@silkweave/nestjs 1.9.1 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@silkweave/nestjs",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "description": "Silkweave NestJS Adapter",
   "repository": {
     "type": "git",
@@ -19,12 +19,12 @@
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "zod": "^3.25.0",
-    "@silkweave/auth": "1.9.1",
-    "@silkweave/logger": "1.9.1",
-    "@silkweave/trpc": "1.9.1",
-    "@silkweave/core": "1.9.1",
-    "@silkweave/typegen": "1.9.1",
-    "@silkweave/mcp": "1.9.1"
+    "@silkweave/auth": "1.11.0",
+    "@silkweave/core": "1.11.0",
+    "@silkweave/mcp": "1.11.0",
+    "@silkweave/logger": "1.11.0",
+    "@silkweave/typegen": "1.11.0",
+    "@silkweave/trpc": "1.11.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/decorator/action.ts

@@ -31,8 +31,8 @@ import { ACTION_METADATA, type ActionMetadata } from '../lib/metadata.js'
  * }
  * ```
  */
-export function Action<I extends object = object, O extends object = object>(
-  options: ActionMetadata<I, O>
+export function Action<I extends object = object, O extends object = object, C = unknown>(
+  options: ActionMetadata<I, O, C>
 ): MethodDecorator {
   return SetMetadata(ACTION_METADATA, options)
 }

package/src/lib/discovery.ts

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { Injectable, type Type } from '@nestjs/common'
 import { DiscoveryService, MetadataScanner, ModuleRef, Reflector } from '@nestjs/core'
-import { createAction, type Action, type SilkweaveContext } from '@silkweave/core'
+import { createAction, type Action, type ActionKind, type SilkweaveContext, type StreamingActionInput } from '@silkweave/core'
 import { kebabCase } from 'change-case'
 import { buildIsEnabled } from './filter.js'
 import { collectGuards, runGuards } from './guards.js'
@@ -30,9 +30,10 @@ export class ActionDiscovery {
    * a list of core `Action` objects ready to feed into `silkweave().actions()`.
    *
    * Action invocation is wrapped to (a) run `@UseGuards` guards declared on the
-   * method or its class against the incoming HTTP request (read from
-   * `ctx.get('request')`) and (b) bind `this` to the resolved Nest provider so
-   * DI-injected dependencies remain available.
+   * method or its class against the incoming request (read from
+   * `ctx.get('request')`, populated by REST/tRPC and by MCP-over-HTTP from the
+   * SDK's `extra.requestInfo`) and (b) bind `this` to the resolved Nest provider
+   * so DI-injected dependencies remain available.
    */
   discover(): Action[] {
     const discovered: DiscoveredAction[] = []
@@ -64,9 +65,47 @@ export class ActionDiscovery {
     const moduleRef = this.moduleRef
     const reflector = this.reflector
 
+    const applyGuards = async (context: SilkweaveContext): Promise<void> => {
+      if (guards.length === 0) { return }
+      // REST and tRPC populate `request`/`response`; MCP-over-HTTP populates
+      // `request` (a `{ headers, url, params, query }` stand-in built from the
+      // SDK's `extra.requestInfo`). Transports with no HTTP request at all (e.g.
+      // MCP stdio) get a header-less stand-in so guards reading `req.headers`
+      // degrade gracefully (deny) instead of dereferencing `undefined`.
+      const request = context.getOptional<unknown>('request')
+      const response = context.getOptional<unknown>('response') ?? null
+      const hasRequest = request != null
+      const guardRequest = hasRequest ? request : { headers: {}, params: {}, query: {} }
+      await runGuards(guards, moduleRef, reflector, d.classRef, d.method, guardRequest, response, hasRequest ? 'http' : 'rpc')
+    }
+
     // Cast at the createAction boundary to bridge dual-zod-version installs
     // (zod@3.25 + zod@4.x can both be present transitively). Runtime is fine -
     // they share the same /v4 surface - but the structural types are distinct.
+    const streaming = d.method.constructor?.name === 'AsyncGeneratorFunction'
+
+    if (streaming) {
+      if (!d.meta.chunk) {
+        throw new Error(`@Action "${name}" is an async generator but has no \`chunk\` schema`)
+      }
+      const method = d.method
+      const instance = d.instance
+      return createAction({
+        name,
+        description: d.meta.description,
+        input: d.meta.input,
+        chunk: d.meta.chunk,
+        kind: d.meta.kind ?? 'mutation',
+        args: d.meta.args,
+        isEnabled,
+        toolResult: d.meta.toolResult,
+        run: async function* (input: object, context: SilkweaveContext) {
+          await applyGuards(context)
+          yield* (method.call(instance, input, context) as AsyncGenerator<object, void, void>)
+        }
+      } as StreamingActionInput<object, unknown, string, ActionKind>) as Action
+    }
+
     return createAction({
       name,
       description: d.meta.description,
@@ -77,11 +116,7 @@ export class ActionDiscovery {
       isEnabled,
       toolResult: d.meta.toolResult,
       run: async (input: object, context: SilkweaveContext): Promise<object> => {
-        if (guards.length > 0) {
-          const request = context.getOptional<unknown>('request')
-          const response = context.getOptional<unknown>('response')
-          await runGuards(guards, moduleRef, reflector, d.classRef, d.method, request, response)
-        }
+        await applyGuards(context)
         const result = await (d.method.call(d.instance, input, context) as Promise<object>)
         return result
       }

package/src/lib/guards.ts

@@ -33,12 +33,17 @@ async function resolveGuard(ref: GuardRef, moduleRef: ModuleRef): Promise<CanAct
 }
 
 /**
- * Run the configured guards against an HTTP request. Throws `ForbiddenException`
+ * Run the configured guards against a request. Throws `ForbiddenException`
  * if any guard rejects, mirroring Nest's HTTP request-pipeline behavior.
  *
  * Pass `null` for `response` when running on top of a tRPC or MCP request that
  * doesn't surface a raw response object; guards that introspect the response
  * will receive `null`.
+ *
+ * `contextType` is reflected through `ExecutionContext.getType()` so guards can
+ * branch on the transport. It is `'http'` for REST/tRPC and for MCP-over-HTTP
+ * (where a header-bearing request stand-in is available); transports without any
+ * HTTP request (e.g. MCP stdio) pass `'rpc'`.
  */
 export async function runGuards(
   guards: GuardRef[],
@@ -47,10 +52,11 @@ export async function runGuards(
   classRef: Type<unknown>,
   handler: (...args: unknown[]) => unknown,
   request: unknown,
-  response: unknown
+  response: unknown,
+  contextType: 'http' | 'rpc' = 'http'
 ): Promise<void> {
   if (guards.length === 0) { return }
-  const context = new SilkweaveExecutionContext([request, response], classRef, handler, 'http')
+  const context = new SilkweaveExecutionContext([request, response], classRef, handler, contextType)
   for (const ref of guards) {
     const guard = await resolveGuard(ref, moduleRef)
     const result = guard.canActivate(context)

package/src/lib/metadata.ts

@@ -6,7 +6,7 @@ export const ACTIONS_METADATA = '__silkweave_actions__'
 
 export type Transport = 'rest' | 'trpc' | 'mcp'
 
-export interface ActionMetadata<I extends object = object, O extends object = object> {
+export interface ActionMetadata<I extends object = object, O extends object = object, C = unknown> {
   /** Action name. Defaults to the kebab-cased method name. */
   name?: string
   /** Human-readable description. Becomes the MCP tool description and REST OpenAPI summary. */
@@ -15,6 +15,13 @@ export interface ActionMetadata<I extends object = object, O extends object = ob
   input: z.ZodType<I> & { shape: Record<string, z.ZodTypeAny> }
   /** Optional Zod object schema for the action's output (used by tRPC type inference). */
   output?: z.ZodType<O> & { shape: Record<string, z.ZodTypeAny> }
+  /**
+   * Zod schema for individual chunks yielded by a streaming (async-generator)
+   * action method. Required when the decorated method is an `async function*`.
+   * Mirrors `Action.chunk` in @silkweave/core; typegen/trpc use it to expose
+   * the action as a tRPC subscription.
+   */
+  chunk?: z.ZodType<C>
   /** `'query'` (GET in REST, `.query()` in tRPC) or `'mutation'` (POST in REST, `.mutation()` in tRPC). Default: `'mutation'`. */
   kind?: ActionKind
   /** Allowlist of transports that should expose this action. Default: all registered transports. */