meocord 4.0.0-beta.5 → 4.0.1

package/CHANGELOG.md

@@ -1,5 +1,126 @@
 # meocord
 
+## 4.0.1
+
+### Patch Changes
+
+- [#290](https://github.com/meocord/meocord/pull/290) [`6e6e68e`](https://github.com/meocord/meocord/commit/6e6e68eff696481b40810b2bf713f2bec769b564) Thanks [@l7aromeo](https://github.com/l7aromeo)! - `Logger` prints objects as `console.log` does, and redacts the bot's credentials from everything it prints: non-enumerable properties no longer appear, and objects print four levels deep.
+
+  - Nested data a bot logs, such as a payload or its settings, still shows in full, and a discord.js structure prints a few hundred lines instead of everything it reaches.
+  - An error prints as before: its stack, its own properties such as `code`, its `cause`, and an `AggregateError`'s errors. Its message and stack are no longer printed a second time below it.
+  - Nothing to change in your code.
+
+## 4.0.0
+
+MeoCord 4 builds with Rsbuild instead of webpack, requires Node.js 22.13 and dotenv 18, and can
+deploy a bot without `node_modules`. Most bots need two changes; see the
+[migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md).
+
+### Major Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Build with [Rsbuild](https://rsbuild.rs) instead of webpack. Production builds are several times
+  faster, and webpack and its four loader and plugin packages are no longer installed with MeoCord.
+  The output layout is unchanged: `dist/main.js`, and assets under `dist/assets/` with the same names.
+  Production source maps now list sources as `../src/...` paths instead of `webpack://` URLs.
+
+  **Breaking:** the `webpack` hook in `meocord.config.ts` is replaced by `rsbuild`, which receives
+  Rsbuild's configuration. A config that still declares `webpack` stops the build with a message
+  saying so. `MeoCordWebpackConfig` is removed; import `RsbuildConfig` from `meocord/interface`
+  instead. The [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#2-replace-the-webpack-hook-with-rsbuild) shows where each
+  webpack setting goes.
+
+- [#44](https://github.com/l7aromeo/meocord/pull/44) [`e48472e`](https://github.com/l7aromeo/meocord/commit/e48472e9ffee2f0371a7a2a71a4063e99ce61674) Thanks [@l7aromeo](https://github.com/l7aromeo)! - **Breaking:** `meocord/decorator` exports only the decorators. The routing helpers it also exported
+  — `getCommandMap`, `getMessageHandlers`, `getReactionHandlers`, `getAutocompleteHandlers`,
+  `findAmbiguousRoutes` and `PARAM_SEPARATOR` — are internal to MeoCord now. See the
+  [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#internal-helpers-are-no-longer-exported).
+
+- [#19](https://github.com/l7aromeo/meocord/pull/19) [`204c7be`](https://github.com/l7aromeo/meocord/commit/204c7bec74886c931732cb771d9178b47fbec5e8) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Require dotenv 18. The `dotenv` peer dependency moves from `^17.4.2` to `^18.0.3`, so install
+  `dotenv@18` alongside MeoCord 4. No application code changes — `import 'dotenv/config'` behaves
+  the same. See the [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#1-upgrade-dotenv-to-18).
+
+- [#33](https://github.com/l7aromeo/meocord/pull/33) [`21b06ae`](https://github.com/l7aromeo/meocord/commit/21b06ae6810cfe203abadcadc6f7b7247c7b305b) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Require Node.js 22.13 or newer, up from 22.0. A built bot loads its compiled config with `require()`
+  of an ES module. Node 22.12 runs that without a flag but still warns on every start and crashes on a
+  config that throws; 22.13 is the first 22 release that does neither. Bun is unaffected. See the
+  [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#before-you-start-nodejs-2213).
+
+- [#36](https://github.com/l7aromeo/meocord/pull/36) [`45e564e`](https://github.com/l7aromeo/meocord/commit/45e564e6baff17313037372ec56baa1711a3584c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - **Breaking:** `app.start()` rejects when the login fails. It logged the error and resolved, so a bot
+  with an invalid token went on to log "Application started" and exit with code 0, which Docker's
+  `restart: on-failure`, systemd and CI all read as success. It now sets the exit code to 1 before
+  rejecting, so a bot that fails to log in exits 1 with its entry point unchanged. See the
+  [migration guide](https://github.com/l7aromeo/meocord/blob/main/docs/MIGRATING.md#4-build-and-start).
+
+### Minor Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Add `bundleDependencies`, which puts everything a bot needs inside `dist`, so it deploys without
+  `node_modules` or an install step. Plain JavaScript dependencies are bundled into `main.js`. Native
+  addons such as `sharp` are found while building and copied, with their platform binary, into
+  `dist/node_modules` — nothing has to be listed. Only binaries for the platform building are copied,
+  whichever package manager installed them.
+
+  A build carrying native addons records its platform in `dist/meocord.platform.json`, and a bot
+  started on another platform stops before going online with a message naming both. Build on the
+  platform you deploy to. See
+  [Self-contained builds](https://github.com/l7aromeo/meocord#self-contained-builds).
+
+- [#47](https://github.com/l7aromeo/meocord/pull/47) [`9652436`](https://github.com/l7aromeo/meocord/commit/965243660323277827a64851f28da9cda2c2fe0c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Add `resolveRoute` and `findRouteConflicts` to `meocord/testing`, for testing which handler a
+  component's customId reaches. `resolveRoute(App, { type, customId })` gives the answer dispatch
+  gives — across every controller the app registers, for that component type, most specific pattern
+  first — as the controller, the handler method and its name, and the captured params, or `undefined`.
+  `findRouteConflicts(App)` returns the pattern pairs that can match the same customId, which MeoCord
+  otherwise only warns about at startup. Both read decorator metadata only, and dispatch runs on the
+  same matcher.
+
+### Patch Changes
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Read `meocord.config.ts` on every build. `meocord build` read the compiled `dist/meocord.config.mjs`
+  left by the previous build, so a config edit took effect one build late, and the watcher's reload
+  on a config change reloaded nothing.
+
+- [#22](https://github.com/l7aromeo/meocord/pull/22) [`4deb96f`](https://github.com/l7aromeo/meocord/commit/4deb96fd73f86a29c46b9bb080c13e6267246cb1) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Start the bot with `bun --no-install` from `meocord start`. Without it, bun downloads any package it
+  cannot find while the bot runs, which a bot deployed without `node_modules` would do in
+  production. If you start `dist/main.js` with bun yourself, pass the flag too.
+
+- [#37](https://github.com/l7aromeo/meocord/pull/37) [`a9452c2`](https://github.com/l7aromeo/meocord/commit/a9452c256beace70141bb87ed33c693d14064d14) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Type the CommonJS build as CommonJS. Every entry point's `require` condition resolved to the ESM
+  declarations, so a CommonJS TypeScript project was told `meocord/core` is an ES module it cannot
+  `require`, even with `skipLibCheck`. Each entry now ships `.d.cts` declarations for `require`, and
+  `meocord/eslint` types its `module.exports` array as what `require` returns.
+
+- [#33](https://github.com/l7aromeo/meocord/pull/33) [`21b06ae`](https://github.com/l7aromeo/meocord/commit/21b06ae6810cfe203abadcadc6f7b7247c7b305b) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Load the compiled config without a transpiler. A built bot reads `dist/meocord.config.mjs` with
+  `require()` and no longer falls back to `meocord.config.ts` when it is missing, so jiti stays out of
+  a bot bundled with `bundleDependencies`. `meocord build` fails when the config does not compile,
+  instead of warning and producing a bot that cannot start.
+
+- [#35](https://github.com/l7aromeo/meocord/pull/35) [`b93a771`](https://github.com/l7aromeo/meocord/commit/b93a771b19664345fec4222d5a2c29dcf5b31a0d) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Generate code that passes a new application's own `lint`. A generated guard failed `tsc` and ESLint
+  — `GuardInterface` imported as a value, and an unused `context` parameter — and generated message and
+  reaction controllers imported names they never used, which only the application's ESLint, run in the
+  background after generating, removed. New applications also typecheck `meocord.config.ts`: the
+  template's `tsconfig.json` includes it instead of excluding it, so a type error in the config fails
+  `lint`, and editors resolve `paths` aliases imported there. `noEmit` stays on, so `tsc` writes nothing
+  beside it.
+
+- [#25](https://github.com/l7aromeo/meocord/pull/25) [`2179f85`](https://github.com/l7aromeo/meocord/commit/2179f85c2912d45e3fefbf996ca267c19a1a773c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Stop `meocord generate` overwriting files. Slash, context-menu and primary entry point controllers
+  all wrote one shared `builders/sample.builder.ts`, so generating a second controller replaced a
+  builder you had already edited. Each controller now gets its own `builders/<name>.builder.ts`
+  exporting `<Name>CommandBuilder`, and registers a command named after it — `admin/ban` registers
+  `admin-ban` — rather than every one registering `sample-slash`. Generating a controller, service or
+  guard refuses if any file it would write already exists.
+
+- [#40](https://github.com/l7aromeo/meocord/pull/40) [`3629edd`](https://github.com/l7aromeo/meocord/commit/3629eddaf20bd0947d24e5582aa167b2c0ca0d47) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Lint `meocord.config.ts`. The shared ESLint config from `meocord/eslint` ignored it, so the config
+  alone skipped the rules every other file follows — unused imports, formatting. It is linted like the
+  rest now; the typecheck it already gets is unchanged.
+
+- [#24](https://github.com/l7aromeo/meocord/pull/24) [`5e2a54b`](https://github.com/l7aromeo/meocord/commit/5e2a54b67a1f9f51c4c3a3e8cf51247de2ac2528) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Type `deleted` on `createMockMessage()`. The mock tracks and documents it, but it was missing from
+  the type, so `message.deleted` did not compile.
+
+- [#24](https://github.com/l7aromeo/meocord/pull/24) [`5e2a54b`](https://github.com/l7aromeo/meocord/commit/5e2a54b67a1f9f51c4c3a3e8cf51247de2ac2528) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Accept slash command builders that add options. `@CommandBuilder(CommandType.SLASH)` rejected
+  `new SlashCommandBuilder().addStringOption(...)`, whose type narrows to
+  `SlashCommandOptionsOnlyBuilder`, so the most common builder — one command with an option — did
+  not compile.
+
+- [#21](https://github.com/l7aromeo/meocord/pull/21) [`bebf116`](https://github.com/l7aromeo/meocord/commit/bebf1168466595546017a317b62acd3707ff2d1c) Thanks [@l7aromeo](https://github.com/l7aromeo)! - Generate applications with current test tooling: vitest and `@vitest/coverage-istanbul` 5,
+  `unplugin-swc` 2, and current eslint, prettier and typescript-eslint. A new application's
+  `test:coverage` no longer fails on its decorated entry files.
+
 ## 4.0.0-beta.5
 
 ### Minor Changes

package/dist/cjs/_shared/{theme-C8w8ivsR.cjs → theme-Bt2Xw_fH.cjs}

@@ -31,7 +31,7 @@ let configLoaded = false;
     try {
         // Called through a variable so a bundler does not try to resolve the path while building the
         // application; the file is only there once the build is done.
-        const load = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-C8w8ivsR.cjs', document.baseURI).href)));
+        const load = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('_shared/theme-Bt2Xw_fH.cjs', document.baseURI).href)));
         const loaded = load(compiledPath);
         return loaded.default ?? loaded;
     } catch (error) {
@@ -42,6 +42,34 @@ let configLoaded = false;
 
 dayjs.extend(utc);
 dayjs.extend(timezone);
+/**
+ * How deep an object argument prints: nested data a bot logs, such as a payload or its settings, shows in full, while
+ * a discord.js structure, which reaches its client and every cache, stops at a few hundred lines.
+ */ const OBJECT_DEPTH = 4;
+/** What a value registered with {@link hideInLogs} prints as. */ const REDACTED = '[redacted]';
+/**
+ * The shortest value registered: a bot's credential is far longer, and a short value, such as a test's placeholder,
+ * would replace ordinary words in every line.
+ */ const MIN_HIDDEN_LENGTH = 16;
+const hiddenValues = new Set();
+/**
+ * Keeps `value`, such as the bot's credential, out of every line Logger prints from now on, whatever object, string
+ * or error carries it: as given, trimmed, and without the `Bot ` or `Bearer ` prefix discord.js strips.
+ */ function hideInLogs(value) {
+    if (typeof value !== 'string') return;
+    const trimmed = value.trim();
+    for (const form of [
+        trimmed,
+        trimmed.replace(/^(Bot|Bearer)\s*/i, '')
+    ]){
+        if (form.length >= MIN_HIDDEN_LENGTH) hiddenValues.add(form);
+    }
+}
+const redact = (text)=>{
+    let out = text;
+    for (const value of hiddenValues)out = out.replaceAll(value, REDACTED);
+    return out;
+};
 class Logger {
     log(...args) {
         this.logWithContext('log', args);
@@ -63,12 +91,11 @@ class Logger {
     }
     formatMessage(message, logType) {
         if (typeof message === 'object' && message !== null) {
+            // As console.log inspects: without non-enumerable properties, which discord.js uses to keep its internals out of logs
             return node_util.inspect(message, {
-                showHidden: true,
-                depth: null,
+                depth: OBJECT_DEPTH,
                 colors: true,
-                compact: false,
-                showProxy: true
+                compact: false
             });
         }
         return (this.colorMap[logType] || ((msg)=>msg))(message);
@@ -76,6 +103,7 @@ class Logger {
     logWithContext(logLevel, messages) {
         if (messages.length === 0) return;
         const config = loadMeoCordConfig();
+        hideInLogs(config?.discordToken);
         const logType = logLevel.toUpperCase();
         const applyColor = this.colorMap[logType] || ((msg)=>msg);
         const formattedMessages = messages.map((message)=>this.formatMessage(message, logType));
@@ -90,7 +118,7 @@ class Logger {
             coloredContext,
             ...formattedMessages
         ].filter((log)=>!!log);
-        console[logLevel](...logTexts);
+        console[logLevel](...logTexts.map(redact));
     }
     constructor(context){
         this.context = context;
@@ -113,4 +141,5 @@ Theme.warningColor = '#FFC107';
 
 exports.Logger = Logger;
 exports.Theme = Theme;
+exports.hideInLogs = hideInLogs;
 exports.loadMeoCordConfig = loadMeoCordConfig;

package/dist/cjs/common/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var theme = require('../_shared/theme-C8w8ivsR.cjs');
+var theme = require('../_shared/theme-Bt2Xw_fH.cjs');
 require('node:util');
 require('dayjs');
 require('dayjs/plugin/utc.js');

package/dist/cjs/core/index.cjs

@@ -3,7 +3,7 @@
 require('reflect-metadata');
 var inversify = require('inversify');
 var discord_js = require('discord.js');
-var theme = require('../_shared/theme-C8w8ivsR.cjs');
+var theme = require('../_shared/theme-Bt2Xw_fH.cjs');
 var controller_decorator = require('../_shared/controller.decorator-DnKZ29W4.cjs');
 var lodashEs = require('lodash-es');
 var enum_index = require('../enum/index.cjs');
@@ -467,6 +467,8 @@ class MeoCordApp {
         this.isShuttingDown = false;
         this.activityInterval = null;
         this.controllerInstancesCache = new Map();
+        // First, so nothing logged from here on, before login or after, prints it
+        theme.hideInLogs(discordToken);
         this.bot = this.discordClient;
         process.on('SIGINT', ()=>this.gracefulShutdown());
         process.on('SIGTERM', ()=>this.gracefulShutdown());

package/dist/esm/common/logger.js

@@ -7,6 +7,34 @@ import chalk from 'chalk';
 
 dayjs.extend(utc);
 dayjs.extend(timezone);
+/**
+ * How deep an object argument prints: nested data a bot logs, such as a payload or its settings, shows in full, while
+ * a discord.js structure, which reaches its client and every cache, stops at a few hundred lines.
+ */ const OBJECT_DEPTH = 4;
+/** What a value registered with {@link hideInLogs} prints as. */ const REDACTED = '[redacted]';
+/**
+ * The shortest value registered: a bot's credential is far longer, and a short value, such as a test's placeholder,
+ * would replace ordinary words in every line.
+ */ const MIN_HIDDEN_LENGTH = 16;
+const hiddenValues = new Set();
+/**
+ * Keeps `value`, such as the bot's credential, out of every line Logger prints from now on, whatever object, string
+ * or error carries it: as given, trimmed, and without the `Bot ` or `Bearer ` prefix discord.js strips.
+ */ function hideInLogs(value) {
+    if (typeof value !== 'string') return;
+    const trimmed = value.trim();
+    for (const form of [
+        trimmed,
+        trimmed.replace(/^(Bot|Bearer)\s*/i, '')
+    ]){
+        if (form.length >= MIN_HIDDEN_LENGTH) hiddenValues.add(form);
+    }
+}
+const redact = (text)=>{
+    let out = text;
+    for (const value of hiddenValues)out = out.replaceAll(value, REDACTED);
+    return out;
+};
 class Logger {
     log(...args) {
         this.logWithContext('log', args);
@@ -28,12 +56,11 @@ class Logger {
     }
     formatMessage(message, logType) {
         if (typeof message === 'object' && message !== null) {
+            // As console.log inspects: without non-enumerable properties, which discord.js uses to keep its internals out of logs
             return inspect(message, {
-                showHidden: true,
-                depth: null,
+                depth: OBJECT_DEPTH,
                 colors: true,
-                compact: false,
-                showProxy: true
+                compact: false
             });
         }
         return (this.colorMap[logType] || ((msg)=>msg))(message);
@@ -41,6 +68,7 @@ class Logger {
     logWithContext(logLevel, messages) {
         if (messages.length === 0) return;
         const config = loadMeoCordConfig();
+        hideInLogs(config?.discordToken);
         const logType = logLevel.toUpperCase();
         const applyColor = this.colorMap[logType] || ((msg)=>msg);
         const formattedMessages = messages.map((message)=>this.formatMessage(message, logType));
@@ -55,7 +83,7 @@ class Logger {
             coloredContext,
             ...formattedMessages
         ].filter((log)=>!!log);
-        console[logLevel](...logTexts);
+        console[logLevel](...logTexts.map(redact));
     }
     constructor(context){
         this.context = context;
@@ -69,4 +97,4 @@ class Logger {
     }
 }
 
-export { Logger };
+export { Logger, REDACTED, hideInLogs };

package/dist/esm/core/meocord.app.js

@@ -1,5 +1,5 @@
 import { ApplicationCommandType, SlashCommandBuilder, MessageFlagsBitField } from 'discord.js';
-import { Logger } from '../common/logger.js';
+import { Logger, hideInLogs } from '../common/logger.js';
 import '../common/theme.js';
 import { getCommandMap, PARAM_SEPARATOR, getAutocompleteHandlers, getMessageHandlers, getReactionHandlers } from '../decorator/controller.decorator.js';
 import { sample } from 'lodash-es';
@@ -450,6 +450,8 @@ class MeoCordApp {
         this.isShuttingDown = false;
         this.activityInterval = null;
         this.controllerInstancesCache = new Map();
+        // First, so nothing logged from here on, before login or after, prints it
+        hideInLogs(discordToken);
         this.bot = this.discordClient;
         process.on('SIGINT', ()=>this.gracefulShutdown());
         process.on('SIGTERM', ()=>this.gracefulShutdown());

package/dist/esm/package.json.js

@@ -1,4 +1,4 @@
-var version = "4.0.0-beta.5";
+var version = "4.0.1";
 var packageJson = {
 	version: version};
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meocord",
   "description": "Decorator-based Discord bot framework built on discord.js. Brings NestJS-style controllers, dependency injection, guards, and testing utilities to bot development — with a full CLI and TypeScript-first design.",
-  "version": "4.0.0-beta.5",
+  "version": "4.0.1",
   "type": "module",
   "engines": {
     "node": ">=22.13"
@@ -26,11 +26,11 @@
   "bin": "./dist/esm/bin/meocord.js",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/l7aromeo/meocord.git"
+    "url": "git+https://github.com/meocord/meocord.git"
   },
-  "homepage": "https://github.com/l7aromeo/meocord#readme",
+  "homepage": "https://meocord.dev",
   "bugs": {
-    "url": "https://github.com/l7aromeo/meocord/issues"
+    "url": "https://github.com/meocord/meocord/issues"
   },
   "license": "MIT",
   "exports": {