@contractkit/plugin-typescript 0.33.1 → 0.33.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractkit/plugin-typescript",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "description": "ContractKit built-in plugin: TypeScript codegen (SDK clients, Koa routers, Zod schemas, plain types)",
   "license": "MIT",
   "author": {
@@ -27,7 +27,7 @@
     ".": "./dist/index.js"
   },
   "dependencies": {
-    "@contractkit/core": "0.28.1"
+    "@contractkit/core": "0.28.2"
   },
   "devDependencies": {
     "@repo/config-eslint": "0.3.1",

package/src/codegen-mcp.ts

@@ -490,23 +490,24 @@ export function generateMcpAggregator(entries: McpAggregatorEntry[]): string {
 /** Generate the optional `mcp.router.ts` — the standard ServerKit route wiring for the dispatcher. */
 export function generateMcpRouter(options: { path?: string } = {}): string {
     const path = options.path ?? '/mcp';
-    return `import { ServerKitRouter, requireSignature } from '@maroonedsoftware/koa';
+    return `import { ServerKitRouter, bodyParserMiddleware, requireSignature } from '@maroonedsoftware/koa';
 import { McpDispatcher, createMcpRequestContext, MCP_AUTH_POLICY } from '@maroonedsoftware/mcp';
 
 /** Mount the MCP endpoint onto a ServerKit router. Call \`registerMcpTools(container)\` at startup. */
 export function mountMcp(router: ReturnType<typeof ServerKitRouter>): void {
-    router.post('${path}', requireSignature('mcp', { policy: MCP_AUTH_POLICY }), async (ctx) => {
+    router.post('${path}', bodyParserMiddleware(['json']), requireSignature('mcp', { policy: MCP_AUTH_POLICY }), async (ctx) => {
         const dispatcher = ctx.container.get(McpDispatcher);
         const context = createMcpRequestContext({ requestId: ctx.requestId, logger: ctx.logger });
         if (dispatcher.sessionMode === 'stateful') {
             ctx.respond = false;
             await dispatcher.dispatchStateful(
-                { req: ctx.req, res: ctx.res, body: ctx.request.body, sessionId: ctx.get('mcp-session-id') },
+                { req: ctx.req, res: ctx.res, body: ctx.parsedBody, sessionId: ctx.get('mcp-session-id') },
                 context,
             );
         } else {
-            const response = await dispatcher.dispatch(JSON.parse(ctx.rawBody), context);
+            const response = await dispatcher.dispatch(JSON.parse(String(ctx.rawBody)), context);
             if (response) ctx.body = response;
+            else ctx.status = 202; // a notification — nothing to return
         }
     });
 }

package/tests/codegen-mcp.test.ts

@@ -233,6 +233,37 @@ describe('generateMcpRouter', () => {
         expect(out).toContain("dispatcher.sessionMode === 'stateful'");
     });
 
+    it('parses the body before verifying the signature', () => {
+        const out = generateMcpRouter({ path: '/mcp' });
+        // `requireSignature` HMACs `ctx.rawBody`, which only `bodyParserMiddleware` populates,
+        // so the parser has to run first. Asserting the whole route line pins the order too.
+        expect(out).toContain("import { ServerKitRouter, bodyParserMiddleware, requireSignature } from '@maroonedsoftware/koa';");
+        expect(out).toContain(
+            "router.post('/mcp', bodyParserMiddleware(['json']), requireSignature('mcp', { policy: MCP_AUTH_POLICY }), async (ctx) => {",
+        );
+    });
+
+    it('answers notifications with 202 rather than falling through to a 404', () => {
+        const out = generateMcpRouter();
+        // `dispatch` resolves undefined for a notification; an unset ctx.body 404s in errorMiddleware.
+        expect(out).toContain('if (response) ctx.body = response;');
+        expect(out).toContain('else ctx.status = 202;');
+    });
+
+    it('stringifies rawBody before JSON.parse', () => {
+        const out = generateMcpRouter();
+        // ctx.rawBody is BinaryLike; JSON.parse takes string.
+        expect(out).toContain('JSON.parse(String(ctx.rawBody))');
+        expect(out).not.toContain('JSON.parse(ctx.rawBody)');
+    });
+
+    it('hands the stateful transport the parsed body', () => {
+        const out = generateMcpRouter();
+        // The parser drains the stream and writes ctx.parsedBody; ctx.request.body is never set.
+        expect(out).toContain('body: ctx.parsedBody');
+        expect(out).not.toContain('ctx.request.body');
+    });
+
     it('defaults the mount path to /mcp', () => {
         expect(generateMcpRouter()).toContain("router.post('/mcp'");
     });