@velajs/vela 1.8.5 → 1.8.7

package/dist/container/container.js

@@ -401,7 +401,18 @@ const IMPORT_TYPE_HINT = 'Did you use `import type { X }`? TypeScript strips typ
                 m.index,
                 m
             ]));
-        const dependencies = paramTypes.map((paramType, index)=>{
+        // Constructor arity. Normally `design:paramtypes` (emitDecoratorMetadata)
+        // gives the count, but some bundlers — notably esbuild (and therefore
+        // Wrangler) — do not emit it, leaving `paramTypes` empty even when
+        // `@Inject(token)` recorded explicit tokens. Fall back to the highest
+        // `@Inject` index so explicit-token constructors still resolve without
+        // emitted metadata. Slots with neither a param type nor an `@Inject` token
+        // still hit the unresolved-dependency error below.
+        const arity = Math.max(paramTypes.length, injectMetadata.reduce((max, m)=>Math.max(max, m.index + 1), 0));
+        const dependencies = Array.from({
+            length: arity
+        }, (_unused, index)=>{
+            const paramType = paramTypes[index];
             const meta = injectMap.get(index);
             const rawToken = meta?.token;
             const isForwardRef = rawToken instanceof ForwardRef;

package/dist/http/instantiate.js

@@ -1,18 +1,45 @@
+import { getConstructorDependencies, getInjectMetadata } from "../container/decorators.js";
 // Resolve a class/token through the container if registered, otherwise treat
 // the input as a plain instance. Used by RouteManager and HandlerExecutor to
 // materialize middleware, guards, pipes, interceptors, and filters per request.
+//
+// When the input is a class that is NOT registered in the container, we fall
+// back to `new clazz()` so plain parameterless helper classes (e.g. mixin
+// guards, ad-hoc `@UseGuards(LocalGuard)` references) keep working. That
+// fallback is unsafe for classes whose CONSTRUCTOR EXPECTS DEPENDENCIES,
+// because zero-arg construction would leave every injected slot `undefined`
+// — a silent failure mode that surfaces later as
+// `Cannot read properties of undefined (reading '...')` deep inside the
+// class. For those classes we throw a loud, actionable error instead.
+//
+// We treat "expects dependencies" as: any `@Inject(...)` parameter metadata
+// OR a non-empty `design:paramtypes` (the SWC/TS emit for any constructor
+// parameter). `@Injectable()` alone is NOT sufficient — `mixin()` and many
+// parameterless guards are `@Injectable()` and still safe to `new` directly.
 export function instantiate(classOrInstance, container) {
     if (typeof classOrInstance === 'function') {
-        if (container.has(classOrInstance)) {
-            return container.resolve(classOrInstance);
+        const clazz = classOrInstance;
+        if (container.has(clazz)) {
+            return container.resolve(clazz);
         }
-        return new classOrInstance();
+        if (constructorExpectsDependencies(clazz)) {
+            throw new Error(`Cannot instantiate ${clazz.name}: the class declares constructor ` + `dependencies (\`@Inject(...)\` parameters or typed constructor ` + `parameters), but no matching provider is registered in the ` + `container. Add it to a module's providers (and export it if used ` + `outside its declaring module) instead of relying on the bare ` + `\`new\` fallback, which would construct the class without ` + `honouring its dependency-injection metadata and leave every ` + `injected field \`undefined\`.`);
+        }
+        return new clazz();
     }
     if (container.has(classOrInstance)) {
         return container.resolve(classOrInstance);
     }
     return classOrInstance;
 }
+// True when calling `new clazz()` would leave an injected slot `undefined`:
+// either the class has explicit `@Inject(...)` metadata, or it has any typed
+// constructor parameter (TS/SWC's `design:paramtypes` emit). Parameterless
+// `@Injectable()` classes return false — `new()` is safe for them.
+function constructorExpectsDependencies(clazz) {
+    if (getInjectMetadata(clazz).length > 0) return true;
+    return getConstructorDependencies(clazz).length > 0;
+}
 export function instantiateMany(items, container) {
     return items.map((item)=>instantiate(item, container));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velajs/vela",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "description": "NestJS-compatible framework for edge runtimes, powered by Hono",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,6 +29,14 @@
     "LICENSE",
     "CHANGELOG.md"
   ],
+  "scripts": {
+    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
+    "test": "vitest run",
+    "test:workers": "vitest run --config vitest.config.workers.ts",
+    "typecheck": "tsc --noEmit",
+    "prepare": "swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
+    "prepublishOnly": "pnpm run typecheck && pnpm test"
+  },
   "sideEffects": [
     "./dist/index.js"
   ],
@@ -58,24 +66,26 @@
     "node": ">=20"
   },
   "dependencies": {
-    "hono": "^4"
+    "hono": "^4.12.26"
+  },
+  "packageManager": "pnpm@10.20.0",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild",
+      "workerd"
+    ]
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.15.2",
-    "@swc/cli": "^0.8.0",
-    "@swc/core": "^1.15.11",
+    "@cloudflare/vitest-pool-workers": "^0.16.18",
+    "@swc/cli": "^0.8.1",
+    "@swc/core": "^1.15.41",
     "@types/bun": "latest",
-    "@vitest/runner": "^4.1.5",
-    "@vitest/snapshot": "^4.1.5",
-    "typescript": "^5",
+    "@vitest/runner": "^4.1.9",
+    "@vitest/snapshot": "^4.1.9",
+    "typescript": "^6.0.3",
     "unplugin-swc": "^1.5.9",
-    "vitest": "^4.1.5",
-    "zod": "^4.3.6"
-  },
-  "scripts": {
-    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
-    "test": "vitest run",
-    "test:workers": "vitest run --config vitest.config.workers.ts",
-    "typecheck": "tsc --noEmit"
+    "vitest": "^4.1.9",
+    "zod": "^4.4.3"
   }
-}
+}