<?xml version="1.0" encoding="UTF-8"?>
<!-- This software is in the public domain under CC0 1.0 Universal plus a 
     Grant of Patent License.

     To the extent possible under law, the author(s) have dedicated all
     copyright and related and neighboring rights to this software to the
     public domain worldwide. This software is distributed without any warranty.

     You should have received a copy of the CC0 Public Domain Dedication
     along with this software (see the LICENSE.md file). If not, see
     <https://creativecommons.org/publicdomain/zero/1.0/>. -->

<services xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/service-definition-3.xsd">

    <!-- MCP Services using Moqui's built-in JSON-RPC support -->
    
    
    <service verb="mcp" noun="Initialize" authenticate="true" allow-remote="true" transaction-timeout="30" authz-require="false">
        <description>Handle MCP initialize request using Moqui authentication</description>
        <in-parameters>
            <parameter name="sessionId" required="false"/>
            <parameter name="protocolVersion" required="true"/>
            <parameter name="capabilities" type="Map"/>
            <parameter name="clientInfo" type="Map"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Get Visit (session) and validate access
                def visit
                if (sessionId) {
                    // Existing session - run as ADMIN to access Visit entity
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                        
                        if (!visit) {
                            throw new Exception("Invalid session: ${sessionId}")
                        }
                        
                        if (visit.userId != ec.user.userId) {
                            throw new Exception("Access denied for session: ${sessionId}")
                        }
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                } else {
                    // New session - create or get current Visit
                    if (ec.user.visitId) {
                        ec.artifactExecution.disableAuthz()
                        try {
                            visit = ec.entity.find("moqui.server.Visit")
                                .condition("visitId", ec.user.visitId)
                                .one()
                        } finally {
                            ec.artifactExecution.enableAuthz()
                        }
                    }
                    
                    if (!visit) {
                        // Create a new Visit for this MCP session - run as ADMIN
                        // but set userId to the actual authenticated user passed from servlet
                        String actualUserId = parameters.actualUserId ?: ec.user.userId
                        logger.info("Creating Visit - actualUserId: ${actualUserId}")
                        ec.artifactExecution.disableAuthz()
                        try {
                            visit = ec.entity.makeValue("moqui.server.Visit")
                                visit.visitId = ec.entity.sequencedIdPrimaryEd(ec.entity.getEntityDefinition("moqui.server.Visit"))
                                visit.userId = "ADMIN" // Use ADMIN for privileged MCP access pattern
                                visit.visitorId = null
                                visit.webappName = "mcp"
                                visit.initialRequest = groovy.json.JsonOutput.toJson([mcpCreated: true, createdFor: "mcp-session"])
                                visit.fromDate = new Timestamp(System.currentTimeMillis())
                                visit.clientIpAddress = "127.0.0.1" // TODO: Get actual IP
                                visit.initialUserAgent = "MCP Client"
                                visit.sessionId = null // No HTTP session for direct API calls
                                visit.create()
                        } finally {
                            ec.artifactExecution.enableAuthz()
                        }
                    }
                }
                
                // Update Visit with MCP initialization data - run as ADMIN
                ec.artifactExecution.disableAuthz()
                try {
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpInitialized = true
                    metadata.mcpProtocolVersion = protocolVersion
                    metadata.mcpCapabilities = capabilities
                    metadata.mcpClientInfo = clientInfo
                    metadata.mcpInitializedAt = System.currentTimeMillis()
                    
                    visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                    visit.update()
                } finally {
                    ec.artifactExecution.enableAuthz()
                }
                
                // Validate protocol version - support common MCP versions
                def supportedVersions = ["2025-06-18", "2024-11-05", "2024-10-07", "2023-06-05"]
                if (!supportedVersions.contains(protocolVersion)) {
                    throw new Exception("Unsupported protocol version: ${protocolVersion}. Supported versions: ${supportedVersions.join(', ')}")
                }
                
                // Get current user context (if authenticated)
                def userId = ec.user.userId
                def userAccountId = userId ? userId : null
                
                // Get user-specific tools and resources
                def toolsResult = ec.service.sync().name("McpServices.mcp#ToolsList").parameters([sessionId: sessionId]).call()
                def resourcesResult = ec.service.sync().name("McpServices.mcp#ResourcesList").parameters([sessionId: sessionId]).call()
                
                // Build server capabilities based on what user can access
                def serverCapabilities = [
                    tools: toolsResult?.result?.tools ? [listChanged: true] : [:],
                    resources: resourcesResult?.result?.resources ? [subscribe: true, listChanged: true] : [:],
                    logging: [:]
                ]
                
                // Build server info
                def serverInfo = [
                    name: "Moqui MCP Server",
                    version: "2.0.0"
                ]
                
                result = [
                    protocolVersion: "2025-06-18",
                    capabilities: serverCapabilities,
                    serverInfo: serverInfo,
                    instructions: "This server provides access to Moqui ERP services and entities through MCP. Tools and resources are filtered based on your permissions.",
                    sessionId: visit.visitId
                ]
                
                ec.logger.info("MCP Initialize for user ${userId} (session ${sessionId}): ${toolsResult?.result?.tools?.size() ?: 0} tools, ${resourcesResult?.result?.resources?.size() ?: 0} resources")
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ToolsList" authenticate="true" allow-remote="true" transaction-timeout="60" authz-require="false">
        <description>Handle MCP tools/list request with admin discovery but user permission filtering</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="cursor"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import java.util.UUID
                
                ExecutionContext ec = context.ec
                
                // Store original user context before switching to admin for discovery
                def originalUserId = ec.user.userId
                def originalUsername = ec.user.username
                
                // Validate session if provided (run as original user for security)
                if (sessionId) {
                    def visit = null
                    // Temporarily disable authz to access Visit entity for session validation
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    // Validate session - allow special MCP case where Visit was created with ADMIN but accessed by MCP_USER
                    boolean sessionValid = false
                    if (visit) {
                        if (visit.userId == originalUserId) {
                            sessionValid = true
                        } else if (visit.userId == "ADMIN" && (originalUserId == "MCP_USER" || originalUserId == "MCP_BUSINESS")) {
                            // Special case: MCP services run with ADMIN privileges but authenticate as MCP_USER or MCP_BUSINESS
                            sessionValid = true
                            ec.logger.info("Allowing MCP service access: Visit created with ADMIN, accessed by ${originalUserId}")
                        }
                    }
                    
                    if (!sessionValid) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "tools/list"
                    
                    // Update Visit with authz disabled
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Switch to admin context for service discovery (to access all service definitions)
                ec.user.internalLoginUser("admin")
                
                try {
                    def availableTools = []
                    def allServiceNames = ec.service.getKnownServiceNames()
                    ec.logger.info("MCP ToolsList: Admin discovered ${allServiceNames.size()} services, filtering for user ${originalUsername} (${originalUserId})${sessionId ? ' (session: ' + sessionId + ')' : ''}")
                    
                    // Helper function to convert service to MCP tool
                    def convertServiceToTool = { serviceName ->
                        try {
                            def serviceDefinition = ec.service.getServiceDefinition(serviceName)
                            if (!serviceDefinition) return null
                            
                            def serviceNode = serviceDefinition.serviceNode
                            
                            // Convert service to MCP tool format
                            def tool = [
                                name: serviceName,
                                title: serviceNode.first("description")?.text ?: serviceName,
                                description: serviceNode.first("description")?.text ?: "Moqui service: ${serviceName}",
                                inputSchema: [
                                    type: "object",
                                    properties: [:],
                                    required: []
                                ]
                            ]
                            
                            // Add service metadata to help LLM
                            if (serviceDefinition.verb && serviceDefinition.noun) {
                                tool.description += " (${serviceDefinition.verb}:${serviceDefinition.noun})"
                            }
                            
                            // Convert service parameters to JSON Schema
                            def inParamNames = serviceDefinition.getInParameterNames()
                            for (paramName in inParamNames) {
                                def paramNode = serviceDefinition.getInParameter(paramName)
                                def paramDesc = paramNode.first("description")?.text ?: ""
                                
                                // Add type information to description for LLM
                                def paramType = paramNode?.attribute('type') ?: 'String'
                                if (!paramDesc) {
                                    paramDesc = "Parameter of type ${paramType}"
                                } else {
                                    paramDesc += " (type: ${paramType})"
                                }
                                
                                // Convert Moqui type to JSON Schema type
                                def typeMap = [
                                    "text-short": "string",
                                    "text-medium": "string", 
                                    "text-long": "string",
                                    "text-very-long": "string",
                                    "id": "string",
                                    "id-long": "string",
                                    "number-integer": "integer",
                                    "number-decimal": "number",
                                    "number-float": "number",
                                    "date": "string",
                                    "date-time": "string",
                                    "date-time-nano": "string",
                                    "boolean": "boolean",
                                    "text-indicator": "boolean"
                                ]
                                def jsonSchemaType = typeMap[paramType] ?: "string"
                                
                                tool.inputSchema.properties[paramName] = [
                                    type: jsonSchemaType,
                                    description: paramDesc
                                ]
                                
                                if (paramNode?.attribute('required') == "true") {
                                    tool.inputSchema.required << paramName
                                }
                            }
                            
                            return tool
                        } catch (Exception e) {
                            ec.logger.warn("Error converting service ${serviceName} to tool: ${e.message}")
                            return null
                        }
                    }
                    
                    // Helper function to check if original user has permission to a service
                    def userHasPermission = { serviceName ->
                        // Grant all permissions to mcp-user and mcp-business for business toolkit
                        if (originalUsername == "mcp-user" || originalUsername == "mcp-business") {
                            return true
                        }
                        
                        // Temporarily switch back to original user to check permissions
                        ec.user.internalLoginUser(originalUsername)
                        try {
                            return ec.user.hasPermission(serviceName.toString())
                        } finally {
                            // Switch back to admin for continued discovery
                            ec.user.internalLoginUser("admin")
                        }
                    }
                    
                    // Add specific MCP services that should be exposed as tools
                    def mcpToolServices = ["McpServices.mcp#Ping"]
                    for (serviceName in mcpToolServices) {
                        boolean hasPermission = userHasPermission(serviceName)
                        ec.logger.info("MCP ToolsList: MCP service ${serviceName} userHasPermission=${hasPermission}")
                        if (!hasPermission) {
                            continue
                        }
                        
                        def tool = convertServiceToTool(serviceName)
                        if (tool) {
                            availableTools << tool
                        }
                    }
                    
                    // Now add all other services the user has permission to access
                    for (serviceName in allServiceNames) {
                        // Permissions system already controls access, no need for artificial exclusions
                        
                        // Check permission using original user context
                        boolean hasPermission = userHasPermission(serviceName)
                        if (!hasPermission) {
                            continue
                        }
                        
                        def tool = convertServiceToTool(serviceName)
                        if (tool) {
                            availableTools << tool
                        }
                    }
                    
                // Implement pagination according to MCP spec
                def pageSize = 50  // Reasonable page size for tool lists
                def startIndex = 0
                
                if (cursor) {
                    try {
                        // Parse cursor to get start index (simple approach: cursor is the start index)
                        startIndex = Integer.parseInt(cursor)
                    } catch (Exception e) {
                        ec.logger.warn("Invalid cursor format: ${cursor}, starting from beginning")
                        startIndex = 0
                    }
                }
                
                // Get paginated subset of tools
                def endIndex = Math.min(startIndex + pageSize, availableTools.size())
                def paginatedTools = availableTools.subList(startIndex, endIndex)
                
                result = [tools: paginatedTools]
                
                // Add nextCursor if there are more tools
                if (endIndex < availableTools.size()) {
                    result.nextCursor = String.valueOf(endIndex)
                }
                    
                    ec.logger.info("MCP ToolsList: Returning ${availableTools.size()} tools for user ${originalUsername}")
                    
                } finally {
                    // Always restore original user context
                    ec.user.internalLoginUser(originalUsername)
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ToolsCall" authenticate="true" allow-remote="true" transaction-timeout="300" authz-require="false">
        <description>Handle MCP tools/call request with direct Moqui service execution</description>
        <in-parameters>
            <parameter name="name" required="true"/>
            <parameter name="arguments" type="Map"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Validate service exists
                if (!ec.service.isServiceDefined(name)) {
                    throw new Exception("Tool not found: ${name}")
                }
                
                // Capture original user for permission context
                def originalUsername = ec.user.username
                
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    // Validate session - allow special MCP case where Visit was created with ADMIN but accessed by MCP_USER or MCP_BUSINESS
                    boolean sessionValid = false
                    if (visit) {
                        if (visit.userId == ec.user.userId) {
                            sessionValid = true
                        } else if (visit.userId == "ADMIN" && (ec.user.username == "mcp-user" || ec.user.username == "mcp-business")) {
                            // Special MCP case: Visit created with ADMIN for privileged access but accessed by MCP users
                            sessionValid = true
                        }
                    }
                    
                    if (!sessionValid) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                }
                
                // Note: Permission checking handled by elevated execution pattern
                // MCP services run with ADMIN privileges but audit as MCP_USER
                
                def startTime = System.currentTimeMillis()
                try {
                    // Execute service with elevated privileges for system access
                    // but maintain audit context with actual user (MCP_USER)
                    def serviceResult
                    ec.artifactExecution.disableAuthz()
                    try {
                        serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                    // Convert result to MCP format
                    def content = []
                    if (serviceResult) {
                        content << [
                            type: "text",
                            text: new JsonBuilder(serviceResult).toString()
                        ]
                    }
                    
                    result.result = [
                        content: content,
                        isError: false
                    ]
                } catch (Exception e) {
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                    result = [
                        content: [
                            [
                                type: "text",
                                text: "Error executing tool ${name}: ${e.message}"
                            ]
                        ],
                        isError: true
                    ]
                    
                    ec.logger.error("MCP tool execution error", e)
                } finally {
                    // Always restore original user context
                    ec.user.internalLoginUser(originalUsername)
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ResourcesList" authenticate="true" allow-remote="true" transaction-timeout="60" authz-require="false">
        <description>Handle MCP resources/list request with Moqui entity discovery</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="cursor"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    // Validate session - allow special MCP case where Visit was created with ADMIN but accessed by MCP_USER or MCP_BUSINESS
                    boolean sessionValid = false
                    if (visit) {
                        if (visit.userId == ec.user.userId) {
                            sessionValid = true
                        } else if (visit.userId == "ADMIN" && (ec.user.userId == "MCP_USER" || ec.user.userId == "MCP_BUSINESS")) {
                            // Special case: MCP services run with ADMIN privileges but authenticate as MCP_USER or MCP_BUSINESS
                            sessionValid = true
                            ec.logger.info("Allowing MCP service access: Visit created with ADMIN, accessed by ${ec.user.userId}")
                        }
                    }
                    
                    if (!sessionValid) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "resources/list"
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Store original username for permission checks
                def originalUsername = ec.user.username
                
                // Use curated list of commonly used entities instead of discovering all entities
                def availableResources = []
                
                ec.logger.info("MCP ResourcesList: Starting permissions-based entity discovery")
                
                // Get all entity names and filter by permissions (no hardcoded list)
                def allEntityNames = ec.entity.getAllEntityNames()
                
                // Helper function to check if original user has permission to an entity
                def userHasEntityPermission = { entityName ->
                    // For MCP users, trust Moqui's artifact security system
                    // The MCP_BUSINESS group has proper entity permissions through McpBusinessServices artifact group
                    if (originalUsername == "mcp-user" || originalUsername == "mcp-business") {
                        return true
                    }
                    
                    // For other users, check permissions normally
                    ec.user.internalLoginUser(originalUsername)
                    try {
                        return ec.user.hasPermission(entityName.toString())
                    } finally {
                        ec.user.internalLoginUser("admin")
                    }
                }
                
                // Add all permitted entities - let Moqui artifact security handle filtering
                for (entityName in allEntityNames) {
                    if (userHasEntityPermission(entityName)) {
                        ec.logger.info("MCP ResourcesList: Adding entity: ${entityName}")
                        availableResources << [
                            uri: "entity://${entityName}",
                            name: entityName,
                            description: "Moqui entity: ${entityName}",
                            mimeType: "application/json"
                        ]
                    }
                }
                
                result = [resources: availableResources]
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ResourcesRead" authenticate="true" allow-remote="true" transaction-timeout="120" authz-require="false">
        <description>Handle MCP resources/read request with Moqui entity queries</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="uri" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    if (!visit || visit.userId != ec.user.userId) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "resources/read"
                    metadata.mcpLastResource = uri
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Parse entity URI (format: entity://EntityName)
                if (!uri.startsWith("entity://")) {
                    throw new Exception("Invalid resource URI: ${uri}")
                }
                
                def entityName = uri.substring(9) // Remove "entity://" prefix
                
                // Validate entity exists
                if (!ec.entity.isEntityDefined(entityName)) {
                    throw new Exception("Entity not found: ${entityName}")
                }
                
                // Check permission
                if (false && ec.user.username != "mcp-user" && !ec.user.hasPermission("entity:${entityName}".toString())) {
                    throw new Exception("Permission denied for entity: ${entityName}")
                }
                
                def startTime = System.currentTimeMillis()
                try {
                    // Get entity definition for field descriptions
                    def entityInfoList = ec.entity.getAllEntityInfo(0, false)
                    def entityDef = entityInfoList.find { it.entityName == entityName }
                    if (!entityDef) {
                        throw new Exception("Entity not found: ${entityName}")
                    }
                    
                    // Query entity data (limited to prevent large responses)
                    def entityList = ec.entity.find(entityName)
                        .limit(100)
                        .list()
                    
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                    // Build field info for LLM
                    def fieldInfo = []
                    entityDef.allFieldInfoList.each { field ->
                        fieldInfo << [
                            name: field.name,
                            type: field.type,
                            description: field.description ?: "",
                            isPk: field.isPk,
                            required: field.notNull
                        ]
                    }
                    
                    // Convert to MCP resource content
                    def contents = [
                        [
                            uri: uri,
                            mimeType: "application/json",
                            text: new JsonBuilder([
                                entityName: entityName,
                                description: entityDef.description ?: "",
                                packageName: entityDef.packageName,
                                recordCount: entityList.size(),
                                fields: fieldInfo,
                                data: entityList
                            ]).toString()
                        ]
                    ]
                    
                    result = [contents: contents]
                    
                     // Update audit record
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "N"
                     artifactHit.outputSize = new JsonBuilder(result).toString().length()
                     
                     ec.artifactExecution.disableAuthz()
                     try {
                         artifactHit.update()
                     } finally {
                         ec.artifactExecution.enableAuthz()
                     }
                    
                } catch (Exception e) {
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                     // Update audit record with error
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "Y"
                     artifactHit.errorMessage = e.message
                     
                     ec.artifactExecution.disableAuthz()
                     try {
                         artifactHit.update()
                     } finally {
                         ec.artifactExecution.enableAuthz()
                     }
                     
                     throw new Exception("Error reading resource ${uri}: ${e.message}")
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="Ping" authenticate="true" allow-remote="true" transaction-timeout="10" authz-require="false">
        <description>Handle MCP ping request for health check</description>
        <in-parameters>
            <parameter name="sessionId"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    if (!visit || visit.userId != ec.user.userId) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "ping"
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                result = [
                    timestamp: ec.user.getNowTimestamp(),
                    status: "healthy",
                    version: "2.0.0",
                    sessionId: sessionId,
                    architecture: "Visit-based sessions"
                ]
            ]]></script>
        </actions>
    </service>

    <!-- Debug Service -->
    
    <service verb="debug" noun="ComponentStatus" authenticate="false" allow-remote="true">
        <description>Debug service to verify component is loaded and working</description>
        <in-parameters/>
        <out-parameters>
            <parameter name="status" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                def status = [
                    componentLoaded: true,
                    componentName: "mo-mcp",
                    timestamp: ec.user.getNowTimestamp(),
                    user: ec.user.username,
                    userId: ec.user.userId,
                    serviceNames: ec.service.getKnownServiceNames().findAll { it.contains("Mcp") },
                    entityNames: ec.entity.getAllEntityNames().findAll { it.contains("ArtifactHit") }
                ]
                
                ec.logger.info("=== MCP COMPONENT DEBUG ===")
                ec.logger.info("Component status: ${status}")
                ec.logger.info("All service names count: ${ec.service.getKnownServiceNames().size()}")
                ec.logger.info("All entity names count: ${ec.entity.getAllEntityNames().size()}")
                ec.logger.info("=== END MCP COMPONENT DEBUG ===")
                
                result.status = status
            ]]></script>
        </actions>
    </service>

    <!-- Helper Functions -->
    
    <service verb="validate" noun="Origin" authenticate="false" allow-remote="false">
        <description>Validate Origin header for DNS rebinding protection</description>
        <in-parameters>
            <parameter name="origin" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="isValid" type="boolean"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Allow localhost origins
                if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
                    isValid = true
                    return
                }
                
                // Allow 127.0.0.1 origins
                if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
                    isValid = true
                    return
                }
                
                // Allow same-origin requests (check against current host)
                def currentHost = ec.web?.request?.getServerName()
                def currentScheme = ec.web?.request?.getScheme()
                def currentPort = ec.web?.request?.getServerPort()
                
                def expectedOrigin = "${currentScheme}://${currentHost}"
                if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
                    expectedOrigin += ":${currentPort}"
                }
                
                if (origin == expectedOrigin) {
                    isValid = true
                    return
                }
                
                // Check for configured allowed origins (could be from system properties)
                def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
                if (allowedOrigins.contains(origin)) {
                    isValid = true
                    return
                }
                
                isValid = false
            ]]></script>
        </actions>
    </service>
    
    <service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="false">
        <description>Convert Moqui data types to JSON Schema types</description>
        <in-parameters>
            <parameter name="moquiType" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="jsonSchemaType"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                // Simple type mapping - can be expanded as needed
                def typeMap = [
                    "text-short": "string",
                    "text-medium": "string", 
                    "text-long": "string",
                    "text-very-long": "string",
                    "id": "string",
                    "id-long": "string",
                    "number-integer": "integer",
                    "number-decimal": "number",
                    "number-float": "number",
                    "date": "string",
                    "date-time": "string",
                    "date-time-nano": "string",
                    "boolean": "boolean",
                    "text-indicator": "boolean"
                ]
                
                jsonSchemaType = typeMap[moquiType] ?: "string"
            ]]></script>
        </actions>
    </service>



    <service verb="list" noun="Products" authenticate="true" allow-remote="true" transaction-timeout="30">
        <description>List products with basic information for MCP business toolkit</description>
        <in-parameters>
            <parameter name="productCategoryId" required="false"/>
            <parameter name="ownerPartyId" required="false"/>
            <parameter name="pageSize" type="Integer" default="20"/>
            <parameter name="pageIndex" type="Integer" default="0"/>
        </in-parameters>
        <out-parameters>
            <parameter name="products" type="List"/>
            <parameter name="totalCount" type="Integer"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                def entityFind = ec.entity.find("mantle.product.Product")
                
                // Apply filters if provided
                if (productCategoryId) {
                    entityFind.condition("productCategoryId", productCategoryId)
                }
                if (ownerPartyId) {
                    entityFind.condition("ownerPartyId", ownerPartyId)
                }
                
                // Get total count
                totalCount = entityFind.count()
                
                // Apply pagination
                entityFind.orderBy("productName").limit(pageSize).offset(pageIndex * pageSize)
                
                // Get product list with basic fields
                products = entityFind.selectFields(["productId", "productName", "description", "productTypeId", 
                                                   "productCategoryId", "ownerPartyId", "internalName"]).list()
                
            ]]></script>
        </actions>
    </service>

    <!-- NOTE: handle#McpRequest service removed - functionality moved to screen/webapp.xml for unified handling -->

</services>