refactor(cli,core,web): unify derive_more error hierarchy, enforce strong IR typing, and harden CST/security abstractions

- Consolidate workspace error handling around cdd_core::error::AppError with derive_more::{Display, Error, From}, adding structured domain variants (MissingArgument, ToolNotFound, InvalidSpecVersion, DuplicateIdentifier, UnresolvedReference, AstMutationError, ConfigError, NotImplemented, NotFound, SyncError, Unauthorized, ValidationError) and wrapping AppError in a zero-duplication Actix ResponseError newtype in cdd-web.
- Eliminate all production .expect() calls across OpenAPI emission, RFC 3986 URI/reference resolution, schema resolution, and emitted Actix/Axum/Reqwest/MCP templates; emit typed WorkflowError and AppError results in generated Arazzo and MCP targets.
- Replace regex-based #[serde(...)] / #[oai(...)] attribute parsing and path template extraction with deterministic ra_ap_syntax token-tree and slice scanners, and upgrade route/test patching to inspect CST ast::Path and ast::Module nodes.
- Wire strong domain types (RustType, HttpMethod, StatusCodeSpec, MediaType, OperationId, RustIdent, ExtensionKey) across ParsedRoute, RouteParam, RequestBodyDefinition, ResponseHeader, ParsedField, and ParsedVariant, replacing fragile substring heuristics with RustType pattern matching.
- Remove clippy #[allow(...)] suppressions by introducing RouteBuildContext, CallbackResolutionContext, OperationParseContext, and RefResolutionScope parameter context structs and boxing large CLI subcommand payloads.
- Replace length-only token signatures and stub handlers in cdd-web with 256-bit keyed MAC token signing, UTC expiration validation, salted password hashing, InMemoryUserDao consolidation, and typed Pet/Store/User request extractors while maintaining 100.00% doc and test coverage.

Author: SamuelMarks

cli/src/from_arazzo.rs

@@ -204,6 +204,7 @@ edition = "2021"
 
 [dependencies]
 clap = { version = "4", features = ["derive"] }
+derive_more = { version = "2.1", default-features = false, features = ["std", "from", "display", "error"] }
 regex = "1"
 reqwest = { version = "0.12", features = ["json"] }
 serde = { version = "1.0", features = ["derive"] }

cli/src/main.rs

@@ -63,7 +63,6 @@ pub struct Cli {
 
 /// All available commands in the CLI.
 #[derive(Subcommand, Debug)]
-#[allow(clippy::large_enum_variant)]
 pub enum Commands {
     /// Synchronize an OpenAPI specification with source code.
     Sync(cdd_cli::sync::SyncArgs),
@@ -72,13 +71,13 @@ pub enum Commands {
     ToDocsJson(cdd_cli::to_docs_json::ToDocsJsonArgs),
     /// Generate code from an OpenAPI specification.
     #[clap(name = "from_openapi")]
-    FromOpenApi(cdd_cli::from_openapi::FromOpenApiArgs),
+    FromOpenApi(Box<cdd_cli::from_openapi::FromOpenApiArgs>),
     /// Generate an OpenAPI specification from source code.
     #[clap(name = "to_openapi")]
     ToOpenApi(cdd_cli::to_openapi::ToOpenApiArgs),
     /// Generate code (SDK, CLI, or Server) from an Arazzo 1.1.0 workflow specification.
     #[clap(name = "from_arazzo")]
-    FromArazzo(cdd_cli::from_arazzo::FromArazzoArgs),
+    FromArazzo(Box<cdd_cli::from_arazzo::FromArazzoArgs>),
     /// Extract an Arazzo 1.1.0 workflow specification from Rust source code.
     #[clap(name = "to_arazzo")]
     ToArazzo(cdd_cli::to_arazzo::ToArazzoArgs),
@@ -100,7 +99,7 @@ pub enum Commands {
     TestGen(cdd_cli::test_gen::TestGenArgs),
     /// Generate a JSON Schema from a Rust struct or enum.
     #[clap(name = "schema-gen")]
-    SchemaGen(cdd_cli::schema_gen::SchemaGenArgs),
+    SchemaGen(Box<cdd_cli::schema_gen::SchemaGenArgs>),
 }
 
 /// Dispatches a parsed [`Cli`] command to its underlying implementation.

cli/src/mcp.rs

@@ -313,7 +313,7 @@ pub fn dispatch_tool_command(
             let input_str = args
                 .get("input")
                 .and_then(Value::as_str)
-                .ok_or_else(|| AppError::General("Missing required argument: 'input'".into()))?;
+                .ok_or(AppError::MissingArgument { argument: "input" })?;
             let output_str = args
                 .get("output")
                 .and_then(Value::as_str)
@@ -336,7 +336,7 @@ pub fn dispatch_tool_command(
             let input_str = args
                 .get("input")
                 .and_then(Value::as_str)
-                .ok_or_else(|| AppError::General("Missing required argument: 'input'".into()))?;
+                .ok_or(AppError::MissingArgument { argument: "input" })?;
             let no_imports = args
                 .get("no_imports")
                 .and_then(Value::as_bool)
@@ -377,7 +377,7 @@ pub fn dispatch_tool_command(
                 .get("dir")
                 .or_else(|| args.get("input"))
                 .and_then(Value::as_str)
-                .ok_or_else(|| AppError::General("Missing required argument: 'dir'".into()))?;
+                .ok_or(AppError::MissingArgument { argument: "dir" })?;
             let truth_str = args.get("truth").and_then(Value::as_str).unwrap_or("code");
             let output_str = args
                 .get("output")
@@ -446,7 +446,7 @@ pub fn dispatch_tool_command(
             let input_str = args
                 .get("input")
                 .and_then(Value::as_str)
-                .ok_or_else(|| AppError::General("Missing required argument: 'input'".into()))?;
+                .ok_or(AppError::MissingArgument { argument: "input" })?;
             let output_str = args
                 .get("output")
                 .and_then(Value::as_str)
@@ -473,7 +473,9 @@ pub fn dispatch_tool_command(
                 output_str
             ))
         }
-        _ => Err(AppError::General(format!("Tool not found: {}", tool_name))),
+        _ => Err(AppError::ToolNotFound {
+            tool: tool_name.to_string(),
+        }),
     }
 }
 
@@ -583,23 +585,18 @@ pub fn handle_request(input: &str) -> Option<String> {
                     };
                     ok_response(req.id, &result)
                 }
+                Err(e @ AppError::ToolNotFound { .. }) => {
+                    err_response(req.id, -32601, e.to_string())
+                }
                 Err(e) => {
-                    if call_params.name != "from_openapi"
-                        && call_params.name != "to_openapi"
-                        && call_params.name != "to_docs_json"
-                        && call_params.name != "sync"
-                    {
-                        err_response(req.id, -32601, e.to_string())
-                    } else {
-                        let result = CallToolResult {
-                            content: vec![CallToolResultContent::Text(TextContent {
-                                text: format!("Error executing {}: {}", call_params.name, e),
-                            })],
-                            is_error: Some(true),
-                            meta: None,
-                        };
-                        ok_response(req.id, &result)
-                    }
+                    let result = CallToolResult {
+                        content: vec![CallToolResultContent::Text(TextContent {
+                            text: format!("Error executing {}: {}", call_params.name, e),
+                        })],
+                        is_error: Some(true),
+                        meta: None,
+                    };
+                    ok_response(req.id, &result)
                 }
             }
         }

cli/src/serve_json_rpc.rs

@@ -11,7 +11,7 @@ use crate::mcp::dispatch_tool_command;
 use actix_web::{web, HttpResponse, Responder};
 #[cfg(not(coverage))]
 use actix_web::{App, HttpServer};
-use cdd_core::error::AppResult;
+use cdd_core::error::{AppError, AppResult};
 use clap::Args;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
@@ -102,7 +102,7 @@ async fn handle_rpc(body: String) -> impl Responder {
                 id,
             },
             Err(e) => {
-                let code = if e.to_string().contains("Missing required argument") {
+                let code = if matches!(e, AppError::MissingArgument { .. }) {
                     -32602
                 } else {
                     -32000
@@ -133,7 +133,7 @@ async fn handle_rpc(body: String) -> impl Responder {
                 }
             }
             Err(e) => {
-                let code = if e.to_string().contains("Missing required argument") {
+                let code = if matches!(e, AppError::MissingArgument { .. }) {
                     -32602
                 } else {
                     -32000
@@ -249,8 +249,11 @@ pub struct ServeJsonRpcConfig {
     pub listen: String,
 }
 
-#[allow(dead_code)]
-fn configure_rpc_app(cfg: &mut web::ServiceConfig) {
+/// Configures the Actix Web service routes for the JSON-RPC 2.0 endpoint.
+///
+/// # Arguments
+/// * `cfg` - Mutable Actix [`web::ServiceConfig`] to register routes on.
+pub fn configure_rpc_app(cfg: &mut web::ServiceConfig) {
     cfg.route("/", web::post().to(handle_rpc));
 }
 

cli/src/sync.rs

@@ -64,11 +64,11 @@ pub struct SyncArgs {
     pub force_type: Vec<(String, String)>,
 }
 
-/// Helper to parse "key=value" arguments.
-fn parse_key_val(s: &str) -> Result<(String, String), String> {
-    let pos = s
-        .find('=')
-        .ok_or_else(|| format!("invalid KEY=value: no `=` found in `{}`", s))?;
+/// Helper to parse `"key=value"` arguments.
+fn parse_key_val(s: &str) -> AppResult<(String, String)> {
+    let pos = s.find('=').ok_or_else(|| {
+        AppError::ValidationError(format!("invalid KEY=value: no `=` found in `{}`", s))
+    })?;
     Ok((s[..pos].to_string(), s[pos + 1..].to_string()))
 }
 

core/src/classes/emit.rs

@@ -41,11 +41,13 @@ pub fn make_record_field(
     }
 
     let file = parse.tree();
-    Ok(file
-        .syntax()
+    file.syntax()
         .descendants()
         .find_map(ast::RecordField::cast)
-        .expect("valid wrapper struct contains record field"))
+        .ok_or_else(|| AppError::AstMutationError {
+            target: name.to_string(),
+            reason: format!("Failed to construct AST RecordField from '{raw_field}'"),
+        })
 }
 
 /// Generates a complete Rust source string for multiple Models (Structs or Enums).
@@ -687,5 +689,7 @@ mod tests {
         assert!(multi_code.contains("#[serde(rename = \"CustomEnum\")]"));
         assert!(multi_code.contains("/// Unit variant doc"));
         assert!(multi_code.contains("UnitVar,"));
+
+        assert!(make_record_field("//", "", false, 0).is_err());
     }
 }