@silkweave/nestjs 2.0.0 → 2.2.0

package/README.md

@@ -174,15 +174,27 @@ Native NestJS `@UseGuards()` on `@Mcp` methods run before the handler is invoked
 
 **Headers over MCP.** The inbound tool-call request is surfaced as a stand-in `{ headers, url, params, query }` object built from the MCP SDK's `extra.requestInfo`, so a header-based guard - e.g. one reading `getRequest().headers['x-api-key']` - works unchanged. `ExecutionContext.getType()` is `'http'` whenever a request is available (and `'rpc'` for transports with none, e.g. MCP stdio). Caveats:
 
-- Only **headers** (and the request `url`) cross the MCP boundary - `getRequest().params`/`.query` are empty objects.
+- **Headers**, the request `url`, and **URL path params** cross the MCP boundary. `getRequest().params` is populated from the route's reflected `@Param` fields (as raw strings, like Express), so a path-scoped guard - e.g. one reading `getRequest().params['id']` to fence a key to one resource - works the same over MCP as over REST. `getRequest().query` is still empty (no query string over MCP).
 - A guard that denies (returns `false` or throws) produces a clean MCP tool error (`ForbiddenException`), not an HTTP 500.
 - For OAuth 2.1 / bearer-token MCP auth, prefer `mcp({ auth })` and read the resolved identity from the silkweave context (`ctx.get('auth')`); the header stand-in is for custom request-reading guards.
 
+**Global guards (opt-in).** App-global guards - registered via `app.useGlobalGuards(new X())` or `{ provide: APP_GUARD, useClass }` - do **not** run on tool calls by default. Opt them in by class with `globalGuards`:
+
+```ts
+SilkweaveModule.forRoot({
+  silkweave: { name: 'app', description: 'My App', version: '1.0.0' },
+  adapters: [mcp({ basePath: '/mcp' })],
+  globalGuards: [ApiKeyGuard]   // runs before each method/class @UseGuards; throttler etc. deliberately excluded
+})
+```
+
+The allow-list is explicit-by-class on purpose - a blanket "run every global" would also fire unrelated globals (e.g. a `ThrottlerGuard`, which assumes a writable response MCP doesn't provide). Listed guards run **before** the method/class `@UseGuards`, mirroring Nest's request pipeline. They see the same request stand-in as method guards: headers, `url`, and path `params` (populated from reflected `@Param` fields); only `query`/IP-derived logic won't apply over MCP.
+
 Controllers are normal Nest providers - inject services via the constructor as usual.
 
 ## What does *not* run
 
-Because the handler is invoked directly (not through Nest's HTTP request pipeline), the following do **not** apply on a tool call - only `@UseGuards()` and parameter-bound pipes do:
+Because the handler is invoked directly (not through Nest's HTTP request pipeline), the following do **not** apply on a tool call - only `@UseGuards()` (plus any opted-in `globalGuards`) and parameter-bound pipes do:
 
 - Globally-registered `ValidationPipe` / interceptors / exception filters (MCP input is instead validated against the reflected Zod schema).
 - DTO class instantiation - whole-DTO `@Body()`/`@Query()` arguments arrive as plain objects, so `@Transform` and DTO methods do not fire.

package/build/index.d.mts

@@ -1,5 +1,5 @@
 import { CanActivate, DynamicModule, MiddlewareConsumer, NestModule, Type } from "@nestjs/common";
-import { DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
+import { ApplicationConfig, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
 import { Action, SilkweaveContext, SilkweaveOptions } from "@silkweave/core";
 import { z } from "zod/v4";
 import { AuthConfig } from "@silkweave/auth";
@@ -137,6 +137,19 @@ interface SilkweaveModuleOptions {
    * reflection when an operation or field isn't present.
    */
   openapi?: OpenApiDocument;
+  /**
+   * Opt-in allow-list of app-global guard classes (registered via
+   * `app.useGlobalGuards()` or `{ provide: APP_GUARD, useClass }`) to run on
+   * every MCP tool call, before each method/class `@UseGuards`. Listed by
+   * class - a blanket "run all globals" is deliberately not offered, since
+   * unrelated globals (e.g. a `ThrottlerGuard` that needs a writable response)
+   * would misbehave over MCP. Empty/omitted ⇒ no global guards run.
+   *
+   * Note: over MCP the request stand-in is headers-only (`params`/`query` are
+   * empty), so per-session or IP-derived guard logic won't apply; header-based
+   * authentication still works.
+   */
+  globalGuards?: Type<CanActivate>[];
 }
 declare const SILKWEAVE_MODULE_OPTIONS = "__silkweave_module_options__";
 //#endregion
@@ -248,15 +261,17 @@ declare class ControllerDiscovery {
   private readonly scanner;
   private readonly reflector;
   private readonly moduleRef;
-  constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, moduleRef: ModuleRef);
+  private readonly appConfig;
+  constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, moduleRef: ModuleRef, appConfig: ApplicationConfig);
   /**
    * Walk every Nest provider/controller, find methods annotated with `@Mcp`,
    * and build a core `Action` per method whose input schema is reflected from
    * the route + parameter decorators (+ optional OpenAPI document) and whose
    * `run` re-binds the validated input back into the method's positional
-   * arguments (with `@UseGuards` guards applied first).
+   * arguments (with `@UseGuards` guards - and any opted-in `globalGuards` -
+   * applied first).
    */
-  discover(openapi?: OpenApiDocument): Action[];
+  discover(openapi?: OpenApiDocument, globalGuards?: Type<CanActivate>[]): Action[];
   private toAction;
   /** Build the merged Zod input shape and the per-argument re-bind plan. */
   private buildInput;
@@ -264,6 +279,23 @@ declare class ControllerDiscovery {
 //#endregion
 //#region src/lib/guards.d.ts
 type GuardRef = Type<CanActivate> | CanActivate;
+/**
+ * Collect the app's global guards that match an opt-in allow-list of classes.
+ *
+ * Reads both registration styles Nest exposes via `ApplicationConfig`:
+ * `useGlobalGuards(new X())` instances (`getGlobalGuards()`) and
+ * `{ provide: APP_GUARD, useClass }` DI guards (`getGlobalRequestGuards()`,
+ * which yields `InstanceWrapper`s - we read `.instance` off each).
+ *
+ * The allow-list is intentionally explicit-by-class: a blanket "run every
+ * global" would also fire unrelated globals (e.g. a `ThrottlerGuard` that
+ * assumes a writable response) on every tool call. An empty allow-list runs
+ * no globals, preserving the prior behavior.
+ *
+ * Call this at tool-call time, not at discovery time: `APP_GUARD` instances
+ * aren't populated until `app.init()` finishes.
+ */
+declare function collectGlobalGuards(appConfig: ApplicationConfig, allowList: Type<CanActivate>[]): CanActivate[];
 /**
  * Read `@UseGuards(...)` metadata for both the method and its class and merge
  * the two lists. Method-level guards run AFTER class-level guards (matching
@@ -372,5 +404,5 @@ declare class SilkweaveModule implements NestModule {
   configure(_consumer: MiddlewareConsumer): void;
 }
 //#endregion
-export { Binding, ControllerDiscovery, FieldDesc, MCP_METADATA, Mcp, McpAdapterOptions, McpMetadata, NestAdapterRegisterContext, NestSilkweaveAdapter, OpenApiDocument, OpenApiLookup, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, SilkweaveModuleOptions, apiPropertyToField, buildOpenApiLookup, classValidatorToField, collectGuards, designTypeToField, fieldToZod, invokeRebound, mcp, mergeField, normalizeEnum, openApiFields, openapiSchemaToField, reflectDtoFields, runGuards, specialBinding, swaggerParamToField, typeTokenToBase };
+export { Binding, ControllerDiscovery, FieldDesc, MCP_METADATA, Mcp, McpAdapterOptions, McpMetadata, NestAdapterRegisterContext, NestSilkweaveAdapter, OpenApiDocument, OpenApiLookup, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, SilkweaveModuleOptions, apiPropertyToField, buildOpenApiLookup, classValidatorToField, collectGlobalGuards, collectGuards, designTypeToField, fieldToZod, invokeRebound, mcp, mergeField, normalizeEnum, openApiFields, openapiSchemaToField, reflectDtoFields, runGuards, specialBinding, swaggerParamToField, typeTokenToBase };
 //# sourceMappingURL=index.d.mts.map

package/build/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/lib/reflect/schema.ts","../src/lib/reflect/openapi.ts","../src/lib/types.ts","../src/adapter/mcp.ts","../src/lib/metadata.ts","../src/decorator/mcp.ts","../src/lib/controllerDiscovery.ts","../src/lib/guards.ts","../src/lib/rebind.ts","../src/lib/silkweave.module.ts"],"mappings":";;;;;;;;;;;;;;;UAeiB,SAAA;EACf,IAAA;EACA,QAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,SAAA;EACR,GAAA;EACA,GAAA;EACA,SAAA;EACA,SAAA;EACA,MAAA;EACA,OAAA;AAAA;;iBAac,UAAA,CAAW,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,SAAA,GAAY,SAAA;;iBA2C9C,UAAA,CAAW,CAAA,EAAG,SAAA,GAAY,CAAA,CAAE,OAAA;;iBAc5B,aAAA,CAAc,KAAA;;iBAWd,eAAA,CAAgB,IAAA,YAAgB,SAAA;;iBAkBhC,iBAAA,CAAkB,IAAA,YAAgB,SAAA;;iBAQlC,mBAAA,CAAoB,CAAA,EAAG,MAAA,gBAAsB,SAAA;;iBAgB7C,kBAAA,CAAmB,CAAA,EAAG,MAAA,gBAAsB,SAAA;;iBA4D5C,qBAAA,CAAsB,KAAA,EAAO,KAAA;EAAQ,IAAA;EAAe,IAAA;EAAe,WAAA;AAAA,KAA6B,SAAA;AA/HhH;AAAA,iBAsIgB,oBAAA,CAAqB,MAAA,EAAQ,MAAA,gBAAsB,SAAA;;;;;;;;iBA4BnD,gBAAA,CAAiB,OAAA,QAAe,MAAA,SAAe,SAAA;;;;;;;;UC5O9C,eAAA;EACf,KAAA,GAAQ,MAAA,SAAe,MAAA;EACvB,UAAA;IAAe,OAAA,GAAU,MAAA;EAAA;AAAA;AAAA,UAGV,aAAA;EACf,GAAA,EAAK,eAAA;EDIL;ECFA,UAAA,EAAY,GAAA;AAAA;;iBAIE,kBAAA,CAAmB,GAAA,EAAK,eAAA,GAAkB,aAAA;;;;;;;iBAwC1C,aAAA,CAAc,MAAA,EAAQ,aAAA,EAAe,MAAA,UAAgB,WAAA,WAAsB,MAAA,SAAe,SAAA;;;;;;;;AD7C1G;;UEJiB,0BAAA;EFSE;EEPjB,WAAA,EAAa,WAAA,CAAY,eAAA;EFIzB;EEFA,gBAAA,EAAkB,gBAAA;EFIlB;EEFA,WAAA,EAAa,gBAAA;EFGL;EEDR,OAAA,EAAS,MAAA;AAAA;;;;;;;AFoBX;UEViB,oBAAA;;WAEN,IAAA;EFQuC;EAAA,SENvC,QAAA;EFM4D;;;;;EAAA,SEA5D,UAAA;EFAmD;EEE5D,QAAA,CAAS,GAAA,EAAK,0BAAA;AAAA;AAAA,UAGC,sBAAA;EFsCS;EEpCxB,SAAA,EAAW,gBAAA;EFoCsC;EElCjD,QAAA,EAAU,oBAAA;EFkCe;EEhCzB,OAAA,GAAU,MAAA;EFgCgC;;;AAc5C;;;EEvCE,OAAA,GAAU,eAAA;AAAA;AAAA,cAGC,wBAAA;;;UC/CI,iBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;EHFQ;EGIf,IAAA,GAAO,WAAA;;EAEP,iBAAA;EHLA;EGOA,WAAA;AAAA;;;;;;;;;;;;AHgBF;;;iBGagB,GAAA,CAAI,OAAA,GAAS,iBAAA,GAAyB,oBAAA;;;;cCjDzC,YAAA;;;;;;AJYb;;;UIFiB,WAAA;EJGf;;;;EIEA,IAAA;EJEQ;;;;EIGR,WAAA;EJEA;;;;AAcF;EIVE,KAAA,GAAQ,MAAA,SAAe,CAAA,CAAE,OAAA;;;;;;;EAOzB,KAAA;AAAA;;;;;;;;;;AJrBF;;;;;;;;;;;;;;;;;;AAwBA;;;;;;;;iBKHgB,GAAA,CAAI,OAAA,GAAS,WAAA,GAAmB,eAAA;;;cCRnC,mBAAA;EAAA,iBAEQ,SAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;EAAA,iBACA,SAAA;cAHA,SAAA,EAAW,gBAAA,EACX,OAAA,EAAS,eAAA,EACT,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA;ENlBN;;;;;;;EM4BxB,QAAA,CAAS,OAAA,GAAU,eAAA,GAAkB,MAAA;EAAA,QAoB7B,QAAA;EN1CR;EAAA,QMwFQ,UAAA;AAAA;;;KCvGL,QAAA,GAAW,IAAA,CAAK,WAAA,IAAe,WAAA;;;;;;iBAOpB,aAAA,CACd,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,0BACZ,QAAA;;;;;;;;;;;;;;iBA8BmB,SAAA,CACpB,MAAA,EAAQ,QAAA,IACR,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,yBACb,OAAA,WACA,QAAA,WACA,WAAA,oBACC,OAAA;;;;;;;KCjDS,OAAA;EACN,IAAA;EAAe,KAAA;EAAe,MAAA;EAAmC,QAAA;EAAoB,KAAA;AAAA;EACrF,IAAA;EAAgB,MAAA;EAA0B,MAAA;EAAkB,QAAA;EAAoB,KAAA;AAAA;EAChF,IAAA;EAAgB,MAAA;AAAA;EAChB,IAAA;AAAA;EACA,IAAA;AAAA;EACA,IAAA;EAAiB,IAAA;AAAA;EACjB,IAAA;AAAA;EACA,IAAA;EAAc,IAAA;AAAA;EACd,IAAA;AAAA;AAAA,UAEI,WAAA;EACR,OAAA,GAAU,MAAA;EACV,EAAA;EACA,KAAA,GAAQ,MAAA;AAAA;;;AR6DV;;;iBQIsB,aAAA,CACpB,MAAA,MAAY,IAAA,iBACZ,QAAA,UACA,KAAA,EAAO,MAAA,mBACP,QAAA,EAAU,OAAA,IACV,OAAA,EAAS,WAAA,cACT,eAAA,YACC,OAAA;;iBASa,cAAA,CAAe,SAAA,UAAmB,IAAA,uBAA2B,OAAA;;;;;;;ARvF7E;;;;;;;;;;;;;;;;;;AAwBA;;;;;;cSJa,eAAA,YAA2B,UAAA;EAAA,iBAEe,OAAA;EAAA,iBAClC,SAAA;EAAA,iBACA,eAAA;cAFkC,OAAA,EAAS,sBAAA,EAC3C,SAAA,EAAW,mBAAA,EACX,eAAA,EAAiB,eAAA;EAAA,OAG7B,OAAA,CAAQ,OAAA,EAAS,sBAAA,GAAyB,aAAA;EAajD,SAAA,CAAU,SAAA,EAAW,kBAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/lib/reflect/schema.ts","../src/lib/reflect/openapi.ts","../src/lib/types.ts","../src/adapter/mcp.ts","../src/lib/metadata.ts","../src/decorator/mcp.ts","../src/lib/controllerDiscovery.ts","../src/lib/guards.ts","../src/lib/rebind.ts","../src/lib/silkweave.module.ts"],"mappings":";;;;;;;;;;;;;;;UAeiB,SAAA;EACf,IAAA;EACA,QAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,SAAA;EACR,GAAA;EACA,GAAA;EACA,SAAA;EACA,SAAA;EACA,MAAA;EACA,OAAA;AAAA;;iBAac,UAAA,CAAW,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,SAAA,GAAY,SAAA;;iBA2C9C,UAAA,CAAW,CAAA,EAAG,SAAA,GAAY,CAAA,CAAE,OAAA;;iBAc5B,aAAA,CAAc,KAAA;;iBAWd,eAAA,CAAgB,IAAA,YAAgB,SAAA;;iBAkBhC,iBAAA,CAAkB,IAAA,YAAgB,SAAA;;iBAQlC,mBAAA,CAAoB,CAAA,EAAG,MAAA,gBAAsB,SAAA;;iBAgB7C,kBAAA,CAAmB,CAAA,EAAG,MAAA,gBAAsB,SAAA;;iBA4D5C,qBAAA,CAAsB,KAAA,EAAO,KAAA;EAAQ,IAAA;EAAe,IAAA;EAAe,WAAA;AAAA,KAA6B,SAAA;AA/HhH;AAAA,iBAsIgB,oBAAA,CAAqB,MAAA,EAAQ,MAAA,gBAAsB,SAAA;;;;;;;;iBA4BnD,gBAAA,CAAiB,OAAA,QAAe,MAAA,SAAe,SAAA;;;;;;;;UC5O9C,eAAA;EACf,KAAA,GAAQ,MAAA,SAAe,MAAA;EACvB,UAAA;IAAe,OAAA,GAAU,MAAA;EAAA;AAAA;AAAA,UAGV,aAAA;EACf,GAAA,EAAK,eAAA;EDIL;ECFA,UAAA,EAAY,GAAA;AAAA;;iBAIE,kBAAA,CAAmB,GAAA,EAAK,eAAA,GAAkB,aAAA;;;;;;;iBAwC1C,aAAA,CAAc,MAAA,EAAQ,aAAA,EAAe,MAAA,UAAgB,WAAA,WAAsB,MAAA,SAAe,SAAA;;;;;;;AD7C1G;;;UEHiB,0BAAA;EFIf;EEFA,WAAA,EAAa,WAAA,CAAY,eAAA;EFIzB;EEFA,gBAAA,EAAkB,gBAAA;EFIlB;EEFA,WAAA,EAAa,gBAAA;EFGb;EEDA,OAAA,EAAS,MAAA;AAAA;;;;;;AFmBX;;UETiB,oBAAA;EFSgB;EAAA,SEPtB,IAAA;EFOmD;EAAA,SELnD,QAAA;EFK4D;;;;;EAAA,SEC5D,UAAA;EFD4D;EEGrE,QAAA,CAAS,GAAA,EAAK,0BAAA;AAAA;AAAA,UAGC,sBAAA;;EAEf,SAAA,EAAW,gBAAA;EFmCiB;EEjC5B,QAAA,EAAU,oBAAA;EFiC8B;EE/BxC,OAAA,GAAU,MAAA;EF+BuC;;AAcnD;;;;EEtCE,OAAA,GAAU,eAAA;EFiDI;;;;;AAkBhB;;;;;AAQA;;EE9DE,YAAA,GAAe,IAAA,CAAK,WAAA;AAAA;AAAA,cAGT,wBAAA;;;UC7DI,iBAAA;;EAEf,QAAA;;EAEA,IAAA,GAAO,UAAA;EHFQ;EGIf,IAAA,GAAO,WAAA;;EAEP,iBAAA;EHLA;EGOA,WAAA;AAAA;;;;;;;;;;;;AHgBF;;;iBGagB,GAAA,CAAI,OAAA,GAAS,iBAAA,GAAyB,oBAAA;;;;cCjDzC,YAAA;;;;;;AJYb;;;UIFiB,WAAA;EJGf;;;;EIEA,IAAA;EJEQ;;;;EIGR,WAAA;EJEA;;;;AAcF;EIVE,KAAA,GAAQ,MAAA,SAAe,CAAA,CAAE,OAAA;;;;;;;EAOzB,KAAA;AAAA;;;;;;;;;;AJrBF;;;;;;;;;;;;;;;;;;AAwBA;;;;;;;;iBKHgB,GAAA,CAAI,OAAA,GAAS,WAAA,GAAmB,eAAA;;;cCRnC,mBAAA;EAAA,iBAEQ,SAAA;EAAA,iBACA,OAAA;EAAA,iBACA,SAAA;EAAA,iBACA,SAAA;EAAA,iBACA,SAAA;cAJA,SAAA,EAAW,gBAAA,EACX,OAAA,EAAS,eAAA,EACT,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,iBAAA;ENdb;;;;;;;;EMyBjB,QAAA,CAAS,OAAA,GAAU,eAAA,EAAiB,YAAA,GAAc,IAAA,CAAK,WAAA,MAAsB,MAAA;EAAA,QAoBrE,QAAA;ENzCR;EAAA,QMiGQ,UAAA;AAAA;;;KCnHL,QAAA,GAAW,IAAA,CAAK,WAAA,IAAe,WAAA;;;;;;APSpC;;;;;;;;;;;iBOSgB,mBAAA,CACd,SAAA,EAAW,iBAAA,EACX,SAAA,EAAW,IAAA,CAAK,WAAA,MACf,WAAA;;;;;;iBAca,aAAA,CACd,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,0BACZ,QAAA;APNH;;;;;;;;;;;;;AAAA,iBOoCsB,SAAA,CACpB,MAAA,EAAQ,QAAA,IACR,SAAA,EAAW,SAAA,EACX,SAAA,EAAW,SAAA,EACX,QAAA,EAAU,IAAA,WACV,OAAA,MAAa,IAAA,yBACb,OAAA,WACA,QAAA,WACA,WAAA,oBACC,OAAA;;;;;;;KC7ES,OAAA;EACN,IAAA;EAAe,KAAA;EAAe,MAAA;EAAmC,QAAA;EAAoB,KAAA;AAAA;EACrF,IAAA;EAAgB,MAAA;EAA0B,MAAA;EAAkB,QAAA;EAAoB,KAAA;AAAA;EAChF,IAAA;EAAgB,MAAA;AAAA;EAChB,IAAA;AAAA;EACA,IAAA;AAAA;EACA,IAAA;EAAiB,IAAA;AAAA;EACjB,IAAA;AAAA;EACA,IAAA;EAAc,IAAA;AAAA;EACd,IAAA;AAAA;AAAA,UAEI,WAAA;EACR,OAAA,GAAU,MAAA;EACV,EAAA;EACA,KAAA,GAAQ,MAAA;AAAA;;;AR6DV;;;iBQIsB,aAAA,CACpB,MAAA,MAAY,IAAA,iBACZ,QAAA,UACA,KAAA,EAAO,MAAA,mBACP,QAAA,EAAU,OAAA,IACV,OAAA,EAAS,WAAA,cACT,eAAA,YACC,OAAA;;iBASa,cAAA,CAAe,SAAA,UAAmB,IAAA,uBAA2B,OAAA;;;;;;;ARvF7E;;;;;;;;;;;;;;;;;;AAwBA;;;;;;cSJa,eAAA,YAA2B,UAAA;EAAA,iBAEe,OAAA;EAAA,iBAClC,SAAA;EAAA,iBACA,eAAA;cAFkC,OAAA,EAAS,sBAAA,EAC3C,SAAA,EAAW,mBAAA,EACX,eAAA,EAAiB,eAAA;EAAA,OAG7B,OAAA,CAAQ,OAAA,EAAS,sBAAA,GAAyB,aAAA;EAajD,SAAA,CAAU,SAAA,EAAW,kBAAA;AAAA"}

package/build/index.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { authMiddleware, mcpCors, mcpTransport, oauthRoutes, protectedResourceMetadata, sideloadResource } from "@silkweave/mcp";
 import express from "express";
 import { ForbiddenException, Inject, Injectable, Module, SetMetadata } from "@nestjs/common";
-import { DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
+import { ApplicationConfig, DiscoveryModule, DiscoveryService, HttpAdapterHost, MetadataScanner, ModuleRef, Reflector } from "@nestjs/core";
 import { createAction, createContext } from "@silkweave/core";
 import { z } from "zod/v4";
 import { GUARDS_METADATA, METHOD_METADATA, PATH_METADATA, ROUTE_ARGS_METADATA } from "@nestjs/common/constants.js";
@@ -8761,6 +8761,26 @@ var SilkweaveExecutionContext = class {
 //#endregion
 //#region src/lib/guards.ts
 /**
+* Collect the app's global guards that match an opt-in allow-list of classes.
+*
+* Reads both registration styles Nest exposes via `ApplicationConfig`:
+* `useGlobalGuards(new X())` instances (`getGlobalGuards()`) and
+* `{ provide: APP_GUARD, useClass }` DI guards (`getGlobalRequestGuards()`,
+* which yields `InstanceWrapper`s - we read `.instance` off each).
+*
+* The allow-list is intentionally explicit-by-class: a blanket "run every
+* global" would also fire unrelated globals (e.g. a `ThrottlerGuard` that
+* assumes a writable response) on every tool call. An empty allow-list runs
+* no globals, preserving the prior behavior.
+*
+* Call this at tool-call time, not at discovery time: `APP_GUARD` instances
+* aren't populated until `app.init()` finishes.
+*/
+function collectGlobalGuards(appConfig, allowList) {
+	if (allowList.length === 0) return [];
+	return [...appConfig.getGlobalGuards(), ...appConfig.getGlobalRequestGuards().map((w) => w.instance)].filter((g) => g != null).filter((g) => allowList.some((c) => g instanceof c));
+}
+/**
 * Read `@UseGuards(...)` metadata for both the method and its class and merge
 * the two lists. Method-level guards run AFTER class-level guards (matching
 * Nest's own behavior).
@@ -9340,22 +9360,24 @@ function __decorate(decorators, target, key, desc) {
 }
 //#endregion
 //#region src/lib/controllerDiscovery.ts
-var _ref$1, _ref2$1, _ref3, _ref4;
+var _ref$1, _ref2$1, _ref3, _ref4, _ref5;
 let ControllerDiscovery = class ControllerDiscovery {
-	constructor(discovery, scanner, reflector, moduleRef) {
+	constructor(discovery, scanner, reflector, moduleRef, appConfig) {
 		this.discovery = discovery;
 		this.scanner = scanner;
 		this.reflector = reflector;
 		this.moduleRef = moduleRef;
+		this.appConfig = appConfig;
 	}
 	/**
 	* Walk every Nest provider/controller, find methods annotated with `@Mcp`,
 	* and build a core `Action` per method whose input schema is reflected from
 	* the route + parameter decorators (+ optional OpenAPI document) and whose
 	* `run` re-binds the validated input back into the method's positional
-	* arguments (with `@UseGuards` guards applied first).
+	* arguments (with `@UseGuards` guards - and any opted-in `globalGuards` -
+	* applied first).
 	*/
-	discover(openapi) {
+	discover(openapi, globalGuards = []) {
 		const lookup = openapi ? buildOpenApiLookup(openapi) : void 0;
 		const discovered = [];
 		for (const wrapper of this.discovery.getProviders().concat(this.discovery.getControllers())) {
@@ -9378,9 +9400,9 @@ let ControllerDiscovery = class ControllerDiscovery {
 				});
 			}
 		}
-		return discovered.map((d) => this.toAction(d, lookup));
+		return discovered.map((d) => this.toAction(d, lookup, globalGuards));
 	}
-	toAction(d, lookup) {
+	toAction(d, lookup, globalGuards) {
 		const proto = Object.getPrototypeOf(d.instance);
 		const route = reflectRoute(d.classRef, d.method);
 		const slots = readParamSlots(d.classRef, d.methodName, proto);
@@ -9392,20 +9414,24 @@ let ControllerDiscovery = class ControllerDiscovery {
 		const description = d.meta.description ?? operation.description ?? `${d.methodName} (${route.method} /${route.path})`;
 		const applyParamPipes = d.meta.pipes !== "skip";
 		const guards = collectGuards(this.reflector, d.classRef, d.method);
-		const { moduleRef, reflector } = this;
+		const pathFields = pathParamFields(bindings);
+		const { moduleRef, reflector, appConfig } = this;
 		const classRef = d.classRef;
 		const method = d.method;
 		const instance = d.instance;
-		const applyGuards = async (context) => {
-			if (guards.length === 0) return;
+		const applyGuards = async (context, input) => {
+			const all = [...collectGlobalGuards(appConfig, globalGuards), ...guards];
+			if (all.length === 0) return;
 			const request = context.getOptional("request");
 			const response = context.getOptional("response") ?? null;
 			const hasRequest = request != null;
-			await runGuards(guards, moduleRef, reflector, classRef, method, hasRequest ? request : {
+			const guardRequest = hasRequest ? request : {
 				headers: {},
 				params: {},
 				query: {}
-			}, response, hasRequest ? "http" : "rpc");
+			};
+			populatePathParams(guardRequest, pathFields, input);
+			await runGuards(all, moduleRef, reflector, classRef, method, guardRequest, response, hasRequest ? "http" : "rpc");
 		};
 		return createAction({
 			name,
@@ -9413,7 +9439,7 @@ let ControllerDiscovery = class ControllerDiscovery {
 			input: z.object(shape),
 			isEnabled: (ctx) => ctx.getOptional("adapter") === "mcp",
 			run: async (input, context) => {
-				await applyGuards(context);
+				await applyGuards(context, input);
 				return await invokeRebound(method, instance, input, bindings, context.getOptional("request"), applyParamPipes) ?? {};
 			}
 		});
@@ -9448,8 +9474,26 @@ ControllerDiscovery = __decorate([Injectable(), __decorateMetadata("design:param
 	typeof (_ref$1 = typeof DiscoveryService !== "undefined" && DiscoveryService) === "function" ? _ref$1 : Object,
 	typeof (_ref2$1 = typeof MetadataScanner !== "undefined" && MetadataScanner) === "function" ? _ref2$1 : Object,
 	typeof (_ref3 = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref3 : Object,
-	typeof (_ref4 = typeof ModuleRef !== "undefined" && ModuleRef) === "function" ? _ref4 : Object
+	typeof (_ref4 = typeof ModuleRef !== "undefined" && ModuleRef) === "function" ? _ref4 : Object,
+	typeof (_ref5 = typeof ApplicationConfig !== "undefined" && ApplicationConfig) === "function" ? _ref5 : Object
 ])], ControllerDiscovery);
+/** Input field names that originate from the URL path (`@Param`), per the re-bind plan. */
+function pathParamFields(bindings) {
+	const fields = [];
+	for (const b of bindings) if (b.kind === "params") fields.push(...b.fields);
+	else if (b.kind === "value" && b.source === "path") fields.push(b.field);
+	return fields;
+}
+/**
+* Fill `request.params` with the reflected path fields from the validated input,
+* matching what Express would populate over REST (raw string values). Only adds
+* keys that are absent, so a real REST request's params are never overwritten.
+*/
+function populatePathParams(request, pathFields, input) {
+	if (pathFields.length === 0 || typeof request !== "object" || request === null) return;
+	const params = request.params ??= {};
+	for (const field of pathFields) if (!(field in params) && input[field] !== void 0) params[field] = String(input[field]);
+}
 function designTypeAt(designTypes, index) {
 	const ctor = designTypes[index];
 	if (ctor === String) return { type: "string" };
@@ -9555,7 +9599,7 @@ let SilkweaveModule = _SilkweaveModule = class SilkweaveModule {
 	configure(_consumer) {
 		const httpAdapter = this.httpAdapterHost.httpAdapter;
 		if (!httpAdapter) throw new Error("@silkweave/nestjs: HttpAdapterHost.httpAdapter is not available.");
-		const allActions = this.discovery.discover(this.options.openapi);
+		const allActions = this.discovery.discover(this.options.openapi, this.options.globalGuards);
 		for (const adapter of this.options.adapters) {
 			const baseContext = createContext({
 				...this.options.context ?? {},
@@ -9581,6 +9625,6 @@ SilkweaveModule = _SilkweaveModule = __decorate([
 	])
 ], SilkweaveModule);
 //#endregion
-export { ControllerDiscovery, MCP_METADATA, Mcp, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, apiPropertyToField, buildOpenApiLookup, classValidatorToField, collectGuards, designTypeToField, fieldToZod, invokeRebound, mcp, mergeField, normalizeEnum, openApiFields, openapiSchemaToField, reflectDtoFields, runGuards, specialBinding, swaggerParamToField, typeTokenToBase };
+export { ControllerDiscovery, MCP_METADATA, Mcp, SILKWEAVE_MODULE_OPTIONS, SilkweaveModule, apiPropertyToField, buildOpenApiLookup, classValidatorToField, collectGlobalGuards, collectGuards, designTypeToField, fieldToZod, invokeRebound, mcp, mergeField, normalizeEnum, openApiFields, openapiSchemaToField, reflectDtoFields, runGuards, specialBinding, swaggerParamToField, typeTokenToBase };
 
 //# sourceMappingURL=index.mjs.map