create-ailk 0.6.1 → 0.8.0

package/templates/apps/api/src/services/lead-routing.ts

@@ -2,7 +2,12 @@
  * @file lead-routing.ts
  * @description Cross-namespace lead orchestration service (ADR 0009 D3).
  *
- * Pipeline: validate → enrich → persist (DB with file fallback) → email.
+ * Pipeline: validate → delivery guard → enrich → persist (DB with file
+ * fallback) → email. Where a lead may go is `resolveLeadDelivery()`
+ * (`lib/lead-delivery.ts`, #6730 D1): with no database but the email vars set,
+ * the owner email IS the delivery; in production with neither, nothing is
+ * accepted. A lead is reported sent only for a durable row or an email the
+ * provider accepted — never for the non-durable file fallback in production.
  * This is the first implementation of ADR 0009 D3's service-layer pattern.
  * Future cross-namespace orchestrators in apps/api/src/services/ should mirror
  * this shape: type-result returns, mocked-dep tests, non-transactional secondary
@@ -32,6 +37,7 @@ import { leadInputSchema } from "@working-theory/validation";
 
 import { writeLeadFallback } from "../lib/file-fallback.js";
 import { appendLeadRecord } from "../lib/lead-capture-store.js";
+import { acceptsKind, resolveLeadDelivery } from "../lib/lead-delivery.js";
 import { prisma } from "../lib/prisma.js";
 
 import { enrichLead } from "./enrichment-shim.js";
@@ -65,11 +71,14 @@ export type SourceMeta = {
   receivedAt: string; // ISO
 };
 
+/** Where the lead landed: a database row, the local file fallback, or the owner's inbox by email (#6730). */
+export type Persisted = "db" | "file" | "email";
+
 export type RouteLeadResult =
   | {
       ok: true;
       id: string;
-      persisted: "db" | "file";
+      persisted: Persisted;
       email:
         | { ok: true; messageId: string }
         | { ok: false; error: string }
@@ -78,7 +87,11 @@ export type RouteLeadResult =
   | {
       ok: false;
       error: {
-        kind: "invalid_input" | "persist_failed" | "config_missing";
+        kind:
+          | "invalid_input"
+          | "persist_failed"
+          | "config_missing"
+          | "delivery_failed";
         message: string;
       };
     };
@@ -272,7 +285,7 @@ type EmailResult =
 async function sendEmail(
   input: RouteLeadInput,
   id: string,
-  persisted: "db" | "file",
+  persisted: Persisted,
 ): Promise<EmailResult> {
   // Request-and-confirm SUPERSEDES this notification for a callback (#5970
   // D6). AC-1 requires the tenant to receive exactly one email, and the
@@ -316,7 +329,22 @@ async function sendEmail(
     siteId: input.siteId,
     source: input.kind === "callback" ? "callback" : input.source,
     email: input.kind === "callback" ? "" : input.email,
-    payload: input.kind === "subscribe" ? {} : input.payload,
+    // A callback's contact details are top-level fields, not payload keys
+    // (#6730): with no database the email is the only record of the
+    // request, so it must carry the name and number to call back.
+    payload:
+      input.kind === "subscribe"
+        ? {}
+        : input.kind === "callback"
+          ? {
+              ...input.payload,
+              name: input.name,
+              phone: input.phone,
+              ...(input.preferredTime !== undefined && {
+                preferredTime: input.preferredTime,
+              }),
+            }
+          : input.payload,
     createdAt: new Date().toISOString(),
   };
 
@@ -324,6 +352,9 @@ async function sendEmail(
     lead: leadForEmail,
     recipientEmail: to,
     fromAddress: from,
+    // A callback has no visitor address to reply to; an empty Reply-To is
+    // not a valid header, so reply to the owner instead.
+    ...(input.kind === "callback" && { replyToOverride: to }),
   });
 
   if (emailResult.ok) {
@@ -337,6 +368,47 @@ async function sendEmail(
   return { ok: false, error: `${kind}: ${message}` };
 }
 
+// ─── Email delivery (#6730 D2) ────────────────────────────────────────────────
+
+type EmailDelivery =
+  | { ok: true; id: string; email: { ok: true; messageId: string } }
+  | { ok: false; message: string };
+
+/**
+ * Deliver a lead as the owner email alone — success only when the provider
+ * accepted it. The id matches the file-fallback id format
+ * (`/^[a-z0-9_-]{8,64}$/i`).
+ */
+async function deliverByEmail(input: RouteLeadInput): Promise<EmailDelivery> {
+  const id = `email-${Date.now()}-${randomUUID().slice(0, 8)}`;
+  const result = await sendEmail(input, id, "email");
+  if ("ok" in result && result.ok) return { ok: true, id, email: result };
+  return {
+    ok: false,
+    message: "error" in result ? result.error : `email skipped: ${result.reason}`,
+  };
+}
+
+// ─── Lead-capture record ─────────────────────────────────────────────────────
+
+function captureRecordFor(input: RouteLeadInput, id: string, sourceMeta: SourceMeta) {
+  return {
+    id,
+    createdAt: sourceMeta.receivedAt,
+    source: input.kind === "callback" ? "callback" : input.source,
+    data:
+      input.kind === "callback"
+        ? { name: input.name, phone: input.phone, ...(input.payload ?? {}) }
+        : input.kind === "subscribe"
+          ? { email: input.email }
+          : { email: input.email, ...(input.payload ?? {}) },
+    metadata: {
+      ip: sourceMeta.ip,
+      userAgent: sourceMeta.userAgent,
+    },
+  };
+}
+
 // ─── Main export ──────────────────────────────────────────────────────────────
 
 export async function routeLead(
@@ -352,13 +424,13 @@ export async function routeLead(
     };
   }
 
-  // 2. Guard: if file capture is disabled AND no DB is configured, bail early.
-  // Both paths are unavailable — returning a clear error is better than a
-  // misleading 201 or a stack trace from Prisma on a missing DATABASE_URL.
-  if (
-    process.env.LEAD_CAPTURE_FILE_DISABLED === "true" &&
-    !process.env.DATABASE_URL
-  ) {
+  // 2. Guard: where can this lead go (#6730 D1)? A kind the configured
+  // delivery cannot take — anything in production with neither a database
+  // nor the email vars, a newsletter signup with no database — is refused
+  // before any write, so no visitor is told a message was sent when it
+  // reached nobody.
+  const delivery = resolveLeadDelivery();
+  if (!acceptsKind(delivery, input.kind)) {
     return {
       ok: false,
       error: {
@@ -374,9 +446,28 @@ export async function routeLead(
   // the real enrichment call with proper type alignment.
   await enrichLead(input as unknown as Parameters<typeof enrichLead>[0]);
 
+  // Email delivery — no database: the owner email is the delivery, so skip
+  // the DB and the (non-durable) file fallback entirely.
+  if (delivery === "email") {
+    const emailed = await deliverByEmail(input);
+    if (!emailed.ok) {
+      return {
+        ok: false,
+        error: { kind: "delivery_failed", message: emailed.message },
+      };
+    }
+    await appendLeadRecord(captureRecordFor(input, emailed.id, sourceMeta));
+    return {
+      ok: true,
+      id: emailed.id,
+      persisted: "email",
+      email: emailed.email,
+    };
+  }
+
   // 4. Persist primary (DB), fallback to file on error
   let id: string;
-  let persisted: "db" | "file";
+  let persisted: Persisted;
   let skipEmail = false;
   let skipReason: string | undefined;
 
@@ -424,7 +515,41 @@ export async function routeLead(
       };
     }
 
-    // 5. File fallback
+    // In production the file fallback is not durable (a serverless instance
+    // does not outlive the request), so reporting it as success would lose
+    // the lead silently. Deliver by email when that is configured; otherwise
+    // fail loudly (#6730 D2). A newsletter signup is never emailed — one
+    // owner email per address is not a list (`acceptsKind`).
+    if (process.env.NODE_ENV === "production") {
+      const dbMsg = dbErr instanceof Error ? dbErr.message : String(dbErr);
+      if (input.kind === "subscribe") {
+        return {
+          ok: false,
+          error: { kind: "persist_failed", message: `db: ${dbMsg}` },
+        };
+      }
+      const emailed = await deliverByEmail(input);
+      if (!emailed.ok) {
+        return {
+          ok: false,
+          error: {
+            kind: "persist_failed",
+            // Not the provider's text: it can echo an address, and this
+            // message is logged (spec D5).
+            message: `db: ${dbMsg}; email delivery failed`,
+          },
+        };
+      }
+      await appendLeadRecord(captureRecordFor(input, emailed.id, sourceMeta));
+      return {
+        ok: true,
+        id: emailed.id,
+        persisted: "email",
+        email: emailed.email,
+      };
+    }
+
+    // 5. File fallback (outside production only)
     // Include a UUID suffix so concurrent fallbacks produce unique IDs even
     // within the same millisecond. Format still matches /^[a-z0-9_-]{8,64}$/i.
     const fallbackLead = {
@@ -468,22 +593,7 @@ export async function routeLead(
   // 6. Write to lead-capture JSONL (always-on canonical AX surface).
   // Best-effort — a write failure does NOT roll back persistence or block email.
   // The file is the agent-readable surface; DB is the transactional record.
-  const captureRecord = {
-    id: id!,
-    createdAt: sourceMeta.receivedAt,
-    source: input.kind === "callback" ? "callback" : input.source,
-    data:
-      input.kind === "callback"
-        ? { name: input.name, phone: input.phone, ...(input.payload ?? {}) }
-        : input.kind === "subscribe"
-          ? { email: input.email }
-          : { email: input.email, ...(input.payload ?? {}) },
-    metadata: {
-      ip: sourceMeta.ip,
-      userAgent: sourceMeta.userAgent,
-    },
-  };
-  await appendLeadRecord(captureRecord);
+  await appendLeadRecord(captureRecordFor(input, id!, sourceMeta));
 
   // 7. Email notification (best-effort — never rolls back persistence)
   let emailResult: EmailResult;

package/templates/apps/api/src/services/leads-inbox.ts

@@ -25,10 +25,14 @@
  *
  * Two preconditions, neither of which this file can assert:
  *
- *   1. `resolveOwnerWorkspaces` must yield a workspace. On a build with no
- *      `multi-tenant` module it yields none — see its own header, and #5677,
- *      which made that a deliberate scope limit rather than a statement that
- *      there is nothing to resolve.
+ *   1. The caller's scope must resolve to a workspace. With the
+ *      `multi-tenant` module that is `resolveOwnerWorkspaces`. Without it
+ *      (#6730 D7) — Free and Pro — that resolver yields none by design (its
+ *      own header, #5677), so the scope is instead the default workspace,
+ *      granted ONLY through `resolveDefaultTenantForOperator`
+ *      (`default-tenant.ts`): `AILK_OPERATOR_EMAIL` set, the caller's
+ *      VERIFIED email equal to it, and the deployment unambiguously
+ *      one-workspace. Any other caller gets the empty page, never a wider one.
  *   2. The `siteId` the leads were WRITTEN under must equal a workspace id,
  *      and there are TWO independent sources of it — both must agree with the
  *      workspace, and neither is `currentSiteId()` on the primary path:
@@ -67,8 +71,10 @@
 import type { Prisma } from "@working-theory/database";
 import type { Id } from "@working-theory/ids";
 
+import { isModuleEnabled } from "../config/modules.js";
 import { prisma } from "../lib/prisma.js";
 
+import { resolveDefaultTenantForOperator } from "./default-tenant.js";
 import { resolveOwnerWorkspaces } from "./owner-workspaces.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
@@ -178,6 +184,40 @@ export function readName(payload: Prisma.JsonValue): string | null {
   return typeof name === "string" ? name.slice(0, MAX_NAME_LENGTH) : null;
 }
 
+// ─── Scope ────────────────────────────────────────────────────────────────────
+
+/**
+ * The workspace ids whose leads the caller may read. With `multi-tenant`,
+ * every workspace they own or administer (`resolveOwnerWorkspaces`,
+ * unchanged). Without it (#6730 D7), the default workspace — only for the
+ * pinned, verified operator on a one-workspace deployment; `null` from the
+ * resolver means no scope at all.
+ */
+async function resolveInboxSiteIds(
+  userId: Id<"user">,
+): Promise<{ ok: true; siteIds: string[] } | { ok: false; message: string }> {
+  if (!isModuleEnabled("multi-tenant")) {
+    try {
+      const tenant = await resolveDefaultTenantForOperator(userId);
+      return {
+        ok: true,
+        siteIds: tenant && LEAD_INBOX_ROLES.has(tenant.role) ? [tenant.workspaceId] : [],
+      };
+    } catch (err) {
+      return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+  }
+
+  const workspaces = await resolveOwnerWorkspaces(userId);
+  if (!workspaces.ok) return { ok: false, message: workspaces.error.message };
+  return {
+    ok: true,
+    siteIds: workspaces.value
+      .filter((workspace) => LEAD_INBOX_ROLES.has(workspace.role))
+      .map((workspace) => workspace.id),
+  };
+}
+
 // ─── Main export ──────────────────────────────────────────────────────────────
 
 /**
@@ -199,17 +239,14 @@ export async function listOwnedLeads(params: {
   cursor?: string | undefined;
   limit: number;
 }): Promise<ListLeadsResult> {
-  const workspaces = await resolveOwnerWorkspaces(params.userId);
-  if (!workspaces.ok) {
+  const scope = await resolveInboxSiteIds(params.userId);
+  if (!scope.ok) {
     return {
       ok: false,
-      error: { kind: "internal_error", message: workspaces.error.message },
+      error: { kind: "internal_error", message: scope.message },
     };
   }
-
-  const siteIds = workspaces.value
-    .filter((workspace) => LEAD_INBOX_ROLES.has(workspace.role))
-    .map((workspace) => workspace.id);
+  const siteIds = scope.siteIds;
 
   // No workspace the caller owns or administers means no lead can match, so
   // there is nothing to query. An empty page is the honest answer — the same

package/templates/apps/mcp/__tests__/audit-single-page.test.ts

@@ -15,9 +15,17 @@
  * - No fetch() call (structural test)
  */
 
-import { readFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve, join } from "node:path";
 
+import {
+  entityMarkup,
+  runAudit,
+  schemaCoverage,
+  type AuditReport,
+} from "@working-theory/aeo";
+
 import { buildSinglePageAuditInput } from "../src/lib/audit-single-page.js";
 
 const REPO_ROOT = resolve(__dirname, "../../..");
@@ -211,3 +219,69 @@ describe("structural guard — no fetch()", () => {
     expect(codeOnly).not.toMatch(/\bfetch\s*\(/);
   });
 });
+
+describe("buildSinglePageAuditInput — sitewide identity (#6597 AC-7)", () => {
+  const evidenceOf = (report: AuditReport, id: string) =>
+    report.perRule.find((r) => r.id === id);
+  const auditOf = async (input: { slug: string; type?: "AboutPage" }, root: string) =>
+    runAudit(await buildSinglePageAuditInput(input, root), [schemaCoverage, entityMarkup]);
+
+  it("schema-coverage passes for the monorepo's AboutPage/about", async () => {
+    const report = await auditOf({ slug: "about", type: "AboutPage" }, CONTENT_ROOT);
+    expect(evidenceOf(report, "schema-coverage")?.pass).toBe(true);
+  });
+
+  it("the monorepo home finds the identity: Identity (organization) ✓", async () => {
+    const report = await auditOf({ slug: "home" }, CONTENT_ROOT);
+    expect(evidenceOf(report, "entity-markup")?.evidence).toContain(
+      "Identity (organization) ✓",
+    );
+  });
+
+  it("stores the flat node array, the page's own primary first", async () => {
+    const input = await buildSinglePageAuditInput({ slug: "about", type: "AboutPage" }, CONTENT_ROOT);
+    const nodes = input.jsonLdByPage["AboutPage/about"] as Array<Record<string, unknown>>;
+    expect(nodes[0]!["@type"]).toBe("AboutPage");
+    expect(nodes.map((n) => n["@type"])).toEqual(
+      expect.arrayContaining(["Organization", "WebSite"]),
+    );
+  });
+
+  describe("a Person site", () => {
+    let root: string;
+    beforeAll(() => {
+      root = mkdtempSync(join(tmpdir(), "mcp-6597-"));
+      writeFileSync(
+        join(root, "_site.mdx"),
+        [
+          "---",
+          'version: "1"',
+          "siteName: Ada",
+          "baseUrl: https://example.com",
+          "defaultLocale: en",
+          "siteIdentity:",
+          "  kind: Person",
+          "  name: Ada Lovelace",
+          "  url: https://example.com",
+          "---",
+          "",
+        ].join("\n"),
+      );
+      mkdirSync(join(root, "en", "HomePage"), { recursive: true });
+      writeFileSync(
+        join(root, "en", "HomePage", "home.mdx"),
+        ["---", "type: HomePage", "slug: home", "title: Ada", "description: Ada's site.", "---", ""].join("\n"),
+      );
+    });
+    afterAll(() => {
+      rmSync(root, { recursive: true, force: true });
+    });
+
+    it("derives person mode from the kind: Identity (person) ✓", async () => {
+      const input = await buildSinglePageAuditInput({ slug: "home" }, root);
+      expect(input.identityMode).toBe("person");
+      const report = runAudit(input, [entityMarkup]);
+      expect(evidenceOf(report, "entity-markup")?.evidence).toContain("Identity (person) ✓");
+    });
+  });
+});

package/templates/apps/mcp/__tests__/lib/audit-single-page-readiness-scan.test.ts

@@ -10,18 +10,18 @@
  *     error, never logged. This is the ordinary "site has nothing of this
  *     type" case every real adapter (MDX, database) takes today.
  *   - a type whose adapter call THROWS is a genuine failure. It must not take
- *     down the audit (the other four reads still complete and their pages
+ *     down the audit (the other two reads still complete and their pages
  *     still count), but it must be visible — logged via `console.error`
  *     (stderr, NOT stdout — the default stdio MCP transport's JSON-RPC
  *     framing channel, #6012 round 2) — rather than silently collapsing into
  *     the same vacuous "nothing found" result.
  *
- * The call-count assertions below prove that all five reads still ran despite
+ * The call-count assertions below prove that all three reads still ran despite
  * the throw — the read AFTER the failing one is not skipped, which a
  * sequential loop that ABORTED on the first throw would fail to show. They
  * are NOT, on their own, proof of CONCURRENCY: the prior sequential `for`
  * loop this replaced used `continue` (not a re-throw), so it too issued all
- * five calls. The `Promise.all` in the source is what delivers the
+ * three calls. The `Promise.all` in the source is what delivers the
  * concurrency AC; these assertions cover the narrower, still load-bearing
  * property that a throw part-way through never truncates the scan.
  */
@@ -93,10 +93,10 @@ describe("scanSitePages — type-not-registered vs adapter-threw (#6012)", () =>
 
     expect(result.readiness!.sitePages).toEqual([]);
     expect(errorSpy).not.toHaveBeenCalled();
-    // All five reads still ran — two listDetail (Product, Service), three
-    // listPages (the three policy types).
+    // All three reads still ran — two listDetail (Product, Service), one
+    // listPages (PurchasePolicyPage, #6646).
     expect(listDetail).toHaveBeenCalledTimes(2);
-    expect(listPages).toHaveBeenCalledTimes(3);
+    expect(listPages).toHaveBeenCalledTimes(1);
   });
 
   it("a type whose adapter call throws is logged to stderr and does not fail the audit", async () => {
@@ -135,9 +135,57 @@ describe("scanSitePages — type-not-registered vs adapter-threw (#6012)", () =>
     // the stdio transport's JSON-RPC channel).
     expect(errorSpy).toHaveBeenCalledTimes(1);
     expect(errorSpy.mock.calls[0]![0]).toMatch(/Service/);
-    // All five reads still ran despite the throw — the read AFTER the
-    // throwing one (ReturnsPolicyPage, et al.) was not skipped.
+    // All three reads still ran despite the throw — the read AFTER the
+    // throwing one (PurchasePolicyPage) was not skipped.
     expect(listDetail).toHaveBeenCalledTimes(2);
-    expect(listPages).toHaveBeenCalledTimes(3);
+    expect(listPages).toHaveBeenCalledTimes(1);
+  });
+
+  it("a PurchasePolicyPage contributes its document-chassis section ids (#6646)", async () => {
+    const purchasePolicy: ContentPage = {
+      type: "PurchasePolicyPage",
+      slug: "purchase-policy",
+      title: "Purchase Policy",
+      description: "Returns, shipping and refunds.",
+      sections: [
+        {
+          id: "purchase-policy-document",
+          type: "document-chassis",
+          data: {
+            headline: "Purchase Policy",
+            sections: [
+              { id: "returns", heading: "Returns", blocks: [] },
+              { id: "shipping", heading: "Shipping", blocks: [] },
+              { id: "refunds", heading: "Refunds", blocks: [] },
+            ],
+          },
+        },
+      ] as ContentPage["sections"],
+    };
+    mockResolveContentAdapter.mockReturnValue({
+      getPageBySlug: jest.fn().mockResolvedValue(HOME_PAGE),
+      listPages: jest.fn().mockResolvedValue([purchasePolicy]),
+      listDetail: jest.fn().mockResolvedValue([]),
+      getDetailBySlug: jest.fn(),
+      searchPages: jest.fn(),
+      extractStructuredData: jest.fn(),
+      createPage: jest.fn(),
+      updatePage: jest.fn(),
+      deletePage: jest.fn(),
+      getPageVersion: jest.fn(),
+    });
+
+    const result = await buildSinglePageAuditInput({
+      slug: "home",
+      type: "HomePage",
+    });
+
+    expect(result.readiness!.sitePages).toEqual([
+      {
+        slug: "purchase-policy",
+        type: "PurchasePolicyPage",
+        chassisSectionIds: ["returns", "shipping", "refunds"],
+      },
+    ]);
   });
 });

package/templates/apps/mcp/__tests__/parity.test.ts

@@ -103,7 +103,6 @@ const MCP_ONLY_TOOLS = new Set([
   "ailkGetPricing", // get_pricing — pure read, no action equivalent (I4)
   "ailkGetFaq", // get_faq — pure read, no action equivalent (I4)
   "ailkAudit", // audit — AEO scoring tool, no web action equivalent (I5; ADR 0013)
-  "ailkSubscribeNewsletter", // subscribe_newsletter — anonymous write via MCP; no Server Action (B7)
   "ailkRequestCallback", // request_callback — anonymous write via MCP; no Server Action (B7)
   "ailkCreateProject", // create_project — agent-only project creator; no Server Action equivalent (#299)
   "ailkGetFlow", // get_flow — agent-callable flow-engine read; no web Server Action (#3956 D7)
@@ -228,6 +227,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // ailkSubmitFlowStep): twenty tools + three paired Server Actions.
     // - ailkPurchase: paired with purchaseAction (apps/web/app/dev/purchase/).
     // - ailkCaptureLead: paired with captureLeadAction (apps/web/app/contact/).
+    // - ailkSubscribeNewsletter: paired with subscribeNewsletterAction
+    //   (apps/web/app/[locale]/newsletter/newsletter.actions.ts, #6730 D9).
     // - ailkSubmitFlowStep: paired with submitFlowStepAction
     //   (apps/web/app/[locale]/flows/[slug]/flow.actions.ts, #3957).
     // - startCheckoutAction, saveRecommendationAction: WEB-ONLY (#4842 D7,
@@ -241,8 +242,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     //   ailkGetLocations, ailkGetOfferings, ailkGetPricing, ailkGetFaq:
     //   MCP-only (pure read; I4; in MCP_ONLY_TOOLS allow-list).
     // - ailkAudit: MCP-only (AEO scoring; I5; in MCP_ONLY_TOOLS allow-list).
-    // - ailkSubscribeNewsletter, ailkRequestCallback:
-    //   MCP-only anonymous-write tools (B7; in MCP_ONLY_TOOLS allow-list).
+    // - ailkRequestCallback: MCP-only anonymous-write tool (B7; in
+    //   MCP_ONLY_TOOLS allow-list).
     // - ailkCreateProject: MCP-only agent project creator (#299; in MCP_ONLY_TOOLS).
     // - ailkCreatePage, ailkUpdatePage, ailkDeletePage: RETIRED by #5853
     //   (D7). Their HTTP twins — the untenanted /v1/content writes — were
@@ -264,7 +265,7 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // - ailkGetEventMeta: MCP-only meta-only scheduling read, twin of
     //   GET /v1/schedule/event-meta (#4633) — same posture as the other
     //   scheduling tools.
-    expect(actions.size).toBe(5);
+    expect(actions.size).toBe(6);
     expect(tools.size).toBe(20);
     expect(r.missingTools).toEqual([]);
     expect(r.orphanTools).toEqual([]);

package/templates/apps/mcp/package.json

@@ -9,7 +9,8 @@
     "lint": "eslint .",
     "build": "tsc -b",
     "type-check": "tsc --noEmit",
-    "dev": "node --experimental-vm-modules dist/index.js",
+    "dev": "tsx watch src/index.ts",
+    "start": "node --experimental-vm-modules dist/index.js",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage"

package/templates/apps/mcp/src/index.ts

@@ -22,6 +22,7 @@
  */
 
 import { initMcpCommerceClaim } from "./lib/commerce-claim.js";
+import { registerLicenseKeyStore } from "./lib/license-key-store.js";
 import { initMcpPublicWorkspace } from "./lib/public-workspace.js";
 
 // Resolves the MCP server's own workspace ONCE, before either transport
@@ -48,6 +49,12 @@ try {
   );
 }
 
+// Registers the renewed licence key's durable home (#6677 DD-6) BEFORE the
+// commerce claim below memoises the licence: with a database, the key a
+// sibling app renewed lives in one SiteSetting row, and the claim must read
+// it. Never throws; without DATABASE_URL the file store stays in place.
+await registerLicenseKeyStore();
+
 // Resolves the deployment's `commerce` add-on claim ONCE, before either
 // transport branch — the sibling of the workspace resolution above and the
 // same #5876 idiom (#5971 spec D2). Without this await the memoised claim is