chore(deps): bump ws from 7.5.10 to 7.5.11#1473
Closed
dependabot[bot] wants to merge 27 commits into
Closed
Conversation
Introduce Model Context Protocol (MCP) support at the @nestia/core layer: - @mcproute method decorator + @McpRoute.Params parameter decorator; stores "nestia/McpRoute" and "nestia/McpRoute/Parameters" reflection metadata. - IMcpRouteReflect internal shape describing per-method tool config (name, title, description, inputSchema, outputSchema, annotations) and per-parameter argument metadata. - McpAdaptor.upgrade(app, options) bootstrap hook that walks the Nest container, collects @McpRoute-annotated methods, and serves each as an MCP tool via @modelcontextprotocol/sdk's low-level Server and StreamableHTTPServerTransport. Stateless mode by default; `sessioned` option enables session IDs. - McpRouteProgrammer emits JSON Schema 2020-12 via typia's JsonSchemaProgrammer for each @McpRoute.Params<T>() parameter type. - McpRouteTransformer wires the programmer into the ts-patch transform pipeline so inputSchema is baked into the decorator call at compile time. - ParameterDecoratorTransformer.FUNCTORS gains "McpRoute.Params" mapping to TypedBodyProgrammer, giving arguments the same runtime typia validation as @TypedBody. - Error mapping: typia validation failure -> JSON-RPC -32602 with structured diagnostics; unknown tool -> -32601; HttpException from handler -> tool result with isError: true; other throws -> -32603. Refs: #1350
Hook MCP routes into the @nestia/sdk analyzer, route-table, and client
code generator so `nestia sdk` / `nestia all` emit typed wrappers for
every @McpRoute-decorated method.
Structures:
- IReflectMcpOperation + IReflectMcpOperationParameter: compile-time
reflection of MCP tool metadata + typed argument descriptor.
- ITypedMcpRoute: final typed route carried by ITypedApplication.
- IReflectController.operations union widened to include the new
operation type; ITypedApplication.routes union widened to include
ITypedMcpRoute.
Analyzers:
- ReflectMcpOperationAnalyzer reads "nestia/McpRoute" metadata +
"nestia/McpRoute/Parameters" entries and produces IReflectMcpOperation.
- TypedMcpRouteAnalyzer converts the operation to ITypedMcpRoute with a
stable `["mcp", <sanitised-tool-name>]` accessor.
- ReflectControllerAnalyzer dispatches to the MCP analyzer first, then
falls through to WebSocket + HTTP (preserving existing behaviour for
non-MCP methods).
- AccessorAnalyzer type-widened to accept the new route shape.
Application wiring:
- NestiaSdkApplication iterates operations, short-circuits MCP (no path
expansion) and calls TypedMcpRouteAnalyzer; aggregate count logic
updated so MCP contributes one route each.
- NestiaSwaggerComposer skips MCP operations (keeps swagger HTTP-only,
same policy used for WebSocket routes).
Generation:
- SdkMcpRouteProgrammer emits, per tool, an async wrapper:
async function <name>(
client: Client,
args: <name>.Input,
): Promise<<name>.Output>
with a paired namespace exposing Input, Output (= Primitive<Return>),
and an `as const` METADATA record. Response is typed via
CallToolResult; the legacy CompatibilityCallToolResult branch is
rejected at runtime with a clear error, and the text content block
is narrowed structurally before JSON.parse.
- SdkFileProgrammer + SdkRouteDirectory dispatch on the third protocol
branch.
Refs: #1350
Add `tests/test-sdk/features/mcp` covering the new @mcproute decorator, McpAdaptor runtime, and the @nestia/sdk MCP code generator. Structure (mirrors tests/test-sdk/features/websocket): - nestia.config.ts: input/output + swagger + e2e blocks so `nestia all` exercises every subcommand path (swagger.json and the e2e automated dir are emitted empty because MCP is not HTTP — same policy as WebSocket). - tsconfig.json extends the shared test-sdk config. - src/Backend.ts boots a minimal NestJS app with CalculatorController and WeatherController, then calls McpAdaptor.upgrade on port 37000. - src/controllers/CalculatorController.ts declares add, subtract, and divide (divide throws BadRequestException on zero divisor to exercise the HttpException -> isError mapping). - src/controllers/WeatherController.ts declares get_weather with a nested `coords` object so the JSON-Schema programmer exercises recursive emission. - src/test/index.ts bootstraps @nestia/e2e's DynamicExecutor. Test coverage (12 cases): Wire-protocol layer (uses @modelcontextprotocol/sdk Client directly): - test_mcp_initialize handshake + capabilities.tools advertised - test_mcp_tools_list 4 tools discoverable + schema shape - test_mcp_tools_call round-trip add + get_weather - test_mcp_invalid_tool unknown tool -> -32601 MethodNotFound - test_mcp_invalid_arguments typia failure -> -32602 InvalidParams - test_mcp_domain_error BadRequestException -> isError: true Generated-SDK layer (uses api.functional.mcp.* wrappers): - test_api_mcp_add typed add via SDK - test_api_mcp_subtract typed subtract via SDK - test_api_mcp_divide_ok typed divide happy path - test_api_mcp_weather_nested typed nested input flow - test_api_mcp_metadata METADATA `as const` literal assertions - test_api_mcp_domain_error SDK wrapper throws on isError result Refs: #1350
Run `prettier -w` on every file introduced or modified by the MCP change set so indentation, import order, and JSDoc wrapping match the rest of the repository (2-space indent, @trivago sort-imports, prettier-plugin-jsdoc). No semantic changes; tests remain green (pnpm --filter @nestia/core build, @nestia/sdk build, nestia all, and the twelve MCP feature tests all pass).
Address review feedback: instead of requiring users to duplicate the tool description in the @mcproute({...}) config object, parse the method's JSDoc block at transform time and inject description + an optional @title tag into the decorator call. Explicit config values still win; the JSDoc path is the default. - packages/core/src/transformers/McpRouteTransformer.ts Add extractJsDoc(method) (walks ts.getJSDocCommentsAndTags, reads main comment + @title tag) and injectJsDoc(method, config) that copies the existing object literal and appends description / title fields when absent. The enriched literal is passed to ts.factory.updateCallExpression alongside the generated JSON Schema. - packages/core/src/decorators/McpRoute.ts Document the auto-fill behaviour on IConfig.description and IConfig.title JSDoc so the source reflects the new contract. - packages/sdk/src/analyses/ReflectMcpOperationAnalyzer.ts Belt-and-suspenders fallback: if the decorator config still lacks description at analyser time (e.g. transformer disabled), use ctx.metadata.description captured by SdkOperationTransformer. - tests/test-sdk/features/mcp/src/controllers/*.ts Swap the test controllers from `description: "..."` in the decorator config to JSDoc-only style, exercising the new path. All twelve MCP feature tests still pass.
fix(website): fix nextra version to avoid its bug
Public form takes only the tool name. Object-form overload and IConfig marked @internal — they are emitted by McpRouteTransformer at compile time, not written by users. Title and description are now read from the method's JSDoc (`@title` tag for title, comment body for description) rather than from config fields.
Adds compile-time validation for the MCP-spec rules samchon called out in the PR review: - @McpRoute.Params() may appear at most once per method (enforceSingleParams in McpRouteTransformer). - Parameter type must be a single static object — no primitives, no unions, no Record<string, X> or index signatures (McpRouteProgrammer with check_mcp_object). - Return type must be `void` or a single static object; mixed `void | object` unions are rejected via TS checker before typia analysis (McpRouteReturnProgrammer). Shared object-only check extracted to programmers/internal/check_mcp_object to avoid duplicating the metadata.objects / isSoleLiteral logic between the params and return programmers. McpRouteTransformer also normalizes the public string overload (@mcproute("name")) into the canonical object literal form before injecting inputSchema, so all downstream consumers see a single shape.
Six fixtures under tests/test-sdk/features/mcp-error-*/ exercise each
constraint enforced by the new compile-time checks. The shared start.js
runner expects features whose name contains "error" to fail at either
`npx tsc` or `npx nestia all`; if all stages succeed it raises
"compile error must be occurred."
- mcp-error-multiple-params two @McpRoute.Params()
- mcp-error-param-non-object @McpRoute.Params() x: string
- mcp-error-param-dynamic-properties Record<string, number> param
- mcp-error-return-non-object Promise<string> return
- mcp-error-return-dynamic-properties Promise<Record<string, number>> return
- mcp-error-return-union-void-object Promise<{...} | void> return
Annotates branch-authored MCP files with the project-standard JSDoc header (description + @author) so they line up with the convention used by the rest of the codebase. Pure documentation, no behavioural change.
…1460) * fix(NestiaConfigLoader): handle baseUrl and path aliases in ts-node registration * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Oleksandr Nesh <neschadin.oleksandr@unibrix.com> Co-authored-by: Jeongho Nam <samchon.github@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Merge samchon/nestia master into the MCP route branch, then tighten the generated MCP client and route analysis around the review findings. MCP SDK imports are aliased in generated clients, @mcproute tools now require exactly one decorated params object, and distribution package dependencies are added only when MCP routes are generated. Constraint: @nestia/core must not force MCP SDK as a peer dependency for ordinary users Constraint: Generated SDK clients still need MCP SDK types when MCP routes are present Rejected: Add MCP SDK to the distribution template package.json | it would affect SDK packages without MCP routes Rejected: Allow zero-argument MCP tools | user requires a single @McpRoute.Params() object Confidence: high Scope-risk: moderate Directive: Keep MCP SDK dependency injection conditional on app.routes containing protocol === mcp Tested: pnpm --filter @nestia/core build Tested: pnpm --filter @nestia/sdk build Tested: pnpm --dir tests/test-sdk start -- --only mcp Not-tested: Full repository test matrix
McpRoute currently exposes stateless Streamable HTTP tools, so the API now avoids implying stateful session support until the server can own transport reuse, session storage, cleanup, and deployment constraints. The SDK path also now treats void MCP tools as a first-class contract and rejects duplicate tool names before generation can emit ambiguous client methods. Constraint: MCP tools are dispatched by tool name, so duplicate names create ambiguous runtime behavior and generated SDK contracts Constraint: Stateful Streamable HTTP requires session storage, transport reuse, cleanup, and sticky deployment rules that are outside this adaptor scope Rejected: Keep the sessioned option | it advertises a stateful mode that this adaptor does not actually implement safely Rejected: Parse text content for void tools | void tools should not require server content and should return Promise<void> in the generated SDK Confidence: high Scope-risk: moderate Directive: Do not reintroduce sessioned mode without a real session transport registry, lifecycle cleanup, and deployment guidance Tested: pnpm --filter @nestia/core build Tested: pnpm --filter @nestia/sdk build Tested: pnpm --dir tests/test-sdk start -- --only mcp Tested: git diff --check Not-tested: pnpm --dir website build | local website/node_modules is missing and build fails before docs compilation with ERR_MODULE_NOT_FOUND for jszip
Self-review found two places where the implementation still leaned on internal shapes: examples and fixtures used the transformer-emitted object form, and distinct MCP tool names could collapse to the same generated SDK accessor after identifier escaping. The public examples now exercise @mcproute(name), the transformer avoids source-text reads on synthetic property names, and SDK validation reports accessor collisions before generation emits duplicate functions. Constraint: McpRoute.IConfig is internal transformer output, not the public authoring surface Constraint: Generated TypeScript SDK files cannot contain two functions with the same escaped accessor name Rejected: Let sanitized accessor collisions fail later in tsc | the analysis error can point at the offending @mcproute declarations directly Rejected: Keep getText() in hasField | synthetic object literals from the string overload do not always have source text Confidence: high Scope-risk: moderate Directive: Keep public docs and test fixtures on @mcproute(tool_name) unless explicitly testing transformer internals Tested: pnpm --filter @nestia/core build Tested: pnpm --filter @nestia/sdk build Tested: pnpm --dir tests/test-sdk start -- --only mcp Tested: git diff --check Not-tested: Full repository test matrix
The CI spell checker flags British spelling in comments, so normalize the transformer note without changing behavior. Constraint: crate-ci/typos runs on every pull request Confidence: high Scope-risk: narrow Tested: pnpm --filter @nestia/core build Tested: git diff --check Not-tested: Full repository test matrix
feat(core, sdk): add Model Context Protocol (MCP) support
Replace TypeScript's `ts.factory` / `ts.createPrinter` with `@ttsc/factory` (string-literal AST kinds, zero dependencies) so `@nestia/migrate` no longer pulls the whole `typescript` package into its bundle. The browser/playground bundle drops its largest dependency. - swap every `import ts from "typescript"` for named `@ttsc/factory` imports (`factory`, `SyntaxKind`, `NodeFlags`, `TsPrinter`, `addSyntheticLeadingComment`, and the AST types); print via `TsPrinter` instead of `ts.createPrinter`. - reimplement the five `@typia/core` factory helpers the generator used (`IdentifierFactory`, `StatementFactory`, `TypeFactory`, `LiteralFactory`, `ExpressionFactory`) on top of `@ttsc/factory` under `src/factories/`, since the upstream ones are built on `ts.factory` and would re-introduce `typescript`. - bump the `@ttsc/factory` catalog to ^0.15.7 (comment support + the printer fixes this migration needs). Verified: the full test-migrate suite (19 OpenAPI documents x nest/sdk x keyword/positional = 76 projects) generates and compiles with `tsc`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NLiDku3JXgsnRkQVrWm24P
The generator no longer imports `typescript` at runtime (it builds source via `@ttsc/factory`), so move `typescript` to devDependencies — it is only needed to compile the package (tsc + the typia transform). Consumers of `@nestia/migrate` no longer pull `typescript`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NLiDku3JXgsnRkQVrWm24P
- bump @ttsc/factory to ^0.15.8, which makes SyntaxKind/NodeFlags a regular string enum instead of a const enum. A const enum cannot be referenced from packages compiled with isolatedModules (e.g. @nestia/editor), which broke their build (TS2748). - FilePrinter.newLine now emits an empty identifier (one blank line) instead of an ExpressionStatement, which printed a stray `;` at statement level. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NLiDku3JXgsnRkQVrWm24P
0.15.9 ships @ttsc/factory CJS-only; its previous re-emitted `.mjs` was not real ESM and broke ESM bundlers (the @nestia/editor vite build that bundles migrate's source). Verified the editor build (vite + tsc) passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NLiDku3JXgsnRkQVrWm24P
0.15.10 restores a real dual CJS/ESM build (0.15.9 had regressed to CJS-only). Verified against the published package: migrate typecheck + the @nestia/editor vite build both pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NLiDku3JXgsnRkQVrWm24P
feat(migrate): build the SDK/NestJS generator on @ttsc/factory
Bumps [ws](https://github.com/websockets/ws) from 7.5.10 to 7.5.11. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/ws-8.21.0
branch
from
June 18, 2026 13:26
5fe1384 to
d721f08
Compare
Owner
|
Closing: Dependabot on this repository is being narrowed to a small allow-list (typescript, ttsc, typia, @nestjs/common), mirroring samchon/typia. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ws from 7.5.10 to 7.5.11.
Release notes
Sourced from ws's releases.
Commits
fd36cd8[dist] 7.5.11e14c458[security] Limit retained message parts