Roadmap

Project vision, milestone tracking, and architectural research for fist.

Completed

Typed Parameter Extractors (fist/extract): Pure, ergonomic parameter extraction and validation helpers (extract.int, extract.float, extract.bool, extract.string, extract.non_empty_string, extract.uuid, extract.custom) with first-class use expression support (require_*) and query string helpers (query_params, query_string, query_int, query_bool).
TypeScript Declarations Generation: Auto-generated .d.mts definitions with full generic parameter typing for JavaScript and TypeScript consumers.
Packaging & Documentation Isolation: Aligned gleam.toml with the official specification, added explicit Codeberg/Hex links, and marked internal_modules to keep public HexDocs clean.

Defensive Path Security (RFC 3986): Formal Section 5.2.4 remove_dot_segments implementation preventing path traversal attacks (. and ..), null-byte sanitization (\0), and Windows backslash normalization.
Wildcard Catch-All (*param / /*): Multi-segment path matching capturing all trailing segments.
Strict 3-Tier Precedence: Static > Dynamic (:param) > Wildcard (*param) with automatic deep backtracking to ancestor wildcards on dead-end static branches.
Monoidal Router Merging (fist.merge): Combining disjoint and compatible routers recursively.
Fail-Fast Collision Protection: Immediate runtime panic on duplicate endpoints, conflicting dynamic parameter names, or conflicting wildcards.
Full Cross-Target Compatibility: 100% test coverage and build parity on both BEAM (Erlang) and JavaScript (Node.js/Bun/Deno/browser) runtimes.
Scalability & Stress Benchmarks: Validated $O(k)$ lookups on 2,000+ route trees, 10,000-burst dispatches, and 50-level path nesting.

Dynamic Mounting & Groups: Full support for :param in mount and group prefixes (e.g. /orgs/:org_id).
Middleware Execution Order: Declarative, outer-to-inner execution order in fist.group.
URL Percent-Decoding: Automatic decoding of path parameters and UTF-8 characters (João -> João).
Defensive Path Parsing: Automatic query string and fragment stripping.
HTTP Helpers: Added fist.head, fist.options, and fist.allowed_methods for CORS preflight and 405 status codes.

Route Metadata: Implemented describe and inspect for route documentation and introspection.

Pure Router Focus: Removed internal helper functions to keep the core minimal.

Core Features: Tree-based routing (Radix Trie), generic handler outputs, and generic context.
Decoupling: Removed mandatory dependency on the Mist web server.

Explore code generation, expanded schema metadata, and automated OpenAPI 3.1 / TypeScript client generation based on fist.inspect.

Explore virtual-host and subdomain multiplexing (req.host) for multi-tenant applications.