@sezzlee/sdk-nestjs 0.0.0-stage → 0.2.0

package/dist/options.js

@@ -0,0 +1,151 @@
+import { defaultRankerTimeoutMs, invokeLimits } from "@sezzlee/core";
+import { ToolFamilyOptions } from "./families.js";
+export function callerOf(outer) {
+    const auth = outer?.auth;
+    const extra = auth?.extra ?? {};
+    const subject = typeof extra["sub"] === "string" ? extra["sub"] : auth?.clientId;
+    return {
+        ...(subject === undefined ? {} : { subject }),
+        ...(auth?.clientId === undefined ? {} : { clientId: auth.clientId }),
+        scopes: auth?.scopes ?? [],
+        ...(auth?.resource === undefined
+            ? {}
+            : { resource: auth.resource.toString() }),
+        ...(auth?.expiresAt === undefined
+            ? {}
+            : { expiresAt: new Date(auth.expiresAt * 1000) }),
+        claim: (name) => {
+            const value = extra[name];
+            return typeof value === "string" ? value : undefined;
+        },
+        header: (name) => {
+            const value = outer?.headers[name.toLowerCase()];
+            return Array.isArray(value) ? value.join(", ") : value;
+        },
+    };
+}
+function specificityOf(target) {
+    if (target.handler !== undefined) {
+        return 3;
+    }
+    if (target.controller !== undefined || target.route !== undefined) {
+        return 2;
+    }
+    return 1;
+}
+/**
+ * Central curation: rules for controllers the host cannot decorate, and rules that repeat.
+ *
+ * `seal` exists because plain "most specific wins" lets a method decorator defeat a tenancy rule.
+ * A sealed field cannot be overridden by any layer; attempting it is a build error.
+ */
+export class ArgumentCurationOptions {
+    valueProviders = new Map();
+    declarations = [];
+    get providers() {
+        return this.valueProviders;
+    }
+    get rules() {
+        return this.declarations;
+    }
+    provide(name, provider) {
+        this.valueProviders.set(name, provider);
+        return this;
+    }
+    curate(target, rules) {
+        this.declarations.push({
+            target,
+            rules,
+            sealed: false,
+            specificity: specificityOf(target),
+        });
+        return this;
+    }
+    everywhere(rules) {
+        return this.curate({}, rules);
+    }
+    seal(target, rules) {
+        this.declarations.push({
+            target,
+            rules,
+            sealed: true,
+            specificity: specificityOf(target),
+        });
+        return this;
+    }
+}
+export class IdentityForwardingOptions {
+    names = new Set(["authorization"]);
+    projector;
+    get carriers() {
+        return this.names;
+    }
+    forward(name) {
+        this.names.add(name.toLowerCase());
+        return this;
+    }
+    clear() {
+        this.names.clear();
+        return this;
+    }
+    project(projector) {
+        this.projector = projector;
+        return this;
+    }
+}
+export class ErrorMappingOptions {
+    items = [];
+    get recognizers() {
+        return this.items;
+    }
+    recognize(recognizer) {
+        this.items.push(recognizer);
+        return this;
+    }
+}
+export class SezzleeOptions {
+    identity = new IdentityForwardingOptions();
+    synthetic = { accept: "application/json" };
+    cache = { lifetimeMs: 30_000, maxCallers: 128 };
+    errors = new ErrorMappingOptions();
+    selection = { default: "exclude" };
+    query = { grouping: "flatten" };
+    naming = { prefixMode: "always" };
+    diagnostics = {
+        failOn: "fatal",
+        escalate: new Set(),
+        downgrade: new Set(),
+    };
+    arguments = new ArgumentCurationOptions();
+    families = new ToolFamilyOptions();
+    visibility = {
+        tier: "declarative",
+        onUnknown: "show",
+        probeTopK: 25,
+        probeConcurrency: 4,
+        probeValues: new Map(),
+    };
+    invoke = {
+        maxResponseBytes: invokeLimits.maxResponseBytes,
+        timeoutMs: invokeLimits.invokeTimeoutMs,
+        maxInlineFileBytes: invokeLimits.maxInlineFileBytes,
+        maxFileBytes: invokeLimits.maxFileBytes,
+    };
+    search = {
+        rankerTimeoutMs: defaultRankerTimeoutMs,
+        onRankerFailure: "fallback",
+    };
+    /** Binding `files.resolver` is what makes `ref` appear in a file argument's schema. */
+    files = {};
+    /**
+     * Grouping labels for a container the host cannot decorate. It sits below a `@McpTool({ tags })`
+     * declaration and above the container-derived default, and like a declaration it replaces that
+     * default rather than adding to it.
+     */
+    tags;
+    /** Search vocabulary for a container the host cannot decorate, below a `@McpTool({ searchTerms })`. */
+    searchTerms;
+    schema;
+    resourceServer;
+}
+export const SEZZLEE_OPTIONS = "SEZZLEE_OPTIONS";

package/dist/outer-connection.d.ts

@@ -0,0 +1,18 @@
+export interface OuterConnection {
+    readonly remoteAddress?: string;
+    readonly remotePort?: number;
+    readonly localAddress?: string;
+    readonly localPort?: number;
+}
+interface SocketLike {
+    readonly remoteAddress?: string;
+    readonly remotePort?: number;
+    readonly localAddress?: string;
+    readonly localPort?: number;
+}
+export declare function connectionOf(source: {
+    readonly socket?: SocketLike;
+} | undefined): OuterConnection | undefined;
+export declare function runWithOuterConnection<T>(connection: OuterConnection | undefined, fn: () => T): T;
+export declare function currentOuterConnection(): OuterConnection | undefined;
+export {};

package/dist/outer-connection.js

@@ -0,0 +1,23 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+export function connectionOf(source) {
+    const socket = source?.socket;
+    if (socket === undefined) {
+        return undefined;
+    }
+    const connection = {
+        remoteAddress: socket.remoteAddress,
+        remotePort: socket.remotePort,
+        localAddress: socket.localAddress,
+        localPort: socket.localPort,
+    };
+    return Object.values(connection).some((value) => value !== undefined)
+        ? connection
+        : undefined;
+}
+export function runWithOuterConnection(connection, fn) {
+    return connection === undefined ? fn() : storage.run(connection, fn);
+}
+export function currentOuterConnection() {
+    return storage.getStore();
+}

package/dist/sezzlee.module.d.ts

@@ -0,0 +1,16 @@
+import { type DynamicModule, type InjectionToken, type MiddlewareConsumer, type NestModule } from "@nestjs/common";
+import { type ExtensionOverrides } from "./extension-points.js";
+import { SezzleeOptions } from "./options.js";
+export interface SezzleeModuleAsyncOptions {
+    imports?: DynamicModule["imports"];
+    inject?: InjectionToken[];
+    useFactory: (...args: never[]) => SezzleeOptions | Promise<SezzleeOptions>;
+    overrides?: ExtensionOverrides;
+}
+export declare class SezzleeModule implements NestModule {
+    private readonly options;
+    constructor(options: SezzleeOptions);
+    static forRoot(configure?: (options: SezzleeOptions) => void, overrides?: ExtensionOverrides): DynamicModule;
+    static forRootAsync(asyncOptions: SezzleeModuleAsyncOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}

package/dist/sezzlee.module.js

@@ -0,0 +1,180 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SezzleeModule_1;
+import { Global, Inject, Module, RequestMethod, } from "@nestjs/common";
+import { APP_INTERCEPTOR, DiscoveryModule } from "@nestjs/core";
+import { requireBearerAuth } from "@modelcontextprotocol/express";
+import { MemorySezzleeCache } from "@sezzlee/core";
+import { SezzleeCatalog } from "./catalog.js";
+const SEZZLEE_PROBE_RESET = Symbol("SEZZLEE_PROBE_RESET");
+const SEZZLEE_LIST_CHANGED = Symbol("SEZZLEE_LIST_CHANGED");
+import { DeclarativeVisibilityEvaluator } from "./visibility/evaluator.js";
+import { SezzleeProbeEvaluator, SezzleeProbeInterceptor, } from "./visibility/probe.js";
+import { CallerVisibilityProvider } from "./visibility/provider.js";
+import { CarrierHashCallerScopeResolver, SEZZLEE_CACHE_INVALIDATOR, SezzleeCacheInvalidator, } from "./cache.js";
+import { SezzleeDispatcher } from "./dispatcher.js";
+import { extensionTokens, toProviders, } from "./extension-points.js";
+import { DefaultInvokeResultMapper } from "./invoke-result-mapper.js";
+import { SEZZLEE_OPTIONS, SezzleeOptions } from "./options.js";
+import { validateSezzleeOptions } from "./options-validation.js";
+import { withAudienceCheck } from "./transport/audience.js";
+import { protectedResourceMetadataHandler, protectedResourceMetadataPath, protectedResourceMetadataUrl, } from "./transport/protected-resource-metadata.js";
+import { SezzleeStreamableHttp } from "./transport/streamable-http.js";
+function defaultProviders() {
+    return [
+        {
+            provide: extensionTokens.cache,
+            useFactory: (options) => new MemorySezzleeCache({
+                lifetimeMs: options.cache.lifetimeMs,
+                maxCallers: options.cache.maxCallers,
+            }),
+            inject: [SEZZLEE_OPTIONS],
+        },
+        {
+            provide: extensionTokens.callerScopeResolver,
+            useClass: CarrierHashCallerScopeResolver,
+        },
+        {
+            provide: extensionTokens.invokeResultMapper,
+            useClass: DefaultInvokeResultMapper,
+        },
+        {
+            provide: extensionTokens.visibilityEvaluator,
+            useClass: DeclarativeVisibilityEvaluator,
+        },
+        { provide: extensionTokens.toolRanker, useValue: null },
+        {
+            provide: extensionTokens.probeEvaluator,
+            useFactory: (dispatcher, options) => new SezzleeProbeEvaluator(dispatcher, options),
+            inject: [SezzleeDispatcher, SEZZLEE_OPTIONS],
+        },
+        {
+            provide: SEZZLEE_PROBE_RESET,
+            useFactory: (catalog, prober) => catalog.onChange(() => {
+                if (prober instanceof SezzleeProbeEvaluator) {
+                    prober.clearDisabled();
+                }
+            }),
+            inject: [SezzleeCatalog, extensionTokens.probeEvaluator],
+        },
+        {
+            provide: CallerVisibilityProvider,
+            useFactory: (evaluator, prober, cache, options) => new CallerVisibilityProvider(evaluator, prober, cache, options),
+            inject: [
+                extensionTokens.visibilityEvaluator,
+                extensionTokens.probeEvaluator,
+                extensionTokens.cache,
+                SEZZLEE_OPTIONS,
+            ],
+        },
+        {
+            /**
+             * Guard: the 2026-07-28 revision delivers `tools/list_changed` only on a
+             * `subscriptions/listen` stream the client opened, so the notification has to be published on
+             * the handler's bus. It cannot be bound per session any more — there are no sessions, and the
+             * per-request server the handler builds is gone before the next catalogue reload.
+             */
+            provide: SEZZLEE_LIST_CHANGED,
+            useFactory: (catalog, transport) => catalog.onChange(() => {
+                transport.notifyToolListChanged();
+            }),
+            inject: [SezzleeCatalog, SezzleeStreamableHttp],
+        },
+        { provide: APP_INTERCEPTOR, useClass: SezzleeProbeInterceptor },
+        SezzleeCatalog,
+        SezzleeDispatcher,
+        SezzleeStreamableHttp,
+        SezzleeCacheInvalidator,
+        {
+            provide: SEZZLEE_CACHE_INVALIDATOR,
+            useExisting: SezzleeCacheInvalidator,
+        },
+    ];
+}
+function moduleExports() {
+    return [
+        ...Object.values(extensionTokens),
+        CallerVisibilityProvider,
+        SezzleeCatalog,
+        SezzleeDispatcher,
+        SezzleeStreamableHttp,
+        SezzleeCacheInvalidator,
+        SEZZLEE_CACHE_INVALIDATOR,
+        SEZZLEE_OPTIONS,
+    ];
+}
+let SezzleeModule = SezzleeModule_1 = class SezzleeModule {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    static forRoot(configure, overrides) {
+        const options = new SezzleeOptions();
+        configure?.(options);
+        validateSezzleeOptions(options);
+        return {
+            module: SezzleeModule_1,
+            imports: [DiscoveryModule],
+            providers: [
+                { provide: SEZZLEE_OPTIONS, useValue: options },
+                ...defaultProviders(),
+                ...toProviders(overrides),
+            ],
+            exports: moduleExports(),
+        };
+    }
+    static forRootAsync(asyncOptions) {
+        return {
+            module: SezzleeModule_1,
+            imports: [DiscoveryModule, ...(asyncOptions.imports ?? [])],
+            providers: [
+                {
+                    provide: SEZZLEE_OPTIONS,
+                    useFactory: async (...args) => {
+                        const options = await asyncOptions.useFactory(...args);
+                        validateSezzleeOptions(options);
+                        return options;
+                    },
+                    inject: asyncOptions.inject ?? [],
+                },
+                ...defaultProviders(),
+                ...toProviders(asyncOptions.overrides),
+            ],
+            exports: moduleExports(),
+        };
+    }
+    configure(consumer) {
+        const resourceServer = this.options.resourceServer;
+        if (resourceServer === undefined) {
+            return;
+        }
+        const mcpPath = resourceServer.mcpPath ?? "/mcp";
+        consumer.apply(protectedResourceMetadataHandler(resourceServer)).forRoutes({
+            path: protectedResourceMetadataPath(mcpPath),
+            method: RequestMethod.GET,
+        });
+        consumer
+            .apply(requireBearerAuth({
+            verifier: withAudienceCheck(resourceServer.verifier, resourceServer.resource),
+            resourceMetadataUrl: protectedResourceMetadataUrl(resourceServer.resource, mcpPath).toString(),
+        }))
+            .forRoutes({ path: mcpPath, method: RequestMethod.ALL });
+    }
+};
+SezzleeModule = SezzleeModule_1 = __decorate([
+    Global(),
+    Module({}),
+    __param(0, Inject(SEZZLEE_OPTIONS)),
+    __metadata("design:paramtypes", [SezzleeOptions])
+], SezzleeModule);
+export { SezzleeModule };

package/dist/synthetic-context.d.ts

@@ -0,0 +1,18 @@
+import { IncomingMessage, ServerResponse } from "node:http";
+import { SezzleeDispatchAborted, type DispatchAbortReason } from "@sezzlee/core";
+import type { DispatchResult } from "./dispatcher.js";
+import type { OuterConnection } from "./outer-connection.js";
+export { SezzleeDispatchAborted };
+export type { DispatchAbortReason };
+export interface SyntheticContext {
+    req: IncomingMessage;
+    res: ServerResponse;
+    result: Promise<DispatchResult>;
+    /**
+     * Abandons the dispatch and delivers a client disconnect to the handler.
+     *
+     * @param reason why the dispatch was abandoned
+     */
+    abort(reason: DispatchAbortReason): void;
+}
+export declare function createSyntheticContext(method: string, url: string, headers: Record<string, string>, scheme: string, body?: Buffer, connection?: OuterConnection): SyntheticContext;

package/dist/synthetic-context.js

@@ -0,0 +1,131 @@
+import { IncomingMessage, ServerResponse } from "node:http";
+import { Socket } from "node:net";
+import { SezzleeDispatchAborted, } from "@sezzlee/core";
+export { SezzleeDispatchAborted };
+function captureHeaders(res) {
+    const headers = {};
+    for (const [name, value] of Object.entries(res.getHeaders())) {
+        if (value === undefined) {
+            continue;
+        }
+        headers[name.toLowerCase()] = Array.isArray(value)
+            ? value.join(", ")
+            : String(value);
+    }
+    return headers;
+}
+function reflectConnection(socket, connection) {
+    if (connection === undefined) {
+        return;
+    }
+    for (const [name, value] of Object.entries(connection)) {
+        if (value !== undefined) {
+            Object.defineProperty(socket, name, { value, configurable: true });
+        }
+    }
+}
+export function createSyntheticContext(method, url, headers, scheme, body, connection) {
+    const socket = new Socket();
+    if (scheme === "https") {
+        Object.defineProperty(socket, "encrypted", { value: true });
+    }
+    reflectConnection(socket, connection);
+    const req = new IncomingMessage(socket);
+    req.method = method;
+    req.url = url;
+    req.headers = { ...headers };
+    if (body !== undefined) {
+        req.headers["content-length"] = String(body.byteLength);
+        req.push(body);
+    }
+    req.push(null);
+    /**
+     * Node's HTTP parser sets `complete`; nothing does for a hand-built message. Left false, the
+     * stream's auto-destroy emits `aborted` as soon as the body is consumed, so every dispatch looked
+     * like a client disconnect — multer answers it with a 500. Pinned by N2 in
+     * test/form-body-probe.spec.ts.
+     */
+    req.complete = true;
+    const res = new ServerResponse(req);
+    const chunks = [];
+    let settled = false;
+    let abandon;
+    const result = new Promise((resolve, reject) => {
+        const capture = (chunk, encoding) => {
+            if (settled) {
+                return;
+            }
+            if (typeof chunk === "string") {
+                chunks.push(Buffer.from(chunk, typeof encoding === "string"
+                    ? encoding
+                    : "utf8"));
+            }
+            else if (chunk instanceof Buffer || chunk instanceof Uint8Array) {
+                chunks.push(Buffer.from(chunk));
+            }
+        };
+        res.write = function write(chunk, encoding, callback) {
+            capture(chunk, encoding);
+            const done = typeof encoding === "function" ? encoding : callback;
+            if (typeof done === "function") {
+                done();
+            }
+            return true;
+        };
+        res.end = function end(chunk, encoding, callback) {
+            if (settled) {
+                return res;
+            }
+            if (typeof chunk !== "function") {
+                capture(chunk, encoding);
+            }
+            const done = [chunk, encoding, callback].find((arg) => typeof arg === "function");
+            const responseHeaders = captureHeaders(res);
+            settled = true;
+            resolve({
+                status: res.statusCode,
+                body: Buffer.concat(chunks).toString("utf8"),
+                contentType: responseHeaders["content-type"],
+                headers: responseHeaders,
+            });
+            res.emit("finish");
+            res.emit("close");
+            if (typeof done === "function") {
+                done();
+            }
+            return res;
+        };
+        /**
+         * `settled` is the single guard: without it an abandoned handler that later calls `res.end()`
+         * resolves an already-rejected dispatch, emits a second `finish`/`close` into Nest's own
+         * listeners, and mutates `chunks` after the body string was built from it. Nest does not
+         * unsubscribe a route handler on disconnect, so an abandoned handler running to completion is
+         * the normal case, not the exception. Pinned by the abandoned-handler tests in
+         * test/dispatch-abort.spec.ts.
+         */
+        abandon = (reason) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            reject(new SezzleeDispatchAborted(reason));
+            try {
+                req.emit("aborted");
+                req.emit("close");
+                res.emit("close");
+                socket.emit("close");
+            }
+            catch (error) {
+                process.stderr.write(`sezzlee: a disconnect listener threw: ${String(error)}\n`);
+            }
+        };
+    });
+    return {
+        req,
+        res,
+        result,
+        abort: (reason) => {
+            abandon?.(reason);
+        },
+    };
+}

package/dist/transport/audience.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenVerifier } from "@modelcontextprotocol/express";
+export declare function withAudienceCheck(inner: OAuthTokenVerifier, resource: URL): OAuthTokenVerifier;

package/dist/transport/audience.js

@@ -0,0 +1,21 @@
+import { OAuthError, OAuthErrorCode } from "@modelcontextprotocol/server";
+function normalize(url) {
+    return url.toString().replace(/\/$/, "");
+}
+export function withAudienceCheck(inner, resource) {
+    return {
+        async verifyAccessToken(token) {
+            const authInfo = await inner.verifyAccessToken(token);
+            if (authInfo.resource === undefined ||
+                normalize(authInfo.resource) !== normalize(resource)) {
+                /**
+                 * Guard: the express middleware recognises only the v2 `OAuthError`; a legacy error class
+                 * escapes as a 500 and the client never sees the `invalid_token` challenge that tells it to
+                 * re-authorize.
+                 */
+                throw new OAuthError(OAuthErrorCode.InvalidToken, "audience mismatch");
+            }
+            return authInfo;
+        },
+    };
+}

package/dist/transport/protected-resource-metadata.d.ts

@@ -0,0 +1,6 @@
+import type { RequestHandler } from "express";
+import type { SezzleeResourceServerOptions } from "../options.js";
+export declare const protectedResourceMetadataWellKnownPrefix = "/.well-known/oauth-protected-resource";
+export declare function protectedResourceMetadataPath(mcpPath: string): string;
+export declare function protectedResourceMetadataUrl(resource: URL, mcpPath: string): URL;
+export declare function protectedResourceMetadataHandler(options: SezzleeResourceServerOptions): RequestHandler;

package/dist/transport/protected-resource-metadata.js

@@ -0,0 +1,23 @@
+export const protectedResourceMetadataWellKnownPrefix = "/.well-known/oauth-protected-resource";
+export function protectedResourceMetadataPath(mcpPath) {
+    return `${protectedResourceMetadataWellKnownPrefix}${mcpPath}`;
+}
+export function protectedResourceMetadataUrl(resource, mcpPath) {
+    return new URL(protectedResourceMetadataPath(mcpPath), resource.origin);
+}
+export function protectedResourceMetadataHandler(options) {
+    return (_request, response) => {
+        response.set("Cache-Control", "public, max-age=300");
+        response.json({
+            resource: options.resource.toString(),
+            authorization_servers: options.authorizationServers.map((url) => url.toString()),
+            ...(options.scopesSupported !== undefined
+                ? { scopes_supported: options.scopesSupported }
+                : {}),
+            ...(options.resourceName !== undefined
+                ? { resource_name: options.resourceName }
+                : {}),
+            bearer_methods_supported: ["header"],
+        });
+    };
+}

package/dist/transport/streamable-http.d.ts

@@ -0,0 +1,25 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import type { Request, Response } from "express";
+export type SezzleeServerFactory = () => McpServer;
+export type SezzleeRequestHandler = (req: Request, res: Response) => Promise<void>;
+/**
+ * Serves the MCP endpoint over Streamable HTTP on both protocol eras.
+ *
+ * The 2026-07-28 revision has no sessions and no `Mcp-Session-Id`, so there is nothing to store
+ * between requests: `createMcpHandler` builds one server per exchange from the factory, and its
+ * `legacy: 'stateless'` default answers 2025-era traffic the same way. A catalogue change reaches
+ * clients through the handler's `subscriptions/listen` bus rather than an unsolicited broadcast,
+ * which is the only delivery the 2026 revision has.
+ */
+export declare class SezzleeStreamableHttp {
+    private readonly served;
+    /**
+     * Binds one endpoint to a server factory and returns its request handler.
+     *
+     * Guard: call this once per endpoint and keep the result — the handler owns the change-event bus
+     * every open `subscriptions/listen` stream is attached to, so building a fresh one per request
+     * would leave every subscriber listening to a bus nobody publishes on.
+     */
+    serve(createServer: SezzleeServerFactory): SezzleeRequestHandler;
+    notifyToolListChanged(): void;
+}

package/dist/transport/streamable-http.js

@@ -0,0 +1,52 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from "@nestjs/common";
+import { createMcpHandler } from "@modelcontextprotocol/server";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { connectionOf, runWithOuterConnection } from "../outer-connection.js";
+/**
+ * Serves the MCP endpoint over Streamable HTTP on both protocol eras.
+ *
+ * The 2026-07-28 revision has no sessions and no `Mcp-Session-Id`, so there is nothing to store
+ * between requests: `createMcpHandler` builds one server per exchange from the factory, and its
+ * `legacy: 'stateless'` default answers 2025-era traffic the same way. A catalogue change reaches
+ * clients through the handler's `subscriptions/listen` bus rather than an unsolicited broadcast,
+ * which is the only delivery the 2026 revision has.
+ */
+let SezzleeStreamableHttp = class SezzleeStreamableHttp {
+    served = [];
+    /**
+     * Binds one endpoint to a server factory and returns its request handler.
+     *
+     * Guard: call this once per endpoint and keep the result — the handler owns the change-event bus
+     * every open `subscriptions/listen` stream is attached to, so building a fresh one per request
+     * would leave every subscriber listening to a bus nobody publishes on.
+     */
+    serve(createServer) {
+        const handler = createMcpHandler(createServer);
+        const dispatchNode = toNodeHandler(handler);
+        const dispatch = async (req, res) => runWithOuterConnection(connectionOf(req), async () => {
+            await dispatchNode(req, res, req.body);
+        });
+        this.served.push({
+            dispatch,
+            notifyToolsChanged: () => {
+                handler.notify.toolsChanged();
+            },
+        });
+        return dispatch;
+    }
+    notifyToolListChanged() {
+        for (const endpoint of this.served) {
+            endpoint.notifyToolsChanged();
+        }
+    }
+};
+SezzleeStreamableHttp = __decorate([
+    Injectable()
+], SezzleeStreamableHttp);
+export { SezzleeStreamableHttp };