@happyvertical/smrt-core 0.30.0

package/dist/generators/mcp.js

@@ -0,0 +1,1220 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { SmrtCollection } from "../collection.js";
+import { ObjectRegistry } from "../registry.js";
+import { generateRuntimeBootstrap, generateClaudeConfig, generateMCPDocumentation, generateMCPScript } from "./mcp-runtime-template.js";
+import { runWithTenantGate } from "./tenant-gate.js";
+class MCPGenerator {
+  config;
+  context;
+  collections = /* @__PURE__ */ new Map();
+  constructor(config = {}, context = {}) {
+    this.config = {
+      name: "smrt-mcp-server",
+      version: "1.0.0",
+      description: "Auto-generated MCP server from smrt objects",
+      server: {
+        name: "smrt-mcp",
+        version: "1.0.0"
+      },
+      ...config
+    };
+    this.context = context;
+  }
+  /**
+   * Get server name
+   */
+  get name() {
+    return this.config.name;
+  }
+  /**
+   * Get server version
+   */
+  get version() {
+    return this.config.version;
+  }
+  /**
+   * Generate all available tools from registered objects
+   */
+  async generateTools() {
+    const tools = [];
+    const registeredClasses = ObjectRegistry.getAllClasses();
+    for (const [key, classInfo] of registeredClasses) {
+      const simpleName = classInfo.name || key;
+      const config = ObjectRegistry.getConfig(simpleName);
+      const mcpConfig = config.mcp;
+      if (mcpConfig === false) {
+        continue;
+      }
+      const excluded = typeof mcpConfig === "object" && mcpConfig?.exclude ? mcpConfig.exclude : [];
+      const included = typeof mcpConfig === "object" ? mcpConfig?.include : void 0;
+      const shouldInclude = (endpoint) => {
+        if (included && !included.includes(endpoint)) return false;
+        if (excluded.includes(endpoint)) return false;
+        return true;
+      };
+      const objectTools = await this.generateObjectTools(
+        simpleName,
+        shouldInclude
+      );
+      tools.push(...objectTools);
+    }
+    return tools;
+  }
+  /**
+   * Generate tools for a specific object
+   */
+  async generateObjectTools(objectName, shouldInclude) {
+    const tools = [];
+    const fields = ObjectRegistry.getFields(objectName);
+    const lowerName = objectName.toLowerCase();
+    const classInfo = ObjectRegistry.getClass(objectName);
+    if (shouldInclude("list")) {
+      tools.push({
+        name: `${lowerName}_list`,
+        description: `List ${objectName} objects with optional filtering`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            limit: {
+              type: "integer",
+              description: "Maximum number of items to return",
+              default: 50,
+              minimum: 1,
+              maximum: 1e3
+            },
+            offset: {
+              type: "integer",
+              description: "Number of items to skip",
+              default: 0,
+              minimum: 0
+            },
+            orderBy: {
+              type: "string",
+              description: 'Field to order by (e.g., "created_at DESC")'
+            },
+            where: {
+              type: "object",
+              description: "Filter conditions as key-value pairs",
+              additionalProperties: true
+            }
+          }
+        }
+      });
+    }
+    if (shouldInclude("get")) {
+      tools.push({
+        name: `${lowerName}_get`,
+        description: `Get a specific ${objectName} by ID or slug`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string",
+              description: "Unique identifier of the object"
+            },
+            slug: {
+              type: "string",
+              description: "URL-friendly identifier of the object"
+            }
+          },
+          required: ["id"]
+        }
+      });
+    }
+    if (shouldInclude("create")) {
+      const properties = {};
+      const required = [];
+      for (const [fieldName, field] of fields) {
+        properties[fieldName] = this.fieldToMCPSchema(field);
+        if (field._meta?.required) {
+          required.push(fieldName);
+        }
+      }
+      tools.push({
+        name: `${lowerName}_create`,
+        description: `Create a new ${objectName}`,
+        inputSchema: {
+          type: "object",
+          properties,
+          required
+        }
+      });
+    }
+    if (shouldInclude("update")) {
+      const properties = {
+        id: {
+          type: "string",
+          description: "ID of the object to update"
+        }
+      };
+      for (const [fieldName, field] of fields) {
+        properties[fieldName] = this.fieldToMCPSchema(field);
+      }
+      tools.push({
+        name: `${lowerName}_update`,
+        description: `Update an existing ${objectName}`,
+        inputSchema: {
+          type: "object",
+          properties,
+          required: ["id"]
+        }
+      });
+    }
+    if (shouldInclude("delete")) {
+      tools.push({
+        name: `${lowerName}_delete`,
+        description: `Delete a ${objectName} by ID`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string",
+              description: "ID of the object to delete"
+            }
+          },
+          required: ["id"]
+        }
+      });
+    }
+    if (classInfo) {
+      const config = ObjectRegistry.getConfig(objectName);
+      const mcpConfig = config.mcp;
+      const included = typeof mcpConfig === "object" ? mcpConfig?.include : void 0;
+      const excluded = typeof mcpConfig === "object" && mcpConfig?.exclude ? mcpConfig.exclude : [];
+      const crudOperations = ["list", "get", "create", "update", "delete"];
+      const customMethodsInInclude = included?.filter((item) => !crudOperations.includes(item)) || [];
+      const hasIncludeList = included !== void 0;
+      const methods = await ObjectRegistry.getAllMethods(objectName);
+      const methodNames = new Set(Array.from(methods.keys()));
+      if (hasIncludeList) {
+        for (const methodName of customMethodsInInclude) {
+          if (excluded.includes(methodName)) continue;
+          const existsInManifest = methodNames.has(methodName);
+          const existsOnClass = this.validateCustomMethod(
+            classInfo.constructor,
+            methodName
+          );
+          if (!existsInManifest && !existsOnClass) {
+            console.warn(
+              `Warning: Custom action '${methodName}' specified in MCP config for ${objectName}, but method ${methodName}() not found on class`
+            );
+            continue;
+          }
+          const methodDef = methods.get(methodName);
+          if (methodDef && !methodDef.isPublic) continue;
+          const toolName = `${lowerName}_${methodName}`.toLowerCase();
+          tools.push({
+            name: toolName,
+            description: `Execute ${methodName} action on ${objectName}`,
+            inputSchema: {
+              type: "object",
+              properties: {
+                id: {
+                  type: "string",
+                  description: "ID of the object to execute action on"
+                },
+                options: {
+                  type: "object",
+                  description: "Additional options for the custom action",
+                  additionalProperties: true
+                }
+              },
+              required: ["id"]
+            }
+          });
+        }
+      } else {
+        for (const [methodName, methodDef] of methods) {
+          if (!methodDef.isPublic) continue;
+          if (excluded.includes(methodName)) continue;
+          const toolName = `${lowerName}_${methodName}`.toLowerCase();
+          tools.push({
+            name: toolName,
+            description: `Execute ${methodName} action on ${objectName}`,
+            inputSchema: {
+              type: "object",
+              properties: {
+                id: {
+                  type: "string",
+                  description: "ID of the object to execute action on"
+                },
+                options: {
+                  type: "object",
+                  description: "Additional options for the custom action",
+                  additionalProperties: true
+                }
+              },
+              required: ["id"]
+            }
+          });
+        }
+      }
+    }
+    return tools;
+  }
+  /**
+   * Validate that a custom method exists on a class
+   */
+  validateCustomMethod(classConstructor, methodName) {
+    try {
+      const prototype = classConstructor.prototype;
+      if (typeof prototype[methodName] === "function") {
+        return true;
+      }
+      if (typeof classConstructor[methodName] === "function") {
+        return true;
+      }
+      return false;
+    } catch (error) {
+      console.warn(
+        `Error validating method ${methodName} on class ${classConstructor.name}:`,
+        error
+      );
+      return false;
+    }
+  }
+  /**
+   * Convert field definition to MCP schema
+   */
+  fieldToMCPSchema(field) {
+    const schema = {
+      description: field._meta?.description || `${field.type} field`
+    };
+    switch (field.type) {
+      case "text":
+        schema.type = "string";
+        if (field._meta?.maxLength) schema.maxLength = field._meta.maxLength;
+        if (field._meta?.minLength) schema.minLength = field._meta.minLength;
+        break;
+      case "integer":
+        schema.type = "integer";
+        if (field._meta?.min !== void 0) schema.minimum = field._meta.min;
+        if (field._meta?.max !== void 0) schema.maximum = field._meta.max;
+        break;
+      case "decimal":
+        schema.type = "number";
+        if (field._meta?.min !== void 0) schema.minimum = field._meta.min;
+        if (field._meta?.max !== void 0) schema.maximum = field._meta.max;
+        break;
+      case "boolean":
+        schema.type = "boolean";
+        break;
+      case "datetime":
+        schema.type = "string";
+        schema.format = "date-time";
+        break;
+      case "json":
+        schema.type = "object";
+        break;
+      case "foreignKey":
+        schema.type = "string";
+        schema.description = `ID of related ${field.related || "object"}`;
+        break;
+      default:
+        schema.type = "string";
+    }
+    if (field._meta?.default !== void 0) {
+      schema.default = field._meta.default;
+    }
+    return schema;
+  }
+  /**
+   * Handle MCP tool calls
+   */
+  async handleToolCall(request) {
+    const { name, arguments: args } = request.params;
+    try {
+      const availableTools = await this.generateTools();
+      const toolExists = availableTools.some((t) => t.name === name);
+      if (!toolExists) {
+        throw new Error(`Unknown tool: ${name}`);
+      }
+      const firstUnderscore = name.indexOf("_");
+      const objectName = firstUnderscore === -1 ? "" : name.slice(0, firstUnderscore);
+      const action = firstUnderscore === -1 ? "" : name.slice(firstUnderscore + 1);
+      if (!objectName || !action) {
+        throw new Error(`Invalid tool name format: ${name}`);
+      }
+      const registeredClasses = ObjectRegistry.getAllClasses();
+      let classInfo = null;
+      let actualObjectName = "";
+      for (const [_key, info] of registeredClasses) {
+        const simpleName = info.name || _key;
+        if (simpleName.toLowerCase() === objectName.toLowerCase()) {
+          classInfo = info;
+          actualObjectName = simpleName;
+          break;
+        }
+      }
+      if (!classInfo) {
+        throw new Error(`Object type '${objectName}' not found`);
+      }
+      const collection = await this.getCollection(actualObjectName, classInfo);
+      const result = await this.executeAction(
+        collection,
+        action,
+        args,
+        actualObjectName
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result, null, 2)
+          }
+        ]
+      };
+    } catch (error) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+          }
+        ]
+      };
+    }
+  }
+  /**
+   * Get or create collection for an object
+   */
+  async getCollection(objectName, classInfo) {
+    if (!this.collections.has(objectName)) {
+      if (!classInfo.collectionConstructor || typeof classInfo.collectionConstructor !== "function") {
+        throw new Error(
+          `No valid collection constructor found for ${objectName}`
+        );
+      }
+      const collection2 = new classInfo.collectionConstructor({
+        ai: this.context.ai,
+        db: this.context.db
+      });
+      if (!(collection2 instanceof SmrtCollection)) {
+        throw new Error(
+          `Collection for ${objectName} must extend SmrtCollection`
+        );
+      }
+      await collection2.initialize();
+      this.collections.set(objectName, collection2);
+    }
+    const collection = this.collections.get(objectName);
+    if (!collection) {
+      throw new Error(`Collection for ${objectName} not found`);
+    }
+    return collection;
+  }
+  /**
+   * Serialize a tool-response payload, excluding sensitive fields (#1540).
+   * Recurses through arrays and plain objects so a SmrtObject nested inside a
+   * custom-action result (e.g. `{ item }`) is also stripped — `JSON.stringify`
+   * would otherwise call its `toJSON()`. Non-plain instances (Date, etc.) and
+   * primitives pass through unchanged; a cycle guard prevents infinite loops.
+   */
+  toPublicData(value, seen = /* @__PURE__ */ new WeakSet()) {
+    if (value === null || typeof value !== "object") return value;
+    if (typeof value.toPublicJSON === "function") return value.toPublicJSON();
+    if (Array.isArray(value)) {
+      if (seen.has(value)) return value;
+      seen.add(value);
+      return value.map((entry) => this.toPublicData(entry, seen));
+    }
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) return value;
+    if (seen.has(value)) return value;
+    seen.add(value);
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = this.toPublicData(entry, seen);
+    }
+    return out;
+  }
+  /**
+   * Mass-assignment guard (#1540): strip framework/server-managed and
+   * `@field({ readonly: true })` fields from a create/update body, and — when an
+   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.
+   */
+  applyWritablePolicy(objectName, data) {
+    if (!data || typeof data !== "object") {
+      return {};
+    }
+    const serverManaged = /* @__PURE__ */ new Set([
+      "id",
+      "tenantId",
+      "tenant_id",
+      "createdAt",
+      "created_at",
+      "updatedAt",
+      "updated_at"
+    ]);
+    const readonly = /* @__PURE__ */ new Set();
+    let writable = null;
+    if (objectName) {
+      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
+      if (apiConfig && typeof apiConfig === "object" && Array.isArray(apiConfig.writable)) {
+        writable = apiConfig.writable;
+      }
+      for (const [name, def] of ObjectRegistry.getFields(objectName)) {
+        if (def && (def.readonly === true || def._meta?.readonly === true)) {
+          readonly.add(name);
+        }
+      }
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (key.startsWith("_")) continue;
+      if (serverManaged.has(key)) continue;
+      if (readonly.has(key)) continue;
+      if (writable && !writable.includes(key)) continue;
+      result[key] = value;
+    }
+    return result;
+  }
+  /**
+   * Execute action on collection
+   */
+  /**
+   * Fail-closed authorization for tool calls (#1540). Mutating tools
+   * (create/update/delete + custom actions) require an authenticated principal
+   * (`context.user`) unless the object opts out via `@smrt({ api: { public } })`.
+   * Reads are allowed when `public` is `true` or `'read'`.
+   */
+  requireToolAuth(objectName, mutating) {
+    const apiConfig = objectName ? ObjectRegistry.getConfig(objectName)?.api : void 0;
+    const publicAccess = apiConfig && typeof apiConfig === "object" ? apiConfig.public : void 0;
+    if (publicAccess === true) return;
+    if (publicAccess === "read" && !mutating) return;
+    if (!this.context.user) {
+      throw new Error("Authentication required");
+    }
+  }
+  async executeAction(collection, action, args, objectName) {
+    const mutating = action !== "list" && action !== "get";
+    this.requireToolAuth(objectName, mutating);
+    return runWithTenantGate(
+      {
+        className: objectName,
+        tenantId: this.context.tenantId,
+        allowCrossTenant: this.context.allowCrossTenant,
+        surface: "MCP"
+      },
+      () => this.runAction(collection, action, args, objectName)
+    );
+  }
+  /**
+   * Derive the set of tenant-scoped object names (lowercased simple names) from
+   * a generated tool list, for the emitted runtime template's tenant gate
+   * (#1554). Tool names are `objectname_action`.
+   *
+   * Detection uses ONLY tenancy's `isTenantScopedClass` (the authoritative
+   * source the interceptor uses; covers `@TenantScoped`), consulted via an
+   * optional dynamic import. We deliberately do NOT fall back to core's
+   * `ObjectRegistry.isTenantScoped`: a `@smrt({ tenantScoped })` model can exist
+   * in an app that has NOT installed `@happyvertical/smrt-tenancy`, and emitting
+   * the static `import { runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy'`
+   * gate for it would crash the generated server at import time. When tenancy is
+   * absent there is also nothing to enforce, so emitting no gate is correct.
+   */
+  async tenantScopedObjectNames(tools) {
+    let isTenantScopedClass;
+    try {
+      const tenancySpecifier = "@happyvertical/smrt-tenancy";
+      const tenancy = await import(
+        /* @vite-ignore */
+        tenancySpecifier
+      );
+      isTenantScopedClass = tenancy.isTenantScopedClass;
+    } catch {
+      isTenantScopedClass = void 0;
+    }
+    if (typeof isTenantScopedClass !== "function") return [];
+    const scoped = /* @__PURE__ */ new Set();
+    for (const tool of tools) {
+      const [objectName] = tool.name.split("_");
+      if (!objectName) continue;
+      for (const [key, info] of ObjectRegistry.getAllClasses()) {
+        const simpleName = info.name || key;
+        if (simpleName.toLowerCase() === objectName.toLowerCase()) {
+          if (isTenantScopedClass(simpleName)) {
+            scoped.add(simpleName.toLowerCase());
+          }
+          break;
+        }
+      }
+    }
+    return Array.from(scoped);
+  }
+  /**
+   * Execute a resolved MCP action (CRUD or custom) against a collection. Always
+   * invoked inside the tenant gate established by {@link executeAction}.
+   */
+  async runAction(collection, action, args, objectName) {
+    switch (action) {
+      case "list": {
+        const listOptions = {
+          limit: Math.min(args.limit || 50, 1e3),
+          offset: args.offset || 0
+        };
+        if (args.where) {
+          listOptions.where = args.where;
+        }
+        if (args.orderBy) {
+          listOptions.orderBy = args.orderBy;
+        }
+        const results = await collection.list(listOptions);
+        const total = await collection.count({ where: args.where || {} });
+        return {
+          data: results.map((result) => this.toPublicData(result)),
+          meta: {
+            total,
+            limit: listOptions.limit,
+            offset: listOptions.offset,
+            count: results.length
+          }
+        };
+      }
+      case "get": {
+        if (!args.id && !args.slug) {
+          throw new Error("Either id or slug is required");
+        }
+        const filter = args.id ? args.id : args.slug;
+        const item = await collection.get(filter);
+        if (!item) {
+          throw new Error("Object not found");
+        }
+        return this.toPublicData(item);
+      }
+      case "create": {
+        const createData = this.applyWritablePolicy(
+          objectName,
+          args
+        );
+        if (this.context.user) {
+          createData.created_by = this.context.user.id;
+          createData.owner_id = this.context.user.id;
+        }
+        const newItem = await collection.create(createData);
+        await newItem.save();
+        return this.toPublicData(newItem);
+      }
+      case "update": {
+        const { id } = args;
+        if (!id) {
+          throw new Error("ID is required for update");
+        }
+        const existing = await collection.get(id);
+        if (!existing) {
+          throw new Error("Object not found");
+        }
+        const updateData = this.applyWritablePolicy(objectName, args);
+        Object.assign(existing, updateData);
+        if (this.context.user) {
+          existing.updated_by = this.context.user.id;
+        }
+        await existing.save();
+        return this.toPublicData(existing);
+      }
+      case "delete": {
+        if (!args.id) {
+          throw new Error("ID is required for delete");
+        }
+        const toDelete = await collection.get(args.id);
+        if (!toDelete) {
+          throw new Error("Object not found");
+        }
+        await toDelete.delete();
+        return { success: true, message: "Object deleted successfully" };
+      }
+      default: {
+        const result = await this.executeCustomAction(collection, action, args);
+        return this.toPublicData(result);
+      }
+    }
+  }
+  /**
+   * Execute a custom action on a collection/object
+   */
+  async executeCustomAction(collection, action, args) {
+    const { id, options = {}, ...directArgs } = args;
+    try {
+      if (id) {
+        const object = await collection.get(id);
+        if (!object) {
+          throw new Error("Object not found");
+        }
+        const objectWithMethods = object;
+        if (typeof objectWithMethods[action] === "function") {
+          const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
+          const result = await objectWithMethods[action](methodArgs);
+          return result;
+        } else {
+          throw new Error(`Method '${action}' not found on object instance`);
+        }
+      } else {
+        if (typeof collection[action] === "function") {
+          const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
+          const result = await collection[action](methodArgs);
+          return result;
+        } else {
+          throw new Error(
+            `Method '${action}' not found on collection. For object-specific actions, provide an 'id' parameter.`
+          );
+        }
+      }
+    } catch (error) {
+      throw new Error(
+        `Failed to execute custom action '${action}': ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  }
+  /**
+   * Generate MCP server info
+   */
+  getServerInfo() {
+    return {
+      name: this.config.server?.name,
+      version: this.config.server?.version,
+      description: this.config.description
+    };
+  }
+  /**
+   * Generate complete MCP server with stdio transport
+   *
+   * Creates a runnable Node.js script that exposes SMRT objects as MCP tools.
+   * The generated server includes:
+   * - Stdio transport integration
+   * - Tool registration from ObjectRegistry
+   * - Error handling and logging
+   * - Graceful shutdown
+   *
+   * @param options - Server generation options
+   * @returns Promise that resolves when all files are written
+   *
+   * @example
+   * ```typescript
+   * const generator = new MCPGenerator({
+   *   name: 'my-app',
+   *   version: '1.0.0'
+   * });
+   *
+   * await generator.generateServer({
+   *   outputPath: '.smrt/mcp-server/index.js',
+   *   serverName: 'my-app-mcp',
+   *   debug: true
+   * });
+   * ```
+   */
+  async generateServer(options = {}) {
+    const {
+      outputPath = ".smrt/mcp-server/index.js",
+      serverName = this.config.name || "smrt-mcp-server",
+      serverVersion = this.config.version || "1.0.0",
+      debug = false,
+      generateClaudeConfigFile = false,
+      generateReadme = false,
+      modular = false
+    } = options;
+    const resolvedPath = resolve(process.cwd(), outputPath);
+    const outputDir = dirname(resolvedPath);
+    await mkdir(outputDir, { recursive: true });
+    if (modular) {
+      await this.generateModularServer(
+        outputDir,
+        serverName,
+        serverVersion,
+        debug
+      );
+    } else {
+      const tools = await this.generateTools();
+      const runtimeOptions = {
+        name: serverName,
+        version: serverVersion,
+        description: this.config.description,
+        config: this.config,
+        context: this.context,
+        debug,
+        tools,
+        tenantScopedObjects: await this.tenantScopedObjectNames(tools)
+      };
+      const serverCode = generateRuntimeBootstrap(runtimeOptions);
+      await writeFile(resolvedPath, serverCode, "utf-8");
+      console.log(`✅ Generated MCP server: ${resolvedPath}`);
+    }
+    if (generateClaudeConfigFile) {
+      const claudeConfig = generateClaudeConfig(serverName, resolvedPath);
+      const claudeConfigPath = resolve(outputDir, "claude-config.example.json");
+      await writeFile(
+        claudeConfigPath,
+        JSON.stringify(claudeConfig, null, 2),
+        "utf-8"
+      );
+      console.log(`✅ Generated Claude config example: ${claudeConfigPath}`);
+    }
+    if (generateReadme) {
+      const readme = generateMCPDocumentation(serverName, outputPath);
+      const readmePath = resolve(outputDir, "MCP-README.md");
+      await writeFile(readmePath, readme, "utf-8");
+      console.log(`✅ Generated MCP documentation: ${readmePath}`);
+    }
+    const mcpScript = generateMCPScript(outputPath);
+    console.log(`
+📝 Add this to your package.json scripts:`);
+    console.log(`   "mcp": "${mcpScript}"
+`);
+  }
+  /**
+   * Generate modular MCP server structure
+   *
+   * Creates separate files for tools, handlers, configuration, and main entry point.
+   * This makes the generated server easier to customize and extend.
+   *
+   * @param outputDir - Directory to generate files in
+   * @param serverName - Server name
+   * @param serverVersion - Server version
+   * @param debug - Enable debug logging
+   */
+  async generateModularServer(outputDir, serverName, serverVersion, debug) {
+    const toolsDir = resolve(outputDir, "tools");
+    const handlersDir = resolve(outputDir, "handlers");
+    await mkdir(toolsDir, { recursive: true });
+    await mkdir(handlersDir, { recursive: true });
+    const configPath = resolve(outputDir, "config.ts");
+    const configCode = this.generateConfigFile(
+      serverName,
+      serverVersion,
+      debug
+    );
+    await writeFile(configPath, configCode, "utf-8");
+    console.log(`✅ Generated config: ${configPath}`);
+    const toolsPath = resolve(toolsDir, "index.ts");
+    const toolsCode = await this.generateToolsFile();
+    await writeFile(toolsPath, toolsCode, "utf-8");
+    console.log(`✅ Generated tools: ${toolsPath}`);
+    const handlersPath = resolve(handlersDir, "index.ts");
+    const tenantScopedObjects = await this.tenantScopedObjectNames(
+      await this.generateTools()
+    );
+    const handlersCode = await this.generateHandlersFile(tenantScopedObjects);
+    await writeFile(handlersPath, handlersCode, "utf-8");
+    console.log(`✅ Generated handlers: ${handlersPath}`);
+    const indexPath = resolve(outputDir, "index.js");
+    const indexCode = this.generateModularIndex();
+    await writeFile(indexPath, indexCode, "utf-8");
+    console.log(`✅ Generated MCP server: ${indexPath}`);
+  }
+  /**
+   * Generate configuration file for modular server
+   */
+  generateConfigFile(serverName, serverVersion, debug) {
+    return `/**
+ * MCP Server Configuration
+ * Auto-generated by @happyvertical/smrt-core
+ */
+
+export const SERVER_NAME = ${JSON.stringify(serverName)};
+export const SERVER_VERSION = ${JSON.stringify(serverVersion)};
+export const SERVER_DESCRIPTION = ${JSON.stringify(this.config.description)};
+export const DEBUG = ${debug};
+`;
+  }
+  /**
+   * Generate tools definitions file for modular server
+   */
+  async generateToolsFile() {
+    const tools = await this.generateTools();
+    return `/**
+ * MCP Tools Definitions
+ * Auto-generated from SMRT objects
+ */
+
+export const tools: Array<{
+  name: string;
+  description: string;
+  inputSchema: any;
+}> = ${JSON.stringify(tools, null, 2)};
+`;
+  }
+  /**
+   * Generate switch cases for tool execution
+   */
+  async generateToolSwitchCases(indent = "    ") {
+    const tools = await this.generateTools();
+    const capitalize = (str) => str.charAt(0).toUpperCase() + str.slice(1);
+    const switchCases = tools.map((tool) => {
+      const [objectName, action] = tool.name.split("_");
+      switch (action) {
+        case "list":
+          return `${indent}case '${tool.name}': {
+${indent}  const limit = args.limit ?? 50;
+${indent}  const offset = args.offset ?? 0;
+${indent}  const where = args.where ?? {};
+
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const items = await collection.list({ where, limit, offset });
+${indent}  const itemsPublic = items.map((item) => item.toPublicJSON());
+${indent}  return { content: [{ type: 'text', text: JSON.stringify(itemsPublic) }] };
+${indent}}`;
+        case "get":
+          return `${indent}case '${tool.name}': {
+${indent}  if (!args.id && !args.slug) {
+${indent}    throw new Error('Either id or slug is required');
+${indent}  }
+
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const filter = args.id || args.slug;
+${indent}  const item = await collection.get(filter);
+
+${indent}  if (!item) {
+${indent}    throw new Error('Object not found');
+${indent}  }
+
+${indent}  return { content: [{ type: 'text', text: JSON.stringify(item.toPublicJSON()) }] };
+${indent}}`;
+        case "create":
+          return `${indent}case '${tool.name}': {
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const newItem = await collection.create(applyWritablePolicy('${capitalize(objectName)}', args));
+${indent}  await newItem.save();
+
+${indent}  return { content: [{ type: 'text', text: JSON.stringify(newItem.toPublicJSON()) }] };
+${indent}}`;
+        case "update":
+          return `${indent}case '${tool.name}': {
+${indent}  const { id, ...updateData } = args;
+${indent}  if (!id) {
+${indent}    throw new Error('ID is required for update');
+${indent}  }
+
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const existing = await collection.get(id);
+${indent}  if (!existing) {
+${indent}    throw new Error('Object not found');
+${indent}  }
+
+${indent}  Object.assign(existing, applyWritablePolicy('${capitalize(objectName)}', updateData));
+${indent}  await existing.save();
+
+${indent}  return { content: [{ type: 'text', text: JSON.stringify(existing.toPublicJSON()) }] };
+${indent}}`;
+        case "delete":
+          return `${indent}case '${tool.name}': {
+${indent}  if (!args.id) {
+${indent}    throw new Error('ID is required for delete');
+${indent}  }
+
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const toDelete = await collection.get(args.id);
+${indent}  if (!toDelete) {
+${indent}    throw new Error('Object not found');
+${indent}  }
+
+${indent}  await toDelete.delete();
+
+${indent}  return { content: [{ type: 'text', text: JSON.stringify({ success: true, message: 'Object deleted successfully' }) }] };
+${indent}}`;
+        default:
+          return `${indent}case '${tool.name}': {
+${indent}  const { id, options = {}, ...directArgs } = args;
+
+${indent}  if (!id) {
+${indent}    throw new Error('ID is required for custom action ${action}');
+${indent}  }
+
+${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
+${indent}    ai: aiConfig
+${indent}  });
+
+${indent}  const object = await collection.get(id);
+${indent}  if (!object) {
+${indent}    throw new Error('Object not found');
+${indent}  }
+
+${indent}  if (typeof object['${action}'] !== 'function') {
+${indent}    throw new Error('Method ${action} not found on object');
+${indent}  }
+
+${indent}  const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
+${indent}  const result = await object['${action}'](methodArgs);
+
+${indent}  return { content: [{ type: 'text', text: JSON.stringify(toPublicResult(result)) }] };
+${indent}}`;
+      }
+    }).join("\n\n");
+    return switchCases;
+  }
+  /**
+   * Generate handlers file for modular server
+   */
+  async generateHandlersFile(tenantScopedObjects = []) {
+    const switchCases = await this.generateToolSwitchCases("        ");
+    const tenantScopedSet = Array.from(
+      new Set(tenantScopedObjects.map((n) => n.toLowerCase()))
+    );
+    const hasTenantScoped = tenantScopedSet.length > 0;
+    return `/**
+ * MCP Tool Call Handlers
+ * Auto-generated from SMRT objects
+ *
+ * SECURITY (#1540): responses exclude @field({ sensitive }) fields and
+ * create/update bodies are mass-assignment guarded. This handler has no
+ * per-call authentication principal — the generated stdio MCP server's trust
+ * boundary is the host process / MCP client. Run it only in a trusted context
+ * or behind an authenticated gateway.
+ *
+ * SECURITY (#1554): tenant-scoped tools run inside a fail-closed tenant gate;
+ * the tenant is taken from SMRT_MCP_TENANT_ID (this server has no auth
+ * principal) and tenancy is enabled so the interceptor enforces filtering.
+ */
+
+import { ObjectRegistry } from '@happyvertical/smrt-core';
+${hasTenantScoped ? "import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\n" : ""}${hasTenantScoped ? `
+// Install the tenancy interceptor so tenant-scoped tools are filtered and the
+// gate fail-closes when no tenant is supplied (#1554).
+enableTenancy();
+const TENANT_SCOPED = new Set(${JSON.stringify(tenantScopedSet)});
+const MCP_TENANT_ID = process.env.SMRT_MCP_TENANT_ID || undefined;
+const MCP_ALLOW_CROSS_TENANT = process.env.SMRT_MCP_ALLOW_CROSS_TENANT === 'true';
+` : ""}
+
+/**
+ * Mass-assignment guard (#1540): strip framework/server-managed and
+ * \`@field({ readonly: true })\` fields from create/update bodies, intersecting
+ * with the optional \`@smrt({ api: { writable: [...] } })\` allowlist.
+ */
+function applyWritablePolicy(objectName: string, data: any): Record<string, any> {
+  if (!data || typeof data !== 'object') return {};
+  const serverManaged = new Set<string>([
+    'id', 'tenantId', 'tenant_id',
+    'createdAt', 'created_at', 'updatedAt', 'updated_at',
+  ]);
+  const readonly = new Set<string>();
+  let writable: string[] | null = null;
+  const apiConfig = ObjectRegistry.getConfig(objectName)?.api as any;
+  if (apiConfig && typeof apiConfig === 'object' && Array.isArray(apiConfig.writable)) {
+    writable = apiConfig.writable;
+  }
+  for (const [name, def] of ObjectRegistry.getFields(objectName)) {
+    if (def && ((def as any).readonly === true || (def as any)._meta?.readonly === true)) {
+      readonly.add(name);
+    }
+  }
+  const result: Record<string, any> = {};
+  for (const [key, value] of Object.entries(data as Record<string, any>)) {
+    if (key.startsWith('_')) continue;
+    if (serverManaged.has(key)) continue;
+    if (readonly.has(key)) continue;
+    if (writable && !writable.includes(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+
+/**
+ * Sensitive-field-safe serialization for custom-action results (#1540).
+ * Recurses through arrays and plain objects so nested SmrtObjects are stripped
+ * too; non-plain instances (Date, etc.) and primitives pass through. Cycle-safe.
+ */
+function toPublicResult(value: any, seen: WeakSet<object> = new WeakSet()): any {
+  if (value === null || typeof value !== 'object') return value;
+  if (typeof value.toPublicJSON === 'function') return value.toPublicJSON();
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    return value.map((entry: any) => toPublicResult(entry, seen));
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  const out: Record<string, any> = {};
+  for (const [key, entry] of Object.entries(value as Record<string, any>)) {
+    out[key] = toPublicResult(entry, seen);
+  }
+  return out;
+}
+
+/**
+ * Handle tool call request
+ */
+export async function handleToolCall(
+  name: string,
+  arguments: any = {},
+  aiConfig: any = {}
+) {
+  try {
+    const args = arguments;
+
+    const runToolBody = async () => {
+      switch (name) {
+${switchCases}
+
+        default:
+          throw new Error(\`Unknown tool: \${name}\`);
+      }
+    };
+${hasTenantScoped ? `
+    // Fail-closed tenant context for tenant-scoped tools (#1554).
+    const [toolObject] = name.split('_');
+    const result =
+      toolObject && TENANT_SCOPED.has(toolObject.toLowerCase())
+        ? await runTenantScopedEntryPoint(
+            { tenantScoped: true, tenantId: MCP_TENANT_ID, allowCrossTenant: MCP_ALLOW_CROSS_TENANT, surface: 'MCP' },
+            runToolBody,
+          )
+        : await runToolBody();` : `
+    const result = await runToolBody();`}
+
+    return result;
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: \`Error executing tool \${name}: \${errorMessage}\`,
+        },
+      ],
+      isError: true,
+    };
+  }
+}
+`;
+  }
+  /**
+   * Generate modular index file (main entry point)
+   */
+  generateModularIndex() {
+    return `#!/usr/bin/env node
+/**
+ * Auto-generated MCP Server
+ * Generated by @happyvertical/smrt-core MCPGenerator
+ *
+ * This server exposes SMRT objects as MCP tools for AI integration.
+ */
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+import { config } from '@happyvertical/smrt-config';
+import { getDatabase } from '@happyvertical/sql';
+import { getAI } from '@happyvertical/ai';
+
+import { SERVER_NAME, SERVER_VERSION, DEBUG } from './config.js';
+import { tools } from './tools/index.js';
+import { handleToolCall } from './handlers/index.js';
+
+/**
+ * Main server startup function
+ */
+async function main() {
+  try {
+    if (DEBUG) {
+      console.error(\`[MCP] Starting server: \${SERVER_NAME} v\${SERVER_VERSION}\`);
+      console.error(\`[MCP] Available tools:\`, tools.map(t => t.name).join(', '));
+    }
+
+    // Load configuration from environment and .smrt.config files
+    const appConfig = await config.load();
+    const aiConfig = appConfig?.ai || {};
+
+    // Create MCP server
+    const server = new Server(
+      {
+        name: SERVER_NAME,
+        version: SERVER_VERSION,
+      },
+      {
+        capabilities: {
+          tools: {},
+        },
+      }
+    );
+
+    // Register ListTools handler
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+      if (DEBUG) {
+        console.error(\`[MCP] ListTools request received\`);
+      }
+
+      return {
+        tools: tools.map(tool => ({
+          name: tool.name,
+          description: tool.description,
+          inputSchema: tool.inputSchema,
+        })),
+      };
+    });
+
+    // Register CallTool handler
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+      const { name, arguments: args = {} } = request.params;
+
+      if (DEBUG) {
+        console.error(\`[MCP] CallTool request: \${name}\`);
+        console.error(\`[MCP] Arguments:\`, JSON.stringify(args, null, 2));
+      }
+
+      return await handleToolCall(name, args, aiConfig);
+    });
+
+    // Setup stdio transport
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+
+    if (DEBUG) {
+      console.error(\`[MCP] Server connected and ready\`);
+    }
+
+    // Handle graceful shutdown
+    const shutdown = async () => {
+      if (DEBUG) {
+        console.error(\`[MCP] Shutting down gracefully\`);
+      }
+      await server.close();
+      process.exit(0);
+    };
+
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+  } catch (error) {
+    console.error('[MCP] Fatal error during server startup:', error);
+    process.exit(1);
+  }
+}
+
+main().catch((error) => {
+  console.error('[MCP] Unhandled error:', error);
+  process.exit(1);
+});
+`;
+  }
+}
+export {
+  MCPGenerator
+};
+//# sourceMappingURL=mcp.js.map