@silkweave/nestjs 1.12.0 → 2.2.0

package/build/index.mjs

@@ -1,18 +1,12 @@
+import { createRequire } from "node:module";
 import { authMiddleware, mcpCors, mcpTransport, oauthRoutes, protectedResourceMetadata, sideloadResource } from "@silkweave/mcp";
 import express from "express";
-import { ForbiddenException, HttpException, Inject, Injectable, Module, SetMetadata } from "@nestjs/common";
-import { validateToken } from "@silkweave/auth";
-import { SilkweaveError, actionMethod, createAction, createContext, methodHasBody, pathParamNames, resolveActionInput, validateActionRouting } from "@silkweave/core";
-import { buildLogLevels } from "@silkweave/logger";
+import { ForbiddenException, Inject, Injectable, Module, SetMetadata } from "@nestjs/common";
+import { ApplicationConfig, DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
+import { createAction, createContext } from "@silkweave/core";
 import { z } from "zod/v4";
-import { buildRouter, createActionLogger, resolveAuth } from "@silkweave/trpc";
-import { createExpressMiddleware } from "@trpc/server/adapters/express";
-import { renderTypegen } from "@silkweave/typegen";
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
-import { camelCase, kebabCase } from "change-case";
-import { GUARDS_METADATA } from "@nestjs/common/constants.js";
+import { GUARDS_METADATA, METHOD_METADATA, PATH_METADATA, ROUTE_ARGS_METADATA } from "@nestjs/common/constants.js";
+import { join } from "node:path";
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
@@ -72,309 +66,46 @@ function mcp(options = {}) {
 	};
 }
 //#endregion
-//#region src/adapter/rest.ts
-const CONSOLE_LEVEL_MAP = {
-	emergency: "error",
-	alert: "error",
-	critical: "error",
-	error: "error",
-	warning: "warn",
-	notice: "info",
-	info: "info",
-	debug: "log"
-};
-function createRestLogger() {
-	return {
-		...buildLogLevels((level, data) => {
-			console[CONSOLE_LEVEL_MAP[level]](data);
-		}),
-		progress: () => {}
-	};
-}
-function actionNameToPath(name) {
-	return `/${name.replace(/\./g, "/")}`;
-}
-async function readJsonBody(req) {
-	return new Promise((resolve, reject) => {
-		const chunks = [];
-		req.on("data", (c) => chunks.push(c));
-		req.on("end", () => {
-			if (chunks.length === 0) return resolve({});
-			try {
-				resolve(JSON.parse(Buffer.concat(chunks).toString("utf-8")));
-			} catch (err) {
-				reject(err instanceof Error ? err : /* @__PURE__ */ new Error("Unable to parse JSON body"));
-			}
-		});
-		req.on("error", reject);
-	});
-}
-function parseQuery(url) {
-	if (!url) return {};
-	const qIndex = url.indexOf("?");
-	if (qIndex === -1) return {};
-	const params = {};
-	const search = new URLSearchParams(url.slice(qIndex + 1));
-	for (const [k, v] of search.entries()) params[k] = v;
-	return params;
-}
-function sendJson(res, body, status) {
-	if (res.headersSent) return;
-	res.statusCode = status;
-	res.setHeader("Content-Type", "application/json");
-	res.end(JSON.stringify(body));
-}
-function handleRestError(err, res) {
-	if (err instanceof z.ZodError) {
-		sendJson(res, {
-			error: "validation_error",
-			issues: err.issues
-		}, 400);
-		return;
-	}
-	if (err instanceof SilkweaveError) {
-		sendJson(res, {
-			error: err.code,
-			message: err.message
-		}, err.statusCode);
-		return;
-	}
-	if (err instanceof HttpException) {
-		const body = err.getResponse();
-		sendJson(res, typeof body === "string" ? {
-			error: err.name,
-			message: body
-		} : body, err.getStatus());
-		return;
-	}
-	console.error(err);
-	sendJson(res, {
-		error: "internal",
-		message: "Internal error"
-	}, 500);
-}
-function createActionHandler(action, context, auth, logger) {
-	return async (req, res) => {
-		try {
-			const reqLike = req;
-			let authInfo;
-			if (auth) {
-				const result = await validateToken(typeof reqLike.headers.authorization === "string" ? reqLike.headers.authorization : void 0, auth, context.fork({ request: req }));
-				if (result.error) {
-					for (const [k, v] of Object.entries(result.error.headers)) res.setHeader(k, v);
-					sendJson(res, result.error.body, result.error.statusCode);
-					return;
-				}
-				authInfo = result.auth;
-			}
-			const query = reqLike.query ?? parseQuery(req.url);
-			const body = methodHasBody(actionMethod(action)) ? reqLike.body ?? await readJsonBody(req) : void 0;
-			const raw = resolveActionInput(action, {
-				params: reqLike.params,
-				query,
-				body
-			});
-			const input = action.input.parse(raw);
-			sendJson(res, await action.run(input, context.fork({
-				logger,
-				request: req,
-				response: res,
-				...authInfo ? { auth: authInfo } : {}
-			})), 200);
-		} catch (err) {
-			handleRestError(err, res);
-		}
-	};
-}
-/**
-* REST adapter for `@silkweave/nestjs`. Registers each discovered `@Action`
-* as an individual route on Nest's HTTP adapter:
-*
-* - HTTP verb comes from `method`, else `GET` for `kind: 'query'`, else `POST`.
-* - Path comes from `path` (joined to `basePath`, may contain `:param`
-*   placeholders), else `${basePath}/${actionName-with-slashes}`.
-* - Input is merged from the request body, the `queryParams` query-string
-*   fields, and any `:param` path placeholders (see `resolveActionInput`).
-*
-* Routes show up in Nest's `RoutesResolver` logger. They are registered
-* directly on the HTTP adapter (not as Nest controllers), so `@nestjs/swagger`'s
-* controller scanner does not see them - use `addSilkweaveActions()` to add them
-* to the OpenAPI document. Works on `@nestjs/platform-express` out of the box.
-* For `@nestjs/platform-fastify`, register `@fastify/express` first.
-*/
-function rest(options = {}) {
-	const basePath = (options.basePath ?? "/api").replace(/\/$/, "");
-	return {
-		name: "rest",
-		basePath,
-		register({ httpAdapter, baseContext, actions }) {
-			const logger = createRestLogger();
-			for (const action of actions) {
-				validateActionRouting(action);
-				const path = action.path ? `${basePath}/${action.path.replace(/^\//, "")}` : `${basePath}${actionNameToPath(action.name)}`;
-				const method = actionMethod(action).toLowerCase();
-				const handler = createActionHandler(action, baseContext, options.auth, logger);
-				httpAdapter[method](path, handler);
-			}
-		}
-	};
-}
-//#endregion
-//#region src/adapter/trpc.ts
-/**
-* tRPC adapter for `@silkweave/nestjs`. Builds a tRPC router from discovered
-* `@Action` methods and mounts the resulting express middleware at
-* `basePath` on Nest's HTTP adapter.
-*
-* Action names with dots (e.g. `users.list` from `@Actions('users')`) collapse
-* to camelCase procedure keys (`usersList`).
-*
-* Works on `@nestjs/platform-express`. On `@nestjs/platform-fastify`, register
-* `@fastify/express` first so Nest can serve Express-style middleware.
-*/
-function trpc(options = {}) {
-	return {
-		name: "trpc",
-		register({ httpAdapter, baseContext, actions }) {
-			const basePath = (options.basePath ?? "/trpc").replace(/\/$/, "") || "/";
-			const router = buildRouter(actions);
-			const logger = createActionLogger();
-			const createContext = async (opts) => {
-				const resolved = await resolveAuth(options.auth, opts.req.headers.authorization, baseContext.fork({ request: opts.req }));
-				if (resolved.kind === "error") {
-					for (const [key, value] of Object.entries(resolved.error.headers)) opts.res.setHeader(key, value);
-					opts.res.statusCode = resolved.error.statusCode;
-					opts.res.setHeader("Content-Type", "application/json");
-					opts.res.end(JSON.stringify(resolved.error.body));
-					throw new Error("Unauthorized");
-				}
-				return { silkweaveContext: baseContext.fork({
-					logger,
-					request: opts.req,
-					response: opts.res,
-					...resolved.authInfo ? { auth: resolved.authInfo } : {}
-				}) };
-			};
-			const middleware = createExpressMiddleware({
-				router,
-				createContext
-			});
-			httpAdapter.use(basePath, middleware);
-		}
-	};
-}
-//#endregion
-//#region src/adapter/typegen.ts
-/**
-* Typegen adapter for `@silkweave/nestjs`. Discovers every `@Action`-decorated
-* method (regardless of `transports` filtering) and writes a single `.d.ts`
-* file with REST input/output interfaces and/or a tRPC `AppRouter` type alias.
-*
-* Designed for the monorepo pattern where the server (this app) is the source
-* of truth for types and consumer apps import from `path` - e.g.
-* `path: '../app/src/types/silkweave.ts'`.
-*/
-function typegen(options) {
-	const enabled = options.enabled ?? process.env["NODE_ENV"] !== "production";
-	return {
-		name: "typegen",
-		allActions: true,
-		register({ actions }) {
-			if (!enabled) return;
-			const output = renderTypegen(actions, options.format ?? "all");
-			const target = resolve(options.path);
-			(async () => {
-				try {
-					await mkdir(dirname(target), { recursive: true });
-					await writeFile(target, output, "utf-8");
-					console.info(`@silkweave/nestjs typegen: wrote ${actions.length} action types to ${target}`);
-				} catch (err) {
-					console.error("@silkweave/nestjs typegen:", err);
-				}
-			})();
-		}
-	};
-}
-//#endregion
 //#region src/lib/metadata.ts
-const ACTION_METADATA = "__silkweave_action__";
-const ACTIONS_METADATA = "__silkweave_actions__";
-const ACTION_RESPONSE_KEY = "__silkweave_response__";
+/** Reflect-metadata key carrying `@Mcp` options on a controller method. */
+const MCP_METADATA = "__silkweave_mcp__";
 //#endregion
-//#region src/decorator/action.ts
+//#region src/decorator/mcp.ts
 /**
-* Method decorator that registers a Silkweave action.
+* Method decorator that exposes an existing NestJS controller route as an MCP
+* tool. It is **additive** - the route keeps serving HTTP exactly as before;
+* `@Mcp()` just opts the method into MCP discovery.
 *
-* The decorated method becomes an Action and is exposed via every adapter
-* configured on `SilkweaveModule` (REST/tRPC/MCP), unless `transports` is
-* provided to restrict it.
+* The tool's name, description, and input schema are reflected from the
+* method's own metadata:
+* - **fields** from the parameter decorators (`@Param`/`@Query`/`@Body`) - a
+*   `@Param('id')` becomes an `id` field; a whole-DTO `@Body() dto: CreateDto`
+*   is flattened to its properties,
+* - **types/constraints/descriptions** from `@nestjs/swagger`
+*   (`@ApiParam`/`@ApiQuery`/`@ApiProperty`/`@ApiOperation`) and, when present,
+*   `class-validator` decorators on the DTOs,
+* - optionally refined by an OpenAPI document passed to `SilkweaveModule`.
 *
-* The method receives `(input, context)` where `input` is the parsed Zod input
-* and `context` is the `SilkweaveContext` (with `logger`, `request`, optional
-* `auth`). The class instance is a normal Nest provider, so other services can
-* be injected via the constructor.
+* On a tool call the input is split back into the method's positional arguments
+* and the method is invoked directly (with `@UseGuards` guards applied first).
 *
 * @example
 * ```ts
-* @Injectable()
-* @Actions('users')
-* export class UserActions {
-*   constructor(private db: DbService) {}
-*
-*   @Action({
-*     description: 'List users',
-*     input: z.object({ limit: z.number().optional() }),
-*     kind: 'query'
-*   })
-*   list(input: { limit?: number }, ctx: SilkweaveContext) {
-*     return this.db.listUsers(input.limit)
+* @Controller('sessions/:sessionId/channels')
+* export class ChannelsController {
+*   @Get(':channelId')
+*   @ApiOperation({ summary: 'Get a specific channel by ID' })
+*   @ApiParam({ name: 'sessionId', description: 'Session ID' })
+*   @ApiParam({ name: 'channelId', description: 'Channel ID' })
+*   @Mcp()
+*   findOne(@Param('sessionId') sessionId: string, @Param('channelId') channelId: string) {
+*     return this.service.get(sessionId, channelId)
 *   }
 * }
 * ```
 */
-function Action(options) {
-	return SetMetadata(ACTION_METADATA, options);
-}
-//#endregion
-//#region src/decorator/actions.ts
-/**
-* Class decorator that groups a provider's `@Action` methods under a common
-* prefix. The prefix is joined to each method's action name with a dot
-* (e.g. `@Actions('users')` + method `list` → action name `users.list`).
-*
-* The class itself remains a normal Nest provider - add `@Injectable()`
-* separately so it can be resolved by the DI container.
-*
-* Accepts either a prefix string (shorthand) or a full options object:
-* ```ts
-* @Actions('users')
-* @Actions({ prefix: 'users', transports: ['rest', 'trpc'] })
-* ```
-*/
-function Actions(prefixOrOptions = {}) {
-	return SetMetadata(ACTIONS_METADATA, typeof prefixOrOptions === "string" ? { prefix: prefixOrOptions } : prefixOrOptions);
-}
-//#endregion
-//#region src/lib/filter.ts
-/**
-* Compile a `transports` allowlist + optional user `isEnabled` into a single
-* `(ctx) => boolean` callback compatible with `Action.isEnabled`.
-*
-* - If `transports` is omitted, the action runs on every adapter.
-* - If `transports` is set, the action is gated on `ctx.get<string>('adapter')`
-*   matching one of the listed transports. Each adapter in `@silkweave/nestjs`
-*   forks its context with `{ adapter: 'rest' | 'trpc' | 'mcp' }`.
-* - If both `transports` and `userIsEnabled` are set, they are AND-combined.
-*/
-function buildIsEnabled(transports, userIsEnabled) {
-	if (!transports && !userIsEnabled) return;
-	return (ctx) => {
-		if (transports) {
-			const adapter = ctx.getOptional("adapter");
-			if (adapter && !transports.includes(adapter)) return false;
-		}
-		return userIsEnabled ? userIsEnabled(ctx) : true;
-	};
+function Mcp(options = {}) {
+	return SetMetadata(MCP_METADATA, options);
 }
 //#endregion
 //#region ../../node_modules/.pnpm/rxjs@7.8.2/node_modules/rxjs/dist/cjs/internal/util/isFunction.js
@@ -9030,6 +8761,26 @@ var SilkweaveExecutionContext = class {
 //#endregion
 //#region src/lib/guards.ts
 /**
+* Collect the app's global guards that match an opt-in allow-list of classes.
+*
+* Reads both registration styles Nest exposes via `ApplicationConfig`:
+* `useGlobalGuards(new X())` instances (`getGlobalGuards()`) and
+* `{ provide: APP_GUARD, useClass }` DI guards (`getGlobalRequestGuards()`,
+* which yields `InstanceWrapper`s - we read `.instance` off each).
+*
+* The allow-list is intentionally explicit-by-class: a blanket "run every
+* global" would also fire unrelated globals (e.g. a `ThrottlerGuard` that
+* assumes a writable response) on every tool call. An empty allow-list runs
+* no globals, preserving the prior behavior.
+*
+* Call this at tool-call time, not at discovery time: `APP_GUARD` instances
+* aren't populated until `app.init()` finishes.
+*/
+function collectGlobalGuards(appConfig, allowList) {
+	if (allowList.length === 0) return [];
+	return [...appConfig.getGlobalGuards(), ...appConfig.getGlobalRequestGuards().map((w) => w.instance)].filter((g) => g != null).filter((g) => allowList.some((c) => g instanceof c));
+}
+/**
 * Read `@UseGuards(...)` metadata for both the method and its class and merge
 * the two lists. Method-level guards run AFTER class-level guards (matching
 * Nest's own behavior).
@@ -9069,6 +8820,532 @@ async function runGuards(guards, moduleRef, reflector, classRef, handler, reques
 	}
 }
 //#endregion
+//#region src/lib/reflect/params.ts
+/**
+* `RouteParamtypes` numeric values from `@nestjs/common` (re-declared to avoid a
+* value import of an internal enum). These are how `@Param`/`@Query`/`@Body`/...
+* tag each handler argument in `ROUTE_ARGS_METADATA`.
+*/
+const PARAMTYPE = {
+	REQUEST: 0,
+	RESPONSE: 1,
+	NEXT: 2,
+	BODY: 3,
+	QUERY: 4,
+	PARAM: 5,
+	HEADERS: 6,
+	SESSION: 7,
+	FILE: 8,
+	FILES: 9,
+	HOST: 10,
+	IP: 11,
+	RAW_BODY: 12
+};
+/**
+* Read and normalise the route-argument metadata for a controller method.
+* Returns one {@link ParamSlot} per decorated handler argument, sorted by
+* argument index.
+*/
+function readParamSlots(classRef, methodName, proto) {
+	const raw = Reflect.getMetadata(ROUTE_ARGS_METADATA, classRef, methodName);
+	if (!raw) return [];
+	const designTypes = Reflect.getMetadata("design:paramtypes", proto, methodName) ?? [];
+	const slots = [];
+	for (const key of Object.keys(raw)) {
+		const entry = raw[key];
+		const paramtype = Number(key.split(":")[0]);
+		if (Number.isNaN(paramtype)) continue;
+		slots.push({
+			paramtype,
+			index: entry.index,
+			data: typeof entry.data === "string" ? entry.data : void 0,
+			pipes: entry.pipes ?? [],
+			designType: designTypes[entry.index]
+		});
+	}
+	return slots.sort((a, b) => a.index - b.index);
+}
+//#endregion
+//#region src/lib/rebind.ts
+function newInstance(P) {
+	try {
+		return new P();
+	} catch {
+		return null;
+	}
+}
+async function applyPipes(value, pipes, metatype, type, data) {
+	if (!pipes || pipes.length === 0) return value;
+	let current = value;
+	for (const p of pipes) {
+		const pipe = typeof p === "function" ? newInstance(p) : p;
+		if (pipe && typeof pipe.transform === "function") current = await pipe.transform(current, {
+			type,
+			metatype,
+			data
+		});
+	}
+	return current;
+}
+/** Pick a subset of keys (skipping `undefined`) into a fresh object. */
+function pickFields(input, fields) {
+	const obj = {};
+	for (const f of fields) if (input[f] !== void 0) obj[f] = input[f];
+	return obj;
+}
+/** Resolve a single positional argument from one binding. */
+async function resolveArg(b, input, request, applyParamPipes) {
+	switch (b.kind) {
+		case "value": {
+			const raw = input[b.field];
+			const type = b.source === "path" ? "param" : b.source;
+			return applyParamPipes ? applyPipes(raw, b.pipes, b.metatype, type, b.field) : raw;
+		}
+		case "object": {
+			const obj = pickFields(input, b.fields);
+			return applyParamPipes ? applyPipes(obj, b.pipes, b.metatype, b.source, void 0) : obj;
+		}
+		case "params": return pickFields(input, b.fields);
+		case "headers": return b.data ? request?.headers?.[b.data.toLowerCase()] : request?.headers ?? {};
+		case "request": return request ?? { headers: {} };
+		case "ip": return request?.ip;
+		case "host": return b.data ? request?.hosts?.[b.data] : request?.hosts;
+		default: return;
+	}
+}
+/**
+* Reconstruct the controller method's positional arguments from the validated
+* tool `input` (and the request stand-in for `@Req`/`@Headers`/...), then call
+* it. `applyParamPipes` controls whether parameter-bound pipes run.
+*/
+async function invokeRebound(method, instance, input, bindings, request, applyParamPipes) {
+	const args = [];
+	for (let i = 0; i < bindings.length; i += 1) args[i] = await resolveArg(bindings[i], input, request, applyParamPipes);
+	return await method.apply(instance, args);
+}
+/** Map a non-input parameter slot (`@Req`/`@Headers`/`@Ip`/...) to its runtime binding. */
+function specialBinding(paramtype, data) {
+	switch (paramtype) {
+		case PARAMTYPE.REQUEST: return { kind: "request" };
+		case PARAMTYPE.RESPONSE:
+		case PARAMTYPE.NEXT: return { kind: "response" };
+		case PARAMTYPE.HEADERS: return {
+			kind: "headers",
+			data
+		};
+		case PARAMTYPE.IP: return { kind: "ip" };
+		case PARAMTYPE.HOST: return {
+			kind: "host",
+			data
+		};
+		case PARAMTYPE.SESSION:
+		case PARAMTYPE.FILE:
+		case PARAMTYPE.FILES:
+		case PARAMTYPE.RAW_BODY: return { kind: "missing" };
+		default: return null;
+	}
+}
+//#endregion
+//#region src/lib/reflect/classValidator.ts
+let cached;
+/**
+* Lazily resolve the optional `class-validator` peer; `null` when not installed.
+* Resolution is attempted both from this package and from the app's working
+* directory - the latter is what finds it in a pnpm install where the optional
+* peer lives in the consumer app rather than alongside `@silkweave/nestjs`. A
+* pnpm-deduped install shares one physical copy, so the metadata singleton the
+* app's decorators wrote to is the same one we read.
+*/
+function loadClassValidator() {
+	if (cached !== void 0) return cached;
+	for (const base of [import.meta.url, join(process.cwd(), "noop.js")]) try {
+		cached = createRequire(base)("class-validator");
+		return cached;
+	} catch {}
+	cached = null;
+	return cached;
+}
+/**
+* Read `class-validator` metadata for a DTO class, grouped by property name.
+* Returns an empty map when `class-validator` is not installed or the class
+* carries no validation decorators - so callers degrade gracefully to swagger /
+* `design:type` reflection.
+*/
+function classValidatorMetas(dtoType) {
+	const cv = loadClassValidator();
+	if (!cv?.getMetadataStorage) return {};
+	let metas;
+	try {
+		metas = cv.getMetadataStorage().getTargetValidationMetadatas(dtoType, null, false, false);
+	} catch {
+		return {};
+	}
+	const out = {};
+	for (const m of metas) {
+		if (!m.propertyName) continue;
+		(out[m.propertyName] ??= []).push({
+			type: m.type,
+			name: m.name,
+			constraints: m.constraints
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/lib/reflect/schema.ts
+/** `@nestjs/swagger` reflect-metadata keys. Read directly so swagger stays an optional peer. */
+const API_MODEL_PROPERTIES = "swagger/apiModelProperties";
+const API_MODEL_PROPERTIES_ARRAY = "swagger/apiModelPropertiesArray";
+/** Strip `undefined` values so a later source never clobbers an earlier one with a hole. */
+function defined(obj) {
+	const out = {};
+	for (const [k, v] of Object.entries(obj)) if (v !== void 0) out[k] = v;
+	return out;
+}
+/** Merge `over` onto `base` - defined keys of `over` win. */
+function mergeField(base, over) {
+	return {
+		...base,
+		...defined(over)
+	};
+}
+function enumToZod(values) {
+	const strings = values.filter((v) => typeof v === "string");
+	if (strings.length === values.length && strings.length > 0) return z.enum(strings);
+	const literals = values.map((v) => z.literal(v));
+	if (literals.length === 0) return z.unknown();
+	if (literals.length === 1) return literals[0];
+	return z.union(literals);
+}
+function baseToZod(d) {
+	switch (d.type) {
+		case "string": {
+			let s = z.string();
+			if (d.minLength != null) s = s.min(d.minLength);
+			if (d.maxLength != null) s = s.max(d.maxLength);
+			return s;
+		}
+		case "integer":
+		case "number": {
+			let n = z.number();
+			if (d.type === "integer") n = n.int();
+			if (d.min != null) n = n.min(d.min);
+			if (d.max != null) n = n.max(d.max);
+			return n;
+		}
+		case "boolean": return z.boolean();
+		case "array": return z.array(d.items ? fieldToZod({
+			...d.items,
+			required: true
+		}) : z.unknown());
+		case "object": return z.record(z.string(), z.unknown());
+		default: return z.unknown();
+	}
+}
+/** Convert a merged {@link FieldDesc} to a Zod schema. */
+function fieldToZod(d) {
+	let schema = d.enum?.length ? enumToZod(d.enum) : baseToZod(d);
+	if (d.description) schema = schema.describe(d.description);
+	if (d.default !== void 0) schema = schema.default(d.default);
+	else if (d.required === false) schema = schema.optional();
+	return schema;
+}
+/** Normalise a TS-enum object or an array literal to a flat value list. */
+function normalizeEnum(value) {
+	if (Array.isArray(value)) return value.filter((v) => typeof v === "string" || typeof v === "number");
+	if (value && typeof value === "object") return Object.values(value).filter((v) => typeof v === "string" || typeof v === "number");
+}
+/** Map a swagger/`design:type` type token (constructor, `[Type]`, or string) to a base type. */
+function typeTokenToBase(type) {
+	if (type == null) return;
+	if (type === String) return "string";
+	if (type === Number) return "number";
+	if (type === Boolean) return "boolean";
+	if (type === Array) return "array";
+	if (type === Date) return "string";
+	if (Array.isArray(type)) return "array";
+	if (typeof type === "string") {
+		const t = type.toLowerCase();
+		if (t === "string" || t === "number" || t === "integer" || t === "boolean" || t === "array" || t === "object") return t;
+	}
+}
+/** From the constructor TypeScript emits via `emitDecoratorMetadata`. */
+function designTypeToField(ctor) {
+	const type = typeTokenToBase(ctor);
+	const f = {};
+	if (type) f.type = type;
+	return f;
+}
+/** From an `@ApiParam`/`@ApiQuery` entry stored under `swagger/apiParameters`. */
+function swaggerParamToField(p) {
+	const f = {};
+	if (p["description"]) f.description = p["description"];
+	if (typeof p["required"] === "boolean") f.required = p["required"];
+	const type = typeTokenToBase(p["type"]);
+	if (type) f.type = type;
+	if (p["isArray"]) f.type = "array";
+	const en = normalizeEnum(p["enum"]);
+	if (en) f.enum = en;
+	if (p["schema"] && typeof p["schema"] === "object") return mergeField(f, openapiSchemaToField(p["schema"]));
+	return f;
+}
+/** From an `@ApiProperty` options object stored under `swagger/apiModelProperties`. */
+function apiPropertyToField(o) {
+	const f = {};
+	if (o["description"]) f.description = o["description"];
+	if (typeof o["required"] === "boolean") f.required = o["required"];
+	const type = typeTokenToBase(o["type"]);
+	if (type) f.type = type;
+	if (o["isArray"]) {
+		f.items = { type: type && type !== "array" ? type : "unknown" };
+		f.type = "array";
+	}
+	const en = normalizeEnum(o["enum"]);
+	if (en) f.enum = en;
+	if (o["minimum"] != null) f.min = o["minimum"];
+	if (o["maximum"] != null) f.max = o["maximum"];
+	if (o["minLength"] != null) f.minLength = o["minLength"];
+	if (o["maxLength"] != null) f.maxLength = o["maxLength"];
+	if (o["format"]) f.format = o["format"];
+	if (o["default"] !== void 0) f.default = o["default"];
+	return f;
+}
+/** `class-validator` decorator type → field base type. */
+const CV_TYPE = {
+	isString: "string",
+	isInt: "integer",
+	isBoolean: "boolean",
+	isArray: "array"
+};
+/** `class-validator` decorator type → numeric-constraint field key. */
+const CV_NUMERIC = {
+	min: "min",
+	max: "max",
+	minLength: "minLength",
+	maxLength: "maxLength"
+};
+/**
+* Fold one `class-validator` metadata entry into the field descriptor. Built-in
+* validators record their identity in `name` (`isString`, `minLength`, ...) with
+* `type: 'customValidation'`; `@IsOptional` uses `name: 'isOptional'`. We key off
+* `name`, falling back to `type`.
+*/
+function applyValidationMeta(f, meta) {
+	const key = meta.name ?? meta.type;
+	if (!key) return;
+	if (key in CV_TYPE) {
+		f.type = CV_TYPE[key];
+		return;
+	}
+	const c0 = meta.constraints?.[0];
+	if (key in CV_NUMERIC) {
+		if (typeof c0 === "number") f[CV_NUMERIC[key]] = c0;
+		return;
+	}
+	if (key === "isNumber") {
+		if (!f.type) f.type = "number";
+		return;
+	}
+	if (key === "isEmail") {
+		if (!f.type) f.type = "string";
+		f.format = "email";
+		return;
+	}
+	if (key === "isDate" || key === "isDateString") {
+		f.type = "string";
+		f.format = "date-time";
+		return;
+	}
+	if (key === "isEnum") {
+		const e = normalizeEnum(c0);
+		if (e) f.enum = e;
+		return;
+	}
+	if (key === "isOptional") f.required = false;
+}
+/** From an array of `class-validator` validation-metadata entries for one property. */
+function classValidatorToField(metas) {
+	const f = {};
+	for (const meta of metas) applyValidationMeta(f, meta);
+	return f;
+}
+/** From an OpenAPI Schema Object (used by both the doc and `@ApiParam({ schema })`). */
+function openapiSchemaToField(schema) {
+	const f = {};
+	const type = typeof schema["type"] === "string" ? schema["type"].toLowerCase() : void 0;
+	if (type === "string" || type === "number" || type === "integer" || type === "boolean" || type === "array" || type === "object") f.type = type;
+	if (schema["description"]) f.description = schema["description"];
+	const en = normalizeEnum(schema["enum"]);
+	if (en) f.enum = en;
+	if (schema["minimum"] != null) f.min = schema["minimum"];
+	if (schema["maximum"] != null) f.max = schema["maximum"];
+	if (schema["minLength"] != null) f.minLength = schema["minLength"];
+	if (schema["maxLength"] != null) f.maxLength = schema["maxLength"];
+	if (schema["format"]) f.format = schema["format"];
+	if (schema["default"] !== void 0) f.default = schema["default"];
+	if (schema["items"] && typeof schema["items"] === "object") f.items = openapiSchemaToField(schema["items"]);
+	return f;
+}
+/**
+* Reflect a whole-DTO class (`@Body() dto: CreateDto`) into per-property
+* {@link FieldDesc}s. Property names are the union of `@ApiProperty` and
+* `class-validator` decorated fields; each field merges `design:type` (base),
+* then `class-validator` constraints, then `@ApiProperty` (highest). Properties
+* default to required unless a source marks them optional.
+*/
+function reflectDtoFields(dtoType) {
+	const proto = dtoType?.prototype;
+	if (!proto) return {};
+	const cvMetas = classValidatorMetas(dtoType);
+	const names = /* @__PURE__ */ new Set();
+	const swaggerArray = Reflect.getMetadata(API_MODEL_PROPERTIES_ARRAY, proto) ?? [];
+	for (const entry of swaggerArray) names.add(entry.replace(/^:/, ""));
+	for (const name of Object.keys(cvMetas)) names.add(name);
+	const out = {};
+	for (const name of names) {
+		let f = designTypeToField(Reflect.getMetadata("design:type", proto, name));
+		if (cvMetas[name]) f = mergeField(f, classValidatorToField(cvMetas[name]));
+		const apiProp = Reflect.getMetadata(API_MODEL_PROPERTIES, proto, name);
+		if (apiProp) {
+			const fromApi = apiPropertyToField(apiProp);
+			if (fromApi.required === void 0 && apiProp["required"] === void 0) fromApi.required = true;
+			f = mergeField(f, fromApi);
+		}
+		if (f.required === void 0) f.required = true;
+		out[name] = f;
+	}
+	return out;
+}
+//#endregion
+//#region src/lib/reflect/openapi.ts
+/** Index a document's operations by `${METHOD} ${path}` for fast matching. */
+function buildOpenApiLookup(doc) {
+	const operations = /* @__PURE__ */ new Map();
+	for (const [path, item] of Object.entries(doc.paths ?? {})) for (const [verb, op] of Object.entries(item ?? {})) operations.set(`${verb.toUpperCase()} ${path}`, op);
+	return {
+		doc,
+		operations
+	};
+}
+/** Locate the operation for a route, tolerating a global path prefix on the document side. */
+function findOperation(lookup, method, openapiPath) {
+	const exact = lookup.operations.get(`${method} ${openapiPath}`);
+	if (exact) return exact;
+	for (const [key, op] of lookup.operations) {
+		const [verb, path] = key.split(" ");
+		if (verb === method && (path.endsWith(openapiPath) || openapiPath.endsWith(path))) return op;
+	}
+}
+function resolveRef(doc, schema) {
+	let current = schema;
+	let guard = 0;
+	while (current && typeof current === "object" && typeof current["$ref"] === "string" && guard < 10) {
+		const match = /^#\/components\/schemas\/(.+)$/.exec(current["$ref"]);
+		if (!match) break;
+		current = doc.components?.schemas?.[match[1]];
+		guard += 1;
+	}
+	return current;
+}
+/**
+* Resolve the per-field descriptors for a route from an ingested OpenAPI
+* document. Merges `parameters` (path/query/header) and the JSON request-body
+* schema's properties into a single field map. Returns `{}` when the operation
+* isn't found - callers fall back to decorator reflection.
+*/
+function openApiFields(lookup, method, openapiPath) {
+	const op = findOperation(lookup, method, openapiPath);
+	if (!op) return {};
+	const out = {};
+	for (const param of op["parameters"] ?? []) {
+		const name = typeof param["name"] === "string" ? param["name"] : void 0;
+		if (!name) continue;
+		const schema = param["schema"] ? resolveRef(lookup.doc, param["schema"]) : void 0;
+		let field = schema ? openapiSchemaToField(schema) : {};
+		if (param["description"]) field = mergeField(field, { description: param["description"] });
+		if (typeof param["required"] === "boolean") field = mergeField(field, { required: param["required"] });
+		out[name] = field;
+	}
+	const bodySchema = resolveRef(lookup.doc, op["requestBody"]?.["content"]?.["application/json"]?.["schema"]);
+	if (bodySchema && typeof bodySchema === "object" && bodySchema["properties"]) {
+		const required = new Set(Array.isArray(bodySchema["required"]) ? bodySchema["required"] : []);
+		for (const [name, propSchema] of Object.entries(bodySchema["properties"])) {
+			const field = openapiSchemaToField(resolveRef(lookup.doc, propSchema));
+			field.required = required.has(name);
+			out[name] = field;
+		}
+	}
+	return out;
+}
+//#endregion
+//#region src/lib/reflect/route.ts
+/**
+* `RequestMethod` numeric values (from `@nestjs/common`) mapped to verbs. We
+* map our own table rather than importing the enum to avoid pulling a value
+* import for a handful of constants.
+*/
+const REQUEST_METHOD = {
+	0: "GET",
+	1: "POST",
+	2: "PUT",
+	3: "DELETE",
+	4: "PATCH",
+	6: "OPTIONS",
+	7: "HEAD"
+};
+function normalizeSegment(value) {
+	if (typeof value !== "string") return "";
+	return value.replace(/^\/+/, "").replace(/\/+$/, "");
+}
+function joinPath(...segments) {
+	return segments.map(normalizeSegment).filter(Boolean).join("/");
+}
+/**
+* Resolve the composed route (controller prefix + method path), HTTP verb, and
+* path-param names for a decorated controller method, reading Nest's own
+* `PATH_METADATA`/`METHOD_METADATA` reflection.
+*/
+function reflectRoute(classRef, method) {
+	const classPath = Reflect.getMetadata(PATH_METADATA, classRef);
+	const methodPath = Reflect.getMetadata(PATH_METADATA, method);
+	const verbCode = Reflect.getMetadata(METHOD_METADATA, method);
+	const path = joinPath(Array.isArray(classPath) ? classPath[0] ?? "" : classPath ?? "", Array.isArray(methodPath) ? methodPath[0] ?? "" : methodPath ?? "");
+	const httpMethod = REQUEST_METHOD[verbCode ?? 0] ?? "GET";
+	const pathParams = [...path.matchAll(/:([A-Za-z0-9_]+)/g)].map((m) => m[1]);
+	return {
+		method: httpMethod,
+		path,
+		openapiPath: `/${path.replace(/:([A-Za-z0-9_]+)/g, "{$1}")}`,
+		pathParams
+	};
+}
+//#endregion
+//#region src/lib/reflect/swagger.ts
+/** `@nestjs/swagger` reflect-metadata keys (read directly - swagger is an optional peer). */
+const API_OPERATION = "swagger/apiOperation";
+const API_PARAMETERS = "swagger/apiParameters";
+/**
+* Read operation-level `@nestjs/swagger` metadata off a controller method:
+* `@ApiOperation` (summary/description) and the `@ApiParam`/`@ApiQuery` array
+* (each describing one path/query field). Returns empty data when swagger
+* decorators are absent.
+*/
+function reflectOperation(method) {
+	const operation = Reflect.getMetadata(API_OPERATION, method);
+	const description = operation ? typeof operation["summary"] === "string" && operation["summary"] ? operation["summary"] : typeof operation["description"] === "string" ? operation["description"] : void 0 : void 0;
+	const parameters = Reflect.getMetadata(API_PARAMETERS, method) ?? [];
+	const params = {};
+	for (const p of parameters) {
+		const name = typeof p["name"] === "string" ? p["name"] : void 0;
+		if (!name) continue;
+		params[name] = swaggerParamToField(p);
+	}
+	return {
+		description,
+		params
+	};
+}
+//#endregion
 //#region \0@oxc-project+runtime@0.127.0/helpers/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
@@ -9082,61 +9359,69 @@ function __decorate(decorators, target, key, desc) {
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 //#endregion
-//#region src/lib/discovery.ts
-var _ref$1, _ref2$1, _ref3, _ref4;
-let ActionDiscovery = class ActionDiscovery {
-	constructor(discovery, scanner, reflector, moduleRef) {
+//#region src/lib/controllerDiscovery.ts
+var _ref$1, _ref2$1, _ref3, _ref4, _ref5;
+let ControllerDiscovery = class ControllerDiscovery {
+	constructor(discovery, scanner, reflector, moduleRef, appConfig) {
 		this.discovery = discovery;
 		this.scanner = scanner;
 		this.reflector = reflector;
 		this.moduleRef = moduleRef;
+		this.appConfig = appConfig;
 	}
 	/**
-	* Walk every Nest provider, find methods annotated with `@Action`, and build
-	* a list of core `Action` objects ready to feed into `silkweave().actions()`.
-	*
-	* Action invocation is wrapped to (a) run `@UseGuards` guards declared on the
-	* method or its class against the incoming request (read from
-	* `ctx.get('request')`, populated by REST/tRPC and by MCP-over-HTTP from the
-	* SDK's `extra.requestInfo`) and (b) bind `this` to the resolved Nest provider
-	* so DI-injected dependencies remain available.
+	* Walk every Nest provider/controller, find methods annotated with `@Mcp`,
+	* and build a core `Action` per method whose input schema is reflected from
+	* the route + parameter decorators (+ optional OpenAPI document) and whose
+	* `run` re-binds the validated input back into the method's positional
+	* arguments (with `@UseGuards` guards - and any opted-in `globalGuards` -
+	* applied first).
 	*/
-	discover() {
+	discover(openapi, globalGuards = []) {
+		const lookup = openapi ? buildOpenApiLookup(openapi) : void 0;
 		const discovered = [];
-		const wrappers = this.discovery.getProviders();
-		for (const wrapper of wrappers) {
+		for (const wrapper of this.discovery.getProviders().concat(this.discovery.getControllers())) {
 			const { instance } = wrapper;
 			if (!instance || typeof instance !== "object") continue;
 			const proto = Object.getPrototypeOf(instance);
 			if (!proto) continue;
 			const classRef = instance.constructor;
-			const classMeta = this.reflector.get("__silkweave_actions__", classRef) ?? {};
 			for (const methodName of this.scanner.getAllMethodNames(proto)) {
 				const method = proto[methodName];
 				if (typeof method !== "function") continue;
-				const meta = this.reflector.get(ACTION_METADATA, method);
+				const meta = this.reflector.get(MCP_METADATA, method);
 				if (!meta) continue;
 				discovered.push({
 					instance,
 					classRef,
 					method,
 					methodName,
-					meta,
-					classMeta
+					meta
 				});
 			}
 		}
-		return discovered.map((d) => this.toAction(d));
-	}
-	toAction(d) {
-		const baseName = d.meta.name ?? kebabCase(d.methodName);
-		const name = d.classMeta.prefix ? `${d.classMeta.prefix}.${baseName}` : baseName;
-		const isEnabled = buildIsEnabled(d.meta.transports ?? d.classMeta.transports, d.meta.isEnabled);
+		return discovered.map((d) => this.toAction(d, lookup, globalGuards));
+	}
+	toAction(d, lookup, globalGuards) {
+		const proto = Object.getPrototypeOf(d.instance);
+		const route = reflectRoute(d.classRef, d.method);
+		const slots = readParamSlots(d.classRef, d.methodName, proto);
+		const operation = reflectOperation(d.method);
+		const docFields = lookup ? openApiFields(lookup, route.method, route.openapiPath) : {};
+		const { shape, bindings } = this.buildInput(d, route.pathParams, slots, operation.params, docFields);
+		const base = d.classRef.name.replace(/Controller$/, "");
+		const name = d.meta.name ?? `${base}.${d.methodName}`;
+		const description = d.meta.description ?? operation.description ?? `${d.methodName} (${route.method} /${route.path})`;
+		const applyParamPipes = d.meta.pipes !== "skip";
 		const guards = collectGuards(this.reflector, d.classRef, d.method);
-		const moduleRef = this.moduleRef;
-		const reflector = this.reflector;
-		const applyGuards = async (context) => {
-			if (guards.length === 0) return;
+		const pathFields = pathParamFields(bindings);
+		const { moduleRef, reflector, appConfig } = this;
+		const classRef = d.classRef;
+		const method = d.method;
+		const instance = d.instance;
+		const applyGuards = async (context, input) => {
+			const all = [...collectGlobalGuards(appConfig, globalGuards), ...guards];
+			if (all.length === 0) return;
 			const request = context.getOptional("request");
 			const response = context.getOptional("response") ?? null;
 			const hasRequest = request != null;
@@ -9145,151 +9430,140 @@ let ActionDiscovery = class ActionDiscovery {
 				params: {},
 				query: {}
 			};
-			await runGuards(guards, moduleRef, reflector, d.classRef, d.method, guardRequest, response, hasRequest ? "http" : "rpc");
-		};
-		if (d.method.constructor?.name === "AsyncGeneratorFunction") {
-			if (!d.meta.chunk) throw new Error(`@Action "${name}" is an async generator but has no \`chunk\` schema`);
-			const method = d.method;
-			const instance = d.instance;
-			return createAction({
-				name,
-				description: d.meta.description,
-				input: d.meta.input,
-				chunk: d.meta.chunk,
-				kind: d.meta.kind ?? "mutation",
-				method: d.meta.method,
-				path: d.meta.path,
-				queryParams: d.meta.queryParams,
-				args: d.meta.args,
-				isEnabled,
-				toolResult: d.meta.toolResult,
-				run: async function* (input, context) {
-					await applyGuards(context);
-					yield* method.call(instance, input, context);
-				}
-			});
-		}
+			populatePathParams(guardRequest, pathFields, input);
+			await runGuards(all, moduleRef, reflector, classRef, method, guardRequest, response, hasRequest ? "http" : "rpc");
+		};
 		return createAction({
 			name,
-			description: d.meta.description,
-			input: d.meta.input,
-			output: d.meta.output,
-			kind: d.meta.kind ?? "mutation",
-			method: d.meta.method,
-			path: d.meta.path,
-			queryParams: d.meta.queryParams,
-			args: d.meta.args,
-			isEnabled,
-			toolResult: d.meta.toolResult,
+			description,
+			input: z.object(shape),
+			isEnabled: (ctx) => ctx.getOptional("adapter") === "mcp",
 			run: async (input, context) => {
-				await applyGuards(context);
-				return await d.method.call(d.instance, input, context);
+				await applyGuards(context, input);
+				return await invokeRebound(method, instance, input, bindings, context.getOptional("request"), applyParamPipes) ?? {};
 			}
 		});
 	}
+	/** Build the merged Zod input shape and the per-argument re-bind plan. */
+	buildInput(d, pathParams, slots, operationParams, docFields) {
+		const proto = Object.getPrototypeOf(d.instance);
+		const designTypes = Reflect.getMetadata("design:paramtypes", proto, d.methodName) ?? [];
+		const fields = {};
+		const maxIndex = slots.reduce((m, s) => Math.max(m, s.index), -1);
+		const bindings = Array.from({ length: maxIndex + 1 }, () => ({ kind: "missing" }));
+		const addField = (name, desc) => {
+			fields[name] = name in fields ? mergeField(fields[name], desc) : desc;
+		};
+		for (const slot of slots) {
+			const { binding, fields: contributed } = contributeSlot(slot, pathParams, designTypes);
+			bindings[slot.index] = binding;
+			for (const [name, desc] of Object.entries(contributed)) addField(name, desc);
+		}
+		for (const [name, desc] of Object.entries(operationParams)) if (name in fields) fields[name] = mergeField(fields[name], desc);
+		for (const [name, desc] of Object.entries(docFields)) if (name in fields) fields[name] = mergeField(fields[name], desc);
+		const shape = {};
+		for (const [name, desc] of Object.entries(fields)) shape[name] = fieldToZod(desc);
+		Object.assign(shape, d.meta.input ?? {});
+		return {
+			shape,
+			bindings
+		};
+	}
 };
-ActionDiscovery = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [
+ControllerDiscovery = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [
 	typeof (_ref$1 = typeof DiscoveryService !== "undefined" && DiscoveryService) === "function" ? _ref$1 : Object,
 	typeof (_ref2$1 = typeof MetadataScanner !== "undefined" && MetadataScanner) === "function" ? _ref2$1 : Object,
 	typeof (_ref3 = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref3 : Object,
-	typeof (_ref4 = typeof ModuleRef !== "undefined" && ModuleRef) === "function" ? _ref4 : Object
-])], ActionDiscovery);
-//#endregion
-//#region src/lib/openapi.ts
-/** Convert a route template's `:param` placeholders to OpenAPI `{param}` form. */
-function toOpenApiPath(template) {
-	return template.replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+	typeof (_ref4 = typeof ModuleRef !== "undefined" && ModuleRef) === "function" ? _ref4 : Object,
+	typeof (_ref5 = typeof ApplicationConfig !== "undefined" && ApplicationConfig) === "function" ? _ref5 : Object
+])], ControllerDiscovery);
+/** Input field names that originate from the URL path (`@Param`), per the re-bind plan. */
+function pathParamFields(bindings) {
+	const fields = [];
+	for (const b of bindings) if (b.kind === "params") fields.push(...b.fields);
+	else if (b.kind === "value" && b.source === "path") fields.push(b.field);
+	return fields;
 }
-/** The OpenAPI path key for an action - mirrors the `rest()` adapter's routing. */
-function actionRoute(action, basePath) {
-	return toOpenApiPath(`${basePath}/${action.path ? action.path.replace(/^\//, "") : action.name.replace(/\./g, "/")}`.replace(/\/{2,}/g, "/"));
+/**
+* Fill `request.params` with the reflected path fields from the validated input,
+* matching what Express would populate over REST (raw string values). Only adds
+* keys that are absent, so a real REST request's params are never overwritten.
+*/
+function populatePathParams(request, pathFields, input) {
+	if (pathFields.length === 0 || typeof request !== "object" || request === null) return;
+	const params = request.params ??= {};
+	for (const field of pathFields) if (!(field in params) && input[field] !== void 0) params[field] = String(input[field]);
 }
-/** `z.toJSONSchema` tags a top-level `$schema`; drop it for a tidy OpenAPI doc. */
-function toJsonSchema(schema) {
-	const { $schema: _schema, ...rest } = z.toJSONSchema(schema);
-	return rest;
+function designTypeAt(designTypes, index) {
+	const ctor = designTypes[index];
+	if (ctor === String) return { type: "string" };
+	if (ctor === Number) return { type: "number" };
+	if (ctor === Boolean) return { type: "boolean" };
+	return {};
 }
-function responseSchema(action) {
-	if (action.output) return toJsonSchema(action.output);
-	if (action.chunk) return {
-		type: "array",
-		items: toJsonSchema(action.chunk)
+/** A `@Param('id')` scalar or a bare `@Param()` covering all path params. */
+function paramContribution(slot, pathParams) {
+	if (slot.data) return {
+		binding: {
+			kind: "value",
+			field: slot.data,
+			source: "path",
+			metatype: slot.designType,
+			pipes: slot.pipes
+		},
+		fields: { [slot.data]: {
+			type: "string",
+			required: true
+		} }
 	};
-}
-/** Split an action's input fields into OpenAPI path/query parameters and a body, matching the `rest()` adapter. */
-function splitInputSources(action, hasBody) {
-	const json = z.toJSONSchema(action.input);
-	const required = new Set(json.required ?? []);
-	const pathParams = new Set(pathParamNames(action.path));
-	const queryKeys = new Set((action.queryParams ?? []).map(String));
-	const split = {
-		parameters: [],
-		bodyProps: {},
-		bodyRequired: []
+	const fields = {};
+	for (const p of pathParams) fields[p] = {
+		type: "string",
+		required: true
+	};
+	return {
+		binding: {
+			kind: "params",
+			fields: pathParams
+		},
+		fields
 	};
-	for (const [key, schema] of Object.entries(json.properties ?? {})) if (pathParams.has(key)) split.parameters.push({
-		name: key,
-		in: "path",
-		required: true,
-		schema
-	});
-	else if (!hasBody || queryKeys.has(key)) split.parameters.push({
-		name: key,
-		in: "query",
-		required: required.has(key),
-		schema
-	});
-	else {
-		split.bodyProps[key] = schema;
-		if (required.has(key)) split.bodyRequired.push(key);
-	}
-	return split;
 }
-/** Build the OpenAPI operation object for a single action. */
-function buildOperation(action, tag) {
-	const hasBody = methodHasBody(actionMethod(action));
-	const { parameters, bodyProps, bodyRequired } = splitInputSources(action, hasBody);
-	const response = responseSchema(action);
-	const operation = {
-		tags: [tag],
-		summary: action.description,
-		operationId: camelCase(action.name),
-		responses: { 200: {
-			description: "Successful response",
-			...response ? { content: { "application/json": { schema: response } } } : {}
-		} }
+/** A `@Query('x')`/`@Body('x')` scalar or a whole-DTO `@Query()`/`@Body()`. */
+function bodyOrQueryContribution(slot, source, requiredScalar, designTypes) {
+	if (slot.data) return {
+		binding: {
+			kind: "value",
+			field: slot.data,
+			source,
+			metatype: slot.designType,
+			pipes: slot.pipes
+		},
+		fields: { [slot.data]: mergeField(designTypeAt(designTypes, slot.index), { required: requiredScalar }) }
 	};
-	if (parameters.length) operation.parameters = parameters;
-	if (hasBody && Object.keys(bodyProps).length) operation.requestBody = {
-		required: bodyRequired.length > 0,
-		content: { "application/json": { schema: {
-			type: "object",
-			properties: bodyProps,
-			required: bodyRequired
-		} } }
+	const dtoFields = reflectDtoFields(slot.designType);
+	return {
+		binding: {
+			kind: "object",
+			source,
+			fields: Object.keys(dtoFields),
+			metatype: slot.designType,
+			pipes: slot.pipes
+		},
+		fields: dtoFields
 	};
-	return operation;
 }
-/**
-* Build an OpenAPI `paths` fragment for a set of Silkweave actions, mirroring
-* exactly how the `rest()` adapter routes them: the same HTTP verb (`method` ??
-* `kind`), the same `path`/`name`-derived route, and the same path/query/body
-* field split (`pathParamNames` + `queryParams`). Schemas are inlined from the
-* Zod input/output via `z.toJSONSchema`; no shared components are emitted.
-*/
-function buildActionPaths(actions, options = {}) {
-	const basePath = (options.basePath ?? "/api").replace(/\/$/, "");
-	const tag = options.tag ?? "Actions";
-	const paths = {};
-	for (const action of actions) {
-		const method = actionMethod(action).toLowerCase();
-		const route = actionRoute(action, basePath);
-		paths[route] = {
-			...paths[route] ?? {},
-			[method]: buildOperation(action, tag)
-		};
-	}
-	return paths;
+/** Map one parameter slot to its input-field contribution and re-bind instruction. */
+function contributeSlot(slot, pathParams, designTypes) {
+	switch (slot.paramtype) {
+		case PARAMTYPE.PARAM: return paramContribution(slot, pathParams);
+		case PARAMTYPE.QUERY: return bodyOrQueryContribution(slot, "query", false, designTypes);
+		case PARAMTYPE.BODY: return bodyOrQueryContribution(slot, "body", true, designTypes);
+		default: return {
+			binding: specialBinding(slot.paramtype, slot.data) ?? { kind: "missing" },
+			fields: {}
+		};
+	}
 }
 //#endregion
 //#region src/lib/types.ts
@@ -9318,14 +9592,14 @@ let SilkweaveModule = _SilkweaveModule = class SilkweaveModule {
 			providers: [{
 				provide: SILKWEAVE_MODULE_OPTIONS,
 				useValue: options
-			}, ActionDiscovery],
+			}, ControllerDiscovery],
 			exports: []
 		};
 	}
 	configure(_consumer) {
 		const httpAdapter = this.httpAdapterHost.httpAdapter;
 		if (!httpAdapter) throw new Error("@silkweave/nestjs: HttpAdapterHost.httpAdapter is not available.");
-		const allActions = this.discovery.discover();
+		const allActions = this.discovery.discover(this.options.openapi, this.options.globalGuards);
 		for (const adapter of this.options.adapters) {
 			const baseContext = createContext({
 				...this.options.context ?? {},
@@ -9346,60 +9620,11 @@ SilkweaveModule = _SilkweaveModule = __decorate([
 	__decorateParam(0, Inject(SILKWEAVE_MODULE_OPTIONS)),
 	__decorateMetadata("design:paramtypes", [
 		Object,
-		typeof (_ref = typeof ActionDiscovery !== "undefined" && ActionDiscovery) === "function" ? _ref : Object,
+		typeof (_ref = typeof ControllerDiscovery !== "undefined" && ControllerDiscovery) === "function" ? _ref : Object,
 		typeof (_ref2 = typeof HttpAdapterHost !== "undefined" && HttpAdapterHost) === "function" ? _ref2 : Object
 	])
 ], SilkweaveModule);
 //#endregion
-//#region src/lib/swagger.ts
-/**
-* Merge every REST-exposed Silkweave `@Action` into a NestJS Swagger
-* `OpenAPIObject`.
-*
-* `@nestjs/swagger` builds its document by scanning **controllers**, but
-* Silkweave registers action routes directly on the HTTP adapter (so they sit
-* ahead of controllers in the request pipeline) - which means the scanner never
-* sees them. This helper closes that gap: it discovers the actions through the
-* same `ActionDiscovery` provider the `rest()` adapter uses, builds OpenAPI
-* paths with the same routing logic (`buildActionPaths`), and merges them into
-* the document. The result stays in sync with the live routes without any
-* dynamic controllers.
-*
-* Call it between `SwaggerModule.createDocument()` and `SwaggerModule.setup()`:
-*
-* @example
-* ```ts
-* const document = SwaggerModule.createDocument(app, config)
-* addSilkweaveActions(app, document)
-* SwaggerModule.setup('api/docs', app, document)
-* ```
-*/
-function addSilkweaveActions(app, document, options = {}) {
-	const discovery = app.get(ActionDiscovery);
-	const moduleOptions = app.get(SILKWEAVE_MODULE_OPTIONS);
-	const restAdapter = moduleOptions.adapters.find((adapter) => adapter.name === "rest");
-	const basePath = options.basePath ?? restAdapter?.basePath ?? "/api";
-	const allActions = discovery.discover();
-	const paths = buildActionPaths(options.includeDisabled ? allActions : allActions.filter((action) => isRestEnabled(action, moduleOptions)), {
-		basePath,
-		tag: options.tag
-	});
-	document.paths ??= {};
-	for (const [route, item] of Object.entries(paths)) document.paths[route] = {
-		...document.paths[route] ?? {},
-		...item
-	};
-	return document;
-}
-/** Whether an action would be registered by the `rest()` adapter (adapter: 'rest'). */
-function isRestEnabled(action, moduleOptions) {
-	if (!action.isEnabled) return true;
-	return action.isEnabled(createContext({
-		...moduleOptions.context ?? {},
-		adapter: "rest"
-	}));
-}
-//#endregion
-export { ACTIONS_METADATA, ACTION_METADATA, ACTION_RESPONSE_KEY, Action, ActionDiscovery, Actions, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, addSilkweaveActions, buildActionPaths, buildIsEnabled, collectGuards, mcp, rest, runGuards, trpc, typegen };
+export { ControllerDiscovery, MCP_METADATA, Mcp, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, apiPropertyToField, buildOpenApiLookup, classValidatorToField, collectGlobalGuards, collectGuards, designTypeToField, fieldToZod, invokeRebound, mcp, mergeField, normalizeEnum, openApiFields, openapiSchemaToField, reflectDtoFields, runGuards, specialBinding, swaggerParamToField, typeTokenToBase };
 
 //# sourceMappingURL=index.mjs.map