@silkweave/nestjs 1.9.0 → 1.9.1

package/build/index.mjs

@@ -1,84 +1,73 @@
-import { createMcpExpressHandler } from "@silkweave/mcp";
+import { authMiddleware, mcpCors, mcpTransport, oauthRoutes, protectedResourceMetadata, sideloadResource } from "@silkweave/mcp";
+import express from "express";
 import { ForbiddenException, HttpException, Inject, Injectable, Module, SetMetadata } from "@nestjs/common";
 import { validateToken } from "@silkweave/auth";
-import { SilkweaveError, createAction, silkweave } from "@silkweave/core";
+import { SilkweaveError, createAction, createContext } from "@silkweave/core";
 import { buildLogLevels } from "@silkweave/logger";
 import { z } from "zod/v4";
 import { buildRouter, createActionLogger, resolveAuth } from "@silkweave/trpc";
 import { createExpressMiddleware } from "@trpc/server/adapters/express";
+import { renderTypegen } from "@silkweave/typegen";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
 import { DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
 import { kebabCase } from "change-case";
 import { GUARDS_METADATA } from "@nestjs/common/constants.js";
 //#region \0rolldown/runtime.js
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-//#endregion
-//#region src/lib/slot.ts
-function createMiddlewareSlot(label) {
-	let handler = (_req, res) => {
-		res.statusCode = 503;
-		res.setHeader("Content-Type", "application/json");
-		res.end(JSON.stringify({
-			error: "not_ready",
-			message: `${label} adapter has not started yet`
-		}));
-	};
-	return {
-		middleware: (req, res, next) => handler(req, res, next),
-		set: (h) => {
-			handler = h;
-		}
-	};
-}
-/**
-* Mount a middleware slot at the given base path on Nest's HTTP adapter and
-* return the slot's `set()` callback. The slot middleware is installed
-* synchronously so it sits in the Express stack before Nest's later-installed
-* 404 catch-all.
-*/
-function reserveSlot(httpAdapter, basePath, label) {
-	const slot = createMiddlewareSlot(label);
-	httpAdapter.use(basePath, slot.middleware);
-	return slot.set;
-}
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
 //#region src/adapter/mcp.ts
+function compose(...handlers) {
+	return (req, res, next) => {
+		let i = 0;
+		const dispatch = () => {
+			const h = handlers[i++];
+			if (!h) return next();
+			h(req, res, (err) => err ? next(err) : dispatch());
+		};
+		dispatch();
+	};
+}
 /**
-* MCP Streamable HTTP adapter for `@silkweave/nestjs`. Builds the same Express
-* sub-app that `@silkweave/mcp`'s `http()` adapter uses internally (via
-* `createMcpExpressHandler`) and mounts it on Nest's running HTTP server at
-* the configured base path.
+* MCP adapter for `@silkweave/nestjs`. Registers the MCP Streamable HTTP
+* transport, sideload, well-known and OAuth routes individually on Nest's
+* HTTP adapter at the configured `basePath` (default `/mcp`):
 *
-* Routes provided by the mounted sub-app:
-* - `POST /mcp`, `GET /mcp`, `DELETE /mcp` — MCP Streamable HTTP transport
-* - `GET /resource/:id` — sideload resources (large MCP responses)
-* - `GET /.well-known/oauth-protected-resource` (when `auth.resourceUrl`/`auth.authorizationServers` set)
-* - `GET /authorize`, `POST /token`, `POST /register`, `GET /auth/callback` (when `auth.provider` set)
+* - `POST/GET/DELETE ${basePath}` - Streamable HTTP transport
+* - `GET ${basePath}/resource/:id` - sideload (`sideloadResources` opt-out)
+* - `GET ${basePath}/.well-known/oauth-protected-resource` - RFC 9728 metadata (when `auth.resourceUrl`/`auth.authorizationServers` set)
+* - `GET ${basePath}/authorize`, `POST ${basePath}/token`, `POST ${basePath}/register`, `GET ${basePath}${callbackPath}` (when `auth.provider` set)
 *
-* Note: this adapter mounts an Express sub-app. On `@nestjs/platform-fastify`,
-* register `@fastify/express` before this adapter so Nest can serve Express
-* middleware.
+* Each route is a real Nest-level route - they show up in
+* `RoutesResolver`'s log and there is no sub-app or middleware-slot
+* indirection.
 */
 function mcp(options = {}) {
 	return {
 		name: "mcp",
-		install: (host) => {
-			const httpAdapter = host.httpAdapter;
-			if (!httpAdapter) throw new Error("@silkweave/nestjs mcp(): HttpAdapterHost.httpAdapter is not available.");
-			const { basePath = "/", auth, ...handlerOptions } = options;
-			const setHandler = reserveSlot(httpAdapter, basePath === "/" ? "/" : basePath.replace(/\/$/, ""), "MCP");
-			return (silkweaveOptions, baseContext) => {
-				const context = baseContext.fork({ adapter: "mcp" });
-				return {
-					context,
-					start: async (actions) => {
-						setHandler(createMcpExpressHandler(silkweaveOptions, context, actions, {
-							...handlerOptions,
-							auth
-						}));
-					},
-					stop: async () => {}
-				};
-			};
+		register({ httpAdapter, silkweaveOptions, baseContext, actions }) {
+			const basePath = (options.basePath ?? "/mcp").replace(/\/$/, "");
+			if (!basePath) throw new Error("@silkweave/nestjs mcp(): basePath cannot be empty or \"/\" - pick a path like \"/mcp\".");
+			const adapter = httpAdapter;
+			const corsHandler = mcpCors(options.cors ?? true);
+			const auth = options.auth;
+			const guard = auth ? authMiddleware(auth, baseContext) : null;
+			const prefix = (...handlers) => handlers.filter((h) => Boolean(h));
+			if (auth?.authorizationServers?.length && auth.resourceUrl) adapter.get(`${basePath}/.well-known/oauth-protected-resource`, ...prefix(corsHandler, protectedResourceMetadata(auth)));
+			if (auth?.provider) {
+				const oauth = oauthRoutes(auth);
+				adapter.get(`${basePath}/.well-known/oauth-authorization-server`, ...prefix(corsHandler, oauth.wellKnownAuthServer));
+				adapter.get(`${basePath}/authorize`, ...prefix(corsHandler, oauth.authorize));
+				adapter.get(`${basePath}${oauth.callbackPath}`, ...prefix(corsHandler, oauth.callback));
+				adapter.post(`${basePath}/token`, ...prefix(corsHandler, ...oauth.token));
+				adapter.post(`${basePath}/register`, ...prefix(corsHandler, ...oauth.register));
+			}
+			const protect = guard ? (h) => compose(guard, h) : (h) => h;
+			if (options.sideloadResources !== false) adapter.get(`${basePath}/resource/:id`, ...prefix(corsHandler, protect(sideloadResource({ resourceDir: options.resourceDir }))));
+			const transport = mcpTransport(silkweaveOptions, baseContext, actions);
+			adapter.post(basePath, ...prefix(corsHandler, express.json(), protect(transport.post)));
+			adapter.get(basePath, ...prefix(corsHandler, protect(transport.stream)));
+			adapter.delete(basePath, ...prefix(corsHandler, protect(transport.stream)));
 		}
 	};
 }
@@ -114,7 +103,7 @@ async function readJsonBody(req) {
 			try {
 				resolve(JSON.parse(Buffer.concat(chunks).toString("utf-8")));
 			} catch (err) {
-				reject(err);
+				reject(err instanceof Error ? err : /* @__PURE__ */ new Error("Unable to parse JSON body"));
 			}
 		});
 		req.on("error", reject);
@@ -164,25 +153,8 @@ function handleRestError(err, res) {
 		message: "Internal error"
 	}, 500);
 }
-function buildHandler(actions, context, auth) {
-	const routes = /* @__PURE__ */ new Map();
-	for (const action of actions) {
-		const method = action.kind === "query" ? "GET" : "POST";
-		routes.set(`${method} ${actionNameToPath(action.name)}`, action);
-	}
-	const logger = createRestLogger();
-	return async (req, res, next) => {
-		const pathOnly = (req.url ?? "/").split("?")[0];
-		const key = `${req.method ?? ""} ${pathOnly}`;
-		const action = routes.get(key);
-		if (!action) {
-			if (next) return next();
-			sendJson(res, {
-				error: "not_found",
-				message: `No route for ${req.method} ${pathOnly}`
-			}, 404);
-			return;
-		}
+function createActionHandler(action, context, auth, logger) {
+	return async (req, res) => {
 		try {
 			const reqLike = req;
 			let authInfo;
@@ -209,33 +181,28 @@ function buildHandler(actions, context, auth) {
 	};
 }
 /**
-* REST adapter for `@silkweave/nestjs`. Mounts each discovered `@Action` as a
-* route on Nest's running HTTP server:
+* REST adapter for `@silkweave/nestjs`. Registers each discovered `@Action`
+* as an individual route on Nest's HTTP adapter:
 *
-* - `kind: 'query'` → `GET ${basePath}/${actionName-with-slashes}` (input read from query string)
-* - `kind: 'mutation'` → `POST ${basePath}/${actionName-with-slashes}` (input read from JSON body)
+* - `kind: 'query'` → `GET ${basePath}/${actionName-with-slashes}` (input from query string)
+* - `kind: 'mutation'` → `POST ${basePath}/${actionName-with-slashes}` (input from JSON body)
 *
-* Works on `@nestjs/platform-express` out of the box. For
-* `@nestjs/platform-fastify`, register `@fastify/express` before this adapter
-* so Nest can serve Express-style middleware.
+* Routes show up in Nest's `RoutesResolver` logger and are eligible for
+* `@nestjs/swagger` scanning. Works on `@nestjs/platform-express` out of the
+* box. For `@nestjs/platform-fastify`, register `@fastify/express` first.
 */
 function rest(options = {}) {
 	return {
 		name: "rest",
-		install: (host) => {
-			const httpAdapter = host.httpAdapter;
-			if (!httpAdapter) throw new Error("@silkweave/nestjs rest(): HttpAdapterHost.httpAdapter is not available.");
-			const setHandler = reserveSlot(httpAdapter, (options.basePath ?? "").replace(/\/$/, "") || "/", "REST");
-			return (_silkweaveOptions, baseContext) => {
-				const context = baseContext.fork({ adapter: "rest" });
-				return {
-					context,
-					start: async (actions) => {
-						setHandler(buildHandler(actions, context, options.auth));
-					},
-					stop: async () => {}
-				};
-			};
+		register({ httpAdapter, baseContext, actions }) {
+			const basePath = (options.basePath ?? "/api").replace(/\/$/, "");
+			const logger = createRestLogger();
+			for (const action of actions) {
+				const path = `${basePath}${actionNameToPath(action.name)}`;
+				const method = action.kind === "query" ? "get" : "post";
+				const handler = createActionHandler(action, baseContext, options.auth, logger);
+				httpAdapter[method](path, handler);
+			}
 		}
 	};
 }
@@ -243,54 +210,75 @@ function rest(options = {}) {
 //#region src/adapter/trpc.ts
 /**
 * tRPC adapter for `@silkweave/nestjs`. Builds a tRPC router from discovered
-* `@Action` methods via `@silkweave/trpc`'s `buildRouter` and mounts the
-* resulting `createExpressMiddleware()` at the configured base path on Nest's
-* underlying HTTP server.
+* `@Action` methods and mounts the resulting express middleware at
+* `basePath` on Nest's HTTP adapter.
 *
 * Action names with dots (e.g. `users.list` from `@Actions('users')`) collapse
-* to camelCase procedure keys (`usersList`) for v1 — flat router only.
+* to camelCase procedure keys (`usersList`).
 *
 * Works on `@nestjs/platform-express`. On `@nestjs/platform-fastify`, register
-* `@fastify/express` first so Nest can mount Express-style middleware.
+* `@fastify/express` first so Nest can serve Express-style middleware.
 */
 function trpc(options = {}) {
 	return {
 		name: "trpc",
-		install: (host) => {
-			const httpAdapter = host.httpAdapter;
-			if (!httpAdapter) throw new Error("@silkweave/nestjs trpc(): HttpAdapterHost.httpAdapter is not available.");
-			const setHandler = reserveSlot(httpAdapter, (options.basePath ?? "/trpc").replace(/\/$/, "") || "/", "tRPC");
-			return (_silkweaveOptions, baseContext) => {
-				const context = baseContext.fork({ adapter: "trpc" });
-				return {
-					context,
-					start: async (actions) => {
-						const router = buildRouter(actions);
-						const logger = createActionLogger();
-						const createContext = async (opts) => {
-							const resolved = await resolveAuth(options.auth, opts.req.headers.authorization, context.fork({ request: opts.req }));
-							if (resolved.kind === "error") {
-								for (const [key, value] of Object.entries(resolved.error.headers)) opts.res.setHeader(key, value);
-								opts.res.statusCode = resolved.error.statusCode;
-								opts.res.setHeader("Content-Type", "application/json");
-								opts.res.end(JSON.stringify(resolved.error.body));
-								throw new Error("Unauthorized");
-							}
-							return { silkweaveContext: context.fork({
-								logger,
-								request: opts.req,
-								response: opts.res,
-								...resolved.authInfo ? { auth: resolved.authInfo } : {}
-							}) };
-						};
-						setHandler(createExpressMiddleware({
-							router,
-							createContext
-						}));
-					},
-					stop: async () => {}
-				};
+		register({ httpAdapter, baseContext, actions }) {
+			const basePath = (options.basePath ?? "/trpc").replace(/\/$/, "") || "/";
+			const router = buildRouter(actions);
+			const logger = createActionLogger();
+			const createContext = async (opts) => {
+				const resolved = await resolveAuth(options.auth, opts.req.headers.authorization, baseContext.fork({ request: opts.req }));
+				if (resolved.kind === "error") {
+					for (const [key, value] of Object.entries(resolved.error.headers)) opts.res.setHeader(key, value);
+					opts.res.statusCode = resolved.error.statusCode;
+					opts.res.setHeader("Content-Type", "application/json");
+					opts.res.end(JSON.stringify(resolved.error.body));
+					throw new Error("Unauthorized");
+				}
+				return { silkweaveContext: baseContext.fork({
+					logger,
+					request: opts.req,
+					response: opts.res,
+					...resolved.authInfo ? { auth: resolved.authInfo } : {}
+				}) };
 			};
+			const middleware = createExpressMiddleware({
+				router,
+				createContext
+			});
+			httpAdapter.use(basePath, middleware);
+		}
+	};
+}
+//#endregion
+//#region src/adapter/typegen.ts
+/**
+* Typegen adapter for `@silkweave/nestjs`. Discovers every `@Action`-decorated
+* method (regardless of `transports` filtering) and writes a single `.d.ts`
+* file with REST input/output interfaces and/or a tRPC `AppRouter` type alias.
+*
+* Designed for the monorepo pattern where the server (this app) is the source
+* of truth for types and consumer apps import from `path` - e.g.
+* `path: '../app/src/types/silkweave.ts'`.
+*/
+function typegen(options) {
+	const enabled = options.enabled ?? process.env["NODE_ENV"] !== "production";
+	return {
+		name: "typegen",
+		allActions: true,
+		register({ actions }) {
+			if (!enabled) return;
+			const output = renderTypegen(actions, options.format ?? "all");
+			const target = resolve(options.path);
+			(async () => {
+				try {
+					await mkdir(dirname(target), { recursive: true });
+					await writeFile(target, output, "utf-8");
+					console.info(`@silkweave/nestjs typegen: wrote ${actions.length} action types to ${target}`);
+				} catch (err) {
+					console.error("@silkweave/nestjs typegen:", err);
+				}
+			})();
 		}
 	};
 }
@@ -341,7 +329,7 @@ function Action(options) {
 * prefix. The prefix is joined to each method's action name with a dot
 * (e.g. `@Actions('users')` + method `list` → action name `users.list`).
 *
-* The class itself remains a normal Nest provider — add `@Injectable()`
+* The class itself remains a normal Nest provider - add `@Injectable()`
 * separately so it can be resolved by the DI container.
 *
 * Accepts either a prefix string (shorthand) or a full options object:
@@ -9040,7 +9028,7 @@ function collectGuards(reflector, classRef, handler) {
 }
 async function resolveGuard(ref, moduleRef) {
 	if (typeof ref === "function") try {
-		return moduleRef.get(ref, { strict: false });
+		return await moduleRef.get(ref, { strict: false });
 	} catch {
 		return moduleRef.create(ref);
 	}
@@ -9063,12 +9051,12 @@ async function runGuards(guards, moduleRef, reflector, classRef, handler, reques
 	}
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.124.0/helpers/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.124.0/helpers/decorate.js
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -9158,74 +9146,62 @@ ActionDiscovery = __decorate([Injectable(), __decorateMetadata("design:paramtype
 //#region src/lib/types.ts
 const SILKWEAVE_MODULE_OPTIONS = "__silkweave_module_options__";
 //#endregion
-//#region \0@oxc-project+runtime@0.124.0/helpers/decorateParam.js
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
 //#endregion
-//#region src/lib/silkweave.service.ts
-var _ref, _ref2;
-let SilkweaveService = class SilkweaveService {
+//#region src/lib/silkweave.module.ts
+var _ref, _ref2, _SilkweaveModule;
+let SilkweaveModule = _SilkweaveModule = class SilkweaveModule {
 	constructor(options, discovery, httpAdapterHost) {
 		this.options = options;
 		this.discovery = discovery;
 		this.httpAdapterHost = httpAdapterHost;
-		this.generators = [];
-	}
-	onModuleInit() {
-		for (const adapter of this.options.adapters) this.generators.push(adapter.install(this.httpAdapterHost));
-	}
-	async onApplicationBootstrap() {
-		const actions = this.discovery.discover();
-		const builder = silkweave(this.options.silkweave);
-		for (const [key, value] of Object.entries(this.options.context ?? {})) builder.set(key, value);
-		for (const gen of this.generators) builder.adapter(gen);
-		builder.actions(actions);
-		await builder.start();
-		this.builder = builder;
 	}
-	async onApplicationShutdown() {
-		this.builder = void 0;
-	}
-	/** Access the underlying silkweave builder once bootstrap has completed. */
-	getBuilder() {
-		return this.builder;
+	static forRoot(options) {
+		return {
+			module: _SilkweaveModule,
+			global: true,
+			imports: [DiscoveryModule],
+			providers: [{
+				provide: SILKWEAVE_MODULE_OPTIONS,
+				useValue: options
+			}, ActionDiscovery],
+			exports: []
+		};
+	}
+	configure(_consumer) {
+		const httpAdapter = this.httpAdapterHost.httpAdapter;
+		if (!httpAdapter) throw new Error("@silkweave/nestjs: HttpAdapterHost.httpAdapter is not available.");
+		const allActions = this.discovery.discover();
+		for (const adapter of this.options.adapters) {
+			const baseContext = createContext({
+				...this.options.context ?? {},
+				adapter: adapter.name
+			});
+			const actions = adapter.allActions ? allActions : allActions.filter((a) => !a.isEnabled || a.isEnabled(baseContext));
+			adapter.register({
+				httpAdapter,
+				silkweaveOptions: this.options.silkweave,
+				baseContext,
+				actions
+			});
+		}
 	}
 };
-SilkweaveService = __decorate([
-	Injectable(),
+SilkweaveModule = _SilkweaveModule = __decorate([
+	Module({}),
 	__decorateParam(0, Inject(SILKWEAVE_MODULE_OPTIONS)),
 	__decorateMetadata("design:paramtypes", [
 		Object,
 		typeof (_ref = typeof ActionDiscovery !== "undefined" && ActionDiscovery) === "function" ? _ref : Object,
 		typeof (_ref2 = typeof HttpAdapterHost !== "undefined" && HttpAdapterHost) === "function" ? _ref2 : Object
 	])
-], SilkweaveService);
-//#endregion
-//#region src/lib/silkweave.module.ts
-var _SilkweaveModule;
-let SilkweaveModule = _SilkweaveModule = class SilkweaveModule {
-	static forRoot(options) {
-		return {
-			module: _SilkweaveModule,
-			global: true,
-			imports: [DiscoveryModule],
-			providers: [
-				{
-					provide: SILKWEAVE_MODULE_OPTIONS,
-					useValue: options
-				},
-				ActionDiscovery,
-				SilkweaveService
-			],
-			exports: [SilkweaveService]
-		};
-	}
-};
-SilkweaveModule = _SilkweaveModule = __decorate([Module({})], SilkweaveModule);
+], SilkweaveModule);
 //#endregion
-export { ACTIONS_METADATA, ACTION_METADATA, ACTION_RESPONSE_KEY, Action, ActionDiscovery, Actions, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, SilkweaveService, buildIsEnabled, collectGuards, mcp, rest, runGuards, trpc };
+export { ACTIONS_METADATA, ACTION_METADATA, ACTION_RESPONSE_KEY, Action, ActionDiscovery, Actions, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, buildIsEnabled, collectGuards, mcp, rest, runGuards, trpc, typegen };
 
 //# sourceMappingURL=index.mjs.map