@happyvertical/smrt-core 0.40.60 → 0.40.62

package/README.md

@@ -368,6 +368,27 @@ class Product extends SmrtObject { /* ... */ }
 
 Generators produce OpenAPI REST endpoints, Commander CLI commands, and MCP server tools respectively. The Vite plugin (`smrtPlugin`) generates virtual modules at dev time for routes, clients, and manifests.
 
+### Durable MCP tasks
+
+Long-running item actions may opt into the experimental
+`io.modelcontextprotocol/tasks` extension. Tasks are disabled by default; list
+the action names explicitly and mark the action as background-eligible:
+
+```typescript
+@smrt({
+  mcp: { include: ['generateReport'], tasks: ['generateReport'] },
+})
+class Report extends SmrtObject {
+  @backgroundEligible()
+  async generateReport(): Promise<ReportResult> { /* ... */ }
+}
+```
+
+The generated MCP server advertises the extension only when at least one task
+action is enabled. A task-aware client can request the action as a durable job,
+then use `tasks/get`, `tasks/update`, and `tasks/cancel` to observe or control
+it. Generated stdio servers run an `mcp-tasks` worker automatically.
+
 ## Dependencies
 
 - `@happyvertical/ai` -- AI client (is/do operations, embeddings)

package/dist/generated-client-runtime.d.ts

@@ -9,10 +9,11 @@
  * failures were therefore invisible to callers — an optimistic-update layer
  * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.
  *
- * `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when
- * the response was JSON), so callers can branch on status and surface server
- * messages. Both helpers are emitted with a `__smrt` prefix so they cannot
- * collide with a collection key in the generated module.
+ * `SmrtClientError` carries the HTTP `status` and, for non-5xx responses, the
+ * parsed error `body`, so callers can branch on status and surface safe server
+ * messages. Server-side failures stay opaque. Both helpers are emitted with a
+ * `__smrt` prefix so they cannot collide with a collection key in the generated
+ * module.
  *
  * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare
  * array for list, a bare object for get/create/update — with snake_case field
@@ -22,5 +23,5 @@
  * (vite-plugin + prebuild) are written to match this shape. This same
  * snake_case wire feeds the mobile DTO codegen; do not change the wire here.
  */
-export declare const CLIENT_FETCH_RUNTIME = "class SmrtClientError extends Error {\n  constructor(message, status, body) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  const body = await __smrtParseBody(response);\n  if (!response.ok) {\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return body;\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    const body = await __smrtParseBody(response);\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return true;\n}";
+export declare const CLIENT_FETCH_RUNTIME = "class SmrtClientError extends Error {\n  constructor(message, status, body, code) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    if (body !== undefined) this.body = body;\n    if (code) this.code = code;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Generated REST routes retain the legacy { error: string } form while custom\n// action failures use { error: { ok: false, code, message, status? } }. Keep\n// the nested message human-readable and retain its machine-readable code.\nfunction __smrtErrorDetail(body) {\n  if (!body || typeof body !== 'object') return {};\n  const error = body.error;\n  if (typeof error === 'string') return { message: error };\n  if (error && typeof error === 'object') {\n    return {\n      message: typeof error.message === 'string' ? error.message : undefined,\n      code: typeof error.code === 'string' ? error.code : undefined,\n    };\n  }\n  return typeof body.message === 'string' ? { message: body.message } : {};\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    // Server-side failures may carry stack traces or upstream payloads. Do not\n    // parse, interpolate, or expose them to browser callers.\n    if (response.status >= 500) {\n      throw new SmrtClientError(\n        'Request failed with status ' + response.status,\n        response.status,\n      );\n    }\n    const body = await __smrtParseBody(response);\n    const detail = __smrtErrorDetail(body);\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status +\n        (detail.message ? ': ' + detail.message : ''),\n      response.status,\n      body,\n      detail.code,\n    );\n  }\n  return __smrtParseBody(response);\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    // Keep 5xx failures opaque for the same reason as __smrtFetchJson.\n    if (response.status >= 500) {\n      throw new SmrtClientError(\n        'Request failed with status ' + response.status,\n        response.status,\n      );\n    }\n    const body = await __smrtParseBody(response);\n    const detail = __smrtErrorDetail(body);\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status +\n        (detail.message ? ': ' + detail.message : ''),\n      response.status,\n      body,\n      detail.code,\n    );\n  }\n  return true;\n}";
 //# sourceMappingURL=generated-client-runtime.d.ts.map

package/dist/generated-client-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-client-runtime.d.ts","sourceRoot":"","sources":["../src/generated-client-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,4pDA0D/B,CAAC"}
+{"version":3,"file":"generated-client-runtime.d.ts","sourceRoot":"","sources":["../src/generated-client-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB,sgGA4F/B,CAAC"}

package/dist/generated-client-runtime.js

@@ -10,10 +10,11 @@
 * failures were therefore invisible to callers — an optimistic-update layer
 * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.
 *
-* `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when
-* the response was JSON), so callers can branch on status and surface server
-* messages. Both helpers are emitted with a `__smrt` prefix so they cannot
-* collide with a collection key in the generated module.
+* `SmrtClientError` carries the HTTP `status` and, for non-5xx responses, the
+* parsed error `body`, so callers can branch on status and surface safe server
+* messages. Server-side failures stay opaque. Both helpers are emitted with a
+* `__smrt` prefix so they cannot collide with a collection key in the generated
+* module.
 *
 * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare
 * array for list, a bare object for get/create/update — with snake_case field
@@ -24,11 +25,12 @@
 * snake_case wire feeds the mobile DTO codegen; do not change the wire here.
 */
 var CLIENT_FETCH_RUNTIME = `class SmrtClientError extends Error {
-  constructor(message, status, body) {
+  constructor(message, status, body, code) {
     super(message);
     this.name = 'SmrtClientError';
     this.status = status;
-    this.body = body;
+    if (body !== undefined) this.body = body;
+    if (code) this.code = code;
   }
 }
 
@@ -48,22 +50,47 @@ async function __smrtParseBody(response) {
   }
 }
 
+// Generated REST routes retain the legacy { error: string } form while custom
+// action failures use { error: { ok: false, code, message, status? } }. Keep
+// the nested message human-readable and retain its machine-readable code.
+function __smrtErrorDetail(body) {
+  if (!body || typeof body !== 'object') return {};
+  const error = body.error;
+  if (typeof error === 'string') return { message: error };
+  if (error && typeof error === 'object') {
+    return {
+      message: typeof error.message === 'string' ? error.message : undefined,
+      code: typeof error.code === 'string' ? error.code : undefined,
+    };
+  }
+  return typeof body.message === 'string' ? { message: body.message } : {};
+}
+
 // Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the
 // parsed JSON body exactly as the server sent it (bare array/object, snake_case
 // fields).
 async function __smrtFetchJson(url, init) {
   const response = await fetch(url, init);
-  const body = await __smrtParseBody(response);
   if (!response.ok) {
-    const detail =
-      body && typeof body === 'object' && body.error ? ': ' + body.error : '';
+    // Server-side failures may carry stack traces or upstream payloads. Do not
+    // parse, interpolate, or expose them to browser callers.
+    if (response.status >= 500) {
+      throw new SmrtClientError(
+        'Request failed with status ' + response.status,
+        response.status,
+      );
+    }
+    const body = await __smrtParseBody(response);
+    const detail = __smrtErrorDetail(body);
     throw new SmrtClientError(
-      'Request failed with status ' + response.status + detail,
+      'Request failed with status ' + response.status +
+        (detail.message ? ': ' + detail.message : ''),
       response.status,
       body,
+      detail.code,
     );
   }
-  return body;
+  return __smrtParseBody(response);
 }
 
 // DELETE variant: rejects on !response.ok (so a failed delete is observable),
@@ -71,13 +98,21 @@ async function __smrtFetchJson(url, init) {
 async function __smrtFetchOk(url, init) {
   const response = await fetch(url, init);
   if (!response.ok) {
+    // Keep 5xx failures opaque for the same reason as __smrtFetchJson.
+    if (response.status >= 500) {
+      throw new SmrtClientError(
+        'Request failed with status ' + response.status,
+        response.status,
+      );
+    }
     const body = await __smrtParseBody(response);
-    const detail =
-      body && typeof body === 'object' && body.error ? ': ' + body.error : '';
+    const detail = __smrtErrorDetail(body);
     throw new SmrtClientError(
-      'Request failed with status ' + response.status + detail,
+      'Request failed with status ' + response.status +
+        (detail.message ? ': ' + detail.message : ''),
       response.status,
       body,
+      detail.code,
     );
   }
   return true;

package/dist/generated-client-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-client-runtime.js","names":[],"sources":["../src/generated-client-runtime.ts"],"sourcesContent":["/**\n * Shared runtime source injected into every generated API client\n * (`smrtPlugin`'s `@happyvertical/smrt-virt-client` and `smrtConsumer`'s\n * `@smrt/client` fallback).\n *\n * The generated fetchers MUST reject on `!response.ok` (#1796): before this,\n * every fetcher resolved `r.json()` regardless of HTTP status, so a 500 (or any\n * error response) resolved successfully with the error payload. Mutation\n * failures were therefore invisible to callers — an optimistic-update layer\n * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.\n *\n * `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when\n * the response was JSON), so callers can branch on status and surface server\n * messages. Both helpers are emitted with a `__smrt` prefix so they cannot\n * collide with a collection key in the generated module.\n *\n * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare\n * array for list, a bare object for get/create/update — with snake_case field\n * names (`created_at`, `updated_at`) exactly as `SmrtObject.toJSON()` emits\n * them. These helpers pass that JSON through unchanged; they do NOT wrap it in\n * an envelope or camelCase the keys. The generated `.d.ts` declarations\n * (vite-plugin + prebuild) are written to match this shape. This same\n * snake_case wire feeds the mobile DTO codegen; do not change the wire here.\n */\nexport const CLIENT_FETCH_RUNTIME = `class SmrtClientError extends Error {\n  constructor(message, status, body) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  const body = await __smrtParseBody(response);\n  if (!response.ok) {\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return body;\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    const body = await __smrtParseBody(response);\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return true;\n}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAa,uBAAuB"}
+{"version":3,"file":"generated-client-runtime.js","names":[],"sources":["../src/generated-client-runtime.ts"],"sourcesContent":["/**\n * Shared runtime source injected into every generated API client\n * (`smrtPlugin`'s `@happyvertical/smrt-virt-client` and `smrtConsumer`'s\n * `@smrt/client` fallback).\n *\n * The generated fetchers MUST reject on `!response.ok` (#1796): before this,\n * every fetcher resolved `r.json()` regardless of HTTP status, so a 500 (or any\n * error response) resolved successfully with the error payload. Mutation\n * failures were therefore invisible to callers — an optimistic-update layer\n * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.\n *\n * `SmrtClientError` carries the HTTP `status` and, for non-5xx responses, the\n * parsed error `body`, so callers can branch on status and surface safe server\n * messages. Server-side failures stay opaque. Both helpers are emitted with a\n * `__smrt` prefix so they cannot collide with a collection key in the generated\n * module.\n *\n * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare\n * array for list, a bare object for get/create/update — with snake_case field\n * names (`created_at`, `updated_at`) exactly as `SmrtObject.toJSON()` emits\n * them. These helpers pass that JSON through unchanged; they do NOT wrap it in\n * an envelope or camelCase the keys. The generated `.d.ts` declarations\n * (vite-plugin + prebuild) are written to match this shape. This same\n * snake_case wire feeds the mobile DTO codegen; do not change the wire here.\n */\nexport const CLIENT_FETCH_RUNTIME = `class SmrtClientError extends Error {\n  constructor(message, status, body, code) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    if (body !== undefined) this.body = body;\n    if (code) this.code = code;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Generated REST routes retain the legacy { error: string } form while custom\n// action failures use { error: { ok: false, code, message, status? } }. Keep\n// the nested message human-readable and retain its machine-readable code.\nfunction __smrtErrorDetail(body) {\n  if (!body || typeof body !== 'object') return {};\n  const error = body.error;\n  if (typeof error === 'string') return { message: error };\n  if (error && typeof error === 'object') {\n    return {\n      message: typeof error.message === 'string' ? error.message : undefined,\n      code: typeof error.code === 'string' ? error.code : undefined,\n    };\n  }\n  return typeof body.message === 'string' ? { message: body.message } : {};\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    // Server-side failures may carry stack traces or upstream payloads. Do not\n    // parse, interpolate, or expose them to browser callers.\n    if (response.status >= 500) {\n      throw new SmrtClientError(\n        'Request failed with status ' + response.status,\n        response.status,\n      );\n    }\n    const body = await __smrtParseBody(response);\n    const detail = __smrtErrorDetail(body);\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status +\n        (detail.message ? ': ' + detail.message : ''),\n      response.status,\n      body,\n      detail.code,\n    );\n  }\n  return __smrtParseBody(response);\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    // Keep 5xx failures opaque for the same reason as __smrtFetchJson.\n    if (response.status >= 500) {\n      throw new SmrtClientError(\n        'Request failed with status ' + response.status,\n        response.status,\n      );\n    }\n    const body = await __smrtParseBody(response);\n    const detail = __smrtErrorDetail(body);\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status +\n        (detail.message ? ': ' + detail.message : ''),\n      response.status,\n      body,\n      detail.code,\n    );\n  }\n  return true;\n}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,IAAa,uBAAuB"}

package/dist/generators/index.d.ts

@@ -6,11 +6,12 @@ export { CLIGenerator, getCLIHandler, setupCLI } from './cli';
 export { canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, PRIVATE_READ_CACHE_CONTROL, type ReadCacheControlOptions, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized, } from './conditional-get';
 export { buildCustomActionInputSchema, buildCustomActionInvocationArgs, type CustomActionFailure, type CustomActionMetadata, type CustomActionScope, customActionParameterInputName, normalizeCustomActionFailure, type ResolveCustomActionMetadataOptions, resolveCustomActionMetadata, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, } from './custom-action';
 export { buildChangeEventStream, type ChangeEventStreamOptions, changeEventSubscribersAtCapacity, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot, } from './events-route';
-export type { MCPConfig, MCPContext, MCPRequest, MCPResponse, MCPTool, } from './mcp';
-export { MCPGenerator } from './mcp';
+export type { MCPConfig, MCPContext, MCPRequest, MCPResponse, MCPTool, MCPToolListCacheHint, MCPToolListCacheOptions, } from './mcp';
+export { MCP_STABLE_CATALOG_TTL_MS, MCPGenerator, resolveMCPToolListCacheHint, sortMCPTools, } from './mcp';
 export type { APIConfig, APIContext, RestServerConfig } from './rest';
 export { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer, } from './rest';
 export type { OpenAPIConfig } from './swagger';
 export { generateOpenAPISpec, setupSwaggerUI, } from './swagger';
 export { runWithTenantGate, setTenantEntryPointRunner, type TenantEntryPointRunner, type TenantGateOptions, } from './tenant-gate';
+export { normalizeTypedHttpError, type TypedHttpFailure, } from './typed-http-error';
 //# sourceMappingURL=index.d.ts.map

package/dist/generators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generators/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,2BAA2B,EAC3B,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,2BAA2B,EAC3B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,OAAO,GACR,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EACL,YAAY,EACZ,6BAA6B,EAC7B,gBAAgB,EAChB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generators/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,2BAA2B,EAC3B,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,2BAA2B,EAC3B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,OAAO,EACP,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,OAAO,CAAC;AAEf,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,2BAA2B,EAC3B,YAAY,GACb,MAAM,OAAO,CAAC;AACf,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EACL,YAAY,EACZ,6BAA6B,EAC7B,gBAAgB,EAChB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/generators/index.js

@@ -3,7 +3,8 @@ import { runWithTenantGate, setTenantEntryPointRunner } from "./tenant-gate.js";
 import { CLIGenerator, getCLIHandler, setupCLI } from "./cli.js";
 import { PRIVATE_READ_CACHE_CONTROL, canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized } from "./conditional-get.js";
 import { DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, buildChangeEventStream, changeEventSubscribersAtCapacity, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot } from "./events-route.js";
-import { MCPGenerator } from "./mcp.js";
+import { MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, resolveMCPToolListCacheHint, sortMCPTools } from "./mcp.js";
+import { normalizeTypedHttpError } from "./typed-http-error.js";
 import { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer } from "./rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./swagger.js";
-export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, resolveCustomActionMetadata, resolveReadCacheControl, resolveTenantEtagDiscriminator, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };
+export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, normalizeTypedHttpError, resolveCustomActionMetadata, resolveMCPToolListCacheHint, resolveReadCacheControl, resolveTenantEtagDiscriminator, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, sortMCPTools, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };

package/dist/generators/mcp-runtime-template.d.ts

@@ -20,6 +20,11 @@ export interface RuntimeOptions {
         inputSchema: Record<string, unknown>;
         outputSchema?: Record<string, unknown>;
     }>;
+    /** Cache hint emitted for deploy-static tools/list results. */
+    toolListCacheHint?: {
+        ttlMs: number;
+        cacheScope: 'private' | 'public';
+    };
     /** Internal invocation metadata; never exposed by the MCP tools/list result. */
     customActions?: Record<string, {
         scope: CustomActionScope;
@@ -30,6 +35,11 @@ export interface RuntimeOptions {
         optionsParameter?: boolean;
         legacyOptions: boolean;
     }>;
+    /** Task-enabled item custom actions. Never emitted in tools/list. */
+    taskActions?: Record<string, {
+        objectName: string;
+        objectType: string;
+    }>;
     /**
      * Lowercased simple names of objects that are `@TenantScoped` (#1554). When
      * non-empty, the generated server imports the tenancy fail-closed gate and

package/dist/generators/mcp-runtime-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-runtime-template.d.ts","sourceRoot":"","sources":["../../src/generators/mcp-runtime-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAStD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wDAAwD;IACxD,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CACpB,MAAM,EACN;QACE,KAAK,EAAE,iBAAiB,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC;QAClB,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,OAAO,CAAC;KACxB,CACF,CAAC;IAEF;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CA8d7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,MAA6B,GACxC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CA0GR"}
+{"version":3,"file":"mcp-runtime-template.d.ts","sourceRoot":"","sources":["../../src/generators/mcp-runtime-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAStD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wDAAwD;IACxD,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,CAAC,CAAC;IACH,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;KAClC,CAAC;IACF,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CACpB,MAAM,EACN;QACE,KAAK,EAAE,iBAAiB,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC;QAClB,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,OAAO,CAAC;KACxB,CACF,CAAC;IACF,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAClB,MAAM,EACN;QACE,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CACF,CAAC;IAEF;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CA2sB7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,MAA6B,GACxC,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CA0GR"}

package/dist/generators/mcp-runtime-template.js

@@ -12,8 +12,12 @@ function capitalize(str) {
 * @returns TypeScript code for server entry point
 */
 function generateRuntimeBootstrap(options = {}) {
-	const { name = "smrt-mcp-server", version = "1.0.0", description = "Auto-generated MCP server from SMRT objects", debug = false, tools = [], customActions = {}, tenantScopedObjects = [], stiTargets = {} } = options;
+	const { name = "smrt-mcp-server", version = "1.0.0", description = "Auto-generated MCP server from SMRT objects", debug = false, tools = [], customActions = {}, taskActions = {}, tenantScopedObjects = [], stiTargets = {}, toolListCacheHint = {
+		ttlMs: 864e5,
+		cacheScope: "private"
+	} } = options;
 	const toolsCode = tools.length > 0 ? JSON.stringify(tools, null, 2) : "[]";
+	const hasTaskActions = Object.keys(taskActions).length > 0;
 	const tenantScopedSet = Array.from(new Set(tenantScopedObjects.map((n) => n.toLowerCase())));
 	const hasTenantScoped = tenantScopedSet.length > 0;
 	const generateSwitchCases = (indent) => {
@@ -180,14 +184,16 @@ import {
   type CallToolRequest,
   type ListToolsRequest,
   Server,
+  ${hasTaskActions ? "specTypeSchemas," : ""}
 } from '@modelcontextprotocol/server';
-import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { ${hasTaskActions ? "StdioServerTransport, " : ""}serveStdio } from '@modelcontextprotocol/server/stdio';
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { ObjectRegistry } from '@happyvertical/smrt-core';
 import { normalizeCustomActionFailure, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY } from '@happyvertical/smrt-core';
 import { loadConfig } from '@happyvertical/smrt-config';
+${hasTaskActions ? "import { McpTaskStore, TaskRunner } from '@happyvertical/smrt-jobs';\n" : ""}
 ${hasTenantScoped ? "import { enableTenancy, runTenantScopedEntryPoint } from '@happyvertical/smrt-tenancy';\n" : ""}
 // Server configuration
 const SERVER_NAME = ${JSON.stringify(name)};
@@ -197,7 +203,9 @@ const DEBUG = ${debug};
 
 // Static tool definitions (generated at build time)
 const TOOLS = ${toolsCode};
+const TOOL_LIST_CACHE_HINT = ${JSON.stringify(toolListCacheHint)};
 const CUSTOM_ACTIONS = ${JSON.stringify(customActions)};
+const TASK_ACTIONS = ${JSON.stringify(taskActions)};
 const STI_TARGETS: Record<string, Record<string, string>> = ${JSON.stringify(stiTargets)};
 ${hasTenantScoped ? `
 // Fail-closed tenant context (#1554): tenant-scoped objects must run inside a
@@ -305,6 +313,211 @@ function errorResult(structuredContent: any, text: string, _meta?: Record<string
   };
 }
 
+${hasTaskActions ? `
+// The bundled SDK validates tools/call responses against its older result
+// codec, which does not yet know CreateTaskResult. Intercept the extension at
+// the transport boundary, then pass every non-task message untouched to the
+// SDK server. This keeps ordinary MCP behaviour and version negotiation owned
+// by the SDK while making the extension available today.
+const MCP_TASKS_EXTENSION = 'io.modelcontextprotocol/tasks';
+let taskRuntime: Promise<{ store: McpTaskStore; runner: TaskRunner }> | undefined;
+
+function clientSupportsTasks(message: any): boolean {
+  return message?.params?._meta?.['io.modelcontextprotocol/clientCapabilities']
+    ?.extensions?.[MCP_TASKS_EXTENSION] !== undefined;
+}
+
+/** Validate the 2026 request envelope before task dispatch mutates a job. */
+function taskEnvelopeError(message: any): { code: number; message: string; data?: any } | undefined {
+  const meta = message?.params?._meta;
+  if (!meta || typeof meta !== 'object' || Array.isArray(meta)) {
+    return {
+      code: -32602,
+      message: 'Request is missing the required _meta envelope for protocol revision 2026-07-28',
+    };
+  }
+  const protocolVersion = meta['io.modelcontextprotocol/protocolVersion'];
+  if (protocolVersion !== '2026-07-28') {
+    return typeof protocolVersion === 'string'
+      ? {
+          code: -32022,
+          message: 'Unsupported protocol version: ' + protocolVersion,
+          data: { supported: ['2026-07-28'], requested: protocolVersion },
+        }
+      : {
+          code: -32602,
+          message: 'Invalid _meta envelope for protocol revision 2026-07-28: io.modelcontextprotocol/protocolVersion must be a string',
+        };
+  }
+  if (!specTypeSchemas.ClientCapabilities.safeParse(
+    meta['io.modelcontextprotocol/clientCapabilities'],
+  ).success) {
+    return {
+      code: -32602,
+      message: 'Invalid _meta envelope for protocol revision 2026-07-28: io.modelcontextprotocol/clientCapabilities is invalid',
+    };
+  }
+  if (
+    meta['io.modelcontextprotocol/clientInfo'] !== undefined &&
+    !specTypeSchemas.Implementation.safeParse(
+      meta['io.modelcontextprotocol/clientInfo'],
+    ).success
+  ) {
+    return {
+      code: -32602,
+      message: 'Invalid _meta envelope for protocol revision 2026-07-28: io.modelcontextprotocol/clientInfo is invalid',
+    };
+  }
+  if (
+    meta['io.modelcontextprotocol/logLevel'] !== undefined &&
+    !specTypeSchemas.LoggingLevel.safeParse(
+      meta['io.modelcontextprotocol/logLevel'],
+    ).success
+  ) {
+    return {
+      code: -32602,
+      message: 'Invalid _meta envelope for protocol revision 2026-07-28: io.modelcontextprotocol/logLevel is invalid',
+    };
+  }
+  if (
+    meta.progressToken !== undefined &&
+    !specTypeSchemas.ProgressToken.safeParse(meta.progressToken).success
+  ) {
+    return {
+      code: -32602,
+      message: 'Invalid _meta envelope for protocol revision 2026-07-28: progressToken is invalid',
+    };
+  }
+  return undefined;
+}
+
+function jsonRpcError(id: any, code: number, message: string, data?: any) {
+  return { jsonrpc: '2.0', id, error: { code, message, ...(data === undefined ? {} : { data }) } };
+}
+
+async function getTaskRuntime() {
+  if (!taskRuntime) {
+    taskRuntime = (async () => {
+      const firstAction = Object.values(TASK_ACTIONS)[0] as { objectName: string } | undefined;
+      if (!firstAction) throw new Error('No task-enabled MCP action is configured');
+      const collection = await ObjectRegistry.getCollection(firstAction.objectName, {
+        persistence: { type: process.env.DATABASE_TYPE || 'sqlite', url: process.env.DATABASE_URL || ':memory:' },
+      });
+      const db = collection.db;
+      const store = await McpTaskStore.create(db, { ownerId: process.env.SMRT_MCP_TENANT_ID || null });
+      const runner = new TaskRunner({ queues: ['mcp-tasks'] });
+      await runner.initialize(db);
+      await runner.start();
+      return { store, runner };
+    })();
+  }
+  return taskRuntime;
+}
+
+function taskInvocationArgs(actionMeta: any, args: Record<string, any>): any[] {
+  const { id: _id, options, ...directArgs } = args;
+  if (actionMeta.legacyOptions) {
+    return [Object.keys(options ?? {}).length > 0 ? options : directArgs];
+  }
+  if (actionMeta.optionsParameter) return [options];
+  const parameterNames = actionMeta.parameterNames || [];
+  const invocationParameterNames = parameterNames.at(-1) === 'context'
+    ? parameterNames.slice(0, -1)
+    : parameterNames;
+  return invocationParameterNames.map((parameterName: string) =>
+    args[parameterName === 'id' ? 'actionId' : parameterName],
+  );
+}
+
+async function handleTaskExtensionMessage(message: any): Promise<any | null> {
+  if (!message || typeof message !== 'object' || message.id === undefined) return null;
+  const method = message.method;
+  const params = message.params ?? {};
+  const action = method === 'tools/call' ? TASK_ACTIONS[params.name] : undefined;
+  const isTaskMethod = action || ['tasks/get', 'tasks/update', 'tasks/cancel'].includes(method);
+  if (!isTaskMethod) return null;
+  // A task-enabled tool retains its normal synchronous behaviour until its
+  // client explicitly opts into Tasks. Do not impose the task envelope on
+  // legacy calls that will be passed untouched to the SDK.
+  if (!clientSupportsTasks(message) && method === 'tools/call') return null;
+  const envelopeError = taskEnvelopeError(message);
+  if (envelopeError) {
+    return jsonRpcError(message.id, envelopeError.code, envelopeError.message, envelopeError.data);
+  }
+  if (!clientSupportsTasks(message)) {
+    // A task-only method cannot fall back to a legacy response shape. A task
+    // tool can still run normally when the client did not opt in, so let the
+    // SDK handle that direct tools/call path.
+    if (method === 'tools/call') return null;
+    return jsonRpcError(message.id, -32021, 'Missing required client capability', {
+      requiredCapabilities: { extensions: { [MCP_TASKS_EXTENSION]: {} } },
+    });
+  }
+  try {
+    const { store } = await getTaskRuntime();
+    if (action) {
+      if (typeof params.arguments?.id !== 'string') {
+        return jsonRpcError(message.id, -32602, 'Task-enabled custom actions require an id');
+      }
+      const actionMeta = CUSTOM_ACTIONS[params.name];
+      const task = await store.createTask({
+        objectType: action.objectType,
+        objectId: params.arguments.id,
+        method: actionMeta.methodName || params.name.slice(params.name.indexOf('_') + 1),
+        invocationArgs: taskInvocationArgs(actionMeta, params.arguments),
+        tenantId: ${hasTenantScoped ? "MCP_TENANT_ID ?? null" : "null"},
+      });
+      return { jsonrpc: '2.0', id: message.id, result: { resultType: 'task', content: [], structuredContent: {}, ...task } };
+    }
+    if (typeof params.taskId !== 'string') {
+      return jsonRpcError(message.id, -32602, 'taskId is required');
+    }
+    if (method === 'tasks/get') {
+      const task = await store.getTask(params.taskId);
+      return { jsonrpc: '2.0', id: message.id, result: { resultType: 'complete', ...task } };
+    }
+    if (method === 'tasks/update') {
+      await store.updateTask(
+        params.taskId,
+        params.inputResponses && typeof params.inputResponses === 'object'
+          ? params.inputResponses
+          : {},
+      );
+      return { jsonrpc: '2.0', id: message.id, result: { resultType: 'complete' } };
+    }
+    await store.cancelTask(params.taskId);
+    return { jsonrpc: '2.0', id: message.id, result: { resultType: 'complete' } };
+  } catch (error) {
+    const messageText = error instanceof Error ? error.message : 'Task operation failed';
+    return jsonRpcError(message.id, -32602, messageText);
+  }
+}
+
+class McpTaskExtensionTransport {
+  onclose?: () => void;
+  onerror?: (error: Error) => void;
+  onmessage?: (message: any) => void;
+
+  constructor(private readonly wire: StdioServerTransport) {}
+
+  async start() {
+    this.wire.onclose = () => this.onclose?.();
+    this.wire.onerror = (error) => this.onerror?.(error);
+    this.wire.onmessage = (message) => {
+      void (async () => {
+        const response = await handleTaskExtensionMessage(message);
+        if (response) await this.wire.send(response);
+        else this.onmessage?.(message);
+      })().catch((error) => this.onerror?.(error instanceof Error ? error : new Error(String(error))));
+    };
+    await this.wire.start();
+  }
+
+  close() { return this.wire.close(); }
+  send(message: any) { return this.wire.send(message); }
+}
+` : ""}
+
 /**
  * Main server startup function
  */
@@ -331,6 +544,16 @@ ${hasTenantScoped ? `
       ObjectRegistry.loadAllManifests({ manifestPaths: localManifestPaths });
     }
 
+    // A manifest supplies schemas and tool metadata, while an executable
+    // custom action also needs the application's actual class constructor.
+    // Consumer builds generate this registration module; load it after the
+    // manifest so decorators enrich the already-known metadata.
+    const localRegisterPath = process.env.SMRT_MCP_REGISTER_PATH
+      || resolve(process.cwd(), '.smrt', 'register.js');
+    if (existsSync(localRegisterPath)) {
+      await import(pathToFileURL(localRegisterPath).href);
+    }
+
     // Load configuration from environment and .smrt.config files
     const appConfig = await loadConfig();
     const aiConfig = appConfig?.ai || {};
@@ -349,6 +572,10 @@ ${hasTenantScoped ? `
       {
         capabilities: {
           tools: {},
+          ${hasTaskActions ? "extensions: { 'io.modelcontextprotocol/tasks': {} }," : ""}
+        },
+        cacheHints: {
+          'tools/list': TOOL_LIST_CACHE_HINT,
         },
       }
     );
@@ -360,7 +587,7 @@ ${hasTenantScoped ? `
       }
 
       return {
-        tools: TOOLS,
+        tools: [...TOOLS].sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0),
       };
     });
 
@@ -416,11 +643,18 @@ ${hasTenantScoped ? `
 
 async function main() {
   try {
-    const handle = serveStdio(() => createServer(), {
+    // Initialize the registry before accepting an intercepted task call. The
+    // SDK would normally invoke this factory for the first regular message,
+    // but task calls can be the first message on a stdio connection.
+    const server = await createServer();
+    const transport = ${hasTaskActions ? "new McpTaskExtensionTransport(new StdioServerTransport())" : "undefined"};
+    const handle = serveStdio(() => server, {
+      ...(transport ? { transport } : {}),
       onerror: (error) => console.error('[MCP] Protocol error:', error),
     });
     const shutdown = async () => {
       if (DEBUG) console.error('[MCP] Shutting down gracefully');
+      ${hasTaskActions ? "if (taskRuntime) {\n        const { runner } = await taskRuntime;\n        await runner.stop();\n      }" : ""}
       await handle.close();
       process.exit(0);
     };