create-ailk 0.23.0 → 0.25.1

package/dist/update.js

@@ -13,26 +13,39 @@
  * template test that imports a file left under review or skipped is held at
  * the site's version with it, so a run never leaves a test newer than the
  * code it exercises (#8704). A site with no record gets one backfilled from
- * `.ailk-site-manifest.json`'s `patternVersion` on its first run, then
- * updates normally. Every refusal throws before the first write.
+ * `.ailk-site-manifest.json`'s `patternVersion` on its first run — one row
+ * per in-scope path of that version's snapshot, on disk or not (#9527) —
+ * then updates normally. A site scaffolded before `@working-theory/mcp-server`
+ * (#9460) has its copied `apps/mcp` moved to the boot set (#9567): the
+ * record's own rules retire the copied server files, and what the record
+ * cannot see — the dependency, the hub seam's imports, the bundle-delivered
+ * paid tools — is planned here and applied with them. The paid MCP tool
+ * registry is rewritten from `apps/mcp/package.json` on every run, as the
+ * module-presence flags are. A site scaffolded before `@working-theory/api`
+ * (#9564) has its copied `apps/api` moved to the boot file the same way
+ * (#9566): the record retires the copied server files and lands the boot
+ * files; the app's rename, its dependencies and delegating scripts, and the
+ * bundle-delivered module files are planned here. Every refusal throws
+ * before the first write.
  *
  * Pure module: no `import.meta.url` — the CLI supplies `templatesDir`, the
  * `adopt.ts` / `add-route.ts` split.
  */
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, rmdirSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { AddModuleRefusedError, readArchitectureHeader } from "./add-module-core.js";
 import { buildScaffoldMarkers, isExcluded, isTextFile, renderTemplateFile, templateDestination } from "./copy.js";
 import { fetchTemplateSnapshot } from "./lib/fetch-template-snapshot.js";
 import { mergeThreeWay } from "./lib/merge-three-way.js";
-import { MODULE_FLAGS_PATH, writeModuleFlags } from "./paid-sections.js";
+import { MODULE_SLICES } from "./module-architecture.js";
+import { MODULE_FLAGS_PATH, PAID_MCP_TOOLS_PATH, writeModuleFlags, writePaidMcpTools, } from "./paid-sections.js";
 import { ParseError } from "./parse-args.js";
 import { SITE_ROSTER_PATH } from "./site-roster.js";
 import { SPOKE_CHECKOUT_TEMPLATE_PATHS } from "./spoke-checkout.js";
 import { excludedRoutePaths } from "./surfaces.js";
-import { TEMPLATE_RECORD_PATH, isRecordable, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
-import { TopologyError, isSpokeExcluded, readSpokeShape, spokeExclusions, } from "./topology.js";
+import { DATABASE_BOOT_FILES, TEMPLATE_RECORD_PATH, isRecordable, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
+import { MCP_SEAM_PATH, MCP_SERVER_HUB, TopologyError, isSpokeExcluded, readSpokeShape, spokeExclusions, } from "./topology.js";
 /** A refusal the CLI exits 2 on, thrown before anything is written. */
 export class UpdateRefusedError extends Error {
     exitCode = 2;
@@ -60,9 +73,20 @@ function versionOlder(a, b) {
     }
     return false;
 }
-/** Every file under `templatesDir`'s three app trees, raw bytes keyed by destination path (D3). */
+/** The reason a boot file is skipped on a site whose `database/` is still the copied package (#9569 DD8). */
+const DATABASE_PACKAGE_GUARD = "database/ is still a package here — convert it to the thin consumer first";
+/**
+ * Every file under `templatesDir`'s three app trees, plus each of the
+ * `DATABASE_BOOT_FILES` present there (#9569 DD8), raw bytes keyed by
+ * destination path (D3).
+ */
 function walkLocalTemplates(templatesDir) {
     const out = new Map();
+    for (const boot of DATABASE_BOOT_FILES) {
+        const abs = join(templatesDir, ...boot.split("/"));
+        if (existsSync(abs))
+            out.set(boot, readFileSync(abs));
+    }
     for (const app of ["web", "api", "mcp"]) {
         const root = join(templatesDir, "apps", app);
         if (!existsSync(root))
@@ -180,6 +204,380 @@ function importedHeldFiles(fromPath, text, held) {
     }
     return [...out];
 }
+// ── The MCP move (#9567): a copied apps/mcp becomes the boot set ──────────
+const MCP_SERVER_PACKAGE = "@working-theory/mcp-server";
+const MCP_PACKAGE_JSON = "apps/mcp/package.json";
+const MCP_SRC = "apps/mcp/src";
+/** The boot set (#9460 DD2): all `apps/mcp/src` holds after the move. */
+const MCP_BOOT_SET = new Set([
+    `${MCP_SRC}/index.ts`,
+    `${MCP_SRC}/app.ts`,
+    `${MCP_SRC}/site.ts`,
+    MCP_SEAM_PATH,
+    PAID_MCP_TOOLS_PATH,
+]);
+/**
+ * The paid tool files a module bundle delivered before #9460 (DD5) — never
+ * recorded, so the move names them. Their packages now ride
+ * `apps/mcp/package.json`. Frozen as of #9460; never extend: no bundle
+ * delivers a file under `apps/mcp/src` any more.
+ */
+const BUNDLED_MCP_TOOLS = new Set([
+    "agent_context",
+    "create_booking",
+    "get_event_meta",
+    "get_flow",
+    "inbox_applications",
+    "inbox_messages",
+    "inbox_submissions",
+    "list_availability",
+    "list_meetings",
+    "person_notes",
+    "proposals",
+    "submit_flow_step",
+].map((name) => `${MCP_SRC}/tools/${name}.ts`));
+/** The old hub seam's two relative imports; each is now `MCP_SERVER_HUB` (DD7). */
+const OLD_HUB_SEAM_IMPORTS = ['"./public-workspace.js"', '"./license-key-store.js"'];
+/** Every file under `root`, as `/`-separated paths relative to `targetDir`. */
+function filesUnder(targetDir, root) {
+    const out = [];
+    const stack = [join(targetDir, ...root.split("/"))];
+    for (let dir = stack.pop(); dir !== undefined; dir = stack.pop()) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const abs = join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(abs);
+            else if (entry.isFile())
+                out.push(abs.slice(targetDir.length + 1).split(sep).join("/"));
+        }
+    }
+    return out.sort();
+}
+/** `pkg` (a parsed package.json) with `entries` merged into `dependencies`, keys sorted. */
+function withDependencies(pkg, entries) {
+    const deps = { ...(pkg.dependencies ?? {}), ...entries };
+    pkg.dependencies = Object.fromEntries(Object.keys(deps).sort().map((key) => [key, deps[key]]));
+    return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+/**
+ * `^<version>` per package from the running `versions.json`, for a move of
+ * `apps/<app>` to `pkg` (#9567 / #9566). Throws — before any write — naming
+ * the first package `versions` lacks.
+ */
+function resolveMoveVersions(app, pkg, packages, versions) {
+    const entries = {};
+    for (const name of packages) {
+        const v = versions[name];
+        if (v === undefined) {
+            throw new UpdateRefusedError(`moving apps/${app} to ${pkg} needs a version for ${name}, and this create-ailk's versions.json has none`);
+        }
+        entries[name] = `^${v}`;
+    }
+    return entries;
+}
+/**
+ * Every unrecorded file under `src`, sorted into what a move removes and
+ * what it lists for review: a `bundled` file (bundle-delivered, never
+ * recorded) is removed even at a boot-set path (#9566: the #9564→#9565
+ * window's in-app module objects sit where the template's re-exports land);
+ * any other boot-set file is left to the record; the rest is reviewed with
+ * `reason`, never deleted.
+ */
+function classifyUnrecorded(targetDir, src, bootSet, recorded, bundled, reason) {
+    const deletes = [];
+    const review = [];
+    for (const path of filesUnder(targetDir, src)) {
+        if (recorded.has(path))
+            continue;
+        if (bundled.has(path))
+            deletes.push(path);
+        else if (!bootSet.has(path))
+            review.push({ path, reason });
+    }
+    return { deletes, review };
+}
+/**
+ * The move a site scaffolded before #9460 needs, or `undefined` when its
+ * `apps/mcp` already depends on the server. README § "Move an existing
+ * site's apps/mcp to this package", steps 1, 5 and 6 — steps 2 to 4 are the
+ * record's own rows and the registry write. Throws before any write when
+ * `versions` lacks a package the move must declare.
+ */
+function planMcpMove(targetDir, modules, hub, recorded, versions) {
+    const pkgText = readFileSync(join(targetDir, MCP_PACKAGE_JSON), "utf8");
+    let pkg;
+    try {
+        pkg = JSON.parse(pkgText);
+    }
+    catch (err) {
+        throw new UpdateRefusedError(`${MCP_PACKAGE_JSON} is not valid JSON: ${err.message}`);
+    }
+    if (Object.hasOwn(pkg.dependencies ?? {}, MCP_SERVER_PACKAGE))
+        return undefined;
+    const packages = [MCP_SERVER_PACKAGE];
+    for (const name of modules) {
+        for (const pack of MODULE_SLICES[name].paidMcpToolPackages ?? []) {
+            if (!packages.includes(pack))
+                packages.push(pack);
+        }
+    }
+    const entries = resolveMoveVersions("mcp", MCP_SERVER_PACKAGE, packages, versions);
+    const move = { packageJson: withDependencies(pkg, entries), deletes: [], review: [] };
+    const seamPath = join(targetDir, ...MCP_SEAM_PATH.split("/"));
+    if (hub && existsSync(seamPath)) {
+        const before = readFileSync(seamPath, "utf8");
+        let after = before;
+        for (const spec of OLD_HUB_SEAM_IMPORTS)
+            after = after.split(spec).join(`"${MCP_SERVER_HUB}"`);
+        if (after !== before)
+            move.seam = after;
+    }
+    if (!existsSync(join(targetDir, ...MCP_SRC.split("/")))) {
+        throw new UpdateRefusedError(`${MCP_PACKAGE_JSON} is present but ${MCP_SRC}/ is not, so apps/mcp cannot be moved to ${MCP_SERVER_PACKAGE}`);
+    }
+    const unrecorded = classifyUnrecorded(targetDir, MCP_SRC, MCP_BOOT_SET, recorded, BUNDLED_MCP_TOOLS, `not in the boot set apps/mcp/src is since ${MCP_SERVER_PACKAGE} (#9460); move it into a package or delete it`);
+    move.deletes = unrecorded.deletes;
+    move.review = unrecorded.review;
+    return move;
+}
+/** Remove every directory under `root` left empty — `root` itself stays. */
+function pruneEmptyDirs(root) {
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const abs = join(root, entry.name);
+        pruneEmptyDirs(abs);
+        if (readdirSync(abs).length === 0)
+            rmdirSync(abs);
+    }
+}
+// ── The API move (#9566): a copied apps/api becomes the boot file ─────────
+const API_PACKAGE = "@working-theory/api";
+/** The app's name since #9564 D10 — the copied app's `@working-theory/api` would shadow the dependency. */
+const API_APP_NAME = "@working-theory/app-api";
+const API_PACKAGE_JSON = "apps/api/package.json";
+const API_SRC = "apps/api/src";
+/** The boot's module objects, one `apps/api/src/modules/<name>.ts` per `@working-theory/api-<name>` (#9565 D5). */
+const API_MODULES_DIR = `${API_SRC}/modules`;
+/**
+ * The scripts #9564 D9 retargets at the installed package: the four base
+ * bins run its compiled `dist/bin/<name>.js`, and `build:vercel` builds the
+ * renamed app. `db:*`, `dev`, `start` and the module bins stay as the site
+ * has them.
+ */
+const API_DELEGATING_SCRIPTS = [
+    "abandon:sweep",
+    "rate-limit:probe",
+    "spokes",
+    "stripe-connections:rekey",
+    "build:vercel",
+];
+/**
+ * The module files a module bundle delivered under `apps/api/src` before
+ * #9565 (D6) — never recorded, so the move names them; their modules now
+ * ride `apps/api/package.json` as packages. The pre-#9565 `MODULE_SLICES`
+ * `apps/api/` entries at 328494dba, all 144, the six `modules/<name>.ts`
+ * among them: between #9564 and #9565 a bundle delivered each module
+ * OBJECT in-app, at the very path the template's one-statement re-export
+ * now takes, importing the routes beside it — so an unrecorded file there
+ * is the old object and goes, and the re-export lands over it. Frozen as of
+ * #9565; never extend: no bundle delivers a file under `apps/api/src` any
+ * more.
+ */
+const BUNDLED_API_FILES = new Set([
+    "__tests__/content-write-production-boot.test.ts",
+    "__tests__/listings-forwarded-rate-limit.test.ts",
+    "__tests__/openapi-keyless-hub.test.ts",
+    "__tests__/schedule-forwarded-rate-limit.test.ts",
+    "bin/deliverable-resend.ts",
+    "bin/deliverable-upload.ts",
+    "bin/flows-copy.ts",
+    "bin/followup-sweep.ts",
+    "bin/listing-csv-sweep.ts",
+    "bin/member-request-match.ts",
+    "bin/seed-presets.ts",
+    "bin/seed-waitlist-experiments.ts",
+    "bin/session-retention-sweep.ts",
+    "config/__tests__/scheduling-credential-key.test.ts",
+    "lib/asset-store.ts",
+    "lib/member-request-match.ts",
+    "lib/public-meetings-config.ts",
+    "lib/ws-token.ts",
+    "modules/commerce.ts",
+    "modules/content-write.ts",
+    "modules/multi-tenant.ts",
+    "modules/scheduling.ts",
+    "modules/signal-collectors.ts",
+    "modules/workspace.ts",
+    "routes/assets/index.ts",
+    "routes/assets/manage.ts",
+    "routes/assets/read.ts",
+    "routes/assets/upload.ts",
+    "routes/billing/index.ts",
+    "routes/billing/portal.ts",
+    "routes/billing/read.ts",
+    "routes/billing/stripe-connection.ts",
+    "routes/billing/stripe-products.ts",
+    "routes/billing/usage.ts",
+    "routes/consent/platform.ts",
+    "routes/deliverables/index.ts",
+    "routes/flow-checkouts/index.ts",
+    "routes/flows/README.md",
+    "routes/flows/index.ts",
+    "routes/flows/recommender.ts",
+    "routes/magnets/index.ts",
+    "routes/member/appointments.ts",
+    "routes/member/artifact-review.ts",
+    "routes/member/artifacts.ts",
+    "routes/member/availability.ts",
+    "routes/member/billing.ts",
+    "routes/member/bookings.ts",
+    "routes/member/consents.ts",
+    "routes/member/deletion-request.ts",
+    "routes/member/meeting-types.ts",
+    "routes/member/messages.ts",
+    "routes/member/onboarding.ts",
+    "routes/member/pieces.ts",
+    "routes/member/profile.ts",
+    "routes/member/purchases.ts",
+    "routes/member/request-form.ts",
+    "routes/member/requests.ts",
+    "routes/project-listings/__tests__/directory.test.ts",
+    "routes/project-listings/get.ts",
+    "routes/project-listings/list.ts",
+    "routes/project-listings/patch.ts",
+    "routes/schedule/__tests__/appointments.test.ts",
+    "routes/schedule/__tests__/meeting-types.test.ts",
+    "routes/schedule/__tests__/meetings.test.ts",
+    "routes/schedule/__tests__/public-connection.test.ts",
+    "routes/schedule/__tests__/spoke.test.ts",
+    "routes/schedule/appointments.ts",
+    "routes/schedule/index.ts",
+    "routes/schedule/meeting-types.ts",
+    "routes/slack/actions.ts",
+    "routes/slack/index.ts",
+    "routes/subscription/index.ts",
+    "routes/subscription/me.ts",
+    "routes/subscription/portal.ts",
+    "routes/waitlist-experiments/comparison.ts",
+    "routes/waitlist-experiments/index.ts",
+    "routes/waitlist-experiments/list.ts",
+    "routes/waitlist-experiments/respond.ts",
+    "routes/waitlist-experiments/signup.ts",
+    "routes/waitlist-experiments/signups.ts",
+    "routes/waitlist-signups/index.ts",
+    "routes/webhooks/__tests__/calcom-connection.test.ts",
+    "routes/webhooks/__tests__/calcom.test.ts",
+    "routes/webhooks/calcom.ts",
+    "routes/workspaces/__tests__/meetings-connection.test.ts",
+    "routes/workspaces/__tests__/meetings.test.ts",
+    "routes/workspaces/agents.ts",
+    "routes/workspaces/callbacks.ts",
+    "routes/workspaces/config.ts",
+    "routes/workspaces/content.ts",
+    "routes/workspaces/general.ts",
+    "routes/workspaces/index.ts",
+    "routes/workspaces/meetings.ts",
+    "routes/workspaces/members.ts",
+    "routes/workspaces/messages-out.ts",
+    "routes/workspaces/messages.ts",
+    "routes/workspaces/offerings.ts",
+    "routes/workspaces/orders.ts",
+    "routes/workspaces/people.ts",
+    "routes/workspaces/pieces.ts",
+    "routes/workspaces/plan.ts",
+    "routes/workspaces/requests.ts",
+    "routes/workspaces/sessions.ts",
+    "routes/workspaces/submissions.ts",
+    "routes/workspaces/subscribers.ts",
+    "routes/workspaces/trial.ts",
+    "services/__tests__/lead-promotion.test.ts",
+    "services/__tests__/leads-inbox.test.ts",
+    "services/flow-aggregate.ts",
+    "services/flow-checkouts.ts",
+    "services/flow-copy.ts",
+    "services/flow-engine.ts",
+    "services/inbox-messages.ts",
+    "services/inbox-orders.ts",
+    "services/inbox-submissions.ts",
+    "services/listing-csv-sweep.ts",
+    "services/listing-promotion.ts",
+    "services/playbook-compile.ts",
+    "services/playbook-render.ts",
+    "services/project-listing-decision.ts",
+    "services/project-listing-flow.ts",
+    "services/project-listing-issue.ts",
+    "services/proposal-payments.ts",
+    "services/recommender-capture.ts",
+    "services/scheduling/__tests__/appointments.test.ts",
+    "services/scheduling/__tests__/cal-provider.test.ts",
+    "services/scheduling/__tests__/connections.test.ts",
+    "services/scheduling/__tests__/meetings.test.ts",
+    "services/scheduling/__tests__/provider-resolution.test.ts",
+    "services/scheduling/appointments.ts",
+    "services/scheduling/cal-provider.ts",
+    "services/scheduling/connections.ts",
+    "services/scheduling/index.ts",
+    "services/scheduling/meetings.ts",
+    "services/scheduling/resolve.ts",
+    "services/scheduling/types.ts",
+    "services/subscription.ts",
+    "services/trial.ts",
+    "services/waitlist-dashboard.ts",
+    "services/waitlist-experiments.ts",
+    "services/waitlist-followup.ts",
+    "services/waitlist-operator-reads.ts",
+    "services/waitlist-scoring.ts",
+    "services/waitlist-signups.ts",
+].map((path) => `${API_SRC}/${path}`));
+/**
+ * The move a site scaffolded before #9565 needs, or `undefined` when its
+ * `apps/api` already depends on the package AND all six module packages. A
+ * site from before #9564 lacks all seven; one scaffolded in the #9564→#9565
+ * window depends on the package but carries the six module objects in-app
+ * (bundle-delivered, unrecorded) and lacks their packages — either is the
+ * move. The boot files, the module objects and the copied server files are
+ * the record's own rows (the running template's `apps/api/src` IS the boot
+ * set); this plans what the record cannot see. Throws before any write when
+ * `versions` lacks a package the move must declare.
+ */
+function planApiMove(targetDir, templatesDir, bootSet, recorded, versions) {
+    const pkgText = readFileSync(join(targetDir, API_PACKAGE_JSON), "utf8");
+    let pkg;
+    try {
+        pkg = JSON.parse(pkgText);
+    }
+    catch (err) {
+        throw new UpdateRefusedError(`${API_PACKAGE_JSON} is not valid JSON: ${err.message}`);
+    }
+    const modulesDir = join(templatesDir, ...API_MODULES_DIR.split("/"));
+    const packages = [
+        API_PACKAGE,
+        ...(existsSync(modulesDir) ? readdirSync(modulesDir) : [])
+            .filter((file) => file.endsWith(".ts"))
+            .map((file) => `${API_PACKAGE}-${file.slice(0, -".ts".length)}`),
+    ];
+    const deps = pkg.dependencies ?? {};
+    if (packages.every((name) => Object.hasOwn(deps, name)))
+        return undefined;
+    const entries = resolveMoveVersions("api", API_PACKAGE, packages, versions);
+    if (pkg.name === API_PACKAGE)
+        pkg.name = API_APP_NAME;
+    const templateScripts = JSON.parse(readFileSync(join(templatesDir, ...API_PACKAGE_JSON.split("/")), "utf8")).scripts ?? {};
+    for (const key of API_DELEGATING_SCRIPTS) {
+        const script = templateScripts[key];
+        if (script !== undefined)
+            (pkg.scripts ??= {})[key] = script;
+    }
+    const move = { packageJson: withDependencies(pkg, entries), deletes: [], review: [] };
+    if (!existsSync(join(targetDir, ...API_SRC.split("/")))) {
+        throw new UpdateRefusedError(`${API_PACKAGE_JSON} is present but ${API_SRC}/ is not, so apps/api cannot be moved to ${API_PACKAGE}`);
+    }
+    const unrecorded = classifyUnrecorded(targetDir, API_SRC, bootSet, recorded, BUNDLED_API_FILES, `not in the boot file apps/api/src is since ${API_PACKAGE} (#9564); move it into a package or delete it`);
+    move.deletes = unrecorded.deletes;
+    move.review = unrecorded.review;
+    return move;
+}
 export async function updateSite(opts) {
     const targetDir = resolve(opts.targetDir);
     const version = opts.version;
@@ -252,7 +650,13 @@ export async function updateSite(opts) {
     const spokeExclusionList = spoke !== undefined ? spokeExclusions(opts.templatesDir, spoke) : undefined;
     // #8748 D3 — the standard spoke checkout is a commerce spoke's alone.
     const sellsAsSpoke = spoke !== undefined && header.modules.includes("commerce");
+    // #9569 DD8 — a `database/` that is still a package (the pre-thin copy) is
+    // never touched: its boot paths are out of scope, reported under the guard.
+    const databaseIsPackage = existsSync(join(targetDir, "database", "package.json"));
+    const bootFileGuarded = (destRel) => databaseIsPackage && DATABASE_BOOT_FILES.includes(destRel);
     const outOfScope = (destRel) => {
+        if (bootFileGuarded(destRel))
+            return true;
         if (isExcluded(destRel, excludedRoutes))
             return true;
         if (!sellsAsSpoke && isExcluded(destRel, SPOKE_CHECKOUT_TEMPLATE_PATHS))
@@ -292,6 +696,15 @@ export async function updateSite(opts) {
         return result;
     }
     // ── The backfill: fetch the old base and build the synthetic record ──
+    // Every in-scope snapshot path gets a row at the snapshot's hash, present
+    // on disk or not (#9527): an absent one then reads as "deleted locally"
+    // on this run and every later one, exactly as a scaffold-written row
+    // whose file the owner removed — never as a new template file to add —
+    // and a copy the owner later restores from the snapshot reads as
+    // untouched. Out-of-scope paths (rules i/ii) stay unrecorded. The absent
+    // rows also feed `knownPaths` on every later run, so a new template file
+    // under an absent recorded directory is never added — the same reading as
+    // "the owner deleted that directory" (rule iii).
     let knownSnapshotPaths;
     if (backfillPatternVersion !== undefined) {
         const base = await loadVersionMap(backfillPatternVersion);
@@ -303,19 +716,47 @@ export async function updateSite(opts) {
         for (const [path, bytes] of [...base.entries()].sort(([a], [b]) => a.localeCompare(b))) {
             if (outOfScope(path))
                 continue;
-            if (!existsSync(join(targetDir, ...path.split("/"))))
-                continue;
             files[path] = { sha256: sha256Hex(bytes), version: backfillPatternVersion };
         }
         record = { schema: 1, projectName: record.projectName, files };
     }
+    // ── The MCP move (#9567), planned before the first write ──────────────
+    // A site scaffolded before #9460 carries the server under apps/mcp/src and
+    // no @working-theory/mcp-server dependency. Its recorded copies the running
+    // template no longer has fall out through the rows below — removed when
+    // untouched, reviewed when edited — and index.ts, app.ts and site.ts arrive
+    // as any template change does. The rest is planned here: the dependency
+    // and each carried module's paid pack, the hub seam's two imports, and the
+    // bundle-delivered paid tools the record never saw. A `--without-mcp`
+    // spoke has no apps/mcp and plans nothing.
+    const mcpPkgPath = join(targetDir, ...MCP_PACKAGE_JSON.split("/"));
+    const mcpMove = existsSync(mcpPkgPath)
+        ? planMcpMove(targetDir, header.modules, spoke === undefined, new Set(Object.keys(record.files)), opts.versions ?? {})
+        : undefined;
+    // ── The API move (#9566), planned before the first write ──────────────
+    // A site scaffolded before #9564 carries the server under apps/api/src, an
+    // apps/api still named @working-theory/api and no @working-theory/api
+    // dependency. The running template's apps/api/src is the boot set: its
+    // recorded copies the template no longer has fall out through the rows
+    // below, and server.ts, index.ts and the six module objects arrive as any
+    // template change does. Planned here: the rename, the package and the six
+    // module packages (the boot passes all six on every boot, #9565 D5), the
+    // delegating scripts (#9564 D9) and the bundle-delivered module files the
+    // record never saw. A spoke has no apps/api and plans nothing.
+    const apiPkgPath = join(targetDir, ...API_PACKAGE_JSON.split("/"));
+    const apiMove = existsSync(apiPkgPath)
+        ? planApiMove(targetDir, opts.templatesDir, new Set([...newMap.keys()].filter((path) => path.startsWith(`${API_SRC}/`))), new Set(Object.keys(record.files)), opts.versions ?? {})
+        : undefined;
     // ── Every recorded row (D4) ────────────────────────────────────────────
     const updated = [];
     const merged = [];
     const added = [];
     const removed = [];
     const current = [];
-    const review = [];
+    const review = [
+        ...(mcpMove?.review ?? []),
+        ...(apiMove?.review ?? []),
+    ];
     const skipped = [];
     const nextFiles = { ...record.files };
     const writes = [];
@@ -323,12 +764,26 @@ export async function updateSite(opts) {
     for (const path of Object.keys(record.files).sort()) {
         const rec = record.files[path];
         if (outOfScope(path)) {
-            skipped.push({ path, reason: "outside this site's scope" });
+            skipped.push({
+                path,
+                reason: bootFileGuarded(path) ? DATABASE_PACKAGE_GUARD : "outside this site's scope",
+            });
             continue;
         }
         const abs = join(targetDir, ...path.split("/"));
         if (!existsSync(abs)) {
-            skipped.push({ path, reason: "deleted locally" });
+            if (newMap.get(path) === undefined) {
+                // Gone here and gone from the template: nothing to keep a row for.
+                delete nextFiles[path];
+                removed.push(path);
+                continue;
+            }
+            skipped.push({
+                path,
+                reason: backfillPatternVersion !== undefined
+                    ? `not in this site; recorded from ${backfillPatternVersion} as deleted locally`
+                    : "deleted locally",
+            });
             continue;
         }
         const diskBytes = readFileSync(abs);
@@ -421,17 +876,36 @@ export async function updateSite(opts) {
         }
     }
     // ── Every recordable path the running template has that this record does not (D4) ──
+    // A path the API move retires (#9566) reads as absent: the old in-app
+    // module object at a boot-set path goes before the writes below, and the
+    // template's re-export lands there as an added file.
+    const retired = new Set(apiMove?.deletes ?? []);
     const knownPaths = new Set([...Object.keys(record.files), ...(knownSnapshotPaths ?? [])]);
     for (const path of [...newMap.keys()].sort()) {
         if (Object.prototype.hasOwnProperty.call(record.files, path))
             continue;
+        // The guard runs before the disk check, so a full-copy site's boot path
+        // reads as guarded, never as "exists, not in the record" (#9569 DD8).
+        if (bootFileGuarded(path)) {
+            skipped.push({ path, reason: DATABASE_PACKAGE_GUARD });
+            continue;
+        }
         const abs = join(targetDir, ...path.split("/"));
         const newBytes = newMap.get(path);
-        if (existsSync(abs)) {
+        if (existsSync(abs) && !retired.has(path)) {
             const diskBytes = readFileSync(abs);
-            if (sha256Hex(diskBytes) !== sha256Hex(newBytes)) {
+            const newHash = sha256Hex(newBytes);
+            if (sha256Hex(diskBytes) !== newHash) {
                 skipped.push({ path, reason: "exists, not in the record" });
             }
+            else if (DATABASE_BOOT_FILES.includes(path)) {
+                // Adoption (#9569 DD8): a thin site converted by hand, or scaffolded
+                // before the boot files were recorded, gains the row for a copy that
+                // already equals the running template's. App paths keep today's
+                // behaviour: an unrecorded, identical copy stays unrecorded.
+                nextFiles[path] = { sha256: newHash, version };
+                current.push(path);
+            }
             continue;
         }
         if (outOfScope(path))
@@ -493,6 +967,12 @@ export async function updateSite(opts) {
         .sort(([a], [b]) => a.localeCompare(b))
         .map(([file, tests]) => ({ file, tests }));
     // ── Apply: writes and removals, then the record (D4 Order) ───────────
+    // #9566 — the API move's removals first: a retired file at a boot-set
+    // path is overwritten by the write that follows, never deleted after it.
+    for (const path of apiMove?.deletes ?? []) {
+        rmSync(join(targetDir, ...path.split("/")));
+        removed.push(path);
+    }
     for (const write of writes.filter((w) => notHeld(w.path))) {
         const abs = join(targetDir, ...write.path.split("/"));
         mkdirSync(dirname(abs), { recursive: true });
@@ -524,6 +1004,34 @@ export async function updateSite(opts) {
         moved.added.push(MODULE_FLAGS_PATH);
     else if (flags === "updated")
         moved.updated.push(MODULE_FLAGS_PATH);
+    // #9567 — the MCP move's writes, then the paid MCP tool registry from the
+    // site's own apps/mcp/package.json on every run (REGENERATED_APP_PATHS,
+    // #9460 DD6) — after the move, so a pack the move declared is a row.
+    if (mcpMove !== undefined) {
+        writeFileSync(mcpPkgPath, mcpMove.packageJson);
+        moved.updated.push(MCP_PACKAGE_JSON);
+        if (mcpMove.seam !== undefined) {
+            writeFileSync(join(targetDir, ...MCP_SEAM_PATH.split("/")), mcpMove.seam);
+            moved.updated.push(MCP_SEAM_PATH);
+        }
+        for (const path of mcpMove.deletes) {
+            rmSync(join(targetDir, ...path.split("/")));
+            moved.removed.push(path);
+        }
+        pruneEmptyDirs(join(targetDir, ...MCP_SRC.split("/")));
+    }
+    const registry = writePaidMcpTools(targetDir);
+    if (registry === "added")
+        moved.added.push(PAID_MCP_TOOLS_PATH);
+    else if (registry === "updated")
+        moved.updated.push(PAID_MCP_TOOLS_PATH);
+    // #9566 — the API move's package.json, then the directories its removals
+    // (applied above, before the writes) left empty.
+    if (apiMove !== undefined) {
+        writeFileSync(apiPkgPath, apiMove.packageJson);
+        moved.updated.push(API_PACKAGE_JSON);
+        pruneEmptyDirs(join(targetDir, ...API_SRC.split("/")));
+    }
     return {
         targetDir,
         version,
@@ -576,6 +1084,13 @@ export function formatUpdateReport(result) {
     if (nothingHappened) {
         return `[create-ailk] Already up to date (create-ailk ${result.version}).\n`;
     }
+    // #9567 / #9566 — the MCP and API moves add dependencies (the mcp README
+    // § Move, step 7, names the install; the API half says the same).
+    for (const pkgJson of [MCP_PACKAGE_JSON, API_PACKAGE_JSON]) {
+        if (result.updated.includes(pkgJson)) {
+            lines.push(`${pkgJson} gained dependencies: run \`pnpm install\`.`);
+        }
+    }
     return lines.join("\n") + "\n";
 }
 export const UPDATE_HELP = `create-ailk update — bring template fixes into a site's copied app code.
@@ -600,8 +1115,17 @@ site's version with it, its record entry is not advanced, and it is listed
 under "Held back with <file>" — reconcile the file, then run update again to
 bring its tests forward. Every other file in the run still updates.
 A site with no record gets one on its first run, from the version its
-.ailk-site-manifest.json already records. Commit before running, and review
-the diff after.
+.ailk-site-manifest.json already records. A site scaffolded before
+@working-theory/mcp-server has its copied apps/mcp moved to the boot set:
+the server and each module's paid MCP pack join apps/mcp/package.json, the
+copied server files go, and apps/mcp/src/lib/paid-tools.generated.ts is
+rewritten on every run. A site scaffolded before @working-theory/api has its
+copied apps/api moved to the boot file: the app becomes @working-theory/app-api,
+the package and the six @working-theory/api-<module> packages join
+apps/api/package.json, its bins and build:vercel delegate to the package, and
+the copied server files go. Run \`pnpm install\` after either move, since the
+app's package.json gained dependencies. Commit before running, and review the
+diff after.
 `;
 /** Parse the argv AFTER the `update` word. Strict `node:util` parseArgs, like `parseAdoptArgs`. */
 export function parseUpdateArgs(argv) {