 24/53] style: format sample_compiled_routers in lib.rs

---
 src/lib.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index bce9c1b..b2b0f12 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -41,10 +41,7 @@ pub mod microbench {
             .insert("/hello", crate::state::MethodMask::from_method("GET"))
             .expect("static all_paths");
         all_paths
-            .insert(
-                "/items/:id",
-                crate::state::MethodMask::from_method("GET"),
-            )
+            .insert("/items/:id", crate::state::MethodMask::from_method("GET"))
             .expect("param all_paths");
         CompiledRouters {
             get,

From 02cd1286c1adccbceb3b2abc5241acbfc66b3dbd Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:21:03 +0300
Subject: [PATCH 25/53] fix(test): support direct router insertions and update
 methods_matching_path_uses_compiled

---
 src/state.rs | 51 ++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 13 deletions(-)

diff --git a/src/state.rs b/src/state.rs
index eae8538..3994736 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -294,10 +294,38 @@ pub fn match_route_compiled(
 /// All HTTP methods that match `path` in a precomputed [`CompiledRouters`] (lock-free 405 list).
 pub fn methods_matching_path_compiled(compiled: &CompiledRouters, path: &str) -> Vec<String> {
     if let Ok(m) = compiled.all_paths.at(path) {
-        m.value.to_vec()
-    } else {
-        Vec::new()
+        let v = m.value.to_vec();
+        if !v.is_empty() {
+            return v;
+        }
+    }
+    const ORDER: [&str; 7] = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+    let mut have = [false; 7];
+    if compiled.get.at(path).is_ok() {
+        have[0] = true;
+        have[1] = true;
+    }
+    if compiled.post.at(path).is_ok() {
+        have[2] = true;
+    }
+    if compiled.put.at(path).is_ok() {
+        have[3] = true;
     }
+    if compiled.patch.at(path).is_ok() {
+        have[4] = true;
+    }
+    if compiled.delete.at(path).is_ok() {
+        have[5] = true;
+    }
+    if compiled.options.at(path).is_ok() {
+        have[6] = true;
+    }
+    ORDER
+        .iter()
+        .zip(have)
+        .filter(|(_, ok)| *ok)
+        .map(|(m, _)| (*m).to_string())
+        .collect()
 }
 
 pub fn map_method_router<'a>(
@@ -331,23 +359,15 @@ fn methods_matching_path(state: &AppState, path: &str) -> Vec<String> {
 }
 
 /// Returns route index and path params, or `None` if the method is unsupported; `Some(None)` if
-/// no match; `Some(Some)` on success. Uses [`CompiledRouters`] when set (lock-free).
+/// method is valid but path did not match.
 #[cfg(test)]
-#[allow(clippy::type_complexity)]
 fn match_route(
     state: &AppState,
     method: &str,
     path: &str,
 ) -> Option<Option<(usize, Vec<(String, String)>)>> {
     if let Some(c) = &state.compiled {
-        let g = router_for_compiled(c, method)?;
-        return Some(g.at(path).ok().map(|m| {
-            let mut pmap = Vec::new();
-            for (k, v) in m.params.iter() {
-                pmap.push((k.to_string(), v.to_string()));
-            }
-            (*m.value, pmap)
-        }));
+        return match_route_compiled(c, method, path);
     }
     let g = map_method_router(state, method)?;
     Some(g.at(path).ok().map(|m| {
@@ -389,6 +409,11 @@ mod tests {
     fn methods_matching_path_uses_compiled() {
         let mut s = AppState::new();
         s.post.lock().insert("/x", 0usize).unwrap();
+        s.path_method_masks
+            .lock()
+            .entry("/x".to_string())
+            .or_default()
+            .insert_method("POST");
         s.compiled = Some(Arc::new(s.snapshot_routers()));
         let m = methods_matching_path(&s, "/x");
         assert_eq!(m, vec!["POST".to_string()]);

From 38bdff6d8441763e2384b1b717c932fff9f69096 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:28:24 +0300
Subject: [PATCH 26/53] fix(clippy): allow type_complexity on test helper
 match_route

---
 src/state.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/state.rs b/src/state.rs
index 3994736..70f9ae4 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -361,6 +361,7 @@ fn methods_matching_path(state: &AppState, path: &str) -> Vec<String> {
 /// Returns route index and path params, or `None` if the method is unsupported; `Some(None)` if
 /// method is valid but path did not match.
 #[cfg(test)]
+#[allow(clippy::type_complexity)]
 fn match_route(
     state: &AppState,
     method: &str,

From a8f4a5436db30d41096f658f1cbc5cc6f9a77ca5 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:39:56 +0300
Subject: [PATCH 27/53] perf(params): zero-allocation path parameter extraction
 from URL slices (#140)

---
 src/dispatch.rs | 14 ++++++++------
 src/params.rs   |  2 +-
 src/state.rs    | 42 ++++++++++++++++++------------------------
 3 files changed, 27 insertions(+), 31 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 08213db..376f5af 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -638,7 +638,7 @@ pub async fn run_rsgi(
         None => Err(pyo3::exceptions::PyValueError::new_err("method")),
         Some(m) => Ok(m),
     }?;
-    let (route_idx, param_map) = match route_out {
+    let (route_idx, params) = match route_out {
         Some(x) => x,
         None => {
             let m = methods_matching_path_compiled(&compiled, &path);
@@ -1088,7 +1088,7 @@ pub async fn run_rsgi(
     let has_dep_kwargs = dependencies.iter().enumerate().any(|(i, dep)| {
         dep_out.get(i).is_some() && (handler_varkw || handler_param_names.contains(&dep.name))
     });
-    let should_use_kwargs = !param_map.is_empty()
+    let should_use_kwargs = !params.is_empty()
         || !query_map.is_empty()
         || has_dep_kwargs
         || claims_val.is_some()
@@ -1108,8 +1108,8 @@ pub async fn run_rsgi(
             return Ok(RunHandlerResult::Ok((res, is_async)));
         }
         let kwargs = PyDict::new(py);
-        for (k, v) in param_map {
-            let vpy = value_for_path_param(py, &v);
+        for (k, v) in params.iter() {
+            let vpy = value_for_path_param(py, v);
             kwargs.set_item(k, vpy)?;
         }
         if !query_map.is_empty() {
@@ -1771,7 +1771,7 @@ async fn run_rsgi_websocket(
     };
     let ws_routes = Arc::clone(&snapshot.websocket_routes);
     let route_match = match_ws_route_compiled(&compiled, &path);
-    let Some((route_idx, param_map)) = route_match else {
+    let Some((route_idx, params)) = route_match else {
         // No route → polite close. ``close`` is sync on RSGIWebsocketProtocol.
         let _ = Python::with_gil(|py| -> PyResult<()> {
             let p = protocol.bind(py);
@@ -1786,8 +1786,10 @@ async fn run_rsgi_websocket(
             .ok_or_else(|| pyo3::exceptions::PyRuntimeError::new_err("ws route index"))?;
         Ok((e.handler.clone(), e.is_async))
     })?;
+    let path_params: Vec<(String, String)> =
+        params.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
     let call_result = Python::with_gil(|py| -> PyResult<(PyObject, bool)> {
-        let ws = WebSocket::new(protocol.clone_ref(py), scope.clone_ref(py), param_map);
+        let ws = WebSocket::new(protocol.clone_ref(py), scope.clone_ref(py), path_params);
         let py_ws = Py::new(py, ws)?;
         let res = handler.bind(py).call1((py_ws,))?.unbind();
         Ok((res, is_async))
diff --git a/src/params.rs b/src/params.rs
index 84dbc48..6938ec4 100644
--- a/src/params.rs
+++ b/src/params.rs
@@ -102,7 +102,7 @@ pub fn value_for_path_param(py: Python<'_>, s: &str) -> Py<PyAny> {
             return f.into_py_any(py).expect("f64 to Python");
         }
     }
-    s.to_string().into_py_any(py).expect("str to Python")
+    pyo3::types::PyString::new(py, s).into_any().unbind()
 }
 
 pub fn header_get_lax(headers: &Bound<'_, PyAny>, name: &str) -> Option<String> {
diff --git a/src/state.rs b/src/state.rs
index 70f9ae4..32591c3 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -259,36 +259,23 @@ pub struct HotSnapshot {
 }
 
 /// Lookup a WebSocket route in a precomputed [`CompiledRouters`] (lock-free).
-pub fn match_ws_route_compiled(
-    compiled: &CompiledRouters,
-    path: &str,
-) -> Option<(usize, Vec<(String, String)>)> {
-    compiled.websocket.at(path).ok().map(|m| {
-        let mut pmap = Vec::new();
-        for (k, v) in m.params.iter() {
-            pmap.push((k.to_string(), v.to_string()));
-        }
-        (*m.value, pmap)
-    })
+pub fn match_ws_route_compiled<'a, 'b>(
+    compiled: &'a CompiledRouters,
+    path: &'b str,
+) -> Option<(usize, matchit::Params<'a, 'b>)> {
+    compiled.websocket.at(path).ok().map(|m| (*m.value, m.params))
 }
 
 /// Lookup an HTTP route in a precomputed [`CompiledRouters`] (lock-free).
 ///
 /// Returns ``None`` for unsupported method, ``Some(None)`` for no match, ``Some(Some(...))`` on hit.
-#[allow(clippy::type_complexity)]
-pub fn match_route_compiled(
-    compiled: &CompiledRouters,
+pub fn match_route_compiled<'a, 'b>(
+    compiled: &'a CompiledRouters,
     method: &str,
-    path: &str,
-) -> Option<Option<(usize, Vec<(String, String)>)>> {
+    path: &'b str,
+) -> Option<Option<(usize, matchit::Params<'a, 'b>)>> {
     let g = router_for_compiled(compiled, method)?;
-    Some(g.at(path).ok().map(|m| {
-        let mut pmap = Vec::new();
-        for (k, v) in m.params.iter() {
-            pmap.push((k.to_string(), v.to_string()));
-        }
-        (*m.value, pmap)
-    }))
+    Some(g.at(path).ok().map(|m| (*m.value, m.params)))
 }
 
 /// All HTTP methods that match `path` in a precomputed [`CompiledRouters`] (lock-free 405 list).
@@ -368,7 +355,14 @@ fn match_route(
     path: &str,
 ) -> Option<Option<(usize, Vec<(String, String)>)>> {
     if let Some(c) = &state.compiled {
-        return match_route_compiled(c, method, path);
+        let res = match_route_compiled(c, method, path)?;
+        return Some(res.map(|(idx, params)| {
+            let mut pmap = Vec::new();
+            for (k, v) in params.iter() {
+                pmap.push((k.to_string(), v.to_string()));
+            }
+            (idx, pmap)
+        }));
     }
     let g = map_method_router(state, method)?;
     Some(g.at(path).ok().map(|m| {

From 90caf70f947cfdaee39ce6d191222d4d880176f7 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:48:05 +0300
Subject: [PATCH 28/53] style: format dispatch.rs and state.rs per cargo fmt

---
 src/dispatch.rs | 6 ++++--
 src/state.rs    | 6 +++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 376f5af..5ff6b2e 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -1786,8 +1786,10 @@ async fn run_rsgi_websocket(
             .ok_or_else(|| pyo3::exceptions::PyRuntimeError::new_err("ws route index"))?;
         Ok((e.handler.clone(), e.is_async))
     })?;
-    let path_params: Vec<(String, String)> =
-        params.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
+    let path_params: Vec<(String, String)> = params
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect();
     let call_result = Python::with_gil(|py| -> PyResult<(PyObject, bool)> {
         let ws = WebSocket::new(protocol.clone_ref(py), scope.clone_ref(py), path_params);
         let py_ws = Py::new(py, ws)?;
diff --git a/src/state.rs b/src/state.rs
index 32591c3..2952518 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -263,7 +263,11 @@ pub fn match_ws_route_compiled<'a, 'b>(
     compiled: &'a CompiledRouters,
     path: &'b str,
 ) -> Option<(usize, matchit::Params<'a, 'b>)> {
-    compiled.websocket.at(path).ok().map(|m| (*m.value, m.params))
+    compiled
+        .websocket
+        .at(path)
+        .ok()
+        .map(|m| (*m.value, m.params))
 }
 
 /// Lookup an HTTP route in a precomputed [`CompiledRouters`] (lock-free).

From 5345138d47da9bd45fe9e7c3b45f3eb3fb0c69a7 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 11:58:58 +0300
Subject: [PATCH 29/53] perf(memory): implement thread-local buffer pool for
 request bodies (#160)

---
 src/buffer_pool.rs | 84 ++++++++++++++++++++++++++++++++++++++++++++++
 src/dispatch.rs    | 25 ++++++++------
 src/lib.rs         |  1 +
 3 files changed, 100 insertions(+), 10 deletions(-)
 create mode 100644 src/buffer_pool.rs

diff --git a/src/buffer_pool.rs b/src/buffer_pool.rs
new file mode 100644
index 0000000..3fd55de
--- /dev/null
+++ b/src/buffer_pool.rs
@@ -0,0 +1,84 @@
+//! Thread-local buffer pool for request bodies to prevent heap fragmentation (issue #160).
+
+use std::cell::RefCell;
+use std::ops::{Deref, DerefMut};
+
+const POOL_CAPACITY_LIMIT: usize = 128 * 1024;
+const INITIAL_BUFFER_CAPACITY: usize = 16 * 1024;
+const MAX_POOL_SIZE: usize = 64;
+
+thread_local! {
+    static BODY_POOL: RefCell<Vec<Vec<u8>>> = const { RefCell::new(Vec::new()) };
+}
+
+/// RAII wrapper around a pooled `Vec<u8>` that automatically returns itself to the
+/// thread-local buffer pool on `Drop` if capacity <= 128 KB.
+pub struct PooledBuffer(Vec<u8>);
+
+impl PooledBuffer {
+    pub fn new() -> Self {
+        let buf = BODY_POOL
+            .with(|pool| pool.borrow_mut().pop())
+            .unwrap_or_else(|| Vec::with_capacity(INITIAL_BUFFER_CAPACITY));
+        Self(buf)
+    }
+
+    pub fn take(&mut self) -> Vec<u8> {
+        std::mem::take(&mut self.0)
+    }
+}
+
+impl Default for PooledBuffer {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Deref for PooledBuffer {
+    type Target = Vec<u8>;
+
+    #[inline]
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl DerefMut for PooledBuffer {
+    #[inline]
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl Drop for PooledBuffer {
+    fn drop(&mut self) {
+        if self.0.capacity() >= INITIAL_BUFFER_CAPACITY && self.0.capacity() <= POOL_CAPACITY_LIMIT {
+            self.0.clear();
+            let buf = std::mem::take(&mut self.0);
+            BODY_POOL.with(|pool| {
+                let mut p = pool.borrow_mut();
+                if p.len() < MAX_POOL_SIZE {
+                    p.push(buf);
+                }
+            });
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_pooled_buffer_recycle() {
+        {
+            let mut buf = PooledBuffer::new();
+            buf.extend_from_slice(b"hello world");
+            assert_eq!(&*buf, b"hello world");
+        }
+        // Dropped -> returned to pool.
+        let buf2 = PooledBuffer::new();
+        assert!(buf2.is_empty());
+        assert!(buf2.capacity() >= INITIAL_BUFFER_CAPACITY);
+    }
+}
diff --git a/src/dispatch.rs b/src/dispatch.rs
index 5ff6b2e..5c2cebf 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -10,6 +10,7 @@ use pyo3::types::{PyBytes, PyDict, PyList, PyString, PyTuple};
 use pyo3::IntoPyObjectExt;
 use serde_json::Value as JsonValue;
 
+use crate::buffer_pool::PooledBuffer;
 use crate::config;
 use crate::form::{self, ParsedFile};
 use crate::params::{build_request_context, header_get_lax, parse_query, value_for_path_param};
@@ -699,22 +700,26 @@ pub async fn run_rsgi(
             routes_arc[route_idx].extra.path_template.clone(),
         )
     });
-    let mut body_bytes: Vec<u8> = if should_read_body {
+    let mut body_bytes: PooledBuffer = if should_read_body {
         let read_fut = Python::with_gil(|py| {
             let p = protocol.bind(py);
             let aw: Bound<PyAny> = p.call0()?;
             pyo3_async_runtimes::tokio::into_future(aw)
         })?;
         let body_obj: PyObject = read_fut.await?;
-        let body = Python::with_gil(|py| -> PyResult<Vec<u8>> {
+        let mut body = PooledBuffer::new();
+        Python::with_gil(|py| -> PyResult<()> {
             let b = body_obj.bind(py);
-            if let Ok(x) = b.extract::<Vec<u8>>() {
-                return Ok(x);
-            }
-            if let Ok(s) = b.str() {
-                return Ok(s.to_string().into_bytes());
+            if let Ok(py_bytes) = b.downcast::<pyo3::types::PyBytes>() {
+                body.extend_from_slice(py_bytes.as_bytes());
+            } else if let Ok(py_str) = b.downcast::<pyo3::types::PyString>() {
+                if let Ok(s) = py_str.to_str() {
+                    body.extend_from_slice(s.as_bytes());
+                }
+            } else if let Ok(bytes_vec) = b.extract::<Vec<u8>>() {
+                body.extend_from_slice(&bytes_vec);
             }
-            Ok(Vec::new())
+            Ok(())
         })?;
         let max = form::max_body_bytes();
         if (body.len() as u64) > max {
@@ -728,7 +733,7 @@ pub async fn run_rsgi(
         }
         body
     } else {
-        Vec::new()
+        PooledBuffer::new()
     };
     let (auth, cookie_raw): (Option<String>, Option<String>) = if require_jwt {
         Python::with_gil(|py| -> PyResult<(Option<String>, Option<String>)> {
@@ -886,7 +891,7 @@ pub async fn run_rsgi(
                         .await
                     }
                 };
-                let multipart_body = std::mem::take(&mut body_bytes);
+                let multipart_body = body_bytes.take();
                 let parsed = match form::parse_multipart(multipart_body, &boundary).await {
                     Ok(p) => p,
                     Err(e) => {
diff --git a/src/lib.rs b/src/lib.rs
index b2b0f12..fccab15 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,6 +8,7 @@ use pyo3::prelude::*;
 use pyo3::types::{PyDict, PyList, PyTuple};
 use serde_json::json;
 
+mod buffer_pool;
 mod config;
 mod db;
 mod dispatch;

From 4a3a789237e4ba86f4a4fa47277da7f8f52251e3 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 12:16:23 +0300
Subject: [PATCH 30/53] chore(deps): upgrade oxyjwt to >=0.7.0 and drop pyjwt /
 cryptography

---
 docs/jwt.md                  | 4 ++--
 perf-test/bench_scenarios.sh | 4 ++--
 pyproject.toml               | 6 ++----
 tests/test_jwt_rs256.py      | 7 ++++---
 4 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/docs/jwt.md b/docs/jwt.md
index 98b8e8c..acde5c1 100644
--- a/docs/jwt.md
+++ b/docs/jwt.md
@@ -38,9 +38,9 @@ The handler is **not** executed when:
 
 ## `decode_jwt_hs` (Python, for tests and HS parity)
 
-The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification in Python tests, use your usual stack (e.g. **PyJWT** + `cryptography` with the same PEM keys).
+The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification and token generation in Python tests, use [`oxyjwt`](https://pypi.org/project/oxyjwt) (`EncodingKey.from_*_pem` / `DecodingKey.from_*_pem`).
 
-**Optional dev dependencies:** `oxyjwt`, `pyjwt`, and `cryptography` are in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
+**Optional dev dependencies:** `oxyjwt` is in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
 
 ## See also
 
diff --git a/perf-test/bench_scenarios.sh b/perf-test/bench_scenarios.sh
index 9145c6c..47026cc 100755
--- a/perf-test/bench_scenarios.sh
+++ b/perf-test/bench_scenarios.sh
@@ -45,9 +45,9 @@ _jwt_token() {
   "${PYTHON}" - <<'PY'
 import time
 try:
-    import jwt
+    import oxyjwt as jwt
 except ImportError as e:
-    raise SystemExit("PyJWT required for JWT scenario: uv sync --extra bench") from e
+    raise SystemExit("oxyjwt required for JWT scenario: uv sync --extra bench") from e
 print(jwt.encode(
     {"sub": "bench", "exp": int(time.time()) + 3600},
     "bench-secret-key-do-not-use-in-prod",
diff --git a/pyproject.toml b/pyproject.toml
index 6eabe0e..27da592 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,10 +37,8 @@ dev = [
     "granian>=1.0",
     "pytest>=8",
     "httpx>=0.27",
-    "oxyjwt>=0.2",
+    "oxyjwt>=0.7.0",
     "pydantic>=2",
-    "pyjwt>=2.8",
-    "cryptography>=42",
     "ruff>=0.8",
 ]
 # Hello-world RPS compare vs FastAPI (see perf-test/bench_hello.sh); not required for library use.
@@ -48,7 +46,7 @@ bench = [
     "fastapi>=0.100",
     "granian>=1.0",
     "httpx>=0.27",
-    "pyjwt>=2.8",
+    "oxyjwt>=0.7.0",
 ]
 
 [tool.maturin]
diff --git a/tests/test_jwt_rs256.py b/tests/test_jwt_rs256.py
index 54507a4..7d8cc41 100644
--- a/tests/test_jwt_rs256.py
+++ b/tests/test_jwt_rs256.py
@@ -7,7 +7,7 @@
 from pathlib import Path
 
 import httpx
-import jwt
+import oxyjwt
 import pytest
 from oxyroute import App
 from oxyroute.testing import asgi_test_app
@@ -19,9 +19,10 @@
 
 def test_asgi_jwt_rs256_bearer() -> None:
     now = int(time.time())
-    tok = jwt.encode(
+    signing_key = oxyjwt.EncodingKey.from_rsa_pem(_PRIV)
+    tok = oxyjwt.encode(
         {"sub": "u-rs", "exp": now + 3600},
-        _PRIV,
+        signing_key,
         algorithm="RS256",
     )
     assert isinstance(tok, str)

From 708281df9a6f943bfd52bcfae431bc2dbd967ad6 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 16:06:53 +0300
Subject: [PATCH 31/53] perf(cache): consolidate HotSnapshot atomic refcounts
 into single Arc<FrozenState> (#149)

---
 src/dispatch.rs | 43 ++++++++++++++-----------------------
 src/lib.rs      | 14 ++++++++++++-
 src/state.rs    | 56 +++++++++++++++++++++++++++++++++----------------
 3 files changed, 67 insertions(+), 46 deletions(-)

diff --git a/src/dispatch.rs b/src/dispatch.rs
index 5ff6b2e..0177a34 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -316,6 +316,7 @@ fn ensure_compiled_snapshot(state: &Arc<RwLock<AppState>>) -> Arc<CompiledRouter
     let mut st = state.write();
     if st.compiled.is_none() {
         st.compiled = Some(Arc::new(st.snapshot_routers()));
+        st.rebuild_snapshot();
     }
     Arc::clone(st.compiled.as_ref().expect("just populated"))
 }
@@ -472,20 +473,6 @@ pub async fn run_rsgi(
     let Some((method, path, query_string, is_head, snapshot)) = prelim else {
         return Ok(Python::with_gil(|py| py.None()));
     };
-    type CfgClones = (
-        Option<Py<PyAny>>,
-        Option<Py<PyAny>>,
-        Arc<Vec<Py<PyAny>>>,
-        Arc<Vec<Py<PyAny>>>,
-    );
-    let (cors_cfg, security_cfg, req_mw, res_mw): CfgClones = Python::with_gil(|_py| {
-        (
-            snapshot.cors.clone(),
-            snapshot.security_headers.clone(),
-            snapshot.request_middleware.clone(),
-            snapshot.response_middleware.clone(),
-        )
-    });
     if (method == "GET" || method == "HEAD") && path == "/openapi.json" && snapshot.include_openapi
     {
         let _ = Python::with_gil(|py| {
@@ -539,7 +526,7 @@ pub async fn run_rsgi(
             }
         }
     }
-    for mw in req_mw.iter() {
+    for mw in snapshot.request_middleware.iter() {
         let out: Py<PyAny> = match Python::with_gil(|py| {
             let f = mw.bind(py);
             f.call1((scope.bind(py), protocol.bind(py)))
@@ -556,10 +543,12 @@ pub async fn run_rsgi(
             return match Python::with_gil(|py| -> PyResult<()> {
                 let mut mapped = map_handler_return(py, &out)?;
 
-                if !res_mw.is_empty() && !matches!(mapped, HandlerMap::AlreadySent) {
+                if !snapshot.response_middleware.is_empty()
+                    && !matches!(mapped, HandlerMap::AlreadySent)
+                {
                     let response_module = py.import("oxyroute.response")?;
                     let response_class = response_module.getattr("Response")?;
-                    for res_m in res_mw.iter() {
+                    for res_m in snapshot.response_middleware.iter() {
                         let kwargs = pyo3::types::PyDict::new(py);
                         match &mapped {
                             HandlerMap::Simple {
@@ -605,16 +594,16 @@ pub async fn run_rsgi(
                     }
                 }
 
-                let mapped = if security_cfg.is_some() || cors_cfg.is_some() {
+                let mapped = if snapshot.security_headers.is_some() || snapshot.cors.is_some() {
                     let scope_bound = scope.bind(py).clone();
                     let mapped = merge_config_response_headers(
                         py,
-                        &security_cfg,
+                        &snapshot.security_headers,
                         scope_bound.clone(),
                         mapped,
                         true,
                     )?;
-                    merge_config_response_headers(py, &cors_cfg, scope_bound, mapped, false)?
+                    merge_config_response_headers(py, &snapshot.cors, scope_bound, mapped, false)?
                 } else {
                     mapped
                 };
@@ -1240,10 +1229,10 @@ pub async fn run_rsgi(
     match Python::with_gil(|py| -> PyResult<()> {
         let mut mapped = map_handler_return(py, &handler_out)?;
 
-        if !res_mw.is_empty() && !matches!(mapped, HandlerMap::AlreadySent) {
+        if !snapshot.response_middleware.is_empty() && !matches!(mapped, HandlerMap::AlreadySent) {
             let response_module = py.import("oxyroute.response")?;
             let response_class = response_module.getattr("Response")?;
-            for res_m in res_mw.iter() {
+            for res_m in snapshot.response_middleware.iter() {
                 let kwargs = pyo3::types::PyDict::new(py);
                 match &mapped {
                     HandlerMap::Simple {
@@ -1287,16 +1276,16 @@ pub async fn run_rsgi(
             }
         }
 
-        let mapped = if security_cfg.is_some() || cors_cfg.is_some() {
+        let mapped = if snapshot.security_headers.is_some() || snapshot.cors.is_some() {
             let scope_bound = scope.bind(py).clone();
             let mapped = merge_config_response_headers(
                 py,
-                &security_cfg,
+                &snapshot.security_headers,
                 scope_bound.clone(),
                 mapped,
                 true,
             )?;
-            merge_config_response_headers(py, &cors_cfg, scope_bound, mapped, false)?
+            merge_config_response_headers(py, &snapshot.cors, scope_bound, mapped, false)?
         } else {
             mapped
         };
@@ -1769,7 +1758,6 @@ async fn run_rsgi_websocket(
         Some(c) => c,
         None => ensure_compiled_snapshot(&state),
     };
-    let ws_routes = Arc::clone(&snapshot.websocket_routes);
     let route_match = match_ws_route_compiled(&compiled, &path);
     let Some((route_idx, params)) = route_match else {
         // No route → polite close. ``close`` is sync on RSGIWebsocketProtocol.
@@ -1781,7 +1769,8 @@ async fn run_rsgi_websocket(
         return Ok(Python::with_gil(|py| py.None()));
     };
     let (handler, is_async) = Python::with_gil(|_py| -> PyResult<(Py<PyAny>, bool)> {
-        let e = ws_routes
+        let e = snapshot
+            .websocket_routes
             .get(route_idx)
             .ok_or_else(|| pyo3::exceptions::PyRuntimeError::new_err("ws route index"))?;
         Ok((e.handler.clone(), e.is_async))
diff --git a/src/lib.rs b/src/lib.rs
index b2b0f12..20f2937 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -447,6 +447,7 @@ impl App {
         }
         // Keep auto-compiled routing snapshots fresh when routes are added before explicit freeze().
         st.compiled = None;
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -480,6 +481,7 @@ impl App {
                 .map_err(|e| pyo3::exceptions::PyValueError::new_err(format!("{e}")))?;
         }
         st.compiled = None;
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -490,12 +492,14 @@ impl App {
         if st.compiled.is_none() {
             st.compiled = Some(Arc::new(st.snapshot_routers()));
         }
+        st.rebuild_snapshot();
         Ok(())
     }
 
     fn set_openapi_served(&self, enabled: bool) -> PyResult<()> {
         let mut st = self.state.write();
         st.include_openapi = enabled;
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -568,6 +572,7 @@ impl App {
         })
         .unwrap_or(false);
         Arc::make_mut(&mut st.exception_handlers).push((exc_type.unbind(), handler, is_async));
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -578,6 +583,7 @@ impl App {
         } else {
             st.request_middleware = Arc::new(Vec::new());
         }
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -596,6 +602,7 @@ impl App {
                 "phase must be 'request', 'response', or 'both'",
             ));
         }
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -603,6 +610,7 @@ impl App {
     fn set_cors(&self, config: Option<Py<PyAny>>) -> PyResult<()> {
         let mut st = self.state.write();
         st.cors = config;
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -611,6 +619,7 @@ impl App {
     fn set_security_headers(&self, config: Option<Py<PyAny>>) -> PyResult<()> {
         let mut st = self.state.write();
         st.security_headers = config;
+        st.rebuild_snapshot();
         Ok(())
     }
 
@@ -633,6 +642,7 @@ impl App {
                 })?;
             let mut st = state.write();
             st.db_pool = Some(pool);
+            st.rebuild_snapshot();
             Ok(())
         })
     }
@@ -643,7 +653,9 @@ impl App {
         pyo3_async_runtimes::tokio::future_into_py(py, async move {
             let pool = {
                 let mut st = state.write();
-                st.db_pool.take()
+                let p = st.db_pool.take();
+                st.rebuild_snapshot();
+                p
             };
             if let Some(p) = pool {
                 p.close().await;
diff --git a/src/state.rs b/src/state.rs
index 2952518..801f896 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -169,6 +169,7 @@ pub struct AppState {
     pub db_pool: Option<sqlx::PgPool>,
     /// Bitmask of allowed HTTP methods per registered path template.
     pub path_method_masks: Mutex<std::collections::HashMap<String, MethodMask>>,
+    pub snapshot: Arc<FrozenState>,
 }
 
 impl AppState {
@@ -178,9 +179,26 @@ impl AppState {
             "info": { "title": "OxyRoute", "version": "0.5.0" },
             "paths": {}
         });
+        let routes = Arc::new(Vec::new());
+        let websocket_routes = Arc::new(Vec::new());
+        let request_middleware = Arc::new(Vec::new());
+        let response_middleware = Arc::new(Vec::new());
+        let exception_handlers = Arc::new(Vec::new());
+        let snapshot = Arc::new(FrozenState {
+            routes: Arc::clone(&routes),
+            websocket_routes: Arc::clone(&websocket_routes),
+            compiled: None,
+            cors: None,
+            security_headers: None,
+            request_middleware: Arc::clone(&request_middleware),
+            response_middleware: Arc::clone(&response_middleware),
+            exception_handlers: Arc::clone(&exception_handlers),
+            include_openapi: true,
+            db_pool: None,
+        });
         Self {
-            routes: Arc::new(Vec::new()),
-            websocket_routes: Arc::new(Vec::new()),
+            routes,
+            websocket_routes,
             get: Mutex::new(Router::new()),
             post: Mutex::new(Router::new()),
             put: Mutex::new(Router::new()),
@@ -192,24 +210,19 @@ impl AppState {
             compiled: None,
             frozen: false,
             include_openapi: true,
-            request_middleware: Arc::new(Vec::new()),
-            response_middleware: Arc::new(Vec::new()),
-            exception_handlers: Arc::new(Vec::new()),
+            request_middleware,
+            response_middleware,
+            exception_handlers,
             cors: None,
             security_headers: None,
             db_pool: None,
             path_method_masks: Mutex::new(std::collections::HashMap::new()),
+            snapshot,
         }
     }
 
-    /// Cheap read-side snapshot of the fields the request hot path touches: the
-    /// returned [`HotSnapshot`] is built **inside one** `state.read()` so the request
-    /// dispatch can release the `RwLock` immediately and avoid further reads.
-    ///
-    /// Cheap because every cloned field is `Arc::clone` / `Option<Py<PyAny>>::clone`
-    /// (both refcount bumps), not deep clones.
-    pub fn hot_snapshot(&self) -> HotSnapshot {
-        HotSnapshot {
+    pub fn rebuild_snapshot(&mut self) {
+        self.snapshot = Arc::new(FrozenState {
             routes: Arc::clone(&self.routes),
             websocket_routes: Arc::clone(&self.websocket_routes),
             compiled: self.compiled.as_ref().map(Arc::clone),
@@ -220,7 +233,13 @@ impl AppState {
             exception_handlers: Arc::clone(&self.exception_handlers),
             include_openapi: self.include_openapi,
             db_pool: self.db_pool.clone(),
-        }
+        });
+    }
+
+    /// Read-side snapshot of the fields the request hot path touches: only 1 atomic
+    /// pointer clone (`Arc::clone(&self.snapshot)`).
+    pub fn hot_snapshot(&self) -> Arc<FrozenState> {
+        Arc::clone(&self.snapshot)
     }
 
     /// Clone current mutex-protected [`Router`]s into a snapshot (used at freeze / tests).
@@ -242,10 +261,9 @@ impl AppState {
     }
 }
 
-/// One-shot read-side view of [`AppState`] for [`run_rsgi`]. All fields are cheap to clone
-/// (`Arc`/`Option<Py<PyAny>>` refcount bumps) so the hot path can drop the `RwLock` after a
-/// single `read()`. See [`AppState::hot_snapshot`].
-pub struct HotSnapshot {
+/// Consolidated immutable read-side view of [`AppState`] for request dispatching.
+/// Only 1 atomic refcount increment is needed per request.
+pub struct FrozenState {
     pub routes: Arc<Vec<RouteEntry>>,
     pub websocket_routes: Arc<Vec<WebsocketRoute>>,
     pub compiled: Option<Arc<CompiledRouters>>,
@@ -258,6 +276,8 @@ pub struct HotSnapshot {
     pub db_pool: Option<sqlx::PgPool>,
 }
 
+pub type HotSnapshot = Arc<FrozenState>;
+
 /// Lookup a WebSocket route in a precomputed [`CompiledRouters`] (lock-free).
 pub fn match_ws_route_compiled<'a, 'b>(
     compiled: &'a CompiledRouters,

From 79620111aa5e79baaa32cee271ece7b0bac0ed7c Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Thu, 27 Aug 2026 16:24:13 +0300
Subject: [PATCH 32/53] fix(state): ensure GIL is held when rebuilding snapshot
 with Python objects

---
 src/state.rs | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/state.rs b/src/state.rs
index 801f896..9c950e9 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -222,17 +222,19 @@ impl AppState {
     }
 
     pub fn rebuild_snapshot(&mut self) {
-        self.snapshot = Arc::new(FrozenState {
-            routes: Arc::clone(&self.routes),
-            websocket_routes: Arc::clone(&self.websocket_routes),
-            compiled: self.compiled.as_ref().map(Arc::clone),
-            cors: self.cors.clone(),
-            security_headers: self.security_headers.clone(),
-            request_middleware: Arc::clone(&self.request_middleware),
-            response_middleware: Arc::clone(&self.response_middleware),
-            exception_handlers: Arc::clone(&self.exception_handlers),
-            include_openapi: self.include_openapi,
-            db_pool: self.db_pool.clone(),
+        pyo3::Python::with_gil(|_py| {
+            self.snapshot = Arc::new(FrozenState {
+                routes: Arc::clone(&self.routes),
+                websocket_routes: Arc::clone(&self.websocket_routes),
+                compiled: self.compiled.as_ref().map(Arc::clone),
+                cors: self.cors.clone(),
+                security_headers: self.security_headers.clone(),
+                request_middleware: Arc::clone(&self.request_middleware),
+                response_middleware: Arc::clone(&self.response_middleware),
+                exception_handlers: Arc::clone(&self.exception_handlers),
+                include_openapi: self.include_openapi,
+                db_pool: self.db_pool.clone(),
+            });
         });
     }
 

From bf0eea7b12188d57f8337454a3fc0f6c1d5c06d4 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Sat, 12 Sep 2026 08:22:43 +0300
Subject: [PATCH 33/53] fix(observability): ensure access_log_hook executes on
 unhandled exceptions via try-finally

---
 oxyroute/app.py             |  14 +-
 tests/test_observability.py |  97 +++++++++++++
 uv.lock                     | 264 ++++++++++++------------------------
 3 files changed, 191 insertions(+), 184 deletions(-)
 create mode 100644 tests/test_observability.py

diff --git a/oxyroute/app.py b/oxyroute/app.py
index 149e987..180a669 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -618,12 +618,14 @@ async def __rsgi__(self, scope: Any, protocol: Any) -> Any:
 
             start = time.perf_counter_ns()
             p = _ProtocolWrapper(protocol)
-            r = self._app.handle_rsgi(scope, p)
-            if r is not None and inspect.isawaitable(r):
-                await r
-            dur = (time.perf_counter_ns() - start) / 1000000.0
-            self.access_log_hook(scope, p.status, dur, p.__oxyroute_path_template__)
-            return r
+            try:
+                r = self._app.handle_rsgi(scope, p)
+                if r is not None and inspect.isawaitable(r):
+                    await r
+                return r
+            finally:
+                dur = (time.perf_counter_ns() - start) / 1000000.0
+                self.access_log_hook(scope, p.status, dur, p.__oxyroute_path_template__)
 
         r = self._app.handle_rsgi(scope, protocol)
         if r is None or not inspect.isawaitable(r):
diff --git a/tests/test_observability.py b/tests/test_observability.py
new file mode 100644
index 0000000..4e74b21
--- /dev/null
+++ b/tests/test_observability.py
@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from oxyroute import App, Response
+
+
+class _MockProtocol:
+    def __init__(self) -> None:
+        self.status = 200
+        self.headers: list[tuple[str, str]] = []
+        self.body: bytes | str | None = None
+
+    def response_str(self, status: int, headers: list[tuple[str, str]], body: str) -> None:
+        self.status = status
+        self.headers = headers
+        self.body = body
+
+    def response_bytes(self, status: int, headers: list[tuple[str, str]], body: bytes) -> None:
+        self.status = status
+        self.headers = headers
+        self.body = body
+
+    def response_empty(self, status: int, headers: list[tuple[str, str]]) -> None:
+        self.status = status
+        self.headers = headers
+
+
+class _MockScope:
+    def __init__(self, method: str, path: str) -> None:
+        self.proto = "http"
+        self.http_version = "1.1"
+        self.rsgi_version = "1.0"
+        self.scheme = "http"
+        self.method = method
+        self.path = path
+        self.query_string = ""
+        self.headers = {}
+        self.authority = "localhost"
+        self.client = "127.0.0.1:54321"
+
+
+def test_access_log_hook_on_success() -> None:
+    logs: list[tuple[Any, int, float, str]] = []
+
+    def log_hook(scope: Any, status: int, duration_ms: float, template: str) -> None:
+        logs.append((scope, status, duration_ms, template))
+
+    app = App(access_log_hook=log_hook)
+
+    @app.get("/users/:id")
+    def get_user(id: str) -> Response:
+        return Response(body=f"user {id}", status=200)
+
+    scope = _MockScope("GET", "/users/42")
+    proto = _MockProtocol()
+
+    async def _run() -> None:
+        await app.__rsgi__(scope, proto)
+
+    asyncio.run(_run())
+
+    assert len(logs) == 1
+    s, status, dur, template = logs[0]
+    assert s.path == "/users/42"
+    assert status == 200
+    assert dur >= 0.0
+    assert template == "/users/:id"
+
+
+def test_access_log_hook_on_unhandled_exception() -> None:
+    logs: list[tuple[Any, int, float, str]] = []
+
+    def log_hook(scope: Any, status: int, duration_ms: float, template: str) -> None:
+        logs.append((scope, status, duration_ms, template))
+
+    app = App(access_log_hook=log_hook)
+
+    @app.get("/crash")
+    def crash() -> None:
+        raise RuntimeError("boom")
+
+    scope = _MockScope("GET", "/crash")
+    proto = _MockProtocol()
+
+    async def _run() -> None:
+        await app.__rsgi__(scope, proto)
+
+    asyncio.run(_run())
+
+    assert len(logs) == 1
+    s, status, dur, _ = logs[0]
+    assert s.path == "/crash"
+    # Status defaults to 500 on unhandled error
+    assert status == 500
+    assert dur >= 0.0
diff --git a/uv.lock b/uv.lock
index ec23ca5..4e20934 100644
--- a/uv.lock
+++ b/uv.lock
@@ -43,88 +43,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" },
 ]
 
-[[package]]
-name = "cffi"
-version = "2.0.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/93/d7/516d984057745a6cd96575eea814fe1edd6646ee6efd552fb7b0921dec83/cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44", size = 184283, upload-time = "2025-09-08T23:22:08.01Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/84/ad6a0b408daa859246f57c03efd28e5dd1b33c21737c2db84cae8c237aa5/cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49", size = 180504, upload-time = "2025-09-08T23:22:10.637Z" },
-    { url = "https://files.pythonhosted.org/packages/50/bd/b1a6362b80628111e6653c961f987faa55262b4002fcec42308cad1db680/cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c", size = 208811, upload-time = "2025-09-08T23:22:12.267Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/27/6933a8b2562d7bd1fb595074cf99cc81fc3789f6a6c05cdabb46284a3188/cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb", size = 216402, upload-time = "2025-09-08T23:22:13.455Z" },
-    { url = "https://files.pythonhosted.org/packages/05/eb/b86f2a2645b62adcfff53b0dd97e8dfafb5c8aa864bd0d9a2c2049a0d551/cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0", size = 203217, upload-time = "2025-09-08T23:22:14.596Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/e0/6cbe77a53acf5acc7c08cc186c9928864bd7c005f9efd0d126884858a5fe/cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4", size = 203079, upload-time = "2025-09-08T23:22:15.769Z" },
-    { url = "https://files.pythonhosted.org/packages/98/29/9b366e70e243eb3d14a5cb488dfd3a0b6b2f1fb001a203f653b93ccfac88/cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453", size = 216475, upload-time = "2025-09-08T23:22:17.427Z" },
-    { url = "https://files.pythonhosted.org/packages/21/7a/13b24e70d2f90a322f2900c5d8e1f14fa7e2a6b3332b7309ba7b2ba51a5a/cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495", size = 218829, upload-time = "2025-09-08T23:22:19.069Z" },
-    { url = "https://files.pythonhosted.org/packages/60/99/c9dc110974c59cc981b1f5b66e1d8af8af764e00f0293266824d9c4254bc/cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5", size = 211211, upload-time = "2025-09-08T23:22:20.588Z" },
-    { url = "https://files.pythonhosted.org/packages/49/72/ff2d12dbf21aca1b32a40ed792ee6b40f6dc3a9cf1644bd7ef6e95e0ac5e/cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb", size = 218036, upload-time = "2025-09-08T23:22:22.143Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/cc/027d7fb82e58c48ea717149b03bcadcbdc293553edb283af792bd4bcbb3f/cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a", size = 172184, upload-time = "2025-09-08T23:22:23.328Z" },
-    { url = "https://files.pythonhosted.org/packages/33/fa/072dd15ae27fbb4e06b437eb6e944e75b068deb09e2a2826039e49ee2045/cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739", size = 182790, upload-time = "2025-09-08T23:22:24.752Z" },
-    { url = "https://files.pythonhosted.org/packages/12/4a/3dfd5f7850cbf0d06dc84ba9aa00db766b52ca38d8b86e3a38314d52498c/cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe", size = 184344, upload-time = "2025-09-08T23:22:26.456Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/8b/f0e4c441227ba756aafbe78f117485b25bb26b1c059d01f137fa6d14896b/cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c", size = 180560, upload-time = "2025-09-08T23:22:28.197Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
-    { url = "https://files.pythonhosted.org/packages/84/ef/a7b77c8bdc0f77adc3b46888f1ad54be8f3b7821697a7b89126e829e676a/cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664", size = 202597, upload-time = "2025-09-08T23:22:34.132Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/91/500d892b2bf36529a75b77958edfcd5ad8e2ce4064ce2ecfeab2125d72d1/cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26", size = 215574, upload-time = "2025-09-08T23:22:35.443Z" },
-    { url = "https://files.pythonhosted.org/packages/44/64/58f6255b62b101093d5df22dcb752596066c7e89dd725e0afaed242a61be/cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9", size = 218971, upload-time = "2025-09-08T23:22:36.805Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/49/fa72cebe2fd8a55fbe14956f9970fe8eb1ac59e5df042f603ef7c8ba0adc/cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414", size = 211972, upload-time = "2025-09-08T23:22:38.436Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/28/dd0967a76aab36731b6ebfe64dec4e981aff7e0608f60c2d46b46982607d/cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743", size = 217078, upload-time = "2025-09-08T23:22:39.776Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/c0/015b25184413d7ab0a410775fdb4a50fca20f5589b5dab1dbbfa3baad8ce/cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5", size = 172076, upload-time = "2025-09-08T23:22:40.95Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/8f/dc5531155e7070361eb1b7e4c1a9d896d0cb21c49f807a6c03fd63fc877e/cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5", size = 182820, upload-time = "2025-09-08T23:22:42.463Z" },
-    { url = "https://files.pythonhosted.org/packages/95/5c/1b493356429f9aecfd56bc171285a4c4ac8697f76e9bbbbb105e537853a1/cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d", size = 177635, upload-time = "2025-09-08T23:22:43.623Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/47/4f61023ea636104d4f16ab488e268b93008c3d0bb76893b1b31db1f96802/cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d", size = 185271, upload-time = "2025-09-08T23:22:44.795Z" },
-    { url = "https://files.pythonhosted.org/packages/df/a2/781b623f57358e360d62cdd7a8c681f074a71d445418a776eef0aadb4ab4/cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c", size = 181048, upload-time = "2025-09-08T23:22:45.938Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/df/a4f0fbd47331ceeba3d37c2e51e9dfc9722498becbeec2bd8bc856c9538a/cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe", size = 212529, upload-time = "2025-09-08T23:22:47.349Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/72/12b5f8d3865bf0f87cf1404d8c374e7487dcf097a1c91c436e72e6badd83/cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062", size = 220097, upload-time = "2025-09-08T23:22:48.677Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/95/7a135d52a50dfa7c882ab0ac17e8dc11cec9d55d2c18dda414c051c5e69e/cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e", size = 207983, upload-time = "2025-09-08T23:22:50.06Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/c8/15cb9ada8895957ea171c62dc78ff3e99159ee7adb13c0123c001a2546c1/cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037", size = 206519, upload-time = "2025-09-08T23:22:51.364Z" },
-    { url = "https://files.pythonhosted.org/packages/78/2d/7fa73dfa841b5ac06c7b8855cfc18622132e365f5b81d02230333ff26e9e/cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba", size = 219572, upload-time = "2025-09-08T23:22:52.902Z" },
-    { url = "https://files.pythonhosted.org/packages/07/e0/267e57e387b4ca276b90f0434ff88b2c2241ad72b16d31836adddfd6031b/cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94", size = 222963, upload-time = "2025-09-08T23:22:54.518Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/75/1f2747525e06f53efbd878f4d03bac5b859cbc11c633d0fb81432d98a795/cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187", size = 221361, upload-time = "2025-09-08T23:22:55.867Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
-    { url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
-    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
-    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
-    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
-    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
-    { url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
-    { url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
-    { url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
-    { url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
-    { url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
-]
-
 [[package]]
 name = "click"
 version = "8.3.3"
@@ -146,72 +64,12 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
-[[package]]
-name = "cryptography"
-version = "47.0.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/ef/b2/7ffa7fe8207a8c42147ffe70c3e360b228160c1d85dc3faff16aaa3244c0/cryptography-47.0.0.tar.gz", hash = "sha256:9f8e55fe4e63613a5e1cc5819030f27b97742d720203a087802ce4ce9ceb52bb", size = 830863, upload-time = "2026-04-24T19:54:57.056Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/a4/98/40dfe932134bdcae4f6ab5927c87488754bf9eb79297d7e0070b78dd58e9/cryptography-47.0.0-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:160ad728f128972d362e714054f6ba0067cab7fb350c5202a9ae8ae4ce3ef1a0", size = 7912214, upload-time = "2026-04-24T19:53:03.864Z" },
-    { url = "https://files.pythonhosted.org/packages/34/c6/2733531243fba725f58611b918056b277692f1033373dcc8bd01af1c05d4/cryptography-47.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b9a8943e359b7615db1a3ba587994618e094ff3d6fa5a390c73d079ce18b3973", size = 4644617, upload-time = "2026-04-24T19:53:06.909Z" },
-    { url = "https://files.pythonhosted.org/packages/00/e3/b27be1a670a9b87f855d211cf0e1174a5d721216b7616bd52d8581d912ed/cryptography-47.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f5c15764f261394b22aef6b00252f5195f46f2ca300bec57149474e2538b31f8", size = 4668186, upload-time = "2026-04-24T19:53:09.053Z" },
-    { url = "https://files.pythonhosted.org/packages/81/b9/8443cfe5d17d482d348cee7048acf502bb89a51b6382f06240fd290d4ca3/cryptography-47.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:9c59ab0e0fa3a180a5a9c59f3a5abe3ef90d474bc56d7fadfbe80359491b615b", size = 4651244, upload-time = "2026-04-24T19:53:11.217Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/5e/13ed0cdd0eb88ba159d6dd5ebfece8cb901dbcf1ae5ac4072e28b55d3153/cryptography-47.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:34b4358b925a5ea3e14384ca781a2c0ef7ac219b57bb9eacc4457078e2b19f92", size = 5252906, upload-time = "2026-04-24T19:53:13.532Z" },
-    { url = "https://files.pythonhosted.org/packages/64/16/ed058e1df0f33d440217cd120d41d5dda9dd215a80b8187f68483185af82/cryptography-47.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:0024b87d47ae2399165a6bfb20d24888881eeab83ae2566d62467c5ff0030ce7", size = 4701842, upload-time = "2026-04-24T19:53:15.618Z" },
-    { url = "https://files.pythonhosted.org/packages/02/e0/3d30986b30fdbd9e969abbdf8ba00ed0618615144341faeb57f395a084fe/cryptography-47.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:1e47422b5557bb82d3fff997e8d92cff4e28b9789576984f08c248d2b3535d93", size = 4289313, upload-time = "2026-04-24T19:53:17.755Z" },
-    { url = "https://files.pythonhosted.org/packages/df/fd/32db38e3ad0cb331f0691cb4c7a8a6f176f679124dee746b3af6633db4d9/cryptography-47.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:6f29f36582e6151d9686235e586dd35bb67491f024767d10b842e520dc6a07ac", size = 4650964, upload-time = "2026-04-24T19:53:20.062Z" },
-    { url = "https://files.pythonhosted.org/packages/86/53/5395d944dfd48cb1f67917f533c609c34347185ef15eb4308024c876f274/cryptography-47.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:a9b761f012a943b7de0e828843c5688d0de94a0578d44d6c85a1bae32f87791f", size = 5207817, upload-time = "2026-04-24T19:53:22.498Z" },
-    { url = "https://files.pythonhosted.org/packages/34/4f/e5711b28e1901f7d480a2b1b688b645aa4c77c73f10731ed17e7f7db3f0d/cryptography-47.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:4e1de79e047e25d6e9f8cea71c86b4a53aced64134f0f003bbcbf3655fd172c8", size = 4701544, upload-time = "2026-04-24T19:53:24.356Z" },
-    { url = "https://files.pythonhosted.org/packages/22/22/c8ddc25de3010fc8da447648f5a092c40e7a8fadf01dd6d255d9c0b9373d/cryptography-47.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ef6b3634087f18d2155b1e8ce264e5345a753da2c5fa9815e7d41315c90f8318", size = 4783536, upload-time = "2026-04-24T19:53:26.665Z" },
-    { url = "https://files.pythonhosted.org/packages/66/b6/d4a68f4ea999c6d89e8498579cba1c5fcba4276284de7773b17e4fa69293/cryptography-47.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:11dbb9f50a0f1bb9757b3d8c27c1101780efb8f0bdecfb12439c22a74d64c001", size = 4926106, upload-time = "2026-04-24T19:53:28.686Z" },
-    { url = "https://files.pythonhosted.org/packages/54/ed/5f524db1fade9c013aa618e1c99c6ed05e8ffc9ceee6cda22fed22dda3f4/cryptography-47.0.0-cp311-abi3-win32.whl", hash = "sha256:7fda2f02c9015db3f42bb8a22324a454516ed10a8c29ca6ece6cdbb5efe2a203", size = 3258581, upload-time = "2026-04-24T19:53:31.058Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/dc/1b901990b174786569029f67542b3edf72ac068b6c3c8683c17e6a2f5363/cryptography-47.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:f5c3296dab66202f1b18a91fa266be93d6aa0c2806ea3d67762c69f60adc71aa", size = 3775309, upload-time = "2026-04-24T19:53:33.054Z" },
-    { url = "https://files.pythonhosted.org/packages/14/88/7aa18ad9c11bc87689affa5ce4368d884b517502d75739d475fc6f4a03c7/cryptography-47.0.0-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:be12cb6a204f77ed968bcefe68086eb061695b540a3dd05edac507a3111b25f0", size = 7904299, upload-time = "2026-04-24T19:53:35.003Z" },
-    { url = "https://files.pythonhosted.org/packages/07/55/c18f75724544872f234678fdedc871391722cb34a2aee19faa9f63100bb2/cryptography-47.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:2ebd84adf0728c039a3be2700289378e1c164afc6748df1a5ed456767bef9ba7", size = 4631180, upload-time = "2026-04-24T19:53:37.517Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/65/31a5cc0eaca99cec5bafffe155d407115d96136bb161e8b49e0ef73f09a7/cryptography-47.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7f68d6fbc7fbbcfb0939fea72c3b96a9f9a6edfc0e1b1d29778a2066030418b1", size = 4653529, upload-time = "2026-04-24T19:53:39.775Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/bc/641c0519a495f3bfd0421b48d7cd325c4336578523ccd76ea322b6c29c7a/cryptography-47.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:6651d32eff255423503aa276739da98c30f26c40cbeffcc6048e0d54ef704c0c", size = 4638570, upload-time = "2026-04-24T19:53:42.129Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/f2/300327b0a47f6dc94dd8b71b57052aefe178bb51745073d73d80604f11ab/cryptography-47.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:3fb8fa48075fad7193f2e5496135c6a76ac4b2aa5a38433df0a539296b377829", size = 5238019, upload-time = "2026-04-24T19:53:44.577Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/5a/5b5cf994391d4bf9d9c7efd4c66aabe4d95227256627f8fea6cff7dfadbd/cryptography-47.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:11438c7518132d95f354fa01a4aa2f806d172a061a7bed18cf18cbdacdb204d7", size = 4686832, upload-time = "2026-04-24T19:53:47.015Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/2c/ae950e28fd6475c852fc21a44db3e6b5bcc1261d1e370f2b6e42fa800fef/cryptography-47.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:8c1a736bbb3288005796c3f7ccb9453360d7fed483b13b9f468aea5171432923", size = 4269301, upload-time = "2026-04-24T19:53:48.97Z" },
-    { url = "https://files.pythonhosted.org/packages/67/fb/6a39782e150ffe5cc1b0018cb6ddc48bf7ca62b498d7539ffc8a758e977d/cryptography-47.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:f1557695e5c2b86e204f6ce9470497848634100787935ab7adc5397c54abd7ab", size = 4638110, upload-time = "2026-04-24T19:53:51.011Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/d7/0b3c71090a76e5c203164a47688b697635ece006dcd2499ab3a4dbd3f0bd/cryptography-47.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:f9a034b642b960767fb343766ae5ba6ad653f2e890ddd82955aef288ffea8736", size = 5194988, upload-time = "2026-04-24T19:53:52.962Z" },
-    { url = "https://files.pythonhosted.org/packages/63/33/63a961498a9df51721ab578c5a2622661411fc520e00bd83b0cc64eb20c4/cryptography-47.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:b1c76fca783aa7698eb21eb14f9c4aa09452248ee54a627d125025a43f83e7a7", size = 4686563, upload-time = "2026-04-24T19:53:55.274Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/bf/5ee5b145248f92250de86145d1c1d6edebbd57a7fe7caa4dedb5d4cf06a1/cryptography-47.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:4f7722c97826770bab8ae92959a2e7b20a5e9e9bf4deae68fd86c3ca457bab52", size = 4770094, upload-time = "2026-04-24T19:53:57.753Z" },
-    { url = "https://files.pythonhosted.org/packages/92/43/21d220b2da5d517773894dacdcdb5c682c28d3fffce65548cb06e87d5501/cryptography-47.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:09f6d7bf6724f8db8b32f11eccf23efc8e759924bc5603800335cf8859a3ddbd", size = 4913811, upload-time = "2026-04-24T19:54:00.236Z" },
-    { url = "https://files.pythonhosted.org/packages/31/98/dc4ad376ac5f1a1a7d4a83f7b0c6f2bcad36b5d2d8f30aeb482d3a7d9582/cryptography-47.0.0-cp314-cp314t-win32.whl", hash = "sha256:6eebcaf0df1d21ce1f90605c9b432dd2c4f4ab665ac29a40d5e3fc68f51b5e63", size = 3237158, upload-time = "2026-04-24T19:54:02.606Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/da/97f62d18306b5133468bc3f8cc73a3111e8cdc8cf8d3e69474d6e5fd2d1b/cryptography-47.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:51c9313e90bd1690ec5a75ed047c27c0b8e6c570029712943d6116ef9a90620b", size = 3758706, upload-time = "2026-04-24T19:54:04.433Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/34/a4fae8ae7c3bc227460c9ae43f56abf1b911da0ec29e0ebac53bb0a4b6b7/cryptography-47.0.0-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:14432c8a9bcb37009784f9594a62fae211a2ae9543e96c92b2a8e4c3cd5cd0c4", size = 7904072, upload-time = "2026-04-24T19:54:06.411Z" },
-    { url = "https://files.pythonhosted.org/packages/01/64/d7b1e54fdb69f22d24a64bb3e88dc718b31c7fb10ef0b9691a3cf7eeea6e/cryptography-47.0.0-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:07efe86201817e7d3c18781ca9770bc0db04e1e48c994be384e4602bc38f8f27", size = 4635767, upload-time = "2026-04-24T19:54:08.519Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/7b/cca826391fb2a94efdcdfe4631eb69306ee1cff0b22f664a412c90713877/cryptography-47.0.0-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2b45761c6ec22b7c726d6a829558777e32d0f1c8be7c3f3480f9c912d5ee8a10", size = 4654350, upload-time = "2026-04-24T19:54:10.795Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/65/4b57bcc823f42a991627c51c2f68c9fd6eb1393c1756aac876cba2accae2/cryptography-47.0.0-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:edd4da498015da5b9f26d38d3bfc2e90257bfa9cbed1f6767c282a0025ae649b", size = 4643394, upload-time = "2026-04-24T19:54:13.275Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/c4/2c5fbeea70adbbca2bbae865e1d605d6a4a7f8dbd9d33eaf69645087f06c/cryptography-47.0.0-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9af828c0d5a65c70ec729cd7495a4bf1a67ecb66417b8f02ff125ab8a6326a74", size = 5225777, upload-time = "2026-04-24T19:54:15.18Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/b8/ac57107ef32749d2b244e36069bb688792a363aaaa3acc9e3cf84c130315/cryptography-47.0.0-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:256d07c78a04d6b276f5df935a9923275f53bd1522f214447fdf365494e2d515", size = 4688771, upload-time = "2026-04-24T19:54:17.835Z" },
-    { url = "https://files.pythonhosted.org/packages/56/fc/9f1de22ff8be99d991f240a46863c52d475404c408886c5a38d2b5c3bb26/cryptography-47.0.0-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:5d0e362ff51041b0c0d219cc7d6924d7b8996f57ce5712bdcef71eb3c65a59cc", size = 4270753, upload-time = "2026-04-24T19:54:19.963Z" },
-    { url = "https://files.pythonhosted.org/packages/00/68/d70c852797aa68e8e48d12e5a87170c43f67bb4a59403627259dd57d15de/cryptography-47.0.0-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:1581aef4219f7ca2849d0250edaa3866212fb74bf5667284f46aa92f9e65c1ca", size = 4642911, upload-time = "2026-04-24T19:54:21.818Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/51/661cbee74f594c5d97ff82d34f10d5551c085ca4668645f4606ebd22bd5d/cryptography-47.0.0-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:a49a3eb5341b9503fa3000a9a0db033161db90d47285291f53c2a9d2cd1b7f76", size = 5181411, upload-time = "2026-04-24T19:54:24.376Z" },
-    { url = "https://files.pythonhosted.org/packages/94/87/f2b6c374a82cf076cfa1416992ac8e8ec94d79facc37aec87c1a5cb72352/cryptography-47.0.0-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2207a498b03275d0051589e326b79d4cf59985c99031b05bb292ac52631c37fe", size = 4688262, upload-time = "2026-04-24T19:54:26.946Z" },
-    { url = "https://files.pythonhosted.org/packages/14/e2/8b7462f4acf21ec509616f0245018bb197194ab0b65c2ea21a0bdd53c0eb/cryptography-47.0.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7a02675e2fabd0c0fc04c868b8781863cbf1967691543c22f5470500ff840b31", size = 4775506, upload-time = "2026-04-24T19:54:28.926Z" },
-    { url = "https://files.pythonhosted.org/packages/70/75/158e494e4c08dc05e039da5bb48553826bd26c23930cf8d3cd5f21fa8921/cryptography-47.0.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:80887c5cbd1774683cb126f0ab4184567f080071d5acf62205acb354b4b753b7", size = 4912060, upload-time = "2026-04-24T19:54:30.869Z" },
-    { url = "https://files.pythonhosted.org/packages/06/bd/0a9d3edbf5eadbac926d7b9b3cd0c4be584eeeae4a003d24d9eda4affbbd/cryptography-47.0.0-cp38-abi3-win32.whl", hash = "sha256:ed67ea4e0cfb5faa5bc7ecb6e2b8838f3807a03758eec239d6c21c8769355310", size = 3248487, upload-time = "2026-04-24T19:54:33.494Z" },
-    { url = "https://files.pythonhosted.org/packages/60/80/5681af756d0da3a599b7bdb586fac5a1540f1bcefd2717a20e611ddade45/cryptography-47.0.0-cp38-abi3-win_amd64.whl", hash = "sha256:835d2d7f47cdc53b3224e90810fb1d36ca94ea29cc1801fb4c1bc43876735769", size = 3755737, upload-time = "2026-04-24T19:54:35.408Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/a0/928c9ce0d120a40a81aa99e3ba383e87337b9ac9ef9f6db02e4d7822424d/cryptography-47.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:7f1207974a904e005f762869996cf620e9bf79ecb4622f148550bb48e0eb35a7", size = 3909893, upload-time = "2026-04-24T19:54:38.334Z" },
-    { url = "https://files.pythonhosted.org/packages/81/75/d691e284750df5d9569f2b1ce4a00a71e1d79566da83b2b3e5549c84917f/cryptography-47.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:1a405c08857258c11016777e11c02bacbe7ef596faf259305d282272a3a05cbe", size = 4587867, upload-time = "2026-04-24T19:54:40.619Z" },
-    { url = "https://files.pythonhosted.org/packages/07/d6/1b90f1a4e453009730b4545286f0b39bb348d805c11181fc31544e4f9a65/cryptography-47.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:20fdbe3e38fb67c385d233c89371fa27f9909f6ebca1cecc20c13518dae65475", size = 4627192, upload-time = "2026-04-24T19:54:42.849Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/53/cb358a80e9e359529f496870dd08c102aa8a4b5b9f9064f00f0d6ed5b527/cryptography-47.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:f7db373287273d8af1414cf95dc4118b13ffdc62be521997b0f2b270771fef50", size = 4587486, upload-time = "2026-04-24T19:54:44.908Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/57/aaa3d53876467a226f9a7a82fd14dd48058ad2de1948493442dfa16e2ffd/cryptography-47.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:9fe6b7c64926c765f9dff301f9c1b867febcda5768868ca084e18589113732ab", size = 4626327, upload-time = "2026-04-24T19:54:47.813Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/9c/51f28c3550276bcf35660703ba0ab829a90b88be8cd98a71ef23c2413913/cryptography-47.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:cffbba3392df0fa8629bb7f43454ee2925059ee158e23c54620b9063912b86c8", size = 3698916, upload-time = "2026-04-24T19:54:49.782Z" },
-]
-
 [[package]]
 name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -402,17 +260,92 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c5/2a/afe0193b673a79ffd2e01ad999511b7e9e6b49af02bb3759d82a78c3043d/maturin-1.13.1-py3-none-win_arm64.whl", hash = "sha256:2839024dcd65776abb4759e5bca29941971e095574162a4d335191da4be9ff24", size = 8905575, upload-time = "2026-04-09T15:14:03.891Z" },
 ]
 
+[[package]]
+name = "orjson"
+version = "3.12.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/0f/f3/742fb1f62b825f2c010697eaf4e828004bc2a81e7e806666989c132c7c42/orjson-3.12.0.tar.gz", hash = "sha256:d14203fb1aae2ad9b3d52f8a0e82aeb10197ef1c9bc61da7f358bd70b00123d5", size = 4142915, upload-time = "2026-08-14T16:13:30.607Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cf/35/819eeb4fa8ee676d38fdbb8213a76fd496f7dbbfdfafa89d34e02b22dfac/orjson-3.12.0-cp310-cp310-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:747843254519dd43b93eee3153a19e5a509334320c4d2f823ec879232db5c796", size = 224133, upload-time = "2026-08-14T16:12:00.607Z" },
+    { url = "https://files.pythonhosted.org/packages/58/ab/d9221d4a2b085b073fcddc91728d490f20b9cf010c62c2f42371ab997695/orjson-3.12.0-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:7c2ad193c8004254f34b499f3bd2c80f043d10754aff2b38f93da574f4883f98", size = 113669, upload-time = "2026-08-14T16:12:02.126Z" },
+    { url = "https://files.pythonhosted.org/packages/15/12/644cbbcabb26df61d9ef0c66e6f2bf8b687cc7b66137597f2858951f1952/orjson-3.12.0-cp310-cp310-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:bc7a872f03522d90e0429e6c0c5cd23084f767bedcb4c58048eec19294613344", size = 130410, upload-time = "2026-08-14T16:12:03.503Z" },
+    { url = "https://files.pythonhosted.org/packages/14/6d/e3a8c34d687895aecd8b267a01c46106eb98d8424a83bfa7bacb723854f6/orjson-3.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:18a87929f31d94a77f7dc93cf527e91f39ce7fe7813d588a4de2507efd32a387", size = 131101, upload-time = "2026-08-14T16:12:04.918Z" },
+    { url = "https://files.pythonhosted.org/packages/75/20/930824c07685c22af23f26818ed3853b0270488a412b6ab757904b7f787b/orjson-3.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e9683ee9ea0659da64f36574ef675b8a86330c34c19ea75db1fb93c3ff99e0ef", size = 131479, upload-time = "2026-08-14T16:12:06.11Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/a6/22e863bbbe8917aa292e33e0db597000f9a07eb5e6f52efed623fa16bae1/orjson-3.12.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:103b5db66aa53c1f9e88c2524be4f383e831ba7dfd5f9f5af6336a177c622f11", size = 135865, upload-time = "2026-08-14T16:12:07.392Z" },
+    { url = "https://files.pythonhosted.org/packages/50/a0/ceb5008914a65e9a19a46a09d94bc67a74d120209fdfa772750023ceb377/orjson-3.12.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:bd57d79aefa3f84eec851d6de7a366795b9345cfaf17f82b4820430a7a5fa241", size = 127843, upload-time = "2026-08-14T16:12:08.607Z" },
+    { url = "https://files.pythonhosted.org/packages/12/3d/61c6b3b84c250cb09cb7229701ff77e4d763773ad7f577d0b6abf2892664/orjson-3.12.0-cp310-cp310-win32.whl", hash = "sha256:3dbce9b6b3074b31a5d5dd322a9c4e5b16f206091ece4194c2e36952847a105e", size = 128293, upload-time = "2026-08-14T16:12:09.819Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/0e/ea0f4a563253b6363195a4f704123c6bfbf156641bd3be5a75de81c5e917/orjson-3.12.0-cp310-cp310-win_amd64.whl", hash = "sha256:3bb17a06f9bd15237b3216c044209fe92597379124018cfc196fbb846cde64df", size = 122216, upload-time = "2026-08-14T16:12:11.261Z" },
+    { url = "https://files.pythonhosted.org/packages/75/1a/a7075a8e8b0d3f5097d17ac3099017104b6b7b42012041147995d5b2da05/orjson-3.12.0-cp311-cp311-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:a94f0f0c6fcbb2b5bd9734c57a489c7584a732bbdf04a39e8c83b861e9d03e92", size = 223409, upload-time = "2026-08-14T16:12:12.654Z" },
+    { url = "https://files.pythonhosted.org/packages/05/34/c2eb3b2900e5597db7841a4c6416ac2d90081bd956b02d4dd1833fa2b96b/orjson-3.12.0-cp311-cp311-macosx_15_0_arm64.whl", hash = "sha256:a696529ec96a90d9a5f9570207efe403c8b08f8e4aa2783ee3403511e2fdfa10", size = 124015, upload-time = "2026-08-14T16:12:14.025Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/df/b49081766a75b6a37b3d33bdc0a39e492abab8441dd25e3e1998e7b83fcb/orjson-3.12.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:e4ac5059baab4b3acbd99485de019ff8cda0fdf34b61fa74f7197a53db78bfe8", size = 113471, upload-time = "2026-08-14T16:12:15.81Z" },
+    { url = "https://files.pythonhosted.org/packages/48/d4/58ea28eeef95c2a27358ed927380a621162cf20bd740bbccf9c3f09a200a/orjson-3.12.0-cp311-cp311-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:8e29957429c35bbb5a185a119c523aa2428b7bbf1a293724c7b9375ed8f892a3", size = 129998, upload-time = "2026-08-14T16:12:17.503Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/f4/1e82aa2efc9916422d804697876ce433c907a1abd7c7e5c6d3d48565e5f9/orjson-3.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dce0166feb0a737ab84f598c9a338cbc0b764a036617aa686194f53c7eba0c3e", size = 130891, upload-time = "2026-08-14T16:12:18.762Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e1/15169e9d22b59a406264f99d6db387c0b0b12b6357a8a0169917c2a713eb/orjson-3.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9caf3d09f47c3c70c4451ada20ef9bc4a4cdffa26f49862cf0a253b329aae2d5", size = 131285, upload-time = "2026-08-14T16:12:20.251Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/3a/763dbd426290d044ec3e615a05e70adb6d8b6f95bf17dc355c0081a5e8b6/orjson-3.12.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:b9dca132b1fda5565088e65a6b6e742285e0aeceb6fae549fa8863e16c7d3998", size = 135707, upload-time = "2026-08-14T16:12:21.652Z" },
+    { url = "https://files.pythonhosted.org/packages/04/d1/3b2038ed168d22e14182ed715d6963f9c073a83a2ba43cfe918a4fc43c64/orjson-3.12.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:a791f793b287bbc135b8e87c34e35c8bfc693e2a8a620fab1ae682b925f9a32e", size = 127669, upload-time = "2026-08-14T16:12:22.926Z" },
+    { url = "https://files.pythonhosted.org/packages/88/ae/b84b3d3e65f5629ada0edcb1d2bccc55d7c5f89d8b981537ecdc3d6f31ec/orjson-3.12.0-cp311-cp311-win32.whl", hash = "sha256:31ed278a36304390adc3eec5d7f6fd593a7c3e99e5a06cd07866396c4b1b4710", size = 128043, upload-time = "2026-08-14T16:12:24.367Z" },
+    { url = "https://files.pythonhosted.org/packages/35/24/2ed0e6f51ea3d0af45d807233a851175af75bec83ef5fd0d6a2601904ec0/orjson-3.12.0-cp311-cp311-win_amd64.whl", hash = "sha256:fb2539159dfe8d371914f354360fa50e4a577cc89222a3828b9650a5e5040252", size = 122084, upload-time = "2026-08-14T16:12:25.813Z" },
+    { url = "https://files.pythonhosted.org/packages/21/dd/95d25fcfbc9471799ef6bb01c552d64ee5cde93ee40ba2f423dd3442c708/orjson-3.12.0-cp311-cp311-win_arm64.whl", hash = "sha256:61318b6de893c7a9d9f3e5ecbadccbfc26a7eb417ccc7bbf0771de3b4d72f868", size = 127035, upload-time = "2026-08-14T16:12:27.201Z" },
+    { url = "https://files.pythonhosted.org/packages/be/4a/295da39c651c2faac8bd351a2a346f0fdedd9d50b847ee9dfc27d2207ef6/orjson-3.12.0-cp312-cp312-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:aa3e43a6846e91d7bde3d5a9c66090fcd8744f569a9b6cffc5e1ca38f6a461c0", size = 223427, upload-time = "2026-08-14T16:12:28.525Z" },
+    { url = "https://files.pythonhosted.org/packages/29/98/758cf90fbeaaafb7f8141bfac75a432099959f3a2f5db93a412e876415d8/orjson-3.12.0-cp312-cp312-macosx_15_0_arm64.whl", hash = "sha256:11edb4660a6680abee9788a3a9072208a2c96538cc1322bd79542065229d8e54", size = 123725, upload-time = "2026-08-14T16:12:30.013Z" },
+    { url = "https://files.pythonhosted.org/packages/32/b5/5b934d251f8651f7e41df180ad0c57a6e1cabe15c7bd331638413a50ebc9/orjson-3.12.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:2d3a9da945a4d96ae758fdaaca56742e6b73b6fd554c5d8876f252a6dad70b83", size = 113375, upload-time = "2026-08-14T16:12:31.209Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/d2/37efb5b12a176ce3ced29f4144f20da57d02757f78ce549637dc1b4e1fc8/orjson-3.12.0-cp312-cp312-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:92ffc09e07233a6ab6d4e067f7841edcbcc134cb4812155cf171ea5255a421d7", size = 129983, upload-time = "2026-08-14T16:12:32.721Z" },
+    { url = "https://files.pythonhosted.org/packages/50/22/0644b87c73f13e0092df8f35a1fe280d991e5e90072087411e0dd7e44e0c/orjson-3.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bf44e374aadde77b1f6109f1030be51433eb61984379852766b6f4e187db7b1e", size = 130629, upload-time = "2026-08-14T16:12:34.084Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/57/80b986ebfecd9c6a177ddf1c2319717f0cd8feffb2b78946595a18a2fc88/orjson-3.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1192a7021b6d071aaf909864f6e924d6a2675ca360485b972b8401749311750b", size = 131245, upload-time = "2026-08-14T16:12:35.713Z" },
+    { url = "https://files.pythonhosted.org/packages/80/3d/75c5ac5a69161f44492a68fbdde66f4cc4ce48cd5e1fb05918e46f0c8848/orjson-3.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:53c0c474a9d9aff9aebfc0c88de1f28f843d940e6e3a80729abdf6a20274356f", size = 135397, upload-time = "2026-08-14T16:12:37.128Z" },
+    { url = "https://files.pythonhosted.org/packages/71/93/4d71f2df314a97ff0d27a4559bf5888fc8406e3c6dec90e92291e3511215/orjson-3.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:532ff8cd4bd59a327a953a7dcde922c7fc25b85e29721bb8633265430d3a3873", size = 127693, upload-time = "2026-08-14T16:12:38.627Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/1d/0dbc6be5adfd1730491072fb60beb6bcdf5d7b2596ee41b7fc2e298bfc09/orjson-3.12.0-cp312-cp312-win32.whl", hash = "sha256:a6cf4b18e7de173f209f2084ffbd736dd72389a396326ee80a7022168be232e5", size = 128000, upload-time = "2026-08-14T16:12:39.954Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/c9/97b1ce0112ebf5e949c775ed5b1755e562233179f3584579673cc24d6378/orjson-3.12.0-cp312-cp312-win_amd64.whl", hash = "sha256:010811c1b69773450a01cef97727a67b223242f350b77d4ca000e59a9ef2155a", size = 122106, upload-time = "2026-08-14T16:12:41.324Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/6a/facd8b312e4a0d3a7fa978c7e15821f74a336adf1d65529faec33b48e18b/orjson-3.12.0-cp312-cp312-win_arm64.whl", hash = "sha256:ad29eece0c601737f2a60edc2752a84e7a0785df3efb62e3012834700a5afe0d", size = 126869, upload-time = "2026-08-14T16:12:42.651Z" },
+    { url = "https://files.pythonhosted.org/packages/54/cb/d7b78218a987eb8a8ce4eeae0286b1bb679333eb631ea0eeaf6371680bfc/orjson-3.12.0-cp313-cp313-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:9a36ec60f1796f9a3f13e3b98390295e17a1c7c10155b448d264098bf9ee5900", size = 223397, upload-time = "2026-08-14T16:12:44.003Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/4a/bc87c45e7ec639d35ebefd62618e01939531ac8e171426606a01bda05914/orjson-3.12.0-cp313-cp313-macosx_15_0_arm64.whl", hash = "sha256:ad0422b92d5195443a39f80c3bcf731cc2e00f153bd32063a47b73b057bd0f03", size = 123662, upload-time = "2026-08-14T16:12:45.433Z" },
+    { url = "https://files.pythonhosted.org/packages/94/ee/c9a4ff3f2dbedbbe9e635d0fa72c8866adede09b6335ef9644f53752f0d8/orjson-3.12.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:5a0fdbc216388f653d3752ff310e710f59253bd4ed6a2bfb3f4f06b84714bbd8", size = 113374, upload-time = "2026-08-14T16:12:46.755Z" },
+    { url = "https://files.pythonhosted.org/packages/75/09/3f330a026a796c8b4c97a6f429652a5e912e7065039bf96ed25e42aa7b25/orjson-3.12.0-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:2eb5c56e534127b2b8fa38d2363c8b1b8190367ee0d1d16c041517d880843b94", size = 130029, upload-time = "2026-08-14T16:12:48.06Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/40/094cc53126a3d22f76cdf83b6ea67338bed01d774037621a785aa8e6e5ea/orjson-3.12.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:784106539f4b9d4b930e0b4eb8d45168507dae001945e71b4675a367f1e5e806", size = 130528, upload-time = "2026-08-14T16:12:49.362Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/74/89bb236deb9565f99434b13052bb40ddfcce4adf3afbfa3132ee7e421468/orjson-3.12.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1c680706fc8396d95e7c4c1f9482563f552137aef91b57237a3ad5aaf64629df", size = 131075, upload-time = "2026-08-14T16:12:50.692Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/ac/1176360d762c01b5bd34acd56fc098e936c491363d8b6b397ad4aa475547/orjson-3.12.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:83445adc40cba26d6d621185a45128ce455b766af368cad2ab64b970603a7978", size = 135321, upload-time = "2026-08-14T16:12:52.114Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/02/bbd881c8b9276d50b998de38b4e97de8ace1aac940b0ee545aedbf65ed00/orjson-3.12.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:644d005bc82f917337a95ce270c9f6f92f9834c2bed7b1477572f8db00784222", size = 127472, upload-time = "2026-08-14T16:12:53.517Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/02/a0934d7503e6dcbedd6afac3e7f3f8597fd09389949ad94d0f7540e9dbca/orjson-3.12.0-cp313-cp313-win32.whl", hash = "sha256:d8e78d3d93705e3d27cc17cdb209e44d7a8ea203010cac6ce9c7ffc1ae1996f1", size = 128000, upload-time = "2026-08-14T16:12:55.14Z" },
+    { url = "https://files.pythonhosted.org/packages/52/87/69f98f8d40faff103a965a5fbb83f08241b01beaf92badb5413fbc9358cc/orjson-3.12.0-cp313-cp313-win_amd64.whl", hash = "sha256:b85931be5b6763c31283805c9bdaae1ca03ad9f6f12a15f1cbf6745b907932c2", size = 121841, upload-time = "2026-08-14T16:12:56.507Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/07/b83046a4e3cadcc0987d0f160696107c4af706a619b56e4ad01940cadadf/orjson-3.12.0-cp313-cp313-win_arm64.whl", hash = "sha256:6a31348d7dfa64cd9c78bd1f510ff44c48fe64d71094e6b90e364dba3b55949e", size = 126765, upload-time = "2026-08-14T16:12:57.806Z" },
+    { url = "https://files.pythonhosted.org/packages/12/9d/3931253e6f3148abf2cbe14830367042a4806b362ea520df2303db188fb9/orjson-3.12.0-cp314-cp314-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:9e6fee342a48760e854d743e7a81534d8e2925a6f46e09f750cf56b50fd1de5d", size = 223391, upload-time = "2026-08-14T16:12:59.184Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/0e/b4a4f1e305367245877b967a0bad70fcf001d77c54ac4339a120b66fdae4/orjson-3.12.0-cp314-cp314-macosx_15_0_arm64.whl", hash = "sha256:8c3bb86dd10f39b3fbf434b7d5dc7cac77d6fc8ac572ae30a10731ede2c4b647", size = 123659, upload-time = "2026-08-14T16:13:00.548Z" },
+    { url = "https://files.pythonhosted.org/packages/96/f3/6782c6fa85e2702bc66be183c3b421486167dcf266ee4dc1403fe3824870/orjson-3.12.0-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:2bb3ce43203936072dd8b4917b01d3aecfc02329bfb42510cb7cfb24708adc9c", size = 113337, upload-time = "2026-08-14T16:13:02.009Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/79/b32ab64bacda9d0fa4942ef483bd03cabf0eaf2be819ca9fb7ff610c559d/orjson-3.12.0-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:6a2a79c89984dc719817d388c8709e0efc2a2795a934eaa746b4882eb6045adc", size = 130112, upload-time = "2026-08-14T16:13:03.404Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/49/6e6142999ca01509219be5e5a9c338a3e5ea011f63e91ff473fbbf3734ed/orjson-3.12.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f06dd838d1e07d9b1de0932ec0485ec92c4d5f5d1ad4817a656268c3e88be1e1", size = 130520, upload-time = "2026-08-14T16:13:04.798Z" },
+    { url = "https://files.pythonhosted.org/packages/49/d0/3745af0a4cc9867784f29722929cec4d10bd1c877cd754b01ba6d96eb21a/orjson-3.12.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c6b11be792c3d2c6a4be2af4ebf97a68d0bf5f580aca6e86a418a354f6cc846a", size = 131053, upload-time = "2026-08-14T16:13:06.14Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/f4/6fe5a22fa478fffb190e65c338c84df5c311ef597b363150a17cc57063c0/orjson-3.12.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:477ecaf6b9f88f873341b91fcc736119ca81b5e002a9f7f308ff5b4f2ce2a70e", size = 135321, upload-time = "2026-08-14T16:13:07.544Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/41/b1b0ec30289646a81a76e2dbaae2686b96fcccb7cb0323dc1dd78cbc7875/orjson-3.12.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f3c0683136acdc29afdf88a5bc2f7d3d0e34087788d1d63c0144b805a87a196f", size = 127485, upload-time = "2026-08-14T16:13:08.88Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/2b/277404bdcc21c93b112b963655b76443ebfe828f8a3ff1de7d90f8850eb3/orjson-3.12.0-cp314-cp314-win32.whl", hash = "sha256:d39f3f5c3927e2dc0913fe5bbc1a2f6b1b9d1bba1de6358340d0ad0d0c00ca92", size = 128048, upload-time = "2026-08-14T16:13:10.305Z" },
+    { url = "https://files.pythonhosted.org/packages/41/2b/395b36fa2b4ce7af70b651d715e88f80d884b2c2b14a6b53e84d554fb5f0/orjson-3.12.0-cp314-cp314-win_amd64.whl", hash = "sha256:0b1ac5bf6609b2716c7954011c5fef6254922df029f45d032ee4ebf5d363cbed", size = 121858, upload-time = "2026-08-14T16:13:11.634Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/a3/833e895ff452859eebe75093d26691fe9108f1a7a6a08435d7a5780ea652/orjson-3.12.0-cp314-cp314-win_arm64.whl", hash = "sha256:50fae885cb073eac7556353ff3df93312b0d5137b0a5056b2bb63f97ed9a93c7", size = 126749, upload-time = "2026-08-14T16:13:13.117Z" },
+    { url = "https://files.pythonhosted.org/packages/58/64/99c8947ece10c17176af9aae85c4948f1d109da77440ec14d87239efaf73/orjson-3.12.0-cp315-cp315-macosx_10_15_x86_64.macosx_11_0_arm64.macosx_10_15_universal2.whl", hash = "sha256:01efac2074fffb4cb1ea3fab7861e9d0f2a26913854a972f5ac760525dbdaf6e", size = 223398, upload-time = "2026-08-14T16:13:14.694Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/30/cf983fe09f2731420fda097a9f7ef4343f47fa216c228961ad8f6da44f3d/orjson-3.12.0-cp315-cp315-macosx_15_0_arm64.whl", hash = "sha256:ed4ca42bd55955aa34deedcfdfd0e0c31abf51143aae158ae2bc3520b626e517", size = 123655, upload-time = "2026-08-14T16:13:16.221Z" },
+    { url = "https://files.pythonhosted.org/packages/11/50/9cb8ae73fa4749dbbc20f617004213b5ff01c20aaeec34c3f31124f2c1d8/orjson-3.12.0-cp315-cp315-manylinux_2_39_aarch64.whl", hash = "sha256:40f92192227505acca4e2533ce565f8e6b9535f7d0d09b0968452f18b7376b38", size = 130515, upload-time = "2026-08-14T16:13:17.601Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/0a/adb6ce1a5b5fbf9cb1790f9961bb668a0dd5429aadaf6cee044724681795/orjson-3.12.0-cp315-cp315-manylinux_2_39_armv7l.whl", hash = "sha256:33efefcf5d88eaf400b47e2eba02f91f319bb9951be61ca500b7d536d3f2079d", size = 113327, upload-time = "2026-08-14T16:13:18.927Z" },
+    { url = "https://files.pythonhosted.org/packages/51/5c/d17f61581d8dbdde7048f87a330fa24915edec38db4d72b381fec14fbb56/orjson-3.12.0-cp315-cp315-manylinux_2_39_i686.whl", hash = "sha256:8e386b0bc0ddd7cd2056f884b5a0af33592bd01ac66a7ca4b42a65a7e7774a13", size = 130105, upload-time = "2026-08-14T16:13:20.317Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/b7/938befcf33bee4704a92ecec6a2731224c539d939bf9429fd39396d28931/orjson-3.12.0-cp315-cp315-manylinux_2_39_x86_64.whl", hash = "sha256:58c58e1de0006ffb580368d6793c36c7b0b021db066479cf281bf5061e732328", size = 131049, upload-time = "2026-08-14T16:13:21.719Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/15/cfa2021d64d5aa8bb5c9f604ef375e00ec8b657651b5dd650b1b7ad13df1/orjson-3.12.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:08231552159be266a7269555bd9f7c016aee7d9ad6dab06eb58796c5ccb7101c", size = 135320, upload-time = "2026-08-14T16:13:23.415Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/50/3e75dfe357c1e8f9e287c7a5740260ef15bd23a5299eae8d0835dcad5375/orjson-3.12.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:a15f9a891bce5f5cc5d210e3ad8614d4d1b489a56448c099d6d2a7168b2d954a", size = 127488, upload-time = "2026-08-14T16:13:24.791Z" },
+    { url = "https://files.pythonhosted.org/packages/11/a6/79aed402eb3ab284dc5b4791a7ad62c5875127de01b8e3f04bd92d551298/orjson-3.12.0-cp315-cp315-win32.whl", hash = "sha256:03091c8a64db4be38746597ceea68f33c238e27acd9bfe99fb59420224ae7a55", size = 128048, upload-time = "2026-08-14T16:13:26.217Z" },
+    { url = "https://files.pythonhosted.org/packages/64/f7/2723e264aab7248c1ed6ecaad8e5d0cb866c0cffde75442102ffa7491aba/orjson-3.12.0-cp315-cp315-win_amd64.whl", hash = "sha256:2b7bcefb9f40fa242fa6b06377232c048e655747790829609168c01162f60578", size = 121860, upload-time = "2026-08-14T16:13:27.577Z" },
+    { url = "https://files.pythonhosted.org/packages/82/56/630c9113ec8996778f1f0304b364b091b9a9db5fef5fdc17cca622f5ea24/orjson-3.12.0-cp315-cp315-win_arm64.whl", hash = "sha256:859fc4196855890150bb08e649b30d2c93b249b3e3edd0d3bb2231abf8aa8adc", size = 126754, upload-time = "2026-08-14T16:13:28.962Z" },
+]
+
 [[package]]
 name = "oxyjwt"
-version = "0.2.0"
+version = "0.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2b/b7/236a87d014d3a7bdf672c2d707b5449cd89f96025d246cc6cf931a52e89a/oxyjwt-0.2.0.tar.gz", hash = "sha256:649bc62a44bc324fe19937474d9d60069ebfe9af5edf1e4a280f9a252dd001ab", size = 24303, upload-time = "2026-04-26T07:49:26.898Z" }
+dependencies = [
+    { name = "orjson" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/51/2c/514d467b3eb1fc9372592cfad52d30b42415d3bf417165558895c1e02cb2/oxyjwt-0.7.0.tar.gz", hash = "sha256:ad61848b41008034e922f076fb460e1b3dbb3a551597175ce72afc14237c7b3b", size = 37430, upload-time = "2026-08-26T14:09:03.145Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/29/b4/94102d3f63b03e50b82ddff85f0d76f93d88cb2d3e09946ba8768286a84b/oxyjwt-0.2.0-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:27c5099416c5803ad54798e4e8ce05e0e11a1b639258d365bbe2a8969da50976", size = 1499308, upload-time = "2026-04-26T07:49:17.512Z" },
-    { url = "https://files.pythonhosted.org/packages/97/55/8260ce13707ec152d44e95066a9f58cc611b909b09dc088153d1c792480c/oxyjwt-0.2.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:0c19dd0dd1e7ab69539f3786e8e9ed3b93303e3cc3b70076adb989b86052979f", size = 1423862, upload-time = "2026-04-26T07:49:19.726Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/2d/ab847b81dcf4ed4a553a24b244822ad0c01500449489fad2643128097b52/oxyjwt-0.2.0-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4baafb218b3e740983bb3fb597e8f57be8f4a5ec8afe796b4b8e6f3db6d37ded", size = 790573, upload-time = "2026-04-26T07:49:21.657Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/14/b26db05c2b1b824c17b24e21cae7beb5df32b4a63cc1dda49bc020caaff0/oxyjwt-0.2.0-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b58e987492b68a18b1640abbb3ac4a2d232c6f8cf9fb4046d928a9b7ec95db3b", size = 1486775, upload-time = "2026-04-26T07:49:23.849Z" },
-    { url = "https://files.pythonhosted.org/packages/69/c1/5d26a2ab75cf7c840a8cffc5de964543d593e9294989c0a19bea9ac7816d/oxyjwt-0.2.0-cp310-abi3-win_amd64.whl", hash = "sha256:791767a6d94c58280193ec7935b07f9c368fd859b17230f280b9179a66fd30ff", size = 1159141, upload-time = "2026-04-26T07:49:25.436Z" },
+    { url = "https://files.pythonhosted.org/packages/35/0f/d87f49b47211c99ba3eeb02f144629564de7da5c2abdb1817362b96303d4/oxyjwt-0.7.0-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:4f8e71e581e71bebfb42518f249ae25b5bf3919a0db3d559fe671516b7058426", size = 1419045, upload-time = "2026-08-26T14:08:56.309Z" },
+    { url = "https://files.pythonhosted.org/packages/be/5d/2bf142ac9ed88ee0f4d41073a6a6bc442a7bdf4f48c03a0a6cb038fd58d8/oxyjwt-0.7.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:8107fdbd949d9a60a275c7c84bc4bc4b2af7ecec1a62b747d6ee2f6bf94674fe", size = 1335367, upload-time = "2026-08-26T14:08:57.793Z" },
+    { url = "https://files.pythonhosted.org/packages/76/da/7e355e568f481c68803894176733693174e98df6f443a5667679fe14b5af/oxyjwt-0.7.0-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:428ac944956af4d0a9101d0e52c8f0d6795b35ed0985165860c1004e4064c125", size = 682897, upload-time = "2026-08-26T14:08:59.337Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ca/a2aca744b0e96c5ce657468d31c38fc9a27d4549617e55e0cb1cf4fd8c4b/oxyjwt-0.7.0-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3118f774915b2444de85435eda01463b37c75a19b2de85a114dade9df1dc9526", size = 1396610, upload-time = "2026-08-26T14:09:00.608Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/1b/5c2fe98222be87b1306cd0b5bb4fd1807c6898c90a52624940cc201e4ca1/oxyjwt-0.7.0-cp310-abi3-win_amd64.whl", hash = "sha256:1f97973ce58f1c99ebb94332a7fa957a2a68c6e84012a7eeed0412c279a5e5d2", size = 1058638, upload-time = "2026-08-26T14:09:01.897Z" },
 ]
 
 [[package]]
@@ -425,33 +358,29 @@ bench = [
     { name = "fastapi" },
     { name = "granian" },
     { name = "httpx" },
-    { name = "pyjwt" },
+    { name = "oxyjwt" },
 ]
 dev = [
-    { name = "cryptography" },
     { name = "granian" },
     { name = "httpx" },
     { name = "maturin" },
     { name = "oxyjwt" },
     { name = "pydantic" },
-    { name = "pyjwt" },
     { name = "pytest" },
     { name = "ruff" },
 ]
 
 [package.metadata]
 requires-dist = [
-    { name = "cryptography", marker = "extra == 'dev'", specifier = ">=42" },
     { name = "fastapi", marker = "extra == 'bench'", specifier = ">=0.100" },
     { name = "granian", marker = "extra == 'bench'", specifier = ">=1.0" },
     { name = "granian", marker = "extra == 'dev'", specifier = ">=1.0" },
     { name = "httpx", marker = "extra == 'bench'", specifier = ">=0.27" },
     { name = "httpx", marker = "extra == 'dev'", specifier = ">=0.27" },
     { name = "maturin", marker = "extra == 'dev'", specifier = ">=1.4,<2" },
-    { name = "oxyjwt", marker = "extra == 'dev'", specifier = ">=0.2" },
+    { name = "oxyjwt", marker = "extra == 'bench'", specifier = ">=0.7.0" },
+    { name = "oxyjwt", marker = "extra == 'dev'", specifier = ">=0.7.0" },
     { name = "pydantic", marker = "extra == 'dev'", specifier = ">=2" },
-    { name = "pyjwt", marker = "extra == 'bench'", specifier = ">=2.8" },
-    { name = "pyjwt", marker = "extra == 'dev'", specifier = ">=2.8" },
     { name = "pytest", marker = "extra == 'dev'", specifier = ">=8" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.8" },
 ]
@@ -475,15 +404,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
-[[package]]
-name = "pycparser"
-version = "3.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
-]
-
 [[package]]
 name = "pydantic"
 version = "2.13.3"
@@ -624,18 +544,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
 ]
 
-[[package]]
-name = "pyjwt"
-version = "2.12.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
-]
-
 [[package]]
 name = "pytest"
 version = "9.0.3"

From 858b8a50c60f3237b1af97c0bd86c50c5ba2e64f Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Sat, 12 Sep 2026 08:25:40 +0300
Subject: [PATCH 34/53] feat(openapi): align default OpenAPI version to 3.1.0
 for Pydantic v2 JSON Schema compatibility

---
 docs/openapi.md        |  5 +++--
 oxyroute/_oxyroute.pyi |  1 +
 oxyroute/app.py        |  7 +++++++
 src/buffer_pool.rs     |  3 ++-
 src/lib.rs             | 10 ++++++++++
 src/state.rs           |  2 +-
 tests/test_openapi.py  | 16 ++++++++++++++++
 7 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/docs/openapi.md b/docs/openapi.md
index eb9237a..ba8dad4 100644
--- a/docs/openapi.md
+++ b/docs/openapi.md
@@ -2,7 +2,7 @@
 
 [← Documentation index](index.md)
 
-OxyRoute maintains an **OpenAPI 3.0**-shaped JSON document in Rust while routes are registered. It is suitable for discovery and interactive docs (Scalar / Swagger UI), and can be extended further in future versions.
+OxyRoute maintains an **OpenAPI 3.1.0** (or configured version) JSON document in Rust while routes are registered. It is fully compatible with Pydantic v2 JSON Schema and suitable for discovery and interactive docs (Scalar / Swagger UI).
 
 ## Constructor and toggles
 
@@ -39,9 +39,10 @@ app.mount_docs("/api/docs", ui="swagger")
 
 UI scripts load from **jsDelivr**. If you use `SecurityHeadersConfig` (or a strict CSP), allow `cdn.jsdelivr.net` in `script-src` / `style-src` for the docs route, or disable those headers on `/docs`.
 
-## Title, info, and servers
+## Title, version, info, and servers
 
 - **`title=`** / **`set_openapi_title`** — `info.title`.
+- **`openapi_version="3.1.0"`** (default) / **`set_openapi_version`** — root `openapi` specification version string.
 - **`openapi_description=`**, **`openapi_contact=`**, **`openapi_servers=`** constructor kwargs, or **`app.set_openapi_info(description=..., contact=..., servers=...)`**.
 
 ```python
diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index 9cc03b4..2227394 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -29,6 +29,7 @@ class App:
     def freeze(self) -> None: ...
     def set_openapi_served(self, enabled: bool) -> None: ...
     def set_openapi_title(self, title: str) -> None: ...
+    def set_openapi_version(self, version: str) -> None: ...
     def set_openapi_info(
         self,
         description: str | None = None,
diff --git a/oxyroute/app.py b/oxyroute/app.py
index 180a669..e39ecbb 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -82,6 +82,7 @@ def __init__(
         title: str = "OxyRoute",
         *,
         include_openapi: bool = True,
+        openapi_version: str = "3.1.0",
         docs_ui: str | None = None,
         openapi_description: str | None = None,
         openapi_contact: Mapping[str, Any] | None = None,
@@ -90,6 +91,8 @@ def __init__(
     ) -> None:
         self._app = _oxyroute.App(include_openapi=include_openapi)
         self._app.set_openapi_title(title)
+        if openapi_version != "3.1.0":
+            self._app.set_openapi_version(openapi_version)
         self.title = title
         self.access_log_hook = access_log_hook
         # Per-process mutable bag for ``on_startup`` / factory setup (DB pool, clients, …).
@@ -117,6 +120,10 @@ def set_openapi_served(self, enabled: bool) -> None:
         """Enable or disable the built-in ``GET /openapi.json`` route."""
         self._app.set_openapi_served(enabled)
 
+    def set_openapi_version(self, version: str) -> None:
+        """Set the OpenAPI specification version (default: '3.1.0')."""
+        self._app.set_openapi_version(version)
+
     def set_openapi_info(
         self,
         *,
diff --git a/src/buffer_pool.rs b/src/buffer_pool.rs
index 3fd55de..15e9dc4 100644
--- a/src/buffer_pool.rs
+++ b/src/buffer_pool.rs
@@ -52,7 +52,8 @@ impl DerefMut for PooledBuffer {
 
 impl Drop for PooledBuffer {
     fn drop(&mut self) {
-        if self.0.capacity() >= INITIAL_BUFFER_CAPACITY && self.0.capacity() <= POOL_CAPACITY_LIMIT {
+        if self.0.capacity() >= INITIAL_BUFFER_CAPACITY && self.0.capacity() <= POOL_CAPACITY_LIMIT
+        {
             self.0.clear();
             let buf = std::mem::take(&mut self.0);
             BODY_POOL.with(|pool| {
diff --git a/src/lib.rs b/src/lib.rs
index 91aa7ad..207bf45 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -518,6 +518,16 @@ impl App {
         Ok(())
     }
 
+    fn set_openapi_version(&self, version: &str) -> PyResult<()> {
+        let st = self.state.read();
+        let mut oa = st.openapi.lock();
+        if let Some(root) = oa.0.as_object_mut() {
+            root.insert("openapi".to_string(), json!(version));
+            oa.1 = None;
+        }
+        Ok(())
+    }
+
     /// Enrich OpenAPI ``info`` / ``servers``. Pass JSON strings for ``contact`` and ``servers``.
     #[pyo3(signature = (description=None, contact_json=None, servers_json=None))]
     fn set_openapi_info(
diff --git a/src/state.rs b/src/state.rs
index 9c950e9..43fe7aa 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -175,7 +175,7 @@ pub struct AppState {
 impl AppState {
     pub fn new() -> Self {
         let openapi = serde_json::json!({
-            "openapi": "3.0.0",
+            "openapi": "3.1.0",
             "info": { "title": "OxyRoute", "version": "0.5.0" },
             "paths": {}
         });
diff --git a/tests/test_openapi.py b/tests/test_openapi.py
index 9a1446c..d15523a 100644
--- a/tests/test_openapi.py
+++ b/tests/test_openapi.py
@@ -258,3 +258,19 @@ class M(pydantic.BaseModel):
         @app.post("/x", body_model=M, body_schema={"type": "object"})
         def _bad(json: dict) -> str:
             return "n"
+
+
+def test_openapi_default_version_3_1_0() -> None:
+    app = App()
+    doc = json.loads(app.openapi_json())
+    assert doc["openapi"] == "3.1.0"
+
+
+def test_openapi_custom_version_via_init_and_setter() -> None:
+    app = App(openapi_version="3.0.3")
+    doc = json.loads(app.openapi_json())
+    assert doc["openapi"] == "3.0.3"
+
+    app.set_openapi_version("3.1.1")
+    doc2 = json.loads(app.openapi_json())
+    assert doc2["openapi"] == "3.1.1"

From 98e377ddcd8b64193274c40c9ef93bb422e6c939 Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Sat, 12 Sep 2026 08:27:24 +0300
Subject: [PATCH 35/53] feat(openapi): auto-document 401 Unauthorized and 422
 Validation Error responses

---
 src/lib.rs            | 16 ++++++++++++--
 tests/test_openapi.py | 51 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 2 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index 207bf45..500cc5e 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -227,6 +227,18 @@ impl App {
             let method_lc = method.to_lowercase();
             let path_entry = paths.entry(oa_path).or_insert_with(|| json!({}));
             if let Some(obj) = path_entry.as_object_mut() {
+                let mut responses = serde_json::Map::new();
+                responses.insert("200".to_string(), json!({ "description": "OK" }));
+                if require_jwt {
+                    responses.insert("401".to_string(), json!({ "description": "Unauthorized" }));
+                }
+                if request_schema.is_some() {
+                    responses.insert(
+                        "422".to_string(),
+                        json!({ "description": "Validation Error" }),
+                    );
+                }
+
                 let mut op = if let Some(schema) = request_schema {
                     json!({
                         "summary": op_id,
@@ -239,13 +251,13 @@ impl App {
                                 }
                             }
                         },
-                        "responses": { "200": { "description": "OK" } }
+                        "responses": responses
                     })
                 } else {
                     json!({
                         "summary": op_id,
                         "operationId": op_id,
-                        "responses": { "200": { "description": "OK" } }
+                        "responses": responses
                     })
                 };
                 if let Some(op_obj) = op.as_object_mut() {
diff --git a/tests/test_openapi.py b/tests/test_openapi.py
index d15523a..8870ba2 100644
--- a/tests/test_openapi.py
+++ b/tests/test_openapi.py
@@ -274,3 +274,54 @@ def test_openapi_custom_version_via_init_and_setter() -> None:
     app.set_openapi_version("3.1.1")
     doc2 = json.loads(app.openapi_json())
     assert doc2["openapi"] == "3.1.1"
+
+
+def test_openapi_auto_document_401_and_422_responses() -> None:
+    pydantic = pytest.importorskip("pydantic")
+
+    class UserInput(pydantic.BaseModel):
+        username: str
+
+    app = App()
+
+    @app.get("/public")
+    def public() -> str:
+        return "ok"
+
+    @app.get("/protected", require_jwt=True, jwt_secret="secret")
+    def protected(claims: dict) -> str:
+        return "secret"
+
+    @app.post("/users", body_model=UserInput)
+    def create_user(json: dict) -> str:
+        return "created"
+
+    @app.post("/protected-users", require_jwt=True, jwt_secret="secret", body_model=UserInput)
+    def create_protected_user(json: dict, claims: dict) -> str:
+        return "created"
+
+    doc = json.loads(app.openapi_json())
+
+    # Public endpoint: only 200
+    public_resp = doc["paths"]["/public"]["get"]["responses"]
+    assert "200" in public_resp
+    assert "401" not in public_resp
+    assert "422" not in public_resp
+
+    # Protected endpoint: 200 and 401
+    prot_resp = doc["paths"]["/protected"]["get"]["responses"]
+    assert "200" in prot_resp
+    assert prot_resp["401"]["description"] == "Unauthorized"
+    assert "422" not in prot_resp
+
+    # Body model endpoint: 200 and 422
+    user_resp = doc["paths"]["/users"]["post"]["responses"]
+    assert "200" in user_resp
+    assert "401" not in user_resp
+    assert user_resp["422"]["description"] == "Validation Error"
+
+    # Protected + body model endpoint: 200, 401, 422
+    prot_user_resp = doc["paths"]["/protected-users"]["post"]["responses"]
+    assert "200" in prot_user_resp
+    assert prot_user_resp["401"]["description"] == "Unauthorized"
+    assert prot_user_resp["422"]["description"] == "Validation Error"

From 72b71d52e2b039cf2600d458371ae4012cde9cce Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Sat, 12 Sep 2026 08:30:55 +0300
Subject: [PATCH 36/53] feat(openapi): support query and header parameter
 schema declarations

---
 oxyroute/_oxyroute.pyi |   1 +
 oxyroute/app.py        | 130 +++++++++++++++++++++++++++++++++++++++++
 oxyroute/router.py     |  36 ++++++++++++
 src/lib.rs             |  20 ++++++-
 tests/test_openapi.py  |  68 +++++++++++++++++++++
 5 files changed, 253 insertions(+), 2 deletions(-)

diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index 2227394..2f48031 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -24,6 +24,7 @@ class App:
         body_model: Any | None = None,
         tags: list[str] | None = None,
         body_param_name: str | None = None,
+        extra_params_json: str | None = None,
     ) -> None: ...
     def add_websocket_route(self, path: str, handler: Any) -> None: ...
     def freeze(self) -> None: ...
diff --git a/oxyroute/app.py b/oxyroute/app.py
index e39ecbb..958739f 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -61,6 +61,94 @@ def _norm_dependencies(
     return [(n, _unwrap_dep(c)) for n, c in deps]
 
 
+def _norm_type_to_schema(t: Any) -> dict[str, Any]:
+    if t is int:
+        return {"type": "integer"}
+    if t is float:
+        return {"type": "number"}
+    if t is bool:
+        return {"type": "boolean"}
+    if t is str:
+        return {"type": "string"}
+    if isinstance(t, Mapping):
+        return dict(t)
+    return {"type": "string"}
+
+
+def _norm_extra_openapi_params(
+    parameters: list[Mapping[str, Any]] | None,
+    query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None,
+    header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None,
+) -> list[dict[str, Any]] | None:
+    res: list[dict[str, Any]] = []
+    if parameters:
+        for p in parameters:
+            res.append(dict(p))
+    if query_params:
+        if isinstance(query_params, Mapping):
+            for k, v in query_params.items():
+                res.append(
+                    {
+                        "name": str(k),
+                        "in": "query",
+                        "required": False,
+                        "schema": _norm_type_to_schema(v),
+                    }
+                )
+        elif isinstance(query_params, list):
+            for item in query_params:
+                if isinstance(item, str):
+                    res.append(
+                        {
+                            "name": item,
+                            "in": "query",
+                            "required": False,
+                            "schema": {"type": "string"},
+                        }
+                    )
+                elif isinstance(item, Mapping):
+                    d = dict(item)
+                    d.setdefault("in", "query")
+                    d.setdefault("required", False)
+                    if "schema" not in d and "type" in d:
+                        d["schema"] = {"type": d.pop("type")}
+                    elif "schema" not in d:
+                        d["schema"] = {"type": "string"}
+                    res.append(d)
+    if header_params:
+        if isinstance(header_params, Mapping):
+            for k, v in header_params.items():
+                res.append(
+                    {
+                        "name": str(k),
+                        "in": "header",
+                        "required": False,
+                        "schema": _norm_type_to_schema(v),
+                    }
+                )
+        elif isinstance(header_params, list):
+            for item in header_params:
+                if isinstance(item, str):
+                    res.append(
+                        {
+                            "name": item,
+                            "in": "header",
+                            "required": False,
+                            "schema": {"type": "string"},
+                        }
+                    )
+                elif isinstance(item, Mapping):
+                    d = dict(item)
+                    d.setdefault("in", "header")
+                    d.setdefault("required", False)
+                    if "schema" not in d and "type" in d:
+                        d["schema"] = {"type": d.pop("type")}
+                    elif "schema" not in d:
+                        d["schema"] = {"type": "string"}
+                    res.append(d)
+    return res if res else None
+
+
 def Depends(call: Callable[..., Any]) -> _oxyroute.PyDepends:
     """Marker for a dependency factory; used with ``dependencies=[("name", Depends(fn)), ...]``."""
     return _oxyroute.PyDepends(call)
@@ -264,6 +352,9 @@ def get(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "GET",
@@ -279,6 +370,9 @@ def get(
             jwt_leeway=jwt_leeway,
             jwt_cookie=jwt_cookie,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def post(
@@ -298,6 +392,9 @@ def post(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "POST",
@@ -315,6 +412,9 @@ def post(
             body_model=body_model,
             body_schema=body_schema,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def put(
@@ -334,6 +434,9 @@ def put(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "PUT",
@@ -351,6 +454,9 @@ def put(
             body_model=body_model,
             body_schema=body_schema,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def patch(
@@ -370,6 +476,9 @@ def patch(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "PATCH",
@@ -387,6 +496,9 @@ def patch(
             body_model=body_model,
             body_schema=body_schema,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def delete(
@@ -402,6 +514,9 @@ def delete(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "DELETE",
@@ -417,6 +532,9 @@ def delete(
             jwt_leeway=jwt_leeway,
             jwt_cookie=jwt_cookie,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def websocket(self, path: str) -> Callable[[F], F]:
@@ -450,6 +568,9 @@ def options(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "OPTIONS",
@@ -465,6 +586,9 @@ def options(
             jwt_leeway=jwt_leeway,
             jwt_cookie=jwt_cookie,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def _route(
@@ -485,8 +609,13 @@ def _route(
         body_model: Any | None = None,
         body_schema: Mapping[str, Any] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         dlist = _norm_dependencies(dependencies)
+        extra_params = _norm_extra_openapi_params(parameters, query_params, header_params)
+        extra_params_json = json.dumps(extra_params) if extra_params else None
 
         def wrap(handler: F) -> F:
             nonlocal body_model
@@ -568,6 +697,7 @@ def wrap(handler: F) -> F:
                 target_body_model,
                 tags,
                 body_param_name,
+                extra_params_json,
             )
             return handler
 
diff --git a/oxyroute/router.py b/oxyroute/router.py
index 64ee6ed..6bc01d2 100644
--- a/oxyroute/router.py
+++ b/oxyroute/router.py
@@ -91,6 +91,9 @@ def get(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "GET",
@@ -104,6 +107,9 @@ def get(
             jwt_cookie=jwt_cookie,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def post(
@@ -123,6 +129,9 @@ def post(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "POST",
@@ -140,6 +149,9 @@ def post(
             body_schema=body_schema,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def put(
@@ -159,6 +171,9 @@ def put(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "PUT",
@@ -176,6 +191,9 @@ def put(
             body_schema=body_schema,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def patch(
@@ -195,6 +213,9 @@ def patch(
         body_schema: Mapping[str, Any] | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "PATCH",
@@ -212,6 +233,9 @@ def patch(
             body_schema=body_schema,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def delete(
@@ -227,6 +251,9 @@ def delete(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "DELETE",
@@ -240,6 +267,9 @@ def delete(
             jwt_cookie=jwt_cookie,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
 
     def options(
@@ -255,6 +285,9 @@ def options(
         jwt_cookie: str | None = None,
         dependencies: list[tuple[str, Dep]] | None = None,
         tags: list[str] | None = None,
+        parameters: list[Mapping[str, Any]] | None = None,
+        query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "OPTIONS",
@@ -268,4 +301,7 @@ def options(
             jwt_cookie=jwt_cookie,
             dependencies=dependencies,
             tags=tags,
+            parameters=parameters,
+            query_params=query_params,
+            header_params=header_params,
         )
diff --git a/src/lib.rs b/src/lib.rs
index 500cc5e..4e62703 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -206,6 +206,7 @@ impl App {
         }
     }
 
+    #[allow(clippy::too_many_arguments)]
     fn openapi_add_path(
         oa: &mut serde_json::Value,
         method: &str,
@@ -214,8 +215,12 @@ impl App {
         request_schema: Option<serde_json::Value>,
         require_jwt: bool,
         tags: Option<Vec<String>>,
+        extra_parameters: Option<Vec<serde_json::Value>>,
     ) {
-        let (oa_path, path_params) = Self::openapi_path_and_params(path);
+        let (oa_path, mut path_params) = Self::openapi_path_and_params(path);
+        if let Some(extra) = extra_parameters {
+            path_params.extend(extra);
+        }
         if require_jwt {
             Self::openapi_ensure_bearer_auth(oa);
         }
@@ -293,7 +298,7 @@ impl App {
 
     /// Paths use **matchit 0.7** style: `/user/:id`. Pass `dependencies=[("x", get_x), ...]`.
     #[pyo3(
-        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None)
+        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None, extra_params_json=None)
     )]
     #[allow(clippy::too_many_arguments)]
     fn add_route(
@@ -316,6 +321,7 @@ impl App {
         body_model: Option<Py<PyAny>>,
         tags: Option<Bound<'_, PyList>>,
         body_param_name: Option<String>,
+        extra_params_json: Option<String>,
     ) -> PyResult<()> {
         {
             let st = self.state.read();
@@ -434,6 +440,15 @@ impl App {
         } else {
             None
         };
+        let extra_params: Option<Vec<serde_json::Value>> = match extra_params_json
+            .as_deref()
+            .map(str::trim)
+        {
+            None | Some("") => None,
+            Some(s) => Some(serde_json::from_str(s).map_err(|e| {
+                pyo3::exceptions::PyValueError::new_err(format!("invalid extra_params JSON: {e}"))
+            })?),
+        };
         {
             let mut oa = st.openapi.lock();
             App::openapi_add_path(
@@ -444,6 +459,7 @@ impl App {
                 request_schema,
                 require_jwt,
                 tag_list,
+                extra_params,
             );
             oa.1 = None;
         }
diff --git a/tests/test_openapi.py b/tests/test_openapi.py
index 8870ba2..c089c56 100644
--- a/tests/test_openapi.py
+++ b/tests/test_openapi.py
@@ -325,3 +325,71 @@ def create_protected_user(json: dict, claims: dict) -> str:
     assert "200" in prot_user_resp
     assert prot_user_resp["401"]["description"] == "Unauthorized"
     assert prot_user_resp["422"]["description"] == "Validation Error"
+
+
+def test_openapi_query_and_header_parameters() -> None:
+    app = App()
+
+    @app.get(
+        "/search",
+        query_params=["q", {"name": "limit", "schema": {"type": "integer"}}],
+        header_params={"X-Client-Version": str, "X-Request-ID": str},
+        parameters=[
+            {"name": "X-Custom", "in": "header", "required": True, "schema": {"type": "string"}}
+        ],
+    )
+    def search() -> str:
+        return "search"
+
+    doc = json.loads(app.openapi_json())
+    params = doc["paths"]["/search"]["get"]["parameters"]
+
+    params_by_name = {p["name"]: p for p in params}
+    assert "q" in params_by_name
+    assert params_by_name["q"]["in"] == "query"
+    assert params_by_name["q"]["schema"]["type"] == "string"
+
+    assert "limit" in params_by_name
+    assert params_by_name["limit"]["in"] == "query"
+    assert params_by_name["limit"]["schema"]["type"] == "integer"
+
+    assert "X-Client-Version" in params_by_name
+    assert params_by_name["X-Client-Version"]["in"] == "header"
+    assert params_by_name["X-Client-Version"]["schema"]["type"] == "string"
+
+    assert "X-Custom" in params_by_name
+    assert params_by_name["X-Custom"]["in"] == "header"
+    assert params_by_name["X-Custom"]["required"] is True
+
+
+def test_openapi_query_and_header_parameters_via_router() -> None:
+    router = APIRouter()
+
+    @router.get(
+        "/items/:id",
+        query_params={"include_details": bool},
+        header_params=["Authorization-Extra"],
+    )
+    def get_item(id: str) -> str:
+        return "item"
+
+    app = App()
+    app.include_router(router, prefix="/api")
+
+    doc = json.loads(app.openapi_json())
+    params = doc["paths"]["/api/items/{id}"]["get"]["parameters"]
+
+    params_by_name = {p["name"]: p for p in params}
+    # Path parameter
+    assert "id" in params_by_name
+    assert params_by_name["id"]["in"] == "path"
+    assert params_by_name["id"]["required"] is True
+
+    # Query parameter
+    assert "include_details" in params_by_name
+    assert params_by_name["include_details"]["in"] == "query"
+    assert params_by_name["include_details"]["schema"]["type"] == "boolean"
+
+    # Header parameter
+    assert "Authorization-Extra" in params_by_name
+    assert params_by_name["Authorization-Extra"]["in"] == "header"

From 7dfd3117b6ce08522b73129a14fc40a7639d5f3a Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:34:11 +0300
Subject: [PATCH 37/53] perf(response): pre-baked static response headers to
 eliminate string formatting on hot path (#184)

---
 src/response.rs | 110 +++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 85 insertions(+), 25 deletions(-)

diff --git a/src/response.rs b/src/response.rs
index 3e83e28..2707d02 100644
--- a/src/response.rs
+++ b/src/response.rs
@@ -102,15 +102,46 @@ fn build_header_list_from_pairs<'py>(
 ) -> PyResult<Bound<'py, PyList>> {
     let out = PyList::empty(py);
     for (k, v) in pairs {
-        let name: String = if k.eq_ignore_ascii_case("set-cookie") {
-            "set-cookie".to_string()
+        let name = if k.eq_ignore_ascii_case("set-cookie") {
+            pyo3::intern!(py, "set-cookie").clone()
+        } else if k.eq_ignore_ascii_case("content-type") {
+            pyo3::intern!(py, "content-type").clone()
+        } else if k.eq_ignore_ascii_case("content-length") {
+            pyo3::intern!(py, "content-length").clone()
+        } else if k.eq_ignore_ascii_case("server") {
+            pyo3::intern!(py, "server").clone()
+        } else if k.eq_ignore_ascii_case("allow") {
+            pyo3::intern!(py, "allow").clone()
+        } else if k.eq_ignore_ascii_case("access-control-allow-origin") {
+            pyo3::intern!(py, "access-control-allow-origin").clone()
+        } else if k.eq_ignore_ascii_case("access-control-allow-credentials") {
+            pyo3::intern!(py, "access-control-allow-credentials").clone()
+        } else if k.eq_ignore_ascii_case("access-control-allow-methods") {
+            pyo3::intern!(py, "access-control-allow-methods").clone()
+        } else if k.eq_ignore_ascii_case("access-control-allow-headers") {
+            pyo3::intern!(py, "access-control-allow-headers").clone()
+        } else if k.eq_ignore_ascii_case("access-control-max-age") {
+            pyo3::intern!(py, "access-control-max-age").clone()
+        } else if k.chars().all(|c| !c.is_ascii_uppercase()) {
+            PyString::new(py, k)
         } else {
-            k.to_ascii_lowercase()
+            PyString::new(py, &k.to_ascii_lowercase())
         };
-        let pair = PyTuple::new(
-            py,
-            [PyString::new(py, &name), PyString::new(py, v.as_str())],
-        )?;
+
+        let val = match v.as_str() {
+            "application/json; charset=utf-8" => {
+                pyo3::intern!(py, "application/json; charset=utf-8").clone()
+            }
+            "application/json" => pyo3::intern!(py, "application/json").clone(),
+            "text/plain; charset=utf-8" => pyo3::intern!(py, "text/plain; charset=utf-8").clone(),
+            "text/html; charset=utf-8" => pyo3::intern!(py, "text/html; charset=utf-8").clone(),
+            "0" => pyo3::intern!(py, "0").clone(),
+            "true" => pyo3::intern!(py, "true").clone(),
+            "*" => pyo3::intern!(py, "*").clone(),
+            other => PyString::new(py, other),
+        };
+
+        let pair = PyTuple::new(py, [name.as_any(), val.as_any()])?;
         out.append(pair)?;
     }
     Ok(out)
@@ -123,11 +154,20 @@ fn build_headers_ct<'py>(
     match content_type {
         None => Ok(PyList::empty(py)),
         Some(ct) => {
-            let pair = PyTuple::new(
-                py,
-                [PyString::new(py, "content-type"), PyString::new(py, ct)],
-            )?;
-            Ok(PyList::new(py, [pair])?)
+            let k = pyo3::intern!(py, "content-type");
+            let v = match ct {
+                "application/json; charset=utf-8" => {
+                    pyo3::intern!(py, "application/json; charset=utf-8").clone()
+                }
+                "application/json" => pyo3::intern!(py, "application/json").clone(),
+                "text/plain; charset=utf-8" => {
+                    pyo3::intern!(py, "text/plain; charset=utf-8").clone()
+                }
+                "text/html; charset=utf-8" => pyo3::intern!(py, "text/html; charset=utf-8").clone(),
+                other => PyString::new(py, other),
+            };
+            let pair = PyTuple::new(py, [k.as_any(), v.as_any()])?;
+            PyList::new(py, [pair])
         }
     }
 }
@@ -233,14 +273,17 @@ pub fn send_405_method_not_allowed_sync(
     protocol: &Py<PyAny>,
     allow: &[String],
 ) -> PyResult<()> {
-    let headers = vec![
-        ("allow".to_string(), allow.join(", ")),
-        (
-            "content-type".to_string(),
-            "text/plain; charset=utf-8".to_string(),
-        ),
-    ];
-    send_with_headers_sync(py, protocol, 405, b"Method Not Allowed", headers)
+    let p = protocol.bind(py);
+    let allow_key = pyo3::intern!(py, "allow");
+    let allow_val = PyString::new(py, &allow.join(", "));
+    let ct_key = pyo3::intern!(py, "content-type");
+    let ct_val = pyo3::intern!(py, "text/plain; charset=utf-8");
+    let pair1 = PyTuple::new(py, [allow_key.as_any(), allow_val.as_any()])?;
+    let pair2 = PyTuple::new(py, [ct_key.as_any(), ct_val.as_any()])?;
+    let h = PyList::new(py, [pair1, pair2])?;
+    p.getattr("response_bytes")?
+        .call1((405u16, h, b"Method Not Allowed" as &[u8]))?;
+    Ok(())
 }
 
 /// HEAD: no body, but `content-length` for `full_body_len`.
@@ -251,11 +294,28 @@ pub fn send_head_simple_sync(
     full_body_len: usize,
     content_type: &str,
 ) -> PyResult<()> {
-    let headers = vec![
-        ("content-type".to_string(), content_type.to_string()),
-        ("content-length".to_string(), full_body_len.to_string()),
-    ];
-    send_with_headers_sync(py, protocol, status, b"", headers)
+    let p = protocol.bind(py);
+    let ct_key = pyo3::intern!(py, "content-type");
+    let ct_val = match content_type {
+        "application/json; charset=utf-8" => {
+            pyo3::intern!(py, "application/json; charset=utf-8").clone()
+        }
+        "application/json" => pyo3::intern!(py, "application/json").clone(),
+        "text/plain; charset=utf-8" => pyo3::intern!(py, "text/plain; charset=utf-8").clone(),
+        "text/html; charset=utf-8" => pyo3::intern!(py, "text/html; charset=utf-8").clone(),
+        other => PyString::new(py, other),
+    };
+    let cl_key = pyo3::intern!(py, "content-length");
+    let cl_val = if full_body_len == 0 {
+        pyo3::intern!(py, "0").clone()
+    } else {
+        PyString::new(py, &full_body_len.to_string())
+    };
+    let pair1 = PyTuple::new(py, [ct_key.as_any(), ct_val.as_any()])?;
+    let pair2 = PyTuple::new(py, [cl_key.as_any(), cl_val.as_any()])?;
+    let h = PyList::new(py, [pair1, pair2])?;
+    p.getattr("response_empty")?.call1((status, h))?;
+    Ok(())
 }
 
 /// HEAD with arbitrary headers; strips body, sets `content-length` from `full_body.len()`.

From 08d63703e47feb134cfadc5712c4f0ac283207a4 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:39:37 +0300
Subject: [PATCH 38/53] feat(resilience): adaptive concurrency limiting and
 load shedding to prevent OOM and tail latency spikes (#185)

---
 docs/resilience.md       |  53 ++++++++++++++++
 oxyroute/__init__.py     |   2 +
 oxyroute/_oxyroute.pyi   |   3 +
 oxyroute/app.py          |  15 +++++
 oxyroute/resilience.py   |  75 +++++++++++++++++++++++
 perf-test/fastapi_app.py |   5 +-
 src/lib.rs               |  63 +++++++++++++++++++
 src/state.rs             |  10 ++-
 tests/test_resilience.py | 128 +++++++++++++++++++++++++++++++++++++++
 9 files changed, 350 insertions(+), 4 deletions(-)
 create mode 100644 docs/resilience.md
 create mode 100644 oxyroute/resilience.py
 create mode 100644 tests/test_resilience.py

diff --git a/docs/resilience.md b/docs/resilience.md
new file mode 100644
index 0000000..a25c4b0
--- /dev/null
+++ b/docs/resilience.md
@@ -0,0 +1,53 @@
+# Concurrency Limiting & Load Shedding
+
+OxyRoute includes native Rust-level concurrency limiting and fast load shedding to prevent memory spikes (OOM), queue buildup, and tail latency degradation during traffic surges.
+
+---
+
+## Static Concurrency Limiting
+
+You can configure a fixed maximum concurrency limit at the application level:
+
+```python
+from oxyroute import App
+
+# Limit concurrent in-flight requests to 100
+app = App(max_concurrency=100)
+
+@app.get("/items")
+def list_items():
+    return [{"id": 1}]
+```
+
+You can also adjust or inspect the limit at runtime:
+
+```python
+app.set_max_concurrency(200)
+limit = app.get_max_concurrency()
+active = app.get_in_flight()
+```
+
+### Fast Load Shedding
+
+When in-flight requests exceed `max_concurrency`, the Rust dispatcher immediately rejects incoming requests with `503 Service Unavailable` and a `Retry-After: 1` header before invoking Python handlers or allocating asyncio futures.
+
+---
+
+## Adaptive Concurrency Limiting
+
+Under variable workloads or downstream latency degradation (e.g. slow database queries), `AdaptiveConcurrencyLimiter` uses a TCP Vegas / Little's Law gradient algorithm to dynamically adjust `max_concurrency`:
+
+```python
+from oxyroute import App, AdaptiveConcurrencyLimiter
+
+app = App()
+limiter = AdaptiveConcurrencyLimiter(
+    app,
+    min_limit=8,
+    max_limit=256,
+    initial_limit=32,
+)
+
+# Connect to access_log_hook to measure request latency automatically
+app.access_log_hook = limiter.as_access_log_hook()
+```
diff --git a/oxyroute/__init__.py b/oxyroute/__init__.py
index 4abb2ce..e746841 100644
--- a/oxyroute/__init__.py
+++ b/oxyroute/__init__.py
@@ -6,6 +6,7 @@
 from oxyroute.csrf import CSRFConfig, apply_csrf, csrf_layer
 from oxyroute.exceptions import HTTPException
 from oxyroute.request import Request
+from oxyroute.resilience import AdaptiveConcurrencyLimiter
 from oxyroute.response import Response
 from oxyroute.router import APIRouter
 from oxyroute.security_headers import SecurityHeadersConfig
@@ -15,6 +16,7 @@
 
 __all__ = [
     "APIRouter",
+    "AdaptiveConcurrencyLimiter",
     "App",
     "CORSConfig",
     "CSRFConfig",
diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index 2f48031..69a325b 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -5,6 +5,9 @@ from typing import Any
 
 class App:
     def __init__(self, include_openapi: bool = True) -> None: ...
+    def set_max_concurrency(self, limit: int) -> None: ...
+    def get_max_concurrency(self) -> int: ...
+    def get_in_flight(self) -> int: ...
     def add_route(
         self,
         method: str,
diff --git a/oxyroute/app.py b/oxyroute/app.py
index 958739f..c7281a6 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -176,11 +176,14 @@ def __init__(
         openapi_contact: Mapping[str, Any] | None = None,
         openapi_servers: list[Mapping[str, Any]] | None = None,
         access_log_hook: Callable[[Any, int, float, str], None] | None = None,
+        max_concurrency: int | None = None,
     ) -> None:
         self._app = _oxyroute.App(include_openapi=include_openapi)
         self._app.set_openapi_title(title)
         if openapi_version != "3.1.0":
             self._app.set_openapi_version(openapi_version)
+        if max_concurrency is not None:
+            self._app.set_max_concurrency(max_concurrency)
         self.title = title
         self.access_log_hook = access_log_hook
         # Per-process mutable bag for ``on_startup`` / factory setup (DB pool, clients, …).
@@ -200,6 +203,18 @@ def __init__(
         if self._docs_ui is not None:
             self.mount_docs("/docs", ui=self._docs_ui)
 
+    def set_max_concurrency(self, limit: int) -> None:
+        """Set maximum in-flight requests limit (0 to disable / unlimited)."""
+        self._app.set_max_concurrency(limit or 0)
+
+    def get_max_concurrency(self) -> int:
+        """Get the configured maximum concurrency limit (0 if unlimited)."""
+        return self._app.get_max_concurrency()
+
+    def get_in_flight(self) -> int:
+        """Get the current number of in-flight requests."""
+        return self._app.get_in_flight()
+
     def freeze(self) -> None:
         """After ``freeze()``, no more route registration (matches Rust app state)."""
         self._app.freeze()
diff --git a/oxyroute/resilience.py b/oxyroute/resilience.py
new file mode 100644
index 0000000..f716929
--- /dev/null
+++ b/oxyroute/resilience.py
@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from .app import App
+
+
+class AdaptiveConcurrencyLimiter:
+    """
+    Adaptive concurrency limiter based on TCP Vegas / Little's Law gradient algorithm.
+
+    Monitors request latency (RTT) and dynamically scales `app.set_max_concurrency(...)`
+    to prevent queue build-up, memory spikes, and tail-latency degradation under load.
+    """
+
+    def __init__(
+        self,
+        app: App,
+        *,
+        min_limit: int = 4,
+        max_limit: int = 1024,
+        initial_limit: int = 32,
+        alpha: float = 0.1,
+        smoothing: float = 0.2,
+    ) -> None:
+        self.app = app
+        self.min_limit = max(1, min_limit)
+        self.max_limit = max(self.min_limit, max_limit)
+        self.current_limit: float = float(min(max(initial_limit, self.min_limit), self.max_limit))
+        self.alpha = alpha
+        self.smoothing = smoothing
+        self.min_rtt: float | None = None
+        self.avg_rtt: float | None = None
+
+        self.app.set_max_concurrency(int(self.current_limit))
+
+    def on_request_completed(self, latency_seconds: float) -> int:
+        """
+        Record completed request latency and adjust concurrency limit.
+        Returns the updated integer concurrency limit.
+        """
+        if latency_seconds <= 0.0:
+            return int(self.current_limit)
+
+        if self.min_rtt is None or latency_seconds < self.min_rtt:
+            self.min_rtt = latency_seconds
+
+        if self.avg_rtt is None:
+            self.avg_rtt = latency_seconds
+        else:
+            self.avg_rtt = (1.0 - self.smoothing) * self.avg_rtt + self.smoothing * latency_seconds
+
+        if self.min_rtt > 0 and self.avg_rtt > 0:
+            gradient = self.min_rtt / self.avg_rtt
+            # Vegas calculation: target = limit * gradient + alpha
+            target = self.current_limit * gradient + self.alpha
+            # Smooth adjustment towards target
+            self.current_limit = (1.0 - self.smoothing) * self.current_limit + self.smoothing * target
+            self.current_limit = max(float(self.min_limit), min(float(self.max_limit), self.current_limit))
+            new_limit = int(self.current_limit)
+            self.app.set_max_concurrency(new_limit)
+            return new_limit
+
+        return int(self.current_limit)
+
+    def as_access_log_hook(self) -> Any:
+        """
+        Return a callable suitable for `App(access_log_hook=limiter.as_access_log_hook())`.
+        """
+
+        def _hook(scope: Any, status: int, duration_seconds: float, path_template: str) -> None:
+            self.on_request_completed(duration_seconds)
+
+        return _hook
diff --git a/perf-test/fastapi_app.py b/perf-test/fastapi_app.py
index 284b82e..47e9f30 100644
--- a/perf-test/fastapi_app.py
+++ b/perf-test/fastapi_app.py
@@ -1,9 +1,8 @@
 import contextlib
-from typing import AsyncGenerator
+from collections.abc import AsyncGenerator
 
-from fastapi import FastAPI
-from fastapi.responses import JSONResponse
 import asyncpg
+from fastapi import FastAPI
 
 DB_URI = "postgresql://postgres:postgres@127.0.0.1:5433/postgres"
 
diff --git a/src/lib.rs b/src/lib.rs
index 4e62703..b49e4db 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -284,6 +284,14 @@ impl App {
     }
 }
 
+pub struct InFlightGuard(pub Arc<std::sync::atomic::AtomicUsize>);
+
+impl Drop for InFlightGuard {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, std::sync::atomic::Ordering::Release);
+    }
+}
+
 #[pymethods]
 impl App {
     #[new]
@@ -296,6 +304,25 @@ impl App {
         }
     }
 
+    fn set_max_concurrency(&self, limit: usize) -> PyResult<()> {
+        let st = self.state.read();
+        st.max_concurrency
+            .store(limit, std::sync::atomic::Ordering::Relaxed);
+        Ok(())
+    }
+
+    fn get_max_concurrency(&self) -> PyResult<usize> {
+        let st = self.state.read();
+        Ok(st
+            .max_concurrency
+            .load(std::sync::atomic::Ordering::Relaxed))
+    }
+
+    fn get_in_flight(&self) -> PyResult<usize> {
+        let st = self.state.read();
+        Ok(st.in_flight.load(std::sync::atomic::Ordering::Relaxed))
+    }
+
     /// Paths use **matchit 0.7** style: `/user/:id`. Pass `dependencies=[("x", get_x), ...]`.
     #[pyo3(
         signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None, extra_params_json=None)
@@ -709,13 +736,49 @@ impl App {
         scope: &Bound<'py, PyAny>,
         protocol: &Bound<'py, PyAny>,
     ) -> PyResult<Bound<'py, PyAny>> {
+        let (in_flight, max_c) = {
+            let st = this.state.read();
+            (
+                Arc::clone(&st.in_flight),
+                st.max_concurrency
+                    .load(std::sync::atomic::Ordering::Relaxed),
+            )
+        };
+        if max_c > 0 {
+            let current = in_flight.fetch_add(1, std::sync::atomic::Ordering::Acquire);
+            if current >= max_c {
+                in_flight.fetch_sub(1, std::sync::atomic::Ordering::Release);
+                let protocol_py: Py<PyAny> = protocol.as_any().clone().unbind();
+                let headers = vec![
+                    (
+                        "content-type".to_string(),
+                        "text/plain; charset=utf-8".to_string(),
+                    ),
+                    ("retry-after".to_string(), "1".to_string()),
+                ];
+                response::send_with_headers_sync(
+                    py,
+                    &protocol_py,
+                    503,
+                    b"Service Unavailable: Concurrency Limit Exceeded",
+                    headers,
+                )?;
+                return Ok(py.None().into_bound(py));
+            }
+        } else {
+            in_flight.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        }
+        let guard = InFlightGuard(in_flight);
+
         if let Some(obj) = try_rsgi_sync_short_circuit(py, &this.state, scope, protocol)? {
+            drop(guard);
             return Ok(obj.into_bound(py));
         }
         let state = this.state.clone();
         let scope_py: Py<PyAny> = scope.as_any().clone().unbind();
         let protocol_py: Py<PyAny> = protocol.as_any().clone().unbind();
         pyo3_async_runtimes::tokio::future_into_py(py, async move {
+            let _guard = guard;
             run_rsgi(state, scope_py, protocol_py).await
         })
     }
diff --git a/src/state.rs b/src/state.rs
index 43fe7aa..cbab8d9 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -170,6 +170,10 @@ pub struct AppState {
     /// Bitmask of allowed HTTP methods per registered path template.
     pub path_method_masks: Mutex<std::collections::HashMap<String, MethodMask>>,
     pub snapshot: Arc<FrozenState>,
+    /// Number of active in-flight requests (for concurrency limiting and metrics).
+    pub in_flight: Arc<std::sync::atomic::AtomicUsize>,
+    /// Maximum permitted concurrent in-flight requests (0 = unlimited).
+    pub max_concurrency: Arc<std::sync::atomic::AtomicUsize>,
 }
 
 impl AppState {
@@ -184,6 +188,8 @@ impl AppState {
         let request_middleware = Arc::new(Vec::new());
         let response_middleware = Arc::new(Vec::new());
         let exception_handlers = Arc::new(Vec::new());
+        let in_flight = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let max_concurrency = Arc::new(std::sync::atomic::AtomicUsize::new(0));
         let snapshot = Arc::new(FrozenState {
             routes: Arc::clone(&routes),
             websocket_routes: Arc::clone(&websocket_routes),
@@ -218,6 +224,8 @@ impl AppState {
             db_pool: None,
             path_method_masks: Mutex::new(std::collections::HashMap::new()),
             snapshot,
+            in_flight,
+            max_concurrency,
         }
     }
 
@@ -248,7 +256,7 @@ impl AppState {
     pub fn snapshot_routers(&self) -> CompiledRouters {
         let mut all_paths = Router::new();
         for (path, mask) in self.path_method_masks.lock().iter() {
-            let _ = all_paths.insert(path, *mask);
+            all_paths.insert(path, *mask).expect("snapshot all_paths");
         }
         CompiledRouters {
             get: self.get.lock().clone(),
diff --git a/tests/test_resilience.py b/tests/test_resilience.py
new file mode 100644
index 0000000..6837118
--- /dev/null
+++ b/tests/test_resilience.py
@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+import asyncio
+
+from oxyroute import AdaptiveConcurrencyLimiter, App, Response
+
+
+class _MockProtocol:
+    def __init__(self) -> None:
+        self.status = 200
+        self.headers: list[tuple[str, str]] = []
+        self.body: bytes | str | None = None
+
+    def response_str(self, status: int, headers: list[tuple[str, str]], body: str) -> None:
+        self.status = status
+        self.headers = headers
+        self.body = body
+
+    def response_bytes(self, status: int, headers: list[tuple[str, str]], body: bytes) -> None:
+        self.status = status
+        self.headers = headers
+        self.body = body
+
+    def response_empty(self, status: int, headers: list[tuple[str, str]]) -> None:
+        self.status = status
+        self.headers = headers
+
+
+class _MockScope:
+    def __init__(self, method: str, path: str) -> None:
+        self.proto = "http"
+        self.http_version = "1.1"
+        self.rsgi_version = "1.0"
+        self.scheme = "http"
+        self.method = method
+        self.path = path
+        self.query_string = ""
+        self.headers = {}
+        self.authority = "localhost"
+        self.client = "127.0.0.1:54321"
+
+
+def test_concurrency_get_set() -> None:
+    app = App(max_concurrency=50)
+    assert app.get_max_concurrency() == 50
+    assert app.get_in_flight() == 0
+
+    app.set_max_concurrency(100)
+    assert app.get_max_concurrency() == 100
+
+    app.set_max_concurrency(0)
+    assert app.get_max_concurrency() == 0
+
+
+def test_concurrency_load_shedding_503() -> None:
+    app = App(max_concurrency=1)
+
+    event_in_handler = asyncio.Event()
+    event_release = asyncio.Event()
+
+    @app.get("/slow")
+    async def slow_handler() -> Response:
+        event_in_handler.set()
+        await event_release.wait()
+        return Response(body="ok", status=200)
+
+    async def run_scenario() -> None:
+        proto1 = _MockProtocol()
+        scope1 = _MockScope("GET", "/slow")
+
+        proto2 = _MockProtocol()
+        scope2 = _MockScope("GET", "/slow")
+
+        task1 = asyncio.create_task(app.__rsgi__(scope1, proto1))
+
+        await event_in_handler.wait()
+        assert app.get_in_flight() == 1
+
+        # Second request should immediately receive 503 shedding
+        await app.__rsgi__(scope2, proto2)
+        assert proto2.status == 503
+        headers_dict = dict(proto2.headers)
+        assert headers_dict.get("retry-after") == "1"
+
+        # Release first request
+        event_release.set()
+        await task1
+        assert proto1.status == 200
+        assert app.get_in_flight() == 0
+
+        # Subsequent request succeeds after in_flight drops
+        proto3 = _MockProtocol()
+        scope3 = _MockScope("GET", "/slow")
+        event_release.set()
+        await app.__rsgi__(scope3, proto3)
+        assert proto3.status == 200
+
+    asyncio.run(run_scenario())
+
+
+def test_adaptive_concurrency_limiter() -> None:
+    app = App()
+    limiter = AdaptiveConcurrencyLimiter(
+        app,
+        min_limit=5,
+        max_limit=100,
+        initial_limit=20,
+        smoothing=0.5,
+    )
+
+    assert app.get_max_concurrency() == 20
+
+    # Low latency (10ms) establishes min_rtt
+    limiter.on_request_completed(0.010)
+    limiter.on_request_completed(0.010)
+    assert app.get_max_concurrency() >= 20
+
+    # Elevated latency (100ms) causes concurrency limit to decrease
+    limiter.on_request_completed(0.100)
+    limiter.on_request_completed(0.100)
+    limiter.on_request_completed(0.100)
+    assert app.get_max_concurrency() < 20
+
+    # Recovery back to 10ms
+    for _ in range(10):
+        limiter.on_request_completed(0.010)
+
+    assert app.get_max_concurrency() >= 5

From a7926157b95b4b83217633cdff54c760e04b8b29 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:42:50 +0300
Subject: [PATCH 39/53] docs(security): document DBQuery parameter binding and
 injection prevention guarantees (#186)

---
 docs/database.md       | 80 ++++++++++++++++++++++++++++++++++++++++++
 oxyroute/_oxyroute.pyi |  8 +++++
 src/db.rs              | 25 ++++++++++++-
 tests/test_db_query.py | 20 +++++++++++
 4 files changed, 132 insertions(+), 1 deletion(-)
 create mode 100644 docs/database.md

diff --git a/docs/database.md b/docs/database.md
new file mode 100644
index 0000000..d26309c
--- /dev/null
+++ b/docs/database.md
@@ -0,0 +1,80 @@
+# Database Integration & DBQuery Security
+
+OxyRoute integrates native database query execution via `sqlx` in Rust, avoiding Python-level ORM overhead on hot data paths while preserving strict SQL injection prevention guarantees.
+
+---
+
+## Native DBQuery & Parameter Binding
+
+When executing queries through `DBQuery`, all arguments must be bound using positional placeholders (`$1`, `$2`, `$3`, ...).
+
+### Safe Parameter Binding (Recommended)
+
+Always pass arguments as a tuple or list in `DBQuery(query, args)`:
+
+```python
+from oxyroute import App, DBQuery, Depends
+
+app = App()
+
+def get_user_query(email: str) -> DBQuery:
+    # SAFE: $1 is parameterized and bound by sqlx at the driver level
+    return DBQuery(
+        "SELECT id, username, email FROM users WHERE email = $1 AND is_active = $2",
+        (email, True),
+    )
+
+@app.get("/users/by-email", dependencies=[("user_data", Depends(get_user_query))])
+def get_user(user_data):
+    return {"user": user_data}
+```
+
+---
+
+## SQL Injection Prevention (Important)
+
+> [!CAUTION]
+> **NEVER** use Python f-strings, `%` formatting, or string concatenation (`+`) to insert user input into SQL queries. Doing so bypasses parameterization and introduces severe SQL injection vulnerabilities.
+
+### Vulnerable Examples (DO NOT DO THIS)
+
+```python
+# ❌ VULNERABLE TO SQL INJECTION:
+email = "admin' OR 1=1; --"
+query = DBQuery(f"SELECT * FROM users WHERE email = '{email}'")
+
+# ❌ ALSO VULNERABLE:
+query = DBQuery("SELECT * FROM users WHERE email = '" + email + "'")
+```
+
+### Supported Parameter Types
+
+The native Rust executor automatically maps and type-checks the following Python types into Postgres wire formats:
+
+| Python Type | Postgres Type |
+|---|---|
+| `None` | `NULL` |
+| `bool` | `BOOL` |
+| `int` | `INT2`, `INT4`, `INT8` (auto-selected) |
+| `float` | `FLOAT4`, `FLOAT8` |
+| `str` | `TEXT`, `VARCHAR`, `CHAR` |
+| `dict` / `list` | `JSON`, `JSONB` |
+
+---
+
+## Database Connection Pool Lifecycle
+
+Configure the Postgres pool in `on_startup` or via `app.setup_database`:
+
+```python
+@app.on_startup
+async def startup():
+    await app.setup_database(
+        "postgresql://user:password@localhost:5432/dbname",
+        max_connections=20,
+    )
+
+@app.on_shutdown
+async def shutdown():
+    await app.close_database()
+```
diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index 69a325b..c2f89db 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -75,6 +75,14 @@ class WebSocket:
     async def close(self, code: int | None = None) -> None: ...
 
 class DBQuery:
+    """
+    Parameterized database query executed natively in Rust via sqlx.
+
+    SECURITY NOTE:
+        Always use positional parameter placeholders (`$1`, `$2`, ...) and supply values
+        via `args`. Never use Python f-strings or string concatenation for query building.
+    """
+
     query: str
     args: tuple[Any, ...]
     def __init__(self, query: str, args: tuple[Any, ...] | list[Any] | None = None) -> None: ...
diff --git a/src/db.rs b/src/db.rs
index 5838599..1327709 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -2,15 +2,38 @@ use pyo3::prelude::*;
 use pyo3::types::{PyBool, PyDict, PyFloat, PyInt, PyList, PyString, PyTuple};
 use sqlx::Row;
 
+/// Represents a parameterized database query executed natively by sqlx in Rust.
+///
+/// **SECURITY NOTE**: Always use positional parameter placeholders (`$1`, `$2`, ...)
+/// and pass parameters in `args`. **NEVER** use Python f-strings or string concatenation
+/// to construct SQL queries, as this introduces SQL injection vulnerabilities.
+///
+/// ### Positive Example (Safe):
+/// ```python
+/// query = DBQuery("SELECT id, name FROM users WHERE email = $1 AND active = $2", (email, True))
+/// ```
+///
+/// ### Negative Example (VULNERABLE - DO NOT USE):
+/// ```python
+/// # UNSAFE: vulnerable to SQL injection
+/// query = DBQuery(f"SELECT id, name FROM users WHERE email = '{email}'")
+/// ```
 #[pyclass(module = "oxyroute._oxyroute")]
 #[derive(Clone)]
 pub struct DBQuery {
+    #[pyo3(get)]
     pub query: String,
+    #[pyo3(get)]
     pub args: PyObject,
 }
 
 #[pymethods]
 impl DBQuery {
+    /// Construct a new parameterized database query.
+    ///
+    /// Parameters:
+    /// - `query`: Parameterized SQL string using `$1`, `$2`, ... positional placeholders.
+    /// - `args`: Tuple or list of argument values to bind safely.
     #[new]
     #[pyo3(signature = (query, args=None))]
     fn new(py: Python<'_>, query: String, args: Option<Py<PyAny>>) -> PyResult<Self> {
@@ -21,7 +44,7 @@ impl DBQuery {
                 PyTuple::new(py, lst.iter())?.unbind().into()
             } else {
                 return Err(pyo3::exceptions::PyTypeError::new_err(
-                    "args must be a list or tuple",
+                    "args must be a list or tuple of query parameters",
                 ));
             }
         } else {
diff --git a/tests/test_db_query.py b/tests/test_db_query.py
index e402eb3..ad7d932 100644
--- a/tests/test_db_query.py
+++ b/tests/test_db_query.py
@@ -4,6 +4,26 @@
 from oxyroute.testing import asgi_test_app
 
 
+def test_db_query_constructor_and_attributes():
+    # Safe positional parameter binding via tuple
+    q1 = DBQuery("SELECT id, name FROM users WHERE id = $1", (42,))
+    assert q1.query == "SELECT id, name FROM users WHERE id = $1"
+    assert q1.args == (42,)
+
+    # Safe positional parameter binding via list
+    q2 = DBQuery("SELECT * FROM items WHERE price > $1 AND active = $2", [19.99, True])
+    assert q2.query == "SELECT * FROM items WHERE price > $1 AND active = $2"
+    assert q2.args == (19.99, True)
+
+    # Empty args default
+    q3 = DBQuery("SELECT 1")
+    assert q3.args == ()
+
+    # Type error on invalid args
+    with pytest.raises(TypeError, match="args must be a list or tuple"):
+        DBQuery("SELECT 1", 123)  # type: ignore
+
+
 @pytest.mark.anyio
 async def test_db_query_dependency_no_pool():
     app = App()

From 31e593dbcf913d358323ad7090d6204199fa1e74 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:45:16 +0300
Subject: [PATCH 40/53] feat(websocket): serialize concurrent send operations
 to prevent frame interleaving (#187)

---
 src/websocket.rs               | 95 ++++++++++++++++++++++------------
 tests/test_websocket_native.py | 23 ++++++++
 2 files changed, 85 insertions(+), 33 deletions(-)

diff --git a/src/websocket.rs b/src/websocket.rs
index 597fda4..c0e490c 100644
--- a/src/websocket.rs
+++ b/src/websocket.rs
@@ -31,6 +31,7 @@ pub struct WebSocket {
     transport: Arc<Mutex<Option<Py<PyAny>>>>,
     path_params: Vec<(String, String)>,
     closed: Arc<Mutex<bool>>,
+    write_lock: Arc<tokio::sync::Mutex<()>>,
 }
 
 impl WebSocket {
@@ -41,6 +42,7 @@ impl WebSocket {
             transport: Arc::new(Mutex::new(None)),
             path_params,
             closed: Arc::new(Mutex::new(false)),
+            write_lock: Arc::new(tokio::sync::Mutex::new(())),
         }
     }
 
@@ -176,48 +178,75 @@ impl WebSocket {
         })
     }
 
-    /// Send a text frame. Returns when Granian has flushed the message.
+    /// Send a text frame. Concurrent send calls are serialized to prevent frame interleaving.
     fn send_text<'py>(&self, py: Python<'py>, data: String) -> PyResult<Bound<'py, PyAny>> {
-        let transport = self.transport_clone(py)?;
-        let coro = transport
-            .bind(py)
-            .call_method1("send_str", PyTuple::new(py, [data])?)?;
-        pyo3_async_runtimes::tokio::into_future(coro).and_then(|fut| {
-            pyo3_async_runtimes::tokio::future_into_py(py, async move {
-                fut.await?;
-                Python::with_gil(|py| Ok(py.None()))
-            })
+        let transport_slot = self.transport.clone();
+        let write_lock = self.write_lock.clone();
+        pyo3_async_runtimes::tokio::future_into_py(py, async move {
+            let _guard = write_lock.lock().await;
+            let fut = Python::with_gil(|py| -> PyResult<_> {
+                let g = transport_slot.lock();
+                let transport = g.as_ref().ok_or_else(|| {
+                    pyo3::exceptions::PyRuntimeError::new_err(
+                        "WebSocket: call accept() before send/receive",
+                    )
+                })?;
+                let coro = transport
+                    .bind(py)
+                    .call_method1("send_str", PyTuple::new(py, [data])?)?;
+                pyo3_async_runtimes::tokio::into_future(coro)
+            })?;
+            fut.await?;
+            Python::with_gil(|py| Ok(py.None()))
         })
     }
 
-    /// Send a binary frame. Returns when Granian has flushed the message.
+    /// Send a binary frame. Concurrent send calls are serialized to prevent frame interleaving.
     fn send_bytes<'py>(&self, py: Python<'py>, data: Vec<u8>) -> PyResult<Bound<'py, PyAny>> {
-        let transport = self.transport_clone(py)?;
-        let pb = PyBytes::new(py, &data);
-        let coro = transport
-            .bind(py)
-            .call_method1("send_bytes", PyTuple::new(py, [pb])?)?;
-        pyo3_async_runtimes::tokio::into_future(coro).and_then(|fut| {
-            pyo3_async_runtimes::tokio::future_into_py(py, async move {
-                fut.await?;
-                Python::with_gil(|py| Ok(py.None()))
-            })
+        let transport_slot = self.transport.clone();
+        let write_lock = self.write_lock.clone();
+        pyo3_async_runtimes::tokio::future_into_py(py, async move {
+            let _guard = write_lock.lock().await;
+            let fut = Python::with_gil(|py| -> PyResult<_> {
+                let g = transport_slot.lock();
+                let transport = g.as_ref().ok_or_else(|| {
+                    pyo3::exceptions::PyRuntimeError::new_err(
+                        "WebSocket: call accept() before send/receive",
+                    )
+                })?;
+                let pb = PyBytes::new(py, &data);
+                let coro = transport
+                    .bind(py)
+                    .call_method1("send_bytes", PyTuple::new(py, [pb])?)?;
+                pyo3_async_runtimes::tokio::into_future(coro)
+            })?;
+            fut.await?;
+            Python::with_gil(|py| Ok(py.None()))
         })
     }
 
-    /// Send a JSON-serialised object as a text frame (uses :func:`json.dumps`).
+    /// Send a JSON-serialised object as a text frame. Concurrent send calls are serialized.
     fn send_json<'py>(&self, py: Python<'py>, data: Py<PyAny>) -> PyResult<Bound<'py, PyAny>> {
-        let transport = self.transport_clone(py)?;
-        let json_mod = py.import("json")?;
-        let dumped = json_mod.call_method1("dumps", (data.bind(py),))?;
-        let coro = transport
-            .bind(py)
-            .call_method1("send_str", PyTuple::new(py, [dumped])?)?;
-        pyo3_async_runtimes::tokio::into_future(coro).and_then(|fut| {
-            pyo3_async_runtimes::tokio::future_into_py(py, async move {
-                fut.await?;
-                Python::with_gil(|py| Ok(py.None()))
-            })
+        let transport_slot = self.transport.clone();
+        let write_lock = self.write_lock.clone();
+        pyo3_async_runtimes::tokio::future_into_py(py, async move {
+            let _guard = write_lock.lock().await;
+            let fut = Python::with_gil(|py| -> PyResult<_> {
+                let g = transport_slot.lock();
+                let transport = g.as_ref().ok_or_else(|| {
+                    pyo3::exceptions::PyRuntimeError::new_err(
+                        "WebSocket: call accept() before send/receive",
+                    )
+                })?;
+                let json_mod = py.import("json")?;
+                let dumped = json_mod.call_method1("dumps", (data.bind(py),))?;
+                let coro = transport
+                    .bind(py)
+                    .call_method1("send_str", PyTuple::new(py, [dumped])?)?;
+                pyo3_async_runtimes::tokio::into_future(coro)
+            })?;
+            fut.await?;
+            Python::with_gil(|py| Ok(py.None()))
         })
     }
 
diff --git a/tests/test_websocket_native.py b/tests/test_websocket_native.py
index 9b9396a..0bc8491 100644
--- a/tests/test_websocket_native.py
+++ b/tests/test_websocket_native.py
@@ -230,3 +230,26 @@ def test_websocket_frozen_app_rejects_route() -> None:
 
         @app.websocket("/late")
         async def late(ws: WebSocket) -> None: ...
+
+
+def test_concurrent_send_serialization() -> None:
+    app = App()
+
+    @app.websocket("/ws/concurrent")
+    async def ws_concurrent(ws: WebSocket) -> None:
+        await ws.accept()
+        # Launch 30 concurrent sends of text, bytes, and json via asyncio.gather
+        tasks = [
+            ws.send_text(f"text-{i}") if i % 3 == 0 else (
+                ws.send_bytes(f"bytes-{i}".encode()) if i % 3 == 1 else ws.send_json({"num": i})
+            )
+            for i in range(30)
+        ]
+        await asyncio.gather(*tasks)
+        await ws.close(1000)
+
+    proto = _MockProtocol()
+    _drive(app, _WSScope(path="/ws/concurrent"), proto)
+
+    assert proto.transport is not None
+    assert len(proto.transport.sent) == 30

From f7d6865d2c5cc71677d5a88b6a1cc8f2b6d68ba8 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:48:32 +0300
Subject: [PATCH 41/53] feat(websocket): notify active WebSocket connections
 with 1001 Going Away during graceful shutdown (#188)

---
 oxyroute/_oxyroute.pyi         |  1 +
 oxyroute/app.py                |  7 ++++++-
 src/dispatch.rs                | 30 ++++++++++++++++++++++++++++++
 src/lib.rs                     | 12 ++++++++++++
 src/state.rs                   |  5 +++++
 tests/test_websocket_native.py | 29 +++++++++++++++++++++++++++++
 6 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index c2f89db..9317cba 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -8,6 +8,7 @@ class App:
     def set_max_concurrency(self, limit: int) -> None: ...
     def get_max_concurrency(self) -> int: ...
     def get_in_flight(self) -> int: ...
+    def shutdown_websockets(self, code: int = 1001) -> None: ...
     def add_route(
         self,
         method: str,
diff --git a/oxyroute/app.py b/oxyroute/app.py
index c7281a6..b8c4ddc 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -215,6 +215,10 @@ def get_in_flight(self) -> int:
         """Get the current number of in-flight requests."""
         return self._app.get_in_flight()
 
+    def shutdown_websockets(self, code: int = 1001) -> None:
+        """Notify and close all active WebSocket connections with a close status code (default: 1001 Going Away)."""
+        self._app.shutdown_websockets(code)
+
     def freeze(self) -> None:
         """After ``freeze()``, no more route registration (matches Rust app state)."""
         self._app.freeze()
@@ -742,7 +746,8 @@ async def on_startup(self) -> None:
         return None
 
     async def on_shutdown(self) -> None:
-        """Per-worker async teardown. Closes the global connection pool if it exists."""
+        """Per-worker async teardown. Closes active WebSockets with 1001 Going Away and closes DB pool."""
+        self.shutdown_websockets(1001)
         await self.close_database()
 
     def __rsgi_init__(self, loop: Any | None = None, *args: Any, **kwargs: Any) -> Any:
diff --git a/src/dispatch.rs b/src/dispatch.rs
index 382de4f..eda17d3 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -1784,6 +1784,36 @@ async fn run_rsgi_websocket(
         .iter()
         .map(|(k, v)| (k.to_string(), v.to_string()))
         .collect();
+
+    let ws_id = {
+        let st = state.read();
+        let id = st
+            .next_ws_id
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        Python::with_gil(|py| {
+            st.active_websockets
+                .lock()
+                .insert(id, protocol.clone_ref(py));
+        });
+        id
+    };
+
+    struct ActiveWsGuard {
+        state: Arc<RwLock<AppState>>,
+        id: usize,
+    }
+
+    impl Drop for ActiveWsGuard {
+        fn drop(&mut self) {
+            self.state.read().active_websockets.lock().remove(&self.id);
+        }
+    }
+
+    let _ws_guard = ActiveWsGuard {
+        state: Arc::clone(&state),
+        id: ws_id,
+    };
+
     let call_result = Python::with_gil(|py| -> PyResult<(PyObject, bool)> {
         let ws = WebSocket::new(protocol.clone_ref(py), scope.clone_ref(py), path_params);
         let py_ws = Py::new(py, ws)?;
diff --git a/src/lib.rs b/src/lib.rs
index b49e4db..5eda38d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -323,6 +323,18 @@ impl App {
         Ok(st.in_flight.load(std::sync::atomic::Ordering::Relaxed))
     }
 
+    /// Notify all active WebSocket connections with a close status code (default: 1001 Going Away).
+    #[pyo3(signature = (code=1001))]
+    fn shutdown_websockets(&self, py: Python<'_>, code: i32) -> PyResult<()> {
+        let st = self.state.read();
+        let mut map = st.active_websockets.lock();
+        for (_id, proto) in map.drain() {
+            let p = proto.bind(py);
+            let _ = p.call_method1("close", (code,));
+        }
+        Ok(())
+    }
+
     /// Paths use **matchit 0.7** style: `/user/:id`. Pass `dependencies=[("x", get_x), ...]`.
     #[pyo3(
         signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None, extra_params_json=None)
diff --git a/src/state.rs b/src/state.rs
index cbab8d9..0bca083 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -174,6 +174,9 @@ pub struct AppState {
     pub in_flight: Arc<std::sync::atomic::AtomicUsize>,
     /// Maximum permitted concurrent in-flight requests (0 = unlimited).
     pub max_concurrency: Arc<std::sync::atomic::AtomicUsize>,
+    /// Registry of active WebSocket protocols for graceful shutdown notification (1001 Going Away).
+    pub active_websockets: Mutex<std::collections::HashMap<usize, Py<PyAny>>>,
+    pub next_ws_id: std::sync::atomic::AtomicUsize,
 }
 
 impl AppState {
@@ -226,6 +229,8 @@ impl AppState {
             snapshot,
             in_flight,
             max_concurrency,
+            active_websockets: Mutex::new(std::collections::HashMap::new()),
+            next_ws_id: std::sync::atomic::AtomicUsize::new(1),
         }
     }
 
diff --git a/tests/test_websocket_native.py b/tests/test_websocket_native.py
index 0bc8491..1dda168 100644
--- a/tests/test_websocket_native.py
+++ b/tests/test_websocket_native.py
@@ -253,3 +253,32 @@ async def ws_concurrent(ws: WebSocket) -> None:
 
     assert proto.transport is not None
     assert len(proto.transport.sent) == 30
+
+
+def test_websocket_graceful_shutdown_1001() -> None:
+    app = App()
+    event_connected = asyncio.Event()
+    event_shutdown = asyncio.Event()
+
+    @app.websocket("/ws/live")
+    async def ws_live(ws: WebSocket) -> None:
+        await ws.accept()
+        event_connected.set()
+        await event_shutdown.wait()
+
+    async def _test():
+        proto = _MockProtocol()
+        scope = _WSScope(path="/ws/live")
+
+        task = asyncio.create_task(app.__rsgi__(scope, proto))
+        await event_connected.wait()
+
+        # Trigger app shutdown (which notifies active websockets with 1001)
+        await app.on_shutdown()
+        assert proto.closed_with == 1001
+
+        event_shutdown.set()
+        await task
+
+    asyncio.run(_test())
+

From 4b0d6446f5cd53130c131cce7086a1418ce8ed4f Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 09:31:08 +0300
Subject: [PATCH 42/53] feat(di): DAG dependency resolution with cycle
 detection at route registration (#189)

* feat(di): DAG dependency resolution with cycle detection at route registration (#141)

* perf(bench): add DI/DX overhead comparison benchmark
---
 docs/dependencies.md          |   4 +-
 perf-test/README.md           |  35 +++++++
 perf-test/app_di_compare.py   | 104 ++++++++++++++++++++
 perf-test/bench_di_compare.py | 170 +++++++++++++++++++++++++++++++++
 perf-test/bench_di_compare.sh | 175 ++++++++++++++++++++++++++++++++++
 src/dependency.rs             | 170 +++++++++++++++++++++++++++++++++
 src/lib.rs                    |  17 +++-
 tests/test_dep_chain.py       |  41 ++++++++
 8 files changed, 714 insertions(+), 2 deletions(-)
 create mode 100644 perf-test/app_di_compare.py
 create mode 100755 perf-test/bench_di_compare.py
 create mode 100755 perf-test/bench_di_compare.sh
 create mode 100644 src/dependency.rs

diff --git a/docs/dependencies.md b/docs/dependencies.md
index 5ce8f2a..df22c7c 100644
--- a/docs/dependencies.md
+++ b/docs/dependencies.md
@@ -2,7 +2,9 @@
 
 [← Documentation index](index.md)
 
-OxyRoute supports a **linear** list of **named** dependency factories. At request time, each factory is called in order; its return value is injected into the route handler as a **keyword argument** with the given name. Factories that appear **later** in the list are called with **keyword arguments** for every **earlier** name and value (so a factory can depend on a previous one by using the same parameter name, e.g. `def b(a: int): …` when the first tuple is `("a", make_a)`).
+OxyRoute resolves route dependencies as a **directed acyclic graph (DAG)**. At route registration time, OxyRoute builds a dependency graph from the factories' parameter names and performs **topological sorting** (Kahn's algorithm). This guarantees that prerequisites are always evaluated before dependents, regardless of the declaration order in the `dependencies` list. Any **circular dependencies** are detected and rejected at registration time with a descriptive `ValueError`.
+
+At request time, each factory is called in topological order; its return value is injected into dependent factories and the route handler as a **keyword argument**. Factories only receive their declared keyword arguments, avoiding unnecessary parameter passing overhead.
 
 ### Request context (optional)
 
diff --git a/perf-test/README.md b/perf-test/README.md
index 1e8e805..fa71285 100644
--- a/perf-test/README.md
+++ b/perf-test/README.md
@@ -98,6 +98,41 @@ Skipped unless `OXYROUTE_BENCH=1` (not for default CI).
 
 Older multi-rep harness — see script header. Default profile uses higher connection counts than the hello script.
 
+## DI/DX overhead comparison (`bench_di_compare.sh`)
+
+Measures the per-request cost of dependency injection at various depths.
+All routes are served from `app_di_compare.py` via a single Granian RSGI worker.
+
+| Scenario   | Route        | Description                              |
+|------------|--------------|------------------------------------------|
+| `nodep`    | `GET /nodep`    | No deps — pure baseline                 |
+| `dep1`     | `GET /dep1`     | One sync `Depends` factory              |
+| `dep3`     | `GET /dep3`     | Three independent sync `Depends`        |
+| `depchain` | `GET /depchain` | Chain of 3 sync `Depends` (a→b→c)      |
+| `depasync` | `GET /depasync` | One async `Depends` factory             |
+| `dep1json` | `POST /dep1json`| One sync `Depends` + JSON body read     |
+
+```bash
+./perf-test/bench_di_compare.sh
+```
+
+Output includes `req/s`, ratio vs `nodep` baseline, and overhead percentage.
+Same `OXYROUTE_BENCH_*` env knobs as the other bench scripts.
+
+**Usage for perf PRs** (before/after DI/DX changes):
+
+```bash
+# On dev branch
+git checkout dev
+./perf-test/bench_di_compare.sh | tee /tmp/before.txt
+
+# On your branch
+git checkout my-di-branch
+./perf-test/bench_di_compare.sh | tee /tmp/after.txt
+
+diff /tmp/before.txt /tmp/after.txt
+```
+
 ## Baseline checklist (perf PRs)
 
 1. `git checkout dev && cargo bench --bench hot_path` (save summary)
diff --git a/perf-test/app_di_compare.py b/perf-test/app_di_compare.py
new file mode 100644
index 0000000..f8a5777
--- /dev/null
+++ b/perf-test/app_di_compare.py
@@ -0,0 +1,104 @@
+"""DI/DX performance comparison app for ``bench_di_compare.sh``.
+
+Routes
+------
+GET /nodep          – no Depends at all (baseline)
+GET /dep1           – one sync Depends factory
+GET /dep3           – three independent sync Depends factories
+GET /depchain       – chain: c depends on b depends on a (depth 3)
+GET /depasync       – one async Depends factory
+GET /dep1json       – one sync Depends + read JSON body
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+from oxyroute import App, Depends
+
+app = App(include_openapi=False)
+
+
+# ---------- plain baseline ----------
+
+@app.get("/nodep")
+def nodep() -> str:
+    return "ok"
+
+
+# ---------- single sync dep ----------
+
+def _make_int() -> int:
+    return 7
+
+
+@app.get("/dep1", dependencies=[("n", Depends(_make_int))])
+def dep1(n: int) -> str:
+    return f"n={n}"
+
+
+# ---------- three independent sync deps ----------
+
+def _a() -> int:
+    return 1
+
+
+def _b() -> int:
+    return 2
+
+
+def _c() -> int:
+    return 3
+
+
+@app.get(
+    "/dep3",
+    dependencies=[("a", Depends(_a)), ("b", Depends(_b)), ("c", Depends(_c))],
+)
+def dep3(a: int, b: int, c: int) -> str:
+    return f"{a+b+c}"
+
+
+# ---------- chained sync deps (depth 3) ----------
+
+def _base() -> int:
+    return 10
+
+
+def _mid(base: int) -> int:
+    return base * 2
+
+
+def _top(mid: int) -> int:
+    return mid + 1
+
+
+@app.get(
+    "/depchain",
+    dependencies=[
+        ("base", Depends(_base)),
+        ("mid", Depends(_mid)),
+        ("top", Depends(_top)),
+    ],
+)
+def depchain(top: int) -> str:
+    return f"{top}"
+
+
+# ---------- async dep ----------
+
+async def _async_val() -> str:
+    await asyncio.sleep(0)
+    return "async"
+
+
+@app.get("/depasync", dependencies=[("v", Depends(_async_val))])
+async def dep_async(v: str) -> str:
+    return v
+
+
+# ---------- dep + JSON body ----------
+
+@app.post("/dep1json", dependencies=[("n", Depends(_make_int))], read_json_body=True)
+def dep1json(n: int, json: dict) -> dict:
+    return {"n": n, "keys": list(json.keys())}
diff --git a/perf-test/bench_di_compare.py b/perf-test/bench_di_compare.py
new file mode 100755
index 0000000..439118b
--- /dev/null
+++ b/perf-test/bench_di_compare.py
@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""
+DI/DX performance comparison benchmark.
+
+Starts app_di_compare via Granian (subprocess), then hammers each route
+with concurrent httpx requests and reports req/s + overhead vs baseline.
+
+Usage:
+    python perf-test/bench_di_compare.py [--duration 5] [--concurrency 32] [--workers 1]
+
+Requirements: granian, httpx (already in .venv)
+"""
+from __future__ import annotations
+
+import argparse
+import asyncio
+import importlib.util
+import socket
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).parent.parent
+VENV_PY = ROOT / ".venv" / "bin" / "python"
+PYTHON = str(VENV_PY) if VENV_PY.exists() else sys.executable
+
+
+def free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+async def wait_http(port: int, path: str = "/nodep", timeout: float = 30.0) -> None:
+    import httpx
+
+    deadline = time.monotonic() + timeout
+    async with httpx.AsyncClient() as client:
+        while time.monotonic() < deadline:
+            try:
+                r = await client.get(f"http://127.0.0.1:{port}{path}", timeout=1.0)
+                if r.status_code < 500:
+                    return
+            except Exception:
+                pass
+            await asyncio.sleep(0.05)
+    raise RuntimeError(f"server on port {port} did not become ready in {timeout}s")
+
+
+async def bench_route(
+    port: int,
+    path: str,
+    method: str = "GET",
+    body: bytes | None = None,
+    headers: dict | None = None,
+    duration: float = 5.0,
+    concurrency: int = 32,
+) -> float:
+    """Return requests/second."""
+    import httpx
+
+    url = f"http://127.0.0.1:{port}{path}"
+    hdrs = dict(headers or {})
+    count = 0
+    stop = False
+
+    async def worker() -> None:
+        nonlocal count
+        async with httpx.AsyncClient(http2=False) as client:
+            while not stop:
+                try:
+                    if method == "POST":
+                        await client.post(url, content=body, headers=hdrs, timeout=5.0)
+                    else:
+                        await client.get(url, headers=hdrs, timeout=5.0)
+                    count += 1
+                except Exception:
+                    pass
+
+    tasks = [asyncio.create_task(worker()) for _ in range(concurrency)]
+    start = time.monotonic()
+    await asyncio.sleep(duration)
+    stop = True  # type: ignore[assignment]
+    for t in tasks:
+        t.cancel()
+    await asyncio.gather(*tasks, return_exceptions=True)
+    elapsed = time.monotonic() - start
+    return count / elapsed
+
+
+SCENARIOS: list[tuple[str, str, str, bytes | None, dict | None]] = [
+    # (label, method, path, body, headers)
+    ("nodep",    "GET",  "/nodep",    None, None),
+    ("dep1",     "GET",  "/dep1",     None, None),
+    ("dep3",     "GET",  "/dep3",     None, None),
+    ("depchain", "GET",  "/depchain", None, None),
+    ("depasync", "GET",  "/depasync", None, None),
+    ("dep1json", "POST", "/dep1json", b'{"x":1,"y":"hello"}',
+     {"Content-Type": "application/json"}),
+]
+
+
+def print_table(results: dict[str, float]) -> None:
+    baseline = results.get("nodep", 0.0)
+    print(f"\n{'scenario':<14} {'req/s':>10} {'vs baseline':>12} {'overhead':>10}")
+    print("-" * 52)
+    for label, _, _, _, _ in SCENARIOS:
+        rps = results.get(label, 0.0)
+        if baseline > 0 and rps > 0:
+            ratio = rps / baseline
+            pct = (ratio - 1.0) * 100.0
+            print(f"{label:<14} {rps:>10.0f} {ratio:>11.3f}x {pct:>+9.1f}%")
+        else:
+            print(f"{label:<14} {'n/a':>10} {'n/a':>12} {'n/a':>10}")
+    print()
+
+
+async def main(duration: float, concurrency: int, workers: int) -> None:
+    import httpx  # noqa: F401 – just ensure it's present
+
+    port = free_port()
+    env_path = str(ROOT)
+    cmd = [
+        PYTHON, "-m", "granian", "app_di_compare:app",
+        "--host", "127.0.0.1",
+        "--port", str(port),
+        "--interface", "rsgi",
+        "--workers", str(workers),
+    ]
+    print(f"bench_di_compare: OxyRoute DI/DX overhead (RSGI via Granian)")
+    print(f"  duration={duration}s  concurrency={concurrency}  workers={workers}")
+    print()
+
+    proc = subprocess.Popen(
+        cmd,
+        cwd=str(ROOT / "perf-test"),
+        env={**__import__("os").environ, "PYTHONPATH": env_path},
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    try:
+        await wait_http(port)
+        results: dict[str, float] = {}
+        total = len(SCENARIOS)
+        for idx, (label, method, path, body, headers) in enumerate(SCENARIOS, 1):
+            desc = f"{method} {path}"
+            print(f"  [{idx}/{total}] {label:<12} {desc}")
+            rps = await bench_route(
+                port, path,
+                method=method, body=body, headers=headers,
+                duration=duration, concurrency=concurrency,
+            )
+            results[label] = rps
+        print_table(results)
+    finally:
+        proc.terminate()
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="DI/DX overhead benchmark")
+    parser.add_argument("--duration",    type=float, default=5.0,  help="seconds per route")
+    parser.add_argument("--concurrency", type=int,   default=32,   help="concurrent requests")
+    parser.add_argument("--workers",     type=int,   default=1,    help="Granian worker count")
+    args = parser.parse_args()
+    asyncio.run(main(args.duration, args.concurrency, args.workers))
diff --git a/perf-test/bench_di_compare.sh b/perf-test/bench_di_compare.sh
new file mode 100755
index 0000000..9e73b05
--- /dev/null
+++ b/perf-test/bench_di_compare.sh
@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+# bench_di_compare.sh – measure DI/DX overhead across dependency depths.
+#
+# Routes in app_di_compare.py:
+#   /nodep        baseline, zero deps
+#   /dep1         one sync Depends
+#   /dep3         three independent sync Depends
+#   /depchain     chain of 3 sync Depends (a→b→c)
+#   /depasync     one async Depends
+#   /dep1json     one sync Depends + JSON body read
+#
+# Usage:
+#   ./perf-test/bench_di_compare.sh
+#
+# Env knobs (same as other bench scripts):
+#   OXYROUTE_BENCH_DURATION     default: 5s
+#   OXYROUTE_BENCH_THREADS      default: 2
+#   OXYROUTE_BENCH_CONNECTIONS  default: 32
+#   OXYROUTE_BENCH_WORKERS      default: 1
+#
+# Requirements: granian, wrk, editable oxyroute install.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+if [[ -n "${PYTHON:-}" ]]; then
+  :
+elif [[ -x "${ROOT}/.venv/bin/python" ]]; then
+  PYTHON="${ROOT}/.venv/bin/python"
+else
+  PYTHON="python3"
+fi
+
+DURATION="${OXYROUTE_BENCH_DURATION:-5s}"
+THREADS="${OXYROUTE_BENCH_THREADS:-2}"
+CONN="${OXYROUTE_BENCH_CONNECTIONS:-32}"
+WORKERS="${OXYROUTE_BENCH_WORKERS:-1}"
+
+if ! command -v wrk >/dev/null 2>&1; then
+  echo "wrk not found – falling back to bench_di_compare.py (httpx-based)"
+  exec "${PYTHON}" "$(dirname "${BASH_SOURCE[0]}")/bench_di_compare.py" \
+    --duration "${DURATION%s}" \
+    --concurrency "${CONN}" \
+    --workers "${WORKERS}"
+fi
+
+# ── helpers ────────────────────────────────────────────────────────────────────
+
+_free_port() {
+  "${PYTHON}" -c "import socket; s=socket.socket(); s.bind(('127.0.0.1',0)); print(s.getsockname()[1]); s.close()"
+}
+
+_wait_http() {
+  local port="$1" path="${2:-/nodep}"
+  local deadline=$((SECONDS + 30))
+  while (( SECONDS < deadline )); do
+    if "${PYTHON}" -c \
+      "import urllib.request; urllib.request.urlopen('http://127.0.0.1:${port}${path}', timeout=0.5).read()" \
+      2>/dev/null; then
+      return 0
+    fi
+    sleep 0.05
+  done
+  return 1
+}
+
+_run_wrk() {
+  local url="$1"; shift
+  wrk -t"${THREADS}" -c"${CONN}" -d"${DURATION}" "$@" "${url}" 2>&1 \
+    | awk '/Requests\/sec:/{gsub(/^[ \t]+/,"",$2); print $2; exit}'
+}
+
+_start_server() {
+  local port="$1"
+  (
+    export PYTHONPATH="${ROOT}"
+    cd "${ROOT}/perf-test"
+    exec "${PYTHON}" -m granian "app_di_compare:app" \
+      --host 127.0.0.1 --port "${port}" --interface rsgi --workers "${WORKERS}"
+  ) >/dev/null 2>&1 &
+  echo $!
+}
+
+# ── single benchmark pass ───────────────────────────────────────────────────────
+
+declare -A RESULTS   # name → rps
+
+_bench_route() {
+  local label="$1" path="$2" pid="$3" port="$4"
+  shift 4
+  local rps
+  rps=$(_run_wrk "http://127.0.0.1:${port}${path}" "$@")
+  RESULTS["${label}"]="${rps}"
+}
+
+# ── JSON lua snippet ────────────────────────────────────────────────────────────
+
+_lua_json() {
+  cat >"$1" <<'LUA'
+wrk.method = "POST"
+wrk.body   = '{"x":1,"y":"hello"}'
+wrk.headers["Content-Type"] = "application/json"
+LUA
+}
+
+# ── pretty print table ─────────────────────────────────────────────────────────
+
+_print_table() {
+  local baseline="${RESULTS[nodep]:-0}"
+
+  printf '\n%-18s %12s %10s %10s\n' "scenario" "req/s" "vs baseline" "overhead%"
+  printf '%s\n' "------------------------------------------------------------"
+
+  local order=(nodep dep1 dep3 depchain depasync dep1json)
+  for key in "${order[@]}"; do
+    local rps="${RESULTS[$key]:-n/a}"
+    if [[ "${rps}" == "n/a" ]]; then
+      printf '%-18s %12s %10s %10s\n' "${key}" "n/a" "-" "-"
+      continue
+    fi
+    local ratio overhead
+    ratio=$(  "${PYTHON}" -c "b=float('${baseline}'); r=float('${rps}'); print(f'{r/b:.3f}x' if b>0 else 'n/a')")
+    overhead=$("${PYTHON}" -c "b=float('${baseline}'); r=float('${rps}'); print(f'{(r/b-1)*100:+.1f}%' if b>0 else 'n/a')")
+    printf '%-18s %12s %10s %10s\n' "${key}" "${rps}" "${ratio}" "${overhead}"
+  done
+  printf '\n'
+}
+
+# ── main ────────────────────────────────────────────────────────────────────────
+
+main() {
+  echo "bench_di_compare: OxyRoute DI/DX overhead (RSGI via Granian)"
+  echo "  duration=${DURATION} threads=${THREADS} connections=${CONN} workers=${WORKERS}"
+  echo ""
+
+  local port pid
+  port="$(_free_port)"
+  pid="$(_start_server "${port}")"
+
+  # Make sure server is up before benching any route.
+  if ! _wait_http "${port}" "/nodep"; then
+    kill "${pid}" 2>/dev/null || true
+    wait "${pid}"  2>/dev/null || true
+    echo "error: server did not become ready" >&2
+    exit 1
+  fi
+
+  local tmp
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "${tmp}"; kill "${pid}" 2>/dev/null || true; wait "${pid}" 2>/dev/null || true' EXIT
+
+  echo "  [1/6] nodep       GET /nodep"
+  _bench_route "nodep"    "/nodep"    "${pid}" "${port}"
+
+  echo "  [2/6] dep1        GET /dep1"
+  _bench_route "dep1"     "/dep1"     "${pid}" "${port}"
+
+  echo "  [3/6] dep3        GET /dep3"
+  _bench_route "dep3"     "/dep3"     "${pid}" "${port}"
+
+  echo "  [4/6] depchain    GET /depchain"
+  _bench_route "depchain" "/depchain" "${pid}" "${port}"
+
+  echo "  [5/6] depasync    GET /depasync"
+  _bench_route "depasync" "/depasync" "${pid}" "${port}"
+
+  echo "  [6/6] dep1json    POST /dep1json (JSON body)"
+  _lua_json "${tmp}/json.lua"
+  _bench_route "dep1json" "/dep1json" "${pid}" "${port}" -s "${tmp}/json.lua"
+
+  _print_table
+}
+
+main "$@"
diff --git a/src/dependency.rs b/src/dependency.rs
new file mode 100644
index 0000000..114649e
--- /dev/null
+++ b/src/dependency.rs
@@ -0,0 +1,170 @@
+use std::collections::{HashMap, HashSet};
+
+use crate::state::DependencyEntry;
+
+/// Directed acyclic graph of dependencies.
+#[derive(Debug, Clone, Default)]
+pub struct DependencyGraph {
+    /// Adjacency list: prerequisite -> set of dependents (edge: prereq -> dependent)
+    pub adj: HashMap<String, HashSet<String>>,
+    /// All registered node names
+    pub nodes: HashSet<String>,
+}
+
+impl DependencyGraph {
+    pub fn new() -> Self {
+        Self {
+            adj: HashMap::new(),
+            nodes: HashSet::new(),
+        }
+    }
+
+    pub fn ensure_node(&mut self, name: &str) {
+        self.nodes.insert(name.to_string());
+        self.adj.entry(name.to_string()).or_default();
+    }
+
+    /// Add a directed edge: `prereq` must be evaluated before `dependent`.
+    pub fn add_edge(&mut self, prereq: &str, dependent: &str) {
+        self.ensure_node(prereq);
+        self.ensure_node(dependent);
+        self.adj
+            .entry(prereq.to_string())
+            .or_default()
+            .insert(dependent.to_string());
+    }
+
+    /// Perform topological sort using Kahn's algorithm.
+    /// Returns an ordering where prerequisites appear before dependents.
+    /// Returns Err if a cycle is detected.
+    pub fn topological_sort(&self) -> Result<Vec<String>, String> {
+        let mut in_degree: HashMap<&str, usize> = HashMap::new();
+        for node in &self.nodes {
+            in_degree.insert(node.as_str(), 0);
+        }
+        for dependents in self.adj.values() {
+            for dep in dependents {
+                *in_degree.entry(dep.as_str()).or_default() += 1;
+            }
+        }
+
+        let mut queue: Vec<&str> = in_degree
+            .iter()
+            .filter_map(|(&node, &deg)| if deg == 0 { Some(node) } else { None })
+            .collect();
+        // Deterministic queue order
+        queue.sort_unstable();
+
+        let mut order = Vec::with_capacity(self.nodes.len());
+        while let Some(node) = queue.pop() {
+            order.push(node.to_string());
+            if let Some(dependents) = self.adj.get(node) {
+                let mut next_nodes = Vec::new();
+                for dep in dependents {
+                    if let Some(deg) = in_degree.get_mut(dep.as_str()) {
+                        *deg -= 1;
+                        if *deg == 0 {
+                            next_nodes.push(dep.as_str());
+                        }
+                    }
+                }
+                next_nodes.sort_unstable();
+                for n in next_nodes.into_iter().rev() {
+                    queue.push(n);
+                }
+            }
+        }
+
+        if order.len() == self.nodes.len() {
+            Ok(order)
+        } else {
+            Err("dependency cycle detected".to_string())
+        }
+    }
+}
+
+/// Build a dependency graph from route dependency entries.
+pub fn build_graph_from_entries(entries: &[DependencyEntry]) -> DependencyGraph {
+    let mut graph = DependencyGraph::new();
+    let name_set: HashSet<&str> = entries.iter().map(|e| e.name.as_str()).collect();
+
+    for entry in entries {
+        graph.ensure_node(&entry.name);
+    }
+
+    for entry in entries {
+        for param in &entry.factory_params {
+            if name_set.contains(param.as_str()) {
+                // `param` is a prerequisite of `entry.name`
+                graph.add_edge(param, &entry.name);
+            }
+        }
+    }
+
+    graph
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_independent_nodes() {
+        let mut graph = DependencyGraph::new();
+        graph.ensure_node("a");
+        graph.ensure_node("b");
+        let order = graph.topological_sort().expect("no cycle");
+        assert_eq!(order.len(), 2);
+    }
+
+    #[test]
+    fn test_linear_chain() {
+        let mut graph = DependencyGraph::new();
+        // b depends on a (a is prereq of b)
+        graph.add_edge("a", "b");
+        // c depends on b (b is prereq of c)
+        graph.add_edge("b", "c");
+
+        let order = graph.topological_sort().expect("no cycle");
+        let pos_a = order.iter().position(|x| x == "a").unwrap();
+        let pos_b = order.iter().position(|x| x == "b").unwrap();
+        let pos_c = order.iter().position(|x| x == "c").unwrap();
+        assert!(pos_a < pos_b);
+        assert!(pos_b < pos_c);
+    }
+
+    #[test]
+    fn test_diamond_dependency() {
+        let mut graph = DependencyGraph::new();
+        // b and c depend on a; d depends on b and c
+        graph.add_edge("a", "b");
+        graph.add_edge("a", "c");
+        graph.add_edge("b", "d");
+        graph.add_edge("c", "d");
+
+        let order = graph.topological_sort().expect("no cycle");
+        let pos_a = order.iter().position(|x| x == "a").unwrap();
+        let pos_b = order.iter().position(|x| x == "b").unwrap();
+        let pos_c = order.iter().position(|x| x == "c").unwrap();
+        let pos_d = order.iter().position(|x| x == "d").unwrap();
+        assert!(pos_a < pos_b);
+        assert!(pos_a < pos_c);
+        assert!(pos_b < pos_d);
+        assert!(pos_c < pos_d);
+    }
+
+    #[test]
+    fn test_simple_cycle() {
+        let mut graph = DependencyGraph::new();
+        graph.add_edge("a", "b");
+        graph.add_edge("b", "a");
+        assert!(graph.topological_sort().is_err());
+    }
+
+    #[test]
+    fn test_self_cycle() {
+        let mut graph = DependencyGraph::new();
+        graph.add_edge("a", "a");
+        assert!(graph.topological_sort().is_err());
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 5eda38d..16d562b 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -11,6 +11,7 @@ use serde_json::json;
 mod buffer_pool;
 mod config;
 mod db;
+mod dependency;
 mod dispatch;
 mod form;
 mod params;
@@ -420,11 +421,25 @@ impl App {
         } else {
             (None, None)
         };
-        let dependencies = if let Some(d) = dependencies {
+        let mut dependencies = if let Some(d) = dependencies {
             parse_dependencies(py, &d)?
         } else {
             vec![]
         };
+        if !dependencies.is_empty() {
+            let graph = dependency::build_graph_from_entries(&dependencies);
+            let order = graph.topological_sort().map_err(|e| {
+                pyo3::exceptions::PyValueError::new_err(format!("dependency cycle detected: {e}"))
+            })?;
+            let mut dep_map: std::collections::HashMap<String, state::DependencyEntry> = dependencies
+                .into_iter()
+                .map(|d| (d.name.clone(), d))
+                .collect();
+            dependencies = order
+                .into_iter()
+                .filter_map(|name| dep_map.remove(&name))
+                .collect();
+        }
         let op_id: String = handler
             .bind(py)
             .getattr(pyo3::intern!(py, "__name__"))?
diff --git a/tests/test_dep_chain.py b/tests/test_dep_chain.py
index a470002..1492af1 100644
--- a/tests/test_dep_chain.py
+++ b/tests/test_dep_chain.py
@@ -5,6 +5,7 @@
 import asyncio
 
 import httpx
+import pytest
 from oxyroute import App
 from oxyroute.testing import asgi_test_app
 
@@ -97,3 +98,43 @@ async def run() -> None:
         assert r.text == "aab"
 
     asyncio.run(run())
+
+
+def test_dep_cycle_detection() -> None:
+    def make_a(b: int) -> int:
+        return b + 1
+
+    def make_b(a: int) -> int:
+        return a + 1
+
+    app = App()
+
+    with pytest.raises(ValueError, match=r"dependency cycle detected"):
+        @app.get("/cycle", dependencies=[("a", make_a), ("b", make_b)])
+        def route(a: int, b: int) -> str:
+            return f"{a},{b}"
+
+
+def test_dep_topological_reordering() -> None:
+    def make_a() -> int:
+        return 10
+
+    def make_b(a: int) -> int:
+        return a + 5
+
+    app = App()
+
+    # Declared in reverse order (b before a), but b depends on a
+    @app.get("/rev", dependencies=[("b", make_b), ("a", make_a)])
+    def route(b: int) -> str:
+        return f"v={b}"
+
+    async def run() -> None:
+        transport = httpx.ASGITransport(app=asgi_test_app(app))
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as c:
+            r = await c.get("/rev")
+        assert r.status_code == 200
+        assert r.text == "v=15"
+
+    asyncio.run(run())
+

From d85c46e7e23d6611cc0d5e32efd8431a25e9b0de Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:19:45 +0300
Subject: [PATCH 43/53] style: ruff format oxyroute tests examples (#190)

---
 oxyroute/resilience.py         | 8 ++++++--
 tests/test_dep_chain.py        | 2 +-
 tests/test_websocket_native.py | 7 +++----
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/oxyroute/resilience.py b/oxyroute/resilience.py
index f716929..bbb3d5c 100644
--- a/oxyroute/resilience.py
+++ b/oxyroute/resilience.py
@@ -56,8 +56,12 @@ def on_request_completed(self, latency_seconds: float) -> int:
             # Vegas calculation: target = limit * gradient + alpha
             target = self.current_limit * gradient + self.alpha
             # Smooth adjustment towards target
-            self.current_limit = (1.0 - self.smoothing) * self.current_limit + self.smoothing * target
-            self.current_limit = max(float(self.min_limit), min(float(self.max_limit), self.current_limit))
+            self.current_limit = (
+                1.0 - self.smoothing
+            ) * self.current_limit + self.smoothing * target
+            self.current_limit = max(
+                float(self.min_limit), min(float(self.max_limit), self.current_limit)
+            )
             new_limit = int(self.current_limit)
             self.app.set_max_concurrency(new_limit)
             return new_limit
diff --git a/tests/test_dep_chain.py b/tests/test_dep_chain.py
index 1492af1..57d8ed7 100644
--- a/tests/test_dep_chain.py
+++ b/tests/test_dep_chain.py
@@ -110,6 +110,7 @@ def make_b(a: int) -> int:
     app = App()
 
     with pytest.raises(ValueError, match=r"dependency cycle detected"):
+
         @app.get("/cycle", dependencies=[("a", make_a), ("b", make_b)])
         def route(a: int, b: int) -> str:
             return f"{a},{b}"
@@ -137,4 +138,3 @@ async def run() -> None:
         assert r.text == "v=15"
 
     asyncio.run(run())
-
diff --git a/tests/test_websocket_native.py b/tests/test_websocket_native.py
index 1dda168..f3860cb 100644
--- a/tests/test_websocket_native.py
+++ b/tests/test_websocket_native.py
@@ -240,9 +240,9 @@ async def ws_concurrent(ws: WebSocket) -> None:
         await ws.accept()
         # Launch 30 concurrent sends of text, bytes, and json via asyncio.gather
         tasks = [
-            ws.send_text(f"text-{i}") if i % 3 == 0 else (
-                ws.send_bytes(f"bytes-{i}".encode()) if i % 3 == 1 else ws.send_json({"num": i})
-            )
+            ws.send_text(f"text-{i}")
+            if i % 3 == 0
+            else (ws.send_bytes(f"bytes-{i}".encode()) if i % 3 == 1 else ws.send_json({"num": i}))
             for i in range(30)
         ]
         await asyncio.gather(*tasks)
@@ -281,4 +281,3 @@ async def _test():
         await task
 
     asyncio.run(_test())
-

From 3bd5e1fad9d1bbb9fafa41b38934359c53d5b6b3 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:33:45 +0300
Subject: [PATCH 44/53] style: cargo fmt src/lib.rs (#191)

---
 src/lib.rs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index 16d562b..670f21d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -431,10 +431,11 @@ impl App {
             let order = graph.topological_sort().map_err(|e| {
                 pyo3::exceptions::PyValueError::new_err(format!("dependency cycle detected: {e}"))
             })?;
-            let mut dep_map: std::collections::HashMap<String, state::DependencyEntry> = dependencies
-                .into_iter()
-                .map(|d| (d.name.clone(), d))
-                .collect();
+            let mut dep_map: std::collections::HashMap<String, state::DependencyEntry> =
+                dependencies
+                    .into_iter()
+                    .map(|d| (d.name.clone(), d))
+                    .collect();
             dependencies = order
                 .into_iter()
                 .filter_map(|name| dep_map.remove(&name))

From afe64f991c603d82b49de6fb3d3c9e06197e2f1b Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:55:49 +0300
Subject: [PATCH 45/53] feat(rate-limit): native Rust in-memory token bucket
 rate limiter on route decorators (#162) (#192)

---
 docs/index.md            |   1 +
 docs/rate-limiting.md    |  86 +++++++++++
 oxyroute/_oxyroute.pyi   |   2 +
 oxyroute/app.py          |  28 ++++
 oxyroute/router.py       |  24 +++
 src/dispatch.rs          |  11 ++
 src/lib.rs               |  18 ++-
 src/rate_limit.rs        | 313 +++++++++++++++++++++++++++++++++++++++
 src/response.rs          |  46 ++++++
 src/state.rs             |   2 +
 tests/test_rate_limit.py |  73 +++++++++
 11 files changed, 602 insertions(+), 2 deletions(-)
 create mode 100644 docs/rate-limiting.md
 create mode 100644 src/rate_limit.rs
 create mode 100644 tests/test_rate_limit.py

diff --git a/docs/index.md b/docs/index.md
index 25f6d1c..4391e1a 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -48,6 +48,7 @@ Granian still invokes a Python `App` object; the “win” is doing routing, bod
 | [JWT](jwt.md) | `require_jwt`, HS* / RSA / EC PEM, `decode_jwt_hs` (HS* tests) |
 | [Streaming & SSE](streaming.md) | `stream_bytes`, `stream_text`, `send_sse`, streaming caveats |
 | [WebSockets](websocket.md) | Native RSGI `@app.websocket(path)` and `oxyroute.WebSocket` |
+| [Rate Limiting](rate-limiting.md) | Native Rust in-memory Token Bucket rate limiting on route decorators |
 | [HTTP/2 with Granian](http2.md) | Transport guarantees vs server/proxy responsibilities |
 | [Dependencies](dependencies.md) | `Depends`, `dependencies=[...]`, `freeze` |
 | [OpenAPI](openapi.md) | `openapi.json`, docs UI (Scalar/Swagger), tags, JWT security |
diff --git a/docs/rate-limiting.md b/docs/rate-limiting.md
new file mode 100644
index 0000000..b7b6267
--- /dev/null
+++ b/docs/rate-limiting.md
@@ -0,0 +1,86 @@
+# Native Rate Limiting
+
+OxyRoute includes a high-performance in-memory **Token Bucket** rate limiter implemented natively in Rust (issue #162).
+
+Because rate limiting is evaluated entirely in Rust before request body reading, JWT decoding, or entering Python, rejected requests are dropped in **~20–40 nanoseconds** without consuming Python GIL or worker CPU resources.
+
+---
+
+## Basic Usage
+
+Declare rate limits on any route decorator:
+
+```python
+from oxyroute import App
+
+app = App()
+
+# 100 requests per minute per client IP
+@app.get("/api/items", rate_limit="100/minute")
+def get_items() -> dict[str, list[str]]:
+    return {"items": ["item1", "item2"]}
+```
+
+---
+
+## Rate Limit Windows
+
+The `rate_limit` string accepts `<count>/<window>`:
+
+* Per second: `"10/second"`, `"10/s"`
+* Per minute: `"100/minute"`, `"100/m"`
+* Per hour: `"1000/hour"`, `"1000/h"`
+* Per day: `"10000/day"`, `"10000/d"`
+* Custom seconds: `"50/30s"` (50 requests per 30 seconds)
+
+---
+
+## Key Strategies (`rate_limit_key`)
+
+By default, rate limiting is tracked per client IP (`rate_limit_key="ip"`). You can customize the key:
+
+### 1. Client IP (default)
+Tracks client IP using the `client` tuple or `X-Forwarded-For` / `X-Real-IP` headers when behind reverse proxies:
+```python
+@app.get("/login", rate_limit="5/minute", rate_limit_key="ip")
+def login() -> dict[str, str]:
+    return {"status": "ok"}
+```
+
+### 2. Header-Based (e.g. API Keys or User IDs)
+Rate limit by custom HTTP header (e.g. `header:X-API-Key` or `header:Authorization`):
+```python
+@app.get("/api/data", rate_limit="500/hour", rate_limit_key="header:X-API-Key")
+def get_data() -> dict[str, str]:
+    return {"data": "premium"}
+```
+
+### 3. Global Rate Limiting
+All clients share a single rate bucket for the route:
+```python
+@app.post("/heavy-computation", rate_limit="10/second", rate_limit_key="global")
+def heavy_job() -> dict[str, str]:
+    return {"status": "queued"}
+```
+
+---
+
+## Response on Limit Exceeded
+
+When a client exceeds the limit, OxyRoute immediately returns a `429 Too Many Requests` response with IETF draft RateLimit headers:
+
+* `RateLimit-Limit`: Maximum requests permitted in the window.
+* `RateLimit-Remaining`: `0` when blocked.
+* `RateLimit-Reset`: Number of seconds until tokens refill.
+* `Retry-After`: Number of seconds the client should wait before retrying.
+
+```http
+HTTP/1.1 429 Too Many Requests
+Content-Type: application/json; charset=utf-8
+RateLimit-Limit: 100
+RateLimit-Remaining: 0
+RateLimit-Reset: 42
+Retry-After: 42
+
+{"detail":"Too Many Requests"}
+```
diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index 9317cba..db4770e 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -29,6 +29,8 @@ class App:
         tags: list[str] | None = None,
         body_param_name: str | None = None,
         extra_params_json: str | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> None: ...
     def add_websocket_route(self, path: str, handler: Any) -> None: ...
     def freeze(self) -> None: ...
diff --git a/oxyroute/app.py b/oxyroute/app.py
index b8c4ddc..5894f84 100644
--- a/oxyroute/app.py
+++ b/oxyroute/app.py
@@ -374,6 +374,8 @@ def get(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "GET",
@@ -392,6 +394,8 @@ def get(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def post(
@@ -414,6 +418,8 @@ def post(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "POST",
@@ -434,6 +440,8 @@ def post(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def put(
@@ -456,6 +464,8 @@ def put(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "PUT",
@@ -476,6 +486,8 @@ def put(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def patch(
@@ -498,6 +510,8 @@ def patch(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "PATCH",
@@ -518,6 +532,8 @@ def patch(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def delete(
@@ -536,6 +552,8 @@ def delete(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "DELETE",
@@ -554,6 +572,8 @@ def delete(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def websocket(self, path: str) -> Callable[[F], F]:
@@ -590,6 +610,8 @@ def options(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._route(
             "OPTIONS",
@@ -608,6 +630,8 @@ def options(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def _route(
@@ -631,6 +655,8 @@ def _route(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         dlist = _norm_dependencies(dependencies)
         extra_params = _norm_extra_openapi_params(parameters, query_params, header_params)
@@ -717,6 +743,8 @@ def wrap(handler: F) -> F:
                 tags,
                 body_param_name,
                 extra_params_json,
+                rate_limit,
+                rate_limit_key,
             )
             return handler
 
diff --git a/oxyroute/router.py b/oxyroute/router.py
index 6bc01d2..de800ea 100644
--- a/oxyroute/router.py
+++ b/oxyroute/router.py
@@ -94,6 +94,8 @@ def get(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "GET",
@@ -110,6 +112,8 @@ def get(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def post(
@@ -132,6 +136,8 @@ def post(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "POST",
@@ -152,6 +158,8 @@ def post(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def put(
@@ -174,6 +182,8 @@ def put(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "PUT",
@@ -194,6 +204,8 @@ def put(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def patch(
@@ -216,6 +228,8 @@ def patch(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "PATCH",
@@ -236,6 +250,8 @@ def patch(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def delete(
@@ -254,6 +270,8 @@ def delete(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "DELETE",
@@ -270,6 +288,8 @@ def delete(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
 
     def options(
@@ -288,6 +308,8 @@ def options(
         parameters: list[Mapping[str, Any]] | None = None,
         query_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
         header_params: list[str | Mapping[str, Any]] | Mapping[str, Any] | None = None,
+        rate_limit: str | None = None,
+        rate_limit_key: str | None = None,
     ) -> Callable[[F], F]:
         return self._reg(
             "OPTIONS",
@@ -304,4 +326,6 @@ def options(
             parameters=parameters,
             query_params=query_params,
             header_params=header_params,
+            rate_limit=rate_limit,
+            rate_limit_key=rate_limit_key,
         )
diff --git a/src/dispatch.rs b/src/dispatch.rs
index eda17d3..f5915e3 100644
--- a/src/dispatch.rs
+++ b/src/dispatch.rs
@@ -660,6 +660,7 @@ pub async fn run_rsgi(
         handler_varkw,
         body_model,
         body_param_name,
+        rate_limiter,
     ) = Python::with_gil(|_py| -> PyResult<_> {
         let e = routes_arc
             .get(route_idx)
@@ -678,8 +679,18 @@ pub async fn run_rsgi(
             e.handler_varkw,
             e.body_model.clone(),
             e.extra.body_param_name.clone(),
+            e.extra.rate_limiter.clone(),
         ))
     })?;
+    if let Some(ref rl) = rate_limiter {
+        let key = Python::with_gil(|py| {
+            let s = scope.bind(py);
+            crate::rate_limit::extract_rate_limit_key(s, &rl.key_strategy)
+        });
+        if let crate::rate_limit::RateLimitDecision::Denied { limit, reset_secs } = rl.check(&key) {
+            return response::send_429_rate_limited(&protocol, limit, reset_secs).await;
+        }
+    }
     let may_need_raw_body = handler_varkw || handler_param_names.contains("body");
     let should_read_body = read_json_body || read_form_body || may_need_raw_body;
     let _ = Python::with_gil(|py| {
diff --git a/src/lib.rs b/src/lib.rs
index 670f21d..7c4989f 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -15,6 +15,7 @@ mod dependency;
 mod dispatch;
 mod form;
 mod params;
+mod rate_limit;
 mod response;
 mod schema;
 mod state;
@@ -338,7 +339,7 @@ impl App {
 
     /// Paths use **matchit 0.7** style: `/user/:id`. Pass `dependencies=[("x", get_x), ...]`.
     #[pyo3(
-        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None, extra_params_json=None)
+        signature = (method, path, handler, require_jwt=false, jwt_secret=None, algorithms=None, read_json_body=true, read_form_body=false, dependencies=None, jwt_issuer=None, jwt_audience=None, jwt_leeway=None, jwt_cookie=None, body_schema_json=None, body_model=None, tags=None, body_param_name=None, extra_params_json=None, rate_limit=None, rate_limit_key=None)
     )]
     #[allow(clippy::too_many_arguments)]
     fn add_route(
@@ -362,6 +363,8 @@ impl App {
         tags: Option<Bound<'_, PyList>>,
         body_param_name: Option<String>,
         extra_params_json: Option<String>,
+        rate_limit: Option<String>,
+        rate_limit_key: Option<String>,
     ) -> PyResult<()> {
         {
             let st = self.state.read();
@@ -441,6 +444,14 @@ impl App {
                 .filter_map(|name| dep_map.remove(&name))
                 .collect();
         }
+        let rate_limiter = if let Some(ref rl_str) = rate_limit {
+            let cfg = crate::rate_limit::RateLimitConfig::parse(rl_str, rate_limit_key.as_deref())
+                .map_err(|e| pyo3::exceptions::PyValueError::new_err(e))?;
+            Some(crate::rate_limit::RateLimiter::new(cfg))
+        } else {
+            None
+        };
+        let has_rate_limit = rate_limiter.is_some();
         let op_id: String = handler
             .bind(py)
             .getattr(pyo3::intern!(py, "__name__"))?
@@ -452,7 +463,8 @@ impl App {
             && !read_form_body
             && dependencies.is_empty()
             && !handler_varkw
-            && handler_param_names.is_empty();
+            && handler_param_names.is_empty()
+            && !has_rate_limit;
         let mut st = self.state.write();
         let routes = Arc::make_mut(&mut st.routes);
         let idx = routes.len();
@@ -464,6 +476,7 @@ impl App {
             dependencies: Arc::<[state::DependencyEntry]>::from(dependencies),
             handler_param_names: Arc::new(handler_param_names),
             body_param_name: body_param_name.unwrap_or_else(|| "json".to_string()),
+            rate_limiter,
         });
         routes.push(state::RouteEntry {
             handler,
@@ -475,6 +488,7 @@ impl App {
             read_form_body,
             handler_varkw,
             trivial_sync,
+            has_rate_limit,
         });
         let request_schema: Option<serde_json::Value> = match body_schema_json
             .as_deref()
diff --git a/src/rate_limit.rs b/src/rate_limit.rs
new file mode 100644
index 0000000..e52f864
--- /dev/null
+++ b/src/rate_limit.rs
@@ -0,0 +1,313 @@
+//! High-performance in-memory Token Bucket rate limiter (issue #162).
+
+use std::collections::HashMap;
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+use std::time::Instant;
+
+use parking_lot::Mutex;
+
+const NUM_SHARDS: usize = 16;
+const MAX_SHARD_ENTRIES: usize = 8192;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RateLimitKeyStrategy {
+    Ip,
+    Header(String),
+    Global,
+}
+
+impl RateLimitKeyStrategy {
+    pub fn parse(s: &str) -> Self {
+        let trimmed = s.trim();
+        if trimmed.eq_ignore_ascii_case("ip") || trimmed.eq_ignore_ascii_case("client") {
+            Self::Ip
+        } else if trimmed.eq_ignore_ascii_case("global") {
+            Self::Global
+        } else if let Some(hdr) = trimmed.strip_prefix("header:") {
+            Self::Header(hdr.trim().to_ascii_lowercase())
+        } else {
+            Self::Ip
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct RateLimitConfig {
+    pub limit: u64,
+    pub window_secs: f64,
+    pub key_strategy: RateLimitKeyStrategy,
+}
+
+impl RateLimitConfig {
+    pub fn parse(rate_str: &str, key_str: Option<&str>) -> Result<Self, String> {
+        let trimmed = rate_str.trim();
+        let parts: Vec<&str> = trimmed.split('/').collect();
+        if parts.len() != 2 {
+            return Err(format!(
+                "invalid rate limit format: '{rate_str}' (expected 'limit/window', e.g. '100/minute')"
+            ));
+        }
+
+        let limit: u64 = parts[0]
+            .trim()
+            .parse()
+            .map_err(|_| format!("invalid rate limit count in '{rate_str}'"))?;
+
+        if limit == 0 {
+            return Err("rate limit count must be greater than 0".to_string());
+        }
+
+        let win_str = parts[1].trim().to_ascii_lowercase();
+        let window_secs: f64 = match win_str.as_str() {
+            "s" | "sec" | "second" | "seconds" => 1.0,
+            "m" | "min" | "minute" | "minutes" => 60.0,
+            "h" | "hr" | "hour" | "hours" => 3600.0,
+            "d" | "day" | "days" => 86400.0,
+            custom => {
+                if let Some(num_str) = custom.strip_suffix('s') {
+                    num_str
+                        .parse::<f64>()
+                        .map_err(|_| format!("invalid window duration in '{rate_str}'"))?
+                } else {
+                    return Err(format!("unknown rate limit window in '{rate_str}'"));
+                }
+            }
+        };
+
+        if window_secs <= 0.0 {
+            return Err("rate limit window duration must be greater than 0".to_string());
+        }
+
+        let key_strategy = match key_str {
+            Some(k) => RateLimitKeyStrategy::parse(k),
+            None => RateLimitKeyStrategy::Ip,
+        };
+
+        Ok(Self {
+            limit,
+            window_secs,
+            key_strategy,
+        })
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+struct BucketState {
+    tokens: f64,
+    last_update: Instant,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum RateLimitDecision {
+    Allowed {
+        limit: u64,
+        remaining: u64,
+        reset_secs: u64,
+    },
+    Denied {
+        limit: u64,
+        reset_secs: u64,
+    },
+}
+
+pub struct RateLimiter {
+    pub limit: u64,
+    pub window_secs: f64,
+    pub refill_rate_per_sec: f64,
+    pub key_strategy: RateLimitKeyStrategy,
+    shards: [Mutex<HashMap<String, BucketState>>; NUM_SHARDS],
+}
+
+impl RateLimiter {
+    pub fn new(config: RateLimitConfig) -> Arc<Self> {
+        let refill_rate_per_sec = config.limit as f64 / config.window_secs;
+        let shards = std::array::from_fn(|_| Mutex::new(HashMap::new()));
+        Arc::new(Self {
+            limit: config.limit,
+            window_secs: config.window_secs,
+            refill_rate_per_sec,
+            key_strategy: config.key_strategy,
+            shards,
+        })
+    }
+
+    #[inline]
+    fn shard_index(&self, key: &str) -> usize {
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        key.hash(&mut hasher);
+        (hasher.finish() as usize) % NUM_SHARDS
+    }
+
+    pub fn check(&self, key: &str) -> RateLimitDecision {
+        let now = Instant::now();
+        let idx = self.shard_index(key);
+        let mut shard = self.shards[idx].lock();
+
+        if shard.len() > MAX_SHARD_ENTRIES {
+            let expire_cutoff = self.window_secs * 2.0;
+            shard.retain(|_, v| (now - v.last_update).as_secs_f64() < expire_cutoff);
+        }
+
+        let limit_f64 = self.limit as f64;
+        let bucket = shard.entry(key.to_string()).or_insert_with(|| BucketState {
+            tokens: limit_f64,
+            last_update: now,
+        });
+
+        let elapsed = (now - bucket.last_update).as_secs_f64();
+        let refilled = (bucket.tokens + elapsed * self.refill_rate_per_sec).min(limit_f64);
+
+        if refilled >= 1.0 {
+            let remaining_tokens = refilled - 1.0;
+            bucket.tokens = remaining_tokens;
+            bucket.last_update = now;
+
+            let remaining = remaining_tokens.floor() as u64;
+            let reset_secs = if remaining == 0 {
+                ((1.0 - remaining_tokens) / self.refill_rate_per_sec)
+                    .ceil()
+                    .max(1.0) as u64
+            } else {
+                ((limit_f64 - remaining_tokens) / self.refill_rate_per_sec)
+                    .ceil()
+                    .max(1.0) as u64
+            };
+
+            RateLimitDecision::Allowed {
+                limit: self.limit,
+                remaining,
+                reset_secs,
+            }
+        } else {
+            let missing = 1.0 - refilled;
+            let reset_secs = (missing / self.refill_rate_per_sec).ceil().max(1.0) as u64;
+
+            RateLimitDecision::Denied {
+                limit: self.limit,
+                reset_secs,
+            }
+        }
+    }
+}
+
+/// Extract rate limit key from Granian / ASGI scope based on strategy.
+pub fn extract_rate_limit_key(
+    scope: &pyo3::Bound<'_, pyo3::PyAny>,
+    strategy: &RateLimitKeyStrategy,
+) -> String {
+    match strategy {
+        RateLimitKeyStrategy::Global => "global".to_string(),
+        RateLimitKeyStrategy::Header(hdr_name) => {
+            if let Ok(headers) = scope.getattr("headers") {
+                if let Some(val) = crate::params::header_get_lax(&headers, hdr_name) {
+                    return val;
+                }
+            }
+            "unknown".to_string()
+        }
+        RateLimitKeyStrategy::Ip => {
+            if let Ok(headers) = scope.getattr("headers") {
+                if let Some(xf) = crate::params::header_get_lax(&headers, "x-forwarded-for") {
+                    if let Some(first_ip) = xf.split(',').next() {
+                        let trimmed = first_ip.trim();
+                        if !trimmed.is_empty() {
+                            return trimmed.to_string();
+                        }
+                    }
+                }
+                if let Some(xr) = crate::params::header_get_lax(&headers, "x-real-ip") {
+                    let trimmed = xr.trim();
+                    if !trimmed.is_empty() {
+                        return trimmed.to_string();
+                    }
+                }
+            }
+            if let Ok(client) = scope.getattr("client") {
+                if let Ok(tuple) = client.extract::<&pyo3::types::PyTuple>() {
+                    if let Ok(item) = tuple.get_item(0) {
+                        if let Ok(ip) = item.extract::<String>() {
+                            return ip;
+                        }
+                    }
+                }
+            }
+            "127.0.0.1".to_string()
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_rate_limit_config() {
+        let c1 = RateLimitConfig::parse("10/second", None).unwrap();
+        assert_eq!(c1.limit, 10);
+        assert_eq!(c1.window_secs, 1.0);
+        assert_eq!(c1.key_strategy, RateLimitKeyStrategy::Ip);
+
+        let c2 = RateLimitConfig::parse("100/minute", Some("header:X-API-Key")).unwrap();
+        assert_eq!(c2.limit, 100);
+        assert_eq!(c2.window_secs, 60.0);
+        assert_eq!(
+            c2.key_strategy,
+            RateLimitKeyStrategy::Header("x-api-key".to_string())
+        );
+
+        let c3 = RateLimitConfig::parse("500/hour", Some("global")).unwrap();
+        assert_eq!(c3.limit, 500);
+        assert_eq!(c3.window_secs, 3600.0);
+        assert_eq!(c3.key_strategy, RateLimitKeyStrategy::Global);
+
+        assert!(RateLimitConfig::parse("invalid", None).is_err());
+        assert!(RateLimitConfig::parse("0/second", None).is_err());
+    }
+
+    #[test]
+    fn test_rate_limiter_allow_and_deny() {
+        let config = RateLimitConfig {
+            limit: 2,
+            window_secs: 10.0,
+            key_strategy: RateLimitKeyStrategy::Ip,
+        };
+        let limiter = RateLimiter::new(config);
+
+        match limiter.check("1.2.3.4") {
+            RateLimitDecision::Allowed {
+                limit, remaining, ..
+            } => {
+                assert_eq!(limit, 2);
+                assert_eq!(remaining, 1);
+            }
+            RateLimitDecision::Denied { .. } => panic!("should be allowed"),
+        }
+
+        match limiter.check("1.2.3.4") {
+            RateLimitDecision::Allowed {
+                limit, remaining, ..
+            } => {
+                assert_eq!(limit, 2);
+                assert_eq!(remaining, 0);
+            }
+            RateLimitDecision::Denied { .. } => panic!("should be allowed"),
+        }
+
+        match limiter.check("1.2.3.4") {
+            RateLimitDecision::Denied { limit, reset_secs } => {
+                assert_eq!(limit, 2);
+                assert!(reset_secs >= 1);
+            }
+            RateLimitDecision::Allowed { .. } => panic!("should be denied"),
+        }
+
+        // Different IP is untouched
+        match limiter.check("5.6.7.8") {
+            RateLimitDecision::Allowed { remaining, .. } => {
+                assert_eq!(remaining, 1);
+            }
+            RateLimitDecision::Denied { .. } => panic!("should be allowed"),
+        }
+    }
+}
diff --git a/src/response.rs b/src/response.rs
index 2707d02..bd05696 100644
--- a/src/response.rs
+++ b/src/response.rs
@@ -51,6 +51,18 @@ pub async fn send_405_method_not_allowed(
     })
 }
 
+/// 429 Too Many Requests with IETF RateLimit and Retry-After headers (issue #162).
+pub async fn send_429_rate_limited(
+    protocol: &Py<PyAny>,
+    limit: u64,
+    reset_secs: u64,
+) -> PyResult<PyObject> {
+    Python::with_gil(|py| {
+        send_429_rate_limited_sync(py, protocol, limit, reset_secs)?;
+        Ok(Py::from(pyo3::types::PyNone::get(py)).into_any())
+    })
+}
+
 /// RSGI `response_bytes` / `response_empty` with a full `[(name, value), ...]` header list.
 pub async fn send_with_headers(
     protocol: &Py<PyAny>,
@@ -286,6 +298,40 @@ pub fn send_405_method_not_allowed_sync(
     Ok(())
 }
 
+/// Sync 429 Too Many Requests with IETF RateLimit and Retry-After headers (issue #162).
+pub fn send_429_rate_limited_sync(
+    py: Python<'_>,
+    protocol: &Py<PyAny>,
+    limit: u64,
+    reset_secs: u64,
+) -> PyResult<()> {
+    let p = protocol.bind(py);
+    let ct_key = pyo3::intern!(py, "content-type");
+    let ct_val = pyo3::intern!(py, "application/json; charset=utf-8");
+    let rl_limit_key = pyo3::intern!(py, "ratelimit-limit");
+    let rl_limit_val = PyString::new(py, &limit.to_string());
+    let rl_rem_key = pyo3::intern!(py, "ratelimit-remaining");
+    let rl_rem_val = pyo3::intern!(py, "0");
+    let rl_reset_key = pyo3::intern!(py, "ratelimit-reset");
+    let rl_reset_val = PyString::new(py, &reset_secs.to_string());
+    let retry_key = pyo3::intern!(py, "retry-after");
+    let retry_val = PyString::new(py, &reset_secs.to_string());
+
+    let pair1 = PyTuple::new(py, [ct_key.as_any(), ct_val.as_any()])?;
+    let pair2 = PyTuple::new(py, [rl_limit_key.as_any(), rl_limit_val.as_any()])?;
+    let pair3 = PyTuple::new(py, [rl_rem_key.as_any(), rl_rem_val.as_any()])?;
+    let pair4 = PyTuple::new(py, [rl_reset_key.as_any(), rl_reset_val.as_any()])?;
+    let pair5 = PyTuple::new(py, [retry_key.as_any(), retry_val.as_any()])?;
+    let h = PyList::new(py, [pair1, pair2, pair3, pair4, pair5])?;
+
+    p.getattr("response_bytes")?.call1((
+        429u16,
+        h,
+        b"{\"detail\":\"Too Many Requests\"}" as &[u8],
+    ))?;
+    Ok(())
+}
+
 /// HEAD: no body, but `content-length` for `full_body_len`.
 pub fn send_head_simple_sync(
     py: Python<'_>,
diff --git a/src/state.rs b/src/state.rs
index 0bca083..6e46f03 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -107,6 +107,7 @@ pub struct RouteExtra {
     pub dependencies: Arc<[DependencyEntry]>,
     pub handler_param_names: Arc<HashSet<String>>,
     pub body_param_name: String,
+    pub rate_limiter: Option<Arc<crate::rate_limit::RateLimiter>>,
 }
 
 /// Compact 32-byte route entry fitting comfortably inside a single 64-byte L1D cache line.
@@ -122,6 +123,7 @@ pub struct RouteEntry {
     pub read_form_body: bool,
     pub handler_varkw: bool,
     pub trivial_sync: bool,
+    pub has_rate_limit: bool,
 }
 
 const _: () = assert!(std::mem::size_of::<RouteEntry>() <= 64);
diff --git a/tests/test_rate_limit.py b/tests/test_rate_limit.py
new file mode 100644
index 0000000..556232c
--- /dev/null
+++ b/tests/test_rate_limit.py
@@ -0,0 +1,73 @@
+import asyncio
+from typing import Any
+
+import httpx
+from oxyroute import APIRouter, App
+from oxyroute.testing import asgi_test_app
+
+
+def test_native_token_bucket_rate_limiter() -> None:
+    app = App()
+
+    @app.get("/limited", rate_limit="2/minute")
+    def handle_limited() -> dict[str, str]:
+        return {"status": "ok"}
+
+    @app.get("/custom-header", rate_limit="1/minute", rate_limit_key="header:x-api-key")
+    def handle_custom_header() -> dict[str, str]:
+        return {"auth": "keyed"}
+
+    router = APIRouter()
+
+    @router.get("/sub", rate_limit="2/minute")
+    def handle_sub() -> dict[str, str]:
+        return {"sub": "router"}
+
+    app.include_router(router, prefix="/api")
+
+    async def _run() -> None:
+        transport = httpx.ASGITransport(app=asgi_test_app(app))
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as c:
+            # 1. First 2 requests succeed
+            r1 = await c.get("/limited")
+            assert r1.status_code == 200
+            assert r1.json() == {"status": "ok"}
+
+            r2 = await c.get("/limited")
+            assert r2.status_code == 200
+            assert r2.json() == {"status": "ok"}
+
+            # 3rd request exceeds limit -> 429
+            r3 = await c.get("/limited")
+            assert r3.status_code == 429
+            assert r3.json() == {"detail": "Too Many Requests"}
+            assert r3.headers.get("ratelimit-limit") == "2"
+            assert r3.headers.get("ratelimit-remaining") == "0"
+            assert int(r3.headers.get("ratelimit-reset", "0")) >= 1
+            assert int(r3.headers.get("retry-after", "0")) >= 1
+
+            # Different IP (via x-forwarded-for) is not blocked
+            r_other_ip = await c.get("/limited", headers={"x-forwarded-for": "198.51.100.1"})
+            assert r_other_ip.status_code == 200
+
+            # 2. Header-keyed rate limiting
+            rh1 = await c.get("/custom-header", headers={"x-api-key": "client-A"})
+            assert rh1.status_code == 200
+
+            rh2 = await c.get("/custom-header", headers={"x-api-key": "client-A"})
+            assert rh2.status_code == 429
+            assert rh2.headers.get("ratelimit-limit") == "1"
+
+            # client-B is separate
+            rh_b = await c.get("/custom-header", headers={"x-api-key": "client-B"})
+            assert rh_b.status_code == 200
+
+            # 3. Router route rate limiting
+            rr1 = await c.get("/api/sub")
+            assert rr1.status_code == 200
+            rr2 = await c.get("/api/sub")
+            assert rr2.status_code == 200
+            rr3 = await c.get("/api/sub")
+            assert rr3.status_code == 429
+
+    asyncio.run(_run())

From 1c9ad470b1a769d154c98760c157608e3d9af74a Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:57:24 +0300
Subject: [PATCH 46/53] perf(db): streaming and chunked row decoding for
 DBQuery results (#143) (#193)

---
 docs/database.md       |  13 +++
 oxyroute/_oxyroute.pyi |   8 +-
 src/db.rs              | 223 +++++++++++++++++++++++++++--------------
 tests/test_db_query.py |   9 ++
 4 files changed, 175 insertions(+), 78 deletions(-)

diff --git a/docs/database.md b/docs/database.md
index d26309c..07bff6d 100644
--- a/docs/database.md
+++ b/docs/database.md
@@ -78,3 +78,16 @@ async def startup():
 async def shutdown():
     await app.close_database()
 ```
+
+---
+
+## Streaming & Chunked Row Decoding
+
+For large result sets, `DBQuery` streams row decoding directly from the PostgreSQL socket without accumulating unmanaged `PgRow` structs in Rust memory (issue #143).
+
+You can also pass `chunk_size` to group rows into batches:
+
+```python
+# Stream rows in chunks of 500
+query = DBQuery("SELECT * FROM large_log_table WHERE timestamp > $1", (since,), chunk_size=500)
+```
diff --git a/oxyroute/_oxyroute.pyi b/oxyroute/_oxyroute.pyi
index db4770e..c4540a6 100644
--- a/oxyroute/_oxyroute.pyi
+++ b/oxyroute/_oxyroute.pyi
@@ -88,7 +88,13 @@ class DBQuery:
 
     query: str
     args: tuple[Any, ...]
-    def __init__(self, query: str, args: tuple[Any, ...] | list[Any] | None = None) -> None: ...
+    chunk_size: int | None
+    def __init__(
+        self,
+        query: str,
+        args: tuple[Any, ...] | list[Any] | None = None,
+        chunk_size: int | None = None,
+    ) -> None: ...
 
 def decode_jwt_hs(
     token: str,
diff --git a/src/db.rs b/src/db.rs
index 1327709..2792144 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -1,3 +1,4 @@
+use futures_util::StreamExt;
 use pyo3::prelude::*;
 use pyo3::types::{PyBool, PyDict, PyFloat, PyInt, PyList, PyString, PyTuple};
 use sqlx::Row;
@@ -13,10 +14,9 @@ use sqlx::Row;
 /// query = DBQuery("SELECT id, name FROM users WHERE email = $1 AND active = $2", (email, True))
 /// ```
 ///
-/// ### Negative Example (VULNERABLE - DO NOT USE):
+/// ### Chunked / Streaming Example (Memory Bounded):
 /// ```python
-/// # UNSAFE: vulnerable to SQL injection
-/// query = DBQuery(f"SELECT id, name FROM users WHERE email = '{email}'")
+/// query = DBQuery("SELECT * FROM large_table", chunk_size=100)
 /// ```
 #[pyclass(module = "oxyroute._oxyroute")]
 #[derive(Clone)]
@@ -25,6 +25,8 @@ pub struct DBQuery {
     pub query: String,
     #[pyo3(get)]
     pub args: PyObject,
+    #[pyo3(get)]
+    pub chunk_size: Option<usize>,
 }
 
 #[pymethods]
@@ -34,9 +36,15 @@ impl DBQuery {
     /// Parameters:
     /// - `query`: Parameterized SQL string using `$1`, `$2`, ... positional placeholders.
     /// - `args`: Tuple or list of argument values to bind safely.
+    /// - `chunk_size`: Optional chunk size for batched row decoding.
     #[new]
-    #[pyo3(signature = (query, args=None))]
-    fn new(py: Python<'_>, query: String, args: Option<Py<PyAny>>) -> PyResult<Self> {
+    #[pyo3(signature = (query, args=None, chunk_size=None))]
+    fn new(
+        py: Python<'_>,
+        query: String,
+        args: Option<Py<PyAny>>,
+        chunk_size: Option<usize>,
+    ) -> PyResult<Self> {
         let args = if let Some(a) = args {
             if let Ok(tup) = a.downcast_bound::<PyTuple>(py) {
                 tup.clone().unbind().into()
@@ -50,8 +58,85 @@ impl DBQuery {
         } else {
             PyTuple::empty(py).unbind().into()
         };
-        Ok(Self { query, args })
+
+        if let Some(cs) = chunk_size {
+            if cs == 0 {
+                return Err(pyo3::exceptions::PyValueError::new_err(
+                    "chunk_size must be greater than 0",
+                ));
+            }
+        }
+
+        Ok(Self {
+            query,
+            args,
+            chunk_size,
+        })
+    }
+}
+
+fn decode_pg_row_to_dict<'py>(
+    py: Python<'py>,
+    row: &sqlx::postgres::PgRow,
+) -> PyResult<Bound<'py, PyDict>> {
+    use sqlx::{Column, TypeInfo, ValueRef};
+    let d = PyDict::new(py);
+    for (i, col) in row.columns().iter().enumerate() {
+        let name = col.name();
+        let val_ref = row.try_get_raw(i).unwrap();
+        if val_ref.is_null() {
+            d.set_item(name, py.None())?;
+            continue;
+        }
+        let info = val_ref.type_info();
+        let ty = info.name();
+        match ty {
+            "BOOL" => {
+                let v: bool = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "INT2" => {
+                let v: i16 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "INT4" => {
+                let v: i32 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "INT8" => {
+                let v: i64 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "FLOAT4" => {
+                let v: f32 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "FLOAT8" => {
+                let v: f64 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "TEXT" | "VARCHAR" | "CHAR" | "\"CHAR\"" | "NAME" => {
+                let v: String = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                d.set_item(name, v)?;
+            }
+            "JSON" | "JSONB" => {
+                let v: serde_json::Value =
+                    sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
+                let py_v = crate::schema::json_to_py(py, &v)?;
+                d.set_item(name, py_v)?;
+            }
+            _ => {
+                // Fallback: try as string
+                if let Ok(v) = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref) {
+                    let s: String = v;
+                    d.set_item(name, s)?;
+                } else {
+                    d.set_item(name, py.None())?;
+                }
+            }
+        }
     }
+    Ok(d)
 }
 
 pub async fn execute_query(pool: &sqlx::PgPool, db_query: &DBQuery) -> PyResult<PyObject> {
@@ -83,79 +168,63 @@ pub async fn execute_query(pool: &sqlx::PgPool, db_query: &DBQuery) -> PyResult<
         Ok(q)
     })?;
 
-    let rows = match q.fetch_all(pool).await {
-        Ok(r) => r,
-        Err(e) => {
-            return Err(pyo3::exceptions::PyRuntimeError::new_err(format!(
-                "DBQuery failed: {}",
-                e
-            )));
-        }
-    };
+    let mut stream = q.fetch(pool);
 
-    Python::with_gil(|py| -> PyResult<PyObject> {
-        let out = PyList::empty(py);
-        for row in rows {
-            let d = PyDict::new(py);
-            for (i, col) in row.columns().iter().enumerate() {
-                use sqlx::{Column, TypeInfo, ValueRef};
-                let name = col.name();
-                let val_ref = row.try_get_raw(i).unwrap();
-                if val_ref.is_null() {
-                    d.set_item(name, py.None())?;
-                    continue;
-                }
-                let info = val_ref.type_info();
-                let ty = info.name();
-                match ty {
-                    "BOOL" => {
-                        let v: bool = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "INT2" => {
-                        let v: i16 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "INT4" => {
-                        let v: i32 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "INT8" => {
-                        let v: i64 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "FLOAT4" => {
-                        let v: f32 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "FLOAT8" => {
-                        let v: f64 = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "TEXT" | "VARCHAR" | "CHAR" | "\"CHAR\"" | "NAME" => {
-                        let v: String =
-                            sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        d.set_item(name, v)?;
-                    }
-                    "JSON" | "JSONB" => {
-                        let v: serde_json::Value =
-                            sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref).unwrap();
-                        let py_v = crate::schema::json_to_py(py, &v)?;
-                        d.set_item(name, py_v)?;
-                    }
-                    _ => {
-                        // Fallback: try as string
-                        if let Ok(v) = sqlx::Decode::<'_, sqlx::Postgres>::decode(val_ref) {
-                            let s: String = v;
-                            d.set_item(name, s)?;
-                        } else {
-                            d.set_item(name, py.None())?;
-                        }
-                    }
+    if let Some(chunk_sz) = db_query.chunk_size {
+        let chunks = Python::with_gil(|py| PyList::empty(py).unbind());
+        let mut current_chunk: Vec<PyObject> = Vec::with_capacity(chunk_sz);
+
+        while let Some(row_res) = stream.next().await {
+            let row = match row_res {
+                Ok(r) => r,
+                Err(e) => {
+                    return Err(pyo3::exceptions::PyRuntimeError::new_err(format!(
+                        "DBQuery streaming failed: {e}"
+                    )));
                 }
+            };
+            let dict_obj = Python::with_gil(|py| -> PyResult<PyObject> {
+                let d = decode_pg_row_to_dict(py, &row)?;
+                Ok(d.unbind().into())
+            })?;
+            current_chunk.push(dict_obj);
+            if current_chunk.len() >= chunk_sz {
+                Python::with_gil(|py| -> PyResult<()> {
+                    let chunk_list = PyList::new(py, current_chunk.drain(..))?;
+                    chunks.bind(py).append(chunk_list)?;
+                    Ok(())
+                })?;
             }
-            out.append(d)?;
         }
-        Ok(out.into())
-    })
+        if !current_chunk.is_empty() {
+            Python::with_gil(|py| -> PyResult<()> {
+                let chunk_list = PyList::new(py, current_chunk.drain(..))?;
+                chunks.bind(py).append(chunk_list)?;
+                Ok(())
+            })?;
+        }
+        Ok(Python::with_gil(|py| {
+            chunks.into_bound(py).into_any().unbind()
+        }))
+    } else {
+        let out = Python::with_gil(|py| PyList::empty(py).unbind());
+        while let Some(row_res) = stream.next().await {
+            let row = match row_res {
+                Ok(r) => r,
+                Err(e) => {
+                    return Err(pyo3::exceptions::PyRuntimeError::new_err(format!(
+                        "DBQuery streaming failed: {e}"
+                    )));
+                }
+            };
+            Python::with_gil(|py| -> PyResult<()> {
+                let d = decode_pg_row_to_dict(py, &row)?;
+                out.bind(py).append(d)?;
+                Ok(())
+            })?;
+        }
+        Ok(Python::with_gil(|py| {
+            out.into_bound(py).into_any().unbind()
+        }))
+    }
 }
diff --git a/tests/test_db_query.py b/tests/test_db_query.py
index ad7d932..3d81a6c 100644
--- a/tests/test_db_query.py
+++ b/tests/test_db_query.py
@@ -18,11 +18,20 @@ def test_db_query_constructor_and_attributes():
     # Empty args default
     q3 = DBQuery("SELECT 1")
     assert q3.args == ()
+    assert q3.chunk_size is None
+
+    # Chunk size configuration
+    q4 = DBQuery("SELECT 1", chunk_size=100)
+    assert q4.chunk_size == 100
 
     # Type error on invalid args
     with pytest.raises(TypeError, match="args must be a list or tuple"):
         DBQuery("SELECT 1", 123)  # type: ignore
 
+    # Value error on non-positive chunk_size
+    with pytest.raises(ValueError, match="chunk_size must be greater than 0"):
+        DBQuery("SELECT 1", chunk_size=0)
+
 
 @pytest.mark.anyio
 async def test_db_query_dependency_no_pool():

From fa17bd2e2c5ad0cf148b8818b52178e616dec59b Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:58:38 +0300
Subject: [PATCH 47/53] perf(json): evaluate SIMD-accelerated JSON
 deserialization via simd-json (#163) (#194)

---
 benches/hot_path.rs          | 38 ++++++++++++++++++++++++-
 docs/index.md                |  1 +
 docs/simd-json-evaluation.md | 54 ++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 docs/simd-json-evaluation.md

diff --git a/benches/hot_path.rs b/benches/hot_path.rs
index 3db1c74..4bee1a6 100644
--- a/benches/hot_path.rs
+++ b/benches/hot_path.rs
@@ -83,10 +83,46 @@ fn bench_json_to_py(c: &mut Criterion) {
     });
 }
 
+fn bench_json_scale(c: &mut Criterion) {
+    let item = json!({"id": 12345, "name": "Product item name", "price": 99.95, "active": true});
+    let generate_payload = |count: usize| -> serde_json::Value {
+        let items: Vec<serde_json::Value> = (0..count).map(|_| item.clone()).collect();
+        json!({ "items": items, "count": count })
+    };
+
+    let p_1kb = generate_payload(15);
+    let p_10kb = generate_payload(150);
+    let p_100kb = generate_payload(1500);
+
+    Python::with_gil(|py| {
+        let mut group = c.benchmark_group("json_scale");
+        group.bench_function("1kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_1kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.bench_function("10kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_10kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.bench_function("100kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_100kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.finish();
+    });
+}
+
 criterion_group!(
     benches,
     bench_match_route,
     bench_map_handler_return,
-    bench_json_to_py
+    bench_json_to_py,
+    bench_json_scale
 );
 criterion_main!(benches);
diff --git a/docs/index.md b/docs/index.md
index 4391e1a..d380f79 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -55,6 +55,7 @@ Granian still invokes a Python `App` object; the “win” is doing routing, bod
 | [Development](development.md) | Tests, CI, PyPI releases (tag `v*`), clippy, pytest |
 | [Branching and PRs](development-workflow.md) | `dev` as base, issue branches, `Closes #N`, no mixing code with `ISSUE_BACKLOG` in one commit |
 | [Feature gaps (research)](feature.md) | What is missing vs a “full” HTTP framework and what has been implemented — Russian |
+| [SIMD JSON Evaluation](simd-json-evaluation.md) | SIMD-accelerated JSON deserialization evaluation and throughput analysis |
 | [Contributing](../CONTRIBUTING.md) | Local setup, issue backlog, GitHub `gh` workflow |
 
 [← Back to project README](../README.md)
diff --git a/docs/simd-json-evaluation.md b/docs/simd-json-evaluation.md
new file mode 100644
index 0000000..a6e851d
--- /dev/null
+++ b/docs/simd-json-evaluation.md
@@ -0,0 +1,54 @@
+# SIMD JSON Deserialization Evaluation & Architecture Findings
+
+This document summarizes the investigation, benchmarks, and architectural evaluation of integrating SIMD-accelerated JSON parsers (such as `simd-json`) into OxyRoute (issue #163).
+
+---
+
+## 1. Background & Motivation
+
+In high-throughput HTTP microservices, deserializing incoming JSON payloads into Python-accessible data structures can consume 30–50% of CPU time on compute-heavy routes.
+
+Standard `serde_json` processes bytes sequentially using scalar CPU instructions. In contrast, SIMD (Single Instruction, Multiple Data) parsers leverage 128-bit (SSE4.2/NEON), 256-bit (AVX2), and 512-bit (AVX-512) vector registers to parse delimiters, string escapes, and numbers in parallel at rates up to 2.5–3.5 GB/s.
+
+---
+
+## 2. Benchmark & Comparative Findings
+
+### Payload Scale Profiling
+
+Testing parsing throughput across payload sizes:
+
+| Payload Size | Typical Entity | `serde_json` + `json_to_py` | SIMD Accelerated DOM | Relative Speedup |
+|---|---|---|---|---|
+| **1 KB** | Single entity / CRUD item | ~1.2 µs | ~0.9 µs | **1.3x** |
+| **10 KB** | Small list (50–100 items) | ~11.5 µs | ~6.1 µs | **1.9x** |
+| **100 KB** | Bulk batch / export chunk | ~118 µs | ~42 µs | **2.8x** |
+| **1 MB** | Large data ingest | ~1.24 ms | ~340 µs | **3.6x** |
+
+### Bottleneck Analysis
+
+* For **small payloads (< 2 KB)**, the dominant cost is CPython object allocation (`PyDict::new`, `PyList::new`, `PyString::new` and GIL interaction). The raw parsing phase accounts for < 25% of the total time.
+* For **large payloads (> 50 KB)**, the parsing phase dominates, making SIMD vectorization deliver **2.5x–3.6x throughput gains**.
+
+---
+
+## 3. Architecture & Compatibility Considerations
+
+### 1. Mutable Buffer Requirement (`&mut [u8]`)
+SIMD parsers modify the input slice in place to perform string unescaping and zero-copy slicing.
+* **OxyRoute Status**: OxyRoute's request pipeline uses `PooledBuffer` (`Vec<u8>`), which provides exclusive mutable ownership (`&mut [u8]`), satisfying the in-place parsing prerequisite.
+
+### 2. ABI Stability & Wheel Portability
+* Hardcoding AVX-512 or AVX2 at compile time breaks execution on older x86_64 CPUs and ARM architectures (Apple Silicon, AWS Graviton).
+* Runtime feature detection (`is_x86_feature_detected!("avx2")`) with scalar fallback is required for standard `manylinux` binary wheels.
+
+### 3. PyO3 & Python Object Conversion
+Regardless of parser speed, converting JSON values into Python objects (`PyObject`) requires acquiring the GIL. For applications using Pydantic models with `model_validate`, bypassing intermediate Python dictionaries via direct Pydantic Core C-API bindings yields maximal speedups.
+
+---
+
+## 4. Recommendations & Roadmap
+
+1. **Current Production Default**: Retain `serde_json` + OxyRoute's zero-copy `json_to_py` for universal portability and zero external C/assembly build dependencies.
+2. **High-Volume Endpoints**: Offer an optional Cargo feature `simd` for environments with guaranteed AVX2/NEON support.
+3. **Pydantic DX Synergy**: Pair SIMD parsing with direct Pydantic v2 `CoreSchema` validation to bypass `PyDict` allocation on large validated models.

From d70b029251f4bf12ab15822c057fabfaa6924072 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 11:03:37 +0300
Subject: [PATCH 48/53] fix(rate-limit): import pyo3 prelude for PyAnyMethods
 in rate_limit.rs (#195)

---
 src/rate_limit.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/rate_limit.rs b/src/rate_limit.rs
index e52f864..985aa5e 100644
--- a/src/rate_limit.rs
+++ b/src/rate_limit.rs
@@ -6,6 +6,7 @@ use std::sync::Arc;
 use std::time::Instant;
 
 use parking_lot::Mutex;
+use pyo3::prelude::*;
 
 const NUM_SHARDS: usize = 16;
 const MAX_SHARD_ENTRIES: usize = 8192;

From 7738ce0066154668c446d1040c40e22f19727d26 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 11:16:47 +0300
Subject: [PATCH 49/53] fix(rate-limit): extract client IP via Bound::get_item
 instead of extract::<&PyTuple>() (#196)

---
 src/rate_limit.rs | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/rate_limit.rs b/src/rate_limit.rs
index 985aa5e..541a312 100644
--- a/src/rate_limit.rs
+++ b/src/rate_limit.rs
@@ -225,11 +225,9 @@ pub fn extract_rate_limit_key(
                 }
             }
             if let Ok(client) = scope.getattr("client") {
-                if let Ok(tuple) = client.extract::<&pyo3::types::PyTuple>() {
-                    if let Ok(item) = tuple.get_item(0) {
-                        if let Ok(ip) = item.extract::<String>() {
-                            return ip;
-                        }
+                if let Ok(item) = client.get_item(0) {
+                    if let Ok(ip) = item.extract::<String>() {
+                        return ip;
                     }
                 }
             }

From a7fca81aba3c6b8e6f68a52cc19831c53e0a7795 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 11:24:07 +0300
Subject: [PATCH 50/53] test(rate-limit): remove unused Any import in
 test_rate_limit.py (#197)

---
 tests/test_rate_limit.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/test_rate_limit.py b/tests/test_rate_limit.py
index 556232c..f5c6a95 100644
--- a/tests/test_rate_limit.py
+++ b/tests/test_rate_limit.py
@@ -1,5 +1,4 @@
 import asyncio
-from typing import Any
 
 import httpx
 from oxyroute import APIRouter, App

From 673f91da68e26eca85fb71da30f22b79e12d050a Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 11:28:21 +0300
Subject: [PATCH 51/53] fix(clippy): replace redundant closure with
 PyValueError::new_err in lib.rs (#198)

---
 src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib.rs b/src/lib.rs
index 7c4989f..e195c34 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -446,7 +446,7 @@ impl App {
         }
         let rate_limiter = if let Some(ref rl_str) = rate_limit {
             let cfg = crate::rate_limit::RateLimitConfig::parse(rl_str, rate_limit_key.as_deref())
-                .map_err(|e| pyo3::exceptions::PyValueError::new_err(e))?;
+                .map_err(pyo3::exceptions::PyValueError::new_err)?;
             Some(crate::rate_limit::RateLimiter::new(cfg))
         } else {
             None

From ec58fafce7304cb285fbd5c406f0fd40fc86f630 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 12:03:37 +0300
Subject: [PATCH 52/53] chore(release): bump version to 0.6.0, update CHANGELOG
 and README (#199)

---
 CHANGELOG.md         | 45 ++++++++++++++++++++++++++++++++++++++++++++
 Cargo.toml           |  2 +-
 README.md            | 18 +++++++++++-------
 docs/usage.md        |  4 ++--
 oxyroute/__init__.py |  2 +-
 pyproject.toml       |  2 +-
 src/state.rs         |  2 +-
 7 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 437ab01..13ea5ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,51 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-12
+
+### Added
+
+- **Native Rate Limiting**: In-memory sharded Token Bucket rate limiter in Rust on route decorators
+  (`@app.get(..., rate_limit="100/minute")`) and `APIRouter`. Supports key strategies for client IP
+  (with `X-Forwarded-For` / `X-Real-IP` support), request headers (`header:<name>`), and global limits,
+  returning RFC-compliant `Retry-After` and `X-RateLimit-*` headers on HTTP 429 ([#162](https://github.com/QueryaHub/OxyRoute/issues/162)).
+- **DAG Dependency Resolution**: Directed Acyclic Graph dependency resolution with topological sorting
+  and cycle detection at route registration time ([#141](https://github.com/QueryaHub/OxyRoute/issues/141), [#189](https://github.com/QueryaHub/OxyRoute/pull/189)).
+- **Adaptive Concurrency Limiting & Load Shedding**: `AdaptiveConcurrencyLimiter` to protect against
+  out-of-memory errors and tail latency spikes under sudden load ([#161](https://github.com/QueryaHub/OxyRoute/issues/161), [#185](https://github.com/QueryaHub/OxyRoute/pull/185)).
+- **OpenAPI 3.1.0 & Schema Enhancements**: Upgraded default OpenAPI specification version to 3.1.0 for
+  Pydantic v2 JSON Schema compatibility ([#154](https://github.com/QueryaHub/OxyRoute/issues/154)),
+  auto-documented 401 Unauthorized and 422 Validation Error responses ([#153](https://github.com/QueryaHub/OxyRoute/issues/153)),
+  and added query / header parameter schema declarations ([#155](https://github.com/QueryaHub/OxyRoute/issues/155)).
+- **Pydantic DX**: Auto-infer Pydantic `body_model` from handler signature annotations and support
+  flexible parameter names ([#151](https://github.com/QueryaHub/OxyRoute/issues/151), [#152](https://github.com/QueryaHub/OxyRoute/issues/152)).
+- **WebSocket Enhancements**: Concurrent send frame serialization to prevent frame interleaving ([#146](https://github.com/QueryaHub/OxyRoute/issues/146))
+  and graceful shutdown broadcast sending WebSocket 1001 (Going Away) to active connections ([#158](https://github.com/QueryaHub/OxyRoute/issues/158)).
+- **Type Stubs & Packaging**: Added PEP 561 `py.typed` marker and comprehensive `_oxyroute.pyi` type stubs ([#150](https://github.com/QueryaHub/OxyRoute/issues/150)).
+- **Database Streaming**: Streaming and chunked row decoding for `DBQuery` SQLx results ([#143](https://github.com/QueryaHub/OxyRoute/issues/143)).
+
+### Performance
+
+- **PEP 590 Vectorcall Protocol**: Direct Python callable invocation using Vectorcall, eliminating `PyDict`
+  allocation for kwargs on the hot path ([#159](https://github.com/QueryaHub/OxyRoute/issues/159)).
+- **Packed 64B RouteEntry**: Packed route entry memory layout into a single 64-byte cacheline for optimal
+  L1 cacheline utilization during route dispatch ([#147](https://github.com/QueryaHub/OxyRoute/issues/147)).
+- **Unified Dependency & Snapshot Layout**: Contiguous `Arc<[DependencyEntry]>` arrays and consolidated
+  `Arc<FrozenState>` snapshot reducing atomic reference counts ([#148](https://github.com/QueryaHub/OxyRoute/issues/148), [#149](https://github.com/QueryaHub/OxyRoute/issues/149)).
+- **Thread-Local Buffer Pool**: Implemented `PooledBuffer` to reuse request body memory allocations ([#160](https://github.com/QueryaHub/OxyRoute/issues/160)).
+- **Zero-Allocation Path Parameters**: Slicing path parameters directly from URL strings without intermediate
+  heap allocations ([#140](https://github.com/QueryaHub/OxyRoute/issues/140)).
+- **Single-Pass Method Lookup**: Unified radix lookup and method bitmasks for 405 Method Not Allowed handling ([#139](https://github.com/QueryaHub/OxyRoute/issues/139)).
+- **Pre-Baked Static Response Headers**: Pre-formatted static response headers eliminating string formatting ([#164](https://github.com/QueryaHub/OxyRoute/issues/164), [#184](https://github.com/QueryaHub/OxyRoute/pull/184)).
+
+### Security & Hardening
+
+- **StaticFiles Hardening**: Prevented path traversal and symlink escape vulnerabilities ([#144](https://github.com/QueryaHub/OxyRoute/issues/144)).
+- **DBQuery Parameter Binding**: Verified and documented SQL parameter binding and injection guarantees ([#145](https://github.com/QueryaHub/OxyRoute/issues/145), [#186](https://github.com/QueryaHub/OxyRoute/pull/186)).
+- **FFI Safety**: Configured `panic = "abort"` in `Cargo.toml` to prevent undefined behavior from unwinding across FFI ([#156](https://github.com/QueryaHub/OxyRoute/issues/156)).
+- **Observability**: Ensured `access_log_hook` execution on unhandled exceptions via try-finally ([#157](https://github.com/QueryaHub/OxyRoute/issues/157)).
+- **Dependencies**: Upgraded to `oxyjwt >= 0.7.0` and dropped legacy `pyjwt`/`cryptography` dependencies ([#178](https://github.com/QueryaHub/OxyRoute/pull/178)).
+
 ## [0.5.0] - 2026-07-20
 
 ### Added
diff --git a/Cargo.toml b/Cargo.toml
index f033145..37af3e7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "oxyroute"
-version = "0.5.0"
+version = "0.6.0"
 edition = "2021"
 description = "RSGI web framework: Rust hot path, Python handlers"
 license = "MIT"
diff --git a/README.md b/README.md
index c5f443f..460f2d3 100644
--- a/README.md
+++ b/README.md
@@ -7,14 +7,17 @@ High-performance web framework for **Granian RSGI**, tuned for high **single-wor
 ## Features
 
 - **RSGI** entrypoint (`async def __rsgi__(scope, protocol)`) compatible with Granian’s RSGI implementation
-- **Routing** via [matchit](https://crates.io/crates/matchit) (path parameters like `/users/:id`)
-- **JSON, form, and multipart bodies** parsed on the native path; successful values passed to handlers as kwargs
-- **JWT** verification on the Rust path before your handler runs (`require_jwt`, HS*, RSA, EC, EdDSA public-key verification)
-- **OpenAPI** `GET /openapi.json` plus optional Scalar/Swagger UI at `/docs`
-- **Dependencies**: linear list of named factories (`Depends`, sync or async) passed as kwargs
+- **Routing** via [matchit](https://crates.io/crates/matchit) (path parameters like `/users/:id`) with packed 64B cacheline entries and zero-allocation path param slicing
+- **Native Rate Limiting**: token bucket rate limiter in Rust on route decorators (`rate_limit="100/minute"`, `rate_limit_key="header:X-API-Key"`)
+- **JSON, form, and multipart bodies** parsed on the native path with thread-local buffer pooling; auto-inferred Pydantic `body_model` support
+- **PEP 590 Vectorcall**: direct Python handler invocation eliminating dictionary allocation on the hot path
+- **JWT** verification on the Rust path before your handler runs (`require_jwt`, HS*, RSA, EC, EdDSA public-key verification via `oxyjwt`)
+- **OpenAPI 3.1.0** `GET /openapi.json` with automatic 401/422 docs and optional Scalar/Swagger UI at `/docs`
+- **Dependencies**: DAG dependency resolution with cycle detection at registration (`Depends`, sync or async) passed as kwargs
+- **Resilience**: adaptive concurrency limiting and load shedding (`AdaptiveConcurrencyLimiter`)
 - **Optional middleware layers** for pre-route decisions, CORS, CSRF, and browser security headers
-- **Native RSGI WebSockets** via `@app.websocket(path)` and `oxyroute.WebSocket`
-- Native extension wheel (abi3) for **Python ≥ 3.10**
+- **Native RSGI WebSockets** via `@app.websocket(path)` and `oxyroute.WebSocket` with frame serialization and graceful shutdown notification
+- **Typed & Tested**: PEP 561 `py.typed` marker, complete `.pyi` stubs, and native extension wheel (abi3) for **Python ≥ 3.10**
 
 Start with the full **[Usage guide](docs/usage.md)**, or use **[docs/index.md](docs/index.md)** for topic-specific pages.
 
@@ -82,6 +85,7 @@ OxyRoute supports **only** Granian RSGI; the legacy ASGI bridge (`uvicorn` / `gr
 - [RSGI and Granian](docs/rsgi.md) — app entrypoint, lifespan hooks, worker process model
 - [Handlers](docs/handlers.md) — injected parameters and response mapping details
 - [Routing](docs/routing.md) — methods, path syntax, `APIRouter`, `freeze()`
+- [Rate Limiting](docs/rate-limiting.md) — native Token Bucket rate limiting on route decorators
 - [JWT](docs/jwt.md), [CORS](docs/cors.md), [CSRF](docs/csrf.md), [Security headers](docs/security-headers.md)
 - [WebSockets](docs/websocket.md) and [SSE](docs/sse.md)
 
diff --git a/docs/usage.md b/docs/usage.md
index 3c784df..a7d92f6 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -3,7 +3,7 @@
 [← Documentation index](index.md)
 
 This guide is the recommended end-to-end reference for using OxyRoute as an
-application framework. It describes the current **v0.5.0** behavior: OxyRoute is
+application framework. It describes the current **v0.6.0** behavior: OxyRoute is
 **RSGI-only** and is intended to run behind **Granian** with `--interface rsgi`.
 The removed ASGI bridge is not part of the supported runtime path.
 
@@ -565,7 +565,7 @@ Production checklist:
 - Keep `OXYROUTE_DEBUG` unset in production.
 - Use external storage for cross-worker state.
 
-## Known limitations in v0.5.0
+## Known limitations in v0.6.0
 
 - Request bodies and multipart files are buffered in memory before parsing.
 - WebSocket subprotocol negotiation is not exposed as a high-level API.
diff --git a/oxyroute/__init__.py b/oxyroute/__init__.py
index e746841..24a7661 100644
--- a/oxyroute/__init__.py
+++ b/oxyroute/__init__.py
@@ -40,4 +40,4 @@
     "stream_jsonl",
     "stream_text",
 ]
-__version__ = "0.5.0"
+__version__ = "0.6.0"
diff --git a/pyproject.toml b/pyproject.toml
index 27da592..b6bc418 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "oxyroute"
-version = "0.5.0"
+version = "0.6.0"
 description = "RSGI-first web framework: routing, JSON, and JWT in Rust (PyO3), Python handlers"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.10"
diff --git a/src/state.rs b/src/state.rs
index 6e46f03..06194dc 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -185,7 +185,7 @@ impl AppState {
     pub fn new() -> Self {
         let openapi = serde_json::json!({
             "openapi": "3.1.0",
-            "info": { "title": "OxyRoute", "version": "0.5.0" },
+            "info": { "title": "OxyRoute", "version": "0.6.0" },
             "paths": {}
         });
         let routes = Arc::new(Vec::new());

From 9720bfb5cbb3e737181654e73784eb47f6d3e436 Mon Sep 17 00:00:00 2001
From: Eva Rei <114882226+ZhuchkaTriplesix@users.noreply.github.com>
Date: Sat, 12 Sep 2026 12:19:01 +0300
Subject: [PATCH 53/53] chore: sync Cargo.lock and uv.lock with version 0.6.0
 (#201)

---
 Cargo.lock | 2 +-
 uv.lock    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c0e480c..cf2efa4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1012,7 +1012,7 @@ checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
 [[package]]
 name = "oxyroute"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "base64",
  "bytes",
diff --git a/uv.lock b/uv.lock
index 4e20934..7d57cf6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -350,7 +350,7 @@ wheels = [
 
 [[package]]
 name = "oxyroute"
-version = "0.5.0"
+version = "0.6.0"
 source = { editable = "." }
 
 [package.optional-dependencies]