create-ailk 0.18.0 → 0.19.0

package/templates/apps/mcp/src/abuse/index.ts

@@ -2,16 +2,18 @@
  * Abuse rule orchestrator for MCP write tools.
  *
  * Runs all in-process heuristics for the anonymous write tools:
- * capture_lead, subscribe_newsletter, request_callback, and — since #5971 —
- * start_purchase.
+ * capture_lead, subscribe_newsletter, request_callback, start_purchase
+ * (#5971), and — since #8071 — create_booking and submit_flow_step.
  *
  * Rules applied (in order):
  *   1. User-Agent deny list (applies to all write tools)
  *   2. Honeypot field check (applies to all write tools)
- *   3. Email format validation (capture_lead, subscribe_newsletter)
- *   4. Per-IP daily cap (capture_lead and start_purchase, each on its OWN
- *      tracker — sharing one would let purchase attempts consume the lead
- *      budget and vice versa, a silent cross-tool denial of service)
+ *   3. Email format validation (capture_lead, subscribe_newsletter, and
+ *      create_booking's attendee.email)
+ *   4. Per-IP daily cap (capture_lead, start_purchase, create_booking and
+ *      submit_flow_step, each on its OWN tracker — sharing one would let one
+ *      tool's calls consume another's budget, a silent cross-tool denial of
+ *      service)
  *
  * The paid layer (lead-routing.ts) extends with real abuse-protection
  * services. OSS gets basic heuristics that stop obvious bots.
@@ -24,11 +26,40 @@ import { isValidEmail } from "./email-validator.js";
 import { isHoneypotTripped } from "./honeypot.js";
 import { buildDenyList, isUserAgentBlocked } from "./user-agent-deny.js";
 
-/** Tools that require email format validation on their input. */
-const EMAIL_VALIDATED_TOOLS = new Set(["capture_lead", "subscribe_newsletter"]);
+/**
+ * Tools that require email format validation on their input, each mapped to
+ * where the email sits in it: top level for the lead tools, `attendee.email`
+ * for create_booking (#8071 D3). submit_flow_step has no fixed email field —
+ * its `values` is a free record the hub's flow engine validates.
+ */
+const EMAIL_VALIDATED_TOOLS = new Map<string, readonly string[]>([
+  ["capture_lead", ["email"]],
+  ["subscribe_newsletter", ["email"]],
+  ["create_booking", ["attendee", "email"]],
+]);
+
+/**
+ * The value at `path` in `input`, or undefined when any step is not a plain
+ * object — a `null`, string or array `attendee` reads as a missing email, so a
+ * malformed body can never throw out of the guard (#8071 SEC-13).
+ */
+function valueAt(input: unknown, path: readonly string[]): unknown {
+  let value = input;
+  for (const key of path) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return undefined;
+    }
+    value = (value as Record<string, unknown>)[key];
+  }
+  return value;
+}
 
 /** The per-tool daily-cap budgets, keyed by MCP tool name. */
-type DailyCapKey = "captureLead" | "startPurchase";
+type DailyCapKey =
+  | "captureLead"
+  | "startPurchase"
+  | "createBooking"
+  | "submitFlowStep";
 
 /**
  * The typed reason codes an {@link AbuseResult} refusal can carry.
@@ -56,8 +87,9 @@ export type AbuseReasonCode =
 /**
  * Tools that apply a per-IP daily cap, each mapped to the tracker that budgets
  * it and the refusal reason it answers with. One tracker per entry — never
- * shared across tools, since a shared budget would let purchase attempts
- * consume the lead allowance and vice versa.
+ * shared across tools, since a shared budget would let one tool's calls
+ * consume another's allowance (purchase attempts the lead budget, flow steps
+ * the lead budget they could otherwise mint Leads past).
  *
  * The reason strings here are prose for the caller and nothing more: every
  * entry refuses with {@link AbuseReasonCode.DAILY_CAP_REACHED}, and that code
@@ -81,6 +113,20 @@ const DAILY_CAPPED_TOOLS = new Map<
       reason: "daily cap reached for start_purchase from this IP",
     },
   ],
+  [
+    "create_booking",
+    {
+      tracker: "createBooking",
+      reason: "daily cap reached for create_booking from this IP",
+    },
+  ],
+  [
+    "submit_flow_step",
+    {
+      tracker: "submitFlowStep",
+      reason: "daily cap reached for submit_flow_step from this IP",
+    },
+  ],
 ]);
 
 export interface AbuseConfig {
@@ -93,6 +139,18 @@ export interface AbuseConfig {
    * keep compiling; omitted falls back to the default.
    */
   startPurchaseDailyCapPerIp?: number;
+  /**
+   * Per-IP daily cap for create_booking (#8071). Default 20, as for
+   * start_purchase: each call creates a real calendar event and emails the
+   * attendee an invite. Optional; omitted falls back to the default.
+   */
+  createBookingDailyCapPerIp?: number;
+  /**
+   * Per-IP daily cap for submit_flow_step (#8071). Default 50, equal to
+   * capture_lead's and no higher: a one-step flow creates a Lead in one call.
+   * Optional; omitted falls back to the default.
+   */
+  submitFlowStepDailyCapPerIp?: number;
   /** Comma-separated extra UA substrings to block. */
   blockedUserAgents: string;
 }
@@ -103,6 +161,12 @@ export const DEFAULT_START_PURCHASE_DAILY_CAP = 20;
 /** Default per-IP daily cap for capture_lead when none is configured. */
 export const DEFAULT_CAPTURE_LEAD_DAILY_CAP = 50;
 
+/** Default per-IP daily cap for create_booking when none is configured. */
+export const DEFAULT_CREATE_BOOKING_DAILY_CAP = 20;
+
+/** Default per-IP daily cap for submit_flow_step when none is configured. */
+export const DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP = 50;
+
 /**
  * Reads a positive-integer env var, falling back to `fallback` for anything
  * that is not one.
@@ -162,6 +226,18 @@ export class AbuseGuard {
           DEFAULT_START_PURCHASE_DAILY_CAP,
         ),
       ),
+      createBooking: new DailyCapTracker(
+        usableCap(
+          config.createBookingDailyCapPerIp,
+          DEFAULT_CREATE_BOOKING_DAILY_CAP,
+        ),
+      ),
+      submitFlowStep: new DailyCapTracker(
+        usableCap(
+          config.submitFlowStepDailyCapPerIp,
+          DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+        ),
+      ),
     };
   }
 
@@ -198,10 +274,12 @@ export class AbuseGuard {
       };
     }
 
-    // Rule 3: Email format validation
-    if (EMAIL_VALIDATED_TOOLS.has(toolName)) {
-      const rec = input as Record<string, unknown>;
-      const email = rec["email"];
+    // Rule 3: Email format validation, at the tool's own email path. A
+    // missing or non-string email passes — the handler's Zod schema is the
+    // authority on required fields.
+    const emailPath = EMAIL_VALIDATED_TOOLS.get(toolName);
+    if (emailPath !== undefined) {
+      const email = valueAt(input, emailPath);
       if (typeof email === "string" && !isValidEmail(email)) {
         return {
           allowed: false,
@@ -227,12 +305,16 @@ export class AbuseGuard {
 }
 
 /**
- * Convenience function for constructing an AbuseGuard from env vars.
- * Reads MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP,
- * MCP_ABUSE_START_PURCHASE_DAILY_CAP and MCP_ABUSE_BLOCKED_USER_AGENTS.
+ * The abuse configuration, read from the environment. The one reader of the
+ * MCP_ABUSE_* variables: both entries reach it through
+ * `httpTransportConfigFromEnv()` (`src/boot.ts`), and
+ * {@link createAbuseGuardFromEnv} wraps it, so a new cap is added here once.
+ *
+ * Every cap goes through {@link readPositiveIntEnv}: a blank, zero or
+ * non-numeric value yields its default, never an unlimited cap.
  */
-export function createAbuseGuardFromEnv(): AbuseGuard {
-  return new AbuseGuard({
+export function abuseConfigFromEnv(): Required<AbuseConfig> {
+  return {
     captureLeadDailyCapPerIp: readPositiveIntEnv(
       "MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP",
       DEFAULT_CAPTURE_LEAD_DAILY_CAP,
@@ -241,6 +323,20 @@ export function createAbuseGuardFromEnv(): AbuseGuard {
       "MCP_ABUSE_START_PURCHASE_DAILY_CAP",
       DEFAULT_START_PURCHASE_DAILY_CAP,
     ),
+    createBookingDailyCapPerIp: readPositiveIntEnv(
+      "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
+      DEFAULT_CREATE_BOOKING_DAILY_CAP,
+    ),
+    submitFlowStepDailyCapPerIp: readPositiveIntEnv(
+      "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
+      DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
+    ),
+    // A literal read, so create-ailk's declared-env scan finds it (#7874).
     blockedUserAgents: process.env["MCP_ABUSE_BLOCKED_USER_AGENTS"] ?? "",
-  });
+  };
+}
+
+/** An AbuseGuard built from {@link abuseConfigFromEnv}. */
+export function createAbuseGuardFromEnv(): AbuseGuard {
+  return new AbuseGuard(abuseConfigFromEnv());
 }

package/templates/apps/mcp/src/boot.ts

@@ -11,11 +11,7 @@
  * a type only, so the stdio entry still never loads the HTTP stack.
  */
 
-import {
-  DEFAULT_CAPTURE_LEAD_DAILY_CAP,
-  DEFAULT_START_PURCHASE_DAILY_CAP,
-  readPositiveIntEnv,
-} from "./abuse/index.js";
+import { abuseConfigFromEnv, readPositiveIntEnv } from "./abuse/index.js";
 import type { HttpTransportConfig } from "./http-transport.js";
 import {
   initMcpCommerceClaim,
@@ -158,28 +154,14 @@ export function httpTransportConfigFromEnv(): HttpTransportConfig & {
   const writeAllowedOrigins = writeOriginsRaw
     ? writeOriginsRaw.split(",").map((o) => o.trim())
     : [];
-  // Both caps go through readPositiveIntEnv rather than a bare parseInt: a
-  // BLANK env var would otherwise yield NaN and silently disable the cap
-  // (#5971 security review round 2).
-  const captureLeadDailyCapPerIp = readPositiveIntEnv(
-    "MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP",
-    DEFAULT_CAPTURE_LEAD_DAILY_CAP,
-  );
-  const startPurchaseDailyCapPerIp = readPositiveIntEnv(
-    "MCP_ABUSE_START_PURCHASE_DAILY_CAP",
-    DEFAULT_START_PURCHASE_DAILY_CAP,
-  );
-  const blockedUserAgents = process.env["MCP_ABUSE_BLOCKED_USER_AGENTS"] ?? "";
-
   return {
     port,
     path,
     rateLimits: { readPerMin, writePerMin },
     cors: { writeAllowedOrigins },
-    abuse: {
-      captureLeadDailyCapPerIp,
-      startPurchaseDailyCapPerIp,
-      blockedUserAgents,
-    },
+    // The MCP_ABUSE_* variables have one reader, shared with
+    // createAbuseGuardFromEnv (#8071); every cap falls back to its default
+    // on a blank or non-numeric value, never to unlimited (#5971).
+    abuse: abuseConfigFromEnv(),
   };
 }

package/templates/apps/mcp/src/http-transport.ts

@@ -51,6 +51,7 @@ import {
   AbuseReasonCode,
   type AbuseConfig,
 } from "./abuse/index.js";
+import { trustedCallerAddress } from "./request-context.js";
 import { createMcpServer } from "./server.js";
 import { createWorkspaceMcpServer } from "./workspace-server.js";
 
@@ -85,6 +86,13 @@ export const ABUSE_REFUSAL_STATUS: Record<AbuseReasonCode, 403 | 422> = {
  * worth money to abuse, so it takes the write branch — the origin allow-list,
  * the write CORS posture, and `abuseGuard.validate()` — rather than the read
  * branch's UA check alone.
+ *
+ * `create_booking` and `submit_flow_step` joined in #8071: each forwards
+ * caller-chosen data to the hub — a real booking on the seller's calendar
+ * that emails the attendee an invite, and a flow step whose completing call
+ * can create a Lead — so they take the same branch, each on its own daily
+ * cap. `__tests__/write-tool-guard.test.ts` fails when a catalog tool that
+ * sends a non-GET request to the hub is missing from this set.
  */
 // Any name added here MUST be enforced through the batch-aware path in
 // writeToolCalls() below — a request body can be a JSON-RPC ARRAY, and a
@@ -96,6 +104,8 @@ export const WRITE_TOOLS = new Set([
   "subscribe_newsletter",
   "request_callback",
   "start_purchase",
+  "create_booking",
+  "submit_flow_step",
 ]);
 
 export interface HttpTransportCorsConfig {
@@ -382,83 +392,93 @@ export async function registerHttpTransport(
         }
       }
     },
-    handler: async (request, reply) => {
-      const body = request.body as unknown;
-      const sessionId = request.headers["mcp-session-id"] as string | undefined;
-
-      try {
-        let transport: StreamableHTTPServerTransport;
-
-        if (config.stateless) {
-          // Stateless mode: each request gets a fresh transport + server.
-          // enableJsonResponse: true ensures plain JSON responses (no SSE).
-          // sessionIdGenerator is intentionally omitted (stateless = no sessions).
-          transport = new StreamableHTTPServerTransport({
-            enableJsonResponse: true,
-          });
-          const server = createMcpServer();
-          // Cast needed: SDK's StreamableHTTPServerTransport.onclose is typed
-          // as `(() => void) | undefined`, which conflicts with Transport.onclose
-          // under exactOptionalPropertyTypes: true. The runtime behaviour is
-          // identical; the cast is safe.
-          await server.connect(transport as unknown as Transport);
-          try {
-            await transport.handleRequest(request.raw, reply.raw, body);
-          } finally {
-            // Close the per-request transport + server to release internal
-            // handles. Without this, the MCP SDK's transport leaves open
-            // sockets that surface as `socket.destroySoon is not a function`
-            // during Jest teardown on Node 20.x (@hono/node-server compat).
-            await transport.close().catch(() => undefined);
-            await server.close().catch(() => undefined);
+    handler: async (request, reply) =>
+      // The lead-write tools read this address (#8073) through
+      // `visitorForwardHeadersForThisCall()` while the SDK dispatches their
+      // call, somewhere inside `transport.handleRequest()` below — the whole
+      // handler body runs inside the store so every path reaches it.
+      trustedCallerAddress.run(request.ip, async () => {
+        const body = request.body as unknown;
+        const sessionId = request.headers["mcp-session-id"] as
+          | string
+          | undefined;
+
+        try {
+          let transport: StreamableHTTPServerTransport;
+
+          if (config.stateless) {
+            // Stateless mode: each request gets a fresh transport + server.
+            // enableJsonResponse: true ensures plain JSON responses (no SSE).
+            // sessionIdGenerator is intentionally omitted (stateless = no sessions).
+            transport = new StreamableHTTPServerTransport({
+              enableJsonResponse: true,
+            });
+            const server = createMcpServer();
+            // Cast needed: SDK's StreamableHTTPServerTransport.onclose is typed
+            // as `(() => void) | undefined`, which conflicts with Transport.onclose
+            // under exactOptionalPropertyTypes: true. The runtime behaviour is
+            // identical; the cast is safe.
+            await server.connect(transport as unknown as Transport);
+            try {
+              await transport.handleRequest(request.raw, reply.raw, body);
+            } finally {
+              // Close the per-request transport + server to release internal
+              // handles. Without this, the MCP SDK's transport leaves open
+              // sockets that surface as `socket.destroySoon is not a function`
+              // during Jest teardown on Node 20.x (@hono/node-server compat).
+              await transport.close().catch(() => undefined);
+              await server.close().catch(() => undefined);
+            }
+            return;
           }
-          return;
-        }
-
-        if (sessionId && transports.has(sessionId)) {
-          // Existing session — reuse transport
-          transport = transports.get(sessionId)!;
-        } else if (!sessionId && isInitializeRequest(body)) {
-          // New initialization — create a stateful transport + fresh server
-          transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: () => randomUUID(),
-            onsessioninitialized: (sid) => {
-              transports.set(sid, transport);
-            },
-          });
 
-          transport.onclose = () => {
-            const sid = transport.sessionId;
-            if (sid) transports.delete(sid);
-          };
-
-          const server = createMcpServer();
-          // Cast needed: SDK's StreamableHTTPServerTransport.onclose is typed
-          // as `(() => void) | undefined`, which conflicts with Transport.onclose
-          // under exactOptionalPropertyTypes: true. The runtime behaviour is
-          // identical; the cast is safe.
-          await server.connect(transport as unknown as Transport);
-        } else {
-          reply.code(400).send({
-            jsonrpc: "2.0",
-            error: { code: -32000, message: "Bad Request: no valid session" },
-            id: null,
-          });
-          return;
-        }
+          if (sessionId && transports.has(sessionId)) {
+            // Existing session — reuse transport
+            transport = transports.get(sessionId)!;
+          } else if (!sessionId && isInitializeRequest(body)) {
+            // New initialization — create a stateful transport + fresh server
+            transport = new StreamableHTTPServerTransport({
+              sessionIdGenerator: () => randomUUID(),
+              onsessioninitialized: (sid) => {
+                transports.set(sid, transport);
+              },
+            });
+
+            transport.onclose = () => {
+              const sid = transport.sessionId;
+              if (sid) transports.delete(sid);
+            };
+
+            const server = createMcpServer();
+            // Cast needed: SDK's StreamableHTTPServerTransport.onclose is typed
+            // as `(() => void) | undefined`, which conflicts with Transport.onclose
+            // under exactOptionalPropertyTypes: true. The runtime behaviour is
+            // identical; the cast is safe.
+            await server.connect(transport as unknown as Transport);
+          } else {
+            reply.code(400).send({
+              jsonrpc: "2.0",
+              error: {
+                code: -32000,
+                message: "Bad Request: no valid session",
+              },
+              id: null,
+            });
+            return;
+          }
 
-        await transport.handleRequest(request.raw, reply.raw, body);
-      } catch (err) {
-        if (!reply.sent) {
-          reply.code(500).send({
-            jsonrpc: "2.0",
-            error: { code: -32603, message: "Internal server error" },
-            id: null,
-          });
+          await transport.handleRequest(request.raw, reply.raw, body);
+        } catch (err) {
+          if (!reply.sent) {
+            reply.code(500).send({
+              jsonrpc: "2.0",
+              error: { code: -32603, message: "Internal server error" },
+              id: null,
+            });
+          }
+          throw err;
         }
-        throw err;
-      }
-    },
+      }),
   });
 
   // DELETE — session termination

package/templates/apps/mcp/src/index.ts

@@ -15,6 +15,8 @@
  *   MCP_CORS_WRITE_ALLOWED_ORIGINS=   (empty = no cross-origin writes)
  *   MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP=50
  *   MCP_ABUSE_START_PURCHASE_DAILY_CAP=20
+ *   MCP_ABUSE_CREATE_BOOKING_DAILY_CAP=20
+ *   MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP=50
  *   MCP_ABUSE_BLOCKED_USER_AGENTS=    (comma-separated substrings)
  *
  * Content adapter (all optional; `CONTENT_ADAPTER` default: mdx):

package/templates/apps/mcp/src/request-context.ts

@@ -0,0 +1,52 @@
+/**
+ * Per-request context for @working-theory/mcp, shared by the HTTP transport
+ * and the MCP lead-write tools (#8073).
+ *
+ * Deliberately dependency-free beyond `@working-theory/api-client` (already
+ * loaded by every tool): `http-transport.ts` imports Fastify and the full
+ * HTTP stack, and `src/index.ts`'s stdio branch dynamic-imports `server.js`
+ * specifically to avoid loading that stack for a local stdio caller. A tool
+ * importing `trustedCallerAddress` straight from `http-transport.ts` would
+ * pull Fastify into every stdio boot and, worse, close an import cycle
+ * (`http-transport.ts` → `server.ts` → `tools/*.ts` → `http-transport.ts`).
+ * This module sits below both: `http-transport.ts` populates the store,
+ * the tools read it, neither imports the other.
+ */
+
+import { AsyncLocalStorage } from "node:async_hooks";
+
+import { visitorForwardHeaders } from "@working-theory/api-client";
+
+/**
+ * The caller address the transport trusted for the POST request currently
+ * being handled — `request.ip`, Fastify's own `trustProxy`-resolved value
+ * (the Vercel entry trusts exactly one hop, #8070 D5), never the raw,
+ * caller-forgeable leftmost `X-Forwarded-For` entry. Populated by
+ * `http-transport.ts` for the duration of one `transport.handleRequest()`
+ * call and read by the three MCP lead-write tools (#8073) so they can
+ * forward it to the hub without the tool gaining an identity argument.
+ * `undefined` outside an HTTP request — stdio has no client address to
+ * forward.
+ */
+export const trustedCallerAddress = new AsyncLocalStorage<string>();
+
+/**
+ * The two visitor-forwarding headers (`x-ailk-visitor-ip`,
+ * `x-ailk-visitor-forward-key`) for the request this call is running inside,
+ * or `undefined` when there is no trusted address for this call (not an HTTP
+ * request), no `AILK_VISITOR_FORWARD_KEY`, or `visitorForwardHeaders` itself
+ * declines (an unsafe transport, an unsafe key value). Read by the lead-write
+ * tools right before they call the hub (#8073).
+ */
+export function visitorForwardHeadersForThisCall():
+  | Record<string, string>
+  | undefined {
+  const address = trustedCallerAddress.getStore();
+  if (!address) return undefined;
+  return visitorForwardHeaders(
+    {
+      get: (name: string) => (name === "x-forwarded-for" ? address : null),
+    },
+    process.env.AILK_VISITOR_FORWARD_KEY,
+  );
+}

package/templates/apps/mcp/src/tools/capture_lead.ts

@@ -17,6 +17,8 @@ import {
   type SubmitLeadOutput,
 } from "@working-theory/validation";
 
+import { visitorForwardHeadersForThisCall } from "../request-context.js";
+
 export { submitLeadInputSchema, submitLeadOutputSchema };
 export type { SubmitLeadInput, SubmitLeadOutput };
 
@@ -47,7 +49,13 @@ export async function ailkCaptureLead(
     },
   };
 
-  const res = await apiClient.leads.submit(body);
+  // #8073 — forward the address the transport trusted (never an identity
+  // argument on this tool's own schema) so the hub counts the write in that
+  // visitor's own rate-limit bucket rather than this MCP host's.
+  const headers = visitorForwardHeadersForThisCall();
+  const res = headers
+    ? await apiClient.leads.submit(body, { headers })
+    : await apiClient.leads.submit(body);
   if (!res.ok) {
     return { ok: false, error: { kind: "api_error", status: res.status } };
   }

package/templates/apps/mcp/src/tools/request_callback.ts

@@ -18,6 +18,8 @@ import {
   type RequestCallbackOutput,
 } from "@working-theory/validation";
 
+import { visitorForwardHeadersForThisCall } from "../request-context.js";
+
 export { requestCallbackInputSchema, requestCallbackOutputSchema };
 export type { RequestCallbackInput, RequestCallbackOutput };
 
@@ -42,7 +44,13 @@ export async function ailkRequestCallback(
     payload: {},
   };
 
-  const res = await apiClient.leads.callback(body);
+  // #8073 — forward the address the transport trusted (never an identity
+  // argument on this tool's own schema) so the hub counts the write in that
+  // visitor's own rate-limit bucket rather than this MCP host's.
+  const headers = visitorForwardHeadersForThisCall();
+  const res = headers
+    ? await apiClient.leads.callback(body, { headers })
+    : await apiClient.leads.callback(body);
   if (!res.ok) {
     return { ok: false, error: { kind: "api_error", status: res.status } };
   }

package/templates/apps/mcp/src/tools/subscribe_newsletter.ts

@@ -18,6 +18,8 @@ import {
   type SubscribeNewsletterOutput,
 } from "@working-theory/validation";
 
+import { visitorForwardHeadersForThisCall } from "../request-context.js";
+
 export { subscribeNewsletterInputSchema, subscribeNewsletterOutputSchema };
 export type { SubscribeNewsletterInput, SubscribeNewsletterOutput };
 
@@ -40,7 +42,13 @@ export async function ailkSubscribeNewsletter(
   const siteId = process.env.AILK_SITE_ID ?? "default";
   const body = { siteId, email, source: "mcp" };
 
-  const res = await apiClient.leads.subscribe(body);
+  // #8073 — forward the address the transport trusted (never an identity
+  // argument on this tool's own schema) so the hub counts the write in that
+  // visitor's own rate-limit bucket rather than this MCP host's.
+  const headers = visitorForwardHeadersForThisCall();
+  const res = headers
+    ? await apiClient.leads.subscribe(body, { headers })
+    : await apiClient.leads.subscribe(body);
   if (!res.ok) {
     return { ok: false, error: { kind: "api_error", status: res.status } };
   }

package/templates/apps/web/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -137,8 +138,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each
@@ -162,7 +163,7 @@
       other commercial damages or losses), even if such Contributor
       has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Support. While redistributing
+   9. Accepting Warranty or Additional Liability. While redistributing
       the Work or Derivative Works thereof, You may choose to offer,
       and charge a fee for, acceptance of support, warranty, indemnity,
       or other liability obligations and/or rights consistent with this
@@ -171,7 +172,7 @@
       of any other Contributor, and only if You agree to indemnify,
       defend, and hold each Contributor harmless for any liability
       incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
+      of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
 
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Tailwind AI
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/templates/apps/web/NOTICE

@@ -0,0 +1,2 @@
+AI Launch Kit
+Copyright 2026 SalesSmyth LLC

package/templates/apps/web/app/.well-known/ai-plugin.json/route.ts

@@ -28,7 +28,7 @@
  * See `docs/security/agent-manifest.md` for the full consumer guidance.
  */
 
-import { SITE_NAME } from "../../../lib/site-brand";
+import { SITE_DESCRIPTION, SITE_NAME } from "../../../lib/site-brand";
 import { resolveBaseUrl } from "../../../src/lib/routes";
 
 /** Soft cap to detect runaway `description_for_model` growth. */
@@ -66,8 +66,8 @@ export function GET(): Response {
     schema_version: "v1",
     name_for_human: SITE_NAME,
     name_for_model: "ai_launch_kit",
-    description_for_human:
-      "AX-first OSS template — ship software with API + MCP as canonical agent surfaces.",
+    // #8085 — the site's own description, as /.well-known/mcp.json (#8057).
+    description_for_human: SITE_DESCRIPTION,
     description_for_model: MANIFEST_DESCRIPTION_FOR_MODEL,
     auth: { type: "none" },
     api: {