create-ailk 0.24.0 → 0.26.0

package/dist/update.js

@@ -1,6 +1,7 @@
 /**
  * `create-ailk update [<target-dir>]` — bring template fixes into a site's
- * already-copied `apps/web`, `apps/api` and `apps/mcp` code (#8522).
+ * already-copied `apps/web`, `apps/api` and `apps/mcp` code (#8522), and
+ * the root `tools/` files their jest configs require (#9654).
  *
  * Reads `.ailk-template-files.json` (`template-record.ts`) to tell an
  * untouched copy from an owner's edit. An untouched file whose template
@@ -13,26 +14,39 @@
  * template test that imports a file left under review or skipped is held at
  * the site's version with it, so a run never leaves a test newer than the
  * code it exercises (#8704). A site with no record gets one backfilled from
- * `.ailk-site-manifest.json`'s `patternVersion` on its first run, then
- * updates normally. Every refusal throws before the first write.
+ * `.ailk-site-manifest.json`'s `patternVersion` on its first run — one row
+ * per in-scope path of that version's snapshot, on disk or not (#9527) —
+ * then updates normally. A site scaffolded before `@working-theory/mcp-server`
+ * (#9460) has its copied `apps/mcp` moved to the boot set (#9567): the
+ * record's own rules retire the copied server files, and what the record
+ * cannot see — the dependency, the hub seam's imports, the bundle-delivered
+ * paid tools — is planned here and applied with them. The paid MCP tool
+ * registry is rewritten from `apps/mcp/package.json` on every run, as the
+ * module-presence flags are. A site scaffolded before `@working-theory/api`
+ * (#9564) has its copied `apps/api` moved to the boot file the same way
+ * (#9566): the record retires the copied server files and lands the boot
+ * files; the app's rename, its dependencies and delegating scripts, and the
+ * bundle-delivered module files are planned here. Every refusal throws
+ * before the first write.
  *
  * Pure module: no `import.meta.url` — the CLI supplies `templatesDir`, the
  * `adopt.ts` / `add-route.ts` split.
  */
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, rmdirSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { AddModuleRefusedError, readArchitectureHeader } from "./add-module-core.js";
 import { buildScaffoldMarkers, isExcluded, isTextFile, renderTemplateFile, templateDestination } from "./copy.js";
 import { fetchTemplateSnapshot } from "./lib/fetch-template-snapshot.js";
 import { mergeThreeWay } from "./lib/merge-three-way.js";
-import { MODULE_FLAGS_PATH, writeModuleFlags } from "./paid-sections.js";
+import { MODULE_SLICES } from "./module-architecture.js";
+import { MODULE_FLAGS_PATH, PAID_MCP_TOOLS_PATH, writeModuleFlags, writePaidMcpTools, } from "./paid-sections.js";
 import { ParseError } from "./parse-args.js";
 import { SITE_ROSTER_PATH } from "./site-roster.js";
 import { SPOKE_CHECKOUT_TEMPLATE_PATHS } from "./spoke-checkout.js";
 import { excludedRoutePaths } from "./surfaces.js";
-import { TEMPLATE_RECORD_PATH, isRecordable, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
-import { TopologyError, isSpokeExcluded, readSpokeShape, spokeExclusions, } from "./topology.js";
+import { DATABASE_BOOT_FILES, ROOT_TOOL_FILES, TEMPLATE_RECORD_PATH, isRecordable, parseTemplateRecord, serializeTemplateRecord, sha256Hex, } from "./template-record.js";
+import { MCP_SEAM_PATH, MCP_SERVER_HUB, TopologyError, isSpokeExcluded, readSpokeShape, spokeExclusions, } from "./topology.js";
 /** A refusal the CLI exits 2 on, thrown before anything is written. */
 export class UpdateRefusedError extends Error {
     exitCode = 2;
@@ -60,9 +74,20 @@ function versionOlder(a, b) {
     }
     return false;
 }
-/** Every file under `templatesDir`'s three app trees, raw bytes keyed by destination path (D3). */
+/** The reason a boot file is skipped on a site whose `database/` is still the copied package (#9569 DD8). */
+const DATABASE_PACKAGE_GUARD = "database/ is still a package here — convert it to the thin consumer first";
+/**
+ * Every file under `templatesDir`'s three app trees, plus each of the
+ * `DATABASE_BOOT_FILES` (#9569 DD8) and `ROOT_TOOL_FILES` (#9654) present
+ * there, raw bytes keyed by destination path (D3).
+ */
 function walkLocalTemplates(templatesDir) {
     const out = new Map();
+    for (const boot of [...DATABASE_BOOT_FILES, ...ROOT_TOOL_FILES]) {
+        const abs = join(templatesDir, ...boot.split("/"));
+        if (existsSync(abs))
+            out.set(boot, readFileSync(abs));
+    }
     for (const app of ["web", "api", "mcp"]) {
         const root = join(templatesDir, "apps", app);
         if (!existsSync(root))
@@ -180,6 +205,537 @@ function importedHeldFiles(fromPath, text, held) {
     }
     return [...out];
 }
+// ── The MCP move (#9567): a copied apps/mcp becomes the boot set ──────────
+const MCP_SERVER_PACKAGE = "@working-theory/mcp-server";
+const MCP_PACKAGE_JSON = "apps/mcp/package.json";
+const MCP_SRC = "apps/mcp/src";
+/** The boot set (#9460 DD2): all `apps/mcp/src` holds after the move. */
+const MCP_BOOT_SET = new Set([
+    `${MCP_SRC}/index.ts`,
+    `${MCP_SRC}/app.ts`,
+    `${MCP_SRC}/site.ts`,
+    MCP_SEAM_PATH,
+    PAID_MCP_TOOLS_PATH,
+]);
+/**
+ * The paid tool files a module bundle delivered before #9460 (DD5) — never
+ * recorded, so the move names them. Their packages now ride
+ * `apps/mcp/package.json`. Frozen as of #9460; never extend: no bundle
+ * delivers a file under `apps/mcp/src` any more.
+ */
+const BUNDLED_MCP_TOOLS = new Set([
+    "agent_context",
+    "create_booking",
+    "get_event_meta",
+    "get_flow",
+    "inbox_applications",
+    "inbox_messages",
+    "inbox_submissions",
+    "list_availability",
+    "list_meetings",
+    "person_notes",
+    "proposals",
+    "submit_flow_step",
+].map((name) => `${MCP_SRC}/tools/${name}.ts`));
+/**
+ * The sha256 of every `apps/mcp/src` file a create-ailk template shipped
+ * before #9460 — the published tarballs 0.1.0 to 0.24.0, each one a blob in
+ * git history before the #9460 merge (#9654). A file under `apps/mcp/src`
+ * whose bytes hash into this set is a template copy, never a site edit, so
+ * the move removes it even where the record names another copy or none.
+ * Frozen as of #9460; never extend: no template ships a server file under
+ * `apps/mcp/src` any more.
+ */
+const PRIOR_MCP_TEMPLATE_HASHES = new Set([
+    "02789f25139dd78952a77c2d6f7a7057d73d18cdf45845913ad4d35964ad0e16",
+    "035a4f5eda5d7a00046f6f3446100dd1e34f85f894f000b04a931e094799c03e",
+    "06fe9518a954091284571ec253abea979c738ee3556b73f8993c759607eb3c4b",
+    "0702b6d5012dab15d4030be01923ed8da8b0a237028e6c88053c8fdcee63e155",
+    "09fedce92b189911964733f6a2535d0d3b0f0104ac18a1ff76abf5fd96261922",
+    "0d42d4c17a35867245fc86c48efa5b6dd2c0f89a03c564f68b7661cde98dddf4",
+    "0dc43a72c6d2fd1a5f36f037d9b01abcb9a11d1653a04fb033b5b6b223fcfbd8",
+    "0fb7cd858e7cd3c1f8757824184519f2494f9c12ec49290d7b97ee7656a7f405",
+    "115ac6b648a45e5e1b22193097e92a8ee4da844be5853ca202cb624651ef4c56",
+    "16cefcfebbcadb2505b8d8253c853b2d2098209fa4bac84fe39dc7f6b38c02c3",
+    "16eaefbceb5edcc3a8039d8ef55776d1a1e317521ecca17386673b87852c4099",
+    "17c6e5115ba947d53dcbb632990f6b66d570ea1657d022c51bf62e09c0b58194",
+    "17cc5d3eed8849a33f2eebd0d12ffa72c9ffebcccf5a4818aaf8f94fca05aa0f",
+    "18185d6f4e4777a7b0856a971c509ce0e094f8ccb8206eb6a1e78d38030c3763",
+    "1c5f0f0cdd304b3aff3934e6f0878adb18fc6555be030cb81e3d4a0764d65c43",
+    "1d328a242845e31426f28c33d58bf5be7be76f526e066858f77916ef2b28af41",
+    "1d5810272869e6a2f66941f862ec7c39a54af82e13ff33d4bff4a19e0d52f1a4",
+    "1ddc5b3a79b4a6453a0ac1f6e60ef3463b58221fb5ee313d52c57e9928ea8cdc",
+    "2131309a986b964e99a9a9589a0c236d5d830b14d66653e2008289eae2e2cf94",
+    "21cd9825d4b7ae057c10b5ca7d01c83387be20be66bf8c38814e7db592a7517e",
+    "21d28634fc19f15389ec99a3e6005490faff1c1d364bc7bd3a1f387edab09434",
+    "22c245c92b973d86f425b934bd65229c0017801e738a80db19aa0a174d7142c0",
+    "23d1318bb8b9aaf489c62ce667d8ba56110f48c8b7c401713a3ac4849c0978bb",
+    "2d901fec3ca30024d39274b9dc27156b4d366c86a5c3fb2897a8ca9b97b6d2d9",
+    "2dfe47a0e1d6904b5b183fc4aeb067e492127f3ee39058677895a9cc5e270b9e",
+    "2eeb3c272e60e1dbf87f868fecac8526f265a4f5327afbeb5ee4c3ecebb848db",
+    "3110e5b85f764e39e0e9c7164290cd62a1be51b90e49ed38611a004143a6b130",
+    "31afce85a1982d17c9e1d8069e54913b0bdb295010104541ea04b061084b314e",
+    "36bc7bea57167851ae81b4baa57daee2fad4f2db9b96b730a72e2ca0c69d75b7",
+    "38fab15821f26449c149c12851ff7a857db89d55c4722f797b15274e31a4a4bf",
+    "39ef3340a53926a8e8dd77f78924d1975fa5284ab7ae2b99bb8602b20bb7e7a8",
+    "3bb46c8ea91349d7551a66c13462f99910ead5b813f0aa51a1b7ab1671f3576a",
+    "3cc84368f3eaaf7e875a145fabf7ac644ee4ef1fa785cf548c9639a69985661e",
+    "40a538c6a84a95690dc810a5249b74e67c234fc5cf4f6cc6476d7961f67ecbdd",
+    "426e33baaeed2bb51a720fce286dba4da00d94418d3554c628c87b3d14e03116",
+    "428c570d20f07c9069578c8729c2dcf7eb6eab3b956f8c20eccbabae2f518272",
+    "436fc6ed239cf5b4612ee4dbf102debaf5384a3872a30a834d1042e521e318f3",
+    "443a31b8af758901d5685134d5046cf4880b534268a9e9cc2ea85185cb5f54ee",
+    "443c60fd527c7703b5f3af9ad9b6efd49c359fdde717228254961ea9e7815117",
+    "4b28c6e6a6799eb9548720a9f16bafd93a15baa04cacbec950c23e2e5be0f1aa",
+    "4b8e654da8220df69a4c4457c1527c2bea9f5aed73d67458c4ce2a14f1b87e8f",
+    "4d01e1fcdda1f941789894a6a54d2940f47096c39f37609a5e908c0aa84789db",
+    "52583caf9f8946c36133949278449dceeb0ac8f74360534ca91b96938d80446c",
+    "5364243db73f8687c1c0ec9cc2516e95efb43a756e295ae8b6469fd55f940649",
+    "578dd3161d2dc283011a069a4d426037ba665f0f787a317779115b570a74269f",
+    "59882d160c82e5be765102c13dd3c05fbd7e48673408f89c194c8e021ae29797",
+    "5ae7a51f8d439d331c5a02229b4109daa5299de6c12d821b78bbc14feda8413f",
+    "5ed07e4eed1e6cc7d19185669a14b8df974ea640d283676f33f4db8566fb8cdc",
+    "5f60e2bd4fb529c02e195b1aef3bf2ebfa55db05212ae9888e265f3f2f9fade8",
+    "6022594cc246c8f3453935781607fa3750b7c8e5b29fab9c841f13364cc9d08a",
+    "60b1ed4e37ecc2e045726f2fd93ef90cc9dea33718532a90e365d6d64d803047",
+    "659248c6e0c85075142c6a86395fb2b6b2bdf36895dfb2aeb5ab5e044528f11b",
+    "66d95e135f59ff1ccdcf3480bd22eac81a559ef0a4439d9a34ce6c25a6885ada",
+    "68976a1295acc8ed025a8a3ab30d78492c7e40e4320ac5acecc53f9e7f2aa04f",
+    "69cebf99ae494a0fd06b4b9408587f230def919dceb4fbcf3ef950f243bbf486",
+    "6b919aa697e9785f175201193e498b17b6c64ffe08c34a9a3ff728d660aa68cf",
+    "6da43872f0bee03f3028183795d41ea257c6102928175efe162ffb0fd37849c8",
+    "6e86925727a045268249248e9dffd7e8869f2604af43fda27c8acf75982988de",
+    "6e8f01a9c1f20f580e2dec7fe8a4c811ffd88621612aac03604aedeaeb9b7c90",
+    "715ed89d03445103ca05c0686c8f6fc7cef0c61b18767c285777bb65122fa81a",
+    "74a2c97adba8e0390a281fddbc5dce3ec7f9e97577b2fcb9abcf0bdcee01b63c",
+    "75abc78c74f28259d817cf159b3969c548395131de6255978b9df4d275aa1544",
+    "77d1aacb454904eded6d9a043de7f95922d53bae9693df48b106a74de7405e98",
+    "78826164442493682a624ba492f6e39b3479208d93a7aa2fdfca70005333255f",
+    "792e6b2cf89272fe9860d585a23687e14881533f3644dd5b1e8e30ea89e6f4a2",
+    "7afb50314471ab4e8f31099db49e29a96e56efd83ba960a42732e177654c874d",
+    "7b7d5053aaa6358eb66042cfca9e2fe6280d354e23a303c129f08a413bf94c4c",
+    "7ed1787f0d71fceb92fb687a8d4e6a5ffc49896ee586303b4311035ba60ba2d2",
+    "81dd15a6b1479896458106b946edc0ac76f6c0acf4d525307b092ed11d2f4596",
+    "83eaa71438882dde8edf0d7978644a93c802a08a50804f5b2c62d01eaeb4edc9",
+    "8441a52d587584cccd6f1fbe3ba5204c9c49a9c6d452d9f844d34dcc0448ad76",
+    "847d648346ea4bd0d2f349399527f5a907e05367c6764696b724f3382090089e",
+    "85df33660e2291ffe1e77b7103e4705c31b93dd7a294872b6c0fca52a3bd3079",
+    "8a9eea9c23a94ff9df729a4aa423e62b02c0632e398bf01524f1caeed61944b9",
+    "8e7d112d48976c7ae66203b6c45e8c20708f60a4486411a30af7857e214b8d27",
+    "91945c6e325758d09d7f70586f63bda0758f187247e4a8cfab05d9ed45c1e25b",
+    "960723d00c54a88af4142cde66b77c5e70cd3b39f59dce462fdf8d153846a9cf",
+    "9623a2f691777ea1fea280782240837b24b8202082bf98dbaa2ea48c670774b8",
+    "9ebfb38044ad35af8156803be6bb975a7c6b1624fa511037d56beb7b9e0d3579",
+    "9ede34ab75c67dc0fe134d7bf64d040e250cec85111ef9fb11be745af5e90277",
+    "a03fd2d78e6e4982209e193ad27f0732035c2c2eb5edfcdd8e3093a42e5334a4",
+    "a14cf80e8cfc09105cd856bc5723a4b1a231f6ad8f08e5a443360c480a6b483b",
+    "a17f89416b31fb883dc9a5c389b021332b2b40e5052fe344e1aec96872475d5f",
+    "a20b034a648c2b9daaf3ca817a2229ce7e0136b0fc7487c7fed5fe0cdf1e9e7b",
+    "a4495346b79124d1b17f6082f0c1f1f99d3845f4f98cfde83543f2eadf600666",
+    "a6d6d6be76cff255bbf77d529dee8775817dae75725bf24964febbbc7cf8d508",
+    "a7421e1949c4f3671cfb0d758fecb3b87aab3df03d0feaed0259443ebb2a4353",
+    "ac7cd310467561330d3cc2914fd29c9a16ecd27d7f8413dd1120e28ce9ee3ad7",
+    "add424a2fbb1027d67270dca6e5e1e0e384dd37a729ba5c091022bc30b3d85c1",
+    "af5c4f3113285a137019f7bcbb905c04f0de3b6917d709a0fc8df3f0f39beda9",
+    "b0c8bc973e3b9f7fdaf95cb02ca111cb685db2ac98559c859071b4f26f600bf4",
+    "b455cd835c1769af463b4ebd91fa6716effbad6f8210df12d47637977b34c6e2",
+    "b7140dd15cac5f55309991e7ce1b438a9514a4b289c9ef807f75ed576246fc26",
+    "b7198546881c491e233018dadd3fbdb6378694e8a15b762b56c17a1c61d10c91",
+    "b7d1e33111a13249d6bc4d0a9334074430bc94f1a0c79d94f5c6f5907b76ae30",
+    "b9bd1f23c0e84f91cf7d46db46cab4cb1232574b0f6c9d6f5926fa0bab110570",
+    "ba7e5b4db4fd020b0aadace2083aacfb9ffafa63465d2026e4a79804eb8cd493",
+    "bb321afe40c6d7495676f9157bc80bbab9d5241fa84340133770b1ba3006d166",
+    "bced6c526cd757d87b4d725e247497b6e1286192b758421786c645719c3b4dfd",
+    "bf398a05bdbdb85a8034ecfd9f4d865587b7d25352a06f3c9f3ca1c0deed6787",
+    "bf4a2222b34a4fdabccd696341f6168104d3d7d74df036187347650ecf350d32",
+    "c1513e2317857959145d66659c3b147cc885ca46f4c239ed85f52a833d058971",
+    "c371bdde5f7ace2448c46a0e009d799bdb90d3351d42131234181d1efd2b486f",
+    "c57ccbaddda8c7d538d103c2b2d96889a815cbcc4469f5f6780b0883d99b4006",
+    "c5a448c17e6bba3379ee938b17309c02eb851cbf5fb54dcd6ec490503b70b121",
+    "c5d35895a261227c6cf537daeac4b24a98d91ea65e8322d7ca5c47d05c83570c",
+    "c64f4b1a9dba4d1fa76f8aea664c81e35961dca2e3f44f63a6783f5164951560",
+    "c676077b914411e737376f9604087aab67ba2f300aedb99e76a5839f1798827b",
+    "ca076f76130bd3e35488bfe23d7f55f1829164a4e09035459f3af2aee1d91ace",
+    "ca842e6ec1748a84fa30adde6f93a84e7b98b6211afbb3e7907e9b6b9b65fed2",
+    "ce7ada5214b23c595422399fbd10a8e95bb1b9b30a345c2117bf1954cc2163a6",
+    "d2b460eee83c40d26db73bded9ad30666fe970eb991c925727eed5e45d1a5cb4",
+    "d4cba3c71603c40bf0a8b6e1643a157e2028d3743b238fb932e059381a17deb9",
+    "d5fcd1015582870231c52f490b8daac7a89dbaa2d387f285e118fff98bf7ada2",
+    "d96ff716399aca50bd6f5c43bb37721e2d4cbb43793a453119f6e15e6eeca34b",
+    "da75ba145c8142544d6211b4eaba8485549511766e2c0d248ac2308b502cf986",
+    "dfbcfe0f30c6079153b5ab51096ef106716a713a7d6169b2ec00840423640560",
+    "e1945e3ff2b6d806fc459c90d0253ca71f2adac5bedc6c578ca21506f9dc094a",
+    "e43789a019a1c487b42cc785175f0b08b36a7e4f5ae72e40a6c1835f9d02b2d6",
+    "e482750dfb358f78b1142a8707cb007cc7a5e5c863614b05d0289f4843d10b6f",
+    "e4948f0dadc17dcae583e2d8732a1e95c8268d4e5bf68bc38e97e05a251b9fcb",
+    "e4aff38f30ca76f6da6ec4bf98c71a51d8fc41877ddcf791aeb61fcf34bb44ea",
+    "e59294cc6a47cabd5df6ab635dd3748f42610e1691b248d24b8962fc3661df43",
+    "e7c7711f3512fdd51bdd175098ffe97c1c4483b4369b2627bbf00eafd65c00af",
+    "e7feca03ec0681bee9bba97b9ee5024215899f95aad72cca08c0902b969bee5c",
+    "e97b05627ca65f8656167b5ffefb8236cce711173a98430d7ac7f063dc598223",
+    "e9ba0a0e497e5d12662a473b81e0cb09f81a094c2763266769e08f5556718f15",
+    "e9c9f8d30528a30084e58d41d93d7e4d58d07a4bd8f1e2c1d132c2525669e8a5",
+    "ec28dcc626ae59a3c5208f342ba8090c3e8640c6e4930a4b518dfdaa4ccdb773",
+    "ef7f59acd7f5de7287681786bb96f1907ac72a9cca7d49732c33320359725ef9",
+    "f37c56da121f8cba9c0a55bc69ef701e3d81c63a15f1a9ff354efc4fed58ff39",
+    "f562f262c2b26f3e613a50aea737bf7b021d8c4ea9e769ce6b4728675fd68b9e",
+    "f6f9e117ab5d1e68b7b99baa30ab822c0126467b8941195a187bf3af20f7faa5",
+    "f8d26912ffbc7c1a7b73a0916111aa5c969d98a60b211ff7ca75d8e7828d86c1",
+    "f984b95c8a9759cdd988722b7de5be6654c69e0ceb12abc4847115f964087fc0",
+    "fc43fb068d3816a65a00144f32ebd3fb077f474090de8c1c99dd77f542c35c43",
+    "fdbdd75dc3b798c548ddf28a3c730fa61f64dc1b48d30ff65e190bbc7bb097ba",
+    "ffe3db23d21ce93dbb8b832a04318cf23aaa8b1d6db11185ebcf30a634e86e6d",
+]);
+/** The old hub seam's two relative imports; each is now `MCP_SERVER_HUB` (DD7). */
+const OLD_HUB_SEAM_IMPORTS = ['"./public-workspace.js"', '"./license-key-store.js"'];
+/** Every file under `root`, as `/`-separated paths relative to `targetDir`. */
+function filesUnder(targetDir, root) {
+    const out = [];
+    const stack = [join(targetDir, ...root.split("/"))];
+    for (let dir = stack.pop(); dir !== undefined; dir = stack.pop()) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const abs = join(dir, entry.name);
+            if (entry.isDirectory())
+                stack.push(abs);
+            else if (entry.isFile())
+                out.push(abs.slice(targetDir.length + 1).split(sep).join("/"));
+        }
+    }
+    return out.sort();
+}
+/** `pkg` (a parsed package.json) with `entries` merged into `dependencies`, keys sorted. */
+function withDependencies(pkg, entries) {
+    const deps = { ...(pkg.dependencies ?? {}), ...entries };
+    pkg.dependencies = Object.fromEntries(Object.keys(deps).sort().map((key) => [key, deps[key]]));
+    return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+/**
+ * `^<version>` per package from the running `versions.json`, for a move of
+ * `apps/<app>` to `pkg` (#9567 / #9566). Throws — before any write — naming
+ * the first package `versions` lacks.
+ */
+function resolveMoveVersions(app, pkg, packages, versions) {
+    const entries = {};
+    for (const name of packages) {
+        const v = versions[name];
+        if (v === undefined) {
+            throw new UpdateRefusedError(`moving apps/${app} to ${pkg} needs a version for ${name}, and this create-ailk's versions.json has none`);
+        }
+        entries[name] = `^${v}`;
+    }
+    return entries;
+}
+/**
+ * Every unrecorded file under `src`, sorted into what a move removes and
+ * what it lists for review: a `bundled` file (bundle-delivered, never
+ * recorded) is removed even at a boot-set path (#9566: the #9564→#9565
+ * window's in-app module objects sit where the template's re-exports land);
+ * any other boot-set file is left to the record; a file whose bytes hash
+ * into `templateCopies` is a prior template copy and is removed (#9654); the
+ * rest is reviewed with `reason`, never deleted.
+ */
+function classifyUnrecorded(targetDir, src, bootSet, recorded, bundled, reason, templateCopies = new Set()) {
+    const deletes = [];
+    const review = [];
+    for (const path of filesUnder(targetDir, src)) {
+        if (recorded.has(path))
+            continue;
+        if (bundled.has(path)) {
+            deletes.push(path);
+            continue;
+        }
+        if (bootSet.has(path))
+            continue;
+        const hash = sha256Hex(readFileSync(join(targetDir, ...path.split("/"))));
+        if (templateCopies.has(hash))
+            deletes.push(path);
+        else
+            review.push({ path, reason });
+    }
+    return { deletes, review };
+}
+/**
+ * The move a site scaffolded before #9460 needs, or `undefined` when its
+ * `apps/mcp` already depends on the server. README § "Move an existing
+ * site's apps/mcp to this package", steps 1, 5 and 6 — steps 2 to 4 are the
+ * record's own rows and the registry write. Throws before any write when
+ * `versions` lacks a package the move must declare.
+ */
+function planMcpMove(targetDir, modules, hub, recorded, versions) {
+    const pkgText = readFileSync(join(targetDir, MCP_PACKAGE_JSON), "utf8");
+    let pkg;
+    try {
+        pkg = JSON.parse(pkgText);
+    }
+    catch (err) {
+        throw new UpdateRefusedError(`${MCP_PACKAGE_JSON} is not valid JSON: ${err.message}`);
+    }
+    if (Object.hasOwn(pkg.dependencies ?? {}, MCP_SERVER_PACKAGE))
+        return undefined;
+    const packages = [MCP_SERVER_PACKAGE];
+    for (const name of modules) {
+        for (const pack of MODULE_SLICES[name].paidMcpToolPackages ?? []) {
+            if (!packages.includes(pack))
+                packages.push(pack);
+        }
+    }
+    const entries = resolveMoveVersions("mcp", MCP_SERVER_PACKAGE, packages, versions);
+    const move = { packageJson: withDependencies(pkg, entries), deletes: [], review: [] };
+    const seamPath = join(targetDir, ...MCP_SEAM_PATH.split("/"));
+    if (hub && existsSync(seamPath)) {
+        const before = readFileSync(seamPath, "utf8");
+        let after = before;
+        for (const spec of OLD_HUB_SEAM_IMPORTS)
+            after = after.split(spec).join(`"${MCP_SERVER_HUB}"`);
+        if (after !== before)
+            move.seam = after;
+    }
+    if (!existsSync(join(targetDir, ...MCP_SRC.split("/")))) {
+        throw new UpdateRefusedError(`${MCP_PACKAGE_JSON} is present but ${MCP_SRC}/ is not, so apps/mcp cannot be moved to ${MCP_SERVER_PACKAGE}`);
+    }
+    const unrecorded = classifyUnrecorded(targetDir, MCP_SRC, MCP_BOOT_SET, recorded, BUNDLED_MCP_TOOLS, `not in the boot set apps/mcp/src is since ${MCP_SERVER_PACKAGE} (#9460); move it into a package or delete it`, PRIOR_MCP_TEMPLATE_HASHES);
+    move.deletes = unrecorded.deletes;
+    move.review = unrecorded.review;
+    return move;
+}
+/** Remove every directory under `root` left empty — `root` itself stays. */
+function pruneEmptyDirs(root) {
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const abs = join(root, entry.name);
+        pruneEmptyDirs(abs);
+        if (readdirSync(abs).length === 0)
+            rmdirSync(abs);
+    }
+}
+// ── The API move (#9566): a copied apps/api becomes the boot file ─────────
+const API_PACKAGE = "@working-theory/api";
+/** The app's name since #9564 D10 — the copied app's `@working-theory/api` would shadow the dependency. */
+const API_APP_NAME = "@working-theory/app-api";
+const API_PACKAGE_JSON = "apps/api/package.json";
+const API_SRC = "apps/api/src";
+/** The boot's module objects, one `apps/api/src/modules/<name>.ts` per `@working-theory/api-<name>` (#9565 D5). */
+const API_MODULES_DIR = `${API_SRC}/modules`;
+/**
+ * The scripts #9564 D9 retargets at the installed package: the four base
+ * bins run its compiled `dist/bin/<name>.js`, and `build:vercel` builds the
+ * renamed app. `db:*`, `dev`, `start` and the module bins stay as the site
+ * has them.
+ */
+const API_DELEGATING_SCRIPTS = [
+    "abandon:sweep",
+    "rate-limit:probe",
+    "spokes",
+    "stripe-connections:rekey",
+    "build:vercel",
+];
+/**
+ * The module files a module bundle delivered under `apps/api/src` before
+ * #9565 (D6) — never recorded, so the move names them; their modules now
+ * ride `apps/api/package.json` as packages. The pre-#9565 `MODULE_SLICES`
+ * `apps/api/` entries at 328494dba, all 144, the six `modules/<name>.ts`
+ * among them: between #9564 and #9565 a bundle delivered each module
+ * OBJECT in-app, at the very path the template's one-statement re-export
+ * now takes, importing the routes beside it — so an unrecorded file there
+ * is the old object and goes, and the re-export lands over it. Frozen as of
+ * #9565; never extend: no bundle delivers a file under `apps/api/src` any
+ * more.
+ */
+const BUNDLED_API_FILES = new Set([
+    "__tests__/content-write-production-boot.test.ts",
+    "__tests__/listings-forwarded-rate-limit.test.ts",
+    "__tests__/openapi-keyless-hub.test.ts",
+    "__tests__/schedule-forwarded-rate-limit.test.ts",
+    "bin/deliverable-resend.ts",
+    "bin/deliverable-upload.ts",
+    "bin/flows-copy.ts",
+    "bin/followup-sweep.ts",
+    "bin/listing-csv-sweep.ts",
+    "bin/member-request-match.ts",
+    "bin/seed-presets.ts",
+    "bin/seed-waitlist-experiments.ts",
+    "bin/session-retention-sweep.ts",
+    "config/__tests__/scheduling-credential-key.test.ts",
+    "lib/asset-store.ts",
+    "lib/member-request-match.ts",
+    "lib/public-meetings-config.ts",
+    "lib/ws-token.ts",
+    "modules/commerce.ts",
+    "modules/content-write.ts",
+    "modules/multi-tenant.ts",
+    "modules/scheduling.ts",
+    "modules/signal-collectors.ts",
+    "modules/workspace.ts",
+    "routes/assets/index.ts",
+    "routes/assets/manage.ts",
+    "routes/assets/read.ts",
+    "routes/assets/upload.ts",
+    "routes/billing/index.ts",
+    "routes/billing/portal.ts",
+    "routes/billing/read.ts",
+    "routes/billing/stripe-connection.ts",
+    "routes/billing/stripe-products.ts",
+    "routes/billing/usage.ts",
+    "routes/consent/platform.ts",
+    "routes/deliverables/index.ts",
+    "routes/flow-checkouts/index.ts",
+    "routes/flows/README.md",
+    "routes/flows/index.ts",
+    "routes/flows/recommender.ts",
+    "routes/magnets/index.ts",
+    "routes/member/appointments.ts",
+    "routes/member/artifact-review.ts",
+    "routes/member/artifacts.ts",
+    "routes/member/availability.ts",
+    "routes/member/billing.ts",
+    "routes/member/bookings.ts",
+    "routes/member/consents.ts",
+    "routes/member/deletion-request.ts",
+    "routes/member/meeting-types.ts",
+    "routes/member/messages.ts",
+    "routes/member/onboarding.ts",
+    "routes/member/pieces.ts",
+    "routes/member/profile.ts",
+    "routes/member/purchases.ts",
+    "routes/member/request-form.ts",
+    "routes/member/requests.ts",
+    "routes/project-listings/__tests__/directory.test.ts",
+    "routes/project-listings/get.ts",
+    "routes/project-listings/list.ts",
+    "routes/project-listings/patch.ts",
+    "routes/schedule/__tests__/appointments.test.ts",
+    "routes/schedule/__tests__/meeting-types.test.ts",
+    "routes/schedule/__tests__/meetings.test.ts",
+    "routes/schedule/__tests__/public-connection.test.ts",
+    "routes/schedule/__tests__/spoke.test.ts",
+    "routes/schedule/appointments.ts",
+    "routes/schedule/index.ts",
+    "routes/schedule/meeting-types.ts",
+    "routes/slack/actions.ts",
+    "routes/slack/index.ts",
+    "routes/subscription/index.ts",
+    "routes/subscription/me.ts",
+    "routes/subscription/portal.ts",
+    "routes/waitlist-experiments/comparison.ts",
+    "routes/waitlist-experiments/index.ts",
+    "routes/waitlist-experiments/list.ts",
+    "routes/waitlist-experiments/respond.ts",
+    "routes/waitlist-experiments/signup.ts",
+    "routes/waitlist-experiments/signups.ts",
+    "routes/waitlist-signups/index.ts",
+    "routes/webhooks/__tests__/calcom-connection.test.ts",
+    "routes/webhooks/__tests__/calcom.test.ts",
+    "routes/webhooks/calcom.ts",
+    "routes/workspaces/__tests__/meetings-connection.test.ts",
+    "routes/workspaces/__tests__/meetings.test.ts",
+    "routes/workspaces/agents.ts",
+    "routes/workspaces/callbacks.ts",
+    "routes/workspaces/config.ts",
+    "routes/workspaces/content.ts",
+    "routes/workspaces/general.ts",
+    "routes/workspaces/index.ts",
+    "routes/workspaces/meetings.ts",
+    "routes/workspaces/members.ts",
+    "routes/workspaces/messages-out.ts",
+    "routes/workspaces/messages.ts",
+    "routes/workspaces/offerings.ts",
+    "routes/workspaces/orders.ts",
+    "routes/workspaces/people.ts",
+    "routes/workspaces/pieces.ts",
+    "routes/workspaces/plan.ts",
+    "routes/workspaces/requests.ts",
+    "routes/workspaces/sessions.ts",
+    "routes/workspaces/submissions.ts",
+    "routes/workspaces/subscribers.ts",
+    "routes/workspaces/trial.ts",
+    "services/__tests__/lead-promotion.test.ts",
+    "services/__tests__/leads-inbox.test.ts",
+    "services/flow-aggregate.ts",
+    "services/flow-checkouts.ts",
+    "services/flow-copy.ts",
+    "services/flow-engine.ts",
+    "services/inbox-messages.ts",
+    "services/inbox-orders.ts",
+    "services/inbox-submissions.ts",
+    "services/listing-csv-sweep.ts",
+    "services/listing-promotion.ts",
+    "services/playbook-compile.ts",
+    "services/playbook-render.ts",
+    "services/project-listing-decision.ts",
+    "services/project-listing-flow.ts",
+    "services/project-listing-issue.ts",
+    "services/proposal-payments.ts",
+    "services/recommender-capture.ts",
+    "services/scheduling/__tests__/appointments.test.ts",
+    "services/scheduling/__tests__/cal-provider.test.ts",
+    "services/scheduling/__tests__/connections.test.ts",
+    "services/scheduling/__tests__/meetings.test.ts",
+    "services/scheduling/__tests__/provider-resolution.test.ts",
+    "services/scheduling/appointments.ts",
+    "services/scheduling/cal-provider.ts",
+    "services/scheduling/connections.ts",
+    "services/scheduling/index.ts",
+    "services/scheduling/meetings.ts",
+    "services/scheduling/resolve.ts",
+    "services/scheduling/types.ts",
+    "services/subscription.ts",
+    "services/trial.ts",
+    "services/waitlist-dashboard.ts",
+    "services/waitlist-experiments.ts",
+    "services/waitlist-followup.ts",
+    "services/waitlist-operator-reads.ts",
+    "services/waitlist-scoring.ts",
+    "services/waitlist-signups.ts",
+].map((path) => `${API_SRC}/${path}`));
+/**
+ * The move a site scaffolded before #9565 needs, or `undefined` when its
+ * `apps/api` already depends on the package AND all six module packages. A
+ * site from before #9564 lacks all seven; one scaffolded in the #9564→#9565
+ * window depends on the package but carries the six module objects in-app
+ * (bundle-delivered, unrecorded) and lacks their packages — either is the
+ * move. The boot files, the module objects and the copied server files are
+ * the record's own rows (the running template's `apps/api/src` IS the boot
+ * set); this plans what the record cannot see. Throws before any write when
+ * `versions` lacks a package the move must declare.
+ */
+function planApiMove(targetDir, templatesDir, bootSet, recorded, versions) {
+    const pkgText = readFileSync(join(targetDir, API_PACKAGE_JSON), "utf8");
+    let pkg;
+    try {
+        pkg = JSON.parse(pkgText);
+    }
+    catch (err) {
+        throw new UpdateRefusedError(`${API_PACKAGE_JSON} is not valid JSON: ${err.message}`);
+    }
+    const modulesDir = join(templatesDir, ...API_MODULES_DIR.split("/"));
+    const packages = [
+        API_PACKAGE,
+        ...(existsSync(modulesDir) ? readdirSync(modulesDir) : [])
+            .filter((file) => file.endsWith(".ts"))
+            .map((file) => `${API_PACKAGE}-${file.slice(0, -".ts".length)}`),
+    ];
+    const deps = pkg.dependencies ?? {};
+    if (packages.every((name) => Object.hasOwn(deps, name)))
+        return undefined;
+    const entries = resolveMoveVersions("api", API_PACKAGE, packages, versions);
+    if (pkg.name === API_PACKAGE)
+        pkg.name = API_APP_NAME;
+    const templateScripts = JSON.parse(readFileSync(join(templatesDir, ...API_PACKAGE_JSON.split("/")), "utf8")).scripts ?? {};
+    for (const key of API_DELEGATING_SCRIPTS) {
+        const script = templateScripts[key];
+        if (script !== undefined)
+            (pkg.scripts ??= {})[key] = script;
+    }
+    const move = { packageJson: withDependencies(pkg, entries), deletes: [], review: [] };
+    if (!existsSync(join(targetDir, ...API_SRC.split("/")))) {
+        throw new UpdateRefusedError(`${API_PACKAGE_JSON} is present but ${API_SRC}/ is not, so apps/api cannot be moved to ${API_PACKAGE}`);
+    }
+    const unrecorded = classifyUnrecorded(targetDir, API_SRC, bootSet, recorded, BUNDLED_API_FILES, `not in the boot file apps/api/src is since ${API_PACKAGE} (#9564); move it into a package or delete it`);
+    move.deletes = unrecorded.deletes;
+    move.review = unrecorded.review;
+    return move;
+}
 export async function updateSite(opts) {
     const targetDir = resolve(opts.targetDir);
     const version = opts.version;
@@ -252,7 +808,13 @@ export async function updateSite(opts) {
     const spokeExclusionList = spoke !== undefined ? spokeExclusions(opts.templatesDir, spoke) : undefined;
     // #8748 D3 — the standard spoke checkout is a commerce spoke's alone.
     const sellsAsSpoke = spoke !== undefined && header.modules.includes("commerce");
+    // #9569 DD8 — a `database/` that is still a package (the pre-thin copy) is
+    // never touched: its boot paths are out of scope, reported under the guard.
+    const databaseIsPackage = existsSync(join(targetDir, "database", "package.json"));
+    const bootFileGuarded = (destRel) => databaseIsPackage && DATABASE_BOOT_FILES.includes(destRel);
     const outOfScope = (destRel) => {
+        if (bootFileGuarded(destRel))
+            return true;
         if (isExcluded(destRel, excludedRoutes))
             return true;
         if (!sellsAsSpoke && isExcluded(destRel, SPOKE_CHECKOUT_TEMPLATE_PATHS))
@@ -292,6 +854,15 @@ export async function updateSite(opts) {
         return result;
     }
     // ── The backfill: fetch the old base and build the synthetic record ──
+    // Every in-scope snapshot path gets a row at the snapshot's hash, present
+    // on disk or not (#9527): an absent one then reads as "deleted locally"
+    // on this run and every later one, exactly as a scaffold-written row
+    // whose file the owner removed — never as a new template file to add —
+    // and a copy the owner later restores from the snapshot reads as
+    // untouched. Out-of-scope paths (rules i/ii) stay unrecorded. The absent
+    // rows also feed `knownPaths` on every later run, so a new template file
+    // under an absent recorded directory is never added — the same reading as
+    // "the owner deleted that directory" (rule iii).
     let knownSnapshotPaths;
     if (backfillPatternVersion !== undefined) {
         const base = await loadVersionMap(backfillPatternVersion);
@@ -303,19 +874,47 @@ export async function updateSite(opts) {
         for (const [path, bytes] of [...base.entries()].sort(([a], [b]) => a.localeCompare(b))) {
             if (outOfScope(path))
                 continue;
-            if (!existsSync(join(targetDir, ...path.split("/"))))
-                continue;
             files[path] = { sha256: sha256Hex(bytes), version: backfillPatternVersion };
         }
         record = { schema: 1, projectName: record.projectName, files };
     }
+    // ── The MCP move (#9567), planned before the first write ──────────────
+    // A site scaffolded before #9460 carries the server under apps/mcp/src and
+    // no @working-theory/mcp-server dependency. Its recorded copies the running
+    // template no longer has fall out through the rows below — removed when
+    // untouched, reviewed when edited — and index.ts, app.ts and site.ts arrive
+    // as any template change does. The rest is planned here: the dependency
+    // and each carried module's paid pack, the hub seam's two imports, and the
+    // bundle-delivered paid tools the record never saw. A `--without-mcp`
+    // spoke has no apps/mcp and plans nothing.
+    const mcpPkgPath = join(targetDir, ...MCP_PACKAGE_JSON.split("/"));
+    const mcpMove = existsSync(mcpPkgPath)
+        ? planMcpMove(targetDir, header.modules, spoke === undefined, new Set(Object.keys(record.files)), opts.versions ?? {})
+        : undefined;
+    // ── The API move (#9566), planned before the first write ──────────────
+    // A site scaffolded before #9564 carries the server under apps/api/src, an
+    // apps/api still named @working-theory/api and no @working-theory/api
+    // dependency. The running template's apps/api/src is the boot set: its
+    // recorded copies the template no longer has fall out through the rows
+    // below, and server.ts, index.ts and the six module objects arrive as any
+    // template change does. Planned here: the rename, the package and the six
+    // module packages (the boot passes all six on every boot, #9565 D5), the
+    // delegating scripts (#9564 D9) and the bundle-delivered module files the
+    // record never saw. A spoke has no apps/api and plans nothing.
+    const apiPkgPath = join(targetDir, ...API_PACKAGE_JSON.split("/"));
+    const apiMove = existsSync(apiPkgPath)
+        ? planApiMove(targetDir, opts.templatesDir, new Set([...newMap.keys()].filter((path) => path.startsWith(`${API_SRC}/`))), new Set(Object.keys(record.files)), opts.versions ?? {})
+        : undefined;
     // ── Every recorded row (D4) ────────────────────────────────────────────
     const updated = [];
     const merged = [];
     const added = [];
     const removed = [];
     const current = [];
-    const review = [];
+    const review = [
+        ...(mcpMove?.review ?? []),
+        ...(apiMove?.review ?? []),
+    ];
     const skipped = [];
     const nextFiles = { ...record.files };
     const writes = [];
@@ -323,12 +922,26 @@ export async function updateSite(opts) {
     for (const path of Object.keys(record.files).sort()) {
         const rec = record.files[path];
         if (outOfScope(path)) {
-            skipped.push({ path, reason: "outside this site's scope" });
+            skipped.push({
+                path,
+                reason: bootFileGuarded(path) ? DATABASE_PACKAGE_GUARD : "outside this site's scope",
+            });
             continue;
         }
         const abs = join(targetDir, ...path.split("/"));
         if (!existsSync(abs)) {
-            skipped.push({ path, reason: "deleted locally" });
+            if (newMap.get(path) === undefined) {
+                // Gone here and gone from the template: nothing to keep a row for.
+                delete nextFiles[path];
+                removed.push(path);
+                continue;
+            }
+            skipped.push({
+                path,
+                reason: backfillPatternVersion !== undefined
+                    ? `not in this site; recorded from ${backfillPatternVersion} as deleted locally`
+                    : "deleted locally",
+            });
             continue;
         }
         const diskBytes = readFileSync(abs);
@@ -352,6 +965,15 @@ export async function updateSite(opts) {
         }
         // Edited.
         if (newBytes === undefined) {
+            // #9654 — the bytes are a pre-#9460 template copy, just not the one
+            // the row names: not an edit, so it is retired as an untouched copy
+            // is, on the move's run or any later one.
+            if (path.startsWith(`${MCP_SRC}/`) && PRIOR_MCP_TEMPLATE_HASHES.has(diskHash)) {
+                deletes.push(path);
+                delete nextFiles[path];
+                removed.push(path);
+                continue;
+            }
             review.push({ path, reason: `edited here, removed from the template in ${version}` });
             continue;
         }
@@ -421,17 +1043,38 @@ export async function updateSite(opts) {
         }
     }
     // ── Every recordable path the running template has that this record does not (D4) ──
+    // A path the API move retires (#9566) reads as absent: the old in-app
+    // module object at a boot-set path goes before the writes below, and the
+    // template's re-export lands there as an added file.
+    const retired = new Set(apiMove?.deletes ?? []);
     const knownPaths = new Set([...Object.keys(record.files), ...(knownSnapshotPaths ?? [])]);
     for (const path of [...newMap.keys()].sort()) {
         if (Object.prototype.hasOwnProperty.call(record.files, path))
             continue;
+        // The guard runs before the disk check, so a full-copy site's boot path
+        // reads as guarded, never as "exists, not in the record" (#9569 DD8).
+        if (bootFileGuarded(path)) {
+            skipped.push({ path, reason: DATABASE_PACKAGE_GUARD });
+            continue;
+        }
         const abs = join(targetDir, ...path.split("/"));
         const newBytes = newMap.get(path);
-        if (existsSync(abs)) {
+        if (existsSync(abs) && !retired.has(path)) {
             const diskBytes = readFileSync(abs);
-            if (sha256Hex(diskBytes) !== sha256Hex(newBytes)) {
+            const newHash = sha256Hex(newBytes);
+            if (sha256Hex(diskBytes) !== newHash) {
                 skipped.push({ path, reason: "exists, not in the record" });
             }
+            else if (DATABASE_BOOT_FILES.includes(path) || ROOT_TOOL_FILES.includes(path)) {
+                // Adoption (#9569 DD8): a thin site converted by hand, or scaffolded
+                // before the boot files were recorded, gains the row for a copy that
+                // already equals the running template's — and so (#9654) does a root
+                // tools/ file a site scaffolded before tools/ was recorded, or copied
+                // by hand. App paths keep today's behaviour: an unrecorded, identical
+                // copy stays unrecorded.
+                nextFiles[path] = { sha256: newHash, version };
+                current.push(path);
+            }
             continue;
         }
         if (outOfScope(path))
@@ -493,6 +1136,12 @@ export async function updateSite(opts) {
         .sort(([a], [b]) => a.localeCompare(b))
         .map(([file, tests]) => ({ file, tests }));
     // ── Apply: writes and removals, then the record (D4 Order) ───────────
+    // #9566 — the API move's removals first: a retired file at a boot-set
+    // path is overwritten by the write that follows, never deleted after it.
+    for (const path of apiMove?.deletes ?? []) {
+        rmSync(join(targetDir, ...path.split("/")));
+        removed.push(path);
+    }
     for (const write of writes.filter((w) => notHeld(w.path))) {
         const abs = join(targetDir, ...write.path.split("/"));
         mkdirSync(dirname(abs), { recursive: true });
@@ -524,6 +1173,34 @@ export async function updateSite(opts) {
         moved.added.push(MODULE_FLAGS_PATH);
     else if (flags === "updated")
         moved.updated.push(MODULE_FLAGS_PATH);
+    // #9567 — the MCP move's writes, then the paid MCP tool registry from the
+    // site's own apps/mcp/package.json on every run (REGENERATED_APP_PATHS,
+    // #9460 DD6) — after the move, so a pack the move declared is a row.
+    if (mcpMove !== undefined) {
+        writeFileSync(mcpPkgPath, mcpMove.packageJson);
+        moved.updated.push(MCP_PACKAGE_JSON);
+        if (mcpMove.seam !== undefined) {
+            writeFileSync(join(targetDir, ...MCP_SEAM_PATH.split("/")), mcpMove.seam);
+            moved.updated.push(MCP_SEAM_PATH);
+        }
+        for (const path of mcpMove.deletes) {
+            rmSync(join(targetDir, ...path.split("/")));
+            moved.removed.push(path);
+        }
+        pruneEmptyDirs(join(targetDir, ...MCP_SRC.split("/")));
+    }
+    const registry = writePaidMcpTools(targetDir);
+    if (registry === "added")
+        moved.added.push(PAID_MCP_TOOLS_PATH);
+    else if (registry === "updated")
+        moved.updated.push(PAID_MCP_TOOLS_PATH);
+    // #9566 — the API move's package.json, then the directories its removals
+    // (applied above, before the writes) left empty.
+    if (apiMove !== undefined) {
+        writeFileSync(apiPkgPath, apiMove.packageJson);
+        moved.updated.push(API_PACKAGE_JSON);
+        pruneEmptyDirs(join(targetDir, ...API_SRC.split("/")));
+    }
     return {
         targetDir,
         version,
@@ -576,6 +1253,13 @@ export function formatUpdateReport(result) {
     if (nothingHappened) {
         return `[create-ailk] Already up to date (create-ailk ${result.version}).\n`;
     }
+    // #9567 / #9566 — the MCP and API moves add dependencies (the mcp README
+    // § Move, step 7, names the install; the API half says the same).
+    for (const pkgJson of [MCP_PACKAGE_JSON, API_PACKAGE_JSON]) {
+        if (result.updated.includes(pkgJson)) {
+            lines.push(`${pkgJson} gained dependencies: run \`pnpm install\`.`);
+        }
+    }
     return lines.join("\n") + "\n";
 }
 export const UPDATE_HELP = `create-ailk update — bring template fixes into a site's copied app code.
@@ -591,17 +1275,27 @@ Options:
 
 Reads .ailk-template-files.json (written beside .ailk-site-manifest.json by
 every template scaffold) to tell an untouched copy from an edit. An
-untouched apps/web, apps/api or apps/mcp file whose template copy changed is
-overwritten. An edited file whose template copy also changed is three-way
-merged with \`git\` (git must be on PATH); a conflict leaves the file alone
-and is listed under "Needs review". Every template test that imports a file
+untouched apps/web, apps/api or apps/mcp file, or a root tools/jest file the
+app jest configs require, whose template copy changed is overwritten. An
+edited file whose template copy also changed is three-way merged with
+\`git\` (git must be on PATH); a conflict leaves the file alone and is
+listed under "Needs review". Every template test that imports a file
 left under "Needs review" or "Skipped" (by a relative import) is held at the
 site's version with it, its record entry is not advanced, and it is listed
 under "Held back with <file>" — reconcile the file, then run update again to
 bring its tests forward. Every other file in the run still updates.
 A site with no record gets one on its first run, from the version its
-.ailk-site-manifest.json already records. Commit before running, and review
-the diff after.
+.ailk-site-manifest.json already records. A site scaffolded before
+@working-theory/mcp-server has its copied apps/mcp moved to the boot set:
+the server and each module's paid MCP pack join apps/mcp/package.json, the
+copied server files go, and apps/mcp/src/lib/paid-tools.generated.ts is
+rewritten on every run. A site scaffolded before @working-theory/api has its
+copied apps/api moved to the boot file: the app becomes @working-theory/app-api,
+the package and the six @working-theory/api-<module> packages join
+apps/api/package.json, its bins and build:vercel delegate to the package, and
+the copied server files go. Run \`pnpm install\` after either move, since the
+app's package.json gained dependencies. Commit before running, and review the
+diff after.
 `;
 /** Parse the argv AFTER the `update` word. Strict `node:util` parseArgs, like `parseAdoptArgs`. */
 export function parseUpdateArgs(argv) {