@happyvertical/smrt-core 0.40.49 → 0.40.50

package/dist/generators/index.js

@@ -1,3 +1,4 @@
+import { SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildCustomActionInputSchema, buildCustomActionInvocationArgs, customActionParameterInputName, normalizeCustomActionFailure, resolveCustomActionMetadata } from "./custom-action.js";
 import { runWithTenantGate, setTenantEntryPointRunner } from "./tenant-gate.js";
 import { CLIGenerator, getCLIHandler, setupCLI } from "./cli.js";
 import { PRIVATE_READ_CACHE_CONTROL, canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized } from "./conditional-get.js";
@@ -5,4 +6,4 @@ import { DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EV
 import { MCPGenerator } from "./mcp.js";
 import { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer } from "./rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./swagger.js";
-export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, PRIVATE_READ_CACHE_CONTROL, buildChangeEventStream, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, normalizeEventsMaxSubscribers, resolveReadCacheControl, resolveTenantEtagDiscriminator, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };
+export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, resolveCustomActionMetadata, resolveReadCacheControl, resolveTenantEtagDiscriminator, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };

package/dist/generators/mcp-runtime-template.d.ts

@@ -1,3 +1,4 @@
+import { CustomActionScope } from './custom-action.js';
 import { MCPConfig, MCPContext } from './mcp.js';
 export interface RuntimeOptions {
     /** Server name (defaults to package name) */
@@ -18,6 +19,16 @@ export interface RuntimeOptions {
         description: string;
         inputSchema: Record<string, unknown>;
     }>;
+    /** Internal invocation metadata; never exposed by the MCP tools/list result. */
+    customActions?: Record<string, {
+        scope: CustomActionScope;
+        isStatic: boolean;
+        /** Declared method name; tool IDs are lowercased protocol aliases. */
+        methodName?: string;
+        parameterNames?: string[];
+        optionsParameter?: boolean;
+        legacyOptions: boolean;
+    }>;
     /**
      * Lowercased simple names of objects that are `@TenantScoped` (#1554). When
      * non-empty, the generated server imports the tenancy fail-closed gate and

package/dist/generators/mcp-runtime-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-runtime-template.d.ts","sourceRoot":"","sources":["../../src/generators/mcp-runtime-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAStD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wDAAwD;IACxD,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CA+Z7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,MAA6B,GACxC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CA0GR"}
+{"version":3,"file":"mcp-runtime-template.d.ts","sourceRoot":"","sources":["../../src/generators/mcp-runtime-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAStD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wDAAwD;IACxD,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC,CAAC;IACH,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CACpB,MAAM,EACN;QACE,KAAK,EAAE,iBAAiB,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC;QAClB,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,OAAO,CAAC;KACxB,CACF,CAAC;IAEF;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CA6b7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,MAA6B,GACxC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CA0GR"}

package/dist/generators/mcp-runtime-template.js

@@ -12,13 +12,15 @@ function capitalize(str) {
 * @returns TypeScript code for server entry point
 */
 function generateRuntimeBootstrap(options = {}) {
-	const { name = "smrt-mcp-server", version = "1.0.0", description = "Auto-generated MCP server from SMRT objects", debug = false, tools = [], tenantScopedObjects = [] } = options;
+	const { name = "smrt-mcp-server", version = "1.0.0", description = "Auto-generated MCP server from SMRT objects", debug = false, tools = [], customActions = {}, tenantScopedObjects = [] } = options;
 	const toolsCode = tools.length > 0 ? JSON.stringify(tools, null, 2) : "[]";
 	const tenantScopedSet = Array.from(new Set(tenantScopedObjects.map((n) => n.toLowerCase())));
 	const hasTenantScoped = tenantScopedSet.length > 0;
 	const generateSwitchCases = (indent) => {
 		return tools.map((tool) => {
-			const [objectName, action] = tool.name.split("_");
+			const separator = tool.name.indexOf("_");
+			const objectName = tool.name.slice(0, separator);
+			const action = tool.name.slice(separator + 1);
 			switch (action) {
 				case "list": return `${indent}case '${tool.name}': {
 ${indent}  const limit = args.limit ?? 50;
@@ -105,28 +107,52 @@ ${indent}  await toDelete.delete();
 ${indent}  return { content: [{ type: 'text', text: JSON.stringify({ success: true, message: 'Object deleted successfully' }) }] };
 ${indent}}`;
 				default: return `${indent}case '${tool.name}': {
-${indent}  const { id, options = {}, ...directArgs } = args;
+${indent}  const actionMeta = CUSTOM_ACTIONS['${tool.name}'] || { scope: 'item', isStatic: false, legacyOptions: true };
+${indent}  const { id, options, ...directArgs } = args;
 
-${indent}  if (!id) {
+${indent}  if (actionMeta.scope === 'item' && !id) {
 ${indent}    throw new Error('ID is required for custom action ${action}');
 ${indent}  }
+${indent}  if (actionMeta.scope === 'collection' && id) {
+${indent}    throw new Error('Custom action ${action} is collection-scoped and does not accept an ID');
+${indent}  }
 
 ${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
 ${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
 ${indent}    ai: aiConfig
 ${indent}  });
 
-${indent}  const object = await collection.get(id);
-${indent}  if (!object) {
-${indent}    throw new Error('Object not found');
+${indent}  const target = actionMeta.scope === 'item'
+${indent}    ? await collection.get(id)
+${indent}    : actionMeta.isStatic
+${indent}      ? ObjectRegistry.getClass('${capitalize(objectName)}')?.constructor
+${indent}      : collection;
+${indent}  if (!target) {
+${indent}    throw new Error(actionMeta.scope === 'item' ? 'Object not found' : 'Custom action target not found');
 ${indent}  }
-
-${indent}  if (typeof object['${action}'] !== 'function') {
-${indent}    throw new Error('Method ${action} not found on object');
+${indent}  const actionMethod = target[actionMeta.methodName || '${action}'];
+${indent}  if (typeof actionMethod !== 'function') {
+${indent}    throw new Error('Method ${action} not found on custom action target');
 ${indent}  }
 
-${indent}  const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
-${indent}  const result = await object['${action}'](methodArgs);
+${indent}  const methodArgs = actionMeta.legacyOptions
+${indent}    ? [Object.keys(options ?? {}).length > 0 ? options : directArgs]
+${indent}    : actionMeta.optionsParameter
+${indent}      ? [options]
+${indent}      : (actionMeta.parameterNames || []).map((parameterName) => args[
+${indent}          parameterName === 'id'
+${indent}            ? 'actionId'
+${indent}            : parameterName
+${indent}        ]);
+${indent}  const result = await actionMethod.call(target, ...methodArgs);
+${indent}  const failure = normalizeCustomActionFailure(result);
+${indent}  if (failure) {
+${indent}    return {
+${indent}      content: [{ type: 'text', text: JSON.stringify({ error: failure }) }],
+${indent}      isError: true,
+${indent}      _meta: { [SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY]: failure },
+${indent}    };
+${indent}  }
 
 ${indent}  return { content: [{ type: 'text', text: JSON.stringify(toPublicResult(result)) }] };
 ${indent}}`;
@@ -157,6 +183,7 @@ import {
   type ListToolsRequest,
 } from '@modelcontextprotocol/sdk/types.js';
 import { ObjectRegistry } from '@happyvertical/smrt-core';
+import { normalizeCustomActionFailure, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY } from '@happyvertical/smrt-core';
 import { config } from '@happyvertical/smrt-config';
 ${hasTenantScoped ? "import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\n" : ""}
 // Server configuration
@@ -167,6 +194,7 @@ const DEBUG = ${debug};
 
 // Static tool definitions (generated at build time)
 const TOOLS = ${toolsCode};
+const CUSTOM_ACTIONS = ${JSON.stringify(customActions)};
 ${hasTenantScoped ? `
 // Fail-closed tenant context (#1554): tenant-scoped objects must run inside a
 // tenant. This stdio server has no auth principal, so the tenant is taken from

package/dist/generators/mcp-runtime-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-runtime-template.js","names":[],"sources":["../../src/generators/mcp-runtime-template.ts"],"sourcesContent":["/**\n * Runtime bootstrap template for generated MCP servers\n *\n * This template provides stdio transport integration for SMRT-generated MCP servers.\n * It handles:\n * - Server initialization with @modelcontextprotocol/sdk\n * - Tool registration from MCPGenerator\n * - Stdio transport connection\n * - Error handling and logging\n * - Graceful shutdown\n */\n\nimport type { MCPConfig, MCPContext } from './mcp.js';\n\n/**\n * Helper function to capitalize first letter\n */\nfunction capitalize(str: string): string {\n  return str.charAt(0).toUpperCase() + str.slice(1);\n}\n\nexport interface RuntimeOptions {\n  /** Server name (defaults to package name) */\n  name?: string;\n\n  /** Server version (defaults to package version) */\n  version?: string;\n\n  /** Server description */\n  description?: string;\n\n  /** MCP generator configuration */\n  config?: MCPConfig;\n\n  /** MCP context (database, AI client, etc.) */\n  context?: MCPContext;\n\n  /** Enable debug logging */\n  debug?: boolean;\n\n  /** Static tool definitions (generated at build time) */\n  tools?: Array<{\n    name: string;\n    description: string;\n    inputSchema: Record<string, unknown>;\n  }>;\n\n  /**\n   * Lowercased simple names of objects that are `@TenantScoped` (#1554). When\n   * non-empty, the generated server imports the tenancy fail-closed gate and\n   * wraps tenant-scoped tool calls so a stdio invocation cannot read across all\n   * tenants. The tenant is sourced from `SMRT_MCP_TENANT_ID` /\n   * `SMRT_MCP_ALLOW_CROSS_TENANT` env vars (this server has no auth principal).\n   */\n  tenantScopedObjects?: string[];\n}\n\n/**\n * Generate runtime bootstrap code for MCP server\n *\n * @param options - Runtime configuration options\n * @returns TypeScript code for server entry point\n */\nexport function generateRuntimeBootstrap(options: RuntimeOptions = {}): string {\n  const {\n    name = 'smrt-mcp-server',\n    version = '1.0.0',\n    description = 'Auto-generated MCP server from SMRT objects',\n    debug = false,\n    tools = [],\n    tenantScopedObjects = [],\n  } = options;\n\n  // Generate static tool array as TypeScript code\n  const toolsCode = tools.length > 0 ? JSON.stringify(tools, null, 2) : '[]';\n\n  // Fail-closed tenant context (#1554): only wire the tenancy gate when at\n  // least one exposed object is tenant-scoped, so apps without tenancy never\n  // get a dangling import.\n  const tenantScopedSet = Array.from(\n    new Set(tenantScopedObjects.map((n) => n.toLowerCase())),\n  );\n  const hasTenantScoped = tenantScopedSet.length > 0;\n\n  // Generate static switch cases using shared helper\n  const generateSwitchCases = (indent: string) => {\n    return tools\n      .map((tool) => {\n        const [objectName, action] = tool.name.split('_');\n\n        switch (action) {\n          case 'list':\n            return `${indent}case '${tool.name}': {\n${indent}  const limit = args.limit ?? 50;\n${indent}  const offset = args.offset ?? 0;\n${indent}  const where = args.where ?? {};\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const items = await collection.list({ where, limit, offset });\n${indent}  const itemsPublic = items.map((item) => item.toPublicJSON(PUBLIC_JSON_OPTIONS));\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(itemsPublic) }] };\n${indent}}`;\n\n          case 'get':\n            return `${indent}case '${tool.name}': {\n${indent}  if (!args.id && !args.slug) {\n${indent}    throw new Error('Either id or slug is required');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const filter = args.id || args.slug;\n${indent}  const item = await collection.get(filter);\n\n${indent}  if (!item) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(item.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'create':\n            return `${indent}case '${tool.name}': {\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const newItem = await collection.create(applyWritablePolicy('${capitalize(objectName)}', args));\n${indent}  await newItem.save();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(newItem.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'update':\n            return `${indent}case '${tool.name}': {\n${indent}  const { id, ...updateData } = args;\n${indent}  if (!id) {\n${indent}    throw new Error('ID is required for update');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const existing = await collection.get(id);\n${indent}  if (!existing) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  Object.assign(existing, applyWritablePolicy('${capitalize(objectName)}', updateData));\n${indent}  await existing.save();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(existing.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'delete':\n            return `${indent}case '${tool.name}': {\n${indent}  if (!args.id) {\n${indent}    throw new Error('ID is required for delete');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const toDelete = await collection.get(args.id);\n${indent}  if (!toDelete) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  await toDelete.delete();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify({ success: true, message: 'Object deleted successfully' }) }] };\n${indent}}`;\n\n          default:\n            // Custom action\n            return `${indent}case '${tool.name}': {\n${indent}  const { id, options = {}, ...directArgs } = args;\n\n${indent}  if (!id) {\n${indent}    throw new Error('ID is required for custom action ${action}');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const object = await collection.get(id);\n${indent}  if (!object) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  if (typeof object['${action}'] !== 'function') {\n${indent}    throw new Error('Method ${action} not found on object');\n${indent}  }\n\n${indent}  const methodArgs = Object.keys(options).length > 0 ? options : directArgs;\n${indent}  const result = await object['${action}'](methodArgs);\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(toPublicResult(result)) }] };\n${indent}}`;\n        }\n      })\n      .join('\\n\\n');\n  };\n\n  const switchCases = generateSwitchCases('          ');\n\n  return `#!/usr/bin/env node\n/**\n * Auto-generated MCP Server\n * Generated by @smrt/core MCPGenerator\n *\n * This server exposes SMRT objects as MCP tools for AI integration.\n *\n * SECURITY (#1540): tool responses exclude @field({ sensitive }) fields and\n * create/update bodies are mass-assignment guarded. This stdio server has NO\n * per-call authentication principal — its trust boundary is the host process /\n * MCP client that launches it. Run it only in a trusted context, or front it\n * with an authenticated gateway. Do not expose it directly to untrusted callers.\n */\n\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n  type CallToolRequest,\n  type ListToolsRequest,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\nimport { config } from '@happyvertical/smrt-config';\n${hasTenantScoped ? \"import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\\n\" : ''}\n// Server configuration\nconst SERVER_NAME = ${JSON.stringify(name)};\nconst SERVER_VERSION = ${JSON.stringify(version)};\nconst SERVER_DESCRIPTION = ${JSON.stringify(description)};\nconst DEBUG = ${debug};\n\n// Static tool definitions (generated at build time)\nconst TOOLS = ${toolsCode};\n${\n  hasTenantScoped\n    ? `\n// Fail-closed tenant context (#1554): tenant-scoped objects must run inside a\n// tenant. This stdio server has no auth principal, so the tenant is taken from\n// the environment; without it (and with tenancy enabled) tenant-scoped tools\n// throw rather than reading across all tenants.\nconst TENANT_SCOPED = new Set(${JSON.stringify(tenantScopedSet)});\nconst MCP_TENANT_ID = process.env.SMRT_MCP_TENANT_ID || undefined;\nconst MCP_ALLOW_CROSS_TENANT = process.env.SMRT_MCP_ALLOW_CROSS_TENANT === 'true';\n`\n    : ''\n}\nconst PUBLIC_JSON_OPTIONS = {\n  permissions: (process.env.SMRT_MCP_PERMISSIONS || '')\n    .split(',')\n    .map((permission) => permission.trim())\n    .filter(Boolean),\n};\n\n/**\n * Mass-assignment guard (#1540): strip framework/server-managed and\n * \\`@field({ readonly: true })\\` fields from create/update bodies, intersecting\n * with the optional \\`@smrt({ api: { writable: [...] } })\\` allowlist.\n */\nfunction applyWritablePolicy(objectName: string, data: any): Record<string, any> {\n  if (!data || typeof data !== 'object') return {};\n  const serverManaged = new Set([\n    'id', 'tenantId', 'tenant_id',\n    'createdAt', 'created_at', 'updatedAt', 'updated_at',\n  ]);\n  const readonly = new Set<string>();\n  let writable: string[] | null = null;\n  const apiConfig = ObjectRegistry.getConfig(objectName)?.api as any;\n  if (apiConfig && typeof apiConfig === 'object' && Array.isArray(apiConfig.writable)) {\n    writable = apiConfig.writable;\n  }\n  for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n    if (def && ((def as any).readonly === true || (def as any)._meta?.readonly === true)) {\n      readonly.add(name);\n    }\n  }\n  const result: Record<string, any> = {};\n  for (const [key, value] of Object.entries(data)) {\n    if (key.startsWith('_')) continue;\n    if (serverManaged.has(key)) continue;\n    if (readonly.has(key)) continue;\n    if (writable && !writable.includes(key)) continue;\n    result[key] = value;\n  }\n  return result;\n}\n\n/**\n * Sensitive-field-safe serialization for custom-action results (#1540).\n * Recurses through arrays and plain objects so nested SmrtObjects are stripped\n * too; non-plain instances (Date, etc.) and primitives pass through. Cycle-safe.\n */\nfunction toPublicResult(value: any, seen: WeakSet<object> = new WeakSet()): any {\n  if (value === null || typeof value !== 'object') return value;\n  if (typeof value.toPublicJSON === 'function') return value.toPublicJSON(PUBLIC_JSON_OPTIONS);\n  if (Array.isArray(value)) {\n    if (seen.has(value)) return value;\n    seen.add(value);\n    return value.map((entry: any) => toPublicResult(entry, seen));\n  }\n  const proto = Object.getPrototypeOf(value);\n  if (proto !== Object.prototype && proto !== null) return value;\n  if (seen.has(value)) return value;\n  seen.add(value);\n  const out: Record<string, any> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    out[key] = toPublicResult(entry, seen);\n  }\n  return out;\n}\n\n/**\n * Main server startup function\n */\nasync function main() {\n  try {\n    if (DEBUG) {\n      console.error(\\`[MCP] Starting server: \\${SERVER_NAME} v\\${SERVER_VERSION}\\`);\n    }\n${\n  hasTenantScoped\n    ? `\n    // Fail-closed tenant context (#1554): install the tenancy interceptor so\n    // tenant-scoped tools are actually filtered, and so the entry-point gate\n    // throws (rather than passing through) when no tenant is supplied. Without\n    // this, a tenant set via SMRT_MCP_TENANT_ID would only set async context\n    // with no interceptor to enforce it.\n    enableTenancy();\n`\n    : ''\n}\n    // Load configuration from environment and .smrt.config files\n    const appConfig = await config.load();\n    const aiConfig = appConfig?.ai || {};\n\n    if (DEBUG) {\n      console.error(\\`[MCP] Loaded \\${TOOLS.length} static tools\\`);\n      console.error(\\`[MCP] Available tools:\\`, TOOLS.map(t => t.name).join(', '));\n    }\n\n    // Create MCP server\n    const server = new Server(\n      {\n        name: SERVER_NAME,\n        version: SERVER_VERSION,\n      },\n      {\n        capabilities: {\n          tools: {},\n        },\n      }\n    );\n\n    // Register ListTools handler\n    server.setRequestHandler(ListToolsRequestSchema, async (_request: ListToolsRequest) => {\n      if (DEBUG) {\n        console.error(\\`[MCP] ListTools request received\\`);\n      }\n\n      return {\n        tools: TOOLS,\n      };\n    });\n\n    // Register CallTool handler\n    server.setRequestHandler(CallToolRequestSchema, async (request: CallToolRequest) => {\n      const { name: toolName, arguments: args = {} } = request.params;\n\n      if (DEBUG) {\n        console.error(\\`[MCP] CallTool request: \\${toolName}\\`);\n        console.error(\\`[MCP] Arguments:\\`, JSON.stringify(args, null, 2));\n      }\n\n      try {\n        // Static switch statement for tool execution\n        const runToolBody = async () => {\n          switch (toolName) {\n${switchCases}\n\n            default:\n              throw new Error(\\`Unknown tool: \\${toolName}\\`);\n          }\n        };\n${\n  hasTenantScoped\n    ? `\n        // Fail-closed tenant context for tenant-scoped tools (#1554).\n        const [toolObject] = toolName.split('_');\n        const result =\n          toolObject && TENANT_SCOPED.has(toolObject.toLowerCase())\n            ? await runTenantScopedEntryPoint(\n                { tenantScoped: true, tenantId: MCP_TENANT_ID, allowCrossTenant: MCP_ALLOW_CROSS_TENANT, surface: 'MCP' },\n                runToolBody,\n              )\n            : await runToolBody();`\n    : `\n        const result = await runToolBody();`\n}\n\n        if (DEBUG) {\n          console.error(\\`[MCP] Tool executed successfully: \\${toolName}\\`);\n        }\n\n        return result;\n      } catch (error) {\n        const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n        console.error(\\`[MCP] Tool execution failed: \\${toolName}\\`, error);\n\n        return {\n          content: [\n            {\n              type: 'text',\n              text: \\`Error executing tool \\${toolName}: \\${errorMessage}\\`,\n            },\n          ],\n          isError: true,\n        };\n      }\n    });\n\n    // Setup stdio transport\n    const transport = new StdioServerTransport();\n\n    // Connect server to transport\n    await server.connect(transport);\n\n    if (DEBUG) {\n      console.error(\\`[MCP] Server connected via stdio transport\\`);\n      console.error(\\`[MCP] Ready to receive requests\\`);\n    }\n\n    // Handle graceful shutdown\n    process.on('SIGINT', async () => {\n      if (DEBUG) {\n        console.error(\\`[MCP] Received SIGINT, shutting down gracefully\\`);\n      }\n      await server.close();\n      process.exit(0);\n    });\n\n    process.on('SIGTERM', async () => {\n      if (DEBUG) {\n        console.error(\\`[MCP] Received SIGTERM, shutting down gracefully\\`);\n      }\n      await server.close();\n      process.exit(0);\n    });\n  } catch (error) {\n    console.error('[MCP] Fatal error during server startup:', error);\n    process.exit(1);\n  }\n}\n\n// Start the server\nmain().catch((error) => {\n  console.error('[MCP] Unhandled error:', error);\n  process.exit(1);\n});\n`;\n}\n\n/**\n * Generate package.json script for running MCP server\n *\n * @param serverPath - Path to generated server file (relative to package root)\n * @returns Script command for package.json\n */\nexport function generateMCPScript(\n  serverPath: string = 'dist/mcp-server.js',\n): string {\n  return `node ${serverPath}`;\n}\n\n/**\n * Generate Claude Desktop configuration example\n *\n * @param serverName - Name for the MCP server\n * @param serverPath - Absolute path to server file\n * @returns Configuration object for claude_desktop_config.json\n */\nexport function generateClaudeConfig(\n  serverName: string,\n  serverPath: string,\n): object {\n  return {\n    mcpServers: {\n      [serverName]: {\n        command: 'node',\n        args: [serverPath],\n      },\n    },\n  };\n}\n\n/**\n * Generate README documentation for MCP server setup\n *\n * @param serverName - Name of the MCP server\n * @param serverPath - Path to the server file\n * @returns Markdown documentation\n */\nexport function generateMCPDocumentation(\n  serverName: string,\n  serverPath: string,\n): string {\n  return `# MCP Server Setup\n\nThis project includes an auto-generated MCP (Model Context Protocol) server that exposes SMRT objects as tools for AI integration.\n\n## Quick Start\n\n### 1. Build the MCP Server\n\n\\`\\`\\`bash\nnpm run build\n\\`\\`\\`\n\nThis generates the MCP server at: \\`${serverPath}\\`\n\n### 2. Configure Claude Desktop\n\nAdd the following to your Claude Desktop configuration file:\n\n**macOS**: \\`~/.config/Claude/claude_desktop_config.json\\`\n**Windows**: \\`%APPDATA%\\\\Claude\\\\claude_desktop_config.json\\`\n\n\\`\\`\\`json\n{\n  \"mcpServers\": {\n    \"${serverName}\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/${serverPath}\"]\n    }\n  }\n}\n\\`\\`\\`\n\nReplace \\`/absolute/path/to/\\` with the actual absolute path to your project directory.\n\n### 3. Restart Claude Desktop\n\nClose and reopen Claude Desktop to load the new MCP server.\n\n### 4. Test the Integration\n\nIn Claude Code, you can now use the auto-generated tools. For example:\n\n- \\`list_products\\` - List all products\n- \\`get_product\\` - Get a specific product by ID\n- \\`create_product\\` - Create a new product\n- And more...\n\n## Environment Variables\n\nThe MCP server supports optional environment variables:\n\n- \\`DATABASE_URL\\` - Database connection string\n\n**AI Provider Configuration (in priority order):**\n1. **Generic configuration** (supports any provider):\n   - \\`SMRT_AI_PROVIDER\\` - Provider name (e.g., 'openai', 'anthropic', 'claude-cli', 'gemini')\n   - \\`SMRT_AI_API_KEY\\` - API key for the provider\n   - \\`SMRT_AI_MODEL\\` - Model to use (optional)\n\n2. **Provider-specific fallbacks**:\n   - \\`OPENAI_API_KEY\\` - OpenAI API key (auto-detects provider as 'openai')\n   - \\`ANTHROPIC_API_KEY\\` - Anthropic API key (auto-detects provider as 'anthropic')\n   - \\`CLAUDE_API_KEY\\` + \\`CLAUDE_MODEL\\` - Claude CLI provider (defaults to 'sonnet')\n\n**Examples:**\n\\`\\`\\`bash\n# Using generic configuration (recommended)\nexport SMRT_AI_PROVIDER=claude-cli\nexport SMRT_AI_MODEL=sonnet\n\n# Using provider-specific configuration\nexport CLAUDE_API_KEY=your-key\nexport CLAUDE_MODEL=sonnet\n\n# Using OpenAI\nexport OPENAI_API_KEY=your-openai-key\n\\`\\`\\`\n\n## Troubleshooting\n\n### Server Not Appearing in Claude\n\n1. Check that the path in \\`claude_desktop_config.json\\` is absolute\n2. Verify the server file exists at the specified path\n3. Check Claude Desktop logs for errors\n\n### Tools Not Working\n\n1. Ensure your database is accessible (if using one)\n2. Check that SMRT objects are properly decorated with \\`@smrt()\\`\n3. Look for errors in the MCP server output\n\n### Debug Mode\n\nTo enable debug logging, set the \\`DEBUG\\` constant to \\`true\\` in the generated server file.\n\n## Generated Tools\n\nThe following tools are automatically generated from your SMRT objects:\n\n- **CRUD Operations**: \\`list_\\`, \\`get_\\`, \\`create_\\`, \\`update_\\`, \\`delete_\\` for each object type\n- **Custom Actions**: Any custom methods included in the \\`@smrt()\\` decorator configuration\n\nSee the SMRT object definitions for the complete list of available tools and their parameters.\n`;\n}\n"],"mappings":";;;;AAiBA,SAAS,WAAW,KAAqB;CACvC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC;AAClD;;;;;;;AA4CA,SAAgB,yBAAyB,UAA0B,CAAC,GAAW;CAC7E,MAAM,EACJ,OAAO,mBACP,UAAU,SACV,cAAc,+CACd,QAAQ,OACR,QAAQ,CAAC,GACT,sBAAsB,CAAC,MACrB;CAGJ,MAAM,YAAY,MAAM,SAAS,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI;CAKtE,MAAM,kBAAkB,MAAM,KAC5B,IAAI,IAAI,oBAAoB,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CACzD;CACA,MAAM,kBAAkB,gBAAgB,SAAS;CAGjD,MAAM,uBAAuB,WAAmB;EAC9C,OAAO,MACJ,KAAK,SAAS;GACb,MAAM,CAAC,YAAY,UAAU,KAAK,KAAK,MAAM,GAAG;GAEhD,QAAQ,QAAR;IACE,KAAK,QACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;IAEC,KAAK,OACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,iEAAiE,WAAW,UAAU,EAAE;EAC/F,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,iDAAiD,WAAW,UAAU,EAAE;EAC/E,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,SAEE,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;;EAEP,OAAO;EACP,OAAO,wDAAwD,OAAO;EACtE,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,uBAAuB,OAAO;EACrC,OAAO,8BAA8B,OAAO;EAC5C,OAAO;;EAEP,OAAO;EACP,OAAO,iCAAiC,OAAO;;EAE/C,OAAO;EACP,OAAO;GACD;EACF,CAAC,CAAC,CACD,KAAK,MAAM;CAChB;CAEA,MAAM,cAAc,oBAAoB,YAAY;CAEpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAwBP,kBAAkB,8FAA8F,GAAG;;sBAE/F,KAAK,UAAU,IAAI,EAAE;yBAClB,KAAK,UAAU,OAAO,EAAE;6BACpB,KAAK,UAAU,WAAW,EAAE;gBACzC,MAAM;;;gBAGN,UAAU;EAExB,kBACI;;;;;gCAK0B,KAAK,UAAU,eAAe,EAAE;;;IAI1D,GACL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0EC,kBACI;;;;;;;IAQA,GACL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CC,YAAY;;;;;;EAOZ,kBACI;;;;;;;;;sCAUA;6CAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DD;;;;;;;AAQA,SAAgB,kBACd,aAAqB,sBACb;CACR,OAAO,QAAQ;AACjB;;;;;;;;AASA,SAAgB,qBACd,YACA,YACQ;CACR,OAAO,EACL,YAAY,GACT,aAAa;EACZ,SAAS;EACT,MAAM,CAAC,UAAU;CACnB,EACF,EACF;AACF;;;;;;;;AASA,SAAgB,yBACd,YACA,YACQ;CACR,OAAO;;;;;;;;;;;;sCAY6B,WAAW;;;;;;;;;;;;OAY1C,WAAW;;oCAEkB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+E/C"}
+{"version":3,"file":"mcp-runtime-template.js","names":[],"sources":["../../src/generators/mcp-runtime-template.ts"],"sourcesContent":["/**\n * Runtime bootstrap template for generated MCP servers\n *\n * This template provides stdio transport integration for SMRT-generated MCP servers.\n * It handles:\n * - Server initialization with @modelcontextprotocol/sdk\n * - Tool registration from MCPGenerator\n * - Stdio transport connection\n * - Error handling and logging\n * - Graceful shutdown\n */\n\nimport type { CustomActionScope } from './custom-action.js';\nimport type { MCPConfig, MCPContext } from './mcp.js';\n\n/**\n * Helper function to capitalize first letter\n */\nfunction capitalize(str: string): string {\n  return str.charAt(0).toUpperCase() + str.slice(1);\n}\n\nexport interface RuntimeOptions {\n  /** Server name (defaults to package name) */\n  name?: string;\n\n  /** Server version (defaults to package version) */\n  version?: string;\n\n  /** Server description */\n  description?: string;\n\n  /** MCP generator configuration */\n  config?: MCPConfig;\n\n  /** MCP context (database, AI client, etc.) */\n  context?: MCPContext;\n\n  /** Enable debug logging */\n  debug?: boolean;\n\n  /** Static tool definitions (generated at build time) */\n  tools?: Array<{\n    name: string;\n    description: string;\n    inputSchema: Record<string, unknown>;\n  }>;\n  /** Internal invocation metadata; never exposed by the MCP tools/list result. */\n  customActions?: Record<\n    string,\n    {\n      scope: CustomActionScope;\n      isStatic: boolean;\n      /** Declared method name; tool IDs are lowercased protocol aliases. */\n      methodName?: string;\n      parameterNames?: string[];\n      optionsParameter?: boolean;\n      legacyOptions: boolean;\n    }\n  >;\n\n  /**\n   * Lowercased simple names of objects that are `@TenantScoped` (#1554). When\n   * non-empty, the generated server imports the tenancy fail-closed gate and\n   * wraps tenant-scoped tool calls so a stdio invocation cannot read across all\n   * tenants. The tenant is sourced from `SMRT_MCP_TENANT_ID` /\n   * `SMRT_MCP_ALLOW_CROSS_TENANT` env vars (this server has no auth principal).\n   */\n  tenantScopedObjects?: string[];\n}\n\n/**\n * Generate runtime bootstrap code for MCP server\n *\n * @param options - Runtime configuration options\n * @returns TypeScript code for server entry point\n */\nexport function generateRuntimeBootstrap(options: RuntimeOptions = {}): string {\n  const {\n    name = 'smrt-mcp-server',\n    version = '1.0.0',\n    description = 'Auto-generated MCP server from SMRT objects',\n    debug = false,\n    tools = [],\n    customActions = {},\n    tenantScopedObjects = [],\n  } = options;\n\n  // Generate static tool array as TypeScript code\n  const toolsCode = tools.length > 0 ? JSON.stringify(tools, null, 2) : '[]';\n\n  // Fail-closed tenant context (#1554): only wire the tenancy gate when at\n  // least one exposed object is tenant-scoped, so apps without tenancy never\n  // get a dangling import.\n  const tenantScopedSet = Array.from(\n    new Set(tenantScopedObjects.map((n) => n.toLowerCase())),\n  );\n  const hasTenantScoped = tenantScopedSet.length > 0;\n\n  // Generate static switch cases using shared helper\n  const generateSwitchCases = (indent: string) => {\n    return tools\n      .map((tool) => {\n        const separator = tool.name.indexOf('_');\n        const objectName = tool.name.slice(0, separator);\n        const action = tool.name.slice(separator + 1);\n\n        switch (action) {\n          case 'list':\n            return `${indent}case '${tool.name}': {\n${indent}  const limit = args.limit ?? 50;\n${indent}  const offset = args.offset ?? 0;\n${indent}  const where = args.where ?? {};\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const items = await collection.list({ where, limit, offset });\n${indent}  const itemsPublic = items.map((item) => item.toPublicJSON(PUBLIC_JSON_OPTIONS));\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(itemsPublic) }] };\n${indent}}`;\n\n          case 'get':\n            return `${indent}case '${tool.name}': {\n${indent}  if (!args.id && !args.slug) {\n${indent}    throw new Error('Either id or slug is required');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const filter = args.id || args.slug;\n${indent}  const item = await collection.get(filter);\n\n${indent}  if (!item) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(item.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'create':\n            return `${indent}case '${tool.name}': {\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const newItem = await collection.create(applyWritablePolicy('${capitalize(objectName)}', args));\n${indent}  await newItem.save();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(newItem.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'update':\n            return `${indent}case '${tool.name}': {\n${indent}  const { id, ...updateData } = args;\n${indent}  if (!id) {\n${indent}    throw new Error('ID is required for update');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const existing = await collection.get(id);\n${indent}  if (!existing) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  Object.assign(existing, applyWritablePolicy('${capitalize(objectName)}', updateData));\n${indent}  await existing.save();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(existing.toPublicJSON(PUBLIC_JSON_OPTIONS)) }] };\n${indent}}`;\n\n          case 'delete':\n            return `${indent}case '${tool.name}': {\n${indent}  if (!args.id) {\n${indent}    throw new Error('ID is required for delete');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const toDelete = await collection.get(args.id);\n${indent}  if (!toDelete) {\n${indent}    throw new Error('Object not found');\n${indent}  }\n\n${indent}  await toDelete.delete();\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify({ success: true, message: 'Object deleted successfully' }) }] };\n${indent}}`;\n\n          default:\n            // Custom action. Its descriptor is deliberately kept separate\n            // from TOOLS so MCP clients receive only protocol-defined fields.\n            return `${indent}case '${tool.name}': {\n${indent}  const actionMeta = CUSTOM_ACTIONS['${tool.name}'] || { scope: 'item', isStatic: false, legacyOptions: true };\n${indent}  const { id, options, ...directArgs } = args;\n\n${indent}  if (actionMeta.scope === 'item' && !id) {\n${indent}    throw new Error('ID is required for custom action ${action}');\n${indent}  }\n${indent}  if (actionMeta.scope === 'collection' && id) {\n${indent}    throw new Error('Custom action ${action} is collection-scoped and does not accept an ID');\n${indent}  }\n\n${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {\n${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },\n${indent}    ai: aiConfig\n${indent}  });\n\n${indent}  const target = actionMeta.scope === 'item'\n${indent}    ? await collection.get(id)\n${indent}    : actionMeta.isStatic\n${indent}      ? ObjectRegistry.getClass('${capitalize(objectName)}')?.constructor\n${indent}      : collection;\n${indent}  if (!target) {\n${indent}    throw new Error(actionMeta.scope === 'item' ? 'Object not found' : 'Custom action target not found');\n${indent}  }\n${indent}  const actionMethod = target[actionMeta.methodName || '${action}'];\n${indent}  if (typeof actionMethod !== 'function') {\n${indent}    throw new Error('Method ${action} not found on custom action target');\n${indent}  }\n\n${indent}  const methodArgs = actionMeta.legacyOptions\n${indent}    ? [Object.keys(options ?? {}).length > 0 ? options : directArgs]\n${indent}    : actionMeta.optionsParameter\n${indent}      ? [options]\n${indent}      : (actionMeta.parameterNames || []).map((parameterName) => args[\n${indent}          parameterName === 'id'\n${indent}            ? 'actionId'\n${indent}            : parameterName\n${indent}        ]);\n${indent}  const result = await actionMethod.call(target, ...methodArgs);\n${indent}  const failure = normalizeCustomActionFailure(result);\n${indent}  if (failure) {\n${indent}    return {\n${indent}      content: [{ type: 'text', text: JSON.stringify({ error: failure }) }],\n${indent}      isError: true,\n${indent}      _meta: { [SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY]: failure },\n${indent}    };\n${indent}  }\n\n${indent}  return { content: [{ type: 'text', text: JSON.stringify(toPublicResult(result)) }] };\n${indent}}`;\n        }\n      })\n      .join('\\n\\n');\n  };\n\n  const switchCases = generateSwitchCases('          ');\n\n  return `#!/usr/bin/env node\n/**\n * Auto-generated MCP Server\n * Generated by @smrt/core MCPGenerator\n *\n * This server exposes SMRT objects as MCP tools for AI integration.\n *\n * SECURITY (#1540): tool responses exclude @field({ sensitive }) fields and\n * create/update bodies are mass-assignment guarded. This stdio server has NO\n * per-call authentication principal — its trust boundary is the host process /\n * MCP client that launches it. Run it only in a trusted context, or front it\n * with an authenticated gateway. Do not expose it directly to untrusted callers.\n */\n\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n  type CallToolRequest,\n  type ListToolsRequest,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { ObjectRegistry } from '@happyvertical/smrt-core';\nimport { normalizeCustomActionFailure, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY } from '@happyvertical/smrt-core';\nimport { config } from '@happyvertical/smrt-config';\n${hasTenantScoped ? \"import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\\n\" : ''}\n// Server configuration\nconst SERVER_NAME = ${JSON.stringify(name)};\nconst SERVER_VERSION = ${JSON.stringify(version)};\nconst SERVER_DESCRIPTION = ${JSON.stringify(description)};\nconst DEBUG = ${debug};\n\n// Static tool definitions (generated at build time)\nconst TOOLS = ${toolsCode};\nconst CUSTOM_ACTIONS = ${JSON.stringify(customActions)};\n${\n  hasTenantScoped\n    ? `\n// Fail-closed tenant context (#1554): tenant-scoped objects must run inside a\n// tenant. This stdio server has no auth principal, so the tenant is taken from\n// the environment; without it (and with tenancy enabled) tenant-scoped tools\n// throw rather than reading across all tenants.\nconst TENANT_SCOPED = new Set(${JSON.stringify(tenantScopedSet)});\nconst MCP_TENANT_ID = process.env.SMRT_MCP_TENANT_ID || undefined;\nconst MCP_ALLOW_CROSS_TENANT = process.env.SMRT_MCP_ALLOW_CROSS_TENANT === 'true';\n`\n    : ''\n}\nconst PUBLIC_JSON_OPTIONS = {\n  permissions: (process.env.SMRT_MCP_PERMISSIONS || '')\n    .split(',')\n    .map((permission) => permission.trim())\n    .filter(Boolean),\n};\n\n/**\n * Mass-assignment guard (#1540): strip framework/server-managed and\n * \\`@field({ readonly: true })\\` fields from create/update bodies, intersecting\n * with the optional \\`@smrt({ api: { writable: [...] } })\\` allowlist.\n */\nfunction applyWritablePolicy(objectName: string, data: any): Record<string, any> {\n  if (!data || typeof data !== 'object') return {};\n  const serverManaged = new Set([\n    'id', 'tenantId', 'tenant_id',\n    'createdAt', 'created_at', 'updatedAt', 'updated_at',\n  ]);\n  const readonly = new Set<string>();\n  let writable: string[] | null = null;\n  const apiConfig = ObjectRegistry.getConfig(objectName)?.api as any;\n  if (apiConfig && typeof apiConfig === 'object' && Array.isArray(apiConfig.writable)) {\n    writable = apiConfig.writable;\n  }\n  for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n    if (def && ((def as any).readonly === true || (def as any)._meta?.readonly === true)) {\n      readonly.add(name);\n    }\n  }\n  const result: Record<string, any> = {};\n  for (const [key, value] of Object.entries(data)) {\n    if (key.startsWith('_')) continue;\n    if (serverManaged.has(key)) continue;\n    if (readonly.has(key)) continue;\n    if (writable && !writable.includes(key)) continue;\n    result[key] = value;\n  }\n  return result;\n}\n\n/**\n * Sensitive-field-safe serialization for custom-action results (#1540).\n * Recurses through arrays and plain objects so nested SmrtObjects are stripped\n * too; non-plain instances (Date, etc.) and primitives pass through. Cycle-safe.\n */\nfunction toPublicResult(value: any, seen: WeakSet<object> = new WeakSet()): any {\n  if (value === null || typeof value !== 'object') return value;\n  if (typeof value.toPublicJSON === 'function') return value.toPublicJSON(PUBLIC_JSON_OPTIONS);\n  if (Array.isArray(value)) {\n    if (seen.has(value)) return value;\n    seen.add(value);\n    return value.map((entry: any) => toPublicResult(entry, seen));\n  }\n  const proto = Object.getPrototypeOf(value);\n  if (proto !== Object.prototype && proto !== null) return value;\n  if (seen.has(value)) return value;\n  seen.add(value);\n  const out: Record<string, any> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    out[key] = toPublicResult(entry, seen);\n  }\n  return out;\n}\n\n/**\n * Main server startup function\n */\nasync function main() {\n  try {\n    if (DEBUG) {\n      console.error(\\`[MCP] Starting server: \\${SERVER_NAME} v\\${SERVER_VERSION}\\`);\n    }\n${\n  hasTenantScoped\n    ? `\n    // Fail-closed tenant context (#1554): install the tenancy interceptor so\n    // tenant-scoped tools are actually filtered, and so the entry-point gate\n    // throws (rather than passing through) when no tenant is supplied. Without\n    // this, a tenant set via SMRT_MCP_TENANT_ID would only set async context\n    // with no interceptor to enforce it.\n    enableTenancy();\n`\n    : ''\n}\n    // Load configuration from environment and .smrt.config files\n    const appConfig = await config.load();\n    const aiConfig = appConfig?.ai || {};\n\n    if (DEBUG) {\n      console.error(\\`[MCP] Loaded \\${TOOLS.length} static tools\\`);\n      console.error(\\`[MCP] Available tools:\\`, TOOLS.map(t => t.name).join(', '));\n    }\n\n    // Create MCP server\n    const server = new Server(\n      {\n        name: SERVER_NAME,\n        version: SERVER_VERSION,\n      },\n      {\n        capabilities: {\n          tools: {},\n        },\n      }\n    );\n\n    // Register ListTools handler\n    server.setRequestHandler(ListToolsRequestSchema, async (_request: ListToolsRequest) => {\n      if (DEBUG) {\n        console.error(\\`[MCP] ListTools request received\\`);\n      }\n\n      return {\n        tools: TOOLS,\n      };\n    });\n\n    // Register CallTool handler\n    server.setRequestHandler(CallToolRequestSchema, async (request: CallToolRequest) => {\n      const { name: toolName, arguments: args = {} } = request.params;\n\n      if (DEBUG) {\n        console.error(\\`[MCP] CallTool request: \\${toolName}\\`);\n        console.error(\\`[MCP] Arguments:\\`, JSON.stringify(args, null, 2));\n      }\n\n      try {\n        // Static switch statement for tool execution\n        const runToolBody = async () => {\n          switch (toolName) {\n${switchCases}\n\n            default:\n              throw new Error(\\`Unknown tool: \\${toolName}\\`);\n          }\n        };\n${\n  hasTenantScoped\n    ? `\n        // Fail-closed tenant context for tenant-scoped tools (#1554).\n        const [toolObject] = toolName.split('_');\n        const result =\n          toolObject && TENANT_SCOPED.has(toolObject.toLowerCase())\n            ? await runTenantScopedEntryPoint(\n                { tenantScoped: true, tenantId: MCP_TENANT_ID, allowCrossTenant: MCP_ALLOW_CROSS_TENANT, surface: 'MCP' },\n                runToolBody,\n              )\n            : await runToolBody();`\n    : `\n        const result = await runToolBody();`\n}\n\n        if (DEBUG) {\n          console.error(\\`[MCP] Tool executed successfully: \\${toolName}\\`);\n        }\n\n        return result;\n      } catch (error) {\n        const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n        console.error(\\`[MCP] Tool execution failed: \\${toolName}\\`, error);\n\n        return {\n          content: [\n            {\n              type: 'text',\n              text: \\`Error executing tool \\${toolName}: \\${errorMessage}\\`,\n            },\n          ],\n          isError: true,\n        };\n      }\n    });\n\n    // Setup stdio transport\n    const transport = new StdioServerTransport();\n\n    // Connect server to transport\n    await server.connect(transport);\n\n    if (DEBUG) {\n      console.error(\\`[MCP] Server connected via stdio transport\\`);\n      console.error(\\`[MCP] Ready to receive requests\\`);\n    }\n\n    // Handle graceful shutdown\n    process.on('SIGINT', async () => {\n      if (DEBUG) {\n        console.error(\\`[MCP] Received SIGINT, shutting down gracefully\\`);\n      }\n      await server.close();\n      process.exit(0);\n    });\n\n    process.on('SIGTERM', async () => {\n      if (DEBUG) {\n        console.error(\\`[MCP] Received SIGTERM, shutting down gracefully\\`);\n      }\n      await server.close();\n      process.exit(0);\n    });\n  } catch (error) {\n    console.error('[MCP] Fatal error during server startup:', error);\n    process.exit(1);\n  }\n}\n\n// Start the server\nmain().catch((error) => {\n  console.error('[MCP] Unhandled error:', error);\n  process.exit(1);\n});\n`;\n}\n\n/**\n * Generate package.json script for running MCP server\n *\n * @param serverPath - Path to generated server file (relative to package root)\n * @returns Script command for package.json\n */\nexport function generateMCPScript(\n  serverPath: string = 'dist/mcp-server.js',\n): string {\n  return `node ${serverPath}`;\n}\n\n/**\n * Generate Claude Desktop configuration example\n *\n * @param serverName - Name for the MCP server\n * @param serverPath - Absolute path to server file\n * @returns Configuration object for claude_desktop_config.json\n */\nexport function generateClaudeConfig(\n  serverName: string,\n  serverPath: string,\n): object {\n  return {\n    mcpServers: {\n      [serverName]: {\n        command: 'node',\n        args: [serverPath],\n      },\n    },\n  };\n}\n\n/**\n * Generate README documentation for MCP server setup\n *\n * @param serverName - Name of the MCP server\n * @param serverPath - Path to the server file\n * @returns Markdown documentation\n */\nexport function generateMCPDocumentation(\n  serverName: string,\n  serverPath: string,\n): string {\n  return `# MCP Server Setup\n\nThis project includes an auto-generated MCP (Model Context Protocol) server that exposes SMRT objects as tools for AI integration.\n\n## Quick Start\n\n### 1. Build the MCP Server\n\n\\`\\`\\`bash\nnpm run build\n\\`\\`\\`\n\nThis generates the MCP server at: \\`${serverPath}\\`\n\n### 2. Configure Claude Desktop\n\nAdd the following to your Claude Desktop configuration file:\n\n**macOS**: \\`~/.config/Claude/claude_desktop_config.json\\`\n**Windows**: \\`%APPDATA%\\\\Claude\\\\claude_desktop_config.json\\`\n\n\\`\\`\\`json\n{\n  \"mcpServers\": {\n    \"${serverName}\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/${serverPath}\"]\n    }\n  }\n}\n\\`\\`\\`\n\nReplace \\`/absolute/path/to/\\` with the actual absolute path to your project directory.\n\n### 3. Restart Claude Desktop\n\nClose and reopen Claude Desktop to load the new MCP server.\n\n### 4. Test the Integration\n\nIn Claude Code, you can now use the auto-generated tools. For example:\n\n- \\`list_products\\` - List all products\n- \\`get_product\\` - Get a specific product by ID\n- \\`create_product\\` - Create a new product\n- And more...\n\n## Environment Variables\n\nThe MCP server supports optional environment variables:\n\n- \\`DATABASE_URL\\` - Database connection string\n\n**AI Provider Configuration (in priority order):**\n1. **Generic configuration** (supports any provider):\n   - \\`SMRT_AI_PROVIDER\\` - Provider name (e.g., 'openai', 'anthropic', 'claude-cli', 'gemini')\n   - \\`SMRT_AI_API_KEY\\` - API key for the provider\n   - \\`SMRT_AI_MODEL\\` - Model to use (optional)\n\n2. **Provider-specific fallbacks**:\n   - \\`OPENAI_API_KEY\\` - OpenAI API key (auto-detects provider as 'openai')\n   - \\`ANTHROPIC_API_KEY\\` - Anthropic API key (auto-detects provider as 'anthropic')\n   - \\`CLAUDE_API_KEY\\` + \\`CLAUDE_MODEL\\` - Claude CLI provider (defaults to 'sonnet')\n\n**Examples:**\n\\`\\`\\`bash\n# Using generic configuration (recommended)\nexport SMRT_AI_PROVIDER=claude-cli\nexport SMRT_AI_MODEL=sonnet\n\n# Using provider-specific configuration\nexport CLAUDE_API_KEY=your-key\nexport CLAUDE_MODEL=sonnet\n\n# Using OpenAI\nexport OPENAI_API_KEY=your-openai-key\n\\`\\`\\`\n\n## Troubleshooting\n\n### Server Not Appearing in Claude\n\n1. Check that the path in \\`claude_desktop_config.json\\` is absolute\n2. Verify the server file exists at the specified path\n3. Check Claude Desktop logs for errors\n\n### Tools Not Working\n\n1. Ensure your database is accessible (if using one)\n2. Check that SMRT objects are properly decorated with \\`@smrt()\\`\n3. Look for errors in the MCP server output\n\n### Debug Mode\n\nTo enable debug logging, set the \\`DEBUG\\` constant to \\`true\\` in the generated server file.\n\n## Generated Tools\n\nThe following tools are automatically generated from your SMRT objects:\n\n- **CRUD Operations**: \\`list_\\`, \\`get_\\`, \\`create_\\`, \\`update_\\`, \\`delete_\\` for each object type\n- **Custom Actions**: Any custom methods included in the \\`@smrt()\\` decorator configuration\n\nSee the SMRT object definitions for the complete list of available tools and their parameters.\n`;\n}\n"],"mappings":";;;;AAkBA,SAAS,WAAW,KAAqB;CACvC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC;AAClD;;;;;;;AAyDA,SAAgB,yBAAyB,UAA0B,CAAC,GAAW;CAC7E,MAAM,EACJ,OAAO,mBACP,UAAU,SACV,cAAc,+CACd,QAAQ,OACR,QAAQ,CAAC,GACT,gBAAgB,CAAC,GACjB,sBAAsB,CAAC,MACrB;CAGJ,MAAM,YAAY,MAAM,SAAS,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI;CAKtE,MAAM,kBAAkB,MAAM,KAC5B,IAAI,IAAI,oBAAoB,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CACzD;CACA,MAAM,kBAAkB,gBAAgB,SAAS;CAGjD,MAAM,uBAAuB,WAAmB;EAC9C,OAAO,MACJ,KAAK,SAAS;GACb,MAAM,YAAY,KAAK,KAAK,QAAQ,GAAG;GACvC,MAAM,aAAa,KAAK,KAAK,MAAM,GAAG,SAAS;GAC/C,MAAM,SAAS,KAAK,KAAK,MAAM,YAAY,CAAC;GAE5C,QAAQ,QAAR;IACE,KAAK,QACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;IAEC,KAAK,OACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,iEAAiE,WAAW,UAAU,EAAE;EAC/F,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,iDAAiD,WAAW,UAAU,EAAE;EAC/E,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,KAAK,UACH,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;;EAEP,OAAO;EACP,OAAO;IAEC,SAGE,OAAO,GAAG,OAAO,QAAQ,KAAK,KAAK;EAC7C,OAAO,uCAAuC,KAAK,KAAK;EACxD,OAAO;;EAEP,OAAO;EACP,OAAO,wDAAwD,OAAO;EACtE,OAAO;EACP,OAAO;EACP,OAAO,qCAAqC,OAAO;EACnD,OAAO;;EAEP,OAAO,2DAA2D,WAAW,UAAU,EAAE;EACzF,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO,mCAAmC,WAAW,UAAU,EAAE;EACjE,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO,0DAA0D,OAAO;EACxE,OAAO;EACP,OAAO,8BAA8B,OAAO;EAC5C,OAAO;;EAEP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;;EAEP,OAAO;EACP,OAAO;GACD;EACF,CAAC,CAAC,CACD,KAAK,MAAM;CAChB;CAEA,MAAM,cAAc,oBAAoB,YAAY;CAEpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;EAyBP,kBAAkB,8FAA8F,GAAG;;sBAE/F,KAAK,UAAU,IAAI,EAAE;yBAClB,KAAK,UAAU,OAAO,EAAE;6BACpB,KAAK,UAAU,WAAW,EAAE;gBACzC,MAAM;;;gBAGN,UAAU;yBACD,KAAK,UAAU,aAAa,EAAE;EAErD,kBACI;;;;;gCAK0B,KAAK,UAAU,eAAe,EAAE;;;IAI1D,GACL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0EC,kBACI;;;;;;;IAQA,GACL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CC,YAAY;;;;;;EAOZ,kBACI;;;;;;;;;sCAUA;6CAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DD;;;;;;;AAQA,SAAgB,kBACd,aAAqB,sBACb;CACR,OAAO,QAAQ;AACjB;;;;;;;;AASA,SAAgB,qBACd,YACA,YACQ;CACR,OAAO,EACL,YAAY,GACT,aAAa;EACZ,SAAS;EACT,MAAM,CAAC,UAAU;CACnB,EACF,EACF;AACF;;;;;;;;AASA,SAAgB,yBACd,YACA,YACQ;CACR,OAAO;;;;;;;;;;;;sCAY6B,WAAW;;;;;;;;;;;;OAY1C,WAAW;;oCAEkB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+E/C"}

package/dist/generators/mcp.d.ts

@@ -67,6 +67,8 @@ export interface MCPResponse {
         type: 'text';
         text: string;
     }>;
+    isError?: boolean;
+    _meta?: Record<string, unknown>;
 }
 /**
  * Generate MCP server from smrt objects
@@ -92,6 +94,9 @@ export declare class MCPGenerator {
      * Generate tools for a specific object
      */
     private generateObjectTools;
+    private buildCustomActionTool;
+    private resolveCustomActionMetadata;
+    private hasCollectionReceiver;
     /**
      * Validate that a custom method exists on a class
      */
@@ -209,6 +214,7 @@ export declare class MCPGenerator {
         /** Generate modular directory structure (tools/, handlers/, config.ts) */
         modular?: boolean;
     }): Promise<void>;
+    private runtimeCustomActions;
     /**
      * Generate modular MCP server structure
      *

package/dist/generators/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/generators/mcp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH;;;;GAIG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C;;;GAGG;AACH,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AASxC,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,QAAQ,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,WAAW,CAAiD;gBAExD,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAc5D;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IA4CzC;;OAEG;YACW,mBAAmB;IAmQjC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkDxB;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IA8E/D;;OAEG;YACW,aAAa;IAuC3B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,oBAAoB;IAI5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;OAEG;IACH;;;;;OAKG;IACH,OAAO,CAAC,eAAe;YAmBT,aAAa;IAyB3B;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IAqCrC;;;OAGG;YACW,SAAS;IAiIvB;;OAEG;YACW,mBAAmB;IAiEjC;;OAEG;IACH,aAAa;;;;;IAQb;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,cAAc,CAClB,OAAO,GAAE;QACP,wDAAwD;QACxD,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,oCAAoC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,qBAAqB;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QAEvB,2BAA2B;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;QAEhB,oDAAoD;QACpD,wBAAwB,CAAC,EAAE,OAAO,CAAC;QAEnC,oCAAoC;QACpC,cAAc,CAAC,EAAE,OAAO,CAAC;QAEzB,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;KACd,GACL,OAAO,CAAC,IAAI,CAAC;IA0EhB;;;;;;;;;;OAUG;YACW,qBAAqB;IA6CnC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;OAEG;YACW,iBAAiB;IAgB/B;;OAEG;YACW,uBAAuB;IA8IrC;;OAEG;YACW,oBAAoB;IA0JlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;CA4G7B"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/generators/mcp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4BH;;;;GAIG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C;;;GAGG;AACH,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AASxC,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,QAAQ,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AA6BD;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,WAAW,CAAiD;gBAExD,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAc5D;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IA4CzC;;OAEG;YACW,mBAAmB;IA2OjC,OAAO,CAAC,qBAAqB;IAsB7B,OAAO,CAAC,2BAA2B;IAcnC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkDxB;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IA4F/D;;OAEG;YACW,aAAa;IAuC3B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,oBAAoB;IAI5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;OAEG;IACH;;;;;OAKG;IACH,OAAO,CAAC,eAAe;YAmBT,aAAa;IAyB3B;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IAqCrC;;;OAGG;YACW,SAAS;IAsIvB;;OAEG;YACW,mBAAmB;IA4GjC;;OAEG;IACH,aAAa;;;;;IAQb;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,cAAc,CAClB,OAAO,GAAE;QACP,wDAAwD;QACxD,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,oCAAoC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,qBAAqB;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QAEvB,2BAA2B;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;QAEhB,oDAAoD;QACpD,wBAAwB,CAAC,EAAE,OAAO,CAAC;QAEnC,oCAAoC;QACpC,cAAc,CAAC,EAAE,OAAO,CAAC;QAEzB,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;KACd,GACL,OAAO,CAAC,IAAI,CAAC;YA2EF,oBAAoB;IAiDlC;;;;;;;;;;OAUG;YACW,qBAAqB;IA6CnC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;OAEG;YACW,iBAAiB;IAgB/B;;OAEG;YACW,uBAAuB;IAgNrC;;OAEG;YACW,oBAAoB;IA0JlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;CA4G7B"}

package/dist/generators/mcp.js

@@ -1,3 +1,4 @@
+import { SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildCustomActionInputSchema, buildCustomActionInvocationArgs, customActionParameterInputName, normalizeCustomActionFailure, resolveCustomActionMetadata } from "./custom-action.js";
 import { ObjectRegistry } from "../registry.js";
 import { SmrtCollection } from "../collection.js";
 import { runWithTenantGate } from "./tenant-gate.js";
@@ -10,6 +11,26 @@ import { mkdir, writeFile } from "node:fs/promises";
 *
 * Exposes smrt objects as AI tools for Claude, GPT, and other AI models
 */
+var CustomActionFailureError = class extends Error {
+	failure;
+	constructor(failure) {
+		super(failure.message);
+		this.failure = failure;
+		this.name = "CustomActionFailureError";
+	}
+};
+/**
+* MCP tool identifiers are lowercase for stable protocol vocabulary, while
+* JavaScript method names retain their declared casing. Resolve a tool suffix
+* back to the registry's canonical method name before inspecting metadata or
+* invoking it.
+*/
+function resolveCustomActionMethod(methods, toolAction) {
+	const direct = methods.get(toolAction);
+	if (direct) return [toolAction, direct];
+	for (const [methodName, method] of methods) if (methodName.toLowerCase() === toolAction.toLowerCase()) return [methodName, method];
+	return [toolAction, void 0];
+}
 /**
 * Generate MCP server from smrt objects
 */
@@ -191,54 +212,35 @@ var MCPGenerator = class {
 				}
 				const methodDef = methods.get(methodName);
 				if (methodDef && !methodDef.isPublic) continue;
-				const toolName = `${lowerName}_${methodName}`.toLowerCase();
-				tools.push({
-					name: toolName,
-					description: `Execute ${methodName} action on ${objectName}`,
-					inputSchema: {
-						type: "object",
-						properties: {
-							id: {
-								type: "string",
-								description: "ID of the object to execute action on"
-							},
-							options: {
-								type: "object",
-								description: "Additional options for the custom action",
-								additionalProperties: true
-							}
-						},
-						required: ["id"]
-					}
-				});
+				tools.push(this.buildCustomActionTool(objectName, lowerName, methodName, methodDef, this.hasCollectionReceiver(classInfo)));
 			}
 			else for (const [methodName, methodDef] of methods) {
 				if (!methodDef.isPublic) continue;
 				if (excluded.includes(methodName)) continue;
-				const toolName = `${lowerName}_${methodName}`.toLowerCase();
-				tools.push({
-					name: toolName,
-					description: `Execute ${methodName} action on ${objectName}`,
-					inputSchema: {
-						type: "object",
-						properties: {
-							id: {
-								type: "string",
-								description: "ID of the object to execute action on"
-							},
-							options: {
-								type: "object",
-								description: "Additional options for the custom action",
-								additionalProperties: true
-							}
-						},
-						required: ["id"]
-					}
-				});
+				tools.push(this.buildCustomActionTool(objectName, lowerName, methodName, methodDef, this.hasCollectionReceiver(classInfo)));
 			}
 		}
 		return tools;
 	}
+	buildCustomActionTool(objectName, lowerName, methodName, methodDef, collectionReceiver = false) {
+		const metadata = this.resolveCustomActionMetadata(objectName, methodName, methodDef, collectionReceiver);
+		return {
+			name: `${lowerName}_${methodName}`.toLowerCase(),
+			description: `Execute ${methodName} action on ${objectName}`,
+			inputSchema: buildCustomActionInputSchema(metadata)
+		};
+	}
+	resolveCustomActionMetadata(objectName, action, method, collectionReceiver = false) {
+		return resolveCustomActionMetadata({
+			actionName: action,
+			method,
+			apiConfig: ObjectRegistry.getConfig(objectName).api,
+			...collectionReceiver ? { defaultScope: "collection" } : {}
+		});
+	}
+	hasCollectionReceiver(classInfo) {
+		return !!classInfo && classInfo.constructor.prototype instanceof SmrtCollection;
+	}
 	/**
 	* Validate that a custom method exists on a class
 	*/
@@ -322,6 +324,14 @@ var MCPGenerator = class {
 				text: JSON.stringify(result, null, 2)
 			}] };
 		} catch (error) {
+			if (error instanceof CustomActionFailureError) return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({ error: error.failure })
+				}],
+				isError: true,
+				_meta: { [SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY]: error.failure }
+			};
 			return { content: [{
 				type: "text",
 				text: `Error: ${error instanceof Error ? error.message : "Unknown error"}`
@@ -535,7 +545,7 @@ var MCPGenerator = class {
 				};
 			}
 			default: {
-				const result = await this.executeCustomAction(collection, action, args);
+				const result = await this.executeCustomAction(collection, action, args, objectName);
 				return this.toPublicData(result);
 			}
 		}
@@ -543,26 +553,43 @@ var MCPGenerator = class {
 	/**
 	* Execute a custom action on a collection/object
 	*/
-	async executeCustomAction(collection, action, args) {
-		const { id, options: rawOptions = {}, ...directArgs } = args;
-		const options = rawOptions;
+	async executeCustomAction(collection, action, args, objectName) {
+		const id = args.id;
+		const [methodName, methodDef] = objectName ? resolveCustomActionMethod(await ObjectRegistry.getAllMethods(objectName), action) : [action, void 0];
+		const metadata = this.resolveCustomActionMetadata(objectName ?? "", methodName, methodDef, objectName ? this.hasCollectionReceiver(ObjectRegistry.getClass(objectName)) : false);
+		const methodArgs = buildCustomActionInvocationArgs(metadata, args);
 		try {
+			if (methodDef && metadata.idRequired && !id) throw new Error(`ID is required for custom action '${action}'`);
+			if (!metadata.idRequired && id && methodDef) throw new Error(`Custom action '${action}' is collection-scoped and does not accept an ID`);
 			if (id) {
 				const object = await collection.get(id);
 				if (!object) throw new Error("Object not found");
-				const objectMethod = object[action];
+				const objectMethod = object[methodName];
 				if (typeof objectMethod === "function") {
-					const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
-					return await objectMethod.call(object, methodArgs);
-				} else throw new Error(`Method '${action}' not found on object instance`);
+					const result = await objectMethod.call(object, ...methodArgs);
+					const failure = normalizeCustomActionFailure(result);
+					if (failure) throw new CustomActionFailureError(failure);
+					return result;
+				} else throw new Error(`Method '${methodName}' not found on object instance`);
+			} else if (metadata.isStatic && objectName) {
+				const classInfo = ObjectRegistry.getClass(objectName);
+				const classMethod = (classInfo?.constructor)?.[methodName];
+				if (typeof classMethod !== "function") throw new Error(`Static method '${methodName}' not found on ${objectName}`);
+				const result = await classMethod.call(classInfo?.constructor, ...methodArgs);
+				const failure = normalizeCustomActionFailure(result);
+				if (failure) throw new CustomActionFailureError(failure);
+				return result;
 			} else {
-				const collectionMethod = collection[action];
+				const collectionMethod = collection[methodName];
 				if (typeof collectionMethod === "function") {
-					const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
-					return await collectionMethod.call(collection, methodArgs);
-				} else throw new Error(`Method '${action}' not found on collection. For object-specific actions, provide an 'id' parameter.`);
+					const result = await collectionMethod.call(collection, ...methodArgs);
+					const failure = normalizeCustomActionFailure(result);
+					if (failure) throw new CustomActionFailureError(failure);
+					return result;
+				} else throw new Error(`Method '${methodName}' not found on collection. For object-specific actions, provide an 'id' parameter.`);
 			}
 		} catch (error) {
+			if (error instanceof CustomActionFailureError) throw error;
 			throw new Error(`Failed to execute custom action '${action}': ${error instanceof Error ? error.message : "Unknown error"}`);
 		}
 	}
@@ -619,6 +646,7 @@ var MCPGenerator = class {
 				context: this.context,
 				debug,
 				tools,
+				customActions: await this.runtimeCustomActions(tools),
 				tenantScopedObjects: await this.tenantScopedObjectNames(tools)
 			}), "utf-8");
 			console.log(`✅ Generated MCP server: ${resolvedPath}`);
@@ -639,6 +667,41 @@ var MCPGenerator = class {
 		console.log(`\n📝 Add this to your package.json scripts:`);
 		console.log(`   "mcp": "${mcpScript}"\n`);
 	}
+	async runtimeCustomActions(tools) {
+		const metadata = {};
+		const crudActions = /* @__PURE__ */ new Set([
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		]);
+		const classes = ObjectRegistry.getAllClasses();
+		for (const tool of tools) {
+			const separator = tool.name.indexOf("_");
+			if (separator === -1) continue;
+			const objectPrefix = tool.name.slice(0, separator);
+			const action = tool.name.slice(separator + 1);
+			if (crudActions.has(action)) continue;
+			const matched = Array.from(classes.entries()).find(([key, info]) => (info.name || key).toLowerCase() === objectPrefix);
+			if (!matched) continue;
+			const [key, classInfo] = matched;
+			const objectName = classInfo.name || key;
+			const [methodName, method] = resolveCustomActionMethod(await ObjectRegistry.getAllMethods(objectName), action);
+			const resolved = this.resolveCustomActionMetadata(objectName, methodName, method, this.hasCollectionReceiver(classInfo));
+			metadata[tool.name] = {
+				scope: resolved.scope,
+				isStatic: resolved.isStatic,
+				methodName,
+				...resolved.parameters ? {
+					parameterNames: resolved.parameters.map((parameter) => parameter.name),
+					optionsParameter: resolved.parameters.length === 1 && resolved.parameters[0]?.name === "options"
+				} : {},
+				legacyOptions: !resolved.parameters
+			};
+		}
+		return metadata;
+	}
 	/**
 	* Generate modular MCP server structure
 	*
@@ -707,8 +770,10 @@ export const tools: Array<{
 	async generateToolSwitchCases(indent = "    ") {
 		const tools = await this.generateTools();
 		const capitalize = (str) => str.charAt(0).toUpperCase() + str.slice(1);
-		return tools.map((tool) => {
-			const [objectName, action] = tool.name.split("_");
+		return (await Promise.all(tools.map(async (tool) => {
+			const separator = tool.name.indexOf("_");
+			const objectName = tool.name.slice(0, separator);
+			const action = tool.name.slice(separator + 1);
 			switch (action) {
 				case "list": return `${indent}case '${tool.name}': {
 ${indent}  const limit = args.limit ?? 50;
@@ -794,34 +859,59 @@ ${indent}  await toDelete.delete();
 
 ${indent}  return { content: [{ type: 'text', text: JSON.stringify({ success: true, message: 'Object deleted successfully' }) }] };
 ${indent}}`;
-				default: return `${indent}case '${tool.name}': {
-${indent}  const { id, options = {}, ...directArgs } = args;
+				default: {
+					const matched = Array.from(ObjectRegistry.getAllClasses().entries()).find(([key, info]) => (info.name || key).toLowerCase() === objectName.toLowerCase());
+					if (!matched) throw new Error(`Unable to resolve custom-action target for tool '${tool.name}'`);
+					const [classKey, classInfo] = matched;
+					const registeredName = classInfo.name || classKey;
+					const [methodName, method] = resolveCustomActionMethod(await ObjectRegistry.getAllMethods(registeredName), action);
+					const metadata = this.resolveCustomActionMetadata(registeredName, methodName, method, this.hasCollectionReceiver(classInfo));
+					const methodArgs = !metadata.parameters ? "Object.keys(options ?? {}).length > 0 ? options : directArgs" : metadata.parameters.length === 1 && metadata.parameters[0]?.name === "options" ? "options" : `[${metadata.parameters.map((parameter) => `args[${JSON.stringify(customActionParameterInputName(metadata, parameter.name))}]`).join(", ")}]`;
+					return `${indent}case '${tool.name}': {
+${indent}  const { id, options, ...directArgs } = args;
 
-${indent}  if (!id) {
+${indent}  if (${JSON.stringify(metadata.scope)} === 'item' && !id) {
 ${indent}    throw new Error('ID is required for custom action ${action}');
 ${indent}  }
+${indent}  if (${JSON.stringify(metadata.scope)} === 'collection' && id) {
+${indent}    throw new Error('Custom action ${action} is collection-scoped and does not accept an ID');
+${indent}  }
 
-${indent}  const collection = await ObjectRegistry.getCollection('${capitalize(objectName)}', {
+${indent}  const collection = await ObjectRegistry.getCollection(${JSON.stringify(registeredName)}, {
 ${indent}    persistence: { type: 'sql', url: process.env.DATABASE_URL || ':memory:' },
 ${indent}    ai: aiConfig
 ${indent}  });
 
-${indent}  const object = await collection.get(id);
-${indent}  if (!object) {
-${indent}    throw new Error('Object not found');
+${indent}  const target = ${JSON.stringify(metadata.scope)} === 'item'
+${indent}    ? await collection.get(id)
+${indent}    : ${metadata.isStatic}
+${indent}      ? ObjectRegistry.getClass(${JSON.stringify(registeredName)})?.constructor
+${indent}      : collection;
+${indent}  if (!target) {
+${indent}    throw new Error(${JSON.stringify(metadata.scope === "item" ? "Object not found" : "Custom action target not found")});
 ${indent}  }
 
-${indent}  if (typeof object['${action}'] !== 'function') {
-${indent}    throw new Error('Method ${action} not found on object');
+${indent}  const actionMethod = target[${JSON.stringify(methodName)}];
+${indent}  if (typeof actionMethod !== 'function') {
+${indent}    throw new Error('Method ${methodName} not found on custom action target');
 ${indent}  }
 
-${indent}  const methodArgs = Object.keys(options).length > 0 ? options : directArgs;
-${indent}  const result = await object['${action}'](methodArgs);
+${indent}  const methodArgs = ${methodArgs.startsWith("[") ? methodArgs : `[${methodArgs}]`};
+${indent}  const result = await actionMethod.call(target, ...methodArgs);
+${indent}  const failure = normalizeCustomActionFailure(result);
+${indent}  if (failure) {
+${indent}    return {
+${indent}      content: [{ type: 'text', text: JSON.stringify({ error: failure }) }],
+${indent}      isError: true,
+${indent}      _meta: { [SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY]: failure },
+${indent}    };
+${indent}  }
 
 ${indent}  return { content: [{ type: 'text', text: JSON.stringify(toPublicResult(result)) }] };
 ${indent}}`;
+				}
 			}
-		}).join("\n\n");
+		}))).join("\n\n");
 	}
 	/**
 	* Generate handlers file for modular server
@@ -845,7 +935,7 @@ ${indent}}`;
  * principal) and tenancy is enabled so the interceptor enforces filtering.
  */
 
-import { ObjectRegistry } from '@happyvertical/smrt-core';
+import { ObjectRegistry, normalizeCustomActionFailure, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY } from '@happyvertical/smrt-core';
 ${hasTenantScoped ? "import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\n" : ""}${hasTenantScoped ? `
 // Install the tenancy interceptor so tenant-scoped tools are filtered and the
 // gate fail-closes when no tenant is supplied (#1554).