meocord 3.2.1 → 4.0.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,69 @@
+# meocord
+
+## 4.0.0-beta.0
+
+### Major Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Build with [Rsbuild](https://rsbuild.rs) instead of webpack. Production builds are several times
+  faster, and webpack and its four loader and plugin packages are no longer installed with MeoCord.
+  The output is unchanged: `dist/main.js`, assets under `dist/assets/` with the same names, and the
+  same source maps.
+
+  **Breaking:** the `webpack` hook in `meocord.config.ts` is replaced by `rsbuild`, which receives
+  Rsbuild's configuration. A config that still declares `webpack` stops the build with a message
+  saying so. `MeoCordWebpackConfig` is removed; import `RsbuildConfig` from `meocord/interface`
+  instead. The [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#2-replace-the-webpack-hook-with-rsbuild) shows where each
+  webpack setting goes.
+
+- [#19](https://github.com/l7aromeo/meocord/pull/19) [`204c7be`](https://github.com/l7aromeo/meocord/commit/204c7bec74886c931732cb771d9178b47fbec5e8) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Require dotenv 18. The `dotenv` peer dependency moves from `^17.4.2` to `^18.0.3`, so install
+  `dotenv@18` alongside MeoCord 4. No application code changes — `import 'dotenv/config'` behaves
+  the same. See the [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#1-upgrade-dotenv-to-18).
+
+### Minor Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Add `bundleDependencies`, which puts everything a bot needs inside `dist`, so it deploys without
+  `node_modules` or an install step. Plain JavaScript dependencies are bundled into `main.js`. Native
+  addons such as `sharp` are found while building and copied, with their platform binary, into
+  `dist/node_modules` — nothing has to be listed.
+
+  A build carrying native addons records its platform in `dist/meocord.platform.json`, and a bot
+  started on another platform stops before going online with a message naming both. Build on the
+  platform you deploy to. See
+  [Self-contained builds](https://github.com/l7aromeo/meocord#self-contained-builds).
+
+### Patch Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Read `meocord.config.ts` on every build. `meocord build` read the compiled `dist/meocord.config.mjs`
+  left by the previous build, so a config edit took effect one build late, and the watcher's reload
+  on a config change reloaded nothing.
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Start the bot with `bun --no-install` from `meocord start`. Without it, bun downloads any package it
+  cannot find while the bot runs, which a bot deployed without `node_modules` would do in
+  production. If you start `dist/main.js` with bun yourself, pass the flag too.
+
+- [#25](https://github.com/l7aromeo/meocord/pull/25) [`2179f85`](https://github.com/l7aromeo/meocord/commit/2179f85c2912d45e3fefbf996ca267c19a1a773c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Stop `meocord generate` overwriting files. Slash, context-menu and primary entry point controllers
+  all wrote one shared `builders/sample.builder.ts`, so generating a second controller replaced a
+  builder you had already edited. Each controller now gets its own `builders/<name>.builder.ts`
+  exporting `<Name>CommandBuilder`, and registers a command named after it — `admin/ban` registers
+  `admin-ban` — rather than every one registering `sample-slash`. Generating a controller, service or
+  guard refuses if any file it would write already exists.
+
+- [#24](https://github.com/l7aromeo/meocord/pull/24) [`5e2a54b`](https://github.com/l7aromeo/meocord/commit/5e2a54b67a1f9f51c4c3a3e8cf51247de2ac2528) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Type `deleted` on `createMockMessage()`. The mock tracks and documents it, but it was missing from
+  the type, so `message.deleted` did not compile.
+
+- [#24](https://github.com/l7aromeo/meocord/pull/24) [`5e2a54b`](https://github.com/l7aromeo/meocord/commit/5e2a54b67a1f9f51c4c3a3e8cf51247de2ac2528) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Accept slash command builders that add options. `@CommandBuilder(CommandType.SLASH)` rejected
+  `new SlashCommandBuilder().addStringOption(...)`, whose type narrows to
+  `SlashCommandOptionsOnlyBuilder`, so the most common builder — one command with an option — did
+  not compile.
+
+- [#21](https://github.com/l7aromeo/meocord/pull/21) [`bebf116`](https://github.com/l7aromeo/meocord/commit/bebf1168466595546017a317b62acd3707ff2d1c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Generate applications with current test tooling: vitest and `@vitest/coverage-istanbul` 5,
+  `unplugin-swc` 2, and current eslint, prettier and typescript-eslint. A new application's
+  `test:coverage` no longer fails on its decorated entry files.
+
+## 3.2.2
+
+### Patch Changes
+
+- [#13](https://github.com/l7aromeo/meocord/pull/13) [`f8a6b15`](https://github.com/l7aromeo/meocord/commit/f8a6b156e8d22abf88443ba77c605d6d47991ab4) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Update the shipped dependencies — `@clack/prompts` 1.8.0, `@swc/core` 1.16.2, and `webpack`
+  5.110.3 — and state the copyright as `2025-present`, including in the notice the CLI prints
+  under `--license` and in its help banner.

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Ukasyah Rahmatullah Zada
+Copyright (c) 2025-present Ukasyah Rahmatullah Zada
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,7 +1,14 @@
 # MeoCord Framework
 
+[![npm version](https://img.shields.io/npm/v/meocord.svg)](https://www.npmjs.com/package/meocord)
+[![CI](https://github.com/l7aromeo/meocord/actions/workflows/release.yml/badge.svg?branch=main)](https://github.com/l7aromeo/meocord/actions/workflows/release.yml)
+[![node](https://img.shields.io/node/v/meocord)](https://www.npmjs.com/package/meocord)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+
 **MeoCord** is a decorator-based Discord bot framework built on top of discord.js. It brings a NestJS-style architecture — controllers, services, guards, and dependency injection — to bot development, with a full CLI, TypeScript-first design, and testing utilities included out of the box.
 
+> **Upgrading from 3.x?** Follow the [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md).
+
 ---
 
 ## Table of Contents
@@ -35,10 +42,10 @@
 - **Decorator-based controllers** — Handle every Discord interaction type — slash commands and their subcommands, autocomplete, buttons, modals, all five select menus, context menus, activity entry points, messages, and reactions — with `@Command`, `@Autocomplete`, `@Controller`, and `@UseGuard` decorators. No routing boilerplate.
 - **Dependency injection** — Built on Inversify. Services are wired into controllers automatically; no manual instantiation or service locators.
 - **Guard system** — Pre-execution hooks for auth, rate limiting, metrics, and anything else. Apply per-method or per-class with `@UseGuard`. Guards receive the full interaction context.
-- **Full CLI** — `meocord create`, `build`, `start`, `generate`. Scaffolds controllers, services, and guards; handles Webpack builds for both development and production.
+- **Full CLI** — `meocord create`, `build`, `start`, `generate`. Scaffolds controllers, services, and guards; builds with Rsbuild for both development and production.
 - **Testing utilities** — `MeoCordTestingModule`, `createMockInteraction`, `createMockMessage`, `createMockUser`, `createMockClient`, `createMockGuild`, `createMockChannel`, `createChatInputOptions`, and `overrideGuard` let you test controllers against real guard logic without a Discord connection. Type guards and reply state machines work out of the box.
 - **TypeScript-first** — Strict types throughout. Decorator metadata, `DeepMocked<T>` for test mocks, and typed config interfaces included.
-- **Extensible build** — Expose a Webpack config hook in `meocord.config.ts` to add rules, plugins, or loaders without ejecting.
+- **Extensible build** — An Rsbuild config hook in `meocord.config.ts` to adjust the build without ejecting, and an option to bundle dependencies so production runs without `node_modules`.
 
 ---
 
@@ -47,8 +54,9 @@
 ### Prerequisites
 
 - **Runtime**: Node.js 22 or newer, or Bun 1.x+
-- **TypeScript**: 5.0+
+- **TypeScript**: 5.0+ with `skipLibCheck` enabled, as generated apps have it; 5.8+ with it off
 - **Package manager**: npm, yarn, pnpm, or bun
+- **Peer dependencies**: `discord.js` 14 and `dotenv` 18 — `meocord create` installs both
 
 MeoCord ships dual ESM/CJS builds. New projects generated by the CLI are preconfigured for ESM.
 
@@ -152,6 +160,9 @@ export class App {}
 
 ## Project Structure
 
+<details>
+<summary><b>The generated file tree</b></summary>
+
 ```
 .
 ├── README.md
@@ -200,13 +211,15 @@ export class App {}
         └── sample.service.spec.ts
 ```
 
+</details>
+
 ---
 
 ## Configuration
 
 ### `meocord.config.ts`
 
-The top-level config file. At minimum it needs `discordToken`. The `webpack` hook lets you extend the build without ejecting.
+The top-level config file. At minimum it needs `discordToken`. The `rsbuild` hook lets you adjust the build without ejecting.
 
 ```typescript
 import { type MeoCordConfig } from 'meocord/interface'
@@ -214,15 +227,50 @@ import { type MeoCordConfig } from 'meocord/interface'
 export default {
   appName: 'MyBot',
   discordToken: process.env.TOKEN!,
-  webpack: config => {
-    config.module.rules?.push({
-      // add custom rules here
-    })
+  rsbuild: config => {
+    // Import .md and .html files as their text.
+    config.tools ??= {}
+    config.tools.rspack = (_rspackConfig, { addRules }) => {
+      addRules([{ test: /\.(md|html)$/i, type: 'asset/source' }])
+    }
     return config
   },
 } satisfies MeoCordConfig
 ```
 
+MeoCord builds with [Rsbuild](https://rsbuild.rs). The hook receives its configuration and returns it, modified. A few things it handles for you, so you do not need rules for them:
+
+- **Images, fonts, svg and media** are emitted to `dist/assets/`, and importing one gives you its absolute path on disk — ready for `fs`, canvas, or a Discord attachment. Nothing is ever inlined as a data URI, whatever its size.
+- **Custom asset paths** — `output.filename.image` (and `svg`, `font`, `media`) accept a function, for when two files share a name in different folders:
+
+  ```typescript
+  import path from 'node:path'
+
+  // ...
+  rsbuild: config => {
+    config.output ??= {}
+    config.output.filename = {
+      ...config.output.filename,
+      // Keep the folder a file came from, so image/star.webp and image/hsr/star.webp do not collide.
+      // The result is relative to dist/assets/, and uses / on every platform.
+      image: ({ filename }) => path.relative('src/assets', filename ?? '').split(path.sep).join('/'),
+    }
+    return config
+  },
+  ```
+
+- **Raw bundler rules** go through `tools.rspack`, which takes a webpack-shaped configuration.
+
+| Option               | Default | Description                                                                                            |
+| -------------------- | ------- | ------------------------------------------------------------------------------------------------------ |
+| `discordToken`       | —       | The bot token. Read it from the environment rather than writing it here.                               |
+| `appName`            | —       | Shown in log lines.                                                                                    |
+| `rsbuild`            | —       | `(config) => config` — adjust the Rsbuild configuration.                                               |
+| `bundleDependencies` | `false` | Put everything the bot needs inside `dist`, native addons included, so it runs without `node_modules`. |
+| `externals`          | `[]`    | Modules to keep out of the bundle. Native addons are found without being listed.                       |
+
+See [Self-contained builds](#self-contained-builds) for when to turn on `bundleDependencies`.
+
 ### ESLint
 
 MeoCord exports a base ESLint config from `meocord/eslint`. Extend it as needed:
@@ -258,7 +306,7 @@ npx meocord --help
 | Command    | Alias | Description                            |
 | ---------- | ----- | -------------------------------------- |
 | `create`   | —     | Scaffold a new MeoCord application     |
-| `build`    | —     | Compile the application via Webpack    |
+| `build`    | —     | Compile the application via Rsbuild    |
 | `start`    | —     | Start the application                  |
 | `generate` | `g`   | Scaffold controllers, services, guards |
 | `show`     | —     | Display framework info                 |
@@ -307,11 +355,15 @@ Each one lands in its own directory, named after the type:
 src/controllers/<type>/
 ├── <name>.<type>.controller.ts
 ├── <name>.<type>.controller.spec.ts
-└── builders/sample.builder.ts     # slash, context-menu and primary-entry-point only
+└── builders/<name>.builder.ts     # slash, context-menu and primary-entry-point only
 ```
 
 A builder is generated only for the three types Discord registers by name. Everything else is addressed by `customId` or, for autocomplete, by the command path it completes — there is nothing to register.
 
+Each controller gets its own builder, `<Name>CommandBuilder`, and registers a command named after it: `npx meocord g co slash Greeting` registers `/greeting`. A nested name uses its whole path, so `admin/ban` registers `/admin-ban` — Discord command names are global to the application, while folders only keep files apart. An autocomplete controller completes the slash command of the same name.
+
+Generating never overwrites. If any file it would write already exists, it refuses, names the files, and writes nothing.
+
 `<name>` may contain `/` to nest: `npx meocord g co button "admin/ban"` writes into `src/controllers/button/admin/`.
 
 Directory layout is organisational only. Controllers are wired up by the `controllers` array on `@MeoCord()`, not by where they sit on disk.
@@ -405,7 +457,8 @@ preceded and followed by "/" or by the ends of the pattern. Write "a/{uuid}" rat
 than "a-{uuid}".
 ```
 
-### Why the rule exists
+<details>
+<summary><b>Why the rule exists</b></summary>
 
 A parameter matches anything up to the next `/`, so an identifier you do not control is captured whole — a hyphen inside a uuid is data, not structure:
 
@@ -425,7 +478,10 @@ Segment counts then keep neighbours apart on their own:
 
 Each id matches exactly one of them.
 
-### Overlapping patterns
+</details>
+
+<details>
+<summary><b>Overlapping patterns</b></summary>
 
 Two patterns with the same segment count can still both match. The one spelling out more literal text wins, so declaration order and file layout never decide it:
 
@@ -438,7 +494,10 @@ Ties between equally literal patterns go to the one with fewer parameters. The r
 
 Where two patterns trade a literal for a parameter in opposite positions — `a/{x}/c` and `a/b/{y}` both take `a/b/c` — neither is more literal, and MeoCord logs a warning at startup naming the pair.
 
-### When nothing matches
+</details>
+
+<details>
+<summary><b>When nothing matches</b></summary>
 
 An unroutable interaction replies "Command not found!" to the user and logs a warning naming the `customId` or command that failed to match. If a control appears dead, that log line is the first place to look.
 
@@ -446,12 +505,17 @@ Autocomplete cannot be replied to, so an unclaimed option is answered with an em
 
 A handler that throws is logged and gets the same treatment — except when it had already replied or deferred, in which case MeoCord leaves the response alone rather than sending a second one Discord would reject.
 
-### Failures never take the bot down
+</details>
+
+<details>
+<summary><b>Failures never take the bot down</b></summary>
 
 discord.js calls event listeners without awaiting them, so anything that rejects out of one is an unhandled rejection — which terminates the process by default. MeoCord wraps every listener it registers, so one bad interaction, one unresolvable controller, or one reaction on a deleted message costs that event and nothing else. The error is logged against the event that produced it, so a genuine misconfiguration still shows up on the first interaction rather than staying hidden.
 
 Where the failure happened before the handler ran, the user is still told: a command interaction gets the error reply, an autocomplete gets its window closed. A reaction whose message can no longer be fetched — deleted, or in a channel the bot lost access to — is skipped quietly, since that is an ordinary outcome rather than a fault.
 
+</details>
+
 ---
 
 ## Subcommands
@@ -642,7 +706,8 @@ const module = MeoCordTestingModule.create({
 const controller = module.get(GreetingSlashController)
 ```
 
-### `createMockInteraction`
+<details>
+<summary><b><code>createMockInteraction</code></b></summary>
 
 Creates a smart mock instance of any discord.js class. The full prototype chain is preserved so `instanceof` checks pass at every level.
 
@@ -713,7 +778,10 @@ const contextMenu = createMockInteraction(UserContextMenuCommandInteraction, {
 
 The override record is typed as `MockProps<T>`, exported from `meocord/testing`. Every key is optional, and a misspelled property name is a compile error.
 
-### `createChatInputOptions`
+</details>
+
+<details>
+<summary><b><code>createChatInputOptions</code></b></summary>
 
 Builds a typed options resolver from a plain record. Type routing mirrors the real `CommandInteractionOptionResolver`: wrong-type access returns `null`, `required=true` throws if the option is absent.
 
@@ -764,7 +832,10 @@ Omit it and `getFocused` throws, the same as the real resolver does when no opti
 
 All methods are mock functions — override any per test with `.mockReturnValue()`.
 
-### `createMockUser` / `createMockClient` / `createMockGuild` / `createMockChannel`
+</details>
+
+<details>
+<summary><b><code>createMockUser</code> / <code>createMockClient</code> / <code>createMockGuild</code> / <code>createMockChannel</code></b></summary>
 
 Convenience wrappers for common discord.js classes. All methods are auto-stubbed as mock functions. Nested managers (`client.users`, `guild.members`, etc.) are independent nested stubs.
 
@@ -783,7 +854,10 @@ await (client.users as any).fetch('user-123')
 expect((client.users as any).fetch).toHaveBeenCalledWith('user-123')
 ```
 
-### `createMockMessage`
+</details>
+
+<details>
+<summary><b><code>createMockMessage</code></b></summary>
 
 Creates a smart mock `Message`. Tracks a `deleted` boolean — `delete()`, `edit()`, `reply()`, `react()`, `pin()`, and `unpin()` throw if the message has already been deleted. `edit()` and `reply()` resolve to a new mock `Message` instance. All methods are mock functions.
 
@@ -806,7 +880,10 @@ edited.delete // → a mock fn
 expect(msg.delete).toHaveBeenCalledTimes(1)
 ```
 
-### `createMock`
+</details>
+
+<details>
+<summary><b><code>createMock</code></b></summary>
 
 Mocks any type without a runtime class — use it for the services a controller depends on. `createMockInteraction` needs a class to build a prototype chain from, which is what makes `instanceof` and the real type guards work; a service double needs none of that, and an injected dependency may be an interface that does not exist at runtime at all.
 
@@ -829,7 +906,10 @@ expect(greetingService.buildGreeting).toHaveBeenCalledWith('Alice')
 
 Nested access works without declaring the shape first — `cache.store.flush()` is a mock fn on a mock fn. Properties passed as `createMock<T>({ ... })` are used exactly as given rather than wrapped, so call assertions do not apply to those.
 
-### `overrideGuard`
+</details>
+
+<details>
+<summary><b><code>overrideGuard</code></b></summary>
 
 Replaces a guard class in the DI container with a stub. No guard dependencies need to be provided.
 
@@ -840,14 +920,17 @@ const module = MeoCordTestingModule.create({
 })
   .overrideGuard(MetricsGuard)
   .useValue({ canActivate: () => true })
-  .overrideGuard(RateLimiterGuard)
+  .overrideGuard(RateLimitGuard)
   .useValue({ canActivate: () => true })
   .compile()
 ```
 
 `canActivate: () => true` allows the method to run. `() => false` blocks it. Multiple guards chain fluently.
 
-### `overrideProvider`
+</details>
+
+<details>
+<summary><b><code>overrideProvider</code></b></summary>
 
 Replaces a provider already registered on the module. The value is typed as `Partial<T>`, so a double only has to cover the methods the test exercises — a class with a private member could never be satisfied by a full object literal anyway. A misspelled method name is still a compile error.
 
@@ -861,7 +944,10 @@ const module = MeoCordTestingModule.create({
   .compile()
 ```
 
-### Full example
+</details>
+
+<details>
+<summary><b>Full example</b></summary>
 
 ```typescript
 import {
@@ -887,7 +973,7 @@ describe('GreetingSlashController', () => {
       controllers: [GreetingSlashController],
       providers: [{ provide: GreetingService, useValue: greetingService }],
     })
-      .overrideGuard(RateLimiterGuard)
+      .overrideGuard(RateLimitGuard)
       .useValue({ canActivate: () => true })
       .compile()
 
@@ -908,6 +994,8 @@ describe('GreetingSlashController', () => {
 })
 ```
 
+</details>
+
 ---
 
 ## Deployment
@@ -943,6 +1031,47 @@ Start in production:
 npx meocord start --prod
 ```
 
+### Self-contained builds
+
+By default `dist/main.js` imports its dependencies at runtime, which is why the server needs `node_modules`. Set `bundleDependencies` and the build puts everything the bot needs inside `dist` instead:
+
+```typescript
+import { type MeoCordConfig } from 'meocord/interface'
+
+export default {
+  discordToken: process.env.TOKEN!,
+  bundleDependencies: true,
+} satisfies MeoCordConfig
+```
+
+Deploying is then copying `dist/` — no `node_modules` beside it, no install step:
+
+```
+dist/
+├── main.js
+├── assets/
+├── node_modules/          (native addons only, if you use any)
+├── package.json
+└── meocord.platform.json  (if there are native addons)
+```
+
+Plain JavaScript dependencies are bundled into `main.js`. **Native addons** — packages that ship a compiled `.node` binary, like `sharp`, canvas bindings or database drivers — cannot be inlined into JavaScript, so MeoCord finds them itself while building, keeps them out of the bundle, and copies each one, with its platform binary and what it needs at runtime, into `dist/node_modules`. There is nothing to list: the build tells you which it packed.
+
+```
+Native addons packed into dist: meo-canvas, sharp
+dist/node_modules holds 7 packages; nothing else to install.
+```
+
+**Build on the platform you deploy to.** A compiled binary only loads on the operating system, CPU and C library it was built for — a build made on a Mac carries macOS binaries, and a Debian (glibc) binary does not load on Alpine (musl). For a container, run `meocord build` inside the image. The build records its platform in `meocord.platform.json`, and a bot started somewhere else stops before going online with a message naming both, instead of failing on the first command that renders an image.
+
+Use `externals` for anything you want kept out of the bundle for another reason; those are copied into `dist/node_modules` too. discord.js's optional accelerators — `zlib-sync`, `bufferutil`, `utf-8-validate` — are never bundled, are packed if you installed them, and are simply skipped by discord.js if you did not.
+
+**On bun, keep it from installing at runtime.** With no `node_modules` in reach, bun downloads any package the moment something imports it. `meocord start` passes `--no-install` for you. If you launch the bundle yourself, pass it too:
+
+```dockerfile
+CMD ["bun", "--no-install", "dist/main.js"]
+```
+
 ### Which runtime the bot runs on
 
 `start` runs the bot on **the runtime you launched it with**. There is nothing to configure and no config key to set — if you typed `bun`, you get a bun process:
@@ -958,7 +1087,8 @@ That matters for more than tidiness. Pinning `node` would oblige a bun-only imag
 
 Development works the same way. The watcher runs the bundle through the same command production does, so a runtime that works in `--dev` cannot quietly differ from the one that ships.
 
-#### Running the CLI itself on bun
+<details>
+<summary><b>Running the CLI itself on bun</b></summary>
 
 The resolution above decides what the _bot_ runs on. The CLI process is decided earlier,
 by the interpreter line `#!/usr/bin/env node`, which nothing in the package can influence
@@ -991,7 +1121,10 @@ bun = true
 
 Then plain `bun run start` runs the CLI and the bot on bun, and node need not exist.
 
-#### Pinning a specific binary
+</details>
+
+<details>
+<summary><b>Pinning a specific binary</b></summary>
 
 To override both signals — a particular install, or a different runtime for comparison — set `MEOCORD_RUNTIME`:
 
@@ -999,44 +1132,26 @@ To override both signals — a particular install, or a different runtime for co
 MEOCORD_RUNTIME=/usr/local/bin/bun npm run start
 ```
 
+</details>
+
 ---
 
 ## Contributing
 
-1. Fork the repository
-2. Create a feature branch: `git checkout -b feat/your-feature`
-3. Commit with conventional commits: `git commit -m "feat: add X"`
-4. Run `bun run lint` and `bun run test` before pushing
-5. If you touched anything under `src/bin/`, also run `bun run build && bun run verify:generated`
-6. Push and open a pull request against `main`
-
-Include a description of what changed and why, and add tests for any new behaviour.
-
-`verify:generated` generates one controller of every type through the built CLI — flat and nested, in separate throwaway projects — and typechecks the result against the published package. Rendering a template says nothing about whether the code it produces compiles, and two bugs lived behind exactly that gap. It runs in CI as part of the Build job, so you do not have to remember it; running it locally is just faster than waiting.
-
-### Commit messages and releases
+Issues, questions, and pull requests are welcome. [CONTRIBUTING.md](./CONTRIBUTING.md) covers getting set up, what each check exists to catch, and how releases work — a change that reaches the published package carries a [changeset](https://github.com/changesets/changesets), and merging the release pull request is what publishes it.
 
-Commit messages drive versioning through [semantic-release](https://semantic-release.gitbook.io/). Only these publish:
-
-| Prefix                         | Release |
-| ------------------------------ | ------- |
-| `feat:`                        | minor   |
-| `fix:`                         | patch   |
-| `perf:`                        | patch   |
-| `BREAKING CHANGE:` in the body | major   |
-
-Everything else — `docs:`, `test:`, `ci:`, `chore:`, `refactor:`, `style:` — lands on `main` without publishing and ships with whatever releasable commit comes next.
-
-Pick the prefix by what reaches the installed package, not by which file you edited. JSDoc is compiled into the published `.d.ts` and is what a user reads in their editor, so correcting a wrong `@example` is a `fix:` even though you only touched a comment. A README-only change is `docs:`.
+Participation is governed by the [Code of Conduct](./CODE_OF_CONDUCT.md). For vulnerabilities, follow [SECURITY.md](./SECURITY.md) rather than opening an issue.
 
 ---
 
 ## Release Notes
 
-Full changelog is available on the [GitHub Releases](https://github.com/l7aromeo/meocord/releases) page.
+Every release is recorded in [CHANGELOG.md](./CHANGELOG.md) and on the [GitHub Releases](https://github.com/l7aromeo/meocord/releases) page. Moving between major versions: the [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md).
 
 ---
 
 ## License
 
-**MeoCord Framework** is licensed under the [MIT License](./LICENSE).
+MeoCord is released under the [MIT License](./LICENSE), which covers the whole repository.
+
+It builds on open-source packages under their own licenses, listed in [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,40 @@
+# Third-Party Notices
+
+MeoCord is licensed under the [MIT License](./LICENSE). It depends on the open-source packages
+below, each under its own license.
+
+None of their code is copied into MeoCord's published package: npm installs each one alongside
+MeoCord, with its own license file. This list is a record of what MeoCord relies on, and of the
+terms those packages are offered under.
+
+## Dependencies
+
+Installed with MeoCord.
+
+| Package                                                            | License    | Source                                       |
+| ------------------------------------------------------------------ | ---------- | -------------------------------------------- |
+| [@clack/prompts](https://www.npmjs.com/package/@clack/prompts)     | MIT        | https://github.com/bombshell-dev/clack       |
+| [@rsbuild/core](https://www.npmjs.com/package/@rsbuild/core)       | MIT        | https://github.com/web-infra-dev/rsbuild     |
+| [chalk](https://www.npmjs.com/package/chalk)                       | MIT        | https://github.com/chalk/chalk               |
+| [cli-table3](https://www.npmjs.com/package/cli-table3)             | MIT        | https://github.com/cli-table/cli-table3      |
+| [commander](https://www.npmjs.com/package/commander)               | MIT        | https://github.com/tj/commander.js           |
+| [dayjs](https://www.npmjs.com/package/dayjs)                       | MIT        | https://github.com/iamkun/dayjs              |
+| [inversify](https://www.npmjs.com/package/inversify)               | MIT        | https://github.com/inversify/monorepo        |
+| [jiti](https://www.npmjs.com/package/jiti)                         | MIT        | https://github.com/unjs/jiti                 |
+| [lodash-es](https://www.npmjs.com/package/lodash-es)               | MIT        | https://github.com/lodash/lodash             |
+| [reflect-metadata](https://www.npmjs.com/package/reflect-metadata) | Apache-2.0 | https://github.com/rbuckton/reflect-metadata |
+| [simple-git](https://www.npmjs.com/package/simple-git)             | MIT        | https://github.com/steveukx/git-js           |
+
+## Peer dependencies
+
+Installed by the application using MeoCord.
+
+| Package                                                | License      | Source                                  |
+| ------------------------------------------------------ | ------------ | --------------------------------------- |
+| [discord.js](https://www.npmjs.com/package/discord.js) | Apache-2.0   | https://github.com/discordjs/discord.js |
+| [dotenv](https://www.npmjs.com/package/dotenv)         | BSD-2-Clause | https://github.com/motdotla/dotenv      |
+
+---
+
+Generated by `scripts/third-party-notices.ts` from the installed packages. Run
+`bun run notices` after adding or removing a dependency.

package/dist/cjs/_shared/{controller.decorator-MUHA_A3z.cjs → controller.decorator-9nIxOp9y.cjs}

@@ -3,7 +3,7 @@
 require('reflect-metadata');
 var inversify = require('inversify');
 var enum_index = require('../enum/index.cjs');
-var metadataKey_enum = require('./metadata-key.enum-BzzvGUId.cjs');
+var metadataKey_enum = require('./metadata-key.enum-aABGdodb.cjs');
 var discord_js = require('discord.js');
 
 /**

package/dist/cjs/_shared/{metadata-key.enum-BzzvGUId.cjs → metadata-key.enum-aABGdodb.cjs}

@@ -1,10 +1,6 @@
 'use strict';
 
 /**
- * MeoCord Framework
- * Copyright (c) 2025 Ukasyah Rahmatullah Zada
- * SPDX-License-Identifier: MIT
- */ /**
  * Centralised metadata keys used across the framework's `Reflect` calls.
  *
  * Keeping them here prevents typos, documents the Inversify 8 key rename,

package/dist/cjs/_shared/{theme-Bz-D4RbT.cjs → theme-BXdSoifk.cjs}

@@ -11,10 +11,6 @@ var chalk = require('chalk');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 /**
- * MeoCord Framework
- * Copyright (c) 2025 Ukasyah Rahmatullah Zada
- * SPDX-License-Identifier: MIT
- */ /**
  * Helper function to fix common JSON formatting issues in tsconfig.json, such as:
  * - Removing single-line comments.
  * - Removing trailing commas.
@@ -55,7 +51,7 @@ let configLoaded = false;
     const compiledPath = path.resolve(process.cwd(), 'dist', 'meocord.config.mjs');
     if (!fs.existsSync(compiledPath)) return undefined;
     try {
-        const jiti$1 = jiti.createJiti((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-Bz-D4RbT.cjs', document.baseURI).href)), {
+        const jiti$1 = jiti.createJiti((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-BXdSoifk.cjs', document.baseURI).href)), {
             interopDefault: true
         });
         return jiti$1(compiledPath);
@@ -64,10 +60,7 @@ let configLoaded = false;
         return undefined;
     }
 }
-/**
- * Loads the source config from meocord.config.ts via jiti with tsconfig path alias resolution.
- * Used in development mode where source files and tsconfig.json are available.
- */ function loadSourceConfig() {
+function loadSourceConfig() {
     const configPath = path.resolve(process.cwd(), 'meocord.config.ts');
     if (!fs.existsSync(configPath)) return undefined;
     try {
@@ -83,7 +76,7 @@ let configLoaded = false;
                 }
             }
         }
-        const jiti$1 = jiti.createJiti((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-Bz-D4RbT.cjs', document.baseURI).href)), {
+        const jiti$1 = jiti.createJiti((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-BXdSoifk.cjs', document.baseURI).href)), {
             interopDefault: true,
             alias: aliases,
             moduleCache: false
@@ -163,11 +156,7 @@ class Logger {
     }
 }
 
-/**
- * MeoCord Framework
- * Copyright (c) 2025 Ukasyah Rahmatullah Zada
- * SPDX-License-Identifier: MIT
- */ class Theme {
+class Theme {
 }
 Theme.successColor = '#28A745';
 Theme.infoColor = '#17A2B8';

package/dist/cjs/common/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var theme = require('../_shared/theme-Bz-D4RbT.cjs');
+var theme = require('../_shared/theme-BXdSoifk.cjs');
 require('node:util');
 require('dayjs');
 require('dayjs/plugin/utc.js');
@@ -11,10 +11,6 @@ require('jiti');
 require('chalk');
 
 /**
- * MeoCord Framework
- * Copyright (c) 2025 Ukasyah Rahmatullah Zada
- * SPDX-License-Identifier: MIT
- */ /**
  * Composes multiple class or method decorators into a single decorator.
  *
  * @example