00.74.10

Latest release — available on Maven Central. A maintenance + DX-tooling release between 00.74.00 (token propagation) and the planned 00.75.00 (Security Event Bus). Additive — every 00.74.00 app compiles and boots identically; no migration.

Release date: 2026-06-12 Previous release: 00.74.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.74.10 Full changelog: GitHub release v00.74.10

It introduces no new security primitive, no new module, no new third-party dependency.

`JSentinelRuntime` tooling API

Build a /health endpoint or a CLI banner without parsing runtime.log():

runtime.summary();      // "OK | 8 services | 0 errors | 1 warnings | 2 INFO"
runtime.healthCheck();  // HealthStatus[overall=DEGRADED, findings=[…], …]
runtime.toJson();       // {"mode":"PRODUCTION","serviceCount":8,…}
runtime.toMap();        // immutable, insertion-order-stable nested map

Four new methods on JSentinelRuntime: summary(), toMap(), toJson(), healthCheck().
Three new records in jSentinel-dx: Health (HEALTHY / DEGRADED / FAILED), HealthFinding(severity, code, message), HealthStatus(overall, findings, registeredServices, inspectedAt). INFO findings do not degrade.
Internal JsonEncoder (RFC-8259, hand-rolled, package-private) — no Jackson, no Gson; a Maven Enforcer rule bans those libraries on jSentinel-dx.

A complete REST /health handler is three lines:

var h = runtime.healthCheck();
resp.setStatusCode(h.hasErrors() ? HttpStatus.SERVICE_UNAVAILABLE : HttpStatus.OK);
resp.setContentType(MediaType.APPLICATION_JSON);
resp.write(runtime.toJson());

All four methods ship @ExperimentalJSentinelApi; promotion is staged for 00.76.

Framework-feedback fixes (`jSentinel-core`)

From real template-integration feedback:

InitialAdminCreationResult.InternalError(String reason, Throwable cause) — the underlying exception is no longer swallowed; InitialAdminBootstrapService now logs WARN with the stacktrace (and adopts HasLogger).
Audit-sink WARN logs in EmailVerificationService and PasswordResetService — best-effort audit failures are now visible (contract unchanged).
PasswordPolicy.minLength() — a default hint method (OptionalInt) so UI helper text reads the real bound instead of duplicating it; MinimumLengthPasswordPolicy overrides it. Every existing policy keeps compiling.

Demos & skills

00.74.10 ships ten skill-rendered demo modules (demo-jsentinel-*, Vaadin / REST / Standalone × base / persistence / hardening + the Vaadin↔REST client) and the matching Claude Code skills.

Quality

No PIT regression — every module ≥ its 00.74.00 score; jSentinel-core stays at 87 %. Some DX-module mutation-coverage lifts are tracked for a follow-up release. Test discipline unchanged: no mocks.

Migration

None. The new JSentinelRuntime methods are pull-API — consumers that don’t call them pay nothing. Just bump the version to 00.74.10.

00.74.00 00.74.20