@silkweave/nestjs 1.9.1 → 1.11.0

package/.turbo/turbo-build.log

@@ -1,17 +1,17 @@
-
-$ tsdown
-ℹ tsdown v0.21.10 powered by rolldown v1.0.0-rc.17
-ℹ config file: /Users/atomic/projects/silkweave/silkweave/packages/nestjs/tsdown.config.ts 
-ℹ entry: src/index.ts
-ℹ tsconfig: tsconfig.json
-ℹ Build start
-ℹ Hint: consider adding deps.onlyBundle option to avoid unintended bundling of dependencies, or set deps.onlyBundle: false to disable this hint.
-See more at https://tsdown.dev/options/dependencies#deps-onlybundle
-Detected dependencies in bundle:
-- rxjs
-ℹ build/index.mjs        337.24 kB │ gzip: 49.36 kB
-ℹ build/index.mjs.map    574.64 kB │ gzip: 86.89 kB
-ℹ build/index.d.mts.map    2.92 kB │ gzip:  1.06 kB
-ℹ build/index.d.mts       15.61 kB │ gzip:  5.45 kB
-ℹ 4 files, total: 930.42 kB
-✔ Build complete in 1171ms
+$ tsdown
+ℹ tsdown v0.21.10 powered by rolldown v1.0.0-rc.17
+ℹ config file: /Users/atomic/projects/silkweave/silkweave/packages/nestjs/tsdown.config.ts 
+ℹ entry: src/index.ts
+ℹ tsconfig: tsconfig.json
+ℹ Build start
+ℹ Cleaning 4 files
+ℹ Hint: consider adding deps.onlyBundle option to avoid unintended bundling of dependencies, or set deps.onlyBundle: false to disable this hint.
+See more at https://tsdown.dev/options/dependencies#deps-onlybundle
+Detected dependencies in bundle:
+- rxjs
+ℹ build/index.mjs        338.49 kB │ gzip: 49.77 kB
+ℹ build/index.mjs.map    577.61 kB │ gzip: 87.77 kB
+ℹ build/index.d.mts.map    2.99 kB │ gzip:  1.07 kB
+ℹ build/index.d.mts       16.35 kB │ gzip:  5.75 kB
+ℹ 4 files, total: 935.45 kB
+✔ Build complete in 742ms

package/.turbo/turbo-prepack.log

@@ -11,9 +11,9 @@
 See more at https://tsdown.dev/options/dependencies#deps-onlybundle
 Detected dependencies in bundle:
 - rxjs
-ℹ build/index.mjs        337.24 kB │ gzip: 49.36 kB
-ℹ build/index.mjs.map    574.64 kB │ gzip: 86.89 kB
-ℹ build/index.d.mts.map    2.92 kB │ gzip:  1.06 kB
-ℹ build/index.d.mts       15.61 kB │ gzip:  5.45 kB
-ℹ 4 files, total: 930.42 kB
-✔ Build complete in 831ms
+ℹ build/index.mjs        337.92 kB │ gzip: 49.52 kB
+ℹ build/index.mjs.map    576.49 kB │ gzip: 87.36 kB
+ℹ build/index.d.mts.map    2.98 kB │ gzip:  1.07 kB
+ℹ build/index.d.mts       15.96 kB │ gzip:  5.58 kB
+ℹ 4 files, total: 933.34 kB
+✔ Build complete in 828ms

package/README.md

@@ -47,11 +47,10 @@ export class UserActions {
     return this.db.getUser(input.id)
   }
 
-  @UseGuards(AdminGuard)
+  @UseGuards(AdminGuard)            // guard reads the request header on every transport, MCP included
   @Action({
     description: 'Ban a user',
-    input: BanInput,
-    transports: ['rest', 'trpc']   // exclude from MCP tools
+    input: BanInput
   })
   ban(input: z.infer<typeof BanInput>) {
     return this.db.banUser(input.id, input.reason)
@@ -98,7 +97,7 @@ The `users.list` and `users.get` actions are now reachable via:
 - **tRPC:** `client.usersList.query({ activeOnly: true })` and `client.usersGet.query({ id: '1' })`
 - **MCP:** tools `UsersList` and `UsersGet`
 
-`users.ban` skips MCP per its `transports: ['rest', 'trpc']` and is guarded by `@UseGuards(AdminGuard)` on every transport that has an HTTP request.
+`users.ban` is guarded by `@UseGuards(AdminGuard)` on **every** transport - REST, tRPC, **and** MCP. The guard reads its credential from the request header (`switchToHttp().getRequest().headers`); over MCP the inbound tool-call headers are surfaced the same way (see [Guards & DI](#guards--di)).
 
 ## Decorators
 
@@ -110,6 +109,7 @@ The `users.list` and `users.get` actions are now reachable via:
 | `description` | `string` | *required* | Human-readable summary. Used as MCP tool description |
 | `input` | `z.ZodObject` | *required* | Zod object schema for the action's input |
 | `output` | `z.ZodObject` | - | Optional output schema (used by tRPC type inference) |
+| `chunk` | `z.ZodType` | - | Schema for chunks yielded by a streaming (`async function*`) method. **Required** when the method is an async generator |
 | `kind` | `'query' \| 'mutation'` | `'mutation'` | `'query'` → GET in REST, `.query()` in tRPC. `'mutation'` → POST / `.mutation()` |
 | `transports` | `('rest' \| 'trpc' \| 'mcp')[]` | all | Allowlist of transports that expose this action |
 | `isEnabled` | `(ctx) => boolean` | - | Dynamic gate (AND-combined with `transports`) |
@@ -158,6 +158,24 @@ Mounts a tRPC HTTP handler built from `@silkweave/trpc`'s `buildRouter`.
 
 Action names with dots (e.g. `users.list`) collapse to camelCase procedure keys (`usersList`) - flat router in v1.
 
+**Streaming.** An `@Action` method declared as an `async function*` (with a `chunk` schema) is registered as a tRPC **subscription** that streams each yielded chunk over SSE - exactly like a standalone `createAction({ chunk, run: async function*(){…} })`. `@UseGuards()` guards still run before the first chunk. This is what `useChat` + `@silkweave/ai`'s `silkweaveTransport()` consume.
+
+```ts
+@Action({
+  description: 'Stream a countdown',
+  input: z.object({ from: z.number().int() }),
+  chunk: z.object({ n: z.number().int() })
+})
+async *countdown(input: { from: number }) {
+  for (let n = input.from; n >= 0; n -= 1) {
+    await new Promise((r) => setTimeout(r, 200))
+    yield { n }
+  }
+}
+```
+
+Declaring an async-generator method without a `chunk` schema throws at discovery time - the schema is required for typegen/tRPC to expose the subscription.
+
 ### `mcp(options?)`
 
 Mounts the MCP Streamable HTTP transport directly at `basePath`, with sideload (`{basePath}/resource/:id`), well-known auth metadata (`{basePath}/.well-known/...`), and the OAuth proxy routes (`{basePath}/authorize`, `/token`, `/register`, `/auth/callback`) namespaced under the same prefix. Composes the handler primitives from `@silkweave/mcp` - no Express sub-app.
@@ -172,7 +190,13 @@ Mounts the MCP Streamable HTTP transport directly at `basePath`, with sideload (
 
 ## Guards & DI
 
-Native NestJS `@UseGuards()` and `@UseInterceptors()` on `@Action` methods run for every HTTP-backed transport. Guards receive an `ExecutionContext` with the HTTP request in `switchToHttp().getRequest()`. The `Reflector` is also wired up so guards can read custom metadata.
+Native NestJS `@UseGuards()` and `@UseInterceptors()` on `@Action` methods run for **every** transport - REST, tRPC, and MCP. Guards receive an `ExecutionContext` with the request in `switchToHttp().getRequest()`. The `Reflector` is also wired up so guards can read custom metadata.
+
+**Headers over MCP.** REST and tRPC pass the raw HTTP request to the guard. For MCP (Streamable HTTP), the inbound tool-call request is surfaced as a stand-in `{ headers, url, params, query }` object built from the MCP SDK's `extra.requestInfo`, so a header-based guard - e.g. one reading `getRequest().headers['x-api-key']` - works unchanged. `ExecutionContext.getType()` is `'http'` whenever a request is available (and `'rpc'` for transports with none, e.g. MCP stdio). Caveats:
+
+- Only **headers** (and the request `url`) cross the MCP boundary. There are no path `params` or `query` on an MCP tool call, so `getRequest().params` / `.query` are empty objects - guards relying on them degrade to "deny" rather than crash.
+- A guard that denies (returns `false` or throws) produces a clean MCP tool error (`ForbiddenException`), not an HTTP 500.
+- For OAuth 2.1 / bearer-token MCP auth, prefer `mcp({ auth })` and read the resolved identity from the silkweave context (`ctx.get('auth')`) inside the action; the header stand-in is for custom request-reading guards.
 
 Action methods are normal Nest provider methods - inject services via the constructor as usual.
 

package/build/index.d.mts

@@ -157,7 +157,7 @@ declare function typegen(options: TypegenAdapterOptions): NestSilkweaveAdapter;
 declare const ACTION_METADATA = "__silkweave_action__";
 declare const ACTIONS_METADATA = "__silkweave_actions__";
 type Transport = 'rest' | 'trpc' | 'mcp';
-interface ActionMetadata<I extends object = object, O extends object = object> {
+interface ActionMetadata<I extends object = object, O extends object = object, C = unknown> {
   /** Action name. Defaults to the kebab-cased method name. */
   name?: string;
   /** Human-readable description. Becomes the MCP tool description and REST OpenAPI summary. */
@@ -170,6 +170,13 @@ interface ActionMetadata<I extends object = object, O extends object = object> {
   output?: z$1.ZodType<O> & {
     shape: Record<string, z$1.ZodTypeAny>;
   };
+  /**
+   * Zod schema for individual chunks yielded by a streaming (async-generator)
+   * action method. Required when the decorated method is an `async function*`.
+   * Mirrors `Action.chunk` in @silkweave/core; typegen/trpc use it to expose
+   * the action as a tRPC subscription.
+   */
+  chunk?: z$1.ZodType<C>;
   /** `'query'` (GET in REST, `.query()` in tRPC) or `'mutation'` (POST in REST, `.mutation()` in tRPC). Default: `'mutation'`. */
   kind?: ActionKind;
   /** Allowlist of transports that should expose this action. Default: all registered transports. */
@@ -226,7 +233,7 @@ declare const ACTION_RESPONSE_KEY = "__silkweave_response__";
  * }
  * ```
  */
-declare function Action<I extends object = object, O extends object = object>(options: ActionMetadata<I, O>): MethodDecorator;
+declare function Action<I extends object = object, O extends object = object, C = unknown>(options: ActionMetadata<I, O, C>): MethodDecorator;
 //#endregion
 //#region src/decorator/actions.d.ts
 /**
@@ -257,9 +264,10 @@ declare class ActionDiscovery {
    * a list of core `Action` objects ready to feed into `silkweave().actions()`.
    *
    * Action invocation is wrapped to (a) run `@UseGuards` guards declared on the
-   * method or its class against the incoming HTTP request (read from
-   * `ctx.get('request')`) and (b) bind `this` to the resolved Nest provider so
-   * DI-injected dependencies remain available.
+   * method or its class against the incoming request (read from
+   * `ctx.get('request')`, populated by REST/tRPC and by MCP-over-HTTP from the
+   * SDK's `extra.requestInfo`) and (b) bind `this` to the resolved Nest provider
+   * so DI-injected dependencies remain available.
    */
   discover(): Action$1[];
   private toAction;
@@ -287,14 +295,19 @@ type GuardRef = Type<CanActivate> | CanActivate;
  */
 declare function collectGuards(reflector: Reflector, classRef: Type<unknown>, handler: (...args: unknown[]) => unknown): GuardRef[];
 /**
- * Run the configured guards against an HTTP request. Throws `ForbiddenException`
+ * Run the configured guards against a request. Throws `ForbiddenException`
  * if any guard rejects, mirroring Nest's HTTP request-pipeline behavior.
  *
  * Pass `null` for `response` when running on top of a tRPC or MCP request that
  * doesn't surface a raw response object; guards that introspect the response
  * will receive `null`.
+ *
+ * `contextType` is reflected through `ExecutionContext.getType()` so guards can
+ * branch on the transport. It is `'http'` for REST/tRPC and for MCP-over-HTTP
+ * (where a header-bearing request stand-in is available); transports without any
+ * HTTP request (e.g. MCP stdio) pass `'rpc'`.
  */
-declare function runGuards(guards: GuardRef[], moduleRef: ModuleRef, reflector: Reflector, classRef: Type<unknown>, handler: (...args: unknown[]) => unknown, request: unknown, response: unknown): Promise<void>;
+declare function runGuards(guards: GuardRef[], moduleRef: ModuleRef, reflector: Reflector, classRef: Type<unknown>, handler: (...args: unknown[]) => unknown, request: unknown, response: unknown, contextType?: 'http' | 'rpc'): Promise<void>;
 //#endregion
 //#region src/lib/silkweave.module.d.ts
 /**

package/build/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/lib/types.ts","../src/adapter/mcp.ts","../src/adapter/rest.ts","../src/adapter/trpc.ts","../src/adapter/typegen.ts","../src/lib/metadata.ts","../src/decorator/action.ts","../src/decorator/actions.ts","../src/lib/discovery.ts","../src/lib/filter.ts","../src/lib/guards.ts","../src/lib/silkweave.module.ts"],"mappings":";;;;;;;;;;;;;;;;;UAUiB,0BAAA;EAAA;EAEf,WAAA,EAAa,WAAA,CAAY,eAAA;;EAEzB,gBAAA,EAAkB,gBAAA;EAFL;EAIb,WAAA,EAAa,gBAAA;EAAA;EAEb,OAAA,EAAS,QAAA;AAAA;;;;;;;;UAUM,oBAAA;EAVf;EAAA,SAYS,IAAA;EAZM;;AAUjB;;;;EAViB,SAmBN,UAAA;EAAA;EAET,QAAA,CAAS,GAAA,EAAK,0BAAA;AAAA;AAAA,UAGC,sBAAA;EAHyB;EAKxC,SAAA,EAAW,gBAAA;EAFI;EAIf,QAAA,EAAU,oBAAA;;EAEV,OAAA,GAAU,MAAA;AAAA;AAAA,cAGC,wBAAA;;;UCtCI,iBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;;EAEP,IAAA,GAAO,WAAA;EDTQ;ECWf,iBAAA;;EAEA,WAAA;AAAA;;;;;;;;;;;;;;;iBA6Bc,GAAA,CAAI,OAAA,GAAS,iBAAA,GAAyB,oBAAA;;;UChCrC,kBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;AAAA;;;AFdT;;;;;;;;;iBEwIgB,IAAA,CAAK,OAAA,GAAS,kBAAA,GAA0B,oBAAA;;;UC5IvC,kBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;AAAA;;;AHAT;;;;;;;;;iBGcgB,IAAA,CAAK,OAAA,GAAS,kBAAA,GAA0B,oBAAA;;;UCnBvC,qBAAA;;EAEf,IAAA;;;;;;AJGF;EIIE,MAAA,GAAS,aAAA;;;;;;EAMT,OAAA;AAAA;;;;;;;;;;iBAYc,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,oBAAA;;;cC7B5C,eAAA;AAAA,cACA,gBAAA;AAAA,KAED,SAAA;AAAA,UAEK,cAAA;;EAEf,IAAA;;EAEA,WAAA;ELFe;EKIf,KAAA,EAAO,GAAA,CAAE,OAAA,CAAQ,CAAA;IAAO,KAAA,EAAO,MAAA,SAAe,GAAA,CAAE,UAAA;EAAA;ELFnC;EKIb,MAAA,GAAS,GAAA,CAAE,OAAA,CAAQ,CAAA;IAAO,KAAA,EAAO,MAAA,SAAe,GAAA,CAAE,UAAA;EAAA;ELEnC;EKAf,IAAA,GAAO,UAAA;ELNP;EKQA,UAAA,GAAa,SAAA;ELRY;EKUzB,SAAA,IAAa,OAAA,EAAS,gBAAA;ELRJ;EKUlB,UAAA,GAAa,QAAA,CAAO,CAAA,EAAG,CAAA;ELRV;EKUb,IAAA,UAAc,CAAA;ELRL;EKUT,WAAA;AAAA;AAAA,UAGe,oBAAA;ELHoB;EKKnC,MAAA;ELMwC;EKJxC,UAAA,GAAa,SAAA;AAAA;AAAA,UAGE,gBAAA;EACf,UAAA,GAAa,QAAA,SAAe,CAAA;AAAA;AAAA,KAGlB,iBAAA,GAAoB,cAAA,mBAAiC,gBAAA;AAAA,cAEpD,mBAAA;;;;;;;;;;;;ALlCb;;;;;;;;;;;;;;;;;;;;;iBMuBgB,MAAA,sDAAA,CACd,OAAA,EAAS,cAAA,CAAe,CAAA,EAAG,CAAA,IAC1B,eAAA;;;;;;;;;;;;ANzBH;;;;;iBOOgB,OAAA,CAAQ,eAAA,YAA0B,oBAAA,GAA4B,cAAA;;;cCEjE,eAAA;EAAA,iBAEQ,SAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;EAAA,iBACA,SAAA;cAHA,SAAA,EAAW,gBAAA,EACX,OAAA,EAAS,eAAA,EACT,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA;;;ARdhC;;;;;;;EQ0BE,QAAA,CAAA,GAAY,QAAA;EAAA,QAqBJ,QAAA;AAAA;;;;;;;;;;;AR/CV;;iBSGgB,cAAA,CACd,UAAA,EAAY,SAAA,gBACZ,aAAA,IAAiB,GAAA,EAAK,gBAAA,8BACnB,GAAA,EAAK,gBAAA;;;KCVL,QAAA,GAAW,IAAA,CAAK,WAAA,IAAe,WAAA;;;;;;iBAOpB,aAAA,CACd,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,0BACZ,QAAA;;AVPH;;;;;;;iBUgCsB,SAAA,CACpB,MAAA,EAAQ,QAAA,IACR,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,yBACb,OAAA,WACA,QAAA,YACC,OAAA;;;;;;;;;AVxCH;;;;;;;;;;;;;;;;;;;;;AAkBA;cWOa,eAAA,YAA2B,UAAA;EAAA,iBAEe,OAAA;EAAA,iBAClC,SAAA;EAAA,iBACA,eAAA;cAFkC,OAAA,EAAS,sBAAA,EAC3C,SAAA,EAAW,eAAA,EACX,eAAA,EAAiB,eAAA;EAAA,OAG7B,OAAA,CAAQ,OAAA,EAAS,sBAAA,GAAyB,aAAA;EAajD,SAAA,CAAU,SAAA,EAAW,kBAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/lib/types.ts","../src/adapter/mcp.ts","../src/adapter/rest.ts","../src/adapter/trpc.ts","../src/adapter/typegen.ts","../src/lib/metadata.ts","../src/decorator/action.ts","../src/decorator/actions.ts","../src/lib/discovery.ts","../src/lib/filter.ts","../src/lib/guards.ts","../src/lib/silkweave.module.ts"],"mappings":";;;;;;;;;;;;;;;;;UAUiB,0BAAA;EAAA;EAEf,WAAA,EAAa,WAAA,CAAY,eAAA;;EAEzB,gBAAA,EAAkB,gBAAA;EAFL;EAIb,WAAA,EAAa,gBAAA;EAAA;EAEb,OAAA,EAAS,QAAA;AAAA;;;;;;;;UAUM,oBAAA;EAVf;EAAA,SAYS,IAAA;EAZM;;AAUjB;;;;EAViB,SAmBN,UAAA;EAAA;EAET,QAAA,CAAS,GAAA,EAAK,0BAAA;AAAA;AAAA,UAGC,sBAAA;EAHyB;EAKxC,SAAA,EAAW,gBAAA;EAFI;EAIf,QAAA,EAAU,oBAAA;;EAEV,OAAA,GAAU,MAAA;AAAA;AAAA,cAGC,wBAAA;;;UCtCI,iBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;;EAEP,IAAA,GAAO,WAAA;EDTQ;ECWf,iBAAA;;EAEA,WAAA;AAAA;;;;;;;;;;;;;;;iBA6Bc,GAAA,CAAI,OAAA,GAAS,iBAAA,GAAyB,oBAAA;;;UChCrC,kBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;AAAA;;;AFdT;;;;;;;;;iBEwIgB,IAAA,CAAK,OAAA,GAAS,kBAAA,GAA0B,oBAAA;;;UC5IvC,kBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;AAAA;;;AHAT;;;;;;;;;iBGcgB,IAAA,CAAK,OAAA,GAAS,kBAAA,GAA0B,oBAAA;;;UCnBvC,qBAAA;;EAEf,IAAA;;;;;;AJGF;EIIE,MAAA,GAAS,aAAA;;;;;;EAMT,OAAA;AAAA;;;;;;;;;;iBAYc,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,oBAAA;;;cC7B5C,eAAA;AAAA,cACA,gBAAA;AAAA,KAED,SAAA;AAAA,UAEK,cAAA;;EAEf,IAAA;;EAEA,WAAA;ELFe;EKIf,KAAA,EAAO,GAAA,CAAE,OAAA,CAAQ,CAAA;IAAO,KAAA,EAAO,MAAA,SAAe,GAAA,CAAE,UAAA;EAAA;ELFnC;EKIb,MAAA,GAAS,GAAA,CAAE,OAAA,CAAQ,CAAA;IAAO,KAAA,EAAO,MAAA,SAAe,GAAA,CAAE,UAAA;EAAA;ELEnC;;;;;;EKKf,KAAA,GAAQ,GAAA,CAAE,OAAA,CAAQ,CAAA;ELPlB;EKSA,IAAA,GAAO,UAAA;ELPP;EKSA,UAAA,GAAa,SAAA;ELTE;EKWf,SAAA,IAAa,OAAA,EAAS,gBAAA;ELDP;EKGf,UAAA,GAAa,QAAA,CAAO,CAAA,EAAG,CAAA;;EAEvB,IAAA,UAAc,CAAA;ELHL;EKKT,WAAA;AAAA;AAAA,UAGe,oBAAA;ELCN;EKCT,MAAA;ELDwC;EKGxC,UAAA,GAAa,SAAA;AAAA;AAAA,UAGE,gBAAA;EACf,UAAA,GAAa,QAAA,SAAe,CAAA;AAAA;AAAA,KAGlB,iBAAA,GAAoB,cAAA,mBAAiC,gBAAA;AAAA,cAEpD,mBAAA;;;;;;;;;;;;ALzCb;;;;;;;;;;;;;;;;;;;;;iBMuBgB,MAAA,mEAAA,CACd,OAAA,EAAS,cAAA,CAAe,CAAA,EAAG,CAAA,EAAG,CAAA,IAC7B,eAAA;;;;;;;;;;;;ANzBH;;;;;iBOOgB,OAAA,CAAQ,eAAA,YAA0B,oBAAA,GAA4B,cAAA;;;cCEjE,eAAA;EAAA,iBAEQ,SAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;EAAA,iBACA,SAAA;cAHA,SAAA,EAAW,gBAAA,EACX,OAAA,EAAS,eAAA,EACT,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA;;;ARdhC;;;;;;;;EQ2BE,QAAA,CAAA,GAAY,QAAA;EAAA,QAqBJ,QAAA;AAAA;;;;;;;;;;;ARhDV;;iBSGgB,cAAA,CACd,UAAA,EAAY,SAAA,gBACZ,aAAA,IAAiB,GAAA,EAAK,gBAAA,8BACnB,GAAA,EAAK,gBAAA;;;KCVL,QAAA,GAAW,IAAA,CAAK,WAAA,IAAe,WAAA;;;;;;iBAOpB,aAAA,CACd,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,0BACZ,QAAA;;AVPH;;;;;;;;;;;;iBUqCsB,SAAA,CACpB,MAAA,EAAQ,QAAA,IACR,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,yBACb,OAAA,WACA,QAAA,WACA,WAAA,oBACC,OAAA;;;;;;;;;AV9CH;;;;;;;;;;;;;;;;;;;;;AAkBA;cWOa,eAAA,YAA2B,UAAA;EAAA,iBAEe,OAAA;EAAA,iBAClC,SAAA;EAAA,iBACA,eAAA;cAFkC,OAAA,EAAS,sBAAA,EAC3C,SAAA,EAAW,eAAA,EACX,eAAA,EAAiB,eAAA;EAAA,OAG7B,OAAA,CAAQ,OAAA,EAAS,sBAAA,GAAyB,aAAA;EAajD,SAAA,CAAU,SAAA,EAAW,kBAAA;AAAA"}

package/build/index.mjs

@@ -9035,16 +9035,21 @@ async function resolveGuard(ref, moduleRef) {
 	return ref;
 }
 /**
-* Run the configured guards against an HTTP request. Throws `ForbiddenException`
+* Run the configured guards against a request. Throws `ForbiddenException`
 * if any guard rejects, mirroring Nest's HTTP request-pipeline behavior.
 *
 * Pass `null` for `response` when running on top of a tRPC or MCP request that
 * doesn't surface a raw response object; guards that introspect the response
 * will receive `null`.
+*
+* `contextType` is reflected through `ExecutionContext.getType()` so guards can
+* branch on the transport. It is `'http'` for REST/tRPC and for MCP-over-HTTP
+* (where a header-bearing request stand-in is available); transports without any
+* HTTP request (e.g. MCP stdio) pass `'rpc'`.
 */
-async function runGuards(guards, moduleRef, reflector, classRef, handler, request, response) {
+async function runGuards(guards, moduleRef, reflector, classRef, handler, request, response, contextType = "http") {
 	if (guards.length === 0) return;
-	const context = new SilkweaveExecutionContext([request, response], classRef, handler, "http");
+	const context = new SilkweaveExecutionContext([request, response], classRef, handler, contextType);
 	for (const ref of guards) {
 		const result = (await resolveGuard(ref, moduleRef)).canActivate(context);
 		if (!((0, import_cjs.isObservable)(result) ? await (0, import_cjs.lastValueFrom)(result) : await Promise.resolve(result))) throw new ForbiddenException("Forbidden resource");
@@ -9078,9 +9083,10 @@ let ActionDiscovery = class ActionDiscovery {
 	* a list of core `Action` objects ready to feed into `silkweave().actions()`.
 	*
 	* Action invocation is wrapped to (a) run `@UseGuards` guards declared on the
-	* method or its class against the incoming HTTP request (read from
-	* `ctx.get('request')`) and (b) bind `this` to the resolved Nest provider so
-	* DI-injected dependencies remain available.
+	* method or its class against the incoming request (read from
+	* `ctx.get('request')`, populated by REST/tRPC and by MCP-over-HTTP from the
+	* SDK's `extra.requestInfo`) and (b) bind `this` to the resolved Nest provider
+	* so DI-injected dependencies remain available.
 	*/
 	discover() {
 		const discovered = [];
@@ -9116,6 +9122,37 @@ let ActionDiscovery = class ActionDiscovery {
 		const guards = collectGuards(this.reflector, d.classRef, d.method);
 		const moduleRef = this.moduleRef;
 		const reflector = this.reflector;
+		const applyGuards = async (context) => {
+			if (guards.length === 0) return;
+			const request = context.getOptional("request");
+			const response = context.getOptional("response") ?? null;
+			const hasRequest = request != null;
+			const guardRequest = hasRequest ? request : {
+				headers: {},
+				params: {},
+				query: {}
+			};
+			await runGuards(guards, moduleRef, reflector, d.classRef, d.method, guardRequest, response, hasRequest ? "http" : "rpc");
+		};
+		if (d.method.constructor?.name === "AsyncGeneratorFunction") {
+			if (!d.meta.chunk) throw new Error(`@Action "${name}" is an async generator but has no \`chunk\` schema`);
+			const method = d.method;
+			const instance = d.instance;
+			return createAction({
+				name,
+				description: d.meta.description,
+				input: d.meta.input,
+				chunk: d.meta.chunk,
+				kind: d.meta.kind ?? "mutation",
+				args: d.meta.args,
+				isEnabled,
+				toolResult: d.meta.toolResult,
+				run: async function* (input, context) {
+					await applyGuards(context);
+					yield* method.call(instance, input, context);
+				}
+			});
+		}
 		return createAction({
 			name,
 			description: d.meta.description,
@@ -9126,11 +9163,7 @@ let ActionDiscovery = class ActionDiscovery {
 			isEnabled,
 			toolResult: d.meta.toolResult,
 			run: async (input, context) => {
-				if (guards.length > 0) {
-					const request = context.getOptional("request");
-					const response = context.getOptional("response");
-					await runGuards(guards, moduleRef, reflector, d.classRef, d.method, request, response);
-				}
+				await applyGuards(context);
 				return await d.method.call(d.instance, input, context);
 			}
 		});