
Security News
Open VSX Begins Implementing Pre-Publish Security Checks After Repeated Supply Chain Incidents
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.
@workflow/nest
Advanced tools
NestJS integration for Workflow DevKit.
npm install @workflow/nest
# or
pnpm add @workflow/nest
You also need to install the SWC packages required by NestJS's SWC builder:
npm install -D @swc/cli @swc/core
# or
pnpm add -D @swc/cli @swc/core
After installing the package, run the init command to generate the SWC configuration:
npx @workflow/nest init
This creates a .swcrc file configured with the Workflow SWC plugin for client-mode transformations.
Important: Add .swcrc to your .gitignore as it contains machine-specific absolute paths:
echo '/.swcrc' >> .gitignore
Ensure your nest-cli.json has SWC as the builder:
{/@skip-typecheck: Shows nest-cli.json configuration/}
{
"compilerOptions": {
"builder": "swc"
}
}
In your app.module.ts:
{/@skip-typecheck: Shows WorkflowModule import/}
import { Module } from '@nestjs/common';
import { WorkflowModule } from '@workflow/nest';
@Module({
imports: [WorkflowModule.forRoot()],
})
export class AppModule {}
Create workflow files in your src/ directory with "use workflow" and "use step" directives:
{/@skip-typecheck: Shows workflow file/}
// src/workflows/example.ts
export async function myStep(data: string) {
'use step';
return data.toUpperCase();
}
export async function myWorkflow(input: string) {
'use workflow';
const result = await myStep(input);
return result;
}
Add scripts to regenerate configuration before builds:
{
"scripts": {
"prebuild": "npx @workflow/nest init --force",
"build": "nest build"
}
}
{/@skip-typecheck: Shows WorkflowModule.forRoot options/}
WorkflowModule.forRoot({
// Directory to scan for workflow files (default: ['src'])
dirs: ['src'],
// Output directory for generated bundles (default: '.nestjs/workflow')
outDir: '.nestjs/workflow',
// Skip building in production when bundles are pre-built
skipBuild: false,
});
The @workflow/nest package provides:
.well-known/workflow/v1/.swcrc configuration with the SWC plugin properly resolvedNestJS uses its own SWC builder that reads configuration from .swcrc. The Workflow SWC plugin needs to be referenced by path in this file. The CLI resolves the plugin path from @workflow/nest's dependencies, eliminating the need for manual configuration or pnpm hoisting.
When you run npx @workflow/nest init, it:
@workflow/swc-plugin (bundled as a dependency of @workflow/nest).swcrc with the absolute path to the pluginThis approach ensures:
.npmrcsrc/NestJS's SWC builder only compiles files within the sourceRoot directory (typically src/). For the workflow client-mode transform to work, workflow files must be in src/ so they get compiled with the SWC plugin that attaches workflowId properties needed by start().
{/@skip-typecheck: Shows WorkflowModule usage/}
import { WorkflowModule } from '@workflow/nest';
// Basic usage
WorkflowModule.forRoot()
// With options
WorkflowModule.forRoot({
dirs: ['src/workflows'],
outDir: '.nestjs/workflow',
skipBuild: process.env.NODE_ENV === 'production',
})
# Generate .swcrc configuration
npx @workflow/nest init
# Force regenerate (overwrites existing)
npx @workflow/nest init --force
# Show help
npx @workflow/nest --help
Apache-2.0
FAQs
NestJS integration for Workflow DevKit
The npm package @workflow/nest receives a total of 2,041 weekly downloads. As such, @workflow/nest popularity was classified as popular.
We found that @workflow/nest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Security News
Lodash 4.17.23 marks a security reset, with maintainers rebuilding governance and infrastructure to support long-term, sustainable maintenance.