create-ailk 0.17.0 → 0.19.0

package/templates/apps/mcp/__tests__/subscribe_newsletter.test.ts

@@ -7,17 +7,27 @@
  * 3. API 400 → { ok: false, error: { kind: 'api_error', status: 400 } }
  * 4. API 503 → { ok: false, error: { kind: 'api_error', status: 503 } }
  * 5. API 429 → { ok: false, error: { kind: 'api_error', status: 429 } }
+ * 6. #8073 — forwards the trusted caller address + AILK_VISITOR_FORWARD_KEY
+ *    as the two visitor-forwarding headers only when both are present
  */
 
 import { ailkSubscribeNewsletter } from "../src/tools/subscribe_newsletter.js";
-
-jest.mock("@working-theory/api-client", () => ({
-  apiClient: {
-    leads: {
-      subscribe: jest.fn(),
+import { trustedCallerAddress } from "../src/request-context.js";
+
+// Everything but `apiClient.leads.subscribe` stays the ACTUAL
+// implementation — in particular `visitorForwardHeaders`, which
+// `request-context.ts` (imported above, for `trustedCallerAddress`) reads
+// for real.
+jest.mock("@working-theory/api-client", () => {
+  const actual = jest.requireActual("@working-theory/api-client");
+  return {
+    ...actual,
+    apiClient: {
+      ...actual.apiClient,
+      leads: { ...actual.apiClient.leads, subscribe: jest.fn() },
     },
-  },
-}));
+  };
+});
 
  
 const { apiClient } = require("@working-theory/api-client") as {
@@ -159,3 +169,55 @@ describe("ailkSubscribeNewsletter — siteId override", () => {
     expect(call.siteId).toBe("site-abc");
   });
 });
+
+describe("ailkSubscribeNewsletter — visitor-forwarding headers (#8073)", () => {
+  afterEach(() => {
+    delete process.env.AILK_VISITOR_FORWARD_KEY;
+  });
+
+  it("calls api-client with exactly one argument when there is no trusted address", async () => {
+    apiClient.leads.subscribe.mockResolvedValueOnce({
+      ok: true,
+      body: { id: "subscr_00000000-0000-7000-8000-0000000000e1", persisted: "db" },
+    });
+    process.env.AILK_VISITOR_FORWARD_KEY = "spoke-key";
+
+    await ailkSubscribeNewsletter(VALID_INPUT);
+
+    expect(apiClient.leads.subscribe.mock.calls[0]).toHaveLength(1);
+  });
+
+  it("forwards the trusted address and the forward key as the two visitor headers", async () => {
+    apiClient.leads.subscribe.mockResolvedValueOnce({
+      ok: true,
+      body: { id: "subscr_00000000-0000-7000-8000-0000000000e2", persisted: "db" },
+    });
+    process.env.AILK_VISITOR_FORWARD_KEY = "spoke-key";
+
+    await trustedCallerAddress.run("203.0.113.9", () =>
+      ailkSubscribeNewsletter(VALID_INPUT),
+    );
+
+    const init = apiClient.leads.subscribe.mock.calls[0][1] as
+      | { headers?: Record<string, string> }
+      | undefined;
+    expect(init?.headers).toEqual({
+      "x-ailk-visitor-ip": "203.0.113.9",
+      "x-ailk-visitor-forward-key": "spoke-key",
+    });
+  });
+
+  it("sends no headers when there is a trusted address but no forward key", async () => {
+    apiClient.leads.subscribe.mockResolvedValueOnce({
+      ok: true,
+      body: { id: "subscr_00000000-0000-7000-8000-0000000000e3", persisted: "db" },
+    });
+    delete process.env.AILK_VISITOR_FORWARD_KEY;
+
+    await trustedCallerAddress.run("203.0.113.9", () =>
+      ailkSubscribeNewsletter(VALID_INPUT),
+    );
+
+    expect(apiClient.leads.subscribe.mock.calls[0]).toHaveLength(1);
+  });
+});

package/templates/apps/mcp/jest.config.cjs

@@ -12,16 +12,8 @@ module.exports = {
   testMatch: ['**/__tests__/**/*.test.ts'],
   moduleFileExtensions: ['ts', 'js', 'json'],
   moduleNameMapper: {
-    // Mock server-only in Jest environments — the package throws by design
-    // outside Next.js. The real guard runs in production Next.js builds.
-    '^server-only$': '<rootDir>/../../__mocks__/server-only.ts',
-    // Map workspace packages to their TypeScript source so ts-jest compiles them
-    // directly (the published dist is ESM, which Jest's CJS preset can't load).
-    '^@working-theory/aeo$': '<rootDir>/../../packages/aeo/src/index.ts',
-    '^@working-theory/common$': '<rootDir>/../../packages/common/src/index.ts',
-    '^@working-theory/aeo/(.*)$': '<rootDir>/../../packages/aeo/src/$1',
-    '^@working-theory/content-adapters$': '<rootDir>/../../packages/content-adapters/src/index.ts',
-    '^@working-theory/content-adapters/(.*)$': '<rootDir>/../../packages/content-adapters/src/$1',
+    // @working-theory/* resolve from the installed packages; their ESM
+    // dist is converted by the transform below.
     // The constants + one-workspace predicate subpath only (#5876 spec D11) —
     // no @prisma/client import, so ts-jest compiles it directly like every
     // other workspace mapping below. The database/dist/ build is empty in a
@@ -29,23 +21,11 @@ module.exports = {
     // can't load. The CLIENT root (`@working-theory/database`) stays
     // deliberately UNMAPPED — see apps/mcp/src/lib/prisma.ts.
     '^@working-theory/database/tenancy$': '<rootDir>/../../database/tenancy.ts',
-    // tenancy.ts's isSentinel import (above) is a VALUE import, so every
-    // suite that loads the tenancy subpath transitively loads this one too
-    // — mirrors apps/api/jest.config.cjs's identical mapping.
-    '^@working-theory/ids$': '<rootDir>/../../packages/ids/src/index.ts',
-    '^@working-theory/license$': '<rootDir>/../../packages/license/src/index.ts',
-    '^@working-theory/metadata$': '<rootDir>/../../packages/metadata/src/index.ts',
-    '^@working-theory/schema$': '<rootDir>/../../packages/schema/src/index.ts',
-    '^@working-theory/schema/(.*)$': '<rootDir>/../../packages/schema/src/$1',
-    '^@working-theory/schema-validator$': '<rootDir>/../../packages/schema-validator/src/index.ts',
-    '^@working-theory/schema-pack-registry$': '<rootDir>/../../packages/schema-pack-registry/src/index.ts',
-    '^@working-theory/validation$': '<rootDir>/../../packages/validation/src/index.ts',
-    '^@working-theory/api-client$': '<rootDir>/../../packages/api-client/src/index.ts',
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },
   collectCoverageFrom: ['src/**/*.ts', '!src/**/*.d.ts'],
   transformIgnorePatterns: [
-    '/node_modules/(?!(\\.pnpm/)?jose@?[^/]*?(/|$))',
+    '/node_modules/(?!(\\.pnpm/)?(jose@?[^/]*?|cookie@?[^/]*?|@vercel(?:\\+analytics@[^/]*?|/analytics)|@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+))(/|$))',
   ],
   transform: {
     '^.+\\.(tsx?|jsx?|mjs)$': [
@@ -61,27 +41,6 @@ module.exports = {
           skipLibCheck: true,
           ignoreDeprecations: '6.0',
           allowJs: true,
-          // paths must mirror moduleNameMapper above so ts-jest's TypeScript
-          // type-checker can resolve workspace package imports during compile.
-          // Jest's moduleNameMapper handles runtime resolution; TS uses paths.
-          baseUrl: '.',
-          paths: {
-            '@working-theory/aeo': ['../../packages/aeo/src/index.ts'],
-            '@working-theory/common': ['../../packages/common/src/index.ts'],
-            '@working-theory/aeo/*': ['../../packages/aeo/src/*'],
-            '@working-theory/api-client': ['../../packages/api-client/src/index.ts'],
-            '@working-theory/content-adapters': ['../../packages/content-adapters/src/index.ts'],
-            '@working-theory/content-adapters/*': ['../../packages/content-adapters/src/*'],
-            '@working-theory/database/tenancy': ['../../database/tenancy.ts'],
-            '@working-theory/ids': ['../../packages/ids/src/index.ts'],
-            '@working-theory/license': ['../../packages/license/src/index.ts'],
-            '@working-theory/metadata': ['../../packages/metadata/src/index.ts'],
-            '@working-theory/schema': ['../../packages/schema/src/index.ts'],
-            '@working-theory/schema/*': ['../../packages/schema/src/*'],
-            '@working-theory/schema-validator': ['../../packages/schema-validator/src/index.ts'],
-            '@working-theory/schema-pack-registry': ['../../packages/schema-pack-registry/src/index.ts'],
-            '@working-theory/validation': ['../../packages/validation/src/index.ts'],
-          },
         },
         // Suppress "import.meta only allowed in ESM modules" — source is ESM,
         // but ts-jest compiles to CommonJS for Jest. The import.meta fallback

package/templates/apps/mcp/src/abuse/index.ts

@@ -2,16 +2,18 @@
  * Abuse rule orchestrator for MCP write tools.
  *
  * Runs all in-process heuristics for the anonymous write tools:
- * capture_lead, subscribe_newsletter, request_callback, and — since #5971 —
- * start_purchase.
+ * capture_lead, subscribe_newsletter, request_callback, start_purchase
+ * (#5971), and — since #8071 — create_booking and submit_flow_step.
  *
  * Rules applied (in order):
  *   1. User-Agent deny list (applies to all write tools)
  *   2. Honeypot field check (applies to all write tools)
- *   3. Email format validation (capture_lead, subscribe_newsletter)
- *   4. Per-IP daily cap (capture_lead and start_purchase, each on its OWN
- *      tracker — sharing one would let purchase attempts consume the lead
- *      budget and vice versa, a silent cross-tool denial of service)
+ *   3. Email format validation (capture_lead, subscribe_newsletter, and
+ *      create_booking's attendee.email)
+ *   4. Per-IP daily cap (capture_lead, start_purchase, create_booking and
+ *      submit_flow_step, each on its OWN tracker — sharing one would let one
+ *      tool's calls consume another's budget, a silent cross-tool denial of
+ *      service)
  *
  * The paid layer (lead-routing.ts) extends with real abuse-protection
  * services. OSS gets basic heuristics that stop obvious bots.
@@ -24,11 +26,40 @@ import { isValidEmail } from "./email-validator.js";
 import { isHoneypotTripped } from "./honeypot.js";
 import { buildDenyList, isUserAgentBlocked } from "./user-agent-deny.js";
 
-/** Tools that require email format validation on their input. */
-const EMAIL_VALIDATED_TOOLS = new Set(["capture_lead", "subscribe_newsletter"]);
+/**
+ * Tools that require email format validation on their input, each mapped to
+ * where the email sits in it: top level for the lead tools, `attendee.email`
+ * for create_booking (#8071 D3). submit_flow_step has no fixed email field —
+ * its `values` is a free record the hub's flow engine validates.
+ */
+const EMAIL_VALIDATED_TOOLS = new Map<string, readonly string[]>([
+  ["capture_lead", ["email"]],
+  ["subscribe_newsletter", ["email"]],
+  ["create_booking", ["attendee", "email"]],
+]);
+
+/**
+ * The value at `path` in `input`, or undefined when any step is not a plain
+ * object — a `null`, string or array `attendee` reads as a missing email, so a
+ * malformed body can never throw out of the guard (#8071 SEC-13).
+ */
+function valueAt(input: unknown, path: readonly string[]): unknown {
+  let value = input;
+  for (const key of path) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return undefined;
+    }
+    value = (value as Record<string, unknown>)[key];
+  }
+  return value;
+}
 
 /** The per-tool daily-cap budgets, keyed by MCP tool name. */
-type DailyCapKey = "captureLead" | "startPurchase";
+type DailyCapKey =
+  | "captureLead"
+  | "startPurchase"
+  | "createBooking"
+  | "submitFlowStep";
 
 /**
  * The typed reason codes an {@link AbuseResult} refusal can carry.
@@ -56,8 +87,9 @@ export type AbuseReasonCode =
 /**
  * Tools that apply a per-IP daily cap, each mapped to the tracker that budgets
  * it and the refusal reason it answers with. One tracker per entry — never
- * shared across tools, since a shared budget would let purchase attempts
- * consume the lead allowance and vice versa.
+ * shared across tools, since a shared budget would let one tool's calls
+ * consume another's allowance (purchase attempts the lead budget, flow steps
+ * the lead budget they could otherwise mint Leads past).
  *
  * The reason strings here are prose for the caller and nothing more: every
  * entry refuses with {@link AbuseReasonCode.DAILY_CAP_REACHED}, and that code
@@ -81,6 +113,20 @@ const DAILY_CAPPED_TOOLS = new Map<
       reason: "daily cap reached for start_purchase from this IP",
     },
   ],
+  [
+    "create_booking",
+    {
+      tracker: "createBooking",
+      reason: "daily cap reached for create_booking from this IP",
+    },
+  ],
+  [
+    "submit_flow_step",
+    {
+      tracker: "submitFlowStep",
+      reason: "daily cap reached for submit_flow_step from this IP",
+    },
+  ],
 ]);
 
 export interface AbuseConfig {
@@ -93,6 +139,18 @@ export interface AbuseConfig {
    * keep compiling; omitted falls back to the default.
    */
   startPurchaseDailyCapPerIp?: number;
+  /**
+   * Per-IP daily cap for create_booking (#8071). Default 20, as for
+   * start_purchase: each call creates a real calendar event and emails the
+   * attendee an invite. Optional; omitted falls back to the default.
+   */
+  createBookingDailyCapPerIp?: number;
+  /**
+   * Per-IP daily cap for submit_flow_step (#8071). Default 50, equal to
+   * capture_lead's and no higher: a one-step flow creates a Lead in one call.
+   * Optional; omitted falls back to the default.
+   */
+  submitFlowStepDailyCapPerIp?: number;
   /** Comma-separated extra UA substrings to block. */
   blockedUserAgents: string;
 }
@@ -103,6 +161,12 @@ export const DEFAULT_START_PURCHASE_DAILY_CAP = 20;
 /** Default per-IP daily cap for capture_lead when none is configured. */
 export const DEFAULT_CAPTURE_LEAD_DAILY_CAP = 50;
 
+/** Default per-IP daily cap for create_booking when none is configured. */
+export const DEFAULT_CREATE_BOOKING_DAILY_CAP = 20;
+
+/** Default per-IP daily cap for submit_flow_step when none is configured. */
+export const DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP = 50;
+
 /**
  * Reads a positive-integer env var, falling back to `fallback` for anything
  * that is not one.
@@ -162,6 +226,18 @@ export class AbuseGuard {
           DEFAULT_START_PURCHASE_DAILY_CAP,
         ),
       ),
+      createBooking: new DailyCapTracker(
+        usableCap(
+          config.createBookingDailyCapPerIp,
+          DEFAULT_CREATE_BOOKING_DAILY_CAP,
+        ),
+      ),
+      submitFlowStep: new DailyCapTracker(
+        usableCap(
+          config.submitFlowStepDailyCapPerIp,
+          DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+        ),
+      ),
     };
   }
 
@@ -198,10 +274,12 @@ export class AbuseGuard {
       };
     }
 
-    // Rule 3: Email format validation
-    if (EMAIL_VALIDATED_TOOLS.has(toolName)) {
-      const rec = input as Record<string, unknown>;
-      const email = rec["email"];
+    // Rule 3: Email format validation, at the tool's own email path. A
+    // missing or non-string email passes — the handler's Zod schema is the
+    // authority on required fields.
+    const emailPath = EMAIL_VALIDATED_TOOLS.get(toolName);
+    if (emailPath !== undefined) {
+      const email = valueAt(input, emailPath);
       if (typeof email === "string" && !isValidEmail(email)) {
         return {
           allowed: false,
@@ -227,12 +305,16 @@ export class AbuseGuard {
 }
 
 /**
- * Convenience function for constructing an AbuseGuard from env vars.
- * Reads MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP,
- * MCP_ABUSE_START_PURCHASE_DAILY_CAP and MCP_ABUSE_BLOCKED_USER_AGENTS.
+ * The abuse configuration, read from the environment. The one reader of the
+ * MCP_ABUSE_* variables: both entries reach it through
+ * `httpTransportConfigFromEnv()` (`src/boot.ts`), and
+ * {@link createAbuseGuardFromEnv} wraps it, so a new cap is added here once.
+ *
+ * Every cap goes through {@link readPositiveIntEnv}: a blank, zero or
+ * non-numeric value yields its default, never an unlimited cap.
  */
-export function createAbuseGuardFromEnv(): AbuseGuard {
-  return new AbuseGuard({
+export function abuseConfigFromEnv(): Required<AbuseConfig> {
+  return {
     captureLeadDailyCapPerIp: readPositiveIntEnv(
       "MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP",
       DEFAULT_CAPTURE_LEAD_DAILY_CAP,
@@ -241,6 +323,20 @@ export function createAbuseGuardFromEnv(): AbuseGuard {
       "MCP_ABUSE_START_PURCHASE_DAILY_CAP",
       DEFAULT_START_PURCHASE_DAILY_CAP,
     ),
+    createBookingDailyCapPerIp: readPositiveIntEnv(
+      "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
+      DEFAULT_CREATE_BOOKING_DAILY_CAP,
+    ),
+    submitFlowStepDailyCapPerIp: readPositiveIntEnv(
+      "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
+      DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+    ),
+    // A literal read, so create-ailk's declared-env scan finds it (#7874).
     blockedUserAgents: process.env["MCP_ABUSE_BLOCKED_USER_AGENTS"] ?? "",
-  });
+  };
+}
+
+/** An AbuseGuard built from {@link abuseConfigFromEnv}. */
+export function createAbuseGuardFromEnv(): AbuseGuard {
+  return new AbuseGuard(abuseConfigFromEnv());
 }

package/templates/apps/mcp/src/app.ts

@@ -0,0 +1,32 @@
+/**
+ * @working-theory/mcp — the Vercel entry (#8070 D2).
+ *
+ * A Vercel project whose root directory is `apps/mcp` detects this file
+ * (`src/app` precedes `src/index` in its Node-backend search, and the chosen
+ * file must import the framework), builds it, and calls the default export —
+ * the `serverlessHandler(app)` request function, which Vercel's Node runtime
+ * accepts where a bare Fastify instance is not a shape it runs.
+ * It never listens; the module-level `await` runs once per instance, so a
+ * warm instance reuses the booted app.
+ *
+ * Run locally, use `src/index.ts` (stdio, or HTTP on MCP_HTTP_PORT) instead.
+ * Everything testable lives in `serverless-app.ts`.
+ */
+
+import Fastify from "fastify";
+
+import { bootMcp } from "./boot.js";
+import {
+  configureServerlessApp,
+  SERVERLESS_FASTIFY_OPTIONS,
+  serverlessHandler,
+} from "./serverless-app.js";
+
+/** Read statically by Vercel's Node builder; caps one request (S8070-03). */
+export const config = { maxDuration: 30 };
+
+await bootMcp();
+const app = Fastify(SERVERLESS_FASTIFY_OPTIONS);
+await configureServerlessApp(app);
+await app.ready();
+export default serverlessHandler(app);

package/templates/apps/mcp/src/boot.ts

@@ -0,0 +1,167 @@
+/**
+ * The boot sequence and the HTTP env→config reader both entrypoints share
+ * (#8070 D1, D2).
+ *
+ * `src/index.ts` (stdio, or HTTP on `MCP_HTTP_PORT`) and `src/app.ts` (the
+ * Vercel entry) each call {@link bootMcp} before they build a transport, and
+ * read the HTTP configuration through {@link httpTransportConfigFromEnv} and
+ * {@link readStatelessEnv}. One copy of each, so the two entries cannot drift.
+ *
+ * Nothing here loads Fastify: the HTTP transport's config type is imported as
+ * a type only, so the stdio entry still never loads the HTTP stack.
+ */
+
+import { abuseConfigFromEnv, readPositiveIntEnv } from "./abuse/index.js";
+import type { HttpTransportConfig } from "./http-transport.js";
+import {
+  initMcpCommerceClaim,
+  startMcpClaimRefresh,
+} from "./lib/commerce-claim.js";
+import {
+  initPublicWorkspace,
+  registerLicenseKeyStore,
+} from "./lib/topology.generated.js";
+
+/**
+ * Runs the boot sequence, in order: the workspace resolution, the licence-key
+ * store, the commerce claim, the claim re-read loop and the one-release
+ * licence warning. Each step that can fail is guarded so one failure never
+ * takes the other tools down.
+ */
+export async function bootMcp(): Promise<void> {
+  // Resolves the MCP server's own workspace ONCE, before any transport is
+  // built — a no-op unless CONTENT_ADAPTER=database (#5876 spec D4/D6).
+  // This is the one `await` that covers every transport:
+  // `getMcpContentAdapter()` (content-adapter.ts) stays synchronous and reads
+  // the memoised result.
+  //
+  // A REJECTION here (a transient DB error — unreachable at boot, a migration
+  // in progress, a bad DATABASE_URL) is caught rather than left to crash the
+  // process: every OTHER tool (lead capture, scheduling, …) has nothing to do
+  // with the content adapter and must keep serving. The module's un-resolved
+  // `{ kind: "not-required" }` state is left in place on a caught failure —
+  // the SAME fail-closed shape an ambiguous workspace count already produces
+  // (D5) — so content tools serve their empty/not-found shape rather than the
+  // whole server going dark over one adapter's connectivity.
+  try {
+    await initPublicWorkspace();
+  } catch (err) {
+    console.error(
+      "[mcp] initPublicWorkspace() failed — content tools will serve their " +
+        "fail-closed empty shape under CONTENT_ADAPTER=database until this " +
+        "resolves; every other tool is unaffected:",
+      err,
+    );
+  }
+
+  // Registers the renewed licence key's durable home (#6677 DD-6) BEFORE the
+  // commerce claim below memoises the licence: with a database, the key a
+  // sibling app renewed lives in one SiteSetting row, and the claim must read
+  // it. Never throws; without DATABASE_URL the file store stays in place.
+  await registerLicenseKeyStore();
+
+  // Resolves the deployment's `commerce` add-on claim at boot, before any
+  // transport is built — the sibling of the workspace resolution above and
+  // the same #5876 idiom (#5971 spec D2). Without this await the memoised
+  // claim is never resolved and `start_purchase` is invisible on a KEYED
+  // site too. The same single licence read now also resolves the licence
+  // features the deployment holds, which gate the five `feature`-tagged
+  // tools (#7136). The re-read loop below runs every `MCP_CLAIM_REFRESH_MS`
+  // thereafter (#7156), so the server's origin agrees with the manifest
+  // route's origin response within that bound; the route answers
+  // `cache-control: public, max-age=86400`, so a downstream cache may serve
+  // an older manifest for up to 24 hours.
+  //
+  // A REJECTION is caught for the same reason: a licence read that fails
+  // must not take the other 19 tools down. `initMcpCommerceClaim()` already
+  // resolves to the fail-closed "unclaimed" internally, so this catch is
+  // belt-and-braces for anything thrown outside its own try.
+  try {
+    await initMcpCommerceClaim();
+  } catch (err) {
+    console.error(
+      "[mcp] initMcpCommerceClaim() failed — start_purchase stays unregistered " +
+        "(fail-closed) until this resolves; every other tool is unaffected:",
+      err,
+    );
+  }
+
+  // Starts the bounded re-read (#7156 spec D1), after the boot read resolves
+  // so the first re-read never races it. Never throws; the timer is unref'd.
+  startMcpClaimRefresh();
+
+  // The one-release warning cycle (#7136): once per process, whichever
+  // transport follows, one stderr line per tool served without its licence
+  // feature. After the claim resolves, or it would warn for every tool.
+  //
+  // A throw here must not stop the server (#7156 spec D2, L1) — only the call
+  // is guarded, not the import: if `./server.js` fails to load, every
+  // transport loads it again and the server could not start anyway.
+  const { reportUnlicensedProTools } = await import("./server.js");
+  try {
+    reportUnlicensedProTools();
+  } catch (err) {
+    console.error(
+      "[mcp] reportUnlicensedProTools() failed — the licence boot warning was " +
+        "not written; every tool is served as registered:",
+      err,
+    );
+  }
+}
+
+/**
+ * Whether the HTTP transport runs stateless, from `MCP_HTTP_STATELESS`
+ * (#8070 D1). Trimmed and case-insensitive: `true`/`1` → on, `false`/`0` →
+ * off, unset or empty → `defaultValue`. Anything else throws, so a typo fails
+ * the boot rather than silently picking a mode.
+ *
+ * Each entry passes its own default: `src/index.ts` passes `false` (today's
+ * stateful server, unchanged); the Vercel entry passes `true`, because a
+ * stateful transport keeps its sessions in one instance's memory and cannot
+ * work across the instances a serverless host runs.
+ */
+export function readStatelessEnv(defaultValue: boolean): boolean {
+  // A literal read, so create-ailk's declared-env scan finds it (#7874).
+  const raw = process.env["MCP_HTTP_STATELESS"];
+  const value = (raw ?? "").trim().toLowerCase();
+  if (value === "") return defaultValue;
+  if (value === "true" || value === "1") return true;
+  if (value === "false" || value === "0") return false;
+  throw new Error(
+    `MCP_HTTP_STATELESS must be one of true, false, 1 or 0 (got "${raw}")`,
+  );
+}
+
+/**
+ * The HTTP transport's configuration, read from the environment as
+ * `src/index.ts` has always read it — with one change: the two per-minute
+ * rates go through {@link readPositiveIntEnv}, as the daily caps already do,
+ * so a blank or non-numeric value falls back to its default instead of
+ * yielding `NaN` and silently disabling the limit (#8070 S8070-06).
+ *
+ * Every variable is optional; the defaults are shown in
+ * `apps/mcp/.env.example`. Stateless mode is not read here: each entry reads
+ * it through {@link readStatelessEnv} with its own default.
+ */
+export function httpTransportConfigFromEnv(): HttpTransportConfig & {
+  port: number;
+} {
+  const port = parseInt(process.env["MCP_HTTP_PORT"] ?? "8080", 10);
+  const path = process.env["MCP_HTTP_PATH"] ?? "/mcp";
+  const readPerMin = readPositiveIntEnv("MCP_RATE_LIMIT_READ_PER_MIN", 60);
+  const writePerMin = readPositiveIntEnv("MCP_RATE_LIMIT_WRITE_PER_MIN", 10);
+  const writeOriginsRaw = process.env["MCP_CORS_WRITE_ALLOWED_ORIGINS"] ?? "";
+  const writeAllowedOrigins = writeOriginsRaw
+    ? writeOriginsRaw.split(",").map((o) => o.trim())
+    : [];
+  return {
+    port,
+    path,
+    rateLimits: { readPerMin, writePerMin },
+    cors: { writeAllowedOrigins },
+    // The MCP_ABUSE_* variables have one reader, shared with
+    // createAbuseGuardFromEnv (#8071); every cap falls back to its default
+    // on a blank or non-numeric value, never to unlimited (#5971).
+    abuse: abuseConfigFromEnv(),
+  };
+}