@happyvertical/smrt-core 0.30.0

package/dist/generators/cli.js

@@ -0,0 +1,462 @@
+import { ObjectRegistry } from "../registry.js";
+import { runWithTenantGate } from "./tenant-gate.js";
+const CRUD_OPERATIONS = ["list", "get", "create", "update", "delete"];
+const RESERVED_FLAGS = /* @__PURE__ */ new Set([
+  "tenant",
+  "all-tenants",
+  "from-file",
+  "limit",
+  "offset",
+  "order-by",
+  "orderBy",
+  "where",
+  "format",
+  "json",
+  "help",
+  "id"
+]);
+class CLIGenerator {
+  config;
+  context;
+  constructor(config = {}, context = {}) {
+    this.config = {
+      name: "smrt-cli",
+      version: "1.0.0",
+      description: "Auto-generated CLI from smrt objects",
+      ...config
+    };
+    this.context = context;
+  }
+  /** CLI program name. */
+  get name() {
+    return this.config.name;
+  }
+  /** CLI version. */
+  get version() {
+    return this.config.version;
+  }
+  /**
+   * Return the argv handler invoked by the generated `setupCLI()` wrapper.
+   *
+   * @returns An async function accepting the post-`node script` argv slice.
+   */
+  generateHandler() {
+    return async (args) => {
+      await this.run(args ?? []);
+    };
+  }
+  /**
+   * Parse and execute a single CLI invocation.
+   *
+   * @param args - argv slice (command + flags).
+   */
+  async run(args) {
+    if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
+      console.log(await this.helpText());
+      return;
+    }
+    const parsed = this.parseArgs(args);
+    if (!parsed) {
+      console.log(await this.helpText());
+      return;
+    }
+    const classInfo = this.resolveClass(parsed.objectName);
+    if (!classInfo) {
+      throw new Error(`Object type '${parsed.objectName}' not found`);
+    }
+    const objectName = classInfo.name || parsed.objectName;
+    await this.assertCommandExposed(objectName, parsed.action);
+    const tenantId = typeof parsed.flags.tenant === "string" ? parsed.flags.tenant : this.context.tenantId;
+    const allowCrossTenant = parsed.flags["all-tenants"] === true || this.context.allowCrossTenant === true;
+    const result = await runWithTenantGate(
+      { className: objectName, tenantId, allowCrossTenant, surface: "CLI" },
+      async () => {
+        const collection = await this.getCollection(objectName);
+        return this.executeAction(collection, objectName, parsed);
+      }
+    );
+    if (result !== void 0) {
+      console.log(JSON.stringify(this.toPublicData(result), null, 2));
+    }
+  }
+  /**
+   * Parse argv into a command + flags. Supports `name:action` and
+   * `name action` command forms, `--key value`, `--key=value`, and bare
+   * `--flag` booleans.
+   */
+  parseArgs(args) {
+    const [command, ...rest] = args;
+    if (!command || command.startsWith("-")) return null;
+    let objectName;
+    let action;
+    let tail = rest;
+    if (command.includes(":")) {
+      const [obj, act] = command.split(":");
+      objectName = obj.toLowerCase();
+      action = act;
+    } else if (rest.length > 0 && !rest[0].startsWith("-")) {
+      objectName = command.toLowerCase();
+      action = rest[0];
+      tail = rest.slice(1);
+    } else {
+      return null;
+    }
+    if (!objectName || !action) return null;
+    const flags = {};
+    let positional;
+    for (let i = 0; i < tail.length; i++) {
+      const token = tail[i];
+      if (token.startsWith("--")) {
+        const body = token.slice(2);
+        const eq = body.indexOf("=");
+        if (eq !== -1) {
+          flags[body.slice(0, eq)] = body.slice(eq + 1);
+        } else {
+          const next = tail[i + 1];
+          if (next !== void 0 && !next.startsWith("--")) {
+            flags[body] = next;
+            i++;
+          } else {
+            flags[body] = true;
+          }
+        }
+      } else if (positional === void 0) {
+        positional = token;
+      }
+    }
+    return { objectName, action, positional, flags };
+  }
+  /**
+   * Resolve a registered class by simple name (case-insensitive), mirroring the
+   * MCP generator's lookup.
+   */
+  resolveClass(objectName) {
+    const registeredClasses = ObjectRegistry.getAllClasses();
+    for (const [key, info] of registeredClasses) {
+      const simpleName = info.name || key;
+      if (simpleName.toLowerCase() === objectName.toLowerCase()) {
+        return info;
+      }
+    }
+    return null;
+  }
+  /**
+   * Throw if `action` is not exposed for `objectName` under its `@smrt({ cli })`
+   * config. `cli: false` disables the object entirely; an `include` list is the
+   * complete allowlist; custom methods must be `isPublic`.
+   */
+  async assertCommandExposed(objectName, action) {
+    const config = ObjectRegistry.getConfig(objectName);
+    const cliConfig = config?.cli;
+    if (cliConfig === false) {
+      throw new Error(`CLI is disabled for ${objectName}`);
+    }
+    const included = typeof cliConfig === "object" ? cliConfig?.include : void 0;
+    const excluded = typeof cliConfig === "object" && cliConfig?.exclude ? cliConfig.exclude : [];
+    if (excluded.includes(action)) {
+      throw new Error(`Command '${action}' is excluded for ${objectName}`);
+    }
+    const isCrud = CRUD_OPERATIONS.includes(action);
+    if (isCrud) {
+      if (included && !included.includes(action)) {
+        throw new Error(`Command '${action}' is not enabled for ${objectName}`);
+      }
+      return;
+    }
+    const methods = await ObjectRegistry.getAllMethods(objectName);
+    const methodDef = methods.get(action);
+    if (!methodDef) {
+      throw new Error(`Unknown command '${action}' for ${objectName}`);
+    }
+    if (!methodDef.isPublic) {
+      throw new Error(`Command '${action}' is not public on ${objectName}`);
+    }
+    if (included !== void 0 && !included.includes(action)) {
+      throw new Error(`Command '${action}' is not enabled for ${objectName}`);
+    }
+  }
+  /**
+   * Get the collection for an object via the registry factory. Uses
+   * `ObjectRegistry.getCollection`, which caches, initializes, and — for plain
+   * `@smrt()` models without a hand-written collection class — auto-creates the
+   * default collection. (A bare `collectionConstructor` check would wrongly
+   * throw for those models even though CRUD is advertised.)
+   */
+  async getCollection(objectName) {
+    return ObjectRegistry.getCollection(objectName, {
+      ai: this.context.ai,
+      db: this.context.db
+    });
+  }
+  /**
+   * Execute a parsed command against a collection.
+   */
+  async executeAction(collection, objectName, parsed) {
+    const { action, positional, flags } = parsed;
+    switch (action) {
+      case "list": {
+        const listOptions = {
+          limit: Math.min(this.toNumber(flags.limit, 50), 1e3),
+          offset: this.toNumber(flags.offset, 0)
+        };
+        const orderBy = flags["order-by"] ?? flags.orderBy;
+        if (typeof orderBy === "string") listOptions.orderBy = orderBy;
+        if (typeof flags.where === "string") {
+          listOptions.where = JSON.parse(flags.where);
+        }
+        return collection.list(listOptions);
+      }
+      case "get": {
+        const id = positional ?? this.flagString(flags.id);
+        if (!id) throw new Error("An id is required for get");
+        const item = await collection.get(id);
+        if (!item) throw new Error(`${objectName} not found`);
+        return item;
+      }
+      case "create": {
+        const data = this.applyWritablePolicy(
+          objectName,
+          await this.readPayload(flags)
+        );
+        if (this.context.user) {
+          data.created_by = this.context.user.id;
+          data.owner_id = this.context.user.id;
+        }
+        const created = await collection.create(data);
+        await created.save();
+        return created;
+      }
+      case "update": {
+        const id = positional ?? this.flagString(flags.id);
+        if (!id) throw new Error("An id is required for update");
+        const existing = await collection.get(id);
+        if (!existing) throw new Error(`${objectName} not found`);
+        const data = this.applyWritablePolicy(
+          objectName,
+          await this.readPayload(flags)
+        );
+        Object.assign(existing, data);
+        if (this.context.user) {
+          existing.updated_by = this.context.user.id;
+        }
+        await existing.save();
+        return existing;
+      }
+      case "delete": {
+        const id = positional ?? this.flagString(flags.id);
+        if (!id) throw new Error("An id is required for delete");
+        const existing = await collection.get(id);
+        if (!existing) throw new Error(`${objectName} not found`);
+        await existing.delete();
+        return { success: true, id, message: `${objectName} deleted` };
+      }
+      default:
+        return this.executeCustomAction(collection, action, positional, flags);
+    }
+  }
+  /**
+   * Execute a custom method on an instance (when an id is given) or on the
+   * collection (singleton actions). Mirrors the MCP custom-action path.
+   */
+  async executeCustomAction(collection, action, positional, flags) {
+    const options = this.customOptions(flags);
+    const id = positional ?? this.flagString(flags.id);
+    if (id) {
+      const object = await collection.get(id);
+      if (!object) throw new Error("Object not found");
+      if (typeof object[action] !== "function") {
+        throw new Error(`Method '${action}' not found on object instance`);
+      }
+      return object[action](options);
+    }
+    if (typeof collection[action] === "function") {
+      return collection[action](options);
+    }
+    throw new Error(
+      `Method '${action}' not found on collection. Provide an id for object-specific actions.`
+    );
+  }
+  /**
+   * Resolve the create/update payload: `--from-file <path>` (JSON) takes
+   * precedence; otherwise non-reserved `--field value` flags form the body.
+   * Reading from a file also keeps secrets off the process argv (#1556).
+   */
+  async readPayload(flags) {
+    const fromFile = flags["from-file"];
+    if (typeof fromFile === "string" && fromFile) {
+      const { readFile } = await import("node:fs/promises");
+      const content = await readFile(fromFile, "utf-8");
+      const parsed = JSON.parse(content);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("--from-file must contain a JSON object");
+      }
+      return parsed;
+    }
+    const data = {};
+    for (const [key, value] of Object.entries(flags)) {
+      if (RESERVED_FLAGS.has(key)) continue;
+      data[key] = this.coerceValue(value);
+    }
+    return data;
+  }
+  /** Collect non-reserved flags as custom-action options. */
+  customOptions(flags) {
+    const options = {};
+    for (const [key, value] of Object.entries(flags)) {
+      if (RESERVED_FLAGS.has(key)) continue;
+      options[key] = this.coerceValue(value);
+    }
+    return options;
+  }
+  /**
+   * Mass-assignment guard (#1540/#1556): strip framework/server-managed and
+   * `@field({ readonly })` fields, and — when an `@smrt({ api: { writable } })`
+   * allowlist is set — intersect with it. Identical policy to the REST/MCP
+   * generators so a CLI create/update cannot set fields the API forbids.
+   */
+  applyWritablePolicy(objectName, data) {
+    if (!data || typeof data !== "object") return {};
+    const serverManaged = /* @__PURE__ */ new Set([
+      "id",
+      "tenantId",
+      "tenant_id",
+      "createdAt",
+      "created_at",
+      "updatedAt",
+      "updated_at"
+    ]);
+    const readonly = /* @__PURE__ */ new Set();
+    let writable = null;
+    if (objectName) {
+      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
+      if (apiConfig && typeof apiConfig === "object" && Array.isArray(apiConfig.writable)) {
+        writable = apiConfig.writable;
+      }
+      for (const [name, def] of ObjectRegistry.getFields(objectName)) {
+        if (def && (def.readonly === true || def._meta?.readonly === true)) {
+          readonly.add(name);
+        }
+      }
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (key.startsWith("_")) continue;
+      if (serverManaged.has(key)) continue;
+      if (readonly.has(key)) continue;
+      if (writable && !writable.includes(key)) continue;
+      result[key] = value;
+    }
+    return result;
+  }
+  /**
+   * Serialize command output, excluding `@field({ sensitive })` fields (#1540).
+   * Recurses arrays/plain objects so a SmrtObject nested in a custom-action
+   * result is stripped too; a cycle guard prevents infinite loops.
+   */
+  toPublicData(value, seen = /* @__PURE__ */ new WeakSet()) {
+    if (value === null || typeof value !== "object") return value;
+    if (typeof value.toPublicJSON === "function") return value.toPublicJSON();
+    if (Array.isArray(value)) {
+      if (seen.has(value)) return value;
+      seen.add(value);
+      return value.map((entry) => this.toPublicData(entry, seen));
+    }
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) return value;
+    if (seen.has(value)) return value;
+    seen.add(value);
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = this.toPublicData(entry, seen);
+    }
+    return out;
+  }
+  /** List the runnable commands grouped by object, for help output. */
+  async listCommands() {
+    const commands = [];
+    for (const [key, classInfo] of ObjectRegistry.getAllClasses()) {
+      const objectName = classInfo.name || key;
+      const config = ObjectRegistry.getConfig(objectName);
+      const cliConfig = config?.cli;
+      if (cliConfig === false) continue;
+      const lower = objectName.toLowerCase();
+      const included = typeof cliConfig === "object" ? cliConfig?.include : void 0;
+      const excluded = typeof cliConfig === "object" && cliConfig?.exclude ? cliConfig.exclude : [];
+      const expose = (cmd) => !excluded.includes(cmd) && (!included || included.includes(cmd));
+      for (const verb of CRUD_OPERATIONS) {
+        if (expose(verb)) commands.push(`${lower}:${verb}`);
+      }
+      const methods = await ObjectRegistry.getAllMethods(objectName);
+      for (const [methodName, methodDef] of methods) {
+        if (CRUD_OPERATIONS.includes(methodName)) continue;
+        if (!methodDef.isPublic) continue;
+        if (excluded.includes(methodName)) continue;
+        if (included !== void 0 && !included.includes(methodName)) continue;
+        commands.push(`${lower}:${methodName}`);
+      }
+    }
+    return commands.sort();
+  }
+  async helpText() {
+    const commands = await this.listCommands();
+    return [
+      `${this.config.name} ${this.config.version}`,
+      this.config.description ?? "",
+      "",
+      "Usage: <object>:<action> [id] [--flags]",
+      "",
+      "Global flags:",
+      "  --tenant <id>     run the command inside a specific tenant",
+      "  --all-tenants     allow cross-tenant access (operator opt-in)",
+      "  --from-file <p>   read create/update payload from a JSON file",
+      "  --where <json>    filter for list",
+      "  --limit / --offset / --order-by",
+      "",
+      "Commands:",
+      ...commands.map((c) => `  ${c}`)
+    ].join("\n");
+  }
+  toNumber(value, fallback) {
+    if (typeof value !== "string") return fallback;
+    const n = Number.parseInt(value, 10);
+    return Number.isNaN(n) ? fallback : n;
+  }
+  flagString(value) {
+    return typeof value === "string" ? value : void 0;
+  }
+  /** Coerce a flag value to a JSON scalar/object where it parses cleanly. */
+  coerceValue(value) {
+    if (typeof value !== "string") return value;
+    if (value === "true") return true;
+    if (value === "false") return false;
+    if (value !== "" && !Number.isNaN(Number(value))) return Number(value);
+    if (value.startsWith("{") && value.endsWith("}") || value.startsWith("[") && value.endsWith("]")) {
+      try {
+        return JSON.parse(value);
+      } catch {
+        return value;
+      }
+    }
+    return value;
+  }
+}
+function setupCLI(config = {}, context = {}) {
+  const generator = new CLIGenerator(config, context);
+  return {
+    run: async (argv) => {
+      const handler = generator.generateHandler();
+      await handler(argv.slice(2));
+    },
+    generator
+  };
+}
+function getCLIHandler(config = {}, context = {}) {
+  const generator = new CLIGenerator(config, context);
+  return generator.generateHandler();
+}
+export {
+  CLIGenerator,
+  getCLIHandler,
+  setupCLI
+};
+//# sourceMappingURL=cli.js.map

package/dist/generators/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sources":["../../src/generators/cli.ts"],"sourcesContent":["/**\n * CLI command generator for smrt objects\n *\n * Exposes registered `@smrt()` objects as a runnable admin CLI: each object gets\n * `list`/`get`/`create`/`update`/`delete` commands plus its public custom\n * methods, dispatched as `objectname:action`.\n *\n * Security parity with the REST/MCP generators (#1540, #1547, #1554, #1556):\n * - **Mass-assignment guard** — create/update bodies are filtered through the\n *   `@smrt({ api: { writable: [...] } })` allowlist, dropping server-managed and\n *   `@field({ readonly })` fields ({@link CLIGenerator.applyWritablePolicy}).\n * - **Exhaustive include** — an `include` list is the COMPLETE allowlist for the\n *   surface; custom methods are gated on `isPublic`.\n * - **Sensitive redaction** — command *output* is serialized through\n *   {@link CLIGenerator.toPublicData} so `@field({ sensitive })` values never\n *   print (input bodies are guarded by the writable allowlist above).\n * - **Fail-closed tenant context** — tenant-scoped reads/writes run inside the\n *   tenancy gate; without `--tenant <id>` / `--all-tenants` (and with tenancy\n *   enabled) the command throws rather than ranging across all tenants.\n */\n\nimport type { SmrtCollection } from '../collection';\nimport { ObjectRegistry } from '../registry';\nimport { runWithTenantGate } from './tenant-gate.js';\n\n/**\n * Configuration for a generated CLI.\n */\nexport interface CLIConfig {\n  /** CLI program name (used in help output). */\n  name?: string;\n  /** CLI version. */\n  version?: string;\n  /** CLI description. */\n  description?: string;\n}\n\n/**\n * Per-invocation context for a generated CLI.\n */\nexport interface CLIContext {\n  /** Database handle passed to collections. */\n  db?: any;\n  /** AI provider passed to collections. */\n  ai?: any;\n  /** Authenticated operator, when the host establishes one. */\n  user?: {\n    id: string;\n    roles?: string[];\n  };\n  /**\n   * Default tenant for tenant-scoped commands when no `--tenant` flag is given.\n   * Hosts that authenticate an operator may set this from the principal.\n   */\n  tenantId?: string;\n  /**\n   * Default cross-tenant opt-in when no `--all-tenants` flag is given. Hosts\n   * may set this for trusted operator/admin shells.\n   */\n  allowCrossTenant?: boolean;\n}\n\n/** Standard CRUD verbs handled directly by the generator. */\nconst CRUD_OPERATIONS = ['list', 'get', 'create', 'update', 'delete'];\n\n/**\n * Flags consumed by the CLI itself — never treated as create/update field\n * values or as custom-action options.\n */\nconst RESERVED_FLAGS = new Set([\n  'tenant',\n  'all-tenants',\n  'from-file',\n  'limit',\n  'offset',\n  'order-by',\n  'orderBy',\n  'where',\n  'format',\n  'json',\n  'help',\n  'id',\n]);\n\n/** Parsed CLI invocation. */\ninterface ParsedInvocation {\n  /** Object/collection segment (lowercased), e.g. `product`. */\n  objectName: string;\n  /** Action segment, e.g. `list` or a custom method name. */\n  action: string;\n  /** First positional argument after the command (typically an id). */\n  positional?: string;\n  /** Parsed flags. String for `--k v`/`--k=v`, `true` for bare `--flag`. */\n  flags: Record<string, string | boolean>;\n}\n\n/**\n * Generate and run an admin CLI for the registered `@smrt()` objects.\n */\nexport class CLIGenerator {\n  private config: CLIConfig;\n  private context: CLIContext;\n\n  constructor(config: CLIConfig = {}, context: CLIContext = {}) {\n    this.config = {\n      name: 'smrt-cli',\n      version: '1.0.0',\n      description: 'Auto-generated CLI from smrt objects',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /** CLI program name. */\n  get name(): string | undefined {\n    return this.config.name;\n  }\n\n  /** CLI version. */\n  get version(): string | undefined {\n    return this.config.version;\n  }\n\n  /**\n   * Return the argv handler invoked by the generated `setupCLI()` wrapper.\n   *\n   * @returns An async function accepting the post-`node script` argv slice.\n   */\n  generateHandler(): (args: string[]) => Promise<void> {\n    return async (args: string[]) => {\n      await this.run(args ?? []);\n    };\n  }\n\n  /**\n   * Parse and execute a single CLI invocation.\n   *\n   * @param args - argv slice (command + flags).\n   */\n  async run(args: string[]): Promise<void> {\n    if (args.length === 0 || args[0] === '--help' || args[0] === 'help') {\n      console.log(await this.helpText());\n      return;\n    }\n\n    const parsed = this.parseArgs(args);\n    if (!parsed) {\n      console.log(await this.helpText());\n      return;\n    }\n\n    const classInfo = this.resolveClass(parsed.objectName);\n    if (!classInfo) {\n      throw new Error(`Object type '${parsed.objectName}' not found`);\n    }\n    const objectName: string = classInfo.name || parsed.objectName;\n\n    await this.assertCommandExposed(objectName, parsed.action);\n\n    const tenantId =\n      typeof parsed.flags.tenant === 'string'\n        ? parsed.flags.tenant\n        : this.context.tenantId;\n    const allowCrossTenant =\n      parsed.flags['all-tenants'] === true ||\n      this.context.allowCrossTenant === true;\n\n    // Tenant-scoping is resolved authoritatively inside tenancy (by class name),\n    // matching the interceptor and covering both @TenantScoped and\n    // @smrt({ tenantScoped }) registrations (#1554).\n    const result = await runWithTenantGate(\n      { className: objectName, tenantId, allowCrossTenant, surface: 'CLI' },\n      async () => {\n        const collection = await this.getCollection(objectName);\n        return this.executeAction(collection, objectName, parsed);\n      },\n    );\n\n    if (result !== undefined) {\n      console.log(JSON.stringify(this.toPublicData(result), null, 2));\n    }\n  }\n\n  /**\n   * Parse argv into a command + flags. Supports `name:action` and\n   * `name action` command forms, `--key value`, `--key=value`, and bare\n   * `--flag` booleans.\n   */\n  private parseArgs(args: string[]): ParsedInvocation | null {\n    const [command, ...rest] = args;\n    if (!command || command.startsWith('-')) return null;\n\n    let objectName: string;\n    let action: string;\n    let tail = rest;\n\n    if (command.includes(':')) {\n      const [obj, act] = command.split(':');\n      objectName = obj.toLowerCase();\n      action = act;\n    } else if (rest.length > 0 && !rest[0].startsWith('-')) {\n      objectName = command.toLowerCase();\n      action = rest[0];\n      tail = rest.slice(1);\n    } else {\n      // A bare object name with no action is not a runnable command.\n      return null;\n    }\n\n    if (!objectName || !action) return null;\n\n    const flags: Record<string, string | boolean> = {};\n    let positional: string | undefined;\n\n    for (let i = 0; i < tail.length; i++) {\n      const token = tail[i];\n      if (token.startsWith('--')) {\n        const body = token.slice(2);\n        const eq = body.indexOf('=');\n        if (eq !== -1) {\n          flags[body.slice(0, eq)] = body.slice(eq + 1);\n        } else {\n          const next = tail[i + 1];\n          if (next !== undefined && !next.startsWith('--')) {\n            flags[body] = next;\n            i++;\n          } else {\n            flags[body] = true;\n          }\n        }\n      } else if (positional === undefined) {\n        positional = token;\n      }\n    }\n\n    return { objectName, action, positional, flags };\n  }\n\n  /**\n   * Resolve a registered class by simple name (case-insensitive), mirroring the\n   * MCP generator's lookup.\n   */\n  private resolveClass(objectName: string): any {\n    const registeredClasses = ObjectRegistry.getAllClasses();\n    for (const [key, info] of registeredClasses) {\n      const simpleName = info.name || key;\n      if (simpleName.toLowerCase() === objectName.toLowerCase()) {\n        return info;\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Throw if `action` is not exposed for `objectName` under its `@smrt({ cli })`\n   * config. `cli: false` disables the object entirely; an `include` list is the\n   * complete allowlist; custom methods must be `isPublic`.\n   */\n  private async assertCommandExposed(\n    objectName: string,\n    action: string,\n  ): Promise<void> {\n    const config = ObjectRegistry.getConfig(objectName);\n    const cliConfig = config?.cli;\n\n    if (cliConfig === false) {\n      throw new Error(`CLI is disabled for ${objectName}`);\n    }\n\n    const included: string[] | undefined =\n      typeof cliConfig === 'object' ? cliConfig?.include : undefined;\n    const excluded: string[] =\n      typeof cliConfig === 'object' && cliConfig?.exclude\n        ? cliConfig.exclude\n        : [];\n\n    if (excluded.includes(action)) {\n      throw new Error(`Command '${action}' is excluded for ${objectName}`);\n    }\n\n    const isCrud = CRUD_OPERATIONS.includes(action);\n\n    if (isCrud) {\n      // An include list, when present, is the complete allowlist for CRUD too.\n      if (included && !included.includes(action)) {\n        throw new Error(`Command '${action}' is not enabled for ${objectName}`);\n      }\n      return;\n    }\n\n    // Custom method: must be public, and — when an include list is present — it\n    // is the COMPLETE allowlist (parity with MCP exhaustive-include, #1547).\n    const methods = await ObjectRegistry.getAllMethods(objectName);\n    const methodDef = methods.get(action);\n    if (!methodDef) {\n      throw new Error(`Unknown command '${action}' for ${objectName}`);\n    }\n    if (!methodDef.isPublic) {\n      throw new Error(`Command '${action}' is not public on ${objectName}`);\n    }\n    if (included !== undefined && !included.includes(action)) {\n      throw new Error(`Command '${action}' is not enabled for ${objectName}`);\n    }\n  }\n\n  /**\n   * Get the collection for an object via the registry factory. Uses\n   * `ObjectRegistry.getCollection`, which caches, initializes, and — for plain\n   * `@smrt()` models without a hand-written collection class — auto-creates the\n   * default collection. (A bare `collectionConstructor` check would wrongly\n   * throw for those models even though CRUD is advertised.)\n   */\n  private async getCollection(\n    objectName: string,\n  ): Promise<SmrtCollection<any>> {\n    return ObjectRegistry.getCollection(objectName, {\n      ai: this.context.ai,\n      db: this.context.db,\n    });\n  }\n\n  /**\n   * Execute a parsed command against a collection.\n   */\n  private async executeAction(\n    collection: SmrtCollection<any>,\n    objectName: string,\n    parsed: ParsedInvocation,\n  ): Promise<any> {\n    const { action, positional, flags } = parsed;\n\n    switch (action) {\n      case 'list': {\n        const listOptions: any = {\n          limit: Math.min(this.toNumber(flags.limit, 50), 1000),\n          offset: this.toNumber(flags.offset, 0),\n        };\n        const orderBy = flags['order-by'] ?? flags.orderBy;\n        if (typeof orderBy === 'string') listOptions.orderBy = orderBy;\n        if (typeof flags.where === 'string') {\n          listOptions.where = JSON.parse(flags.where);\n        }\n        return collection.list(listOptions);\n      }\n\n      case 'get': {\n        const id = positional ?? this.flagString(flags.id);\n        if (!id) throw new Error('An id is required for get');\n        const item = await collection.get(id);\n        if (!item) throw new Error(`${objectName} not found`);\n        return item;\n      }\n\n      case 'create': {\n        const data = this.applyWritablePolicy(\n          objectName,\n          await this.readPayload(flags),\n        );\n        if (this.context.user) {\n          (data as any).created_by = this.context.user.id;\n          (data as any).owner_id = this.context.user.id;\n        }\n        const created = await collection.create(data);\n        await created.save();\n        return created;\n      }\n\n      case 'update': {\n        const id = positional ?? this.flagString(flags.id);\n        if (!id) throw new Error('An id is required for update');\n        const existing = await collection.get(id);\n        if (!existing) throw new Error(`${objectName} not found`);\n        const data = this.applyWritablePolicy(\n          objectName,\n          await this.readPayload(flags),\n        );\n        Object.assign(existing, data);\n        if (this.context.user) {\n          (existing as any).updated_by = this.context.user.id;\n        }\n        await existing.save();\n        return existing;\n      }\n\n      case 'delete': {\n        const id = positional ?? this.flagString(flags.id);\n        if (!id) throw new Error('An id is required for delete');\n        const existing = await collection.get(id);\n        if (!existing) throw new Error(`${objectName} not found`);\n        await existing.delete();\n        return { success: true, id, message: `${objectName} deleted` };\n      }\n\n      default:\n        return this.executeCustomAction(collection, action, positional, flags);\n    }\n  }\n\n  /**\n   * Execute a custom method on an instance (when an id is given) or on the\n   * collection (singleton actions). Mirrors the MCP custom-action path.\n   */\n  private async executeCustomAction(\n    collection: SmrtCollection<any>,\n    action: string,\n    positional: string | undefined,\n    flags: Record<string, string | boolean>,\n  ): Promise<any> {\n    const options = this.customOptions(flags);\n    const id = positional ?? this.flagString(flags.id);\n\n    if (id) {\n      const object = (await collection.get(id)) as any;\n      if (!object) throw new Error('Object not found');\n      if (typeof object[action] !== 'function') {\n        throw new Error(`Method '${action}' not found on object instance`);\n      }\n      return object[action](options);\n    }\n\n    if (typeof (collection as any)[action] === 'function') {\n      return (collection as any)[action](options);\n    }\n    throw new Error(\n      `Method '${action}' not found on collection. Provide an id for object-specific actions.`,\n    );\n  }\n\n  /**\n   * Resolve the create/update payload: `--from-file <path>` (JSON) takes\n   * precedence; otherwise non-reserved `--field value` flags form the body.\n   * Reading from a file also keeps secrets off the process argv (#1556).\n   */\n  private async readPayload(\n    flags: Record<string, string | boolean>,\n  ): Promise<Record<string, any>> {\n    const fromFile = flags['from-file'];\n    if (typeof fromFile === 'string' && fromFile) {\n      const { readFile } = await import('node:fs/promises');\n      const content = await readFile(fromFile, 'utf-8');\n      const parsed = JSON.parse(content);\n      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw new Error('--from-file must contain a JSON object');\n      }\n      return parsed as Record<string, any>;\n    }\n\n    const data: Record<string, any> = {};\n    for (const [key, value] of Object.entries(flags)) {\n      if (RESERVED_FLAGS.has(key)) continue;\n      data[key] = this.coerceValue(value);\n    }\n    return data;\n  }\n\n  /** Collect non-reserved flags as custom-action options. */\n  private customOptions(\n    flags: Record<string, string | boolean>,\n  ): Record<string, any> {\n    const options: Record<string, any> = {};\n    for (const [key, value] of Object.entries(flags)) {\n      if (RESERVED_FLAGS.has(key)) continue;\n      options[key] = this.coerceValue(value);\n    }\n    return options;\n  }\n\n  /**\n   * Mass-assignment guard (#1540/#1556): strip framework/server-managed and\n   * `@field({ readonly })` fields, and — when an `@smrt({ api: { writable } })`\n   * allowlist is set — intersect with it. Identical policy to the REST/MCP\n   * generators so a CLI create/update cannot set fields the API forbids.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: any,\n  ): Record<string, any> {\n    if (!data || typeof data !== 'object') return {};\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, any> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize command output, excluding `@field({ sensitive })` fields (#1540).\n   * Recurses arrays/plain objects so a SmrtObject nested in a custom-action\n   * result is stripped too; a cycle guard prevents infinite loops.\n   */\n  private toPublicData(value: any, seen: WeakSet<object> = new WeakSet()): any {\n    if (value === null || typeof value !== 'object') return value;\n    if (typeof value.toPublicJSON === 'function') return value.toPublicJSON();\n    if (Array.isArray(value)) {\n      if (seen.has(value)) return value;\n      seen.add(value);\n      return value.map((entry) => this.toPublicData(entry, seen));\n    }\n    const proto = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null) return value;\n    if (seen.has(value)) return value;\n    seen.add(value);\n    const out: Record<string, any> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      out[key] = this.toPublicData(entry, seen);\n    }\n    return out;\n  }\n\n  /** List the runnable commands grouped by object, for help output. */\n  async listCommands(): Promise<string[]> {\n    const commands: string[] = [];\n    for (const [key, classInfo] of ObjectRegistry.getAllClasses()) {\n      const objectName = classInfo.name || key;\n      const config = ObjectRegistry.getConfig(objectName);\n      const cliConfig = config?.cli;\n      if (cliConfig === false) continue;\n\n      const lower = objectName.toLowerCase();\n      const included: string[] | undefined =\n        typeof cliConfig === 'object' ? cliConfig?.include : undefined;\n      const excluded: string[] =\n        typeof cliConfig === 'object' && cliConfig?.exclude\n          ? cliConfig.exclude\n          : [];\n\n      const expose = (cmd: string) =>\n        !excluded.includes(cmd) && (!included || included.includes(cmd));\n\n      for (const verb of CRUD_OPERATIONS) {\n        if (expose(verb)) commands.push(`${lower}:${verb}`);\n      }\n\n      const methods = await ObjectRegistry.getAllMethods(objectName);\n      for (const [methodName, methodDef] of methods) {\n        if (CRUD_OPERATIONS.includes(methodName)) continue;\n        if (!methodDef.isPublic) continue;\n        if (excluded.includes(methodName)) continue;\n        if (included !== undefined && !included.includes(methodName)) continue;\n        commands.push(`${lower}:${methodName}`);\n      }\n    }\n    return commands.sort();\n  }\n\n  private async helpText(): Promise<string> {\n    const commands = await this.listCommands();\n    return [\n      `${this.config.name} ${this.config.version}`,\n      this.config.description ?? '',\n      '',\n      'Usage: <object>:<action> [id] [--flags]',\n      '',\n      'Global flags:',\n      '  --tenant <id>     run the command inside a specific tenant',\n      '  --all-tenants     allow cross-tenant access (operator opt-in)',\n      '  --from-file <p>   read create/update payload from a JSON file',\n      '  --where <json>    filter for list',\n      '  --limit / --offset / --order-by',\n      '',\n      'Commands:',\n      ...commands.map((c) => `  ${c}`),\n    ].join('\\n');\n  }\n\n  private toNumber(\n    value: string | boolean | undefined,\n    fallback: number,\n  ): number {\n    if (typeof value !== 'string') return fallback;\n    const n = Number.parseInt(value, 10);\n    return Number.isNaN(n) ? fallback : n;\n  }\n\n  private flagString(value: string | boolean | undefined): string | undefined {\n    return typeof value === 'string' ? value : undefined;\n  }\n\n  /** Coerce a flag value to a JSON scalar/object where it parses cleanly. */\n  private coerceValue(value: string | boolean): any {\n    if (typeof value !== 'string') return value;\n    if (value === 'true') return true;\n    if (value === 'false') return false;\n    if (value !== '' && !Number.isNaN(Number(value))) return Number(value);\n    if (\n      (value.startsWith('{') && value.endsWith('}')) ||\n      (value.startsWith('[') && value.endsWith(']'))\n    ) {\n      try {\n        return JSON.parse(value);\n      } catch {\n        return value;\n      }\n    }\n    return value;\n  }\n}\n\n/**\n * Convenience runner used by the generated `setupCLI()` wrapper.\n *\n * @param config - CLI configuration.\n * @param context - Per-invocation context.\n * @returns A `{ run, generator }` pair; `run(argv)` strips the leading\n *   `node script` entries before dispatching.\n */\nexport function setupCLI(config: CLIConfig = {}, context: CLIContext = {}) {\n  const generator = new CLIGenerator(config, context);\n  return {\n    run: async (argv: string[]) => {\n      const handler = generator.generateHandler();\n      await handler(argv.slice(2));\n    },\n    generator,\n  };\n}\n\n/**\n * Get a bare argv handler for a generated CLI.\n *\n * @param config - CLI configuration.\n * @param context - Per-invocation context.\n * @returns An async argv-slice handler.\n */\nexport function getCLIHandler(\n  config: CLIConfig = {},\n  context: CLIContext = {},\n) {\n  const generator = new CLIGenerator(config, context);\n  return generator.generateHandler();\n}\n"],"names":[],"mappings":";;AA+DA,MAAM,kBAAkB,CAAC,QAAQ,OAAO,UAAU,UAAU,QAAQ;AAMpE,MAAM,qCAAqB,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAiBM,MAAM,aAAa;AAAA,EAChB;AAAA,EACA;AAAA,EAER,YAAY,SAAoB,IAAI,UAAsB,CAAA,GAAI;AAC5D,SAAK,SAAS;AAAA,MACZ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,GAAG;AAAA,IAAA;AAEL,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,OAA2B;AAC7B,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAGA,IAAI,UAA8B;AAChC,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAqD;AACnD,WAAO,OAAO,SAAmB;AAC/B,YAAM,KAAK,IAAI,QAAQ,EAAE;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAI,MAA+B;AACvC,QAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,QAAQ;AACnE,cAAQ,IAAI,MAAM,KAAK,SAAA,CAAU;AACjC;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,UAAU,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI,MAAM,KAAK,SAAA,CAAU;AACjC;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,aAAa,OAAO,UAAU;AACrD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,gBAAgB,OAAO,UAAU,aAAa;AAAA,IAChE;AACA,UAAM,aAAqB,UAAU,QAAQ,OAAO;AAEpD,UAAM,KAAK,qBAAqB,YAAY,OAAO,MAAM;AAEzD,UAAM,WACJ,OAAO,OAAO,MAAM,WAAW,WAC3B,OAAO,MAAM,SACb,KAAK,QAAQ;AACnB,UAAM,mBACJ,OAAO,MAAM,aAAa,MAAM,QAChC,KAAK,QAAQ,qBAAqB;AAKpC,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,WAAW,YAAY,UAAU,kBAAkB,SAAS,MAAA;AAAA,MAC9D,YAAY;AACV,cAAM,aAAa,MAAM,KAAK,cAAc,UAAU;AACtD,eAAO,KAAK,cAAc,YAAY,YAAY,MAAM;AAAA,MAC1D;AAAA,IAAA;AAGF,QAAI,WAAW,QAAW;AACxB,cAAQ,IAAI,KAAK,UAAU,KAAK,aAAa,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA,IAChE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAU,MAAyC;AACzD,UAAM,CAAC,SAAS,GAAG,IAAI,IAAI;AAC3B,QAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG,QAAO;AAEhD,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO;AAEX,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,YAAM,CAAC,KAAK,GAAG,IAAI,QAAQ,MAAM,GAAG;AACpC,mBAAa,IAAI,YAAA;AACjB,eAAS;AAAA,IACX,WAAW,KAAK,SAAS,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,GAAG;AACtD,mBAAa,QAAQ,YAAA;AACrB,eAAS,KAAK,CAAC;AACf,aAAO,KAAK,MAAM,CAAC;AAAA,IACrB,OAAO;AAEL,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,cAAc,CAAC,OAAQ,QAAO;AAEnC,UAAM,QAA0C,CAAA;AAChD,QAAI;AAEJ,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,QAAQ,KAAK,CAAC;AACpB,UAAI,MAAM,WAAW,IAAI,GAAG;AAC1B,cAAM,OAAO,MAAM,MAAM,CAAC;AAC1B,cAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,YAAI,OAAO,IAAI;AACb,gBAAM,KAAK,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC;AAAA,QAC9C,OAAO;AACL,gBAAM,OAAO,KAAK,IAAI,CAAC;AACvB,cAAI,SAAS,UAAa,CAAC,KAAK,WAAW,IAAI,GAAG;AAChD,kBAAM,IAAI,IAAI;AACd;AAAA,UACF,OAAO;AACL,kBAAM,IAAI,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF,WAAW,eAAe,QAAW;AACnC,qBAAa;AAAA,MACf;AAAA,IACF;AAEA,WAAO,EAAE,YAAY,QAAQ,YAAY,MAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,YAAyB;AAC5C,UAAM,oBAAoB,eAAe,cAAA;AACzC,eAAW,CAAC,KAAK,IAAI,KAAK,mBAAmB;AAC3C,YAAM,aAAa,KAAK,QAAQ;AAChC,UAAI,WAAW,YAAA,MAAkB,WAAW,eAAe;AACzD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,qBACZ,YACA,QACe;AACf,UAAM,SAAS,eAAe,UAAU,UAAU;AAClD,UAAM,YAAY,QAAQ;AAE1B,QAAI,cAAc,OAAO;AACvB,YAAM,IAAI,MAAM,uBAAuB,UAAU,EAAE;AAAA,IACrD;AAEA,UAAM,WACJ,OAAO,cAAc,WAAW,WAAW,UAAU;AACvD,UAAM,WACJ,OAAO,cAAc,YAAY,WAAW,UACxC,UAAU,UACV,CAAA;AAEN,QAAI,SAAS,SAAS,MAAM,GAAG;AAC7B,YAAM,IAAI,MAAM,YAAY,MAAM,qBAAqB,UAAU,EAAE;AAAA,IACrE;AAEA,UAAM,SAAS,gBAAgB,SAAS,MAAM;AAE9C,QAAI,QAAQ;AAEV,UAAI,YAAY,CAAC,SAAS,SAAS,MAAM,GAAG;AAC1C,cAAM,IAAI,MAAM,YAAY,MAAM,wBAAwB,UAAU,EAAE;AAAA,MACxE;AACA;AAAA,IACF;AAIA,UAAM,UAAU,MAAM,eAAe,cAAc,UAAU;AAC7D,UAAM,YAAY,QAAQ,IAAI,MAAM;AACpC,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,oBAAoB,MAAM,SAAS,UAAU,EAAE;AAAA,IACjE;AACA,QAAI,CAAC,UAAU,UAAU;AACvB,YAAM,IAAI,MAAM,YAAY,MAAM,sBAAsB,UAAU,EAAE;AAAA,IACtE;AACA,QAAI,aAAa,UAAa,CAAC,SAAS,SAAS,MAAM,GAAG;AACxD,YAAM,IAAI,MAAM,YAAY,MAAM,wBAAwB,UAAU,EAAE;AAAA,IACxE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cACZ,YAC8B;AAC9B,WAAO,eAAe,cAAc,YAAY;AAAA,MAC9C,IAAI,KAAK,QAAQ;AAAA,MACjB,IAAI,KAAK,QAAQ;AAAA,IAAA,CAClB;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cACZ,YACA,YACA,QACc;AACd,UAAM,EAAE,QAAQ,YAAY,MAAA,IAAU;AAEtC,YAAQ,QAAA;AAAA,MACN,KAAK,QAAQ;AACX,cAAM,cAAmB;AAAA,UACvB,OAAO,KAAK,IAAI,KAAK,SAAS,MAAM,OAAO,EAAE,GAAG,GAAI;AAAA,UACpD,QAAQ,KAAK,SAAS,MAAM,QAAQ,CAAC;AAAA,QAAA;AAEvC,cAAM,UAAU,MAAM,UAAU,KAAK,MAAM;AAC3C,YAAI,OAAO,YAAY,SAAU,aAAY,UAAU;AACvD,YAAI,OAAO,MAAM,UAAU,UAAU;AACnC,sBAAY,QAAQ,KAAK,MAAM,MAAM,KAAK;AAAA,QAC5C;AACA,eAAO,WAAW,KAAK,WAAW;AAAA,MACpC;AAAA,MAEA,KAAK,OAAO;AACV,cAAM,KAAK,cAAc,KAAK,WAAW,MAAM,EAAE;AACjD,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,2BAA2B;AACpD,cAAM,OAAO,MAAM,WAAW,IAAI,EAAE;AACpC,YAAI,CAAC,KAAM,OAAM,IAAI,MAAM,GAAG,UAAU,YAAY;AACpD,eAAO;AAAA,MACT;AAAA,MAEA,KAAK,UAAU;AACb,cAAM,OAAO,KAAK;AAAA,UAChB;AAAA,UACA,MAAM,KAAK,YAAY,KAAK;AAAA,QAAA;AAE9B,YAAI,KAAK,QAAQ,MAAM;AACpB,eAAa,aAAa,KAAK,QAAQ,KAAK;AAC5C,eAAa,WAAW,KAAK,QAAQ,KAAK;AAAA,QAC7C;AACA,cAAM,UAAU,MAAM,WAAW,OAAO,IAAI;AAC5C,cAAM,QAAQ,KAAA;AACd,eAAO;AAAA,MACT;AAAA,MAEA,KAAK,UAAU;AACb,cAAM,KAAK,cAAc,KAAK,WAAW,MAAM,EAAE;AACjD,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,8BAA8B;AACvD,cAAM,WAAW,MAAM,WAAW,IAAI,EAAE;AACxC,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,GAAG,UAAU,YAAY;AACxD,cAAM,OAAO,KAAK;AAAA,UAChB;AAAA,UACA,MAAM,KAAK,YAAY,KAAK;AAAA,QAAA;AAE9B,eAAO,OAAO,UAAU,IAAI;AAC5B,YAAI,KAAK,QAAQ,MAAM;AACpB,mBAAiB,aAAa,KAAK,QAAQ,KAAK;AAAA,QACnD;AACA,cAAM,SAAS,KAAA;AACf,eAAO;AAAA,MACT;AAAA,MAEA,KAAK,UAAU;AACb,cAAM,KAAK,cAAc,KAAK,WAAW,MAAM,EAAE;AACjD,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,8BAA8B;AACvD,cAAM,WAAW,MAAM,WAAW,IAAI,EAAE;AACxC,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,GAAG,UAAU,YAAY;AACxD,cAAM,SAAS,OAAA;AACf,eAAO,EAAE,SAAS,MAAM,IAAI,SAAS,GAAG,UAAU,WAAA;AAAA,MACpD;AAAA,MAEA;AACE,eAAO,KAAK,oBAAoB,YAAY,QAAQ,YAAY,KAAK;AAAA,IAAA;AAAA,EAE3E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBACZ,YACA,QACA,YACA,OACc;AACd,UAAM,UAAU,KAAK,cAAc,KAAK;AACxC,UAAM,KAAK,cAAc,KAAK,WAAW,MAAM,EAAE;AAEjD,QAAI,IAAI;AACN,YAAM,SAAU,MAAM,WAAW,IAAI,EAAE;AACvC,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,kBAAkB;AAC/C,UAAI,OAAO,OAAO,MAAM,MAAM,YAAY;AACxC,cAAM,IAAI,MAAM,WAAW,MAAM,gCAAgC;AAAA,MACnE;AACA,aAAO,OAAO,MAAM,EAAE,OAAO;AAAA,IAC/B;AAEA,QAAI,OAAQ,WAAmB,MAAM,MAAM,YAAY;AACrD,aAAQ,WAAmB,MAAM,EAAE,OAAO;AAAA,IAC5C;AACA,UAAM,IAAI;AAAA,MACR,WAAW,MAAM;AAAA,IAAA;AAAA,EAErB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,YACZ,OAC8B;AAC9B,UAAM,WAAW,MAAM,WAAW;AAClC,QAAI,OAAO,aAAa,YAAY,UAAU;AAC5C,YAAM,EAAE,SAAA,IAAa,MAAM,OAAO,kBAAkB;AACpD,YAAM,UAAU,MAAM,SAAS,UAAU,OAAO;AAChD,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAA4B,CAAA;AAClC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAI,eAAe,IAAI,GAAG,EAAG;AAC7B,WAAK,GAAG,IAAI,KAAK,YAAY,KAAK;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,cACN,OACqB;AACrB,UAAM,UAA+B,CAAA;AACrC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAI,eAAe,IAAI,GAAG,EAAG;AAC7B,cAAQ,GAAG,IAAI,KAAK,YAAY,KAAK;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,oBACN,YACA,MACqB;AACrB,QAAI,CAAC,QAAQ,OAAO,SAAS,iBAAiB,CAAA;AAE9C,UAAM,oCAAoB,IAAI;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AAED,UAAM,+BAAe,IAAA;AACrB,QAAI,WAA4B;AAEhC,QAAI,YAAY;AACd,YAAM,YAAY,eAAe,UAAU,UAAU,GAAG;AACxD,UACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAC5D;AACA,mBAAY,UAAqC;AAAA,MACnD;AAEA,iBAAW,CAAC,MAAM,GAAG,KAAK,eAAe,UAAU,UAAU,GAAG;AAC9D,YAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAAO;AAClE,mBAAS,IAAI,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA8B,CAAA;AACpC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,UAAI,IAAI,WAAW,GAAG,EAAG;AACzB,UAAI,cAAc,IAAI,GAAG,EAAG;AAC5B,UAAI,SAAS,IAAI,GAAG,EAAG;AACvB,UAAI,YAAY,CAAC,SAAS,SAAS,GAAG,EAAG;AACzC,aAAO,GAAG,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,aAAa,OAAY,OAAwB,oBAAI,WAAgB;AAC3E,QAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAI,OAAO,MAAM,iBAAiB,WAAY,QAAO,MAAM,aAAA;AAC3D,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,WAAK,IAAI,KAAK;AACd,aAAO,MAAM,IAAI,CAAC,UAAU,KAAK,aAAa,OAAO,IAAI,CAAC;AAAA,IAC5D;AACA,UAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,QAAI,UAAU,OAAO,aAAa,UAAU,KAAM,QAAO;AACzD,QAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,SAAK,IAAI,KAAK;AACd,UAAM,MAA2B,CAAA;AACjC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAI,GAAG,IAAI,KAAK,aAAa,OAAO,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,eAAkC;AACtC,UAAM,WAAqB,CAAA;AAC3B,eAAW,CAAC,KAAK,SAAS,KAAK,eAAe,iBAAiB;AAC7D,YAAM,aAAa,UAAU,QAAQ;AACrC,YAAM,SAAS,eAAe,UAAU,UAAU;AAClD,YAAM,YAAY,QAAQ;AAC1B,UAAI,cAAc,MAAO;AAEzB,YAAM,QAAQ,WAAW,YAAA;AACzB,YAAM,WACJ,OAAO,cAAc,WAAW,WAAW,UAAU;AACvD,YAAM,WACJ,OAAO,cAAc,YAAY,WAAW,UACxC,UAAU,UACV,CAAA;AAEN,YAAM,SAAS,CAAC,QACd,CAAC,SAAS,SAAS,GAAG,MAAM,CAAC,YAAY,SAAS,SAAS,GAAG;AAEhE,iBAAW,QAAQ,iBAAiB;AAClC,YAAI,OAAO,IAAI,EAAG,UAAS,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE;AAAA,MACpD;AAEA,YAAM,UAAU,MAAM,eAAe,cAAc,UAAU;AAC7D,iBAAW,CAAC,YAAY,SAAS,KAAK,SAAS;AAC7C,YAAI,gBAAgB,SAAS,UAAU,EAAG;AAC1C,YAAI,CAAC,UAAU,SAAU;AACzB,YAAI,SAAS,SAAS,UAAU,EAAG;AACnC,YAAI,aAAa,UAAa,CAAC,SAAS,SAAS,UAAU,EAAG;AAC9D,iBAAS,KAAK,GAAG,KAAK,IAAI,UAAU,EAAE;AAAA,MACxC;AAAA,IACF;AACA,WAAO,SAAS,KAAA;AAAA,EAClB;AAAA,EAEA,MAAc,WAA4B;AACxC,UAAM,WAAW,MAAM,KAAK,aAAA;AAC5B,WAAO;AAAA,MACL,GAAG,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,OAAO;AAAA,MAC1C,KAAK,OAAO,eAAe;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;AAAA,IAAA,EAC/B,KAAK,IAAI;AAAA,EACb;AAAA,EAEQ,SACN,OACA,UACQ;AACR,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,IAAI,OAAO,SAAS,OAAO,EAAE;AACnC,WAAO,OAAO,MAAM,CAAC,IAAI,WAAW;AAAA,EACtC;AAAA,EAEQ,WAAW,OAAyD;AAC1E,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C;AAAA;AAAA,EAGQ,YAAY,OAA8B;AAChD,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI,UAAU,OAAQ,QAAO;AAC7B,QAAI,UAAU,QAAS,QAAO;AAC9B,QAAI,UAAU,MAAM,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,EAAG,QAAO,OAAO,KAAK;AACrE,QACG,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAC5C;AACA,UAAI;AACF,eAAO,KAAK,MAAM,KAAK;AAAA,MACzB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAUO,SAAS,SAAS,SAAoB,IAAI,UAAsB,CAAA,GAAI;AACzE,QAAM,YAAY,IAAI,aAAa,QAAQ,OAAO;AAClD,SAAO;AAAA,IACL,KAAK,OAAO,SAAmB;AAC7B,YAAM,UAAU,UAAU,gBAAA;AAC1B,YAAM,QAAQ,KAAK,MAAM,CAAC,CAAC;AAAA,IAC7B;AAAA,IACA;AAAA,EAAA;AAEJ;AASO,SAAS,cACd,SAAoB,IACpB,UAAsB,CAAA,GACtB;AACA,QAAM,YAAY,IAAI,aAAa,QAAQ,OAAO;AAClD,SAAO,UAAU,gBAAA;AACnB;"}

package/dist/generators/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @smrt/core generators - Create REST APIs and MCP servers from SMRT objects
+ */
+export type { CLIConfig, CLIContext } from './cli';
+export { CLIGenerator, getCLIHandler, setupCLI } from './cli';
+export type { MCPConfig, MCPContext, MCPRequest, MCPResponse, MCPTool, } from './mcp';
+export { MCPGenerator } from './mcp';
+export type { APIConfig, APIContext, RestServerConfig } from './rest';
+export { APIGenerator, createRestServer, startRestServer } from './rest';
+export type { OpenAPIConfig } from './swagger';
+export { generateOpenAPISpec, setupSwaggerUI, } from './swagger';
+export { runWithTenantGate, setTenantEntryPointRunner, type TenantEntryPointRunner, type TenantGateOptions, } from './tenant-gate';
+//# sourceMappingURL=index.d.ts.map

package/dist/generators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generators/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9D,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,OAAO,GACR,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC"}

package/dist/generators/mcp-runtime-template.d.ts

@@ -0,0 +1,60 @@
+import { MCPConfig, MCPContext } from './mcp.js';
+export interface RuntimeOptions {
+    /** Server name (defaults to package name) */
+    name?: string;
+    /** Server version (defaults to package version) */
+    version?: string;
+    /** Server description */
+    description?: string;
+    /** MCP generator configuration */
+    config?: MCPConfig;
+    /** MCP context (database, AI client, etc.) */
+    context?: MCPContext;
+    /** Enable debug logging */
+    debug?: boolean;
+    /** Static tool definitions (generated at build time) */
+    tools?: Array<{
+        name: string;
+        description: string;
+        inputSchema: any;
+    }>;
+    /**
+     * Lowercased simple names of objects that are `@TenantScoped` (#1554). When
+     * non-empty, the generated server imports the tenancy fail-closed gate and
+     * wraps tenant-scoped tool calls so a stdio invocation cannot read across all
+     * tenants. The tenant is sourced from `SMRT_MCP_TENANT_ID` /
+     * `SMRT_MCP_ALLOW_CROSS_TENANT` env vars (this server has no auth principal).
+     */
+    tenantScopedObjects?: string[];
+}
+/**
+ * Generate runtime bootstrap code for MCP server
+ *
+ * @param options - Runtime configuration options
+ * @returns TypeScript code for server entry point
+ */
+export declare function generateRuntimeBootstrap(options?: RuntimeOptions): string;
+/**
+ * Generate package.json script for running MCP server
+ *
+ * @param serverPath - Path to generated server file (relative to package root)
+ * @returns Script command for package.json
+ */
+export declare function generateMCPScript(serverPath?: string): string;
+/**
+ * Generate Claude Desktop configuration example
+ *
+ * @param serverName - Name for the MCP server
+ * @param serverPath - Absolute path to server file
+ * @returns Configuration object for claude_desktop_config.json
+ */
+export declare function generateClaudeConfig(serverName: string, serverPath: string): object;
+/**
+ * Generate README documentation for MCP server setup
+ *
+ * @param serverName - Name of the MCP server
+ * @param serverPath - Path to the server file
+ * @returns Markdown documentation
+ */
+export declare function generateMCPDocumentation(serverName: string, serverPath: string): string;
+//# sourceMappingURL=mcp-runtime-template.d.ts.map

package/dist/generators/mcp-runtime-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-runtime-template.d.ts","sourceRoot":"","sources":["../../src/generators/mcp-runtime-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAStD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wDAAwD;IACxD,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,GAAG,CAAC;KAClB,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CAyZ7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,MAA6B,GACxC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CA0GR"}