koatty 4.2.0 → 4.3.0

package/.turbo/turbo-build.log

@@ -1,100 +1,99 @@
-
-
-> koatty@4.2.0 build /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
-> pnpm run build:js && pnpm run build:dts && pnpm run build:doc && pnpm run build:cp
-
-
-> koatty@4.2.0 build:js /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
-> tsup
-
-CLI Building entry: src/index.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Using tsup config: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/tsup.config.ts
-CLI Target: node18
-CLI Cleaning output folder
-CJS Build start
-ESM Build start
-ESM dist/index.mjs     27.66 KB
-ESM dist/index.mjs.map 65.74 KB
-ESM ⚡️ Build success in 84ms
-CJS dist/index.js     31.62 KB
-CJS dist/index.js.map 65.89 KB
-CJS ⚡️ Build success in 85ms
-
-> koatty@4.2.0 build:dts /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
-> bash scripts/build-dts.sh
-
-🔨 Building type declarations for koatty...
-⏳ Waiting for dependencies to be ready...
-
-🔍 Checking dependencies: koatty_config, koatty_container, koatty_core, koatty_exception, koatty_lib, koatty_loader, koatty_logger, koatty_router, koatty_serve, koatty_trace, koatty_validation
-  ✓ koatty_config type declarations ready
-  ✓ koatty_container type declarations ready
-  ✓ koatty_core type declarations ready
-  ✓ koatty_exception type declarations ready
-  ✓ koatty_lib type declarations ready
-  ✓ koatty_loader type declarations ready
-  ✓ koatty_logger type declarations ready
-  ✓ koatty_router type declarations ready
-  ✓ koatty_serve type declarations ready
-  ✓ koatty_trace type declarations ready
-  ✓ koatty_validation type declarations ready
-
-✅ All dependencies ready (waited 1ms)
-📝 Running TypeScript compiler...
-⠙📦 Running API Extractor...
-
-api-extractor 7.55.2  - https://api-extractor.com/
-
-Using configuration from ./api-extractor.json
-Analysis will use the bundled TypeScript version 5.8.2
-*** The target project appears to use TypeScript 5.9.3 which is newer than the bundled compiler engine; consider upgrading API Extractor.
-Writing: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/temp/koatty.api.json
-Writing package typings: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/dist/index.d.ts
-Warning: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty-core/dist/index.d.ts:899:4 - (tsdoc-undefined-tag) The TSDoc tag "@interface" is not defined in this configuration
-Warning: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty-core/dist/index.d.ts:900:4 - (tsdoc-undefined-tag) The TSDoc tag "@extends" is not defined in this configuration
-Warning: src/core/Bootstrap.ts:21:4 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
-Warning: src/core/Bootstrap.ts:30:1 - (ae-missing-release-tag) "ExecBootStrap" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-Warning: src/core/Bootstrap.ts:140:64 - (tsdoc-characters-after-block-tag) The token "@Bootstrap" looks like a TSDoc tag but contains an invalid character "("; if it is not a tag, use a backslash to escape the "@"
-Warning: src/core/Bootstrap.ts:165:1 - (ae-missing-release-tag) "createApplication" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-Warning: src/core/Decorator.ts:17:4 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
-Warning: src/core/Decorator.ts:29:1 - (ae-missing-release-tag) "Bootstrap" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-Warning: src/core/Decorator.ts:43:31 - (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
-Warning: src/core/Decorator.ts:43:11 - (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
-Warning: src/core/Decorator.ts:44:28 - (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
-Warning: src/core/Decorator.ts:44:13 - (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
-Warning: src/core/Decorator.ts:45:18 - (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
-Warning: src/core/Decorator.ts:45:12 - (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
-Warning: src/core/Decorator.ts:54:1 - (ae-missing-release-tag) "ComponentScan" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-Warning: src/core/Decorator.ts:79:1 - (ae-missing-release-tag) "ConfigurationScan" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-
-API Extractor completed successfully
-⠙✅ Type declarations built successfully
-
-> koatty@4.2.0 build:doc /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
-> api-documenter markdown --input temp --output docs/api
-
-
-api-documenter 7.28.2  - https://api-extractor.com/
-
-Reading koatty.api.json
-
-Deleting old output from docs/api
-Writing koatty package
-
-> koatty@4.2.0 build:cp /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
-> node scripts/copyFiles && node ../../scripts/postBuild.js
-
-Copied package.json to dist/
-Copied LICENSE to dist/
-Copied README.md to dist/
-File copy completed
-📦 postBuild: koatty
-  ✓ Copied package.json to dist/
-  ✓ Copied LICENSE to dist/
-  ✓ Copied README.md to dist/
-  ✓ Fixed paths in dist/package.json
-  ✓ Cleaned DTS declarations
-  ✅ Done
-
+
+> koatty@4.3.0 build /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
+> pnpm run build:js && pnpm run build:dts && pnpm run build:doc && pnpm run build:cp
+
+
+> koatty@4.3.0 build:js /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
+> tsup
+
+CLI Building entry: src/index.ts
+CLI Using tsconfig: tsconfig.json
+CLI tsup v8.5.1
+CLI Using tsup config: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/tsup.config.ts
+CLI Target: node18
+CLI Cleaning output folder
+CJS Build start
+ESM Build start
+CJS dist/index.js     31.81 KB
+CJS dist/index.js.map 66.93 KB
+CJS ⚡️ Build success in 86ms
+ESM dist/index.mjs     27.83 KB
+ESM dist/index.mjs.map 66.78 KB
+ESM ⚡️ Build success in 86ms
+
+> koatty@4.3.0 build:dts /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
+> bash scripts/build-dts.sh
+
+🔨 Building type declarations for koatty...
+⏳ Waiting for dependencies to be ready...
+
+🔍 Checking dependencies: koatty_config, koatty_container, koatty_core, koatty_exception, koatty_lib, koatty_loader, koatty_logger, koatty_router, koatty_serve, koatty_trace, koatty_validation
+  ✓ koatty_config type declarations ready
+  ✓ koatty_container type declarations ready
+  ✓ koatty_core type declarations ready
+  ✓ koatty_exception type declarations ready
+  ✓ koatty_lib type declarations ready
+  ✓ koatty_loader type declarations ready
+  ✓ koatty_logger type declarations ready
+  ✓ koatty_router type declarations ready
+  ✓ koatty_serve type declarations ready
+  ✓ koatty_trace type declarations ready
+  ✓ koatty_validation type declarations ready
+
+✅ All dependencies ready (waited 0ms)
+📝 Running TypeScript compiler...
+📦 Running API Extractor...
+
+api-extractor 7.55.2  - https://api-extractor.com/
+
+Using configuration from ./api-extractor.json
+Analysis will use the bundled TypeScript version 5.8.2
+*** The target project appears to use TypeScript 5.9.3 which is newer than the bundled compiler engine; consider upgrading API Extractor.
+Writing: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/temp/koatty.api.json
+Writing package typings: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty/dist/index.d.ts
+Warning: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty-core/dist/index.d.ts:917:4 - (tsdoc-undefined-tag) The TSDoc tag "@interface" is not defined in this configuration
+Warning: /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty-core/dist/index.d.ts:918:4 - (tsdoc-undefined-tag) The TSDoc tag "@extends" is not defined in this configuration
+Warning: src/core/Bootstrap.ts:21:4 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
+Warning: src/core/Bootstrap.ts:30:1 - (ae-missing-release-tag) "ExecBootStrap" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+Warning: src/core/Bootstrap.ts:148:64 - (tsdoc-characters-after-block-tag) The token "@Bootstrap" looks like a TSDoc tag but contains an invalid character "("; if it is not a tag, use a backslash to escape the "@"
+Warning: src/core/Bootstrap.ts:173:1 - (ae-missing-release-tag) "createApplication" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+Warning: src/core/Decorator.ts:18:4 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
+Warning: src/core/Decorator.ts:30:1 - (ae-missing-release-tag) "Bootstrap" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+Warning: src/core/Decorator.ts:50:31 - (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
+Warning: src/core/Decorator.ts:50:11 - (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
+Warning: src/core/Decorator.ts:51:28 - (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
+Warning: src/core/Decorator.ts:51:13 - (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
+Warning: src/core/Decorator.ts:52:18 - (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
+Warning: src/core/Decorator.ts:52:12 - (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
+Warning: src/core/Decorator.ts:61:1 - (ae-missing-release-tag) "ComponentScan" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+Warning: src/core/Decorator.ts:86:1 - (ae-missing-release-tag) "ConfigurationScan" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+
+API Extractor completed successfully
+✅ Type declarations built successfully
+
+> koatty@4.3.0 build:doc /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
+> api-documenter markdown --input temp --output docs/api
+
+
+api-documenter 7.28.2  - https://api-extractor.com/
+
+Reading koatty.api.json
+
+Deleting old output from docs/api
+Writing koatty package
+
+> koatty@4.3.0 build:cp /Volumes/ExternalSSD/Users/richen/Workspace/nodejs/koatty-monorepo/packages/koatty
+> node scripts/copyFiles && node ../../scripts/postBuild.js
+
+Copied package.json to dist/
+Copied LICENSE to dist/
+Copied README.md to dist/
+File copy completed
+📦 postBuild: koatty
+  ✓ Copied package.json to dist/
+  ✓ Copied LICENSE to dist/
+  ✓ Copied README.md to dist/
+  ✓ Fixed paths in dist/package.json
+  ✓ Cleaned DTS declarations
+  ✅ Done
+

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # koatty
 
+## 4.3.0
+
+### Minor Changes
+
+- Phase B security hardening (koatty-hardening-and-ai-evolution-plan.md, ADR-101/102/103). Fail-closed defaults with a `security.legacyDefaults: true` rollback switch; see docs/migration/4.3.0.md for the full migration guide.
+
+  Highlights:
+
+  - SecurityProfile (strict/standard/development) exposed read-only as `app.security`, with a startup summary and per-item WARN when rolling back
+  - body parsing failures return 400/413/415 instead of silently producing `{}`; body size limit follows the security profile (1mb in production)
+  - DTO validation whitelist on by default (strict profile rejects unknown fields); `__proto__`/`constructor` keys never reach DTO instances
+  - AOP aspect failures abort the business method unless opted out via `{ onError: 'log' }` or `app.security.aop.onAspectError`
+  - After/AfterEach aspects receive the business result via `options.result`
+  - GraphQL: profile-driven playground/introspection/depth limits, built-in depth rule, optional complexity package fails startup when configured but missing, CDN-free GraphiQL
+  - uploads: profile-driven maxFiles/maxFields/maxFieldsSize, keepExtensions defaults off, array-aware temp cleanup, new `safeFilename` export
+  - ops endpoints: minimal liveness body, /ready 503 while draining, /metrics behind the exposeMetrics policy (loopback/RFC1918/allowCidrs/token), Prometheus bound to 127.0.0.1, rateLimit middleware wired (default off)
+  - request IDs validated (`[A-Za-z0-9._:-]{1,128}`), query fallback disabled, structured access logs, topology service header opt-in
+  - WebSocket: profile maxPayload, perMessageDeflate off, Origin check, connection limits, error-message redaction, slow-consumer guard, timer cleanup on destroy
+  - TLS minVersion TLSv1.2 by default; TypeORM production logs errors only with sensitive-parameter redaction; Swagger disabled in production by default
+  - defect fixes: escapeHtml (&-escaping, valid entities), ReDoS-safe isNumberString, plugin run() executes once, bootstrap failures propagate, Redis default port 6379, gRPC ListServices, koatty_cli bin (CJS build), RedLocker.resetInstance, config() write loss, CLI sandbox + `apply` dry-run by default
+
+### Patch Changes
+
+- Updated dependencies
+  - koatty_core@2.3.0
+  - koatty_router@2.3.0
+  - koatty_serve@3.3.0
+  - koatty_trace@2.3.0
+  - koatty_config@1.4.0
+  - koatty_container@3.0.0
+  - koatty_lib@1.6.0
+  - koatty_exception@2.2.1
+  - koatty_loader@2.0.0
+  - koatty_logger@3.0.0
+
 ## 4.2.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /*!
 * @Author: richen
-* @Date: 2026-04-24 16:20:43
+* @Date: 2026-09-27 22:09:07
 * @License: BSD (3-Clause)
 * @Copyright (c) - <richenlin(at)gmail.com>
 * @HomePage: https://koatty.org/

package/dist/index.js

@@ -34,7 +34,7 @@ var path__namespace = /*#__PURE__*/_interopNamespace(path);
 
 /*!
 * @Author: richen
-* @Date: 2026-04-24 08:20:40
+* @Date: 2026-09-27 14:09:05
 * @License: BSD (3-Clause)
 * @Copyright (c) - <richenlin(at)gmail.com>
 * @HomePage: https://koatty.org/
@@ -51,7 +51,7 @@ var require_package = __commonJS({
   "package.json"(exports$1, module) {
     module.exports = {
       name: "koatty",
-      version: "4.2.0",
+      version: "4.3.0",
       description: "Koa + Typescript = koatty. Use Typescript's decorator implement auto injection.",
       scripts: {
         build: "pnpm run build:js && pnpm run build:dts && pnpm run build:doc && pnpm run build:cp",
@@ -764,7 +764,11 @@ var executeBootstrap = /* @__PURE__ */ __name(async function(target, bootFunc, i
     }
     return app;
   } catch (err) {
+    if (checkUTRuntime() || isInitiative) {
+      throw err;
+    }
     koatty_logger.DefaultLogger.Fatal(err);
+    process.exitCode = 1;
   }
 }, "executeBootstrap");
 async function createApplication(target, bootFunc) {
@@ -793,7 +797,10 @@ function Bootstrap(bootFunc) {
       throw new Error(`class does not inherit from Koatty`);
     }
     koatty_container.IOC.saveClass("COMPONENT", target, "KOATTY_APP");
-    ExecBootStrap(bootFunc)(target);
+    ExecBootStrap(bootFunc)(target).catch((err) => {
+      koatty_logger.DefaultLogger.Fatal(err);
+      process.exitCode = 1;
+    });
   }, "class");
 }
 __name(Bootstrap, "Bootstrap");