0.9.0

The guarded-mounting release: requests register on the route group whose middleware guards them.

BREAKING — one-line migration. The four register(request:) methods moved from Application to RoutesBuilder and take an app: parameter: try app.register(request: X.self) → try app.register(request: X.self, app: app), or mount behind your credential group: try authed.register(request: X.self, app: app). See the full changelog.

Highlights

• RoutesBuilder.register(request:app:) (FOSMVVMVapor) — the group you register on decides the middleware that guards the route: mount privileged requests behind ClientCredentialMiddleware, public ones on the Application itself (an Application is a RoutesBuilder). Guarded writes are rejected before anything mutates, and .live refreshes ride the same guarded route. Every method still derives and validates the request's load plan at boot — where a request mounts is your decision; that its plan is derived is not.
• Path-prefixing groups are rejected at boot. Clients derive the served URL from the request type, so app.grouped("admin") would make client and server silently disagree — registration now fails fast with a diagnostic naming the request and the mounted path. Mount on middleware-only groups.

Full changelog: https://github.com/foscomputerservices/FOSUtilities/blob/0.9.0/CHANGELOG.md