@silkweave/nestjs 1.10.0 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@silkweave/nestjs",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Silkweave NestJS Adapter",
   "repository": {
     "type": "git",
@@ -19,12 +19,12 @@
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "zod": "^3.25.0",
-    "@silkweave/auth": "1.10.0",
-    "@silkweave/core": "1.10.0",
-    "@silkweave/trpc": "1.10.0",
-    "@silkweave/mcp": "1.10.0",
-    "@silkweave/logger": "1.10.0",
-    "@silkweave/typegen": "1.10.0"
+    "@silkweave/auth": "1.11.0",
+    "@silkweave/core": "1.11.0",
+    "@silkweave/mcp": "1.11.0",
+    "@silkweave/logger": "1.11.0",
+    "@silkweave/typegen": "1.11.0",
+    "@silkweave/trpc": "1.11.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/lib/discovery.ts

@@ -30,9 +30,10 @@ export class ActionDiscovery {
    * a list of core `Action` objects ready to feed into `silkweave().actions()`.
    *
    * Action invocation is wrapped to (a) run `@UseGuards` guards declared on the
-   * method or its class against the incoming HTTP request (read from
-   * `ctx.get('request')`) and (b) bind `this` to the resolved Nest provider so
-   * DI-injected dependencies remain available.
+   * method or its class against the incoming request (read from
+   * `ctx.get('request')`, populated by REST/tRPC and by MCP-over-HTTP from the
+   * SDK's `extra.requestInfo`) and (b) bind `this` to the resolved Nest provider
+   * so DI-injected dependencies remain available.
    */
   discover(): Action[] {
     const discovered: DiscoveredAction[] = []
@@ -66,9 +67,16 @@ export class ActionDiscovery {
 
     const applyGuards = async (context: SilkweaveContext): Promise<void> => {
       if (guards.length === 0) { return }
+      // REST and tRPC populate `request`/`response`; MCP-over-HTTP populates
+      // `request` (a `{ headers, url, params, query }` stand-in built from the
+      // SDK's `extra.requestInfo`). Transports with no HTTP request at all (e.g.
+      // MCP stdio) get a header-less stand-in so guards reading `req.headers`
+      // degrade gracefully (deny) instead of dereferencing `undefined`.
       const request = context.getOptional<unknown>('request')
-      const response = context.getOptional<unknown>('response')
-      await runGuards(guards, moduleRef, reflector, d.classRef, d.method, request, response)
+      const response = context.getOptional<unknown>('response') ?? null
+      const hasRequest = request != null
+      const guardRequest = hasRequest ? request : { headers: {}, params: {}, query: {} }
+      await runGuards(guards, moduleRef, reflector, d.classRef, d.method, guardRequest, response, hasRequest ? 'http' : 'rpc')
     }
 
     // Cast at the createAction boundary to bridge dual-zod-version installs

package/src/lib/guards.ts

@@ -33,12 +33,17 @@ async function resolveGuard(ref: GuardRef, moduleRef: ModuleRef): Promise<CanAct
 }
 
 /**
- * Run the configured guards against an HTTP request. Throws `ForbiddenException`
+ * Run the configured guards against a request. Throws `ForbiddenException`
  * if any guard rejects, mirroring Nest's HTTP request-pipeline behavior.
  *
  * Pass `null` for `response` when running on top of a tRPC or MCP request that
  * doesn't surface a raw response object; guards that introspect the response
  * will receive `null`.
+ *
+ * `contextType` is reflected through `ExecutionContext.getType()` so guards can
+ * branch on the transport. It is `'http'` for REST/tRPC and for MCP-over-HTTP
+ * (where a header-bearing request stand-in is available); transports without any
+ * HTTP request (e.g. MCP stdio) pass `'rpc'`.
  */
 export async function runGuards(
   guards: GuardRef[],
@@ -47,10 +52,11 @@ export async function runGuards(
   classRef: Type<unknown>,
   handler: (...args: unknown[]) => unknown,
   request: unknown,
-  response: unknown
+  response: unknown,
+  contextType: 'http' | 'rpc' = 'http'
 ): Promise<void> {
   if (guards.length === 0) { return }
-  const context = new SilkweaveExecutionContext([request, response], classRef, handler, 'http')
+  const context = new SilkweaveExecutionContext([request, response], classRef, handler, contextType)
   for (const ref of guards) {
     const guard = await resolveGuard(ref, moduleRef)
     const result = guard.canActivate(context)