create-ailk 0.4.0 → 0.6.0

package/templates/apps/mcp/__tests__/tools/purchase.test.ts

@@ -1,53 +1,99 @@
 /**
- * Tests for the ailkPurchase MCP tool (Phase 3 U2: live implementation).
+ * Tests for the ailkPurchase MCP tool.
+ *
+ * Rewritten for #6001: three security reviews on PR #5991 flagged that an
+ * anonymous MCP caller could forward its own successUrl/cancelUrl/
+ * allowPromotionCodes to `checkout.createSession` — a phishing-amplification
+ * open redirect off the seller's real checkout — so the tool is now gated by
+ * `purchaseMcpInputSchema`, a `.strict()` `.pick()` of the shared
+ * `purchaseInputSchema` exposing exactly `productCode` + `quantity`. A call
+ * carrying any of the three excluded fields now FAILS validation rather than
+ * having them silently stripped, and both redirects are ALWAYS derived from
+ * `AILK_BASE_URL`.
+ *
+ * `purchaseInputSchema` itself is unchanged (#5971 shape, still shared with
+ * the Server Action / API route, which are not anonymous surfaces) — its own
+ * schema tests below stay as coverage of the SHARED schema, distinct from
+ * `purchaseMcpInputSchema`'s tests, which cover the tool's OWN gate.
+ *
+ * `__tests__/start_purchase.test.ts` owns the parity proof and the
+ * hosted-URL/unknown-offering behaviour; this suite keeps the schema coverage
+ * and the architectural guard alongside it.
  *
  * Acceptance criteria verified here:
- * - purchaseInputSchema validates correct inputs
- * - purchaseInputSchema rejects invalid inputs
- * - purchaseOutputSchema validates { url: string } live shape
- * - ailkPurchase handler calls POST /v1/checkout/sessions
- * - ailkPurchase returns { url: string } on success
- * - ailkPurchase returns Zod errors on invalid input
+ * - purchaseInputSchema (the shared schema) accepts/rejects per the route's
+ *   own validation — unchanged coverage, since the schema itself is
+ *   byte-unchanged (#6001 AC3)
+ * - purchaseMcpInputSchema (the tool's own gate) accepts exactly
+ *   productCode + quantity and REJECTS successUrl/cancelUrl/
+ *   allowPromotionCodes outright (#6001 AC1)
+ * - purchaseOutputSchema validates the { url: string } live shape
+ * - ailkPurchase calls POST /v1/checkout/sessions through the api-client seam
+ * - ailkPurchase always derives successUrl/cancelUrl from AILK_BASE_URL, with
+ *   and without the env var set, and never forwards allowPromotionCodes
+ *   (#6001 AC2)
+ * - ailkPurchase returns { url } on success, a typed body on bad input
  * - No Stripe SDK import in apps/mcp (architectural guard)
- * - Parity: response shape matches purchaseAction Server Action shape
  */
 
-import { ailkPurchase } from "../../src/tools/purchase.js";
+import { checkout } from "@working-theory/api-client";
 import {
   purchaseInputSchema as PurchaseInputSchema,
+  purchaseMcpInputSchema as PurchaseMcpInputSchema,
   purchaseOutputSchema as PurchaseOutputSchema,
 } from "@working-theory/validation";
 
-// ── fetch mock ────────────────────────────────────────────────────────────────
+import {
+  __setMcpCommerceClaimForTest,
+  resetMcpCommerceClaim,
+} from "../../src/lib/commerce-claim.js";
+import { ailkPurchase } from "../../src/tools/purchase.js";
+
+jest.mock("@working-theory/api-client", () => ({
+  checkout: { createSession: jest.fn() },
+}));
+
+const createSession = checkout.createSession as jest.MockedFunction<
+  typeof checkout.createSession
+>;
 
-const mockFetch = jest.fn();
-global.fetch = mockFetch;
+function sessionCreated(url: string) {
+  return { ok: true as const, body: { sessionId: "cs_test_id", url } };
+}
+
+beforeEach(() => {
+  // Every direct `ailkPurchase` call below bypasses registration, so gate 2
+  // would answer the module-disabled body under the fail-closed default.
+  __setMcpCommerceClaimForTest("claimed");
+});
 
 afterEach(() => {
   jest.clearAllMocks();
+  resetMcpCommerceClaim();
+  delete process.env.AILK_BASE_URL;
 });
 
-// ── Input schema ──────────────────────────────────────────────────────────────
+// ── Shared input schema (purchaseInputSchema — byte-unchanged, #6001 AC3) ──────
 
-describe("PurchaseInputSchema", () => {
-  it("accepts valid input with priceId and quantity", () => {
+describe("PurchaseInputSchema — the shared schema (Server Action / API route)", () => {
+  it("accepts valid input with productCode and quantity", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_test_123",
+      productCode: "price_test_123",
       quantity: 1,
     });
     expect(result.success).toBe(true);
   });
 
-  it("accepts valid input with priceId only (quantity defaults)", () => {
+  it("accepts valid input with productCode only (quantity defaults)", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_test_abc",
+      productCode: "price_test_abc",
     });
     expect(result.success).toBe(true);
   });
 
   it("accepts valid input with successUrl and cancelUrl", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_test_123",
+      productCode: "price_test_123",
       successUrl: "https://example.com/success",
       cancelUrl: "https://example.com/cancel",
     });
@@ -56,7 +102,7 @@ describe("PurchaseInputSchema", () => {
 
   it("accepts an optional allowPromotionCodes boolean", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_test_123",
+      productCode: "price_test_123",
       allowPromotionCodes: true,
     });
     expect(result.success).toBe(true);
@@ -64,25 +110,39 @@ describe("PurchaseInputSchema", () => {
 
   it("rejects a non-boolean allowPromotionCodes", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_test_123",
+      productCode: "price_test_123",
       allowPromotionCodes: "yes",
     });
     expect(result.success).toBe(false);
   });
 
-  it("rejects input missing priceId", () => {
+  it("rejects input missing productCode", () => {
     const result = PurchaseInputSchema.safeParse({ quantity: 1 });
     expect(result.success).toBe(false);
   });
 
-  it("rejects input with empty priceId", () => {
-    const result = PurchaseInputSchema.safeParse({ priceId: "" });
+  it("rejects input with empty productCode", () => {
+    const result = PurchaseInputSchema.safeParse({ productCode: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a productCode outside the route's character set", () => {
+    const result = PurchaseInputSchema.safeParse({
+      productCode: "has spaces",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a productCode longer than 200 characters", () => {
+    const result = PurchaseInputSchema.safeParse({
+      productCode: "a".repeat(201),
+    });
     expect(result.success).toBe(false);
   });
 
   it("rejects input with non-integer quantity", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_x",
+      productCode: "price_x",
       quantity: 1.5,
     });
     expect(result.success).toBe(false);
@@ -90,11 +150,98 @@ describe("PurchaseInputSchema", () => {
 
   it("rejects input with quantity less than 1", () => {
     const result = PurchaseInputSchema.safeParse({
-      priceId: "price_x",
+      productCode: "price_x",
       quantity: 0,
     });
     expect(result.success).toBe(false);
   });
+
+  it("rejects input with quantity above the route's maximum of 999", () => {
+    const result = PurchaseInputSchema.safeParse({
+      productCode: "price_x",
+      quantity: 1000,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a non-http(s) redirect URL the route would reject", () => {
+    const result = PurchaseInputSchema.safeParse({
+      productCode: "price_x",
+      successUrl: "javascript:alert(1)",
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+// ── MCP-only input schema (purchaseMcpInputSchema — the tool's own gate) ───────
+
+describe("PurchaseMcpInputSchema — the registered tool's OWN gate (#6001)", () => {
+  it("accepts productCode and quantity", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+      quantity: 2,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts productCode alone (quantity optional)", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects a call carrying successUrl", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+      successUrl: "https://example.com/success",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a call carrying cancelUrl", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+      cancelUrl: "https://example.com/cancel",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a call carrying allowPromotionCodes", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+      allowPromotionCodes: true,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a call carrying all three excluded fields at once", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_test_123",
+      successUrl: "https://attacker.example/phish",
+      cancelUrl: "https://attacker.example/cancel",
+      allowPromotionCodes: true,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("still rejects missing/invalid productCode, same as the shared schema", () => {
+    expect(PurchaseMcpInputSchema.safeParse({}).success).toBe(false);
+    expect(
+      PurchaseMcpInputSchema.safeParse({ productCode: "" }).success,
+    ).toBe(false);
+    expect(
+      PurchaseMcpInputSchema.safeParse({ productCode: "has spaces" }).success,
+    ).toBe(false);
+  });
+
+  it("still rejects a quantity above the route's maximum of 999", () => {
+    const result = PurchaseMcpInputSchema.safeParse({
+      productCode: "price_x",
+      quantity: 1000,
+    });
+    expect(result.success).toBe(false);
+  });
 });
 
 // ── Output schema (live shape) ────────────────────────────────────────────────
@@ -121,79 +268,41 @@ describe("PurchaseOutputSchema", () => {
 // ── ailkPurchase handler ──────────────────────────────────────────────────────
 
 describe("ailkPurchase — valid input", () => {
-  it("calls POST /v1/checkout/sessions with mapped payload", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      status: 201,
-      json: () =>
-        Promise.resolve({
-          sessionId: "cs_test_abc123",
-          url: "https://checkout.stripe.com/pay/cs_test_abc123",
-        }),
-    });
+  it("calls POST /v1/checkout/sessions with the mapped payload", async () => {
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_abc123"),
+    );
 
     await ailkPurchase({
-      priceId: "price_test_123",
+      productCode: "price_test_123",
       quantity: 1,
-      successUrl: "https://example.com/success",
-      cancelUrl: "https://example.com/cancel",
-    });
-
-    expect(mockFetch).toHaveBeenCalledTimes(1);
-    const [url, opts] = mockFetch.mock.calls[0] as [string, RequestInit];
-    expect(url).toMatch(/\/v1\/checkout\/sessions$/);
-    expect(opts.method).toBe("POST");
-    const body = JSON.parse(opts.body as string) as Record<string, unknown>;
-    expect(body.productCode).toBe("price_test_123");
-    expect(body.quantity).toBe(1);
-  });
-
-  it("forwards allowPromotionCodes when supplied, omits it otherwise", async () => {
-    const okResponse = () => ({
-      ok: true,
-      status: 201,
-      json: () =>
-        Promise.resolve({
-          sessionId: "cs_test_promo",
-          url: "https://checkout.stripe.com/pay/cs_test_promo",
-        }),
     });
-    mockFetch.mockResolvedValueOnce(okResponse());
 
-    await ailkPurchase({
-      priceId: "price_test_123",
-      allowPromotionCodes: true,
-    });
+    expect(createSession).toHaveBeenCalledTimes(1);
+    const payload = createSession.mock.calls[0]![0];
+    expect(payload.productCode).toBe("price_test_123");
+    expect(payload.quantity).toBe(1);
+  });
 
-    const withFlag = JSON.parse(
-      (mockFetch.mock.calls[0] as [string, RequestInit])[1].body as string,
-    ) as Record<string, unknown>;
-    expect(withFlag.allowPromotionCodes).toBe(true);
+  it("never forwards allowPromotionCodes — it is not part of the tool's input", async () => {
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_promo"),
+    );
 
-    mockFetch.mockResolvedValueOnce(okResponse());
-    await ailkPurchase({ priceId: "price_test_123" });
+    await ailkPurchase({ productCode: "price_test_123" });
 
-    const withoutFlag = JSON.parse(
-      (mockFetch.mock.calls[1] as [string, RequestInit])[1].body as string,
-    ) as Record<string, unknown>;
-    expect(withoutFlag).not.toHaveProperty("allowPromotionCodes");
+    expect(createSession.mock.calls[0]![0]).not.toHaveProperty(
+      "allowPromotionCodes",
+    );
   });
 
   it("returns { url } on success", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      status: 201,
-      json: () =>
-        Promise.resolve({
-          sessionId: "cs_test_xyz",
-          url: "https://checkout.stripe.com/pay/cs_test_xyz",
-        }),
-    });
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_xyz"),
+    );
 
     const output = await ailkPurchase({
-      priceId: "price_test_xyz",
-      successUrl: "https://example.com/success",
-      cancelUrl: "https://example.com/cancel",
+      productCode: "price_test_xyz",
     });
 
     expect(output).toEqual({
@@ -202,57 +311,125 @@ describe("ailkPurchase — valid input", () => {
   });
 
   it("output validates against PurchaseOutputSchema", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      status: 201,
-      json: () =>
-        Promise.resolve({
-          sessionId: "cs_test_valid",
-          url: "https://checkout.stripe.com/pay/cs_test_valid",
-        }),
-    });
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_valid"),
+    );
 
-    const output = await ailkPurchase({ priceId: "price_test_valid" });
-    const result = PurchaseOutputSchema.safeParse(output);
-    expect(result.success).toBe(true);
+    const output = await ailkPurchase({ productCode: "price_test_valid" });
+    expect(PurchaseOutputSchema.safeParse(output).success).toBe(true);
   });
 });
 
-describe("ailkPurchase — invalid input (Zod errors)", () => {
-  it("throws ZodError for missing priceId before any fetch", async () => {
-    await expect(
-      ailkPurchase({ quantity: 1 } as never),
-    ).rejects.toThrow();
-    expect(mockFetch).not.toHaveBeenCalled();
+describe("ailkPurchase — invalid input (typed error body, no side effect)", () => {
+  it("returns validation_failed for a missing productCode before any call", async () => {
+    const result = await ailkPurchase({ quantity: 1 } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
   });
 
-  it("throws ZodError for empty priceId before any fetch", async () => {
-    await expect(
-      ailkPurchase({ priceId: "" }),
-    ).rejects.toThrow();
-    expect(mockFetch).not.toHaveBeenCalled();
+  it("returns validation_failed for an empty productCode before any call", async () => {
+    const result = await ailkPurchase({ productCode: "" });
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("returns validation_failed for a call carrying successUrl (#6001 AC1)", async () => {
+    const result = await ailkPurchase({
+      productCode: "price_test_123",
+      successUrl: "https://attacker.example/phish",
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("returns validation_failed for a call carrying cancelUrl (#6001 AC1)", async () => {
+    const result = await ailkPurchase({
+      productCode: "price_test_123",
+      cancelUrl: "https://attacker.example/cancel",
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("returns validation_failed for a call carrying allowPromotionCodes (#6001 AC1)", async () => {
+    const result = await ailkPurchase({
+      productCode: "price_test_123",
+      allowPromotionCodes: true,
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
   });
 });
 
-describe("ailkPurchase — parity shape with purchaseAction", () => {
-  it("success shape is { url: string } matching Server Action shape", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      status: 201,
-      json: () =>
-        Promise.resolve({
-          sessionId: "cs_test_parity",
-          url: "https://checkout.stripe.com/pay/cs_test_parity",
-        }),
+describe("ailkPurchase — always derives redirects from AILK_BASE_URL (#6001 AC2)", () => {
+  it("derives both redirect URLs from AILK_BASE_URL when it is set", async () => {
+    process.env.AILK_BASE_URL = "https://example.com";
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_base"),
+    );
+
+    await ailkPurchase({ productCode: "price_test_123" });
+
+    expect(createSession).toHaveBeenCalledWith({
+      productCode: "price_test_123",
+      successUrl:
+        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "https://example.com/purchase/cancel",
     });
+  });
+
+  it("falls back to the tool's existing default when AILK_BASE_URL is unset", async () => {
+    delete process.env.AILK_BASE_URL;
+    delete process.env.NEXT_PUBLIC_BASE_URL;
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_fallback"),
+    );
+
+    await ailkPurchase({ productCode: "price_test_123" });
+
+    expect(createSession).toHaveBeenCalledWith({
+      productCode: "price_test_123",
+      successUrl:
+        "http://localhost:3000/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "http://localhost:3000/purchase/cancel",
+    });
+  });
+
+  // #6084 AC-6/D1 — the literal template token survives, and cancelUrl
+  // carries no session parameter at all.
+  it("successUrl carries the literal {CHECKOUT_SESSION_ID} token; cancelUrl carries no session parameter (#6084 D1)", async () => {
+    process.env.AILK_BASE_URL = "https://example.com";
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_braces"),
+    );
+
+    await ailkPurchase({ productCode: "price_test_123" });
+
+    const payload = createSession.mock.calls[0]![0] as {
+      successUrl: string;
+      cancelUrl: string;
+    };
+    expect(payload.successUrl).toContain("{CHECKOUT_SESSION_ID}");
+    expect(payload.cancelUrl).not.toContain("session_id");
+    expect(payload.cancelUrl).not.toContain("{CHECKOUT_SESSION_ID}");
+  });
+});
+
+describe("ailkPurchase — parity shape with purchaseAction", () => {
+  it("success shape is { url: string } matching the Server Action shape", async () => {
+    createSession.mockResolvedValueOnce(
+      sessionCreated("https://checkout.stripe.com/pay/cs_test_parity"),
+    );
 
     const output = await ailkPurchase({
-      priceId: "price_parity",
-      successUrl: "https://example.com/success",
-      cancelUrl: "https://example.com/cancel",
+      productCode: "price_parity",
     });
 
-    // Shape must match purchaseAction's success shape
     expect(output).toHaveProperty("url");
     expect(typeof (output as { url: string }).url).toBe("string");
   });

package/templates/apps/mcp/eslint.config.mjs

@@ -0,0 +1,69 @@
+// Self-contained ESLint flat config for this scaffolded package.
+//
+// It deliberately does NOT depend on @working-theory/eslint-config — that
+// package is internal to the AI Launch Kit monorepo and is not published, so
+// it cannot be a dependency of a scaffolded starter. Everything below comes
+// from public npm packages already pinned as devDependencies (see
+// package.json): @eslint/js, globals and typescript-eslint.
+//
+// Source file name (#5556): this file is checked in as `_eslint.config.mjs`,
+// not `eslint.config.mjs` — build-templates.mjs renames it at snapshot time
+// (renameScaffoldLintConfigs()). A file literally named `eslint.config.mjs`
+// anywhere under this monorepo (even one this repo's own root eslint.config.ts
+// lists in its `ignores`) is auto-discovered by ESLint's flat-config nested
+// resolution as a competing config root, which breaks the monorepo's own
+// lint runs (verified live: typescript-eslint's "multiple candidate
+// TSConfigRootDirs" parser error across unrelated packages/create-ailk
+// files). The underscore prefix keeps it invisible to that discovery while
+// it lives in this checkout; only the snapshot in templates/ — which ships
+// to the customer, not this repo — gets the real filename.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: [
+      "**/.next/**",
+      "**/dist/**",
+      "**/generated/**",
+      "**/node_modules/**",
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.browser,
+        ...globals.jest,
+      },
+      // Explicit, self-contained root — this scaffold config is never meant
+      // to combine with any sibling scaffold package's config (each ships
+      // standalone), and leaving it unset makes typescript-eslint's
+      // candidate-root disambiguation ambiguous the moment more than one
+      // scaffold package's config resolves in the same ESLint process (e.g.
+      // this monorepo's own `templates/` build, where all four exist
+      // side by side; a real customer scaffold never has that problem,
+      // since it only ever ships and lints ONE of these four at a time).
+      parserOptions: {
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      // Downgraded rather than off, so both stay visible without failing a
+      // fresh scaffold's lint:
+      //   - unused-vars: most of the source follows the underscore-prefix
+      //     convention for intentionally-unused bindings, which this rule's
+      //     default options don't recognize; a handful of test fixtures also
+      //     carry genuinely-unused locals this minimal config doesn't try to
+      //     triage file-by-file.
+      //   - require-imports: CommonJS require() is the correct form in Jest
+      //     config/mock files and in a few test-only dynamic re-require
+      //     patterns.
+      "@typescript-eslint/no-unused-vars": "warn",
+      "@typescript-eslint/no-require-imports": "warn",
+    },
+  },
+);

package/templates/apps/mcp/jest.config.cjs

@@ -22,6 +22,17 @@ module.exports = {
     '^@working-theory/aeo/(.*)$': '<rootDir>/../../packages/aeo/src/$1',
     '^@working-theory/content-adapters$': '<rootDir>/../../packages/content-adapters/src/index.ts',
     '^@working-theory/content-adapters/(.*)$': '<rootDir>/../../packages/content-adapters/src/$1',
+    // The constants + one-workspace predicate subpath only (#5876 spec D11) —
+    // no @prisma/client import, so ts-jest compiles it directly like every
+    // other workspace mapping below. The database/dist/ build is empty in a
+    // fresh checkout, and the published dist is ESM, which Jest's CJS preset
+    // can't load. The CLIENT root (`@working-theory/database`) stays
+    // deliberately UNMAPPED — see apps/mcp/src/lib/prisma.ts.
+    '^@working-theory/database/tenancy$': '<rootDir>/../../database/tenancy.ts',
+    // tenancy.ts's isSentinel import (above) is a VALUE import, so every
+    // suite that loads the tenancy subpath transitively loads this one too
+    // — mirrors apps/api/jest.config.cjs's identical mapping.
+    '^@working-theory/ids$': '<rootDir>/../../packages/ids/src/index.ts',
     '^@working-theory/license$': '<rootDir>/../../packages/license/src/index.ts',
     '^@working-theory/metadata$': '<rootDir>/../../packages/metadata/src/index.ts',
     '^@working-theory/schema$': '<rootDir>/../../packages/schema/src/index.ts',
@@ -61,6 +72,8 @@ module.exports = {
             '@working-theory/api-client': ['../../packages/api-client/src/index.ts'],
             '@working-theory/content-adapters': ['../../packages/content-adapters/src/index.ts'],
             '@working-theory/content-adapters/*': ['../../packages/content-adapters/src/*'],
+            '@working-theory/database/tenancy': ['../../database/tenancy.ts'],
+            '@working-theory/ids': ['../../packages/ids/src/index.ts'],
             '@working-theory/license': ['../../packages/license/src/index.ts'],
             '@working-theory/metadata': ['../../packages/metadata/src/index.ts'],
             '@working-theory/schema': ['../../packages/schema/src/index.ts'],

package/templates/apps/mcp/package.json

@@ -6,7 +6,7 @@
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
-    "lint": "tsx ../../scripts/lint-package.ts",
+    "lint": "eslint .",
     "build": "tsc -b",
     "type-check": "tsc --noEmit",
     "dev": "node --experimental-vm-modules dist/index.js",
@@ -18,9 +18,11 @@
     "@fastify/cors": "^11.2.0",
     "@fastify/rate-limit": "^10.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@prisma/adapter-pg": "^7.8.0",
     "@working-theory/aeo": "workspace:*",
     "@working-theory/api-client": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
+    "@working-theory/database": "workspace:*",
     "@working-theory/license": "workspace:*",
     "@working-theory/metadata": "workspace:*",
     "@working-theory/schema": "workspace:*",
@@ -34,6 +36,10 @@
     "@types/node": "^22.20.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "eslint": "^10.6.0",
+    "@eslint/js": "^10.0.1",
+    "globals": "^17.7.0",
+    "typescript-eslint": "^8.62.1"
   }
 }