bro.js v3.0.0 – What’s new

Tired of flaky state leaking between tests or worrying about insecure defaults? bro.js just hit v3.0.0 and brings a bunch of practical upgrades that let you focus on code, not on runtime quirks. 厌倦了测试之间不稳定的状态泄漏，或者担心不安全的默认设置？bro.js 刚刚发布了 v3.0.0 版本，带来了一系列实用的升级，让你能够专注于代码本身，而非运行时的各种怪癖。

Edge & Web Standard Runtime

Edge 与 Web 标准运行时

Separate entry points for Node (bro-framework), Next.js (bro-framework/next), and Edge/worker (bro-framework/edge). No more node:crypto or node:fs in Edge – it now uses the native Web Crypto API and Response.json(). Guarded process.env lookups make the runtime portable for Cloudflare Workers and Next.js Edge. 为 Node (bro-framework)、Next.js (bro-framework/next) 和 Edge/worker (bro-framework/edge) 提供了独立的入口点。Edge 环境中不再包含 node:crypto 或 node:fs，现在改用原生的 Web Crypto API 和 Response.json()。受保护的 process.env 查询使运行时能够兼容 Cloudflare Workers 和 Next.js Edge。

Immutable Instance‑Scoped Engine

不可变的实例级引擎

All global singletons are gone. State lives inside the createBro(config) or createServer() instance, giving you true isolation per request or tenant. 移除了所有全局单例。状态现在存在于 createBro(config) 或 createServer() 实例内部，从而实现了每个请求或租户之间的真正隔离。

Strict TypeScript Contracts

严格的 TypeScript 契约

Core context is generic‑typed via AppContext. No more any – you can type ctx.db, ctx.env, and ctx.user precisely. Updated declaration files (src/index.d.ts, src/next.d.ts) now compile with zero errors. 核心上下文通过 AppContext 进行泛型类型定义。不再使用 any 类型——你可以精确地定义 ctx.db、ctx.env 和 ctx.user 的类型。更新后的声明文件 (src/index.d.ts, src/next.d.ts) 现在可以零错误编译。

Contract Studio (bro studio)

契约工作室 (bro studio)

Generates strongly‑typed React Query hooks and MSW handlers straight from Zod schemas. OpenAPI output now includes request/auth/multipart metadata and RFC 9457 problem details. 直接从 Zod 模式生成强类型的 React Query hooks 和 MSW 处理程序。OpenAPI 输出现在包含请求/认证/多部分元数据以及 RFC 9457 问题详情。

In‑Process Testing (bro.test())

进程内测试 (bro.test())

A self‑contained HTTP testing harness that shuts down cleanly. testRoute() lets you call a handler directly without starting a server. Built‑in hooks for DB transaction rollbacks and fake timers. 一个自包含的 HTTP 测试工具，支持干净地关闭。testRoute() 允许你在不启动服务器的情况下直接调用处理程序。内置了数据库事务回滚和伪造计时器的钩子。

Production Observability & Security

生产环境可观测性与安全性

OpenTelemetry spans, metrics, and W3C trace propagation. createPinoAdapter redacts PII (Authorization, Cookie) by default. Scaffolding no longer embeds literal secrets. In production, a missing or short JWT secret crashes the app early. CORS is now strict – you must provide an explicit allowlist. API keys are hashed; OIDC and JWKS caching via jose. 支持 OpenTelemetry 跨度、指标和 W3C 追踪传播。createPinoAdapter 默认会屏蔽个人身份信息 (PII)（如 Authorization、Cookie）。脚手架不再嵌入明文密钥。在生产环境中，如果 JWT 密钥缺失或过短，应用会提前崩溃。CORS 现在变得严格——你必须提供明确的白名单。API 密钥经过哈希处理；通过 jose 库实现 OIDC 和 JWKS 缓存。

Lifecycle Adapters & CLI

生命周期适配器与 CLI

TaskManager now handles workers, dead‑letter queues, exponential backoff, and Redis lease locks. PostgresAdapter is production‑ready, and S3/Local upload adapters are secure. bro init scaffolds bro.config.js, a Dockerfile, Vitest config, and an example env file. CLI commands (bro doctor, bro sdk, bro studio) all target the default routes/ folder. TaskManager 现在可以处理工作进程、死信队列、指数退避和 Redis 租约锁。PostgresAdapter 已达到生产就绪状态，S3/本地上传适配器也更加安全。bro init 可生成 bro.config.js、Dockerfile、Vitest 配置和一个示例 env 文件。CLI 命令 (bro doctor, bro sdk, bro studio) 均指向默认的 routes/ 文件夹。

All of this is aimed at making bro.js a solid, secure, and edge‑ready framework for production workloads. Give it a spin and let us know how it fits your stack! 所有这些改进旨在使 bro.js 成为一个稳健、安全且面向边缘计算的生产级框架。快来尝试一下，并告诉我们它与你的技术栈契合度如何！