cello-framework 1.2.0__tar.gz → 1.2.2__tar.gz

{cello_framework-1.2.0 → cello_framework-1.2.2}/.github/workflows/publish.yml

@@ -165,6 +165,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
+          skip-existing: true
 
   # ============================================================================
   # Publish to Test PyPI (manual trigger)

{cello_framework-1.2.0 → cello_framework-1.2.2}/CLAUDE.md

@@ -4,7 +4,7 @@
 
 **Cello** is an ultra-fast, Rust-powered Python async web framework designed to achieve C-level performance on the hot path while maintaining Python's developer experience. It's the successor to frameworks like FastAPI, Robyn, and Litestar, combining their best features with pure Rust implementation for maximum performance.
 
-**Version:** 1.1.0
+**Version:** 1.2.2
 **License:** MIT
 **Python Requirement:** 3.12+
 **Author:** Jagadeesh Katla
@@ -336,7 +336,7 @@ from cello import App, ProblemDetails
 @app.exception_handler(ValueError)
 def handle_value_error(request, exc):
     return ProblemDetails(
-        type_url="/errors/validation",
+        type_uri="/errors/validation",
         title="Validation Error",
         status=400,
         detail=str(exc),
@@ -346,6 +346,8 @@ def handle_value_error(request, exc):
 
 ## Version History
 
+- **v1.2.2**: Security & bug fixes — CSRF `HttpOnly` on double-submit cookie (critical, broke all AJAX CSRF); all middleware `skip_path` prefix bypass fixed via `path_matches_skip()` helper; `FixedWindowStore` window_start never updated after reset; unused `mut` cleaned in minijinja tests
+- **v1.2.1**: Bug fixes — server port never bound (`pyo3_asyncio` replaced with native `py.allow_threads` + `tokio::block_on`); `ProblemDetails` was missing from Python module export; `And`/`Or` guards now accept both `*args` and list styles; CSRF `HttpOnly` removed from double-submit cookie (JS must read it); `FixedWindowStore` window_start never updated after reset; all middleware `skip_path` used raw `starts_with` allowing prefix bypass; doc corrections (`type_uri` not `type_url`)
 - **v1.2.0**: Bug fixes (shutdown coroutine never awaited, KeyboardInterrupt in shutdown handler, `request.redis` AttributeError); Redis Lua scripting (`eval`, `evalsha`, `script_load`); Rust-native `AsyncClient` backed by `reqwest + Tokio` — GIL never held during HTTP I/O, HTTP/2, gzip, rustls
 - **v1.1.0**: MiniJinja Jinja2-compatible template engine (`MiniJinjaEngine`, `App.enable_templates()`, `App.render()`, `App.render_string()`); minijinja 2 Rust crate; HTML auto-escaping; globals; 47 new tests; 6 examples
 - **v1.0.1**: Cross-platform fixes (Windows multi-worker, signal handling, UNC paths; ARM JSON fallback; Linux-only CPU affinity), async compatibility fixes (handler validation, guards, cache decorator, blueprints), guards and database exports in `__all__`

{cello_framework-1.2.0 → cello_framework-1.2.2}/Cargo.lock

@@ -341,7 +341,7 @@ dependencies = [
 
 [[package]]
 name = "cello-framework"
-version = "1.2.0"
+version = "1.2.2"
 dependencies = [
  "async-graphql",
  "async-graphql-value",

{cello_framework-1.2.0 → cello_framework-1.2.2}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cello-framework"
-version = "1.2.0"
+version = "1.2.2"
 edition = "2021"
 description = "Ultra-fast Rust-powered Python async web framework"
 license = "MIT"

{cello_framework-1.2.0 → cello_framework-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cello-framework
-Version: 1.2.0
+Version: 1.2.2
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{cello_framework-1.2.0 → cello_framework-1.2.2}/docs/features/security/overview.md

@@ -270,8 +270,8 @@ admin_only = RoleGuard(["admin"])
 can_edit = PermissionGuard(["posts:edit"])
 
 # Composable guards
-admin_or_editor = Or(RoleGuard(["admin"]), RoleGuard(["editor"]))
-admin_with_write = And(RoleGuard(["admin"]), PermissionGuard(["write"]))
+admin_or_editor = Or([RoleGuard(["admin"]), RoleGuard(["editor"])])
+admin_with_write = And([RoleGuard(["admin"]), PermissionGuard(["write"])])
 
 @app.get("/admin", guards=[admin_only])
 def admin_panel(request):

{cello_framework-1.2.0 → cello_framework-1.2.2}/docs/learn/guides/error-handling.md

@@ -116,49 +116,32 @@ def handle_unexpected(request, exc):
 ### Using ProblemDetails in Cello
 
 ```python
-from cello import App, Response
+from cello import App, ProblemDetails
 
 app = App()
 
-def problem(type_url: str, title: str, status: int,
-            detail: str = None, instance: str = None, **extra) -> Response:
-    """Helper to build an RFC 7807 response."""
-    body = {"type": type_url, "title": title, "status": status}
-    if detail:
-        body["detail"] = detail
-    if instance:
-        body["instance"] = instance
-    body.update(extra)
-    resp = Response.json(body, status=status)
-    resp.set_header("Content-Type", "application/problem+json")
-    return resp
-```
-
-Use the helper in handlers and exception handlers:
-
-```python
 @app.get("/users/{id}")
 def get_user(request):
     user = find_user(request.params["id"])
     if not user:
-        return problem(
-            type_url="/errors/not-found",
+        return ProblemDetails(
+            type_uri="/errors/not-found",
             title="User Not Found",
             status=404,
             detail=f"No user with ID {request.params['id']}",
             instance=request.path,
-        )
+        ).to_response()
     return user
 
 @app.exception_handler(ValueError)
 def handle_validation(request, exc):
-    return problem(
-        type_url="/errors/validation",
+    return ProblemDetails(
+        type_uri="/errors/validation",
         title="Validation Error",
         status=400,
         detail=str(exc),
         instance=request.path,
-    )
+    ).to_response()
 ```
 
 ---
@@ -213,22 +196,22 @@ class ConflictError(Exception):
 
 @app.exception_handler(NotFoundError)
 def handle_not_found(request, exc):
-    return problem(
-        type_url="/errors/not-found",
+    return ProblemDetails(
+        type_uri="/errors/not-found",
         title=f"{exc.resource} Not Found",
         status=404,
         detail=str(exc),
         instance=request.path,
-    )
+    ).to_response()
 
 @app.exception_handler(ConflictError)
 def handle_conflict(request, exc):
-    return problem(
-        type_url="/errors/conflict",
+    return ProblemDetails(
+        type_uri="/errors/conflict",
         title="Conflict",
         status=409,
         detail=str(exc),
-    )
+    ).to_response()
 ```
 
 Then raise them in handlers:
@@ -253,12 +236,12 @@ from cello.guards import GuardError
 
 @app.exception_handler(GuardError)
 def handle_guard_error(request, exc):
-    return problem(
-        type_url="/errors/access-denied",
+    return ProblemDetails(
+        type_uri="/errors/access-denied",
         title="Access Denied",
         status=exc.status_code,
         detail=exc.message,
-    )
+    ).to_response()
 ```
 
 ---

cello_framework-1.2.2/docs/releases/v1.2.1.md

@@ -0,0 +1,167 @@
+---
+title: v1.2.1 Release Notes
+description: Cello Framework v1.2.1 — Critical Bug Fixes
+tags:
+  - v1.2.1
+  - Release Notes
+  - Bug Fixes
+  - Changelog
+---
+
+# Cello v1.2.1 — Critical Bug Fixes
+
+**Release Date:** June 14, 2026
+**License:** MIT
+**Python:** 3.12+
+
+---
+
+## Overview
+
+Cello v1.2.1 is a patch release fixing critical bugs discovered after v1.2.0: the HTTP server
+never bound its port, `ProblemDetails` was inaccessible from Python, and `And`/`Or` guards
+rejected the `And(g1, g2)` call style. All changes are fully backwards-compatible.
+
+---
+
+## Bug Fixes
+
+### Server Port Never Bound
+
+**Symptom:** `app.run()` started without error but the server never listened on any port —
+`ss -tlnp` showed nothing, all connections were refused.
+
+**Root cause:** `pyo3_asyncio::tokio::run` drives Tokio socket I/O through Python's asyncio
+selector loop. In Python 3.12+ with pyo3 0.20, the two event loops do not integrate correctly:
+the asyncio loop never ticks the Tokio I/O reactor, so `TcpListener::accept()` never resolves
+and the port never appears in the OS socket table.
+
+**Fix:** Replaced `pyo3_asyncio::tokio::run(py, ...)` with `py.allow_threads(|| runtime.block_on(...))`.
+The GIL is released for the duration of the server run; Tokio drives all I/O natively. Python
+handlers re-acquire the GIL individually via `Python::with_gil` when invoked.
+
+```python
+# Before (broken — port never bound)
+app.run(port=8000)   # silently hangs
+
+# After (fixed)
+app.run(port=8000)   # binds and serves immediately
+```
+
+---
+
+### `ProblemDetails` Not Importable
+
+**Symptom:** `from cello import ProblemDetails` raised `ImportError`.
+
+**Root cause:** `ProblemDetails` had `#[pyclass]` in `src/error.rs` but was never registered
+with `m.add_class::<error::ProblemDetails>()` in the PyO3 module, and was missing from
+`python/cello/__init__.py`.
+
+**Fix:** Added to module registration and Python exports.
+
+```python
+# Now works
+from cello import ProblemDetails
+
+@app.exception_handler(ValueError)
+def handle_error(request, exc):
+    return ProblemDetails(
+        type_uri="/errors/validation",
+        title="Validation Error",
+        status=400,
+        detail=str(exc),
+        instance=request.path,
+    ).to_response()
+```
+
+!!! note "Field name is `type_uri`, not `type_url`"
+    The constructor parameter follows the RFC 7807 naming convention.
+    Use `type_uri=`, not `type_url=`.
+
+---
+
+### `And`/`Or` Guards Rejected `*args` Call Style
+
+**Symptom:** `And(guard1, guard2)` raised `TypeError: And.__init__() takes 2 positional arguments but 3 were given`.
+
+**Root cause:** `And` and `Or` only accepted a single list argument.
+
+**Fix:** Both now accept either a list or `*args`.
+
+```python
+# Both styles now work
+admin_and_write = And([RoleGuard(["admin"]), PermissionGuard(["write"])])
+admin_and_write = And(RoleGuard(["admin"]), PermissionGuard(["write"]))
+
+admin_or_editor = Or([RoleGuard(["admin"]), RoleGuard(["editor"])])
+admin_or_editor = Or(RoleGuard(["admin"]), RoleGuard(["editor"]))
+```
+
+---
+
+### CSRF Cookie Readable by JavaScript (Security)
+
+**Symptom:** AJAX/SPA applications using CSRF protection failed all POST/PUT/DELETE requests with 403.
+
+**Root cause:** The CSRF double-submit cookie was set with the `HttpOnly` flag. This prevents
+JavaScript from reading the cookie value, making it impossible for the frontend to copy it into
+the `X-CSRF-Token` header — which is the entire point of the double-submit pattern.
+
+**Fix:** Removed `HttpOnly` from the CSRF cookie. The CSRF cookie is intentionally readable by
+JavaScript; the session cookie (where sensitive data lives) remains `HttpOnly`.
+
+```javascript
+// Now works — JS can read the CSRF cookie and send it back
+const csrf = document.cookie.match(/_csrf=([^;]+)/)?.[1];
+fetch("/api/data", {
+    method: "POST",
+    headers: { "X-CSRF-Token": csrf },
+    body: JSON.stringify(data),
+});
+```
+
+---
+
+### Rate Limiter Fixed-Window Counter Reset (Bug)
+
+**Symptom:** After the first rate-limit window expired, the fixed-window counter reset to zero
+on every single subsequent request, making rate limiting completely ineffective.
+
+**Root cause:** When the time window rolled over, `entry.count` was reset to 0 but
+`entry.window_start` was never updated to the new window. Every request in the new window
+saw `window_start != current_window` and reset the counter again.
+
+**Fix:** Update `entry.window_start = current_window` alongside the count reset.
+
+---
+
+### Auth Skip-Path Prefix Bypass (Security)
+
+**Symptom:** Calling `skip_path("/health")` to exclude the health endpoint from authentication
+also excluded `/healthz`, `/healthy`, and any other path starting with `/health`.
+
+**Root cause:** Path matching used `request.path.starts_with(skip_path)` without checking that
+the following character is `/` or end-of-string.
+
+**Fix:** Path is now only skipped when it equals the pattern exactly or starts with
+`{pattern}/`. Affects `JwtAuth`, `BasicAuth`, `ApiKeyAuth`, `RateLimitMiddleware`,
+`SessionMiddleware`, `CsrfMiddleware`, and `GuardsMiddleware`.
+
+```python
+# Before: /healthz would also be skipped (security bypass)
+jwt.skip_path("/health")
+
+# After: only /health and /health/* are skipped
+jwt.skip_path("/health")
+```
+
+---
+
+## Upgrade
+
+```bash
+pip install --upgrade cello-framework==1.2.1
+```
+
+No API changes — drop-in replacement for v1.2.0.

cello_framework-1.2.2/docs/releases/v1.2.2.md

@@ -0,0 +1,131 @@
+---
+title: v1.2.2 Release Notes
+description: Cello Framework v1.2.2 — Security & Bug Fixes
+tags:
+  - v1.2.2
+  - Release Notes
+  - Security
+  - Bug Fixes
+---
+
+# Cello v1.2.2 — Security & Bug Fixes
+
+**Release Date:** June 14, 2026
+**License:** MIT
+**Python:** 3.12+
+
+---
+
+## Overview
+
+Cello v1.2.2 is a patch release that fixes one critical security bug, one security
+vulnerability, and two correctness bugs discovered during a thorough code review of v1.2.1.
+All changes are fully backwards-compatible.
+
+**Upgrade immediately** if you use CSRF protection or authentication middleware skip-paths.
+
+---
+
+## Security Fixes
+
+### CSRF Double-Submit Cookie Was `HttpOnly` (Critical)
+
+**Symptom:** AJAX applications and SPAs using `CsrfMiddleware` received 403 on every
+POST/PUT/DELETE request, even when the CSRF token was correctly set.
+
+**Root cause:** The CSRF double-submit cookie was set with `HttpOnly`, which prevents
+JavaScript from reading cookie values. The double-submit pattern *requires* JavaScript
+to read the cookie and copy its value into the `X-CSRF-Token` request header. With
+`HttpOnly` set, this was impossible — every state-changing request failed CSRF validation.
+
+**Fix:** Removed `HttpOnly` from the CSRF token cookie. The CSRF cookie is intentionally
+readable by JavaScript (that is the design). Your session cookie, which holds sensitive
+data, remains `HttpOnly`.
+
+```javascript
+// Now works — JavaScript can read the CSRF cookie
+const csrf = document.cookie.match(/_csrf=([^;]+)/)?.[1];
+
+fetch("/api/submit", {
+    method: "POST",
+    headers: { "X-CSRF-Token": csrf, "Content-Type": "application/json" },
+    body: JSON.stringify({ name: "Alice" }),
+});
+```
+
+---
+
+### Auth Middleware `skip_path` Allowed Prefix Bypass (Security)
+
+**Symptom:** Calling `jwt.skip_path("/health")` to exclude the health-check endpoint
+from authentication also excluded `/healthz`, `/healthy`, `/health-admin`, and any
+other path whose string representation started with `/health`.
+
+**Root cause:** All middleware used `request.path.starts_with(skip_path)` with no
+boundary check. An attacker aware of a skipped path could craft a URL that bypasses
+authentication.
+
+**Affected middleware:** `JwtAuth`, `BasicAuth`, `ApiKeyAuth`, `RateLimitMiddleware`,
+`SessionMiddleware`, `CsrfMiddleware`, `GuardsMiddleware`.
+
+**Fix:** Paths are now only skipped when:
+
+- The path **exactly equals** the pattern, or
+- The path **starts with** `{pattern}/` (sub-path match).
+
+```python
+# Before: /healthz was also skipped — security bypass
+jwt_auth.skip_path("/health")
+
+# After: only /health and /health/* are skipped
+jwt_auth.skip_path("/health")
+```
+
+---
+
+## Bug Fixes
+
+### Rate Limiter Fixed-Window Counter Broke After First Window
+
+**Symptom:** After the first time-window expired, the `FixedWindowStore` rate limiter
+stopped enforcing limits entirely — every request was allowed regardless of how many
+had been made.
+
+**Root cause:** When the window rolled over, the per-client entry's `count` was reset
+to 0 but `window_start` was never updated to the new window ID. Every subsequent
+request also saw `window_start != current_window` and reset the counter to 0 again,
+making the limiter permanently ineffective after the first window.
+
+**Fix:** `window_start` is now updated to `current_window` alongside the count reset.
+
+---
+
+### Unused `mut` Warnings in Template Engine Tests
+
+Five test functions in `minijinja_engine.rs` declared `let mut env = Environment::new()`
+where `mut` was not needed (the variable was never mutated after construction). These
+were cleaned up to eliminate Clippy warnings.
+
+---
+
+## Files Changed
+
+| File | Change |
+|------|--------|
+| `src/middleware/csrf.rs` | Remove `HttpOnly` from CSRF cookie |
+| `src/middleware/mod.rs` | Add `path_matches_skip()` shared helper |
+| `src/middleware/auth.rs` | Use `path_matches_skip()` in JWT/Basic/ApiKey |
+| `src/middleware/session.rs` | Use `path_matches_skip()` |
+| `src/middleware/rate_limit.rs` | Use `path_matches_skip()`; fix `window_start` reset |
+| `src/middleware/guards.rs` | Use `path_matches_skip()` |
+| `src/minijinja_engine.rs` | Remove unused `mut` from test bindings |
+
+---
+
+## Upgrade
+
+```bash
+pip install --upgrade cello-framework==1.2.2
+```
+
+Drop-in replacement for v1.2.1. No API changes.

{cello_framework-1.2.0 → cello_framework-1.2.2}/mkdocs.yml

@@ -364,6 +364,8 @@ nav:
 
   - Release Notes:
     - releases/index.md
+    - v1.2.2: releases/v1.2.2.md
+    - v1.2.1: releases/v1.2.1.md
     - v1.2.0: releases/v1.2.0.md
     - v1.1.0: releases/v1.1.0.md
     - v1.0.1: releases/v1.0.1.md

{cello_framework-1.2.0 → cello_framework-1.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "cello-framework"
-version = "1.2.0"
+version = "1.2.2"
 description = "Ultra-fast Rust-powered Python async web framework"
 readme = "README.md"
 license = { text = "MIT" }

{cello_framework-1.2.0 → cello_framework-1.2.2}/python/cello/__init__.py

@@ -143,6 +143,9 @@ from cello._cello import (
     HttpResponse,
 )
 
+# RFC 7807 Problem Details
+from cello._cello import ProblemDetails
+
 def validate_jwt_config(config: JwtConfig) -> JwtConfig:
     """Validate a JwtConfig instance.
 
@@ -285,13 +288,15 @@ __all__ = [
     "EventSourcingConfig",
     "CqrsConfig",
     "SagaConfig",
+    # RFC 7807
+    "ProblemDetails",
     # Config validators
     "validate_jwt_config",
     "validate_session_config",
     "validate_rate_limit_config",
     "validate_tls_config",
 ]
-__version__ = "1.2.0"
+__version__ = "1.2.2"
 
 
 class Blueprint:

{cello_framework-1.2.0 → cello_framework-1.2.2}/python/cello/guards.py

@@ -124,9 +124,12 @@ class Authenticated(Guard):
         return True
 
 class And(Guard):
-    """Pass only if ALL guards pass."""
-    def __init__(self, guards: List[Callable]):
-        self.guards = guards
+    """Pass only if ALL guards pass. Accepts a list or *args: And([g1, g2]) or And(g1, g2)."""
+    def __init__(self, *args):
+        if len(args) == 1 and isinstance(args[0], list):
+            self.guards = args[0]
+        else:
+            self.guards = list(args)
 
     def __call__(self, request: Any):
         for guard in self.guards:
@@ -139,9 +142,12 @@ class And(Guard):
         return True
 
 class Or(Guard):
-    """Pass if ANY guard passes."""
-    def __init__(self, guards: List[Callable]):
-        self.guards = guards
+    """Pass if ANY guard passes. Accepts a list or *args: Or([g1, g2]) or Or(g1, g2)."""
+    def __init__(self, *args):
+        if len(args) == 1 and isinstance(args[0], list):
+            self.guards = args[0]
+        else:
+            self.guards = list(args)
 
     def __call__(self, request: Any):
         last_error = None

{cello_framework-1.2.0 → cello_framework-1.2.2}/src/lib.rs

@@ -754,60 +754,55 @@ def openapi_handler(request):
         let startup_handlers = self.startup_handlers.clone();
         let shutdown_handlers = self.shutdown_handlers.clone();
 
-        // Configure pyo3-asyncio to use a single-threaded Tokio runtime.
+        // Release the GIL and run a native Tokio current-thread runtime.
         //
-        // PERF: current_thread avoids GIL contention — N Tokio threads all competing
-        // for Python::with_gil creates massive serialization overhead. Parallelism comes
-        // from multi-process (fork + SO_REUSEPORT on Unix, subprocess on Windows).
-        //
-        // After this call, asyncio.get_event_loop() inside any Python handler returns the
-        // pyo3-asyncio Tokio-backed loop instead of _UnixSelectorEventLoop, proving that
-        // Python coroutines are now driven by Tokio. The GIL is released during I/O waits
-        // within coroutines — no uvloop needed, no external event loop optimisation.
-        let mut builder = tokio::runtime::Builder::new_current_thread();
-        builder.enable_all();
-        pyo3_asyncio::tokio::init(builder);
-
-        // pyo3_asyncio::tokio::run creates a new Python asyncio event loop backed by
-        // our Tokio runtime, then runs the given future as a coroutine on that loop.
-        // The GIL is managed internally: released when Tokio is waiting, re-acquired
-        // only when Python bytecode needs to execute.
-        pyo3_asyncio::tokio::run(py, async move {
-            let mut config = server::ServerConfig::new(&host_owned, port);
-            config.workers = workers.unwrap_or(0);
-
-            let server = Server::new(
-                config,
-                router,
-                handlers,
-                middleware,
-                websocket_handlers,
-                dependency_container,
-                guards,
-                prometheus,
-            );
-
-            // Startup hooks — driven by Tokio so async def handlers work without asyncio.run()
-            for handler in &startup_handlers {
-                if let Err(e) = run_lifecycle_handler_async(handler.clone()).await {
-                    eprintln!("Error in startup handler: {e}");
-                }
-            }
+        // pyo3_asyncio::tokio::run was previously used here but it drives Tokio I/O
+        // through Python's asyncio selector loop, which breaks socket binding in
+        // environments where the two event loops don't integrate (Python 3.12+ / pyo3 0.20).
+        // Since the server's hot path is pure Rust I/O, we release the GIL with
+        // allow_threads and block on a self-contained Tokio runtime. Python handlers
+        // re-acquire the GIL individually via Python::with_gil when they need it.
+        py.allow_threads(|| {
+            tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .expect("failed to build Tokio runtime")
+                .block_on(async move {
+                    let mut config = server::ServerConfig::new(&host_owned, port);
+                    config.workers = workers.unwrap_or(0);
+
+                    let server = Server::new(
+                        config,
+                        router,
+                        handlers,
+                        middleware,
+                        websocket_handlers,
+                        dependency_container,
+                        guards,
+                        prometheus,
+                    );
+
+                    // Startup hooks
+                    for handler in &startup_handlers {
+                        if let Err(e) = run_lifecycle_handler_async(handler.clone()).await {
+                            eprintln!("Error in startup handler: {e}");
+                        }
+                    }
 
-            let _ = server.run().await;
+                    let _ = server.run().await;
 
-            // Shutdown hooks — KeyboardInterrupt is expected on CTRL+C, suppress it.
-            for handler in &shutdown_handlers {
-                match run_lifecycle_handler_async(handler.clone()).await {
-                    Err(e) if !e.to_string().contains("KeyboardInterrupt") => {
-                        eprintln!("Error in shutdown handler: {e}");
+                    // Shutdown hooks
+                    for handler in &shutdown_handlers {
+                        match run_lifecycle_handler_async(handler.clone()).await {
+                            Err(e) if !e.to_string().contains("KeyboardInterrupt") => {
+                                eprintln!("Error in shutdown handler: {e}");
+                            }
+                            _ => {}
+                        }
                     }
-                    _ => {}
-                }
-            }
-
-            Ok(())
-        })
+                })
+        });
+        Ok(())
     }
 
     /// Internal route registration.
@@ -2112,5 +2107,8 @@ fn _cello(_py: Python<'_>, m: &PyModule) -> PyResult<()> {
     m.add_class::<PyCqrsConfig>()?;
     m.add_class::<PySagaConfig>()?;
 
+    // RFC 7807 error type
+    m.add_class::<error::ProblemDetails>()?;
+
     Ok(())
 }