Improve compile time

Author: owjs3901

crates/vespera/src/multipart.rs

@@ -168,6 +168,23 @@ impl TypedMultipartError {
     }
 }
 
+/// Canonical JSON error envelope, byte-identical to `Validated<T>`'s 422
+/// envelope — `{"errors":[{"message":...,"path":...}]}` (message before path)
+/// — so multipart failures are consumed uniformly and, under JNI, the 422
+/// body hoists into the wire header exactly like a `Validated` rejection.
+/// Serialized through a borrowing `Serialize` (no `serde_json::Value`
+/// map/array/object intermediate).
+#[derive(serde::Serialize)]
+struct MultipartOneError<'a> {
+    message: &'a str,
+    path: &'a str,
+}
+
+#[derive(serde::Serialize)]
+struct MultipartErrorEnvelope<'a> {
+    errors: [MultipartOneError<'a>; 1],
+}
+
 impl IntoResponse for TypedMultipartError {
     fn into_response(self) -> Response {
         let status = match &self {
@@ -189,31 +206,22 @@ impl IntoResponse for TypedMultipartError {
             Self::FieldTooLarge { .. } => StatusCode::PAYLOAD_TOO_LARGE,
             Self::Other { .. } => StatusCode::INTERNAL_SERVER_ERROR,
         };
-        // Canonical JSON error envelope, byte-identical to `Validated<T>`'s
-        // 422 envelope — `{"errors":[{"message":...,"path":...}]}` (message
-        // before path) — so multipart failures are consumed uniformly and,
-        // under JNI, the 422 body hoists into the wire header exactly like a
-        // `Validated` rejection.  Serialized through a borrowing `Serialize`
-        // (no `serde_json::Value` map/array/object intermediate). `path` is
-        // the offending field name when known, else empty.
-        #[derive(serde::Serialize)]
-        struct OneError<'a> {
-            message: &'a str,
-            path: &'a str,
-        }
-        #[derive(serde::Serialize)]
-        struct Envelope<'a> {
-            errors: [OneError<'a>; 1],
-        }
+        // Serialize the canonical 422 envelope (see module-scope
+        // `MultipartErrorEnvelope` / `MultipartOneError`); `path` is the
+        // offending field name when known, else empty.
         let path = self.field_name().unwrap_or("");
         let message = self.response_message();
-        let body = serde_json::to_vec(&Envelope {
-            errors: [OneError {
+        let body = serde_json::to_vec(&MultipartErrorEnvelope {
+            errors: [MultipartOneError {
                 message: &message,
                 path,
             }],
         })
-        .expect("multipart error envelope is infallible to serialize");
+        // Serializing a struct of two `&str` is infallible in practice; the
+        // fallback keeps this request-time error path panic-free (matching
+        // `Validated<T>`'s 422 envelope) by emitting a minimal valid envelope
+        // instead of unwinding inside a handler.
+        .unwrap_or_else(|_| br#"{"errors":[{"message":"serialization error","path":""}]}"#.to_vec());
         (
             status,
             [(

crates/vespera_inprocess/Cargo.toml

@@ -6,6 +6,16 @@ description = "In-process HTTP dispatch for axum — drive a Router via oneshot
 license.workspace = true
 repository.workspace = true
 
+[features]
+# Compiles the criterion A/B "before" twins (serde-based wire header
+# parse/serialize, the `http::request::Builder` request build, the
+# `serde_json::Value` 422 hoist) and the `bench_support` surface that
+# `benches/dispatch.rs` calls.  OFF by default so production builds (and
+# the shipped JNI cdylib) never compile the serde wire-header scaffolding
+# that exists only to benchmark the hand-rolled production path against.
+# Enable with `cargo bench -p vespera_inprocess --features bench-support`.
+bench-support = []
+
 [dependencies]
 # Lock-free read snapshot for the multi-app router registry: named-app
 # dispatch (every request in a multi-app JNI deployment) resolves with a

crates/vespera_inprocess/benches/dispatch.rs

@@ -803,6 +803,7 @@ fn bench_async_spawn_pattern(c: &mut Criterion) {
 /// - `response_serialize_*`: slice-serialize of a many-header response
 ///   (10 single-value + 3-value `set-cookie` + content-type/length) —
 ///   `write_wire_header_into_slice` (hand) vs the `serde_json` twin.
+#[cfg(feature = "bench-support")]
 fn bench_wire_header_serde(c: &mut Criterion) {
     use vespera_inprocess::ResponseMetadata;
     use vespera_inprocess::bench_support::{
@@ -893,6 +894,7 @@ fn bench_wire_header_serde(c: &mut Criterion) {
 /// Fixtures span the dispatch hot path's real request shapes: a bodyless `GET`
 /// (the DIRECT sweet spot), a `GET` with 3 headers, a small `POST` with
 /// `content-type`, and a `POST` with 8 realistic headers.
+#[cfg(feature = "bench-support")]
 fn bench_request_build_path(c: &mut Criterion) {
     use vespera_inprocess::bench_support::{bench_build_request_new, bench_build_request_old};
 
@@ -967,6 +969,7 @@ fn bench_request_build_path(c: &mut Criterion) {
 /// Fixtures: a 1-error envelope (typical single-field failure) and a 5-error
 /// envelope (form-heavy request) — where the eliminated `Value` map/array/key
 /// allocations scale with error count.
+#[cfg(feature = "bench-support")]
 fn bench_hoist_422_path(c: &mut Criterion) {
     use vespera_inprocess::bench_support::{bench_hoist_new, bench_hoist_old};
 
@@ -1056,9 +1059,23 @@ criterion_group!(
     bench_registry_ab,
     bench_headers_path,
     bench_streaming_path,
-    bench_async_spawn_pattern,
+    bench_async_spawn_pattern
+);
+
+// The within-run A/B groups compare the production hand-rolled paths against
+// the retained `serde_json` / `http::request::Builder` / `serde_json::Value`
+// "before" twins.  Those twins live behind the `bench-support` feature so a
+// production build never compiles them — run these groups with
+// `cargo bench -p vespera_inprocess --bench dispatch --features bench-support`.
+#[cfg(feature = "bench-support")]
+criterion_group!(
+    ab_benches,
     bench_wire_header_serde,
     bench_request_build_path,
     bench_hoist_422_path
 );
+
+#[cfg(feature = "bench-support")]
+criterion_main!(benches, ab_benches);
+#[cfg(not(feature = "bench-support"))]
 criterion_main!(benches);

crates/vespera_inprocess/src/dispatch.rs

@@ -13,11 +13,65 @@ use crate::envelope::{RequestEnvelope, ResponseEnvelope, ResponseMetadata};
 use crate::internal::{dispatch_and_split, dispatch_parts, to_response_envelope_text};
 use crate::registry::resolve_app_router;
 use crate::wire::{
-    WIRE_HEADER_RESERVE, WIRE_VERSION, error_wire, header_capacity_estimate, parse_wire_header,
-    split_wire_borrowed, split_wire_request, to_wire_bytes, write_wire_header_into_slice,
-    write_wire_header_into_vec,
+    WIRE_HEADER_RESERVE, WIRE_VERSION, WireRequestHeader, error_wire, header_capacity_estimate,
+    parse_wire_header, split_wire_borrowed, split_wire_request, to_wire_bytes,
+    write_wire_header_into_slice, write_wire_header_into_vec,
 };
 
+// ── Shared wire prelude (used by every wire entry point) ─────────────
+
+/// Ingress-cap guard shared by the **buffered** wire entry points
+/// (`dispatch_from_bytes_async`, `dispatch_into_async`,
+/// `dispatch_into_async_borrowed`, and the response-streaming pair).
+/// Returns the `413` wire bytes when the request exceeds the configured
+/// maximum, else `None`.  Centralizing the message keeps the cap identical
+/// across entry points; **bidirectional** streaming is intentionally exempt
+/// (it is `O(chunk)` RAM) and so does not call this.
+#[inline]
+pub fn check_ingress_cap(len: usize) -> Option<Vec<u8>> {
+    if crate::config::request_exceeds_limit(len) {
+        Some(error_wire(
+            413,
+            &format!(
+                "request size {len} bytes exceeds configured maximum of {} bytes",
+                crate::config::max_request_bytes()
+            ),
+        ))
+    } else {
+        None
+    }
+}
+
+/// Wire-prelude shared by **every** wire entry point (buffered,
+/// direct-write, and streaming): parse the header, enforce the protocol
+/// [`WIRE_VERSION`], and resolve the target app [`Router`].  Centralizing
+/// this keeps the security-sensitive version check + app resolution
+/// byte-identical across all dispatchers — the previous per-entry-point
+/// copies were a drift hazard.
+///
+/// `header_bytes` is the wire header-JSON region; the returned
+/// [`WireRequestHeader`] borrows from it, so the caller MUST keep it alive
+/// for as long as the header is used.  On failure the `Err` carries the
+/// exact wire error bytes to deliver in the caller's shape (`400` for a
+/// parse error or version mismatch, `400`/`404` from app resolution).
+#[inline]
+pub fn parse_validate_resolve(
+    header_bytes: &[u8],
+) -> Result<(WireRequestHeader<'_>, Router), Vec<u8>> {
+    let header = parse_wire_header(header_bytes).map_err(|msg| error_wire(400, &msg))?;
+    if header.v != WIRE_VERSION {
+        return Err(error_wire(
+            400,
+            &format!(
+                "unsupported wire version: got {}, expected {WIRE_VERSION}",
+                header.v
+            ),
+        ));
+    }
+    let router = resolve_app_router(&header)?;
+    Ok((header, router))
+}
+
 // ── Dispatch (direct API — backward compatible) ──────────────────────
 
 /// Dispatch a [`RequestEnvelope`] through an axum [`Router`] and
@@ -118,40 +172,20 @@ pub fn dispatch_from_bytes(input: Vec<u8>, runtime: &tokio::runtime::Runtime) ->
 /// guarantees as [`dispatch_from_bytes`]), including `404` when no app
 /// is registered under the requested name.
 pub async fn dispatch_from_bytes_async(input: Vec<u8>) -> Vec<u8> {
-    // Ingress cap (defense-in-depth): reject an oversized buffered
-    // request with 413 before doing any further work.  Unlimited by
-    // default (see `max_request_bytes`); streaming paths are exempt.
-    if crate::config::request_exceeds_limit(input.len()) {
-        return error_wire(
-            413,
-            &format!(
-                "request size {} bytes exceeds configured maximum of {} bytes",
-                input.len(),
-                crate::config::max_request_bytes()
-            ),
-        );
+    // Ingress cap (defense-in-depth): reject an oversized buffered request
+    // with 413 before any further work.  Unlimited by default; bidirectional
+    // streaming is exempt.  See [`check_ingress_cap`].
+    if let Some(err) = check_ingress_cap(input.len()) {
+        return err;
     }
-    // Wire-level checks next: malformed input must report parse
-    // errors regardless of whether an app is registered.
+    // Malformed input must report parse errors regardless of whether an app
+    // is registered, so split first, then the shared parse/version/resolve.
     let (header_bytes, body_bytes) = match split_wire_request(input) {
         Ok(parts) => parts,
         Err(msg) => return error_wire(400, &msg),
     };
-    let header = match parse_wire_header(&header_bytes) {
-        Ok(h) => h,
-        Err(msg) => return error_wire(400, &msg),
-    };
-    if header.v != WIRE_VERSION {
-        return error_wire(
-            400,
-            &format!(
-                "unsupported wire version: got {}, expected {WIRE_VERSION}",
-                header.v
-            ),
-        );
-    }
-    let router = match resolve_app_router(&header) {
-        Ok(r) => r,
+    let (header, router) = match parse_validate_resolve(&header_bytes) {
+        Ok(parts) => parts,
         Err(wire) => return wire,
     };
 
@@ -296,41 +330,15 @@ pub fn dispatch_into(
 pub async fn dispatch_into_async(input: Vec<u8>, out: &mut [u8]) -> DirectWriteResult {
     // Ingress cap (defense-in-depth) — same policy as
     // `dispatch_from_bytes_async`; 413 written into the caller buffer.
-    if crate::config::request_exceeds_limit(input.len()) {
-        return write_wire_into(
-            out,
-            &error_wire(
-                413,
-                &format!(
-                    "request size {} bytes exceeds configured maximum of {} bytes",
-                    input.len(),
-                    crate::config::max_request_bytes()
-                ),
-            ),
-        );
+    if let Some(err) = check_ingress_cap(input.len()) {
+        return write_wire_into(out, &err);
     }
     let (header_bytes, body_bytes) = match split_wire_request(input) {
         Ok(parts) => parts,
         Err(msg) => return write_wire_into(out, &error_wire(400, &msg)),
     };
-    let header = match parse_wire_header(&header_bytes) {
-        Ok(h) => h,
-        Err(msg) => return write_wire_into(out, &error_wire(400, &msg)),
-    };
-    if header.v != WIRE_VERSION {
-        return write_wire_into(
-            out,
-            &error_wire(
-                400,
-                &format!(
-                    "unsupported wire version: got {}, expected {WIRE_VERSION}",
-                    header.v
-                ),
-            ),
-        );
-    }
-    let router = match resolve_app_router(&header) {
-        Ok(r) => r,
+    let (header, router) = match parse_validate_resolve(&header_bytes) {
+        Ok(parts) => parts,
         Err(wire) => return write_wire_into(out, &wire),
     };
 
@@ -381,41 +389,15 @@ pub async fn dispatch_into_async(input: Vec<u8>, out: &mut [u8]) -> DirectWriteR
 /// the same error / `422` / overflow semantics apply.
 pub async fn dispatch_into_async_borrowed(input: &[u8], out: &mut [u8]) -> DirectWriteResult {
     // Ingress cap (defense-in-depth) — same policy as `dispatch_into_async`.
-    if crate::config::request_exceeds_limit(input.len()) {
-        return write_wire_into(
-            out,
-            &error_wire(
-                413,
-                &format!(
-                    "request size {} bytes exceeds configured maximum of {} bytes",
-                    input.len(),
-                    crate::config::max_request_bytes()
-                ),
-            ),
-        );
+    if let Some(err) = check_ingress_cap(input.len()) {
+        return write_wire_into(out, &err);
     }
     let (header_bytes, body_bytes) = match split_wire_borrowed(input) {
         Ok(parts) => parts,
         Err(msg) => return write_wire_into(out, &error_wire(400, &msg)),
     };
-    let header = match parse_wire_header(header_bytes) {
-        Ok(h) => h,
-        Err(msg) => return write_wire_into(out, &error_wire(400, &msg)),
-    };
-    if header.v != WIRE_VERSION {
-        return write_wire_into(
-            out,
-            &error_wire(
-                400,
-                &format!(
-                    "unsupported wire version: got {}, expected {WIRE_VERSION}",
-                    header.v
-                ),
-            ),
-        );
-    }
-    let router = match resolve_app_router(&header) {
-        Ok(r) => r,
+    let (header, router) = match parse_validate_resolve(header_bytes) {
+        Ok(parts) => parts,
         Err(wire) => return write_wire_into(out, &wire),
     };
 

crates/vespera_inprocess/src/internal.rs

@@ -54,6 +54,7 @@ pub async fn dispatch_parts<'h>(
 /// Start a request builder with method + URI.  When `query` is empty
 /// the borrowed `path` feeds `Uri` parsing directly — no intermediate
 /// `String`; otherwise a single exact-capacity join is allocated.
+#[cfg(any(test, feature = "bench-support"))]
 fn request_builder(method: Method, path: &str, query: &str) -> http::request::Builder {
     let builder = Request::builder().method(method);
     if query.is_empty() {
@@ -174,6 +175,7 @@ fn build_request_from_bytes<'h>(
 /// `wire_header_serde` group's hand-vs-`serde_json` twin).  Routes the request
 /// through the builder state machine the production path replaced; produces a
 /// byte-identical request.  Not used on any production path.
+#[cfg(any(test, feature = "bench-support"))]
 fn build_request_from_bytes_builder_old<'h>(
     method_str: &str,
     path: &str,
@@ -204,6 +206,7 @@ fn build_request_from_bytes_builder_old<'h>(
 /// Sum a built request's method / path / query / header byte lengths so the
 /// `request_build_ab` A/B cannot be optimised down to a partial build.
 /// Bench-only.
+#[cfg(any(test, feature = "bench-support"))]
 fn request_field_len_sum(req: &Request<Body>) -> usize {
     let mut acc = req.method().as_str().len() + req.uri().path().len();
     if let Some(query) = req.uri().query() {
@@ -217,6 +220,7 @@ fn request_field_len_sum(req: &Request<Body>) -> usize {
 
 /// Bench A/B: production direct-construction request build cost.  Returns a
 /// summed length so the optimiser cannot elide the build.  Bench-only.
+#[cfg(any(test, feature = "bench-support"))]
 #[doc(hidden)]
 #[must_use]
 pub fn bench_build_request_new(
@@ -232,6 +236,7 @@ pub fn bench_build_request_new(
 
 /// Bench A/B: previous `http::request::Builder` request build cost.
 /// Bench-only.
+#[cfg(any(test, feature = "bench-support"))]
 #[doc(hidden)]
 #[must_use]
 pub fn bench_build_request_old(

crates/vespera_inprocess/src/lib.rs

@@ -107,6 +107,7 @@ pub use wire::error_wire;
 /// `pub` items) can call both the hand-rolled and the retained
 /// `serde_json` wire-header paths in the same measurement run.  Hidden
 /// from docs; do not depend on it.
+#[cfg(any(test, feature = "bench-support"))]
 #[doc(hidden)]
 pub mod bench_support {
     pub use crate::internal::{bench_build_request_new, bench_build_request_old};